samba.git/python/samba/tests/sid_strings.py, branch talloc-2.4.4

pytest: sid_strings: Samba DN object refuses sub-auth overflow

2024-05-07T23:25:35+00:00

We were mistakenly asserting something that did not happen with
Windows, because Samba already won't parse the DN string.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10763

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

pytest: sid_strings: adjust to match Windows 2016

2024-05-07T23:25:35+00:00

9 hex-digit subauths like '0xABCDef123' will not fit in 32 bits, so
should be rejected on parsing.

In other situations, such as defaultSecurityDescriptor, overflowing
SID subauths on Windows will saturate to 0xffffffff, resulting in a
valid but probably meaningless SID. It is possible that in previous
testing we saw that here, but it is more likely I got confused. In any
case, now I see them being rejected, and that is good.

The saturating defaultSecurityDescriptor case is tested in
SidStringBehavioursThatWindowsAllows.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10763

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

pytest: sid_strings: Windows does allow lowercase s-1-... SIDs

2024-05-07T23:25:35+00:00

And so should we.

Right now, these tests won't pass against Windows because they rely on
ldb pre-parsing of the SIDs, so they fail before Windows gets to see
them. Running them against Windows looks something like this, BTW:

    SAMBA_SID_STRINGS_SKIP_LOCAL=1  \
    SMB_CONF_PATH=st/ad_dc/etc/smb.conf \
    PYTHONPATH=bin/default/python \
    DC_SERVER=192.168.122.126 \
    DC_USERNAME=Administrator DC_PASSWORD='xxx' \
    python3 python/samba/tests/sid_strings.py

When things are right, the only failing tests should be from the
SidStringBehavioursThatSambaPrefers suite.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10763

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

pytest: sid_strings: use more reliable well known SID

2024-05-07T23:25:35+00:00

It seems as if the well-known SID S-1-5-32-579
(DOMAIN_ALIAS_RID_ACCESS_CONTROL_ASSISTANCE_OPS) is
not always present -- specifically, it was not there on the
Windows machine used to develop these tests, but it is there on
the one I am now using.

S-1-5-32-545 (DOMAIN_ALIAS_RID_USERS) is surely going to exist,
so we use that instead.

That changes some of the assertions, making some NO_SUCH_OBJECTs
into successes.

For these tests we are only interested in the parsing of the SIDs, not
their meaning, so it's OK to change it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10763

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

pytests: sid_strings: do not fail if epoch ending has zeros

2023-11-15T04:05:34+00:00

To avoid collisions in random OID strings, we started using the epoch
date modulus 100 million. The trouble is we did not strip out the
leading zeros, so the field might be '00000123' when it should be
'123', if the date happened not to correspond to an epoch with a zero
in the eighth to last place. This has been the case for most of the
last 1041 days, but fortunately the bug was only introduced earlier
this year.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15520

Signed-off-by: Douglas Bagnall 
Reviewed-by: Martin Schwenke

pytest: sid_strings: handle SDDLValueError

2023-11-01T20:10:46+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

python:tests: Correct search expression

2023-10-13T03:50:31+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

python:tests: Fix comment

2023-10-13T03:50:31+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

pytest:sid_strings: Do bad SIDs fail differently in simple-bind?

2023-04-28T02:15:36+00:00

No.

That's good and expected because a failure here should fall back to the
next thing in the simple bind pecking order (canonical names).

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

pytest:sid_strings: do bad SIDS work in search filters?

2023-04-28T02:15:36+00:00

Yes.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett