diff options
| author | Douglas Bagnall <douglas.bagnall@catalyst.net.nz> | 2023-04-23 08:52:42 +1200 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2023-04-28 02:15:36 +0000 |
| commit | ec2d2f8ea83f433b32071ebf40a8358c084b060b (patch) | |
| tree | dfac2f5a7cbfaa7f7a0a5a181916defcd9bc5b80 /python | |
| parent | 0528da54b8cc53954f10f23049fa90a5f3bdd50c (diff) | |
| download | samba-ec2d2f8ea83f433b32071ebf40a8358c084b060b.tar.gz samba-ec2d2f8ea83f433b32071ebf40a8358c084b060b.tar.bz2 samba-ec2d2f8ea83f433b32071ebf40a8358c084b060b.zip | |
pytest:sddl: tests around spaces in access flags and SIDs
It turns out that in accesss flags Windows will allow leading spaces
and spaces separating flags but not trailing spaces.
We choose to follow this in part because we found it happening in the
wild in our tests for upgradeprovision until a few commits ago.
Windows will also allow spaces in some parts of SIDs.
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'python')
| -rw-r--r-- | python/samba/tests/sddl.py | 32 |
1 files changed, 30 insertions, 2 deletions
diff --git a/python/samba/tests/sddl.py b/python/samba/tests/sddl.py index 338599ba2c8..b8750880d6d 100644 --- a/python/samba/tests/sddl.py +++ b/python/samba/tests/sddl.py @@ -572,6 +572,12 @@ class SddlNonCanonical(SddlDecodeEncodeBase): ''.join(f"(A;;0xabc{i:03};;;S-1-5-21-11111111-22222222-33333333-{i})" for i in range(101, 601))) ), + + # Windows allows a space in the middle of access flags + ("D:AI(A;CI;RP LCLORC;;;AU)", "D:AI(A;CI;LCRPLORC;;;AU)"), + ("D:AI(A;CI;RP LCLO RC;;;AU)", "D:AI(A;CI;LCRPLORC;;;AU)"), + # space before string flags is ignored. + ("D:(A;; GA;;;LG)", "D:(A;;GA;;;LG)"), ] @@ -650,6 +656,25 @@ class SddlShouldFail(SddlDecodeEncodeBase): "D:(A;;GA;f30e3bbf-9ff0-11d1-b603-0000f80367c1 ;;WD)", "D:(A;;GA;; f30e3bbf-9ff0-11d1-b603-0000f80367c1;WD)", "D:(A;;GA;;f30e3bbf-9ff0-11d1-b603-0000f80367c1 ;WD)", + + # space splits a flag in half. + "D:AI(A;CI;RP LCLOR C;;;AU)", + # tabs in flags + "D:AI(A;CI;RP LC\tLORC;;;AU)", + "D:AI(A;CI;RP LC\t LORC;;;AU)", + + # incomplete SIDs + "O:S", + "O:S-", + "O:S-1", + "O:S-10", + "O:S-0", + "O:S-1-", + "O:S-0x1", + "O:S-0x1-", + + "O:", + "O:XX", ] @@ -679,8 +704,8 @@ class SddlWindowsIsLessFussy(SddlDecodeEncodeBase): # whitespace is ignored, repaired on return ("D:(A;;GA;;; LG)", "D:(A;;GA;;;LG)"), ("D: (A;;GA;;;LG)", "D:(A;;GA;;;LG)"), - # whitespace before string flags is ignored. - ("D:(A;; GA;;;LG)", "D:(A;;GA;;;LG)"), + # whitespace before ACL string flags is ignored. + ("D: AI(A;;GA;;;LG)", "D:AI(A;;GA;;;LG)"), # wrong case on type is ignored, fixed ("D:(a;;GA;;;LG)", "D:(A;;GA;;;LG)"), ("D:(A;;GA;;;lg)", "D:(A;;GA;;;LG)"), @@ -698,6 +723,9 @@ class SddlWindowsIsLessFussy(SddlDecodeEncodeBase): # whitespace in absent ace flags ("D:(A; ;GA;;;LG)","D:(A;;GA;;;LG)"), + # space after ACL flags + ("D:AI (A;;GA;;;LG)", "D:AI(A;;GA;;;LG)"), + # and more whitespace. ("D:(A;;GA;;; WD)", "D:(A;;GA;;;WD)"), ("D:(A;;GA;;;WD )", "D:(A;;GA;;;WD)"), |