summaryrefslogtreecommitdiff
path: root/libcli/security/tests
AgeCommit message (Collapse)AuthorFilesLines
2025-10-17Add missing include needed for cmocka.hAndreas Schneider2-0/+2
This will be required in future. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-08-07libcli/security: use talloc_free at the end of sub-testsRabinarayan Panigrahi2-1/+57
Memory should be free by talloc_free() if it is allocated using talloc_new() Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Anoop C S <anoopcs@samba.org> Autobuild-Date(master): Thu Aug 7 09:02:29 UTC 2025 on atb-devel-224
2023-12-21libcli/security: tests for signed zeros in sddl condtional ACEsDouglas Bagnall1-0/+2
REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65122 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-14libcli/security: tests for conditional ACE integer base persistenceDouglas Bagnall1-0/+8
Credit to OSS-Fuzz. REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62929 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-14libcli/security: fix tests for SDDL conditional ACE round-tripDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-14libcli/security: clarify tests for SDDL round tripsDouglas Bagnall1-6/+7
The `failed = failed || ok` did the same thing, obscurely. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-27libcli/security: add test_claims_conversionDouglas Bagnall7-0/+171
These are unit tests for converting wire claims into sorted claims v1 structures. These are based from packets derived from the krb5.conditional_ace tests, and currently don't test more than they do, but they work about a hundred thousand times quicker. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-27libcli/security: test_run_conditional_ace tests more comparisonsDouglas Bagnall1-2/+51
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-27libcli/security: test_run_conditional_ace can set debug levelsDouglas Bagnall1-1/+12
No -d, just `bin/test_run_conditional_ace 3`. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-27libcli/security/tests: gunzip the oversized-acls test vectorsDouglas Bagnall2-0/+20
These are just as readable with `less` as they were with `zless`. This file has been slightly manually edited to add line-breaks. There is not an easy setting in Python's json module to get good formatting. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Nov 27 02:10:12 UTC 2023 on atb-devel-224
2023-11-27libcli/security/tests: remove duplicate TX-integer tests from oversized-ACLsDouglas Bagnall1-0/+0
We had two sets of test vectors (Windows ground-truth for SDDL compilation) that got mixed up. The "oversized ACLs" set is ACLs that contain repeated ACEs, like "D:P(D;;;;;MP)(D;;;;;MP)" -- Windows will assign a size to the ACL that is greater than the sum of the ACEs, while Samba will not (in part because we don't actually store a size for the ACL, instead calculating it on the fly from the size of the ACEs). The "TX integers" set is for resource attribute ACEs with octet-string data that contains pure integers (lacking '#' characters) in their SDDL, like «(RA;;;;;WD;("bar",TX,0x0,0077,00,0077,00))». We used to think that was weird, and that RA-TX ACEs should contain octet-strings in the conditional ACE style. But now we have realised it's not weird, it's normal, and we have fixed our handling of these ACEs. As a result of this mix-up, some of the tests labelled as "oversized ACLs" started passing when we fixed the TX integer problem, and that was confusing. All of the removed tests are already on the TX integer set -- the removed ones were duplicates. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-27libcli/security/test_sddl_conditional_ace: adjust RA octet parse testsDouglas Bagnall2-5/+5
We are going to parse octet strings like Windows (as opposed to like Windows docs), so the tests need changing. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-15libcli/security/test_sddl_conditional_ace: add message testsDouglas Bagnall1-0/+87
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-09libcli/security: Optionally disallow device‐specific attributes and ↵Joseph Sutton1-4/+17
operators where they are not applicable Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-02libcli/security: Allow empty composites and resource attribute listsJoseph Sutton1-0/+8
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-25libcli/security: Fix code spellingJoseph Sutton4-8/+8
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-29libcli/security: test_run_condtional_ace: va_end() on errorsDouglas Bagnall1-0/+2
CID 1545154, CID 1545155. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-27libcli/security: Test hex‐escapes that should be literalsJoseph Sutton1-0/+4
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-27libcli/security: Fix code formattingJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-27libcli/security: Use ACL revision constantsJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26libcli/security: conditional ace sddl: do not write nested compositesDouglas Bagnall1-2/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26libcl/security: conditional ACE sddl >= ops take literal parens onlyDouglas Bagnall1-0/+4
You can't do things like '(a == b) == (c < d)'. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26libcli/security/sddl_conditional_ace: ban empty expressions in SDDLDouglas Bagnall2-10/+11
The trouble is with expressions like "(!(()))", which boil down to a single NOT operation with no argument, which is invalid and can't be run or expressed as SDDL. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26libcli/security: Check for sddl_from_conditional_ace() failure in ↵Andrew Bartlett1-0/+10
test_sddl_conditional_ace Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-09-26libcli/security: adjust tests for evaluate_claims flagDouglas Bagnall1-6/+10
Most tests were prepared in advance, but we left these ones to test the change. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26libcli/security: cmocka test for running conditional ACEsDouglas Bagnall1-0/+674
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26libcli/security/tests: add some test stringsDouglas Bagnall4-0/+112
These will soon be used by python/samba/tests/sddl_conditional_ace.py, and are a format understood by the Windows programs in libcli/security/tests/windows. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26libcli/security: windows-sddl-test: fix read of text examplesDouglas Bagnall1-0/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26libcli/security: windows-sddl-test: fix typo in --helpDouglas Bagnall1-1/+1
found by Rob van der Linde. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest:security_descriptors: test collected conditional ACEsDouglas Bagnall2-0/+2
These tests were named in the superclass, but were not actually run, nor was the file in git. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: security descriptors: test some conditional and RA ACEsDouglas Bagnall2-0/+0
We have two sets of tests: one that will succeed, and one that is going to remain a knownfail. The latter involves Resource Attribute ACEs that have the TX type, meaning "byte string". In MS-DTYP, a bytestring is defined like "#6869210a", with a hash, followed by an even number of hex digits. In other places on the web, it is mentioned that zeroes in the string can be replaced by hashes, like so "#686921#a". We discover via indirect fuzzing that a TX RA ACE can also take bare integers, like "6869210a" or "2023". As it would be tricky to support this, and there is no evidence of this occurring in the wild, we will probably leave this as a knownfail. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: security_descriptors: tests without revision number hackDouglas Bagnall1-0/+0
ACL revision 4 (SECURITY_ACL_REVISION_ADS) is effectively a superset of revision 2 (SECURITY_ACL_REVISION_NT4), so any revision 2 ACL can be called revision 4 without any problem. But not vice versa: a revision 4 ACL can contain ACE types that a revision 2 ACL can't. The extra ACE types relate to objects. Samba currently simplifies things by calling all its ACLs revision 4, even if (as is commonly the case) the ACLs contain only revision 2 ACEs. On the other hand, Windows will use revision 2 whenever it can. In other tests we skip past this by forcing Windows ACLs to v4 before comparison. This test is to remind us of the incompatibility. It would not be hard to fix. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: security_descriptors test for repetitive ACLsDouglas Bagnall1-0/+0
If there are multiple identical ACEs in an SDDL ACL, Windows will decode them all and put extra trailing zeroes at the end of the ACL. In contrast, Samba will decode the ACEs and not put extra zeroes at the end. The problem comes when Samba tries to read a binary ACL from Windows that has the extra zeroes, because Samba's ACL size calculation is based on the size of its constituent ACEs, not the ACL size field. There is no good reason for an ACL to have repeated ACEs, but they could be added accidentally. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26libcli/security: test SDDL compilation in cmockaDouglas Bagnall1-0/+855
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24pytest: compare Samba vs Windows SDDL security descriptorsDouglas Bagnall2-0/+1
Can Samba understand Windows security descriptors? Does it parse SDDL the same way? Here we test on over 7000 SDDL/descriptor pairs and find the answer is pleasing. In later commits we will add more tests using different classes of ACE. The test cases are derived from fuzz seeds, exported to Windows via the script in the last commit, with the Windows descriptor bytes found using libcli/security/tests/windows/windows-sddl-test.py. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24libcli/security: test helper script extracts fuzz SDDLDouglas Bagnall1-0/+49
This allows us to try the fuzz seeds as SDDL on Windows, then test that Samba matches Windows' security descriptors in the cases where the SDDL compiles. This will find SDDL edge cases that might otherwise be missed. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24libcli/security: move Windows test script to windows subdirDouglas Bagnall1-0/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24libcli/security: rewrite SDDL tests for running on WindowsDouglas Bagnall1-244/+166
This script never worked well because it had to shell out to Powershell, which never worked well due to syntax conflicts and Powershell's specialness. The attempted ctypes version did not work, due to the difficulty in expressing things like "relative PSECURITY_DESCRIPTOR" in ctypes. It turns out that pywin32 is easy to install and use, and we can extract the NDR bytes which is far more useful than just testing if the SDDL parses. On Windows: 1. install Python from python.org 2. run `pip install pywin32` 3. copy e.g. libcli/security/tests/data/conditional-aces.txt to Windows 4. run `python windows-sddl-tests.py conditional-aces.txt` 5. add `--help` to see how to export descriptor bytes. The default output is a whole lot of multi-coloured text, indicating what failed and what didn't. With --export-json it writes a JSON file mapping SDDL strings to NDR byte sequences, which can be used to compare with Samba's attempts. If you are only interested in --export-json, you might also like --quiet. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24libcli/security: add some test more Windows SDDL test stringsDouglas Bagnall4-2/+8
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24libcli/security: script to turn token/descriptor pairs into sddlDouglas Bagnall1-0/+72
We fuzz security descriptors in a couple of different ways, and this maps seeds from one form into the other. The SDDL examples can also be used in Windows tests. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28libcli/security/tests: test strings for windows and samba SDDL testsDouglas Bagnall6-0/+144
These are produced by editing `python/samba/test/sddl.py to enable `test_write_test_strings`, the running `make test TESTS='sddl\\b'`. The windows executable from the C file added in a recent commit can run these tests using the `-i` flag. The Samba sddl.py tests can be induced to use them too, but that is only useful for showing they are still in sync. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28libcli/security: SDDL parse tests to run on WindowsDouglas Bagnall2-0/+599
The C version tests the public SDDL API on Windows which seems to follow Active Directory closely, though case in hex numbers is reversed vis-a-vis defaultSecurityDescriptor. The python version is less refined and tests powershell functions. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 03:00:20 +0000