summaryrefslogtreecommitdiff
path: root/python/samba/tests/sddl.py
AgeCommit message (Collapse)AuthorFilesLines
2024-07-25libcli:security: allow spaces after BAD:Douglas Bagnall1-5/+5
In AD_DS_Classes_Windows_Server_v1903.ldf from https://www.microsoft.com/en-us/download/details.aspx?id=23782, we see defaultSecurityDescriptor: O:BAG:BAD: (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPLCLORC;;;AU) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15685 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Jul 25 06:27:27 UTC 2024 on atb-devel-224
2023-11-01pytest:sddl: assert SDDLValueError values make senseDouglas Bagnall1-2/+13
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-01s4/librpc/py_security: use SDDLValueError for better error messagesDouglas Bagnall1-1/+1
The aim is to allow samba-tool to tell users where their SDDL went wrong. Some tests would turn into errors (not knownfail-able failures) if they were not changed at the same time, so they are changed too. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-01pytest:sddl: handle SDDLValueErrorDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: sddl strings dir can be defined in classDouglas Bagnall1-9/+15
Before we had to do this in an environment variable. In that case we are probably wanting to monitor changes, so we like it to print more messages than we want to see in an autobuild run that will hopefully never do anything interesting. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26pytest: sddl tests can be only externally definedDouglas Bagnall1-0/+3
Currently a test suite needs a strings list in order to import new strings. This lets us avoid that and have the actual tests defined only in external lists, making it easier to see we're testing the same thing on Windows and reducing duplication. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24pytest/sddl: tests for more invalid or weird casesDouglas Bagnall1-0/+11
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24pytest/sddl: add option for case-insensitive testsDouglas Bagnall1-1/+3
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24pytest/sddl: environment option for exporting as fuzz seedsDouglas Bagnall1-1/+22
We want realistic examples for sddl fuzzing seeds, and we want realistic examples for sddl tests, so hopefully we only need to get it right once. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-24pytest/sddl: replace/export tests based on environment varsDouglas Bagnall1-42/+45
We had a stupid system involving test functions with side-effects, that needed to be enabled by editing the file. Now you get the same effects by setting environment variables, the names of which you can only learn by reading the file closely. This works better because some stuff needs to happen at class-time rather than instance-time. Also the environment variables specify the import and export locations. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl: show the correct handling of the "FA" SDDL flagAndrew Bartlett1-1/+11
The "FA" flag should map to 0x1f01ff, and 0x1f01ff should be converted back into "FA". This will be fixed over the next couple of commits. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-04-28pytest:sddl Samba had the wrong value for FA, now fix the testsAndrew Bartlett1-109/+39
The tests that were in SddlWindowsFlagsAreDifferent have the behaviour we want, and as we aim for Samba flags no longer being different, we shift them to SddlNonCanonical. The tests in SddlSambaDoesItsOwnThing are removed because they showed Samba's old behaviour around FA. This will create knownfails, which will be fixed by the commit fixing the value of "FA". Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-04-28pytest:sddl: test we only accept normal GUIDsDouglas Bagnall1-0/+9
By normal GUID, I mean ones like f30e3bbf-9ff0-11d1-b603-0000f80367c1, with four hyphens and no curly braces. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl: tests around spaces in access flags and SIDsDouglas Bagnall1-2/+30
It turns out that in accesss flags Windows will allow leading spaces and spaces separating flags but not trailing spaces. We choose to follow this in part because we found it happening in the wild in our tests for upgradeprovision until a few commits ago. Windows will also allow spaces in some parts of SIDs. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl debugging: should_fail test says how it failedDouglas Bagnall1-1/+2
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl: add tests for long DACLs, differing flag interpretationsDouglas Bagnall1-0/+121
Windows converts hex numbers into flags differently, and has different ideas of what constitutes "FA", and possibly others. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl: let hex numbers differ in case (0xa == 0xA)Douglas Bagnall1-1/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl: helpers to exchange SDDL strings with Windows testprogramDouglas Bagnall1-0/+88
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl: SDDL strings where Windows behaviour differsDouglas Bagnall1-0/+62
These ones we might want to match. They are understandable behaviours, like matching lowercase flags and coping with whitespace in some places. These tests are set up to document the differences without overwhelming the knownfails. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl: Add negative tests of unparseable stringsDouglas Bagnall1-0/+78
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl: allow tests to make negative assertionsDouglas Bagnall1-1/+13
If the subclass has `should_succeed = False`, all the cases in that class will be tested to ensure they can't be successfully parsed. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl: split each string into it's own testDouglas Bagnall1-42/+48
This of course allows for fine-grained knownfails. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl: tweak some test stringsDouglas Bagnall1-23/+32
Adding, diversifying, and disambiguating. The leading portion of the test stirngs will soon be used in the test name, and strings that don't differ in the first hundred characters will cause naming clashes. There is no good reason for them all to test the same flags in the same order. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest/sddl: split tests into canonical and non-canonicalDouglas Bagnall1-144/+411
The examples in the canonical list are already in the form that Windows and Samba will use for that SD. We check the round trip. The examples in the non-canonical list will change in a round trip, so we also give the string we think they should end up as. These have been checked on Windows. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest/sddl: remove unused importsDouglas Bagnall1-1/+0
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest/sddl: rework to allow multiple lists, no early stopDouglas Bagnall1-7/+31
The test will fail right now because it makes round trip assertions. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest/sddl: assert sddl string equalityDouglas Bagnall1-0/+1
It's not that I think our SD equality check will miss anything, but we are here to test things like that. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest/sddl: remove duplicate test caseDouglas Bagnall1-4/+0
The other copy is on line 102. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest/sddl: give test more of a nameDouglas Bagnall1-1/+1
I think it worked, but the convention is that tests have a test_ prefix, and it woudn't be surpoising if something somewhere decides to depend on that. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytests/sddl: clarify boundaries between sddl casesDouglas Bagnall1-134/+138
It is now easier to see where one SD ends and another starts. Best looked at with -b or --word-diff. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28pytest:sddl: test empty DACL with flagsDouglas Bagnall1-0/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-21libcli: Fix parsing access flags from multiple tablesVolker Lendecke1-2/+3
We have to look at all available mappings for parsing sddl for each special flag set. "GW" and "FX" come from two different tables, but the previous code settled on one table and then expected both "GW" and "FX" to come from that same table. Change the code to look at all tables per special flag set. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Apr 21 00:04:36 UTC 2021 on sn-devel-184
2021-04-20torture: Show sddl_decode() failure for "GWFX" access maskVolker Lendecke1-0/+6
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-04-19torture: Move sddl tests to pythonVolker Lendecke1-0/+180
This kind of test is better hosted in python than in C. More lines, but the ones in source4/libcli/security/tests/sddl.c were preeetty long... Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 19:38:19 +0000