pytest: security_descriptors test for repetitive ACLs

If there are multiple identical ACEs in an SDDL ACL, Windows will decode
them all and put extra trailing zeroes at the end of the ACL.

In contrast, Samba will decode the ACEs and not put extra zeroes at the
end.

The problem comes when Samba tries to read a binary ACL from Windows that
has the extra zeroes, because Samba's ACL size calculation is based on
the size of its constituent ACEs, not the ACL size field.

There is no good reason for an ACL to have repeated ACEs, but they could
be added accidentally.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/libcli/security/tests/data/oversize-acls.json.gz b/libcli/security/tests/data/oversize-acls.json.gz
new file mode 100644 (file)
index 0000000..a45348b
Binary files /dev/null and b/libcli/security/tests/data/oversize-acls.json.gz differ

diff --git a/python/samba/tests/security_descriptors.py b/python/samba/tests/security_descriptors.py
index e63eca4bce936aa56a82ad6f946a40cc0cfc5882..3edf8a8155d5d4163bf8c5b469ce55abe6f56308 100644 (file)
--- a/python/samba/tests/security_descriptors.py
+++ b/python/samba/tests/security_descriptors.py
@@ -136,3 +136,15 @@ class SDDLvsDescriptorRegistryObjectRights(SDDLvsDescriptorBase):
     """We'll fail these because we don't recognise 'KA' and related object
     rights strings that are used for registry objects."""
     json_file = TEST_DIR / 'registry-object-rights.json'
+
+
+@DynamicTestCase
+class SDDLvsDescriptorOverSizeAcls(SDDLvsDescriptorBase):
+    """These are ordinary ACLs that contain duplicate ACEs (e.g.
+    'D:P(D;;;;;MP)(D;;;;;MP)(D;;;;;MP)(D;;;;;MP)'). Due to a
+    peculiarity in Windows, the ACL structures generated have extra
+    trailing zero bytes. Due to a peculiarity in the way Samba reads
+    an ACL (namely, it assumes an ACL will be just big enough for its
+    ACEs), these cannot currently be parsed by Samba.
+    """
+    json_file = TEST_DIR / 'oversize-acls.json.gz'

diff --git a/selftest/knownfail.d/security-descriptors b/selftest/knownfail.d/security-descriptors
index e9bf6425787f39f5ecfcd63dd43c6f99fbbfc029..c985057f94f889fc839e1258891a98abaa8f50f4 100644 (file)
--- a/selftest/knownfail.d/security-descriptors
+++ b/selftest/knownfail.d/security-descriptors
@@ -1 +1,3 @@
 ^samba.tests.security_descriptors.+SDDLvsDescriptorRegistryObjectRights.+
+^samba.tests.security_descriptors.+SDDLvsDescriptorOverSizeAcls.+
+