CVE-2020-25722 selftest: Adapt selftest to restriction on swapping account types

This makes many of our tests pass again.  We do not pass against Windows 2019 on all
as this does not have this restriction at this time.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

diff --git a/selftest/knownfail.d/uac_objectclass_restrict b/selftest/knownfail.d/uac_objectclass_restrict
index 040c4eb219d7b964f5ef66e389456df0c41ee7a1..32d8a99f950c83d4cde388a2da964ad79fd062f5 100644 (file)
--- a/selftest/knownfail.d/uac_objectclass_restrict
+++ b/selftest/knownfail.d/uac_objectclass_restrict
@@ -27,31 +27,7 @@
 ^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_objectclass_mod_lock_UF_NORMAL_ACCOUNT_user_replace\(ad_dc_default\)
 ^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_objectclass_mod_lock_UF_SERVER_TRUST_ACCOUNT_computer_replace\(ad_dc_default\)
 ^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_objectclass_mod_lock_UF_WORKSTATION_TRUST_ACCOUNT_computer_replace\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_0x10000000\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_0x20000000\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_0x40000000\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_0x80000000\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_00000004\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_00000400\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_00004000\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_00008000\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_ACCOUNTDISABLE\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_DONT_EXPIRE_PASSWD\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_DONT_REQUIRE_PREAUTH\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_HOMEDIR_REQUIRED\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_LOCKOUT\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_MNS_LOGON_ACCOUNT\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_NORMAL_ACCOUNT\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_NOT_DELEGATED\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_NO_AUTH_DATA_REQUIRED\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_PASSWD_CANT_CHANGE\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_PASSWD_NOTREQD\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_PASSWORD_EXPIRED\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_SCRIPT\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_SMARTCARD_REQUIRED\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_USE_AES_KEYS\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_USE_DES_KEY_ONLY\(ad_dc_default\)
+^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_SERVER_TRUST_ACCOUNT\(ad_dc_default\)
 ^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_WORKSTATION_TRUST_ACCOUNT\(ad_dc_default\)
 ^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_unrelated_modify_UF_NORMAL_ACCOUNT\(ad_dc_default\)
 ^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_unrelated_modify_UF_WORKSTATION_TRUST_ACCOUNT\(ad_dc_default\)
@@ -62,6 +38,3 @@
 ^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_add_UF_INTERDOMAIN_TRUST_ACCOUNT\(ad_dc_default\)
 ^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_add_UF_NORMAL_ACCOUNT\(ad_dc_default\)
 ^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_add_UF_NORMAL_ACCOUNT_UF_PASSWD_NOTREQD\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_INTERDOMAIN_TRUST_ACCOUNT\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_TRUSTED_FOR_DELEGATION\(ad_dc_default\)
-^samba4.user_account_control.python\(ad_dc_default\).__main__.UserAccountControlTests.test_uac_bits_set_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION\(ad_dc_default\)

diff --git a/source4/dsdb/tests/python/user_account_control.py b/source4/dsdb/tests/python/user_account_control.py
index 1633998ada42cd04b0e15d04f74bfea263e5538d..7a7cfd40b72e122267be1ba744561cc8a9b5767b 100755 (executable)
--- a/source4/dsdb/tests/python/user_account_control.py
+++ b/source4/dsdb/tests/python/user_account_control.py
@@ -219,6 +219,23 @@ class UserAccountControlTests(samba.tests.TestCase):
         print("Adding computer account %s" % computername)
         samdb.add(msg)
 
+    def add_user_ldap(self, username, others=None, samdb=None):
+        if samdb is None:
+            samdb = self.samdb
+        dn = "CN=%s,%s" % (username, self.OU)
+        samaccountname = "%s" % username
+        msg_dict = {
+            "dn": dn,
+            "objectclass": "user"}
+        if others is not None:
+            msg_dict = dict(list(msg_dict.items()) + list(others.items()))
+
+        msg = ldb.Message.from_dict(self.samdb, msg_dict)
+        msg["sAMAccountName"] = samaccountname
+
+        print("Adding user account %s" % username)
+        samdb.add(msg)
+
     def get_creds(self, target_username, target_password):
         creds_tmp = Credentials()
         creds_tmp.set_username(target_username)
@@ -532,17 +549,21 @@ class UserAccountControlTests(samba.tests.TestCase):
 
     def _test_uac_bits_set_with_args(self, bit, bit_str):
         user_sid = self.sd_utils.get_object_sid(self.unpriv_user_dn)
-        mod = "(OA;;CC;bf967a86-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
+        # Allow the creation of any children and write to any
+        # attributes (this is not a test of ACLs, this is a test of
+        # non-ACL userAccountControl rules
+        mod = f"(OA;CI;WP;;;{user_sid})(OA;;CC;;;{user_sid})"
 
         old_sd = self.sd_utils.read_sd_on_dn(self.OU)
 
         self.sd_utils.dacl_add_ace(self.OU, mod)
 
+        # We want to start with UF_NORMAL_ACCOUNT, so we make a user
         computername = self.computernames[0]
-        self.add_computer_ldap(computername)
+        self.add_user_ldap(computername)
 
         res = self.admin_samdb.search("%s" % self.base_dn,
-                                      expression="(&(objectClass=computer)(samAccountName=%s$))" % computername,
+                                      expression="(&(objectClass=user)(cn=%s))" % computername,
                                       scope=SCOPE_SUBTREE,
                                       attrs=[])
 
@@ -588,7 +609,11 @@ class UserAccountControlTests(samba.tests.TestCase):
 
     def _test_uac_bits_unrelated_modify_with_args(self, account_type):
         user_sid = self.sd_utils.get_object_sid(self.unpriv_user_dn)
-        mod = "(OA;;CC;bf967a86-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
+
+        # Allow the creation of any children and write to any
+        # attributes (this is not a test of ACLs, this is a test of
+        # non-ACL userAccountControl rules
+        mod = f"(OA;CI;WP;;;{user_sid})(OA;;CC;;;{user_sid})"
 
         old_sd = self.sd_utils.read_sd_on_dn(self.OU)
 
@@ -596,22 +621,19 @@ class UserAccountControlTests(samba.tests.TestCase):
 
         computername = self.computernames[0]
         if account_type == UF_WORKSTATION_TRUST_ACCOUNT:
-            self.add_computer_ldap(computername, others={"userAccountControl": [str(account_type)]})
-        else:
             self.add_computer_ldap(computername)
+        else:
+            self.add_user_ldap(computername)
 
         res = self.admin_samdb.search(self.OU,
-                                      expression=f"(cn={computername})",
+                                      expression=f"(&(objectclass=user)(cn={computername}))",
                                       scope=SCOPE_SUBTREE,
                                       attrs=["userAccountControl"])
         self.assertEqual(len(res), 1)
 
         orig_uac = int(res[0]["userAccountControl"][0])
-        if account_type == UF_WORKSTATION_TRUST_ACCOUNT:
-            self.assertEqual(orig_uac, account_type)
-        else:
-            self.assertEqual(orig_uac & UF_NORMAL_ACCOUNT,
-                             account_type)
+        self.assertEqual(orig_uac & account_type,
+                         account_type)
 
         m = ldb.Message()
         m.dn = res[0].dn
@@ -649,7 +671,7 @@ class UserAccountControlTests(samba.tests.TestCase):
                 self.fail(f"got {estr} resetting userAccountControl to initial value {orig_uac:#08x}")
 
             res = self.admin_samdb.search("%s" % self.base_dn,
-                                          expression="(&(objectClass=computer)(samAccountName=%s$))" % computername,
+                                          expression="(&(objectClass=user)(cn=%s))" % computername,
                                           scope=SCOPE_SUBTREE,
                                           attrs=["userAccountControl"])
 
@@ -696,7 +718,7 @@ class UserAccountControlTests(samba.tests.TestCase):
                     self.fail("Unable to set userAccountControl bit 0x%08X on %s: %s" % (bit, m.dn, estr))
 
             res = self.admin_samdb.search("%s" % self.base_dn,
-                                          expression="(&(objectClass=computer)(samAccountName=%s$))" % computername,
+                                          expression="(&(objectClass=user)(cn=%s))" % computername,
                                           scope=SCOPE_SUBTREE,
                                           attrs=["userAccountControl"])
 
@@ -726,7 +748,7 @@ class UserAccountControlTests(samba.tests.TestCase):
                 self.fail("Unable to set userAccountControl bit 0x%08X on %s: %s" % (bit, m.dn, estr))
 
             res = self.admin_samdb.search("%s" % self.base_dn,
-                                          expression="(&(objectClass=computer)(samAccountName=%s$))" % computername,
+                                          expression="(&(objectClass=user)(cn=%s))" % computername,
                                           scope=SCOPE_SUBTREE,
                                           attrs=["userAccountControl"])
 
@@ -767,7 +789,7 @@ class UserAccountControlTests(samba.tests.TestCase):
                     self.fail("Unexpectedly unable to remove userAccountControl bit 0x%08X on %s: %s" % (bit, m.dn, estr))
 
             res = self.admin_samdb.search("%s" % self.base_dn,
-                                          expression="(&(objectClass=computer)(samAccountName=%s$))" % computername,
+                                          expression="(&(objectClass=user)(cn=%s))" % computername,
                                           scope=SCOPE_SUBTREE,
                                           attrs=["userAccountControl"])