From: Andrew Bartlett <abartlet@samba.org>
Date: Fri, 17 Sep 2021 01:41:40 +0000 (+1200)
Subject: CVE-2020-25722 selftest: Catch errors from samdb.modify() in user_account_control... 
X-Git-Tag: samba-4.13.14~206
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=081a7c7ff9b9992046d8797be681d0421cb0b372;p=thirdparty%2Fsamba.git

CVE-2020-25722 selftest: Catch errors from samdb.modify() in user_account_control tests

This will allow these to be listed in a knownfail shortly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
---

diff --git a/source4/dsdb/tests/python/user_account_control.py b/source4/dsdb/tests/python/user_account_control.py
index 442fe741220..a22a72f12da 100755
--- a/source4/dsdb/tests/python/user_account_control.py
+++ b/source4/dsdb/tests/python/user_account_control.py
@@ -306,7 +306,11 @@ class UserAccountControlTests(samba.tests.TestCase):
         m.dn = res[0].dn
         m["userAccountControl"] = ldb.MessageElement(str(samba.dsdb.UF_NORMAL_ACCOUNT|UF_PASSWD_NOTREQD),
                                                      ldb.FLAG_MOD_REPLACE, "userAccountControl")
-        self.samdb.modify(m)
+        try:
+            self.samdb.modify(m)
+        except LdbError as e:
+            (enum, estr) = e.args
+            self.fail(f"got {estr} setting userAccountControl to UF_NORMAL_ACCOUNT|UF_PASSWD_NOTREQD")
 
         m = ldb.Message()
         m.dn = res[0].dn
@@ -361,7 +365,11 @@ class UserAccountControlTests(samba.tests.TestCase):
         m.dn = res[0].dn
         m["userAccountControl"] = ldb.MessageElement(str(samba.dsdb.UF_NORMAL_ACCOUNT|UF_PASSWD_NOTREQD),
                                                      ldb.FLAG_MOD_REPLACE, "userAccountControl")
-        self.samdb.modify(m)
+        try:
+            self.samdb.modify(m)
+        except LdbError as e:
+            (enum, estr) = e.args
+            self.fail(f"got {estr} setting userAccountControl to UF_NORMAL_ACCOUNT|UF_PASSWD_NOTREQD")
 
         m = ldb.Message()
         m.dn = res[0].dn
@@ -458,7 +466,11 @@ class UserAccountControlTests(samba.tests.TestCase):
         m.dn = res[0].dn
         m["userAccountControl"] = ldb.MessageElement(str(UF_ACCOUNTDISABLE),
                                                      ldb.FLAG_MOD_REPLACE, "userAccountControl")
-        self.admin_samdb.modify(m)
+        try:
+            self.admin_samdb.modify(m)
+        except LdbError as e:
+            (enum, estr) = e.args
+            self.fail(f"got {estr} setting userAccountControl to UF_ACCOUNTDISABLE (as admin)")
 
         res = self.admin_samdb.search("%s" % self.base_dn,
                                       expression="(&(objectClass=computer)(samAccountName=%s$))" % computername,
@@ -579,7 +591,11 @@ class UserAccountControlTests(samba.tests.TestCase):
             m.dn = res[0].dn
             m["userAccountControl"] = ldb.MessageElement(str(orig_uac),
                                                          ldb.FLAG_MOD_REPLACE, "userAccountControl")
-            self.admin_samdb.modify(m)
+            try:
+                self.admin_samdb.modify(m)
+            except LdbError as e:
+                (enum, estr) = e.args
+                self.fail(f"got {estr} resetting userAccountControl to initial value {orig_uac:#08x}")
 
             res = self.admin_samdb.search("%s" % self.base_dn,
                                           expression="(&(objectClass=computer)(samAccountName=%s$))" % computername,
@@ -898,7 +914,12 @@ class UserAccountControlTests(samba.tests.TestCase):
             and account_type == UF_NORMAL_ACCOUNT):
             self.admin_samdb.add(msg_dict)
         elif objectclass == "computer":
-            self.admin_samdb.add(msg_dict)
+            try:
+                self.admin_samdb.add(msg_dict)
+            except ldb.LdbError as e:
+                (num, msg) = e.args
+                self.fail("Failed to create {objectclass} account "
+                          "with {account_type_string}")
         else:
             self.assertRaisesLdbError(ldb.ERR_OBJECT_CLASS_VIOLATION,
                                       "Should have been unable to {account_type_str} on {objectclass}",