53 lines
2.1 KiB
Diff
53 lines
2.1 KiB
Diff
From d392b10c55bbcedda01fdd87fe6035fa3a6986b3 Mon Sep 17 00:00:00 2001
|
|
From: Joseph Sutton <josephsutton@catalyst.net.nz>
|
|
Date: Tue, 18 Jan 2022 11:56:38 +1300
|
|
Subject: [PATCH 01/99] CVE-2022-0336: pytest: Add a test for an SPN conflict
|
|
with a re-added SPN
|
|
|
|
This test currently fails, as re-adding an SPN means that later checks
|
|
do not run.
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14950
|
|
|
|
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
|
|
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
|
|
---
|
|
python/samba/tests/ldap_spn.py | 7 +++++++
|
|
selftest/knownfail.d/ldap_spn | 1 +
|
|
2 files changed, 8 insertions(+)
|
|
|
|
diff --git a/python/samba/tests/ldap_spn.py b/python/samba/tests/ldap_spn.py
|
|
index 8a398ffaa49..6ebdf8f9a32 100644
|
|
--- a/python/samba/tests/ldap_spn.py
|
|
+++ b/python/samba/tests/ldap_spn.py
|
|
@@ -268,6 +268,8 @@ class LdapSpnTestBase(TestCase):
|
|
for k in ('dNSHostName', 'servicePrincipalName'):
|
|
if isinstance(m.get(k), str):
|
|
m[k] = m[k].format(dnsname=f"x.{REALM}")
|
|
+ elif isinstance(m.get(k), list):
|
|
+ m[k] = [x.format(dnsname=f"x.{REALM}") for x in m[k]]
|
|
|
|
msg = ldb.Message.from_dict(samdb, m, op)
|
|
|
|
@@ -727,6 +729,11 @@ class LdapSpnSambaOnlyTest(LdapSpnTestBase):
|
|
('user:C', 'host/{dnsname}', '*', ok),
|
|
('user:D', 'www/{dnsname}', 'D', denied),
|
|
),
|
|
+ ("add a conflict, along with a re-added SPN",
|
|
+ ('A', 'cifs/{dnsname}', '*', ok),
|
|
+ ('B', 'cifs/heeble.example.net', 'B', ok),
|
|
+ ('B', ['cifs/heeble.example.net', 'host/{dnsname}'], 'B', constraint),
|
|
+ ),
|
|
|
|
("changing dNSHostName after host",
|
|
('A', {'dNSHostName': '{dnsname}'}, '*', ok),
|
|
diff --git a/selftest/knownfail.d/ldap_spn b/selftest/knownfail.d/ldap_spn
|
|
index 63f9fe02ef7..16dafa91b66 100644
|
|
--- a/selftest/knownfail.d/ldap_spn
|
|
+++ b/selftest/knownfail.d/ldap_spn
|
|
@@ -1 +1,2 @@
|
|
samba.tests.ldap_spn.+LdapSpnTest.test_spn_dodgy_spns
|
|
+samba.tests.ldap_spn.+LdapSpnSambaOnlyTest.test_spn_add_a_conflict_along_with_a_re_added_SPN
|
|
--
|
|
2.25.1
|