73 lines
3.0 KiB
Diff
73 lines
3.0 KiB
Diff
From bdb3e3f669bd991da819040e726e003e4e2b841d Mon Sep 17 00:00:00 2001
|
|
From: Andrew Bartlett <abartlet@samba.org>
|
|
Date: Tue, 15 Oct 2019 16:28:46 +1300
|
|
Subject: [PATCH 6/7] CVE-2019-14847 dsdb: Demonstrate the correct interaction
|
|
of ranged_results style attributes and dirsync
|
|
|
|
Incremental results are provided by a flag on the dirsync control, not
|
|
by changing the attribute name.
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14040
|
|
|
|
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
|
|
---
|
|
selftest/knownfail.d/dirsync | 1 +
|
|
source4/dsdb/tests/python/dirsync.py | 26 ++++++++++++++++++++++++++
|
|
2 files changed, 27 insertions(+)
|
|
create mode 100644 selftest/knownfail.d/dirsync
|
|
|
|
diff --git a/selftest/knownfail.d/dirsync b/selftest/knownfail.d/dirsync
|
|
new file mode 100644
|
|
index 00000000000..bc49fe0d9bb
|
|
--- /dev/null
|
|
+++ b/selftest/knownfail.d/dirsync
|
|
@@ -0,0 +1 @@
|
|
+^samba4.ldap.dirsync.python\(ad_dc_ntvfs\).__main__.ExtendedDirsyncTests.test_dirsync_linkedattributes_range\(
|
|
\ No newline at end of file
|
|
diff --git a/source4/dsdb/tests/python/dirsync.py b/source4/dsdb/tests/python/dirsync.py
|
|
index 136f4d3bba6..b6f7022a50b 100755
|
|
--- a/source4/dsdb/tests/python/dirsync.py
|
|
+++ b/source4/dsdb/tests/python/dirsync.py
|
|
@@ -28,6 +28,7 @@ from samba.tests.subunitrun import TestProgram, SubunitOptions
|
|
import samba.getopt as options
|
|
import base64
|
|
|
|
+import ldb
|
|
from ldb import LdbError, SCOPE_BASE
|
|
from ldb import Message, MessageElement, Dn
|
|
from ldb import FLAG_MOD_ADD, FLAG_MOD_DELETE
|
|
@@ -590,6 +591,31 @@ class SimpleDirsyncTests(DirsyncBaseTests):
|
|
|
|
class ExtendedDirsyncTests(SimpleDirsyncTests):
|
|
|
|
+ def test_dirsync_linkedattributes_range(self):
|
|
+ self.ldb_simple = self.get_ldb_connection(self.simple_user, self.user_pass)
|
|
+ res = self.ldb_admin.search(self.base_dn,
|
|
+ attrs=["member;range=1-1"],
|
|
+ expression="(name=Administrators)",
|
|
+ controls=["dirsync:1:0:0"])
|
|
+
|
|
+ self.assertTrue(len(res) > 0)
|
|
+ self.assertTrue(res[0].get("member;range=1-1") is None)
|
|
+ self.assertTrue(res[0].get("member") is not None)
|
|
+ self.assertTrue(len(res[0].get("member")) > 0)
|
|
+
|
|
+ def test_dirsync_linkedattributes_range_user(self):
|
|
+ self.ldb_simple = self.get_ldb_connection(self.simple_user, self.user_pass)
|
|
+ try:
|
|
+ res = self.ldb_simple.search(self.base_dn,
|
|
+ attrs=["member;range=1-1"],
|
|
+ expression="(name=Administrators)",
|
|
+ controls=["dirsync:1:0:0"])
|
|
+ except LdbError as e:
|
|
+ (num, _) = e.args
|
|
+ self.assertEquals(num, ldb.ERR_INSUFFICIENT_ACCESS_RIGHTS)
|
|
+ else:
|
|
+ self.fail()
|
|
+
|
|
def test_dirsync_linkedattributes(self):
|
|
flag_incr_linked = 2147483648
|
|
self.ldb_simple = self.get_ldb_connection(self.simple_user, self.user_pass)
|
|
--
|
|
2.17.1
|