diff options
author | Andrew Bartlett <abartlet@samba.org> | 2023-03-03 10:31:40 +1300 |
---|---|---|
committer | Jule Anger <janger@samba.org> | 2023-03-20 10:03:44 +0100 |
commit | a8c573012f54e74e86deec6ac2bd84e2450dad03 (patch) | |
tree | 3b9c3912868450a49ff434df89e79d4eeaac7c0e | |
parent | a91fc6e9f1def8bed920efba9c1bd1f4713eb3ca (diff) | |
download | samba-a8c573012f54e74e86deec6ac2bd84e2450dad03.tar.gz |
CVE-2023-0614 dsdb: Alter timeout test in large_ldap.py to be slower by matching on large objects
This changes the slow aspect to be the object matching not the filter parsing.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
-rw-r--r-- | source4/dsdb/tests/python/large_ldap.py | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/source4/dsdb/tests/python/large_ldap.py b/source4/dsdb/tests/python/large_ldap.py index 13729052e65..0da79da6f73 100644 --- a/source4/dsdb/tests/python/large_ldap.py +++ b/source4/dsdb/tests/python/large_ldap.py @@ -32,7 +32,7 @@ from samba.tests.subunitrun import SubunitOptions, TestProgram import samba.getopt as options from samba.auth import system_session -from samba import ldb +from samba import ldb, sd_utils from samba.samdb import SamDB from samba.ndr import ndr_unpack from samba import gensec @@ -123,10 +123,13 @@ class LargeLDAPTest(samba.tests.TestCase): def setUpClass(cls): cls.ldb = SamDB(url, credentials=creds, session_info=system_session(lp), lp=lp) cls.base_dn = cls.ldb.domain_dn() + + cls.sd_utils = sd_utils.SDUtils(cls.ldb) cls.USER_NAME = "large_user" + format(random.randint(0, 99999), "05") + "-" cls.OU_NAME="large_user_ou" + format(random.randint(0, 99999), "05") cls.ou_dn = ldb.Dn(cls.ldb, "ou=" + cls.OU_NAME + "," + str(cls.base_dn)) + samba.tests.delete_force(cls.ldb, cls.ou_dn, controls=['tree_delete:1']) @@ -249,6 +252,7 @@ class LargeLDAPTest(samba.tests.TestCase): self.assertGreater(count, count_jpeg) def test_timeout(self): + policy_dn = ldb.Dn(self.ldb, 'CN=Default Query Policy,CN=Query-Policies,' 'CN=Directory Service,CN=Windows NT,CN=Services,' @@ -286,9 +290,19 @@ class LargeLDAPTest(samba.tests.TestCase): session_info=system_session(lp), lp=lp) + for x in range(200): + user_name = self.USER_NAME + format(x, "03") + ace = "(OD;;RP;{6bc69afa-7bd9-4184-88f5-28762137eb6a};;S-1-%d)" % x + dn = ldb.Dn(self.ldb, "cn=" + user_name + "," + str(self.ou_dn)) + + # add an ACE that denies access to the above random attr + # for a not-existing user. This makes each SD distinct + # and so will slow SD parsing. + self.sd_utils.dacl_add_ace(dn, ace) + # Create a large search expression that will take a long time to # evaluate. - expression = '(anr=l)' * 10000 + expression = f'(jpegPhoto=*X*)' * 1000 expression = f'(|{expression})' # Perform the LDAP search. |