From: Tim Beale Date: Wed, 16 Aug 2017 03:00:31 +0000 (+1200) Subject: selftest: Update getnc_unpriv tests to pass against Samba X-Git-Url: http://git.samba.org/?a=commitdiff_plain;h=37ed946c75e4f62b173b943b0db649fdbdbf72ed;p=metze%2Fsamba%2Fwip.git selftest: Update getnc_unpriv tests to pass against Samba In general Windows seems to return BAD_DN rather than ACCESS_DENIED for an unprivileged user. In the the long-term, it's unrealistic to think that Samba and Windows will agree exactly on every error code returned. So for the tests to be maintainable and pass against Windows and Samba, they need to handle differences in expected errors. To get around this problem, I've changed the expected_error to be a set, so that multiple error codes (one for Microsoft, one for Samba) can be specified for each test case. This approach also highlights the cases where Microsoft and Samba currently differ. Signed-off-by: Andrew Bartlett Signed-off-by: Tim Beale Reviewed-by: Garming Sam --- diff --git a/selftest/knownfail.d/getnc_unpriv b/selftest/knownfail.d/getnc_unpriv deleted file mode 100644 index 40977f9618d9..000000000000 --- a/selftest/knownfail.d/getnc_unpriv +++ /dev/null @@ -1,10 +0,0 @@ -samba4.drs.getnc_unpriv.python\(vampire_dc\).getnc_unpriv.DrsReplicaSyncUnprivTestCase.test_repl_no_userpriv\(vampire_dc\) -samba4.drs.getnc_unpriv.python\(vampire_dc\).getnc_unpriv.DrsReplicaSyncUnprivTestCase.test_repl_getchanges_userpriv\(vampire_dc\) -samba4.drs.getnc_unpriv.python\(vampire_dc\).getnc_unpriv.DrsReplicaSyncUnprivTestCase.test_repl_getallchanges_userpriv\(vampire_dc\) -samba4.drs.getnc_unpriv.python\(vampire_dc\).getnc_unpriv.DrsReplicaSyncUnprivTestCase.test_repl_both_userpriv\(vampire_dc\) -samba4.drs.getnc_unpriv.python\(vampire_dc\)\(vampire_dc\) -samba4.drs.getnc_unpriv.python\(promoted_dc\).getnc_unpriv.DrsReplicaSyncUnprivTestCase.test_repl_no_userpriv\(promoted_dc\) -samba4.drs.getnc_unpriv.python\(promoted_dc\).getnc_unpriv.DrsReplicaSyncUnprivTestCase.test_repl_getchanges_userpriv\(promoted_dc\) -samba4.drs.getnc_unpriv.python\(promoted_dc\).getnc_unpriv.DrsReplicaSyncUnprivTestCase.test_repl_getallchanges_userpriv\(promoted_dc\) -samba4.drs.getnc_unpriv.python\(promoted_dc\).getnc_unpriv.DrsReplicaSyncUnprivTestCase.test_repl_both_userpriv\(promoted_dc\) -samba4.drs.getnc_unpriv.python\(promoted_dc\)\(promoted_dc\) diff --git a/source4/torture/drs/python/getnc_unpriv.py b/source4/torture/drs/python/getnc_unpriv.py index 41d96110492b..a65dd13d99e6 100644 --- a/source4/torture/drs/python/getnc_unpriv.py +++ b/source4/torture/drs/python/getnc_unpriv.py @@ -111,8 +111,8 @@ class DrsReplicaSyncUnprivTestCase(drs_base.DrsBaseTestCase): 8, req8) self.fail("Should have failed with user denied access") except WERRORError as (enum, estr): - self.assertEquals(enum, expected_error, - "Got unexpected error: %s" % estr) + self.assertTrue(enum in expected_error, + "Got unexpected error: %s" % estr) def _test_repl_single_obj(self, repl_obj, expected_error, partial_attribute_set=None): @@ -165,18 +165,19 @@ class DrsReplicaSyncUnprivTestCase(drs_base.DrsBaseTestCase): self.sd_utils.dacl_add_ace(self.base_dn, self.acl_mod_get_changes) self._test_repl_single_obj(repl_obj=self.ou, - expected_error=werror.WERR_DS_DRA_ACCESS_DENIED) + expected_error=[werror.WERR_DS_DRA_ACCESS_DENIED]) self._test_repl_secret(repl_obj=self.ou, - expected_error=werror.WERR_DS_DRA_ACCESS_DENIED) + expected_error=[werror.WERR_DS_DRA_ACCESS_DENIED]) self._test_repl_secret(repl_obj=self.user_dn, - expected_error=werror.WERR_DS_DRA_ACCESS_DENIED) + expected_error=[werror.WERR_DS_DRA_ACCESS_DENIED]) self._test_repl_secret(repl_obj=self.user_dn, dest_dsa=self.ldb_dc1.get_ntds_GUID(), - expected_error=werror.WERR_DS_DRA_ACCESS_DENIED) + expected_error=[werror.WERR_DS_DRA_ACCESS_DENIED]) - self._test_repl_full(expected_error=werror.WERR_DS_DRA_ACCESS_DENIED) - self._test_repl_full_on_ou(expected_error=werror.WERR_DS_CANT_FIND_EXPECTED_NC) + self._test_repl_full(expected_error=[werror.WERR_DS_DRA_ACCESS_DENIED]) + self._test_repl_full_on_ou(expected_error=[werror.WERR_DS_CANT_FIND_EXPECTED_NC, + werror.WERR_DS_DRA_ACCESS_DENIED]) # Partial Attribute Sets don't require GET_ALL_CHANGES rights, so we # expect the following to succeed @@ -215,16 +216,20 @@ class DrsReplicaSyncUnprivTestCase(drs_base.DrsBaseTestCase): self._test_repl_single_obj(repl_obj=self.ou, expected_error=None) + # Microsoft returns DB_ERROR, Samba returns ACCESS_DENIED self._test_repl_secret(repl_obj=self.ou, - expected_error=werror.WERR_DS_DRA_DB_ERROR) + expected_error=[werror.WERR_DS_DRA_DB_ERROR, + werror.WERR_DS_DRA_ACCESS_DENIED]) self._test_repl_secret(repl_obj=self.user_dn, - expected_error=werror.WERR_DS_DRA_DB_ERROR) + expected_error=[werror.WERR_DS_DRA_DB_ERROR, + werror.WERR_DS_DRA_ACCESS_DENIED]) + # Note that Windows accepts this but Samba rejects it self._test_repl_secret(repl_obj=self.user_dn, dest_dsa=self.ldb_dc1.get_ntds_GUID(), - expected_error=None) + expected_error=[werror.WERR_DS_DRA_ACCESS_DENIED]) self._test_repl_full(expected_error=None) - self._test_repl_full_on_ou(expected_error=werror.WERR_DS_CANT_FIND_EXPECTED_NC) + self._test_repl_full_on_ou(expected_error=[werror.WERR_DS_CANT_FIND_EXPECTED_NC]) self._test_repl_single_obj(repl_obj=self.ou, expected_error=None, @@ -238,24 +243,27 @@ class DrsReplicaSyncUnprivTestCase(drs_base.DrsBaseTestCase): We expect all these requests to be rejected. """ + # Microsoft usually returns BAD_DN, Samba returns ACCESS_DENIED + usual_error = [werror.WERR_DS_DRA_BAD_DN, werror.WERR_DS_DRA_ACCESS_DENIED] + self._test_repl_single_obj(repl_obj=self.ou, - expected_error=werror.WERR_DS_DRA_BAD_DN) + expected_error=usual_error) self._test_repl_secret(repl_obj=self.ou, - expected_error=werror.WERR_DS_DRA_BAD_DN) + expected_error=usual_error) self._test_repl_secret(repl_obj=self.user_dn, - expected_error=werror.WERR_DS_DRA_BAD_DN) + expected_error=usual_error) self._test_repl_secret(repl_obj=self.user_dn, dest_dsa=self.ldb_dc1.get_ntds_GUID(), - expected_error=werror.WERR_DS_DRA_BAD_DN) + expected_error=usual_error) - self._test_repl_full(expected_error=werror.WERR_DS_DRA_ACCESS_DENIED) - self._test_repl_full_on_ou(expected_error=werror.WERR_DS_DRA_BAD_DN) + self._test_repl_full(expected_error=[werror.WERR_DS_DRA_ACCESS_DENIED]) + self._test_repl_full_on_ou(expected_error=usual_error) self._test_repl_single_obj(repl_obj=self.ou, - expected_error=werror.WERR_DS_DRA_BAD_DN, + expected_error=usual_error, partial_attribute_set=self.get_partial_attribute_set()) - self._test_repl_full(expected_error=werror.WERR_DS_DRA_ACCESS_DENIED, + self._test_repl_full(expected_error=[werror.WERR_DS_DRA_ACCESS_DENIED], partial_attribute_set=self.get_partial_attribute_set())