test_nfs4_acls: Add tests for mapping of ACL types

Add testcases for mapping the type field (ALLOW or DENY) between NFSv4
ACLs and security descriptors.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

diff --git a/source3/modules/test_nfs4_acls.c b/source3/modules/test_nfs4_acls.c
index 18322afb4a03f6f9d7049a77fbcd088da9bf7878..b29714d23e33ad9f24f92df703fda0b7ea278b59 100644 (file)
--- a/source3/modules/test_nfs4_acls.c
+++ b/source3/modules/test_nfs4_acls.c
@@ -163,12 +163,119 @@ static void test_empty_dacl_to_nfs4(void **state)
        assert_null(smb_first_ace4(nfs4_acl));
 }
 
+struct ace_dacl_type_mapping {
+       uint32_t nfs4_type;
+       enum security_ace_type dacl_type;
+} ace_dacl_type_mapping[] = {
+       { SMB_ACE4_ACCESS_ALLOWED_ACE_TYPE,     SEC_ACE_TYPE_ACCESS_ALLOWED   },
+       { SMB_ACE4_ACCESS_DENIED_ACE_TYPE,      SEC_ACE_TYPE_ACCESS_DENIED    },
+};
+
+static void test_acl_type_nfs4_to_dacl(void **state)
+{
+       struct dom_sid *sids = *state;
+       TALLOC_CTX *frame = talloc_stackframe();
+       int i;
+
+       for (i = 0; i < ARRAY_SIZE(ace_dacl_type_mapping); i++) {
+               struct SMB4ACL_T *nfs4_acl;
+               SMB_ACE4PROP_T nfs4_ace;
+               struct security_ace *dacl_aces;
+               int good_aces;
+               struct smbacl4_vfs_params params = {
+                       .mode = e_simple,
+                       .do_chown = true,
+                       .acedup = e_merge,
+                       .map_full_control = true,
+               };
+
+               nfs4_acl = smb_create_smb4acl(frame);
+               assert_non_null(nfs4_acl);
+
+               nfs4_ace = (SMB_ACE4PROP_T) {
+                       .flags          = 0,
+                       .who.uid        = 1000,
+                       .aceType        = ace_dacl_type_mapping[i].nfs4_type,
+                       .aceFlags       = 0,
+                       .aceMask        = SMB_ACE4_READ_DATA,
+               };
+               assert_non_null(smb_add_ace4(nfs4_acl, &nfs4_ace));
+
+               assert_true(smbacl4_nfs42win(frame, &params, nfs4_acl,
+                                            &sids[2], &sids[3], false,
+                                            &dacl_aces, &good_aces));
+
+               assert_int_equal(good_aces, 1);
+               assert_non_null(dacl_aces);
+
+               assert_int_equal(dacl_aces[0].type,
+                                ace_dacl_type_mapping[i].dacl_type);
+               assert_int_equal(dacl_aces[0].flags, 0);
+               assert_int_equal(dacl_aces[0].access_mask, SEC_FILE_READ_DATA);
+               assert_true(dom_sid_equal(&dacl_aces[0].trustee, &sids[0]));
+       }
+
+       TALLOC_FREE(frame);
+}
+
+static void test_acl_type_dacl_to_nfs4(void **state)
+{
+       struct dom_sid *sids = *state;
+       TALLOC_CTX *frame = talloc_stackframe();
+       int i;
+
+       for (i = 0; i < ARRAY_SIZE(ace_dacl_type_mapping); i++) {
+               struct SMB4ACL_T *nfs4_acl;
+               struct SMB4ACE_T *nfs4_ace_container;
+               SMB_ACE4PROP_T *nfs4_ace;
+               struct security_ace dacl_aces[1];
+               struct security_acl *dacl;
+               struct smbacl4_vfs_params params = {
+                       .mode = e_simple,
+                       .do_chown = true,
+                       .acedup = e_merge,
+                       .map_full_control = true,
+               };
+
+               init_sec_ace(&dacl_aces[0], &sids[0],
+                            ace_dacl_type_mapping[i].dacl_type,
+                            SEC_FILE_READ_DATA, 0);
+               dacl = make_sec_acl(frame, SECURITY_ACL_REVISION_ADS,
+                                   ARRAY_SIZE(dacl_aces), dacl_aces);
+               assert_non_null(dacl);
+
+               nfs4_acl = smbacl4_win2nfs4(frame, false, dacl, &params,
+                                           101, 102);
+
+               assert_non_null(nfs4_acl);
+               assert_int_equal(smbacl4_get_controlflags(nfs4_acl),
+                                SEC_DESC_SELF_RELATIVE);
+               assert_int_equal(smb_get_naces(nfs4_acl), 1);
+
+               nfs4_ace_container = smb_first_ace4(nfs4_acl);
+               assert_non_null(nfs4_ace_container);
+               assert_null(smb_next_ace4(nfs4_ace_container));
+
+               nfs4_ace = smb_get_ace4(nfs4_ace_container);
+               assert_int_equal(nfs4_ace->flags, 0);
+               assert_int_equal(nfs4_ace->who.uid, 1000);
+               assert_int_equal(nfs4_ace->aceFlags, 0);
+               assert_int_equal(nfs4_ace->aceType,
+                                ace_dacl_type_mapping[i].nfs4_type);
+               assert_int_equal(nfs4_ace->aceMask, SMB_ACE4_READ_DATA);
+       }
+
+       TALLOC_FREE(frame);
+}
+
 int main(int argc, char **argv)
 {
        const struct CMUnitTest tests[] = {
                cmocka_unit_test(test_cached_id_mappings),
                cmocka_unit_test(test_empty_nfs4_to_dacl),
                cmocka_unit_test(test_empty_dacl_to_nfs4),
+               cmocka_unit_test(test_acl_type_nfs4_to_dacl),
+               cmocka_unit_test(test_acl_type_dacl_to_nfs4),
        };
 
        cmocka_set_message_output(CM_OUTPUT_SUBUNIT);