python/samba/tests/sddl.py

   1 # Unix SMB/CIFS implementation.
   2 # Copyright (C) Volker Lendecke <vl@samba.org> 2021
   3 #
   4 # This program is free software; you can redistribute it and/or modify
   5 # it under the terms of the GNU General Public License as published by
   6 # the Free Software Foundation; either version 3 of the License, or
   7 # (at your option) any later version.
   8 #
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13 #
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16 #
  17
  18 """Tests for samba.dcerpc.security"""
  19
  20 from samba.dcerpc import security
  21 from samba.tests import TestCase, DynamicTestCase, get_env_dir
  22 from samba.colour import c_RED, c_GREEN
  23 import os
  24
  25
  26 class SddlDecodeEncodeBase(TestCase):
  27     maxDiff = 10000
  28     case_insensitive = False
  29
  30     @classmethod
  31     def setUpDynamicTestCases(cls):
  32         cls.domain_sid = security.dom_sid("S-1-2-3-4")
  33
  34         strings_dir = getattr(cls, 'strings_dir', None)
  35         if strings_dir is not None:
  36             cls.read_windows_strings(strings_dir, False)
  37
  38         for (key, fn) in [
  39                 ("SAMBA_WRITE_WINDOWS_STRINGS_DIR",
  40                  cls.write_windows_strings),
  41                 ("SAMBA_READ_WINDOWS_STRINGS_DIR",
  42                  cls.read_windows_strings),
  43                 ("SAMBA_WRITE_FUZZ_STRINGS_DIR",
  44                  cls.write_sddl_strings_for_fuzz_seeds)]:
  45             dir = get_env_dir(key)
  46             if dir is not None:
  47                 fn(dir)
  48
  49         seen = set()
  50         for pair in cls.strings:
  51             if isinstance(pair, str):
  52                 pair = (pair, pair)
  53
  54             if pair in seen:
  55                 print(f"seen {pair} after {len(seen)}")
  56             seen.add(pair)
  57             sddl, canonical = pair
  58
  59             name = sddl
  60             if len(name) > 120:
  61                 name = f"{name[:100]}+{len(name) - 100}-more-characters"
  62
  63             if cls.should_succeed:
  64                 cls.generate_dynamic_test('test_sddl', name, sddl, canonical)
  65             else:
  66                 cls.generate_dynamic_test('test_sddl_should_fail',
  67                                           name, sddl, canonical)
  68
  69     def _test_sddl_with_args(self, s, canonical):
  70         try:
  71             sd1 = security.descriptor.from_sddl(s, self.domain_sid)
  72         except (TypeError, ValueError, security.SDDLValueError) as e:
  73             self.fail(f"raised {e}")
  74
  75         sddl = sd1.as_sddl(self.domain_sid)
  76         sd2 = security.descriptor.from_sddl(sddl, self.domain_sid)
  77         self.assertEqual(sd1, sd2)
  78         if '0X' in canonical.upper() or self.case_insensitive:
  79             # let's chill out about case in hex numbers.
  80             self.assertEqual(sddl.upper(), canonical.upper())
  81         else:
  82             self.assertEqual(sddl, canonical)
  83
  84     def _test_sddl_should_fail_with_args(self, s, canonical):
  85         try:
  86             sd = security.descriptor.from_sddl(s, self.domain_sid)
  87         except security.SDDLValueError as e:
  88             generic_msg, specific_msg, position, sddl = e.args
  89             self.assertEqual(generic_msg, "Unable to parse SDDL")
  90             self.assertIsInstance(specific_msg, str)
  91             self.assertIsInstance(position, int)
  92             self.assertLessEqual(position, len(s))
  93             self.assertGreaterEqual(position, 0)
  94             self.assertEqual(s, sddl)
  95
  96             print(f"{s}\n{' ' * position}^\n {specific_msg}")
  97         else:
  98             self.fail(f"{sd.as_sddl(self.domain_sid)} should fail to parse")
  99
 100     @classmethod
 101     def write_sddl_strings_for_fuzz_seeds(cls, dir):
 102         """write all the SDDL strings we have into a directory as individual
 103         files, using a naming convention beloved of fuzzing engines.
 104
 105         To run this set an environment variable; see
 106         cls.setUpDynamicTestCases(), above.
 107
 108         Note this will only run in subclasses annotated with @DynamicTestCase.
 109         """
 110         from hashlib import md5
 111         for sddl in cls.strings:
 112             if not isinstance(sddl, str):
 113                 sddl = sddl[0]
 114             name = md5(sddl.encode()).hexdigest()
 115             with open(os.path.join(dir, name), 'w') as f:
 116                 f.write(sddl)
 117
 118     @classmethod
 119     def write_windows_strings(cls, dir):
 120         """Write all test cases in the format used by
 121         libcli/security/tests/windows/windows-sddl-tests.c which, if
 122         compiled on Windows under Cygwin or MSYS64, can run SDDL
 123         parsing tests using the Windows API. This allows us to run the
 124         same tests here and on Windows, to ensure we get the same
 125         results.
 126
 127         That test program can read examples in a bespoke text format,
 128         in which each line looks like:
 129
 130            original sddl -> returned sddl
 131
 132         That is, the separator consists of the 4 bytes " -> ".
 133         Multi-line examples are not possible.
 134
 135         To run this set an environment variable; see
 136         cls.setUpDynamicTestCases(), above. Then if you copy the
 137         file/s produced to Windows and run them in your POSIX-y shell
 138         with
 139
 140           windows-sddl-tests -i path/to/*.txt
 141
 142         the results on Windows will be shown.
 143
 144         Note this will only run in subclasses annotated with @DynamicTestCase.
 145         """
 146         name = f"{dir}/{cls.name}.txt"
 147         with open(name, 'w') as f:
 148             for p in cls.strings:
 149                 if isinstance(p, str):
 150                     p = (p, p)
 151                 print(f"{p[0]} -> {p[1]}", file=f)
 152
 153     @classmethod
 154     def read_windows_strings(cls, dir, verbose=True):
 155         """This is complementary to cls.write_windows_strings(), which writes
 156         these tests in a format usable on Windows. In this case
 157         examples will be read in, replacing the strings here with the
 158         ones listed. Along the way it alerts you to the changes.
 159
 160         To run this set an environment variable; see
 161         cls.setUpDynamicTestCases(), above.
 162
 163         Note this will only run in subclasses annotated with @DynamicTestCase.
 164         """
 165         filename = f"{dir}/{cls.name}.txt"
 166
 167         if not hasattr(cls, 'strings'):
 168             cls.strings = []
 169
 170         old_pairs = set()
 171         for s in cls.strings:
 172             if isinstance(s, str):
 173                 s = (s, s)
 174             old_pairs.add(s)
 175
 176         new_pairs = set()
 177         with open(filename) as f:
 178             for line in f:
 179                 line = line.rstrip()
 180                 if line.startswith('#') or line == '':
 181                     continue
 182                 o, _, c = line.partition(' -> ')
 183                 if c == '':
 184                     c = o
 185                 new_pairs.add((o, c))
 186
 187         if old_pairs == new_pairs:
 188             # nothing to do
 189             if verbose:
 190                 print(f"no change in {c_GREEN(cls.name)}")
 191             return
 192
 193         if verbose:
 194             print(f"change in {c_RED(cls.name)}")
 195             print("added:")
 196             for x in sorted(new_pairs - old_pairs):
 197                 print(x)
 198             print("removed:")
 199             for x in sorted(old_pairs - new_pairs):
 200                 print(x)
 201
 202         cls.strings[:] = sorted(new_pairs)
 203
 204
 205 @DynamicTestCase
 206 class SddlNonCanonical(SddlDecodeEncodeBase):
 207     """These ones are transformed in the round trip into a preferred
 208     synonym. For example "S:D:" is accepted as input, but only "D:S:
 209     will be output.
 210     """
 211     name = "non_canonical"
 212     should_succeed = True
 213     strings = [
 214         # format is (original, canonical); after passing through an SD
 215         # object, the SDDL will look like the canonical version.
 216         ("D:(A;;CC;;;BA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)",
 217          "D:(A;;CC;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;LCRPLORC;;;AU)"),
 218
 219         (("D:(A;;RP;;;WD)"
 220           "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)"
 221           "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)"
 222           "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)"
 223           "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)"
 224           "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)"
 225           "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)"
 226           "(A;;RPLCLORC;;;AU)"
 227           "(A;;RPWPCRLCLOCCRCWDWOSW;;;BO)"
 228           "(A;CI;RPWPCRLCLOCCRCWDWOSDSW;;;BA)"
 229           "(A;;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)"
 230           "(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;ES)"
 231           "(A;CI;LC;;;RU)"
 232           "(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 233           "(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 234           "(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 235           "(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 236           "(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 237           "(OA;;RP;c7407360-20bf-11d0-a768-00aa006e0529;;RU)"
 238           "(OA;CIIO;RPLCLORC;;bf967a9c-0de6-11d0-a285-00aa003049e2;RU)"
 239           "(A;;RPRC;;;RU)"
 240           "(OA;CIIO;RPLCLORC;;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 241           "(A;;LCRPLORC;;;ED)"
 242           "(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)"
 243           "(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)"
 244           "(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)"
 245           "(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)"
 246           "(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)"
 247           "(OA;CIIO;RPLCLORC;;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)"
 248           "(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;RU)"
 249           "(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;AU)"
 250           "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;ED)"
 251           "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;ED)"
 252           "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;ED)"
 253           "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;NO)"
 254           "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)"
 255           "(OA;;CR;e2a36dc9-ae17-47c3-b58b-be34c55ba633;;SU)"
 256           "(OA;;CR;280f369c-67c7-438e-ae98-1d46f3c6f541;;AU)"
 257           "(OA;;CR;ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501;;AU)"
 258           "(OA;;CR;05c74c5e-4deb-43b4-bd9f-86664c2a7fd5;;AU)"
 259           "S:(AU;SA;WDWOWP;;;WD)"),
 260          ("D:(A;;RP;;;WD)"
 261           "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)"
 262           "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)"
 263           "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)"
 264           "(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)"
 265           "(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)"
 266           "(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)"
 267           "(A;;LCRPLORC;;;AU)"
 268           "(A;;CCLCSWRPWPLOCRRCWDWO;;;BO)"
 269           "(A;CI;CCLCSWRPWPLOCRSDRCWDWO;;;BA)"
 270           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 271           "(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;ES)"
 272           "(A;CI;LC;;;RU)"
 273           "(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 274           "(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 275           "(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 276           "(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 277           "(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 278           "(OA;;RP;c7407360-20bf-11d0-a768-00aa006e0529;;RU)"
 279           "(OA;CIIO;LCRPLORC;;bf967a9c-0de6-11d0-a285-00aa003049e2;RU)"
 280           "(A;;RPRC;;;RU)"
 281           "(OA;CIIO;LCRPLORC;;bf967aba-0de6-11d0-a285-00aa003049e2;RU)"
 282           "(A;;LCRPLORC;;;ED)"
 283           "(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)"
 284           "(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)"
 285           "(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)"
 286           "(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)"
 287           "(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)"
 288           "(OA;CIIO;LCRPLORC;;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)"
 289           "(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;RU)"
 290           "(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;AU)"
 291           "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;ED)"
 292           "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;ED)"
 293           "(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;ED)"
 294           "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;NO)"
 295           "(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)"
 296           "(OA;;CR;e2a36dc9-ae17-47c3-b58b-be34c55ba633;;SU)"
 297           "(OA;;CR;280f369c-67c7-438e-ae98-1d46f3c6f541;;AU)"
 298           "(OA;;CR;ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501;;AU)"
 299           "(OA;;CR;05c74c5e-4deb-43b4-bd9f-86664c2a7fd5;;AU)"
 300           "S:(AU;SA;WPWDWO;;;WD)")),
 301
 302          (("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;BO)"
 303            "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)"
 304            "(A;;WPRPCRCCDCLCLORCWOWDSDDTSW;;;SY)"
 305            "(A;;RPCRLCLORCSDDT;;;CO)"
 306            "(OA;;WP;4c164200-20c0-11d0-a768-00aa006e0529;;CO)"
 307            "(A;;RPLCLORC;;;AU)"
 308            "(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)"
 309            "(A;;CCDC;;;PS)"
 310            "(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)"
 311            "(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;SY)"
 312            "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;PS)"
 313            "(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)"
 314            "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;PS)"
 315            "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;CO)"
 316            "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;CO)"
 317            "(OA;;WP;3e0abfd0-126a-11d0-a060-00aa006c33ed;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 318            "(OA;;WP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 319            "(OA;;WP;bf967950-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 320            "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 321            "(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)"),
 322           ("D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BO)"
 323            "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AO)"
 324            "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 325            "(A;;LCRPDTLOCRSDRC;;;CO)"
 326            "(OA;;WP;4c164200-20c0-11d0-a768-00aa006e0529;;CO)"
 327            "(A;;LCRPLORC;;;AU)"
 328            "(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)"
 329            "(A;;CCDC;;;PS)"
 330            "(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)"
 331            "(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;SY)"
 332            "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;PS)"
 333            "(OA;;RPWP;77b5b886-944a-11d1-aebd-0000f80367c1;;PS)"
 334            "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;PS)"
 335            "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;CO)"
 336            "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;CO)"
 337            "(OA;;WP;3e0abfd0-126a-11d0-a060-00aa006c33ed;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 338            "(OA;;WP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 339            "(OA;;WP;bf967950-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 340            "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 341            "(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)")),
 342
 343          ("D:(A;;RPLCLORC;;;BO)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)",
 344           "D:(A;;LCRPLORC;;;BO)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;LCRPLORC;;;AU)"),
 345
 346         (("D:(A;;WPCRCCDCLCLORCWOWDSDDTSWRP;;;BO)"
 347           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)"
 348           "(A;;RPWPCRCCDCLCLORCWOWDSDSWDT;;;SY)"
 349           "(A;;RPCRLCLORCSDDT;;;CO)"
 350           "(OA;;WP;4c164200-20c0-11d0-a768-00aa006e0529;;CO)"
 351           "(A;;RPLCLORC;;;AU)"
 352           "(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)"
 353           "(A;;CCDC;;;PS)"
 354           "(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)"
 355           "(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;SY)"
 356           "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;PS)"
 357           "(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)"
 358           "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;PS)"
 359           "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;CO)"
 360           "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;CO)"
 361           "(OA;;WP;3e0abfd0-126a-11d0-a060-00aa006c33ed;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 362           "(OA;;WP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 363           "(OA;;WP;bf967950-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 364           "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 365           "(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;SU)"),
 366          ("D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BO)"
 367           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AO)"
 368           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 369           "(A;;LCRPDTLOCRSDRC;;;CO)"
 370           "(OA;;WP;4c164200-20c0-11d0-a768-00aa006e0529;;CO)"
 371           "(A;;LCRPLORC;;;AU)"
 372           "(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)"
 373           "(A;;CCDC;;;PS)"
 374           "(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)"
 375           "(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;SY)"
 376           "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;PS)"
 377           "(OA;;RPWP;77b5b886-944a-11d1-aebd-0000f80367c1;;PS)"
 378           "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;PS)"
 379           "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;CO)"
 380           "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;CO)"
 381           "(OA;;WP;3e0abfd0-126a-11d0-a060-00aa006c33ed;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 382           "(OA;;WP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 383           "(OA;;WP;bf967950-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 384           "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 385           "(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;SU)")),
 386
 387         (("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;BO)"
 388           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)"
 389           "(A;;RPLCLORC;;;AU)",
 390           "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BO)"
 391           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 392           "(A;;LCRPLORC;;;AU)")),
 393
 394         (("D:(A;;;;;BO)"
 395           "(A;;;;;AO)"
 396           "(A;;;;;SY)"
 397           "(A;;RPCRLCLORCSDDT;;;CO)"
 398           "(OA;;WP;4c164200-20c0-11d0-a768-00aa006e0529;;CO)"
 399           "(A;;RPLCLORC;;;AU)"
 400           "(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)"
 401           "(A;;CCDC;;;PS)"
 402           "(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)"
 403           "(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;SY)"
 404           "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;PS)"
 405           "(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)"
 406           "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;PS)"
 407           "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;CO)"
 408           "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;CO)"
 409           "(OA;;WP;3e0abfd0-126a-11d0-a060-00aa006c33ed;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 410           "(OA;;WP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 411           "(OA;;WP;bf967950-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 412           "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 413           "(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;SU)"),
 414          ("D:(A;;;;;BO)"
 415           "(A;;;;;AO)"
 416           "(A;;;;;SY)"
 417           "(A;;LCRPDTLOCRSDRC;;;CO)"
 418           "(OA;;WP;4c164200-20c0-11d0-a768-00aa006e0529;;CO)"
 419           "(A;;LCRPLORC;;;AU)"
 420           "(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)"
 421           "(A;;CCDC;;;PS)"
 422           "(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)"
 423           "(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;SY)"
 424           "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;PS)"
 425           "(OA;;RPWP;77b5b886-944a-11d1-aebd-0000f80367c1;;PS)"
 426           "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;PS)"
 427           "(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;CO)"
 428           "(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;CO)"
 429           "(OA;;WP;3e0abfd0-126a-11d0-a060-00aa006c33ed;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 430           "(OA;;WP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 431           "(OA;;WP;bf967950-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 432           "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;CO)"
 433           "(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;SU)")),
 434
 435         ("D:(A;;RPLCLORC;;;AU)",
 436          "D:(A;;LCRPLORC;;;AU)"),
 437
 438         (("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;BO)"
 439           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)"
 440           "(A;;RPLCLORC;;;AU)"
 441           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)"
 442           "(A;;RPLCLORC;;;PS)"
 443           "(OA;;CR;ab721a55-1e2f-11d0-9819-00aa0040529b;;AU)"
 444           "(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;SU)"),
 445          ("D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BO)"
 446           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 447           "(A;;LCRPLORC;;;AU)"
 448           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AO)"
 449           "(A;;LCRPLORC;;;PS)"
 450           "(OA;;CR;ab721a55-1e2f-11d0-9819-00aa0040529b;;AU)"
 451           "(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;SU)")),
 452
 453         (("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;BO)"
 454           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)"
 455           "(A;;RPLCLORC;;;AU)"
 456           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;CO)"),
 457          ("D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BO)"
 458           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 459           "(A;;LCRPLORC;;;AU)"
 460           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;CO)")),
 461
 462         (("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;BO)"
 463           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)"
 464           "(A;;RPLCLORC;;;AU)S:(AU;SA;CRWP;;;WD)"),
 465          ("D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BO)"
 466           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 467           "(A;;LCRPLORC;;;AU)S:(AU;SA;WPCR;;;WD)")),
 468
 469         (("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSWRP;;;BO)"
 470           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)"
 471           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)"
 472           "(A;;RPLCLORC;;;PS)"
 473           "(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)"
 474           "(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;PS)"
 475           "(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;PS)"
 476           "(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)"
 477           "(OA;;RPWP;E45795B2-9455-11d1-AEBD-0000F80367C1;;PS)"
 478           "(OA;;RPWP;E45795B3-9455-11d1-AEBD-0000F80367C1;;PS)"
 479           "(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;;RD)"
 480           "(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;;RD)"
 481           "(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;RD)"
 482           "(A;;RC;;;AU)"
 483           "(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;AU)"
 484           "(OA;;RP;77B5B886-944A-11d1-AEBD-0000F80367C1;;AU)"
 485           "(OA;;RP;E45795B3-9455-11d1-AEBD-0000F80367C1;;AU)"
 486           "(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)"
 487           "(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)"
 488           "(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;;RD)"
 489           "(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;SY)"
 490           "(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;SU)"
 491           "(OA;;WPRP;6db69a1c-9422-11d1-aebd-0000f80367c1;;SU)"),
 492          ("D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BO)"
 493           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 494           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AO)"
 495           "(A;;LCRPLORC;;;PS)"
 496           "(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)"
 497           "(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;PS)"
 498           "(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;PS)"
 499           "(OA;;RPWP;77b5b886-944a-11d1-aebd-0000f80367c1;;PS)"
 500           "(OA;;RPWP;e45795b2-9455-11d1-aebd-0000f80367c1;;PS)"
 501           "(OA;;RPWP;e45795b3-9455-11d1-aebd-0000f80367c1;;PS)"
 502           "(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;;RD)"
 503           "(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;;RD)"
 504           "(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;RD)"
 505           "(A;;RC;;;AU)"
 506           "(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;AU)"
 507           "(OA;;RP;77b5b886-944a-11d1-aebd-0000f80367c1;;AU)"
 508           "(OA;;RP;e45795b3-9455-11d1-aebd-0000f80367c1;;AU)"
 509           "(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)"
 510           "(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)"
 511           "(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;;RD)"
 512           "(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;SY)"
 513           "(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;SU)"
 514           "(OA;;RPWP;6db69a1c-9422-11d1-aebd-0000f80367c1;;SU)")),
 515
 516         (("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)"),
 517          ("D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)")),
 518
 519         (("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)"
 520           "(A;;RPLCLORC;;;AU)"
 521           "(A;;LCRPLORC;;;ED)"),
 522          ("D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 523           "(A;;LCRPLORC;;;AU)"
 524           "(A;;LCRPLORC;;;ED)")),
 525
 526         (("D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)"
 527           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;BO)"
 528           "(OA;;CCDC;bf967a86-0de6-11d0-a285-00aa003049e2;;AO)"
 529           "(OA;;CCDC;bf967aba-0de6-11d0-a285-00aa003049e2;;AO)"
 530           "(OA;;CCDC;bf967a9c-0de6-11d0-a285-00aa003049e2;;AO)"
 531           "(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)"
 532           "(A;;RPLCLORC;;;AU)"
 533           "(A;;LCRPLORC;;;ED)"
 534           "(OA;;CCDC;4828CC14-1437-45bc-9B07-AD6F015E5F28;;AO)"),
 535          ("D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 536           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BO)"
 537           "(OA;;CCDC;bf967a86-0de6-11d0-a285-00aa003049e2;;AO)"
 538           "(OA;;CCDC;bf967aba-0de6-11d0-a285-00aa003049e2;;AO)"
 539           "(OA;;CCDC;bf967a9c-0de6-11d0-a285-00aa003049e2;;AO)"
 540           "(OA;;CCDC;bf967aa8-0de6-11d0-a285-00aa003049e2;;PO)"
 541           "(A;;LCRPLORC;;;AU)"
 542           "(A;;LCRPLORC;;;ED)"
 543           "(OA;;CCDC;4828cc14-1437-45bc-9b07-ad6f015e5f28;;AO)")),
 544
 545         (("D:(A;;RPWPCRCCDCLCLORCWOWDSW;;;BO)"
 546           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)"
 547           "(A;;RPLCLORC;;;AU)"),
 548          ("D:(A;;CCDCLCSWRPWPLOCRRCWDWO;;;BO)"
 549           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 550           "(A;;LCRPLORC;;;AU)")),
 551
 552         (("D:(A;CI;RPWPCRCCDCLCLORCWOWDSDDTSW;;;BO)"
 553           "(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)"
 554           "(A;;RPLCLORC;;;AU)"),
 555          ("D:(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BO)"
 556           "(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)"
 557           "(A;;LCRPLORC;;;AU)")),
 558
 559         ("S:D:P", "D:PS:"),
 560         ("S:D:", "D:S:"),
 561
 562         # decimal to hex
 563         ("D:(A;;123456789;;;LG)",
 564          "D:(A;;0x75bcd15;;;LG)"),
 565
 566         # octal to hex
 567         ("D:(A;;01234567;;;LG)",
 568          "D:(A;;0x53977;;;LG)"),
 569
 570         # numbers to flags
 571         ("D:(A;;16;;;LG)",
 572          "D:(A;;RP;;;LG)"),
 573         ("D:(A;;17;;;LG)",
 574          "D:(A;;CCRP;;;LG)"),
 575         ("D:(A;;0xff;;;LG)",
 576          "D:(A;;CCDCLCSWRPWPDTLO;;;LG)"),
 577         ("D:(A;;0xf01ff;;;LG)",
 578          "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;LG)"),
 579         ("D:(A;;0xe00f0000;;;LG)",
 580          "D:(A;;SDRCWDWOGXGWGR;;;LG)"),
 581
 582         # ACL flags
 583         ("D:ARPAI(A;;GA;;;SY)", "D:PARAI(A;;GA;;;SY)"),
 584         ("D:AIPAR(A;;GA;;;SY)", "D:PARAI(A;;GA;;;SY)"),
 585         ("D:PARP(A;;GA;;;SY)", "D:PAR(A;;GA;;;SY)"),
 586         ("D:PPPPPPPPPPPP(A;;GA;;;SY)", "D:P(A;;GA;;;SY)"),
 587
 588         # hex vs decimal
 589         ('D:(A;;CC;;;S-1-21474836480-32-579)',
 590          'D:(A;;CC;;;S-1-0x500000000-32-579)'),
 591         ("D:(A;;GA;;;S-1-5000000000-30-40)",
 592          "D:(A;;GA;;;S-1-0x12A05F200-30-40)"),
 593         ("D:(A;;GA;;;S-1-0x2-3-4)",
 594          "D:(A;;GA;;;S-1-2-3-4)"),
 595         ("D:(A;;GA;;;S-1-0x20-3-4)",
 596          "D:(A;;GA;;;S-1-32-3-4)"),
 597         ("D:(A;;GA;;;S-1-3-0x00000002-3-4)",
 598          "D:(A;;GA;;;S-1-3-2-3-4)"),
 599         ("D:(A;;GA;;;S-1-3-0xffffffff-3-4)",
 600          "D:(A;;GA;;;S-1-3-4294967295-3-4)"),
 601         ("D:(A;;GA;;;S-1-5-21-0x1-0x2-0x3-513)",
 602          "D:(A;;GA;;;S-1-5-21-1-2-3-513)"),
 603         ("D:(A;;GA;;;S-1-5-21-2447931902-1787058256-3961074038-0x4b1)",
 604          "D:(A;;GA;;;S-1-5-21-2447931902-1787058256-3961074038-1201)"),
 605
 606         # ambiguous 'D', looks like part of the SID but isn't
 607         ("O:S-1-2-0x200D:", "O:S-1-2-512D:"),
 608         ("O:S-1-2-0x2D:(A;;GA;;;LG)", "O:S-1-2-2D:(A;;GA;;;LG)"),
 609
 610         # like the 'samba3.blackbox.large_acl.NT1' test in
 611         # WindowsFlagsAreDifferent below, except using numeric flags
 612         # that can't easily be turned into symbolic flags. Also it is
 613         # longer, and uses different flags for each ACE.
 614         (("D:(A;;0x00654321;;;WD)" +
 615           ''.join(f"(A;;0x00abc{i:03};;;S-1-5-21-11111111-22222222-33333333-{i})"
 616                   for i in range(101, 601))),
 617          ("D:(A;;0x654321;;;WD)" +
 618           ''.join(f"(A;;0xabc{i:03};;;S-1-5-21-11111111-22222222-33333333-{i})"
 619                   for i in range(101, 601)))
 620          ),
 621
 622         # Windows allows a space in the middle of access flags
 623         ("D:AI(A;CI;RP LCLORC;;;AU)", "D:AI(A;CI;LCRPLORC;;;AU)"),
 624         ("D:AI(A;CI;RP LCLO  RC;;;AU)", "D:AI(A;CI;LCRPLORC;;;AU)"),
 625         # space before string flags is ignored.
 626         ("D:(A;; GA;;;LG)", "D:(A;;GA;;;LG)"),
 627         ("D:(A;; 0x75bcd15;;;LG)", "D:(A;;0x75bcd15;;;LG)"),
 628
 629         # from 'samba3.blackbox.large_acl.NT1.able to retrieve a large ACL if VFS supports it'
 630         (("D:(A;;0x001f01ff;;;WD)" +
 631           ''.join(f"(A;;0x001f01ff;;;S-1-5-21-11111111-22222222-33333333-{i})"
 632                   for i in range(1001, 1201))),
 633          ("D:(A;;FA;;;WD)" +
 634           ''.join(f"(A;;FA;;;S-1-5-21-11111111-22222222-33333333-{i})"
 635                   for i in range(1001, 1201)))
 636          ),
 637
 638         # from samba4.blackbox.samba-tool_ntacl, but using 0x1f01ff in place of FA (which it will become)
 639         (("O:S-1-5-21-2212615479-2695158682-2101375468-512"
 640           "G:S-1-5-21-2212615479-2695158682-2101375468-513"
 641           "D:P(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375468-512)"
 642           "(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375468-519)"
 643           "(A;OICIIO;0x001f01ff;;;CO)"
 644           "(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375468-512)"
 645           "(A;OICI;0x001f01ff;;;SY)"
 646           "(A;OICI;0x001200a9;;;AU)"
 647           "(A;OICI;0x001200a9;;;ED)"
 648           "S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;"
 649           "bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 650           "(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;"
 651           "bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"),
 652          ("O:S-1-5-21-2212615479-2695158682-2101375468-512"
 653           "G:S-1-5-21-2212615479-2695158682-2101375468-513"
 654           "D:P(A;OICI;FA;;;S-1-5-21-2212615479-2695158682-2101375468-512)"
 655           "(A;OICI;FA;;;S-1-5-21-2212615479-2695158682-2101375468-519)"
 656           "(A;OICIIO;FA;;;CO)"
 657           "(A;OICI;FA;;;S-1-5-21-2212615479-2695158682-2101375468-512)"
 658           "(A;OICI;FA;;;SY)"
 659           "(A;OICI;0x1200a9;;;AU)"
 660           "(A;OICI;0x1200a9;;;ED)"
 661           "S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;"
 662           "bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 663           "(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;"
 664           "bf967aa5-0de6-11d0-a285-00aa003049e2;WD)")),
 665
 666         (("O:LAG:BAD:P(A;OICI;0x1f01ff;;;BA)"),
 667          ("O:LAG:BAD:P(A;OICI;FA;;;BA)")),
 668
 669         (("O:LAG:BAD:(A;;0x1ff;;;WD)",
 670           ("O:LAG:BAD:(A;;CCDCLCSWRPWPDTLOCR;;;WD)"))),
 671
 672         ("D:(A;;FAGX;;;SY)", "D:(A;;0x201f01ff;;;SY)"),
 673         # whitespace before ACL string flags is ignored.
 674         ("D: (A;;GA;;;LG)", "D:(A;;GA;;;LG)"),
 675         ("D: AI(A;;GA;;;LG)", "D:AI(A;;GA;;;LG)"),
 676         ("D: P(A;;GA;;;LG)", "D:P(A;;GA;;;LG)"),
 677         ("D: S:","D:S:"),
 678     ]
 679
 680
 681 @DynamicTestCase
 682 class SddlCanonical(SddlDecodeEncodeBase):
 683     """These ones are expected to be returned in exactly the form they
 684     start in. Hence we only have one string for each example.
 685     """
 686     name = "canonical"
 687     should_succeed = True
 688     strings = [
 689         # derived from GPO acl in provision, "-512D" could be misinterpreted
 690         ("O:S-1-5-21-1225132014-296224811-2507946102-512"
 691          "G:S-1-5-21-1225132014-296224811-2507946102-512"
 692          "D:P"),
 693         "D:(A;;GA;;;SY)",
 694         "D:(A;;GA;;;RU)",
 695         "D:(A;;GA;;;LG)",
 696         "D:(A;;0x401200a0;;;LG)",
 697         "D:S:",
 698         "D:PS:",
 699         'D:(A;;GA;;;RS)',
 700         "S:(AU;SA;CR;;;WD)(AU;SA;CR;;;WD)",
 701
 702         ("S:(OU;CISA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 703          "(OU;CISA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"),
 704
 705         "D:(A;;GA;;;S-1-3-4294967295-3-4)",
 706         "D:(A;;GA;;;S-1-5-21-1-2-3-513)",
 707         "D:(A;;GA;;;S-1-5-21-2447931902-1787058256-3961074038-1201)",
 708         "O:S-1-2-512D:",
 709         "D:PARAI(A;;GA;;;SY)",
 710         "D:P(A;;GA;;;LG)(A;;GX;;;AA)",
 711         "D:(A;;FA;;;WD)",
 712         "D:(A;;CCDCLCSWRPWPDTLOCR;;;WD)",
 713         "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)"
 714
 715     ]
 716
 717
 718 @DynamicTestCase
 719 class SddlShouldFail(SddlDecodeEncodeBase):
 720     """These ones should be rejected.
 721     """
 722     name = "should_fail"
 723     should_succeed = False
 724     strings = [
 725         "Z:(A;;GA;;;SY)",
 726         "D:(Antlers;;GA;;;SY)",
 727         "Q:(A;;GA;;;RU)",
 728         "d:(A;;GA;;;LG)",
 729         "D:((A;;GA;;;LG))",
 730         "D:(A;;GA;;)",
 731         "D :S:",
 732         "S:(AU;SA;CROOO;;;WD)(AU;SA;CR;;;WD)",
 733         "D:(A;;GA;;;S-1-0x1313131313131-513)",
 734         "D:(A;;GA;a;;S-1-5-21-2447931902-1787058256-0x3961074038-1201)",
 735         "D:(A;;GA;a;;S-1-5-21-2447931902-1787058256-0xec193176-1201)",
 736         ("S:(OOU;CISA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 737          "(OU;CISA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"),
 738         ("S:(OU;CISA;WP;f30e3bbe-9ff0-11d1-b603-00potato7c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 739          "(OU;CISA;WP;f30e3bbf-9ff0-11d1-b603-00chips7c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"),
 740         "D:P:S:",
 741         "D:(Ā;;GA;;;LG)", # macron on Ā
 742
 743         # whitespace around flags
 744         "D:(A;;123456789 ;;;LG)",
 745         "D:(A;;0x75bcd15\t;;;LG)",
 746         "D:(A;; 0x75bcd15;;;LG",
 747         "D:(A;;0x 75bcd15;;;LG)",
 748         # Windows accepts space before string flags, not after.
 749         "D:(A;;GA ;;;LG)",
 750         "D:(A;;RP ;;;LG)",
 751         # wrong numbers of ';'
 752         "D:(A;;GA;;;LG;)",
 753         "D:(A;;GA;;;LG;;)",
 754         "D:(A;;GA)",
 755         f"D:(A;{';' * 10000})",
 756
 757         # space after SID is bad
 758         # but Windows accepts space before SID, after 2-letter SID
 759         "D:(A;;GA;;;S-1-3-4 )",
 760
 761         "D:(A;;GA; f30e3bbf-9ff0-11d1-b603-0000f80367c1;;WD)",
 762         "D:(A;;GA;f30e3bbf-9ff0-11d1-b603-0000f80367c1 ;;WD)",
 763         "D:(A;;GA;; f30e3bbf-9ff0-11d1-b603-0000f80367c1;WD)",
 764         "D:(A;;GA;;f30e3bbf-9ff0-11d1-b603-0000f80367c1 ;WD)",
 765
 766         # Samba used to use GUID_from_string(), which would take
 767         # anything GUID-ish, including {}-wrapped GUIDs, hyphen-less
 768         # hexstrings, and 16 raw bytes. But we only want one kind.
 769         "D:(A;;GA;;{f30e3bbf-9ff0-11d1-b603-0000f80367c1};WD)",
 770         # would have been treated as raw bytes.
 771         "D:(A;;GA;;0123456789abcdef;WD)",
 772         # would have been 16 hex pairs.
 773         "D:(A;;GA;;0123456789abcdef0123456789abcdef;WD)",
 774
 775         # space splits a flag in half.
 776         "D:AI(A;CI;RP LCLOR C;;;AU)",
 777         # tabs in flags
 778         "D:AI(A;CI;RP LC\tLORC;;;AU)",
 779         "D:AI(A;CI;RP LC\t LORC;;;AU)",
 780
 781         # incomplete SIDs
 782         "O:S",
 783         "O:S-",
 784         "O:S-1",
 785         "O:S-10",
 786         "O:S-0",
 787         "O:S-1-",
 788         "O:S-0x1",
 789         "O:S-0x1-",
 790
 791         "O:",
 792         "O:XX",
 793
 794         "D:("
 795         "D:()"
 796         "D:())"
 797         "D:(A;;0x75bcd15;;;LG))",
 798     ]
 799
 800
 801 @DynamicTestCase
 802 class SddlWindowsIsFussy(SddlDecodeEncodeBase):
 803     """Windows won't accept these strings, seemingly for semantic rather than
 804     syntactic reasons.
 805     """
 806     name = "windows_is_fussy"
 807     should_succeed = True
 808     strings = [
 809         # Windows doesn't seem to want AU type in DACL.
 810         ("D:(A;;RP;;;WD)"
 811          "(AU;SA;CR;;;BA)"
 812          "(AU;SA;CR;;;DU)"),
 813     ]
 814
 815
 816 @DynamicTestCase
 817 class SddlWindowsIsLessFussy(SddlDecodeEncodeBase):
 818     """Windows will accept these seemingly malformed strings, but Samba
 819     won't.
 820     """
 821     name = "windows_is_less_fussy"
 822     should_succeed = False
 823     strings = [
 824         # whitespace is ignored, repaired on return
 825         ("D:(A;;GA;;; LG)", "D:(A;;GA;;;LG)"),
 826         # wrong case on type is ignored, fixed
 827         ("D:(a;;GA;;;LG)", "D:(A;;GA;;;LG)"),
 828         ("D:(A;;GA;;;lg)", "D:(A;;GA;;;LG)"),
 829         ("D:(A;;ga;;;LG)", "D:(A;;GA;;;LG)"),
 830
 831         # whitespace around ACL flags
 832         ("D:P (A;;GA;;;LG)", "D:P(A;;GA;;;LG)"),
 833
 834         # whitespace between ACES
 835         ("D:P(A;;GA;;;LG) (A;;GX;;;AA)",
 836          "D:P(A;;GA;;;LG)(A;;GX;;;AA)"),
 837
 838         # whitespace in absent ace flags
 839         ("D:(A; ;GA;;;LG)","D:(A;;GA;;;LG)"),
 840
 841         # space after ACL flags
 842         ("D:AI (A;;GA;;;LG)", "D:AI(A;;GA;;;LG)"),
 843
 844         # and more whitespace.
 845         ("D:(A;;GA;;; WD)", "D:(A;;GA;;;WD)"),
 846         ("D:(A;;GA;;;WD )", "D:(A;;GA;;;WD)"),
 847         ("D:(A;;GA;;; S-1-3-4)", "D:(A;;GA;;;OW)"),
 848         ("D:(A;;GA;; ;S-1-3-4)", "D:(A;;GA;;;OW)"),
 849         ("D:(A;;GA; ;;S-1-3-4)", "D:(A;;GA;;;OW)"),
 850         ("D:(A;;GA;;; S-1-333-4)", "D:(A;;GA;;;S-1-333-4)"),
 851         ("D:(A;;GA; ;;S-1-333-4)", "D:(A;;GA;;;S-1-333-4)"),
 852         (" O:AA", "O:AA"),
 853         ("  O:AA  ", "O:AA"),
 854         ("  O:AA G:WD ", "O:AAG:WD"),
 855
 856         # spaces in some parts of the SID (not subauth)
 857         ("O:S- 1- 2-3", "O:S-1-2-3"),
 858     ]
 859
 860
 861 @DynamicTestCase
 862 class SddlWindowsIsWeird(SddlDecodeEncodeBase):
 863     """Windows will accept some very misleading SDDL strings.
 864     """
 865     name = "windows_is_weird"
 866     should_succeed = False
 867     strings = [
 868         # overflow of hex turns on all flags
 869         ("D:(A;;0x123456789;;;LG)",
 870          "D:(A;;0xffffffff;;;LG)"),
 871         # S-Ox1- makes all the rest of the SID hex.
 872         ('D:(A;;CC;;;S-0x1-0-0-579)',
 873          'D:(A;;CC;;;S-1-0-0-1401)'),
 874         ('O:S-0x1-20-0-579', 'O:S-1-32-0-1401'),
 875         ("D:(A;;GA;;;S-1-3-4294967296-3-4)",
 876          "D:(A;;GA;;;S-1-3-4294967295-3-4)"),
 877         # sid overflow
 878         ("D:(A;;GA;;;S-1-3-0x100000000-3-4)",
 879          "D:(A;;GA;;;S-1-3-4294967295-3-4)"),
 880         ("D:(A;;GA;;;S-1-5-21-0x1313131313131-513)",
 881          "D:(A;;GA;;;S-1-5-21-4294967295-513)"),
 882         # negative numbers for access flags
 883         ("D:(A;;-99;;;LG)",
 884          "D:(A;;0xffffff9d;;;LG)"),
 885         ("D:(A;;-0xffffff55;;;LG)",
 886          "D:(A;;CCDCSWWPLO;;;LG)"),
 887         # combine overflow with negatives
 888         # -9876543210 == -0xffffffff  ==  -(-1)  ==  0x1  ==  CC flag
 889         ("D:(A;;-9876543210;;;LG)",
 890          "D:(A;;CC;;;LG)"),
 891         # overflow of hex turns on all flags
 892         ("D:(A;;100000000000000000000000;;;LG)",
 893          "D:(A;;0xffffffff;;;LG)"),
 894     ]