mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 10:26:52 +01:00
Matt RichardsonandClaude Fable 5.1
0f767ce529
Add support for accessing the previously ssh-only debug commands via `nebula ctl <command>.` - unix socket (named pipe on windows) for communication - sockets scoped to the user + an optional group - in cmd/nebula and cmd/nebula-service, but not nebula.Main Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
45 lines
1.6 KiB
Go
45 lines
1.6 KiB
Go
//go:build windows
|
|
|
|
package localapi
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"golang.org/x/sys/windows"
|
|
)
|
|
|
|
// TestLookupGroupIDOnWindows: an account name resolves to its SID, a SID written out
|
|
// is accepted as it is, and an account the host does not know is reported.
|
|
func TestLookupGroupIDOnWindows(t *testing.T) {
|
|
users, err := windows.CreateWellKnownSid(windows.WinBuiltinUsersSid)
|
|
require.NoError(t, err)
|
|
|
|
got, err := lookupGroupID("Users")
|
|
require.NoError(t, err)
|
|
assert.Equal(t, users.String(), got)
|
|
|
|
got, err = lookupGroupID(users.String())
|
|
require.NoError(t, err)
|
|
assert.Equal(t, users.String(), got)
|
|
|
|
_, err = lookupGroupID("no-such-account-nebula-test")
|
|
require.ErrorContains(t, err, "does not exist")
|
|
}
|
|
|
|
// TestSDDLAdmitsTheGroup: the descriptor is the owner, SYSTEM and Administrators with
|
|
// full access, plus the group with what a client needs and nothing generic, so a
|
|
// member cannot create an instance of the pipe; see pipeClientAccess.
|
|
func TestSDDLAdmitsTheGroup(t *testing.T) {
|
|
sddl, err := sddlFor(ownerOnly())
|
|
require.NoError(t, err)
|
|
assert.NotContains(t, sddl, "S-1-5-32-545")
|
|
|
|
sddl, err = sddlFor(Access{Mode: groupSocketMode, Group: Group{Name: "Users", ID: "S-1-5-32-545"}})
|
|
require.NoError(t, err)
|
|
assert.Contains(t, sddl, "(A;;GA;;;SY)(A;;GA;;;BA)(A;;0x120083;;;S-1-5-32-545)")
|
|
assert.Zero(t, pipeClientAccess&windows.FILE_APPEND_DATA, "FILE_APPEND_DATA is FILE_CREATE_PIPE_INSTANCE on a pipe")
|
|
assert.Zero(t, pipeClientAccess&(windows.GENERIC_READ|windows.GENERIC_WRITE|windows.GENERIC_ALL))
|
|
}
|