File: //usr/lib/python3/dist-packages/samba/tests/krb5/__pycache__/s4u_tests.cpython-310.pyc
o
eF�cU� � @ s d dl Z d dlZe j�d d� dejd< d dlZd dlmZmZ d dl m
Z
m Z d dl m
Z
d dlmZmZ d d lmZ d d
lmZmZ d d lmZmZmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ d dl%m& m' m(Z) d Z*d Z+G d
d� de�Z,e-dkr�d Z*d Z+d dl.Z.e.�/� dS dS )� Nz
bin/python�1�PYTHONUNBUFFERED)�dsdb�ntstatus)�krb5pac�lsa)�env_get_var_value)� Cksumtype�Enctype)� KDCBaseTest)�RodcPacEncryptionKey�ZeroedChecksumKey)�AES256_CTS_HMAC_SHA1_96�ARCFOUR_HMAC_MD5�KDC_ERR_BADMATCH�KDC_ERR_BADOPTION�KDC_ERR_BAD_INTEGRITY�KDC_ERR_GENERIC�KDC_ERR_INAPP_CKSUM�KDC_ERR_MODIFIED�KDC_ERR_SUMTYPE_NOSUPP�KDC_ERR_TGT_REVOKED�KU_PA_ENC_TIMESTAMP�KU_AS_REP_ENC_PART�KU_TGS_REP_ENC_PART_SUB_KEY� NT_PRINCIPALFc s: e Zd Z� fdd�Zd�dd�Zdd� Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dLdM� Z(dNdO� Z)dPdQ� Z*dRdS� Z+dTdU� Z,dVdW� Z-dXdY� Z.dZd[� Z/d\d]� Z0d^d_� Z1d`da� Z2dbdc� Z3ddde� Z4dfdg� Z5dhdi� Z6djdk� Z7e8j9e8j:e8j;hZ<dldm� Z=dndo� Z>dpdq� Z?drds� Z@dtdu� ZAdvdw� ZBdxdy� ZCdzd{� ZDd|d}� ZEd~d� ZFd�d�d��ZGd�d�d��ZHd�d�� ZI� ZJS )��S4UKerberosTestsc s t t| ��� t| _t| _d S �N)�superr �setUp�global_asn1_print�
do_asn1_print�global_hexdump�
do_hexdump��self�� __class__� �</usr/lib/python3/dist-packages/samba/tests/krb5/s4u_tests.pyr = s
zS4UKerberosTests.setUpNc C s\ | � � }|�� }|�� }| jd|gd�}| jdd|gd�}| jdd�}t�d�}d } d}
| j| t|�|||d |d d |
d d d
� } | � | �} | �
| � | � | d d � | � | d
d� | j | d t�
� d�}
|
D ]}|d dkrt|d } nqf| j |t�� d�}| �||d �}| �� \}}| �||�}| j|t�� d�}| �|t|�}| j|t�� d�}| �d|�}t�d�}|g} | j| t|�|||d |d d |
d d d
� } | � | �} | �
| � | d }| � |d� |�t| d d �}z | j |t�� d�}W n t�y | j |t� � d�}Y nw |}t d�}| jd|gd�}t�d�}| jdd�}| d }| � |d �}| j ||||d�}|g} | � |j!�}| �� \} } | j"d0i d | �d | �d | �d|�d t|��d |�d!|�d"|�d#d �d$|�d%d �d&d'�d(|
�d)d �d*d �d+d �d,d �d-|�d.|��} | � | �} | �
| � | d }|d/k�r�|�t#| d d �}| j |t� � d�}|S )1N� �� name_type�names� �krbtgti�� )�offset� forwardable)� � � i���) �padata� kdc_options�cname�realm�sname� from_time� till_time�
renew_time�nonce�etypes� addresses�additional_ticketszmsg-type� z
error-code� ze-data)�asn1Specz padata-type� z padata-valuer � zenc-part�cipher�FOR_USER�ticket�key��namer8 �tgt_session_key�ctyper5 �cusec�ctimer6 r7 r8 r9 r: r; r< r= i���r> r? �EncAuthorizationData�EncAuthorizationData_keyr@ �ticket_session_key�authenticator_subkey�
r( )$�get_service_creds� get_username� get_realm�PrincipalName_create�get_KerberosTime� krb5_asn1�
KDCOptions�
AS_REQ_create�str�send_recv_transaction�assertIsNotNone� assertEqual�
der_decode� METHOD_DATA� ETYPE_INFO2� PasswordKey_from_etype_info2�get_KerberosTimeWithUsec�PA_ENC_TS_ENC_create�
der_encode�
PA_ENC_TS_ENC�EncryptedData_creater �
EncryptedData�PA_DATA_create�decryptr � EncASRepPart� Exception�
EncTGSRepPartr �EncryptionKey_import�PA_S4U2Self_create� RandomKey�etype�TGS_REQ_creater ) r% �pa_s4u2self_ctype�
service_creds�servicer8 r7 r9 �tillr6 r5 r> �req�rep�
rep_padata�pa� etype_info2rI �patime�pausec�pa_ts�msg_type� enc_part2�
for_user_name�unamerH rR �pa_s4u�subkeyrO rN r( r( r) �_test_s4u2selfB s
�
� ��
�
�
��
� �������� �
� � �
������
��z S4UKerberosTests._test_s4u2selfc C s | � � }| �|d� d S )NrT )r� r` �r% r� r( r( r) �
test_s4u2self� s z S4UKerberosTests.test_s4u2selfc C � | j tjd�}| �|d� d S )N�ru rT )r� r �HMAC_MD5r` r� r( r( r) � test_s4u2self_hmac_md5_checksum� � z0S4UKerberosTests.test_s4u2self_hmac_md5_checksumc C r� �Nr� rA )r� r �MD5r` r� r( r( r) �"test_s4u2self_md5_unkeyed_checksum� r� z3S4UKerberosTests.test_s4u2self_md5_unkeyed_checksumc C r� r� )r� r �SHA1r` r� r( r( r) �#test_s4u2self_sha1_unkeyed_checksum� r� z4S4UKerberosTests.test_s4u2self_sha1_unkeyed_checksumc C r� r� )r� r �CRC32r` r� r( r( r) �$test_s4u2self_crc32_unkeyed_checksum� r� z5S4UKerberosTests.test_s4u2self_crc32_unkeyed_checksumc s| |� dd �}�j�jj|d�}|� dd �}�j�jj|d�}��|��|� dd �}|d ur1|���|�� }�jt|gd�� �� � }|�
� } �� || �}
|� dd �} | d u r]|�� d d� } �jtd| gd�} |� � �|� d d �}
|
d uryt
�|
�}
|� d
d �}|d ur�t
�|�}|� d d �}|� d
d �}|r��j}d }n
d }�j}��|� |� dd�}t
�|�}��|�}��tj�}|� dttf�}|� dd �}� ���fdd�}�jd'i d��d� �d��d| �d|�d|
�d |
�d
|�d|�dd �d |�d |�d |�d �j�d |�d
|�d!��d"|�dt|��d#d$�d|��}�j |d �| |d%� |�s6|d& }�� |�}�� |� �� i |� d S )(N� client_opts�� account_type�opts� service_opts�modify_service_tgt_fnr+ � service_name����host�expected_flags�unexpected_flags�expected_error_moder �expected_statusr6 �0r> � expect_edatac s �j � ��jd d�}|g|fS )NrJ )rq � session_key)�_kdc_exchange_dict�_callback_dict�req_bodyr� �� client_cnamer8 r% � service_tgtr( r) �generate_s4u2self_padata s �
zES4UKerberosTests._run_s4u2self_test.<locals>.generate_s4u2self_padata�expected_crealm�expected_cname�expected_srealm�expected_sname�expected_account_name� expected_sid�ticket_decryption_key�expect_ticket_checksumT�generate_padata_fn�check_error_fn� check_rep_fn�check_kdc_private_fn�tgtrS �
expect_claimsF)r7 r8 r9 r> �rep_ticket_credsr( ) �pop�get_cached_creds� AccountType�USER�COMPUTER�get_tgtrV rX r � get_samdb�get_dn�
get_objectSidrW rZ � TicketFlags�generic_check_kdc_error�generic_check_kdc_rep� assertIsNoner[ � TicketDecryptionKey_from_credsrr r
�AES256r r �tgs_exchange_dict�generic_check_kdc_privater] �_generic_kdc_exchange�get_ticket_pacr_ r` ) r% �kdc_dictr� � client_credsr� rv r� � client_name�samdb� client_dn�sidr� �
service_snamer� r� r� r� r� r� r6 �service_decryption_keyrS r> r� r� �kdc_exchange_dictrH �pacr( r� r) �_run_s4u2self_test� s� � �
� �
� �
�������� �
� � �
����������
z#S4UKerberosTests._run_s4u2self_testc C s( | � ddidtj| jdd�dd�� d S )N�
not_delegatedFr1 T��flag)r� r6 r� r� �r� � functools�partial�set_ticket_forwardabler$ r( r( r) �test_s4u2self_forwardableT � ����z*S4UKerberosTests.test_s4u2self_forwardablec s, � fdd�}� � tddid|ddd�� d S )Nc s � j | dd�} � �| �S )NTr� )r� �remove_ticket_pac)rH r$ r( r) �forwardable_no_pacc s
zAS4UKerberosTests.test_s4u2self_no_pac.<locals>.forwardable_no_pacr� Fr1 )r� r� r6 r� r� r� )r� r )r% r� r( r$ r) �test_s4u2self_no_pacb s ���z%S4UKerberosTests.test_s4u2self_no_pacc C s& | � dditj| jdd�dd�� d S )Nr� FTr� r1 )r� r� r� r� r$ r( r( r) �!test_s4u2self_without_forwardableu s ����z2S4UKerberosTests.test_s4u2self_without_forwardablec C �( | � ddidtj| jdd�dd�� d S )Nr� Fr1 r� �r� r6 r� r� r� r$ r( r( r) � test_s4u2self_not_forwardable� r� z.S4UKerberosTests.test_s4u2self_not_forwardablec C r� )Nr� Tr1 r� r� r� r$ r( r( r) �"test_s4u2self_client_not_delegated� r� z3S4UKerberosTests.test_s4u2self_client_not_delegatedc C �0 | � ddiddd�dtj| jdd�dd�� d S ) Nr� Fr( �� trusted_to_auth_for_delegation�delegation_to_spnr1 Tr� �r� r� r6 r� r� r� r$ r( r( r) �'test_s4u2self_not_trusted_empty_allowed� � �����z8S4UKerberosTests.test_s4u2self_not_trusted_empty_allowedc C r� ) Nr� F��testr� r1 Tr� )r� r� r6 r� r� r� r$ r( r( r) �*test_s4u2self_not_trusted_nonempty_allowed� r� z;S4UKerberosTests.test_s4u2self_not_trusted_nonempty_allowedc C �0 | � ddiddd�dtj| jdd�dd�� d S ) Nr� FTr( r� r1 r� r� r� r$ r( r( r) �#test_s4u2self_trusted_empty_allowed� r� z4S4UKerberosTests.test_s4u2self_trusted_empty_allowedc C r� ) Nr� FTr� r� r1 r� r� r� r$ r( r( r) �&test_s4u2self_trusted_nonempty_allowed� r� z7S4UKerberosTests.test_s4u2self_trusted_nonempty_allowedc C sZ | j | jjddd�d�}|�� d d� }| �tdddiddi|d tj| jdd
�d �� d S ) NTr )r� �idr� r� Fr� r� r1 r� )r� r� r� r� r� r6 r� ) r� r� r� rV r� r r� r� r� )r% � other_creds� other_snamer( r( r) �test_s4u2self_wrong_sname� s* �������z*S4UKerberosTests.test_s4u2self_wrong_snamec C s0 | � ddiddd�dtj| jdd�dd�� d S )Nr� FT)r� �no_auth_data_requiredr1 r� r� r� r$ r( r( r) �#test_s4u2self_no_auth_data_required r� z4S4UKerberosTests.test_s4u2self_no_auth_data_requiredc 0 C s� |� dd �}| j| jj|d�}| �� }|�� }| �||�}|� di �}|� di �}|� dd�} |� dd�}
| �| o:|
� |
r_| j| jj|d�} | � d|� t
| �� �|d< | j| jj|d�} n | j| jj|d�} | rv| � d |� | � � |d < | j| jj|d�} |� d
d �}
t �
|
�}| j||
|d �}| j|| |
|d �}| �| �}|� d
d �}|d ur�||�}|jg}|� dd �}|d ur�||�}|� dd �}|d u r�t
t �d��}|�� }|�� }| jt|gd�}| �� d d� }| �� }| �� d d� }| �� } d} | jt| |gd�} | �| �} | j} |� d�}!|� dd �}"|!�r | j}#d }$n
d }#| j}$| �|"� |� dd �}%|%d u�r:| �|!� |� dd �}&| � t j �}'|� dt t f�}(| � � })|� dg �}*d|� d|� �}+|*�!|+� |� d d �},| j"d0i d |�d |�d | �d!| �d"|�d#|�d$| �d%| �d&|#�d'|$�d(| j#�d|!�d|"�d)i �d*|�d+|'�d|�d|&�d|%�d,|)�d|*�d |,��}-| j$|-d | | |(|d-� |!�s�|-d. }.| j%|.|,d/�}/|,�r�| �&|/� n| �|/� | �'i |� d S )1Nr� r� �
service1_opts�
service2_opts�allow_delegationF�
allow_rbcd�delegation_from_dnr� �client_tkt_optionsr1 )r6 r� �modify_client_tkt_fnr� r6 zcname-in-addl-tktr+ r� r� r� r� r� � pac_optionsr> �expected_transited_serviceszhost/�@�
expect_pacTr� r� r� r� r� r� �expected_supported_etypesr� r� r� r� �
callback_dictr� rS �expected_proxy_target)r7 r8 r9 r> r@ r� )r r( )(r� r� r� r� r� r� r� � assertFalser� � assertNotInr] �get_spnrZ r� r� �get_service_ticketrH r[ rV rW rX r r� �tgs_supported_enctypesr� r� r� �
assertTruerr r
r� r r �appendr� r� r� r� r_ r` )0r% r� r� r� r� r� r� r� r� r r �service1_creds�service2_credsr r� �
client_tgt�client_service_tkt� service1_tgtr r@ r� r6 �client_username� client_realmr� �
service1_name�service1_realm�
service2_name�service2_realm�service2_service�service2_sname�service2_decryption_key�service2_etypesr� r� r� r� r� r rS r> r r �transited_servicer r� rH r� r( r( r) �_run_delegation_test s> � � �� �
��
����
��
�������� �
� � �
�����������
z%S4UKerberosTests._run_delegation_testc C s. | � � }| �|�}|tjk r| �d� d S d S )NzRBCD requires FL2008)r� �get_domain_functional_levelr �DS_DOMAIN_FUNCTION_2008�skipTest)r% r� �functional_levelr( r( r) �skip_unless_fl2008� s
�z#S4UKerberosTests.skip_unless_fl2008c C s | � ddd�� d S )Nr T)r� r �r# r$ r( r( r) �test_constrained_delegation� s
��z,S4UKerberosTests.test_constrained_delegationc C s | � ddddidd�� d S )Nr Tr� F)r� r r� r r) r$ r( r( r) �1test_constrained_delegation_no_auth_data_required� s ���zBS4UKerberosTests.test_constrained_delegation_no_auth_data_requiredc C s, g d�}| � ddtj| j|d�|d�� d S )N��service1�service2�service3r T��services)r� r r r )r# r� r� �add_delegation_info�r% r1 r( r( r) �4test_constrained_delegation_existing_delegation_info� s ���zES4UKerberosTests.test_constrained_delegation_existing_delegation_infoc C s | � ttjdd�� d S )NF)r� r� r )r# r r �NT_STATUS_NOT_SUPPORTEDr$ r( r( r) �'test_constrained_delegation_not_allowed� s ��z8S4UKerberosTests.test_constrained_delegation_not_allowedc C s | � ttfd| jdd�� d S )NTF�r� r r r� )r# r r r� r$ r( r( r) �)test_constrained_delegation_no_client_pac� s ���z:S4UKerberosTests.test_constrained_delegation_no_client_pacc C s | � td| jdd�� d S )NTF)r� r r� r� �r# r r� r$ r( r( r) �*test_constrained_delegation_no_service_pac� s ��z;S4UKerberosTests.test_constrained_delegation_no_service_pacc C s$ | � ttfd| jdddid�� d S )NTFr� )r� r r r� r� )r# r r r� r$ r( r( r) �?test_constrained_delegation_no_client_pac_no_auth_data_required s ����zPS4UKerberosTests.test_constrained_delegation_no_client_pac_no_auth_data_requiredc C s" | � td| jddiddd�� d S )NTr� F)r� r r� r� r r� r9 r$ r( r( r) �@test_constrained_delegation_no_service_pac_no_auth_data_required s ���zQS4UKerberosTests.test_constrained_delegation_no_service_pac_no_auth_data_requiredc C s& | � ttjdtj| jdd�d�� d S )NTFr� )r� r� r r )r# r r � NT_STATUS_ACCOUNT_RESTRICTIONr� r� r� r$ r( r( r) �+test_constrained_delegation_non_forwardable s ���z<S4UKerberosTests.test_constrained_delegation_non_forwardablec C s | � dddd�� d S )Nr �0001T)r� r r r) r$ r( r( r) �,test_constrained_delegation_pac_options_rbcd+ s ��z=S4UKerberosTests.test_constrained_delegation_pac_options_rbcdc C s& | � � | �dddddidd�� d S )Nr Tr? r� F)r� r r r� r )r( r# r$ r( r( r) � test_rbcd_no_auth_data_required5 s ���z0S4UKerberosTests.test_rbcd_no_auth_data_requiredc C s6 | � � g d�}| �dddtj| j|d�|d�� d S )Nr, r Tr? r0 )r� r r r r )r( r# r� r� r2 r3 r( r( r) �"test_rbcd_existing_delegation_infoC s ���z3S4UKerberosTests.test_rbcd_existing_delegation_infoc C s | � ttjddd�� d S )NFr? �r� r� r r )r# r r �NT_STATUS_NOT_FOUNDr$ r( r( r) �test_rbcd_not_allowedU s ��z&S4UKerberosTests.test_rbcd_not_allowedc C s& | � � | �ttjdd| jd�� d S �NTr? �r� r� r r r �r( r# r r r5 r� r$ r( r( r) �test_rbcd_no_client_pac_a` s ��z*S4UKerberosTests.test_rbcd_no_client_pac_ac C s, | � � | �ttjdd| jddid�� d S )NTr? r� � host/test)r� r� r r r r� �r( r# r r �NT_STATUS_NO_MATCHr� r$ r( r( r) �test_rbcd_no_client_pac_bn � ���z*S4UKerberosTests.test_rbcd_no_client_pac_bc C s$ | � � | �tdd| jdd�� d S )NTr? F)r� r r r� r� �r( r# r r� r$ r( r( r) �test_rbcd_no_service_pac s ��z)S4UKerberosTests.test_rbcd_no_service_pacc C s, | � � | �ttjdd| jddid�� d S )NTr? r� )r� r� r r r r� rH r$ r( r( r) �/test_rbcd_no_client_pac_no_auth_data_required_a� rN z@S4UKerberosTests.test_rbcd_no_client_pac_no_auth_data_required_ac
C s2 | � � | �ttjdd| jddiddid�� d S )NTr? r� rJ r� )r� r� r r r r� r� rK r$ r( r( r) �/test_rbcd_no_client_pac_no_auth_data_required_b� s ����z@S4UKerberosTests.test_rbcd_no_client_pac_no_auth_data_required_bc C s* | � � | �tdd| jddidd�� d S )NTr? r� F)r� r r r� r� r� rO r$ r( r( r) �.test_rbcd_no_service_pac_no_auth_data_required� s ���z?S4UKerberosTests.test_rbcd_no_service_pac_no_auth_data_requiredc
C s0 | � � | �ttjddtj| jdd�d�� d S )NTr? Fr� rG )r( r# r r r= r� r� r� r$ r( r( r) �test_rbcd_non_forwardable� s ���z*S4UKerberosTests.test_rbcd_non_forwardablec C s" | � � | �ttjddd�� d S )NTr rC )r( r# r r r5 r$ r( r( r) �test_rbcd_no_pac_options_a� s ��z+S4UKerberosTests.test_rbcd_no_pac_options_ac C s( | � � | �ttjddddid�� d S )NTr r� rJ )r� r� r r r� )r( r# r r rL r$ r( r( r) �test_rbcd_no_pac_options_b� s ���z+S4UKerberosTests.test_rbcd_no_pac_options_bc
C s, | � ttfddtj| jddd�dd�� d S )NTr� F�r� �update_pac_checksums)r� r r r r� )r# r r r� r� r� r$ r( r( r) �3test_bronze_bit_constrained_delegation_old_checksum� s ����zDS4UKerberosTests.test_bronze_bit_constrained_delegation_old_checksumc C s8 | � � | �ttftjdddtj| jddd�d�� d S )NTr? r� FrW )r� r� r r r r ) r( r# r r r r5 r� r� r� r$ r( r( r) �!test_bronze_bit_rbcd_old_checksum� s ����z2S4UKerberosTests.test_bronze_bit_rbcd_old_checksumc
C st | j D ]4}| j|d��$ |tjkrttf}nt}| �|dtj | j
|d�dd�� W d � n1 s2w Y qd S �N��checksumTFr7 ) �pac_checksum_types�subTestr �PAC_TYPE_TICKET_CHECKSUMr r r r# r� r� �remove_pac_checksum�r% r] r� r( r( r) �3test_constrained_delegation_missing_client_checksum s&
���� ���zDS4UKerberosTests.test_constrained_delegation_missing_client_checksumc C sd t jt jfD ])}| j|d�� | �ttjdtj | j
|d�d�� W d � n1 s*w Y qd S )Nr\ T�r� r� r r� ) r �PAC_TYPE_SRV_CHECKSUM�PAC_TYPE_KDC_CHECKSUMr_ r# r r � NT_STATUS_INSUFFICIENT_RESOURCESr� r� ra �r% r] r( r( r) �4test_constrained_delegation_missing_service_checksum" s ���� ���zES4UKerberosTests.test_constrained_delegation_missing_service_checksumc C s| | � � | jD ]4}| j|d��$ |tjkrt}nt}| �|tj ddt
j | j |d�d�� W d � n1 s6w Y qd S �Nr\ Tr? rG )
r( r^ r_ r r` r r r# r r5 r� r� ra rb r( r( r) �!test_rbcd_missing_client_checksum1 s&
��� ���z2S4UKerberosTests.test_rbcd_missing_client_checksumc C sn | � � tjtjfD ]*}| j|d�� | �ttjddt j
| j |d�d�� W d � n1 s/w Y q
d S )Nr\ Tr? �r� r� r r r� ) r( r re rf r_ r# r r rg r� r� ra rh r( r( r) �"test_rbcd_missing_service_checksumG s$ ���� ���z3S4UKerberosTests.test_rbcd_missing_service_checksumc
C s` | j D ]*}| j|d�� | �ttfdtj| j|d�dd�� W d � n1 s(w Y qd S r[ )r^ r_ r# r r r� r� �zeroed_pac_checksumrh r( r( r) �2test_constrained_delegation_zeroed_client_checksumY s
���� ���zCS4UKerberosTests.test_constrained_delegation_zeroed_client_checksumc C s~ | j D ]9}| j|d��) |tjkrttf}tj}nd}d }| �||dt j
| j |d�d�� W d � n1 s7w Y qd S )Nr\ r Trd ) r^ r_ r re r r r �NT_STATUS_WRONG_PASSWORDr# r� r� rn �r% r] r� r� r( r( r) �3test_constrained_delegation_zeroed_service_checksumg s*
���� ���zDS4UKerberosTests.test_constrained_delegation_zeroed_service_checksumc C sh | � � | jD ]*}| j|d�� | �ttjddtj| j |d�d�� W d � n1 s,w Y qd S rj )
r( r^ r_ r# r r r5 r� r� rn rh r( r( r) � test_rbcd_zeroed_client_checksum| s
��� ���z1S4UKerberosTests.test_rbcd_zeroed_client_checksumc C s� | � � | jD ]8}| j|d��( |tjkrt}tj}nd}d }| �||ddt j
| j |d�d�� W d � n1 s:w Y qd S )Nr\ r Tr? rl ) r( r^ r_ r re r r rp r# r� r� rn rq r( r( r) �!test_rbcd_zeroed_service_checksum� s*
��� ���z2S4UKerberosTests.test_rbcd_zeroed_service_checksumc C s� | j D ]C}| jD ]=}| j||d��, |tjkr!|tjkr!ttf}nt tf}| �
|dt j | j
||d�dd�� W d � n1 s@w Y qqd S )N�r] rM TFr7 )r^ �unkeyed_ctypesr_ r re r r� r r r r# r� r� �unkeyed_pac_checksum�r% r] rM r� r( r( r) �3test_constrained_delegation_unkeyed_client_checksum� s2
����� ����zDS4UKerberosTests.test_constrained_delegation_unkeyed_client_checksumc
C s� | j D ]N}| jD ]H}| j||d��7 |tjkr,|tjkr$ttf}t j
}n t tf}t j }nd}d }| �
||dtj| j||d�d�� W d � n1 sKw Y qqd S )Nru r Trd )r^ rv r_ r re r r� r r r �NT_STATUS_LOGON_FAILUREr rg r# r� r� rw �r% r] rM r� r� r( r( r) �4test_constrained_delegation_unkeyed_service_checksum� s<
������ ����zES4UKerberosTests.test_constrained_delegation_unkeyed_service_checksumc C s� | � � | jD ]A}| jD ];}| j||d��* |tjkr#|tjkr#t}nt }| �
|t j ddt
j| j||d�d�� W d � n1 sBw Y q qd S )Nru Tr? rG )r( r^ rv r_ r re r r� r r r# r r5 r� r� rw rx r( r( r) �!test_rbcd_unkeyed_client_checksum� s.
��� ����z2S4UKerberosTests.test_rbcd_unkeyed_client_checksumc C s� | � � | jD ]K}| jD ]E}| j||d��4 |tjkr,|tjkr&t}t j
}n
t }t j }nd}d }| �
||ddtj| j||d�d�� W d � n1 sLw Y q qd S )Nru r Tr? rl )r( r^ rv r_ r re r r� r r rz r rg r# r� r� rw r{ r( r( r) �"test_rbcd_unkeyed_service_checksum� s8
���� ����z3S4UKerberosTests.test_rbcd_unkeyed_service_checksumc C sL | � � }| �|�}|tjkrttf}d}nd}d }| �|d| j|d�� d S )NFr Tr7 )r� r$ r r% r r r# �rc4_pac_checksums)r% r� r' r� r� r( r( r) �/test_constrained_delegation_rc4_client_checksum s
���z@S4UKerberosTests.test_constrained_delegation_rc4_client_checksumc C s. | � � ttf}| �|tjdd| jd�� d S rF )r( r r r# r r5 r )r% r� r( r( r) � test_rbcd_rc4_client_checksum& s ���z.S4UKerberosTests.test_rbcd_rc4_client_checksumc C s | � � }| j|||did�S )NF��
checksum_keys�include_checksums��get_krbtgt_checksum_key�modified_ticket)r% rH r] r� r( r( r) ra 6 s
�z$S4UKerberosTests.remove_pac_checksumc C sh | � � }| �|�}|j}tj|tj|tj|i}|tjkr |}n|}t|j|j �||< | j
|||did�S �NTr� ) �get_krbtgt_credsr� �decryption_keyr re rf r` r
rI �kvnor� )r% rH r] � krbtgt_creds�
krbtgt_key�
server_keyr� �
zeroed_keyr( r( r) rn = s"
�
��z$S4UKerberosTests.zeroed_pac_checksumc
C sl | � � }| �|�}|j}tj|tj|tj|tj|i}|| }t|j |j
�} || _ | ||< | j |||did�S r� )
r� r� r� r re rf r` �PAC_TYPE_FULL_CHECKSUMr rI r� rM r� )
r% rH r] rM r� r� r� r� rI �new_keyr( r( r) rw U s
��z%S4UKerberosTests.unkeyed_pac_checksumc C sf | � � }| j|tjd�}|j}tj|tj|tj|tj |i}tjdtjdtjdtj di}| j
|||d�S )N)rs Tr� ) r� r� r
�RC4r� r re rf r` r� r� )r% rH r� �rc4_krbtgt_keyr� r� r� r( r( r) r l s& ����z"S4UKerberosTests.rc4_pac_checksumsc s& � �fdd�}� � � }� j|||d�S )Nc s� | j }� �tjdd� |D �� tttj���}t�� }t�d�|_ ||_
t |�|_ t�
� }||_t�� }tj|_||_|�|� || _ | jd7 _| S )Nc s s � | ]}|j V qd S r )�type)�.0�bufferr( r( r) � <genexpr>� s � zNS4UKerberosTests.add_delegation_info.<locals>.modify_pac_fn.<locals>.<genexpr>�test_proxy_targetr* )�buffersr
r � PAC_TYPE_CONSTRAINED_DELEGATION�list�mapr �String�PAC_CONSTRAINED_DELEGATION� proxy_target�transited_services�len�num_transited_services� PAC_CONSTRAINED_DELEGATION_CTR�info�
PAC_BUFFERr� r � num_buffers)r� � pac_buffersr� �
delegationr� �
pac_bufferr3 r( r) �
modify_pac_fn� s$ �
z;S4UKerberosTests.add_delegation_info.<locals>.modify_pac_fn)r� r� r� )r% rH r1 r� r� r( r3 r) r2 � s �z$S4UKerberosTests.add_delegation_infoTc C s6 t j| jd|d�}|r| �� }nd }| j||||d�S )Nr1 )r� �value)� modify_fnr� rX )r� r� �modify_ticket_flagr� r� )r% rH r� rX r� r� r( r( r) r� � s �
�z'S4UKerberosTests.set_ticket_forwardablec C s | j |dd�S )NT)� exclude_pac)r� )r% rH r( r( r) r� � s �z"S4UKerberosTests.remove_ticket_pacr )T)K�__name__�
__module__� __qualname__r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r# r( r* r+ r4 r6 r8 r: r; r< r> r@ rA rB rE rI rM rP rQ rR rS rT rU rV rY rZ rc ri rk rm ro rr rs rt r r� r� r� rv ry r| r} r~ r� r� ra rn rw r r2 r� r� �
__classcell__r( r( r& r) r ; s�
t
#
!r �__main__)0�sys�os�path�insert�environr� �sambar r � samba.dcerpcr r � samba.testsr �samba.tests.krb5.kcryptor r
� samba.tests.krb5.kdc_base_testr � samba.tests.krb5.raw_testcaser r
�"samba.tests.krb5.rfc4120_constantsr r r r r r r r r r r r r r � samba.tests.krb5.rfc4120_pyasn1�tests�krb5�rfc4120_pyasn1rZ r r" r r� �unittest�mainr( r( r( r) �<module> sB
@
�