FcHddlZddlZejdddejd<ddlmZddlmZddl m Z ddl m Z ddl Z dd lmZdd lmZdd lmZddlZdd lmZmZmZmZmZmZmZdd lmZmZddl m!Z!m"Z"m#Z#m$Z$ddl%m&Z&m'Z'ddl(m)Z)ddl*m+Z+m,Z,m-Z-ddl.m/Z/ddl0m1Z1ddl2m3Z3ddl4m5Z5ddl6m7cm8cm9Z:ddl;mZ>m?Z?m@Z@mAZAdZBdZCGddeZD d#dZEdZFdZGdZHdZIGd d!e3ZJeKd"krdZBdZCddlLZLeLjMdSdS)$Nz bin/python1PYTHONUNBUFFERED)futures)Enum)partial)Pipe)default_backend)Cipher) algorithms) NTSTATUSErrordsdbgenerate_random_bytesgenerate_random_passwordntstatus unix2nttimewerror)DONT_USE_KERBEROSMUST_USE_KERBEROS)!aead_aes_256_cbc_hmac_sha512_blobdes_crypt_blob_16 md4_hash_blob sha512_pbkdf2)lsasamr)SamDB) connect_samdbenv_get_var_value env_loadparm) AsReqBaseTest)kcrypto) KDCBaseTest)KerberosCredentials)KDC_ERR_CLIENT_REVOKEDKDC_ERR_PREAUTH_FAILED KRB_AS_REP KRB_ERROR NT_PRINCIPAL NT_SRV_INSTFceZdZdZdZdZdS)ConnectionResultN)__name__ __module__ __qualname__ LOCKED_OUTWRONG_PASSWORDSUCCESS@/usr/lib/python3/dist-packages/samba/tests/krb5/lockout_tests.pyr*r*MsJNGGGr5r*Tc jtjt} | t} | || || || || || t| } | t| d} | }|j}|}| }| t$||g}| }| d}t+jd}| | t0jj}| |}|g}| |}| }| rt<t>f}nd}tA| `!|"d|#d stId | %| ||||||| |||||||| ||d \}}| &||d }| r |tNks | s|tPkrtId|| s tRj*S|d}|t<kr tRj+S|t>kr tRj,StId|)N/) name_typenamesi)offset postdatedr0timeout)main process failed to indicate readinessT)cnamerealmsnametillclient_as_etypesexpected_error_modeexpected_crealmexpected_cnameexpected_srealmexpected_sname expected_saltetypespadata kdc_optionsexpected_supported_etypesexpected_account_name preauth_keyticket_decryption_key pac_requestzmsg-typezwrong message type z error-codezwrong error code )-r setUpClasssetUpr" set_username set_password set_domain set_realmset_workstationset_kerberos_stater get_usernamePrincipalName_creater'splitget_krbtgt_credstgs_supported_enctypes get_realmr(get_saltget_KerberosTime krb5_asn1 KDCOptionsPasswordKey_from_credsr EnctypeAES256"get_enc_timestamp_pa_data_from_keyTicketDecryptionKey_from_credsget_default_enctypesr#r$type_ldb send_bytespollAssertionError_test_as_exchangeassertIsNotNoner&r%r*r3r1r2)pipeurlhostnameusernamepassworddomainrC workstationdn expect_error as_req_base user_creds user_namerB krbtgt_credskrbtgt_supported_etypeskrbtgt_accountrDrLrErOrR ts_enc_padatarNkrbtgt_decryption_keyrMexpected_error_modesas_repkdc_exchange_dictmsg_type error_codes r6 connect_kdcrSsu//K$&&JH%%%H%%%&!!!{+++!!"3444''))I  , ,|3!!F ('''j!H?I--.!)Z!7!7=8==>>> ('' %J+++** - - -..===>>>r5c t} | || || || || t |d|dstd t|| ttj S#tj$r} | j\} } | tjkrtd| ddt$jd d | vrtjcYd} ~ Sdt$jd d | vrtjcYd} ~ Std| dd} ~ wwxYw) Nr=r>r?rAru credentialslpz$connection raised wrong error code ()zdata x,)r"rWrXrYr[r\rrorprqrrr*r3ldbLdbErrorargsERR_INVALID_CREDENTIALSrWERR_ACCOUNT_LOCKED_OUTr1WERR_LOGON_FAILUREr2) rtrurvrwrxryrCrzr{r~errnumestrs r6 connect_ntlmrs%&&JH%%%H%%%&!!!{+++!!"3444 OOD 99Q9  JHIII( #$ ! ! ! !$ '' < . . .H T #- - - ",%(",",",-- - 761 6 6 6 6$ > >#. . . . . . . 3V. 3 3 3 3t ; ;#2 2 2 2 2 2 2 "-%)"-"-"-.. . .s18C""E>1A E9<E>E9 E>&E99E>c $t} | || } tdd} | d} t | } t | } d| z }t|| z} | t | ddz } ttj | dt}|| } | dd}t!| |}t#j}||_t#j}||_t)j}t-| |_t)j}t-||_t)jd|d }|d |d st9d  |||||ddddt<jS#t@$re}|j!\}}|tDj#krt<j$cYd}~S|tDj%krt<j&cYd}~St9d|ddd}~wwxYw)N utf-16leilittlelength byteorder ncacn_np:[krb5,seal,smb2]r=r>r?rAT)serveraccount nt_password nt_verifier lm_change lm_password lm_verifier password3$pwd change raised wrong error code (08Xr)'r"rX get_nt_hashrencoderlenbytesintto_bytesr r ARC4r encryptorupdaterrStringstringr CryptPasswordlistdataPasswordhashrorprqChangePasswordUser3r*r3r rrNT_STATUS_ACCOUNT_LOCKED_OUTr1NT_STATUS_WRONG_PASSWORDr2)rtrurvrwrxryrCrzr{r~nt_hash new_passwordnew_password_md4new_password_len remaining_lenrkeyverifierrrrrconnrrrs r6 connect_samrrs%&&JH%%%$$&&G,B33L&&z22L%\22<((**M'',6LCLL!1()+3!555L zw//&((***3)++##L11L 3B3 C!#..H Z\\FFMjllGGN$&&KL))K-//KH~~K 9;;;; < r?rA)rrrxrrr)#r"rXrrrrrrrrrrrrrEncryptedPasswordAESr auth_datasalt cipher_lencipherPBKDF2IterationsrorprqChangePasswordUser4r*r3r rrrr1rr2)rtrurvrwrxryrCrzr{r~rrrrriv iterationscek enc_key_salt mac_key_salt ciphertextrpwd_bufrrrrs r6connect_samr_aesrJs%&&JH%%%$$&&G,B33L&&z22L||C $5$5+,.6$88$l2L Z\\FFMjllGGN r " "BJ Z 0 0C9L9L>l>A>J>J>@ BBJ '))GYG88GLZG*%%GN)G 9;;;; < r?rArr.modify_attrsp}*E +k'**.4''D  S!!!!!r5)lockoutDurationlockoutThresholdmsDS-LogonTimeSyncIntervalscopeattrsr+rridxrr-rr)superrVglobal_asn1_print do_asn1_printglobal_hexdump do_hexdump get_samdbrr domain_dnsearch SCOPE_BASE assertEqualrget addCleanuplockout_threshold get_minPwdAge set_minPwdAge) selfrreslockout_durationr sync_interval minPwdAgerr __class__s @@r6rVzLockoutTests.setUps  .(  & 1 122 " " " " " "ll7!$"@"@"@AA CHH%%%q6::&7Q:??  %68HIII  %q))) FJJ'9qJAA  %79JKKK"# &(>???A #?Q GG   4% ' ' '  0!444''))  +Y777 C     r5c|jdrdS|jdrdS|d|jddS)Nztdb://zmdb://zconnection to z is not local!)ru startswithfail)rrs r6assertLocalSamDBzLockoutTests.assertLocalSamDBsb 9   ) )  F 9   ) )  F <59<<<=====r5c|drdS|r|d}|||ddS)Nr>r?rz!test failed to indicate readiness)rpdone exceptionr )rrtfuturer$s r6wait_for_readyzLockoutTests.wait_for_ready'si 99Q9    F ;;== (((33I$ 566666r5c:|tdSrdo_lockout_transactionrrs r6test_lockout_transaction_kdcz)LockoutTests.test_lockout_transaction_kdc4s ##K00000r5c:|tdSrr)rr*s r6test_lockout_transaction_ntlmz*LockoutTests.test_lockout_transaction_ntlm7 ##L11111r5c:|tdSrr)rr*s r6test_lockout_transaction_samrz*LockoutTests.test_lockout_transaction_samr:r/r5cr|js|d|tdSN gnutls_pbkdf2() is not availablegnutls_pbkdf2_supportskipTestr)rr*s r6!test_lockout_transaction_samr_aesz.LockoutTests.test_lockout_transaction_samr_aes=s;) > MM< = = = ##$455555r5c:|tdSrr)rr*s r6'test_lockout_transaction_ldap_pw_changez4LockoutTests.test_lockout_transaction_ldap_pw_changeBs ##O44444r5c>|tddSNT)renamer(r*s r6#test_lockout_transaction_rename_kdcz0LockoutTests.test_lockout_transaction_rename_kdcLs! ##K#=====r5c>|tddSr>r-r*s r6$test_lockout_transaction_rename_ntlmz1LockoutTests.test_lockout_transaction_rename_ntlmOs! ##L#>>>>>r5c>|tddSr>r;r*s r6.test_lockout_transaction_rename_ldap_pw_changez;LockoutTests.test_lockout_transaction_rename_ldap_pw_changeRs! ##OD#AAAAAr5c>|tddSNF correct_pwr(r*s r6$test_lockout_transaction_bad_pwd_kdcz1LockoutTests.test_lockout_transaction_bad_pwd_kdcUs! ##KE#BBBBBr5c>|tddSrFr-r*s r6%test_lockout_transaction_bad_pwd_ntlmz2LockoutTests.test_lockout_transaction_bad_pwd_ntlmX! ##LU#CCCCCr5c>|tddSrFr1r*s r6%test_lockout_transaction_bad_pwd_samrz2LockoutTests.test_lockout_transaction_bad_pwd_samr[rLr5cv|js|d|tddS)Nr5FrGr6r*s r6)test_lockout_transaction_bad_pwd_samr_aesz6LockoutTests.test_lockout_transaction_bad_pwd_samr_aes^s@) > MM< = = = ##$4#GGGGGr5c>|tddSrFr;r*s r6/test_lockout_transaction_bad_pwd_ldap_pw_changez MM< = = = ))*:;;;;;r5c:|tdSrrUrr*s r6-test_bad_pwd_count_transaction_ldap_pw_changez:LockoutTests.test_bad_pwd_count_transaction_ldap_pw_changets ))/:::::r5c>|tddSr>rTr*s r6)test_bad_pwd_count_transaction_rename_kdcz6LockoutTests.test_bad_pwd_count_transaction_rename_kdcws! ))+d)CCCCCr5c>|tddSr>rXr*s r6*test_bad_pwd_count_transaction_rename_ntlmz7LockoutTests.test_bad_pwd_count_transaction_rename_ntlmzs! )),t)DDDDDr5c>|tddSr>r`r*s r64test_bad_pwd_count_transaction_rename_ldap_pw_changezALockoutTests.test_bad_pwd_count_transaction_rename_ldap_pw_change}s! ))/$)GGGGGr5c:|tdSr)do_lockout_racerr*s r6test_lockout_race_kdcz"LockoutTests.test_lockout_race_kdcs [)))))r5c:|tdSr)rirr*s r6test_lockout_race_ntlmz#LockoutTests.test_lockout_race_ntlm \*****r5c:|tdSr)rirr*s r6test_lockout_race_samrz#LockoutTests.test_lockout_race_samrrmr5cr|js|d|tdSr4)r7r8rirr*s r6test_lockout_race_samr_aesz'LockoutTests.test_lockout_race_samr_aess;) > MM< = = = -.....r5c:|tdSr)rirr*s r6 test_lockout_race_ldap_pw_changez-LockoutTests.test_lockout_race_ldap_pw_changes _-----r5c:|tdSr)do_logon_without_transactionrr*s r6#test_logon_without_transaction_ntlmz0LockoutTests.test_logon_without_transaction_ntlmrZr5cX|ttddS)NF)r|)do_logonrrr*s r6test_logon_kdczLockoutTests.test_logon_kdcs' gk>>>?????r5c:|tdSr)rxrr*s r6test_logon_ntlmzLockoutTests.test_logon_ntlm l#####r5c:|tdSr)rxrr*s r6test_logon_samrzLockoutTests.test_logon_samrr|r5cr|js|d|tdSr4)r7r8rxrr*s r6test_logon_samr_aesz LockoutTests.test_logon_samr_aess9) > MM< = = = &'''''r5c:|tdSr)rxrr*s r6test_logon_ldap_pw_changez&LockoutTests.test_logon_ldap_pw_changes o&&&&&r5c  ||jjd}|}|}|}t |||}||| }td\}} | d|| d| | | ||||t#| } || t&jdS) NF account_type use_cache samdb_urlrrTduplexr=ldap:// rtrurvrwrxryrCrzr{)get_cached_creds AccountTypeUSERget_dnget_admin_credsget_lprrr! get_passwordrro host_dns_namer] get_domainrbget_workstationrrr*r3) r connect_fnr~user_dnrrrrxour_pipe their_piperesults r6rxzLockoutTests.do_logonsu**8H8M5:+<< ##%%**,, [[]] 2*5777 e$$$**,, $4000* D!!! A%*=*=*?*? A A%*%8%8%:%:%/%<%<%>%>%-#-#8#8#:#:","6"6"8"8(2(B(B(D(D"7||--- !1!9:::::r5FTc||jjd}|}|}|}t |||}||| } |s | dd} tj d5} td\} } | || d |||| |||t'| } || | | d d }d d }t/j|}t/j|t.jd|d<t/j|t.jd|d<t9|jD]} |||d.#t.j $rJ}|j!\}}|"|t.j#|"d|Yd}~d}~wwxYw|$|t.j%dg}|"dtM|tO|d(dd}|)|tTj+z| ,dt[j.d|r`t/j|}|/}t/j|t.j0d|d<||n##tb$r|2wxYw|3| 4d}|"|tjj6ddddS#1swxYwYdS)NFrrr+ max_workersTrrrz "Secret007"rz "Secret008"rrrzpwd change should have failedzOFailed to obtain remote address for the LDAP client while changing the password"msDS-User-Account-Control-Computedrrrr=sAMAccountNamer>r?)7rrrrrrrrr!rrProcessPoolExecutorrsubmitrr]rrbrrr&transaction_startrrrrrrrangerrr rrrERR_OPERATIONS_ERRORrrrrr assertTruer UF_LOCKOUTrotimesleepget_new_usernamer Exceptiontransaction_canceltransaction_commitrr*r1)rrr?rHr~rrrrrxexecutorrrconnect_futurerrrirrrruac new_usernamers r6r)z#LockoutTests.do_lockout_transactions**8H8M5:+<< ##%%**,, [[]] 2*5777 e$$$**,, %}H (Q 7 7 7Z B8#'t#4#4#4 Hj%__5e113355,,..#0022!!,,.. **,,&6688w<<- ! !N   . 9 9 9  # # % % %A  -33J?? ,33J?? k'**-k.1.A.:<<C-k.1.>.:<<Ct566CCA C S))) "ABBBB< / / /$'H T((c.FGGG((*4*.//////// /ll3>?@#BB  CHH---#a&**%I)*%,,--do 5666##D))) 1  &+g..C#'#8#8#:#:L,/,>$,(-*-*C()LL%%%   ((***   $ $ & & &#**1*55F   V%5%@ A A AuZ BZ BZ BZ BZ BZ BZ BZ BZ BZ BZ BZ BZ BZ BZ BZ BZ BZ BsY CQ &BO&I,O&,K;AK;O&KD O&%Q & PA Q  Q$'Q$c||jjd}|}|}|}t |||}||tj d5}td\} } | || d| | ||dd |||t'| } || | | | d t/jdt3j|} t7t/j} t9| }t3jd t2jd | d <t3jt'|t2jd| d<|r7|}t3j|t2jd| d<| | |!|t2j"dg}|#dtI|t7|d%dd}|&|tNj(zn##tR$r|*wxYw|+| ,d}|#|tZj.|dddn #1swxYwY|!|t2j"d g}|#dtI|t7|d%d d}|#d|dS)NFrrr+rTrrrrr=r badPwdCountbadPasswordTimerrrrrr>r?r,)/rrrrrrrrr!rrrrrr]rrrbrrr&rrorrrrrrrrrrrrrrr assertFalser rrrrrr*r2)rrr?r~rrrrrrrrrnow bad_pwd_timerrrr bad_pwd_counts r6rUz)LockoutTests.do_bad_pwd_count_transactionHs**8H8M5:+<< ##%%**,, [[]] 2*5777 e$$$ (Q 7 7 7C N8#'t#4#4#4 Hj%__5e113355,,..#0022#00223B37!,,.. **,,&6688w<<- ! !N   . 9 9 9  # # % % %* ##D))) 1 k'**$)++&&*3// %(%7(!&#&#M"*-); %%(%*'*'%&*$(#8#8#:#:L,/,>$,(-*-*C() S!!!ll3>?@#BB  CHH---#a&**%I)*%,,--  t!67777   ((***   $ $ & & &#**1*55F   V%5%Df M M MGC NC NC NC NC NC NC NC NC NC NC NC NC NC NC NNll7!$"/22 CHH%%%CFJJ}!J<<==  M*****s-,C3N: FM?N: M  AN::N>N>c||jjd}|}|}|}t |||}|||j dz}tj |5}g} g} t|D] } td\} } | | ||| d||||dd |||t-| }| ||| | | | D]} | d t5jdn##t8$r|wxYw|d }d }t?| D]b\} }| d }|tBj"kr|dz }1|tBj#kr|dz }G|$d| d|c|%||j |%|||j z dddn #1swxYwY|&|tNj(ddg}|%dtS|tU|d +dd }|%|j |tU|d +dd }|,|tZj.zdS)NFrrr+rTrrrrr=rr>r?zprocess z gave an unexpected result rrrr)/rrrrrrrrr!rrrrrappendrrr]rrrbrrr&rrorrrrr enumeraterr*r1r2r rrrrrrrrr r)rrr~rrrr num_attemptsrconnect_futures our_pipesrrrrlockoutswrong_passwordsrrrrs r6rizLockoutTests.do_lockout_racesz**8H8M5:+<< ##%%**,, [[]] 2*5777 e$$$ -1  (\ B B B5 Nh OI<(( > >'+4'8'8'8$*  ***!)#9%"5"5"7"799"0022'4466'4466ss;%0022$..00 * : : < <7||"1 "% "% &&~666##Hn====  # # % % %  )..H''---- 1    ((***   $ $ & & &HO%.%?%? + +!>'..q.99-888MHH/>>>#q(OOII***!'**++++   _d.D E E E   X|d6L'L M M Mk5 N5 N5 N5 N5 N5 N5 N5 N5 N5 N5 N5 N5 N5 N5 Nrll 3> 79:: CHH%%%CFJJ}!J<<==  /???#a&**A!"$$%% do-.....s,6D5L ,.HL  H;;CL  LLcn||jjd}|}|}|}t |||}||| }tj d5}td\} } | || d|||||||t'| } || | | | d | d } || t2jn##t6$r|wxYw|ddddS#1swxYwYdS) NFrrr+rTrrrr=r>r?)rrrrrrrrr!rrrrrrr]rrbrrr&rrorrr*r3rrr) rrr~rrrrrxrrrrrs r6ruz)LockoutTests.do_logon_without_transaction sw**8H8M5:+<< ##%%**,, [[]] 2*5777 e$$$**,, (Q 7 7 7 '8#'t#4#4#4 Hj%__5e113355,,..#0022!!,,.. **,,&6688w<<- ! !N   . 9 9 9  # # % % % ##D)))(..q.99  )9)ABBBB   ((***   $ $ & & &A ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' 's,CH*A G&%H*& HH**H.1H.)FT)F),r.r/r0rVr!r&r+r.r2r9r<r@rBrDrIrKrNrPrRrVrYr\r^rarcrergrjrlrorqrsrvryr{r~rrrxr)rUriru __classcell__)rs@r6rrs>!>!>!>!>!@>>> 7 7 7111222222666 555>>>???BBBCCCDDDDDDHHH GGG777888888<<< ;;;DDDEEEHHH***++++++/// ...888 @@@$$$$$$((( '''!;!;!;R',*.oBoBoBoBn\+\+\+\+DV/V/V/~1'1'1'1'1'1'1'r5r__main__)T)Nsysospathinsertenviron concurrentrenumr functoolsrmultiprocessingrrcryptography.hazmat.backendsr +cryptography.hazmat.primitives.ciphers.baser &cryptography.hazmat.primitives.ciphersr rsambar r rrrrrsamba.credentialsrr samba.cryptorrrr samba.dcerpcrr samba.samdbr samba.testsrrrsamba.tests.krb5.as_req_testsrsamba.tests.krb5r samba.tests.krb5.kdc_base_testr!samba.tests.krb5.raw_testcaser"samba.tests.krb5.rfc4120_pyasn1testskrb5rfc4120_pyasn1re"samba.tests.krb5.rfc4120_constantsr#r$r%r&r'r(r r r*rrrrrrr.unittestmainr4r5r6rs( < !$  888888>>>>>>====== CBBBBBBB #"""""""FFFFFFFFFF777777$$$$$$666666======333333333333t"j?j?j?j?Z-(-(-(`W(W(W(tR(R(R(j;(;(;(|] '] '] '] '] ';] '] '] '@ zNOOOHMOOOOO r5