
    Fch                        d dl Z d dlZe j                            d d           dej        d<   d dlmZ d dlZd dlm	Z	m
Z
mZ d dlmZmZmZmZmZmZ d dlmZmZ d d	lmZ d dlmc mc mZ d d
lmZ d dlmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+ d dl,mc mc m-Z. dZ/dZ0 G d de          Z1e2dk    rdZ/dZ0d dl3Z3 e3j4                     dS dS )    Nz
bin/python1PYTHONUNBUFFERED)partial)NTSTATUSErrorgenerate_random_passwordntstatus)lsamiscnetlogonntlmsspsamrsecurity)ndr_pack
ndr_unpack)SamDB)KDCBaseTest)AES128_CTS_HMAC_SHA1_96AES256_CTS_HMAC_SHA1_96ARCFOUR_HMAC_MD5DES3_CBC_MD5DES3_CBC_SHA1DES_CBC_CRCDES_CBC_MD5KDC_ERR_ETYPE_NOSUPPKDC_ERR_POLICYKDC_ERR_PREAUTH_REQUIRED	KRB_ERRORNT_PRINCIPALNT_SRV_INSTFc                   b    e Zd Ze fd            Z fdZej        j        ddddfdZ	dWdZ
d Zd	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Z d Z!d Z"d  Z#d! Z$d" Z%d# Z&d$ Z'd% Z(d& Z)d' Z*d( Z+d) Z,d* Z-d+ Z.d, Z/d- Z0d. Z1d/ Z2d0 Z3d1 Z4d2 Z5d3 Z6d4 Z7d5 Z8d6 Z9d7 Z:d8 Z;d9 Z<d: Z=d; Z>d< Z?d= Z@d> ZAd? ZBd@ ZCdA ZDdB ZEdC ZFdD ZGdE ZHdF ZIdG ZJdH ZKdI ZLdJ ZMdK ZNdL ZOdM ZPdN ZQdO ZRdP ZSdQ ZTdR ZUdS ZV	 	 	 	 dXdTZW	 	 	 	 	 	 dYdUZX	 	 	 	 dZdVZY xZZS )[ProtectedUsersTestsc                 V    t                                                       d | _        d S N)super
setUpClass_search_iterator)cls	__class__s    H/usr/lib/python3/dist-packages/samba/tests/krb5/protected_users_tests.pyr%   zProtectedUsersTests.setUpClass:   s'    #    c                 x    t                                                       t          | _        t          | _        d S r#   )r$   setUpglobal_asn1_printdo_asn1_printglobal_hexdump
do_hexdump)selfr(   s    r)   r,   zProtectedUsersTests.setUp@   s'    .(r*   FNTc                     d| i}d}|r?|                                  }	d|	                                 dt          j         d}
||
fz  }|||fz  }|r||d<   |                     |||          S )Nkerberos_enabled <SID=->	member_of)account_typeopts	use_cache)	get_samdbget_domain_sidr   DOMAIN_RID_PROTECTED_USERSget_cached_creds)r1   	protectedr9   ntlmr8   supported_enctypescachedr:   memberssamdbprotected_users_groups              r)   
_get_credszProtectedUsersTests._get_credsF   s     D
  	0NN$$E&OU-A-A-C-C &O &O(0(K&O &O &O!-//G 	|#G 	( 'D$$,*./5 % 7 7 	7r*   c                    |                                  }	 t          d|                                 ||                                           }|                     |d           nN# t
          j        $ r<}|                     |d           |j        \  }}|t
          j	        k    r Y d }~d S d }~ww xY w|
                    dt
          j        dg          }|                     dt          |                     |                     ||                                          }	|d	                             dd	
          }
t#          t$          j        |
          }|                     |	t)          |                     d S )Nzldap://)urlcredentialslpzexpected to get an errorgot unexpected error tokenGroups)scopeattrs   r   )idx)r<   r   host_dns_nameget_lpassertFalseldbLdbError
assertTrueargsERR_INVALID_CREDENTIALSsearch
SCOPE_BASEassertEquallenget_objectSidget_dngetr   r   dom_sidstr)r1   credsexpect_errorrE   ldaperrnum_ressidtoken_groups	token_sids               r)   _connectzProtectedUsersTests._connecta   s{     	G>u':':'<'<>>%* KKMM+ + +D \+EFFFF | 	 	 	OOL*@AAAXFCc111FFFFF	 kk" #!.  1 1 	CHH%%%  771vzz-Qz77x/>>	c)nn-----s   9A& &B151B,,B1c                 `    |                      ddd          }|                     |           d S )NFTr@   rA   rC   rG   rn   r1   client_credss     r)   test_ntlm_not_protectedz+ProtectedUsersTests.test_ntlm_not_protected   s<    ,0.3 ' 5 5 	l#####r*   c                 d    |                      ddd          }|                     |d           d S )NTFrp   re   rq   rr   s     r)   test_ntlm_protectedz'ProtectedUsersTests.test_ntlm_protected   s@    ,0.3 ' 5 5 	l66666r*   c                    |                                  }|                                 }|                     ||          }d|                                 dt          j         d}|                     |t          j        ||          dd           | 	                    dd|          }| 
                    |d	           d S )
Nr5   r6   r7   memberFexpect_attrT)r@   rA   r8   rv   )r<   get_new_usernamecreate_groupr=   r   r>   add_to_grouprV   DnrG   rn   r1   rE   
group_namegroup_dnrF   rs   s         r)   test_ntlm_protected_nestedz.ProtectedUsersTests.test_ntlm_protected_nested   s      **,,
$$UJ77"K)=)=)?)? "K "K$,$G"K "K "K(CF52G$H$H" 	 	7 	7 	7 ,019 ' ; ; 	l66666r*   c                    |                                  }|                                }t          j        d| d          }|                                }t	          j                    }||_        t	          j                    }||_        t          j                    }	t          j                    }
| 	                    t                    5 }|                    |||	|
dd d            d d d            n# 1 swxY w Y   |j        j        \  }}|r!|                     t          j        |           n |                     t          j        |           | 	                    t                    5 }|                    |||	|
dd d d            d d d            n# 1 swxY w Y   |j        j        \  }}|r!|                     t          j        |           n |                     t          j        |           t	          j                    }||_        t	          j                    }||_        | 	                    t                    5 }|                    |||	|
           d d d            n# 1 swxY w Y   |j        j        \  }}|t          j        k    rF|r"|                     t          j        |           d S |                     t          j        |           d S d S )Nz	ncacn_np:z[krb5,seal,smb2]T)serveraccountnt_passwordnt_verifier	lm_changelm_passwordlm_verifier)r   r   r   r   r   r   r   	password3)r   r   passwordhash)r<   rS   r   get_usernamer	   StringstringCryptPasswordPasswordassertRaisesr   ChangePasswordUser2	exceptionrY   r]   r   NT_STATUS_ACCOUNT_RESTRICTIONNT_STATUS_WRONG_PASSWORDChangePasswordUser3AsciiStringOemChangePasswordUser2NT_STATUS_NOT_IMPLEMENTED)r1   rd   r@   rE   server_nameconnusernamer   r   r   r   rg   rh   ri   s                 r)   _test_samr_change_passwordz.ProtectedUsersTests._test_samr_change_password   s{     ))++yB[BBBCC%%''#*,,!(**moo}-- 	7$$F-41<1</31515 % 7 7 7	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 	7 #Q 	EXCSIIIIX>DDD}-- 	5$$F-41<1</31515/3 % 5 5 5	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 #Q 	EXCSIIIIX>DDD""#/##!}-- 	:''v071<-8 ( : : :	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: #Q(444 I  !GMMMMM  !BCHHHHH	 54s6   	C22C69C6)FFF>I$$I(+I(c                 b    |                      dd          }|                     |d           d S )NFr@   rC   r@   rG   r   rr   s     r)   'test_samr_change_password_not_protectedz;ProtectedUsersTests.test_samr_change_password_not_protected   sB     .3 ' 5 5 	'''FFFFFr*   c                 b    |                      dd          }|                     |d           d S )NTFr   r   r   rr   s     r)   #test_samr_change_password_protectedz7ProtectedUsersTests.test_samr_change_password_protected   sB     .3 ' 5 5 	'''EEEEEr*   c                     |                                  }|                                }|                                \  }}d}t          j                    }	d|	_        t          j                    }
t          j        |
_        ||
_	        t          j                    }t          j
        |_        ||_	        t          j                    }t          j        |_        ||
|g|	_        t          |	          }d}|                    d||          }|                     | j        j        dt$          j        i          }t)          j        d| d	|                                 |          }|t(          j        k    rt)          j                    }t1          j                    }dgd
z  |_        t1          j                    }t7          |                                          |_        |                    |           ||_        ||_        n|t(          j         k    r~t)          j!                    }t7          |          |_"        t)          j#                    |_$        tK          |d                   |j$        _&        t7          |d                   |j$        _'        n| (                    d|            t)          j)                    }||j*        _+        ||j,        _+        ||j-        _+        ||_.        t(          j/        }d}	 |0                    ||1                                ||||           | 2                    |d           d S # tf          $ r<}| 4                    |d           |j5        \  }}|tl          j7        k    r Y d }~d S d }~ww xY w)NWorkstation   s   abcdefghr   )flags	challengetarget_infosecure_channel_type)r9   r:   zncacn_ip_tcp:z[schannel,seal]   nt_responsezunknown logon type zexpected errorrL   )8r<   rS   get_ntlm_username_domainr   AV_PAIR_LISTcountAV_PAIRMsvAvNbComputerNameAvIdValueMsvAvNbDomainNameMsvAvEOLpairr   get_ntlm_responser?   AccountTypeCOMPUTERr
   SEC_CHAN_WKSTAr   rT   NetlogonInteractiveInformationnetr_PasswordInfor   r   r   listget_nt_hashencrypt_samr_password
lmpassword
ntpasswordNetlogonNetworkInformationnetr_NetworkInfor   netr_ChallengeResponsentr^   lengthdatafailnetr_IdentityInfodomain_namer   account_nameworkstationidentity_infoNetlogonValidationSamInfo2netr_LogonSamLogonExget_workstationrU   r   rX   rY   r   r   )r1   rd   
logon_typer@   rE   r   r   domainr   r   computername
domainnameeoltarget_info_blobr   response
mach_credsr   logonlm_passnt_passr   validation_level
netr_flagsrg   rh   ri   s                              r)   _test_samlogonz"ProtectedUsersTests._test_samlogon   sZ     $$&& 99;;&#*,,((#7(_&&
!3
!
o#&c:#K00	**5>7G + I I **)2')<= + ? ?
  !H!H!H!H!%!+- - @@@.00EmooG38GLmooG 1 1 3 344GL,,W555&E&E8>>>-//E"9ooEO688EH!(="9::EHO -!899EHMM II8J88999 244+1!(,4")+6!(+#>
	:%%f&0&@&@&B&B&0&+&6&02 2 2 Y(899999  	 	 	OOI'=>>>XFCh<<< =<<<<<		s   3,L7 7
M=1M88M=c                 x    |                      dd          }|                     |t          j        d           d S NFTr@   rA   rd   r   r@   rG   r   r   r   rr   s     r)   'test_samlogon_interactive_not_protectedz;ProtectedUsersTests.test_samlogon_interactive_not_protectedQ  sQ    ,0 ' 2 2,'/'N&+ 	 	- 	- 	- 	- 	-r*   c                 x    |                      dd          }|                     |t          j        d           d S NTr   r   r   rr   s     r)   #test_samlogon_interactive_protectedz7ProtectedUsersTests.test_samlogon_interactive_protectedY  sQ    ,0 ' 2 2,'/'N&* 	 	, 	, 	, 	, 	,r*   c                 x    |                      dd          }|                     |t          j        d           d S r   rG   r   r   r   rr   s     r)   #test_samlogon_network_not_protectedz7ProtectedUsersTests.test_samlogon_network_not_protecteda  sQ    ,0 ' 2 2,'/'J&+ 	 	- 	- 	- 	- 	-r*   c                 x    |                      dd          }|                     |t          j        d           d S r   r   rr   s     r)   test_samlogon_network_protectedz3ProtectedUsersTests.test_samlogon_network_protectedi  sQ    ,0 ' 2 2,'/'J&* 	 	, 	, 	, 	, 	,r*   c                 (   |                      dd          }|                                }t          dd          }d| d                    d          }|                                 }t          j        |          }t          j        |t
          j        d          |d<   |	                    |           |
                    |           |                     ||t          j        j        t          j        j        t          j        j        h           d S )	NTFr       "z	utf-16-le
unicodePwd)expected_etypes)rG   r`   r   encoder<   rV   MessageMessageElementFLAG_MOD_REPLACEmodifyset_passwordget_keyskcryptoEnctypeAES256AES128RC4)r1   rs   	client_dnnew_passwordutf16pwrE   msgs          r)   test_protected_nt_hashz*ProtectedUsersTests.test_protected_nt_hashr  s   .3 ' 5 5 ''))	/B77%l%%%,,[99  k)$$.w/2/C/;= =L 	S!!,///eY'.'='.'='.':'< 	 	= 	= 	= 	= 	=r*   c                 l    |                      d          }|                     |t          d           d S NFr   T)etypere   rG   _test_etyper   rr   s     r)   test_des_cbc_crc_not_protectedz2ProtectedUsersTests.test_des_cbc_crc_not_protected  C    77[&* 	 	, 	, 	, 	, 	,r*   c                 n    |                      d          }|                     |t          dd           d S NTr   F)r	  re   rc4_supportr
  rr   s     r)   test_des_cbc_crc_protectedz.ProtectedUsersTests.test_des_cbc_crc_protected  E    66[&* 	 	? 	? 	? 	? 	?r*   c                 l    |                      d          }|                     |t          d           d S r  rG   r  r   rr   s     r)   test_des_cbc_md5_not_protectedz2ProtectedUsersTests.test_des_cbc_md5_not_protected  r  r*   c                 n    |                      d          }|                     |t          dd           d S r  r  rr   s     r)   test_des_cbc_md5_protectedz.ProtectedUsersTests.test_des_cbc_md5_protected  r  r*   c                 l    |                      d          }|                     |t          d           d S r  rG   r  r   rr   s     r)   test_des3_cbc_md5_not_protectedz3ProtectedUsersTests.test_des3_cbc_md5_not_protected  sC    77\&* 	 	, 	, 	, 	, 	,r*   c                 n    |                      d          }|                     |t          dd           d S r  r  rr   s     r)   test_des3_cbc_md5_protectedz/ProtectedUsersTests.test_des3_cbc_md5_protected  sE    66\&* 	 	? 	? 	? 	? 	?r*   c                 l    |                      d          }|                     |t          d           d S r  rG   r  r   rr   s     r)    test_des3_cbc_sha1_not_protectedz4ProtectedUsersTests.test_des3_cbc_sha1_not_protected  sC    77]&* 	 	, 	, 	, 	, 	,r*   c                 n    |                      d          }|                     |t          dd           d S r  r  rr   s     r)   test_des3_cbc_sha1_protectedz0ProtectedUsersTests.test_des3_cbc_sha1_protected  sE    66]&* 	 	? 	? 	? 	? 	?r*   c                 j    |                      d          }|                     |t                     d S NFr   r	  rG   r  r   rr   s     r)   test_rc4_not_protectedz*ProtectedUsersTests.test_rc4_not_protected  s5    77-=>>>>>r*   c                 x    |                      d          }|                     |t          t          d           d S )NTr   Fr	  preauth_etyper  rG   r  r   r   rr   s     r)   !test_rc4_protected_aes256_preauthz5ProtectedUsersTests.test_rc4_protected_aes256_preauth  sG    66-='>%* 	 	, 	, 	, 	, 	,r*   c                 |    |                      d          }|                     |t          t          ddd           d S )NTr   Fr	  r)  re   r  expect_edatar%  rr   s     r)   test_rc4_protected_rc4_preauthz2ProtectedUsersTests.test_rc4_protected_rc4_preauth  sL    66-='7&*&+ 	 	- 	- 	- 	- 	-r*   c                 j    |                      d          }|                     |t                     d S r#  rG   r  r   rr   s     r)   test_aes256_not_protectedz-ProtectedUsersTests.test_aes256_not_protected  5    77-DEEEEEr*   c                 l    |                      d          }|                     |t          d           d S NTr   Fr	  r  r1  rr   s     r)   test_aes256_protectedz)ProtectedUsersTests.test_aes256_protected  D    66-D%* 	 	, 	, 	, 	, 	,r*   c                 x    |                      d          }|                     |t          t          f           d S r#  rG   r  r   r   rr   s     r)   test_aes256_rc4_not_protectedz1ProtectedUsersTests.test_aes256_rc4_not_protected  M    77.E.>.@ 	A 	A 	A 	A 	Ar*   c                 z    |                      d          }|                     |t          t          fd           d S r5  r:  rr   s     r)   test_aes256_rc4_protectedz-ProtectedUsersTests.test_aes256_rc4_protected  M    66.E.>.@%* 	 	, 	, 	, 	, 	,r*   c                 x    |                      d          }|                     |t          t          f           d S r#  r*  rr   s     r)   test_rc4_aes256_not_protectedz1ProtectedUsersTests.test_rc4_aes256_not_protected  M    77.>.E.G 	H 	H 	H 	H 	Hr*   c                 z    |                      d          }|                     |t          t          fd           d S r5  r*  rr   s     r)   test_rc4_aes256_protectedz-ProtectedUsersTests.test_rc4_aes256_protected  M    66.>.E.G%* 	 	, 	, 	, 	, 	,r*   c                 j    |                      d          }|                     |t                     d S r#  rG   r  r   rr   s     r)   test_aes128_not_protectedz-ProtectedUsersTests.test_aes128_not_protected  r3  r*   c                 l    |                      d          }|                     |t          d           d S r5  rG  rr   s     r)   test_aes128_protectedz)ProtectedUsersTests.test_aes128_protected  r8  r*   c                 x    |                      d          }|                     |t          t          f           d S r#  rG   r  r   r   rr   s     r)   test_aes128_rc4_not_protectedz1ProtectedUsersTests.test_aes128_rc4_not_protected  r<  r*   c                 z    |                      d          }|                     |t          t          fd           d S r5  rL  rr   s     r)   test_aes128_rc4_protectedz-ProtectedUsersTests.test_aes128_rc4_protected  r?  r*   c                 x    |                      d          }|                     |t          t          f           d S r#  rG   r  r   r   rr   s     r)   test_rc4_aes128_not_protectedz1ProtectedUsersTests.test_rc4_aes128_not_protected  rB  r*   c                 z    |                      d          }|                     |t          t          fd           d S r5  rQ  rr   s     r)   test_rc4_aes128_protectedz-ProtectedUsersTests.test_rc4_aes128_protected  rE  r*   c                     |                      d| j        j                  }|                     |t                     d S NFr@   r9   r$  rG   r   r   r  r   rr   s     r)   test_rc4_mac_not_protectedz.ProtectedUsersTests.test_rc4_mac_not_protected#  sH    )2 ' 4 4 	-=>>>>>r*   c                     |                      d| j        j                  }|                     |t          t
          d           d S )NTrW  Fr(  rG   r   r   r  r   r   rr   s     r)   %test_rc4_mac_protected_aes256_preauthz9ProtectedUsersTests.test_rc4_mac_protected_aes256_preauth*  sZ    )2 ' 4 4 	-='>%* 	 	, 	, 	, 	, 	,r*   c                     |                      d| j        j                  }|                     |t          t          ddd           d S )NTrW  Fr-  rX  rr   s     r)   "test_rc4_mac_protected_rc4_preauthz6ProtectedUsersTests.test_rc4_mac_protected_rc4_preauth3  s_    )2 ' 4 4 	-='7&*&+ 	 	- 	- 	- 	- 	-r*   c                     |                      d| j        j                  }|                     |t          t
          f           d S rV  rG   r   r   r  r   r   rr   s     r)   !test_aes256_rc4_mac_not_protectedz5ProtectedUsersTests.test_aes256_rc4_mac_not_protected=  `    )2 ' 4 4 	.E.>.@ 	A 	A 	A 	A 	Ar*   c                     |                      d| j        j                  }|                     |t          t
          fd           d S NTrW  Fr6  r`  rr   s     r)   test_aes256_rc4_mac_protectedz1ProtectedUsersTests.test_aes256_rc4_mac_protectedE  `    )2 ' 4 4 	.E.>.@%* 	 	, 	, 	, 	, 	,r*   c                     |                      d| j        j                  }|                     |t          t
          f           d S rV  r[  rr   s     r)   !test_rc4_aes256_mac_not_protectedz5ProtectedUsersTests.test_rc4_aes256_mac_not_protectedN  `    )2 ' 4 4 	.>.E.G 	H 	H 	H 	H 	Hr*   c                     |                      d| j        j                  }|                     |t          t
          fd           d S rd  r[  rr   s     r)   test_rc4_aes256_mac_protectedz1ProtectedUsersTests.test_rc4_aes256_mac_protectedV  `    )2 ' 4 4 	.>.E.G%* 	 	, 	, 	, 	, 	,r*   c                     |                      d| j        j                  }|                     |t          t
          f           d S rV  rG   r   r   r  r   r   rr   s     r)   !test_aes128_rc4_mac_not_protectedz5ProtectedUsersTests.test_aes128_rc4_mac_not_protected_  rb  r*   c                     |                      d| j        j                  }|                     |t          t
          fd           d S rd  rn  rr   s     r)   test_aes128_rc4_mac_protectedz1ProtectedUsersTests.test_aes128_rc4_mac_protectedg  rf  r*   c                     |                      d| j        j                  }|                     |t          t
          f           d S rV  rG   r   r   r  r   r   rr   s     r)   !test_rc4_aes128_mac_not_protectedz5ProtectedUsersTests.test_rc4_aes128_mac_not_protectedp  ri  r*   c                     |                      d| j        j                  }|                     |t          t
          fd           d S rd  rs  rr   s     r)   test_rc4_aes128_mac_protectedz1ProtectedUsersTests.test_rc4_aes128_mac_protectedx  rl  r*   c                 j    |                      d          }|                     |t                     d S NFr   r)  r%  rr   s     r)   test_ts_rc4_not_protectedz-ProtectedUsersTests.test_ts_rc4_not_protected  s5    775EFFFFFr*   c                 p    |                      d          }|                     |t          ddd           d S )NTr   Fr)  re   r  r.  r%  rr   s     r)   test_ts_rc4_protectedz)ProtectedUsersTests.test_ts_rc4_protected  sI    665E&*&+ 	 	- 	- 	- 	- 	-r*   c                    |                                  }|                                 }|                     ||          }d|                                 dt          j         d}|                     |t          j        ||          dd           | 	                    d|          }| 
                    |t          ddd	           d S )
Nr5   r6   r7   ry   Frz   )r@   r8   Tr|  )r<   r|   r}   r=   r   r>   r~   rV   r   rG   r  r   r   s         r)   test_ts_rc4_protected_nestedz0ProtectedUsersTests.test_ts_rc4_protected_nested  s      **,,
$$UJ77"K)=)=)?)? "K "K$,$G"K "K "K(CF52G$H$H" 	 	7 	7 	7 19 ' ; ; 	5E&*&+ 	 	- 	- 	- 	- 	-r*   c                 j    |                      d          }|                     |t                     d S rx  r1  rr   s     r)   test_ts_aes256_not_protectedz0ProtectedUsersTests.test_ts_aes256_not_protected  5    775LMMMMMr*   c                 l    |                      d          }|                     |t          d           d S NTr   Fr)  r  r1  rr   s     r)   test_ts_aes256_protectedz,ProtectedUsersTests.test_ts_aes256_protected  D    665L%* 	 	, 	, 	, 	, 	,r*   c                 j    |                      d          }|                     |t                     d S rx  rG  rr   s     r)   test_ts_aes128_not_protectedz0ProtectedUsersTests.test_ts_aes128_not_protected  r  r*   c                 l    |                      d          }|                     |t          d           d S r  rG  rr   s     r)   test_ts_aes128_protectedz,ProtectedUsersTests.test_ts_aes128_protected  r  r*   c                     |                      d| j        j                  }|                     |t                     d S NFrW  ry  rX  rr   s     r)   test_ts_rc4_mac_not_protectedz1ProtectedUsersTests.test_ts_rc4_mac_not_protected  sH    )2 ' 4 4 	5EFFFFFr*   c                     |                      d| j        j                  }|                     |t          ddd           d S )NTrW  Fr|  rX  rr   s     r)   test_ts_rc4_mac_protectedz-ProtectedUsersTests.test_ts_rc4_mac_protected  s\    )2 ' 4 4 	5E&*&+ 	 	- 	- 	- 	- 	-r*   c                     |                      d| j        j                  }|                     |t                     d S r  rG   r   r   r  r   rr   s     r)    test_ts_aes256_mac_not_protectedz4ProtectedUsersTests.test_ts_aes256_mac_not_protected  H    )2 ' 4 4 	5LMMMMMr*   c                     |                      d| j        j                  }|                     |t          d           d S NTrW  Fr  r  rr   s     r)   test_ts_aes256_mac_protectedz0ProtectedUsersTests.test_ts_aes256_mac_protected  W    )2 ' 4 4 	5L%* 	 	, 	, 	, 	, 	,r*   c                     |                      d| j        j                  }|                     |t                     d S r  rG   r   r   r  r   rr   s     r)    test_ts_aes128_mac_not_protectedz4ProtectedUsersTests.test_ts_aes128_mac_not_protected  r  r*   c                     |                      d| j        j                  }|                     |t          d           d S r  r  rr   s     r)   test_ts_aes128_mac_protectedz0ProtectedUsersTests.test_ts_aes128_mac_protected  r  r*   c                     |                                  }|                     d| j        j        t          j        j                  }|                     |          }|                     ||           d S )NFr@   r9   rB   	get_client_credsrG   r   r   r   r   r  get_tgtget_service_ticketr1   rs   service_credstgts       r)   #test_service_rc4_only_not_protectedz7ProtectedUsersTests.test_service_rc4_only_not_protected  so    ,,..%595E5N;B?;N ( P P ll<((]33333r*   c                     |                                  }|                     d| j        j        t          j        j                  }|                     |          }|                     ||           d S )NTr  r  r  s       r)   test_service_rc4_only_protectedz3ProtectedUsersTests.test_service_rc4_only_protected  so    ,,..$595E5N;B?;N ( P P ll<((]33333r*   c                     |                      d          }|                     d          }|                     |t          |          }|                     ||           d S )NFr      offsetr)  tillexpected_endrG   get_KerberosTimer  r   check_ticket_timesr1   rs   r  r  s       r)   'test_tgt_lifetime_shorter_not_protectedz;ProtectedUsersTests.test_tgt_lifetime_shorter_not_protected  n    77$$K$88|-D$(  * * 	$77777r*   c                     |                      d          }|                     d          }|                     |t          |d          }|                     |||           d S )NTr   r  r  Fr)  r  r  r  expected_renew_timer  r  s       r)   #test_tgt_lifetime_shorter_protectedz7ProtectedUsersTests.test_tgt_lifetime_shorter_protected  s    66$$K$88|-D$(e  = = 	$48 	  	: 	: 	: 	: 	:r*   c                     |                      d          }|                     d          }|                     |t          |          }|                     ||           d S )NFr   `T  r  r  r  r  r  s       r)   &test_tgt_lifetime_longer_not_protectedz:ProtectedUsersTests.test_tgt_lifetime_longer_not_protected  r  r*   c                     |                      d          }|                     d          }|                     |t          |d          }d}|                     |||           d S )	NTr   r  r  Fr  i@8  )expected_lifeexpected_renew_lifer  )r1   rs   r  r  r  s        r)   "test_tgt_lifetime_longer_protectedz6ProtectedUsersTests.test_tgt_lifetime_longer_protected  s    66$$K$88|-D$(e  = = $=4A 	  	C 	C 	C 	C 	Cr*   c                 x   |                      d          }|                     d          }|                     |t          |          }|                     ||           |                                 }|                     d          }|                     |||          }|                     ||           d S )	NFr   r  r  r  r  頌  r  rG   r  r  r   r  get_service_credsr  r1   rs   r  r  r  till2tickets          r)   "test_ticket_lifetime_not_protectedz6ProtectedUsersTests.test_ticket_lifetime_not_protected+  s    77$$K$88(?d  L L$777..00%%\%::((m%(HHT:::::r*   c                 |   |                      d          }|                     d          }|                     |t          |d          }|                     |||           |                                 }|                     d          }|                     |||	          }|                     ||
           d S )NTr   r  r  Fr  r  r  r  r  r  r  s          r)   test_ticket_lifetime_protectedz2ProtectedUsersTests.test_ticket_lifetime_protected9  s    66$$K$88(?d    	$48 	  	: 	: 	: ..00%%\%::((m%(HHT:::::r*   c                 b    |                      d          }|                     |dd           d S )NFr   forwardablekdc_optionsexpected_flagsrG   _get_tgt_check_flagsrr   s     r)   !test_forwardable_as_not_protectedz5ProtectedUsersTests.test_forwardable_as_not_protectedL  sH    77!!,M1> 	" 	@ 	@ 	@ 	@ 	@r*   c                 d    |                      d          }|                     |ddd           d S )NTr   r  Fr  unexpected_flagsr  r  rr   s     r)   test_forwardable_as_protectedz1ProtectedUsersTests.test_forwardable_as_protectedR  sF    66!!,M3@.3 	" 	5 	5 	5 	5 	5r*   c                 b    |                      d          }|                     |dd           d S )NFr   	proxiabler  r  rr   s     r)   test_proxiable_as_not_protectedz3ProtectedUsersTests.test_proxiable_as_not_protected[  sC    77!!,K1< 	" 	> 	> 	> 	> 	>r*   c                 d    |                      d          }|                     |ddd           d S )NTr   r  Fr  r  rr   s     r)   test_proxiable_as_protectedz/ProtectedUsersTests.test_proxiable_as_protecteda  sF    66!!,K3>.3 	" 	5 	5 	5 	5 	5r*   c                 f    |                      d          }|                     |dddd           d S )NTr   r  F)r  r  r  re   r  rr   s     r)   (test_proxiable_as_protected_policy_errorz<ProtectedUsersTests.test_proxiable_as_protected_policy_errorj  sM    66!!,K3>.3$ 	" 	H 	H 	H 	H 	Hr*   c                 X   |                      d          }|                     |          }|                     |t          | j        dd          |                                           }|                                 }|                     ||dt          j	        d                     d S )NFr   r  Tflagvalue	modify_fnchecksum_keysr  
rG   r  modified_ticketr   modify_ticket_flagget_krbtgt_checksum_keyr  r  	krb5_asn1TicketFlagsr1   rs   r  r  s       r)   "test_forwardable_tgs_not_protectedz6ProtectedUsersTests.test_forwardable_tgs_not_protecteds  s    77ll<((""d5M$(* * *6688	 # : : ..00M$0?? 	  	A 	A 	A 	A 	Ar*   c                 ^   |                      d          }|                     |d          }|                     |t          | j        dd          |                                           }|                                 }|                     ||dt          j	        d          d           d S )	NTr   Fr  r  r  r  r  r  r  r  r  s       r)   test_forwardable_tgs_protectedz2ProtectedUsersTests.test_forwardable_tgs_protected  s    66ll<Ul;;""d5M$(* * *6688	 # : : ..00M$0?? 	  	 	 	 	 	r*   c                 X   |                      d          }|                     |          }|                     |t          | j        dd          |                                           }|                                 }|                     ||dt          j	        d                     d S )NFr   r  Tr  r  r  r  r  s       r)    test_proxiable_tgs_not_protectedz4ProtectedUsersTests.test_proxiable_tgs_not_protected  s    77ll<((""d5K$(* * *6688	 # : : ..00K$0== 	  	? 	? 	? 	? 	?r*   c                 ^   |                      d          }|                     |d          }|                     |t          | j        dd          |                                           }|                                 }|                     ||dt          j	        d          d           d S )	NTr   Fr  r  r  r  r  r  r  s       r)   test_proxiable_tgs_protectedz0ProtectedUsersTests.test_proxiable_tgs_protected  s    66ll<Ul;;""d5K$(* * *6688	 # : : ..00K$0== 	  	 	 	 	 	r*   c                    |j         }|d         }|                    d|          }|d         }	|                    dd           }
|                     |          }|.|                     |d           |                     ||          }n|                     |d           |                     ||	                    d                     |
,|                     |           |                     |           d S |-|                     |d	           |                     ||          }|+|                     ||
                    d                     d S d S )
Nauthtime	starttimeendtimez
renew-tillz+did not supply expected endtime or lifetime)epochr  z+supplied both expected endtime and lifetimeasciiz.supplied both expected renew time and lifetime)ticket_privatera   get_EpochFromKerberosTimeassertIsNotNoner  assertIsNoner]   decode)r1   ticket_credsr  r  r  r  r  r  r  r  
renew_tills              r)   r  z&ProtectedUsersTests.check_ticket_times  s    ,*%JJ{H55	#ZZd33
229==	  !NP P P  00y8E 1 G GLL mKM M M 	w~~g'>'>???1222122222".!!'DF F F '+&;&;#,? '< 'A 'A# #.  !4!+!2!27!;!;= = = = = /.r*   c                    |t           t          f}nt          |t                    r|f}|                                }|                                }	|                                }
|                     t          |	                    d                    }|                     t          d|	g          }|                     t          d|	                                g          }|}||                     d          }|}|                                 }|                     |          }|j        }t!          j        d          }t!          j        d          }|rt&          nd}||r
t(          |f}nt(          }|                     ||	||||||	||	||
|||d ||||          \  }}|                     |           |                     t0          |d	                    |d
         }|r|                     ||           ||k    rd S n|                     ||           |d         }|                     ||d         |                                          }n|                     ||          }|                     |          }|g}|	                                }|                     ||	||||||||||
|||||||||          \  }}|r|                     ||           d S |                     |           |d         }|S )N/	name_typenameskrbtgtr  r  	renewabler   )cnamerealmsnamer  
renew_timeclient_as_etypesexpected_error_modeexpected_crealmexpected_cnameexpected_srealmexpected_snameexpected_saltr  expected_supported_etypesetypespadatar  ticket_decryption_keyr  r.  zmsg-typez
error-codepreauth_etype_info2)r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  preauth_keyr  r  r.  rep_ticket_creds) r   r   
isinstanceintr   	get_realmget_saltPrincipalName_creater   splitr   upperr  get_krbtgt_credsTicketDecryptionKey_from_credstgs_supported_enctypesr  
KDCOptionsr  r   r   _test_as_exchanger  r]   r   assertInPasswordKey_from_etype_info2get_kvnoPasswordKey_from_creds"get_enc_timestamp_pa_data_from_keycheck_error_repcheck_as_reply) r1   rd   re   r	  r)  r  r  r.  	user_namer  saltr  r  r  r  r  krbtgt_credsr  r   r  r  expected_errorr  repkdc_exchange_dict
error_codeetype_info2r  ts_enc_padatar  expected_realmr  s                                    r)   r  zProtectedUsersTests._test_etype  s    =,.>?EEs## 	HE&&((	!!~~))L090D0D * F F))K1950A * C C22!(EKKMM)B 3 D D <(((66D
,,..//== 	 '=*;77".{;;1=D--1  ?&>&N##&>#%)%;%;%!&$7 %- %$"-*9'&;')) &< &+ &+"C"*   %%%YJ888\*J Bj*=>>>//F 0   !4jAAA+,ABK;;E<GN<ANN<L<LN NKK 55e]KKK??LL!%!7!7!" .*)*))&5##"7#%+ "8 "' "',  	  n5554C   ();<r*   c                    |                                 }|                                }|                                }	t          t          f}
|                     t          |                    d                    }|                     t          d|g          }|                     t          d|	                                g          }|}| 
                    d          }|                                 }|                     |          }|j        }t          j        |          }|t          j        |          }|t          j        |          }|                     |||||
t$          |||||	||||
d |||          \  }}|                     |           |d         }|                     ||d         |                                          }|                     |          }|g}|	                                }|rt.          nd}|                     |||||
||||||	||||
|||||	          \  }}|r|                     ||           d S |                     |           |d
         }|S )Nr  r  r  r  r  )r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   )r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  )r   r!  r"  r   r   r#  r   r$  r   r%  r  r&  r'  r(  r  r)  r  r*  r   check_pre_authenticationr,  r-  r/  r   r0  r1  )r1   rd   r  r  re   r  r  r2  r  r3  r	  r  r  r  r  r  r4  r  r   r6  r7  r9  r  r:  r  r;  r5  r  s                               r)   r  z(ProtectedUsersTests._get_tgt_check_flagsZ  s    &&((	!!~~(*:;))L090D0D * F F))K1950A * C C22!(EKKMM)B 3 D D $$E$22,,..//== 	 '=*;77%&2>BBN'(45EFF!%!7!7" 8!)! )-&5#"7#' "8 "% "%( 	%%c***'(=>778CA8=8H8HJ J ??LL+7>Q!%!7!7" .*)*))-&5##"7#) "8 "% "%*  	  n5554C   ();<r*   )F)NNNN)FNNNTN)TFNN)[__name__
__module____qualname__classmethodr%   r,   r   r   USERrG   rn   rt   rw   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r  r  r!  r&  r+  r/  r2  r7  r;  r>  rA  rD  rH  rJ  rM  rO  rR  rT  rY  r\  r^  ra  re  rh  rk  ro  rq  rt  rv  rz  r}  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  __classcell__)r(   s   @r)   r!   r!   9   s       $ $ $ $ [$
) ) ) ) ) !, 7 <!&*7 7 7 76. . . .<$ $ $7 7 77 7 7(@I @I @IFG G GF F FT: T: T:n- - -, , ,- - -, , ,= = =2, , ,? ? ?, , ,? ? ?, , ,? ? ?, , ,? ? ?? ? ?
, , ,- - -F F F
, , ,A A A, , ,H H H, , ,F F F
, , ,A A A, , ,H H H, , ,? ? ?, , ,- - -A A A, , ,H H H, , ,A A A, , ,H H H, , ,G G G
- - -- - -$N N N
, , ,N N N
, , ,G G G- - -N N N, , ,N N N, , ,4 4 44 4 48 8 8	: 	: 	:8 8 8
C 
C 
C; ; ;; ; ;&@ @ @5 5 5> > >5 5 5H H HA A A  $? ? ?  $ )-)-/3/3)= )= )= )=Z "'"& $!%z z z z~ *.*/,0.2f f f f f f f fr*   r!   __main__)5sysospathinsertenviron	functoolsr   rV   sambar   r   r   samba.dcerpcr	   r
   r   r   r   r   	samba.ndrr   r   samba.samdbr   samba.tests.krb5.kcryptotestskrb5r   samba.tests.krb5.kdc_base_testr   "samba.tests.krb5.rfc4120_constantsr   r   r   r   r   r   r   r   r   r   r   r   r   samba.tests.krb5.rfc4120_pyasn1rfc4120_pyasn1r  r-   r/   r!   r>  unittestmainr4   r*   r)   <module>rX     s9  & 


 				 <      !$
        



 C C C C C C C C C C E E E E E E E E E E E E E E E E * * * * * * * *       * * * * * * * * * * * * 6 6 6 6 6 6                              4 3 3 3 3 3 3 3 3 3 3 3 G G G G G+ G G GT$ zNOOOHMOOOOO	 r*   