
    Fc                     ~   d dl Z d dlZe j                            d d           dej        d<   d dlZd dlmZmZ d dl	m
Z
mZmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZmZ d dlmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z% d dl&m'c m(c m)Z* dZ+dZ, G d de          Z-e.dk    rdZ+dZ,d dl/Z/ e/j0                     dS dS )    Nz
bin/python1PYTHONUNBUFFERED)dsdbntstatus)krb5paclsasecurity)env_get_var_value)	CksumtypeEnctype)KDCBaseTest)RodcPacEncryptionKeyZeroedChecksumKey)AES256_CTS_HMAC_SHA1_96ARCFOUR_HMAC_MD5KDC_ERR_BADMATCHKDC_ERR_BADOPTIONKDC_ERR_BAD_INTEGRITYKDC_ERR_GENERICKDC_ERR_INAPP_CKSUMKDC_ERR_MODIFIEDKDC_ERR_SUMTYPE_NOSUPPKDC_ERR_TGT_REVOKEDKU_PA_ENC_TIMESTAMPKU_AS_REP_ENC_PARTKU_TGS_REP_ENC_PART_SUB_KEYNT_PRINCIPALFc                       e Zd Z fdZdHdZd Zd Zd Zd Zd Z	d	 Z
d
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Z d  Z!d! Z"d" Z#d# Z$d$ Z%d% Z&d& Z'd' Z(d( Z)d) Z*d* Z+d+ Z,d, Z-d- Z.d. Z/d/ Z0d0 Z1d1 Z2d2 Z3d3 Z4d4 Z5d5 Z6d6 Z7d7 Z8d8 Z9d9 Z:e;j<        e;j=        e;j>        hZ?d: Z@d; ZAd< ZBd= ZCd> ZDd? ZEd@ ZFdA ZGdB ZHdC ZIdHdDZJdIdFZKdG ZL xZMS )JS4UKerberosTestsc                     t          t          |                                            t          | _        t
          | _        d S N)superr   setUpglobal_asn1_printdo_asn1_printglobal_hexdump
do_hexdump)self	__class__s    </usr/lib/python3/dist-packages/samba/tests/krb5/s4u_tests.pyr#   zS4UKerberosTests.setUp=   s3    %%++---.(    Nc                 	   |                                  }|                                }|                                }|                     d|g          }|                     dd|g          }|                     d          }t          j        d          }d }	d}
|                     |	t          |          |||d |d d	|
d d 
          }| 	                    |          }| 
                    |           |                     |d         d           |                     |d         d           |                     |d         t          j                              }|D ]}|d         dk    r
|d         } n|                     |t          j                              }|                     ||d                   }|                                 \  }}|                     ||          }|                     |t          j                              }|                     |t*          |          }|                     |t          j                              }|                     d|          }t          j        d          }|g}	|                     |	t          |          |||d |d d	|
d d 
          }| 	                    |          }| 
                    |           |d         }|                     |d           |                    t2          |d         d                   }	 |                     |t          j                              }n8# t6          $ r+ |                     |t          j                              }Y nw xY w|}t;          d          }|                     d|g          }t          j        d          }|                     d          }|d         }|                     |d                   }|                     ||||          }|g}	|                      |j!                  }|                                 \  }}| "                    |	|||t          |          |||d |d d|
d d d d ||          }| 	                    |          }| 
                    |           |d         }|dk    rO|                    tF          |d         d                   }|                     |t          j                              }|S )N   	name_typenames   krbtgti  )offsetforwardable)         i)padatakdc_optionscnamerealmsname	from_time	till_time
renew_timenonceetypes	addressesadditional_ticketszmsg-type   z
error-code   ze-data)asn1Speczpadata-type   zpadata-valuer      zenc-partcipherFOR_USERticketkeynamer;   tgt_session_keyctypei)r8   cusecctimerK   r9   r:   r;   r<   r=   r>   r?   r@   rA   rB   EncAuthorizationDataEncAuthorizationData_keyrC   ticket_session_keyauthenticator_subkey   )$get_service_credsget_username	get_realmPrincipalName_createget_KerberosTime	krb5_asn1
KDCOptionsAS_REQ_createstrsend_recv_transactionassertIsNotNoneassertEqual
der_decodeMETHOD_DATAETYPE_INFO2PasswordKey_from_etype_info2get_KerberosTimeWithUsecPA_ENC_TS_ENC_create
der_encodePA_ENC_TS_ENCEncryptedData_creater   EncryptedDataPA_DATA_createdecryptr   EncASRepPart	ExceptionEncTGSRepPartr
   EncryptionKey_importPA_S4U2Self_create	RandomKeyetypeTGS_REQ_creater   )r(   pa_s4u2self_ctypeservice_credsservicer;   r:   r<   tillr9   r8   rA   reqrep
rep_padatapaetype_info2rL   patimepausecpa_tsmsg_type	enc_part2for_user_nameunamerK   rU   pa_s4usubkeyrR   rQ   s                                 r*   _test_s4u2selfzS4UKerberosTests._test_s4u2selfB   s\   ..00,,..''))))AgY)GG))Ah=N)OO$$E$22*=99  -0-=-=',',',+/+/,0'1(.+/48 ! : : ((--S!!!Z"---\*B///__MI$9$;$; % = =
  	 	B- B&& 0 ' oo)"7"9"9 & ; ; //{1~NN88::))&&99	0G0I0IJJ))#/BEJJ	0G0I0IJJ##Au--*=99  -0-=-=',',',+/+/,0'1(.+/48 ! : : ((--S!!!z?2&&&KK 2C
OH4MNN		?I$:$<$< ( > >II 	? 	? 	?I$;$=$= ( ? ?III	?
 )*55))Am_)MM*=99$$E$22X!66y7GHH((e59K/@ ) B B  2 8996688!!(-(-)/.1+.>.>(-(-(-,0,0-1(2)/,07;;?595G7=% " ? ?& ((--S!!!z?r>>+S_X-FH HII$;$=$= ( ? ?I s   (M 2M;:M;c                 Z    |                                  }|                     |d           d S )NrW   )r   rc   r(   r   s     r*   test_s4u2selfzS4UKerberosTests.test_s4u2self   s/    &&((2&&&&&r+   c                 r    |                      t          j                  }|                     |d           d S )Nrx   rW   )r   r   HMAC_MD5rc   r   s     r*   test_s4u2self_hmac_md5_checksumz0S4UKerberosTests.test_s4u2self_hmac_md5_checksum   s7    &&9K&LL2&&&&&r+   c                 r    |                      t          j                  }|                     |d           d S Nr   rD   )r   r   MD5rc   r   s     r*   "test_s4u2self_md5_unkeyed_checksumz3S4UKerberosTests.test_s4u2self_md5_unkeyed_checksum   s6    &&&GG2&&&&&r+   c                 r    |                      t          j                  }|                     |d           d S r   )r   r   SHA1rc   r   s     r*   #test_s4u2self_sha1_unkeyed_checksumz4S4UKerberosTests.test_s4u2self_sha1_unkeyed_checksum   s6    &&&HH2&&&&&r+   c                 r    |                      t          j                  }|                     |d           d S r   )r   r   CRC32rc   r   s     r*   $test_s4u2self_crc32_unkeyed_checksumz5S4UKerberosTests.test_s4u2self_crc32_unkeyed_checksum   s6    &&&II2&&&&&r+   c                 6     |                     dd           }                      j        j        |          }|                     dd           }                      j        j        |          }                     |           |                     dd           }| |            |                                }                     t          |g           	                                }|
                                }	                     ||	          }
|                     dd           }||                                d d         }                     t          d|g          }|                                |                     d	d           }|t          j        |          }|                     d
d           }|t          j        |          }|                     dd          }|                     dd           }|r
 j        }d }nd } j        }                     |           |                     dd          }t          j        |          }                     |          }                     t*          j                  }|                     dt.          t0          f          }|                     dd           }|                     dd           }|                     dd           }  fd}                     ||||
|||d||| j        || |t7          |          d|          }                     |d ||           |s2|d         }                     |          }                     |                                i |           d S )Nclient_optsaccount_typeoptsservice_optsmodify_service_tgt_fnr.   service_namehostexpected_flagsunexpected_flagsexpected_error_moder   expected_statusr9   0rA   expect_edataexpected_groupsunexpected_groupsc                 J                         j        d           }|g|fS NrM   rt   session_key)_kdc_exchange_dict_callback_dictreq_bodyr   client_cnamer;   r(   service_tgts       r*   generate_s4u2self_padatazES4UKerberosTests._run_s4u2self_test.<locals>.generate_s4u2self_padata"  s=     ,,! + 7	 -  F 8X%%r+   TF)expected_crealmexpected_cnameexpected_srealmexpected_snameexpected_account_namer   expected_sidr   r   ticket_decryption_keyexpect_ticket_checksumgenerate_padata_fncheck_error_fncheck_rep_fncheck_kdc_private_fnr   r   tgtrV   r9   expect_claimsr   r:   r;   r<   rA   rep_ticket_creds) popget_cached_credsAccountTypeUSERCOMPUTERget_tgtrY   r[   r   	get_samdbget_dnget_objectSidrZ   r]   TicketFlagsgeneric_check_kdc_errorgeneric_check_kdc_repassertIsNoner^   TicketDecryptionKey_from_credsru   r   AES256r   r   tgs_exchange_dictgeneric_check_kdc_privater`   _generic_kdc_exchangeget_ticket_pacrb   rc   )!r(   kdc_dictr   client_credsr   ry   r   client_namesamdb	client_dnsidr   service_snamer   r   r   r   r   r   r9   service_decryption_keyrV   rA   r   r   r   r   kdc_exchange_dictrK   pacr   r;   r   s!   `                             @@@r*   _run_s4u2self_testz#S4UKerberosTests._run_s4u2self_test   s   ll=$77,,). -    ||ND99--)2 .   ll=11 (-Dd K K ,//<<K"//1100<8C} 1 F F    ''))	  	22||ND99(5577<L11L9?8N 2 P P &&((!&6==%&2>BBN#<<(:DAA'(45EFF&ll+@!DD",,'8$?? 	/!9NLL!N5Lo...ll=#66*;77!%!D!D" "  $~~gn==h)@)9); < <  ||ND99",,'8$??$LL)<dCC		& 		& 		& 		& 		& 		& 		& 		& !22!'!("-/)-"8#'7)%!%!? 3+!5K((%- 3 ' '0 	""#4)-).)6*0	 	# 	2 	2 	2 # 	&&'9:F%%f--C  %%% 	X&&&&&r+   c                 p    |                      ddidt          j        | j        d          dd           d S )Nnot_delegatedFr4   Tflag)r   r9   r   r   r   	functoolspartialset_ticket_forwardabler(   s    r*   test_s4u2self_forwardablez*S4UKerberosTests.test_s4u2self_forwardableW  s_     $U   -)2):/d*< *< *<"/ 		 		 		 		 		r+   c           	      X      fd}                      t          ddid|ddd           d S )Nc                 \                         | d          }                     |           S )NTr   )r   remove_ticket_pac)rK   r(   s    r*   forwardable_no_paczAS4UKerberosTests.test_s4u2self_no_pac.<locals>.forwardable_no_pacf  s/    00d0CCF))&111r+   r   Fr4   )r   r   r9   r   r   r   )r   r   )r(   r   s   ` r*   test_s4u2self_no_pacz%S4UKerberosTests.test_s4u2self_no_pace  se    	2 	2 	2 	2 	2 	':#U   -);"/ %	 	
	 
	 
	 
	 
	r+   c                 n    |                      ddit          j        | j        d          dd           d S )Nr   FTr   r4   )r   r   r   r   r   s    r*   !test_s4u2self_without_forwardablez2S4UKerberosTests.test_s4u2self_without_forwardablex  s\     $U  *3):/d*< *< *<$1 	 	 	 	 	r+   c                 p    |                      ddidt          j        | j        d          dd           d S )Nr   Fr4   r   r   r9   r   r   r   r   s    r*   test_s4u2self_not_forwardablez.S4UKerberosTests.test_s4u2self_not_forwardable  s_     $U   -)2):/e*= *= *=$1 		 		 		 		 		r+   c                 p    |                      ddidt          j        | j        d          dd           d S )Nr   Tr4   r   r   r   r   s    r*   "test_s4u2self_client_not_delegatedz3S4UKerberosTests.test_s4u2self_client_not_delegated  s_     $T   -)2):/d*< *< *<$1 		 		 		 		 		r+   c           	      x    |                      ddiddddt          j        | j        d          dd           d S )	Nr   F trusted_to_auth_for_delegationdelegation_to_spnr4   Tr   r   r   r9   r   r   r   r   s    r*   'test_s4u2self_not_trusted_empty_allowedz8S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed  sq     $U  7<)+! !  -)2):/d*< *< *<"/ 	 	 	 	 	r+   c           	      x    |                      ddiddddt          j        | j        d          dd           d S )	Nr   Ftestr   r4   Tr   )r   r   r9   r   r   r   r   s    r*   *test_s4u2self_not_trusted_nonempty_allowedz;S4UKerberosTests.test_s4u2self_not_trusted_nonempty_allowed  sq     $U  7<)2! !  -)2):/d*< *< *<$1 	 	 	 	 	r+   c           	      x    |                      ddiddddt          j        | j        d          dd           d S )	Nr   FTr   r   r4   r   r  r   r   s    r*   #test_s4u2self_trusted_empty_allowedz4S4UKerberosTests.test_s4u2self_trusted_empty_allowed  sq     $U  7;)+! !  -)2):/d*< *< *<"/ 	 	 	 	 	r+   c           	      x    |                      ddiddddt          j        | j        d          dd           d S )	Nr   FTr  r   r4   r   r  r   r   s    r*   &test_s4u2self_trusted_nonempty_allowedz7S4UKerberosTests.test_s4u2self_trusted_nonempty_allowed  sq     $U  7;)2! !  -)2):/d*< *< *<"/ 	 	 	 	 	r+   c                    |                      | j        j        ddd          }|                                d d         }|                     t
          dddiddi|d	t          j        | j        d
          d           d S )NTr   )r   idr   r   Fr   r   r4   r   )r   r   r   r   r   r9   r   )	r   r   r   rY   r   r   r   r   r   )r(   other_credsother_snames      r*   test_s4u2self_wrong_snamez*S4UKerberosTests.test_s4u2self_wrong_sname  s    ++)226  ,   "..00"5'7 %#U  5d! !,,)2):/d*< *< *< 	 	 	 	 	r+   c           	      x    |                      ddiddddt          j        | j        d          dd           d S )Nr   FT)r   no_auth_data_requiredr4   r   r  r   r   s    r*   #test_s4u2self_no_auth_data_requiredz4S4UKerberosTests.test_s4u2self_no_auth_data_required  sq     $U  7;-1! !  -)2):/d*< *< *<"/ 	 	 	 	 	r+   c                 h    |                      ddit          j        gt          j        gd           d S )Nr   F)r   r   r   )r   r	   SID_SERVICE_ASSERTED_IDENTITY.SID_AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITYr   s    r*   test_s4u2self_asserted_identityz0S4UKerberosTests.test_s4u2self_asserted_identity  sN     $U  %-$J#K&.&]%^ 	 	 	 	 	r+   c                    9:; |                     dd          }|                     dd           }                      j        j        |          }                                 }|                                }                     ||          }|                     di           }|                     di           }	|                     dd          }
|                     dd          }                     |
o|           |r}                      j        j        |          } 	                    d	|	           t          |                                          |	d	<                         j        j        |	          }nq                      j        j        |	          }|
r- 	                    d
|           |                                |d
<                         j        j        |          }                     |          ;|                                }|                                :                     t           |g          9|                                d d         }|                                }d}                     t           ||g          }                     |          }|                     dd          }|                     dd           }|                     dd           }|                     dd          }t%          j        |          }|                     dt(          t*          f          }|rň9: ;fd}t%          j        d          }t%          j        d          }t%          j        d          }                     t0          j                  }                     :9|||||||||| j         j        ;|t          |          dd          }                     |d |||           |d         } n1                     |||          }!                     |!|||          } |                     dd           }"|" |"|           } | j        g}#|                     dd           }$|$ |$;          ;|                     dd           }%|%!t          t%          j        d                    }%|                                d d         }&|                                }'d}(                     t           |(|&g          })                     |          }*|j         }+|                     d          },|                     d d           }-|,r
 j!        }.d }/nd }. j        }/ "                    |-           |                     d!d           }0|0 #                    |,           |                     d"d           }1                     t0          j                  }2|                                }3|                     d#g           }4d$| d%| }5|4$                    |5                                :9|'|)|||||+|*|.|/ j        |,|-i ;|2|%|1|0|3|4|&          }6                     |6d |'|)||#'           |,sL|6d         }7 %                    |7|(          }8|r &                    |8           n "                    |8            '                    i |           d S ))Ns4u2selfFr   r   service1_optsservice2_optsallow_delegation
allow_rbcddelegation_from_dnr   r.   r   r   
expect_pacTr   r   client_tkt_optionsr4   rA   c                 J                         j        d           }|g|fS r   r   )r   r   r   r   r   client_realmr(   service1_tgts       r*   r   zGS4UKerberosTests._run_delegation_test.<locals>.generate_s4u2self_padatak  s=     00%&$0$<	 1     x))r+   r   )r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rV   r9   r   r   r   r   )r9   r   modify_client_tkt_fnr   r9   zcname-in-addl-tktr   r   r   pac_optionsexpected_transited_serviceszhost/@)r   r   r   r   r   r   r   r   expected_supported_etypesr   r   r   r   r   r   callback_dictr   rV   r9   r$  r   expected_proxy_targetr%  r  )r:   r;   r<   rA   rC   )r  )(r   r   r   r   r   r   r   assertFalser   assertNotInr`   get_spnr   rY   rZ   r[   r   r   r]   r   r   r   r^   ru   r   r   r   r   r   r   get_service_ticketrK   tgs_supported_enctypesr   r   
assertTrueappendr   rb   rc   )<r(   r   r  r   r   r   r   r   r  r  r  r  service1_credsservice2_credsclient_usernameservice1_nameservice1_realmservice1_serviceservice1_snameservice1_decryption_keyr  r   r   r  r   rA   r   s4u2self_expected_flagss4u2self_unexpected_flagss4u2self_kdc_optionss4u2self_authenticator_subkeys4u2self_kdc_exchange_dictclient_service_tkt
client_tgtr#  rC   r   r9   service2_nameservice2_realmservice2_serviceservice2_snameservice2_decryption_keyservice2_etypesr   r   r   r   r   r$  rV   r)  r%  transited_servicer   rK   r   r   r!  r"  s<   `                                                        @@@r*   _run_delegation_testz%S4UKerberosTests._run_delegation_test$  s   <<
E22ll=$77,,). -      ''))	  	22 _b99 _b99#<<(:EBB\\,66
)8j999 	$!22!-6" 3 $ $N 1=AAA25n6K6K6M6M2N2NM./!22!-6" 3 $ $NN "22!-6" 3 $ $N   N  !4mDDD5C5K5K5M5M12!22!-6" 3 $ $N ||N33&3355#--//00<8G7H 1 J J '3355crc:'1133!22"+;+8+: 3 ; ; #'"E"E# # \\,55
",,'8$??$LL)<dCC%\\*>NN"./ABBh)@)9); < <  6	/	* 	* 	* 	* 	* 	* 	* 	* '0&;M&J&J#(1(=c(B(B%#,#7#F#F ,0NN7>,J,J))-)?)? ,+ .-&5 /"3 6!:&=#;!7%)%C %B 455#"' *@ *$ *$&* &&'A-1-;-;.4	 ' 6 6 6 "<<N!Ol2D5C & E EJ "&!8!8.-	 "9 "/ "/  (||,BDII+!5!56H!I!I078 (-Dd K K ,00>>Lll=$77i23FGGHHK&3355crc:'1133!22"+;+8+: 3 ; ; #'"E"E# #(?&ll+@AA",,'8$?? 	/!9NLL!N5Lo...||ND99#OO/000ll=$77#~~gn== . 6 6 8 8&.ll)2'/ '/# EMDDNDD#**+<=== 22('*)"1+/&5"9)%!%!? 3+!5##%"7(C!1 3 # #4 	""#4)-)7)7*06H 	# 	J 	J 	J # 	'&'9:F%%f%DDC '$$S))))!!#&&& 	X&&&&&r+   c                     |                                  }|                     |          }|t          j        k     r|                     d           d S d S )NzRBCD requires FL2008)r   get_domain_functional_levelr   DS_DOMAIN_FUNCTION_2008skipTest)r(   r   functional_levels      r*   skip_unless_fl2008z#S4UKerberosTests.skip_unless_fl2008  sT      ;;EBBd:::MM011111 ;:r+   c                 6    |                      ddd           d S )Nr   T)r   r  rG  r   s    r*   test_constrained_delegationz,S4UKerberosTests.test_constrained_delegation	  s4    !!'($( 	 	 	 	 	r+   c                 f    |                      ddt          j        gt          j        gd           d S )Nr   T)r   r  r   r   )rG  r	   r  r  r   s    r*   <test_constrained_delegation_authentication_asserted_identityzMS4UKerberosTests.test_constrained_delegation_authentication_asserted_identity  sH     	!!'($($,$[#\&.&L%M	 	 	 	 	 	r+   c           	      n    |                      dddddit          j        gt          j        gd           d S )Nr   Tr   )r   r  r  r  r   r   )rG  r	   r  r  r   s    r*   5test_constrained_delegation_service_asserted_identityzFS4UKerberosTests.test_constrained_delegation_service_asserted_identity  sW     	!!'($( 4d" %-$J#K&.&]%^	 	
	 
	 
	 
	 
	r+   c                 >    |                      ddddidd           d S )Nr   Tr  F)r   r  r  r  rO  r   s    r*   1test_constrained_delegation_no_auth_data_requiredzBS4UKerberosTests.test_constrained_delegation_no_auth_data_required,  sC    !!'($(+T" $ 	 	 	 	 	r+   c                 t    g d}|                      ddt          j        | j        |          |d           d S )Nservice1service2service3r   Tservices)r   r  r#  r%  )rG  r   r   add_delegation_infor(   r]  s     r*   4test_constrained_delegation_existing_delegation_infozES4UKerberosTests.test_constrained_delegation_existing_delegation_info8  sd     877!!'($((1(9,x)A )A )A/7 	 	 	 	 	r+   c                 V    |                      t          t          j        dd           d S )NF)r   r   r  )rG  r   r   NT_STATUS_NOT_SUPPORTEDr   s    r*   'test_constrained_delegation_not_allowedz8S4UKerberosTests.test_constrained_delegation_not_allowedG  s<     	!!'8#+#C$) 	 	 	 	 	r+   c                 \    |                      t          t          fd| j        dd           d S )NTFr   r  r#  r   )rG  r   r   r   r   s    r*   )test_constrained_delegation_no_client_pacz:S4UKerberosTests.test_constrained_delegation_no_client_pacQ  sG     	!!(8(;(=$((,(> % 	 	 	 	 	r+   c                 N    |                      t          d| j        dd           d S )NTF)r   r  r   r   rG  r   r   r   s    r*   *test_constrained_delegation_no_service_pacz;S4UKerberosTests.test_constrained_delegation_no_service_pac]  s?     	!!':$()-)? %	 	 	 	 	 	r+   c                 b    |                      t          t          fd| j        dddid           d S )NTFr  )r   r  r#  r   r  )rG  r   r   r   r   s    r*   ?test_constrained_delegation_no_client_pac_no_auth_data_requiredzPS4UKerberosTests.test_constrained_delegation_no_client_pac_no_auth_data_requiredh  sQ     	!!(8(9(;$((,(> %+T"	 	
	 
	 
	 
	 
	r+   c           	      V    |                      t          d| j        ddiddd           d S )NTr  F)r   r  r   r  r  r   rh  r   s    r*   @test_constrained_delegation_no_service_pac_no_auth_data_requiredzQS4UKerberosTests.test_constrained_delegation_no_service_pac_no_auth_data_requiredw  sN     	!!':$()-)?+T" $ %	 	
	 
	 
	 
	 
	r+   c           	          |                      t          t          j        dt	          j        | j        d          d           d S )NTFr   )r   r   r  r#  )rG  r   r   NT_STATUS_ACCOUNT_RESTRICTIONr   r   r   r   s    r*   +test_constrained_delegation_non_forwardablez<S4UKerberosTests.test_constrained_delegation_non_forwardable  sW    !!'8#+#I$((1(9/e)= )= )=	 	 	 	 	 	r+   c                 8    |                      dddd           d S )Nr   0001T)r   r$  r  rO  r   s    r*   ,test_constrained_delegation_pac_options_rbcdz=S4UKerberosTests.test_constrained_delegation_pac_options_rbcd  s9     	!!'(%$( 	 	 	 	 	r+   c                 h    |                                   |                     dddddidd           d S )Nr   Trr  r  F)r   r  r$  r  r  )rM  rG  r   s    r*   test_rbcd_no_auth_data_requiredz0S4UKerberosTests.test_rbcd_no_auth_data_required  sX    !!!!!'("%+T" $ 		 		 		 		 		r+   c           	          |                                   g d}|                     dddt          j        | j        |          |d           d S )NrX  r   Trr  r\  )r   r  r$  r#  r%  )rM  rG  r   r   r^  r_  s     r*   "test_rbcd_existing_delegation_infoz3S4UKerberosTests.test_rbcd_existing_delegation_info  sy    !!!
 877!!'("%(1(9,x)A )A )A/7 	 	 	 	 	r+   c                 X    |                      t          t          j        ddd           d S )NFrr  r   r   r  r$  )rG  r   r   NT_STATUS_NOT_FOUNDr   s    r*   test_rbcd_not_allowedz&S4UKerberosTests.test_rbcd_not_allowed  s?     	!!'8#+#?#%	 	 	 	 	 	r+   c                     |                                   |                     t          t          j        dd| j        d           d S NTrr  r   r   r  r$  r#  rM  rG  r   r   rb  r   r   s    r*   test_rbcd_no_client_pac_az*S4UKerberosTests.test_rbcd_no_client_pac_a  sW    !!! 	!!'7#+#C"%(,(> 	 	 	 	 	r+   c           	          |                                   |                     t          t          j        dd| j        ddid           d S )NTrr  r   	host/test)r   r   r  r$  r#  r  rM  rG  r   r   NT_STATUS_NO_MATCHr   r   s    r*   test_rbcd_no_client_pac_bz*S4UKerberosTests.test_rbcd_no_client_pac_b  sa    !!! 	!!'7#+#>"%(,(>'+"	 	
	 
	 
	 
	 
	r+   c                 x    |                                   |                     t          dd| j        dd           d S )NTrr  F)r   r  r$  r   r   rM  rG  r   r   r   s    r*   test_rbcd_no_service_pacz)S4UKerberosTests.test_rbcd_no_service_pac  sT    !!! 	!!':"%)-)? % 	 	 	 	 	r+   c           	          |                                   |                     t          t          j        dd| j        ddid           d S )NTrr  r  )r   r   r  r$  r#  r  r  r   s    r*   /test_rbcd_no_client_pac_no_auth_data_required_az@S4UKerberosTests.test_rbcd_no_client_pac_no_auth_data_required_a  sa    !!! 	!!'7#+#C"%(,(>+T"	 	
	 
	 
	 
	 
	r+   c           
          |                                   |                     t          t          j        dd| j        ddiddid           d S )NTrr  r   r  r  )r   r   r  r$  r#  r  r  r  r   s    r*   /test_rbcd_no_client_pac_no_auth_data_required_bz@S4UKerberosTests.test_rbcd_no_client_pac_no_auth_data_required_b  sm    !!! 	!!'7#+#>"%(,(>'+" ,T" 	 	 	 	 	r+   c           	      ~    |                                   |                     t          dd| j        ddidd           d S )NTrr  r  F)r   r  r$  r   r  r   r  r   s    r*   .test_rbcd_no_service_pac_no_auth_data_requiredz?S4UKerberosTests.test_rbcd_no_service_pac_no_auth_data_required  s`    !!! 	!!':"%)-)?+T" !&	 	
	 
	 
	 
	 
	r+   c           
          |                                   |                     t          t          j        ddt          j        | j        d          d           d S )NTrr  Fr   r~  )rM  rG  r   r   ro  r   r   r   r   s    r*   test_rbcd_non_forwardablez*S4UKerberosTests.test_rbcd_non_forwardable)  sn    !!! 	!!'8#+#I"%(1(9/e)= )= )= 	 	 	 	 	r+   c                     |                                   |                     t          t          j        ddd           d S )NTr   ry  )rM  rG  r   r   rb  r   s    r*   test_rbcd_no_pac_options_az+S4UKerberosTests.test_rbcd_no_pac_options_a8  sQ    !!! 	!!'8#+#C""	 	 	 	 	 	r+   c                     |                                   |                     t          t          j        ddddid           d S )NTr   r   r  )r   r   r  r$  r  )rM  rG  r   r   r  r   s    r*   test_rbcd_no_pac_options_bz+S4UKerberosTests.test_rbcd_no_pac_options_bE  s[    !!!
 	!!'8#+#>""'+" 		 		 		 		 		r+   c           
          |                      t          t          fddt          j        | j        dd          dd           d S )NTr   Fr   update_pac_checksums)r   r  r  r#  r   )rG  r   r   r   r   r   r   s    r*   3test_bronze_bit_constrained_delegation_old_checksumzDS4UKerberosTests.test_bronze_bit_constrained_delegation_old_checksumV  sd    !!(8(=(?$(&)(1(9/E); ); ); !&	 	
	 
	 
	 
	 
	r+   c                     |                                   |                     t          t          ft          j        dddt          j        | j        dd          d           d S )NTrr  r   Fr  )r   r   r  r$  r  r#  )	rM  rG  r   r   r   rb  r   r   r   r   s    r*   !test_bronze_bit_rbcd_old_checksumz2S4UKerberosTests.test_bronze_bit_rbcd_old_checksumd  s|    !!! 	!!(8(=(?#+#C"%&)(1(9/E); ); );
 
	 	 	 	 	r+   c           
      (   | j         D ]}|                     |          5  |t          j        k    rt          t
          f}nt          }|                     |dt          j	        | j
        |          dd           d d d            n# 1 swxY w Y   d S NchecksumTFre  )pac_checksum_typessubTestr   PAC_TYPE_TICKET_CHECKSUMr   r   r   rG  r   r   remove_pac_checksumr(   r  r   s      r*   3test_constrained_delegation_missing_client_checksumzDS4UKerberosTests.test_constrained_delegation_missing_client_checksumu  s    / 	 	Hx00  w???+;+<+>'' +:'))/B,0090A 4x1I 1I 1I(-                 	 	s   ABB
	B
	c                    t           j        t           j        fD ]r}|                     |          5  |                     t
          t          j        dt          j	        | j
        |          d           d d d            n# 1 swxY w Y   sd S )Nr  Tr   r   r  r   )r   PAC_TYPE_SRV_CHECKSUMPAC_TYPE_KDC_CHECKSUMr  rG  r   r    NT_STATUS_INSUFFICIENT_RESOURCESr   r   r  r(   r  s     r*   4test_constrained_delegation_missing_service_checksumzES4UKerberosTests.test_constrained_delegation_missing_service_checksum  s     6 68 	 	Hx00 	 	))/>$E,01:1B 4x2I 2I 2I   	 	 	 	 	 	 	 	 	 	 	 	 	 	 		 	s   AB  B	B	c                 X   |                                   | j        D ]}|                     |          5  |t          j        k    rt
          }nt          }|                     |t          j	        ddt          j        | j        |          d           d d d            n# 1 swxY w Y   d S Nr  Trr  r~  )rM  r  r  r   r  r   r   rG  r   rb  r   r   r  r  s      r*   !test_rbcd_missing_client_checksumz2S4UKerberosTests.test_rbcd_missing_client_checksum  s
   !!! / 	 	Hx00  w???*:''*9'))/B$<&*'-090A 4x1I 1I 1I 	 	 	              	 	s   ABB"	%B"	c                 F   |                                   t          j        t          j        fD ]s}|                     |          5  |                     t          t          j        ddt          j
        | j        |          d           d d d            n# 1 swxY w Y   td S )Nr  Trr  r   r   r  r$  r   )rM  r   r  r  r  rG  r   r   r  r   r   r  r  s     r*   "test_rbcd_missing_service_checksumz3S4UKerberosTests.test_rbcd_missing_service_checksum  s    !!! !6 68 	 	Hx00 
 
))/>$E&*'-1:1B 4x2I 2I 2I 	 	 	
 
 
 
 
 
 
 
 
 
 
 
 
 
 
	 	s   ABB	B	c           
          | j         D ]o}|                     |          5  |                     t          t          fdt          j        | j        |          dd           d d d            n# 1 swxY w Y   pd S r  )r  r  rG  r   r   r   r   zeroed_pac_checksumr  s     r*   2test_constrained_delegation_zeroed_client_checksumzCS4UKerberosTests.test_constrained_delegation_zeroed_client_checksum  s    / 
	 
	Hx00 	 	))0@0E0G,0090A 4x1I 1I 1I(-   	 	 	 	 	 	 	 	 	 	 	 	 	 	 	
	 
	s   A A,,A0	3A0	c                 :   | j         D ]}|                     |          5  |t          j        k    rt          t
          f}t          j        }nd}d }|                     ||dt          j
        | j        |          d           d d d            n# 1 swxY w Y   d S )Nr  r   Tr  )r  r  r   r  r   r   r   NT_STATUS_WRONG_PASSWORDrG  r   r   r  r(   r  r   r   s       r*   3test_constrained_delegation_zeroed_service_checksumzDS4UKerberosTests.test_constrained_delegation_zeroed_service_checksum  s   / 	 	Hx00  w<<<+;+@+B'&.&GOO*+'&*O))/B+:,01:1B 4x2I 2I 2I	                 	 	s   A#BB	B	c                 $   |                                   | j        D ]s}|                     |          5  |                     t          t
          j        ddt          j        | j	        |          d           d d d            n# 1 swxY w Y   td S r  )
rM  r  r  rG  r   r   rb  r   r   r  r  s     r*    test_rbcd_zeroed_client_checksumz1S4UKerberosTests.test_rbcd_zeroed_client_checksum  s    !!! / 	 	Hx00 
 
))/?$<&*'-090A 4x1I 1I 1I 	 	 	
 
 
 
 
 
 
 
 
 
 
 
 
 
 
	 	s   ABB	B	c                 V   |                                   | j        D ]}|                     |          5  |t          j        k    rt
          }t          j        }nd}d }|                     ||ddt          j
        | j        |          d           d d d            n# 1 swxY w Y   d S )Nr  r   Trr  r  )rM  r  r  r   r  r   r   r  rG  r   r   r  r  s       r*   !test_rbcd_zeroed_service_checksumz2S4UKerberosTests.test_rbcd_zeroed_service_checksum  s   !!! / 	 	Hx00  w<<<*:'&.&GOO*+'&*O))/B+:&*'-1:1B 4x2I 2I 2I                 	 	s   ABB!	$B!	c                 n   | j         D ]}| j        D ]}|                     ||          5  |t          j        k    r|t
          j        k    rt          t          f}nt          t          f}| 
                    |dt          j        | j        ||          dd           d d d            n# 1 swxY w Y   d S )Nr  rP   TFre  )r  unkeyed_ctypesr  r   r  r   r   r   r   r   rG  r   r   unkeyed_pac_checksumr(   r  rP   r   s       r*   3test_constrained_delegation_unkeyed_client_checksumzDS4UKerberosTests.test_constrained_delegation_unkeyed_client_checksum  s1   / 	 	H,  \\85\AA   G$AAA % 7 7/E/B/D++ 0?/B/D+ --3F044=4E $ 9)15@ 5@ 5@ -2                 	 	s   A2B((B,/B,c                    | j         D ]}| j        D ]}|                     ||          5  |t          j        k    rF|t
          j        k    rt          t          f}t          j
        }nt          t          f}t          j        }nd}d }|                     ||dt          j        | j        ||          d           d d d            n# 1 swxY w Y   d S )Nr  r   Tr  )r  r  r  r   r  r   r   r   r   r   NT_STATUS_LOGON_FAILUREr   r  rG  r   r   r  r(   r  rP   r   r   s        r*   4test_constrained_delegation_unkeyed_service_checksumzES4UKerberosTests.test_constrained_delegation_unkeyed_service_checksum#  sN   / 	 	H,  \\85\AA  7#@@@ IN223I3F3H/.6.NOO3B3F3H/ !) I ,O /0+*.--3F/>045>5F $ 9)16@ 6@ 6@	                 	 	s   BCC	C	c                    |                                   | j        D ]}| j        D ]}|                     ||          5  |t          j        k    r|t          j        k    rt          }nt          }| 
                    |t          j        ddt          j        | j        ||          d           d d d            n# 1 swxY w Y   d S )Nr  Trr  r~  )rM  r  r  r  r   r  r   r   r   r   rG  r   rb  r   r   r  r  s       r*   !test_rbcd_unkeyed_client_checksumz2S4UKerberosTests.test_rbcd_unkeyed_client_checksum@  s3   !!! / 	 	H,  \\85\AA   G$AAA % 7 7.D++.=+--3F ( @*.+14=4E $ 9)15@ 5@ 5@	 	
 
 
              	 	s   A/B99B= B=c                    |                                   | j        D ]}| j        D ]}|                     ||          5  |t          j        k    r8|t          j        k    rt          }t          j
        }nt          }t          j        }nd}d }|                     ||ddt          j        | j        ||          d           d d d            n# 1 swxY w Y   d S )Nr  r   Trr  r  )rM  r  r  r  r   r  r   r   r   r   r  r   r  rG  r   r   r  r  s        r*   "test_rbcd_unkeyed_service_checksumz3S4UKerberosTests.test_rbcd_unkeyed_service_checksumY  sQ   !!! / 	 	H,  \\85\AA  7#@@@ IN222H/.6.NOO2A/ ( I ,O /0+*.--3F/>*.+15>5F $ 9)16@ 6@ 6@ 	 	 	              	 	s   BCCCc                     |                                  }|                     |          }|t          j        k    rt          t
          f}d}nd}d }|                     |d| j        |d           d S )NFr   Tre  )r   rI  r   rJ  r   r   rG  rc4_pac_checksums)r(   r   rL  r   r   s        r*   /test_constrained_delegation_rc4_client_checksumz@S4UKerberosTests.test_constrained_delegation_rc4_client_checksumw  s      ;;EBBt;;;#2#6#8 LL"#L!!':$((,(> ,	 	 	 	 	 	r+   c                     |                                   t          t          f}|                     |t          j        dd| j        d           d S r}  )rM  r   r   rG  r   rb  r  )r(   r   s     r*   test_rbcd_rc4_client_checksumz.S4UKerberosTests.test_rbcd_rc4_client_checksum  sg    !!!  /02 	!!':#+#C"%(,(> 	 	 	 	 	r+   c                 ^    |                                  }|                     |||di          S )NFchecksum_keysinclude_checksumsget_krbtgt_checksum_keymodified_ticket)r(   rK   r  r  s       r*   r  z$S4UKerberosTests.remove_pac_checksum  s@    4466##F2?7?6G $ I I 	Ir+   c                 F   |                                  }|                     |          }|j        }t          j        |t          j        |t          j        |i}|t          j        k    r|}n|}t          |j        |j	                  ||<   | 
                    |||di          S NTr  )get_krbtgt_credsr   decryption_keyr   r  r  r  r   rL   kvnor  )r(   rK   r  krbtgt_creds
krbtgt_key
server_keyr  
zeroed_keys           r*   r  z$S4UKerberosTests.zeroed_pac_checksum  s    ,,..88FF
*
 ):):,j
 w444#JJ#J"3JN4>O#E #Eh ##F2?7?6F $ H H 	Hr+   c                 V   |                                  }|                     |          }|j        }t          j        |t          j        |t          j        |t          j        |i}||         }t          |j	        |j
                  }	||	_        |	||<   |                     |||di          S r  )r  r   r  r   r  r  r  PAC_TYPE_FULL_CHECKSUMr   rL   r  rP   r  )
r(   rK   r  rP   r  r  r  r  rL   new_keys
             r*   r  z%S4UKerberosTests.unkeyed_pac_checksum  s    ,,..88FF
*
 ):):,j*J	
 H%&sw99")h##F2?7?6F $ H H 	Hr+   c                 r   |                                  }|                     |t          j                  }|j        }t
          j        |t
          j        |t
          j        |t
          j	        |i}t
          j        dt
          j        dt
          j        dt
          j	        di}| 
                    |||          S )N)rv   Tr  )r  r   r   RC4r  r   r  r  r  r  r  )r(   rK   r  rc4_krbtgt_keyr  r  r  s          r*   r  z"S4UKerberosTests.rc4_pac_checksums  s    ,,..<< = - - *
 ):)>,n*N	
 )4)4,d*D	
 ##F2?6G $ I I 	Ir+   c                 j      fd}                                  }                     |||          S )Nc                 (   | j         }                    t          j        d |D                        t	          t          t          j                            }t          j                    }t          j        d          |_	        ||_
        t          |          |_        t          j                    }||_        t          j                    }t          j        |_        ||_        |                    |           || _         | xj        dz  c_        | S )Nc              3   $   K   | ]}|j         V  d S r!   )type).0buffers     r*   	<genexpr>zNS4UKerberosTests.add_delegation_info.<locals>.modify_pac_fn.<locals>.<genexpr>  s$      DDffkDDDDDDr+   test_proxy_targetr-   )buffersr+  r   PAC_TYPE_CONSTRAINED_DELEGATIONlistmapr   StringPAC_CONSTRAINED_DELEGATIONproxy_targettransited_serviceslennum_transited_servicesPAC_CONSTRAINED_DELEGATION_CTRinfo
PAC_BUFFERr  r0  num_buffers)r   pac_buffersr  
delegationr  
pac_bufferr(   r]  s         r*   modify_pac_fnz;S4UKerberosTests.add_delegation_info.<locals>.modify_pac_fn  s    +KWDDDDDDF F F "&c#*h&?&?!@!@ ;==J&)j1D&E&EJ#,>J)034F0G0GJ-9;;D"DI +--J%EJO"JOz***%CKOOq OOJr+   )r  r  r  )r(   rK   r]  r  r  s   ` `  r*   r^  z$S4UKerberosTests.add_delegation_info  s]    	 	 	 	 	 	4 4466##F2?2? $ A A 	Ar+   Tc                     t          j        | j        d|          }|r|                                 }nd }|                     ||||          S )Nr4   )r   value)	modify_fnr  r  )r   r   modify_ticket_flagr  r  )r(   rK   r   r  r  r  s         r*   r   z'S4UKerberosTests.set_ticket_forwardable  sq    %d&=+8,02 2 2	   	! 88::MM M##F.72?9M $ O O 	Or+   c                 0    |                      |d          S )NT)exclude_pac)r  )r(   rK   s     r*   r   z"S4UKerberosTests.remove_ticket_pac  s$    ##F04 $ 6 6 	6r+   r!   )T)N__name__
__module____qualname__r#   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r
  r  r  r  rG  rM  rP  rR  rT  rV  r`  rc  rf  ri  rk  rm  rp  rs  ru  rw  r{  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   r   r   r   r  r  r  r  r  r  r  r  r  r  r  r^  r   r   __classcell__)r)   s   @r*   r   r   ;   sy       ) ) ) ) )
E E E ER' ' '
' ' '' ' '' ' '' ' 's' s' s'n
 
 
  &	 	 	
 
 

 
 
  &  &  &  $  6  $  \' \' \'|2 2 2  
 
 
  
 
 
    
 
 
	 	 	    	 	 	      $	 	 	    "    "  (  "      "    "  &    ,  $    *  "  .  mY^Y_EN  .  :  2  <  *   I I IH H H0H H H.I I I2A A A ABO O O O6 6 6 6 6 6 6r+   r   __main__)1sysospathinsertenvironr   sambar   r   samba.dcerpcr   r   r	   samba.testsr
   samba.tests.krb5.kcryptor   r   samba.tests.krb5.kdc_base_testr   samba.tests.krb5.raw_testcaser   r   "samba.tests.krb5.rfc4120_constantsr   r   r   r   r   r   r   r   r   r   r   r   r   r   samba.tests.krb5.rfc4120_pyasn1testskrb5rfc4120_pyasn1r]   r$   r&   r   r  unittestmainr   r+   r*   <module>r     s   & 


 				 <      !$
                      / / / / / / / / / / ) ) ) ) ) ) 7 7 7 7 7 7 7 7 6 6 6 6 6 6                                        4 3 3 3 3 3 3 3 3 3 3 3 b6 b6 b6 b6 b6{ b6 b6 b6J/ zNOOOHMOOOOO	 r+   