a
    )&iԃ                    @   sn  d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d	lmZ d d
l m!Z!m"Z" d dl#Z$d dl#m%Z% d dl&m'  m(  m)Z* d dl+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZSmTZTmUZUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\ d dl]m'  m(  m^Z^ dd Z_e_e_`d!ddZae*jbjce*jd_ee*jbjce*jd_ceae*jd_fe*jgjce*jh_ee*jgjce*jh_ceae*jh_fe*jijce*jj_ee*jijce*jj_ceae*jj_fe*jkjce*jl_ee*jkjce*jl_ceae*jl_fd"ddZme*jnjce*jo_eeme*jo_fe*jpjce*jq_eeme*jq_fe*jrjce*js_eeme*js_fe*jtjce*ju_eeme*ju_fe*jvjce*jw_eeme*jw_fe*jxjce*jy_eeme*jy_fG dd dZzG dd dezZ{G dd de{Z|G dd de{Z}G dd deZ~G dd dZG dd  d e%ZdS )#    N)Enum)decode)encode)BitStringEncoder)PyAsn1Error)Credentials)krb5pacsecurity)FEATURE_SEAL)ndr_pack
ndr_unpack)TestCaseInTempDir)1AD_IF_RELEVANTAD_WIN2K_PACFX_FAST_ARMOR_AP_REQUESTKDC_ERR_GENERICKDC_ERR_PREAUTH_FAILED%KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONSKERB_ERR_TYPE_EXTENDED
KRB_AP_REP
KRB_AP_REQ
KRB_AS_REP
KRB_AS_REQ	KRB_ERRORKRB_PRIVKRB_TGS_REPKRB_TGS_REQKU_AP_REQ_AUTHKU_AS_REP_ENC_PARTKU_AP_REQ_ENC_PARTKU_ENC_CHALLENGE_KDCKU_FAST_ENCKU_FAST_FINISHEDKU_FAST_REPKU_FAST_REQ_CHKSUMKU_KRB_PRIVKU_NON_KERB_CKSUM_SALTKU_TGS_REP_ENC_PART_SESSIONKU_TGS_REP_ENC_PART_SUB_KEYKU_TGS_REQ_AUTHKU_TGS_REQ_AUTH_CKSUMKU_TGS_REQ_AUTH_DAT_SESSIONKU_TGS_REQ_AUTH_DAT_SUBKEY	KU_TICKETNT_PRINCIPALNT_SRV_INSTNT_WELLKNOWNPADATA_ENCRYPTED_CHALLENGEPADATA_ENC_TIMESTAMPPADATA_ETYPE_INFOPADATA_ETYPE_INFO2PADATA_FOR_USERPADATA_FX_COOKIEPADATA_FX_ERRORPADATA_FX_FASTPADATA_KDC_REQPADATA_PAC_OPTIONSPADATA_PAC_REQUESTPADATA_PK_AS_REQPADATA_PK_AS_REP_19PADATA_SUPPORTED_ETYPESc                 K   sx   |d ur| |}t|}|d r4|d|d  > }n|}| }t|}|dk rZd| }	nd}	d| d|	  }
|
ddfS )N      r       FT)ZclonelenZasOctets)selfvalueasn1SpecZ	encodeFunoptionsZvalueLengthZalignedValueZ	substratelengthZpaddingret rI   ?/usr/lib/python3/dist-packages/samba/tests/krb5/raw_testcase.pyBitStringEncoder_encodeValue32g   s    

rK   c                 C   s   d|    }g }d}|  D ]2}dD ](}d|> }||@ r>d}nd}|| q$qt||k rztt||D ]}	|d qjd| }
d|
 }t|D ]P}	|	| jv r| j|	 }n||	 dkrd|	 }nq|d	||||	 f 7 }d
|
 }q|d|
 7 }|S )N%s    )         r@            r   rS   r    z: (
%s zunknown-bit-%uz%s%s:%uz,
%s z
%s))ZasBinaryZ	asNumbersappendrB   rangeprettyPrintNamedValues)rC   scoperH   bitsZhighest_bitZbytebitmaskvalZbitPositionindentZdelimnamerI   rI   rJ   !BitString_NamedValues_prettyPrint   s2    


r_   c                 C   s4   t | }|| jv r| j| }nd}d|||f }|S )Nz<__unknown__>z%d (0x%x) %s)intrW   )rC   rX   Zintvalr^   rH   rI   rI   rJ   Integer_NamedValues_prettyPrint   s    
ra   c                   @   sH   e Zd Zdd Zdd Zdd Zddd	Zdd
dZdd Zdd Z	dS )Krb5EncryptionKeyc                 C   sL   t jjt jjt jjt jjt jjt jji}|| _	|j
| _|| j | _|| _d S N)kcryptoEnctypeAES256Z	CksumtypeZSHA1_AES256AES128ZSHA1_AES128RC4ZHMAC_MD5keyZenctypeetypectypekvno)rC   ri   rl   ZEncTypeChecksumrI   rI   rJ   __init__   s    zKrb5EncryptionKey.__init__c                 C   s   t | j||}|S rc   )rd   encryptri   )rC   usage	plaintext
ciphertextrI   rI   rJ   rn      s    zKrb5EncryptionKey.encryptc                 C   s   t | j||}|S rc   )rd   decryptri   )rC   ro   rq   rp   rI   rI   rJ   rr      s    zKrb5EncryptionKey.decryptNc                 C   s    |d u r| j }t|}t|S rc   )rk   rd   checksum_lenbytes)rC   rk   rs   rI   rI   rJ   make_zeroed_checksum   s    
z&Krb5EncryptionKey.make_zeroed_checksumc                 C   s$   |d u r| j }t|| j||}|S rc   )rk   rd   make_checksumri   rC   ro   rp   rk   cksumrI   rI   rJ   rv      s    zKrb5EncryptionKey.make_checksumc                 C   s:   | j |kr"td| j  d| dt|| j||| d S )Nzkey checksum type (z) != checksum type ())rk   AssertionErrorrd   verify_checksumri   rw   rI   rI   rJ   r{     s    

z!Krb5EncryptionKey.verify_checksumc                 C   s   | j | jjd}|S )N)keytypekeyvalue)rj   ri   contentsrC   ZEncryptionKey_objrI   rI   rJ   
export_obj  s    zKrb5EncryptionKey.export_obj)N)N)
__name__
__module____qualname__rm   rn   rr   ru   rv   r{   r   rI   rI   rI   rJ   rb      s   

rb   c                       sF   e Zd Zd
 fdd	Zd fdd	Zd fdd	Z fdd	Z  ZS )RodcPacEncryptionKeyNc                    s`   t  || |d u r<| j}|d ur4|dL }|dM }|p:d }|d urV|jddd| _nd| _d S )N     rR   little	byteorder    )superrm   rl   to_bytesrodc_id)rC   ri   rl   r   	__class__rI   rJ   rm     s    zRodcPacEncryptionKey.__init__c                    s   t  |}|tt| j S rc   )r   ru   rt   rB   r   )rC   rk   checksumr   rI   rJ   make_rodc_zeroed_checksum&  s    z.RodcPacEncryptionKey.make_rodc_zeroed_checksumc                    s   t  |||}|| j S rc   )r   rv   r   rC   ro   rp   rk   r   r   rI   rJ   make_rodc_checksum*  s    z'RodcPacEncryptionKey.make_rodc_checksumc                    s\   | j rF|d d |dd   }}| j |krFt| j   d|  t |||| d S )Nz != )r   rz   hexr   r{   )rC   ro   rp   rk   rx   Zcksum_rodc_idr   rI   rJ   verify_rodc_checksum.  s    
z)RodcPacEncryptionKey.verify_rodc_checksum)N)N)N)r   r   r   rm   r   r   r   __classcell__rI   rI   r   rJ   r     s   r   c                   @   s    e Zd ZdddZdddZdS )ZeroedChecksumKeyNc                 C   s
   |  |S rc   )ru   rC   ro   rp   rk   rI   rI   rJ   rv   =  s    zZeroedChecksumKey.make_checksumc                 C   s
   |  |S rc   )r   r   rI   rI   rJ   r   @  s    z$ZeroedChecksumKey.make_rodc_checksum)N)N)r   r   r   rv   r   rI   rI   rI   rJ   r   <  s   
r   c                       sX   e Zd Z fddZedd ZdddZd fdd		Zdd
dZd fdd	Z	  Z
S )WrongLengthChecksumKeyc                    s   t  || || _d S rc   )r   rm   _length)rC   ri   rl   rG   r   rI   rJ   rm   E  s    zWrongLengthChecksumKey.__init__c                 C   s:   |t | }|dkr"|t|7 }n|dk r6|d | }|S Nr   )rB   rt   )clsr   rG   ZdiffrI   rI   rJ   _adjust_to_lengthJ  s    z(WrongLengthChecksumKey._adjust_to_lengthNc                 C   s
   t | jS rc   rt   r   rC   rk   rI   rI   rJ   ru   T  s    z+WrongLengthChecksumKey.make_zeroed_checksumc                    s   t  |||}| || jS rc   )r   rv   r   r   r   r   rI   rJ   rv   W  s    z$WrongLengthChecksumKey.make_checksumc                 C   s
   t | jS rc   r   r   rI   rI   rJ   r   [  s    z0WrongLengthChecksumKey.make_rodc_zeroed_checksumc                    s   t  |||}| || jS rc   )r   r   r   r   r   r   rI   rJ   r   ^  s    z)WrongLengthChecksumKey.make_rodc_checksum)N)N)N)N)r   r   r   rm   classmethodr   ru   rv   r   r   r   rI   rI   r   rJ   r   D  s   
	

r   c                       s,  e Zd ZejejB ejB Z fddZdd Z	dd Z
dd ZeejjejfejjejfejjejfejjejfejjejfgZed	d
 Zedd Zdd Zdd Zdd Z dd Z!dd Z"dd Z#dd Z$dd Z%dd Z&dd  Z'd!d" Z(d#d$ Z)d%d& Z*d'd( Z+d)d* Z,d+d, Z-d-d. Z.  Z/S )/KerberosCredentialsc                    sj   t t|   d}|tjO }|tjO }|tjO }|| _|| _|| _	d | _
i | _d | _d | _d | _d | _d S r   )r   r   rm   r	   KERB_ENCTYPE_RC4_HMAC_MD5$KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96$KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96as_supported_enctypestgs_supported_enctypesap_supported_enctypesrl   forced_keysforced_saltdnupnspn)rC   Zall_enc_typesr   rI   rJ   rm   i  s    


zKerberosCredentials.__init__c                 C   s   t || _d S rc   )r`   r   rC   rD   rI   rI   rJ   set_as_supported_enctypes}  s    z-KerberosCredentials.set_as_supported_enctypesc                 C   s   t || _d S rc   )r`   r   r   rI   rI   rJ   set_tgs_supported_enctypes  s    z.KerberosCredentials.set_tgs_supported_enctypesc                 C   s   t || _d S rc   )r`   r   r   rI   rI   rJ   set_ap_supported_enctypes  s    z-KerberosCredentials.set_ap_supported_enctypesc                 C   s:   d}|D ],}| j | }||@ r,td| ||O }q|S )Nr   zGot duplicate etype: )	etype_map
ValueError)r   etypesrY   rj   rZ   rI   rI   rJ   etypes_to_bits  s    

z"KerberosCredentials.etypes_to_bitsc                 C   sZ   d}| j  D ]$\}}||@ r|| M }||f7 }q|| j M }|dkrVtd| |S )NrI   r   zUnsupported etype bits: )r   itemsfast_supported_bitsr   )r   rY   r   rj   rZ   rI   rI   rJ   bits_to_etypes  s    
z"KerberosCredentials.bits_to_etypesc                 C   s   |  | jS rc   )r   r   rC   rI   rI   rJ   get_as_krb5_etypes  s    z&KerberosCredentials.get_as_krb5_etypesc                 C   s   |  | jS rc   )r   r   r   rI   rI   rJ   get_tgs_krb5_etypes  s    z'KerberosCredentials.get_tgs_krb5_etypesc                 C   s   |  | jS rc   )r   r   r   rI   rI   rJ   get_ap_krb5_etypes  s    z&KerberosCredentials.get_ap_krb5_etypesc                 C   s   |d@ r|dO }|| _ d S )N           rl   )rC   rl   rI   rI   rJ   set_kvno  s    zKerberosCredentials.set_kvnoc                 C   s   | j S rc   r   r   rI   rI   rJ   get_kvno  s    zKerberosCredentials.get_kvnoc                 C   s4   t |}t|}t||}t|| j| j|< d S rc   )r`   binasciiZa2b_hexrd   Keyr   rl   r   )rC   rj   Zhexkeyr~   ri   rI   rI   rJ   set_forced_key  s    
z"KerberosCredentials.set_forced_keyc                 C   s   t |}| j|S rc   )r`   r   get)rC   rj   rI   rI   rJ   get_forced_key  s    z"KerberosCredentials.get_forced_keyc                 C   s   t || _d S rc   )rt   r   )rC   saltrI   rI   rJ   set_forced_salt  s    z#KerberosCredentials.set_forced_saltc                 C   s   | j S rc   )r   r   rI   rI   rJ   get_forced_salt  s    z#KerberosCredentials.get_forced_saltc                 C   s   | j d ur| j S |  }|d ur:|ddd dd}n|  }|  r|   }|d dkrn|d d }d|   ||   f }n|   | }|	d	S )
N@rS   r   / $z%shost%s.%sutf-8)
r   get_upnrsplitreplaceget_usernameZget_workstationlower	get_realmupperr   )rC   r   Z	salt_nameZsalt_stringrI   rI   rJ   get_salt  s"    


zKerberosCredentials.get_saltc                 C   s
   || _ d S rc   r   )rC   r   rI   rI   rJ   set_dn  s    zKerberosCredentials.set_dnc                 C   s   | j S rc   r   r   rI   rI   rJ   get_dn  s    zKerberosCredentials.get_dnc                 C   s
   || _ d S rc   r   )rC   r   rI   rI   rJ   set_spn  s    zKerberosCredentials.set_spnc                 C   s   | j S rc   r   r   rI   rI   rJ   get_spn  s    zKerberosCredentials.get_spnc                 C   s
   || _ d S rc   r   )rC   r   rI   rI   rJ   set_upn  s    zKerberosCredentials.set_upnc                 C   s   | j S rc   r   r   rI   rI   rJ   r     s    zKerberosCredentials.get_upnc                 C   s    |  | | |  d  d S NrS   )set_passwordr   r   )rC   passwordrI   rI   rJ   update_password  s    
z#KerberosCredentials.update_password)0r   r   r   r	   ZKERB_ENCTYPE_FAST_SUPPORTEDZ(KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTEDZKERB_ENCTYPE_CLAIMS_SUPPORTEDr   rm   r   r   r   collectionsOrderedDictrd   re   rf   r   rg   r   rh   r   ZDES_MD5KERB_ENCTYPE_DES_CBC_MD5ZDES_CRCKERB_ENCTYPE_DES_CBC_CRCr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rI   rI   r   rJ   r   c  s^   


r   c                   @   s   e Zd ZdddZdd ZdS )KerberosTicketCredsNc
           
      C   s:   || _ || _|| _|| _|| _|| _|| _|| _|	| _d S rc   )	ticketsession_keycrealmcnamesrealmsnamedecryption_keyticket_privateencpart_private)
rC   r   r   r   r   r   r   r   r   r   rI   rI   rJ   rm     s    zKerberosTicketCreds.__init__c                 C   s   || j d< || _d S Nr   )r   r   )rC   r   rI   rI   rJ   	set_sname  s    
zKerberosTicketCreds.set_sname)NNNNNNN)r   r   r   rm   r   rI   rI   rI   rJ   r     s        
r   c                .       s  e Zd ZdZG dd deZejejej	hZ
dddejjddejjddejjd	dfZd
Zedd Zedd Zdd Ze fddZ fddZ fddZdd ZdddZdddZddd Zdd!d"Zdd#d$Zdd%d&Zd d'd(Z dd)d*Z!dd+d,Z"dd-d.Z#dd/d0Z$dd1d2Z%d3d4 Z&dd5d6Z'dd7d8Z(dd9d:Z)d	d;d<Z*d
d=d>Z+dd?d@Z,ddBdCZ-ddDdEZ.ddFdGZ/ddHdIZ0dJdK Z1dLdM Z2ddNdOZ3dPdQ Z4dRdS Z5dTdU Z6dVdW Z7ddXdYZ8dZd[ Z9d\d] Z:d^d_ Z;d`da Z<dbdc Z=ddde Z>dddfdgdhZ?ddidjZ@ddkdlZAdmdn ZBdodp ZCdqdr ZDddsdtZEddudvZFddwdxZGddydzZHd{d| ZId}d~ ZJdd ZKdddZLedd ZMdd ZNdd ZOdd ZPdd ZQdd ZRdd ZSdd ZTdd ZUdddZVdd ZWdddZXdddZYdddZZdd Z[dd Z\dddZ]dddZ^dddZ_d ddZ`dd Zadd Zbd!ddZcd"ddZdddd
dddddddddddddeedddddddddddddddddddddddddddd
f-ddZfddd
dddddddddddddeeddddddddddddddddddddddddddddd
f.ddZgdd Zhd#ddZidd Zjdd Zkd$ddZlddĄ Zmd%ddƄZnd&ddȄZoddʄ Zpdd̄ Zqdd΄ ZrddЄ Zsdd҄ ZtddԄ Zuddք Zvd'dd؄Zwdddd
d
ddddٜddۄZxd(dd݄Zyd)dd߄Zzd*ddZ{d+ddZ|dd Z}dd Z~dd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zd,ddZ  ZS (-  RawKerberosTestzA raw Kerberos Test case.c                   @   s   e Zd Ze Ze ZdS )zRawKerberosTest.KpasswdModeN)r   r   r   objectSETCHANGErI   rI   rI   rJ   KpasswdMode  s   r   iZdummy)rD   r^   Zaes128Zaes256Zrc4Fc                 C   s   | j r
d S g }t| j}g }td|d D ]4}ttt||}|D ]}t|}|| qFq*|D ]f}d }	d}
|D ]@}| j| d }|	d u r|}	n|	d| 7 }	|
| j| d f7 }
qt|	|
d}|| qd|| _d| _ d S )NrS   rI   r^   z_%srD   )r^   r   T)	"setup_etype_test_permutations_donerB   etypes_to_testrV   list	itertoolspermutationsrU   etype_test_permutations)r   resZnum_idxsr   ZnumchunkeZelpr^   r   idxnrrI   rI   rJ   setup_etype_test_permutations&  s.    

z-RawKerberosTest.setup_etype_test_permutationsc                 C   s>   |    g }d}| jD ]"}|d |f}|d7 }|| q|S )Nr   r^   rS   )r  r   rU   )r   r   r  r  r  rI   rI   rJ   etype_test_permutation_name_idxF  s    
z/RawKerberosTest.etype_test_permutation_name_idxc                 C   s   | j | }|d |d fS )Nr^   r   )r   )rC   r  r  rI   rI   rJ   etype_test_permutation_by_idxQ  s    
z-RawKerberosTest.etype_test_permutation_by_idxc                    s   t    tjd| _tjd| _i | _tjjddd}|d u rHd}tt	|| _
tjjddd}|d u rrd}tt	|| _tjjddd}|d u rd	}tt	|| _tjjd
dd}|d u rd	}tt	|| _d S )NSERVERZ	DC_SERVERZFAST_SUPPORTTallow_missing0ZTKT_SIG_SUPPORTZ
EXPECT_PAC1ZEXPECT_EXTRA_PAC_BUFFERS)r   
setUpClasssambatestsenv_get_var_valuehostdc_host
creds_dictboolr`   kdc_fast_supporttkt_sig_support
expect_pacexpect_extra_pac_buffers)r   r  r  r  r  r   rI   rJ   r  U  s:    
zRawKerberosTest.setUpClassc                    sR   t    d| _d| _tjjddd}|d u r2d}tt|| _	d | _
t | _d S )NFZSTRICT_CHECKINGTr
  r  )r   setUpdo_asn1_print
do_hexdumpr  r  r  r  r`   strict_checkingsr   unspecified_kvno)rC   r  r   rI   rJ   r  y  s    
zRawKerberosTest.setUpc                    s   |  d t   d S )NtearDown)_disconnectr   r   r   r   rI   rJ   r     s    
zRawKerberosTest.tearDownc                 C   s8   | j d u rd S | j   d | _ | jr4tjd|  d S )Nzdisconnect[%s]
)r  closer  sysstderrwrite)rC   reasonrI   rI   rJ   r!    s    

zRawKerberosTest._disconnectNc                 C   s   |d u rd}zpt ||t jt jt jd| _t  | jd d | jd d | jd d | _| jd | j| jd d  W n< t j	y   | j
   Y n ty   | j
   Y n0 d S )NX   r   rS   rR   
   r@   )socketZgetaddrinfoZ	AF_UNSPECZSOCK_STREAMZSOL_TCPar  
settimeoutconnecterrorr"  IOErrorrC   r  portrI   rI   rJ   _connect_tcp  s     .

zRawKerberosTest._connect_tcpc                 C   s.   |    | || | jr*tjd|  d S )Nzconnected[%s]
)assertNotConnectedr1  r  r#  r$  r%  r/  rI   rI   rJ   r,    s    zRawKerberosTest.connectTc                 C   sR   d }|d ur.|p|}t jjd||f |d}nd}|d u rN|rNt jj||d}|S )Nz%s_%sr
  T)r  r  r  )rC   Zvarnameprefixfallback_defaultr  r\   Zallow_missing_prefixrI   rI   rJ   env_get_var  s    
zRawKerberosTest.env_get_varc                 C   s  t  }|  | d|}| d|}|d u}	| jd|d|	d}
|
d u rL|}
| jd|d|d}|| || ||
 |d ur|| | jd|dd	}|d ur|| | jd
|dd	}|d ur|| | jd|dd	}|d ur|	| |rd}|d u rd}nd}n|}|}| jd|d|d}|d urF|
t| | jd|d|d}|d urr|tjj| | jd|ddd}|d ur|tjj| | jd|ddd}|d ur|tjj| |s| |jd|  |S )NZDOMAINZREALMZUSERNAMEF)r4  r  ZPASSWORDZAS_SUPPORTED_ENCTYPESTr
  ZTGS_SUPPORTED_ENCTYPESZAP_SUPPORTED_ENCTYPESZKVNOZAES256_KEY_HEXZAES128_KEY_HEXZRC4_KEY_HEXz/Please supply %s encryption keys in environment)r   Zguessr5  Z
set_domainZ	set_realmZset_usernamer   r   r   r   r   r`   r   rd   re   rf   rg   rh   
assertTruer   )rC   r3  default_usernameallow_missing_passwordallow_missing_keysrequire_strongest_keycZdomainrealmZallow_missing_usernameZusernamer   r   r   r   Zkvno_allow_missingZaes256_allow_missingrl   Z
aes256_keyZ
aes128_keyZrc4_keyrI   rI   rJ   _get_krb5_creds_from_env  s    











z(RawKerberosTest._get_krb5_creds_from_envc           
   
   C   s   || j v r| j | S d }d }z| j|||||d}W n( ty\ }	 z|	}W Y d }	~	n"d }	~	0 0 | | || j |< |S |d urz
| }W nH ty }	 z0td|  td|  td|	  W Y d }	~	n"d }	~	0 0 | | || j |< |S |d S )N)r7  r8  r9  r:  zERROR FROM ENV: %rzFALLBACK-FN: %szFALLBACK-ERROR: %r)r  r=  	ExceptionassertIsNotNoneprint)
rC   r3  r7  r8  r9  r:  Zfallback_creds_fncredsZenv_errerrrI   rI   rJ   _get_krb5_creds  s8    





"

zRawKerberosTest._get_krb5_credsc                 C   s   | j d ||d}|S )Nr3  r8  r9  rC  rC   r8  r9  r;  rI   rI   rJ   get_user_creds4  s
    zRawKerberosTest.get_user_credsc                 C   s   | j d||d}|S )NZSERVICErD  rE  rF  rI   rI   rJ   get_service_creds<  s
    z!RawKerberosTest.get_service_credsc                 C   s   | j d||d}|S )NZCLIENTrD  rE  rF  rI   rI   rJ   get_client_credsD  s
    z RawKerberosTest.get_client_credsc                 C   s   | j d||d}|S )Nr	  rD  rE  rF  rI   rI   rJ   get_server_credsL  s
    z RawKerberosTest.get_server_credsc                 C   s0   | j d||d}|| tB  |d |S )NZADMINrD  r   )rC  Zset_gensec_featuresZget_gensec_featuresr
   Zset_workstationrF  rI   rI   rJ   get_admin_credsT  s    
zRawKerberosTest.get_admin_credsc                 C   s&   |r|  | | jdd| |d}|S )NZRODC_KRBTGTT)r3  r8  r9  r:  r6  rC  rC   Zrequire_keysr:  r;  rI   rI   rJ   get_rodc_krbtgt_creds^  s    
z%RawKerberosTest.get_rodc_krbtgt_credsc                 C   s(   |r|  | | jddd| |d}|S )NZKRBTGTkrbtgtT)r3  r7  r8  r9  r:  rL  rM  rI   rI   rJ   get_krbtgt_credsi  s    
z RawKerberosTest.get_krbtgt_credsc                 C   s   t  }|  |S rc   )r   Zset_anonymous)rC   r;  rI   rI   rJ   get_anon_credsu  s    zRawKerberosTest.get_anon_credsc                 C   sD   |d u r| j }|r@|d ur0tjd||f  ntjd|  d S )Nz%s:
%srL   )r  r#  r$  r%  )rC   r^   obj
asn1_printrI   rI   rJ   	asn1_dumpz  s    zRawKerberosTest.asn1_dumpc                 C   s6   |d u r| j }|r2tjd|t|| |f  d S )Nz	%s: %d
%s)r  r#  r$  r%  rB   hexdump)rC   r^   blobrU  rI   rI   rJ   hex_dump  s    zRawKerberosTest.hex_dumpc           	      C   sb   |d urt |jdd }nd}| j|||d t||d\}}| jd ||d |r^t|}|S )N:r   z<None-asn1Spec>rU  rE   rS  )typer   splitrW  pyasn1_der_decoderT  pyasn1_native_encode)	rC   rV  rE   native_encoderS  rU  
class_namerR  _rI   rI   rJ   
der_decode  s    zRawKerberosTest.der_decodec                 C   s`   |rt ||d}t|jdd }|d ur<| jd ||d t|}|d ur\| j|||d |S )NrZ  rX  r   r[  rY  )pyasn1_native_decoder\  r   r]  rT  pyasn1_der_encoderW  )rC   rR  rE   native_decoderS  rU  ra  rV  rI   rI   rJ   
der_encode  s    zRawKerberosTest.der_encodec                 C   s$   | j |d|dd}| j||d d S )NF)rf  rS  rU  rY  )rg  send_msg)rC   reqrS  rU  Zk5_pdurI   rI   rJ   send_pdu  s    zRawKerberosTest.send_pduc              
   C   s   t dt|}|}||7 }| jd||d | jd||d z2| j|d}|t|kr^W d S ||d  }q>W nh tjy } z| d|   W Y d }~n<d }~0  t	y } z| d|   W Y d }~n
d }~0 0 d S )N>Irh  rY  r   zsend_msg: %s)
structZpackrB   rW  r  sendr)  r-  r!  r.  )rC   msgrU  headerZreq_pduZsentr  rI   rI   rJ   rh    s     zRawKerberosTest.send_msgr   c              
   C   s   d }z^|d ur| j | | j |d}| j d t|dkrP| d W d S | jd||d W n tjy   | j d tj	
d Y nh tjy } z| d|   W Y d }~n<d }~0  ty } z| d|   W Y d }~n
d }~0 0 |S )Nr   r(  zrecv_raw: EOFrecv_rawrY  zrecv_raw: TIMEOUT
zrecv_raw: %s)r  r+  ZrecvrB   r!  rW  r)  timeoutr#  r$  r%  r-  r.  )rC   num_recvrU  rq  rep_pdur  rI   rI   rJ   rp    s(    
zRawKerberosTest.recv_rawc           	      C   s   | j d||d}|d u rd S td|dd }|d }|dkrDdS |}d}|dkr| j |||d}| t|d ||7 }|t| }qL|S )Nr@   )rr  rU  rq  rk  r   r   r   rS   )rp  rl  unpackassertGreaterEqualrB   )	rC   rS  rU  rq  Zraw_pduro  Zk5_lenZmissingrs  rI   rI   rJ   recv_pdu_raw  s&    zRawKerberosTest.recv_pdu_rawc           
      C   s   | j |||d}|sd |fS | j|d dddd}|d }| |d |d }| |tttg |tkrpt }n"|tkrt	 }n|tkrt }| j|||dd}	|	|fS )NrS  rU  rq  F)rE   r`  rS  rU  zfield-0rP   zfield-1rE   rS  rU  )
rv  rc  assertEqualassertInr   r   r   	krb5_asn1AS_REPTGS_REP)
rC   rS  rU  rq  rs  Zk5_rawpvnomsg_typerE   reprI   rI   rJ   
recv_reply  s6    

zRawKerberosTest.recv_replyc                 C   s   | j |||d\}}|S )Nrw  )r  )rC   rS  rU  rq  r  rs  rI   rI   rJ   recv_pdu	  s
    
zRawKerberosTest.recv_pduc                 C   s   | j | jdd d S )NzNot connectedrn  )r?  r  r   rI   rI   rJ   assertIsConnected  s    z!RawKerberosTest.assertIsConnectedc                 C   s   | j | jdd d S )NzIs connectedr  )assertIsNoner  r   rI   rI   rJ   r2    s    z"RawKerberosTest.assertNotConnectedc                 C   sl   |r
| j n| j}| | z$| j|||d | j|||d}W n ty\   | d  Y n0 | d |S )N)rS  rU  rw  ztransaction failedtransaction done)r  r  r,  rj  r  r>  r!  )rC   ri  rS  rU  rq  to_rodcr  r  rI   rI   rJ   send_recv_transaction  s    



z%RawKerberosTest.send_recv_transactionc                 C   s   |  |j d S rc   )r6  Z	isNoValuer   rI   rI   rJ   assertNoValue(  s    zRawKerberosTest.assertNoValuec                 C   s   |  | d S rc   )r?  r   rI   rI   rJ   assertHasValue+  s    zRawKerberosTest.assertHasValuec                 C   s
   | |S rc   )r   )rC   rR  elemrI   rI   rJ   getElementValue.  s    zRawKerberosTest.getElementValuec                 C   s   |  ||}| | d S rc   )r  r  )rC   rR  r  vrI   rI   rJ   assertElementMissing1  s    z$RawKerberosTest.assertElementMissingc                 C   sT   |  ||}| | | jrPt|tjjrP|r@| dt| n| 	dt| d S r   )
r  r?  r  
isinstancer   abc	Containerry  rB   assertNotEqual)rC   rR  r  expect_emptyr  rI   rI   rJ   assertElementPresent5  s    
z$RawKerberosTest.assertElementPresentc                 C   s&   |  ||}| | | || d S rc   )r  r?  ry  rC   rR  r  rD   r  rI   rI   rJ   assertElementEqual?  s    
z"RawKerberosTest.assertElementEqualc                 C   s,   |  ||}| | | |t|d d S )Nutf8)r  r?  ry  rt   r  rI   rI   rJ   assertElementEqualUTF8D  s    
z&RawKerberosTest.assertElementEqualUTF8c                 C   s~   |  |d |d  | j t|d t|d d||f d tt|d D ],}| j |d | |d | d||f d qLd S )N	name-typename-stringzprinc1=%s != princ2=%sr  )ry  rB   rV   )rC   Zprinc1Zprinc2r  rI   rI   rJ   assertPrincipalEqualI  s    





z$RawKerberosTest.assertPrincipalEqualc                 C   s6   |  ||}| | t|t d}| || d S NrZ  )r  r?  rd  r{  ZPrincipalNamer  r  rI   rI   rJ   assertElementEqualPrincipalU  s    
z+RawKerberosTest.assertElementEqualPrincipalc                 C   sp   |  ||}|dkr|}|d urb| | | |d || jurlt|}| |d | || n
| | d S )N
autodetectr   )r  r?  r  r  r`   ry  r  r  rI   rI   rJ   assertElementKVNO[  s    

z!RawKerberosTest.assertElementKVNOc              	   C   s   |  ||}| | |d urj| |tj t|D ]4\}}|dkr4| d|| d|j|  d|  q4|d ur| |tj t|D ]4\}}|dkr| d|| d|j|  d|  qd S )NrS   r  'z' expected in r  z' unexpected in )r  r?  ZassertIsInstancer{  TicketFlags	enumeratery  namedValues)rC   rR  r  expectedZ
unexpectedr  iflagrI   rI   rJ   assertElementFlagsl  s(    
z"RawKerberosTest.assertElementFlags)require_strictrequire_orderedc                   s|   | j r|r| || n`d| d| }| j sj d urj|d  d7 } fdd|D } fdd|D }| ||| d S )Nz
expected: z got: z (ignoring: ry   c                 3   s   | ]}| vr|V  qd S rc   rI   .0xr  rI   rJ   	<genexpr>  r   z>RawKerberosTest.assertSequenceElementsEqual.<locals>.<genexpr>c                 3   s   | ]}| vr|V  qd S rc   rI   r  r  rI   rJ   r    r   )r  ry  ZassertCountEqual)rC   r  Zgotr  r  fail_msgrI   r  rJ   assertSequenceElementsEqual~  s    
z+RawKerberosTest.assertSequenceElementsEqualc                 C   sH   |d u rt   }|d ur$|t| }tjj|tjjd}|d|jfS )N)Ztz%Y%m%d%H%M%SZ)timer`   datetimeZfromtimestamptimezoneutcstrftimeZmicrosecond)rC   epochoffsetZdtrI   rI   rJ   get_KerberosTimeWithUsec  s    z(RawKerberosTest.get_KerberosTimeWithUsecc                 C   s   | j ||d\}}|S )N)r  r  )r  )rC   r  r  r  rb  rI   rI   rJ   get_KerberosTime  s    z RawKerberosTest.get_KerberosTimec                 C   s@   t |tr| }tj|d}|jtjjd}t|	 }|S )Nr  )Ztzinfo)
r  rt   r   r  strptimer   r  r  r`   	timestamp)rC   Zkerberos_timer  rI   rI   rJ   get_EpochFromKerberosTime  s    
z)RawKerberosTest.get_EpochFromKerberosTimec                 C   s   d}d}t ||}|S )Ni   i)randomrandint)rC   Z	nonce_minZ	nonce_maxr  rI   rI   rJ   	get_Nonce  s    zRawKerberosTest.get_Noncec                 C   sD   i }|d ur@|D ].}|d }||v r2t d| |d ||< q|S )Npadata-typezDuplicate type padata-value)RuntimeError)rC   pa_datapa_dictpaZpa_typerI   rI   rJ   get_pa_dict  s    zRawKerberosTest.get_pa_dictc                 C   s   t ||}t||S rc   )rd   r   r   )rC   rj   r~   rl   ri   rI   rI   rJ   SessionKey_create  s    z!RawKerberosTest.SessionKey_createc                 C   s0   |  | |  | tj||||d}t||S )N)params)r?  rd   Zstring_to_keyr   )rC   rj   pwdr   rl   r  ri   rI   rI   rJ   PasswordKey_create  s    

z"RawKerberosTest.PasswordKey_createc           	      C   s\   |d }| d}|tjjkr6| }| j|||dS | d}| }| j|||||dS )Nrj   r   rj   r~   rl   	s2kparams)rj   r  r   rl   r  )r   rd   re   rh   get_nt_hashr  get_passwordr  )	rC   rA  etype_info2rl   r  r   nthashr  r   rI   rI   rJ   PasswordKey_from_etype_info2  s    


z,RawKerberosTest.PasswordKey_from_etype_info2c           
      C   s   |d u r&|  }|r|d }ntjj}||}|d ur<|S | }d| ||f }|tjjkr| }| j||d | j	|||dS |
 }| j||d | }	| j|||	|dS )Nr   zE%s has no fixed key for etype[%s] kvno[%s] nor a password specified, r  r  )rj   r  r   rl   )r   rd   re   rh   r   r   r   r  r?  r  r  r   r  )
rC   rA  rj   r   Z
forced_keyrl   r  r  r   r   rI   rI   rJ   TicketDecryptionKey_from_creds  s8    


z.RawKerberosTest.TicketDecryptionKey_from_credsc                 C   s$   t |}t|j}| j||dS )N)rj   r~   )rd   Z_get_enctype_profiler  Zgenerate_random_bytesZkeysizer  )rC   rj   r  r~   rI   rI   rJ   	RandomKey  s    
zRawKerberosTest.RandomKeyc                 C   s   |  |d |d S )Nr|   r}   )r  r   rI   rI   rJ   EncryptionKey_import  s    
z$RawKerberosTest.EncryptionKey_importc                 C   s0   | ||}|j|d}|jd ur,|j|d< |S )N)rj   cipherrl   )rn   rj   rl   )rC   ri   ro   rp   rq   ZEncryptedData_objrI   rI   rJ   EncryptedData_create  s    

z$RawKerberosTest.EncryptedData_createc                 C   s,   |d u r|j }|j|||d}||d}|S )Nrk   )	cksumtyper   )rk   rv   )rC   ri   ro   rp   rk   r   ZChecksum_objrI   rI   rJ   Checksum_create
  s    zRawKerberosTest.Checksum_createc                 C   s   ||d}|S )N)r  r  rI   )r   	name_typenamesZPrincipalName_objrI   rI   rJ   PrincipalName_create  s    z$RawKerberosTest.PrincipalName_createc                 C   s   ||d}|S )N)ad-typead-datarI   )rC   Zad_typeZad_dataZAUTH_DATA_objrI   rI   rJ   AuthorizationData_create$  s    z(RawKerberosTest.AuthorizationData_createc                 C   s   ||d}|S )N)r  r  rI   )rC   Zpadata_typeZpadata_valueZPA_DATA_objrI   rI   rJ   PA_DATA_create/  s    zRawKerberosTest.PA_DATA_createc                 C   s   ||d}|S )N)patimestamppausecrI   )rC   ZtsusecZPA_ENC_TS_ENC_objrI   rI   rJ   PA_ENC_TS_ENC_create;  s    z$RawKerberosTest.PA_ENC_TS_ENC_createc                 C   s   d|i}|S )NrF   rI   )rC   rF   ZPA_PAC_OPTIONS_objrI   rI   rJ   PA_PAC_OPTIONS_createF  s    z%RawKerberosTest.PA_PAC_OPTIONS_createc                 C   s   ||d}|S )N)z
armor-typezarmor-valuerI   )rC   Z
armor_typeZarmor_valueZKRB_FAST_ARMOR_objrI   rI   rJ   KRB_FAST_ARMOR_createO  s    z%RawKerberosTest.KRB_FAST_ARMOR_createc                 C   s   |||d}|S )N)zfast-optionspadatareq-bodyrI   )rC   fast_optionsr  req_bodyZKRB_FAST_REQ_objrI   rI   rJ   KRB_FAST_REQ_create[  s
    z#RawKerberosTest.KRB_FAST_REQ_createc                 C   s   ||d}|d ur||d< |S )N)zreq-checksumzenc-fast-reqarmorrI   )rC   r  Zreq_checksumZenc_fast_reqZKRB_FAST_ARMORED_REQ_objrI   rI   rJ   KRB_FAST_ARMORED_REQ_createi  s    z+RawKerberosTest.KRB_FAST_ARMORED_REQ_createc                 C   s   d|i}|S )Narmored-datarI   )rC   Zarmored_dataZPA_FX_FAST_REQUEST_objrI   rI   rJ   PA_FX_FAST_REQUEST_createw  s    z)RawKerberosTest.PA_FX_FAST_REQUEST_createc                 C   s2   d|i}|s|S | j |t d}| t|}|S )Nzinclude-pacrZ  )rg  r{  ZKERB_PA_PAC_REQUESTr  r;   )rC   Zinclude_pacZpa_data_createZKERB_PA_PAC_REQUEST_objZpa_pacr  rI   rI   rJ   KERB_PA_PAC_REQUEST_create  s    z*RawKerberosTest.KERB_PA_PAC_REQUEST_createc                 C   s,   |  |}| j|t d}| t|}|S r  )r  rg  r{  PA_PAC_OPTIONSr  r:   )rC   rF   pac_optionsrI   rI   rJ   get_pa_pac_options  s    
z"RawKerberosTest.get_pa_pac_optionsc                 C   s   |d ur.| j |t ||d}| |||}nd }|||||	d}|d urR||d< |d urb||d< |d urr||d< |d ur||d< |
d ur|
|d< |d ur||d< |d ur||d	< |S )
Nrx  )zkdc-optionsr<  tillnoncerj   r   r   fromZrtime	addresseszenc-authorization-datazadditional-tickets)rg  r{  ZAuthorizationDatar  )rC   kdc_optionsr   r<  r   	from_time	till_time
renew_timer  r   r  additional_ticketsEncAuthorizationDataEncAuthorizationData_keyEncAuthorizationData_usagerS  rU  Zenc_ad_plainZenc_adKDC_REQ_BODY_objrI   rI   rJ   KDC_REQ_BODY_create  sB    &z#RawKerberosTest.KDC_REQ_BODY_createc           	      C   s>   d||d}|d ur||d< |d ur2t ||d}nd }||fS )NrP   )r~  msg-typer  r  rZ  )rd  )	rC   r  r  r  rE   rS  rU  ZKDC_REQ_objZKDC_REQ_decodedrI   rI   rJ   KDC_REQ_create  s    zRawKerberosTest.KDC_REQ_createc                 C   sX   | j ||||||||	|
||d d d ||d}| jt||t ||d\}}|rP|S ||fS )N)r  r  r   rS  rU  r  r  r  rE   rS  rU  )r  r  r   r{  AS_REQ)rC   r  r  r   r<  r   r  r  r  r  r   r  r  native_decoded_onlyrS  rU  r  rR  decodedrI   rI   rJ   AS_REQ_create   s:    .
zRawKerberosTest.AS_REQ_createc                 C   s   dt |||d}|S )NrP   )r~  r  z
ap-optionsr   authenticator)r   )rC   
ap_optionsr   r
  Z
AP_REQ_objrI   rI   rJ   AP_REQ_createJ  s    	zRawKerberosTest.AP_REQ_createc	           
      C   sT   d||||d}	|d ur ||	d< |d ur0||	d< |d ur@||	d< |d urP||	d< |	S )NrP   )zauthenticator-vnor   r   cusecctimerx   subkey
seq-numberauthorization-datarI   )
rC   r   r   rx   r  r  r  
seq_numberauthorization_dataZAuthenticator_objrI   rI   rJ   Authenticator_create[  s    z$RawKerberosTest.Authenticator_createc           $      C   sJ  |d urt }nt}| j|d |||	|
||||||||d}| j|t ||d}| j|t||d}d }|d urt| }t	
dd}| j|||||||d d}| j|t ||d}| |t|}td}| jt|||d} | j| t ||d} | t| }!|d ur||! n|!g}| jt||t ||d	\}"}#|rB|#S |#|"fS )
Nr  r   r<  r   r  r  r  r  r   r  r  r  r  r   rx  r  r       r   r   rx   r  r  r  r  r  r  r  r   r
  r  )r,   r+   r  rg  r{  KDC_REQ_BODYr  r*   r   r  r  r  Authenticatorr  r)   	APOptionsr  strAP_REQr  r9   rU   r  r   TGS_REQ)$rC   r  r  r  r   r  r   r<  r   r  r  r  r  r   r  r  r  r  ticket_session_keyauthenticator_subkeybody_checksum_typer  rS  rU  r   r  req_body_blobreq_body_checksum
subkey_objr  r
  r  ap_req
pa_tgs_reqrR  r  rI   rI   rJ   TGS_REQ_create{  s    7	



zRawKerberosTest.TGS_REQ_createc           
      C   s   |d j ddd}|d D ]}|| 7 }q|| 7 }|d 7 }| |t||}|||dd}| j|t d}	| t|	S )	Nr  r@   r   r   r  ZKerberos)r^   r<  rx   ZauthrZ  )	r   r   r  r&   rg  r{  ZPA_S4U2Selfr  r5   )
rC   r^   r<  Ztgt_session_keyrk   Z
cksum_datar  rx   ZPA_S4U2Self_objZpa_s4u2selfrI   rI   rJ   PA_S4U2Self_create  s&    z"RawKerberosTest.PA_S4U2Self_createc                 C   s>   d|i}|d ur||d< |d ur(||d< | j |t d}|S )NZ	newpasswdZtargnameZ	targrealmrZ  )rg  r{  ZChangePasswdDataMS)rC   new_passwordtarget_princtarget_realmZChangePasswdDataMS_objZchange_password_datarI   rI   rJ   ChangePasswdDataMS_create  s    z)RawKerberosTest.ChangePasswdDataMS_createc                 C   s   ||d}|d ur||d< |d ur*||d< |d ur:||d< |d urJ||d< | j |t d}	| |t|	}
dt|
d}| j |t d}|S )	N)	user-dataz	s-addressr  r  r  z	r-addressrZ  rP   )r~  r  enc-part)rg  r{  EncKrbPrivPartr  r%   r   )rC   r  	user_data	s_addressr  r  r  	r_addressZEncKrbPrivPart_objZenc_krb_priv_partZenc_dataZKRB_PRIV_objkrb_privrI   rI   rJ   KRB_PRIV_create(  s4    	zRawKerberosTest.KRB_PRIV_createc              	   C   s   |  | jd |  \}}	| j|||||	||d}
dt| t|
 }| |d t }||d?  ||d@  ||d?  ||d@  |t|d?  |t|d@  || ||
 |S )Nzcall self.connect() first)r1  r  r  r  r2  rO   i   r?      )	r?  r  r  r4  rB   
assertLess	bytearrayrU   extend)rC   r  r0  versionr  r%  local_addressremote_addressr  r  r3  sizern  rI   rI   rJ   kpasswd_createO  s,    

zRawKerberosTest.kpasswd_createc                 C   sJ   |  |dd |d }|  |d|j | |d|j |||d }|S )Nr~  rP   r.  rj   rl   r  )r  rj   r  rl   rr   )rC   rR  ri   ro   enc_partrI   rI   rJ   get_enc_partt  s    zRawKerberosTest.get_enc_partc
           .   	      s  || j ju r d}
| |||}nD|| j ju rT| |d | |d d}
|d}n| d|  | tj	j
}|d u r~d}tt|}||d |d}|	rtd	d
}nd }| j|d d dt|d}| j| jdd | | j | jjtjkrd n"tjkrd n| d   fdd}| j d	 }||}d }| |||
||||}| | |  }| d | | |d d }|dd  }|d	 d> |d B }|d d> |d B }|d d> |d B }| |t | | d| | !|| | "d|d  | "d|d  |r|d | }||d  }|j#}| j$|t% d}| &|dt' | (||t)}| j$|t* d}| +|d | +|d z| j$|t, d}W n t-y   |   Y n0 | &|dt, | (||t.}| j$|t/ d}| 0|d  | 0|d! |d" } n| j$|t1 d}!| j2t3d#d$gd%}"| 4 5 6 }#| &|!d&d | &|!dt1 | 0|!d | 0|!d! | +|!d' | +|!d( |!d) }$t7|t8r| |$| n| 9|$| | 0|!d* | 0|!d+ | &|!d,|#d | :|!d-|" | 0|!d. |!d/ } | d d }%| dd  }&|%d	 d> |%d B }'t7|t8r^| |'| n| 9|'| |&s| d	|'d0 d S |&d	 rt7|t;r| |&| n| 9|&| n(| d1t |& t<=d2|&\}(})}*}+},}-d S )3Ni  z"target_princ only valid for pw setz"target_realm only valid for pw setrS   r   zinvalid mode r  )tgtr   	auth_datar  r   r  F)r  r  ro   r  i  )r0  rR      zunknown family c                    s    t | dS )N)z	addr-typeZaddress)r)  Z	inet_pton)ZipZ	addr_typefamilyrI   rJ   create_address  s    
z8RawKerberosTest.kpasswd_exchange.<locals>.create_addressr  rO   r?   rQ   r@   rP   ~   ^   rZ  r  r  r  r  r  r-  ZkadminZchangepwr  r  r~  stimesusec
error-coder   r   r<  r   e-texte-dataz#got an error result, but no message   z>HIIIQQ)>r   r   r,  r   r  r   Zfailr  rd   re   rf   r  r{  r  r  r  generate_ap_reqr   r,  r  r?  r  rD  r)  ZAF_INETZAF_INET6Zgetsocknamer=  rh  rv  r!  ry  rB   r6  r  r   rc  ZAP_REPr  r   r?  r   ZEncAPRepPartr  r   r   r%   r/  r  r   r  r.   rP  r   r   r  r`   rz  r  rt   rl  rt  ).rC   r   r)  Zexpected_codeZexpected_msgmoder*  r+  r  Zsend_seq_numberr9  r0  r  kdc_exchange_dictr  r%  rE  Zlocal_ipr:  r;  rn  rs  ro  ZreplyZ	reply_lenZreply_versionZ
ap_rep_lenZap_repr3  ri   r>  Zpriv_enc_partZresult_dataZ	krb_errorr   r<  
error_codestatusmessageZstatus_codeZempty_bytesZ
min_lengthZhistory_lengthZ
propertiesZexpire_timeZmin_agerI   rC  rJ   kpasswd_exchange  s   

	





z RawKerberosTest.kpasswd_exchangec           :      C   sx  |d }|d }|d }|d }|d }|d }|d }|d }|d	 }|d
 }|d }|d }|d }|d }|d }|d }|d u r| j dd}d|v r|d }n|  }||d< | j||||||||||	|
|||d}t|} |d ur| D ]"\}!}"|"d ur|"| |!< q| |!= q|d urR| D ]$\}!}"|"d urH|"||!< n||!= q,g }#|d urt| |}$|#|$ |d ur| |}%|#|% |tkrd }&d }'n*| 	t
| | j|||dd}&| t|&}'|d ur| | ||||\}(}ng }(|d ur4| | |||d dd})|d }*| |*|)}+nd }+|d urv||||\},}| |, | tdd |,D d nd },|d ur|d }-| |- |tkr| j|t d}.n| 	t
| |&}.| |-t|.}/|(|#7 }(|||| |(|+|/}0nd }0g }1|'d ur
|1|' |0d ur|1|0 |,d ur0|1|,7 }1|0d u rB|1|#7 }1|1sLd }1|1|d< |(|d< | |d < | j||1|| d!\}2}3|d" }4| j|3|4d#}5| |5 | |5d$}6| |6 d }7|d urt}7| | | d%t| | d%| |d ur|}7| | | 	d%t| | |7 |6tkr>| |5d&}8d'|8 }9n
d(| }9| 	|6|7|9 |6tkrl||||5S ||||5S ))Ncheck_error_fncheck_rep_fngenerate_fast_fngenerate_fast_armor_fngenerate_fast_padata_fngenerate_padata_fncallback_dictreq_msg_typereq_asn1Specrep_msg_typeexpected_error_moder  pac_requestr  	inner_req	outer_reqi  )r  r  r  Fr  Tfast_armor_typec                 S   s   g | ]}|d  qS )r  rI   r  r  rI   rI   rJ   
<listcomp>  r   z9RawKerberosTest._generic_kdc_exchange.<locals>.<listcomp>zDon't create TGS-REQ manually	armor_keyrZ  
req_padatafast_padatar  )r  r  r  rE   r  )r  r  r   rK  zGot unexpected error: zExpected to fail with error: )r  r  r  dictr   r  rU   r  r   ry  r   rO  r  r9   r?  r  assertNotInrg  r{  r  r  r$   r  r  r  r   r  r  rB   ):rC   rQ  r   r<  r   r  r  r  r   r  r  r  r  r   rV  rW  rX  rY  rZ  r[  r\  r]  r^  r_  r`  r  ra  r  rb  rc  r  r  Zinner_req_bodyri   rD   Zadditional_padataZpa_pac_requestZpa_pac_optionsZtgs_reqZtgs_req_padatarj  Zfast_ap_reqre  
fast_armorZouter_padatarh  Zchecksum_blobr   Zfastr  Zreq_objZreq_decodedr  r  r  Zexpected_msg_typerR  r  rI   rI   rJ   _generic_kdc_exchangeN  sJ   









































z%RawKerberosTest._generic_kdc_exchanger   r   c.           /   3   C   s   |dkrd}nt |tjjs"|f}ttjttjtj	|||||||||	|
|||||||||||||||||||||| |!|"|#|$|%|&|'|(|)|*|+|,|-d2}.|d u ri }|.S )Nr   rI   )2r]  r^  r_  rep_asn1Specrep_encpart_asn1Specexpected_crealmexpected_cnameexpected_anonexpected_srealmexpected_snameexpected_account_nameexpected_upn_nameexpected_sidexpected_supported_etypesexpected_flagsunexpected_flagsticket_decryption_keyexpect_ticket_checksumrX  rY  rZ  re  r[  rV  rW  check_kdc_private_fnr\  r`  expected_statusclient_as_etypesexpected_saltr   preauth_keyrh  	armor_tgtarmor_subkeyrA  r  rb  rc  ra  r  expect_edatar  expect_claimsexpect_upn_dns_info_exexpect_pac_attrsexpect_pac_attrs_pac_requestexpect_requester_sidr  )
r  r   r  r  r   r{  r  r   r|  ZEncASRepPart)/rC   rq  rr  rs  rt  ru  rv  rw  rx  ry  rz  r{  r|  r}  rX  rY  rZ  re  r[  rV  rW  r~  r\  r`  r  r  r  r   r  rh  r  r  rA  r  rb  rc  ra  r  r  r  r  r  r  r  r  r  rQ  rI   rI   rJ   as_exchange_dict&	  st    .4z RawKerberosTest.as_exchange_dictc/           0   4   C   s   |dkrd}nt |tjjs"|f}ttjttjtj	|||||||||	|
|||||||||||||||||||||| |!|"|#|$|%|&|'|(|)|*|+|,|-|.d3}/|d u ri }|/S )Nr   rI   )3r]  r^  r_  ro  rp  rq  rr  rs  rt  ru  rv  rw  rx  ry  rz  r{  r|  r}  rX  rY  rZ  re  r[  rV  rW  r~  r\  r`  r  r@  r!  rh  r  r  rA  r   r  rb  rc  ra  r  r  r  r  r  r  r  r  expected_proxy_targetexpected_transited_servicesr  )
r  r   r  r  r   r{  r  r   r}  EncTGSRepPart)0rC   rq  rr  rs  rt  ru  rv  rw  rx  ry  rz  r{  r|  r}  rX  rY  rZ  re  r[  rV  rW  r~  r`  r  r\  r@  rh  r  r  r   rA  r!  r  rb  rc  ra  r  r  r  r  r  r  r  r  r  r  r  rQ  rI   rI   rJ   tgs_exchange_dict	  sv    /5z!RawKerberosTest.tgs_exchange_dictc           #      C   s  |d }|d }|d }|d }|d }|d }	|d }
|d }|d	 }|  |d
| | |d}| jr| |d| |r| jtddgd}n|d }| |d| | |d | |d}d }d }| | |d ur|  |dd | |d| | |d| | |d | |d}| | |d ur| |d |d }t	t
tdd }|t	|kpp|| dk}|r| |d| j n| |d | |d | |d}| |d | |d}d }| | |d ur| |d | |dd | |d | |d}d }| |\}}|d ur| |}t|v r|t }| j|||d d!}d"|v r~| |d" }| ||}|d#}|d ur|d$ }| j|||d d%d& d }|d ur|  |d|j | |d|j |t|} | j| t d'}d }!| | |d ur|  |d|j | jr<| |d|j |||}"z| j|"|
 d'}!W n& ty   | j|"t d'}!Y n0 | |	 |	d ur|	|||||!| |S )(Nrq  rs  rt  ru  r|  r~  rp  r_  rh  r  r  r   	WELLKNOWN	ANONYMOUSrH  rr  r   r   ztkt-vnorP   r<  r   r.  rj   r  zenc-tkt-in-skeyrS   r  rl   r  r  T)finishedstrengthen-keyr  zticket-checksumr   )rR  rZ  ) r  r  r  r  r  r0   r  r  r?  rB   tupler{  
KDCOptionsr  r  r  get_preauth_keyr  r8   check_fx_fast_datar  generate_strengthen_reply_keyr   check_rep_padatarj   rl   rr   r-   rc  EncTicketPartr>  r  )#rC   rQ  r\  r  rq  rs  rt  ru  r|  r~  rp  r  rh  r  rr  r   Zticket_encpartZticket_cipherr  posZexpect_kvnoZencpartZencpart_cipherticket_checksumZencpart_decryption_keyZencpart_decryption_usager  fx_fast_datafast_responsestrengthen_keyZfast_finishedr   Zticket_decpartr   Zrep_decpartrI   rI   rJ   generic_check_kdc_rep 
  s   


















z%RawKerberosTest.generic_check_kdc_repc           
      C   s   | j |t d}|d d }| |d |j |t|d }| j |t d}|rh| jrh| 	d| |rx| 	d| |d }	| |	|d  |S )	NrZ  r  zenc-fast-reprj   r  r  r  r  )
rc  r{  ZPA_FX_FAST_REPLYry  rj   rr   r#   ZKrbFastResponser  rz  )
rC   rQ  r  rh  r  expect_strengthen_keyZenc_fast_repZfast_repr  r  rI   rI   rJ   r  
  s     
z"RawKerberosTest.check_fx_fast_datac           -      C   s  |d }t ttdd }|t |k o4|| dk}	t ttdd }
|
t |k ob||
 dk}t ttdd }|t |k o|| dk}|p|}|d }|d }|d	 }|d
 }|d }|d }|d}|d}| |d}|d ur
|d }| ||| |d }|r"|  }n|  }| 	|}|g}| j
s^| j	|tjjd}|| | jrx| |rxd}n|d }d }|d ur| |d|| | |d | |d} | |  | d ur| | d | | d | | }| |d| | j
r| |d| | |d | |d | j
r<| |d | |d |rd| j
rp| |d n| |d | j
r| |d g  |d ur| j|d!| d" d }!|d ur| |d | |d}"| |" |"d ur| |"d | |"d | |"}!| |d# | |d$|d$  |tkr<| j
rH| |d% n| |d% | |d|| | |d | j
rx| |d | |d |r| j
r| |d n| |d | |d&| | |d'| | j
r| |d g  | |}#| j
r|	s d|#v r| |d( | |d( }$|	rj| t|$ |d) }%|%tjtj B tj!B O }%t"#d*|$t \}&| $|&|% n| %t|$ d|#v r| t&|$ | j'|$t& t( d+}'| |'d,|# n| %t&|$ n| |d(g  |d ur|!d ur| $|j)|!j) | $|j*j+|!j*j+ |!d ur|!}(n|}(t,||(|||||||d-	})|d ur| j-|)|d.}*|du rb| |* n|d/u rv| .|* |*d ur| /|*| |d0 }+|+r| | |d ur| | o|t0k},| j1|)||,||+p| j2d1 |)|d2< d S )3Nr  canonicalizerS   r  	renewablerenewrq  rr  rt  ru  r|  r_  rz  r{  r   rh  r  )rj   Tr  flagsri   r|   r}   r   r   Z	transitedZauthtimeZ	starttimeZendtimez
renew-tillZcaddrr  )r  zlast-reqr  zkey-expirationr   r   zencrypted-pa-datary  z<LrZ  rF   )r   r   r   r   r   r   r   r  Fr}  )service_ticketr  r}  Zrep_ticket_creds)3rB   r  r{  r  r   r  verify_ticket_checksumrN  rP  r  r  rd   re   rh   rU   r  is_tgsr  r  r?  r  r  r  r  r  r   get_sent_pac_optionsr  rz  r>   r	   r   r   r   rl  rt  ry  rl  r:   rc  r  rj   ri   r~   r   get_ticket_pacr  check_pac_buffersr   verify_ticketr  )-rC   rQ  r\  r  r   r   r  r  Z	canon_posr  Zrenewable_posr  Z	renew_posr  Zexpect_renew_tillrq  rr  rt  ru  r|  r_  rz  r{  r   rh  r  krbtgt_creds
krbtgt_keykrbtgt_keysZkrbtgt_key_rc4r  r  Z
ticket_keyZencpart_session_keyZencpart_keysent_pac_optionsZenc_pa_dictry  Zsupported_etypesr  r   Zticket_credspac_datar}  r  rI   rI   rJ   generic_check_kdc_private
  s   





























z)RawKerberosTest.generic_check_kdc_privatec           '      C   sB  t tj|}|d }|d }|d }|d }tjtjtjtjtjg}|d }	tt	t
dd }
|
t|	k ox|	|
 dk}|r|tj | jr|r|tj |tkr|d ur|tj |tj | |s|tkr|tj tjh}| js|tj | |}|d	 }|r$|d
 }n|d }|d u rP| jrD|}n|tj |rb|tj |d }|d u r| jr|}n|tj |r|tj dd |jD }| j||d|d |d }|d }|d }|d u r|d us|d urd}|jD ]8}|jtjkr`|d }|d }|jj}| |t|j  t!t"t|j#}| || q|jtjkr|d }|d d }| ||jj$ q|jtjkr|jjj%j&}|d ur| |t|j$ |d ur:t'|(ddd }| ||j) q|jtjkr|j}|j*}|d } | | |j+ |d }!|!d urL| |!|j, |r\| -| |d ur:|d ur~| ||j. |d ur:| |t|j/ n|jtjkr|r|j}"| d|"j0 |"j1}#t2|#d@ }$t2|#d@ }%| |du |$ | |d u |% n6|jtjkr|r|jj3}&|d ur| |t|& qd S )Nr_  r  ru  r  r  zcname-in-addl-tktrS   r  r  r  ra  r  c                 S   s   g | ]
}|j qS rI   )r\  )r  
pac_bufferrI   rI   rJ   rg    s   z5RawKerberosTest.check_pac_buffers.<locals>.<listcomp>F)r  r  rv  rx  r  Tr  r  rr  r  r   -rq  rw  rR   )4r   r   PAC_DATAZPAC_TYPE_LOGON_INFOPAC_TYPE_SRV_CHECKSUMPAC_TYPE_KDC_CHECKSUMZPAC_TYPE_LOGON_NAMEZPAC_TYPE_UPN_DNS_INFOrB   r  r{  r  rU   ZPAC_TYPE_CONSTRAINED_DELEGATIONr  ZPAC_TYPE_CLIENT_CLAIMS_INFOr   ZPAC_TYPE_DEVICE_INFOZPAC_TYPE_DEVICE_CLAIMS_INFOr  PAC_TYPE_TICKET_CHECKSUMr  addr  ZPAC_TYPE_ATTRIBUTES_INFOZPAC_TYPE_REQUESTER_SIDbuffersr  r\  infory  r  Zproxy_targetr   maptransited_servicesaccount_nameZinfo3baser`   r   ZridexZdns_domain_nameZupn_namer?  ZsamaccountnameZ	objectsidZflags_lengthr  r  Zsid)'rC   r  rQ  pacr_  r  ru  r  Zexpected_typesr  r  Zconstrained_delegationr  r  r  r  r  Zbuffer_typesrv  rx  r  r  r  r  Zdelegation_infor  rr  r  Z
logon_infoZexpected_ridZupn_dns_infoZupn_dns_info_exZexpected_realmrw  Z	attr_infor  Zrequested_pacZ	given_pacZrequester_sidrI   rI   rJ   r    s    














z!RawKerberosTest.check_pac_buffersc                 C   s  |d }|d }|d }|d }|d }	|  |}
|d }| |dd | |d	t | |d
}| ||	 | jr| |d | |d | |d | |d | jr| |d |r|s| jt	ddgd}| 
|d| n| |d | |d| | 
|d| | |d |d }|d }|d u r\|tkoZ|
 sV|d u sV|tkoZ| }|s|| | | |d |S | |d}| jr| | |d ur|tkr0|
s0| j|t d}| t|d  |d }| dt| t|d d d}t|d d  d}| || | d!| n| | | j|t d}| t|d" |
r| d#t| | |}| t| |d$ }| | | j||t |d%d&}|d' }| ||||}||d(< |S ))Nr_  rs  rt  ru  r`  re  r~  rP   r  rK  r  r  rI  rJ  r   r  r  rH  r   r<  r   rL  r  r  rM  rZ  z	data-typez
data-value   r@   r   r?   rQ   r   rS   rh  F)r  r  Zpreauth_etype_info2)	sent_fastr  r   r  rz  r  r  r  r  r0   r  r  r   r   r  r?  r   rc  r{  ZKERB_ERROR_DATAry  r   rB   r`   
from_bytesZMETHOD_DATAassertGreaterr  r8   r  r  )rC   rQ  r\  r  innerr_  rs  rt  ru  r`  r  re  rR  rr  r  r  ZedataZ
error_dataZextended_errorrS  r  
rep_padataZrep_pa_dictrh  r  r  rI   rI   rJ   generic_check_kdc_error%  s    








z'RawKerberosTest.generic_check_kdc_errorc           ,      C   s  |d }|d }|d }| dg }| |}	| |}
|tkrJ| |	 d}d}d}d}tjj|v rjd}|D ]T}||vr|qn|tjjtjj	fv rd}||kr|}|tjjfv rn|dkrn||krn|}qn|dkr||f7 }|dkr||f7 }d}|	r|dkr|t
f7 }|tf7 }|tkrH| |}d	|v r|dtfvr|tf7 }n|tkr|rr| t|d |tf7 }t|dkr|tf7 }|tkr|	r|tf7 }n
|tf7 }|
s|tf7 }|tf7 }| jr|	s|
s|tf7 }|tf7 }td
d |D }| j||ttttthd |s(d S | |}| t}|d urV| t|d | t}|d urz| t|d | t}|d ur| t|d | t}|d ur| t|d | t}|d ur||d< | t
}|d ur| j|t  d}| j!|||dd | t}|d urJ| j|t" d}| #|d| | t}|d urT|
sv| t|d n|d }| $| | %|\}}| &||}| j'r| (t|d t|dkrT| j|t) d} | | d |j* |+t,| d }!| j|!t- d}!|!d }"| .d|! | /|"}#t00 }$| 1|$d |# | 1|#|$d  | t}%|%d ur`| j|%t2 d}%| 3t|%d | j'r| t|%t| t4dt|%D ]}&| 5|%|& d}'| j'r| |'||&  | 5|%|& d}(|'tjjkr| j'r:| 6|( n(| $|( |d })|)d ur:| |(|) | 5|%|& d}*| j'r| 6|* q| t}+|+d ur| j|+t7 d}+| t|+d | 5|+d d}'| |'tjj | |'|d  | 5|+d d}(| j'r| $|( | t|(d |%S )Nr_  r  rj   r  rI   Fr   Tr  c                 s   s   | ]}|d  V  qdS )r  NrI   rf  rI   rI   rJ   r    r   z3RawKerberosTest.check_rep_padata.<locals>.<genexpr>r  fast_cookierZ  )r  rF   rh  r  r  r  i,  rS   r   r  r  )8r   r  sent_enc_challenger   r6  rd   re   rh   rf   rg   r7   r6   r  r   r:   r  rB   r3   r4   r   r1   r2   r<   r=   r  r8   r  r  r  ry  rc  r{  r   r  r  r  r?  r  generate_kdc_challenge_keyr  r  ZEncryptedDatarj   rr   r    ZPA_ENC_TS_ENCrz  r  r  r6  ZETYPE_INFO2ru  rV   r  r  Z
ETYPE_INFO),rC   rQ  r\  r  rR  r_  r  Zproposed_etypesr  r  r  Zexpect_etype_info2Zexpect_etype_infoZexpected_aes_typeZexpected_rc4_typerj   Zexpected_patypesr  Zgot_patypesr  Zenc_timestampZ	pk_as_reqZpk_as_rep19Zfx_fastr  Z
fast_errorr  Zenc_challengerh  r  rb  kdc_challenge_keyZencrypted_challengeZ	challengeZ
rep_patimeZrep_timeZcurrent_timer  r  r  r   r  r  Z
etype_inforI   rI   rJ   r    sZ   














































z RawKerberosTest.check_rep_padatac                 C   sp   |d }|  |||}	| j|	t d}	| |t|	}	| |||	}
| |
}| j|t d}| 	t
|}|S )Nrh  rZ  )r  rg  r{  Z
KrbFastReqr  r!   r  r  ZPA_FX_FAST_REQUESTr  r8   )rC   rQ  _callback_dictr  rj  rm  r   r  rh  Zfast_reqZfast_armored_reqZfx_fast_requestrI   rI   rJ   generate_simple_fastV  s2    
z$RawKerberosTest.generate_simple_fastc              
   C   s0  d }|r$|  | |d }|d }	nF|d }|d }	|d urj|d }
| j|t d}| j|jt||
d}|d }d }|	d ur|	 }|d u rt	d	d
}| 
 \}}| j|j|j||||||d}| j|t d}|d u r|rtnt}| |j||}td}| jt||j|d}| j|t d}|S )Nr  r  r@  r   r!  rZ  r  rA  r   r  r  r  r  )r  rg  r{  r  r  r   r*   r   r  r  r  r  r   r   r  r   r)   r  r  r  r  r   r  )rC   rQ  r  r  r  ro   r  r#  r@  r   r!  r"  rA  r$  r  r  Zauthenticator_objZauthenticator_blobr
  r  Z
ap_req_objr%  rI   rI   rJ   rO  w  sh    

	

zRawKerberosTest.generate_ap_reqc                 C   s,   | j |||dd}| t|}|g}||fS )NFrd  )rO  r  r9   )rC   rQ  r\  r  r%  r&  r  rI   rI   rJ   generate_simple_tgs_padata  s    z*RawKerberosTest.generate_simple_tgs_padatac                 C   s\   |d }|t kr|d }t}n,|d }|d ur8|}t}n|d }|j}t}| | ||fS )Nr_  r  r   r@  )r   r   r(   r   r'   r?  )rC   rQ  r  ri   ro   r   r@  rI   rI   rJ   r    s    
zRawKerberosTest.get_preauth_keyc                 C   s"   t |j|jdd}t|d }|S )Ns   subkeyarmors   ticketarmorrd   cf2ri   rb   )rC   r  r   rh  rI   rI   rJ   generate_armor_key  s    
z"RawKerberosTest.generate_armor_keyc                 C   s$   t |j|jdd}t||j}|S )Ns   strengthenkeys   replykey)rd   r  ri   rb   rl   )rC   r  Z	reply_keyZstrengthen_reply_keyrI   rI   rJ   r    s    z-RawKerberosTest.generate_strengthen_reply_keyc                 C   s"   t |j|jdd}t|d }|S )Ns   clientchallengearmor   challengelongtermr  )rC   rh  longterm_keyZclient_challenge_keyrI   rI   rJ   generate_client_challenge_key  s    
z-RawKerberosTest.generate_client_challenge_keyc                 C   s"   t |j|jdd}t|d }|S )Ns   kdcchallengearmorr  r  )rC   rh  r  r  rI   rI   rJ   r    s    
z*RawKerberosTest.generate_kdc_challenge_keyc                 C   sF   |d }|  |j| | j|t d}| |t|}|  || d S )Nr  rZ  )ry  rk   rg  r{  ZTicketr  r"   )rC   r   Zexpected_checksumrh  Zexpected_typeZticket_blobr   rI   rI   rJ   r    s    z&RawKerberosTest.verify_ticket_checksumc                    s^  |j }|jd }| |d|j | |d|j |t|d }| j|t	
 d}|d}|rl| | n|d u rxd S |  }	| j||	|d\}}
|sd S ttj|
}ttj|
}i }t|j|jD ]\}}|j}|| jv r| ||d|  |jj}|jj}|d	@ r|d
O }||f||< |tjkrttj|jj}tt||_t||j_qt|}
|tj  \}}|!t"|
|| |tj# \} t$|t%j&j'r| j(r|d }nt) fdd|D }n|}|*t"| | |s| tj| nl|tjd\}}|r| | n|du r&| +| |d urZ||d< | j,|t	
 d}|*t"||| d S )Nr.  rj   rl   r  rZ  r  r  Duplicate checksum type r   r   r   c                 3   s   | ]}|j  kr|V  qd S rc   r  )r  ri   Z	kdc_ctyperI   rJ   r  d  s   
z0RawKerberosTest.verify_ticket.<locals>.<genexpr>)NNF)-r   r   r  rj   r  rl   rr   r-   rc  r{  r  r   r?  get_empty_pacreplace_pacr   r   r  ZPAC_DATA_RAWzipr  r\  pac_checksum_typesrl  r  	signaturer  PAC_SIGNATURE_DATA	remainingrt   rB   r   r  r{   r&   r  r  r   r  r  r  nextr   r  rg  )rC   r   r  r  r  r}  ri   r>  rA  	empty_pacr  r  Zraw_pacZ	checksumsr  Zraw_pac_bufferbuffer_typer   rk   r  server_checksumZserver_ctypekdc_checksumr  r  Zticket_ctyperI   r  rJ   r  	  s    










zRawKerberosTest.verify_ticket)new_ticket_key	modify_fnmodify_pac_fnexclude_pacallow_empty_authdataupdate_pac_checksumschecksum_keysinclude_checksumsc                C   sR  |d u ri }|	d u ri }	|  | | j |  |	 | j |rN| | d}|sf| | | |	 |d u}
|j}|d u r|}tj|vr||tj< tj|vr|	tj
}|d ur||tj< |jd }| |d|j | |d|j |t|d }| j|t d}|d ur||}|	d}|
r4| | |d urd }|s|  }| j|||
d\}}|d urttj|}|d ur||}|r| }||d< | j|t d}| |||	| t|}| t|}| j|||
|d	\}}||d< | j|t d}|  |t|}|j }||d< t!||j"|j#|j$|j%|j&|||j'd
	}|S )NFr.  rj   rl   r  rZ  r  r  )r  r  )r   r   r   r   r   r   r   r   )(ZassertLessEqualkeysr  r  ZassertFalser   r   r  r  r   r  r   r  rj   r  rl   rr   r-   rc  r{  r  r?  r  r  r   r  copyrg  r  r   r  r   r  r   r   r   r   r   r   r   )rC   r   r  r  r  r  r  r  r  r  r  ri   kdc_checksum_keyr>  rA  new_pacr  Zempty_pac_auth_datar  r  Zenc_part_to_signrb  Zenc_part_newZ
new_ticketZnew_ticket_credsrI   rI   rJ   modified_ticket  s    
















zRawKerberosTest.modified_ticketc                 C   s  |j }i }|D ]0}|j}|| jv r| ||d|  |||< q| jD ]}||v r||du r||}	| jd8  _||	 qF||du rFt	 }
t
 }	||	_|
|	_||	 | jd7  _|	||< qF| D ]l\}}	|| }|jd@ }|tjkr| | |t|}n|tjkr,| }n| }||	j_||	j_q||_ |tj}|d ur|tj }t|}|t|}||j_|tj}|d ur|d u rt }|tj }|t|}||j_d S )Nr  FrS   Tl    )r  r\  r  rl  r   popZnum_buffersremover   r  Z
PAC_BUFFERr  rU   r   rk   r  r?  r   r&   r  ru   r   r  r   rv   r  rt   )rC   r  r  r  r>  Zpac_buffersZchecksum_buffersr  r  Zchecksum_bufferr  Zchecksum_keyrk   r  Zserver_checksum_bufferZserver_checksum_keyr  r  Zkdc_checksum_bufferr  r  rI   rI   rJ   r    sz    














z$RawKerberosTest.update_pac_checksumsc                 C   s  |d ur"|  |dt | |d g }d }d }|D ]}|d tkr| j|d t d}g }	|D ]B}
|
d tkr| |d |
d }|d ur|	| q`|	|
 q`|r| |d |	s|r| j	|	t d}| 
t|}nd }|d us|r2|| q2|r
| |d ||fS )Nr  r  rZ  zMultiple PACs detectedzExpected PACzExpected AD-RELEVANT)r  r   r  r   rc  r{  r  rU   r?  rg  r  )rC   rA  r  r  r  Znew_auth_dataZad_relevantZold_pacZauthdata_elemZrelevant_elemsZrelevant_elemrI   rI   rJ   r  q  sJ    zRawKerberosTest.replace_pacc                 C   s   |  |d |\}}|S rc   )r  )rC   rA  r  rb  r  rI   rI   rJ   get_pac  s    zRawKerberosTest.get_pacc                 C   s6   |j d}|r| | n|d u r(d S | j||dS )Nr  r  )r   r   r?  r  )rC   r   r  rA  rI   rI   rJ   r    s    zRawKerberosTest.get_ticket_pacc                 C   s   |   }| |}tj|iS rc   )rP  r  r   r  )rC   r  r  rI   rI   rJ   get_krbtgt_checksum_key  s    
z'RawKerberosTest.get_krbtgt_checksum_keyc                 C   s   |d d }|dv S )Nr  r   )rO  s   krbtgtrI   )rC   Z	principalr^   rI   rI   rJ   r    s    zRawKerberosTest.is_tgsc                 C   s   |j d }| |S r   )r   r  )rC   r   r   rI   rI   rJ   is_tgt  s    
zRawKerberosTest.is_tgtc                 C   s   |  ttdS r   )r  r   rt   r   rI   rI   rJ   r    s    zRawKerberosTest.get_empty_pacc                 C   s   |  |d S )Nri  )r  )rC   rQ  rI   rI   rJ   get_outer_pa_dict  s    z!RawKerberosTest.get_outer_pa_dictc                 C   s    |  |d }|r|S | |S )Nrj  )r  r  )rC   rQ  Zreq_pa_dictrI   rI   rJ   get_fast_pa_dict  s    z RawKerberosTest.get_fast_pa_dictc                 C   s   |  |}t|v S rc   )r  r8   )rC   rQ  Zouter_pa_dictrI   rI   rJ   r    s    
zRawKerberosTest.sent_fastc                 C   s   |  |}t|v S rc   )r  r1   )rC   rQ  fast_pa_dictrI   rI   rJ   r    s    
z"RawKerberosTest.sent_enc_challengec                 C   sb   |  |}t|vrdS | j|t t d}|d }|d d |dd   }}|dt| 7 }|S )Nr   rZ  rF   r@   r  )r  r:   rc  r{  r  rB   )rC   rQ  r  r  r  rI   rI   rJ   r    s    

z$RawKerberosTest.get_sent_pac_optionsc                 C   s.   |   }| }| }| jt||gd}|S )NrH  )rP  r   r   r  r/   )rC   r  Zkrbtgt_usernameZkrbtgt_realmZkrbtgt_snamerI   rI   rJ   get_krbtgt_sname  s    z RawKerberosTest.get_krbtgt_snamec           $         s    fdd}|sd }| j } n
| j}d }  d ur4|}!nd }!| j|||	|
||||||!|| | j||||||t||||||||d}"| j|"|||||d}#|#|"fS )Nc                    s    |fS rc   rI   )Z_kdc_exchange_dictr  r  r  rI   rJ   _generate_padata_copy  s    z@RawKerberosTest._test_as_exchange.<locals>._generate_padata_copy)rq  rr  rt  ru  rv  rw  rx  ry  r|  r[  rV  rW  r~  r`  r  r  rz  r{  r  r  ra  r  r  r  r  r  r  )r   r<  r   r  r   )r  r  r  r  r  rn  )$rC   r   r<  r   r  r  r`  rq  rr  rt  ru  r  r   r  r  rv  rw  rx  rz  r{  ry  r  r|  ra  r  r  r  r  r  r  r  rV  rW  r[  rQ  r  rI   r  rJ   _test_as_exchange  s\    z!RawKerberosTest._test_as_exchange)N)N)TF)NFTF)NFTFN)FT)FT)FT)FT)FT)TF)TF)N)N)NTNN)NTNN)NN)N)r   NN)NNN)NNN)NNN)NNNF)F)NN)NN)N)NNNNN)N)N)N)T)NN)NNN)TNN)NNTNN)N)NN)NNNN)NNNT)NNNNNNNNNNNN)FT)F)r   )NN)TT)N)TF)T)T)NNNNNNNNNNTNNNF)r   r   r   __doc__r   r   r   r  r  r  r  rd   re   rf   rg   rh   r   r   r   r  r  r  r  r  r   r!  r1  r,  r5  r=  rC  rG  rH  rI  rJ  rK  rN  rP  rQ  rT  rW  rc  rg  rj  rh  rp  rv  r  r  r  r2  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r	  r  r  r'  r(  r,  r4  r=  r?  rU  rn  r   r  r  r  r  r  r  r  r  r  rO  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   rI   rI   r   rJ   r     s  


#

  
    
K     
1  
	 
	 
	 
	 
 
 
	
   
   
   

 
"
	
 
L  
+  
J3    
  
   
'%   
 R           
 Z
m
n  
 W *
f S
& 
A	
		 
{ 
^ 
1	              r   )r   )r   )r#  r)  rl  r  r  r  r   r   r   enumr   Zpyasn1.codec.der.decoderr   r^  Zpyasn1.codec.der.encoderr   re  Zpyasn1.codec.native.decoderrd  Zpyasn1.codec.native.encoderr_  Zpyasn1.codec.ber.encoderr   Zpyasn1.errorr   Zsamba.credentialsr   Zsamba.dcerpcr   r	   Zsamba.gensecr
   Z	samba.ndrr   r   Zsamba.testsr  r   Zsamba.tests.krb5.rfc4120_pyasn1r  Zkrb5Zrfc4120_pyasn1r{  Z"samba.tests.krb5.rfc4120_constantsr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r5   r6   r7   r8   r9   r:   r;   r<   r=   r>   Zsamba.tests.krb5.kcryptord   rK   ZencodeValuer_   ZTicketFlagsValuesr  r  rW   ZprettyPrintZKDCOptionsValuesr  ZAPOptionsValuesr  ZPACOptionFlagsValuesZPACOptionFlagsra   ZNameTypeValuesZNameTypeZAuthDataTypeValuesZAuthDataTypeZPADataTypeValuesZ
PADataTypeZEncryptionTypeValuesZEncryptionTypeZChecksumTypeValuesZChecksumTypeZKerbErrorDataTypeValuesZKerbErrorDataTyperb   r   r   r   r   r   r   rI   rI   rI   rJ   <module>   s   3

4' 