a
    )&i                     @   s  d dl Z d dlZd dlZe jd d dejd< d dlmZ d dlm	Z	m
Z
 d dlmZ d dlmZmZ d d	lmZ d d
lmZmZ d dlmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z# d dl$m%  m&  m'Z( dZ)dZ*G dd deZ+e,dkrdZ)dZ*d dl-Z-e-.  dS )    Nz
bin/python1ZPYTHONUNBUFFERED)ntstatus)krb5paclsa)env_get_var_value)	CksumtypeEnctype)KDCBaseTest)RodcPacEncryptionKeyZeroedChecksumKey)AES256_CTS_HMAC_SHA1_96ARCFOUR_HMAC_MD5KDC_ERR_BADMATCHKDC_ERR_BADOPTIONKDC_ERR_BAD_INTEGRITYKDC_ERR_GENERICKDC_ERR_INAPP_CKSUMKDC_ERR_MODIFIEDKDC_ERR_SUMTYPE_NOSUPPKDC_ERR_TGT_REVOKEDKU_PA_ENC_TIMESTAMPKU_AS_REP_ENC_PARTKU_TGS_REP_ENC_PART_SUB_KEYNT_PRINCIPALFc                       s  e Zd Z fddZdddZdd Zdd	 Zd
d Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zdd Zdd Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Zd6d7 Zd8d9 Zd:d; Zd<d= Z d>d? Z!d@dA Z"dBdC Z#dDdE Z$dFdG Z%dHdI Z&dJdK Z'dLdM Z(dNdO Z)dPdQ Z*dRdS Z+dTdU Z,dVdW Z-dXdY Z.dZd[ Z/d\d] Z0d^d_ Z1d`da Z2dbdc Z3ddde Z4dfdg Z5dhdi Z6e7j8e7j9e7j:hZ;djdk Z<dldm Z=dndo Z>dpdq Z?drds Z@dtdu ZAdvdw ZBddxdyZCdd{d|ZDd}d~ ZE  ZFS )S4UKerberosTestsc                    s   t t|   t| _t| _d S N)superr   setUpglobal_asn1_printZdo_asn1_printglobal_hexdumpZ
do_hexdumpself	__class__ </usr/lib/python3/dist-packages/samba/tests/krb5/s4u_tests.pyr   <   s    zS4UKerberosTests.setUpNc                 C   s  |   }| }| }| jd|gd}| jdd|gd}| jdd}td}d }	d}
| j|	t||||d |d d	|
d d d
}| 	|}| 
| | |d d | |d d | j|d t d}|D ]}|d dkr|d } qq| j|t d}| ||d }|  \}}| ||}| j|t d}| |t|}| j|t d}| d|}td}|g}	| j|	t||||d |d d	|
d d d
}| 	|}| 
| |d }| |d |t|d d }z| j|t d}W n& ty   | j|t d}Y n0 |}td}| jd|gd}td}| jdd}|d }| |d }| j||||d}|g}	|  |j!}|  \}}| j"|	|||t||||d |d d|
d d d d ||d}| 	|}| 
| |d }|dkr
|t#|d d }| j|t d}|S )N   Z	name_typenames   Zkrbtgti  )offsetforwardable)         i)padatakdc_optionscnamerealmsname	from_time	till_time
renew_timenonceetypes	addressesadditional_ticketszmsg-type   z
error-code   ze-data)Zasn1Speczpadata-type   zpadata-valuer      zenc-partZcipherZFOR_USERticketkeynamer2   Ztgt_session_keyctypei)r/   cusecctimer?   r0   r1   r2   r3   r4   r5   r6   r7   r8   r9   ZEncAuthorizationDataZEncAuthorizationData_keyr:   ticket_session_keyauthenticator_subkey   )$Zget_service_credsget_username	get_realmPrincipalName_createZget_KerberosTime	krb5_asn1
KDCOptionsZAS_REQ_createstrZsend_recv_transactionassertIsNotNoneassertEqualZ
der_decodeZMETHOD_DATAZETYPE_INFO2ZPasswordKey_from_etype_info2Zget_KerberosTimeWithUsecZPA_ENC_TS_ENC_createZ
der_encodeZPA_ENC_TS_ENCZEncryptedData_creater   ZEncryptedDataZPA_DATA_createZdecryptr   ZEncASRepPart	ExceptionZEncTGSRepPartr   ZEncryptionKey_importPA_S4U2Self_create	RandomKeyetypeZTGS_REQ_creater   )r!   pa_s4u2self_ctypeservice_credsZservicer2   r1   r3   Ztillr0   r/   r8   ZreqZrepZ
rep_padataZpaZetype_info2r@   ZpatimeZpausecZpa_tsmsg_typeZ	enc_part2Zfor_user_nameunamer?   rF   pa_s4uZsubkeyrE   rD   r$   r$   r%   _test_s4u2selfA   s    










zS4UKerberosTests._test_s4u2selfc                 C   s   |   }| |d d S )NrH   )rZ   rP   r!   rW   r$   r$   r%   test_s4u2self   s    zS4UKerberosTests.test_s4u2selfc                 C   s   | j tjd}| |d d S )NrU   rH   )rZ   r   ZHMAC_MD5rP   r[   r$   r$   r%   test_s4u2self_hmac_md5_checksum   s    z0S4UKerberosTests.test_s4u2self_hmac_md5_checksumc                 C   s   | j tjd}| |d d S Nr]   r;   )rZ   r   MD5rP   r[   r$   r$   r%   "test_s4u2self_md5_unkeyed_checksum   s    z3S4UKerberosTests.test_s4u2self_md5_unkeyed_checksumc                 C   s   | j tjd}| |d d S r_   )rZ   r   SHA1rP   r[   r$   r$   r%   #test_s4u2self_sha1_unkeyed_checksum   s    z4S4UKerberosTests.test_s4u2self_sha1_unkeyed_checksumc                 C   s   | j tjd}| |d d S r_   )rZ   r   CRC32rP   r[   r$   r$   r%   $test_s4u2self_crc32_unkeyed_checksum   s    z5S4UKerberosTests.test_s4u2self_crc32_unkeyed_checksumc                    s*  | dd }jjj|d}| dd }jjj|d}|| dd }|d urb|| }jt|gd 	 }|
 }	||	}
| dd }|d u r| d d }jtd|gd}| | d	d }|d urt|}| d
d }|d urt|}| dd}| dd }|r<j}d }nd }j}| | dd}t|}|}tj}| dttf}| dd } fdd}j |||
|||d|||j|||t|d|d}j|d ||d |s|d }|}| i | d S )Nclient_optsZaccount_typeZoptsservice_optsmodify_service_tgt_fnr'   service_namehostexpected_flagsunexpected_flagsexpected_error_moder   expected_statusr0   0r8   expect_edatac                    s   j  jd d}|g|fS )NrA   )rR   Zsession_key)Z_kdc_exchange_dictZ_callback_dictZreq_bodyrY   client_cnamer2   r!   Zservice_tgtr$   r%   generate_s4u2self_padata  s    zES4UKerberosTests._run_s4u2self_test.<locals>.generate_s4u2self_padataTF)expected_crealmexpected_cnameexpected_srealmexpected_snameexpected_account_nameexpected_sidrm   rn   ticket_decryption_keyZexpect_ticket_checksumZgenerate_padata_fncheck_error_fncheck_rep_fncheck_kdc_private_fnro   rp   tgtrG   r0   Zexpect_claimsrr   )r1   r2   r3   r8   rep_ticket_creds) popget_cached_credsAccountTypeUSERCOMPUTERget_tgtrI   rK   r   	get_samdbget_dnget_objectSidrJ   rL   TicketFlagsgeneric_check_kdc_errorgeneric_check_kdc_repassertIsNonerM   TicketDecryptionKey_from_credsrS   r   AES256r   r   tgs_exchange_dictgeneric_check_kdc_privaterN   _generic_kdc_exchangeget_ticket_pacrO   rP   )r!   kdc_dictrf   client_credsrh   rV   ri   Zclient_namesamdb	client_dnsidrj   Zservice_snamerm   rn   ro   rp   r}   r~   r0   Zservice_decryption_keyrG   r8   rr   ru   kdc_exchange_dictr?   pacr$   rs   r%   _run_s4u2self_test   s    







z#S4UKerberosTests._run_s4u2self_testc                 C   s(   |  ddidtj| jdddd d S )Nnot_delegatedFr+   Tflag)rf   r0   ri   rm   r   	functoolspartialset_ticket_forwardabler    r$   r$   r%   test_s4u2self_forwardableS  s    z*S4UKerberosTests.test_s4u2self_forwardablec              	      s,    fdd}  tddid|ddd d S )Nc                    s    j | dd}  | S )NTr   )r   remove_ticket_pac)r?   r    r$   r%   forwardable_no_pacb  s    zAS4UKerberosTests.test_s4u2self_no_pac.<locals>.forwardable_no_pacr   Fr+   )ro   rf   r0   ri   rm   rr   )r   r   )r!   r   r$   r    r%   test_s4u2self_no_paca  s    z%S4UKerberosTests.test_s4u2self_no_pacc                 C   s&   |  dditj| jdddd d S )Nr   FTr   r+   )rf   ri   rn   r   r    r$   r$   r%   !test_s4u2self_without_forwardablet  s    z2S4UKerberosTests.test_s4u2self_without_forwardablec                 C   s(   |  ddidtj| jdddd d S )Nr   Fr+   r   rf   r0   ri   rn   r   r    r$   r$   r%   test_s4u2self_not_forwardable  s    z.S4UKerberosTests.test_s4u2self_not_forwardablec                 C   s(   |  ddidtj| jdddd d S )Nr   Tr+   r   r   r   r    r$   r$   r%   "test_s4u2self_client_not_delegated  s    z3S4UKerberosTests.test_s4u2self_client_not_delegatedc              	   C   s0   |  ddiddddtj| jdddd d S )	Nr   Fr$   trusted_to_auth_for_delegationdelegation_to_spnr+   Tr   rf   rh   r0   ri   rm   r   r    r$   r$   r%   'test_s4u2self_not_trusted_empty_allowed  s    z8S4UKerberosTests.test_s4u2self_not_trusted_empty_allowedc              	   C   s0   |  ddiddddtj| jdddd d S )	Nr   Ftestr   r+   Tr   )rf   rh   r0   ri   rn   r   r    r$   r$   r%   *test_s4u2self_not_trusted_nonempty_allowed  s    z;S4UKerberosTests.test_s4u2self_not_trusted_nonempty_allowedc              	   C   s0   |  ddiddddtj| jdddd d S )	Nr   FTr$   r   r+   r   r   r   r    r$   r$   r%   #test_s4u2self_trusted_empty_allowed  s    z4S4UKerberosTests.test_s4u2self_trusted_empty_allowedc              	   C   s0   |  ddiddddtj| jdddd d S )	Nr   FTr   r   r+   r   r   r   r    r$   r$   r%   &test_s4u2self_trusted_nonempty_allowed  s    z7S4UKerberosTests.test_s4u2self_trusted_nonempty_allowedc                 C   sZ   | j | jjdddd}| d d }| tdddiddi|d	tj| jdd
d d S )NTr   )r   idrg   rk   Fr   r   r+   r   )ro   rr   rf   rh   rj   r0   ri   )	r   r   r   rI   r   r   r   r   r   )r!   Zother_credsZother_snamer$   r$   r%   test_s4u2self_wrong_sname  s*    z*S4UKerberosTests.test_s4u2self_wrong_snamec              	   C   s0   |  ddiddddtj| jdddd d S )Nr   FT)r   no_auth_data_requiredr+   r   r   r   r    r$   r$   r%   #test_s4u2self_no_auth_data_required  s    z4S4UKerberosTests.test_s4u2self_no_auth_data_requiredc           0      C   sr  | dd }| j| jj|d}|  }| }| ||}| di }| di }| dd}	| dd}
| |	ot|
 |
r| j| jj|d}| 	d| t
| |d< | j| jj|d}n@| j| jj|d}|	r| 	d	| | |d	< | j| jj|d}| d
d}t|}| j|||d}| j||||d}| |}| dd }|d ur^||}|jg}| dd }|d ur||}| dd }|d u rt
td}| }| }| jt|gd}| d d }| }| d d }| }d}| jt||gd}| |}|j} | d}!| dd }"|!rF| j}#d }$nd }#| j}$| |" | dd }%|%d urz| |! | dd }&| tj}'| dtt f}(| })| dg }*d| d| }+|*!|+ | dd},| j"||||||| ||#|$| j#|!|"i ||'||&|%|)|*|,d}-| j$|-d |||(|d |!sb|-d  }.| j%|.|,d!}/|,rX| &|/ n
| |/ | 'i | d S )"Nrf   rg   service1_optsservice2_optsallow_delegationF
allow_rbcdZdelegation_from_dnr   client_tkt_optionsr+   )r0   rm   modify_client_tkt_fnri   r0   zcname-in-addl-tktr'   rk   rl   ro   rp   rr   pac_optionsr8   expected_transited_serviceszhost/@
expect_pacT)rv   rw   rx   ry   rz   r{   Zexpected_supported_etypesr|   r}   r~   r   ro   rp   Zcallback_dictr   rG   r0   r   rr   expected_proxy_targetr   r   )r1   r2   r3   r8   r:   r   )r   )(r   r   r   r   r   r   r   ZassertFalser   assertNotInrN   Zget_spnrL   r   r   Zget_service_ticketr?   rM   rI   rJ   rK   r   r   Ztgs_supported_enctypesr   r   r   Z
assertTruerS   r   r   r   r   appendr   r   r   r   rO   rP   )0r!   r   rf   r   r   r   r   r   r   r   r   Zservice1_credsZservice2_credsr   rm   Z
client_tgtZclient_service_tktZservice1_tgtr   r:   ri   r0   Zclient_usernameZclient_realmrt   Zservice1_nameZservice1_realmZservice2_nameZservice2_realmZservice2_serviceZservice2_snameZservice2_decryption_keyZservice2_etypesro   rp   r}   r~   rr   r   rG   r8   r   r   Ztransited_servicer   r   r?   r   r$   r$   r%   _run_delegation_test  s   










z%S4UKerberosTests._run_delegation_testc                 C   s   |  ddd d S )Nr   T)ro   r   r   r    r$   r$   r%   test_constrained_delegation  s
    z,S4UKerberosTests.test_constrained_delegationc                 C   s   |  ddddidd d S )Nr   Tr   F)ro   r   r   r   r   r    r$   r$   r%   1test_constrained_delegation_no_auth_data_required  s    zBS4UKerberosTests.test_constrained_delegation_no_auth_data_requiredc                 C   s,   g d}|  ddtj| j|d|d d S )NZservice1Zservice2Zservice3r   Tservices)ro   r   r   r   r   r   r   add_delegation_infor!   r   r$   r$   r%   4test_constrained_delegation_existing_delegation_info  s    zES4UKerberosTests.test_constrained_delegation_existing_delegation_infoc                 C   s   |  ttjdd d S )NF)ro   rp   r   r   r   r   NT_STATUS_NOT_SUPPORTEDr    r$   r$   r%   'test_constrained_delegation_not_allowed  s    z8S4UKerberosTests.test_constrained_delegation_not_allowedc                 C   s   |  ttfd| jdd d S )NTFro   r   r   rr   )r   r   r   r   r    r$   r$   r%   )test_constrained_delegation_no_client_pac  s    z:S4UKerberosTests.test_constrained_delegation_no_client_pacc                 C   s   |  td| jdd d S )NTF)ro   r   ri   rr   r   r   r   r    r$   r$   r%   *test_constrained_delegation_no_service_pac  s    z;S4UKerberosTests.test_constrained_delegation_no_service_pacc                 C   s$   |  ttfd| jdddid d S )NTFr   )ro   r   r   rr   r   )r   r   r   r   r    r$   r$   r%   ?test_constrained_delegation_no_client_pac_no_auth_data_required  s    zPS4UKerberosTests.test_constrained_delegation_no_client_pac_no_auth_data_requiredc              	   C   s"   |  td| jddiddd d S )NTr   F)ro   r   ri   r   r   rr   r   r    r$   r$   r%   @test_constrained_delegation_no_service_pac_no_auth_data_required	  s    zQS4UKerberosTests.test_constrained_delegation_no_service_pac_no_auth_data_requiredc              	   C   s&   |  ttjdtj| jddd d S )NTFr   )ro   rp   r   r   r   r   r   ZNT_STATUS_ACCOUNT_RESTRICTIONr   r   r   r    r$   r$   r%   +test_constrained_delegation_non_forwardable  s    z<S4UKerberosTests.test_constrained_delegation_non_forwardablec                 C   s   |  dddd d S )Nr   0001T)ro   r   r   r   r    r$   r$   r%   ,test_constrained_delegation_pac_options_rbcd#  s    z=S4UKerberosTests.test_constrained_delegation_pac_options_rbcdc                 C   s   |  dddddidd d S )Nr   Tr   r   F)ro   r   r   r   r   r   r    r$   r$   r%   test_rbcd_no_auth_data_required-  s    z0S4UKerberosTests.test_rbcd_no_auth_data_requiredc              	   C   s.   g d}|  dddtj| j|d|d d S )Nr   r   Tr   r   )ro   r   r   r   r   r   r   r$   r$   r%   "test_rbcd_existing_delegation_info9  s    z3S4UKerberosTests.test_rbcd_existing_delegation_infoc                 C   s   |  ttjddd d S )NFr   ro   rp   r   r   )r   r   r   ZNT_STATUS_NOT_FOUNDr    r$   r$   r%   test_rbcd_not_allowedI  s    z&S4UKerberosTests.test_rbcd_not_allowedc                 C   s   |  ttjdd| jd d S )NTr   ro   rp   r   r   r   r   r   r   r   r   r    r$   r$   r%   test_rbcd_no_client_pac_aT  s    z*S4UKerberosTests.test_rbcd_no_client_pac_ac              	   C   s$   |  ttjdd| jddid d S )NTr   r   	host/test)ro   rp   r   r   r   r   r   r   r   NT_STATUS_NO_MATCHr   r    r$   r$   r%   test_rbcd_no_client_pac_b`  s    z*S4UKerberosTests.test_rbcd_no_client_pac_bc                 C   s   |  tdd| jdd d S )NTr   F)ro   r   r   ri   rr   r   r    r$   r$   r%   test_rbcd_no_service_paco  s    z)S4UKerberosTests.test_rbcd_no_service_pacc              	   C   s$   |  ttjdd| jddid d S )NTr   r   )ro   rp   r   r   r   r   r   r    r$   r$   r%   /test_rbcd_no_client_pac_no_auth_data_required_a{  s    z@S4UKerberosTests.test_rbcd_no_client_pac_no_auth_data_required_ac              
   C   s*   |  ttjdd| jddiddid d S )NTr   r   r   r   )ro   rp   r   r   r   r   r   r   r    r$   r$   r%   /test_rbcd_no_client_pac_no_auth_data_required_b  s    z@S4UKerberosTests.test_rbcd_no_client_pac_no_auth_data_required_bc              	   C   s"   |  tdd| jddidd d S )NTr   r   F)ro   r   r   ri   r   rr   r   r    r$   r$   r%   .test_rbcd_no_service_pac_no_auth_data_required  s    z?S4UKerberosTests.test_rbcd_no_service_pac_no_auth_data_requiredc              
   C   s(   |  ttjddtj| jddd d S )NTr   Fr   r   r   r    r$   r$   r%   test_rbcd_non_forwardable  s    z*S4UKerberosTests.test_rbcd_non_forwardablec                 C   s   |  ttjddd d S )NTr   r   r   r    r$   r$   r%   test_rbcd_no_pac_options_a  s    z+S4UKerberosTests.test_rbcd_no_pac_options_ac                 C   s    |  ttjddddid d S )NTr   r   r   )ro   rp   r   r   r   )r   r   r   r   r    r$   r$   r%   test_rbcd_no_pac_options_b  s    z+S4UKerberosTests.test_rbcd_no_pac_options_bc              
   C   s,   |  ttfddtj| jddddd d S )NTrq   Fr   update_pac_checksums)ro   r   r   r   rr   )r   r   r   r   r   r   r    r$   r$   r%   3test_bronze_bit_constrained_delegation_old_checksum  s    zDS4UKerberosTests.test_bronze_bit_constrained_delegation_old_checksumc                 C   s,   |  ttjdddtj| jdddd d S )NTr   rq   Fr   )ro   rp   r   r   r   r   )r   r   r   r   r   r   r   r    r$   r$   r%   !test_bronze_bit_rbcd_old_checksum  s    z2S4UKerberosTests.test_bronze_bit_rbcd_old_checksumc              
   C   st   | j D ]h}| j|dH |tjkr,ttf}nt}| |dtj	| j
|ddd W d    q1 sd0    Y  qd S NchecksumTFr   )pac_checksum_typessubTestr   PAC_TYPE_TICKET_CHECKSUMr   r   r   r   r   r   remove_pac_checksumr!   r   ro   r$   r$   r%   3test_constrained_delegation_missing_client_checksum  s     

zDS4UKerberosTests.test_constrained_delegation_missing_client_checksumc                 C   sh   t dd | jD ]R}| j|d2 | ttjdtj| j	|dd W d    q1 sX0    Y  qd S )Nc                 S   s
   | t jkS r   r   r   xr$   r$   r%   <lambda>      zWS4UKerberosTests.test_constrained_delegation_missing_service_checksum.<locals>.<lambda>r   Tro   rp   r   ri   
filterr   r   r   r   r    NT_STATUS_INSUFFICIENT_RESOURCESr   r   r   r!   r   r$   r$   r%   4test_constrained_delegation_missing_service_checksum  s    zES4UKerberosTests.test_constrained_delegation_missing_service_checksumc                 C   st   | j D ]h}| j|dH |tjkr(t}nt}| |tjddt	j
| j|dd W d    q1 sd0    Y  qd S Nr   Tr   r   )r   r   r   r   r   r   r   r   r   r   r   r   r   r$   r$   r%   !test_rbcd_missing_client_checksum  s    

z2S4UKerberosTests.test_rbcd_missing_client_checksumc                 C   sj   t dd | jD ]T}| j|d4 | ttjddtj| j	|dd W d    q1 sZ0    Y  qd S )Nc                 S   s
   | t jkS r   r   r   r$   r$   r%   r  &  r  zES4UKerberosTests.test_rbcd_missing_service_checksum.<locals>.<lambda>r   Tr   ro   rp   r   r   ri   r  r  r$   r$   r%   "test_rbcd_missing_service_checksum$  s    z3S4UKerberosTests.test_rbcd_missing_service_checksumc              
   C   s`   | j D ]T}| j|d4 | ttfdtj| j|ddd W d    q1 sP0    Y  qd S r   )r   r   r   r   r   r   r   zeroed_pac_checksumr  r$   r$   r%   2test_constrained_delegation_zeroed_client_checksum4  s    
zCS4UKerberosTests.test_constrained_delegation_zeroed_client_checksumc                 C   s~   | j D ]r}| j|dR |tjkr2ttf}tj}nd}d }| ||dt	j
| j|dd W d    q1 sn0    Y  qd S )Nr   r   Tr  )r   r   r   PAC_TYPE_SRV_CHECKSUMr   r   r   NT_STATUS_WRONG_PASSWORDr   r   r   r  r!   r   ro   rp   r$   r$   r%   3test_constrained_delegation_zeroed_service_checksumB  s$    

zDS4UKerberosTests.test_constrained_delegation_zeroed_service_checksumc                 C   s`   | j D ]T}| j|d4 | ttjddtj| j|dd W d    q1 sP0    Y  qd S r	  )	r   r   r   r   r   r   r   r   r  r  r$   r$   r%    test_rbcd_zeroed_client_checksumW  s    
z1S4UKerberosTests.test_rbcd_zeroed_client_checksumc                 C   s|   | j D ]p}| j|dP |tjkr.t}tj}nd}d }| ||ddtj	| j
|dd W d    q1 sl0    Y  qd S )Nr   r   Tr   r  )r   r   r   r  r   r   r  r   r   r   r  r  r$   r$   r%   !test_rbcd_zeroed_service_checksumf  s"    

z2S4UKerberosTests.test_rbcd_zeroed_service_checksumc                 C   s   | j D ]}| jD ]z}| j||dX |tjkrB|tjkrBttf}nt	tf}| 
|dtj| j||ddd W d    q1 s0    Y  qqd S )Nr   rC   TFr   )r   unkeyed_ctypesr   r   r  r   rb   r   r   r   r   r   r   unkeyed_pac_checksumr!   r   rC   ro   r$   r$   r%   3test_constrained_delegation_unkeyed_client_checksum}  s,    


zDS4UKerberosTests.test_constrained_delegation_unkeyed_client_checksumc                 C   s   | j D ]}| jD ]}| j||dn |tjkrX|tjkrHttf}t	j
}q`ttf}t	j}nd}d }| ||dtj| j||dd W d    q1 s0    Y  qqd S )Nr  r   Tr  )r   r  r   r   r  r   rb   r   r   r   NT_STATUS_LOGON_FAILUREr   r  r   r   r   r  r!   r   rC   ro   rp   r$   r$   r%   4test_constrained_delegation_unkeyed_service_checksum  s4    



zES4UKerberosTests.test_constrained_delegation_unkeyed_service_checksumc                 C   s   | j D ]}| jD ]v}| j||dT |tjkr>|tjkr>t}nt}| 	|t
jddtj| j||dd W d    q1 s|0    Y  qqd S )Nr  Tr   r   )r   r  r   r   r  r   rb   r   r   r   r   r   r   r   r  r  r$   r$   r%   !test_rbcd_unkeyed_client_checksum  s&    


z2S4UKerberosTests.test_rbcd_unkeyed_client_checksumc                 C   s   | j D ]}| jD ]}| j||dh |tjkrP|tjkrDt}tj	}qXt
}tj}nd}d }| ||ddtj| j||dd W d    q1 s0    Y  qqd S )Nr  r   Tr   r  )r   r  r   r   r  r   rb   r   r   r  r   r  r   r   r   r  r  r$   r$   r%   "test_rbcd_unkeyed_service_checksum  s.    



z3S4UKerberosTests.test_rbcd_unkeyed_service_checksumc                 C   s   |   }| j|||didS )NFchecksum_keysZinclude_checksumsget_krbtgt_checksum_keymodified_ticket)r!   r?   r   r   r$   r$   r%   r     s
    z$S4UKerberosTests.remove_pac_checksumc                 C   sh   |   }| |}|j}tj|tj|tj|i}|tjkr>|}n|}t|j|j	||< | j
|||didS NTr  )get_krbtgt_credsr   decryption_keyr   r  PAC_TYPE_KDC_CHECKSUMr   r   r@   kvnor#  )r!   r?   r   krbtgt_creds
krbtgt_key
server_keyr   Z
zeroed_keyr$   r$   r%   r    s"    

z$S4UKerberosTests.zeroed_pac_checksumc           
      C   sf   |   }| |}|j}tj|tj|tj|i}|| }t|j|j	}	||	_
|	||< | j|||didS r$  )r%  r   r&  r   r  r'  r   r
   r@   r(  rC   r#  )
r!   r?   r   rC   r)  r*  r+  r   r@   Znew_keyr$   r$   r%   r    s    
z%S4UKerberosTests.unkeyed_pac_checksumc                    s&    fdd}   } j|||dS )Nc                    s   | j } tjdd |D  tttj}t }td|_	||_
t||_t }||_t }tj|_||_|| || _ |  jd7  _| S )Nc                 s   s   | ]}|j V  qd S r   )type).0bufferr$   r$   r%   	<genexpr>  r  zNS4UKerberosTests.add_delegation_info.<locals>.modify_pac_fn.<locals>.<genexpr>Ztest_proxy_targetr&   )Zbuffersr   r   ZPAC_TYPE_CONSTRAINED_DELEGATIONlistmapr   StringZPAC_CONSTRAINED_DELEGATIONZproxy_targettransited_serviceslenZnum_transited_servicesZPAC_CONSTRAINED_DELEGATION_CTRinfoZ
PAC_BUFFERr,  r   Znum_buffers)r   Zpac_buffersr3  Z
delegationr5  Z
pac_bufferr   r$   r%   modify_pac_fn  s$    

z;S4UKerberosTests.add_delegation_info.<locals>.modify_pac_fn)r   r6  r!  )r!   r?   r   r6  r   r$   r   r%   r     s    z$S4UKerberosTests.add_delegation_infoTc                 C   s6   t j| jd|d}|r |  }nd }| j||||dS )Nr+   )r   value)	modify_fnr   r   )r   r   Zmodify_ticket_flagr"  r#  )r!   r?   r   r   r8  r   r$   r$   r%   r   :  s    
z'S4UKerberosTests.set_ticket_forwardablec                 C   s   | j |ddS )NT)Zexclude_pac)r#  )r!   r?   r$   r$   r%   r   I  s    z"S4UKerberosTests.remove_ticket_pac)N)N)T)G__name__
__module____qualname__r   rZ   r\   r^   ra   rc   re   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r
  r  r  r  r  r  r   r`   rb   rd   r  r  r  r  r  r   r  r  r   r   r   __classcell__r$   r$   r"   r%   r   :   s   
 
t #


!
r   __main__)/sysosr   pathinsertenvironZsambar   Zsamba.dcerpcr   r   Zsamba.testsr   Zsamba.tests.krb5.kcryptor   r   Zsamba.tests.krb5.kdc_base_testr	   Zsamba.tests.krb5.raw_testcaser
   r   Z"samba.tests.krb5.rfc4120_constantsr   r   r   r   r   r   r   r   r   r   r   r   r   r   Zsamba.tests.krb5.rfc4120_pyasn1ZtestsZkrb5Zrfc4120_pyasn1rL   r   r   r   r9  Zunittestmainr$   r$   r$   r%   <module>   s<   
@          
