The Samba-Bugzilla – Attachment 16882 Details for
Bug 14881
Backport bronze bit fixes, tests, and selftest improvements
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
patch backported to 4.12 (only)
bronze-bit-for-samba-4.12.patch (text/plain), 2.54 MB, created by
Andrew Bartlett
on 2021-10-27 23:52:06 UTC
(
hide
)
Description:
patch backported to 4.12 (only)
Filename:
MIME Type:
Creator:
Andrew Bartlett
Created:
2021-10-27 23:52:06 UTC
Size:
2.54 MB
patch
obsolete
>From f462037f85c3f4cd2aaad538c635259c017ed7f9 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Wed, 27 Oct 2021 14:24:50 +1300 >Subject: [PATCH 001/380] Revert "bootstrap: Cope with case changes in CentOS 8 > repo names" > >This reverts commit 9b5dd480590fb4693547e9a1e27452058c0f5da8. > >[abartlet@samba.org Reverted to allow subsequent patches to apply > cleanly] >--- > .gitlab-ci.yml | 2 +- > bootstrap/config.py | 3 +-- > bootstrap/generated-dists/centos8/bootstrap.sh | 3 +-- > bootstrap/sha1sum.txt | 2 +- > 4 files changed, 4 insertions(+), 6 deletions(-) > >diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml >index c706dac66bd..56adf10c7be 100644 >--- a/.gitlab-ci.yml >+++ b/.gitlab-ci.yml >@@ -22,7 +22,7 @@ variables: > # Set this to the contents of bootstrap/sha1sum.txt > # which is generated by bootstrap/template.py --render > # >- SAMBA_CI_CONTAINER_TAG: 8bec130a6b741608616302662edee02fd39f3baf >+ SAMBA_CI_CONTAINER_TAG: 41319f2580c026f66b2750604a0eb15d6b6f7b50 > # > # We use the ubuntu1804 image as default as > # it matches what we have on sn-devel-184. >diff --git a/bootstrap/config.py b/bootstrap/config.py >index 5ead9f74501..bcada1dc628 100644 >--- a/bootstrap/config.py >+++ b/bootstrap/config.py >@@ -226,8 +226,7 @@ set -xueo pipefail > yum update -y > yum install -y dnf-plugins-core > yum install -y epel-release >-yum config-manager --set-enabled PowerTools -y || \ >- yum config-manager --set-enabled powertools -y >+yum config-manager --set-enabled PowerTools -y > yum update -y > > yum install -y \ >diff --git a/bootstrap/generated-dists/centos8/bootstrap.sh b/bootstrap/generated-dists/centos8/bootstrap.sh >index e6fab86e446..22484b3f6ad 100755 >--- a/bootstrap/generated-dists/centos8/bootstrap.sh >+++ b/bootstrap/generated-dists/centos8/bootstrap.sh >@@ -10,8 +10,7 @@ set -xueo pipefail > yum update -y > yum install -y dnf-plugins-core > yum install -y epel-release >-yum config-manager --set-enabled PowerTools -y || \ >- yum config-manager --set-enabled powertools -y >+yum config-manager --set-enabled PowerTools -y > yum update -y > > yum install -y \ >diff --git a/bootstrap/sha1sum.txt b/bootstrap/sha1sum.txt >index 5328cff1cd3..62c2245564e 100644 >--- a/bootstrap/sha1sum.txt >+++ b/bootstrap/sha1sum.txt >@@ -1 +1 @@ >-8bec130a6b741608616302662edee02fd39f3baf >+41319f2580c026f66b2750604a0eb15d6b6f7b50 >-- >2.25.1 > > >From 7f39b48fb55b62e920b87acaf77e5948c55f0c61 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Wed, 4 Mar 2020 13:58:48 +1300 >Subject: [PATCH 002/380] bootstrap: Remove long-unsupported OS versions > >Samba has not built on these versions for quite some time due to >the need for Python 3.5 and GnuTLS 3.4.7 > >These were always marked as broken, but given the requirements >these are never likely to come back. > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >(cherry picked from commit d048d7e17d756099e208fa4d6b931a147b0b1489) >--- > .gitlab-ci.yml | 2 +- > bootstrap/.gitlab-ci.yml | 12 -- > bootstrap/config.py | 64 ---------- > bootstrap/generated-dists/Vagrantfile | 28 ----- > bootstrap/generated-dists/centos6/Dockerfile | 27 ----- > .../generated-dists/centos6/bootstrap.sh | 109 ------------------ > bootstrap/generated-dists/centos6/locale.sh | 55 --------- > .../generated-dists/centos6/packages.yml | 89 -------------- > bootstrap/generated-dists/debian7/Dockerfile | 27 ----- > .../generated-dists/debian7/bootstrap.sh | 101 ---------------- > bootstrap/generated-dists/debian7/locale.sh | 55 --------- > .../generated-dists/debian7/packages.yml | 86 -------------- > bootstrap/generated-dists/debian8/Dockerfile | 27 ----- > .../generated-dists/debian8/bootstrap.sh | 105 ----------------- > bootstrap/generated-dists/debian8/locale.sh | 55 --------- > .../generated-dists/debian8/packages.yml | 90 --------------- > .../generated-dists/ubuntu1404/Dockerfile | 27 ----- > .../generated-dists/ubuntu1404/bootstrap.sh | 103 ----------------- > .../generated-dists/ubuntu1404/locale.sh | 55 --------- > .../generated-dists/ubuntu1404/packages.yml | 88 -------------- > bootstrap/sha1sum.txt | 2 +- > 21 files changed, 2 insertions(+), 1205 deletions(-) > delete mode 100644 bootstrap/generated-dists/centos6/Dockerfile > delete mode 100755 bootstrap/generated-dists/centos6/bootstrap.sh > delete mode 100755 bootstrap/generated-dists/centos6/locale.sh > delete mode 100644 bootstrap/generated-dists/centos6/packages.yml > delete mode 100644 bootstrap/generated-dists/debian7/Dockerfile > delete mode 100755 bootstrap/generated-dists/debian7/bootstrap.sh > delete mode 100755 bootstrap/generated-dists/debian7/locale.sh > delete mode 100644 bootstrap/generated-dists/debian7/packages.yml > delete mode 100644 bootstrap/generated-dists/debian8/Dockerfile > delete mode 100755 bootstrap/generated-dists/debian8/bootstrap.sh > delete mode 100755 bootstrap/generated-dists/debian8/locale.sh > delete mode 100644 bootstrap/generated-dists/debian8/packages.yml > delete mode 100644 bootstrap/generated-dists/ubuntu1404/Dockerfile > delete mode 100755 bootstrap/generated-dists/ubuntu1404/bootstrap.sh > delete mode 100755 bootstrap/generated-dists/ubuntu1404/locale.sh > delete mode 100644 bootstrap/generated-dists/ubuntu1404/packages.yml > >diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml >index 56adf10c7be..00ffff202d9 100644 >--- a/.gitlab-ci.yml >+++ b/.gitlab-ci.yml >@@ -22,7 +22,7 @@ variables: > # Set this to the contents of bootstrap/sha1sum.txt > # which is generated by bootstrap/template.py --render > # >- SAMBA_CI_CONTAINER_TAG: 41319f2580c026f66b2750604a0eb15d6b6f7b50 >+ SAMBA_CI_CONTAINER_TAG: cd4cebb9c611fb98f3a21171dd4832df930add28 > # > # We use the ubuntu1804 image as default as > # it matches what we have on sn-devel-184. >diff --git a/bootstrap/.gitlab-ci.yml b/bootstrap/.gitlab-ci.yml >index aa0b6448d74..cbf1cb9b58a 100644 >--- a/bootstrap/.gitlab-ci.yml >+++ b/bootstrap/.gitlab-ci.yml >@@ -89,21 +89,12 @@ ubuntu1804: > ubuntu1604: > extends: .build_image_template > >-ubuntu1404: >- extends: .build_image_template_force_broken >- > debian10: > extends: .build_image_template > > debian9: > extends: .build_image_template > >-debian8: >- extends: .build_image_template_force_broken >- >-debian7: >- extends: .build_image_template_force_broken >- > fedora31: > extends: .build_image_template > >@@ -124,9 +115,6 @@ centos7: > # We install a compat-gnutls34 package for GnuTLS >= 3.4.7 > PKG_CONFIG_PATH: /usr/lib64/compat-gnutls34/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig > >-centos6: >- extends: .build_image_template_force_broken >- > opensuse150: > extends: .build_image_template > >diff --git a/bootstrap/config.py b/bootstrap/config.py >index bcada1dc628..552524ae759 100644 >--- a/bootstrap/config.py >+++ b/bootstrap/config.py >@@ -374,30 +374,6 @@ end > > > DEB_DISTS = { >- 'debian7': { >- 'docker_image': 'debian:7', >- 'vagrant_box': 'debian/wheezy64', >- 'replace': { >- 'libgnutls28-dev': 'libgnutls-dev', >- 'libsystemd-dev': '', # not available, remove >- 'lmdb-utils': '', # not available, remove >- 'liblmdb-dev': '', # not available, remove >- 'python-gpg': 'python-gpgme', >- 'python3-gpg': '', # no python3 gpg pkg available, remove >- 'language-pack-en': '', # included in locales >- 'liburing-dev': '', # not available >- } >- }, >- 'debian8': { >- 'docker_image': 'debian:8', >- 'vagrant_box': 'debian/jessie64', >- 'replace': { >- 'python-gpg': 'python-gpgme', >- 'python3-gpg': 'python3-gpgme', >- 'language-pack-en': '', # included in locales >- 'liburing-dev': '', # not available >- } >- }, > 'debian9': { > 'docker_image': 'debian:9', > 'vagrant_box': 'debian/stretch64', >@@ -414,22 +390,6 @@ DEB_DISTS = { > 'liburing-dev': '', # not available > } > }, >- 'ubuntu1404': { >- 'docker_image': 'ubuntu:14.04', >- 'vagrant_box': 'ubuntu/trusty64', >- 'replace': { >- 'libsystemd-dev': '', # remove >- 'libgnutls28-dev': 'libgnutls-dev', >- 'python-gpg': 'python-gpgme', >- 'python3-gpg': 'python3-gpgme', >- 'lmdb-utils': 'lmdb-utils/trusty-backports', >- 'liblmdb-dev': 'liblmdb-dev/trusty-backports', >- 'libunwind-dev': 'libunwind8-dev', >- 'glusterfs-common': '', >- 'libcephfs-dev': '', >- 'liburing-dev': '', # not available >- } >- }, > 'ubuntu1604': { > 'docker_image': 'ubuntu:16.04', > 'vagrant_box': 'ubuntu/xenial64', >@@ -452,30 +412,6 @@ DEB_DISTS = { > > > RPM_DISTS = { >- 'centos6': { >- 'docker_image': 'centos:6', >- 'vagrant_box': 'centos/6', >- 'bootstrap': YUM_BOOTSTRAP, >- 'replace': { >- 'lsb-release': 'redhat-lsb', >- 'python3': 'python36', >- 'python3-devel': 'python36-devel', >- 'python2-gpg': 'pygpgme', >- 'python3-gpg': '', # no python3-gpg yet >- '@development-tools': '"@Development Tools"', # add quotes >- 'glibc-langpack-en': '', # included in glibc-common >- 'glibc-locale-source': '', # included in glibc-common >- 'procps-ng': 'procps', # centos6 still use old name >- # update perl core modules on centos >- # fix: Can't locate Archive/Tar.pm in @INC >- 'perl': 'perl-core', >- 'rpcsvc-proto-devel': '', >- 'glusterfs-api-devel': '', >- 'glusterfs-devel': '', >- 'libcephfs-devel': '', >- 'liburing-devel': '', # not available >- } >- }, > 'centos7': { > 'docker_image': 'centos:7', > 'vagrant_box': 'centos/7', >diff --git a/bootstrap/generated-dists/Vagrantfile b/bootstrap/generated-dists/Vagrantfile >index b3cb6bea485..983e66aa57f 100644 >--- a/bootstrap/generated-dists/Vagrantfile >+++ b/bootstrap/generated-dists/Vagrantfile >@@ -10,13 +10,6 @@ Vagrant.configure("2") do |config| > config.ssh.insert_key = false > > >- config.vm.define "centos6" do |v| >- v.vm.box = "centos/6" >- v.vm.hostname = "centos6" >- v.vm.provision :shell, path: "centos6/bootstrap.sh" >- v.vm.provision :shell, path: "centos6/locale.sh" >- end >- > config.vm.define "centos7" do |v| > v.vm.box = "centos/7" > v.vm.hostname = "centos7" >@@ -38,20 +31,6 @@ Vagrant.configure("2") do |config| > v.vm.provision :shell, path: "debian10/locale.sh" > end > >- config.vm.define "debian7" do |v| >- v.vm.box = "debian/wheezy64" >- v.vm.hostname = "debian7" >- v.vm.provision :shell, path: "debian7/bootstrap.sh" >- v.vm.provision :shell, path: "debian7/locale.sh" >- end >- >- config.vm.define "debian8" do |v| >- v.vm.box = "debian/jessie64" >- v.vm.hostname = "debian8" >- v.vm.provision :shell, path: "debian8/bootstrap.sh" >- v.vm.provision :shell, path: "debian8/locale.sh" >- end >- > config.vm.define "debian9" do |v| > v.vm.box = "debian/stretch64" > v.vm.hostname = "debian9" >@@ -94,13 +73,6 @@ Vagrant.configure("2") do |config| > v.vm.provision :shell, path: "opensuse151/locale.sh" > end > >- config.vm.define "ubuntu1404" do |v| >- v.vm.box = "ubuntu/trusty64" >- v.vm.hostname = "ubuntu1404" >- v.vm.provision :shell, path: "ubuntu1404/bootstrap.sh" >- v.vm.provision :shell, path: "ubuntu1404/locale.sh" >- end >- > config.vm.define "ubuntu1604" do |v| > v.vm.box = "ubuntu/xenial64" > v.vm.hostname = "ubuntu1604" >diff --git a/bootstrap/generated-dists/centos6/Dockerfile b/bootstrap/generated-dists/centos6/Dockerfile >deleted file mode 100644 >index 2716eebdd35..00000000000 >--- a/bootstrap/generated-dists/centos6/Dockerfile >+++ /dev/null >@@ -1,27 +0,0 @@ >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-FROM centos:6 >- >-# pass in with --build-arg while build >-ARG SHA1SUM >-RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt >- >-ADD *.sh /tmp/ >-# need root permission, do it before USER samba >-RUN /tmp/bootstrap.sh && /tmp/locale.sh >- >-# if ld.gold exists, force link it to ld >-RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD" >- >-# make test can not work with root, so we have to create a new user >-RUN useradd -m -U -s /bin/bash samba && \ >- mkdir -p /etc/sudoers.d && \ >- echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba >- >-USER samba >-WORKDIR /home/samba >-# samba tests rely on this >-ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8 >\ No newline at end of file >diff --git a/bootstrap/generated-dists/centos6/bootstrap.sh b/bootstrap/generated-dists/centos6/bootstrap.sh >deleted file mode 100755 >index ee6fcc33799..00000000000 >--- a/bootstrap/generated-dists/centos6/bootstrap.sh >+++ /dev/null >@@ -1,109 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-yum update -y >-yum install -y epel-release >-yum install -y yum-plugin-copr >-yum copr enable -y sergiomb/SambaAD >-yum update -y >- >-yum install -y \ >- "@Development Tools" \ >- acl \ >- attr \ >- autoconf \ >- avahi-devel \ >- bind-utils \ >- binutils \ >- bison \ >- chrpath \ >- cups-devel \ >- curl \ >- dbus-devel \ >- docbook-dtds \ >- docbook-style-xsl \ >- flex \ >- gawk \ >- gcc \ >- gdb \ >- git \ >- glib2-devel \ >- glibc-common \ >- gnutls-devel \ >- gpgme-devel \ >- gzip \ >- hostname \ >- htop \ >- jansson-devel \ >- keyutils-libs-devel \ >- krb5-devel \ >- krb5-server \ >- lcov \ >- libacl-devel \ >- libarchive-devel \ >- libattr-devel \ >- libblkid-devel \ >- libbsd-devel \ >- libcap-devel \ >- libicu-devel \ >- libnsl2-devel \ >- libpcap-devel \ >- libsemanage-python \ >- libtasn1-devel \ >- libtasn1-tools \ >- libtirpc-devel \ >- libunwind-devel \ >- libuuid-devel \ >- libxslt \ >- lmdb \ >- lmdb-devel \ >- make \ >- mingw64-gcc \ >- ncurses-devel \ >- openldap-devel \ >- pam-devel \ >- patch \ >- perl-Archive-Tar \ >- perl-ExtUtils-MakeMaker \ >- perl-JSON-Parse \ >- perl-Parse-Yapp \ >- perl-Test-Base \ >- perl-core \ >- perl-generators \ >- perl-interpreter \ >- pkgconfig \ >- policycoreutils-python \ >- popt-devel \ >- procps \ >- psmisc \ >- python3-dns \ >- python3-markdown \ >- python36 \ >- python36-devel \ >- quota-devel \ >- readline-devel \ >- redhat-lsb \ >- rng-tools \ >- rpcgen \ >- rsync \ >- sed \ >- sudo \ >- systemd-devel \ >- tar \ >- tree \ >- which \ >- xfsprogs-devel \ >- yum-utils \ >- zlib-devel >- >-yum clean all >- >-if [ ! -f /usr/bin/python3 ]; then >- ln -sf /usr/bin/python3.6 /usr/bin/python3 >-fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/centos6/locale.sh b/bootstrap/generated-dists/centos6/locale.sh >deleted file mode 100755 >index cc64e180483..00000000000 >--- a/bootstrap/generated-dists/centos6/locale.sh >+++ /dev/null >@@ -1,55 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-# refer to /usr/share/i18n/locales >-INPUTFILE=en_US >-# refer to /usr/share/i18n/charmaps >-CHARMAP=UTF-8 >-# locale to generate in /usr/lib/locale >-# glibc/localedef will normalize UTF-8 to utf8, follow the naming style >-LOCALE=$INPUTFILE.utf8 >- >-# if locale is already correct, exit >-( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0 >- >-# if locale not available, generate locale into /usr/lib/locale >-if ! ( locale --all-locales | grep -i $LOCALE ) >-then >- # no-archive means create its own dir >- localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE >-fi >- >-# update locale conf and global env file >-# set both LC_ALL and LANG for safe >- >-# update conf for Debian family >-FILE=/etc/default/locale >-if [ -f $FILE ] >-then >- echo LC_ALL="$LOCALE" > $FILE >- echo LANG="$LOCALE" >> $FILE >-fi >- >-# update conf for RedHat family >-FILE=/etc/locale.conf >-if [ -f $FILE ] >-then >- # LC_ALL is not valid in this file, set LANG only >- echo LANG="$LOCALE" > $FILE >-fi >- >-# update global env file >-FILE=/etc/environment >-if [ -f $FILE ] >-then >- # append LC_ALL if not exist >- grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE >- # append LANG if not exist >- grep LANG $FILE || echo LANG="$LOCALE" >> $FILE >-fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/centos6/packages.yml b/bootstrap/generated-dists/centos6/packages.yml >deleted file mode 100644 >index 1e2b5a98fa6..00000000000 >--- a/bootstrap/generated-dists/centos6/packages.yml >+++ /dev/null >@@ -1,89 +0,0 @@ >---- >-packages: >- - "@Development Tools" >- - acl >- - attr >- - autoconf >- - avahi-devel >- - bind-utils >- - binutils >- - bison >- - chrpath >- - cups-devel >- - curl >- - dbus-devel >- - docbook-dtds >- - docbook-style-xsl >- - flex >- - gawk >- - gcc >- - gdb >- - git >- - glib2-devel >- - glibc-common >- - gnutls-devel >- - gpgme-devel >- - gzip >- - hostname >- - htop >- - jansson-devel >- - keyutils-libs-devel >- - krb5-devel >- - krb5-server >- - lcov >- - libacl-devel >- - libarchive-devel >- - libattr-devel >- - libblkid-devel >- - libbsd-devel >- - libcap-devel >- - libicu-devel >- - libnsl2-devel >- - libpcap-devel >- - libsemanage-python >- - libtasn1-devel >- - libtasn1-tools >- - libtirpc-devel >- - libunwind-devel >- - libuuid-devel >- - libxslt >- - lmdb >- - lmdb-devel >- - make >- - mingw64-gcc >- - ncurses-devel >- - openldap-devel >- - pam-devel >- - patch >- - perl-Archive-Tar >- - perl-ExtUtils-MakeMaker >- - perl-JSON-Parse >- - perl-Parse-Yapp >- - perl-Test-Base >- - perl-core >- - perl-generators >- - perl-interpreter >- - pkgconfig >- - policycoreutils-python >- - popt-devel >- - procps >- - psmisc >- - python3-dns >- - python3-markdown >- - python36 >- - python36-devel >- - quota-devel >- - readline-devel >- - redhat-lsb >- - rng-tools >- - rpcgen >- - rsync >- - sed >- - sudo >- - systemd-devel >- - tar >- - tree >- - which >- - xfsprogs-devel >- - yum-utils >- - zlib-devel >\ No newline at end of file >diff --git a/bootstrap/generated-dists/debian7/Dockerfile b/bootstrap/generated-dists/debian7/Dockerfile >deleted file mode 100644 >index dfe0e389653..00000000000 >--- a/bootstrap/generated-dists/debian7/Dockerfile >+++ /dev/null >@@ -1,27 +0,0 @@ >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-FROM debian:7 >- >-# pass in with --build-arg while build >-ARG SHA1SUM >-RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt >- >-ADD *.sh /tmp/ >-# need root permission, do it before USER samba >-RUN /tmp/bootstrap.sh && /tmp/locale.sh >- >-# if ld.gold exists, force link it to ld >-RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD" >- >-# make test can not work with root, so we have to create a new user >-RUN useradd -m -U -s /bin/bash samba && \ >- mkdir -p /etc/sudoers.d && \ >- echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba >- >-USER samba >-WORKDIR /home/samba >-# samba tests rely on this >-ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8 >\ No newline at end of file >diff --git a/bootstrap/generated-dists/debian7/bootstrap.sh b/bootstrap/generated-dists/debian7/bootstrap.sh >deleted file mode 100755 >index daedce84fd9..00000000000 >--- a/bootstrap/generated-dists/debian7/bootstrap.sh >+++ /dev/null >@@ -1,101 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-export DEBIAN_FRONTEND=noninteractive >-apt-get -y update >- >-apt-get -y install \ >- acl \ >- apt-utils \ >- attr \ >- autoconf \ >- bind9utils \ >- binutils \ >- bison \ >- build-essential \ >- chrpath \ >- curl \ >- debhelper \ >- dnsutils \ >- docbook-xml \ >- docbook-xsl \ >- flex \ >- gcc \ >- gdb \ >- git \ >- glusterfs-common \ >- gzip \ >- heimdal-multidev \ >- hostname \ >- htop \ >- krb5-config \ >- krb5-kdc \ >- krb5-user \ >- lcov \ >- libacl1-dev \ >- libarchive-dev \ >- libattr1-dev \ >- libavahi-common-dev \ >- libblkid-dev \ >- libbsd-dev \ >- libcap-dev \ >- libcephfs-dev \ >- libcups2-dev \ >- libdbus-1-dev \ >- libglib2.0-dev \ >- libgnutls-dev \ >- libgpgme11-dev \ >- libicu-dev \ >- libjansson-dev \ >- libjs-jquery \ >- libjson-perl \ >- libkrb5-dev \ >- libldap2-dev \ >- libncurses5-dev \ >- libpam0g-dev \ >- libparse-yapp-perl \ >- libpcap-dev \ >- libpopt-dev \ >- libreadline-dev \ >- libtasn1-bin \ >- libtasn1-dev \ >- libunwind-dev \ >- locales \ >- lsb-release \ >- make \ >- mawk \ >- mingw-w64 \ >- patch \ >- perl \ >- perl-modules \ >- pkg-config \ >- procps \ >- psmisc \ >- python3 \ >- python3-dbg \ >- python3-dev \ >- python3-dnspython \ >- python3-iso8601 \ >- python3-markdown \ >- python3-matplotlib \ >- python3-pexpect \ >- rng-tools \ >- rsync \ >- sed \ >- sudo \ >- tar \ >- tree \ >- uuid-dev \ >- xfslibs-dev \ >- xsltproc \ >- zlib1g-dev >- >-apt-get -y autoremove >-apt-get -y autoclean >-apt-get -y clean >\ No newline at end of file >diff --git a/bootstrap/generated-dists/debian7/locale.sh b/bootstrap/generated-dists/debian7/locale.sh >deleted file mode 100755 >index cc64e180483..00000000000 >--- a/bootstrap/generated-dists/debian7/locale.sh >+++ /dev/null >@@ -1,55 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-# refer to /usr/share/i18n/locales >-INPUTFILE=en_US >-# refer to /usr/share/i18n/charmaps >-CHARMAP=UTF-8 >-# locale to generate in /usr/lib/locale >-# glibc/localedef will normalize UTF-8 to utf8, follow the naming style >-LOCALE=$INPUTFILE.utf8 >- >-# if locale is already correct, exit >-( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0 >- >-# if locale not available, generate locale into /usr/lib/locale >-if ! ( locale --all-locales | grep -i $LOCALE ) >-then >- # no-archive means create its own dir >- localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE >-fi >- >-# update locale conf and global env file >-# set both LC_ALL and LANG for safe >- >-# update conf for Debian family >-FILE=/etc/default/locale >-if [ -f $FILE ] >-then >- echo LC_ALL="$LOCALE" > $FILE >- echo LANG="$LOCALE" >> $FILE >-fi >- >-# update conf for RedHat family >-FILE=/etc/locale.conf >-if [ -f $FILE ] >-then >- # LC_ALL is not valid in this file, set LANG only >- echo LANG="$LOCALE" > $FILE >-fi >- >-# update global env file >-FILE=/etc/environment >-if [ -f $FILE ] >-then >- # append LC_ALL if not exist >- grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE >- # append LANG if not exist >- grep LANG $FILE || echo LANG="$LOCALE" >> $FILE >-fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/debian7/packages.yml b/bootstrap/generated-dists/debian7/packages.yml >deleted file mode 100644 >index 3cac6870b3e..00000000000 >--- a/bootstrap/generated-dists/debian7/packages.yml >+++ /dev/null >@@ -1,86 +0,0 @@ >---- >-packages: >- - acl >- - apt-utils >- - attr >- - autoconf >- - bind9utils >- - binutils >- - bison >- - build-essential >- - chrpath >- - curl >- - debhelper >- - dnsutils >- - docbook-xml >- - docbook-xsl >- - flex >- - gcc >- - gdb >- - git >- - glusterfs-common >- - gzip >- - heimdal-multidev >- - hostname >- - htop >- - krb5-config >- - krb5-kdc >- - krb5-user >- - lcov >- - libacl1-dev >- - libarchive-dev >- - libattr1-dev >- - libavahi-common-dev >- - libblkid-dev >- - libbsd-dev >- - libcap-dev >- - libcephfs-dev >- - libcups2-dev >- - libdbus-1-dev >- - libglib2.0-dev >- - libgnutls-dev >- - libgpgme11-dev >- - libicu-dev >- - libjansson-dev >- - libjs-jquery >- - libjson-perl >- - libkrb5-dev >- - libldap2-dev >- - libncurses5-dev >- - libpam0g-dev >- - libparse-yapp-perl >- - libpcap-dev >- - libpopt-dev >- - libreadline-dev >- - libtasn1-bin >- - libtasn1-dev >- - libunwind-dev >- - locales >- - lsb-release >- - make >- - mawk >- - mingw-w64 >- - patch >- - perl >- - perl-modules >- - pkg-config >- - procps >- - psmisc >- - python3 >- - python3-dbg >- - python3-dev >- - python3-dnspython >- - python3-iso8601 >- - python3-markdown >- - python3-matplotlib >- - python3-pexpect >- - rng-tools >- - rsync >- - sed >- - sudo >- - tar >- - tree >- - uuid-dev >- - xfslibs-dev >- - xsltproc >- - zlib1g-dev >\ No newline at end of file >diff --git a/bootstrap/generated-dists/debian8/Dockerfile b/bootstrap/generated-dists/debian8/Dockerfile >deleted file mode 100644 >index a5a35654c22..00000000000 >--- a/bootstrap/generated-dists/debian8/Dockerfile >+++ /dev/null >@@ -1,27 +0,0 @@ >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-FROM debian:8 >- >-# pass in with --build-arg while build >-ARG SHA1SUM >-RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt >- >-ADD *.sh /tmp/ >-# need root permission, do it before USER samba >-RUN /tmp/bootstrap.sh && /tmp/locale.sh >- >-# if ld.gold exists, force link it to ld >-RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD" >- >-# make test can not work with root, so we have to create a new user >-RUN useradd -m -U -s /bin/bash samba && \ >- mkdir -p /etc/sudoers.d && \ >- echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba >- >-USER samba >-WORKDIR /home/samba >-# samba tests rely on this >-ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8 >\ No newline at end of file >diff --git a/bootstrap/generated-dists/debian8/bootstrap.sh b/bootstrap/generated-dists/debian8/bootstrap.sh >deleted file mode 100755 >index 010508360ed..00000000000 >--- a/bootstrap/generated-dists/debian8/bootstrap.sh >+++ /dev/null >@@ -1,105 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-export DEBIAN_FRONTEND=noninteractive >-apt-get -y update >- >-apt-get -y install \ >- acl \ >- apt-utils \ >- attr \ >- autoconf \ >- bind9utils \ >- binutils \ >- bison \ >- build-essential \ >- chrpath \ >- curl \ >- debhelper \ >- dnsutils \ >- docbook-xml \ >- docbook-xsl \ >- flex \ >- gcc \ >- gdb \ >- git \ >- glusterfs-common \ >- gzip \ >- heimdal-multidev \ >- hostname \ >- htop \ >- krb5-config \ >- krb5-kdc \ >- krb5-user \ >- lcov \ >- libacl1-dev \ >- libarchive-dev \ >- libattr1-dev \ >- libavahi-common-dev \ >- libblkid-dev \ >- libbsd-dev \ >- libcap-dev \ >- libcephfs-dev \ >- libcups2-dev \ >- libdbus-1-dev \ >- libglib2.0-dev \ >- libgnutls28-dev \ >- libgpgme11-dev \ >- libicu-dev \ >- libjansson-dev \ >- libjs-jquery \ >- libjson-perl \ >- libkrb5-dev \ >- libldap2-dev \ >- liblmdb-dev \ >- libncurses5-dev \ >- libpam0g-dev \ >- libparse-yapp-perl \ >- libpcap-dev \ >- libpopt-dev \ >- libreadline-dev \ >- libsystemd-dev \ >- libtasn1-bin \ >- libtasn1-dev \ >- libunwind-dev \ >- lmdb-utils \ >- locales \ >- lsb-release \ >- make \ >- mawk \ >- mingw-w64 \ >- patch \ >- perl \ >- perl-modules \ >- pkg-config \ >- procps \ >- psmisc \ >- python3 \ >- python3-dbg \ >- python3-dev \ >- python3-dnspython \ >- python3-gpgme \ >- python3-iso8601 \ >- python3-markdown \ >- python3-matplotlib \ >- python3-pexpect \ >- rng-tools \ >- rsync \ >- sed \ >- sudo \ >- tar \ >- tree \ >- uuid-dev \ >- xfslibs-dev \ >- xsltproc \ >- zlib1g-dev >- >-apt-get -y autoremove >-apt-get -y autoclean >-apt-get -y clean >\ No newline at end of file >diff --git a/bootstrap/generated-dists/debian8/locale.sh b/bootstrap/generated-dists/debian8/locale.sh >deleted file mode 100755 >index cc64e180483..00000000000 >--- a/bootstrap/generated-dists/debian8/locale.sh >+++ /dev/null >@@ -1,55 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-# refer to /usr/share/i18n/locales >-INPUTFILE=en_US >-# refer to /usr/share/i18n/charmaps >-CHARMAP=UTF-8 >-# locale to generate in /usr/lib/locale >-# glibc/localedef will normalize UTF-8 to utf8, follow the naming style >-LOCALE=$INPUTFILE.utf8 >- >-# if locale is already correct, exit >-( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0 >- >-# if locale not available, generate locale into /usr/lib/locale >-if ! ( locale --all-locales | grep -i $LOCALE ) >-then >- # no-archive means create its own dir >- localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE >-fi >- >-# update locale conf and global env file >-# set both LC_ALL and LANG for safe >- >-# update conf for Debian family >-FILE=/etc/default/locale >-if [ -f $FILE ] >-then >- echo LC_ALL="$LOCALE" > $FILE >- echo LANG="$LOCALE" >> $FILE >-fi >- >-# update conf for RedHat family >-FILE=/etc/locale.conf >-if [ -f $FILE ] >-then >- # LC_ALL is not valid in this file, set LANG only >- echo LANG="$LOCALE" > $FILE >-fi >- >-# update global env file >-FILE=/etc/environment >-if [ -f $FILE ] >-then >- # append LC_ALL if not exist >- grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE >- # append LANG if not exist >- grep LANG $FILE || echo LANG="$LOCALE" >> $FILE >-fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/debian8/packages.yml b/bootstrap/generated-dists/debian8/packages.yml >deleted file mode 100644 >index 1c9552b85f3..00000000000 >--- a/bootstrap/generated-dists/debian8/packages.yml >+++ /dev/null >@@ -1,90 +0,0 @@ >---- >-packages: >- - acl >- - apt-utils >- - attr >- - autoconf >- - bind9utils >- - binutils >- - bison >- - build-essential >- - chrpath >- - curl >- - debhelper >- - dnsutils >- - docbook-xml >- - docbook-xsl >- - flex >- - gcc >- - gdb >- - git >- - glusterfs-common >- - gzip >- - heimdal-multidev >- - hostname >- - htop >- - krb5-config >- - krb5-kdc >- - krb5-user >- - lcov >- - libacl1-dev >- - libarchive-dev >- - libattr1-dev >- - libavahi-common-dev >- - libblkid-dev >- - libbsd-dev >- - libcap-dev >- - libcephfs-dev >- - libcups2-dev >- - libdbus-1-dev >- - libglib2.0-dev >- - libgnutls28-dev >- - libgpgme11-dev >- - libicu-dev >- - libjansson-dev >- - libjs-jquery >- - libjson-perl >- - libkrb5-dev >- - libldap2-dev >- - liblmdb-dev >- - libncurses5-dev >- - libpam0g-dev >- - libparse-yapp-perl >- - libpcap-dev >- - libpopt-dev >- - libreadline-dev >- - libsystemd-dev >- - libtasn1-bin >- - libtasn1-dev >- - libunwind-dev >- - lmdb-utils >- - locales >- - lsb-release >- - make >- - mawk >- - mingw-w64 >- - patch >- - perl >- - perl-modules >- - pkg-config >- - procps >- - psmisc >- - python3 >- - python3-dbg >- - python3-dev >- - python3-dnspython >- - python3-gpgme >- - python3-iso8601 >- - python3-markdown >- - python3-matplotlib >- - python3-pexpect >- - rng-tools >- - rsync >- - sed >- - sudo >- - tar >- - tree >- - uuid-dev >- - xfslibs-dev >- - xsltproc >- - zlib1g-dev >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu1404/Dockerfile b/bootstrap/generated-dists/ubuntu1404/Dockerfile >deleted file mode 100644 >index 4cbb2d3902c..00000000000 >--- a/bootstrap/generated-dists/ubuntu1404/Dockerfile >+++ /dev/null >@@ -1,27 +0,0 @@ >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-FROM ubuntu:14.04 >- >-# pass in with --build-arg while build >-ARG SHA1SUM >-RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt >- >-ADD *.sh /tmp/ >-# need root permission, do it before USER samba >-RUN /tmp/bootstrap.sh && /tmp/locale.sh >- >-# if ld.gold exists, force link it to ld >-RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD" >- >-# make test can not work with root, so we have to create a new user >-RUN useradd -m -U -s /bin/bash samba && \ >- mkdir -p /etc/sudoers.d && \ >- echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba >- >-USER samba >-WORKDIR /home/samba >-# samba tests rely on this >-ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8 >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu1404/bootstrap.sh b/bootstrap/generated-dists/ubuntu1404/bootstrap.sh >deleted file mode 100755 >index 78c8969ac69..00000000000 >--- a/bootstrap/generated-dists/ubuntu1404/bootstrap.sh >+++ /dev/null >@@ -1,103 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-export DEBIAN_FRONTEND=noninteractive >-apt-get -y update >- >-apt-get -y install \ >- acl \ >- apt-utils \ >- attr \ >- autoconf \ >- bind9utils \ >- binutils \ >- bison \ >- build-essential \ >- chrpath \ >- curl \ >- debhelper \ >- dnsutils \ >- docbook-xml \ >- docbook-xsl \ >- flex \ >- gcc \ >- gdb \ >- git \ >- gzip \ >- heimdal-multidev \ >- hostname \ >- htop \ >- krb5-config \ >- krb5-kdc \ >- krb5-user \ >- language-pack-en \ >- lcov \ >- libacl1-dev \ >- libarchive-dev \ >- libattr1-dev \ >- libavahi-common-dev \ >- libblkid-dev \ >- libbsd-dev \ >- libcap-dev \ >- libcups2-dev \ >- libdbus-1-dev \ >- libglib2.0-dev \ >- libgnutls-dev \ >- libgpgme11-dev \ >- libicu-dev \ >- libjansson-dev \ >- libjs-jquery \ >- libjson-perl \ >- libkrb5-dev \ >- libldap2-dev \ >- liblmdb-dev/trusty-backports \ >- libncurses5-dev \ >- libpam0g-dev \ >- libparse-yapp-perl \ >- libpcap-dev \ >- libpopt-dev \ >- libreadline-dev \ >- libtasn1-bin \ >- libtasn1-dev \ >- libunwind8-dev \ >- lmdb-utils/trusty-backports \ >- locales \ >- lsb-release \ >- make \ >- mawk \ >- mingw-w64 \ >- patch \ >- perl \ >- perl-modules \ >- pkg-config \ >- procps \ >- psmisc \ >- python3 \ >- python3-dbg \ >- python3-dev \ >- python3-dnspython \ >- python3-gpgme \ >- python3-iso8601 \ >- python3-markdown \ >- python3-matplotlib \ >- python3-pexpect \ >- rng-tools \ >- rsync \ >- sed \ >- sudo \ >- tar \ >- tree \ >- uuid-dev \ >- xfslibs-dev \ >- xsltproc \ >- zlib1g-dev >- >-apt-get -y autoremove >-apt-get -y autoclean >-apt-get -y clean >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu1404/locale.sh b/bootstrap/generated-dists/ubuntu1404/locale.sh >deleted file mode 100755 >index cc64e180483..00000000000 >--- a/bootstrap/generated-dists/ubuntu1404/locale.sh >+++ /dev/null >@@ -1,55 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-# refer to /usr/share/i18n/locales >-INPUTFILE=en_US >-# refer to /usr/share/i18n/charmaps >-CHARMAP=UTF-8 >-# locale to generate in /usr/lib/locale >-# glibc/localedef will normalize UTF-8 to utf8, follow the naming style >-LOCALE=$INPUTFILE.utf8 >- >-# if locale is already correct, exit >-( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0 >- >-# if locale not available, generate locale into /usr/lib/locale >-if ! ( locale --all-locales | grep -i $LOCALE ) >-then >- # no-archive means create its own dir >- localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE >-fi >- >-# update locale conf and global env file >-# set both LC_ALL and LANG for safe >- >-# update conf for Debian family >-FILE=/etc/default/locale >-if [ -f $FILE ] >-then >- echo LC_ALL="$LOCALE" > $FILE >- echo LANG="$LOCALE" >> $FILE >-fi >- >-# update conf for RedHat family >-FILE=/etc/locale.conf >-if [ -f $FILE ] >-then >- # LC_ALL is not valid in this file, set LANG only >- echo LANG="$LOCALE" > $FILE >-fi >- >-# update global env file >-FILE=/etc/environment >-if [ -f $FILE ] >-then >- # append LC_ALL if not exist >- grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE >- # append LANG if not exist >- grep LANG $FILE || echo LANG="$LOCALE" >> $FILE >-fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu1404/packages.yml b/bootstrap/generated-dists/ubuntu1404/packages.yml >deleted file mode 100644 >index f6c8a0aaa00..00000000000 >--- a/bootstrap/generated-dists/ubuntu1404/packages.yml >+++ /dev/null >@@ -1,88 +0,0 @@ >---- >-packages: >- - acl >- - apt-utils >- - attr >- - autoconf >- - bind9utils >- - binutils >- - bison >- - build-essential >- - chrpath >- - curl >- - debhelper >- - dnsutils >- - docbook-xml >- - docbook-xsl >- - flex >- - gcc >- - gdb >- - git >- - gzip >- - heimdal-multidev >- - hostname >- - htop >- - krb5-config >- - krb5-kdc >- - krb5-user >- - language-pack-en >- - lcov >- - libacl1-dev >- - libarchive-dev >- - libattr1-dev >- - libavahi-common-dev >- - libblkid-dev >- - libbsd-dev >- - libcap-dev >- - libcups2-dev >- - libdbus-1-dev >- - libglib2.0-dev >- - libgnutls-dev >- - libgpgme11-dev >- - libicu-dev >- - libjansson-dev >- - libjs-jquery >- - libjson-perl >- - libkrb5-dev >- - libldap2-dev >- - liblmdb-dev/trusty-backports >- - libncurses5-dev >- - libpam0g-dev >- - libparse-yapp-perl >- - libpcap-dev >- - libpopt-dev >- - libreadline-dev >- - libtasn1-bin >- - libtasn1-dev >- - libunwind8-dev >- - lmdb-utils/trusty-backports >- - locales >- - lsb-release >- - make >- - mawk >- - mingw-w64 >- - patch >- - perl >- - perl-modules >- - pkg-config >- - procps >- - psmisc >- - python3 >- - python3-dbg >- - python3-dev >- - python3-dnspython >- - python3-gpgme >- - python3-iso8601 >- - python3-markdown >- - python3-matplotlib >- - python3-pexpect >- - rng-tools >- - rsync >- - sed >- - sudo >- - tar >- - tree >- - uuid-dev >- - xfslibs-dev >- - xsltproc >- - zlib1g-dev >\ No newline at end of file >diff --git a/bootstrap/sha1sum.txt b/bootstrap/sha1sum.txt >index 62c2245564e..2378dd2d94f 100644 >--- a/bootstrap/sha1sum.txt >+++ b/bootstrap/sha1sum.txt >@@ -1 +1 @@ >-41319f2580c026f66b2750604a0eb15d6b6f7b50 >+cd4cebb9c611fb98f3a21171dd4832df930add28 >-- >2.25.1 > > >From bf46319a4cbb0f8fb4231b77d7ca68b475ef0970 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Wed, 4 Mar 2020 13:55:27 +1300 >Subject: [PATCH 003/380] .gitlab-ci.yml: Do not build Samba for Ubuntu 16.04 > or Debian 9 any longer > >These only have Python 3.5 and we want to increase the minimum to Python 3.6. > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >(cherry picked from commit e9ce0f13e695f1d7e719923628255ea786a90c20) >--- > .gitlab-ci.yml | 10 +- > bootstrap/.gitlab-ci.yml | 6 - > bootstrap/config.py | 19 ---- > bootstrap/generated-dists/Vagrantfile | 14 --- > bootstrap/generated-dists/debian9/Dockerfile | 27 ----- > .../generated-dists/debian9/bootstrap.sh | 105 ------------------ > bootstrap/generated-dists/debian9/locale.sh | 55 --------- > .../generated-dists/debian9/packages.yml | 90 --------------- > .../generated-dists/ubuntu1604/Dockerfile | 27 ----- > .../generated-dists/ubuntu1604/bootstrap.sh | 104 ----------------- > .../generated-dists/ubuntu1604/locale.sh | 55 --------- > .../generated-dists/ubuntu1604/packages.yml | 89 --------------- > bootstrap/sha1sum.txt | 2 +- > 13 files changed, 2 insertions(+), 601 deletions(-) > delete mode 100644 bootstrap/generated-dists/debian9/Dockerfile > delete mode 100755 bootstrap/generated-dists/debian9/bootstrap.sh > delete mode 100755 bootstrap/generated-dists/debian9/locale.sh > delete mode 100644 bootstrap/generated-dists/debian9/packages.yml > delete mode 100644 bootstrap/generated-dists/ubuntu1604/Dockerfile > delete mode 100755 bootstrap/generated-dists/ubuntu1604/bootstrap.sh > delete mode 100755 bootstrap/generated-dists/ubuntu1604/locale.sh > delete mode 100644 bootstrap/generated-dists/ubuntu1604/packages.yml > >diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml >index 00ffff202d9..9bd5dd04b4f 100644 >--- a/.gitlab-ci.yml >+++ b/.gitlab-ci.yml >@@ -22,7 +22,7 @@ variables: > # Set this to the contents of bootstrap/sha1sum.txt > # which is generated by bootstrap/template.py --render > # >- SAMBA_CI_CONTAINER_TAG: cd4cebb9c611fb98f3a21171dd4832df930add28 >+ SAMBA_CI_CONTAINER_TAG: 2b0275df23424240774afcd61fae8abed8663996 > # > # We use the ubuntu1804 image as default as > # it matches what we have on sn-devel-184. >@@ -277,14 +277,6 @@ ubuntu1804-samba-o3: > extends: .samba-o3-template > image: $SAMBA_CI_CONTAINER_IMAGE_ubuntu1804 > >-ubuntu1604-samba-o3: >- extends: .samba-o3-template >- image: $SAMBA_CI_CONTAINER_IMAGE_ubuntu1604 >- >-debian9-samba-o3: >- extends: .samba-o3-template >- image: $SAMBA_CI_CONTAINER_IMAGE_debian9 >- > debian10-samba-o3: > extends: .samba-o3-template > image: $SAMBA_CI_CONTAINER_IMAGE_debian10 >diff --git a/bootstrap/.gitlab-ci.yml b/bootstrap/.gitlab-ci.yml >index cbf1cb9b58a..4e52da09dcc 100644 >--- a/bootstrap/.gitlab-ci.yml >+++ b/bootstrap/.gitlab-ci.yml >@@ -86,15 +86,9 @@ services: > ubuntu1804: > extends: .build_image_template > >-ubuntu1604: >- extends: .build_image_template >- > debian10: > extends: .build_image_template > >-debian9: >- extends: .build_image_template >- > fedora31: > extends: .build_image_template > >diff --git a/bootstrap/config.py b/bootstrap/config.py >index 552524ae759..19a2cf08b9d 100644 >--- a/bootstrap/config.py >+++ b/bootstrap/config.py >@@ -374,14 +374,6 @@ end > > > DEB_DISTS = { >- 'debian9': { >- 'docker_image': 'debian:9', >- 'vagrant_box': 'debian/stretch64', >- 'replace': { >- 'language-pack-en': '', # included in locales >- 'liburing-dev': '', # not available >- } >- }, > 'debian10': { > 'docker_image': 'debian:10', > 'vagrant_box': 'debian/buster64', >@@ -390,17 +382,6 @@ DEB_DISTS = { > 'liburing-dev': '', # not available > } > }, >- 'ubuntu1604': { >- 'docker_image': 'ubuntu:16.04', >- 'vagrant_box': 'ubuntu/xenial64', >- 'replace': { >- 'python-gpg': 'python-gpgme', >- 'python3-gpg': 'python3-gpgme', >- 'glusterfs-common': '', >- 'libcephfs-dev': '', >- 'liburing-dev': '', # not available >- } >- }, > 'ubuntu1804': { > 'docker_image': 'ubuntu:18.04', > 'vagrant_box': 'ubuntu/bionic64', >diff --git a/bootstrap/generated-dists/Vagrantfile b/bootstrap/generated-dists/Vagrantfile >index 983e66aa57f..091c65488cb 100644 >--- a/bootstrap/generated-dists/Vagrantfile >+++ b/bootstrap/generated-dists/Vagrantfile >@@ -31,13 +31,6 @@ Vagrant.configure("2") do |config| > v.vm.provision :shell, path: "debian10/locale.sh" > end > >- config.vm.define "debian9" do |v| >- v.vm.box = "debian/stretch64" >- v.vm.hostname = "debian9" >- v.vm.provision :shell, path: "debian9/bootstrap.sh" >- v.vm.provision :shell, path: "debian9/locale.sh" >- end >- > config.vm.define "fedora29" do |v| > v.vm.box = "fedora/29-cloud-base" > v.vm.hostname = "fedora29" >@@ -73,13 +66,6 @@ Vagrant.configure("2") do |config| > v.vm.provision :shell, path: "opensuse151/locale.sh" > end > >- config.vm.define "ubuntu1604" do |v| >- v.vm.box = "ubuntu/xenial64" >- v.vm.hostname = "ubuntu1604" >- v.vm.provision :shell, path: "ubuntu1604/bootstrap.sh" >- v.vm.provision :shell, path: "ubuntu1604/locale.sh" >- end >- > config.vm.define "ubuntu1804" do |v| > v.vm.box = "ubuntu/bionic64" > v.vm.hostname = "ubuntu1804" >diff --git a/bootstrap/generated-dists/debian9/Dockerfile b/bootstrap/generated-dists/debian9/Dockerfile >deleted file mode 100644 >index 50195295447..00000000000 >--- a/bootstrap/generated-dists/debian9/Dockerfile >+++ /dev/null >@@ -1,27 +0,0 @@ >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-FROM debian:9 >- >-# pass in with --build-arg while build >-ARG SHA1SUM >-RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt >- >-ADD *.sh /tmp/ >-# need root permission, do it before USER samba >-RUN /tmp/bootstrap.sh && /tmp/locale.sh >- >-# if ld.gold exists, force link it to ld >-RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD" >- >-# make test can not work with root, so we have to create a new user >-RUN useradd -m -U -s /bin/bash samba && \ >- mkdir -p /etc/sudoers.d && \ >- echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba >- >-USER samba >-WORKDIR /home/samba >-# samba tests rely on this >-ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8 >\ No newline at end of file >diff --git a/bootstrap/generated-dists/debian9/bootstrap.sh b/bootstrap/generated-dists/debian9/bootstrap.sh >deleted file mode 100755 >index f0847eb3c20..00000000000 >--- a/bootstrap/generated-dists/debian9/bootstrap.sh >+++ /dev/null >@@ -1,105 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-export DEBIAN_FRONTEND=noninteractive >-apt-get -y update >- >-apt-get -y install \ >- acl \ >- apt-utils \ >- attr \ >- autoconf \ >- bind9utils \ >- binutils \ >- bison \ >- build-essential \ >- chrpath \ >- curl \ >- debhelper \ >- dnsutils \ >- docbook-xml \ >- docbook-xsl \ >- flex \ >- gcc \ >- gdb \ >- git \ >- glusterfs-common \ >- gzip \ >- heimdal-multidev \ >- hostname \ >- htop \ >- krb5-config \ >- krb5-kdc \ >- krb5-user \ >- lcov \ >- libacl1-dev \ >- libarchive-dev \ >- libattr1-dev \ >- libavahi-common-dev \ >- libblkid-dev \ >- libbsd-dev \ >- libcap-dev \ >- libcephfs-dev \ >- libcups2-dev \ >- libdbus-1-dev \ >- libglib2.0-dev \ >- libgnutls28-dev \ >- libgpgme11-dev \ >- libicu-dev \ >- libjansson-dev \ >- libjs-jquery \ >- libjson-perl \ >- libkrb5-dev \ >- libldap2-dev \ >- liblmdb-dev \ >- libncurses5-dev \ >- libpam0g-dev \ >- libparse-yapp-perl \ >- libpcap-dev \ >- libpopt-dev \ >- libreadline-dev \ >- libsystemd-dev \ >- libtasn1-bin \ >- libtasn1-dev \ >- libunwind-dev \ >- lmdb-utils \ >- locales \ >- lsb-release \ >- make \ >- mawk \ >- mingw-w64 \ >- patch \ >- perl \ >- perl-modules \ >- pkg-config \ >- procps \ >- psmisc \ >- python3 \ >- python3-dbg \ >- python3-dev \ >- python3-dnspython \ >- python3-gpg \ >- python3-iso8601 \ >- python3-markdown \ >- python3-matplotlib \ >- python3-pexpect \ >- rng-tools \ >- rsync \ >- sed \ >- sudo \ >- tar \ >- tree \ >- uuid-dev \ >- xfslibs-dev \ >- xsltproc \ >- zlib1g-dev >- >-apt-get -y autoremove >-apt-get -y autoclean >-apt-get -y clean >\ No newline at end of file >diff --git a/bootstrap/generated-dists/debian9/locale.sh b/bootstrap/generated-dists/debian9/locale.sh >deleted file mode 100755 >index cc64e180483..00000000000 >--- a/bootstrap/generated-dists/debian9/locale.sh >+++ /dev/null >@@ -1,55 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-# refer to /usr/share/i18n/locales >-INPUTFILE=en_US >-# refer to /usr/share/i18n/charmaps >-CHARMAP=UTF-8 >-# locale to generate in /usr/lib/locale >-# glibc/localedef will normalize UTF-8 to utf8, follow the naming style >-LOCALE=$INPUTFILE.utf8 >- >-# if locale is already correct, exit >-( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0 >- >-# if locale not available, generate locale into /usr/lib/locale >-if ! ( locale --all-locales | grep -i $LOCALE ) >-then >- # no-archive means create its own dir >- localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE >-fi >- >-# update locale conf and global env file >-# set both LC_ALL and LANG for safe >- >-# update conf for Debian family >-FILE=/etc/default/locale >-if [ -f $FILE ] >-then >- echo LC_ALL="$LOCALE" > $FILE >- echo LANG="$LOCALE" >> $FILE >-fi >- >-# update conf for RedHat family >-FILE=/etc/locale.conf >-if [ -f $FILE ] >-then >- # LC_ALL is not valid in this file, set LANG only >- echo LANG="$LOCALE" > $FILE >-fi >- >-# update global env file >-FILE=/etc/environment >-if [ -f $FILE ] >-then >- # append LC_ALL if not exist >- grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE >- # append LANG if not exist >- grep LANG $FILE || echo LANG="$LOCALE" >> $FILE >-fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/debian9/packages.yml b/bootstrap/generated-dists/debian9/packages.yml >deleted file mode 100644 >index a242cd8b362..00000000000 >--- a/bootstrap/generated-dists/debian9/packages.yml >+++ /dev/null >@@ -1,90 +0,0 @@ >---- >-packages: >- - acl >- - apt-utils >- - attr >- - autoconf >- - bind9utils >- - binutils >- - bison >- - build-essential >- - chrpath >- - curl >- - debhelper >- - dnsutils >- - docbook-xml >- - docbook-xsl >- - flex >- - gcc >- - gdb >- - git >- - glusterfs-common >- - gzip >- - heimdal-multidev >- - hostname >- - htop >- - krb5-config >- - krb5-kdc >- - krb5-user >- - lcov >- - libacl1-dev >- - libarchive-dev >- - libattr1-dev >- - libavahi-common-dev >- - libblkid-dev >- - libbsd-dev >- - libcap-dev >- - libcephfs-dev >- - libcups2-dev >- - libdbus-1-dev >- - libglib2.0-dev >- - libgnutls28-dev >- - libgpgme11-dev >- - libicu-dev >- - libjansson-dev >- - libjs-jquery >- - libjson-perl >- - libkrb5-dev >- - libldap2-dev >- - liblmdb-dev >- - libncurses5-dev >- - libpam0g-dev >- - libparse-yapp-perl >- - libpcap-dev >- - libpopt-dev >- - libreadline-dev >- - libsystemd-dev >- - libtasn1-bin >- - libtasn1-dev >- - libunwind-dev >- - lmdb-utils >- - locales >- - lsb-release >- - make >- - mawk >- - mingw-w64 >- - patch >- - perl >- - perl-modules >- - pkg-config >- - procps >- - psmisc >- - python3 >- - python3-dbg >- - python3-dev >- - python3-dnspython >- - python3-gpg >- - python3-iso8601 >- - python3-markdown >- - python3-matplotlib >- - python3-pexpect >- - rng-tools >- - rsync >- - sed >- - sudo >- - tar >- - tree >- - uuid-dev >- - xfslibs-dev >- - xsltproc >- - zlib1g-dev >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu1604/Dockerfile b/bootstrap/generated-dists/ubuntu1604/Dockerfile >deleted file mode 100644 >index 93001fcdcca..00000000000 >--- a/bootstrap/generated-dists/ubuntu1604/Dockerfile >+++ /dev/null >@@ -1,27 +0,0 @@ >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-FROM ubuntu:16.04 >- >-# pass in with --build-arg while build >-ARG SHA1SUM >-RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt >- >-ADD *.sh /tmp/ >-# need root permission, do it before USER samba >-RUN /tmp/bootstrap.sh && /tmp/locale.sh >- >-# if ld.gold exists, force link it to ld >-RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD" >- >-# make test can not work with root, so we have to create a new user >-RUN useradd -m -U -s /bin/bash samba && \ >- mkdir -p /etc/sudoers.d && \ >- echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba >- >-USER samba >-WORKDIR /home/samba >-# samba tests rely on this >-ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8 >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu1604/bootstrap.sh b/bootstrap/generated-dists/ubuntu1604/bootstrap.sh >deleted file mode 100755 >index a8f47762ded..00000000000 >--- a/bootstrap/generated-dists/ubuntu1604/bootstrap.sh >+++ /dev/null >@@ -1,104 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-export DEBIAN_FRONTEND=noninteractive >-apt-get -y update >- >-apt-get -y install \ >- acl \ >- apt-utils \ >- attr \ >- autoconf \ >- bind9utils \ >- binutils \ >- bison \ >- build-essential \ >- chrpath \ >- curl \ >- debhelper \ >- dnsutils \ >- docbook-xml \ >- docbook-xsl \ >- flex \ >- gcc \ >- gdb \ >- git \ >- gzip \ >- heimdal-multidev \ >- hostname \ >- htop \ >- krb5-config \ >- krb5-kdc \ >- krb5-user \ >- language-pack-en \ >- lcov \ >- libacl1-dev \ >- libarchive-dev \ >- libattr1-dev \ >- libavahi-common-dev \ >- libblkid-dev \ >- libbsd-dev \ >- libcap-dev \ >- libcups2-dev \ >- libdbus-1-dev \ >- libglib2.0-dev \ >- libgnutls28-dev \ >- libgpgme11-dev \ >- libicu-dev \ >- libjansson-dev \ >- libjs-jquery \ >- libjson-perl \ >- libkrb5-dev \ >- libldap2-dev \ >- liblmdb-dev \ >- libncurses5-dev \ >- libpam0g-dev \ >- libparse-yapp-perl \ >- libpcap-dev \ >- libpopt-dev \ >- libreadline-dev \ >- libsystemd-dev \ >- libtasn1-bin \ >- libtasn1-dev \ >- libunwind-dev \ >- lmdb-utils \ >- locales \ >- lsb-release \ >- make \ >- mawk \ >- mingw-w64 \ >- patch \ >- perl \ >- perl-modules \ >- pkg-config \ >- procps \ >- psmisc \ >- python3 \ >- python3-dbg \ >- python3-dev \ >- python3-dnspython \ >- python3-gpgme \ >- python3-iso8601 \ >- python3-markdown \ >- python3-matplotlib \ >- python3-pexpect \ >- rng-tools \ >- rsync \ >- sed \ >- sudo \ >- tar \ >- tree \ >- uuid-dev \ >- xfslibs-dev \ >- xsltproc \ >- zlib1g-dev >- >-apt-get -y autoremove >-apt-get -y autoclean >-apt-get -y clean >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu1604/locale.sh b/bootstrap/generated-dists/ubuntu1604/locale.sh >deleted file mode 100755 >index cc64e180483..00000000000 >--- a/bootstrap/generated-dists/ubuntu1604/locale.sh >+++ /dev/null >@@ -1,55 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-# refer to /usr/share/i18n/locales >-INPUTFILE=en_US >-# refer to /usr/share/i18n/charmaps >-CHARMAP=UTF-8 >-# locale to generate in /usr/lib/locale >-# glibc/localedef will normalize UTF-8 to utf8, follow the naming style >-LOCALE=$INPUTFILE.utf8 >- >-# if locale is already correct, exit >-( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0 >- >-# if locale not available, generate locale into /usr/lib/locale >-if ! ( locale --all-locales | grep -i $LOCALE ) >-then >- # no-archive means create its own dir >- localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE >-fi >- >-# update locale conf and global env file >-# set both LC_ALL and LANG for safe >- >-# update conf for Debian family >-FILE=/etc/default/locale >-if [ -f $FILE ] >-then >- echo LC_ALL="$LOCALE" > $FILE >- echo LANG="$LOCALE" >> $FILE >-fi >- >-# update conf for RedHat family >-FILE=/etc/locale.conf >-if [ -f $FILE ] >-then >- # LC_ALL is not valid in this file, set LANG only >- echo LANG="$LOCALE" > $FILE >-fi >- >-# update global env file >-FILE=/etc/environment >-if [ -f $FILE ] >-then >- # append LC_ALL if not exist >- grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE >- # append LANG if not exist >- grep LANG $FILE || echo LANG="$LOCALE" >> $FILE >-fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu1604/packages.yml b/bootstrap/generated-dists/ubuntu1604/packages.yml >deleted file mode 100644 >index c3cd9af9c3e..00000000000 >--- a/bootstrap/generated-dists/ubuntu1604/packages.yml >+++ /dev/null >@@ -1,89 +0,0 @@ >---- >-packages: >- - acl >- - apt-utils >- - attr >- - autoconf >- - bind9utils >- - binutils >- - bison >- - build-essential >- - chrpath >- - curl >- - debhelper >- - dnsutils >- - docbook-xml >- - docbook-xsl >- - flex >- - gcc >- - gdb >- - git >- - gzip >- - heimdal-multidev >- - hostname >- - htop >- - krb5-config >- - krb5-kdc >- - krb5-user >- - language-pack-en >- - lcov >- - libacl1-dev >- - libarchive-dev >- - libattr1-dev >- - libavahi-common-dev >- - libblkid-dev >- - libbsd-dev >- - libcap-dev >- - libcups2-dev >- - libdbus-1-dev >- - libglib2.0-dev >- - libgnutls28-dev >- - libgpgme11-dev >- - libicu-dev >- - libjansson-dev >- - libjs-jquery >- - libjson-perl >- - libkrb5-dev >- - libldap2-dev >- - liblmdb-dev >- - libncurses5-dev >- - libpam0g-dev >- - libparse-yapp-perl >- - libpcap-dev >- - libpopt-dev >- - libreadline-dev >- - libsystemd-dev >- - libtasn1-bin >- - libtasn1-dev >- - libunwind-dev >- - lmdb-utils >- - locales >- - lsb-release >- - make >- - mawk >- - mingw-w64 >- - patch >- - perl >- - perl-modules >- - pkg-config >- - procps >- - psmisc >- - python3 >- - python3-dbg >- - python3-dev >- - python3-dnspython >- - python3-gpgme >- - python3-iso8601 >- - python3-markdown >- - python3-matplotlib >- - python3-pexpect >- - rng-tools >- - rsync >- - sed >- - sudo >- - tar >- - tree >- - uuid-dev >- - xfslibs-dev >- - xsltproc >- - zlib1g-dev >\ No newline at end of file >diff --git a/bootstrap/sha1sum.txt b/bootstrap/sha1sum.txt >index 2378dd2d94f..7344075d11d 100644 >--- a/bootstrap/sha1sum.txt >+++ b/bootstrap/sha1sum.txt >@@ -1 +1 @@ >-cd4cebb9c611fb98f3a21171dd4832df930add28 >+2b0275df23424240774afcd61fae8abed8663996 >-- >2.25.1 > > >From 8a9e1d2f57aaac8e8ae2a4ff56f098e5896eedaa Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 17 Mar 2020 16:49:02 +1300 >Subject: [PATCH 004/380] bootstrap: Bring back a Ubuntu 16.04 build but just > for the samba-fuzz task > >This is needed to restore oss-fuzz support, as this uses the Ubuntu 16.04 package list >because all the docker images provided start with a Ubuntu 16.04 base. > >REF: https://github.com/google/oss-fuzz/issues/3505 >REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21189 > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> >(cherry picked from commit e10910f8de542b0be9b89942791bd37288b7a32a) >--- > .gitlab-ci.yml | 3 +- > bootstrap/.gitlab-ci.yml | 11 +- > bootstrap/config.py | 11 ++ > bootstrap/generated-dists/Vagrantfile | 7 ++ > .../generated-dists/ubuntu1604/Dockerfile | 27 +++++ > .../generated-dists/ubuntu1604/bootstrap.sh | 104 ++++++++++++++++++ > .../generated-dists/ubuntu1604/locale.sh | 55 +++++++++ > .../generated-dists/ubuntu1604/packages.yml | 89 +++++++++++++++ > bootstrap/sha1sum.txt | 2 +- > 9 files changed, 305 insertions(+), 4 deletions(-) > create mode 100644 bootstrap/generated-dists/ubuntu1604/Dockerfile > create mode 100755 bootstrap/generated-dists/ubuntu1604/bootstrap.sh > create mode 100755 bootstrap/generated-dists/ubuntu1604/locale.sh > create mode 100644 bootstrap/generated-dists/ubuntu1604/packages.yml > >diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml >index 9bd5dd04b4f..8becacb8d4e 100644 >--- a/.gitlab-ci.yml >+++ b/.gitlab-ci.yml >@@ -22,7 +22,7 @@ variables: > # Set this to the contents of bootstrap/sha1sum.txt > # which is generated by bootstrap/template.py --render > # >- SAMBA_CI_CONTAINER_TAG: 2b0275df23424240774afcd61fae8abed8663996 >+ SAMBA_CI_CONTAINER_TAG: 6bb2eeaf8203467d9a93a722071b0f081027410e > # > # We use the ubuntu1804 image as default as > # it matches what we have on sn-devel-184. >@@ -157,6 +157,7 @@ samba-static: > > samba-fuzz: > extends: .shared_template >+ image: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-ubuntu1604:${SAMBA_CI_CONTAINER_TAG} > > ctdb: > extends: .shared_template >diff --git a/bootstrap/.gitlab-ci.yml b/bootstrap/.gitlab-ci.yml >index 4e52da09dcc..ecd9f4d4223 100644 >--- a/bootstrap/.gitlab-ci.yml >+++ b/bootstrap/.gitlab-ci.yml >@@ -9,6 +9,7 @@ services: > - gce > variables: > SAMBA_CI_IS_BROKEN_IMAGE: "no" >+ SAMBA_CI_TEST_JOB: "samba-o3" > before_script: > # Ensure we are generating correct the container > - uname -a >@@ -40,9 +41,9 @@ services: > docker run --volume $(pwd):${samba_repo_root} --workdir ${samba_repo_root} ${ci_image_name} \ > bootstrap/template.py --sha1sum > /tmp/sha1sum-template.txt > diff -u bootstrap/sha1sum.txt /tmp/sha1sum-template.txt >- # run smoke test with samba-o3 >+ # run smoke test with samba-o3 or samba-fuzz > docker run --volume $(pwd):${samba_repo_root} --workdir ${samba_repo_root} ${ci_image_name} \ >- /bin/bash -c "sudo chown -R samba:samba ./** && export PKG_CONFIG_PATH=/usr/lib64/compat-gnutls34/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig && script/autobuild.py samba-o3 --verbose --nocleanup --keeplogs --tail --testbase /tmp/samba-testbase" >+ /bin/bash -c "sudo chown -R samba:samba ./** && export PKG_CONFIG_PATH=/usr/lib64/compat-gnutls34/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig && script/autobuild.py ${SAMBA_CI_TEST_JOB} --verbose --nocleanup --keeplogs --tail --testbase /tmp/samba-testbase" > docker tag ${ci_image_name} ${ci_image_path}:${SAMBA_CI_CONTAINER_TAG} > docker tag ${ci_image_name} ${ci_image_path}:${timestamp_tag} > # We build all images, but only upload is it's not marked as broken >@@ -83,6 +84,12 @@ services: > # > - $SAMBA_CI_REBUILD_BROKEN_IMAGES == "yes" > >+# This is ONLY for oss-fuzz, so we test a fuzz build not a real one >+ubuntu1604: >+ extends: .build_image_template >+ variables: >+ SAMBA_CI_TEST_JOB: "samba-fuzz" >+ > ubuntu1804: > extends: .build_image_template > >diff --git a/bootstrap/config.py b/bootstrap/config.py >index 19a2cf08b9d..ff9bb150672 100644 >--- a/bootstrap/config.py >+++ b/bootstrap/config.py >@@ -382,6 +382,17 @@ DEB_DISTS = { > 'liburing-dev': '', # not available > } > }, >+ 'ubuntu1604': { >+ 'docker_image': 'ubuntu:16.04', >+ 'vagrant_box': 'ubuntu/xenial64', >+ 'replace': { >+ 'python-gpg': 'python-gpgme', >+ 'python3-gpg': 'python3-gpgme', >+ 'glusterfs-common': '', >+ 'libcephfs-dev': '', >+ 'liburing-dev': '', # not available >+ } >+ }, > 'ubuntu1804': { > 'docker_image': 'ubuntu:18.04', > 'vagrant_box': 'ubuntu/bionic64', >diff --git a/bootstrap/generated-dists/Vagrantfile b/bootstrap/generated-dists/Vagrantfile >index 091c65488cb..47c58d5a87b 100644 >--- a/bootstrap/generated-dists/Vagrantfile >+++ b/bootstrap/generated-dists/Vagrantfile >@@ -66,6 +66,13 @@ Vagrant.configure("2") do |config| > v.vm.provision :shell, path: "opensuse151/locale.sh" > end > >+ config.vm.define "ubuntu1604" do |v| >+ v.vm.box = "ubuntu/xenial64" >+ v.vm.hostname = "ubuntu1604" >+ v.vm.provision :shell, path: "ubuntu1604/bootstrap.sh" >+ v.vm.provision :shell, path: "ubuntu1604/locale.sh" >+ end >+ > config.vm.define "ubuntu1804" do |v| > v.vm.box = "ubuntu/bionic64" > v.vm.hostname = "ubuntu1804" >diff --git a/bootstrap/generated-dists/ubuntu1604/Dockerfile b/bootstrap/generated-dists/ubuntu1604/Dockerfile >new file mode 100644 >index 00000000000..93001fcdcca >--- /dev/null >+++ b/bootstrap/generated-dists/ubuntu1604/Dockerfile >@@ -0,0 +1,27 @@ >+# >+# This file is generated by 'bootstrap/template.py --render' >+# See also bootstrap/config.py >+# >+ >+FROM ubuntu:16.04 >+ >+# pass in with --build-arg while build >+ARG SHA1SUM >+RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt >+ >+ADD *.sh /tmp/ >+# need root permission, do it before USER samba >+RUN /tmp/bootstrap.sh && /tmp/locale.sh >+ >+# if ld.gold exists, force link it to ld >+RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD" >+ >+# make test can not work with root, so we have to create a new user >+RUN useradd -m -U -s /bin/bash samba && \ >+ mkdir -p /etc/sudoers.d && \ >+ echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba >+ >+USER samba >+WORKDIR /home/samba >+# samba tests rely on this >+ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8 >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu1604/bootstrap.sh b/bootstrap/generated-dists/ubuntu1604/bootstrap.sh >new file mode 100755 >index 00000000000..a8f47762ded >--- /dev/null >+++ b/bootstrap/generated-dists/ubuntu1604/bootstrap.sh >@@ -0,0 +1,104 @@ >+#!/bin/bash >+ >+# >+# This file is generated by 'bootstrap/template.py --render' >+# See also bootstrap/config.py >+# >+ >+set -xueo pipefail >+ >+export DEBIAN_FRONTEND=noninteractive >+apt-get -y update >+ >+apt-get -y install \ >+ acl \ >+ apt-utils \ >+ attr \ >+ autoconf \ >+ bind9utils \ >+ binutils \ >+ bison \ >+ build-essential \ >+ chrpath \ >+ curl \ >+ debhelper \ >+ dnsutils \ >+ docbook-xml \ >+ docbook-xsl \ >+ flex \ >+ gcc \ >+ gdb \ >+ git \ >+ gzip \ >+ heimdal-multidev \ >+ hostname \ >+ htop \ >+ krb5-config \ >+ krb5-kdc \ >+ krb5-user \ >+ language-pack-en \ >+ lcov \ >+ libacl1-dev \ >+ libarchive-dev \ >+ libattr1-dev \ >+ libavahi-common-dev \ >+ libblkid-dev \ >+ libbsd-dev \ >+ libcap-dev \ >+ libcups2-dev \ >+ libdbus-1-dev \ >+ libglib2.0-dev \ >+ libgnutls28-dev \ >+ libgpgme11-dev \ >+ libicu-dev \ >+ libjansson-dev \ >+ libjs-jquery \ >+ libjson-perl \ >+ libkrb5-dev \ >+ libldap2-dev \ >+ liblmdb-dev \ >+ libncurses5-dev \ >+ libpam0g-dev \ >+ libparse-yapp-perl \ >+ libpcap-dev \ >+ libpopt-dev \ >+ libreadline-dev \ >+ libsystemd-dev \ >+ libtasn1-bin \ >+ libtasn1-dev \ >+ libunwind-dev \ >+ lmdb-utils \ >+ locales \ >+ lsb-release \ >+ make \ >+ mawk \ >+ mingw-w64 \ >+ patch \ >+ perl \ >+ perl-modules \ >+ pkg-config \ >+ procps \ >+ psmisc \ >+ python3 \ >+ python3-dbg \ >+ python3-dev \ >+ python3-dnspython \ >+ python3-gpgme \ >+ python3-iso8601 \ >+ python3-markdown \ >+ python3-matplotlib \ >+ python3-pexpect \ >+ rng-tools \ >+ rsync \ >+ sed \ >+ sudo \ >+ tar \ >+ tree \ >+ uuid-dev \ >+ xfslibs-dev \ >+ xsltproc \ >+ zlib1g-dev >+ >+apt-get -y autoremove >+apt-get -y autoclean >+apt-get -y clean >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu1604/locale.sh b/bootstrap/generated-dists/ubuntu1604/locale.sh >new file mode 100755 >index 00000000000..cc64e180483 >--- /dev/null >+++ b/bootstrap/generated-dists/ubuntu1604/locale.sh >@@ -0,0 +1,55 @@ >+#!/bin/bash >+ >+# >+# This file is generated by 'bootstrap/template.py --render' >+# See also bootstrap/config.py >+# >+ >+set -xueo pipefail >+ >+# refer to /usr/share/i18n/locales >+INPUTFILE=en_US >+# refer to /usr/share/i18n/charmaps >+CHARMAP=UTF-8 >+# locale to generate in /usr/lib/locale >+# glibc/localedef will normalize UTF-8 to utf8, follow the naming style >+LOCALE=$INPUTFILE.utf8 >+ >+# if locale is already correct, exit >+( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0 >+ >+# if locale not available, generate locale into /usr/lib/locale >+if ! ( locale --all-locales | grep -i $LOCALE ) >+then >+ # no-archive means create its own dir >+ localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE >+fi >+ >+# update locale conf and global env file >+# set both LC_ALL and LANG for safe >+ >+# update conf for Debian family >+FILE=/etc/default/locale >+if [ -f $FILE ] >+then >+ echo LC_ALL="$LOCALE" > $FILE >+ echo LANG="$LOCALE" >> $FILE >+fi >+ >+# update conf for RedHat family >+FILE=/etc/locale.conf >+if [ -f $FILE ] >+then >+ # LC_ALL is not valid in this file, set LANG only >+ echo LANG="$LOCALE" > $FILE >+fi >+ >+# update global env file >+FILE=/etc/environment >+if [ -f $FILE ] >+then >+ # append LC_ALL if not exist >+ grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE >+ # append LANG if not exist >+ grep LANG $FILE || echo LANG="$LOCALE" >> $FILE >+fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu1604/packages.yml b/bootstrap/generated-dists/ubuntu1604/packages.yml >new file mode 100644 >index 00000000000..c3cd9af9c3e >--- /dev/null >+++ b/bootstrap/generated-dists/ubuntu1604/packages.yml >@@ -0,0 +1,89 @@ >+--- >+packages: >+ - acl >+ - apt-utils >+ - attr >+ - autoconf >+ - bind9utils >+ - binutils >+ - bison >+ - build-essential >+ - chrpath >+ - curl >+ - debhelper >+ - dnsutils >+ - docbook-xml >+ - docbook-xsl >+ - flex >+ - gcc >+ - gdb >+ - git >+ - gzip >+ - heimdal-multidev >+ - hostname >+ - htop >+ - krb5-config >+ - krb5-kdc >+ - krb5-user >+ - language-pack-en >+ - lcov >+ - libacl1-dev >+ - libarchive-dev >+ - libattr1-dev >+ - libavahi-common-dev >+ - libblkid-dev >+ - libbsd-dev >+ - libcap-dev >+ - libcups2-dev >+ - libdbus-1-dev >+ - libglib2.0-dev >+ - libgnutls28-dev >+ - libgpgme11-dev >+ - libicu-dev >+ - libjansson-dev >+ - libjs-jquery >+ - libjson-perl >+ - libkrb5-dev >+ - libldap2-dev >+ - liblmdb-dev >+ - libncurses5-dev >+ - libpam0g-dev >+ - libparse-yapp-perl >+ - libpcap-dev >+ - libpopt-dev >+ - libreadline-dev >+ - libsystemd-dev >+ - libtasn1-bin >+ - libtasn1-dev >+ - libunwind-dev >+ - lmdb-utils >+ - locales >+ - lsb-release >+ - make >+ - mawk >+ - mingw-w64 >+ - patch >+ - perl >+ - perl-modules >+ - pkg-config >+ - procps >+ - psmisc >+ - python3 >+ - python3-dbg >+ - python3-dev >+ - python3-dnspython >+ - python3-gpgme >+ - python3-iso8601 >+ - python3-markdown >+ - python3-matplotlib >+ - python3-pexpect >+ - rng-tools >+ - rsync >+ - sed >+ - sudo >+ - tar >+ - tree >+ - uuid-dev >+ - xfslibs-dev >+ - xsltproc >+ - zlib1g-dev >\ No newline at end of file >diff --git a/bootstrap/sha1sum.txt b/bootstrap/sha1sum.txt >index 7344075d11d..1c9d01d5e7d 100644 >--- a/bootstrap/sha1sum.txt >+++ b/bootstrap/sha1sum.txt >@@ -1 +1 @@ >-2b0275df23424240774afcd61fae8abed8663996 >+6bb2eeaf8203467d9a93a722071b0f081027410e >-- >2.25.1 > > >From 726fb38c1ce2126886eaf8a8ed050c54e98c5daf Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Tue, 17 Mar 2020 17:39:48 +0100 >Subject: [PATCH 005/380] bootstrap: Add podman command to readme > >Reviewed-by: Alexander Bokovoy <ab@samba.org> >(cherry picked from commit 272b43d331c7cd0452069128166404af7f088b36) >--- > bootstrap/READMD.md | 4 ++++ > 1 file changed, 4 insertions(+) > >diff --git a/bootstrap/READMD.md b/bootstrap/READMD.md >index b8a30098b67..023686e20c4 100644 >--- a/bootstrap/READMD.md >+++ b/bootstrap/READMD.md >@@ -83,6 +83,10 @@ With Docker: > docker pull registry.gitlab.com/samba-team/devel/samba/samba-ci-ubuntu1804:${sha1sum} > docker run -it -v $(pwd):/home/samba/samba samba-ci-ubuntu1804:${sha1sum} bash > >+With podman: >+ >+ podman run -ti --cap-add=SYS_PTRACE --security-opt seccomp=unconfined registry.gitlab.com/samba-team/devel/samba/samba-ci-ubuntu1804:${sha1sum} bash >+ > With Vagrant: > > cd bootstrap/generated-dists/ >-- >2.25.1 > > >From 12fe6ac5e72ff4ca10d883ce3ef2098d8e6fd2a0 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Mon, 16 Mar 2020 17:00:16 +0100 >Subject: [PATCH 006/380] third_party: Update nss_wrapper to version 1.1.10 > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Alexander Bokovoy <ab@samba.org> > >Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> >Autobuild-Date(master): Fri Mar 20 12:41:36 UTC 2020 on sn-devel-184 > >(cherry picked from commit 639e64d30d54d600e96ea06c9a2afaa91cb1c9a4) >--- > buildtools/wafsamba/samba_third_party.py | 2 +- > third_party/nss_wrapper/nss_wrapper.c | 550 ++++++++++++++++++++--- > third_party/nss_wrapper/wscript | 3 +- > 3 files changed, 493 insertions(+), 62 deletions(-) > >diff --git a/buildtools/wafsamba/samba_third_party.py b/buildtools/wafsamba/samba_third_party.py >index 38df19369d7..a7026034984 100644 >--- a/buildtools/wafsamba/samba_third_party.py >+++ b/buildtools/wafsamba/samba_third_party.py >@@ -29,7 +29,7 @@ Build.BuildContext.CHECK_SOCKET_WRAPPER = CHECK_SOCKET_WRAPPER > > @conf > def CHECK_NSS_WRAPPER(conf): >- return conf.CHECK_BUNDLED_SYSTEM_PKG('nss_wrapper', minversion='1.1.7') >+ return conf.CHECK_BUNDLED_SYSTEM_PKG('nss_wrapper', minversion='1.1.10') > Build.BuildContext.CHECK_NSS_WRAPPER = CHECK_NSS_WRAPPER > > @conf >diff --git a/third_party/nss_wrapper/nss_wrapper.c b/third_party/nss_wrapper/nss_wrapper.c >index 1bcd3b1b72d..d90264c6d24 100644 >--- a/third_party/nss_wrapper/nss_wrapper.c >+++ b/third_party/nss_wrapper/nss_wrapper.c >@@ -351,6 +351,15 @@ struct nwrap_libc_fns { > struct hostent *(*_libc_gethostbyname)(const char *name); > #ifdef HAVE_GETHOSTBYNAME2 /* GNU extension */ > struct hostent *(*_libc_gethostbyname2)(const char *name, int af); >+#endif >+#ifdef HAVE_GETHOSTBYNAME2_R /* GNU extension */ >+ int (*_libc_gethostbyname2_r)(const char *name, >+ int af, >+ struct hostent *ret, >+ char *buf, >+ size_t buflen, >+ struct hostent **result, >+ int *h_errnop); > #endif > struct hostent *(*_libc_gethostbyaddr)(const void *addr, socklen_t len, int type); > >@@ -395,6 +404,14 @@ struct nwrap_module_nss_fns { > NSS_STATUS (*_nss_getgrent_r)(struct group *result, char *buffer, > size_t buflen, int *errnop); > NSS_STATUS (*_nss_endgrent)(void); >+ NSS_STATUS (*_nss_gethostbyaddr_r)(const void *addr, socklen_t addrlen, >+ int af, struct hostent *result, >+ char *buffer, size_t buflen, >+ int *errnop, int *h_errnop); >+ NSS_STATUS (*_nss_gethostbyname2_r)(const char *name, int af, >+ struct hostent *result, >+ char *buffer, size_t buflen, >+ int *errnop, int *h_errnop); > }; > > struct nwrap_backend { >@@ -405,6 +422,8 @@ struct nwrap_backend { > struct nwrap_module_nss_fns *fns; > }; > >+struct nwrap_vector; >+ > struct nwrap_ops { > struct passwd * (*nw_getpwnam)(struct nwrap_backend *b, > const char *name); >@@ -440,6 +459,18 @@ struct nwrap_ops { > struct group *grdst, char *buf, > size_t buflen, struct group **grdstp); > void (*nw_endgrent)(struct nwrap_backend *b); >+ struct hostent *(*nw_gethostbyaddr)(struct nwrap_backend *b, >+ const void *addr, >+ socklen_t len, int type); >+ struct hostent *(*nw_gethostbyname)(struct nwrap_backend *b, >+ const char *name); >+ struct hostent *(*nw_gethostbyname2)(struct nwrap_backend *b, >+ const char *name, int af); >+ int (*nw_gethostbyname2_r)(struct nwrap_backend *b, >+ const char *name, int af, >+ struct hostent *hedst, >+ char *buf, size_t buflen, >+ struct hostent **hedstp); > }; > > /* Public prototypes */ >@@ -485,6 +516,20 @@ static int nwrap_files_getgrent_r(struct nwrap_backend *b, > struct group *grdst, char *buf, > size_t buflen, struct group **grdstp); > static void nwrap_files_endgrent(struct nwrap_backend *b); >+static struct hostent *nwrap_files_gethostbyaddr(struct nwrap_backend *b, >+ const void *addr, >+ socklen_t len, int type); >+static struct hostent *nwrap_files_gethostbyname(struct nwrap_backend *b, >+ const char *name); >+#ifdef HAVE_GETHOSTBYNAME2 >+static struct hostent *nwrap_files_gethostbyname2(struct nwrap_backend *b, >+ const char *name, int af); >+#endif /* HAVE_GETHOSTBYNAME2 */ >+static int nwrap_files_gethostbyname2_r(struct nwrap_backend *b, >+ const char *name, int af, >+ struct hostent *hedst, >+ char *buf, size_t buflen, >+ struct hostent **hedstp); > > /* prototypes for module backend */ > >@@ -522,6 +567,18 @@ static void nwrap_module_setgrent(struct nwrap_backend *b); > static void nwrap_module_endgrent(struct nwrap_backend *b); > static int nwrap_module_initgroups(struct nwrap_backend *b, > const char *user, gid_t group); >+static struct hostent *nwrap_module_gethostbyaddr(struct nwrap_backend *b, >+ const void *addr, >+ socklen_t len, int type); >+static struct hostent *nwrap_module_gethostbyname(struct nwrap_backend *b, >+ const char *name); >+static struct hostent *nwrap_module_gethostbyname2(struct nwrap_backend *b, >+ const char *name, int af); >+static int nwrap_module_gethostbyname2_r(struct nwrap_backend *b, >+ const char *name, int af, >+ struct hostent *hedst, >+ char *buf, size_t buflen, >+ struct hostent **hedstp); > > struct nwrap_ops nwrap_files_ops = { > .nw_getpwnam = nwrap_files_getpwnam, >@@ -541,6 +598,12 @@ struct nwrap_ops nwrap_files_ops = { > .nw_getgrent = nwrap_files_getgrent, > .nw_getgrent_r = nwrap_files_getgrent_r, > .nw_endgrent = nwrap_files_endgrent, >+ .nw_gethostbyaddr = nwrap_files_gethostbyaddr, >+ .nw_gethostbyname = nwrap_files_gethostbyname, >+#ifdef HAVE_GETHOSTBYNAME2 >+ .nw_gethostbyname2 = nwrap_files_gethostbyname2, >+#endif /* HAVE_GETHOSTBYNAME2 */ >+ .nw_gethostbyname2_r = nwrap_files_gethostbyname2_r, > }; > > struct nwrap_ops nwrap_module_ops = { >@@ -561,6 +624,10 @@ struct nwrap_ops nwrap_module_ops = { > .nw_getgrent = nwrap_module_getgrent, > .nw_getgrent_r = nwrap_module_getgrent_r, > .nw_endgrent = nwrap_module_endgrent, >+ .nw_gethostbyaddr = nwrap_module_gethostbyaddr, >+ .nw_gethostbyname = nwrap_module_gethostbyname, >+ .nw_gethostbyname2 = nwrap_module_gethostbyname2, >+ .nw_gethostbyname2_r = nwrap_module_gethostbyname2_r, > }; > > struct nwrap_libc { >@@ -571,7 +638,7 @@ struct nwrap_libc { > }; > > struct nwrap_main { >- int num_backends; >+ size_t num_backends; > struct nwrap_backend *backends; > struct nwrap_libc *libc; > }; >@@ -1318,6 +1385,27 @@ static struct hostent *libc_gethostbyname2(const char *name, int af) > } > #endif > >+#ifdef HAVE_GETHOSTBYNAME2_R /* GNU extension */ >+static int libc_gethostbyname2_r(const char *name, >+ int af, >+ struct hostent *ret, >+ char *buf, >+ size_t buflen, >+ struct hostent **result, >+ int *h_errnop) >+{ >+ nwrap_load_lib_function(NWRAP_LIBNSL, gethostbyname2_r); >+ >+ return nwrap_main_global->libc->fns->_libc_gethostbyname2_r(name, >+ af, >+ ret, >+ buf, >+ buflen, >+ result, >+ h_errnop); >+} >+#endif >+ > static struct hostent *libc_gethostbyaddr(const void *addr, > socklen_t len, > int type) >@@ -1417,22 +1505,24 @@ static int libc_getnameinfo(const struct sockaddr *sa, > static void *nwrap_load_module_fn(struct nwrap_backend *b, > const char *fn_name) > { >- void *res; >- char *s; >+ void *res = NULL; >+ char *s = NULL; >+ int rc; > >- if (!b->so_handle) { >+ if (b->so_handle == NULL) { > NWRAP_LOG(NWRAP_LOG_ERROR, "No handle"); > return NULL; > } > >- if (asprintf(&s, "_nss_%s_%s", b->name, fn_name) == -1) { >+ rc = asprintf(&s, "_nss_%s_%s", b->name, fn_name); >+ if (rc == -1) { > NWRAP_LOG(NWRAP_LOG_ERROR, "Out of memory"); > return NULL; > } > > res = dlsym(b->so_handle, s); >- if (!res) { >- NWRAP_LOG(NWRAP_LOG_ERROR, >+ if (res == NULL) { >+ NWRAP_LOG(NWRAP_LOG_WARN, > "Cannot find function %s in %s", > s, b->so_path); > } >@@ -1475,6 +1565,10 @@ static struct nwrap_module_nss_fns *nwrap_load_module_fns(struct nwrap_backend * > nwrap_load_module_fn(b, "getgrent_r"); > *(void **)(&fns->_nss_endgrent) = > nwrap_load_module_fn(b, "endgrent"); >+ *(void **)(&fns->_nss_gethostbyaddr_r) = >+ nwrap_load_module_fn(b, "gethostbyaddr_r"); >+ *(void **)(&fns->_nss_gethostbyname2_r) = >+ nwrap_load_module_fn(b, "gethostbyname2_r"); > > return fns; > } >@@ -1501,7 +1595,7 @@ static void *nwrap_load_module(const char *so_path) > static bool nwrap_module_init(const char *name, > struct nwrap_ops *ops, > const char *so_path, >- int *num_backends, >+ size_t *num_backends, > struct nwrap_backend **backends) > { > struct nwrap_backend *b; >@@ -3513,9 +3607,9 @@ static void nwrap_files_endgrent(struct nwrap_backend *b) > } > > /* hosts functions */ >-static int nwrap_files_gethostbyname(const char *name, int af, >- struct hostent *result, >- struct nwrap_vector *addr_list) >+static int nwrap_files_internal_gethostbyname(const char *name, int af, >+ struct hostent *result, >+ struct nwrap_vector *addr_list) > { > struct nwrap_entlist *el; > struct hostent *he; >@@ -3527,6 +3621,12 @@ static int nwrap_files_gethostbyname(const char *name, int af, > bool he_found = false; > bool ok; > >+ /* >+ * We need to make sure we have zeroed return pointer for consumers >+ * which don't check return values, e.g. OpenLDAP. >+ */ >+ ZERO_STRUCTP(result); >+ > ok = nwrap_files_cache_reload(nwrap_he_global.cache); > if (!ok) { > NWRAP_LOG(NWRAP_LOG_ERROR, "error loading hosts file"); >@@ -3611,19 +3711,30 @@ no_ent: > return -1; > } > >-#ifdef HAVE_GETHOSTBYNAME_R >-static int nwrap_gethostbyname_r(const char *name, >- struct hostent *ret, >- char *buf, size_t buflen, >- struct hostent **result, int *h_errnop) >+static int nwrap_files_gethostbyname2_r(struct nwrap_backend *b, >+ const char *name, int af, >+ struct hostent *hedst, >+ char *buf, size_t buflen, >+ struct hostent **hedstp) > { >- struct nwrap_vector *addr_list = malloc(sizeof(struct nwrap_vector)); >+ struct nwrap_vector *addr_list = NULL; > union { > char *ptr; > char **list; > } g; > int rc; > >+ (void) b; /* unused */ >+ (void) af; /* unused */ >+ >+ if (name == NULL || hedst == NULL || buf == NULL || buflen == 0) { >+ errno = EINVAL; >+ return -1; >+ } >+ *hedstp = NULL; >+ buf[0] = '\0'; >+ >+ addr_list = calloc(1, sizeof(struct nwrap_vector)); > if (addr_list == NULL) { > NWRAP_LOG(NWRAP_LOG_ERROR, > "Unable to allocate memory for address list"); >@@ -3631,20 +3742,17 @@ static int nwrap_gethostbyname_r(const char *name, > return -1; > } > >- ZERO_STRUCTP(addr_list); >- >- rc = nwrap_files_gethostbyname(name, AF_UNSPEC, ret, addr_list); >+ rc = nwrap_files_internal_gethostbyname(name, af, hedst, >+ addr_list); > if (rc == -1) { >- *h_errnop = h_errno; >- if (addr_list->items != NULL) { >- free(addr_list->items); >- } >+ SAFE_FREE(addr_list->items); > SAFE_FREE(addr_list); > errno = ENOENT; > return -1; > } > >- if (buflen < (addr_list->count * sizeof(void *))) { >+ /* +1 i for ending NULL pointer */ >+ if (buflen < ((addr_list->count + 1) * sizeof(void *))) { > SAFE_FREE(addr_list->items); > SAFE_FREE(addr_list); > return ERANGE; >@@ -3655,15 +3763,38 @@ static int nwrap_gethostbyname_r(const char *name, > * +1 is for ending NULL pointer. */ > memcpy(buf, addr_list->items, (addr_list->count + 1) * sizeof(void *)); > >- free(addr_list->items); >- free(addr_list); >+ SAFE_FREE(addr_list->items); >+ SAFE_FREE(addr_list); > > g.ptr = buf; >- ret->h_addr_list = g.list; >- *result = ret; >+ hedst->h_addr_list = g.list; >+ *hedstp = hedst; > return 0; > } > >+#ifdef HAVE_GETHOSTBYNAME_R >+static int nwrap_gethostbyname_r(const char *name, >+ struct hostent *ret, >+ char *buf, size_t buflen, >+ struct hostent **result, int *h_errnop) >+{ >+ int rc; >+ size_t i; >+ >+ for (i=0; i < nwrap_main_global->num_backends; i++) { >+ struct nwrap_backend *b = &nwrap_main_global->backends[i]; >+ rc = b->ops->nw_gethostbyname2_r(b, name, AF_UNSPEC, ret, >+ buf, buflen, result); >+ if (rc == 0) { >+ return 0; >+ } else if (rc == ERANGE) { >+ return ERANGE; >+ } >+ } >+ *h_errnop = h_errno; >+ return ENOENT; >+} >+ > int gethostbyname_r(const char *name, > struct hostent *ret, > char *buf, size_t buflen, >@@ -3682,6 +3813,44 @@ int gethostbyname_r(const char *name, > } > #endif > >+#ifdef HAVE_GETHOSTBYNAME2_R >+static int nwrap_gethostbyname2_r(const char *name, int af, >+ struct hostent *ret, >+ char *buf, size_t buflen, >+ struct hostent **result, int *h_errnop) >+{ >+ int rc; >+ size_t i; >+ >+ for (i=0; i < nwrap_main_global->num_backends; i++) { >+ struct nwrap_backend *b = &nwrap_main_global->backends[i]; >+ rc = b->ops->nw_gethostbyname2_r(b, name, af, ret, >+ buf, buflen, result); >+ if (rc == 0) { >+ return 0; >+ } else if (rc == ERANGE) { >+ return ERANGE; >+ } >+ } >+ *h_errnop = h_errno; >+ return ENOENT; >+} >+ >+int gethostbyname2_r(const char *name, int af, >+ struct hostent *ret, >+ char *buf, size_t buflen, >+ struct hostent **result, int *h_errnop) >+{ >+ if (!nss_wrapper_hosts_enabled()) { >+ return libc_gethostbyname2_r(name, af, ret, buf, buflen, >+ result, h_errnop); >+ } >+ >+ return nwrap_gethostbyname2_r(name, af, ret, buf, buflen, result, >+ h_errnop); >+} >+#endif >+ > static int nwrap_files_getaddrinfo(const char *name, > unsigned short port, > const struct addrinfo *hints, >@@ -3785,7 +3954,8 @@ static int nwrap_files_getaddrinfo(const char *name, > return rc; > } > >-static struct hostent *nwrap_files_gethostbyaddr(const void *addr, >+static struct hostent *nwrap_files_gethostbyaddr(struct nwrap_backend *b, >+ const void *addr, > socklen_t len, int type) > { > struct hostent *he; >@@ -3795,6 +3965,7 @@ static struct hostent *nwrap_files_gethostbyaddr(const void *addr, > size_t i; > bool ok; > >+ (void) b; /* unused */ > (void) len; /* unused */ > > ok = nwrap_files_cache_reload(nwrap_he_global.cache); >@@ -3831,15 +4002,23 @@ static int nwrap_gethostbyaddr_r(const void *addr, socklen_t len, int type, > char *buf, size_t buflen, > struct hostent **result, int *h_errnop) > { >- *result = nwrap_files_gethostbyaddr(addr, len, type); >+ size_t i; >+ for (i=0; i < nwrap_main_global->num_backends; i++) { >+ struct nwrap_backend *b = &nwrap_main_global->backends[i]; >+ *result = b->ops->nw_gethostbyaddr(b, addr, len, type); >+ if (*result != NULL) { >+ break; >+ } >+ } >+ > if (*result != NULL) { > memset(buf, '\0', buflen); > *ret = **result; > return 0; >- } else { >- *h_errnop = h_errno; >- return -1; > } >+ >+ *h_errnop = h_errno; >+ return -1; > } > > int gethostbyaddr_r(const void *addr, socklen_t len, int type, >@@ -4336,13 +4515,189 @@ static void nwrap_module_endgrent(struct nwrap_backend *b) > b->fns->_nss_endgrent(); > } > >+static struct hostent *nwrap_module_gethostbyaddr(struct nwrap_backend *b, >+ const void *addr, >+ socklen_t len, int type) >+{ >+ static struct hostent he; >+ static char *buf = NULL; >+ static size_t buflen = 1000; >+ NSS_STATUS status; >+ >+ if (b->fns->_nss_gethostbyaddr_r == NULL) { >+ return NULL; >+ } >+ >+ if (buf == NULL) { >+ buf = (char *)malloc(buflen); >+ if (buf == NULL) { >+ return NULL; >+ } >+ } >+again: >+ status = b->fns->_nss_gethostbyaddr_r(addr, len, type, &he, >+ buf, buflen, &errno, &h_errno); >+ if (status == NSS_STATUS_TRYAGAIN) { >+ char *p = NULL; >+ >+ buflen *= 2; >+ p = (char *)realloc(buf, buflen); >+ if (p == NULL) { >+ SAFE_FREE(buf); >+ return NULL; >+ } >+ buf = p; >+ goto again; >+ } >+ if (status == NSS_STATUS_NOTFOUND) { >+ SAFE_FREE(buf); >+ return NULL; >+ } >+ if (status != NSS_STATUS_SUCCESS) { >+ SAFE_FREE(buf); >+ return NULL; >+ } >+ >+ return &he; >+} >+ >+static int nwrap_module_gethostbyname2_r(struct nwrap_backend *b, >+ const char *name, int af, >+ struct hostent *hedst, >+ char *buf, size_t buflen, >+ struct hostent **hedstp) >+{ >+ NSS_STATUS status; >+ >+ *hedstp = NULL; >+ >+ if (b->fns->_nss_gethostbyname2_r == NULL) { >+ return ENOENT; >+ } >+ >+ status = b->fns->_nss_gethostbyname2_r(name, af, hedst, >+ buf, buflen, &errno, &h_errno); >+ switch (status) { >+ case NSS_STATUS_SUCCESS: >+ *hedstp = hedst; >+ return 0; >+ case NSS_STATUS_NOTFOUND: >+ if (errno != 0) { >+ return errno; >+ } >+ return ENOENT; >+ case NSS_STATUS_TRYAGAIN: >+ if (errno != 0) { >+ return errno; >+ } >+ return ERANGE; >+ default: >+ if (errno != 0) { >+ return errno; >+ } >+ return status; >+ } >+} >+ >+static struct hostent *nwrap_module_gethostbyname(struct nwrap_backend *b, >+ const char *name) >+{ >+ static struct hostent he; >+ static char *buf = NULL; >+ static size_t buflen = 1000; >+ NSS_STATUS status; >+ >+ if (b->fns->_nss_gethostbyname2_r == NULL) { >+ return NULL; >+ } >+ >+ if (buf == NULL) { >+ buf = (char *)malloc(buflen); >+ if (buf == NULL) { >+ return NULL; >+ } >+ } >+ >+again: >+ status = b->fns->_nss_gethostbyname2_r(name, AF_UNSPEC, &he, >+ buf, buflen, &errno, &h_errno); >+ if (status == NSS_STATUS_TRYAGAIN) { >+ char *p = NULL; >+ >+ buflen *= 2; >+ p = (char *)realloc(buf, buflen); >+ if (p == NULL) { >+ SAFE_FREE(buf); >+ return NULL; >+ } >+ buf = p; >+ goto again; >+ } >+ if (status == NSS_STATUS_NOTFOUND) { >+ SAFE_FREE(buf); >+ return NULL; >+ } >+ if (status != NSS_STATUS_SUCCESS) { >+ SAFE_FREE(buf); >+ return NULL; >+ } >+ >+ return &he; >+} >+ >+static struct hostent *nwrap_module_gethostbyname2(struct nwrap_backend *b, >+ const char *name, int af) >+{ >+ static struct hostent he; >+ static char *buf = NULL; >+ static size_t buflen = 1000; >+ NSS_STATUS status; >+ >+ if (b->fns->_nss_gethostbyname2_r == NULL) { >+ return NULL; >+ } >+ >+ if (buf == NULL) { >+ buf = (char *)malloc(buflen); >+ if (buf == NULL) { >+ return NULL; >+ } >+ } >+ >+again: >+ status = b->fns->_nss_gethostbyname2_r(name, af, &he, >+ buf, buflen, &errno, &h_errno); >+ if (status == NSS_STATUS_TRYAGAIN) { >+ char *p = NULL; >+ >+ buflen *= 2; >+ p = (char *)realloc(buf, buflen); >+ if (p == NULL) { >+ SAFE_FREE(buf); >+ return NULL; >+ } >+ buf = p; >+ goto again; >+ } >+ if (status == NSS_STATUS_NOTFOUND) { >+ SAFE_FREE(buf); >+ return NULL; >+ } >+ if (status != NSS_STATUS_SUCCESS) { >+ SAFE_FREE(buf); >+ return NULL; >+ } >+ >+ return &he; >+} >+ > /**************************************************************************** > * GETPWNAM > ***************************************************************************/ > > static struct passwd *nwrap_getpwnam(const char *name) > { >- int i; >+ size_t i; > struct passwd *pwd; > > for (i=0; i < nwrap_main_global->num_backends; i++) { >@@ -4372,7 +4727,8 @@ struct passwd *getpwnam(const char *name) > static int nwrap_getpwnam_r(const char *name, struct passwd *pwdst, > char *buf, size_t buflen, struct passwd **pwdstp) > { >- int i,ret; >+ size_t i; >+ int ret; > > for (i=0; i < nwrap_main_global->num_backends; i++) { > struct nwrap_backend *b = &nwrap_main_global->backends[i]; >@@ -4409,7 +4765,7 @@ int getpwnam_r(const char *name, struct passwd *pwdst, > > static struct passwd *nwrap_getpwuid(uid_t uid) > { >- int i; >+ size_t i; > struct passwd *pwd; > > for (i=0; i < nwrap_main_global->num_backends; i++) { >@@ -4439,7 +4795,8 @@ struct passwd *getpwuid(uid_t uid) > static int nwrap_getpwuid_r(uid_t uid, struct passwd *pwdst, > char *buf, size_t buflen, struct passwd **pwdstp) > { >- int i,ret; >+ size_t i; >+ int ret; > > for (i=0; i < nwrap_main_global->num_backends; i++) { > struct nwrap_backend *b = &nwrap_main_global->backends[i]; >@@ -4474,7 +4831,7 @@ int getpwuid_r(uid_t uid, struct passwd *pwdst, > > static void nwrap_setpwent(void) > { >- int i; >+ size_t i; > > for (i=0; i < nwrap_main_global->num_backends; i++) { > struct nwrap_backend *b = &nwrap_main_global->backends[i]; >@@ -4498,7 +4855,7 @@ void setpwent(void) > > static struct passwd *nwrap_getpwent(void) > { >- int i; >+ size_t i; > struct passwd *pwd; > > for (i=0; i < nwrap_main_global->num_backends; i++) { >@@ -4529,7 +4886,8 @@ struct passwd *getpwent(void) > static int nwrap_getpwent_r(struct passwd *pwdst, char *buf, > size_t buflen, struct passwd **pwdstp) > { >- int i,ret; >+ size_t i; >+ int ret; > > for (i=0; i < nwrap_main_global->num_backends; i++) { > struct nwrap_backend *b = &nwrap_main_global->backends[i]; >@@ -4578,7 +4936,7 @@ int getpwent_r(struct passwd *pwdst, char *buf, > > static void nwrap_endpwent(void) > { >- int i; >+ size_t i; > > for (i=0; i < nwrap_main_global->num_backends; i++) { > struct nwrap_backend *b = &nwrap_main_global->backends[i]; >@@ -4602,7 +4960,7 @@ void endpwent(void) > > static int nwrap_initgroups(const char *user, gid_t group) > { >- int i; >+ size_t i; > > for (i=0; i < nwrap_main_global->num_backends; i++) { > struct nwrap_backend *b = &nwrap_main_global->backends[i]; >@@ -4633,7 +4991,7 @@ int initgroups(const char *user, gid_t group) > > static struct group *nwrap_getgrnam(const char *name) > { >- int i; >+ size_t i; > struct group *grp; > > for (i=0; i < nwrap_main_global->num_backends; i++) { >@@ -4663,7 +5021,8 @@ struct group *getgrnam(const char *name) > static int nwrap_getgrnam_r(const char *name, struct group *grdst, > char *buf, size_t buflen, struct group **grdstp) > { >- int i, ret; >+ size_t i; >+ int ret; > > for (i=0; i < nwrap_main_global->num_backends; i++) { > struct nwrap_backend *b = &nwrap_main_global->backends[i]; >@@ -4704,7 +5063,7 @@ int getgrnam_r(const char *name, struct group *grp, > > static struct group *nwrap_getgrgid(gid_t gid) > { >- int i; >+ size_t i; > struct group *grp; > > for (i=0; i < nwrap_main_global->num_backends; i++) { >@@ -4734,7 +5093,8 @@ struct group *getgrgid(gid_t gid) > static int nwrap_getgrgid_r(gid_t gid, struct group *grdst, > char *buf, size_t buflen, struct group **grdstp) > { >- int i,ret; >+ size_t i; >+ int ret; > > for (i=0; i < nwrap_main_global->num_backends; i++) { > struct nwrap_backend *b = &nwrap_main_global->backends[i]; >@@ -4771,7 +5131,7 @@ int getgrgid_r(gid_t gid, struct group *grdst, > > static void nwrap_setgrent(void) > { >- int i; >+ size_t i; > > for (i=0; i < nwrap_main_global->num_backends; i++) { > struct nwrap_backend *b = &nwrap_main_global->backends[i]; >@@ -4806,7 +5166,7 @@ out: > > static struct group *nwrap_getgrent(void) > { >- int i; >+ size_t i; > struct group *grp; > > for (i=0; i < nwrap_main_global->num_backends; i++) { >@@ -4837,7 +5197,8 @@ struct group *getgrent(void) > static int nwrap_getgrent_r(struct group *grdst, char *buf, > size_t buflen, struct group **grdstp) > { >- int i,ret; >+ size_t i; >+ int ret; > > for (i=0; i < nwrap_main_global->num_backends; i++) { > struct nwrap_backend *b = &nwrap_main_global->backends[i]; >@@ -4887,7 +5248,7 @@ int getgrent_r(struct group *src, char *buf, > > static void nwrap_endgrent(void) > { >- int i; >+ size_t i; > > for (i=0; i < nwrap_main_global->num_backends; i++) { > struct nwrap_backend *b = &nwrap_main_global->backends[i]; >@@ -5129,6 +5490,7 @@ void endhostent(void) > } > #endif /* HAVE_SOLARIS_ENDHOSTENT */ > >+ > #ifdef BSD > /* BSD implementation stores data in thread local storage but GLIBC does not */ > static __thread struct hostent user_he; >@@ -5137,12 +5499,37 @@ static __thread struct nwrap_vector user_addrlist; > static struct hostent user_he; > static struct nwrap_vector user_addrlist; > #endif /* BSD */ >+ >+static struct hostent *nwrap_files_gethostbyname(struct nwrap_backend *b, >+ const char *name) >+{ >+ int ret; >+ >+ (void) b; /* unused */ >+ >+ ret = nwrap_files_internal_gethostbyname(name, AF_UNSPEC, &user_he, >+ &user_addrlist); >+ if (ret == 0) { >+ return &user_he; >+ } >+ >+ return NULL; >+} >+ > static struct hostent *nwrap_gethostbyname(const char *name) > { >- if (nwrap_files_gethostbyname(name, AF_UNSPEC, &user_he, &user_addrlist) == -1) { >- return NULL; >+ size_t i; >+ struct hostent *he = NULL; >+ >+ for (i=0; i < nwrap_main_global->num_backends; i++) { >+ struct nwrap_backend *b = &nwrap_main_global->backends[i]; >+ he = b->ops->nw_gethostbyname(b, name); >+ if (he != NULL) { >+ return he; >+ } > } >- return &user_he; >+ >+ return NULL; > } > > struct hostent *gethostbyname(const char *name) >@@ -5164,12 +5551,37 @@ static __thread struct nwrap_vector user_addrlist2; > static struct hostent user_he2; > static struct nwrap_vector user_addrlist2; > #endif /* BSD */ >+ >+static struct hostent *nwrap_files_gethostbyname2(struct nwrap_backend *b, >+ const char *name, int af) >+{ >+ int ret; >+ >+ (void) b; /* unused */ >+ >+ ret = nwrap_files_internal_gethostbyname(name, af, &user_he2, >+ &user_addrlist2); >+ if (ret == 0) { >+ return &user_he2; >+ } >+ >+ return NULL; >+} >+ > static struct hostent *nwrap_gethostbyname2(const char *name, int af) > { >- if (nwrap_files_gethostbyname(name, af, &user_he2, &user_addrlist2) == -1) { >- return NULL; >+ size_t i; >+ struct hostent *he = NULL; >+ >+ for (i=0; i < nwrap_main_global->num_backends; i++) { >+ struct nwrap_backend *b = &nwrap_main_global->backends[i]; >+ he = b->ops->nw_gethostbyname2(b, name, af); >+ if (he != NULL) { >+ return he; >+ } > } >- return &user_he2; >+ >+ return NULL; > } > > struct hostent *gethostbyname2(const char *name, int af) >@@ -5185,7 +5597,18 @@ struct hostent *gethostbyname2(const char *name, int af) > static struct hostent *nwrap_gethostbyaddr(const void *addr, > socklen_t len, int type) > { >- return nwrap_files_gethostbyaddr(addr, len, type); >+ size_t i; >+ struct hostent *he = NULL; >+ >+ for (i=0; i < nwrap_main_global->num_backends; i++) { >+ struct nwrap_backend *b = &nwrap_main_global->backends[i]; >+ he = b->ops->nw_gethostbyaddr(b, addr, len, type); >+ if (he != NULL) { >+ return he; >+ } >+ } >+ >+ return NULL; > } > > struct hostent *gethostbyaddr(const void *addr, >@@ -5531,6 +5954,7 @@ static int nwrap_getnameinfo(const struct sockaddr *sa, socklen_t salen, > socklen_t addrlen; > uint16_t port; > sa_family_t type; >+ size_t i; > > if (sa == NULL || salen < sizeof(sa_family_t)) { > return EAI_FAMILY; >@@ -5585,7 +6009,13 @@ static int nwrap_getnameinfo(const struct sockaddr *sa, socklen_t salen, > if (host != NULL) { > he = NULL; > if ((flags & NI_NUMERICHOST) == 0) { >- he = nwrap_files_gethostbyaddr(addr, addrlen, type); >+ for (i=0; i < nwrap_main_global->num_backends; i++) { >+ struct nwrap_backend *b = &nwrap_main_global->backends[i]; >+ he = b->ops->nw_gethostbyaddr(b, addr, addrlen, type); >+ if (he != NULL) { >+ break; >+ } >+ } > if ((flags & NI_NAMEREQD) && (he == NULL || he->h_name == NULL)) > return EAI_NONAME; > } >@@ -5698,7 +6128,7 @@ void nwrap_constructor(void) > */ > void nwrap_destructor(void) > { >- int i; >+ size_t i; > > NWRAP_LOCK_ALL; > if (nwrap_main_global != NULL) { >diff --git a/third_party/nss_wrapper/wscript b/third_party/nss_wrapper/wscript >index dd83083b2e7..1f6e705ee07 100644 >--- a/third_party/nss_wrapper/wscript >+++ b/third_party/nss_wrapper/wscript >@@ -2,7 +2,7 @@ > > import os > >-VERSION="1.1.7" >+VERSION="1.1.10" > > def configure(conf): > if conf.CHECK_NSS_WRAPPER(): >@@ -28,6 +28,7 @@ def configure(conf): > msg='Checking for printf format validation support') > > conf.CHECK_FUNCS('gethostbyaddr_r gethostbyname_r') >+ conf.CHECK_FUNCS('gethostbyname2 gethostbyname2_r') > # Solaris > conf.CHECK_FUNCS('__posix_getpwnam_r __posix_getpwuid_r') > conf.CHECK_FUNCS('__posix_getgrgid_r __posix_getgrnam_r') >-- >2.25.1 > > >From e8fd17d4285019b8fd7ed48c82e52dd49101ce4c Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Thu, 19 Mar 2020 10:23:02 +0100 >Subject: [PATCH 007/380] gitlab-ci: Remove Fedora 29 which is already EOL > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 087566641e32821ea3cae0d23bd70a5602581b53) >--- > .gitlab-ci.yml | 7 +- > bootstrap/.gitlab-ci.yml | 3 - > bootstrap/config.py | 9 -- > bootstrap/generated-dists/Vagrantfile | 7 -- > bootstrap/generated-dists/fedora29/Dockerfile | 27 ----- > .../generated-dists/fedora29/bootstrap.sh | 108 ------------------ > bootstrap/generated-dists/fedora29/locale.sh | 55 --------- > .../generated-dists/fedora29/packages.yml | 95 --------------- > bootstrap/sha1sum.txt | 2 +- > 9 files changed, 2 insertions(+), 311 deletions(-) > delete mode 100644 bootstrap/generated-dists/fedora29/Dockerfile > delete mode 100755 bootstrap/generated-dists/fedora29/bootstrap.sh > delete mode 100755 bootstrap/generated-dists/fedora29/locale.sh > delete mode 100644 bootstrap/generated-dists/fedora29/packages.yml > >diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml >index 8becacb8d4e..1d89dda5045 100644 >--- a/.gitlab-ci.yml >+++ b/.gitlab-ci.yml >@@ -22,7 +22,7 @@ variables: > # Set this to the contents of bootstrap/sha1sum.txt > # which is generated by bootstrap/template.py --render > # >- SAMBA_CI_CONTAINER_TAG: 6bb2eeaf8203467d9a93a722071b0f081027410e >+ SAMBA_CI_CONTAINER_TAG: 2366db8ea66e6a07f36b77c0f3152a06e7056adc > # > # We use the ubuntu1804 image as default as > # it matches what we have on sn-devel-184. >@@ -39,7 +39,6 @@ variables: > SAMBA_CI_CONTAINER_IMAGE_debian10: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-debian10:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_opensuse150: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-opensuse150:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_opensuse151: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-opensuse151:${SAMBA_CI_CONTAINER_TAG} >- SAMBA_CI_CONTAINER_IMAGE_fedora29: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora29:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_fedora30: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora30:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_fedora31: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora31:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_centos7: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-centos7:${SAMBA_CI_CONTAINER_TAG} >@@ -303,10 +302,6 @@ centos8-samba-o3: > extends: .samba-o3-template > image: $SAMBA_CI_CONTAINER_IMAGE_centos8 > >-fedora29-samba-o3: >- extends: .samba-o3-template >- image: $SAMBA_CI_CONTAINER_IMAGE_fedora29 >- > fedora30-samba-o3: > extends: .samba-o3-template > image: $SAMBA_CI_CONTAINER_IMAGE_fedora30 >diff --git a/bootstrap/.gitlab-ci.yml b/bootstrap/.gitlab-ci.yml >index ecd9f4d4223..c4c8599ef3d 100644 >--- a/bootstrap/.gitlab-ci.yml >+++ b/bootstrap/.gitlab-ci.yml >@@ -102,9 +102,6 @@ fedora31: > fedora30: > extends: .build_image_template > >-fedora29: >- extends: .build_image_template >- > centos8: > extends: .build_image_template > >diff --git a/bootstrap/config.py b/bootstrap/config.py >index ff9bb150672..36a19a1e6cf 100644 >--- a/bootstrap/config.py >+++ b/bootstrap/config.py >@@ -453,15 +453,6 @@ RPM_DISTS = { > 'liburing-devel': '', # not available yet, Add me back, once available! > } > }, >- 'fedora29': { >- 'docker_image': 'fedora:29', >- 'vagrant_box': 'fedora/29-cloud-base', >- 'bootstrap': DNF_BOOTSTRAP, >- 'replace': { >- 'lsb-release': 'redhat-lsb', >- 'liburing-devel': '', # not available >- } >- }, > 'fedora30': { > 'docker_image': 'fedora:30', > 'vagrant_box': 'fedora/30-cloud-base', >diff --git a/bootstrap/generated-dists/Vagrantfile b/bootstrap/generated-dists/Vagrantfile >index 47c58d5a87b..2daf1dde552 100644 >--- a/bootstrap/generated-dists/Vagrantfile >+++ b/bootstrap/generated-dists/Vagrantfile >@@ -31,13 +31,6 @@ Vagrant.configure("2") do |config| > v.vm.provision :shell, path: "debian10/locale.sh" > end > >- config.vm.define "fedora29" do |v| >- v.vm.box = "fedora/29-cloud-base" >- v.vm.hostname = "fedora29" >- v.vm.provision :shell, path: "fedora29/bootstrap.sh" >- v.vm.provision :shell, path: "fedora29/locale.sh" >- end >- > config.vm.define "fedora30" do |v| > v.vm.box = "fedora/30-cloud-base" > v.vm.hostname = "fedora30" >diff --git a/bootstrap/generated-dists/fedora29/Dockerfile b/bootstrap/generated-dists/fedora29/Dockerfile >deleted file mode 100644 >index 268c79da161..00000000000 >--- a/bootstrap/generated-dists/fedora29/Dockerfile >+++ /dev/null >@@ -1,27 +0,0 @@ >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-FROM fedora:29 >- >-# pass in with --build-arg while build >-ARG SHA1SUM >-RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt >- >-ADD *.sh /tmp/ >-# need root permission, do it before USER samba >-RUN /tmp/bootstrap.sh && /tmp/locale.sh >- >-# if ld.gold exists, force link it to ld >-RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD" >- >-# make test can not work with root, so we have to create a new user >-RUN useradd -m -U -s /bin/bash samba && \ >- mkdir -p /etc/sudoers.d && \ >- echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba >- >-USER samba >-WORKDIR /home/samba >-# samba tests rely on this >-ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8 >\ No newline at end of file >diff --git a/bootstrap/generated-dists/fedora29/bootstrap.sh b/bootstrap/generated-dists/fedora29/bootstrap.sh >deleted file mode 100755 >index effe2a9d214..00000000000 >--- a/bootstrap/generated-dists/fedora29/bootstrap.sh >+++ /dev/null >@@ -1,108 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-dnf update -y >- >-dnf install -y \ >- --setopt=install_weak_deps=False \ >- @development-tools \ >- acl \ >- attr \ >- autoconf \ >- avahi-devel \ >- bind-utils \ >- binutils \ >- bison \ >- chrpath \ >- cups-devel \ >- curl \ >- dbus-devel \ >- docbook-dtds \ >- docbook-style-xsl \ >- flex \ >- gawk \ >- gcc \ >- gdb \ >- git \ >- glib2-devel \ >- glibc-common \ >- glibc-langpack-en \ >- glusterfs-api-devel \ >- glusterfs-devel \ >- gnutls-devel \ >- gpgme-devel \ >- gzip \ >- hostname \ >- htop \ >- jansson-devel \ >- keyutils-libs-devel \ >- krb5-devel \ >- krb5-server \ >- lcov \ >- libacl-devel \ >- libarchive-devel \ >- libattr-devel \ >- libblkid-devel \ >- libbsd-devel \ >- libcap-devel \ >- libcephfs-devel \ >- libicu-devel \ >- libnsl2-devel \ >- libpcap-devel \ >- libsemanage-python \ >- libtasn1-devel \ >- libtasn1-tools \ >- libtirpc-devel \ >- libunwind-devel \ >- libuuid-devel \ >- libxslt \ >- lmdb \ >- lmdb-devel \ >- make \ >- mingw64-gcc \ >- ncurses-devel \ >- openldap-devel \ >- pam-devel \ >- patch \ >- perl \ >- perl-Archive-Tar \ >- perl-ExtUtils-MakeMaker \ >- perl-JSON-Parse \ >- perl-Parse-Yapp \ >- perl-Test-Base \ >- perl-generators \ >- perl-interpreter \ >- pkgconfig \ >- policycoreutils-python \ >- popt-devel \ >- procps-ng \ >- psmisc \ >- python3 \ >- python3-devel \ >- python3-dns \ >- python3-gpg \ >- python3-markdown \ >- quota-devel \ >- readline-devel \ >- redhat-lsb \ >- rng-tools \ >- rpcgen \ >- rpcsvc-proto-devel \ >- rsync \ >- sed \ >- sudo \ >- systemd-devel \ >- tar \ >- tree \ >- which \ >- xfsprogs-devel \ >- yum-utils \ >- zlib-devel >- >-dnf clean all >\ No newline at end of file >diff --git a/bootstrap/generated-dists/fedora29/locale.sh b/bootstrap/generated-dists/fedora29/locale.sh >deleted file mode 100755 >index cc64e180483..00000000000 >--- a/bootstrap/generated-dists/fedora29/locale.sh >+++ /dev/null >@@ -1,55 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-# refer to /usr/share/i18n/locales >-INPUTFILE=en_US >-# refer to /usr/share/i18n/charmaps >-CHARMAP=UTF-8 >-# locale to generate in /usr/lib/locale >-# glibc/localedef will normalize UTF-8 to utf8, follow the naming style >-LOCALE=$INPUTFILE.utf8 >- >-# if locale is already correct, exit >-( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0 >- >-# if locale not available, generate locale into /usr/lib/locale >-if ! ( locale --all-locales | grep -i $LOCALE ) >-then >- # no-archive means create its own dir >- localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE >-fi >- >-# update locale conf and global env file >-# set both LC_ALL and LANG for safe >- >-# update conf for Debian family >-FILE=/etc/default/locale >-if [ -f $FILE ] >-then >- echo LC_ALL="$LOCALE" > $FILE >- echo LANG="$LOCALE" >> $FILE >-fi >- >-# update conf for RedHat family >-FILE=/etc/locale.conf >-if [ -f $FILE ] >-then >- # LC_ALL is not valid in this file, set LANG only >- echo LANG="$LOCALE" > $FILE >-fi >- >-# update global env file >-FILE=/etc/environment >-if [ -f $FILE ] >-then >- # append LC_ALL if not exist >- grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE >- # append LANG if not exist >- grep LANG $FILE || echo LANG="$LOCALE" >> $FILE >-fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/fedora29/packages.yml b/bootstrap/generated-dists/fedora29/packages.yml >deleted file mode 100644 >index 3b767f8ba08..00000000000 >--- a/bootstrap/generated-dists/fedora29/packages.yml >+++ /dev/null >@@ -1,95 +0,0 @@ >---- >-packages: >- - @development-tools >- - acl >- - attr >- - autoconf >- - avahi-devel >- - bind-utils >- - binutils >- - bison >- - chrpath >- - cups-devel >- - curl >- - dbus-devel >- - docbook-dtds >- - docbook-style-xsl >- - flex >- - gawk >- - gcc >- - gdb >- - git >- - glib2-devel >- - glibc-common >- - glibc-langpack-en >- - glusterfs-api-devel >- - glusterfs-devel >- - gnutls-devel >- - gpgme-devel >- - gzip >- - hostname >- - htop >- - jansson-devel >- - keyutils-libs-devel >- - krb5-devel >- - krb5-server >- - lcov >- - libacl-devel >- - libarchive-devel >- - libattr-devel >- - libblkid-devel >- - libbsd-devel >- - libcap-devel >- - libcephfs-devel >- - libicu-devel >- - libnsl2-devel >- - libpcap-devel >- - libsemanage-python >- - libtasn1-devel >- - libtasn1-tools >- - libtirpc-devel >- - libunwind-devel >- - libuuid-devel >- - libxslt >- - lmdb >- - lmdb-devel >- - make >- - mingw64-gcc >- - ncurses-devel >- - openldap-devel >- - pam-devel >- - patch >- - perl >- - perl-Archive-Tar >- - perl-ExtUtils-MakeMaker >- - perl-JSON-Parse >- - perl-Parse-Yapp >- - perl-Test-Base >- - perl-generators >- - perl-interpreter >- - pkgconfig >- - policycoreutils-python >- - popt-devel >- - procps-ng >- - psmisc >- - python3 >- - python3-devel >- - python3-dns >- - python3-gpg >- - python3-markdown >- - quota-devel >- - readline-devel >- - redhat-lsb >- - rng-tools >- - rpcgen >- - rpcsvc-proto-devel >- - rsync >- - sed >- - sudo >- - systemd-devel >- - tar >- - tree >- - which >- - xfsprogs-devel >- - yum-utils >- - zlib-devel >\ No newline at end of file >diff --git a/bootstrap/sha1sum.txt b/bootstrap/sha1sum.txt >index 1c9d01d5e7d..39f2633892e 100644 >--- a/bootstrap/sha1sum.txt >+++ b/bootstrap/sha1sum.txt >@@ -1 +1 @@ >-6bb2eeaf8203467d9a93a722071b0f081027410e >+2366db8ea66e6a07f36b77c0f3152a06e7056adc >-- >2.25.1 > > >From 5ea7f8cc213d10116331189c47e8ade83753d43d Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Thu, 19 Mar 2020 10:28:23 +0100 >Subject: [PATCH 008/380] gitlab-ci: Remove Fedora 30 > >It is pretty similar to Fedora 31, so remove it safe some CI resources. >We will add Fedora 32 next. > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit ef08b30380093726297529d20b087e64caa58572) >--- > .gitlab-ci.yml | 7 +- > bootstrap/.gitlab-ci.yml | 3 - > bootstrap/config.py | 9 -- > bootstrap/generated-dists/Vagrantfile | 7 -- > bootstrap/generated-dists/fedora30/Dockerfile | 27 ----- > .../generated-dists/fedora30/bootstrap.sh | 108 ------------------ > bootstrap/generated-dists/fedora30/locale.sh | 55 --------- > .../generated-dists/fedora30/packages.yml | 95 --------------- > bootstrap/sha1sum.txt | 2 +- > 9 files changed, 2 insertions(+), 311 deletions(-) > delete mode 100644 bootstrap/generated-dists/fedora30/Dockerfile > delete mode 100755 bootstrap/generated-dists/fedora30/bootstrap.sh > delete mode 100755 bootstrap/generated-dists/fedora30/locale.sh > delete mode 100644 bootstrap/generated-dists/fedora30/packages.yml > >diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml >index 1d89dda5045..a8e1099be11 100644 >--- a/.gitlab-ci.yml >+++ b/.gitlab-ci.yml >@@ -22,7 +22,7 @@ variables: > # Set this to the contents of bootstrap/sha1sum.txt > # which is generated by bootstrap/template.py --render > # >- SAMBA_CI_CONTAINER_TAG: 2366db8ea66e6a07f36b77c0f3152a06e7056adc >+ SAMBA_CI_CONTAINER_TAG: 9f95136e88779ec8eed6c18614b1e0779ef2bfec > # > # We use the ubuntu1804 image as default as > # it matches what we have on sn-devel-184. >@@ -39,7 +39,6 @@ variables: > SAMBA_CI_CONTAINER_IMAGE_debian10: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-debian10:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_opensuse150: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-opensuse150:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_opensuse151: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-opensuse151:${SAMBA_CI_CONTAINER_TAG} >- SAMBA_CI_CONTAINER_IMAGE_fedora30: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora30:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_fedora31: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora31:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_centos7: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-centos7:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_centos8: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-centos8:${SAMBA_CI_CONTAINER_TAG} >@@ -302,10 +301,6 @@ centos8-samba-o3: > extends: .samba-o3-template > image: $SAMBA_CI_CONTAINER_IMAGE_centos8 > >-fedora30-samba-o3: >- extends: .samba-o3-template >- image: $SAMBA_CI_CONTAINER_IMAGE_fedora30 >- > fedora31-samba-o3: > extends: .samba-o3-template > image: $SAMBA_CI_CONTAINER_IMAGE_fedora31 >diff --git a/bootstrap/.gitlab-ci.yml b/bootstrap/.gitlab-ci.yml >index c4c8599ef3d..89c1453a34c 100644 >--- a/bootstrap/.gitlab-ci.yml >+++ b/bootstrap/.gitlab-ci.yml >@@ -99,9 +99,6 @@ debian10: > fedora31: > extends: .build_image_template > >-fedora30: >- extends: .build_image_template >- > centos8: > extends: .build_image_template > >diff --git a/bootstrap/config.py b/bootstrap/config.py >index 36a19a1e6cf..6d4d662d563 100644 >--- a/bootstrap/config.py >+++ b/bootstrap/config.py >@@ -453,15 +453,6 @@ RPM_DISTS = { > 'liburing-devel': '', # not available yet, Add me back, once available! > } > }, >- 'fedora30': { >- 'docker_image': 'fedora:30', >- 'vagrant_box': 'fedora/30-cloud-base', >- 'bootstrap': DNF_BOOTSTRAP, >- 'replace': { >- 'lsb-release': 'redhat-lsb', >- 'liburing-devel': '', # not available >- } >- }, > 'fedora31': { > 'docker_image': 'fedora:31', > 'vagrant_box': 'fedora/31-cloud-base', >diff --git a/bootstrap/generated-dists/Vagrantfile b/bootstrap/generated-dists/Vagrantfile >index 2daf1dde552..770e364c70b 100644 >--- a/bootstrap/generated-dists/Vagrantfile >+++ b/bootstrap/generated-dists/Vagrantfile >@@ -31,13 +31,6 @@ Vagrant.configure("2") do |config| > v.vm.provision :shell, path: "debian10/locale.sh" > end > >- config.vm.define "fedora30" do |v| >- v.vm.box = "fedora/30-cloud-base" >- v.vm.hostname = "fedora30" >- v.vm.provision :shell, path: "fedora30/bootstrap.sh" >- v.vm.provision :shell, path: "fedora30/locale.sh" >- end >- > config.vm.define "fedora31" do |v| > v.vm.box = "fedora/31-cloud-base" > v.vm.hostname = "fedora31" >diff --git a/bootstrap/generated-dists/fedora30/Dockerfile b/bootstrap/generated-dists/fedora30/Dockerfile >deleted file mode 100644 >index f2a2c3546f0..00000000000 >--- a/bootstrap/generated-dists/fedora30/Dockerfile >+++ /dev/null >@@ -1,27 +0,0 @@ >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-FROM fedora:30 >- >-# pass in with --build-arg while build >-ARG SHA1SUM >-RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt >- >-ADD *.sh /tmp/ >-# need root permission, do it before USER samba >-RUN /tmp/bootstrap.sh && /tmp/locale.sh >- >-# if ld.gold exists, force link it to ld >-RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD" >- >-# make test can not work with root, so we have to create a new user >-RUN useradd -m -U -s /bin/bash samba && \ >- mkdir -p /etc/sudoers.d && \ >- echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba >- >-USER samba >-WORKDIR /home/samba >-# samba tests rely on this >-ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8 >\ No newline at end of file >diff --git a/bootstrap/generated-dists/fedora30/bootstrap.sh b/bootstrap/generated-dists/fedora30/bootstrap.sh >deleted file mode 100755 >index effe2a9d214..00000000000 >--- a/bootstrap/generated-dists/fedora30/bootstrap.sh >+++ /dev/null >@@ -1,108 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-dnf update -y >- >-dnf install -y \ >- --setopt=install_weak_deps=False \ >- @development-tools \ >- acl \ >- attr \ >- autoconf \ >- avahi-devel \ >- bind-utils \ >- binutils \ >- bison \ >- chrpath \ >- cups-devel \ >- curl \ >- dbus-devel \ >- docbook-dtds \ >- docbook-style-xsl \ >- flex \ >- gawk \ >- gcc \ >- gdb \ >- git \ >- glib2-devel \ >- glibc-common \ >- glibc-langpack-en \ >- glusterfs-api-devel \ >- glusterfs-devel \ >- gnutls-devel \ >- gpgme-devel \ >- gzip \ >- hostname \ >- htop \ >- jansson-devel \ >- keyutils-libs-devel \ >- krb5-devel \ >- krb5-server \ >- lcov \ >- libacl-devel \ >- libarchive-devel \ >- libattr-devel \ >- libblkid-devel \ >- libbsd-devel \ >- libcap-devel \ >- libcephfs-devel \ >- libicu-devel \ >- libnsl2-devel \ >- libpcap-devel \ >- libsemanage-python \ >- libtasn1-devel \ >- libtasn1-tools \ >- libtirpc-devel \ >- libunwind-devel \ >- libuuid-devel \ >- libxslt \ >- lmdb \ >- lmdb-devel \ >- make \ >- mingw64-gcc \ >- ncurses-devel \ >- openldap-devel \ >- pam-devel \ >- patch \ >- perl \ >- perl-Archive-Tar \ >- perl-ExtUtils-MakeMaker \ >- perl-JSON-Parse \ >- perl-Parse-Yapp \ >- perl-Test-Base \ >- perl-generators \ >- perl-interpreter \ >- pkgconfig \ >- policycoreutils-python \ >- popt-devel \ >- procps-ng \ >- psmisc \ >- python3 \ >- python3-devel \ >- python3-dns \ >- python3-gpg \ >- python3-markdown \ >- quota-devel \ >- readline-devel \ >- redhat-lsb \ >- rng-tools \ >- rpcgen \ >- rpcsvc-proto-devel \ >- rsync \ >- sed \ >- sudo \ >- systemd-devel \ >- tar \ >- tree \ >- which \ >- xfsprogs-devel \ >- yum-utils \ >- zlib-devel >- >-dnf clean all >\ No newline at end of file >diff --git a/bootstrap/generated-dists/fedora30/locale.sh b/bootstrap/generated-dists/fedora30/locale.sh >deleted file mode 100755 >index cc64e180483..00000000000 >--- a/bootstrap/generated-dists/fedora30/locale.sh >+++ /dev/null >@@ -1,55 +0,0 @@ >-#!/bin/bash >- >-# >-# This file is generated by 'bootstrap/template.py --render' >-# See also bootstrap/config.py >-# >- >-set -xueo pipefail >- >-# refer to /usr/share/i18n/locales >-INPUTFILE=en_US >-# refer to /usr/share/i18n/charmaps >-CHARMAP=UTF-8 >-# locale to generate in /usr/lib/locale >-# glibc/localedef will normalize UTF-8 to utf8, follow the naming style >-LOCALE=$INPUTFILE.utf8 >- >-# if locale is already correct, exit >-( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0 >- >-# if locale not available, generate locale into /usr/lib/locale >-if ! ( locale --all-locales | grep -i $LOCALE ) >-then >- # no-archive means create its own dir >- localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE >-fi >- >-# update locale conf and global env file >-# set both LC_ALL and LANG for safe >- >-# update conf for Debian family >-FILE=/etc/default/locale >-if [ -f $FILE ] >-then >- echo LC_ALL="$LOCALE" > $FILE >- echo LANG="$LOCALE" >> $FILE >-fi >- >-# update conf for RedHat family >-FILE=/etc/locale.conf >-if [ -f $FILE ] >-then >- # LC_ALL is not valid in this file, set LANG only >- echo LANG="$LOCALE" > $FILE >-fi >- >-# update global env file >-FILE=/etc/environment >-if [ -f $FILE ] >-then >- # append LC_ALL if not exist >- grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE >- # append LANG if not exist >- grep LANG $FILE || echo LANG="$LOCALE" >> $FILE >-fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/fedora30/packages.yml b/bootstrap/generated-dists/fedora30/packages.yml >deleted file mode 100644 >index 3b767f8ba08..00000000000 >--- a/bootstrap/generated-dists/fedora30/packages.yml >+++ /dev/null >@@ -1,95 +0,0 @@ >---- >-packages: >- - @development-tools >- - acl >- - attr >- - autoconf >- - avahi-devel >- - bind-utils >- - binutils >- - bison >- - chrpath >- - cups-devel >- - curl >- - dbus-devel >- - docbook-dtds >- - docbook-style-xsl >- - flex >- - gawk >- - gcc >- - gdb >- - git >- - glib2-devel >- - glibc-common >- - glibc-langpack-en >- - glusterfs-api-devel >- - glusterfs-devel >- - gnutls-devel >- - gpgme-devel >- - gzip >- - hostname >- - htop >- - jansson-devel >- - keyutils-libs-devel >- - krb5-devel >- - krb5-server >- - lcov >- - libacl-devel >- - libarchive-devel >- - libattr-devel >- - libblkid-devel >- - libbsd-devel >- - libcap-devel >- - libcephfs-devel >- - libicu-devel >- - libnsl2-devel >- - libpcap-devel >- - libsemanage-python >- - libtasn1-devel >- - libtasn1-tools >- - libtirpc-devel >- - libunwind-devel >- - libuuid-devel >- - libxslt >- - lmdb >- - lmdb-devel >- - make >- - mingw64-gcc >- - ncurses-devel >- - openldap-devel >- - pam-devel >- - patch >- - perl >- - perl-Archive-Tar >- - perl-ExtUtils-MakeMaker >- - perl-JSON-Parse >- - perl-Parse-Yapp >- - perl-Test-Base >- - perl-generators >- - perl-interpreter >- - pkgconfig >- - policycoreutils-python >- - popt-devel >- - procps-ng >- - psmisc >- - python3 >- - python3-devel >- - python3-dns >- - python3-gpg >- - python3-markdown >- - quota-devel >- - readline-devel >- - redhat-lsb >- - rng-tools >- - rpcgen >- - rpcsvc-proto-devel >- - rsync >- - sed >- - sudo >- - systemd-devel >- - tar >- - tree >- - which >- - xfsprogs-devel >- - yum-utils >- - zlib-devel >\ No newline at end of file >diff --git a/bootstrap/sha1sum.txt b/bootstrap/sha1sum.txt >index 39f2633892e..ef012315ce1 100644 >--- a/bootstrap/sha1sum.txt >+++ b/bootstrap/sha1sum.txt >@@ -1 +1 @@ >-2366db8ea66e6a07f36b77c0f3152a06e7056adc >+9f95136e88779ec8eed6c18614b1e0779ef2bfec >-- >2.25.1 > > >From 4920e3348df9d2f953289e7e0ddf26d5617fed3b Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Thu, 19 Mar 2020 10:32:17 +0100 >Subject: [PATCH 009/380] gitlab-ci: Add Fedora 32 (Beta) > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> >Autobuild-Date(master): Fri Mar 20 15:19:50 UTC 2020 on sn-devel-184 > >(cherry picked from commit bce99f59332ffd4d817be457ff4b39743e724319) >--- > .gitlab-ci.yml | 7 +- > bootstrap/.gitlab-ci.yml | 3 + > bootstrap/config.py | 10 ++ > bootstrap/generated-dists/Vagrantfile | 7 ++ > bootstrap/generated-dists/fedora32/Dockerfile | 27 +++++ > .../generated-dists/fedora32/bootstrap.sh | 109 ++++++++++++++++++ > bootstrap/generated-dists/fedora32/locale.sh | 55 +++++++++ > .../generated-dists/fedora32/packages.yml | 96 +++++++++++++++ > bootstrap/sha1sum.txt | 2 +- > 9 files changed, 314 insertions(+), 2 deletions(-) > create mode 100644 bootstrap/generated-dists/fedora32/Dockerfile > create mode 100755 bootstrap/generated-dists/fedora32/bootstrap.sh > create mode 100755 bootstrap/generated-dists/fedora32/locale.sh > create mode 100644 bootstrap/generated-dists/fedora32/packages.yml > >diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml >index a8e1099be11..bf05c3cd792 100644 >--- a/.gitlab-ci.yml >+++ b/.gitlab-ci.yml >@@ -22,7 +22,7 @@ variables: > # Set this to the contents of bootstrap/sha1sum.txt > # which is generated by bootstrap/template.py --render > # >- SAMBA_CI_CONTAINER_TAG: 9f95136e88779ec8eed6c18614b1e0779ef2bfec >+ SAMBA_CI_CONTAINER_TAG: 9061307e79ad13733c69352a965eeb4f44bef4b7 > # > # We use the ubuntu1804 image as default as > # it matches what we have on sn-devel-184. >@@ -40,6 +40,7 @@ variables: > SAMBA_CI_CONTAINER_IMAGE_opensuse150: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-opensuse150:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_opensuse151: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-opensuse151:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_fedora31: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora31:${SAMBA_CI_CONTAINER_TAG} >+ SAMBA_CI_CONTAINER_IMAGE_fedora32: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora32:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_centos7: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-centos7:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_centos8: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-centos8:${SAMBA_CI_CONTAINER_TAG} > >@@ -305,6 +306,10 @@ fedora31-samba-o3: > extends: .samba-o3-template > image: $SAMBA_CI_CONTAINER_IMAGE_fedora31 > >+fedora32-samba-o3: >+ extends: .samba-o3-template >+ image: $SAMBA_CI_CONTAINER_IMAGE_fedora32 >+ > # > # Keep the samba-o3 sections at the end ... > # >diff --git a/bootstrap/.gitlab-ci.yml b/bootstrap/.gitlab-ci.yml >index 89c1453a34c..8427dbdc314 100644 >--- a/bootstrap/.gitlab-ci.yml >+++ b/bootstrap/.gitlab-ci.yml >@@ -99,6 +99,9 @@ debian10: > fedora31: > extends: .build_image_template > >+fedora32: >+ extends: .build_image_template >+ > centos8: > extends: .build_image_template > >diff --git a/bootstrap/config.py b/bootstrap/config.py >index 6d4d662d563..093b84676f0 100644 >--- a/bootstrap/config.py >+++ b/bootstrap/config.py >@@ -463,6 +463,16 @@ RPM_DISTS = { > 'policycoreutils-python': 'python3-policycoreutils', > } > }, >+ 'fedora32': { >+ 'docker_image': 'fedora:32', >+ 'vagrant_box': 'fedora/32-cloud-base', >+ 'bootstrap': DNF_BOOTSTRAP, >+ 'replace': { >+ 'lsb-release': 'redhat-lsb', >+ 'libsemanage-python': 'python3-libsemanage', >+ 'policycoreutils-python': 'python3-policycoreutils', >+ } >+ }, > 'opensuse150': { > 'docker_image': 'opensuse/leap:15.0', > 'vagrant_box': 'opensuse/openSUSE-15.0-x86_64', >diff --git a/bootstrap/generated-dists/Vagrantfile b/bootstrap/generated-dists/Vagrantfile >index 770e364c70b..15fc686f584 100644 >--- a/bootstrap/generated-dists/Vagrantfile >+++ b/bootstrap/generated-dists/Vagrantfile >@@ -38,6 +38,13 @@ Vagrant.configure("2") do |config| > v.vm.provision :shell, path: "fedora31/locale.sh" > end > >+ config.vm.define "fedora32" do |v| >+ v.vm.box = "fedora/32-cloud-base" >+ v.vm.hostname = "fedora32" >+ v.vm.provision :shell, path: "fedora32/bootstrap.sh" >+ v.vm.provision :shell, path: "fedora32/locale.sh" >+ end >+ > config.vm.define "opensuse150" do |v| > v.vm.box = "opensuse/openSUSE-15.0-x86_64" > v.vm.hostname = "opensuse150" >diff --git a/bootstrap/generated-dists/fedora32/Dockerfile b/bootstrap/generated-dists/fedora32/Dockerfile >new file mode 100644 >index 00000000000..d8a75cf8445 >--- /dev/null >+++ b/bootstrap/generated-dists/fedora32/Dockerfile >@@ -0,0 +1,27 @@ >+# >+# This file is generated by 'bootstrap/template.py --render' >+# See also bootstrap/config.py >+# >+ >+FROM fedora:32 >+ >+# pass in with --build-arg while build >+ARG SHA1SUM >+RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt >+ >+ADD *.sh /tmp/ >+# need root permission, do it before USER samba >+RUN /tmp/bootstrap.sh && /tmp/locale.sh >+ >+# if ld.gold exists, force link it to ld >+RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD" >+ >+# make test can not work with root, so we have to create a new user >+RUN useradd -m -U -s /bin/bash samba && \ >+ mkdir -p /etc/sudoers.d && \ >+ echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba >+ >+USER samba >+WORKDIR /home/samba >+# samba tests rely on this >+ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8 >\ No newline at end of file >diff --git a/bootstrap/generated-dists/fedora32/bootstrap.sh b/bootstrap/generated-dists/fedora32/bootstrap.sh >new file mode 100755 >index 00000000000..18c58092eff >--- /dev/null >+++ b/bootstrap/generated-dists/fedora32/bootstrap.sh >@@ -0,0 +1,109 @@ >+#!/bin/bash >+ >+# >+# This file is generated by 'bootstrap/template.py --render' >+# See also bootstrap/config.py >+# >+ >+set -xueo pipefail >+ >+dnf update -y >+ >+dnf install -y \ >+ --setopt=install_weak_deps=False \ >+ @development-tools \ >+ acl \ >+ attr \ >+ autoconf \ >+ avahi-devel \ >+ bind-utils \ >+ binutils \ >+ bison \ >+ chrpath \ >+ cups-devel \ >+ curl \ >+ dbus-devel \ >+ docbook-dtds \ >+ docbook-style-xsl \ >+ flex \ >+ gawk \ >+ gcc \ >+ gdb \ >+ git \ >+ glib2-devel \ >+ glibc-common \ >+ glibc-langpack-en \ >+ glusterfs-api-devel \ >+ glusterfs-devel \ >+ gnutls-devel \ >+ gpgme-devel \ >+ gzip \ >+ hostname \ >+ htop \ >+ jansson-devel \ >+ keyutils-libs-devel \ >+ krb5-devel \ >+ krb5-server \ >+ lcov \ >+ libacl-devel \ >+ libarchive-devel \ >+ libattr-devel \ >+ libblkid-devel \ >+ libbsd-devel \ >+ libcap-devel \ >+ libcephfs-devel \ >+ libicu-devel \ >+ libnsl2-devel \ >+ libpcap-devel \ >+ libtasn1-devel \ >+ libtasn1-tools \ >+ libtirpc-devel \ >+ libunwind-devel \ >+ liburing-devel \ >+ libuuid-devel \ >+ libxslt \ >+ lmdb \ >+ lmdb-devel \ >+ make \ >+ mingw64-gcc \ >+ ncurses-devel \ >+ openldap-devel \ >+ pam-devel \ >+ patch \ >+ perl \ >+ perl-Archive-Tar \ >+ perl-ExtUtils-MakeMaker \ >+ perl-JSON-Parse \ >+ perl-Parse-Yapp \ >+ perl-Test-Base \ >+ perl-generators \ >+ perl-interpreter \ >+ pkgconfig \ >+ popt-devel \ >+ procps-ng \ >+ psmisc \ >+ python3 \ >+ python3-devel \ >+ python3-dns \ >+ python3-gpg \ >+ python3-libsemanage \ >+ python3-markdown \ >+ python3-policycoreutils \ >+ quota-devel \ >+ readline-devel \ >+ redhat-lsb \ >+ rng-tools \ >+ rpcgen \ >+ rpcsvc-proto-devel \ >+ rsync \ >+ sed \ >+ sudo \ >+ systemd-devel \ >+ tar \ >+ tree \ >+ which \ >+ xfsprogs-devel \ >+ yum-utils \ >+ zlib-devel >+ >+dnf clean all >\ No newline at end of file >diff --git a/bootstrap/generated-dists/fedora32/locale.sh b/bootstrap/generated-dists/fedora32/locale.sh >new file mode 100755 >index 00000000000..cc64e180483 >--- /dev/null >+++ b/bootstrap/generated-dists/fedora32/locale.sh >@@ -0,0 +1,55 @@ >+#!/bin/bash >+ >+# >+# This file is generated by 'bootstrap/template.py --render' >+# See also bootstrap/config.py >+# >+ >+set -xueo pipefail >+ >+# refer to /usr/share/i18n/locales >+INPUTFILE=en_US >+# refer to /usr/share/i18n/charmaps >+CHARMAP=UTF-8 >+# locale to generate in /usr/lib/locale >+# glibc/localedef will normalize UTF-8 to utf8, follow the naming style >+LOCALE=$INPUTFILE.utf8 >+ >+# if locale is already correct, exit >+( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0 >+ >+# if locale not available, generate locale into /usr/lib/locale >+if ! ( locale --all-locales | grep -i $LOCALE ) >+then >+ # no-archive means create its own dir >+ localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE >+fi >+ >+# update locale conf and global env file >+# set both LC_ALL and LANG for safe >+ >+# update conf for Debian family >+FILE=/etc/default/locale >+if [ -f $FILE ] >+then >+ echo LC_ALL="$LOCALE" > $FILE >+ echo LANG="$LOCALE" >> $FILE >+fi >+ >+# update conf for RedHat family >+FILE=/etc/locale.conf >+if [ -f $FILE ] >+then >+ # LC_ALL is not valid in this file, set LANG only >+ echo LANG="$LOCALE" > $FILE >+fi >+ >+# update global env file >+FILE=/etc/environment >+if [ -f $FILE ] >+then >+ # append LC_ALL if not exist >+ grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE >+ # append LANG if not exist >+ grep LANG $FILE || echo LANG="$LOCALE" >> $FILE >+fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/fedora32/packages.yml b/bootstrap/generated-dists/fedora32/packages.yml >new file mode 100644 >index 00000000000..3165af8dd82 >--- /dev/null >+++ b/bootstrap/generated-dists/fedora32/packages.yml >@@ -0,0 +1,96 @@ >+--- >+packages: >+ - @development-tools >+ - acl >+ - attr >+ - autoconf >+ - avahi-devel >+ - bind-utils >+ - binutils >+ - bison >+ - chrpath >+ - cups-devel >+ - curl >+ - dbus-devel >+ - docbook-dtds >+ - docbook-style-xsl >+ - flex >+ - gawk >+ - gcc >+ - gdb >+ - git >+ - glib2-devel >+ - glibc-common >+ - glibc-langpack-en >+ - glusterfs-api-devel >+ - glusterfs-devel >+ - gnutls-devel >+ - gpgme-devel >+ - gzip >+ - hostname >+ - htop >+ - jansson-devel >+ - keyutils-libs-devel >+ - krb5-devel >+ - krb5-server >+ - lcov >+ - libacl-devel >+ - libarchive-devel >+ - libattr-devel >+ - libblkid-devel >+ - libbsd-devel >+ - libcap-devel >+ - libcephfs-devel >+ - libicu-devel >+ - libnsl2-devel >+ - libpcap-devel >+ - libtasn1-devel >+ - libtasn1-tools >+ - libtirpc-devel >+ - libunwind-devel >+ - liburing-devel >+ - libuuid-devel >+ - libxslt >+ - lmdb >+ - lmdb-devel >+ - make >+ - mingw64-gcc >+ - ncurses-devel >+ - openldap-devel >+ - pam-devel >+ - patch >+ - perl >+ - perl-Archive-Tar >+ - perl-ExtUtils-MakeMaker >+ - perl-JSON-Parse >+ - perl-Parse-Yapp >+ - perl-Test-Base >+ - perl-generators >+ - perl-interpreter >+ - pkgconfig >+ - popt-devel >+ - procps-ng >+ - psmisc >+ - python3 >+ - python3-devel >+ - python3-dns >+ - python3-gpg >+ - python3-libsemanage >+ - python3-markdown >+ - python3-policycoreutils >+ - quota-devel >+ - readline-devel >+ - redhat-lsb >+ - rng-tools >+ - rpcgen >+ - rpcsvc-proto-devel >+ - rsync >+ - sed >+ - sudo >+ - systemd-devel >+ - tar >+ - tree >+ - which >+ - xfsprogs-devel >+ - yum-utils >+ - zlib-devel >\ No newline at end of file >diff --git a/bootstrap/sha1sum.txt b/bootstrap/sha1sum.txt >index ef012315ce1..df1b85b9f21 100644 >--- a/bootstrap/sha1sum.txt >+++ b/bootstrap/sha1sum.txt >@@ -1 +1 @@ >-9f95136e88779ec8eed6c18614b1e0779ef2bfec >+9061307e79ad13733c69352a965eeb4f44bef4b7 >-- >2.25.1 > > >From a7e297dbc631afdfcfe0082d9bb7318dbc0ba212 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Wed, 25 Mar 2020 22:17:46 +0100 >Subject: [PATCH 010/380] bootstrap: add ubuntu2004 Ubuntu Focal Fossa > (development branch) > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >(cherry picked from commit 53402b353007893f3851afbf574c2a67f9f6a44b) >--- > .gitlab-ci.yml | 9 +- > bootstrap/.gitlab-ci.yml | 3 + > bootstrap/config.py | 7 ++ > bootstrap/generated-dists/Vagrantfile | 7 ++ > .../generated-dists/ubuntu2004/Dockerfile | 27 +++++ > .../generated-dists/ubuntu2004/bootstrap.sh | 106 ++++++++++++++++++ > .../generated-dists/ubuntu2004/locale.sh | 55 +++++++++ > .../generated-dists/ubuntu2004/packages.yml | 91 +++++++++++++++ > bootstrap/sha1sum.txt | 2 +- > 9 files changed, 304 insertions(+), 3 deletions(-) > create mode 100644 bootstrap/generated-dists/ubuntu2004/Dockerfile > create mode 100755 bootstrap/generated-dists/ubuntu2004/bootstrap.sh > create mode 100755 bootstrap/generated-dists/ubuntu2004/locale.sh > create mode 100644 bootstrap/generated-dists/ubuntu2004/packages.yml > >diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml >index bf05c3cd792..efb9fe87d17 100644 >--- a/.gitlab-ci.yml >+++ b/.gitlab-ci.yml >@@ -22,7 +22,7 @@ variables: > # Set this to the contents of bootstrap/sha1sum.txt > # which is generated by bootstrap/template.py --render > # >- SAMBA_CI_CONTAINER_TAG: 9061307e79ad13733c69352a965eeb4f44bef4b7 >+ SAMBA_CI_CONTAINER_TAG: f5212e7abcae3208b796c939432ab9bec319264a > # > # We use the ubuntu1804 image as default as > # it matches what we have on sn-devel-184. >@@ -33,8 +33,9 @@ variables: > # Please see the samba-o3 sections at the end of this file! > # We should run that for each available image > # >- SAMBA_CI_CONTAINER_IMAGE_ubuntu1804: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-ubuntu1804:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_ubuntu1604: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-ubuntu1604:${SAMBA_CI_CONTAINER_TAG} >+ SAMBA_CI_CONTAINER_IMAGE_ubuntu1804: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-ubuntu1804:${SAMBA_CI_CONTAINER_TAG} >+ SAMBA_CI_CONTAINER_IMAGE_ubuntu2004: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-ubuntu2004:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_debian9: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-debian9:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_debian10: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-debian10:${SAMBA_CI_CONTAINER_TAG} > SAMBA_CI_CONTAINER_IMAGE_opensuse150: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-opensuse150:${SAMBA_CI_CONTAINER_TAG} >@@ -277,6 +278,10 @@ ubuntu1804-samba-o3: > extends: .samba-o3-template > image: $SAMBA_CI_CONTAINER_IMAGE_ubuntu1804 > >+.ubuntu2004-samba-o3: >+ extends: .samba-o3-template >+ image: $SAMBA_CI_CONTAINER_IMAGE_ubuntu2004 >+ > debian10-samba-o3: > extends: .samba-o3-template > image: $SAMBA_CI_CONTAINER_IMAGE_debian10 >diff --git a/bootstrap/.gitlab-ci.yml b/bootstrap/.gitlab-ci.yml >index 8427dbdc314..d6cf02109fd 100644 >--- a/bootstrap/.gitlab-ci.yml >+++ b/bootstrap/.gitlab-ci.yml >@@ -93,6 +93,9 @@ ubuntu1604: > ubuntu1804: > extends: .build_image_template > >+ubuntu2004: >+ extends: .build_image_template >+ > debian10: > extends: .build_image_template > >diff --git a/bootstrap/config.py b/bootstrap/config.py >index 093b84676f0..b862053b915 100644 >--- a/bootstrap/config.py >+++ b/bootstrap/config.py >@@ -400,6 +400,13 @@ DEB_DISTS = { > 'liburing-dev': '', # not available > } > }, >+ 'ubuntu2004': { >+ 'docker_image': 'ubuntu:20.04', >+ 'vagrant_box': 'ubuntu/focal64', >+ 'replace': { >+ 'liburing-dev': '', # not available >+ } >+ }, > } > > >diff --git a/bootstrap/generated-dists/Vagrantfile b/bootstrap/generated-dists/Vagrantfile >index 15fc686f584..e01c20bc161 100644 >--- a/bootstrap/generated-dists/Vagrantfile >+++ b/bootstrap/generated-dists/Vagrantfile >@@ -73,5 +73,12 @@ Vagrant.configure("2") do |config| > v.vm.provision :shell, path: "ubuntu1804/locale.sh" > end > >+ config.vm.define "ubuntu2004" do |v| >+ v.vm.box = "ubuntu/focal64" >+ v.vm.hostname = "ubuntu2004" >+ v.vm.provision :shell, path: "ubuntu2004/bootstrap.sh" >+ v.vm.provision :shell, path: "ubuntu2004/locale.sh" >+ end >+ > > end >diff --git a/bootstrap/generated-dists/ubuntu2004/Dockerfile b/bootstrap/generated-dists/ubuntu2004/Dockerfile >new file mode 100644 >index 00000000000..f94e8801aad >--- /dev/null >+++ b/bootstrap/generated-dists/ubuntu2004/Dockerfile >@@ -0,0 +1,27 @@ >+# >+# This file is generated by 'bootstrap/template.py --render' >+# See also bootstrap/config.py >+# >+ >+FROM ubuntu:20.04 >+ >+# pass in with --build-arg while build >+ARG SHA1SUM >+RUN [ -n $SHA1SUM ] && echo $SHA1SUM > /sha1sum.txt >+ >+ADD *.sh /tmp/ >+# need root permission, do it before USER samba >+RUN /tmp/bootstrap.sh && /tmp/locale.sh >+ >+# if ld.gold exists, force link it to ld >+RUN set -x; LD=$(which ld); LD_GOLD=$(which ld.gold); test -x $LD_GOLD && ln -sf $LD_GOLD $LD && test -x $LD && echo "$LD is now $LD_GOLD" >+ >+# make test can not work with root, so we have to create a new user >+RUN useradd -m -U -s /bin/bash samba && \ >+ mkdir -p /etc/sudoers.d && \ >+ echo "samba ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/samba >+ >+USER samba >+WORKDIR /home/samba >+# samba tests rely on this >+ENV USER=samba LC_ALL=en_US.utf8 LANG=en_US.utf8 >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu2004/bootstrap.sh b/bootstrap/generated-dists/ubuntu2004/bootstrap.sh >new file mode 100755 >index 00000000000..97d32815d72 >--- /dev/null >+++ b/bootstrap/generated-dists/ubuntu2004/bootstrap.sh >@@ -0,0 +1,106 @@ >+#!/bin/bash >+ >+# >+# This file is generated by 'bootstrap/template.py --render' >+# See also bootstrap/config.py >+# >+ >+set -xueo pipefail >+ >+export DEBIAN_FRONTEND=noninteractive >+apt-get -y update >+ >+apt-get -y install \ >+ acl \ >+ apt-utils \ >+ attr \ >+ autoconf \ >+ bind9utils \ >+ binutils \ >+ bison \ >+ build-essential \ >+ chrpath \ >+ curl \ >+ debhelper \ >+ dnsutils \ >+ docbook-xml \ >+ docbook-xsl \ >+ flex \ >+ gcc \ >+ gdb \ >+ git \ >+ glusterfs-common \ >+ gzip \ >+ heimdal-multidev \ >+ hostname \ >+ htop \ >+ krb5-config \ >+ krb5-kdc \ >+ krb5-user \ >+ language-pack-en \ >+ lcov \ >+ libacl1-dev \ >+ libarchive-dev \ >+ libattr1-dev \ >+ libavahi-common-dev \ >+ libblkid-dev \ >+ libbsd-dev \ >+ libcap-dev \ >+ libcephfs-dev \ >+ libcups2-dev \ >+ libdbus-1-dev \ >+ libglib2.0-dev \ >+ libgnutls28-dev \ >+ libgpgme11-dev \ >+ libicu-dev \ >+ libjansson-dev \ >+ libjs-jquery \ >+ libjson-perl \ >+ libkrb5-dev \ >+ libldap2-dev \ >+ liblmdb-dev \ >+ libncurses5-dev \ >+ libpam0g-dev \ >+ libparse-yapp-perl \ >+ libpcap-dev \ >+ libpopt-dev \ >+ libreadline-dev \ >+ libsystemd-dev \ >+ libtasn1-bin \ >+ libtasn1-dev \ >+ libunwind-dev \ >+ lmdb-utils \ >+ locales \ >+ lsb-release \ >+ make \ >+ mawk \ >+ mingw-w64 \ >+ patch \ >+ perl \ >+ perl-modules \ >+ pkg-config \ >+ procps \ >+ psmisc \ >+ python3 \ >+ python3-dbg \ >+ python3-dev \ >+ python3-dnspython \ >+ python3-gpg \ >+ python3-iso8601 \ >+ python3-markdown \ >+ python3-matplotlib \ >+ python3-pexpect \ >+ rng-tools \ >+ rsync \ >+ sed \ >+ sudo \ >+ tar \ >+ tree \ >+ uuid-dev \ >+ xfslibs-dev \ >+ xsltproc \ >+ zlib1g-dev >+ >+apt-get -y autoremove >+apt-get -y autoclean >+apt-get -y clean >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu2004/locale.sh b/bootstrap/generated-dists/ubuntu2004/locale.sh >new file mode 100755 >index 00000000000..cc64e180483 >--- /dev/null >+++ b/bootstrap/generated-dists/ubuntu2004/locale.sh >@@ -0,0 +1,55 @@ >+#!/bin/bash >+ >+# >+# This file is generated by 'bootstrap/template.py --render' >+# See also bootstrap/config.py >+# >+ >+set -xueo pipefail >+ >+# refer to /usr/share/i18n/locales >+INPUTFILE=en_US >+# refer to /usr/share/i18n/charmaps >+CHARMAP=UTF-8 >+# locale to generate in /usr/lib/locale >+# glibc/localedef will normalize UTF-8 to utf8, follow the naming style >+LOCALE=$INPUTFILE.utf8 >+ >+# if locale is already correct, exit >+( locale | grep LC_ALL | grep -i $LOCALE ) && exit 0 >+ >+# if locale not available, generate locale into /usr/lib/locale >+if ! ( locale --all-locales | grep -i $LOCALE ) >+then >+ # no-archive means create its own dir >+ localedef --inputfile $INPUTFILE --charmap $CHARMAP --no-archive $LOCALE >+fi >+ >+# update locale conf and global env file >+# set both LC_ALL and LANG for safe >+ >+# update conf for Debian family >+FILE=/etc/default/locale >+if [ -f $FILE ] >+then >+ echo LC_ALL="$LOCALE" > $FILE >+ echo LANG="$LOCALE" >> $FILE >+fi >+ >+# update conf for RedHat family >+FILE=/etc/locale.conf >+if [ -f $FILE ] >+then >+ # LC_ALL is not valid in this file, set LANG only >+ echo LANG="$LOCALE" > $FILE >+fi >+ >+# update global env file >+FILE=/etc/environment >+if [ -f $FILE ] >+then >+ # append LC_ALL if not exist >+ grep LC_ALL $FILE || echo LC_ALL="$LOCALE" >> $FILE >+ # append LANG if not exist >+ grep LANG $FILE || echo LANG="$LOCALE" >> $FILE >+fi >\ No newline at end of file >diff --git a/bootstrap/generated-dists/ubuntu2004/packages.yml b/bootstrap/generated-dists/ubuntu2004/packages.yml >new file mode 100644 >index 00000000000..f45deb2c808 >--- /dev/null >+++ b/bootstrap/generated-dists/ubuntu2004/packages.yml >@@ -0,0 +1,91 @@ >+--- >+packages: >+ - acl >+ - apt-utils >+ - attr >+ - autoconf >+ - bind9utils >+ - binutils >+ - bison >+ - build-essential >+ - chrpath >+ - curl >+ - debhelper >+ - dnsutils >+ - docbook-xml >+ - docbook-xsl >+ - flex >+ - gcc >+ - gdb >+ - git >+ - glusterfs-common >+ - gzip >+ - heimdal-multidev >+ - hostname >+ - htop >+ - krb5-config >+ - krb5-kdc >+ - krb5-user >+ - language-pack-en >+ - lcov >+ - libacl1-dev >+ - libarchive-dev >+ - libattr1-dev >+ - libavahi-common-dev >+ - libblkid-dev >+ - libbsd-dev >+ - libcap-dev >+ - libcephfs-dev >+ - libcups2-dev >+ - libdbus-1-dev >+ - libglib2.0-dev >+ - libgnutls28-dev >+ - libgpgme11-dev >+ - libicu-dev >+ - libjansson-dev >+ - libjs-jquery >+ - libjson-perl >+ - libkrb5-dev >+ - libldap2-dev >+ - liblmdb-dev >+ - libncurses5-dev >+ - libpam0g-dev >+ - libparse-yapp-perl >+ - libpcap-dev >+ - libpopt-dev >+ - libreadline-dev >+ - libsystemd-dev >+ - libtasn1-bin >+ - libtasn1-dev >+ - libunwind-dev >+ - lmdb-utils >+ - locales >+ - lsb-release >+ - make >+ - mawk >+ - mingw-w64 >+ - patch >+ - perl >+ - perl-modules >+ - pkg-config >+ - procps >+ - psmisc >+ - python3 >+ - python3-dbg >+ - python3-dev >+ - python3-dnspython >+ - python3-gpg >+ - python3-iso8601 >+ - python3-markdown >+ - python3-matplotlib >+ - python3-pexpect >+ - rng-tools >+ - rsync >+ - sed >+ - sudo >+ - tar >+ - tree >+ - uuid-dev >+ - xfslibs-dev >+ - xsltproc >+ - zlib1g-dev >\ No newline at end of file >diff --git a/bootstrap/sha1sum.txt b/bootstrap/sha1sum.txt >index df1b85b9f21..c3a72eec5c6 100644 >--- a/bootstrap/sha1sum.txt >+++ b/bootstrap/sha1sum.txt >@@ -1 +1 @@ >-9061307e79ad13733c69352a965eeb4f44bef4b7 >+f5212e7abcae3208b796c939432ab9bec319264a >-- >2.25.1 > > >From 3f40e387bc72c72d5e4a982bb9a114b46dc8cdb1 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Tue, 24 Mar 2020 15:36:48 +0100 >Subject: [PATCH 011/380] bootstrap: add python3-pyasn1/python3-cryptography > for kerberos testing > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >(cherry picked from commit 99b644248746a8a038d6f4b15aa621a907adc987) >--- > .gitlab-ci.yml | 2 +- > bootstrap/config.py | 8 ++++---- > bootstrap/generated-dists/centos7/bootstrap.sh | 2 ++ > bootstrap/generated-dists/centos7/packages.yml | 2 ++ > bootstrap/generated-dists/centos8/bootstrap.sh | 2 ++ > bootstrap/generated-dists/centos8/packages.yml | 2 ++ > bootstrap/generated-dists/debian10/bootstrap.sh | 2 ++ > bootstrap/generated-dists/debian10/packages.yml | 2 ++ > bootstrap/generated-dists/fedora31/bootstrap.sh | 2 ++ > bootstrap/generated-dists/fedora31/packages.yml | 2 ++ > bootstrap/generated-dists/fedora32/bootstrap.sh | 2 ++ > bootstrap/generated-dists/fedora32/packages.yml | 2 ++ > bootstrap/generated-dists/opensuse150/bootstrap.sh | 2 ++ > bootstrap/generated-dists/opensuse150/packages.yml | 2 ++ > bootstrap/generated-dists/opensuse151/bootstrap.sh | 2 ++ > bootstrap/generated-dists/opensuse151/packages.yml | 2 ++ > bootstrap/generated-dists/ubuntu1604/bootstrap.sh | 2 ++ > bootstrap/generated-dists/ubuntu1604/packages.yml | 2 ++ > bootstrap/generated-dists/ubuntu1804/bootstrap.sh | 2 ++ > bootstrap/generated-dists/ubuntu1804/packages.yml | 2 ++ > bootstrap/generated-dists/ubuntu2004/bootstrap.sh | 2 ++ > bootstrap/generated-dists/ubuntu2004/packages.yml | 2 ++ > bootstrap/sha1sum.txt | 2 +- > 23 files changed, 46 insertions(+), 6 deletions(-) > >diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml >index efb9fe87d17..6a5e8693e80 100644 >--- a/.gitlab-ci.yml >+++ b/.gitlab-ci.yml >@@ -22,7 +22,7 @@ variables: > # Set this to the contents of bootstrap/sha1sum.txt > # which is generated by bootstrap/template.py --render > # >- SAMBA_CI_CONTAINER_TAG: f5212e7abcae3208b796c939432ab9bec319264a >+ SAMBA_CI_CONTAINER_TAG: 7414ad7ef9108d406b1f6b17ebce19e32aee9f70 > # > # We use the ubuntu1804 image as default as > # it matches what we have on sn-devel-184. >diff --git a/bootstrap/config.py b/bootstrap/config.py >index b862053b915..196f9bdf8eb 100644 >--- a/bootstrap/config.py >+++ b/bootstrap/config.py >@@ -129,6 +129,7 @@ PKGS = [ > ('mawk', 'gawk'), > > ('python3', 'python3'), >+ ('python3-cryptography', 'python3-cryptography'), # for krb5 tests > ('python3-dev', 'python3-devel'), > ('python3-dbg', ''), > ('python3-iso8601', ''), >@@ -137,6 +138,7 @@ PKGS = [ > ('python3-matplotlib', ''), > ('python3-dnspython', 'python3-dns'), > ('python3-pexpect', ''), # for wintest only >+ ('python3-pyasn1', 'python3-pyasn1'), # for krb5 tests > > ('', 'libsemanage-python'), > ('', 'policycoreutils-python'), >@@ -418,9 +420,10 @@ RPM_DISTS = { > 'replace': { > 'lsb-release': 'redhat-lsb', > 'python3': 'python36', >- 'python3-crypto': 'python36-crypto', >+ 'python3-cryptography': 'python36-cryptography', > 'python3-devel': 'python36-devel', > 'python3-dns': 'python36-dns', >+ 'python3-pyasn1': 'python36-pyasn1', > 'python3-gpg': 'python36-gpg', > 'python3-iso8601' : 'python36-iso8601', > 'python3-markdown': 'python36-markdown', >@@ -455,7 +458,6 @@ RPM_DISTS = { > 'perl-JSON-Parse': '', # does not exist? > 'perl-Test-Base': 'perl-Test-Simple', > 'policycoreutils-python': 'python3-policycoreutils', >- 'python3-crypto': '', > 'quota-devel': '', # FIXME: Add me back, once available! > 'liburing-devel': '', # not available yet, Add me back, once available! > } >@@ -503,7 +505,6 @@ RPM_DISTS = { > 'perl-interpreter': '', > 'procps-ng': 'procps', > 'python-dns': 'python2-dnspython', >- 'python3-crypto': 'python3-pycrypto', > 'python3-dns': 'python3-dnspython', > 'python3-markdown': 'python3-Markdown', > 'quota-devel': '', >@@ -536,7 +537,6 @@ RPM_DISTS = { > 'perl-interpreter': '', > 'procps-ng': 'procps', > 'python-dns': 'python2-dnspython', >- 'python3-crypto': 'python3-pycrypto', > 'python3-dns': 'python3-dnspython', > 'python3-markdown': 'python3-Markdown', > 'quota-devel': '', >diff --git a/bootstrap/generated-dists/centos7/bootstrap.sh b/bootstrap/generated-dists/centos7/bootstrap.sh >index 2f0bb1bcc28..37f5d684663 100755 >--- a/bootstrap/generated-dists/centos7/bootstrap.sh >+++ b/bootstrap/generated-dists/centos7/bootstrap.sh >@@ -83,9 +83,11 @@ yum install -y \ > procps-ng \ > psmisc \ > python36 \ >+ python36-cryptography \ > python36-devel \ > python36-dns \ > python36-markdown \ >+ python36-pyasn1 \ > quota-devel \ > readline-devel \ > redhat-lsb \ >diff --git a/bootstrap/generated-dists/centos7/packages.yml b/bootstrap/generated-dists/centos7/packages.yml >index 475326b6db7..1b80882bd8c 100644 >--- a/bootstrap/generated-dists/centos7/packages.yml >+++ b/bootstrap/generated-dists/centos7/packages.yml >@@ -69,9 +69,11 @@ packages: > - procps-ng > - psmisc > - python36 >+ - python36-cryptography > - python36-devel > - python36-dns > - python36-markdown >+ - python36-pyasn1 > - quota-devel > - readline-devel > - redhat-lsb >diff --git a/bootstrap/generated-dists/centos8/bootstrap.sh b/bootstrap/generated-dists/centos8/bootstrap.sh >index 22484b3f6ad..61debd5e2ee 100755 >--- a/bootstrap/generated-dists/centos8/bootstrap.sh >+++ b/bootstrap/generated-dists/centos8/bootstrap.sh >@@ -84,12 +84,14 @@ yum install -y \ > procps-ng \ > psmisc \ > python3 \ >+ python3-cryptography \ > python3-devel \ > python3-dns \ > python3-gpg \ > python3-libsemanage \ > python3-markdown \ > python3-policycoreutils \ >+ python3-pyasn1 \ > readline-devel \ > redhat-lsb \ > rng-tools \ >diff --git a/bootstrap/generated-dists/centos8/packages.yml b/bootstrap/generated-dists/centos8/packages.yml >index 07be0deeceb..2467b35dafb 100644 >--- a/bootstrap/generated-dists/centos8/packages.yml >+++ b/bootstrap/generated-dists/centos8/packages.yml >@@ -69,12 +69,14 @@ packages: > - procps-ng > - psmisc > - python3 >+ - python3-cryptography > - python3-devel > - python3-dns > - python3-gpg > - python3-libsemanage > - python3-markdown > - python3-policycoreutils >+ - python3-pyasn1 > - readline-devel > - redhat-lsb > - rng-tools >diff --git a/bootstrap/generated-dists/debian10/bootstrap.sh b/bootstrap/generated-dists/debian10/bootstrap.sh >index f0847eb3c20..9391c1ca815 100755 >--- a/bootstrap/generated-dists/debian10/bootstrap.sh >+++ b/bootstrap/generated-dists/debian10/bootstrap.sh >@@ -81,6 +81,7 @@ apt-get -y install \ > procps \ > psmisc \ > python3 \ >+ python3-cryptography \ > python3-dbg \ > python3-dev \ > python3-dnspython \ >@@ -89,6 +90,7 @@ apt-get -y install \ > python3-markdown \ > python3-matplotlib \ > python3-pexpect \ >+ python3-pyasn1 \ > rng-tools \ > rsync \ > sed \ >diff --git a/bootstrap/generated-dists/debian10/packages.yml b/bootstrap/generated-dists/debian10/packages.yml >index a242cd8b362..dee4d5cef20 100644 >--- a/bootstrap/generated-dists/debian10/packages.yml >+++ b/bootstrap/generated-dists/debian10/packages.yml >@@ -70,6 +70,7 @@ packages: > - procps > - psmisc > - python3 >+ - python3-cryptography > - python3-dbg > - python3-dev > - python3-dnspython >@@ -78,6 +79,7 @@ packages: > - python3-markdown > - python3-matplotlib > - python3-pexpect >+ - python3-pyasn1 > - rng-tools > - rsync > - sed >diff --git a/bootstrap/generated-dists/fedora31/bootstrap.sh b/bootstrap/generated-dists/fedora31/bootstrap.sh >index 18c58092eff..09d36e88058 100755 >--- a/bootstrap/generated-dists/fedora31/bootstrap.sh >+++ b/bootstrap/generated-dists/fedora31/bootstrap.sh >@@ -83,12 +83,14 @@ dnf install -y \ > procps-ng \ > psmisc \ > python3 \ >+ python3-cryptography \ > python3-devel \ > python3-dns \ > python3-gpg \ > python3-libsemanage \ > python3-markdown \ > python3-policycoreutils \ >+ python3-pyasn1 \ > quota-devel \ > readline-devel \ > redhat-lsb \ >diff --git a/bootstrap/generated-dists/fedora31/packages.yml b/bootstrap/generated-dists/fedora31/packages.yml >index 3165af8dd82..a2fbd0eb83b 100644 >--- a/bootstrap/generated-dists/fedora31/packages.yml >+++ b/bootstrap/generated-dists/fedora31/packages.yml >@@ -72,12 +72,14 @@ packages: > - procps-ng > - psmisc > - python3 >+ - python3-cryptography > - python3-devel > - python3-dns > - python3-gpg > - python3-libsemanage > - python3-markdown > - python3-policycoreutils >+ - python3-pyasn1 > - quota-devel > - readline-devel > - redhat-lsb >diff --git a/bootstrap/generated-dists/fedora32/bootstrap.sh b/bootstrap/generated-dists/fedora32/bootstrap.sh >index 18c58092eff..09d36e88058 100755 >--- a/bootstrap/generated-dists/fedora32/bootstrap.sh >+++ b/bootstrap/generated-dists/fedora32/bootstrap.sh >@@ -83,12 +83,14 @@ dnf install -y \ > procps-ng \ > psmisc \ > python3 \ >+ python3-cryptography \ > python3-devel \ > python3-dns \ > python3-gpg \ > python3-libsemanage \ > python3-markdown \ > python3-policycoreutils \ >+ python3-pyasn1 \ > quota-devel \ > readline-devel \ > redhat-lsb \ >diff --git a/bootstrap/generated-dists/fedora32/packages.yml b/bootstrap/generated-dists/fedora32/packages.yml >index 3165af8dd82..a2fbd0eb83b 100644 >--- a/bootstrap/generated-dists/fedora32/packages.yml >+++ b/bootstrap/generated-dists/fedora32/packages.yml >@@ -72,12 +72,14 @@ packages: > - procps-ng > - psmisc > - python3 >+ - python3-cryptography > - python3-devel > - python3-dns > - python3-gpg > - python3-libsemanage > - python3-markdown > - python3-policycoreutils >+ - python3-pyasn1 > - quota-devel > - readline-devel > - redhat-lsb >diff --git a/bootstrap/generated-dists/opensuse150/bootstrap.sh b/bootstrap/generated-dists/opensuse150/bootstrap.sh >index 3fbcaacb24f..341b0ef9d35 100755 >--- a/bootstrap/generated-dists/opensuse150/bootstrap.sh >+++ b/bootstrap/generated-dists/opensuse150/bootstrap.sh >@@ -80,9 +80,11 @@ zypper --non-interactive install \ > python2-semanage \ > python3 \ > python3-Markdown \ >+ python3-cryptography \ > python3-devel \ > python3-dnspython \ > python3-gpg \ >+ python3-pyasn1 \ > readline-devel \ > rng-tools \ > rpcgen \ >diff --git a/bootstrap/generated-dists/opensuse150/packages.yml b/bootstrap/generated-dists/opensuse150/packages.yml >index 0eb19244677..b8c469cadca 100644 >--- a/bootstrap/generated-dists/opensuse150/packages.yml >+++ b/bootstrap/generated-dists/opensuse150/packages.yml >@@ -68,9 +68,11 @@ packages: > - python2-semanage > - python3 > - python3-Markdown >+ - python3-cryptography > - python3-devel > - python3-dnspython > - python3-gpg >+ - python3-pyasn1 > - readline-devel > - rng-tools > - rpcgen >diff --git a/bootstrap/generated-dists/opensuse151/bootstrap.sh b/bootstrap/generated-dists/opensuse151/bootstrap.sh >index 3fbcaacb24f..341b0ef9d35 100755 >--- a/bootstrap/generated-dists/opensuse151/bootstrap.sh >+++ b/bootstrap/generated-dists/opensuse151/bootstrap.sh >@@ -80,9 +80,11 @@ zypper --non-interactive install \ > python2-semanage \ > python3 \ > python3-Markdown \ >+ python3-cryptography \ > python3-devel \ > python3-dnspython \ > python3-gpg \ >+ python3-pyasn1 \ > readline-devel \ > rng-tools \ > rpcgen \ >diff --git a/bootstrap/generated-dists/opensuse151/packages.yml b/bootstrap/generated-dists/opensuse151/packages.yml >index 0eb19244677..b8c469cadca 100644 >--- a/bootstrap/generated-dists/opensuse151/packages.yml >+++ b/bootstrap/generated-dists/opensuse151/packages.yml >@@ -68,9 +68,11 @@ packages: > - python2-semanage > - python3 > - python3-Markdown >+ - python3-cryptography > - python3-devel > - python3-dnspython > - python3-gpg >+ - python3-pyasn1 > - readline-devel > - rng-tools > - rpcgen >diff --git a/bootstrap/generated-dists/ubuntu1604/bootstrap.sh b/bootstrap/generated-dists/ubuntu1604/bootstrap.sh >index a8f47762ded..f5791357d45 100755 >--- a/bootstrap/generated-dists/ubuntu1604/bootstrap.sh >+++ b/bootstrap/generated-dists/ubuntu1604/bootstrap.sh >@@ -80,6 +80,7 @@ apt-get -y install \ > procps \ > psmisc \ > python3 \ >+ python3-cryptography \ > python3-dbg \ > python3-dev \ > python3-dnspython \ >@@ -88,6 +89,7 @@ apt-get -y install \ > python3-markdown \ > python3-matplotlib \ > python3-pexpect \ >+ python3-pyasn1 \ > rng-tools \ > rsync \ > sed \ >diff --git a/bootstrap/generated-dists/ubuntu1604/packages.yml b/bootstrap/generated-dists/ubuntu1604/packages.yml >index c3cd9af9c3e..932cc162041 100644 >--- a/bootstrap/generated-dists/ubuntu1604/packages.yml >+++ b/bootstrap/generated-dists/ubuntu1604/packages.yml >@@ -69,6 +69,7 @@ packages: > - procps > - psmisc > - python3 >+ - python3-cryptography > - python3-dbg > - python3-dev > - python3-dnspython >@@ -77,6 +78,7 @@ packages: > - python3-markdown > - python3-matplotlib > - python3-pexpect >+ - python3-pyasn1 > - rng-tools > - rsync > - sed >diff --git a/bootstrap/generated-dists/ubuntu1804/bootstrap.sh b/bootstrap/generated-dists/ubuntu1804/bootstrap.sh >index 97d32815d72..e668057ea82 100755 >--- a/bootstrap/generated-dists/ubuntu1804/bootstrap.sh >+++ b/bootstrap/generated-dists/ubuntu1804/bootstrap.sh >@@ -82,6 +82,7 @@ apt-get -y install \ > procps \ > psmisc \ > python3 \ >+ python3-cryptography \ > python3-dbg \ > python3-dev \ > python3-dnspython \ >@@ -90,6 +91,7 @@ apt-get -y install \ > python3-markdown \ > python3-matplotlib \ > python3-pexpect \ >+ python3-pyasn1 \ > rng-tools \ > rsync \ > sed \ >diff --git a/bootstrap/generated-dists/ubuntu1804/packages.yml b/bootstrap/generated-dists/ubuntu1804/packages.yml >index f45deb2c808..edf5720f84c 100644 >--- a/bootstrap/generated-dists/ubuntu1804/packages.yml >+++ b/bootstrap/generated-dists/ubuntu1804/packages.yml >@@ -71,6 +71,7 @@ packages: > - procps > - psmisc > - python3 >+ - python3-cryptography > - python3-dbg > - python3-dev > - python3-dnspython >@@ -79,6 +80,7 @@ packages: > - python3-markdown > - python3-matplotlib > - python3-pexpect >+ - python3-pyasn1 > - rng-tools > - rsync > - sed >diff --git a/bootstrap/generated-dists/ubuntu2004/bootstrap.sh b/bootstrap/generated-dists/ubuntu2004/bootstrap.sh >index 97d32815d72..e668057ea82 100755 >--- a/bootstrap/generated-dists/ubuntu2004/bootstrap.sh >+++ b/bootstrap/generated-dists/ubuntu2004/bootstrap.sh >@@ -82,6 +82,7 @@ apt-get -y install \ > procps \ > psmisc \ > python3 \ >+ python3-cryptography \ > python3-dbg \ > python3-dev \ > python3-dnspython \ >@@ -90,6 +91,7 @@ apt-get -y install \ > python3-markdown \ > python3-matplotlib \ > python3-pexpect \ >+ python3-pyasn1 \ > rng-tools \ > rsync \ > sed \ >diff --git a/bootstrap/generated-dists/ubuntu2004/packages.yml b/bootstrap/generated-dists/ubuntu2004/packages.yml >index f45deb2c808..edf5720f84c 100644 >--- a/bootstrap/generated-dists/ubuntu2004/packages.yml >+++ b/bootstrap/generated-dists/ubuntu2004/packages.yml >@@ -71,6 +71,7 @@ packages: > - procps > - psmisc > - python3 >+ - python3-cryptography > - python3-dbg > - python3-dev > - python3-dnspython >@@ -79,6 +80,7 @@ packages: > - python3-markdown > - python3-matplotlib > - python3-pexpect >+ - python3-pyasn1 > - rng-tools > - rsync > - sed >diff --git a/bootstrap/sha1sum.txt b/bootstrap/sha1sum.txt >index c3a72eec5c6..085ef7c5297 100644 >--- a/bootstrap/sha1sum.txt >+++ b/bootstrap/sha1sum.txt >@@ -1 +1 @@ >-f5212e7abcae3208b796c939432ab9bec319264a >+7414ad7ef9108d406b1f6b17ebce19e32aee9f70 >-- >2.25.1 > > >From 223077cce9193ffc82d9acf0469fcc1acaa871d1 Mon Sep 17 00:00:00 2001 >From: Martin Schwenke <martin@meltin.net> >Date: Wed, 9 Dec 2020 00:03:47 +1100 >Subject: [PATCH 012/380] bootstrap: Cope with case changes in CentOS 8 repo > names > >RN: Be more flexible with repository names in CentOS 8 test environments > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14594 >Signed-off-by: Martin Schwenke <martin@meltin.net> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >[abartlet@samba.org backported from commit 1c59f49aaede8ec1662d4e49aef84fcd902a8a76 > due to conflicts in sha1sum because changes in-between > this and the last backported changes were not included] >--- > .gitlab-ci.yml | 2 +- > bootstrap/config.py | 3 ++- > bootstrap/generated-dists/centos8/bootstrap.sh | 3 ++- > bootstrap/sha1sum.txt | 2 +- > 4 files changed, 6 insertions(+), 4 deletions(-) > >diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml >index 6a5e8693e80..7c7597e31b6 100644 >--- a/.gitlab-ci.yml >+++ b/.gitlab-ci.yml >@@ -22,7 +22,7 @@ variables: > # Set this to the contents of bootstrap/sha1sum.txt > # which is generated by bootstrap/template.py --render > # >- SAMBA_CI_CONTAINER_TAG: 7414ad7ef9108d406b1f6b17ebce19e32aee9f70 >+ SAMBA_CI_CONTAINER_TAG: 5a03ad6f346def64a757bcd2e71dc9a5c10ceae0 > # > # We use the ubuntu1804 image as default as > # it matches what we have on sn-devel-184. >diff --git a/bootstrap/config.py b/bootstrap/config.py >index 196f9bdf8eb..93e321a7e81 100644 >--- a/bootstrap/config.py >+++ b/bootstrap/config.py >@@ -228,7 +228,8 @@ set -xueo pipefail > yum update -y > yum install -y dnf-plugins-core > yum install -y epel-release >-yum config-manager --set-enabled PowerTools -y >+yum config-manager --set-enabled PowerTools -y || \ >+ yum config-manager --set-enabled powertools -y > yum update -y > > yum install -y \ >diff --git a/bootstrap/generated-dists/centos8/bootstrap.sh b/bootstrap/generated-dists/centos8/bootstrap.sh >index 61debd5e2ee..2ee15dba86c 100755 >--- a/bootstrap/generated-dists/centos8/bootstrap.sh >+++ b/bootstrap/generated-dists/centos8/bootstrap.sh >@@ -10,7 +10,8 @@ set -xueo pipefail > yum update -y > yum install -y dnf-plugins-core > yum install -y epel-release >-yum config-manager --set-enabled PowerTools -y >+yum config-manager --set-enabled PowerTools -y || \ >+ yum config-manager --set-enabled powertools -y > yum update -y > > yum install -y \ >diff --git a/bootstrap/sha1sum.txt b/bootstrap/sha1sum.txt >index 085ef7c5297..b1e6736def0 100644 >--- a/bootstrap/sha1sum.txt >+++ b/bootstrap/sha1sum.txt >@@ -1 +1 @@ >-7414ad7ef9108d406b1f6b17ebce19e32aee9f70 >+5a03ad6f346def64a757bcd2e71dc9a5c10ceae0 >-- >2.25.1 > > >From 64b62b7c9fea1b288d4eec350dcadaa7e8785e65 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Tue, 24 Mar 2020 14:02:58 +0100 >Subject: [PATCH 013/380] python/tests: let usage.py be more verbose on errors > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >(cherry picked from commit 0f805db40a4948f9902733aa03ed6ae2789dabb3) >--- > python/samba/tests/usage.py | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 4b7bccde758..259ec91f66e 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -331,8 +331,9 @@ class HelpTestSuper(TestCase): > > if self.check_return_code: > self.assertEqual(p.returncode, 0, >- "%s %s\nreturncode should not be %d" % >- (filename, h, p.returncode)) >+ "%s %s\nreturncode should not be %d\n" >+ "err:\n%s\nout:\n%s" % >+ (filename, h, p.returncode, err, out)) > if self.check_contains_usage: > self.assertIn('usage', outl, 'lacks "Usage:"\n') > if self.check_multiline: >-- >2.25.1 > > >From c55219d57f55e0bd300a23b505c2d0d1e657fd43 Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Sat, 15 Feb 2020 18:33:33 +0100 >Subject: [PATCH 014/380] python/tests/krb5: add crypto.py from greghudson/pyk5 > as kcrypto.py > >This is crypto.py of commit f0612aa908062fb239d1c3873595e7204ae1691d >from https://github.com/greghudson/pyk5.git > >This will be used in order to do raw protocol testing against >[MS-KILE] KDCs. > >Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> > >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit 679bb52c957dafcec96ff37f87d8c3496996b909) >--- > python/samba/tests/krb5/kcrypto.py | 713 +++++++++++++++++++++++++++++ > python/samba/tests/source.py | 6 + > python/samba/tests/usage.py | 4 +- > 3 files changed, 722 insertions(+), 1 deletion(-) > create mode 100644 python/samba/tests/krb5/kcrypto.py > >diff --git a/python/samba/tests/krb5/kcrypto.py b/python/samba/tests/krb5/kcrypto.py >new file mode 100644 >index 00000000000..18c0f71c24c >--- /dev/null >+++ b/python/samba/tests/krb5/kcrypto.py >@@ -0,0 +1,713 @@ >+# Copyright (C) 2013 by the Massachusetts Institute of Technology. >+# All rights reserved. >+# >+# Redistribution and use in source and binary forms, with or without >+# modification, are permitted provided that the following conditions >+# are met: >+# >+# * Redistributions of source code must retain the above copyright >+# notice, this list of conditions and the following disclaimer. >+# >+# * Redistributions in binary form must reproduce the above copyright >+# notice, this list of conditions and the following disclaimer in >+# the documentation and/or other materials provided with the >+# distribution. >+# >+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS >+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT >+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS >+# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE >+# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, >+# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES >+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR >+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) >+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, >+# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) >+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED >+# OF THE POSSIBILITY OF SUCH DAMAGE. >+ >+# XXX current status: >+# * Done and tested >+# - AES encryption, checksum, string2key, prf >+# - cf2 (needed for FAST) >+# * Still to do: >+# - DES enctypes and cksumtypes >+# - RC4 exported enctype (if we need it for anything) >+# - Unkeyed checksums >+# - Special RC4, raw DES/DES3 operations for GSSAPI >+# * Difficult or low priority: >+# - Camellia not supported by PyCrypto >+# - Cipher state only needed for kcmd suite >+# - Nonstandard enctypes and cksumtypes like des-hmac-sha1 >+ >+from math import gcd >+from functools import reduce >+from struct import pack, unpack >+from Crypto.Cipher import AES, DES3, ARC4 >+from Crypto.Hash import HMAC, MD4, MD5, SHA >+from Crypto.Protocol.KDF import PBKDF2 >+from Crypto.Random import get_random_bytes >+ >+ >+class Enctype(object): >+ DES_CRC = 1 >+ DES_MD4 = 2 >+ DES_MD5 = 3 >+ DES3 = 16 >+ AES128 = 17 >+ AES256 = 18 >+ RC4 = 23 >+ >+ >+class Cksumtype(object): >+ CRC32 = 1 >+ MD4 = 2 >+ MD4_DES = 3 >+ MD5 = 7 >+ MD5_DES = 8 >+ SHA1 = 9 >+ SHA1_DES3 = 12 >+ SHA1_AES128 = 15 >+ SHA1_AES256 = 16 >+ HMAC_MD5 = -138 >+ >+ >+class InvalidChecksum(ValueError): >+ pass >+ >+ >+def _zeropad(s, padsize): >+ # Return s padded with 0 bytes to a multiple of padsize. >+ padlen = (padsize - (len(s) % padsize)) % padsize >+ return s + bytes(padlen) >+ >+ >+def _xorbytes(b1, b2): >+ # xor two strings together and return the resulting string. >+ assert len(b1) == len(b2) >+ return bytes([x ^ y for x, y in zip(b1, b2)]) >+ >+ >+def _mac_equal(mac1, mac2): >+ # Constant-time comparison function. (We can't use HMAC.verify >+ # since we use truncated macs.) >+ assert len(mac1) == len(mac2) >+ res = 0 >+ for x, y in zip(mac1, mac2): >+ res |= x ^ y >+ return res == 0 >+ >+ >+def _nfold(str, nbytes): >+ # Convert str to a string of length nbytes using the RFC 3961 nfold >+ # operation. >+ >+ # Rotate the bytes in str to the right by nbits bits. >+ def rotate_right(str, nbits): >+ nbytes, remain = (nbits//8) % len(str), nbits % 8 >+ return bytes([(str[i-nbytes] >> remain) | >+ (str[i-nbytes-1] << (8-remain) & 0xff) >+ for i in range(len(str))]) >+ >+ # Add equal-length strings together with end-around carry. >+ def add_ones_complement(str1, str2): >+ n = len(str1) >+ v = [a + b for a, b in zip(str1, str2)] >+ # Propagate carry bits to the left until there aren't any left. >+ while any(x & ~0xff for x in v): >+ v = [(v[i-n+1]>>8) + (v[i]&0xff) for i in range(n)] >+ return bytes([x for x in v]) >+ >+ # Concatenate copies of str to produce the least common multiple >+ # of len(str) and nbytes, rotating each copy of str to the right >+ # by 13 bits times its list position. Decompose the concatenation >+ # into slices of length nbytes, and add them together as >+ # big-endian ones' complement integers. >+ slen = len(str) >+ lcm = nbytes * slen // gcd(nbytes, slen) >+ bigstr = b''.join((rotate_right(str, 13 * i) for i in range(lcm // slen))) >+ slices = (bigstr[p:p+nbytes] for p in range(0, lcm, nbytes)) >+ return reduce(add_ones_complement, slices) >+ >+ >+def _is_weak_des_key(keybytes): >+ return keybytes in (b'\x01\x01\x01\x01\x01\x01\x01\x01', >+ b'\xFE\xFE\xFE\xFE\xFE\xFE\xFE\xFE', >+ b'\x1F\x1F\x1F\x1F\x0E\x0E\x0E\x0E', >+ b'\xE0\xE0\xE0\xE0\xF1\xF1\xF1\xF1', >+ b'\x01\xFE\x01\xFE\x01\xFE\x01\xFE', >+ b'\xFE\x01\xFE\x01\xFE\x01\xFE\x01', >+ b'\x1F\xE0\x1F\xE0\x0E\xF1\x0E\xF1', >+ b'\xE0\x1F\xE0\x1F\xF1\x0E\xF1\x0E', >+ b'\x01\xE0\x01\xE0\x01\xF1\x01\xF1', >+ b'\xE0\x01\xE0\x01\xF1\x01\xF1\x01', >+ b'\x1F\xFE\x1F\xFE\x0E\xFE\x0E\xFE', >+ b'\xFE\x1F\xFE\x1F\xFE\x0E\xFE\x0E', >+ b'\x01\x1F\x01\x1F\x01\x0E\x01\x0E', >+ b'\x1F\x01\x1F\x01\x0E\x01\x0E\x01', >+ b'\xE0\xFE\xE0\xFE\xF1\xFE\xF1\xFE', >+ b'\xFE\xE0\xFE\xE0\xFE\xF1\xFE\xF1') >+ >+ >+class _EnctypeProfile(object): >+ # Base class for enctype profiles. Usable enctype classes must define: >+ # * enctype: enctype number >+ # * keysize: protocol size of key in bytes >+ # * seedsize: random_to_key input size in bytes >+ # * random_to_key (if the keyspace is not dense) >+ # * string_to_key >+ # * encrypt >+ # * decrypt >+ # * prf >+ >+ @classmethod >+ def random_to_key(cls, seed): >+ if len(seed) != cls.seedsize: >+ raise ValueError('Wrong seed length') >+ return Key(cls.enctype, seed) >+ >+ >+class _SimplifiedEnctype(_EnctypeProfile): >+ # Base class for enctypes using the RFC 3961 simplified profile. >+ # Defines the encrypt, decrypt, and prf methods. Subclasses must >+ # define: >+ # * blocksize: Underlying cipher block size in bytes >+ # * padsize: Underlying cipher padding multiple (1 or blocksize) >+ # * macsize: Size of integrity MAC in bytes >+ # * hashmod: PyCrypto hash module for underlying hash function >+ # * basic_encrypt, basic_decrypt: Underlying CBC/CTS cipher >+ >+ @classmethod >+ def derive(cls, key, constant): >+ # RFC 3961 only says to n-fold the constant only if it is >+ # shorter than the cipher block size. But all Unix >+ # implementations n-fold constants if their length is larger >+ # than the block size as well, and n-folding when the length >+ # is equal to the block size is a no-op. >+ plaintext = _nfold(constant, cls.blocksize) >+ rndseed = b'' >+ while len(rndseed) < cls.seedsize: >+ ciphertext = cls.basic_encrypt(key, plaintext) >+ rndseed += ciphertext >+ plaintext = ciphertext >+ return cls.random_to_key(rndseed[0:cls.seedsize]) >+ >+ @classmethod >+ def encrypt(cls, key, keyusage, plaintext, confounder): >+ ki = cls.derive(key, pack('>iB', keyusage, 0x55)) >+ ke = cls.derive(key, pack('>iB', keyusage, 0xAA)) >+ if confounder is None: >+ confounder = get_random_bytes(cls.blocksize) >+ basic_plaintext = confounder + _zeropad(plaintext, cls.padsize) >+ hmac = HMAC.new(ki.contents, basic_plaintext, cls.hashmod).digest() >+ return cls.basic_encrypt(ke, basic_plaintext) + hmac[:cls.macsize] >+ >+ @classmethod >+ def decrypt(cls, key, keyusage, ciphertext): >+ ki = cls.derive(key, pack('>iB', keyusage, 0x55)) >+ ke = cls.derive(key, pack('>iB', keyusage, 0xAA)) >+ if len(ciphertext) < cls.blocksize + cls.macsize: >+ raise ValueError('ciphertext too short') >+ basic_ctext, mac = ciphertext[:-cls.macsize], ciphertext[-cls.macsize:] >+ if len(basic_ctext) % cls.padsize != 0: >+ raise ValueError('ciphertext does not meet padding requirement') >+ basic_plaintext = cls.basic_decrypt(ke, basic_ctext) >+ hmac = HMAC.new(ki.contents, basic_plaintext, cls.hashmod).digest() >+ expmac = hmac[:cls.macsize] >+ if not _mac_equal(mac, expmac): >+ raise InvalidChecksum('ciphertext integrity failure') >+ # Discard the confounder. >+ return basic_plaintext[cls.blocksize:] >+ >+ @classmethod >+ def prf(cls, key, string): >+ # Hash the input. RFC 3961 says to truncate to the padding >+ # size, but implementations truncate to the block size. >+ hashval = cls.hashmod.new(string).digest() >+ truncated = hashval[:-(len(hashval) % cls.blocksize)] >+ # Encrypt the hash with a derived key. >+ kp = cls.derive(key, b'prf') >+ return cls.basic_encrypt(kp, truncated) >+ >+ >+class _DES3CBC(_SimplifiedEnctype): >+ enctype = Enctype.DES3 >+ keysize = 24 >+ seedsize = 21 >+ blocksize = 8 >+ padsize = 8 >+ macsize = 20 >+ hashmod = SHA >+ >+ @classmethod >+ def random_to_key(cls, seed): >+ # XXX Maybe reframe as _DESEnctype.random_to_key and use that >+ # way from DES3 random-to-key when DES is implemented, since >+ # MIT does this instead of the RFC 3961 random-to-key. >+ def expand(seed): >+ def parity(b): >+ # Return b with the low-order bit set to yield odd parity. >+ b &= ~1 >+ return b if bin(b & ~1).count('1') % 2 else b | 1 >+ assert len(seed) == 7 >+ firstbytes = [parity(b & ~1) for b in seed] >+ lastbyte = parity(sum((seed[i]&1) << i+1 for i in range(7))) >+ keybytes = bytes([b for b in firstbytes + [lastbyte]]) >+ if _is_weak_des_key(keybytes): >+ keybytes[7] = bytes([keybytes[7] ^ 0xF0]) >+ return keybytes >+ >+ if len(seed) != 21: >+ raise ValueError('Wrong seed length') >+ k1, k2, k3 = expand(seed[:7]), expand(seed[7:14]), expand(seed[14:]) >+ return Key(cls.enctype, k1 + k2 + k3) >+ >+ @classmethod >+ def string_to_key(cls, string, salt, params): >+ if params is not None and params != b'': >+ raise ValueError('Invalid DES3 string-to-key parameters') >+ k = cls.random_to_key(_nfold(string + salt, 21)) >+ return cls.derive(k, b'kerberos') >+ >+ @classmethod >+ def basic_encrypt(cls, key, plaintext): >+ assert len(plaintext) % 8 == 0 >+ des3 = DES3.new(key.contents, AES.MODE_CBC, bytes(8)) >+ return des3.encrypt(plaintext) >+ >+ @classmethod >+ def basic_decrypt(cls, key, ciphertext): >+ assert len(ciphertext) % 8 == 0 >+ des3 = DES3.new(key.contents, AES.MODE_CBC, bytes(8)) >+ return des3.decrypt(ciphertext) >+ >+ >+class _AESEnctype(_SimplifiedEnctype): >+ # Base class for aes128-cts and aes256-cts. >+ blocksize = 16 >+ padsize = 1 >+ macsize = 12 >+ hashmod = SHA >+ >+ @classmethod >+ def string_to_key(cls, string, salt, params): >+ (iterations,) = unpack('>L', params or b'\x00\x00\x10\x00') >+ prf = lambda p, s: HMAC.new(p, s, SHA).digest() >+ seed = PBKDF2(string, salt, cls.seedsize, iterations, prf) >+ tkey = cls.random_to_key(seed) >+ return cls.derive(tkey, b'kerberos') >+ >+ @classmethod >+ def basic_encrypt(cls, key, plaintext): >+ assert len(plaintext) >= 16 >+ aes = AES.new(key.contents, AES.MODE_CBC, bytes(16)) >+ ctext = aes.encrypt(_zeropad(plaintext, 16)) >+ if len(plaintext) > 16: >+ # Swap the last two ciphertext blocks and truncate the >+ # final block to match the plaintext length. >+ lastlen = len(plaintext) % 16 or 16 >+ ctext = ctext[:-32] + ctext[-16:] + ctext[-32:-16][:lastlen] >+ return ctext >+ >+ @classmethod >+ def basic_decrypt(cls, key, ciphertext): >+ assert len(ciphertext) >= 16 >+ aes = AES.new(key.contents, AES.MODE_ECB) >+ if len(ciphertext) == 16: >+ return aes.decrypt(ciphertext) >+ # Split the ciphertext into blocks. The last block may be partial. >+ cblocks = [ciphertext[p:p+16] for p in range(0, len(ciphertext), 16)] >+ lastlen = len(cblocks[-1]) >+ # CBC-decrypt all but the last two blocks. >+ prev_cblock = bytes(16) >+ plaintext = b'' >+ for b in cblocks[:-2]: >+ plaintext += _xorbytes(aes.decrypt(b), prev_cblock) >+ prev_cblock = b >+ # Decrypt the second-to-last cipher block. The left side of >+ # the decrypted block will be the final block of plaintext >+ # xor'd with the final partial cipher block; the right side >+ # will be the omitted bytes of ciphertext from the final >+ # block. >+ b = aes.decrypt(cblocks[-2]) >+ lastplaintext =_xorbytes(b[:lastlen], cblocks[-1]) >+ omitted = b[lastlen:] >+ # Decrypt the final cipher block plus the omitted bytes to get >+ # the second-to-last plaintext block. >+ plaintext += _xorbytes(aes.decrypt(cblocks[-1] + omitted), prev_cblock) >+ return plaintext + lastplaintext >+ >+ >+class _AES128CTS(_AESEnctype): >+ enctype = Enctype.AES128 >+ keysize = 16 >+ seedsize = 16 >+ >+ >+class _AES256CTS(_AESEnctype): >+ enctype = Enctype.AES256 >+ keysize = 32 >+ seedsize = 32 >+ >+ >+class _RC4(_EnctypeProfile): >+ enctype = Enctype.RC4 >+ keysize = 16 >+ seedsize = 16 >+ >+ @staticmethod >+ def usage_str(keyusage): >+ # Return a four-byte string for an RFC 3961 keyusage, using >+ # the RFC 4757 rules. Per the errata, do not map 9 to 8. >+ table = {3: 8, 23: 13} >+ msusage = table[keyusage] if keyusage in table else keyusage >+ return pack('<i', msusage) >+ >+ @classmethod >+ def string_to_key(cls, string, salt, params): >+ utf16string = string.decode('UTF-8').encode('UTF-16LE') >+ return Key(cls.enctype, MD4.new(utf16string).digest()) >+ >+ @classmethod >+ def encrypt(cls, key, keyusage, plaintext, confounder): >+ if confounder is None: >+ confounder = get_random_bytes(8) >+ ki = HMAC.new(key.contents, cls.usage_str(keyusage), MD5).digest() >+ cksum = HMAC.new(ki, confounder + plaintext, MD5).digest() >+ ke = HMAC.new(ki, cksum, MD5).digest() >+ return cksum + ARC4.new(ke).encrypt(confounder + plaintext) >+ >+ @classmethod >+ def decrypt(cls, key, keyusage, ciphertext): >+ if len(ciphertext) < 24: >+ raise ValueError('ciphertext too short') >+ cksum, basic_ctext = ciphertext[:16], ciphertext[16:] >+ ki = HMAC.new(key.contents, cls.usage_str(keyusage), MD5).digest() >+ ke = HMAC.new(ki, cksum, MD5).digest() >+ basic_plaintext = ARC4.new(ke).decrypt(basic_ctext) >+ exp_cksum = HMAC.new(ki, basic_plaintext, MD5).digest() >+ ok = _mac_equal(cksum, exp_cksum) >+ if not ok and keyusage == 9: >+ # Try again with usage 8, due to RFC 4757 errata. >+ ki = HMAC.new(key.contents, pack('<i', 8), MD5).digest() >+ exp_cksum = HMAC.new(ki, basic_plaintext, MD5).digest() >+ ok = _mac_equal(cksum, exp_cksum) >+ if not ok: >+ raise InvalidChecksum('ciphertext integrity failure') >+ # Discard the confounder. >+ return basic_plaintext[8:] >+ >+ @classmethod >+ def prf(cls, key, string): >+ return HMAC.new(key.contents, string, SHA).digest() >+ >+ >+class _ChecksumProfile(object): >+ # Base class for checksum profiles. Usable checksum classes must >+ # define: >+ # * checksum >+ # * verify (if verification is not just checksum-and-compare) >+ @classmethod >+ def verify(cls, key, keyusage, text, cksum): >+ expected = cls.checksum(key, keyusage, text) >+ if not _mac_equal(cksum, expected): >+ raise InvalidChecksum('checksum verification failure') >+ >+ >+class _SimplifiedChecksum(_ChecksumProfile): >+ # Base class for checksums using the RFC 3961 simplified profile. >+ # Defines the checksum and verify methods. Subclasses must >+ # define: >+ # * macsize: Size of checksum in bytes >+ # * enc: Profile of associated enctype >+ >+ @classmethod >+ def checksum(cls, key, keyusage, text): >+ kc = cls.enc.derive(key, pack('>iB', keyusage, 0x99)) >+ hmac = HMAC.new(kc.contents, text, cls.enc.hashmod).digest() >+ return hmac[:cls.macsize] >+ >+ @classmethod >+ def verify(cls, key, keyusage, text, cksum): >+ if key.enctype != cls.enc.enctype: >+ raise ValueError('Wrong key type for checksum') >+ super(_SimplifiedChecksum, cls).verify(key, keyusage, text, cksum) >+ >+ >+class _SHA1AES128(_SimplifiedChecksum): >+ macsize = 12 >+ enc = _AES128CTS >+ >+ >+class _SHA1AES256(_SimplifiedChecksum): >+ macsize = 12 >+ enc = _AES256CTS >+ >+ >+class _SHA1DES3(_SimplifiedChecksum): >+ macsize = 20 >+ enc = _DES3CBC >+ >+ >+class _HMACMD5(_ChecksumProfile): >+ @classmethod >+ def checksum(cls, key, keyusage, text): >+ ksign = HMAC.new(key.contents, b'signaturekey\0', MD5).digest() >+ md5hash = MD5.new(_RC4.usage_str(keyusage) + text).digest() >+ return HMAC.new(ksign, md5hash, MD5).digest() >+ >+ @classmethod >+ def verify(cls, key, keyusage, text, cksum): >+ if key.enctype != Enctype.RC4: >+ raise ValueError('Wrong key type for checksum') >+ super(_HMACMD5, cls).verify(key, keyusage, text, cksum) >+ >+ >+_enctype_table = { >+ Enctype.DES3: _DES3CBC, >+ Enctype.AES128: _AES128CTS, >+ Enctype.AES256: _AES256CTS, >+ Enctype.RC4: _RC4 >+} >+ >+ >+_checksum_table = { >+ Cksumtype.SHA1_DES3: _SHA1DES3, >+ Cksumtype.SHA1_AES128: _SHA1AES128, >+ Cksumtype.SHA1_AES256: _SHA1AES256, >+ Cksumtype.HMAC_MD5: _HMACMD5 >+} >+ >+ >+def _get_enctype_profile(enctype): >+ if enctype not in _enctype_table: >+ raise ValueError('Invalid enctype %d' % enctype) >+ return _enctype_table[enctype] >+ >+ >+def _get_checksum_profile(cksumtype): >+ if cksumtype not in _checksum_table: >+ raise ValueError('Invalid cksumtype %d' % cksumtype) >+ return _checksum_table[cksumtype] >+ >+ >+class Key(object): >+ def __init__(self, enctype, contents): >+ e = _get_enctype_profile(enctype) >+ if len(contents) != e.keysize: >+ raise ValueError('Wrong key length') >+ self.enctype = enctype >+ self.contents = contents >+ >+ >+def seedsize(enctype): >+ e = _get_enctype_profile(enctype) >+ return e.seedsize >+ >+ >+def random_to_key(enctype, seed): >+ e = _get_enctype_profile(enctype) >+ if len(seed) != e.seedsize: >+ raise ValueError('Wrong crypto seed length') >+ return e.random_to_key(seed) >+ >+ >+def string_to_key(enctype, string, salt, params=None): >+ e = _get_enctype_profile(enctype) >+ return e.string_to_key(string, salt, params) >+ >+ >+def encrypt(key, keyusage, plaintext, confounder=None): >+ e = _get_enctype_profile(key.enctype) >+ return e.encrypt(key, keyusage, plaintext, confounder) >+ >+ >+def decrypt(key, keyusage, ciphertext): >+ # Throw InvalidChecksum on checksum failure. Throw ValueError on >+ # invalid key enctype or malformed ciphertext. >+ e = _get_enctype_profile(key.enctype) >+ return e.decrypt(key, keyusage, ciphertext) >+ >+ >+def prf(key, string): >+ e = _get_enctype_profile(key.enctype) >+ return e.prf(key, string) >+ >+ >+def make_checksum(cksumtype, key, keyusage, text): >+ c = _get_checksum_profile(cksumtype) >+ return c.checksum(key, keyusage, text) >+ >+ >+def verify_checksum(cksumtype, key, keyusage, text, cksum): >+ # Throw InvalidChecksum exception on checksum failure. Throw >+ # ValueError on invalid cksumtype, invalid key enctype, or >+ # malformed checksum. >+ c = _get_checksum_profile(cksumtype) >+ c.verify(key, keyusage, text, cksum) >+ >+ >+def prfplus(key, pepper, l): >+ # Produce l bytes of output using the RFC 6113 PRF+ function. >+ out = b'' >+ count = 1 >+ while len(out) < l: >+ out += prf(key, bytes([count]) + pepper) >+ count += 1 >+ return out[:l] >+ >+ >+def cf2(enctype, key1, key2, pepper1, pepper2): >+ # Combine two keys and two pepper strings to produce a result key >+ # of type enctype, using the RFC 6113 KRB-FX-CF2 function. >+ e = _get_enctype_profile(enctype) >+ return e.random_to_key(_xorbytes(prfplus(key1, pepper1, e.seedsize), >+ prfplus(key2, pepper2, e.seedsize))) >+ >+ >+if __name__ == '__main__': >+ def h(hexstr): >+ return bytes.fromhex(hexstr) >+ >+ # AES128 encrypt and decrypt >+ kb = h('9062430C8CDA3388922E6D6A509F5B7A') >+ conf = h('94B491F481485B9A0678CD3C4EA386AD') >+ keyusage = 2 >+ plain = b'9 bytesss' >+ ctxt = h('68FB9679601F45C78857B2BF820FD6E53ECA8D42FD4B1D7024A09205ABB7CD2E' >+ 'C26C355D2F') >+ k = Key(Enctype.AES128, kb) >+ assert(encrypt(k, keyusage, plain, conf) == ctxt) >+ assert(decrypt(k, keyusage, ctxt) == plain) >+ >+ # AES256 encrypt and decrypt >+ kb = h('F1C795E9248A09338D82C3F8D5B567040B0110736845041347235B1404231398') >+ conf = h('E45CA518B42E266AD98E165E706FFB60') >+ keyusage = 4 >+ plain = b'30 bytes bytes bytes bytes byt' >+ ctxt = h('D1137A4D634CFECE924DBC3BF6790648BD5CFF7DE0E7B99460211D0DAEF3D79A' >+ '295C688858F3B34B9CBD6EEBAE81DAF6B734D4D498B6714F1C1D') >+ k = Key(Enctype.AES256, kb) >+ assert(encrypt(k, keyusage, plain, conf) == ctxt) >+ assert(decrypt(k, keyusage, ctxt) == plain) >+ >+ # AES128 checksum >+ kb = h('9062430C8CDA3388922E6D6A509F5B7A') >+ keyusage = 3 >+ plain = b'eight nine ten eleven twelve thirteen' >+ cksum = h('01A4B088D45628F6946614E3') >+ k = Key(Enctype.AES128, kb) >+ verify_checksum(Cksumtype.SHA1_AES128, k, keyusage, plain, cksum) >+ >+ # AES256 checksum >+ kb = h('B1AE4CD8462AFF1677053CC9279AAC30B796FB81CE21474DD3DDBCFEA4EC76D7') >+ keyusage = 4 >+ plain = b'fourteen' >+ cksum = h('E08739E3279E2903EC8E3836') >+ k = Key(Enctype.AES256, kb) >+ verify_checksum(Cksumtype.SHA1_AES256, k, keyusage, plain, cksum) >+ >+ # AES128 string-to-key >+ string = b'password' >+ salt = b'ATHENA.MIT.EDUraeburn' >+ params = h('00000002') >+ kb = h('C651BF29E2300AC27FA469D693BDDA13') >+ k = string_to_key(Enctype.AES128, string, salt, params) >+ assert(k.contents == kb) >+ >+ # AES256 string-to-key >+ string = b'X' * 64 >+ salt = b'pass phrase equals block size' >+ params = h('000004B0') >+ kb = h('89ADEE3608DB8BC71F1BFBFE459486B05618B70CBAE22092534E56C553BA4B34') >+ k = string_to_key(Enctype.AES256, string, salt, params) >+ assert(k.contents == kb) >+ >+ # AES128 prf >+ kb = h('77B39A37A868920F2A51F9DD150C5717') >+ k = string_to_key(Enctype.AES128, b'key1', b'key1') >+ assert(prf(k, b'\x01\x61') == kb) >+ >+ # AES256 prf >+ kb = h('0D674DD0F9A6806525A4D92E828BD15A') >+ k = string_to_key(Enctype.AES256, b'key2', b'key2') >+ assert(prf(k, b'\x02\x62') == kb) >+ >+ # AES128 cf2 >+ kb = h('97DF97E4B798B29EB31ED7280287A92A') >+ k1 = string_to_key(Enctype.AES128, b'key1', b'key1') >+ k2 = string_to_key(Enctype.AES128, b'key2', b'key2') >+ k = cf2(Enctype.AES128, k1, k2, b'a', b'b') >+ assert(k.contents == kb) >+ >+ # AES256 cf2 >+ kb = h('4D6CA4E629785C1F01BAF55E2E548566B9617AE3A96868C337CB93B5E72B1C7B') >+ k1 = string_to_key(Enctype.AES256, b'key1', b'key1') >+ k2 = string_to_key(Enctype.AES256, b'key2', b'key2') >+ k = cf2(Enctype.AES256, k1, k2, b'a', b'b') >+ assert(k.contents == kb) >+ >+ # DES3 encrypt and decrypt >+ kb = h('0DD52094E0F41CECCB5BE510A764B35176E3981332F1E598') >+ conf = h('94690A17B2DA3C9B') >+ keyusage = 3 >+ plain = b'13 bytes byte' >+ ctxt = h('839A17081ECBAFBCDC91B88C6955DD3C4514023CF177B77BF0D0177A16F705E8' >+ '49CB7781D76A316B193F8D30') >+ k = Key(Enctype.DES3, kb) >+ assert(encrypt(k, keyusage, plain, conf) == ctxt) >+ assert(decrypt(k, keyusage, ctxt) == _zeropad(plain, 8)) >+ >+ # DES3 string-to-key >+ string = b'password' >+ salt = b'ATHENA.MIT.EDUraeburn' >+ kb = h('850BB51358548CD05E86768C313E3BFEF7511937DCF72C3E') >+ k = string_to_key(Enctype.DES3, string, salt) >+ assert(k.contents == kb) >+ >+ # DES3 checksum >+ kb = h('7A25DF8992296DCEDA0E135BC4046E2375B3C14C98FBC162') >+ keyusage = 2 >+ plain = b'six seven' >+ cksum = h('0EEFC9C3E049AABC1BA5C401677D9AB699082BB4') >+ k = Key(Enctype.DES3, kb) >+ verify_checksum(Cksumtype.SHA1_DES3, k, keyusage, plain, cksum) >+ >+ # DES3 cf2 >+ kb = h('E58F9EB643862C13AD38E529313462A7F73E62834FE54A01') >+ k1 = string_to_key(Enctype.DES3, b'key1', b'key1') >+ k2 = string_to_key(Enctype.DES3, b'key2', b'key2') >+ k = cf2(Enctype.DES3, k1, k2, b'a', b'b') >+ assert(k.contents == kb) >+ >+ # RC4 encrypt and decrypt >+ kb = h('68F263DB3FCE15D031C9EAB02D67107A') >+ conf = h('37245E73A45FBF72') >+ keyusage = 4 >+ plain = b'30 bytes bytes bytes bytes byt' >+ ctxt = h('95F9047C3AD75891C2E9B04B16566DC8B6EB9CE4231AFB2542EF87A7B5A0F260' >+ 'A99F0460508DE0CECC632D07C354124E46C5D2234EB8') >+ k = Key(Enctype.RC4, kb) >+ assert(encrypt(k, keyusage, plain, conf) == ctxt) >+ assert(decrypt(k, keyusage, ctxt) == plain) >+ >+ # RC4 string-to-key >+ string = b'foo' >+ kb = h('AC8E657F83DF82BEEA5D43BDAF7800CC') >+ k = string_to_key(Enctype.RC4, string, None) >+ assert(k.contents == kb) >+ >+ # RC4 checksum >+ kb = h('F7D3A155AF5E238A0B7A871A96BA2AB2') >+ keyusage = 6 >+ plain = b'seventeen eighteen nineteen twenty' >+ cksum = h('EB38CC97E2230F59DA4117DC5859D7EC') >+ k = Key(Enctype.RC4, kb) >+ verify_checksum(Cksumtype.HMAC_MD5, k, keyusage, plain, cksum) >+ >+ # RC4 cf2 >+ kb = h('24D7F6B6BAE4E5C00D2082C5EBAB3672') >+ k1 = string_to_key(Enctype.RC4, b'key1', b'key1') >+ k2 = string_to_key(Enctype.RC4, b'key2', b'key2') >+ k = cf2(Enctype.RC4, k1, k2, b'a', b'b') >+ assert(k.contents == kb) >diff --git a/python/samba/tests/source.py b/python/samba/tests/source.py >index 4bb652c4204..b7608b1bab3 100644 >--- a/python/samba/tests/source.py >+++ b/python/samba/tests/source.py >@@ -90,6 +90,9 @@ class TestSource(TestCase): > if "wafsamba" in fname: > # FIXME: No copyright headers in wafsamba > continue >+ if fname.endswith("python/samba/tests/krb5/kcrypto.py"): >+ # Imported from MIT testing repo >+ continue > match = copyright_re.search(text) > if not match: > incorrect.append((fname, 'no copyright line found\n')) >@@ -132,6 +135,9 @@ class TestSource(TestCase): > # Imported from subunit/testtools, which are dual > # Apache2/BSD-3. > continue >+ if fname.endswith("python/samba/tests/krb5/kcrypto.py"): >+ # Imported from MIT testing repo >+ continue > if not gpl_re.search(text): > incorrect.append(fname) > >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 259ec91f66e..06fdc9afacb 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -84,7 +84,8 @@ EXCLUDE_USAGE = { > 'selftest/tests.py', > 'python/samba/subunit/run.py', > 'bin/python/samba/subunit/run.py', >- 'python/samba/tests/dcerpc/raw_protocol.py' >+ 'python/samba/tests/dcerpc/raw_protocol.py', >+ 'python/samba/tests/krb5/kcrypto.py', > } > > EXCLUDE_HELP = { >@@ -101,6 +102,7 @@ EXCLUDE_DIRS = { > 'bin/ab', > 'bin/python/samba/tests', > 'bin/python/samba/tests/dcerpc', >+ 'bin/python/samba/tests/krb5', > } > > >-- >2.25.1 > > >From c0bc4d8fafb7773ce10462f2234b52de5aaff702 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Fri, 20 Mar 2020 12:47:39 +0100 >Subject: [PATCH 015/380] python/tests/krb5: convert kcrypto.py to > python3-cryptography and a few Samba helpers > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >(cherry picked from commit 8bdd37997686d4ca60584bdfda78440be8432405) >--- > python/samba/tests/krb5/kcrypto.py | 460 +++++++++++++++++------------ > 1 file changed, 273 insertions(+), 187 deletions(-) > mode change 100644 => 100755 python/samba/tests/krb5/kcrypto.py > >diff --git a/python/samba/tests/krb5/kcrypto.py b/python/samba/tests/krb5/kcrypto.py >old mode 100644 >new mode 100755 >index 18c0f71c24c..0907d881b68 >--- a/python/samba/tests/krb5/kcrypto.py >+++ b/python/samba/tests/krb5/kcrypto.py >@@ -1,3 +1,5 @@ >+#!/usr/bin/env python3 >+# > # Copyright (C) 2013 by the Massachusetts Institute of Technology. > # All rights reserved. > # >@@ -40,14 +42,26 @@ > # - Cipher state only needed for kcmd suite > # - Nonstandard enctypes and cksumtypes like des-hmac-sha1 > >+import sys >+import os >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ > from math import gcd > from functools import reduce > from struct import pack, unpack >-from Crypto.Cipher import AES, DES3, ARC4 >-from Crypto.Hash import HMAC, MD4, MD5, SHA >-from Crypto.Protocol.KDF import PBKDF2 >-from Crypto.Random import get_random_bytes >- >+from cryptography.hazmat.primitives import hashes >+from cryptography.hazmat.primitives import hmac >+from cryptography.hazmat.primitives.ciphers import algorithms as ciphers >+from cryptography.hazmat.primitives.ciphers import modes >+from cryptography.hazmat.primitives.ciphers.base import Cipher >+from cryptography.hazmat.backends import default_backend >+from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC >+from samba.tests import TestCase >+from samba.credentials import Credentials >+from samba import generate_random_bytes as get_random_bytes >+from samba.compat import get_string, get_bytes > > class Enctype(object): > DES_CRC = 1 >@@ -97,6 +111,15 @@ def _mac_equal(mac1, mac2): > res |= x ^ y > return res == 0 > >+def SIMPLE_HASH(string, algo_cls): >+ hash_ctx = hashes.Hash(algo_cls(), default_backend()) >+ hash_ctx.update(string) >+ return hash_ctx.finalize() >+ >+def HMAC_HASH(key, string, algo_cls): >+ hmac_ctx = hmac.HMAC(key, algo_cls(), default_backend()) >+ hmac_ctx.update(string) >+ return hmac_ctx.finalize() > > def _nfold(str, nbytes): > # Convert str to a string of length nbytes using the RFC 3961 nfold >@@ -199,7 +222,7 @@ class _SimplifiedEnctype(_EnctypeProfile): > if confounder is None: > confounder = get_random_bytes(cls.blocksize) > basic_plaintext = confounder + _zeropad(plaintext, cls.padsize) >- hmac = HMAC.new(ki.contents, basic_plaintext, cls.hashmod).digest() >+ hmac = HMAC_HASH(ki.contents, basic_plaintext, cls.hashalgo) > return cls.basic_encrypt(ke, basic_plaintext) + hmac[:cls.macsize] > > @classmethod >@@ -212,7 +235,7 @@ class _SimplifiedEnctype(_EnctypeProfile): > if len(basic_ctext) % cls.padsize != 0: > raise ValueError('ciphertext does not meet padding requirement') > basic_plaintext = cls.basic_decrypt(ke, basic_ctext) >- hmac = HMAC.new(ki.contents, basic_plaintext, cls.hashmod).digest() >+ hmac = HMAC_HASH(ki.contents, basic_plaintext, cls.hashalgo) > expmac = hmac[:cls.macsize] > if not _mac_equal(mac, expmac): > raise InvalidChecksum('ciphertext integrity failure') >@@ -223,7 +246,7 @@ class _SimplifiedEnctype(_EnctypeProfile): > def prf(cls, key, string): > # Hash the input. RFC 3961 says to truncate to the padding > # size, but implementations truncate to the block size. >- hashval = cls.hashmod.new(string).digest() >+ hashval = SIMPLE_HASH(string, cls.hashalgo) > truncated = hashval[:-(len(hashval) % cls.blocksize)] > # Encrypt the hash with a derived key. > kp = cls.derive(key, b'prf') >@@ -237,7 +260,7 @@ class _DES3CBC(_SimplifiedEnctype): > blocksize = 8 > padsize = 8 > macsize = 20 >- hashmod = SHA >+ hashalgo = hashes.SHA1 > > @classmethod > def random_to_key(cls, seed): >@@ -272,14 +295,20 @@ class _DES3CBC(_SimplifiedEnctype): > @classmethod > def basic_encrypt(cls, key, plaintext): > assert len(plaintext) % 8 == 0 >- des3 = DES3.new(key.contents, AES.MODE_CBC, bytes(8)) >- return des3.encrypt(plaintext) >+ algo = ciphers.TripleDES(key.contents) >+ cbc = modes.CBC(bytes(8)) >+ encryptor = Cipher(algo, cbc, default_backend()).encryptor() >+ ciphertext = encryptor.update(plaintext) >+ return ciphertext > > @classmethod > def basic_decrypt(cls, key, ciphertext): > assert len(ciphertext) % 8 == 0 >- des3 = DES3.new(key.contents, AES.MODE_CBC, bytes(8)) >- return des3.decrypt(ciphertext) >+ algo = ciphers.TripleDES(key.contents) >+ cbc = modes.CBC(bytes(8)) >+ decryptor = Cipher(algo, cbc, default_backend()).decryptor() >+ plaintext = decryptor.update(ciphertext) >+ return plaintext > > > class _AESEnctype(_SimplifiedEnctype): >@@ -287,21 +316,35 @@ class _AESEnctype(_SimplifiedEnctype): > blocksize = 16 > padsize = 1 > macsize = 12 >- hashmod = SHA >+ hashalgo = hashes.SHA1 > > @classmethod > def string_to_key(cls, string, salt, params): > (iterations,) = unpack('>L', params or b'\x00\x00\x10\x00') >- prf = lambda p, s: HMAC.new(p, s, SHA).digest() >- seed = PBKDF2(string, salt, cls.seedsize, iterations, prf) >+ pwbytes = get_bytes(string) >+ kdf = PBKDF2HMAC(algorithm=hashes.SHA1(), >+ length=cls.seedsize, >+ salt=salt, >+ iterations=iterations, >+ backend=default_backend()) >+ seed = kdf.derive(pwbytes) > tkey = cls.random_to_key(seed) > return cls.derive(tkey, b'kerberos') > > @classmethod > def basic_encrypt(cls, key, plaintext): > assert len(plaintext) >= 16 >- aes = AES.new(key.contents, AES.MODE_CBC, bytes(16)) >- ctext = aes.encrypt(_zeropad(plaintext, 16)) >+ >+ algo = ciphers.AES(key.contents) >+ cbc = modes.CBC(bytes(16)) >+ aes_ctx = Cipher(algo, cbc, default_backend()) >+ >+ def aes_encrypt(plaintext): >+ encryptor = aes_ctx.encryptor() >+ ciphertext = encryptor.update(plaintext) >+ return ciphertext >+ >+ ctext = aes_encrypt(_zeropad(plaintext, 16)) > if len(plaintext) > 16: > # Swap the last two ciphertext blocks and truncate the > # final block to match the plaintext length. >@@ -312,9 +355,18 @@ class _AESEnctype(_SimplifiedEnctype): > @classmethod > def basic_decrypt(cls, key, ciphertext): > assert len(ciphertext) >= 16 >- aes = AES.new(key.contents, AES.MODE_ECB) >+ >+ algo = ciphers.AES(key.contents) >+ cbc = modes.CBC(bytes(16)) >+ aes_ctx = Cipher(algo, cbc, default_backend()) >+ >+ def aes_decrypt(ciphertext): >+ decryptor = aes_ctx.decryptor() >+ plaintext = decryptor.update(ciphertext) >+ return plaintext >+ > if len(ciphertext) == 16: >- return aes.decrypt(ciphertext) >+ return aes_decrypt(ciphertext) > # Split the ciphertext into blocks. The last block may be partial. > cblocks = [ciphertext[p:p+16] for p in range(0, len(ciphertext), 16)] > lastlen = len(cblocks[-1]) >@@ -322,19 +374,19 @@ class _AESEnctype(_SimplifiedEnctype): > prev_cblock = bytes(16) > plaintext = b'' > for b in cblocks[:-2]: >- plaintext += _xorbytes(aes.decrypt(b), prev_cblock) >+ plaintext += _xorbytes(aes_decrypt(b), prev_cblock) > prev_cblock = b > # Decrypt the second-to-last cipher block. The left side of > # the decrypted block will be the final block of plaintext > # xor'd with the final partial cipher block; the right side > # will be the omitted bytes of ciphertext from the final > # block. >- b = aes.decrypt(cblocks[-2]) >+ b = aes_decrypt(cblocks[-2]) > lastplaintext =_xorbytes(b[:lastlen], cblocks[-1]) > omitted = b[lastlen:] > # Decrypt the final cipher block plus the omitted bytes to get > # the second-to-last plaintext block. >- plaintext += _xorbytes(aes.decrypt(cblocks[-1] + omitted), prev_cblock) >+ plaintext += _xorbytes(aes_decrypt(cblocks[-1] + omitted), prev_cblock) > return plaintext + lastplaintext > > >@@ -365,32 +417,43 @@ class _RC4(_EnctypeProfile): > > @classmethod > def string_to_key(cls, string, salt, params): >- utf16string = string.decode('UTF-8').encode('UTF-16LE') >- return Key(cls.enctype, MD4.new(utf16string).digest()) >+ utf8string = get_string(string) >+ tmp = Credentials() >+ tmp.set_anonymous() >+ tmp.set_password(utf8string) >+ nthash = tmp.get_nt_hash() >+ return Key(cls.enctype, nthash) > > @classmethod > def encrypt(cls, key, keyusage, plaintext, confounder): > if confounder is None: > confounder = get_random_bytes(8) >- ki = HMAC.new(key.contents, cls.usage_str(keyusage), MD5).digest() >- cksum = HMAC.new(ki, confounder + plaintext, MD5).digest() >- ke = HMAC.new(ki, cksum, MD5).digest() >- return cksum + ARC4.new(ke).encrypt(confounder + plaintext) >+ ki = HMAC_HASH(key.contents, cls.usage_str(keyusage), hashes.MD5) >+ cksum = HMAC_HASH(ki, confounder + plaintext, hashes.MD5) >+ ke = HMAC_HASH(ki, cksum, hashes.MD5) >+ >+ encryptor = Cipher(ciphers.ARC4(ke), None, default_backend()).encryptor() >+ ctext = encryptor.update(confounder + plaintext) >+ >+ return cksum + ctext > > @classmethod > def decrypt(cls, key, keyusage, ciphertext): > if len(ciphertext) < 24: > raise ValueError('ciphertext too short') > cksum, basic_ctext = ciphertext[:16], ciphertext[16:] >- ki = HMAC.new(key.contents, cls.usage_str(keyusage), MD5).digest() >- ke = HMAC.new(ki, cksum, MD5).digest() >- basic_plaintext = ARC4.new(ke).decrypt(basic_ctext) >- exp_cksum = HMAC.new(ki, basic_plaintext, MD5).digest() >+ ki = HMAC_HASH(key.contents, cls.usage_str(keyusage), hashes.MD5) >+ ke = HMAC_HASH(ki, cksum, hashes.MD5) >+ >+ decryptor = Cipher(ciphers.ARC4(ke), None, default_backend()).decryptor() >+ basic_plaintext = decryptor.update(basic_ctext) >+ >+ exp_cksum = HMAC_HASH(ki, basic_plaintext, hashes.MD5) > ok = _mac_equal(cksum, exp_cksum) > if not ok and keyusage == 9: > # Try again with usage 8, due to RFC 4757 errata. >- ki = HMAC.new(key.contents, pack('<i', 8), MD5).digest() >- exp_cksum = HMAC.new(ki, basic_plaintext, MD5).digest() >+ ki = HMAC_HASH(key.contents, pack('<i', 8), hashes.MD5) >+ exp_cksum = HMAC_HASH(ki, basic_plaintext, hashes.MD5) > ok = _mac_equal(cksum, exp_cksum) > if not ok: > raise InvalidChecksum('ciphertext integrity failure') >@@ -399,7 +462,7 @@ class _RC4(_EnctypeProfile): > > @classmethod > def prf(cls, key, string): >- return HMAC.new(key.contents, string, SHA).digest() >+ return HMAC_HASH(key.contents, string, hashes.SHA1) > > > class _ChecksumProfile(object): >@@ -424,7 +487,7 @@ class _SimplifiedChecksum(_ChecksumProfile): > @classmethod > def checksum(cls, key, keyusage, text): > kc = cls.enc.derive(key, pack('>iB', keyusage, 0x99)) >- hmac = HMAC.new(kc.contents, text, cls.enc.hashmod).digest() >+ hmac = HMAC_HASH(kc.contents, text, cls.enc.hashalgo) > return hmac[:cls.macsize] > > @classmethod >@@ -452,9 +515,9 @@ class _SHA1DES3(_SimplifiedChecksum): > class _HMACMD5(_ChecksumProfile): > @classmethod > def checksum(cls, key, keyusage, text): >- ksign = HMAC.new(key.contents, b'signaturekey\0', MD5).digest() >- md5hash = MD5.new(_RC4.usage_str(keyusage) + text).digest() >- return HMAC.new(ksign, md5hash, MD5).digest() >+ ksign = HMAC_HASH(key.contents, b'signaturekey\0', hashes.MD5) >+ md5hash = SIMPLE_HASH(_RC4.usage_str(keyusage) + text, hashes.MD5) >+ return HMAC_HASH(ksign, md5hash, hashes.MD5) > > @classmethod > def verify(cls, key, keyusage, text, cksum): >@@ -564,150 +627,173 @@ def cf2(enctype, key1, key2, pepper1, pepper2): > return e.random_to_key(_xorbytes(prfplus(key1, pepper1, e.seedsize), > prfplus(key2, pepper2, e.seedsize))) > >- >-if __name__ == '__main__': >- def h(hexstr): >- return bytes.fromhex(hexstr) >- >- # AES128 encrypt and decrypt >- kb = h('9062430C8CDA3388922E6D6A509F5B7A') >- conf = h('94B491F481485B9A0678CD3C4EA386AD') >- keyusage = 2 >- plain = b'9 bytesss' >- ctxt = h('68FB9679601F45C78857B2BF820FD6E53ECA8D42FD4B1D7024A09205ABB7CD2E' >- 'C26C355D2F') >- k = Key(Enctype.AES128, kb) >- assert(encrypt(k, keyusage, plain, conf) == ctxt) >- assert(decrypt(k, keyusage, ctxt) == plain) >- >- # AES256 encrypt and decrypt >- kb = h('F1C795E9248A09338D82C3F8D5B567040B0110736845041347235B1404231398') >- conf = h('E45CA518B42E266AD98E165E706FFB60') >- keyusage = 4 >- plain = b'30 bytes bytes bytes bytes byt' >- ctxt = h('D1137A4D634CFECE924DBC3BF6790648BD5CFF7DE0E7B99460211D0DAEF3D79A' >- '295C688858F3B34B9CBD6EEBAE81DAF6B734D4D498B6714F1C1D') >- k = Key(Enctype.AES256, kb) >- assert(encrypt(k, keyusage, plain, conf) == ctxt) >- assert(decrypt(k, keyusage, ctxt) == plain) >- >- # AES128 checksum >- kb = h('9062430C8CDA3388922E6D6A509F5B7A') >- keyusage = 3 >- plain = b'eight nine ten eleven twelve thirteen' >- cksum = h('01A4B088D45628F6946614E3') >- k = Key(Enctype.AES128, kb) >- verify_checksum(Cksumtype.SHA1_AES128, k, keyusage, plain, cksum) >- >- # AES256 checksum >- kb = h('B1AE4CD8462AFF1677053CC9279AAC30B796FB81CE21474DD3DDBCFEA4EC76D7') >- keyusage = 4 >- plain = b'fourteen' >- cksum = h('E08739E3279E2903EC8E3836') >- k = Key(Enctype.AES256, kb) >- verify_checksum(Cksumtype.SHA1_AES256, k, keyusage, plain, cksum) >- >- # AES128 string-to-key >- string = b'password' >- salt = b'ATHENA.MIT.EDUraeburn' >- params = h('00000002') >- kb = h('C651BF29E2300AC27FA469D693BDDA13') >- k = string_to_key(Enctype.AES128, string, salt, params) >- assert(k.contents == kb) >- >- # AES256 string-to-key >- string = b'X' * 64 >- salt = b'pass phrase equals block size' >- params = h('000004B0') >- kb = h('89ADEE3608DB8BC71F1BFBFE459486B05618B70CBAE22092534E56C553BA4B34') >- k = string_to_key(Enctype.AES256, string, salt, params) >- assert(k.contents == kb) >- >- # AES128 prf >- kb = h('77B39A37A868920F2A51F9DD150C5717') >- k = string_to_key(Enctype.AES128, b'key1', b'key1') >- assert(prf(k, b'\x01\x61') == kb) >- >- # AES256 prf >- kb = h('0D674DD0F9A6806525A4D92E828BD15A') >- k = string_to_key(Enctype.AES256, b'key2', b'key2') >- assert(prf(k, b'\x02\x62') == kb) >- >- # AES128 cf2 >- kb = h('97DF97E4B798B29EB31ED7280287A92A') >- k1 = string_to_key(Enctype.AES128, b'key1', b'key1') >- k2 = string_to_key(Enctype.AES128, b'key2', b'key2') >- k = cf2(Enctype.AES128, k1, k2, b'a', b'b') >- assert(k.contents == kb) >- >- # AES256 cf2 >- kb = h('4D6CA4E629785C1F01BAF55E2E548566B9617AE3A96868C337CB93B5E72B1C7B') >- k1 = string_to_key(Enctype.AES256, b'key1', b'key1') >- k2 = string_to_key(Enctype.AES256, b'key2', b'key2') >- k = cf2(Enctype.AES256, k1, k2, b'a', b'b') >- assert(k.contents == kb) >- >- # DES3 encrypt and decrypt >- kb = h('0DD52094E0F41CECCB5BE510A764B35176E3981332F1E598') >- conf = h('94690A17B2DA3C9B') >- keyusage = 3 >- plain = b'13 bytes byte' >- ctxt = h('839A17081ECBAFBCDC91B88C6955DD3C4514023CF177B77BF0D0177A16F705E8' >- '49CB7781D76A316B193F8D30') >- k = Key(Enctype.DES3, kb) >- assert(encrypt(k, keyusage, plain, conf) == ctxt) >- assert(decrypt(k, keyusage, ctxt) == _zeropad(plain, 8)) >- >- # DES3 string-to-key >- string = b'password' >- salt = b'ATHENA.MIT.EDUraeburn' >- kb = h('850BB51358548CD05E86768C313E3BFEF7511937DCF72C3E') >- k = string_to_key(Enctype.DES3, string, salt) >- assert(k.contents == kb) >- >- # DES3 checksum >- kb = h('7A25DF8992296DCEDA0E135BC4046E2375B3C14C98FBC162') >- keyusage = 2 >- plain = b'six seven' >- cksum = h('0EEFC9C3E049AABC1BA5C401677D9AB699082BB4') >- k = Key(Enctype.DES3, kb) >- verify_checksum(Cksumtype.SHA1_DES3, k, keyusage, plain, cksum) >- >- # DES3 cf2 >- kb = h('E58F9EB643862C13AD38E529313462A7F73E62834FE54A01') >- k1 = string_to_key(Enctype.DES3, b'key1', b'key1') >- k2 = string_to_key(Enctype.DES3, b'key2', b'key2') >- k = cf2(Enctype.DES3, k1, k2, b'a', b'b') >- assert(k.contents == kb) >- >- # RC4 encrypt and decrypt >- kb = h('68F263DB3FCE15D031C9EAB02D67107A') >- conf = h('37245E73A45FBF72') >- keyusage = 4 >- plain = b'30 bytes bytes bytes bytes byt' >- ctxt = h('95F9047C3AD75891C2E9B04B16566DC8B6EB9CE4231AFB2542EF87A7B5A0F260' >- 'A99F0460508DE0CECC632D07C354124E46C5D2234EB8') >- k = Key(Enctype.RC4, kb) >- assert(encrypt(k, keyusage, plain, conf) == ctxt) >- assert(decrypt(k, keyusage, ctxt) == plain) >- >- # RC4 string-to-key >- string = b'foo' >- kb = h('AC8E657F83DF82BEEA5D43BDAF7800CC') >- k = string_to_key(Enctype.RC4, string, None) >- assert(k.contents == kb) >- >- # RC4 checksum >- kb = h('F7D3A155AF5E238A0B7A871A96BA2AB2') >- keyusage = 6 >- plain = b'seventeen eighteen nineteen twenty' >- cksum = h('EB38CC97E2230F59DA4117DC5859D7EC') >- k = Key(Enctype.RC4, kb) >- verify_checksum(Cksumtype.HMAC_MD5, k, keyusage, plain, cksum) >- >- # RC4 cf2 >- kb = h('24D7F6B6BAE4E5C00D2082C5EBAB3672') >- k1 = string_to_key(Enctype.RC4, b'key1', b'key1') >- k2 = string_to_key(Enctype.RC4, b'key2', b'key2') >- k = cf2(Enctype.RC4, k1, k2, b'a', b'b') >- assert(k.contents == kb) >+def h(hexstr): >+ return bytes.fromhex(hexstr) >+ >+class KcrytoTest(TestCase): >+ """kcrypto Test case.""" >+ >+ def test_aes128_crypr(self): >+ # AES128 encrypt and decrypt >+ kb = h('9062430C8CDA3388922E6D6A509F5B7A') >+ conf = h('94B491F481485B9A0678CD3C4EA386AD') >+ keyusage = 2 >+ plain = b'9 bytesss' >+ ctxt = h('68FB9679601F45C78857B2BF820FD6E53ECA8D42FD4B1D7024A09205ABB7CD2E' >+ 'C26C355D2F') >+ k = Key(Enctype.AES128, kb) >+ self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt) >+ self.assertEqual(decrypt(k, keyusage, ctxt), plain) >+ >+ def test_aes256_crypt(self): >+ # AES256 encrypt and decrypt >+ kb = h('F1C795E9248A09338D82C3F8D5B567040B0110736845041347235B1404231398') >+ conf = h('E45CA518B42E266AD98E165E706FFB60') >+ keyusage = 4 >+ plain = b'30 bytes bytes bytes bytes byt' >+ ctxt = h('D1137A4D634CFECE924DBC3BF6790648BD5CFF7DE0E7B99460211D0DAEF3D79A' >+ '295C688858F3B34B9CBD6EEBAE81DAF6B734D4D498B6714F1C1D') >+ k = Key(Enctype.AES256, kb) >+ self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt) >+ self.assertEqual(decrypt(k, keyusage, ctxt), plain) >+ >+ def test_aes128_checksum(self): >+ # AES128 checksum >+ kb = h('9062430C8CDA3388922E6D6A509F5B7A') >+ keyusage = 3 >+ plain = b'eight nine ten eleven twelve thirteen' >+ cksum = h('01A4B088D45628F6946614E3') >+ k = Key(Enctype.AES128, kb) >+ verify_checksum(Cksumtype.SHA1_AES128, k, keyusage, plain, cksum) >+ >+ def test_aes256_checksum(self): >+ # AES256 checksum >+ kb = h('B1AE4CD8462AFF1677053CC9279AAC30B796FB81CE21474DD3DDBCFEA4EC76D7') >+ keyusage = 4 >+ plain = b'fourteen' >+ cksum = h('E08739E3279E2903EC8E3836') >+ k = Key(Enctype.AES256, kb) >+ verify_checksum(Cksumtype.SHA1_AES256, k, keyusage, plain, cksum) >+ >+ def test_aes128_string_to_key(self): >+ # AES128 string-to-key >+ string = b'password' >+ salt = b'ATHENA.MIT.EDUraeburn' >+ params = h('00000002') >+ kb = h('C651BF29E2300AC27FA469D693BDDA13') >+ k = string_to_key(Enctype.AES128, string, salt, params) >+ self.assertEqual(k.contents, kb) >+ >+ def test_aes256_string_to_key(self): >+ # AES256 string-to-key >+ string = b'X' * 64 >+ salt = b'pass phrase equals block size' >+ params = h('000004B0') >+ kb = h('89ADEE3608DB8BC71F1BFBFE459486B05618B70CBAE22092534E56C553BA4B34') >+ k = string_to_key(Enctype.AES256, string, salt, params) >+ self.assertEqual(k.contents, kb) >+ >+ def test_aes128_prf(self): >+ # AES128 prf >+ kb = h('77B39A37A868920F2A51F9DD150C5717') >+ k = string_to_key(Enctype.AES128, b'key1', b'key1') >+ self.assertEqual(prf(k, b'\x01\x61'), kb) >+ >+ def test_aes256_prf(self): >+ # AES256 prf >+ kb = h('0D674DD0F9A6806525A4D92E828BD15A') >+ k = string_to_key(Enctype.AES256, b'key2', b'key2') >+ self.assertEqual(prf(k, b'\x02\x62'), kb) >+ >+ def test_aes128_cf2(self): >+ # AES128 cf2 >+ kb = h('97DF97E4B798B29EB31ED7280287A92A') >+ k1 = string_to_key(Enctype.AES128, b'key1', b'key1') >+ k2 = string_to_key(Enctype.AES128, b'key2', b'key2') >+ k = cf2(Enctype.AES128, k1, k2, b'a', b'b') >+ self.assertEqual(k.contents, kb) >+ >+ def test_aes256_cf2(self): >+ # AES256 cf2 >+ kb = h('4D6CA4E629785C1F01BAF55E2E548566B9617AE3A96868C337CB93B5E72B1C7B') >+ k1 = string_to_key(Enctype.AES256, b'key1', b'key1') >+ k2 = string_to_key(Enctype.AES256, b'key2', b'key2') >+ k = cf2(Enctype.AES256, k1, k2, b'a', b'b') >+ self.assertEqual(k.contents, kb) >+ >+ def test_des3_crypt(self): >+ # DES3 encrypt and decrypt >+ kb = h('0DD52094E0F41CECCB5BE510A764B35176E3981332F1E598') >+ conf = h('94690A17B2DA3C9B') >+ keyusage = 3 >+ plain = b'13 bytes byte' >+ ctxt = h('839A17081ECBAFBCDC91B88C6955DD3C4514023CF177B77BF0D0177A16F705E8' >+ '49CB7781D76A316B193F8D30') >+ k = Key(Enctype.DES3, kb) >+ self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt) >+ self.assertEqual(decrypt(k, keyusage, ctxt), _zeropad(plain, 8)) >+ >+ def test_des3_string_to_key(self): >+ # DES3 string-to-key >+ string = b'password' >+ salt = b'ATHENA.MIT.EDUraeburn' >+ kb = h('850BB51358548CD05E86768C313E3BFEF7511937DCF72C3E') >+ k = string_to_key(Enctype.DES3, string, salt) >+ self.assertEqual(k.contents, kb) >+ >+ def test_des3_checksum(self): >+ # DES3 checksum >+ kb = h('7A25DF8992296DCEDA0E135BC4046E2375B3C14C98FBC162') >+ keyusage = 2 >+ plain = b'six seven' >+ cksum = h('0EEFC9C3E049AABC1BA5C401677D9AB699082BB4') >+ k = Key(Enctype.DES3, kb) >+ verify_checksum(Cksumtype.SHA1_DES3, k, keyusage, plain, cksum) >+ >+ def test_des3_cf2(self): >+ # DES3 cf2 >+ kb = h('E58F9EB643862C13AD38E529313462A7F73E62834FE54A01') >+ k1 = string_to_key(Enctype.DES3, b'key1', b'key1') >+ k2 = string_to_key(Enctype.DES3, b'key2', b'key2') >+ k = cf2(Enctype.DES3, k1, k2, b'a', b'b') >+ self.assertEqual(k.contents, kb) >+ >+ def test_rc4_crypt(self): >+ # RC4 encrypt and decrypt >+ kb = h('68F263DB3FCE15D031C9EAB02D67107A') >+ conf = h('37245E73A45FBF72') >+ keyusage = 4 >+ plain = b'30 bytes bytes bytes bytes byt' >+ ctxt = h('95F9047C3AD75891C2E9B04B16566DC8B6EB9CE4231AFB2542EF87A7B5A0F260' >+ 'A99F0460508DE0CECC632D07C354124E46C5D2234EB8') >+ k = Key(Enctype.RC4, kb) >+ self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt) >+ self.assertEqual(decrypt(k, keyusage, ctxt), plain) >+ >+ def test_rc4_string_to_key(self): >+ # RC4 string-to-key >+ string = b'foo' >+ kb = h('AC8E657F83DF82BEEA5D43BDAF7800CC') >+ k = string_to_key(Enctype.RC4, string, None) >+ self.assertEqual(k.contents, kb) >+ >+ def test_rc4_checksum(self): >+ # RC4 checksum >+ kb = h('F7D3A155AF5E238A0B7A871A96BA2AB2') >+ keyusage = 6 >+ plain = b'seventeen eighteen nineteen twenty' >+ cksum = h('EB38CC97E2230F59DA4117DC5859D7EC') >+ k = Key(Enctype.RC4, kb) >+ verify_checksum(Cksumtype.HMAC_MD5, k, keyusage, plain, cksum) >+ >+ def test_rc4_cf2(self): >+ # RC4 cf2 >+ kb = h('24D7F6B6BAE4E5C00D2082C5EBAB3672') >+ k1 = string_to_key(Enctype.RC4, b'key1', b'key1') >+ k2 = string_to_key(Enctype.RC4, b'key2', b'key2') >+ k = cf2(Enctype.RC4, k1, k2, b'a', b'b') >+ self.assertEqual(k.contents, kb) >+ >+if __name__ == "__main__": >+ import unittest >+ unittest.main() >-- >2.25.1 > > >From 8c6f3165cef55fc648bc46a9da06660016d50622 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Wed, 25 Mar 2020 22:07:39 +0100 >Subject: [PATCH 016/380] s4:selftest: run samba.tests.krb5.kcrypto test > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >(cherry picked from commit 7010a1311d193c78e9f26adeafe98458217edbca) >--- > source4/selftest/tests.py | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 7d55aed89b4..9194c9b04f7 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -742,6 +742,8 @@ planoldpythontestsuite("nt4_dc", "samba.tests.netbios", extra_args=['-U"$USERNAM > planoldpythontestsuite("ad_dc:local", "samba.tests.gpo", extra_args=['-U"$USERNAME%$PASSWORD"']) > planoldpythontestsuite("ad_dc:local", "samba.tests.dckeytab", extra_args=['-U"$USERNAME%$PASSWORD"']) > >+planoldpythontestsuite("none", "samba.tests.krb5.kcrypto") >+ > for env in ["ad_dc", smbv1_disabled_testenv]: > planoldpythontestsuite(env, "samba.tests.smb", extra_args=['-U"$USERNAME%$PASSWORD"']) > planoldpythontestsuite(env + ":local", "samba.tests.ntacls_backup", >-- >2.25.1 > > >From b01f92a03087aed4bed0686682dea73d99961fea Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Mon, 23 Mar 2020 08:53:54 +0100 >Subject: [PATCH 017/380] python/tests/krb5: add support for Cksumtype.MD5 > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >(cherry picked from commit 47385248c8e462162e01afc3d3d68b97dff3542c) >--- > python/samba/tests/krb5/kcrypto.py | 43 +++++++++++++++++++++++++++++- > 1 file changed, 42 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/kcrypto.py b/python/samba/tests/krb5/kcrypto.py >index 0907d881b68..ed3c84fa186 100755 >--- a/python/samba/tests/krb5/kcrypto.py >+++ b/python/samba/tests/krb5/kcrypto.py >@@ -526,6 +526,13 @@ class _HMACMD5(_ChecksumProfile): > super(_HMACMD5, cls).verify(key, keyusage, text, cksum) > > >+class _MD5(_ChecksumProfile): >+ @classmethod >+ def checksum(cls, key, keyusage, text): >+ # This is unkeyed! >+ return SIMPLE_HASH(text, hashes.MD5) >+ >+ > _enctype_table = { > Enctype.DES3: _DES3CBC, > Enctype.AES128: _AES128CTS, >@@ -538,7 +545,8 @@ _checksum_table = { > Cksumtype.SHA1_DES3: _SHA1DES3, > Cksumtype.SHA1_AES128: _SHA1AES128, > Cksumtype.SHA1_AES256: _SHA1AES256, >- Cksumtype.HMAC_MD5: _HMACMD5 >+ Cksumtype.HMAC_MD5: _HMACMD5, >+ Cksumtype.MD5: _MD5, > } > > >@@ -794,6 +802,39 @@ class KcrytoTest(TestCase): > k = cf2(Enctype.RC4, k1, k2, b'a', b'b') > self.assertEqual(k.contents, kb) > >+ def _test_md5_unkeyed_checksum(self, etype, usage): >+ # MD5 unkeyed checksum >+ pw = b'pwd' >+ salt = b'bytes' >+ key = string_to_key(etype, pw, salt) >+ plain = b'seventeen eighteen nineteen twenty' >+ cksum = h('9d9588cdef3a8cefc9d2c208d978f60c') >+ verify_checksum(Cksumtype.MD5, key, usage, plain, cksum) >+ >+ def test_md5_unkeyed_checksum_des3_usage_40(self): >+ return self._test_md5_unkeyed_checksum(Enctype.DES3, 40) >+ >+ def test_md5_unkeyed_checksum_des3_usage_50(self): >+ return self._test_md5_unkeyed_checksum(Enctype.DES3, 50) >+ >+ def test_md5_unkeyed_checksum_rc4_usage_40(self): >+ return self._test_md5_unkeyed_checksum(Enctype.RC4, 40) >+ >+ def test_md5_unkeyed_checksum_rc4_usage_50(self): >+ return self._test_md5_unkeyed_checksum(Enctype.RC4, 50) >+ >+ def test_md5_unkeyed_checksum_aes128_usage_40(self): >+ return self._test_md5_unkeyed_checksum(Enctype.AES128, 40) >+ >+ def test_md5_unkeyed_checksum_aes128_usage_50(self): >+ return self._test_md5_unkeyed_checksum(Enctype.AES128, 50) >+ >+ def test_md5_unkeyed_checksum_aes256_usage_40(self): >+ return self._test_md5_unkeyed_checksum(Enctype.AES256, 40) >+ >+ def test_md5_unkeyed_checksum_aes256_usage_50(self): >+ return self._test_md5_unkeyed_checksum(Enctype.AES256, 50) >+ > if __name__ == "__main__": > import unittest > unittest.main() >-- >2.25.1 > > >From 86b6a91bd50749cdadc55505c3072cfd02c8aec3 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Thu, 13 Feb 2020 16:29:38 +0100 >Subject: [PATCH 018/380] python/tests/krb5: add rfc4120.asn1 > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >(cherry picked from commit a2f75c314e9946f74e9dacceac690295999925b5) >--- > python/samba/tests/krb5/rfc4120.asn1 | 392 +++++++++++++++++++++++++++ > 1 file changed, 392 insertions(+) > create mode 100644 python/samba/tests/krb5/rfc4120.asn1 > >diff --git a/python/samba/tests/krb5/rfc4120.asn1 b/python/samba/tests/krb5/rfc4120.asn1 >new file mode 100644 >index 00000000000..ec44557f45a >--- /dev/null >+++ b/python/samba/tests/krb5/rfc4120.asn1 >@@ -0,0 +1,392 @@ >+KerberosV5Spec2 { >+ iso(1) identified-organization(3) dod(6) internet(1) >+ security(5) kerberosV5(2) modules(4) krb5spec2(2) >+} DEFINITIONS EXPLICIT TAGS ::= BEGIN >+ >+-- OID arc for KerberosV5 >+-- >+-- This OID may be used to identify Kerberos protocol messages >+-- encapsulated in other protocols. >+-- >+-- This OID also designates the OID arc for KerberosV5-related OIDs. >+-- >+-- NOTE: RFC 1510 had an incorrect value (5) for "dod" in its OID. >+id-krb5 OBJECT IDENTIFIER ::= { >+ iso(1) identified-organization(3) dod(6) internet(1) >+ security(5) kerberosV5(2) >+} >+ >+Int32 ::= INTEGER (-2147483648..2147483647) >+ -- signed values representable in 32 bits >+ >+UInt32 ::= INTEGER (0..4294967295) >+ -- unsigned 32 bit values >+ >+Microseconds ::= INTEGER (0..999999) >+ -- microseconds >+ >+KerberosString ::= GeneralString (IA5String) >+ >+Realm ::= KerberosString >+ >+PrincipalName ::= SEQUENCE { >+ name-type [0] Int32, >+ name-string [1] SEQUENCE OF KerberosString >+} >+ >+KerberosTime ::= GeneralizedTime -- with no fractional seconds >+ >+HostAddress ::= SEQUENCE { >+ addr-type [0] Int32, >+ address [1] OCTET STRING >+} >+ >+-- NOTE: HostAddresses is always used as an OPTIONAL field and >+-- should not be empty. >+HostAddresses -- NOTE: subtly different from rfc1510, >+ -- but has a value mapping and encodes the same >+ ::= SEQUENCE OF HostAddress >+ >+-- NOTE: AuthorizationData is always used as an OPTIONAL field and >+-- should not be empty. >+AuthorizationData ::= SEQUENCE OF SEQUENCE { >+ ad-type [0] Int32, >+ ad-data [1] OCTET STRING >+} >+ >+PA-DATA ::= SEQUENCE { >+ -- NOTE: first tag is [1], not [0] >+ padata-type [1] Int32, >+ padata-value [2] OCTET STRING -- might be encoded AP-REQ >+} >+ >+KerberosFlags ::= BIT STRING (SIZE (32..MAX)) >+ -- minimum number of bits shall be sent, >+ -- but no fewer than 32 >+ >+EncryptedData ::= SEQUENCE { >+ etype [0] Int32 -- EncryptionType --, >+ kvno [1] UInt32 OPTIONAL, >+ cipher [2] OCTET STRING -- ciphertext >+} >+ >+EncryptionKey ::= SEQUENCE { >+ keytype [0] Int32 -- actually encryption type --, >+ keyvalue [1] OCTET STRING >+} >+ >+Checksum ::= SEQUENCE { >+ cksumtype [0] Int32, >+ checksum [1] OCTET STRING >+} >+ >+Ticket ::= [APPLICATION 1] SEQUENCE { >+ tkt-vno [0] INTEGER (5), >+ realm [1] Realm, >+ sname [2] PrincipalName, >+ enc-part [3] EncryptedData -- EncTicketPart >+} >+ >+-- Encrypted part of ticket >+EncTicketPart ::= [APPLICATION 3] SEQUENCE { >+ flags [0] TicketFlags, >+ key [1] EncryptionKey, >+ crealm [2] Realm, >+ cname [3] PrincipalName, >+ transited [4] TransitedEncoding, >+ authtime [5] KerberosTime, >+ starttime [6] KerberosTime OPTIONAL, >+ endtime [7] KerberosTime, >+ renew-till [8] KerberosTime OPTIONAL, >+ caddr [9] HostAddresses OPTIONAL, >+ authorization-data [10] AuthorizationData OPTIONAL >+} >+ >+-- encoded Transited field >+TransitedEncoding ::= SEQUENCE { >+ tr-type [0] Int32 -- must be registered --, >+ contents [1] OCTET STRING >+} >+ >+TicketFlags ::= KerberosFlags >+ -- reserved(0), >+ -- forwardable(1), >+ -- forwarded(2), >+ -- proxiable(3), >+ -- proxy(4), >+ -- may-postdate(5), >+ -- postdated(6), >+ -- invalid(7), >+ -- renewable(8), >+ -- initial(9), >+ -- pre-authent(10), >+ -- hw-authent(11), >+-- the following are new since 1510 >+ -- transited-policy-checked(12), >+ -- ok-as-delegate(13) >+ >+AS-REQ ::= [APPLICATION 10] KDC-REQ >+ >+TGS-REQ ::= [APPLICATION 12] KDC-REQ >+ >+KDC-REQ ::= SEQUENCE { >+ -- NOTE: first tag is [1], not [0] >+ pvno [1] INTEGER (5) , >+ msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), >+ padata [3] SEQUENCE OF PA-DATA OPTIONAL >+ -- NOTE: not empty --, >+ req-body [4] KDC-REQ-BODY >+} >+ >+KDC-REQ-BODY ::= SEQUENCE { >+ kdc-options [0] KDCOptions, >+ cname [1] PrincipalName OPTIONAL >+ -- Used only in AS-REQ --, >+ realm [2] Realm >+ -- Server's realm >+ -- Also client's in AS-REQ --, >+ sname [3] PrincipalName OPTIONAL, >+ from [4] KerberosTime OPTIONAL, >+ till [5] KerberosTime, >+ rtime [6] KerberosTime OPTIONAL, >+ nonce [7] UInt32, >+ etype [8] SEQUENCE OF Int32 -- EncryptionType >+ -- in preference order --, >+ addresses [9] HostAddresses OPTIONAL, >+ enc-authorization-data [10] EncryptedData OPTIONAL >+ -- AuthorizationData --, >+ additional-tickets [11] SEQUENCE OF Ticket OPTIONAL >+ -- NOTE: not empty >+} >+ >+KDCOptions ::= KerberosFlags >+ -- reserved(0), >+ -- forwardable(1), >+ -- forwarded(2), >+ -- proxiable(3), >+ -- proxy(4), >+ -- allow-postdate(5), >+ -- postdated(6), >+ -- unused7(7), >+ -- renewable(8), >+ -- unused9(9), >+ -- unused10(10), >+ -- opt-hardware-auth(11), >+ -- unused12(12), >+ -- unused13(13), >+-- 15 is reserved for canonicalize >+ -- unused15(15), >+-- 26 was unused in 1510 >+ -- disable-transited-check(26), >+-- >+ -- renewable-ok(27), >+ -- enc-tkt-in-skey(28), >+ -- renew(30), >+ -- validate(31) >+ >+AS-REP ::= [APPLICATION 11] KDC-REP >+ >+TGS-REP ::= [APPLICATION 13] KDC-REP >+ >+KDC-REP ::= SEQUENCE { >+ pvno [0] INTEGER (5), >+ msg-type [1] INTEGER (11 -- AS -- | 13 -- TGS --), >+ padata [2] SEQUENCE OF PA-DATA OPTIONAL >+ -- NOTE: not empty --, >+ crealm [3] Realm, >+ cname [4] PrincipalName, >+ ticket [5] Ticket, >+ enc-part [6] EncryptedData >+ -- EncASRepPart or EncTGSRepPart, >+ -- as appropriate >+} >+ >+EncASRepPart ::= [APPLICATION 25] EncKDCRepPart >+ >+EncTGSRepPart ::= [APPLICATION 26] EncKDCRepPart >+ >+EncKDCRepPart ::= SEQUENCE { >+ key [0] EncryptionKey, >+ last-req [1] LastReq, >+ nonce [2] UInt32, >+ key-expiration [3] KerberosTime OPTIONAL, >+ flags [4] TicketFlags, >+ authtime [5] KerberosTime, >+ starttime [6] KerberosTime OPTIONAL, >+ endtime [7] KerberosTime, >+ renew-till [8] KerberosTime OPTIONAL, >+ srealm [9] Realm, >+ sname [10] PrincipalName, >+ caddr [11] HostAddresses OPTIONAL >+} >+ >+LastReq ::= SEQUENCE OF SEQUENCE { >+ lr-type [0] Int32, >+ lr-value [1] KerberosTime >+} >+ >+AP-REQ ::= [APPLICATION 14] SEQUENCE { >+ pvno [0] INTEGER (5), >+ msg-type [1] INTEGER (14), >+ ap-options [2] APOptions, >+ ticket [3] Ticket, >+ authenticator [4] EncryptedData -- Authenticator >+} >+ >+APOptions ::= KerberosFlags >+ -- reserved(0), >+ -- use-session-key(1), >+ -- mutual-required(2) >+ >+-- Unencrypted authenticator >+Authenticator ::= [APPLICATION 2] SEQUENCE { >+ authenticator-vno [0] INTEGER (5), >+ crealm [1] Realm, >+ cname [2] PrincipalName, >+ cksum [3] Checksum OPTIONAL, >+ cusec [4] Microseconds, >+ ctime [5] KerberosTime, >+ subkey [6] EncryptionKey OPTIONAL, >+ seq-number [7] UInt32 OPTIONAL, >+ authorization-data [8] AuthorizationData OPTIONAL >+} >+ >+AP-REP ::= [APPLICATION 15] SEQUENCE { >+ pvno [0] INTEGER (5), >+ msg-type [1] INTEGER (15), >+ enc-part [2] EncryptedData -- EncAPRepPart >+} >+ >+EncAPRepPart ::= [APPLICATION 27] SEQUENCE { >+ ctime [0] KerberosTime, >+ cusec [1] Microseconds, >+ subkey [2] EncryptionKey OPTIONAL, >+ seq-number [3] UInt32 OPTIONAL >+} >+ >+KRB-SAFE ::= [APPLICATION 20] SEQUENCE { >+ pvno [0] INTEGER (5), >+ msg-type [1] INTEGER (20), >+ safe-body [2] KRB-SAFE-BODY, >+ cksum [3] Checksum >+} >+ >+KRB-SAFE-BODY ::= SEQUENCE { >+ user-data [0] OCTET STRING, >+ timestamp [1] KerberosTime OPTIONAL, >+ usec [2] Microseconds OPTIONAL, >+ seq-number [3] UInt32 OPTIONAL, >+ s-address [4] HostAddress, >+ r-address [5] HostAddress OPTIONAL >+} >+ >+KRB-PRIV ::= [APPLICATION 21] SEQUENCE { >+ pvno [0] INTEGER (5), >+ msg-type [1] INTEGER (21), >+ -- NOTE: there is no [2] tag >+ enc-part [3] EncryptedData -- EncKrbPrivPart >+} >+ >+EncKrbPrivPart ::= [APPLICATION 28] SEQUENCE { >+ user-data [0] OCTET STRING, >+ timestamp [1] KerberosTime OPTIONAL, >+ usec [2] Microseconds OPTIONAL, >+ seq-number [3] UInt32 OPTIONAL, >+ s-address [4] HostAddress -- sender's addr --, >+ r-address [5] HostAddress OPTIONAL -- recip's addr >+} >+ >+KRB-CRED ::= [APPLICATION 22] SEQUENCE { >+ pvno [0] INTEGER (5), >+ msg-type [1] INTEGER (22), >+ tickets [2] SEQUENCE OF Ticket, >+ enc-part [3] EncryptedData -- EncKrbCredPart >+} >+ >+EncKrbCredPart ::= [APPLICATION 29] SEQUENCE { >+ ticket-info [0] SEQUENCE OF KrbCredInfo, >+ nonce [1] UInt32 OPTIONAL, >+ timestamp [2] KerberosTime OPTIONAL, >+ usec [3] Microseconds OPTIONAL, >+ s-address [4] HostAddress OPTIONAL, >+ r-address [5] HostAddress OPTIONAL >+} >+ >+KrbCredInfo ::= SEQUENCE { >+ key [0] EncryptionKey, >+ prealm [1] Realm OPTIONAL, >+ pname [2] PrincipalName OPTIONAL, >+ flags [3] TicketFlags OPTIONAL, >+ authtime [4] KerberosTime OPTIONAL, >+ starttime [5] KerberosTime OPTIONAL, >+ endtime [6] KerberosTime OPTIONAL, >+ renew-till [7] KerberosTime OPTIONAL, >+ srealm [8] Realm OPTIONAL, >+ sname [9] PrincipalName OPTIONAL, >+ caddr [10] HostAddresses OPTIONAL >+} >+ >+KRB-ERROR ::= [APPLICATION 30] SEQUENCE { >+ pvno [0] INTEGER (5), >+ msg-type [1] INTEGER (30), >+ ctime [2] KerberosTime OPTIONAL, >+ cusec [3] Microseconds OPTIONAL, >+ stime [4] KerberosTime, >+ susec [5] Microseconds, >+ error-code [6] Int32, >+ crealm [7] Realm OPTIONAL, >+ cname [8] PrincipalName OPTIONAL, >+ realm [9] Realm -- service realm --, >+ sname [10] PrincipalName -- service name --, >+ e-text [11] KerberosString OPTIONAL, >+ e-data [12] OCTET STRING OPTIONAL >+} >+ >+METHOD-DATA ::= SEQUENCE OF PA-DATA >+ >+TYPED-DATA ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE { >+ data-type [0] Int32, >+ data-value [1] OCTET STRING OPTIONAL >+} >+ >+-- preauth stuff follows >+ >+PA-ENC-TIMESTAMP ::= EncryptedData -- PA-ENC-TS-ENC >+ >+PA-ENC-TS-ENC ::= SEQUENCE { >+ patimestamp [0] KerberosTime -- client's time --, >+ pausec [1] Microseconds OPTIONAL >+} >+ >+ETYPE-INFO-ENTRY ::= SEQUENCE { >+ etype [0] Int32, >+ salt [1] OCTET STRING OPTIONAL >+} >+ >+ETYPE-INFO ::= SEQUENCE OF ETYPE-INFO-ENTRY >+ >+ETYPE-INFO2-ENTRY ::= SEQUENCE { >+ etype [0] Int32, >+ salt [1] KerberosString OPTIONAL, >+ s2kparams [2] OCTET STRING OPTIONAL >+} >+ >+ETYPE-INFO2 ::= SEQUENCE SIZE (1..MAX) OF ETYPE-INFO2-ENTRY >+ >+AD-IF-RELEVANT ::= AuthorizationData >+ >+AD-KDCIssued ::= SEQUENCE { >+ ad-checksum [0] Checksum, >+ i-realm [1] Realm OPTIONAL, >+ i-sname [2] PrincipalName OPTIONAL, >+ elements [3] AuthorizationData >+} >+ >+AD-AND-OR ::= SEQUENCE { >+ condition-count [0] Int32, >+ elements [1] AuthorizationData >+} >+ >+AD-MANDATORY-FOR-KDC ::= AuthorizationData >+ >+END >-- >2.25.1 > > >From 2e180b414ec501e9b3f48d7a947f86e11f211a7e Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Thu, 13 Feb 2020 16:29:38 +0100 >Subject: [PATCH 019/380] python/tests/krb5: modify rfc4120.asn1 in order to > generate pyasn1 code > >The pyasn1 bindings are generated by pyasn1gen.py from >https://github.com/kimgr/asn1ate.git > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >(cherry picked from commit 94d068427f6cf23ab68c135ed9833db4b9155b65) >--- > python/samba/tests/krb5/rfc4120.asn1 | 293 +++++- > python/samba/tests/krb5/rfc4120_pyasn1.py | 914 ++++++++++++++++++ > .../samba/tests/krb5/rfc4120_pyasn1_regen.sh | 41 + > python/samba/tests/source.py | 6 + > 4 files changed, 1243 insertions(+), 11 deletions(-) > create mode 100644 python/samba/tests/krb5/rfc4120_pyasn1.py > create mode 100755 python/samba/tests/krb5/rfc4120_pyasn1_regen.sh > >diff --git a/python/samba/tests/krb5/rfc4120.asn1 b/python/samba/tests/krb5/rfc4120.asn1 >index ec44557f45a..05b43106034 100644 >--- a/python/samba/tests/krb5/rfc4120.asn1 >+++ b/python/samba/tests/krb5/rfc4120.asn1 >@@ -25,15 +25,23 @@ UInt32 ::= INTEGER (0..4294967295) > Microseconds ::= INTEGER (0..999999) > -- microseconds > >-KerberosString ::= GeneralString (IA5String) >+-- >+-- asn1ate doesn't support 'GeneralString (IA5String)' >+-- only 'GeneralString' or 'IA5String', on the wire >+-- GeneralString is used. >+-- >+-- KerberosString ::= GeneralString (IA5String) >+KerberosString ::= GeneralString > > Realm ::= KerberosString > > PrincipalName ::= SEQUENCE { >- name-type [0] Int32, >+ name-type [0] NameType, -- Int32, > name-string [1] SEQUENCE OF KerberosString > } > >+NameType ::= Int32 >+ > KerberosTime ::= GeneralizedTime -- with no fractional seconds > > HostAddress ::= SEQUENCE { >@@ -50,36 +58,48 @@ HostAddresses -- NOTE: subtly different from rfc1510, > -- NOTE: AuthorizationData is always used as an OPTIONAL field and > -- should not be empty. > AuthorizationData ::= SEQUENCE OF SEQUENCE { >- ad-type [0] Int32, >+ ad-type [0] AuthDataType, -- Int32, > ad-data [1] OCTET STRING > } > >+AuthDataType ::= Int32 >+ > PA-DATA ::= SEQUENCE { > -- NOTE: first tag is [1], not [0] >- padata-type [1] Int32, >+ padata-type [1] PADataType, -- Int32 > padata-value [2] OCTET STRING -- might be encoded AP-REQ > } > >-KerberosFlags ::= BIT STRING (SIZE (32..MAX)) >+PADataType ::= Int32 >+ >+-- >+-- asn1ate doesn't support 'MAX' nor a lower range != 1. >+-- We'll use a custom enodeValue() hooks for BitString >+-- in order to encode them with at least 32-Bit. >+-- >+-- KerberosFlags ::= BIT STRING (SIZE (32..MAX)) >+KerberosFlags ::= BIT STRING (SIZE (1..32)) > -- minimum number of bits shall be sent, > -- but no fewer than 32 > > EncryptedData ::= SEQUENCE { >- etype [0] Int32 -- EncryptionType --, >+ etype [0] EncryptionType, --Int32 EncryptionType -- > kvno [1] UInt32 OPTIONAL, > cipher [2] OCTET STRING -- ciphertext > } > > EncryptionKey ::= SEQUENCE { >- keytype [0] Int32 -- actually encryption type --, >+ keytype [0] EncryptionType, -- Int32 actually encryption type -- > keyvalue [1] OCTET STRING > } > > Checksum ::= SEQUENCE { >- cksumtype [0] Int32, >+ cksumtype [0] ChecksumType, -- Int32, > checksum [1] OCTET STRING > } > >+ChecksumType ::= Int32 >+ > Ticket ::= [APPLICATION 1] SEQUENCE { > tkt-vno [0] INTEGER (5), > realm [1] Realm, >@@ -150,7 +170,7 @@ KDC-REQ-BODY ::= SEQUENCE { > till [5] KerberosTime, > rtime [6] KerberosTime OPTIONAL, > nonce [7] UInt32, >- etype [8] SEQUENCE OF Int32 -- EncryptionType >+ etype [8] SEQUENCE OF EncryptionType -- Int32 - EncryptionType > -- in preference order --, > addresses [9] HostAddresses OPTIONAL, > enc-authorization-data [10] EncryptedData OPTIONAL >@@ -159,6 +179,8 @@ KDC-REQ-BODY ::= SEQUENCE { > -- NOTE: not empty > } > >+EncryptionType ::= Int32 >+ > KDCOptions ::= KerberosFlags > -- reserved(0), > -- forwardable(1), >@@ -344,7 +366,11 @@ KRB-ERROR ::= [APPLICATION 30] SEQUENCE { > > METHOD-DATA ::= SEQUENCE OF PA-DATA > >-TYPED-DATA ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE { >+-- >+-- asn1ate doesn't support 'MAX' >+-- >+-- TYPED-DATA ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE { >+TYPED-DATA ::= SEQUENCE SIZE (1..256) OF SEQUENCE { > data-type [0] Int32, > data-value [1] OCTET STRING OPTIONAL > } >@@ -371,7 +397,7 @@ ETYPE-INFO2-ENTRY ::= SEQUENCE { > s2kparams [2] OCTET STRING OPTIONAL > } > >-ETYPE-INFO2 ::= SEQUENCE SIZE (1..MAX) OF ETYPE-INFO2-ENTRY >+ETYPE-INFO2 ::= SEQUENCE SIZE (1..256) OF ETYPE-INFO2-ENTRY > > AD-IF-RELEVANT ::= AuthorizationData > >@@ -389,4 +415,249 @@ AD-AND-OR ::= SEQUENCE { > > AD-MANDATORY-FOR-KDC ::= AuthorizationData > >+ >+ >+ >+ >+ >+-- >+-- >+-- prettyPrint values >+-- >+-- >+ >+NameTypeValues ::= INTEGER { -- Int32 >+ kRB5-NT-UNKNOWN(0), -- Name type not known >+ kRB5-NT-PRINCIPAL(1), -- Just the name of the principal as in >+ kRB5-NT-SRV-INST(2), -- Service and other unique instance (krbtgt) >+ kRB5-NT-SRV-HST(3), -- Service with host name as instance >+ kRB5-NT-SRV-XHST(4), -- Service with host as remaining components >+ kRB5-NT-UID(5), -- Unique ID >+ kRB5-NT-X500-PRINCIPAL(6), -- PKINIT >+ kRB5-NT-SMTP-NAME(7), -- Name in form of SMTP email name >+ kRB5-NT-ENTERPRISE-PRINCIPAL(10), -- Windows 2000 UPN >+ kRB5-NT-WELLKNOWN(11), -- Wellknown >+ kRB5-NT-ENT-PRINCIPAL-AND-ID(-130), -- Windows 2000 UPN and SID >+ kRB5-NT-MS-PRINCIPAL(-128), -- NT 4 style name >+ kRB5-NT-MS-PRINCIPAL-AND-ID(-129) -- NT style name and SID >+} >+NameTypeSequence ::= SEQUENCE { >+ dummy [0] NameTypeValues >+} >+ >+TicketFlagsValues ::= BIT STRING { -- KerberosFlags >+ reserved(0), >+ forwardable(1), >+ forwarded(2), >+ proxiable(3), >+ proxy(4), >+ may-postdate(5), >+ postdated(6), >+ invalid(7), >+ renewable(8), >+ initial(9), >+ pre-authent(10), >+ hw-authent(11), >+-- the following are new since 1510 >+ transited-policy-checked(12), >+ ok-as-delegate(13) >+} >+TicketFlagsSequence ::= SEQUENCE { >+ dummy [0] TicketFlagsValues >+} >+ >+KDCOptionsValues ::= BIT STRING { -- KerberosFlags >+ reserved(0), >+ forwardable(1), >+ forwarded(2), >+ proxiable(3), >+ proxy(4), >+ allow-postdate(5), >+ postdated(6), >+ unused7(7), >+ renewable(8), >+ unused9(9), >+ unused10(10), >+ opt-hardware-auth(11), >+ unused12(12), >+ unused13(13), >+-- 15 is reserved for canonicalize >+ unused15(15), >+-- 26 was unused in 1510 >+ disable-transited-check(26), >+-- >+ renewable-ok(27), >+ enc-tkt-in-skey(28), >+ renew(30), >+ validate(31) >+} >+KDCOptionsSequence ::= SEQUENCE { >+ dummy [0] KDCOptionsValues >+} >+ >+MessageTypeValues ::= INTEGER { >+ krb-as-req(10), -- Request for initial authentication >+ krb-as-rep(11), -- Response to KRB_AS_REQ request >+ krb-tgs-req(12), -- Request for authentication based on TGT >+ krb-tgs-rep(13), -- Response to KRB_TGS_REQ request >+ krb-ap-req(14), -- application request to server >+ krb-ap-rep(15), -- Response to KRB_AP_REQ_MUTUAL >+ krb-safe(20), -- Safe (checksummed) application message >+ krb-priv(21), -- Private (encrypted) application message >+ krb-cred(22), -- Private (encrypted) message to forward credentials >+ krb-error(30) -- Error response >+} >+MessageTypeSequence ::= SEQUENCE { >+ dummy [0] MessageTypeValues >+} >+ >+PADataTypeValues ::= INTEGER { >+ kRB5-PADATA-NONE(0), >+ -- kRB5-PADATA-TGS-REQ(1), >+ -- kRB5-PADATA-AP-REQ(1), >+ kRB5-PADATA-KDC-REQ(1), >+ kRB5-PADATA-ENC-TIMESTAMP(2), >+ kRB5-PADATA-PW-SALT(3), >+ kRB5-PADATA-ENC-UNIX-TIME(5), >+ kRB5-PADATA-SANDIA-SECUREID(6), >+ kRB5-PADATA-SESAME(7), >+ kRB5-PADATA-OSF-DCE(8), >+ kRB5-PADATA-CYBERSAFE-SECUREID(9), >+ kRB5-PADATA-AFS3-SALT(10), >+ kRB5-PADATA-ETYPE-INFO(11), >+ kRB5-PADATA-SAM-CHALLENGE(12), -- (sam/otp) >+ kRB5-PADATA-SAM-RESPONSE(13), -- (sam/otp) >+ kRB5-PADATA-PK-AS-REQ-19(14), -- (PKINIT-19) >+ kRB5-PADATA-PK-AS-REP-19(15), -- (PKINIT-19) >+ -- kRB5-PADATA-PK-AS-REQ-WIN(15), - (PKINIT - old number) >+ kRB5-PADATA-PK-AS-REQ(16), -- (PKINIT-25) >+ kRB5-PADATA-PK-AS-REP(17), -- (PKINIT-25) >+ kRB5-PADATA-PA-PK-OCSP-RESPONSE(18), >+ kRB5-PADATA-ETYPE-INFO2(19), >+ -- kRB5-PADATA-USE-SPECIFIED-KVNO(20), >+ kRB5-PADATA-SVR-REFERRAL-INFO(20), --- old ms referral number >+ kRB5-PADATA-SAM-REDIRECT(21), -- (sam/otp) >+ kRB5-PADATA-GET-FROM-TYPED-DATA(22), >+ kRB5-PADATA-SAM-ETYPE-INFO(23), >+ kRB5-PADATA-SERVER-REFERRAL(25), >+ kRB5-PADATA-ALT-PRINC(24), -- (crawdad@fnal.gov) >+ kRB5-PADATA-SAM-CHALLENGE2(30), -- (kenh@pobox.com) >+ kRB5-PADATA-SAM-RESPONSE2(31), -- (kenh@pobox.com) >+ kRB5-PA-EXTRA-TGT(41), -- Reserved extra TGT >+ kRB5-PADATA-TD-KRB-PRINCIPAL(102), -- PrincipalName >+ kRB5-PADATA-PK-TD-TRUSTED-CERTIFIERS(104), -- PKINIT >+ kRB5-PADATA-PK-TD-CERTIFICATE-INDEX(105), -- PKINIT >+ kRB5-PADATA-TD-APP-DEFINED-ERROR(106), -- application specific >+ kRB5-PADATA-TD-REQ-NONCE(107), -- INTEGER >+ kRB5-PADATA-TD-REQ-SEQ(108), -- INTEGER >+ kRB5-PADATA-PA-PAC-REQUEST(128), -- jbrezak@exchange.microsoft.com >+ kRB5-PADATA-FOR-USER(129), -- MS-KILE >+ kRB5-PADATA-FOR-X509-USER(130), -- MS-KILE >+ kRB5-PADATA-FOR-CHECK-DUPS(131), -- MS-KILE >+ kRB5-PADATA-AS-CHECKSUM(132), -- MS-KILE >+ -- kRB5-PADATA-PK-AS-09-BINDING(132), - client send this to >+ -- tell KDC that is supports >+ -- the asCheckSum in the >+ -- PK-AS-REP >+ kRB5-PADATA-FX-COOKIE(133), -- krb-wg-preauth-framework >+ kRB5-PADATA-AUTHENTICATION-SET(134), -- krb-wg-preauth-framework >+ kRB5-PADATA-AUTH-SET-SELECTED(135), -- krb-wg-preauth-framework >+ kRB5-PADATA-FX-FAST(136), -- krb-wg-preauth-framework >+ kRB5-PADATA-FX-ERROR(137), -- krb-wg-preauth-framework >+ kRB5-PADATA-ENCRYPTED-CHALLENGE(138), -- krb-wg-preauth-framework >+ kRB5-PADATA-OTP-CHALLENGE(141), -- (gareth.richards@rsa.com) >+ kRB5-PADATA-OTP-REQUEST(142), -- (gareth.richards@rsa.com) >+ kBB5-PADATA-OTP-CONFIRM(143), -- (gareth.richards@rsa.com) >+ kRB5-PADATA-OTP-PIN-CHANGE(144), -- (gareth.richards@rsa.com) >+ kRB5-PADATA-EPAK-AS-REQ(145), >+ kRB5-PADATA-EPAK-AS-REP(146), >+ kRB5-PADATA-PKINIT-KX(147), -- krb-wg-anon >+ kRB5-PADATA-PKU2U-NAME(148), -- zhu-pku2u >+ kRB5-PADATA-REQ-ENC-PA-REP(149), -- >+ kRB5-PADATA-SUPPORTED-ETYPES(165) -- MS-KILE >+} >+PADataTypeSequence ::= SEQUENCE { >+ dummy [0] PADataTypeValues >+} >+ >+AuthDataTypeValues ::= INTEGER { >+ kRB5-AUTHDATA-IF-RELEVANT(1), >+ kRB5-AUTHDATA-INTENDED-FOR-SERVER(2), >+ kRB5-AUTHDATA-INTENDED-FOR-APPLICATION-CLASS(3), >+ kRB5-AUTHDATA-KDC-ISSUED(4), >+ kRB5-AUTHDATA-AND-OR(5), >+ kRB5-AUTHDATA-MANDATORY-TICKET-EXTENSIONS(6), >+ kRB5-AUTHDATA-IN-TICKET-EXTENSIONS(7), >+ kRB5-AUTHDATA-MANDATORY-FOR-KDC(8), >+ kRB5-AUTHDATA-INITIAL-VERIFIED-CAS(9), >+ kRB5-AUTHDATA-OSF-DCE(64), >+ kRB5-AUTHDATA-SESAME(65), >+ kRB5-AUTHDATA-OSF-DCE-PKI-CERTID(66), >+ kRB5-AUTHDATA-WIN2K-PAC(128), >+ kRB5-AUTHDATA-GSS-API-ETYPE-NEGOTIATION(129), -- Authenticator only >+ kRB5-AUTHDATA-SIGNTICKET-OLDER(-17), >+ kRB5-AUTHDATA-SIGNTICKET-OLD(142), >+ kRB5-AUTHDATA-SIGNTICKET(512) >+} >+AuthDataTypeSequence ::= SEQUENCE { >+ dummy [0] AuthDataTypeValues >+} >+ >+ChecksumTypeValues ::= INTEGER { >+ kRB5-CKSUMTYPE-NONE(0), >+ kRB5-CKSUMTYPE-CRC32(1), >+ kRB5-CKSUMTYPE-RSA-MD4(2), >+ kRB5-CKSUMTYPE-RSA-MD4-DES(3), >+ kRB5-CKSUMTYPE-DES-MAC(4), >+ kRB5-CKSUMTYPE-DES-MAC-K(5), >+ kRB5-CKSUMTYPE-RSA-MD4-DES-K(6), >+ kRB5-CKSUMTYPE-RSA-MD5(7), >+ kRB5-CKSUMTYPE-RSA-MD5-DES(8), >+ kRB5-CKSUMTYPE-RSA-MD5-DES3(9), >+ kRB5-CKSUMTYPE-SHA1-OTHER(10), >+ kRB5-CKSUMTYPE-HMAC-SHA1-DES3(12), >+ kRB5-CKSUMTYPE-SHA1(14), >+ kRB5-CKSUMTYPE-HMAC-SHA1-96-AES-128(15), >+ kRB5-CKSUMTYPE-HMAC-SHA1-96-AES-256(16), >+ kRB5-CKSUMTYPE-GSSAPI(32771), -- 0x8003 >+ kRB5-CKSUMTYPE-HMAC-MD5(-138), -- unofficial microsoft number >+ kRB5-CKSUMTYPE-HMAC-MD5-ENC(-1138) -- even more unofficial >+} >+ChecksumTypeSequence ::= SEQUENCE { >+ dummy [0] ChecksumTypeValues >+} >+ >+EncryptionTypeValues ::= INTEGER { >+ kRB5-ENCTYPE-NULL(0), >+ kRB5-ENCTYPE-DES-CBC-CRC(1), >+ kRB5-ENCTYPE-DES-CBC-MD4(2), >+ kRB5-ENCTYPE-DES-CBC-MD5(3), >+ kRB5-ENCTYPE-DES3-CBC-MD5(5), >+ kRB5-ENCTYPE-OLD-DES3-CBC-SHA1(7), >+ kRB5-ENCTYPE-SIGN-DSA-GENERATE(8), >+ kRB5-ENCTYPE-ENCRYPT-RSA-PRIV(9), >+ kRB5-ENCTYPE-ENCRYPT-RSA-PUB(10), >+ kRB5-ENCTYPE-DES3-CBC-SHA1(16), -- with key derivation >+ kRB5-ENCTYPE-AES128-CTS-HMAC-SHA1-96(17), >+ kRB5-ENCTYPE-AES256-CTS-HMAC-SHA1-96(18), >+ kRB5-ENCTYPE-ARCFOUR-HMAC-MD5(23), >+ kRB5-ENCTYPE-ARCFOUR-HMAC-MD5-56(24), >+ kRB5-ENCTYPE-ENCTYPE-PK-CROSS(48), >+-- some "old" windows types >+ kRB5-ENCTYPE-ARCFOUR-MD4(-128), >+ kRB5-ENCTYPE-ARCFOUR-HMAC-OLD(-133), >+ kRB5-ENCTYPE-ARCFOUR-HMAC-OLD-EXP(-135), >+-- these are for Heimdal internal use >+-- kRB5-ENCTYPE-DES-CBC-NONE(-0x1000), >+-- kRB5-ENCTYPE-DES3-CBC-NONE(-0x1001), >+-- kRB5-ENCTYPE-DES-CFB64-NONE(-0x1002), >+-- kRB5-ENCTYPE-DES-PCBC-NONE(-0x1003), >+-- kRB5-ENCTYPE-DIGEST-MD5-NONE(-0x1004), - private use, lukeh@padl.com >+-- kRB5-ENCTYPE-CRAM-MD5-NONE(-0x1005) - private use, lukeh@padl.com >+ kRB5-ENCTYPE-DUMMY(-1111) >+} >+EncryptionTypeSequence ::= SEQUENCE { >+ dummy [0] EncryptionTypeValues >+} >+ > END >diff --git a/python/samba/tests/krb5/rfc4120_pyasn1.py b/python/samba/tests/krb5/rfc4120_pyasn1.py >new file mode 100644 >index 00000000000..b2627aa3dcb >--- /dev/null >+++ b/python/samba/tests/krb5/rfc4120_pyasn1.py >@@ -0,0 +1,914 @@ >+# Auto-generated by asn1ate v.0.6.1.dev0 from rfc4120.asn1 >+# (last modified on 2020-03-26 10:28:24.346775) >+ >+# KerberosV5Spec2 >+from pyasn1.type import univ, char, namedtype, namedval, tag, constraint, useful >+ >+ >+def _OID(*components): >+ output = [] >+ for x in tuple(components): >+ if isinstance(x, univ.ObjectIdentifier): >+ output.extend(list(x)) >+ else: >+ output.append(int(x)) >+ >+ return univ.ObjectIdentifier(output) >+ >+ >+class Int32(univ.Integer): >+ pass >+ >+ >+Int32.subtypeSpec = constraint.ValueRangeConstraint(-2147483648, 2147483647) >+ >+ >+class AuthDataType(Int32): >+ pass >+ >+ >+class AuthorizationData(univ.SequenceOf): >+ pass >+ >+ >+AuthorizationData.componentType = univ.Sequence(componentType=namedtype.NamedTypes( >+ namedtype.NamedType('ad-type', AuthDataType().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('ad-data', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+)) >+ >+ >+class AD_AND_OR(univ.Sequence): >+ pass >+ >+ >+AD_AND_OR.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('condition-count', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('elements', AuthorizationData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+) >+ >+ >+class AD_IF_RELEVANT(AuthorizationData): >+ pass >+ >+ >+class ChecksumType(Int32): >+ pass >+ >+ >+class Checksum(univ.Sequence): >+ pass >+ >+ >+Checksum.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('cksumtype', ChecksumType().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('checksum', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+) >+ >+ >+class KerberosString(char.GeneralString): >+ pass >+ >+ >+class NameType(Int32): >+ pass >+ >+ >+class PrincipalName(univ.Sequence): >+ pass >+ >+ >+PrincipalName.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('name-type', NameType().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('name-string', univ.SequenceOf(componentType=KerberosString()).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+) >+ >+ >+class Realm(KerberosString): >+ pass >+ >+ >+class AD_KDCIssued(univ.Sequence): >+ pass >+ >+ >+AD_KDCIssued.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('ad-checksum', Checksum().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))), >+ namedtype.OptionalNamedType('i-realm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.OptionalNamedType('i-sname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))), >+ namedtype.NamedType('elements', AuthorizationData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))) >+) >+ >+ >+class AD_MANDATORY_FOR_KDC(AuthorizationData): >+ pass >+ >+ >+class EncryptionType(Int32): >+ pass >+ >+ >+class UInt32(univ.Integer): >+ pass >+ >+ >+UInt32.subtypeSpec = constraint.ValueRangeConstraint(0, 4294967295) >+ >+ >+class EncryptedData(univ.Sequence): >+ pass >+ >+ >+EncryptedData.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('etype', EncryptionType().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.OptionalNamedType('kvno', UInt32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('cipher', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))) >+) >+ >+ >+class AP_REP(univ.Sequence): >+ pass >+ >+ >+AP_REP.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 15)) >+AP_REP.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('pvno', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(5)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('msg-type', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(15)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('enc-part', EncryptedData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))) >+) >+ >+ >+class KerberosFlags(univ.BitString): >+ pass >+ >+ >+KerberosFlags.subtypeSpec=constraint.ValueSizeConstraint(1, 32) >+ >+ >+class APOptions(KerberosFlags): >+ pass >+ >+ >+class Ticket(univ.Sequence): >+ pass >+ >+ >+Ticket.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 1)) >+Ticket.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('tkt-vno', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(5)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('realm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('sname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))), >+ namedtype.NamedType('enc-part', EncryptedData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))) >+) >+ >+ >+class AP_REQ(univ.Sequence): >+ pass >+ >+ >+AP_REQ.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 14)) >+AP_REQ.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('pvno', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(5)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('msg-type', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(14)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('ap-options', APOptions().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.NamedType('ticket', Ticket().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))), >+ namedtype.NamedType('authenticator', EncryptedData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4))) >+) >+ >+ >+class PADataType(Int32): >+ pass >+ >+ >+class PA_DATA(univ.Sequence): >+ pass >+ >+ >+PA_DATA.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('padata-type', PADataType().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('padata-value', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))) >+) >+ >+ >+class KDC_REP(univ.Sequence): >+ pass >+ >+ >+KDC_REP.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('pvno', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(5)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('msg-type', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(11, 13)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.OptionalNamedType('padata', univ.SequenceOf(componentType=PA_DATA()).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.NamedType('crealm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))), >+ namedtype.NamedType('cname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4))), >+ namedtype.NamedType('ticket', Ticket().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 5))), >+ namedtype.NamedType('enc-part', EncryptedData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 6))) >+) >+ >+ >+class AS_REP(KDC_REP): >+ pass >+ >+ >+AS_REP.tagSet = KDC_REP.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 11)) >+ >+ >+class HostAddress(univ.Sequence): >+ pass >+ >+ >+HostAddress.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('addr-type', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('address', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+) >+ >+ >+class HostAddresses(univ.SequenceOf): >+ pass >+ >+ >+HostAddresses.componentType = HostAddress() >+ >+ >+class KDCOptions(KerberosFlags): >+ pass >+ >+ >+class KerberosTime(useful.GeneralizedTime): >+ pass >+ >+ >+class KDC_REQ_BODY(univ.Sequence): >+ pass >+ >+ >+KDC_REQ_BODY.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('kdc-options', KDCOptions().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.OptionalNamedType('cname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1))), >+ namedtype.NamedType('realm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.OptionalNamedType('sname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))), >+ namedtype.OptionalNamedType('from', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 4))), >+ namedtype.NamedType('till', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 5))), >+ namedtype.OptionalNamedType('rtime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 6))), >+ namedtype.NamedType('nonce', UInt32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 7))), >+ namedtype.NamedType('etype', univ.SequenceOf(componentType=EncryptionType()).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 8))), >+ namedtype.OptionalNamedType('addresses', HostAddresses().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 9))), >+ namedtype.OptionalNamedType('enc-authorization-data', EncryptedData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 10))), >+ namedtype.OptionalNamedType('additional-tickets', univ.SequenceOf(componentType=Ticket()).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 11))) >+) >+ >+ >+class KDC_REQ(univ.Sequence): >+ pass >+ >+ >+KDC_REQ.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('pvno', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(5)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('msg-type', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(10, 12)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.OptionalNamedType('padata', univ.SequenceOf(componentType=PA_DATA()).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))), >+ namedtype.NamedType('req-body', KDC_REQ_BODY().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4))) >+) >+ >+ >+class AS_REQ(KDC_REQ): >+ pass >+ >+ >+AS_REQ.tagSet = KDC_REQ.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 10)) >+ >+ >+class AuthDataTypeValues(univ.Integer): >+ pass >+ >+ >+AuthDataTypeValues.namedValues = namedval.NamedValues( >+ ('kRB5-AUTHDATA-IF-RELEVANT', 1), >+ ('kRB5-AUTHDATA-INTENDED-FOR-SERVER', 2), >+ ('kRB5-AUTHDATA-INTENDED-FOR-APPLICATION-CLASS', 3), >+ ('kRB5-AUTHDATA-KDC-ISSUED', 4), >+ ('kRB5-AUTHDATA-AND-OR', 5), >+ ('kRB5-AUTHDATA-MANDATORY-TICKET-EXTENSIONS', 6), >+ ('kRB5-AUTHDATA-IN-TICKET-EXTENSIONS', 7), >+ ('kRB5-AUTHDATA-MANDATORY-FOR-KDC', 8), >+ ('kRB5-AUTHDATA-INITIAL-VERIFIED-CAS', 9), >+ ('kRB5-AUTHDATA-OSF-DCE', 64), >+ ('kRB5-AUTHDATA-SESAME', 65), >+ ('kRB5-AUTHDATA-OSF-DCE-PKI-CERTID', 66), >+ ('kRB5-AUTHDATA-WIN2K-PAC', 128), >+ ('kRB5-AUTHDATA-GSS-API-ETYPE-NEGOTIATION', 129), >+ ('kRB5-AUTHDATA-SIGNTICKET-OLDER', -17), >+ ('kRB5-AUTHDATA-SIGNTICKET-OLD', 142), >+ ('kRB5-AUTHDATA-SIGNTICKET', 512) >+) >+ >+ >+class AuthDataTypeSequence(univ.Sequence): >+ pass >+ >+ >+AuthDataTypeSequence.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('dummy', AuthDataTypeValues().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ >+class EncryptionKey(univ.Sequence): >+ pass >+ >+ >+EncryptionKey.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('keytype', EncryptionType().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('keyvalue', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+) >+ >+ >+class Microseconds(univ.Integer): >+ pass >+ >+ >+Microseconds.subtypeSpec = constraint.ValueRangeConstraint(0, 999999) >+ >+ >+class Authenticator(univ.Sequence): >+ pass >+ >+ >+Authenticator.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 2)) >+Authenticator.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('authenticator-vno', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(5)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('crealm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('cname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))), >+ namedtype.OptionalNamedType('cksum', Checksum().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))), >+ namedtype.NamedType('cusec', Microseconds().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 4))), >+ namedtype.NamedType('ctime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 5))), >+ namedtype.OptionalNamedType('subkey', EncryptionKey().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 6))), >+ namedtype.OptionalNamedType('seq-number', UInt32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 7))), >+ namedtype.OptionalNamedType('authorization-data', AuthorizationData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 8))) >+) >+ >+ >+class ChecksumTypeValues(univ.Integer): >+ pass >+ >+ >+ChecksumTypeValues.namedValues = namedval.NamedValues( >+ ('kRB5-CKSUMTYPE-NONE', 0), >+ ('kRB5-CKSUMTYPE-CRC32', 1), >+ ('kRB5-CKSUMTYPE-RSA-MD4', 2), >+ ('kRB5-CKSUMTYPE-RSA-MD4-DES', 3), >+ ('kRB5-CKSUMTYPE-DES-MAC', 4), >+ ('kRB5-CKSUMTYPE-DES-MAC-K', 5), >+ ('kRB5-CKSUMTYPE-RSA-MD4-DES-K', 6), >+ ('kRB5-CKSUMTYPE-RSA-MD5', 7), >+ ('kRB5-CKSUMTYPE-RSA-MD5-DES', 8), >+ ('kRB5-CKSUMTYPE-RSA-MD5-DES3', 9), >+ ('kRB5-CKSUMTYPE-SHA1-OTHER', 10), >+ ('kRB5-CKSUMTYPE-HMAC-SHA1-DES3', 12), >+ ('kRB5-CKSUMTYPE-SHA1', 14), >+ ('kRB5-CKSUMTYPE-HMAC-SHA1-96-AES-128', 15), >+ ('kRB5-CKSUMTYPE-HMAC-SHA1-96-AES-256', 16), >+ ('kRB5-CKSUMTYPE-GSSAPI', 32771), >+ ('kRB5-CKSUMTYPE-HMAC-MD5', -138), >+ ('kRB5-CKSUMTYPE-HMAC-MD5-ENC', -1138) >+) >+ >+ >+class ChecksumTypeSequence(univ.Sequence): >+ pass >+ >+ >+ChecksumTypeSequence.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('dummy', ChecksumTypeValues().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ >+class ETYPE_INFO_ENTRY(univ.Sequence): >+ pass >+ >+ >+ETYPE_INFO_ENTRY.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('etype', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.OptionalNamedType('salt', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+) >+ >+ >+class ETYPE_INFO(univ.SequenceOf): >+ pass >+ >+ >+ETYPE_INFO.componentType = ETYPE_INFO_ENTRY() >+ >+ >+class ETYPE_INFO2_ENTRY(univ.Sequence): >+ pass >+ >+ >+ETYPE_INFO2_ENTRY.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('etype', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.OptionalNamedType('salt', KerberosString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.OptionalNamedType('s2kparams', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))) >+) >+ >+ >+class ETYPE_INFO2(univ.SequenceOf): >+ pass >+ >+ >+ETYPE_INFO2.componentType = ETYPE_INFO2_ENTRY() >+ETYPE_INFO2.subtypeSpec=constraint.ValueSizeConstraint(1, 256) >+ >+ >+class EncAPRepPart(univ.Sequence): >+ pass >+ >+ >+EncAPRepPart.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 27)) >+EncAPRepPart.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('ctime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('cusec', Microseconds().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.OptionalNamedType('subkey', EncryptionKey().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))), >+ namedtype.OptionalNamedType('seq-number', UInt32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))) >+) >+ >+ >+class LastReq(univ.SequenceOf): >+ pass >+ >+ >+LastReq.componentType = univ.Sequence(componentType=namedtype.NamedTypes( >+ namedtype.NamedType('lr-type', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('lr-value', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+)) >+ >+ >+class TicketFlags(KerberosFlags): >+ pass >+ >+ >+class EncKDCRepPart(univ.Sequence): >+ pass >+ >+ >+EncKDCRepPart.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('key', EncryptionKey().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))), >+ namedtype.NamedType('last-req', LastReq().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('nonce', UInt32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.OptionalNamedType('key-expiration', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))), >+ namedtype.NamedType('flags', TicketFlags().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 4))), >+ namedtype.NamedType('authtime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 5))), >+ namedtype.OptionalNamedType('starttime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 6))), >+ namedtype.NamedType('endtime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 7))), >+ namedtype.OptionalNamedType('renew-till', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 8))), >+ namedtype.NamedType('srealm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 9))), >+ namedtype.NamedType('sname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 10))), >+ namedtype.OptionalNamedType('caddr', HostAddresses().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 11))) >+) >+ >+ >+class EncASRepPart(EncKDCRepPart): >+ pass >+ >+ >+EncASRepPart.tagSet = EncKDCRepPart.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 25)) >+ >+ >+class KrbCredInfo(univ.Sequence): >+ pass >+ >+ >+KrbCredInfo.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('key', EncryptionKey().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))), >+ namedtype.OptionalNamedType('prealm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.OptionalNamedType('pname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))), >+ namedtype.OptionalNamedType('flags', TicketFlags().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))), >+ namedtype.OptionalNamedType('authtime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 4))), >+ namedtype.OptionalNamedType('starttime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 5))), >+ namedtype.OptionalNamedType('endtime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 6))), >+ namedtype.OptionalNamedType('renew-till', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 7))), >+ namedtype.OptionalNamedType('srealm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 8))), >+ namedtype.OptionalNamedType('sname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 9))), >+ namedtype.OptionalNamedType('caddr', HostAddresses().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 10))) >+) >+ >+ >+class EncKrbCredPart(univ.Sequence): >+ pass >+ >+ >+EncKrbCredPart.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 29)) >+EncKrbCredPart.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('ticket-info', univ.SequenceOf(componentType=KrbCredInfo()).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.OptionalNamedType('nonce', UInt32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.OptionalNamedType('timestamp', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.OptionalNamedType('usec', Microseconds().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))), >+ namedtype.OptionalNamedType('s-address', HostAddress().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4))), >+ namedtype.OptionalNamedType('r-address', HostAddress().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 5))) >+) >+ >+ >+class EncKrbPrivPart(univ.Sequence): >+ pass >+ >+ >+EncKrbPrivPart.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 28)) >+EncKrbPrivPart.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('user-data', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.OptionalNamedType('timestamp', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.OptionalNamedType('usec', Microseconds().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.OptionalNamedType('seq-number', UInt32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))), >+ namedtype.NamedType('s-address', HostAddress().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4))), >+ namedtype.OptionalNamedType('r-address', HostAddress().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 5))) >+) >+ >+ >+class EncTGSRepPart(EncKDCRepPart): >+ pass >+ >+ >+EncTGSRepPart.tagSet = EncKDCRepPart.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 26)) >+ >+ >+class TransitedEncoding(univ.Sequence): >+ pass >+ >+ >+TransitedEncoding.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('tr-type', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('contents', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+) >+ >+ >+class EncTicketPart(univ.Sequence): >+ pass >+ >+ >+EncTicketPart.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 3)) >+EncTicketPart.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('flags', TicketFlags().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('key', EncryptionKey().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1))), >+ namedtype.NamedType('crealm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.NamedType('cname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))), >+ namedtype.NamedType('transited', TransitedEncoding().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4))), >+ namedtype.NamedType('authtime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 5))), >+ namedtype.OptionalNamedType('starttime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 6))), >+ namedtype.NamedType('endtime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 7))), >+ namedtype.OptionalNamedType('renew-till', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 8))), >+ namedtype.OptionalNamedType('caddr', HostAddresses().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 9))), >+ namedtype.OptionalNamedType('authorization-data', AuthorizationData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 10))) >+) >+ >+ >+class EncryptionTypeValues(univ.Integer): >+ pass >+ >+ >+EncryptionTypeValues.namedValues = namedval.NamedValues( >+ ('kRB5-ENCTYPE-NULL', 0), >+ ('kRB5-ENCTYPE-DES-CBC-CRC', 1), >+ ('kRB5-ENCTYPE-DES-CBC-MD4', 2), >+ ('kRB5-ENCTYPE-DES-CBC-MD5', 3), >+ ('kRB5-ENCTYPE-DES3-CBC-MD5', 5), >+ ('kRB5-ENCTYPE-OLD-DES3-CBC-SHA1', 7), >+ ('kRB5-ENCTYPE-SIGN-DSA-GENERATE', 8), >+ ('kRB5-ENCTYPE-ENCRYPT-RSA-PRIV', 9), >+ ('kRB5-ENCTYPE-ENCRYPT-RSA-PUB', 10), >+ ('kRB5-ENCTYPE-DES3-CBC-SHA1', 16), >+ ('kRB5-ENCTYPE-AES128-CTS-HMAC-SHA1-96', 17), >+ ('kRB5-ENCTYPE-AES256-CTS-HMAC-SHA1-96', 18), >+ ('kRB5-ENCTYPE-ARCFOUR-HMAC-MD5', 23), >+ ('kRB5-ENCTYPE-ARCFOUR-HMAC-MD5-56', 24), >+ ('kRB5-ENCTYPE-ENCTYPE-PK-CROSS', 48), >+ ('kRB5-ENCTYPE-ARCFOUR-MD4', -128), >+ ('kRB5-ENCTYPE-ARCFOUR-HMAC-OLD', -133), >+ ('kRB5-ENCTYPE-ARCFOUR-HMAC-OLD-EXP', -135), >+ ('kRB5-ENCTYPE-DUMMY', -1111) >+) >+ >+ >+class EncryptionTypeSequence(univ.Sequence): >+ pass >+ >+ >+EncryptionTypeSequence.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('dummy', EncryptionTypeValues().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ >+class KDCOptionsValues(univ.BitString): >+ pass >+ >+ >+KDCOptionsValues.namedValues = namedval.NamedValues( >+ ('reserved', 0), >+ ('forwardable', 1), >+ ('forwarded', 2), >+ ('proxiable', 3), >+ ('proxy', 4), >+ ('allow-postdate', 5), >+ ('postdated', 6), >+ ('unused7', 7), >+ ('renewable', 8), >+ ('unused9', 9), >+ ('unused10', 10), >+ ('opt-hardware-auth', 11), >+ ('unused12', 12), >+ ('unused13', 13), >+ ('unused15', 15), >+ ('disable-transited-check', 26), >+ ('renewable-ok', 27), >+ ('enc-tkt-in-skey', 28), >+ ('renew', 30), >+ ('validate', 31) >+) >+ >+ >+class KDCOptionsSequence(univ.Sequence): >+ pass >+ >+ >+KDCOptionsSequence.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('dummy', KDCOptionsValues().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ >+class KRB_CRED(univ.Sequence): >+ pass >+ >+ >+KRB_CRED.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 22)) >+KRB_CRED.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('pvno', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(5)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('msg-type', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(22)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('tickets', univ.SequenceOf(componentType=Ticket()).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.NamedType('enc-part', EncryptedData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))) >+) >+ >+ >+class KRB_ERROR(univ.Sequence): >+ pass >+ >+ >+KRB_ERROR.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 30)) >+KRB_ERROR.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('pvno', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(5)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('msg-type', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(30)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.OptionalNamedType('ctime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.OptionalNamedType('cusec', Microseconds().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))), >+ namedtype.NamedType('stime', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 4))), >+ namedtype.NamedType('susec', Microseconds().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 5))), >+ namedtype.NamedType('error-code', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 6))), >+ namedtype.OptionalNamedType('crealm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 7))), >+ namedtype.OptionalNamedType('cname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 8))), >+ namedtype.NamedType('realm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 9))), >+ namedtype.NamedType('sname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 10))), >+ namedtype.OptionalNamedType('e-text', KerberosString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 11))), >+ namedtype.OptionalNamedType('e-data', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 12))) >+) >+ >+ >+class KRB_PRIV(univ.Sequence): >+ pass >+ >+ >+KRB_PRIV.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 21)) >+KRB_PRIV.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('pvno', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(5)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('msg-type', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(21)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('enc-part', EncryptedData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))) >+) >+ >+ >+class KRB_SAFE_BODY(univ.Sequence): >+ pass >+ >+ >+KRB_SAFE_BODY.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('user-data', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.OptionalNamedType('timestamp', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.OptionalNamedType('usec', Microseconds().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.OptionalNamedType('seq-number', UInt32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))), >+ namedtype.NamedType('s-address', HostAddress().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4))), >+ namedtype.OptionalNamedType('r-address', HostAddress().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 5))) >+) >+ >+ >+class KRB_SAFE(univ.Sequence): >+ pass >+ >+ >+KRB_SAFE.tagSet = univ.Sequence.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 20)) >+KRB_SAFE.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('pvno', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(5)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('msg-type', univ.Integer().subtype(subtypeSpec=constraint.SingleValueConstraint(20)).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('safe-body', KRB_SAFE_BODY().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))), >+ namedtype.NamedType('cksum', Checksum().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))) >+) >+ >+ >+class METHOD_DATA(univ.SequenceOf): >+ pass >+ >+ >+METHOD_DATA.componentType = PA_DATA() >+ >+ >+class MessageTypeValues(univ.Integer): >+ pass >+ >+ >+MessageTypeValues.namedValues = namedval.NamedValues( >+ ('krb-as-req', 10), >+ ('krb-as-rep', 11), >+ ('krb-tgs-req', 12), >+ ('krb-tgs-rep', 13), >+ ('krb-ap-req', 14), >+ ('krb-ap-rep', 15), >+ ('krb-safe', 20), >+ ('krb-priv', 21), >+ ('krb-cred', 22), >+ ('krb-error', 30) >+) >+ >+ >+class MessageTypeSequence(univ.Sequence): >+ pass >+ >+ >+MessageTypeSequence.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('dummy', MessageTypeValues().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ >+class NameTypeValues(univ.Integer): >+ pass >+ >+ >+NameTypeValues.namedValues = namedval.NamedValues( >+ ('kRB5-NT-UNKNOWN', 0), >+ ('kRB5-NT-PRINCIPAL', 1), >+ ('kRB5-NT-SRV-INST', 2), >+ ('kRB5-NT-SRV-HST', 3), >+ ('kRB5-NT-SRV-XHST', 4), >+ ('kRB5-NT-UID', 5), >+ ('kRB5-NT-X500-PRINCIPAL', 6), >+ ('kRB5-NT-SMTP-NAME', 7), >+ ('kRB5-NT-ENTERPRISE-PRINCIPAL', 10), >+ ('kRB5-NT-WELLKNOWN', 11), >+ ('kRB5-NT-ENT-PRINCIPAL-AND-ID', -130), >+ ('kRB5-NT-MS-PRINCIPAL', -128), >+ ('kRB5-NT-MS-PRINCIPAL-AND-ID', -129) >+) >+ >+ >+class NameTypeSequence(univ.Sequence): >+ pass >+ >+ >+NameTypeSequence.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('dummy', NameTypeValues().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ >+class PA_ENC_TIMESTAMP(EncryptedData): >+ pass >+ >+ >+class PA_ENC_TS_ENC(univ.Sequence): >+ pass >+ >+ >+PA_ENC_TS_ENC.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('patimestamp', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.OptionalNamedType('pausec', Microseconds().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+) >+ >+ >+class PADataTypeValues(univ.Integer): >+ pass >+ >+ >+PADataTypeValues.namedValues = namedval.NamedValues( >+ ('kRB5-PADATA-NONE', 0), >+ ('kRB5-PADATA-KDC-REQ', 1), >+ ('kRB5-PADATA-ENC-TIMESTAMP', 2), >+ ('kRB5-PADATA-PW-SALT', 3), >+ ('kRB5-PADATA-ENC-UNIX-TIME', 5), >+ ('kRB5-PADATA-SANDIA-SECUREID', 6), >+ ('kRB5-PADATA-SESAME', 7), >+ ('kRB5-PADATA-OSF-DCE', 8), >+ ('kRB5-PADATA-CYBERSAFE-SECUREID', 9), >+ ('kRB5-PADATA-AFS3-SALT', 10), >+ ('kRB5-PADATA-ETYPE-INFO', 11), >+ ('kRB5-PADATA-SAM-CHALLENGE', 12), >+ ('kRB5-PADATA-SAM-RESPONSE', 13), >+ ('kRB5-PADATA-PK-AS-REQ-19', 14), >+ ('kRB5-PADATA-PK-AS-REP-19', 15), >+ ('kRB5-PADATA-PK-AS-REQ', 16), >+ ('kRB5-PADATA-PK-AS-REP', 17), >+ ('kRB5-PADATA-PA-PK-OCSP-RESPONSE', 18), >+ ('kRB5-PADATA-ETYPE-INFO2', 19), >+ ('kRB5-PADATA-SVR-REFERRAL-INFO', 20), >+ ('kRB5-PADATA-SAM-REDIRECT', 21), >+ ('kRB5-PADATA-GET-FROM-TYPED-DATA', 22), >+ ('kRB5-PADATA-SAM-ETYPE-INFO', 23), >+ ('kRB5-PADATA-SERVER-REFERRAL', 25), >+ ('kRB5-PADATA-ALT-PRINC', 24), >+ ('kRB5-PADATA-SAM-CHALLENGE2', 30), >+ ('kRB5-PADATA-SAM-RESPONSE2', 31), >+ ('kRB5-PA-EXTRA-TGT', 41), >+ ('kRB5-PADATA-TD-KRB-PRINCIPAL', 102), >+ ('kRB5-PADATA-PK-TD-TRUSTED-CERTIFIERS', 104), >+ ('kRB5-PADATA-PK-TD-CERTIFICATE-INDEX', 105), >+ ('kRB5-PADATA-TD-APP-DEFINED-ERROR', 106), >+ ('kRB5-PADATA-TD-REQ-NONCE', 107), >+ ('kRB5-PADATA-TD-REQ-SEQ', 108), >+ ('kRB5-PADATA-PA-PAC-REQUEST', 128), >+ ('kRB5-PADATA-FOR-USER', 129), >+ ('kRB5-PADATA-FOR-X509-USER', 130), >+ ('kRB5-PADATA-FOR-CHECK-DUPS', 131), >+ ('kRB5-PADATA-AS-CHECKSUM', 132), >+ ('kRB5-PADATA-FX-COOKIE', 133), >+ ('kRB5-PADATA-AUTHENTICATION-SET', 134), >+ ('kRB5-PADATA-AUTH-SET-SELECTED', 135), >+ ('kRB5-PADATA-FX-FAST', 136), >+ ('kRB5-PADATA-FX-ERROR', 137), >+ ('kRB5-PADATA-ENCRYPTED-CHALLENGE', 138), >+ ('kRB5-PADATA-OTP-CHALLENGE', 141), >+ ('kRB5-PADATA-OTP-REQUEST', 142), >+ ('kBB5-PADATA-OTP-CONFIRM', 143), >+ ('kRB5-PADATA-OTP-PIN-CHANGE', 144), >+ ('kRB5-PADATA-EPAK-AS-REQ', 145), >+ ('kRB5-PADATA-EPAK-AS-REP', 146), >+ ('kRB5-PADATA-PKINIT-KX', 147), >+ ('kRB5-PADATA-PKU2U-NAME', 148), >+ ('kRB5-PADATA-REQ-ENC-PA-REP', 149), >+ ('kRB5-PADATA-SUPPORTED-ETYPES', 165) >+) >+ >+ >+class PADataTypeSequence(univ.Sequence): >+ pass >+ >+ >+PADataTypeSequence.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('dummy', PADataTypeValues().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ >+class TGS_REP(KDC_REP): >+ pass >+ >+ >+TGS_REP.tagSet = KDC_REP.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 13)) >+ >+ >+class TGS_REQ(KDC_REQ): >+ pass >+ >+ >+TGS_REQ.tagSet = KDC_REQ.tagSet.tagExplicitly(tag.Tag(tag.tagClassApplication, tag.tagFormatConstructed, 12)) >+ >+ >+class TYPED_DATA(univ.SequenceOf): >+ pass >+ >+ >+TYPED_DATA.componentType = univ.Sequence(componentType=namedtype.NamedTypes( >+ namedtype.NamedType('data-type', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.OptionalNamedType('data-value', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+)) >+ >+TYPED_DATA.subtypeSpec=constraint.ValueSizeConstraint(1, 256) >+ >+ >+class TicketFlagsValues(univ.BitString): >+ pass >+ >+ >+TicketFlagsValues.namedValues = namedval.NamedValues( >+ ('reserved', 0), >+ ('forwardable', 1), >+ ('forwarded', 2), >+ ('proxiable', 3), >+ ('proxy', 4), >+ ('may-postdate', 5), >+ ('postdated', 6), >+ ('invalid', 7), >+ ('renewable', 8), >+ ('initial', 9), >+ ('pre-authent', 10), >+ ('hw-authent', 11), >+ ('transited-policy-checked', 12), >+ ('ok-as-delegate', 13) >+) >+ >+ >+class TicketFlagsSequence(univ.Sequence): >+ pass >+ >+ >+TicketFlagsSequence.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('dummy', TicketFlagsValues().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ >+id_krb5 = _OID(1, 3, 6, 1, 5, 2) >+ >+ >diff --git a/python/samba/tests/krb5/rfc4120_pyasn1_regen.sh b/python/samba/tests/krb5/rfc4120_pyasn1_regen.sh >new file mode 100755 >index 00000000000..2e3995688f2 >--- /dev/null >+++ b/python/samba/tests/krb5/rfc4120_pyasn1_regen.sh >@@ -0,0 +1,41 @@ >+#!/bin/bash >+# >+ >+# >+# I used https://github.com/kimgr/asn1ate.git >+# to generate pyasn1 bindings for rfc4120.asn1 >+# >+ >+PATH_TO_ASN1ATE_CHECKOUT=$1 >+PATH_TO_ASN1_INPUT_FILE=$2 >+ >+set -u >+set -e >+ >+usage() { >+ echo "usage: $0 PATH_TO_ASN1ATE_CHECKOUT PATH_TO_ASN1_INPUT_FILE > PATH_TO_PYASN1_OUTPUT_FILE" >+} >+ >+test -n "${PATH_TO_ASN1ATE_CHECKOUT}" || { >+ usage >+ exit 1 >+} >+test -n "${PATH_TO_ASN1_INPUT_FILE}" || { >+ usage >+ exit 1 >+} >+test -d "${PATH_TO_ASN1ATE_CHECKOUT}" || { >+ usage >+ exit 1 >+} >+test -f "${PATH_TO_ASN1_INPUT_FILE}" || { >+ usage >+ exit 1 >+} >+ >+PATH_TO_PYASN1GEN_PY="${PATH_TO_ASN1ATE_CHECKOUT}/asn1ate/pyasn1gen.py" >+ >+PYTHONPATH="${PATH_TO_ASN1ATE_CHECKOUT}:${PYTHONPATH-}" >+export PYTHONPATH >+ >+python3 "${PATH_TO_PYASN1GEN_PY}" "${PATH_TO_ASN1_INPUT_FILE}" >diff --git a/python/samba/tests/source.py b/python/samba/tests/source.py >index b7608b1bab3..cebfb9ae8fb 100644 >--- a/python/samba/tests/source.py >+++ b/python/samba/tests/source.py >@@ -93,6 +93,9 @@ class TestSource(TestCase): > if fname.endswith("python/samba/tests/krb5/kcrypto.py"): > # Imported from MIT testing repo > continue >+ if fname.endswith("python/samba/tests/krb5/rfc4120_pyasn1.py"): >+ # Autogenerated >+ continue > match = copyright_re.search(text) > if not match: > incorrect.append((fname, 'no copyright line found\n')) >@@ -138,6 +141,9 @@ class TestSource(TestCase): > if fname.endswith("python/samba/tests/krb5/kcrypto.py"): > # Imported from MIT testing repo > continue >+ if fname.endswith("python/samba/tests/krb5/rfc4120_pyasn1.py"): >+ # Autogenerated >+ continue > if not gpl_re.search(text): > incorrect.append(fname) > >-- >2.25.1 > > >From ae39d8c5397cb4a05c6727349f4da26110a27091 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Thu, 13 Feb 2020 16:29:38 +0100 >Subject: [PATCH 020/380] python/tests/krb5: add raw_testcase.py as the base > for our Kerberos protocol testing > >Pair-Programmed-With: Isaac Boukris <iboukris@samba.org> > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >(cherry picked from commit fb7cba50ae3472b29aa806208badc1ded8979073) >--- > python/samba/tests/krb5/raw_testcase.py | 869 ++++++++++++++++++++++++ > 1 file changed, 869 insertions(+) > create mode 100644 python/samba/tests/krb5/raw_testcase.py > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >new file mode 100644 >index 00000000000..6c7bcd418a0 >--- /dev/null >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -0,0 +1,869 @@ >+# Unix SMB/CIFS implementation. >+# Copyright (C) Isaac Boukris 2020 >+# Copyright (C) Stefan Metzmacher 2020 >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import socket >+import struct >+import time >+import datetime >+import random >+ >+import samba.tests >+from samba.credentials import Credentials >+from samba.tests import TestCase >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+import samba.tests.krb5.kcrypto as kcrypto >+ >+from pyasn1.codec.der.decoder import decode as pyasn1_der_decode >+from pyasn1.codec.der.encoder import encode as pyasn1_der_encode >+from pyasn1.codec.native.decoder import decode as pyasn1_native_decode >+from pyasn1.codec.native.encoder import encode as pyasn1_native_encode >+ >+from pyasn1.codec.ber.encoder import BitStringEncoder as BitStringEncoder >+def BitStringEncoder_encodeValue32(self, value, asn1Spec, encodeFun, **options): >+ # >+ # BitStrings like KDCOptions or TicketFlags should at least >+ # be 32-Bit on the wire >+ # >+ if asn1Spec is not None: >+ # TODO: try to avoid ASN.1 schema instantiation >+ value = asn1Spec.clone(value) >+ >+ valueLength = len(value) >+ if valueLength % 8: >+ alignedValue = value << (8 - valueLength % 8) >+ else: >+ alignedValue = value >+ >+ substrate = alignedValue.asOctets() >+ length = len(substrate) >+ # We need at least 32-Bit / 4-Bytes >+ if length < 4: >+ padding = 4 - length >+ else: >+ padding = 0 >+ ret = b'\x00' + substrate + (b'\x00' * padding) >+ return ret, False, True >+BitStringEncoder.encodeValue = BitStringEncoder_encodeValue32 >+ >+def BitString_NamedValues_prettyPrint(self, scope=0): >+ ret = "%s" % self.asBinary() >+ bits = [] >+ highest_bit = 32 >+ for byte in self.asNumbers(): >+ for bit in [7,6,5,4,3,2,1,0]: >+ mask = 1 << bit >+ if byte & mask: >+ val = 1 >+ else: >+ val = 0 >+ bits.append(val) >+ if len(bits) < highest_bit: >+ for bitPosition in range(len(bits), highest_bit): >+ bits.append(0) >+ indent = " " * scope >+ delim = ": (\n%s " % indent >+ for bitPosition in range(highest_bit): >+ if bitPosition in self.prettyPrintNamedValues: >+ name = self.prettyPrintNamedValues[bitPosition] >+ elif bits[bitPosition] != 0: >+ name = "unknown-bit-%u" % bitPosition >+ else: >+ continue >+ ret += "%s%s:%u" % (delim, name, bits[bitPosition]) >+ delim = ",\n%s " % indent >+ ret += "\n%s)" % indent >+ return ret >+krb5_asn1.TicketFlags.prettyPrintNamedValues = krb5_asn1.TicketFlagsValues.namedValues >+krb5_asn1.TicketFlags.namedValues = krb5_asn1.TicketFlagsValues.namedValues >+krb5_asn1.TicketFlags.prettyPrint = BitString_NamedValues_prettyPrint >+krb5_asn1.KDCOptions.prettyPrintNamedValues = krb5_asn1.KDCOptionsValues.namedValues >+krb5_asn1.KDCOptions.namedValues = krb5_asn1.KDCOptionsValues.namedValues >+krb5_asn1.KDCOptions.prettyPrint = BitString_NamedValues_prettyPrint >+ >+def Integer_NamedValues_prettyPrint(self, scope=0): >+ intval = int(self) >+ if intval in self.prettyPrintNamedValues: >+ name = self.prettyPrintNamedValues[intval] >+ else: >+ name = "<__unknown__>" >+ ret = "%d (0x%x) %s" % (intval, intval, name) >+ return ret >+krb5_asn1.NameType.prettyPrintNamedValues = krb5_asn1.NameTypeValues.namedValues >+krb5_asn1.NameType.prettyPrint = Integer_NamedValues_prettyPrint >+krb5_asn1.AuthDataType.prettyPrintNamedValues = krb5_asn1.AuthDataTypeValues.namedValues >+krb5_asn1.AuthDataType.prettyPrint = Integer_NamedValues_prettyPrint >+krb5_asn1.PADataType.prettyPrintNamedValues = krb5_asn1.PADataTypeValues.namedValues >+krb5_asn1.PADataType.prettyPrint = Integer_NamedValues_prettyPrint >+krb5_asn1.EncryptionType.prettyPrintNamedValues = krb5_asn1.EncryptionTypeValues.namedValues >+krb5_asn1.EncryptionType.prettyPrint = Integer_NamedValues_prettyPrint >+krb5_asn1.ChecksumType.prettyPrintNamedValues = krb5_asn1.ChecksumTypeValues.namedValues >+krb5_asn1.ChecksumType.prettyPrint = Integer_NamedValues_prettyPrint >+ >+class Krb5EncryptionKey(object): >+ def __init__(self, key, kvno): >+ EncTypeChecksum = { >+ kcrypto.Enctype.AES256: kcrypto.Cksumtype.SHA1_AES256, >+ kcrypto.Enctype.AES128: kcrypto.Cksumtype.SHA1_AES128, >+ kcrypto.Enctype.RC4: kcrypto.Cksumtype.HMAC_MD5, >+ } >+ self.key = key >+ self.etype = key.enctype >+ self.ctype = EncTypeChecksum[self.etype] >+ self.kvno = kvno >+ return >+ >+ def encrypt(self, usage, plaintext): >+ ciphertext = kcrypto.encrypt(self.key, usage, plaintext) >+ return ciphertext >+ >+ def decrypt(self, usage, ciphertext): >+ plaintext = kcrypto.decrypt(self.key, usage, ciphertext) >+ return plaintext >+ >+ def make_checksum(self, usage, plaintext, ctype=None): >+ if ctype is None: >+ ctype = self.ctype >+ cksum = kcrypto.make_checksum(ctype, self.key, usage, plaintext) >+ return cksum >+ >+ def export_obj(self): >+ EncryptionKey_obj = { >+ 'keytype': self.etype, >+ 'keyvalue': self.key.contents, >+ }; >+ return EncryptionKey_obj >+ >+class RawKerberosTest(TestCase): >+ """A raw Kerberos Test case.""" >+ >+ def setUp(self): >+ super(RawKerberosTest, self).setUp() >+ self.do_asn1_print = False >+ self.do_hexdump = False >+ >+ self.host = samba.tests.env_get_var_value('SERVER') >+ >+ self.s = None >+ >+ def tearDown(self): >+ self._disconnect("tearDown") >+ super(TestCase, self).tearDown() >+ >+ def _disconnect(self, reason): >+ if self.s is None: >+ return >+ self.s.close() >+ self.s = None >+ if self.do_hexdump: >+ sys.stderr.write("disconnect[%s]\n" % reason) >+ >+ def _connect_tcp(self): >+ tcp_port = 88 >+ try: >+ self.a = socket.getaddrinfo(self.host, tcp_port, socket.AF_UNSPEC, >+ socket.SOCK_STREAM, socket.SOL_TCP, >+ 0) >+ self.s = socket.socket(self.a[0][0], self.a[0][1], self.a[0][2]) >+ self.s.settimeout(10) >+ self.s.connect(self.a[0][4]) >+ except socket.error as e: >+ self.s.close() >+ raise >+ except IOError as e: >+ self.s.close() >+ raise >+ except Exception as e: >+ raise >+ finally: >+ pass >+ >+ def connect(self): >+ self.assertNotConnected() >+ self._connect_tcp() >+ if self.do_hexdump: >+ sys.stderr.write("connected[%s]\n" % self.host) >+ return >+ >+ def get_user_creds(self): >+ c = Credentials() >+ c.guess() >+ domain = samba.tests.env_get_var_value('DOMAIN') >+ realm = samba.tests.env_get_var_value('REALM') >+ username = samba.tests.env_get_var_value('USERNAME') >+ password = samba.tests.env_get_var_value('PASSWORD') >+ c.set_domain(domain) >+ c.set_realm(realm) >+ c.set_username(username) >+ c.set_password(password) >+ return c >+ >+ def get_service_creds(self, allow_missing_password=False): >+ c = Credentials() >+ c.guess() >+ domain = samba.tests.env_get_var_value('DOMAIN') >+ realm = samba.tests.env_get_var_value('REALM') >+ username = samba.tests.env_get_var_value('SERVICE_USERNAME') >+ password = samba.tests.env_get_var_value('SERVICE_PASSWORD', >+ allow_missing=allow_missing_password) >+ c.set_domain(domain) >+ c.set_realm(realm) >+ c.set_username(username) >+ if password is not None: >+ c.set_password(password) >+ return c >+ >+ def get_anon_creds(self): >+ c = Credentials() >+ c.set_anonymous() >+ return c >+ >+ def asn1_dump(self, name, obj, asn1_print=None): >+ if asn1_print is None: >+ asn1_print = self.do_asn1_print >+ if asn1_print: >+ if name is not None: >+ sys.stderr.write("%s:\n%s" % (name, obj)) >+ else: >+ sys.stderr.write("%s" % (obj)) >+ >+ def hex_dump(self, name, blob, hexdump=None): >+ if hexdump is None: >+ hexdump = self.do_hexdump >+ if hexdump: >+ sys.stderr.write("%s: %d\n%s" % (name, len(blob), self.hexdump(blob))) >+ >+ def der_decode(self, blob, asn1Spec=None, native_encode=True, asn1_print=None, hexdump=None): >+ if asn1Spec is not None: >+ class_name = type(asn1Spec).__name__.split(':')[0] >+ else: >+ class_name = "<None-asn1Spec>" >+ self.hex_dump(class_name, blob, hexdump=hexdump) >+ obj,_ = pyasn1_der_decode(blob, asn1Spec=asn1Spec) >+ self.asn1_dump(None, obj, asn1_print=asn1_print) >+ if native_encode: >+ obj = pyasn1_native_encode(obj) >+ return obj >+ >+ def der_encode(self, obj, asn1Spec=None, native_decode=True, asn1_print=None, hexdump=None): >+ if native_decode: >+ obj = pyasn1_native_decode(obj, asn1Spec=asn1Spec) >+ class_name = type(obj).__name__.split(':')[0] >+ if class_name is not None: >+ self.asn1_dump(None, obj, asn1_print=asn1_print) >+ blob = pyasn1_der_encode(obj) >+ if class_name is not None: >+ self.hex_dump(class_name, blob, hexdump=hexdump) >+ return blob >+ >+ def send_pdu(self, req, asn1_print=None, hexdump=None): >+ try: >+ k5_pdu = self.der_encode(req, native_decode=False, asn1_print=asn1_print, hexdump=False) >+ header = struct.pack('>I', len(k5_pdu)) >+ req_pdu = header >+ req_pdu += k5_pdu >+ self.hex_dump("send_pdu", header, hexdump=hexdump) >+ self.hex_dump("send_pdu", k5_pdu, hexdump=hexdump) >+ while True: >+ sent = self.s.send(req_pdu, 0) >+ if sent == len(req_pdu): >+ break >+ req_pdu = req_pdu[sent:] >+ except socket.error as e: >+ self._disconnect("send_pdu: %s" % e) >+ raise >+ except IOError as e: >+ self._disconnect("send_pdu: %s" % e) >+ raise >+ finally: >+ pass >+ >+ def recv_raw(self, num_recv=0xffff, hexdump=None, timeout=None): >+ rep_pdu = None >+ try: >+ if timeout is not None: >+ self.s.settimeout(timeout) >+ rep_pdu = self.s.recv(num_recv, 0) >+ self.s.settimeout(10) >+ if len(rep_pdu) == 0: >+ self._disconnect("recv_raw: EOF") >+ return None >+ self.hex_dump("recv_raw", rep_pdu, hexdump=hexdump) >+ except socket.timeout as e: >+ self.s.settimeout(10) >+ sys.stderr.write("recv_raw: TIMEOUT\n") >+ pass >+ except socket.error as e: >+ self._disconnect("recv_raw: %s" % e) >+ raise >+ except IOError as e: >+ self._disconnect("recv_raw: %s" % e) >+ raise >+ finally: >+ pass >+ return rep_pdu >+ >+ def recv_pdu_raw(self, asn1_print=None, hexdump=None, timeout=None): >+ rep_pdu = None >+ rep = None >+ try: >+ raw_pdu = self.recv_raw(num_recv=4, hexdump=hexdump, timeout=timeout) >+ if raw_pdu is None: >+ return (None, None) >+ header = struct.unpack(">I", raw_pdu[0:4]) >+ k5_len = header[0] >+ if k5_len == 0: >+ return (None, "") >+ missing = k5_len >+ rep_pdu = b'' >+ while missing > 0: >+ raw_pdu = self.recv_raw(num_recv=missing, hexdump=hexdump, timeout=timeout) >+ self.assertGreaterEqual(len(raw_pdu), 1) >+ rep_pdu += raw_pdu >+ missing = k5_len - len(rep_pdu) >+ k5_raw = self.der_decode(rep_pdu, asn1Spec=None, native_encode=False, >+ asn1_print=False, hexdump=False) >+ pvno=k5_raw['field-0'] >+ self.assertEqual(pvno, 5) >+ msg_type=k5_raw['field-1'] >+ self.assertIn(msg_type, [11,13,30]) >+ if msg_type == 11: >+ asn1Spec=krb5_asn1.AS_REP() >+ elif msg_type == 13: >+ asn1Spec=krb5_asn1.TGS_REP() >+ elif msg_type == 30: >+ asn1Spec=krb5_asn1.KRB_ERROR() >+ rep = self.der_decode(rep_pdu, asn1Spec=asn1Spec, >+ asn1_print=asn1_print, hexdump=False) >+ finally: >+ pass >+ return (rep, rep_pdu) >+ >+ def recv_pdu(self, asn1_print=None, hexdump=None, timeout=None): >+ (rep, rep_pdu) = self.recv_pdu_raw(asn1_print=asn1_print, >+ hexdump=hexdump, >+ timeout=timeout) >+ return rep >+ >+ def assertIsConnected(self): >+ self.assertIsNotNone(self.s, msg="Not connected") >+ return >+ >+ def assertNotConnected(self): >+ self.assertIsNone(self.s, msg="Is connected") >+ return >+ >+ def send_recv_transaction(self, req, asn1_print=None, hexdump=None, timeout=None): >+ self.connect() >+ try: >+ self.send_pdu(req, asn1_print=asn1_print, hexdump=hexdump) >+ rep = self.recv_pdu(asn1_print=asn1_print, hexdump=hexdump, timeout=timeout) >+ except Exception: >+ self._disconnect("transaction failed") >+ raise >+ self._disconnect("transaction done") >+ return rep >+ >+ def assertNoValue(self, value): >+ self.assertTrue(value.isNoValue) >+ return >+ >+ def assertHasValue(self, value): >+ self.assertIsNotNone(value) >+ return >+ >+ def assertPrincipalEqual(self, princ1, princ2): >+ self.assertEqual(princ1['name-type'], princ2['name-type']) >+ self.assertEqual(len(princ1['name-string']), len(princ2['name-string']), >+ msg="princ1=%s != princ2=%s" % (princ1, princ2)) >+ for idx in range(len(princ1['name-string'])): >+ self.assertEqual(princ1['name-string'][idx], princ2['name-string'][idx], >+ msg="princ1=%s != princ2=%s" % (princ1, princ2)) >+ return >+ >+ def get_KerberosTimeWithUsec(self, epoch=None, offset=None): >+ if epoch is None: >+ epoch = time.time() >+ if offset is not None: >+ epoch = epoch + int(offset) >+ dt = datetime.datetime.fromtimestamp(epoch, tz=datetime.timezone.utc) >+ return (dt.strftime("%Y%m%d%H%M%SZ"), dt.microsecond) >+ >+ def get_KerberosTime(self, epoch=None, offset=None): >+ (s, _) = self.get_KerberosTimeWithUsec(epoch=epoch, offset=offset) >+ return s >+ >+ def SessionKey_create(self, etype, contents, kvno=None): >+ key = kcrypto.Key(etype, contents) >+ return Krb5EncryptionKey(key, kvno) >+ >+ def PasswordKey_create(self, etype=None, pwd=None, salt=None, kvno=None): >+ key = kcrypto.string_to_key(etype, pwd, salt) >+ return Krb5EncryptionKey(key, kvno) >+ >+ def PasswordKey_from_etype_info2(self, creds, etype_info2, kvno=None): >+ e = etype_info2['etype'] >+ salt = None >+ try: >+ salt = etype_info2['salt'] >+ except: >+ pass >+ >+ if e == kcrypto.Enctype.RC4: >+ self.assertIsNone(salt) >+ nthash = creds.get_nt_hash() >+ return self.SessionKey_create(etype=e, contents=nthash, kvno=kvno) >+ >+ password = creds.get_password() >+ return self.PasswordKey_create(etype=e, pwd=password, salt=salt, kvno=kvno) >+ >+ def RandomKey(self, etype): >+ e = kcrypto._get_enctype_profile(etype) >+ contents = samba.generate_random_bytes(e.keysize) >+ return self.SessionKey_create(etype=etype, contents=contents) >+ >+ def EncryptionKey_import(self, EncryptionKey_obj): >+ return self.SessionKey_create(EncryptionKey_obj['keytype'], >+ EncryptionKey_obj['keyvalue']) >+ >+ def EncryptedData_create(self, key, usage, plaintext): >+ # EncryptedData ::= SEQUENCE { >+ # etype [0] Int32 -- EncryptionType --, >+ # kvno [1] UInt32 OPTIONAL, >+ # cipher [2] OCTET STRING -- ciphertext >+ # } >+ ciphertext = key.encrypt(usage, plaintext) >+ EncryptedData_obj = { >+ 'etype': key.etype, >+ 'cipher': ciphertext >+ } >+ if key.kvno is not None: >+ EncryptedData_obj['kvno'] = key.kvno >+ return EncryptedData_obj >+ >+ def Checksum_create(self, key, usage, plaintext, ctype=None): >+ #Checksum ::= SEQUENCE { >+ # cksumtype [0] Int32, >+ # checksum [1] OCTET STRING >+ #} >+ if ctype is None: >+ ctype = key.ctype >+ checksum = key.make_checksum(usage, plaintext, ctype=ctype) >+ Checksum_obj = { >+ 'cksumtype': ctype, >+ 'checksum': checksum, >+ } >+ return Checksum_obj >+ >+ def PrincipalName_create(self, name_type, names): >+ # PrincipalName ::= SEQUENCE { >+ # name-type [0] Int32, >+ # name-string [1] SEQUENCE OF KerberosString >+ # } >+ PrincipalName_obj = { >+ 'name-type': name_type, >+ 'name-string': names, >+ } >+ return PrincipalName_obj >+ >+ def PA_DATA_create(self, padata_type, padata_value): >+ # PA-DATA ::= SEQUENCE { >+ # -- NOTE: first tag is [1], not [0] >+ # padata-type [1] Int32, >+ # padata-value [2] OCTET STRING -- might be encoded AP-REQ >+ # } >+ PA_DATA_obj = { >+ 'padata-type': padata_type, >+ 'padata-value': padata_value, >+ } >+ return PA_DATA_obj >+ >+ def PA_ENC_TS_ENC_create(self, ts, usec): >+ #PA-ENC-TS-ENC ::= SEQUENCE { >+ # patimestamp[0] KerberosTime, -- client's time >+ # pausec[1] krb5int32 OPTIONAL >+ #} >+ PA_ENC_TS_ENC_obj = { >+ 'patimestamp': ts, >+ 'pausec': usec, >+ } >+ return PA_ENC_TS_ENC_obj >+ >+ def KDC_REQ_BODY_create(self, >+ kdc_options, >+ cname, >+ realm, >+ sname, >+ from_time, >+ till_time, >+ renew_time, >+ nonce, >+ etypes, >+ addresses, >+ EncAuthorizationData, >+ EncAuthorizationData_key, >+ additional_tickets, >+ asn1_print=None, >+ hexdump=None): >+ #KDC-REQ-BODY ::= SEQUENCE { >+ # kdc-options [0] KDCOptions, >+ # cname [1] PrincipalName OPTIONAL >+ # -- Used only in AS-REQ --, >+ # realm [2] Realm >+ # -- Server's realm >+ # -- Also client's in AS-REQ --, >+ # sname [3] PrincipalName OPTIONAL, >+ # from [4] KerberosTime OPTIONAL, >+ # till [5] KerberosTime, >+ # rtime [6] KerberosTime OPTIONAL, >+ # nonce [7] UInt32, >+ # etype [8] SEQUENCE OF Int32 -- EncryptionType >+ # -- in preference order --, >+ # addresses [9] HostAddresses OPTIONAL, >+ # enc-authorization-data [10] EncryptedData OPTIONAL >+ # -- AuthorizationData --, >+ # additional-tickets [11] SEQUENCE OF Ticket OPTIONAL >+ # -- NOTE: not empty >+ #} >+ if EncAuthorizationData is not None: >+ enc_ad_plain = self.der_encode(EncAuthorizationData, >+ asn1Spec=krb5_asn1.AuthorizationData(), >+ asn1_print=asn1_print, >+ hexdump=hexdump) >+ enc_ad = self.EncryptedData_create(EncAuthorizationData_key, enc_ad_plain) >+ else: >+ enc_ad = None >+ KDC_REQ_BODY_obj = { >+ 'kdc-options': kdc_options, >+ 'realm': realm, >+ 'till': till_time, >+ 'nonce': nonce, >+ 'etype': etypes, >+ } >+ if cname is not None: >+ KDC_REQ_BODY_obj['cname'] = cname >+ if sname is not None: >+ KDC_REQ_BODY_obj['sname'] = sname >+ if from_time is not None: >+ KDC_REQ_BODY_obj['from'] = from_time >+ if renew_time is not None: >+ KDC_REQ_BODY_obj['rtime'] = renew_time >+ if addresses is not None: >+ KDC_REQ_BODY_obj['addresses'] = addresses >+ if enc_ad is not None: >+ KDC_REQ_BODY_obj['enc-authorization-data'] = enc_ad >+ if additional_tickets is not None: >+ KDC_REQ_BODY_obj['additional-tickets'] = additional_tickets >+ return KDC_REQ_BODY_obj >+ >+ def KDC_REQ_create(self, >+ msg_type, >+ padata, >+ kdc_options, >+ cname, >+ realm, >+ sname, >+ from_time, >+ till_time, >+ renew_time, >+ nonce, >+ etypes, >+ addresses, >+ EncAuthorizationData, >+ EncAuthorizationData_key, >+ additional_tickets, >+ asn1Spec=None, >+ asn1_print=None, >+ hexdump=None): >+ #KDC-REQ ::= SEQUENCE { >+ # -- NOTE: first tag is [1], not [0] >+ # pvno [1] INTEGER (5) , >+ # msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), >+ # padata [3] SEQUENCE OF PA-DATA OPTIONAL >+ # -- NOTE: not empty --, >+ # req-body [4] KDC-REQ-BODY >+ #} >+ # >+ KDC_REQ_BODY_obj = self.KDC_REQ_BODY_create(kdc_options, >+ cname, >+ realm, >+ sname, >+ from_time, >+ till_time, >+ renew_time, >+ nonce, >+ etypes, >+ addresses, >+ EncAuthorizationData, >+ EncAuthorizationData_key, >+ additional_tickets, >+ asn1_print=asn1_print, >+ hexdump=hexdump) >+ KDC_REQ_obj = { >+ 'pvno': 5, >+ 'msg-type': msg_type, >+ 'req-body': KDC_REQ_BODY_obj, >+ } >+ if padata is not None: >+ KDC_REQ_obj['padata'] = padata >+ if asn1Spec is not None: >+ KDC_REQ_decoded = pyasn1_native_decode(KDC_REQ_obj, asn1Spec=asn1Spec) >+ else: >+ KDC_REQ_decoded = None >+ return KDC_REQ_obj, KDC_REQ_decoded >+ >+ def AS_REQ_create(self, >+ padata, # optional >+ kdc_options, # required >+ cname, # optional >+ realm, # required >+ sname, # optional >+ from_time, # optional >+ till_time, # required >+ renew_time, # optional >+ nonce, # required >+ etypes, # required >+ addresses, # optional >+ EncAuthorizationData, >+ EncAuthorizationData_key, >+ additional_tickets, >+ native_decoded_only=True, >+ asn1_print=None, >+ hexdump=None): >+ #KDC-REQ ::= SEQUENCE { >+ # -- NOTE: first tag is [1], not [0] >+ # pvno [1] INTEGER (5) , >+ # msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), >+ # padata [3] SEQUENCE OF PA-DATA OPTIONAL >+ # -- NOTE: not empty --, >+ # req-body [4] KDC-REQ-BODY >+ #} >+ # >+ #KDC-REQ-BODY ::= SEQUENCE { >+ # kdc-options [0] KDCOptions, >+ # cname [1] PrincipalName OPTIONAL >+ # -- Used only in AS-REQ --, >+ # realm [2] Realm >+ # -- Server's realm >+ # -- Also client's in AS-REQ --, >+ # sname [3] PrincipalName OPTIONAL, >+ # from [4] KerberosTime OPTIONAL, >+ # till [5] KerberosTime, >+ # rtime [6] KerberosTime OPTIONAL, >+ # nonce [7] UInt32, >+ # etype [8] SEQUENCE OF Int32 -- EncryptionType >+ # -- in preference order --, >+ # addresses [9] HostAddresses OPTIONAL, >+ # enc-authorization-data [10] EncryptedData OPTIONAL >+ # -- AuthorizationData --, >+ # additional-tickets [11] SEQUENCE OF Ticket OPTIONAL >+ # -- NOTE: not empty >+ #} >+ obj,decoded = self.KDC_REQ_create(msg_type=10, >+ padata=padata, >+ kdc_options=kdc_options, >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=from_time, >+ till_time=till_time, >+ renew_time=renew_time, >+ nonce=nonce, >+ etypes=etypes, >+ addresses=addresses, >+ EncAuthorizationData=EncAuthorizationData, >+ EncAuthorizationData_key=EncAuthorizationData_key, >+ additional_tickets=additional_tickets, >+ asn1Spec=krb5_asn1.AS_REQ(), >+ asn1_print=asn1_print, >+ hexdump=hexdump) >+ if native_decoded_only: >+ return decoded >+ return decoded, obj >+ >+ def AP_REQ_create(self, ap_options, ticket, authenticator): >+ # AP-REQ ::= [APPLICATION 14] SEQUENCE { >+ # pvno [0] INTEGER (5), >+ # msg-type [1] INTEGER (14), >+ # ap-options [2] APOptions, >+ # ticket [3] Ticket, >+ # authenticator [4] EncryptedData -- Authenticator >+ #} >+ AP_REQ_obj = { >+ 'pvno': 5, >+ 'msg-type': 14, >+ 'ap-options': ap_options, >+ 'ticket': ticket, >+ 'authenticator': authenticator, >+ } >+ return AP_REQ_obj >+ >+ def Authenticator_create(self, crealm, cname, cksum, cusec, ctime, subkey, seq_number, >+ authorization_data): >+ # -- Unencrypted authenticator >+ # Authenticator ::= [APPLICATION 2] SEQUENCE { >+ # authenticator-vno [0] INTEGER (5), >+ # crealm [1] Realm, >+ # cname [2] PrincipalName, >+ # cksum [3] Checksum OPTIONAL, >+ # cusec [4] Microseconds, >+ # ctime [5] KerberosTime, >+ # subkey [6] EncryptionKey OPTIONAL, >+ # seq-number [7] UInt32 OPTIONAL, >+ # authorization-data [8] AuthorizationData OPTIONAL >+ #} >+ Authenticator_obj = { >+ 'authenticator-vno': 5, >+ 'crealm': crealm, >+ 'cname': cname, >+ 'cusec': cusec, >+ 'ctime': ctime, >+ } >+ if cksum is not None: >+ Authenticator_obj['cksum'] = cksum >+ if subkey is not None: >+ Authenticator_obj['subkey'] = subkey >+ if seq_number is not None: >+ Authenticator_obj['seq-number'] = seq_number >+ if authorization_data is not None: >+ Authenticator_obj['authorization-data'] = authorization_data >+ return Authenticator_obj >+ >+ def TGS_REQ_create(self, >+ padata, # optional >+ cusec, >+ ctime, >+ ticket, >+ kdc_options, # required >+ cname, # optional >+ realm, # required >+ sname, # optional >+ from_time, # optional >+ till_time, # required >+ renew_time, # optional >+ nonce, # required >+ etypes, # required >+ addresses, # optional >+ EncAuthorizationData, >+ EncAuthorizationData_key, >+ additional_tickets, >+ ticket_session_key, >+ authenticator_subkey=None, >+ body_checksum_type=None, >+ native_decoded_only=True, >+ asn1_print=None, >+ hexdump=None): >+ #KDC-REQ ::= SEQUENCE { >+ # -- NOTE: first tag is [1], not [0] >+ # pvno [1] INTEGER (5) , >+ # msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), >+ # padata [3] SEQUENCE OF PA-DATA OPTIONAL >+ # -- NOTE: not empty --, >+ # req-body [4] KDC-REQ-BODY >+ #} >+ # >+ #KDC-REQ-BODY ::= SEQUENCE { >+ # kdc-options [0] KDCOptions, >+ # cname [1] PrincipalName OPTIONAL >+ # -- Used only in AS-REQ --, >+ # realm [2] Realm >+ # -- Server's realm >+ # -- Also client's in AS-REQ --, >+ # sname [3] PrincipalName OPTIONAL, >+ # from [4] KerberosTime OPTIONAL, >+ # till [5] KerberosTime, >+ # rtime [6] KerberosTime OPTIONAL, >+ # nonce [7] UInt32, >+ # etype [8] SEQUENCE OF Int32 -- EncryptionType >+ # -- in preference order --, >+ # addresses [9] HostAddresses OPTIONAL, >+ # enc-authorization-data [10] EncryptedData OPTIONAL >+ # -- AuthorizationData --, >+ # additional-tickets [11] SEQUENCE OF Ticket OPTIONAL >+ # -- NOTE: not empty >+ #} >+ >+ req_body = self.KDC_REQ_BODY_create(kdc_options=kdc_options, >+ cname=None, >+ realm=realm, >+ sname=sname, >+ from_time=from_time, >+ till_time=till_time, >+ renew_time=renew_time, >+ nonce=nonce, >+ etypes=etypes, >+ addresses=addresses, >+ EncAuthorizationData=EncAuthorizationData, >+ EncAuthorizationData_key=EncAuthorizationData_key, >+ additional_tickets=additional_tickets) >+ req_body = self.der_encode(req_body, asn1Spec=krb5_asn1.KDC_REQ_BODY(), >+ asn1_print=asn1_print, hexdump=hexdump) >+ >+ req_body_checksum = self.Checksum_create(ticket_session_key, 6, req_body, >+ ctype=body_checksum_type) >+ >+ subkey_obj = None >+ if authenticator_subkey is not None: >+ subkey_obj = authenticator_subkey.export_obj() >+ seq_number = random.randint(0, 0xfffffffe) >+ authenticator = self.Authenticator_create(crealm=realm, >+ cname=cname, >+ cksum=req_body_checksum, >+ cusec=cusec, >+ ctime=ctime, >+ subkey=subkey_obj, >+ seq_number=seq_number, >+ authorization_data=None) >+ authenticator = self.der_encode(authenticator, asn1Spec=krb5_asn1.Authenticator(), >+ asn1_print=asn1_print, hexdump=hexdump) >+ >+ authenticator = self.EncryptedData_create(ticket_session_key, 7, authenticator) >+ >+ ap_options = krb5_asn1.APOptions('0') >+ ap_req = self.AP_REQ_create(ap_options=str(ap_options), >+ ticket=ticket, >+ authenticator=authenticator) >+ ap_req = self.der_encode(ap_req, asn1Spec=krb5_asn1.AP_REQ(), >+ asn1_print=asn1_print, hexdump=hexdump) >+ pa_tgs_req = self.PA_DATA_create(1, ap_req) >+ if padata is not None: >+ padata.append(pa_tgs_req) >+ else: >+ padata = [pa_tgs_req] >+ >+ obj,decoded = self.KDC_REQ_create(msg_type=12, >+ padata=padata, >+ kdc_options=kdc_options, >+ cname=None, >+ realm=realm, >+ sname=sname, >+ from_time=from_time, >+ till_time=till_time, >+ renew_time=renew_time, >+ nonce=nonce, >+ etypes=etypes, >+ addresses=addresses, >+ EncAuthorizationData=EncAuthorizationData, >+ EncAuthorizationData_key=EncAuthorizationData_key, >+ additional_tickets=additional_tickets, >+ asn1Spec=krb5_asn1.TGS_REQ(), >+ asn1_print=asn1_print, >+ hexdump=hexdump) >+ if native_decoded_only: >+ return decoded >+ return decoded, obj >-- >2.25.1 > > >From 5278f81a1563fbe44b9da4657717afc51b9f1bcc Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Thu, 13 Feb 2020 16:29:38 +0100 >Subject: [PATCH 021/380] python/tests/krb5: add simple_tests.py with the first > simple test > >This just demonstrates that the infrastructure works:-) > >I'm running this as: > > SERVER=172.31.9.188 DOMAIN=W2012R2-L6 REALM=W2012R2-L6.BASE \ > USERNAME=administrator PASSWORD=A1b2C3d4 SERVICE_USERNAME="w2012r2-188" \ > python/samba/tests/krb5/simple_tests.py > >Pair-Programmed-With: Isaac Boukris <iboukris@samba.org> > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >(cherry picked from commit 4f6d26609a66a42df671a540677af15e67efc0df) >--- > python/samba/tests/krb5/simple_tests.py | 171 ++++++++++++++++++++++++ > python/samba/tests/usage.py | 1 + > 2 files changed, 172 insertions(+) > create mode 100755 python/samba/tests/krb5/simple_tests.py > >diff --git a/python/samba/tests/krb5/simple_tests.py b/python/samba/tests/krb5/simple_tests.py >new file mode 100755 >index 00000000000..c9998c4d2db >--- /dev/null >+++ b/python/samba/tests/krb5/simple_tests.py >@@ -0,0 +1,171 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+from samba.tests.krb5.raw_testcase import RawKerberosTest >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+ >+global_asn1_print = False >+global_hexdump = False >+ >+class SimpleKerberosTests(RawKerberosTest): >+ >+ def setUp(self): >+ super(SimpleKerberosTests, self).setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ def test_simple(self): >+ user_creds = self.get_user_creds() >+ user = user_creds.get_username() >+ realm = user_creds.get_realm() >+ >+ cname = self.PrincipalName_create(name_type=1, names=[user]) >+ sname = self.PrincipalName_create(name_type=2, names=["krbtgt", realm]) >+ >+ till = self.get_KerberosTime(offset=36000) >+ >+ kdc_options = krb5_asn1.KDCOptions('forwardable') >+ padata = None >+ >+ etypes=(18,17,23) >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ self.assertEqual(rep['msg-type'], 30) >+ self.assertEqual(rep['error-code'], 25) >+ rep_padata = self.der_decode(rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) >+ >+ for pa in rep_padata: >+ if pa['padata-type'] == 19: >+ etype_info2 = pa['padata-value'] >+ break >+ >+ etype_info2 = self.der_decode(etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ >+ key = self.PasswordKey_from_etype_info2(user_creds, etype_info2[0]) >+ >+ (patime, pausec) = self.get_KerberosTimeWithUsec() >+ pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) >+ >+ enc_pa_ts_usage = 1 >+ pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) >+ >+ pa_ts = self.PA_DATA_create(2, pa_ts) >+ >+ kdc_options = krb5_asn1.KDCOptions('forwardable') >+ padata = [pa_ts] >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ msg_type = rep['msg-type'] >+ self.assertEqual(msg_type, 11) >+ >+ usage = 3 >+ enc_part2 = key.decrypt(usage, rep['enc-part']['cipher']) >+ enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) >+ >+ # TGS Request >+ service_creds = self.get_service_creds(allow_missing_password=True) >+ service_name = service_creds.get_username() >+ >+ sname = self.PrincipalName_create(name_type=2, names=["host", service_name]) >+ kdc_options = krb5_asn1.KDCOptions('forwardable') >+ till = self.get_KerberosTime(offset=36000) >+ ticket = rep['ticket'] >+ ticket_session_key = self.EncryptionKey_import(enc_part2['key']) >+ padata = [] >+ >+ subkey = self.RandomKey(ticket_session_key.etype) >+ subkey_usage = 9 >+ >+ (ctime, cusec) = self.get_KerberosTimeWithUsec() >+ >+ req = self.TGS_REQ_create(padata=padata, >+ cusec=cusec, >+ ctime=ctime, >+ ticket=ticket, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7ffffffe, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None, >+ ticket_session_key=ticket_session_key, >+ authenticator_subkey=subkey) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ msg_type = rep['msg-type'] >+ self.assertEqual(msg_type, 13) >+ >+ enc_part2 = subkey.decrypt(subkey_usage, rep['enc-part']['cipher']) >+ enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ >+ return >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 06fdc9afacb..18e9fad232f 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -86,6 +86,7 @@ EXCLUDE_USAGE = { > 'bin/python/samba/subunit/run.py', > 'python/samba/tests/dcerpc/raw_protocol.py', > 'python/samba/tests/krb5/kcrypto.py', >+ 'python/samba/tests/krb5/simple_tests.py', > } > > EXCLUDE_HELP = { >-- >2.25.1 > > >From 410f981c611ffdd3a0f661208736120a9d86723c Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Thu, 13 Feb 2020 16:29:38 +0100 >Subject: [PATCH 022/380] s4:selftest: run samba.tests.krb5.simple_tests > against ad_dc_default > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> > >Autobuild-User(master): Stefan Metzmacher <metze@samba.org> >Autobuild-Date(master): Fri Mar 27 19:54:25 UTC 2020 on sn-devel-184 > >(cherry picked from commit c4ccdf4b30de1b1e63d3fd99d33b924b816a5d37) >--- > source4/selftest/tests.py | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 9194c9b04f7..693209f2d1e 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -743,6 +743,8 @@ planoldpythontestsuite("ad_dc:local", "samba.tests.gpo", extra_args=['-U"$USERNA > planoldpythontestsuite("ad_dc:local", "samba.tests.dckeytab", extra_args=['-U"$USERNAME%$PASSWORD"']) > > planoldpythontestsuite("none", "samba.tests.krb5.kcrypto") >+planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.simple_tests", >+ environ={'SERVICE_USERNAME':'$SERVER'}) > > for env in ["ad_dc", smbv1_disabled_testenv]: > planoldpythontestsuite(env, "samba.tests.smb", extra_args=['-U"$USERNAME%$PASSWORD"']) >-- >2.25.1 > > >From 6fe467d921213dbc3cd51dd0712197472beb06ea Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Thu, 7 May 2020 17:16:53 +0200 >Subject: [PATCH 023/380] Revert "selftest: allow any kdc error in > mitm-s4u2self test" > >This reverts commit a53fa8ffe3e36f7921baf5d31a1052747f90aa7d. > >This allows a clean revert (and so removal) of the test. > >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit ce65e8979dda9774b170db7a9fa7ba458af4cee9) >--- > source4/torture/krb5/kdc-canon-heimdal.c | 14 ++++++++------ > 1 file changed, 8 insertions(+), 6 deletions(-) > >diff --git a/source4/torture/krb5/kdc-canon-heimdal.c b/source4/torture/krb5/kdc-canon-heimdal.c >index 700e1c2b37e..8dc3e24a8d5 100644 >--- a/source4/torture/krb5/kdc-canon-heimdal.c >+++ b/source4/torture/krb5/kdc-canon-heimdal.c >@@ -737,12 +737,13 @@ static bool torture_krb5_post_recv_tgs_req_canon_test(struct torture_krb5_contex > error.pvno, 5, > "Got wrong error.pvno"); > expected_error = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN - KRB5KDC_ERR_NONE; >- if (!test_context->test_data->mitm_s4u2self) { >- torture_assert_int_equal(test_context->tctx, >- error.error_code, >- expected_error, >- "Got wrong error.error_code"); >+ if (error.error_code != expected_error && test_context->test_data->mitm_s4u2self) { >+ expected_error = KRB5KRB_AP_ERR_INAPP_CKSUM - KRB5KDC_ERR_NONE; > } >+ torture_assert_int_equal(test_context->tctx, >+ error.error_code, >+ expected_error, >+ "Got wrong error.error_code"); > } else { > torture_assert_int_equal(test_context->tctx, > decode_TGS_REP(recv_buf->data, recv_buf->length, >@@ -2089,7 +2090,8 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void * > || test_data->upn == false)) { > > if (test_data->mitm_s4u2self) { >- torture_assert_int_not_equal(tctx, k5ret, 0, assertion_message); >+ torture_assert_int_equal(tctx, k5ret, KRB5KRB_AP_ERR_INAPP_CKSUM, >+ assertion_message); > /* Done testing mitm-s4u2self */ > return true; > } >-- >2.25.1 > > >From 7620840700f6c4810821e821c645542da9279ace Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Thu, 7 May 2020 17:17:00 +0200 >Subject: [PATCH 024/380] Revert "selftest: mitm-s4u2self: use zlib for > CRC32_checksum calc" > >This reverts commit 151f8c0f31d3d17b9418db3793ec14ba7dbf2143. > >This allows a clean revert (and so removal) of the test. > >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit b5adc112771f22c2d7c4319063c3e89074c4f4ab) >--- > source4/torture/krb5/kdc-canon-heimdal.c | 19 ++++++------------- > 1 file changed, 6 insertions(+), 13 deletions(-) > >diff --git a/source4/torture/krb5/kdc-canon-heimdal.c b/source4/torture/krb5/kdc-canon-heimdal.c >index 8dc3e24a8d5..dffebd74038 100644 >--- a/source4/torture/krb5/kdc-canon-heimdal.c >+++ b/source4/torture/krb5/kdc-canon-heimdal.c >@@ -33,7 +33,6 @@ > #include "auth/auth_sam_reply.h" > #include "auth/gensec/gensec.h" > #include "param/param.h" >-#include "zlib.h" > > #define TEST_CANONICALIZE 0x0000001 > #define TEST_ENTERPRISE 0x0000002 >@@ -215,17 +214,6 @@ static bool test_accept_ticket(struct torture_context *tctx, > return true; > } > >-static void >-zCRC32_checksum(const void *data, >- size_t len, >- Checksum *C) >-{ >- uint32_t *crc = C->checksum.data; >- *crc = ~(crc32(0xffffffff, data, len)); >- C->checksum.length = 4; >- C->cksumtype = 1; >-} >- > krb5_error_code > _krb5_s4u2self_to_checksumdata(krb5_context context, > const PA_S4U2Self *self, >@@ -264,7 +252,11 @@ static bool change_for_user_principal(struct torture_krb5_context *test_context, > torture_assert_int_equal(test_context->tctx, > _krb5_s4u2self_to_checksumdata(k5_ctx, &mod_self, &cksum_data), > 0, "_krb5_s4u2self_to_checksumdata() failed"); >- zCRC32_checksum(cksum_data.data, cksum_data.length, &mod_self.cksum); >+ torture_assert_int_equal(test_context->tctx, >+ krb5_create_checksum(k5_ctx, NULL, KRB5_KU_OTHER_CKSUM, >+ CKSUMTYPE_CRC32, cksum_data.data, >+ cksum_data.length, &mod_self.cksum), >+ 0, "krb5_create_checksum() failed"); > > ASN1_MALLOC_ENCODE(PA_S4U2Self, for_user->padata_value.data, for_user->padata_value.length, > &mod_self, &used, ret); >@@ -278,6 +270,7 @@ static bool change_for_user_principal(struct torture_krb5_context *test_context, > > free_PA_S4U2Self(&self); > krb5_data_free(&cksum_data); >+ free_Checksum(&mod_self.cksum); > > return true; > } >-- >2.25.1 > > >From 22b18f728ca3e03b27c6324f0d4004a4afafddeb Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Thu, 7 May 2020 17:17:12 +0200 >Subject: [PATCH 025/380] Revert "CVE-2018-16860 selftest: Add test for > S4U2Self with unkeyed checksum" > >This reverts commit 5639e973c1f6f1b28b122741763f1d05b47bc2d8. > >This is no longer needed as the next commit includes a Python >test for this, without the complexity of being inside krb5.kdc.canon. > >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 19875a37318a7cd5585572616cf12a775591193f) >--- > source4/torture/krb5/kdc-canon-heimdal.c | 105 +---------------------- > 1 file changed, 4 insertions(+), 101 deletions(-) > >diff --git a/source4/torture/krb5/kdc-canon-heimdal.c b/source4/torture/krb5/kdc-canon-heimdal.c >index dffebd74038..9e0808b134c 100644 >--- a/source4/torture/krb5/kdc-canon-heimdal.c >+++ b/source4/torture/krb5/kdc-canon-heimdal.c >@@ -44,8 +44,7 @@ > #define TEST_S4U2SELF 0x0000080 > #define TEST_REMOVEDOLLAR 0x0000100 > #define TEST_AS_REQ_SPN 0x0000200 >-#define TEST_MITM_S4U2SELF 0x0000400 >-#define TEST_ALL 0x00007FF >+#define TEST_ALL 0x00003FF > > struct test_data { > const char *test_name; >@@ -63,7 +62,6 @@ struct test_data { > bool upn; > bool other_upn_suffix; > bool s4u2self; >- bool mitm_s4u2self; > bool removedollar; > bool as_req_spn; > bool spn_is_upn; >@@ -214,67 +212,6 @@ static bool test_accept_ticket(struct torture_context *tctx, > return true; > } > >-krb5_error_code >-_krb5_s4u2self_to_checksumdata(krb5_context context, >- const PA_S4U2Self *self, >- krb5_data *data); >- >-/* Helper function to modify the principal in PA_FOR_USER padata */ >-static bool change_for_user_principal(struct torture_krb5_context *test_context, >- krb5_data *modified_send_buf) >-{ >- PA_DATA *for_user; >- int i = 0; >- size_t used; >- krb5_error_code ret; >- PA_S4U2Self self, mod_self; >- krb5_data cksum_data; >- krb5_principal admin; >- heim_octet_string orig_padata_value; >- krb5_context k5_ctx = test_context->smb_krb5_context->krb5_context; >- >- for_user = krb5_find_padata(test_context->tgs_req.padata->val, >- test_context->tgs_req.padata->len, KRB5_PADATA_FOR_USER, &i); >- torture_assert(test_context->tctx, for_user != NULL, "No PA_FOR_USER in s4u2self request"); >- orig_padata_value = for_user->padata_value; >- >- torture_assert_int_equal(test_context->tctx, >- krb5_make_principal(k5_ctx, &admin, test_context->test_data->realm, >- "Administrator", NULL), >- 0, "krb5_make_principal() failed"); >- torture_assert_int_equal(test_context->tctx, >- decode_PA_S4U2Self(for_user->padata_value.data, >- for_user->padata_value.length, &self, NULL), >- 0, "decode_PA_S4U2Self() failed"); >- mod_self = self; >- mod_self.name = admin->name; >- >- torture_assert_int_equal(test_context->tctx, >- _krb5_s4u2self_to_checksumdata(k5_ctx, &mod_self, &cksum_data), >- 0, "_krb5_s4u2self_to_checksumdata() failed"); >- torture_assert_int_equal(test_context->tctx, >- krb5_create_checksum(k5_ctx, NULL, KRB5_KU_OTHER_CKSUM, >- CKSUMTYPE_CRC32, cksum_data.data, >- cksum_data.length, &mod_self.cksum), >- 0, "krb5_create_checksum() failed"); >- >- ASN1_MALLOC_ENCODE(PA_S4U2Self, for_user->padata_value.data, for_user->padata_value.length, >- &mod_self, &used, ret); >- torture_assert(test_context->tctx, ret == 0, "Failed to encode PA_S4U2Self ASN1 struct"); >- ASN1_MALLOC_ENCODE(TGS_REQ, modified_send_buf->data, modified_send_buf->length, >- &test_context->tgs_req, &used, ret); >- torture_assert(test_context->tctx, ret == 0, "Failed to encode TGS_REQ ASN1 struct"); >- >- free(for_user->padata_value.data); >- for_user->padata_value = orig_padata_value; >- >- free_PA_S4U2Self(&self); >- krb5_data_free(&cksum_data); >- free_Checksum(&mod_self.cksum); >- >- return true; >-} >- > /* > * TEST_AS_REQ and TEST_AS_REQ_SELF - SEND > * >@@ -694,12 +631,7 @@ static bool torture_krb5_pre_send_tgs_req_canon_test(struct torture_krb5_context > > } > >- if (test_context->test_data->mitm_s4u2self) { >- torture_assert(test_context->tctx, change_for_user_principal(test_context, modified_send_buf), >- "Failed to modify PA_FOR_USER principal name"); >- } else { >- *modified_send_buf = *send_buf; >- } >+ *modified_send_buf = *send_buf; > > return true; > } >@@ -718,7 +650,6 @@ static bool torture_krb5_post_recv_tgs_req_canon_test(struct torture_krb5_contex > { > KRB_ERROR error; > size_t used; >- krb5_error_code expected_error; > > /* > * If this account did not have a servicePrincipalName, then >@@ -729,13 +660,9 @@ static bool torture_krb5_post_recv_tgs_req_canon_test(struct torture_krb5_contex > torture_assert_int_equal(test_context->tctx, > error.pvno, 5, > "Got wrong error.pvno"); >- expected_error = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN - KRB5KDC_ERR_NONE; >- if (error.error_code != expected_error && test_context->test_data->mitm_s4u2self) { >- expected_error = KRB5KRB_AP_ERR_INAPP_CKSUM - KRB5KDC_ERR_NONE; >- } > torture_assert_int_equal(test_context->tctx, > error.error_code, >- expected_error, >+ KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN - KRB5KDC_ERR_NONE, > "Got wrong error.error_code"); > } else { > torture_assert_int_equal(test_context->tctx, >@@ -778,8 +705,6 @@ static bool torture_krb5_post_recv_tgs_req_canon_test(struct torture_krb5_contex > torture_assert_int_equal(test_context->tctx, > *test_context->tgs_rep.ticket.enc_part.kvno & 0xFFFF0000, > 0, "Unexpecedly got a RODC number in the KVNO, should just be principal KVNO"); >- torture_assert(test_context->tctx, test_context->test_data->mitm_s4u2self == false, >- "KDC accepted PA_S4U2Self with unkeyed checksum!"); > free_TGS_REP(&test_context->tgs_rep); > } > torture_assert(test_context->tctx, test_context->packet_count == 0, "too many packets"); >@@ -2081,23 +2006,7 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void * > && (test_data->enterprise > || test_data->spn_is_upn > || test_data->upn == false)) { >- >- if (test_data->mitm_s4u2self) { >- torture_assert_int_equal(tctx, k5ret, KRB5KRB_AP_ERR_INAPP_CKSUM, >- assertion_message); >- /* Done testing mitm-s4u2self */ >- return true; >- } >- > torture_assert_int_equal(tctx, k5ret, 0, assertion_message); >- >- /* Check that the impersonate principal is not being canonicalized by the KDC. */ >- if (test_data->s4u2self) { >- torture_assert(tctx, krb5_principal_compare(k5_context, server_creds->client, >- principal), >- "TGS-REP cname does not match requested client principal"); >- } >- > torture_assert_int_equal(tctx, krb5_cc_store_cred(k5_context, > ccache, server_creds), > 0, "krb5_cc_store_cred failed"); >@@ -2571,7 +2480,7 @@ struct torture_suite *torture_krb5_canon(TALLOC_CTX *mem_ctx) > (i & TEST_UPN) ? "upn" : > ((i & TEST_AS_REQ_SPN) ? "spn" : > ((i & TEST_REMOVEDOLLAR) ? "removedollar" : "samaccountname")), >- (i & TEST_S4U2SELF) ? (i & TEST_MITM_S4U2SELF) ? "mitm-s4u2self" : "s4u2self" : "normal"); >+ (i & TEST_S4U2SELF) ? "s4u2self" : "normal"); > struct torture_suite *sub_suite = torture_suite_create(mem_ctx, name); > > struct test_data *test_data = talloc_zero(suite, struct test_data); >@@ -2585,11 +2494,6 @@ struct torture_suite *torture_krb5_canon(TALLOC_CTX *mem_ctx) > continue; > } > } >- if (i & TEST_MITM_S4U2SELF) { >- if (!(i & TEST_S4U2SELF)) { >- continue; >- } >- } > > test_data->test_name = name; > test_data->real_realm >@@ -2610,7 +2514,6 @@ struct torture_suite *torture_krb5_canon(TALLOC_CTX *mem_ctx) > test_data->win2k = (i & TEST_WIN2K) != 0; > test_data->upn = (i & TEST_UPN) != 0; > test_data->s4u2self = (i & TEST_S4U2SELF) != 0; >- test_data->mitm_s4u2self = (i & TEST_MITM_S4U2SELF) != 0; > test_data->removedollar = (i & TEST_REMOVEDOLLAR) != 0; > test_data->as_req_spn = (i & TEST_AS_REQ_SPN) != 0; > torture_suite_add_simple_tcase_const(sub_suite, name, torture_krb5_as_req_canon, >-- >2.25.1 > > >From 2e6b6ccb8e2b47e883c924738d05559622d4476f Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Mon, 4 May 2020 18:09:53 +0200 >Subject: [PATCH 026/380] selftest: add python S4U2Self tests including unkeyed > checksums > >To test the CRC32 I reverted the unkeyed-checksum fix (43958af1) >and the weak-crypto fix (389d1b97). Note that the unkeyed-md5 >still worked even with weak-crypto disabled, and that the >unkeyed-sha1 never worked but I left it anyway. > >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Fri May 15 12:25:40 UTC 2020 on sn-devel-184 > >(cherry picked from commit 8b5e7644130146bcc4e5a0dd05da6458a6025dd8) >--- > python/samba/tests/krb5/kcrypto.py | 85 ++++++++++ > python/samba/tests/krb5/raw_testcase.py | 23 +++ > python/samba/tests/krb5/rfc4120.asn1 | 8 + > python/samba/tests/krb5/rfc4120_pyasn1.py | 14 +- > python/samba/tests/krb5/s4u_tests.py | 197 ++++++++++++++++++++++ > python/samba/tests/usage.py | 1 + > selftest/knownfail | 2 + > selftest/skip_mit_kdc | 1 + > selftest/target/Samba4.pm | 23 +++ > source4/selftest/tests.py | 4 + > 10 files changed, 357 insertions(+), 1 deletion(-) > create mode 100755 python/samba/tests/krb5/s4u_tests.py > >diff --git a/python/samba/tests/krb5/kcrypto.py b/python/samba/tests/krb5/kcrypto.py >index ed3c84fa186..2572fa5bab3 100755 >--- a/python/samba/tests/krb5/kcrypto.py >+++ b/python/samba/tests/krb5/kcrypto.py >@@ -51,6 +51,7 @@ os.environ["PYTHONUNBUFFERED"] = "1" > from math import gcd > from functools import reduce > from struct import pack, unpack >+from binascii import crc32 > from cryptography.hazmat.primitives import hashes > from cryptography.hazmat.primitives import hmac > from cryptography.hazmat.primitives.ciphers import algorithms as ciphers >@@ -533,6 +534,21 @@ class _MD5(_ChecksumProfile): > return SIMPLE_HASH(text, hashes.MD5) > > >+class _SHA1(_ChecksumProfile): >+ @classmethod >+ def checksum(cls, key, keyusage, text): >+ # This is unkeyed! >+ return SIMPLE_HASH(text, hashes.SHA1) >+ >+ >+class _CRC32(_ChecksumProfile): >+ @classmethod >+ def checksum(cls, key, keyusage, text): >+ # This is unkeyed! >+ cksum = (~crc32(text, 0xffffffff)) & 0xffffffff >+ return pack('<I', cksum) >+ >+ > _enctype_table = { > Enctype.DES3: _DES3CBC, > Enctype.AES128: _AES128CTS, >@@ -547,6 +563,8 @@ _checksum_table = { > Cksumtype.SHA1_AES256: _SHA1AES256, > Cksumtype.HMAC_MD5: _HMACMD5, > Cksumtype.MD5: _MD5, >+ Cksumtype.SHA1: _SHA1, >+ Cksumtype.CRC32: _CRC32, > } > > >@@ -835,6 +853,73 @@ class KcrytoTest(TestCase): > def test_md5_unkeyed_checksum_aes256_usage_50(self): > return self._test_md5_unkeyed_checksum(Enctype.AES256, 50) > >+ def _test_sha1_unkeyed_checksum(self, etype, usage): >+ # SHA1 unkeyed checksum >+ pw = b'password' >+ salt = b'salt' >+ key = string_to_key(etype, pw, salt) >+ plain = b'twenty nineteen eighteen seventeen' >+ cksum = h('381c870d8875d1913555de19af5c885fd27b7da9') >+ verify_checksum(Cksumtype.SHA1, key, usage, plain, cksum) >+ >+ def test_sha1_unkeyed_checksum_des3_usage_40(self): >+ return self._test_sha1_unkeyed_checksum(Enctype.DES3, 40) >+ >+ def test_sha1_unkeyed_checksum_des3_usage_50(self): >+ return self._test_sha1_unkeyed_checksum(Enctype.DES3, 50) >+ >+ def test_sha1_unkeyed_checksum_rc4_usage_40(self): >+ return self._test_sha1_unkeyed_checksum(Enctype.RC4, 40) >+ >+ def test_sha1_unkeyed_checksum_rc4_usage_50(self): >+ return self._test_sha1_unkeyed_checksum(Enctype.RC4, 50) >+ >+ def test_sha1_unkeyed_checksum_aes128_usage_40(self): >+ return self._test_sha1_unkeyed_checksum(Enctype.AES128, 40) >+ >+ def test_sha1_unkeyed_checksum_aes128_usage_50(self): >+ return self._test_sha1_unkeyed_checksum(Enctype.AES128, 50) >+ >+ def test_sha1_unkeyed_checksum_aes256_usage_40(self): >+ return self._test_sha1_unkeyed_checksum(Enctype.AES256, 40) >+ >+ def test_sha1_unkeyed_checksum_aes256_usage_50(self): >+ return self._test_sha1_unkeyed_checksum(Enctype.AES256, 50) >+ >+ def _test_crc32_unkeyed_checksum(self, etype, usage): >+ # CRC32 unkeyed checksum >+ pw = b'password' >+ salt = b'salt' >+ key = string_to_key(etype, pw, salt) >+ plain = b'africa america asia australia europe' >+ cksum = h('ce595a53') >+ verify_checksum(Cksumtype.CRC32, key, usage, plain, cksum) >+ >+ def test_crc32_unkeyed_checksum_des3_usage_40(self): >+ return self._test_crc32_unkeyed_checksum(Enctype.DES3, 40) >+ >+ def test_crc32_unkeyed_checksum_des3_usage_50(self): >+ return self._test_crc32_unkeyed_checksum(Enctype.DES3, 50) >+ >+ def test_crc32_unkeyed_checksum_rc4_usage_40(self): >+ return self._test_crc32_unkeyed_checksum(Enctype.RC4, 40) >+ >+ def test_crc32_unkeyed_checksum_rc4_usage_50(self): >+ return self._test_crc32_unkeyed_checksum(Enctype.RC4, 50) >+ >+ def test_crc32_unkeyed_checksum_aes128_usage_40(self): >+ return self._test_crc32_unkeyed_checksum(Enctype.AES128, 40) >+ >+ def test_crc32_unkeyed_checksum_aes128_usage_50(self): >+ return self._test_crc32_unkeyed_checksum(Enctype.AES128, 50) >+ >+ def test_crc32_unkeyed_checksum_aes256_usage_40(self): >+ return self._test_crc32_unkeyed_checksum(Enctype.AES256, 40) >+ >+ def test_crc32_unkeyed_checksum_aes256_usage_50(self): >+ return self._test_crc32_unkeyed_checksum(Enctype.AES256, 50) >+ >+ > if __name__ == "__main__": > import unittest > unittest.main() >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 6c7bcd418a0..f43ce9cbc3c 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -867,3 +867,26 @@ class RawKerberosTest(TestCase): > if native_decoded_only: > return decoded > return decoded, obj >+ >+ def PA_S4U2Self_create(self, name, realm, tgt_session_key, ctype=None): >+ # PA-S4U2Self ::= SEQUENCE { >+ # name [0] PrincipalName, >+ # realm [1] Realm, >+ # cksum [2] Checksum, >+ # auth [3] GeneralString >+ # } >+ cksum_data = name['name-type'].to_bytes(4, byteorder='little') >+ for n in name['name-string']: >+ cksum_data += n.encode() >+ cksum_data += realm.encode() >+ cksum_data += "Kerberos".encode() >+ cksum = self.Checksum_create(tgt_session_key, 17, cksum_data, ctype) >+ >+ PA_S4U2Self_obj = { >+ 'name': name, >+ 'realm': realm, >+ 'cksum': cksum, >+ 'auth': "Kerberos", >+ } >+ pa_s4u2self = self.der_encode(PA_S4U2Self_obj, asn1Spec=krb5_asn1.PA_S4U2Self()) >+ return self.PA_DATA_create(129, pa_s4u2self) >diff --git a/python/samba/tests/krb5/rfc4120.asn1 b/python/samba/tests/krb5/rfc4120.asn1 >index 05b43106034..98ba887729d 100644 >--- a/python/samba/tests/krb5/rfc4120.asn1 >+++ b/python/samba/tests/krb5/rfc4120.asn1 >@@ -415,6 +415,14 @@ AD-AND-OR ::= SEQUENCE { > > AD-MANDATORY-FOR-KDC ::= AuthorizationData > >+-- S4U >+ >+PA-S4U2Self ::= SEQUENCE { >+ name [0] PrincipalName, >+ realm [1] Realm, >+ cksum [2] Checksum, >+ auth [3] KerberosString >+} > > > >diff --git a/python/samba/tests/krb5/rfc4120_pyasn1.py b/python/samba/tests/krb5/rfc4120_pyasn1.py >index b2627aa3dcb..05304a8a099 100644 >--- a/python/samba/tests/krb5/rfc4120_pyasn1.py >+++ b/python/samba/tests/krb5/rfc4120_pyasn1.py >@@ -1,5 +1,5 @@ > # Auto-generated by asn1ate v.0.6.1.dev0 from rfc4120.asn1 >-# (last modified on 2020-03-26 10:28:24.346775) >+# (last modified on 2020-05-06 17:51:00.323318) > > # KerberosV5Spec2 > from pyasn1.type import univ, char, namedtype, namedval, tag, constraint, useful >@@ -780,6 +780,18 @@ PA_ENC_TS_ENC.componentType = namedtype.NamedTypes( > ) > > >+class PA_S4U2Self(univ.Sequence): >+ pass >+ >+ >+PA_S4U2Self.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('name', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))), >+ namedtype.NamedType('realm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('cksum', Checksum().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))), >+ namedtype.NamedType('auth', KerberosString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))) >+) >+ >+ > class PADataTypeValues(univ.Integer): > pass > >diff --git a/python/samba/tests/krb5/s4u_tests.py b/python/samba/tests/krb5/s4u_tests.py >new file mode 100755 >index 00000000000..ae38635c53b >--- /dev/null >+++ b/python/samba/tests/krb5/s4u_tests.py >@@ -0,0 +1,197 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+from samba.tests import env_get_var_value >+from samba.tests.krb5.kcrypto import Cksumtype >+from samba.tests.krb5.raw_testcase import RawKerberosTest >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+ >+global_asn1_print = False >+global_hexdump = False >+ >+class S4UKerberosTests(RawKerberosTest): >+ >+ def setUp(self): >+ super(S4UKerberosTests, self).setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ def _test_s4u2self(self, pa_s4u2self_ctype=None): >+ service_creds = self.get_service_creds() >+ service = service_creds.get_username() >+ realm = service_creds.get_realm() >+ >+ cname = self.PrincipalName_create(name_type=1, names=[service]) >+ sname = self.PrincipalName_create(name_type=2, names=["krbtgt", realm]) >+ >+ till = self.get_KerberosTime(offset=36000) >+ >+ kdc_options = krb5_asn1.KDCOptions('forwardable') >+ padata = None >+ >+ etypes=(18,17,23) >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ self.assertEqual(rep['msg-type'], 30) >+ self.assertEqual(rep['error-code'], 25) >+ rep_padata = self.der_decode(rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) >+ >+ for pa in rep_padata: >+ if pa['padata-type'] == 19: >+ etype_info2 = pa['padata-value'] >+ break >+ >+ etype_info2 = self.der_decode(etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ >+ key = self.PasswordKey_from_etype_info2(service_creds, etype_info2[0]) >+ >+ (patime, pausec) = self.get_KerberosTimeWithUsec() >+ pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) >+ >+ enc_pa_ts_usage = 1 >+ pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) >+ >+ pa_ts = self.PA_DATA_create(2, pa_ts) >+ >+ kdc_options = krb5_asn1.KDCOptions('forwardable') >+ padata = [pa_ts] >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ msg_type = rep['msg-type'] >+ self.assertEqual(msg_type, 11) >+ >+ usage = 3 >+ enc_part2 = key.decrypt(usage, rep['enc-part']['cipher']) >+ enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) >+ >+ # S4U2Self Request >+ sname = cname >+ >+ for_user_name = env_get_var_value('FOR_USER') >+ uname = self.PrincipalName_create(name_type=1, names=[for_user_name]) >+ >+ kdc_options = krb5_asn1.KDCOptions('forwardable') >+ till = self.get_KerberosTime(offset=36000) >+ ticket = rep['ticket'] >+ ticket_session_key = self.EncryptionKey_import(enc_part2['key']) >+ pa_s4u = self.PA_S4U2Self_create(name=uname, realm=realm, >+ tgt_session_key=ticket_session_key, >+ ctype=pa_s4u2self_ctype) >+ padata = [pa_s4u] >+ >+ subkey = self.RandomKey(ticket_session_key.etype) >+ subkey_usage = 9 >+ >+ (ctime, cusec) = self.get_KerberosTimeWithUsec() >+ >+ req = self.TGS_REQ_create(padata=padata, >+ cusec=cusec, >+ ctime=ctime, >+ ticket=ticket, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7ffffffe, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None, >+ ticket_session_key=ticket_session_key, >+ authenticator_subkey=subkey) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ msg_type = rep['msg-type'] >+ if msg_type == 13: >+ enc_part2 = subkey.decrypt(subkey_usage, rep['enc-part']['cipher']) >+ enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ >+ return msg_type >+ >+ # Using the checksum type from the tgt_session_key happens to work everywhere >+ def test_s4u2self(self): >+ msg_type = self._test_s4u2self() >+ self.assertEqual(msg_type, 13) >+ >+ # Per spec, the checksum of PA-FOR-USER is HMAC_MD5, see [MS-SFU] 2.2.1 >+ def test_s4u2self_hmac_md5_checksum(self): >+ msg_type = self._test_s4u2self(pa_s4u2self_ctype=Cksumtype.HMAC_MD5) >+ self.assertEqual(msg_type, 13) >+ >+ def test_s4u2self_md5_unkeyed_checksum(self): >+ msg_type = self._test_s4u2self(pa_s4u2self_ctype=Cksumtype.MD5) >+ self.assertEqual(msg_type, 30) >+ >+ def test_s4u2self_sha1_unkeyed_checksum(self): >+ msg_type = self._test_s4u2self(pa_s4u2self_ctype=Cksumtype.SHA1) >+ self.assertEqual(msg_type, 30) >+ >+ def test_s4u2self_crc32_unkeyed_checksum(self): >+ msg_type = self._test_s4u2self(pa_s4u2self_ctype=Cksumtype.CRC32) >+ self.assertEqual(msg_type, 30) >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 18e9fad232f..58053474e03 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -87,6 +87,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/dcerpc/raw_protocol.py', > 'python/samba/tests/krb5/kcrypto.py', > 'python/samba/tests/krb5/simple_tests.py', >+ 'python/samba/tests/krb5/s4u_tests.py', > } > > EXCLUDE_HELP = { >diff --git a/selftest/knownfail b/selftest/knownfail >index f5466fccd8c..44ab3e59069 100644 >--- a/selftest/knownfail >+++ b/selftest/knownfail >@@ -380,3 +380,5 @@ > ^samba.tests.ntlmdisabled.python\(ktest\).python2.ntlmdisabled.NtlmDisabledTests.test_samr_change_password\(ktest\) > ^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python3.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\) > ^samba.tests.ntlmdisabled.python\(ad_dc_no_ntlm\).python2.ntlmdisabled.NtlmDisabledTests.test_ntlm_connection\(ad_dc_no_ntlm\) >+# Fixed upstream heimdal in PR #439 >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_hmac_md5_checksum >diff --git a/selftest/skip_mit_kdc b/selftest/skip_mit_kdc >index 4a51c98ea0b..ea644638c9f 100644 >--- a/selftest/skip_mit_kdc >+++ b/selftest/skip_mit_kdc >@@ -3,3 +3,4 @@ > .*RODC > ^samba4.ntvfs.cifs.ntlm.base.unlink > ^samba4.ntvfs.cifs.krb5.base.unlink >+^samba.tests.krb5.s4u_tests >diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm >index 860cc06d99b..927638cb7c4 100755 >--- a/selftest/target/Samba4.pm >+++ b/selftest/target/Samba4.pm >@@ -895,6 +895,29 @@ sub provision_raw_step2($$$) > return undef; > } > >+ my $srv_account = "srv_account"; >+ $samba_tool_cmd = ""; >+ $samba_tool_cmd .= "RESOLV_CONF=\"$ret->{RESOLV_CONF}\" "; >+ $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; >+ $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" "; >+ $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool") >+ . " user create --configfile=$ctx->{smb_conf} $srv_account $ctx->{password}"; >+ unless (system($samba_tool_cmd) == 0) { >+ warn("Unable to add $srv_account user: \n$samba_tool_cmd\n"); >+ return undef; >+ } >+ >+ $samba_tool_cmd = ""; >+ $samba_tool_cmd .= "RESOLV_CONF=\"$ret->{RESOLV_CONF}\" "; >+ $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; >+ $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" "; >+ $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool") >+ . " spn add HOST/$srv_account --configfile=$ctx->{smb_conf} $srv_account"; >+ unless (system($samba_tool_cmd) == 0) { >+ warn("Unable to add spn for $srv_account: \n$samba_tool_cmd\n"); >+ return undef; >+ } >+ > my $ldbmodify = ""; > $ldbmodify .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; > $ldbmodify .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" "; >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 693209f2d1e..59b447de40a 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -745,6 +745,10 @@ planoldpythontestsuite("ad_dc:local", "samba.tests.dckeytab", extra_args=['-U"$U > planoldpythontestsuite("none", "samba.tests.krb5.kcrypto") > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.simple_tests", > environ={'SERVICE_USERNAME':'$SERVER'}) >+planoldpythontestsuite("ad_dc_default:local", "samba.tests.krb5.s4u_tests", >+ environ={'SERVICE_USERNAME':'srv_account', >+ 'SERVICE_PASSWORD':'$PASSWORD', >+ 'FOR_USER':'$USERNAME'}) > > for env in ["ad_dc", smbv1_disabled_testenv]: > planoldpythontestsuite(env, "samba.tests.smb", extra_args=['-U"$USERNAME%$PASSWORD"']) >-- >2.25.1 > > >From efdad55260a4a5c68ca646a2f101d36013cc3f60 Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Sun, 19 Jan 2020 16:24:24 +0100 >Subject: [PATCH 027/380] selftest: add test for disallowed-forwardable server > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14233 > >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 197f97bc13c513ae6ae2b4129b23489081f63c64) >--- > selftest/knownfail.d/disallowed_forwardable_server | 1 + > testprogs/blackbox/test_s4u_heimdal.sh | 13 +++++++++++-- > 2 files changed, 12 insertions(+), 2 deletions(-) > create mode 100644 selftest/knownfail.d/disallowed_forwardable_server > >diff --git a/selftest/knownfail.d/disallowed_forwardable_server b/selftest/knownfail.d/disallowed_forwardable_server >new file mode 100644 >index 00000000000..2e05909ab89 >--- /dev/null >+++ b/selftest/knownfail.d/disallowed_forwardable_server >@@ -0,0 +1 @@ >+^samba4.blackbox.krb5.s4u.test S4U2Proxy using received ticket >diff --git a/testprogs/blackbox/test_s4u_heimdal.sh b/testprogs/blackbox/test_s4u_heimdal.sh >index 0e12c7ec096..c6ada54e85b 100755 >--- a/testprogs/blackbox/test_s4u_heimdal.sh >+++ b/testprogs/blackbox/test_s4u_heimdal.sh >@@ -54,7 +54,7 @@ testit "set not-delegated flag" $samba_tool user sensitive $princ on || failed=` > > > echo $PASSWORD > $PREFIX/tmppassfile >-testit "kinit with password" $samba4kinit -f --password-file=$PREFIX/tmppassfile $impersonator || failed=`expr $failed + 1` >+testit "kinit impersonator" $samba4kinit -f --password-file=$PREFIX/tmppassfile $impersonator || failed=`expr $failed + 1` > > testit "test S4U2Self with normal user" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=${USERNAME} $impersonator || failed=`expr $failed + 1` > testit "test S4U2Proxy with normal user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=`expr $failed + 1` >@@ -68,6 +68,15 @@ testit "unset not-delegated flag" $samba_tool user sensitive $princ off || faile > testit "test S4U2Self after unsetting ND flag" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=$princ $impersonator || failed=`expr $failed + 1` > testit "test S4U2Proxy after unsetting ND flag" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=`expr $failed + 1` > >+testit "kinit user cache" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile $USERNAME || failed=`expr $failed + 1` >+testit "get a ticket to impersonator" $samba4kgetcred -c $ocache --forwardable $impersonator || failed=`expr $failed + 1` >+testit "test S4U2Proxy evidence ticket obtained by TGS" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=`expr $failed + 1` > >-rm -f $ocache $PREFIX/tmpccache tmppassfile >+testit "set not-delegated on impersonator" $samba_tool user sensitive $impersonator on || failed=`expr $failed + 1` >+testit "kinit user cache again" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile $USERNAME || failed=`expr $failed + 1` >+testit "get a ticket to sensitive impersonator" $samba4kgetcred -c $ocache --forwardable $impersonator || failed=`expr $failed + 1` >+testit_expect_failure "test S4U2Proxy using received ticket" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=`expr $failed + 1` >+ >+ >+rm -f $ocache $PREFIX/tmpccache $PREFIX/tmppassfile > exit $failed >-- >2.25.1 > > >From 30cacb3e63225077f94578d52f1228a7d690ed7d Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Mon, 13 Jan 2020 23:42:54 +0100 >Subject: [PATCH 028/380] heimdal: apply disallow-forwardable on server in TGS > request > >upstream commit: 839b073facd2aecda6740224d73e560bc79965dc > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14233 > >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 8fdff19c5461315556014d25d237a958edeed1a2) >--- > selftest/knownfail.d/disallowed_forwardable_server | 1 - > source4/heimdal/kdc/krb5tgs.c | 6 ++++++ > 2 files changed, 6 insertions(+), 1 deletion(-) > delete mode 100644 selftest/knownfail.d/disallowed_forwardable_server > >diff --git a/selftest/knownfail.d/disallowed_forwardable_server b/selftest/knownfail.d/disallowed_forwardable_server >deleted file mode 100644 >index 2e05909ab89..00000000000 >--- a/selftest/knownfail.d/disallowed_forwardable_server >+++ /dev/null >@@ -1 +0,0 @@ >-^samba4.blackbox.krb5.s4u.test S4U2Proxy using received ticket >diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c >index ee3ac3d8f53..efbdd6ed77f 100644 >--- a/source4/heimdal/kdc/krb5tgs.c >+++ b/source4/heimdal/kdc/krb5tgs.c >@@ -866,6 +866,12 @@ tgs_make_reply(krb5_context context, > et.flags.anonymous = tgt->flags.anonymous; > et.flags.ok_as_delegate = server->entry.flags.ok_as_delegate; > >+ /* See MS-KILE 3.3.5.1 */ >+ if (!server->entry.flags.forwardable) >+ et.flags.forwardable = 0; >+ if (!server->entry.flags.proxiable) >+ et.flags.proxiable = 0; >+ > if(rspac->length) { > /* > * No not need to filter out the any PAC from the >-- >2.25.1 > > >From 29ea1a6f61f89680a881f2ab324231872c171477 Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Thu, 7 May 2020 01:25:36 +0200 >Subject: [PATCH 029/380] selftest: allow EncASRepPart to be encoded as > EncTGSRepPart > >that's how MIT kdc encodes it, clients accept both. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14233 > >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit a823cc1e8bc9a68a7e662022705039397a5df7e1) >--- > python/samba/tests/krb5/simple_tests.py | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/simple_tests.py b/python/samba/tests/krb5/simple_tests.py >index c9998c4d2db..236fbda1cd5 100755 >--- a/python/samba/tests/krb5/simple_tests.py >+++ b/python/samba/tests/krb5/simple_tests.py >@@ -115,7 +115,12 @@ class SimpleKerberosTests(RawKerberosTest): > > usage = 3 > enc_part2 = key.decrypt(usage, rep['enc-part']['cipher']) >- enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) >+ >+ # MIT KDC encodes both EncASRepPart and EncTGSRepPart with application tag 26 >+ try: >+ enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) >+ except Exception: >+ enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) > > # TGS Request > service_creds = self.get_service_creds(allow_missing_password=True) >-- >2.25.1 > > >From f879fcbe345da12b1aa610fbd34f9036f53873fb Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Wed, 6 May 2020 15:54:55 +0200 >Subject: [PATCH 030/380] selftest: test forwardable flag in cross-realm tgt > tickets > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14233 > >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 9b302a57ff0d4c3a373f762f2ad4daf736b0853b) >--- > python/samba/tests/krb5/xrealm_tests.py | 180 ++++++++++++++++++++++++ > python/samba/tests/usage.py | 1 + > selftest/knownfail.d/xrealm | 1 + > source4/selftest/tests.py | 2 + > 4 files changed, 184 insertions(+) > create mode 100755 python/samba/tests/krb5/xrealm_tests.py > create mode 100644 selftest/knownfail.d/xrealm > >diff --git a/python/samba/tests/krb5/xrealm_tests.py b/python/samba/tests/krb5/xrealm_tests.py >new file mode 100755 >index 00000000000..64064b8a670 >--- /dev/null >+++ b/python/samba/tests/krb5/xrealm_tests.py >@@ -0,0 +1,180 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+from samba.tests.krb5.raw_testcase import RawKerberosTest >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+import samba.tests >+ >+global_asn1_print = False >+global_hexdump = False >+ >+class XrealmKerberosTests(RawKerberosTest): >+ >+ def setUp(self): >+ super(XrealmKerberosTests, self).setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ def test_xrealm(self): >+ user_creds = self.get_user_creds() >+ user = user_creds.get_username() >+ realm = user_creds.get_realm() >+ >+ cname = self.PrincipalName_create(name_type=1, names=[user]) >+ sname = self.PrincipalName_create(name_type=2, names=["krbtgt", realm]) >+ >+ till = self.get_KerberosTime(offset=36000) >+ >+ kdc_options = krb5_asn1.KDCOptions('forwardable') >+ padata = None >+ >+ etypes=(18,17,23) >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ self.assertEqual(rep['msg-type'], 30) >+ self.assertEqual(rep['error-code'], 25) >+ rep_padata = self.der_decode(rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) >+ >+ for pa in rep_padata: >+ if pa['padata-type'] == 19: >+ etype_info2 = pa['padata-value'] >+ break >+ >+ etype_info2 = self.der_decode(etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ >+ key = self.PasswordKey_from_etype_info2(user_creds, etype_info2[0]) >+ >+ (patime, pausec) = self.get_KerberosTimeWithUsec() >+ pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) >+ >+ enc_pa_ts_usage = 1 >+ pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) >+ >+ pa_ts = self.PA_DATA_create(2, pa_ts) >+ >+ kdc_options = krb5_asn1.KDCOptions('forwardable') >+ padata = [pa_ts] >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ msg_type = rep['msg-type'] >+ self.assertEqual(msg_type, 11) >+ >+ usage = 3 >+ enc_part2 = key.decrypt(usage, rep['enc-part']['cipher']) >+ >+ # MIT KDC encodes both EncASRepPart and EncTGSRepPart with application tag 26 >+ try: >+ enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) >+ except Exception: >+ enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ >+ # TGS Request (for cross-realm TGT) >+ trust_realm = samba.tests.env_get_var_value('TRUST_REALM') >+ sname = self.PrincipalName_create(name_type=2, names=["krbtgt", trust_realm]) >+ >+ kdc_options = krb5_asn1.KDCOptions('forwardable') >+ till = self.get_KerberosTime(offset=36000) >+ ticket = rep['ticket'] >+ ticket_session_key = self.EncryptionKey_import(enc_part2['key']) >+ padata = [] >+ >+ subkey = self.RandomKey(ticket_session_key.etype) >+ subkey_usage = 9 >+ >+ (ctime, cusec) = self.get_KerberosTimeWithUsec() >+ >+ req = self.TGS_REQ_create(padata=padata, >+ cusec=cusec, >+ ctime=ctime, >+ ticket=ticket, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7ffffffe, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None, >+ ticket_session_key=ticket_session_key, >+ authenticator_subkey=subkey) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ msg_type = rep['msg-type'] >+ self.assertEqual(msg_type, 13) >+ >+ enc_part2 = subkey.decrypt(subkey_usage, rep['enc-part']['cipher']) >+ enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ >+ # Check the forwardable flag >+ fwd_pos = len(tuple(krb5_asn1.TicketFlags('forwardable'))) -1 >+ assert(krb5_asn1.TicketFlags(enc_part2['flags'])[fwd_pos]) >+ >+ return >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 58053474e03..89b5e957407 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -88,6 +88,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/kcrypto.py', > 'python/samba/tests/krb5/simple_tests.py', > 'python/samba/tests/krb5/s4u_tests.py', >+ 'python/samba/tests/krb5/xrealm_tests.py', > } > > EXCLUDE_HELP = { >diff --git a/selftest/knownfail.d/xrealm b/selftest/knownfail.d/xrealm >new file mode 100644 >index 00000000000..2e09644b1d8 >--- /dev/null >+++ b/selftest/knownfail.d/xrealm >@@ -0,0 +1 @@ >+^samba.tests.krb5.xrealm_tests.samba.tests.krb5.xrealm_tests.XrealmKerberosTests.test_xrealm >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 59b447de40a..52a61a2cced 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -750,6 +750,8 @@ planoldpythontestsuite("ad_dc_default:local", "samba.tests.krb5.s4u_tests", > 'SERVICE_PASSWORD':'$PASSWORD', > 'FOR_USER':'$USERNAME'}) > >+planoldpythontestsuite("fl2008r2dc:local", "samba.tests.krb5.xrealm_tests") >+ > for env in ["ad_dc", smbv1_disabled_testenv]: > planoldpythontestsuite(env, "samba.tests.smb", extra_args=['-U"$USERNAME%$PASSWORD"']) > planoldpythontestsuite(env + ":local", "samba.tests.ntacls_backup", >-- >2.25.1 > > >From a4ffa145736a9a4ba6ad020d27dbbb7fbf32ceac Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Sat, 9 May 2020 16:26:45 +0200 >Subject: [PATCH 031/380] selftest: test forwardable flag in cross-realm with > s4u2proxy > >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit fb7dfdbe8f94f7f053d67832e7f28a751136d733) >--- > selftest/knownfail.d/s4u2p_fwd | 2 ++ > source4/selftest/tests.py | 2 +- > testprogs/blackbox/test_s4u_heimdal.sh | 17 ++++++++++++++--- > 3 files changed, 17 insertions(+), 4 deletions(-) > create mode 100644 selftest/knownfail.d/s4u2p_fwd > >diff --git a/selftest/knownfail.d/s4u2p_fwd b/selftest/knownfail.d/s4u2p_fwd >new file mode 100644 >index 00000000000..63ade3eece0 >--- /dev/null >+++ b/selftest/knownfail.d/s4u2p_fwd >@@ -0,0 +1,2 @@ >+^samba4.blackbox.krb5.s4u.get a ticket to impersonator for trust user >+^samba4.blackbox.krb5.s4u.test S4U2Proxy evidence ticket obtained by TGS of trust user >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 52a61a2cced..b10ac26e964 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -482,7 +482,7 @@ if have_heimdal_support: > plantestsuite("samba4.blackbox.kinit_trust", "fl2003dc:local", [os.path.join(bbdir, "test_kinit_trusts_heimdal.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', '$TRUST_SERVER', '$TRUST_USERNAME', '$TRUST_PASSWORD', '$TRUST_REALM', '$TRUST_DOMAIN', '$PREFIX', "external", "arcfour-hmac-md5"]) > plantestsuite("samba4.blackbox.export.keytab", "ad_dc_ntvfs:local", [os.path.join(bbdir, "test_export_keytab_heimdal.sh"), '$SERVER', '$USERNAME', '$REALM', '$DOMAIN', "$PREFIX", smbclient4]) > plantestsuite("samba4.blackbox.kpasswd", "ad_dc_ntvfs:local", [os.path.join(bbdir, "test_kpasswd_heimdal.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', "$PREFIX/ad_dc_ntvfs"]) >- plantestsuite("samba4.blackbox.krb5.s4u", "fl2008r2dc:local", [os.path.join(bbdir, "test_s4u_heimdal.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', '$PREFIX', configuration]) >+ plantestsuite("samba4.blackbox.krb5.s4u", "fl2008r2dc:local", [os.path.join(bbdir, "test_s4u_heimdal.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', '$TRUST_SERVER', '$TRUST_USERNAME', '$TRUST_PASSWORD', '$TRUST_REALM', '$TRUST_DOMAIN', '$PREFIX', configuration]) > else: > plantestsuite("samba4.blackbox.kinit", "ad_dc_ntvfs:local", [os.path.join(bbdir, "test_kinit_mit.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', '$PREFIX', smbclient4, configuration]) > plantestsuite("samba4.blackbox.kinit", "fl2000dc:local", [os.path.join(bbdir, "test_kinit_mit.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', '$PREFIX', smbclient4, configuration]) >diff --git a/testprogs/blackbox/test_s4u_heimdal.sh b/testprogs/blackbox/test_s4u_heimdal.sh >index c6ada54e85b..c63eeaa2e30 100755 >--- a/testprogs/blackbox/test_s4u_heimdal.sh >+++ b/testprogs/blackbox/test_s4u_heimdal.sh >@@ -12,8 +12,13 @@ USERNAME=$2 > PASSWORD=$3 > REALM=$4 > DOMAIN=$5 >-PREFIX=$6 >-shift 6 >+TRUST_SERVER=$6 >+TRUST_USERNAME=$7 >+TRUST_PASSWORD=$8 >+TRUST_REALM=$9 >+TRUST_DOMAIN=${10} >+PREFIX=${11} >+shift 11 > failed=0 > > >@@ -39,7 +44,7 @@ export KRB5CCNAME > rm -rf $KRB5CCNAME_PATH > > princ=test_impersonate_princ >-impersonator=test_impersonator >+impersonator=test_impersonator.$REALM > target="CIFS/$SERVER.$REALM" > > >@@ -72,6 +77,12 @@ testit "kinit user cache" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmp > testit "get a ticket to impersonator" $samba4kgetcred -c $ocache --forwardable $impersonator || failed=`expr $failed + 1` > testit "test S4U2Proxy evidence ticket obtained by TGS" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=`expr $failed + 1` > >+echo $TRUST_PASSWORD > $PREFIX/tmppassfile >+testit "kinit trust user cache" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile $TRUST_USERNAME@$TRUST_REALM || failed=`expr $failed + 1` >+testit "get a ticket to impersonator for trust user" $samba4kgetcred -c $ocache --forwardable $impersonator || failed=`expr $failed + 1` >+testit "test S4U2Proxy evidence ticket obtained by TGS of trust user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=`expr $failed + 1` >+ >+echo $PASSWORD > $PREFIX/tmppassfile > testit "set not-delegated on impersonator" $samba_tool user sensitive $impersonator on || failed=`expr $failed + 1` > testit "kinit user cache again" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile $USERNAME || failed=`expr $failed + 1` > testit "get a ticket to sensitive impersonator" $samba4kgetcred -c $ocache --forwardable $impersonator || failed=`expr $failed + 1` >-- >2.25.1 > > >From cf78e03fc45ea1e8396751875e26b87926e9b9e9 Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Tue, 14 Jan 2020 13:16:02 +0100 >Subject: [PATCH 032/380] db-glue.c: set forwardable flag on cross-realm tgt > tickets > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14233 > >Match Windows behavior and allow the forwardable flag to be >set in cross-realm tickets. We used to allow forwardable to >any server, but now that we apply disallow-forwardable policy >in heimdal we need to explicitly allow in the corss-realm case >(and remove the workaround we have for it the MIT plugin). > >Signed-off-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Fri Jun 12 22:10:34 UTC 2020 on sn-devel-184 > >(cherry picked from commit 7655a0298e5f55582bf48ec776d8cd8b79fb5dd9) >--- > selftest/knownfail.d/s4u2p_fwd | 2 -- > selftest/knownfail.d/xrealm | 1 - > source4/kdc/db-glue.c | 3 +++ > source4/kdc/mit_samba.c | 5 ----- > 4 files changed, 3 insertions(+), 8 deletions(-) > delete mode 100644 selftest/knownfail.d/s4u2p_fwd > delete mode 100644 selftest/knownfail.d/xrealm > >diff --git a/selftest/knownfail.d/s4u2p_fwd b/selftest/knownfail.d/s4u2p_fwd >deleted file mode 100644 >index 63ade3eece0..00000000000 >--- a/selftest/knownfail.d/s4u2p_fwd >+++ /dev/null >@@ -1,2 +0,0 @@ >-^samba4.blackbox.krb5.s4u.get a ticket to impersonator for trust user >-^samba4.blackbox.krb5.s4u.test S4U2Proxy evidence ticket obtained by TGS of trust user >diff --git a/selftest/knownfail.d/xrealm b/selftest/knownfail.d/xrealm >deleted file mode 100644 >index 2e09644b1d8..00000000000 >--- a/selftest/knownfail.d/xrealm >+++ /dev/null >@@ -1 +0,0 @@ >-^samba.tests.krb5.xrealm_tests.samba.tests.krb5.xrealm_tests.XrealmKerberosTests.test_xrealm >diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c >index d2a79920ab5..5fd0f431cdf 100644 >--- a/source4/kdc/db-glue.c >+++ b/source4/kdc/db-glue.c >@@ -1562,6 +1562,9 @@ static krb5_error_code samba_kdc_trust_message2entry(krb5_context context, > > entry_ex->entry.max_renew = NULL; > >+ /* Match Windows behavior and allow forwardable flag in cross-realm. */ >+ entry_ex->entry.flags.forwardable = 1; >+ > ret = samba_kdc_sort_encryption_keys(entry_ex); > if (ret != 0) { > krb5_clear_error_message(context); >diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c >index 5a4f6e73e97..54dcd545ea1 100644 >--- a/source4/kdc/mit_samba.c >+++ b/source4/kdc/mit_samba.c >@@ -304,11 +304,6 @@ fetch_referral_principal: > > sdb_free_entry(&sentry); > >- if ((kflags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) == 0) { >- kentry->attributes &= ~KRB5_KDB_DISALLOW_FORWARDABLE; >- kentry->attributes &= ~KRB5_KDB_DISALLOW_PROXIABLE; >- } >- > done: > krb5_free_principal(ctx->context, referral_principal); > referral_principal = NULL; >-- >2.25.1 > > >From fe2411ad9a1bc5bb734f4c2500d85ff4f326e202 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Tue, 3 Nov 2020 09:25:48 +1300 >Subject: [PATCH 033/380] selftest: add mit kdc specific known fail > >Add a MIT kerberos specific known fail, will be needed by subsequent >commits. > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 04248f5e868d38498bdc8f9705c9a60fcfe79c09) >--- > selftest/knownfail_mit_kdc | 0 > selftest/wscript | 2 ++ > 2 files changed, 2 insertions(+) > create mode 100644 selftest/knownfail_mit_kdc > >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >new file mode 100644 >index 00000000000..e69de29bb2d >diff --git a/selftest/wscript b/selftest/wscript >index 501a5df5824..95086b4f0ed 100644 >--- a/selftest/wscript >+++ b/selftest/wscript >@@ -263,6 +263,8 @@ def cmd_testonly(opt): > > if CONFIG_GET(opt, 'USING_SYSTEM_KRB5') and CONFIG_GET(opt, 'MIT_KDC_PATH'): > env.OPTIONS += " --mitkrb5 --exclude=${srcdir}/selftest/skip_mit_kdc" >+ env.FILTER_XFAIL += " --expected-failures=${srcdir}/selftest/"\ >+ "knownfail_mit_kdc" > > if not CONFIG_GET(opt, 'HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X'): > # older MIT krb5 libraries (< 1.14) don't have >-- >2.25.1 > > >From 415e1ee1929aaef1ebe62ee4d55e2a62cece5795 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Tue, 27 Oct 2020 09:29:56 +1300 >Subject: [PATCH 034/380] tests python krb5: Make PrincipalName_create a class > method > >Make PrincipalName_create a class method, so it can be used in helper >classes. > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit b14dca7c1c063e069517ff01b33c63a000d398c3) >--- > python/samba/tests/krb5/raw_testcase.py | 1 + > 1 file changed, 1 insertion(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index f43ce9cbc3c..45e46e0b7ba 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -470,6 +470,7 @@ class RawKerberosTest(TestCase): > } > return Checksum_obj > >+ @classmethod > def PrincipalName_create(self, name_type, names): > # PrincipalName ::= SEQUENCE { > # name-type [0] Int32, >-- >2.25.1 > > >From 7d4dd909317f1c8377771eed129ed95f58f661a5 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Tue, 27 Oct 2020 09:31:24 +1300 >Subject: [PATCH 035/380] tests python krb5: Add canonicalize flag to ASN1 > >Add the canonicalize flag to KerberosFlags, so that it can be used in >python based canonicalization tests. > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 41c8aa4b991aad306d731b08d068c480eb5c7fed) >--- > python/samba/tests/krb5/rfc4120.asn1 | 8 ++++---- > python/samba/tests/krb5/rfc4120_pyasn1.py | 4 ++-- > 2 files changed, 6 insertions(+), 6 deletions(-) > >diff --git a/python/samba/tests/krb5/rfc4120.asn1 b/python/samba/tests/krb5/rfc4120.asn1 >index 98ba887729d..58e0c1636a1 100644 >--- a/python/samba/tests/krb5/rfc4120.asn1 >+++ b/python/samba/tests/krb5/rfc4120.asn1 >@@ -196,8 +196,8 @@ KDCOptions ::= KerberosFlags > -- opt-hardware-auth(11), > -- unused12(12), > -- unused13(13), >--- 15 is reserved for canonicalize >- -- unused15(15), >+-- Canonicalize is used in RFC 6806 >+ -- canonicalize(15), > -- 26 was unused in 1510 > -- disable-transited-check(26), > -- >@@ -489,8 +489,8 @@ KDCOptionsValues ::= BIT STRING { -- KerberosFlags > opt-hardware-auth(11), > unused12(12), > unused13(13), >--- 15 is reserved for canonicalize >- unused15(15), >+-- Canonicalize is used by RFC 6806 >+ canonicalize(15), > -- 26 was unused in 1510 > disable-transited-check(26), > -- >diff --git a/python/samba/tests/krb5/rfc4120_pyasn1.py b/python/samba/tests/krb5/rfc4120_pyasn1.py >index 05304a8a099..b4ea678afd8 100644 >--- a/python/samba/tests/krb5/rfc4120_pyasn1.py >+++ b/python/samba/tests/krb5/rfc4120_pyasn1.py >@@ -1,5 +1,5 @@ > # Auto-generated by asn1ate v.0.6.1.dev0 from rfc4120.asn1 >-# (last modified on 2020-05-06 17:51:00.323318) >+# (last modified on 2020-11-03 14:07:15.270009) > > # KerberosV5Spec2 > from pyasn1.type import univ, char, namedtype, namedval, tag, constraint, useful >@@ -610,7 +610,7 @@ KDCOptionsValues.namedValues = namedval.NamedValues( > ('opt-hardware-auth', 11), > ('unused12', 12), > ('unused13', 13), >- ('unused15', 15), >+ ('canonicalize', 15), > ('disable-transited-check', 26), > ('renewable-ok', 27), > ('enc-tkt-in-skey', 28), >-- >2.25.1 > > >From 0e4a44f7e46d4f19d5362411c1c433a56106a77b Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Tue, 27 Oct 2020 09:32:21 +1300 >Subject: [PATCH 036/380] tests python krb5: Add python kerberos > canonicalization tests > >Add python canonicalization tests, loosely based on the code in >source4/torture/krb5/kdc-canon-heimdal.c. The long term goal is to move >the integration level tests out of kdc-canon-heimdal, leaving it as a >heimdal library unit test. > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 005435dc4d7de9d442c7513edec8c782fe20fda3) >--- > .../tests/krb5/as_canonicalization_tests.py | 499 ++++++++++++++++++ > python/samba/tests/usage.py | 1 + > selftest/knownfail_mit_kdc | 144 +++++ > source4/selftest/tests.py | 1 + > 4 files changed, 645 insertions(+) > create mode 100755 python/samba/tests/krb5/as_canonicalization_tests.py > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >new file mode 100755 >index 00000000000..7b599ad6e44 >--- /dev/null >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -0,0 +1,499 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# >+# Copyright (C) Catalyst IT Ltd. 2020 >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+from enum import Enum, unique >+import pyasn1 >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+from samba.tests.krb5.raw_testcase import RawKerberosTest >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+import samba >+from samba.auth import system_session >+from samba.credentials import ( >+ Credentials, >+ CLI_CRED_NTLMv2_AUTH, >+ CLI_CRED_NTLM_AUTH, >+ DONT_USE_KERBEROS) >+from samba.dcerpc.misc import SEC_CHAN_WKSTA >+from samba.dsdb import ( >+ UF_WORKSTATION_TRUST_ACCOUNT, >+ UF_PASSWD_NOTREQD, >+ UF_NORMAL_ACCOUNT) >+from samba.samdb import SamDB >+from samba.tests import delete_force, DynamicTestCase >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+@unique >+class TestOptions(Enum): >+ Canonicalize = 1 >+ Enterprise = 2 >+ UpperRealm = 4 >+ UpperUserName = 8 >+ NetbiosRealm = 16 >+ UPN = 32 >+ RemoveDollar = 64 >+ Last = 128 >+ >+ def is_set(self, x): >+ return self.value & x >+ >+ >+@unique >+class CredentialsType(Enum): >+ User = 1 >+ Machine = 2 >+ >+ def is_set(self, x): >+ return self.value & x >+ >+ >+class TestData: >+ >+ def __init__(self, options, creds): >+ self.options = options >+ self.user_creds = creds >+ self.user_name = self.get_username(options, creds) >+ self.realm = self.get_realm(options, creds) >+ self.cname = RawKerberosTest.PrincipalName_create( >+ name_type=1, names=[self.user_name]) >+ self.sname = RawKerberosTest.PrincipalName_create( >+ name_type=2, names=["krbtgt", self.realm]) >+ self.canonicalize = TestOptions.Canonicalize.is_set(options) >+ >+ def get_realm(self, options, creds): >+ realm = creds.get_realm() >+ if TestOptions.NetbiosRealm.is_set(options): >+ realm = creds.get_domain() >+ if TestOptions.UpperRealm.is_set(options): >+ realm = realm.upper() >+ else: >+ realm = realm.lower() >+ return realm >+ >+ def get_username(self, options, creds): >+ name = creds.get_username() >+ if TestOptions.RemoveDollar.is_set(options) and name.endswith("$"): >+ name = name[:-1] >+ if TestOptions.Enterprise.is_set(options): >+ realm = creds.get_realm() >+ name = "{0}@{1}".format(name, realm) >+ if TestOptions.UpperUserName.is_set(options): >+ name = name.upper() >+ return name >+ >+ def __repr__(self): >+ rep = "Test Data: " >+ rep += "options = '" + "{:08b}".format(self.options) + "'" >+ rep += "user name = '" + self.user_name + "'" >+ rep += ", realm = '" + self.realm + "'" >+ rep += ", cname = '" + str(self.cname) + "'" >+ rep += ", sname = '" + str(self.sname) + "'" >+ return rep >+ >+ >+MACHINE_NAME = "tstkrb5cnnusr" >+USER_NAME = "tstkrb5cnnmch" >+ >+# Encryption types >+AES256_CTS_HMAC_SHA1_96 = int( >+ krb5_asn1.EncryptionTypeValues('kRB5-ENCTYPE-AES256-CTS-HMAC-SHA1-96')) >+AES128_CTS_HMAC_SHA1_96 = int( >+ krb5_asn1.EncryptionTypeValues('kRB5-ENCTYPE-AES128-CTS-HMAC-SHA1-96')) >+ARCFOUR_HMAC_MD5 = int( >+ krb5_asn1.EncryptionTypeValues('kRB5-ENCTYPE-ARCFOUR-HMAC-MD5')) >+ >+# Message types >+KRB_ERROR = int(krb5_asn1.MessageTypeValues('krb-error')) >+KRB_AS_REP = int(krb5_asn1.MessageTypeValues('krb-as-rep')) >+ >+# PAData types >+PADATA_ENC_TIMESTAMP = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-ENC-TIMESTAMP')) >+PADATA_ETYPE_INFO2 = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-ETYPE-INFO2')) >+ >+# Error codes >+KDC_ERR_C_PRINCIPAL_UNKNOWN = 6 >+KDC_ERR_PREAUTH_REQUIRED = 25 >+ >+# Name types >+NT_UNKNOWN = int(krb5_asn1.NameTypeValues('kRB5-NT-UNKNOWN')) >+NT_PRINCIPAL = int(krb5_asn1.NameTypeValues('kRB5-NT-PRINCIPAL')) >+NT_SRV_INST = int(krb5_asn1.NameTypeValues('kRB5-NT-SRV-INST')) >+ >+ >+@DynamicTestCase >+class KerberosASCanonicalizationTests(RawKerberosTest): >+ >+ @classmethod >+ def setUpDynamicTestCases(cls): >+ >+ def skip(ct, options): >+ ''' Filter out any mutually exclusive test options ''' >+ if ct != CredentialsType.Machine and\ >+ TestOptions.RemoveDollar.is_set(options): >+ return True >+ return False >+ >+ def build_test_name(ct, options): >+ name = "%sCredentials" % ct.name >+ for opt in TestOptions: >+ if opt.is_set(options): >+ name += ("_%s" % opt.name) >+ return name >+ >+ for ct in CredentialsType: >+ for x in range(TestOptions.Last.value): >+ if skip(ct, x): >+ continue >+ name = build_test_name(ct, x) >+ cls.generate_dynamic_test("test", name, x, ct) >+ >+ @classmethod >+ def setUpClass(cls): >+ cls.lp = cls.get_loadparm(cls) >+ cls.username = os.environ["USERNAME"] >+ cls.password = os.environ["PASSWORD"] >+ cls.domain = os.environ["DOMAIN"] >+ cls.realm = os.environ["REALM"] >+ cls.host = os.environ["SERVER"] >+ >+ c = Credentials() >+ c.set_username(cls.username) >+ c.set_password(cls.password) >+ c.set_domain(cls.domain) >+ c.set_realm(cls.realm) >+ cls.credentials = c >+ >+ cls.session = system_session() >+ cls.ldb = SamDB(url="ldap://%s" % cls.host, >+ session_info=cls.session, >+ credentials=cls.credentials, >+ lp=cls.lp) >+ cls.create_machine_account() >+ cls.create_user_account() >+ >+ @classmethod >+ def tearDownClass(cls): >+ super(KerberosASCanonicalizationTests, cls).tearDownClass() >+ delete_force(cls.ldb, cls.machine_dn) >+ delete_force(cls.ldb, cls.user_dn) >+ >+ def setUp(self): >+ super(KerberosASCanonicalizationTests, self).setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ # >+ # Create a test user account >+ @classmethod >+ def create_user_account(cls): >+ cls.user_pass = samba.generate_random_password(32, 32) >+ cls.user_name = USER_NAME >+ cls.user_dn = "cn=%s,%s" % (cls.user_name, cls.ldb.domain_dn()) >+ >+ # remove the account if it exists, this will happen if a previous test >+ # run failed >+ delete_force(cls.ldb, cls.user_dn) >+ >+ utf16pw = ('"%s"' % cls.user_pass).encode('utf-16-le') >+ cls.ldb.add({ >+ "dn": cls.user_dn, >+ "objectclass": "user", >+ "sAMAccountName": "%s" % cls.user_name, >+ "userAccountControl": str(UF_NORMAL_ACCOUNT), >+ "unicodePwd": utf16pw}) >+ >+ cls.user_creds = Credentials() >+ cls.user_creds.guess(cls.lp) >+ cls.user_creds.set_password(cls.user_pass) >+ cls.user_creds.set_username(cls.user_name) >+ cls.user_creds.set_workstation(cls.machine_name) >+ >+ # >+ # Create the machine account >+ @classmethod >+ def create_machine_account(cls): >+ cls.machine_pass = samba.generate_random_password(32, 32) >+ cls.machine_name = MACHINE_NAME >+ cls.machine_dn = "cn=%s,%s" % (cls.machine_name, cls.ldb.domain_dn()) >+ >+ # remove the account if it exists, this will happen if a previous test >+ # run failed >+ delete_force(cls.ldb, cls.machine_dn) >+ >+ utf16pw = ('"%s"' % cls.machine_pass).encode('utf-16-le') >+ cls.ldb.add({ >+ "dn": cls.machine_dn, >+ "objectclass": "computer", >+ "sAMAccountName": "%s$" % cls.machine_name, >+ "userAccountControl": >+ str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), >+ "unicodePwd": utf16pw}) >+ >+ cls.machine_creds = Credentials() >+ cls.machine_creds.guess(cls.lp) >+ cls.machine_creds.set_secure_channel_type(SEC_CHAN_WKSTA) >+ cls.machine_creds.set_kerberos_state(DONT_USE_KERBEROS) >+ cls.machine_creds.set_password(cls.machine_pass) >+ cls.machine_creds.set_username(cls.machine_name + "$") >+ cls.machine_creds.set_workstation(cls.machine_name) >+ >+ def _test_with_args(self, x, ct): >+ if ct == CredentialsType.User: >+ creds = self.user_creds >+ elif ct == CredentialsType.Machine: >+ creds = self.machine_creds >+ else: >+ raise Exception("Unexpected credential type") >+ data = TestData(x, creds) >+ >+ try: >+ (rep, as_rep) = self.as_req(data) >+ except pyasn1.error.PyAsn1Error as e: >+ import traceback >+ self.fail("ASN1 Error, Options {0:08b}:{1} {2}".format( >+ traceback.format_exc(), >+ data.options, >+ e)) >+ # If as_req triggered an expected server error response >+ # No need to test the response data. >+ if rep is not None: >+ # The kvno is optional, heimdal includes it >+ # MIT does not. >+ if 'kvno' in rep['enc-part']: >+ kvno = rep['enc-part']['kvno'] >+ self.check_kvno(kvno, data) >+ >+ cname = rep['cname'] >+ self.check_cname(cname, data) >+ >+ crealm = rep['crealm'].decode('ascii') >+ self.check_crealm(crealm, data) >+ >+ sname = as_rep['sname'] >+ self.check_sname(sname, data) >+ >+ srealm = as_rep['srealm'].decode('ascii') >+ self.check_srealm(srealm, data) >+ >+ def as_req(self, data): >+ user_creds = data.user_creds >+ realm = data.realm >+ >+ cname = data.cname >+ sname = data.sname >+ >+ till = self.get_KerberosTime(offset=36000) >+ >+ kdc_options = "0" >+ if data.canonicalize: >+ kdc_options = str(krb5_asn1.KDCOptions('canonicalize')) >+ >+ padata = None >+ >+ # Set the allowable encryption types >+ etypes = ( >+ AES256_CTS_HMAC_SHA1_96, >+ AES128_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5) >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=kdc_options, >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ # >+ # Check the protocol version, should be 5 >+ self.assertEqual( >+ rep['pvno'], 5, "Data {0}".format(str(data))) >+ >+ self.assertEqual( >+ rep['msg-type'], KRB_ERROR, "Data {0}".format(str(data))) >+ >+ # We should get KDC_ERR_PREAUTH_REQUIRED >+ # unless the RemoveDollar and Enterprise options are set >+ # then we should get a KDC_ERR_C_PRINCIPAL_UNKNOWN >+ if TestOptions.RemoveDollar.is_set(data.options) and\ >+ TestOptions.Enterprise.is_set(data.options): >+ self.assertEqual( >+ rep['error-code'], >+ KDC_ERR_C_PRINCIPAL_UNKNOWN, >+ "Error code {0}, Data {1}".format(rep['error-code'], str(data))) >+ return (None, None) >+ >+ self.assertEqual( >+ rep['error-code'], >+ KDC_ERR_PREAUTH_REQUIRED, >+ "Error code {0}, Data {1}".format(rep['error-code'], str(data))) >+ >+ rep_padata = self.der_decode( >+ rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) >+ >+ for pa in rep_padata: >+ if pa['padata-type'] == 19: >+ etype_info2 = pa['padata-value'] >+ break >+ >+ etype_info2 = self.der_decode( >+ etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ >+ key = self.PasswordKey_from_etype_info2(user_creds, etype_info2[0]) >+ >+ (patime, pausec) = self.get_KerberosTimeWithUsec() >+ pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) >+ >+ enc_pa_ts_usage = 1 >+ pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) >+ >+ pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts) >+ >+ kdc_options = "0" >+ if data.canonicalize: >+ kdc_options = str(krb5_asn1.KDCOptions('canonicalize')) >+ padata = [pa_ts] >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=kdc_options, >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ # >+ # Check the protocol version, should be 5 >+ self.assertEqual( >+ rep['pvno'], 5, "Data {0}".format(str(data))) >+ >+ msg_type = rep['msg-type'] >+ # Should not have got an error. >+ # If we did, fail and print the error code to help debugging >+ self.assertNotEqual( >+ msg_type, >+ KRB_ERROR, >+ "Error code {0}, Data {1}".format( >+ rep.get('error-code', ''), >+ str(data))) >+ >+ self.assertEqual(msg_type, KRB_AS_REP, "Data {0}".format(str(data))) >+ >+ # Decrypt and decode the EncKdcRepPart >+ enc = key.decrypt(3, rep['enc-part']['cipher']) >+ if enc[0] == 0x7A: >+ # MIT Kerberos Tags the EncASRepPart as a EncKDCRepPart >+ # i.e. tag number 26 instead of tag number 25 >+ as_rep = self.der_decode(enc, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ else: >+ as_rep = self.der_decode(enc, asn1Spec=krb5_asn1.EncASRepPart()) >+ >+ return (rep, as_rep) >+ >+ def check_cname(self, cname, data): >+ nt = cname['name-type'] >+ self.assertEqual( >+ NT_PRINCIPAL, >+ nt, >+ "cname name-type, Options {0:08b}".format(data.options)) >+ >+ ns = cname['name-string'] >+ name = ns[0].decode('ascii') >+ >+ expected = data.user_name >+ if TestOptions.Canonicalize.is_set(data.options): >+ expected = data.user_creds.get_username() >+ self.assertEqual( >+ expected, >+ name, >+ "cname principal, Options {0:08b}".format(data.options)) >+ >+ def check_crealm(self, crealm, data): >+ realm = data.user_creds.get_realm() >+ self.assertEqual( >+ realm, crealm, "crealm, Options {0:08b}".format(data.options)) >+ >+ def check_sname(self, sname, data): >+ nt = sname['name-type'] >+ self.assertEqual( >+ NT_SRV_INST, >+ nt, >+ "sname name-type, Options {0:08b}".format(data.options)) >+ >+ ns = sname['name-string'] >+ name = ns[0].decode('ascii') >+ self.assertEqual( >+ 'krbtgt', >+ name, >+ "sname principal, Options {0:08b}".format(data.options)) >+ >+ realm = ns[1].decode('ascii') >+ expected = data.realm >+ if TestOptions.Canonicalize.is_set(data.options): >+ expected = data.user_creds.get_realm().upper() >+ self.assertEqual( >+ expected, >+ realm, >+ "sname realm, Options {0:08b}".format(data.options)) >+ >+ def check_srealm(self, srealm, data): >+ realm = data.user_creds.get_realm() >+ self.assertEqual( >+ realm, srealm, "srealm, Options {0:08b}".format(data.options)) >+ >+ def check_kvno(self, kvno, data): >+ self.assertEqual( >+ 1, kvno, "kvno, Options {0:08b}".format(data.options)) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 89b5e957407..2f813760814 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -89,6 +89,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/simple_tests.py', > 'python/samba/tests/krb5/s4u_tests.py', > 'python/samba/tests/krb5/xrealm_tests.py', >+ 'python/samba/tests/krb5/as_canonicalization_tests.py', > } > > EXCLUDE_HELP = { >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index e69de29bb2d..96d3e51da5c 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -0,0 +1,144 @@ >+# >+# Currently MOST but not quite all the Canonicalization tests fail on the >+# MIT KDC >+# >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_Enterprise_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperRealm_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperRealm_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperRealm_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperRealm_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperRealm_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperRealm_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Canonicalize_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UpperRealm_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UpperRealm_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UpperRealm_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UpperRealm_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UpperUserName_UPN\( >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index b10ac26e964..78b1a8494f3 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -1284,6 +1284,7 @@ for env in ["rodc", "promoted_dc", "fl2000dc", "fl2008r2dc"]: > '--option=torture:expect_machine_account=true'] + extra_options, > "samba4.krb5.kdc with machine account") > >+planpythontestsuite("ad_dc", "samba.tests.krb5.as_canonicalization_tests") > > for env in [ > 'vampire_dc', >-- >2.25.1 > > >From 7189760a7c4bd64e8d360b2e569bd69ad2f92327 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 10 Nov 2020 11:09:13 +1300 >Subject: [PATCH 037/380] selftest: Send enterprise principals tagged as such > >This test passed against Samba but failed against Windows when >an enterprise principal (user@domain.com@REALM) was encoded as >NT_PRINCIPAL. > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d7f731ed3577b407370d8fe7a62b4c3ee2dd9c75) >--- > .../tests/krb5/as_canonicalization_tests.py | 24 ++++++-- > selftest/knownfail.d/kdc-enterprise | 57 +++++++++++++++++++ > selftest/knownfail_mit_kdc | 8 +++ > 3 files changed, 84 insertions(+), 5 deletions(-) > create mode 100644 selftest/knownfail.d/kdc-enterprise > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index 7b599ad6e44..3f8ed5c5a11 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -77,10 +77,16 @@ class TestData: > self.user_creds = creds > self.user_name = self.get_username(options, creds) > self.realm = self.get_realm(options, creds) >+ >+ if TestOptions.Enterprise.is_set(options): >+ client_name_type = NT_ENTERPRISE_PRINCIPAL >+ else: >+ client_name_type = NT_PRINCIPAL >+ > self.cname = RawKerberosTest.PrincipalName_create( >- name_type=1, names=[self.user_name]) >+ name_type=client_name_type, names=[self.user_name]) > self.sname = RawKerberosTest.PrincipalName_create( >- name_type=2, names=["krbtgt", self.realm]) >+ name_type=NT_SRV_INST, names=["krbtgt", self.realm]) > self.canonicalize = TestOptions.Canonicalize.is_set(options) > > def get_realm(self, options, creds): >@@ -143,6 +149,7 @@ KDC_ERR_PREAUTH_REQUIRED = 25 > NT_UNKNOWN = int(krb5_asn1.NameTypeValues('kRB5-NT-UNKNOWN')) > NT_PRINCIPAL = int(krb5_asn1.NameTypeValues('kRB5-NT-PRINCIPAL')) > NT_SRV_INST = int(krb5_asn1.NameTypeValues('kRB5-NT-SRV-INST')) >+NT_ENTERPRISE_PRINCIPAL = int(krb5_asn1.NameTypeValues('kRB5-NT-ENTERPRISE-PRINCIPAL')) > > > @DynamicTestCase >@@ -436,10 +443,17 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > return (rep, as_rep) > > def check_cname(self, cname, data): >- nt = cname['name-type'] >+ if TestOptions.Canonicalize.is_set(data.options): >+ expected_name_type = NT_PRINCIPAL >+ elif TestOptions.Enterprise.is_set(data.options): >+ expected_name_type = NT_ENTERPRISE_PRINCIPAL >+ else: >+ expected_name_type = NT_PRINCIPAL >+ >+ name_type = cname['name-type'] > self.assertEqual( >- NT_PRINCIPAL, >- nt, >+ expected_name_type, >+ name_type, > "cname name-type, Options {0:08b}".format(data.options)) > > ns = cname['name-string'] >diff --git a/selftest/knownfail.d/kdc-enterprise b/selftest/knownfail.d/kdc-enterprise >new file mode 100644 >index 00000000000..4e4f8a93e03 >--- /dev/null >+++ b/selftest/knownfail.d/kdc-enterprise >@@ -0,0 +1,57 @@ >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName_NetbiosRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName_UPN\( >+ >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 96d3e51da5c..9bac4737591 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -142,3 +142,11 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UpperUserName_NetbiosRealm\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UpperUserName_NetbiosRealm_UPN\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UpperUserName\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UpperUserName_UPN\( >-- >2.25.1 > > >From 31bffef894818d8012876d6b7b8d6d4f54905f2f Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 10 Nov 2020 11:09:59 +1300 >Subject: [PATCH 038/380] selftest: Fix flipped machine and user constants > >This naturally does not change the test, but reduces developer >confusion. > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 579a3c641c72b65f6ba39141a55c765b517bd7f8) >--- > python/samba/tests/krb5/as_canonicalization_tests.py | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index 3f8ed5c5a11..7cdf614482e 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -120,8 +120,8 @@ class TestData: > return rep > > >-MACHINE_NAME = "tstkrb5cnnusr" >-USER_NAME = "tstkrb5cnnmch" >+MACHINE_NAME = "tstkrb5cnnmch" >+USER_NAME = "tstkrb5cnnusr" > > # Encryption types > AES256_CTS_HMAC_SHA1_96 = int( >-- >2.25.1 > > >From 5f06624f40f9068f6ea94d585bb381c63c39f91a Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 10 Nov 2020 11:12:13 +1300 >Subject: [PATCH 039/380] selftest: Make as_canonicalization_tests.py easier to > run outside "make test" > >This takes the realm from the LDAP base DN and so avoids one >easy mistake to make. So far the NT4 domain name is not >auto-detected, so much be read from the smb.conf. > >By using .guess() the smb.conf is read for the unspecified >parts (eg workstation for an NTLM login to the LDAP server if >the target server is an IP address). > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d85e71f449037fa035fa2fae6b64caf695c53cb3) >--- > python/samba/tests/krb5/as_canonicalization_tests.py | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index 7cdf614482e..c0c3208d216 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -185,14 +185,20 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > cls.username = os.environ["USERNAME"] > cls.password = os.environ["PASSWORD"] > cls.domain = os.environ["DOMAIN"] >- cls.realm = os.environ["REALM"] > cls.host = os.environ["SERVER"] > > c = Credentials() > c.set_username(cls.username) > c.set_password(cls.password) > c.set_domain(cls.domain) >- c.set_realm(cls.realm) >+ try: >+ realm = os.environ["REALM"] >+ c.set_realm(realm) >+ except KeyError: >+ pass >+ >+ c.guess() >+ > cls.credentials = c > > cls.session = system_session() >@@ -236,6 +242,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > > cls.user_creds = Credentials() > cls.user_creds.guess(cls.lp) >+ cls.user_creds.set_realm(cls.ldb.domain_dns_name().upper()) > cls.user_creds.set_password(cls.user_pass) > cls.user_creds.set_username(cls.user_name) > cls.user_creds.set_workstation(cls.machine_name) >@@ -263,6 +270,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > > cls.machine_creds = Credentials() > cls.machine_creds.guess(cls.lp) >+ cls.machine_creds.set_realm(cls.ldb.domain_dns_name().upper()) > cls.machine_creds.set_secure_channel_type(SEC_CHAN_WKSTA) > cls.machine_creds.set_kerberos_state(DONT_USE_KERBEROS) > cls.machine_creds.set_password(cls.machine_pass) >-- >2.25.1 > > >From d3dd1fdcdf374101f3c9e30a5426fe99b382ecc3 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 10 Nov 2020 13:46:28 +1300 >Subject: [PATCH 040/380] samdb: Add samdb.domain_netbios_name() > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >[abartlet@samba.org: Backported from commit >d79218dbba3d0f26d6a0e22b3c91b0731bf641dd as this backport >to Samba 4.13 does not include 07ce48088824bba2054e029edfa6fbae972c1921 >(samba-tool: Create unix user with modified template homedir)] >--- > python/samba/netcmd/user.py | 10 ++-------- > python/samba/samdb.py | 15 +++++++++++++++ > python/samba/tests/samdb.py | 13 ++++++++++--- > selftest/tests.py | 1 + > 4 files changed, 28 insertions(+), 11 deletions(-) > >diff --git a/python/samba/netcmd/user.py b/python/samba/netcmd/user.py >index 26db3105da0..aa8e96a2581 100644 >--- a/python/samba/netcmd/user.py >+++ b/python/samba/netcmd/user.py >@@ -3001,14 +3001,8 @@ The users gecos field will be set to 'User4 test' > > if unix_home is None: > # obtain nETBIOS Domain Name >- filter = "(&(objectClass=crossRef)(nETBIOSName=*))" >- searchdn = ("CN=Partitions,CN=Configuration," + domaindn) >- try: >- res = samdb.search(searchdn, >- scope=ldb.SCOPE_SUBTREE, >- expression=filter) >- unix_domain = res[0]["nETBIOSName"][0] >- except IndexError: >+ unix_domain = samdb.domain_netbios_name() >+ if unix_domain is None: > raise CommandError('Unable to find Unix domain') > > unix_home = "/home/{0}/{1}".format(unix_domain, username) >diff --git a/python/samba/samdb.py b/python/samba/samdb.py >index d903babb406..e4030099b5c 100644 >--- a/python/samba/samdb.py >+++ b/python/samba/samdb.py >@@ -928,6 +928,21 @@ accountExpires: %u > domain_dn = self.get_default_basedn() > return domain_dn.canonical_str().split('/')[0] > >+ def domain_netbios_name(self): >+ """return the NetBIOS name of the domain root""" >+ domain_dn = self.get_default_basedn() >+ dns_name = self.domain_dns_name() >+ filter = "(&(objectClass=crossRef)(nETBIOSName=*)(ncName=%s)(dnsroot=%s))" % (domain_dn, dns_name) >+ partitions_dn = self.get_partitions_dn() >+ res = self.search(partitions_dn, >+ scope=ldb.SCOPE_ONELEVEL, >+ expression=filter) >+ try: >+ netbios_domain = res[0]["nETBIOSName"][0].decode() >+ except IndexError: >+ return None >+ return netbios_domain >+ > def forest_dns_name(self): > """return the DNS name of the forest root""" > forest_dn = self.get_root_basedn() >diff --git a/python/samba/tests/samdb.py b/python/samba/tests/samdb.py >index a185a1566e3..834c5a204a6 100644 >--- a/python/samba/tests/samdb.py >+++ b/python/samba/tests/samdb.py >@@ -38,13 +38,13 @@ class SamDBTestCase(TestCaseInTempDir): > super(SamDBTestCase, self).setUp() > self.session = system_session() > logger = logging.getLogger("selftest") >- domain = "dsdb" >- realm = "dsdb.samba.example.com" >+ self.domain = "dsdb" >+ self.realm = "dsdb.samba.example.com" > host_name = "test" > server_role = "active directory domain controller" > self.result = provision(logger, > self.session, targetdir=self.tempdir, >- realm=realm, domain=domain, >+ realm=self.realm, domain=self.domain, > hostname=host_name, > use_ntvfs=True, > serverrole=server_role, >@@ -61,3 +61,10 @@ class SamDBTestCase(TestCaseInTempDir): > shutil.rmtree(os.path.join(self.tempdir, d)) > > super(SamDBTestCase, self).tearDown() >+ >+ >+class SamDBTests(SamDBTestCase): >+ >+ def test_get_domain(self): >+ self.assertEqual(self.samdb.domain_dns_name(), self.realm.lower()) >+ self.assertEqual(self.samdb.domain_netbios_name(), self.domain.upper()) >diff --git a/selftest/tests.py b/selftest/tests.py >index 91c75b0ebed..b9b95d800cc 100644 >--- a/selftest/tests.py >+++ b/selftest/tests.py >@@ -211,6 +211,7 @@ planpythontestsuite("none", "samba.tests.graph") > plantestsuite("wafsamba.duplicate_symbols", "none", [os.path.join(srcdir(), "buildtools/wafsamba/test_duplicate_symbol.sh")]) > planpythontestsuite("none", "samba.tests.glue") > planpythontestsuite("none", "samba.tests.tdb_util") >+planpythontestsuite("none", "samba.tests.samdb") > planpythontestsuite("none", "samba.tests.samdb_api") > > if with_pam: >-- >2.25.1 > > >From 8bbaf0e3a3d44ffc727b4288b37bb01583c1adb2 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 10 Nov 2020 13:47:30 +1300 >Subject: [PATCH 041/380] selftest: Make as_canonicalization_tests.py > auto-detect the NT4 domain name > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 2693f12fbe321e0f4932b1f74d7006dbac140e8e) >--- > python/samba/tests/krb5/as_canonicalization_tests.py | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index c0c3208d216..221ff486fd8 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -184,18 +184,21 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > cls.lp = cls.get_loadparm(cls) > cls.username = os.environ["USERNAME"] > cls.password = os.environ["PASSWORD"] >- cls.domain = os.environ["DOMAIN"] > cls.host = os.environ["SERVER"] > > c = Credentials() > c.set_username(cls.username) > c.set_password(cls.password) >- c.set_domain(cls.domain) > try: > realm = os.environ["REALM"] > c.set_realm(realm) > except KeyError: > pass >+ try: >+ domain = os.environ["DOMAIN"] >+ c.set_domain(domain) >+ except KeyError: >+ pass > > c.guess() > >@@ -243,6 +246,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > cls.user_creds = Credentials() > cls.user_creds.guess(cls.lp) > cls.user_creds.set_realm(cls.ldb.domain_dns_name().upper()) >+ cls.user_creds.set_domain(cls.ldb.domain_netbios_name().upper()) > cls.user_creds.set_password(cls.user_pass) > cls.user_creds.set_username(cls.user_name) > cls.user_creds.set_workstation(cls.machine_name) >@@ -271,6 +275,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > cls.machine_creds = Credentials() > cls.machine_creds.guess(cls.lp) > cls.machine_creds.set_realm(cls.ldb.domain_dns_name().upper()) >+ cls.machine_creds.set_domain(cls.ldb.domain_netbios_name().upper()) > cls.machine_creds.set_secure_channel_type(SEC_CHAN_WKSTA) > cls.machine_creds.set_kerberos_state(DONT_USE_KERBEROS) > cls.machine_creds.set_password(cls.machine_pass) >-- >2.25.1 > > >From 648c162e4a15a179ca15b294290e0511288bff28 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 10 Nov 2020 11:21:24 +1300 >Subject: [PATCH 042/380] selftest: Fix formatting of failure (traceback and > options swapped in format string) > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit ab8c0a181bebe17a597af49790f6e7b17e13c29b) >--- > python/samba/tests/krb5/as_canonicalization_tests.py | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index 221ff486fd8..f0e9f6307f6 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -296,8 +296,8 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > except pyasn1.error.PyAsn1Error as e: > import traceback > self.fail("ASN1 Error, Options {0:08b}:{1} {2}".format( >- traceback.format_exc(), > data.options, >+ traceback.format_exc(), > e)) > # If as_req triggered an expected server error response > # No need to test the response data. >-- >2.25.1 > > >From 2b43617bc7e44ef231a79dc1e5b51eda9f88d78c Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 10 Nov 2020 11:27:06 +1300 >Subject: [PATCH 043/380] selftest: Add in encrypted-pa-data from RFC 6806 > >This comes from Windows 2019 which supports FAST. > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit fc77ece0e2b5fd324809e17a9b208cc7854cee4b) >--- > python/samba/tests/krb5/rfc4120.asn1 | 3 ++- > python/samba/tests/krb5/rfc4120_pyasn1.py | 19 ++++++++++--------- > 2 files changed, 12 insertions(+), 10 deletions(-) > >diff --git a/python/samba/tests/krb5/rfc4120.asn1 b/python/samba/tests/krb5/rfc4120.asn1 >index 58e0c1636a1..654f9788ca7 100644 >--- a/python/samba/tests/krb5/rfc4120.asn1 >+++ b/python/samba/tests/krb5/rfc4120.asn1 >@@ -239,7 +239,8 @@ EncKDCRepPart ::= SEQUENCE { > renew-till [8] KerberosTime OPTIONAL, > srealm [9] Realm, > sname [10] PrincipalName, >- caddr [11] HostAddresses OPTIONAL >+ caddr [11] HostAddresses OPTIONAL, >+ encrypted-pa-data[12] METHOD-DATA OPTIONAL > } > > LastReq ::= SEQUENCE OF SEQUENCE { >diff --git a/python/samba/tests/krb5/rfc4120_pyasn1.py b/python/samba/tests/krb5/rfc4120_pyasn1.py >index b4ea678afd8..1d89f94adf1 100644 >--- a/python/samba/tests/krb5/rfc4120_pyasn1.py >+++ b/python/samba/tests/krb5/rfc4120_pyasn1.py >@@ -1,5 +1,5 @@ > # Auto-generated by asn1ate v.0.6.1.dev0 from rfc4120.asn1 >-# (last modified on 2020-11-03 14:07:15.270009) >+# (last modified on 2020-11-06 11:30:42.476808) > > # KerberosV5Spec2 > from pyasn1.type import univ, char, namedtype, namedval, tag, constraint, useful >@@ -438,6 +438,13 @@ LastReq.componentType = univ.Sequence(componentType=namedtype.NamedTypes( > )) > > >+class METHOD_DATA(univ.SequenceOf): >+ pass >+ >+ >+METHOD_DATA.componentType = PA_DATA() >+ >+ > class TicketFlags(KerberosFlags): > pass > >@@ -458,7 +465,8 @@ EncKDCRepPart.componentType = namedtype.NamedTypes( > namedtype.OptionalNamedType('renew-till', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 8))), > namedtype.NamedType('srealm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 9))), > namedtype.NamedType('sname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 10))), >- namedtype.OptionalNamedType('caddr', HostAddresses().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 11))) >+ namedtype.OptionalNamedType('caddr', HostAddresses().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 11))), >+ namedtype.OptionalNamedType('encrypted-pa-data', METHOD_DATA().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 12))) > ) > > >@@ -702,13 +710,6 @@ KRB_SAFE.componentType = namedtype.NamedTypes( > ) > > >-class METHOD_DATA(univ.SequenceOf): >- pass >- >- >-METHOD_DATA.componentType = PA_DATA() >- >- > class MessageTypeValues(univ.Integer): > pass > >-- >2.25.1 > > >From d8fd226773b933a662943d5200efc67528324354 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 10 Nov 2020 13:50:37 +1300 >Subject: [PATCH 044/380] selftest: Windows 2019 implements the RemoveDollar > behaviour for Enterprise principals > >This is documented in MS-KILE. > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Autobuild-User(master): Gary Lockyer <gary@samba.org> >Autobuild-Date(master): Wed Nov 11 02:38:46 UTC 2020 on sn-devel-184 > >(cherry picked from commit f214a3ba5a3e9f129f10062392ae03edd62d8186) >--- > .../tests/krb5/as_canonicalization_tests.py | 11 ---------- > selftest/knownfail.d/kdc-enterprise | 20 ------------------- > selftest/knownfail_mit_kdc | 20 +++++++++++++++++++ > 3 files changed, 20 insertions(+), 31 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index f0e9f6307f6..caa186bed41 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -366,17 +366,6 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > self.assertEqual( > rep['msg-type'], KRB_ERROR, "Data {0}".format(str(data))) > >- # We should get KDC_ERR_PREAUTH_REQUIRED >- # unless the RemoveDollar and Enterprise options are set >- # then we should get a KDC_ERR_C_PRINCIPAL_UNKNOWN >- if TestOptions.RemoveDollar.is_set(data.options) and\ >- TestOptions.Enterprise.is_set(data.options): >- self.assertEqual( >- rep['error-code'], >- KDC_ERR_C_PRINCIPAL_UNKNOWN, >- "Error code {0}, Data {1}".format(rep['error-code'], str(data))) >- return (None, None) >- > self.assertEqual( > rep['error-code'], > KDC_ERR_PREAUTH_REQUIRED, >diff --git a/selftest/knownfail.d/kdc-enterprise b/selftest/knownfail.d/kdc-enterprise >index 4e4f8a93e03..d15d67c8af6 100644 >--- a/selftest/knownfail.d/kdc-enterprise >+++ b/selftest/knownfail.d/kdc-enterprise >@@ -1,19 +1,3 @@ >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm_UPN_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UPN_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_UPN_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UPN_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_UPN_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_UPN_RemoveDollar\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_RemoveDollar\( >@@ -26,14 +10,10 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_RemoveDollar\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UPN_RemoveDollar\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_RemoveDollar\( >-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_UPN_RemoveDollar\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_RemoveDollar\( >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 9bac4737591..00edbc0c34d 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -150,3 +150,23 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UPN\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UpperUserName\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UpperUserName_UPN\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UPN_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_RemoveDollar\( >+samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_UPN_RemoveDollar\( >-- >2.25.1 > > >From a87cfead30a4f630aaa5e22ccb8b3646bb94e989 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Wed, 4 Nov 2020 13:54:46 +1300 >Subject: [PATCH 045/380] selftest: add heimdal kdc specific known fail > >Add a heimdal kerberos specific known fail, will be needed by subsequent >commits. > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 5cb5134377f099353e0f91c44cc11e45d548d40f) >--- > selftest/knownfail_heimdal_kdc | 0 > selftest/wscript | 3 +++ > 2 files changed, 3 insertions(+) > create mode 100644 selftest/knownfail_heimdal_kdc > >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >new file mode 100644 >index 00000000000..e69de29bb2d >diff --git a/selftest/wscript b/selftest/wscript >index 95086b4f0ed..82354071d5b 100644 >--- a/selftest/wscript >+++ b/selftest/wscript >@@ -265,6 +265,9 @@ def cmd_testonly(opt): > env.OPTIONS += " --mitkrb5 --exclude=${srcdir}/selftest/skip_mit_kdc" > env.FILTER_XFAIL += " --expected-failures=${srcdir}/selftest/"\ > "knownfail_mit_kdc" >+ else: >+ env.FILTER_XFAIL += " --expected-failures=${srcdir}/selftest/"\ >+ "knownfail_heimdal_kdc" > > if not CONFIG_GET(opt, 'HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X'): > # older MIT krb5 libraries (< 1.14) don't have >-- >2.25.1 > > >From 2fe18d5ebb4af139bed09d9ea8718aac901b9e9b Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Wed, 4 Nov 2020 13:58:24 +1300 >Subject: [PATCH 046/380] tests python krb5: Add python kerberos compatability > tests > >Add new python test to document the differences between the MIT and >Heimdal Kerberos implementations. > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 1e1d8b9c83f32c06ecab31214a20b77529ee038e) >--- > .../samba/tests/krb5/compatability_tests.py | 174 ++++++++++++++++++ > python/samba/tests/usage.py | 1 + > selftest/knownfail_heimdal_kdc | 4 + > selftest/knownfail_mit_kdc | 4 + > source4/selftest/tests.py | 1 + > 5 files changed, 184 insertions(+) > create mode 100755 python/samba/tests/krb5/compatability_tests.py > >diff --git a/python/samba/tests/krb5/compatability_tests.py b/python/samba/tests/krb5/compatability_tests.py >new file mode 100755 >index 00000000000..63bd5269c2b >--- /dev/null >+++ b/python/samba/tests/krb5/compatability_tests.py >@@ -0,0 +1,174 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# Copyright (C) Catalyst.Net Ltd 2020 >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+from samba.tests.krb5.raw_testcase import RawKerberosTest >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class SimpleKerberosTests(RawKerberosTest): >+ >+ def setUp(self): >+ super(SimpleKerberosTests, self).setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ def test_mit_EncASRepPart_tag(self): >+ creds = self.get_user_creds() >+ (enc, _) = self.as_req(creds) >+ self.assertEqual(0x7a, enc[0]) >+ >+ def test_heimdal_EncASRepPart_tag(self): >+ creds = self.get_user_creds() >+ (enc, _) = self.as_req(creds) >+ self.assertEqual(0x79, enc[0]) >+ >+ def test_mit_EncryptedData_kvno(self): >+ creds = self.get_user_creds() >+ (_, enc) = self.as_req(creds) >+ if 'kvno' in enc: >+ self.fail("kvno present in EncryptedData") >+ >+ def test_heimdal_EncryptedData_kvno(self): >+ creds = self.get_user_creds() >+ (_, enc) = self.as_req(creds) >+ if 'kvno' not in enc: >+ self.fail("kvno absent in EncryptedData") >+ >+ def test_mit_EncASRepPart_FAST_support(self): >+ creds = self.get_user_creds() >+ (enc, _) = self.as_req(creds) >+ self.assertEqual(0x7A, enc[0]) >+ as_rep = self.der_decode(enc, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ flags = int(as_rep['flags'], base=2) >+ # MIT sets enc-pa-rep, flag bit 15 >+ # RFC 6806 11. Negotiation of FAST and Detecting Modified Requests >+ self.assertTrue(0x00010000 & flags) >+ >+ def test_heimdal_EncASRepPart_FAST_support(self): >+ creds = self.get_user_creds() >+ (enc, _) = self.as_req(creds) >+ self.assertEqual(0x79, enc[0]) >+ as_rep = self.der_decode(enc, asn1Spec=krb5_asn1.EncASRepPart()) >+ flags = as_rep['flags'] >+ flags = int(as_rep['flags'], base=2) >+ # Heimdal does not set enc-pa-rep, flag bit 15 >+ # RFC 6806 11. Negotiation of FAST and Detecting Modified Requests >+ self.assertFalse(0x00010000 & flags) >+ >+ def as_req(self, creds): >+ user = creds.get_username() >+ realm = creds.get_realm() >+ >+ cname = self.PrincipalName_create(name_type=1, names=[user]) >+ sname = self.PrincipalName_create(name_type=2, names=["krbtgt", realm]) >+ >+ till = self.get_KerberosTime(offset=36000) >+ >+ kdc_options = krb5_asn1.KDCOptions('forwardable') >+ padata = None >+ >+ etypes = (18, 17, 23) >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ self.assertEqual(rep['msg-type'], 30) >+ self.assertEqual(rep['error-code'], 25) >+ rep_padata = self.der_decode( >+ rep['e-data'], >+ asn1Spec=krb5_asn1.METHOD_DATA()) >+ >+ for pa in rep_padata: >+ if pa['padata-type'] == 19: >+ etype_info2 = pa['padata-value'] >+ break >+ >+ etype_info2 = self.der_decode( >+ etype_info2, >+ asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ >+ key = self.PasswordKey_from_etype_info2(creds, etype_info2[0]) >+ >+ (patime, pausec) = self.get_KerberosTimeWithUsec() >+ pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) >+ >+ enc_pa_ts_usage = 1 >+ pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) >+ >+ pa_ts = self.PA_DATA_create(2, pa_ts) >+ >+ kdc_options = krb5_asn1.KDCOptions('forwardable') >+ padata = [pa_ts] >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ msg_type = rep['msg-type'] >+ self.assertEqual(msg_type, 11) >+ >+ usage = 3 >+ enc_part = rep['enc-part'] >+ enc_as_rep_part = key.decrypt(usage, rep['enc-part']['cipher']) >+ return (enc_as_rep_part, enc_part) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 2f813760814..fbb9a06d99e 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -90,6 +90,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/s4u_tests.py', > 'python/samba/tests/krb5/xrealm_tests.py', > 'python/samba/tests/krb5/as_canonicalization_tests.py', >+ 'python/samba/tests/krb5/compatability_tests.py', > } > > EXCLUDE_HELP = { >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index e69de29bb2d..7ab56b6721b 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -0,0 +1,4 @@ >+# >+# We expect all the MIT specific compatability tests to fail on heimdal >+# kerberos >+^samba.tests.krb5.compatability_tests.samba.tests.krb5.compatability_tests.SimpleKerberosTests.test_mit_ >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 00edbc0c34d..9953d51f21d 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -1,4 +1,8 @@ > # >+# We expect all the heimdal specific compatability tests to fail on MIT >+# kerberos >+^samba.tests.krb5.compatability_tests.samba.tests.krb5.compatability_tests.SimpleKerberosTests.test_heimdal_ >+# > # Currently MOST but not quite all the Canonicalization tests fail on the > # MIT KDC > # >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 78b1a8494f3..76828e27d66 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -1285,6 +1285,7 @@ for env in ["rodc", "promoted_dc", "fl2000dc", "fl2008r2dc"]: > "samba4.krb5.kdc with machine account") > > planpythontestsuite("ad_dc", "samba.tests.krb5.as_canonicalization_tests") >+planpythontestsuite("ad_dc", "samba.tests.krb5.compatability_tests") > > for env in [ > 'vampire_dc', >-- >2.25.1 > > >From 03911f9334e64ca0a7412613f5332270a73dd3ee Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Tue, 10 Nov 2020 11:19:02 +1300 >Subject: [PATCH 047/380] tests python krb5: Add constants module > >Extract the constants used in the tests into a separate module. >To reduce code duplication > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 532c941fbb8fc5fc5da4aa2d0e170229076e9aa7) >--- > python/samba/tests/krb5/rfc4120_constants.py | 49 ++++++++++++++++++++ > python/samba/tests/usage.py | 1 + > 2 files changed, 50 insertions(+) > create mode 100644 python/samba/tests/krb5/rfc4120_constants.py > >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >new file mode 100644 >index 00000000000..e939bb75e82 >--- /dev/null >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -0,0 +1,49 @@ >+# Unix SMB/CIFS implementation. >+# Copyright (C) 2020 Catalyst.Net Ltd >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+ >+# Encryption types >+AES256_CTS_HMAC_SHA1_96 = int( >+ krb5_asn1.EncryptionTypeValues('kRB5-ENCTYPE-AES256-CTS-HMAC-SHA1-96')) >+AES128_CTS_HMAC_SHA1_96 = int( >+ krb5_asn1.EncryptionTypeValues('kRB5-ENCTYPE-AES128-CTS-HMAC-SHA1-96')) >+ARCFOUR_HMAC_MD5 = int( >+ krb5_asn1.EncryptionTypeValues('kRB5-ENCTYPE-ARCFOUR-HMAC-MD5')) >+ >+# Message types >+KRB_ERROR = int(krb5_asn1.MessageTypeValues('krb-error')) >+KRB_AS_REP = int(krb5_asn1.MessageTypeValues('krb-as-rep')) >+ >+# PAData types >+PADATA_ENC_TIMESTAMP = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-ENC-TIMESTAMP')) >+PADATA_ETYPE_INFO2 = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-ETYPE-INFO2')) >+ >+# Error codes >+KDC_ERR_C_PRINCIPAL_UNKNOWN = 6 >+KDC_ERR_PREAUTH_FAILED = 24 >+KDC_ERR_PREAUTH_REQUIRED = 25 >+KDC_ERR_SKEW = 37 >+ >+# Name types >+NT_UNKNOWN = int(krb5_asn1.NameTypeValues('kRB5-NT-UNKNOWN')) >+NT_PRINCIPAL = int(krb5_asn1.NameTypeValues('kRB5-NT-PRINCIPAL')) >+NT_SRV_INST = int(krb5_asn1.NameTypeValues('kRB5-NT-SRV-INST')) >+NT_ENTERPRISE_PRINCIPAL = int(krb5_asn1.NameTypeValues( >+ 'kRB5-NT-ENTERPRISE-PRINCIPAL')) >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index fbb9a06d99e..536721a1f86 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -91,6 +91,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/xrealm_tests.py', > 'python/samba/tests/krb5/as_canonicalization_tests.py', > 'python/samba/tests/krb5/compatability_tests.py', >+ 'python/samba/tests/krb5/rfc4120_constants.py', > } > > EXCLUDE_HELP = { >-- >2.25.1 > > >From a4f77bd26a05784e93090b3721ebd1529aea2cb4 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Tue, 10 Nov 2020 11:20:03 +1300 >Subject: [PATCH 048/380] tests python krb5: Refactor canonicalization test > constants > >Modify tests to use the constants defined in rfc4120_constants.py > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 97b830cbcac53fcf49bbcd272812d1ba019bac51) >--- > .../tests/krb5/as_canonicalization_tests.py | 30 +------------------ > 1 file changed, 1 insertion(+), 29 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index caa186bed41..303788b672e 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -41,6 +41,7 @@ from samba.dsdb import ( > UF_NORMAL_ACCOUNT) > from samba.samdb import SamDB > from samba.tests import delete_force, DynamicTestCase >+from samba.tests.krb5.rfc4120_constants import * > > global_asn1_print = False > global_hexdump = False >@@ -123,35 +124,6 @@ class TestData: > MACHINE_NAME = "tstkrb5cnnmch" > USER_NAME = "tstkrb5cnnusr" > >-# Encryption types >-AES256_CTS_HMAC_SHA1_96 = int( >- krb5_asn1.EncryptionTypeValues('kRB5-ENCTYPE-AES256-CTS-HMAC-SHA1-96')) >-AES128_CTS_HMAC_SHA1_96 = int( >- krb5_asn1.EncryptionTypeValues('kRB5-ENCTYPE-AES128-CTS-HMAC-SHA1-96')) >-ARCFOUR_HMAC_MD5 = int( >- krb5_asn1.EncryptionTypeValues('kRB5-ENCTYPE-ARCFOUR-HMAC-MD5')) >- >-# Message types >-KRB_ERROR = int(krb5_asn1.MessageTypeValues('krb-error')) >-KRB_AS_REP = int(krb5_asn1.MessageTypeValues('krb-as-rep')) >- >-# PAData types >-PADATA_ENC_TIMESTAMP = int( >- krb5_asn1.PADataTypeValues('kRB5-PADATA-ENC-TIMESTAMP')) >-PADATA_ETYPE_INFO2 = int( >- krb5_asn1.PADataTypeValues('kRB5-PADATA-ETYPE-INFO2')) >- >-# Error codes >-KDC_ERR_C_PRINCIPAL_UNKNOWN = 6 >-KDC_ERR_PREAUTH_REQUIRED = 25 >- >-# Name types >-NT_UNKNOWN = int(krb5_asn1.NameTypeValues('kRB5-NT-UNKNOWN')) >-NT_PRINCIPAL = int(krb5_asn1.NameTypeValues('kRB5-NT-PRINCIPAL')) >-NT_SRV_INST = int(krb5_asn1.NameTypeValues('kRB5-NT-SRV-INST')) >-NT_ENTERPRISE_PRINCIPAL = int(krb5_asn1.NameTypeValues('kRB5-NT-ENTERPRISE-PRINCIPAL')) >- >- > @DynamicTestCase > class KerberosASCanonicalizationTests(RawKerberosTest): > >-- >2.25.1 > > >From 93f1e420cf2d6d01aeb96b47fca5c6bea799a6f5 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Tue, 10 Nov 2020 11:20:58 +1300 >Subject: [PATCH 049/380] tests python krb5: Refactor compatability test > constants > >Modify tests to use the constants defined in rfc4120_constants.py > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 82a413f48b7ef71feb68fc34f7ca753d45eb8974) >--- > .../samba/tests/krb5/compatability_tests.py | 42 ++++++++++++------- > 1 file changed, 28 insertions(+), 14 deletions(-) > >diff --git a/python/samba/tests/krb5/compatability_tests.py b/python/samba/tests/krb5/compatability_tests.py >index 63bd5269c2b..bf561346ab3 100755 >--- a/python/samba/tests/krb5/compatability_tests.py >+++ b/python/samba/tests/krb5/compatability_tests.py >@@ -25,10 +25,17 @@ os.environ["PYTHONUNBUFFERED"] = "1" > > from samba.tests.krb5.raw_testcase import RawKerberosTest > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+from samba.tests.krb5.rfc4120_constants import * > > global_asn1_print = False > global_hexdump = False > >+HIEMDAL_ENC_AS_REP_PART_TYPE_TAG = 0x79 >+# MIT uses the EncTGSRepPart tag for the EncASRepPart >+MIT_ENC_AS_REP_PART_TYPE_TAG = 0x7A >+ >+ENC_PA_REP_FLAG = 0x00010000 >+ > > class SimpleKerberosTests(RawKerberosTest): > >@@ -40,12 +47,12 @@ class SimpleKerberosTests(RawKerberosTest): > def test_mit_EncASRepPart_tag(self): > creds = self.get_user_creds() > (enc, _) = self.as_req(creds) >- self.assertEqual(0x7a, enc[0]) >+ self.assertEqual(MIT_ENC_AS_REP_PART_TYPE_TAG, enc[0]) > > def test_heimdal_EncASRepPart_tag(self): > creds = self.get_user_creds() > (enc, _) = self.as_req(creds) >- self.assertEqual(0x79, enc[0]) >+ self.assertEqual(HIEMDAL_ENC_AS_REP_PART_TYPE_TAG, enc[0]) > > def test_mit_EncryptedData_kvno(self): > creds = self.get_user_creds() >@@ -62,37 +69,44 @@ class SimpleKerberosTests(RawKerberosTest): > def test_mit_EncASRepPart_FAST_support(self): > creds = self.get_user_creds() > (enc, _) = self.as_req(creds) >- self.assertEqual(0x7A, enc[0]) >+ self.assertEqual(MIT_ENC_AS_REP_PART_TYPE_TAG, enc[0]) > as_rep = self.der_decode(enc, asn1Spec=krb5_asn1.EncTGSRepPart()) > flags = int(as_rep['flags'], base=2) > # MIT sets enc-pa-rep, flag bit 15 > # RFC 6806 11. Negotiation of FAST and Detecting Modified Requests >- self.assertTrue(0x00010000 & flags) >+ self.assertTrue(ENC_PA_REP_FLAG & flags) > > def test_heimdal_EncASRepPart_FAST_support(self): > creds = self.get_user_creds() > (enc, _) = self.as_req(creds) >- self.assertEqual(0x79, enc[0]) >+ self.assertEqual(HIEMDAL_ENC_AS_REP_PART_TYPE_TAG, enc[0]) > as_rep = self.der_decode(enc, asn1Spec=krb5_asn1.EncASRepPart()) > flags = as_rep['flags'] > flags = int(as_rep['flags'], base=2) > # Heimdal does not set enc-pa-rep, flag bit 15 > # RFC 6806 11. Negotiation of FAST and Detecting Modified Requests >- self.assertFalse(0x00010000 & flags) >+ self.assertFalse(ENC_PA_REP_FLAG & flags) > > def as_req(self, creds): > user = creds.get_username() > realm = creds.get_realm() > >- cname = self.PrincipalName_create(name_type=1, names=[user]) >- sname = self.PrincipalName_create(name_type=2, names=["krbtgt", realm]) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[user]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, >+ names=["krbtgt", realm]) > > till = self.get_KerberosTime(offset=36000) > > kdc_options = krb5_asn1.KDCOptions('forwardable') > padata = None > >- etypes = (18, 17, 23) >+ etypes = ( >+ AES256_CTS_HMAC_SHA1_96, >+ AES128_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5) > > req = self.AS_REQ_create(padata=padata, > kdc_options=str(kdc_options), >@@ -111,14 +125,14 @@ class SimpleKerberosTests(RawKerberosTest): > rep = self.send_recv_transaction(req) > self.assertIsNotNone(rep) > >- self.assertEqual(rep['msg-type'], 30) >- self.assertEqual(rep['error-code'], 25) >+ self.assertEqual(rep['msg-type'], KRB_ERROR) >+ self.assertEqual(rep['error-code'], KDC_ERR_PREAUTH_REQUIRED) > rep_padata = self.der_decode( > rep['e-data'], > asn1Spec=krb5_asn1.METHOD_DATA()) > > for pa in rep_padata: >- if pa['padata-type'] == 19: >+ if pa['padata-type'] == PADATA_ETYPE_INFO2: > etype_info2 = pa['padata-value'] > break > >@@ -136,7 +150,7 @@ class SimpleKerberosTests(RawKerberosTest): > pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) > >- pa_ts = self.PA_DATA_create(2, pa_ts) >+ pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts) > > kdc_options = krb5_asn1.KDCOptions('forwardable') > padata = [pa_ts] >@@ -159,7 +173,7 @@ class SimpleKerberosTests(RawKerberosTest): > self.assertIsNotNone(rep) > > msg_type = rep['msg-type'] >- self.assertEqual(msg_type, 11) >+ self.assertEqual(msg_type, KRB_AS_REP) > > usage = 3 > enc_part = rep['enc-part'] >-- >2.25.1 > > >From 0186a9dda5e3b7a4e312efe1742d2f231ebff9b4 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Tue, 10 Nov 2020 13:51:39 +1300 >Subject: [PATCH 050/380] tests python krb5: raw_testcase permit RC4 salts > >MIT kerberos returns a salt when ARCFOUR_HMAC_MD5, this commit removes >the check that a salt is not returned. A test for the difference >between MIT and Heimdal will be added in the subsequent commits. > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 1bab87c50baf0fecb5d4cd09e1a9896730c6377e) >--- > python/samba/tests/krb5/raw_testcase.py | 1 - > 1 file changed, 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 45e46e0b7ba..e67f5464e59 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -425,7 +425,6 @@ class RawKerberosTest(TestCase): > pass > > if e == kcrypto.Enctype.RC4: >- self.assertIsNone(salt) > nthash = creds.get_nt_hash() > return self.SessionKey_create(etype=e, contents=nthash, kvno=kvno) > >-- >2.25.1 > > >From 74f23242a07b722a0fe472d23a5b8d609dc532cc Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Fri, 6 Nov 2020 09:07:04 +1300 >Subject: [PATCH 051/380] tests python krb5: Convert kdc-heimdal to python > >Implement the tests in source4/torture/krb5/kdc-heimdal.c in python. >The following tests were not re-implemented as they are client side >tests for the "Orpheus Lyre" attack: > TORTURE_KRB5_TEST_CHANGE_SERVER_OUT > TORTURE_KRB5_TEST_CHANGE_SERVER_IN > TORTURE_KRB5_TEST_CHANGE_SERVER_BOTH > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit a00a1c9745033dae05eee17cfa4e2c5354a81e68) >--- > python/samba/tests/krb5/kdc_tests.py | 219 +++++++++++++++++++++++++++ > python/samba/tests/usage.py | 1 + > source4/selftest/tests.py | 1 + > 3 files changed, 221 insertions(+) > create mode 100755 python/samba/tests/krb5/kdc_tests.py > >diff --git a/python/samba/tests/krb5/kdc_tests.py b/python/samba/tests/krb5/kdc_tests.py >new file mode 100755 >index 00000000000..57a25448965 >--- /dev/null >+++ b/python/samba/tests/krb5/kdc_tests.py >@@ -0,0 +1,219 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# Copyright (C) 2020 Catalyst.Net Ltd >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+from samba.tests.krb5.raw_testcase import RawKerberosTest >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+from samba.tests.krb5.rfc4120_constants import * >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class KdcTests(RawKerberosTest): >+ """ Port of the tests in source4/torture/krb5/kdc-heimdal.c >+ To python. >+ """ >+ >+ def setUp(self): >+ super(KdcTests, self).setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ def as_req(self, creds, etypes, padata=None): >+ user = creds.get_username() >+ realm = creds.get_realm() >+ >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[user]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, >+ names=["krbtgt", realm]) >+ till = self.get_KerberosTime(offset=36000) >+ >+ kdc_options = 0 >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ return rep >+ >+ def get_pa_data(self, creds, rep, skew=0): >+ rep_padata = self.der_decode( >+ rep['e-data'], >+ asn1Spec=krb5_asn1.METHOD_DATA()) >+ >+ for pa in rep_padata: >+ if pa['padata-type'] == PADATA_ETYPE_INFO2: >+ etype_info2 = pa['padata-value'] >+ break >+ >+ etype_info2 = self.der_decode( >+ etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ >+ key = self.PasswordKey_from_etype_info2(creds, etype_info2[0]) >+ >+ (patime, pausec) = self.get_KerberosTimeWithUsec(offset=skew) >+ pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) >+ >+ enc_pa_ts_usage = 1 >+ pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) >+ >+ pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts) >+ >+ padata = [pa_ts] >+ return padata >+ >+ def check_pre_authenication(self, rep): >+ """ Check that the kdc response was pre-authentication required >+ """ >+ self.check_error_rep(rep, KDC_ERR_PREAUTH_REQUIRED) >+ >+ def check_as_reply(self, rep): >+ """ Check that the kdc response is an AS-REP and that the >+ values for: >+ msg-type >+ pvno >+ tkt-pvno >+ kvno >+ match the expected values >+ """ >+ >+ # Should have a reply, and it should an AS-REP message. >+ self.assertIsNotNone(rep) >+ self.assertEqual(rep['msg-type'], KRB_AS_REP) >+ >+ # Protocol version number should be 5 >+ pvno = int(rep['pvno']) >+ self.assertEqual(5, pvno) >+ >+ # The ticket version number should be 5 >+ tkt_vno = int(rep['ticket']['tkt-vno']) >+ self.assertEqual(5, tkt_vno) >+ >+ # Check that the kvno is not an RODC kvno >+ # MIT kerberos does not provide the kvno, so we treat it as optional. >+ # This is tested in compatability_test.py >+ if 'kvno' in rep['enc-part']: >+ kvno = int(rep['enc-part']['kvno']) >+ # If the high order bits are set this is an RODC kvno. >+ self.assertEqual(0, kvno & 0xFFFF0000) >+ >+ def check_error_rep(self, rep, expected): >+ """ Check that the reply is an error message, with the expected >+ error-code specified. >+ """ >+ self.assertIsNotNone(rep) >+ self.assertEqual(rep['msg-type'], KRB_ERROR) >+ self.assertEqual(rep['error-code'], expected) >+ >+ def test_aes256_cts_hmac_sha1_96(self): >+ creds = self.get_user_creds() >+ etype = (AES256_CTS_HMAC_SHA1_96,) >+ >+ rep = self.as_req(creds, etype) >+ self.check_pre_authenication(rep) >+ >+ padata = self.get_pa_data(creds, rep) >+ rep = self.as_req(creds, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ etype = rep['enc-part']['etype'] >+ self.assertEquals(AES256_CTS_HMAC_SHA1_96, etype) >+ >+ def test_arc4_hmac_md5(self): >+ creds = self.get_user_creds() >+ etype = (ARCFOUR_HMAC_MD5,) >+ >+ rep = self.as_req(creds, etype) >+ self.check_pre_authenication(rep) >+ >+ padata = self.get_pa_data(creds, rep) >+ rep = self.as_req(creds, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ etype = rep['enc-part']['etype'] >+ self.assertEquals(ARCFOUR_HMAC_MD5, etype) >+ >+ def test_aes_rc4(self): >+ creds = self.get_user_creds() >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ >+ rep = self.as_req(creds, etype) >+ self.check_pre_authenication(rep) >+ >+ padata = self.get_pa_data(creds, rep) >+ rep = self.as_req(creds, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ etype = rep['enc-part']['etype'] >+ self.assertEquals(AES256_CTS_HMAC_SHA1_96, etype) >+ >+ def test_clock_skew(self): >+ creds = self.get_user_creds() >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ >+ rep = self.as_req(creds, etype) >+ self.check_pre_authenication(rep) >+ >+ padata = self.get_pa_data(creds, rep, skew=3600) >+ rep = self.as_req(creds, etype, padata=padata) >+ >+ self.check_error_rep(rep, KDC_ERR_SKEW) >+ >+ def test_invalid_password(self): >+ creds = self.insta_creds(template=self.get_user_creds()) >+ creds.set_password("Not the correct password") >+ >+ etype = (AES256_CTS_HMAC_SHA1_96,) >+ >+ rep = self.as_req(creds, etype) >+ self.check_pre_authenication(rep) >+ >+ padata = self.get_pa_data(creds, rep) >+ rep = self.as_req(creds, etype, padata=padata) >+ >+ self.check_error_rep(rep, KDC_ERR_PREAUTH_FAILED) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 536721a1f86..35abaf2dafa 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -92,6 +92,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/as_canonicalization_tests.py', > 'python/samba/tests/krb5/compatability_tests.py', > 'python/samba/tests/krb5/rfc4120_constants.py', >+ 'python/samba/tests/krb5/kdc_tests.py', > } > > EXCLUDE_HELP = { >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 76828e27d66..f72060e9870 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -1286,6 +1286,7 @@ for env in ["rodc", "promoted_dc", "fl2000dc", "fl2008r2dc"]: > > planpythontestsuite("ad_dc", "samba.tests.krb5.as_canonicalization_tests") > planpythontestsuite("ad_dc", "samba.tests.krb5.compatability_tests") >+planpythontestsuite("ad_dc", "samba.tests.krb5.kdc_tests") > > for env in [ > 'vampire_dc', >-- >2.25.1 > > >From 66c868177ea79fc608f02776f9074fc19f6f3c19 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Tue, 10 Nov 2020 16:56:46 +1300 >Subject: [PATCH 052/380] tests python krb5: refactor compatability tests > >Refactor to aid the adding of tests for the inclusion of a salt when >ARCFOUR_HMAC_MD5 encryption selected > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d492355f293e2da400318665035b056dfaba852c) >--- > .../samba/tests/krb5/compatability_tests.py | 24 ++++++++++++++----- > 1 file changed, 18 insertions(+), 6 deletions(-) > >diff --git a/python/samba/tests/krb5/compatability_tests.py b/python/samba/tests/krb5/compatability_tests.py >index bf561346ab3..5990d2ce8df 100755 >--- a/python/samba/tests/krb5/compatability_tests.py >+++ b/python/samba/tests/krb5/compatability_tests.py >@@ -87,7 +87,7 @@ class SimpleKerberosTests(RawKerberosTest): > # RFC 6806 11. Negotiation of FAST and Detecting Modified Requests > self.assertFalse(ENC_PA_REP_FLAG & flags) > >- def as_req(self, creds): >+ def as_pre_auth_req(self, creds, etypes): > user = creds.get_username() > realm = creds.get_realm() > >@@ -103,10 +103,6 @@ class SimpleKerberosTests(RawKerberosTest): > kdc_options = krb5_asn1.KDCOptions('forwardable') > padata = None > >- etypes = ( >- AES256_CTS_HMAC_SHA1_96, >- AES128_CTS_HMAC_SHA1_96, >- ARCFOUR_HMAC_MD5) > > req = self.AS_REQ_create(padata=padata, > kdc_options=str(kdc_options), >@@ -123,10 +119,16 @@ class SimpleKerberosTests(RawKerberosTest): > EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) >- self.assertIsNotNone(rep) > >+ return (rep, cname, sname, realm, till) >+ >+ def check_preauth_rep(self, rep): >+ self.assertIsNotNone(rep) > self.assertEqual(rep['msg-type'], KRB_ERROR) > self.assertEqual(rep['error-code'], KDC_ERR_PREAUTH_REQUIRED) >+ >+ def get_etype_info2(self, rep): >+ > rep_padata = self.der_decode( > rep['e-data'], > asn1Spec=krb5_asn1.METHOD_DATA()) >@@ -139,7 +141,17 @@ class SimpleKerberosTests(RawKerberosTest): > etype_info2 = self.der_decode( > etype_info2, > asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ return etype_info2 >+ >+ def as_req(self, creds): >+ etypes = ( >+ AES256_CTS_HMAC_SHA1_96, >+ AES128_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5) >+ (rep, cname, sname, realm, till) = self.as_pre_auth_req(creds, etypes) >+ self.check_preauth_rep(rep) > >+ etype_info2 = self.get_etype_info2(rep) > key = self.PasswordKey_from_etype_info2(creds, etype_info2[0]) > > (patime, pausec) = self.get_KerberosTimeWithUsec() >-- >2.25.1 > > >From cb18851317987279cca0249feeddce85e489710c Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Tue, 10 Nov 2020 16:57:11 +1300 >Subject: [PATCH 053/380] tests python krb5: add arcfour salt tests > >MIT kerberos returns a salt when ARCFOUR_HMAC_MD5 encryption selected, >Heimdal does not. > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Thu Nov 12 22:54:22 UTC 2020 on sn-devel-184 > >(cherry picked from commit 2ba6d596ff0a3580eca9285fd83569bcb147ce77) >--- > .../samba/tests/krb5/compatability_tests.py | 20 +++++++++++++++++++ > 1 file changed, 20 insertions(+) > >diff --git a/python/samba/tests/krb5/compatability_tests.py b/python/samba/tests/krb5/compatability_tests.py >index 5990d2ce8df..e4b1453e712 100755 >--- a/python/samba/tests/krb5/compatability_tests.py >+++ b/python/samba/tests/krb5/compatability_tests.py >@@ -87,6 +87,26 @@ class SimpleKerberosTests(RawKerberosTest): > # RFC 6806 11. Negotiation of FAST and Detecting Modified Requests > self.assertFalse(ENC_PA_REP_FLAG & flags) > >+ def test_mit_arcfour_salt(self): >+ creds = self.get_user_creds() >+ etypes = (ARCFOUR_HMAC_MD5,) >+ (rep, *_) = self.as_pre_auth_req(creds, etypes) >+ self.check_preauth_rep(rep) >+ etype_info2 = self.get_etype_info2(rep) >+ if 'salt' not in etype_info2[0]: >+ self.fail( >+ "(MIT) Salt not populated for ARCFOUR_HMAC_MD5 encryption") >+ >+ def test_heimdal_arcfour_salt(self): >+ creds = self.get_user_creds() >+ etypes = (ARCFOUR_HMAC_MD5,) >+ (rep, *_) = self.as_pre_auth_req(creds, etypes) >+ self.check_preauth_rep(rep) >+ etype_info2 = self.get_etype_info2(rep) >+ if 'salt' in etype_info2[0]: >+ self.fail( >+ "(Heimdal) Salt populated for ARCFOUR_HMAC_MD5 encryption") >+ > def as_pre_auth_req(self, creds, etypes): > user = creds.get_username() > realm = creds.get_realm() >-- >2.25.1 > > >From 573e9ad57b84033bf101c5cd3cb2acad4d89ff78 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Wed, 18 Nov 2020 14:49:28 +1300 >Subject: [PATCH 054/380] tests python krb5: Extra canonicalization tests > >Add tests that set the server name to the client name for the machine >account in the kerberos AS_REQ. This replicates the TEST_AS_REQ_SELF >test phase in source4/torture/krb5/kdc-canon-heimdal.c. > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Mon Nov 30 05:21:42 UTC 2020 on sn-devel-184 > >(cherry picked from commit 7f7e2b0e1e17321d800de787098bb2b2c8259ecd) >--- > .../tests/krb5/as_canonicalization_tests.py | 74 +++++++++----- > selftest/knownfail.d/kdc-enterprise | 26 +++++ > selftest/knownfail_mit_kdc | 96 +++++++++++++++++++ > 3 files changed, 172 insertions(+), 24 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index 303788b672e..6ea3ff0491e 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -56,7 +56,8 @@ class TestOptions(Enum): > NetbiosRealm = 16 > UPN = 32 > RemoveDollar = 64 >- Last = 128 >+ AsReqSelf = 128 >+ Last = 256 > > def is_set(self, x): > return self.value & x >@@ -76,8 +77,8 @@ class TestData: > def __init__(self, options, creds): > self.options = options > self.user_creds = creds >- self.user_name = self.get_username(options, creds) >- self.realm = self.get_realm(options, creds) >+ self.user_name = self._get_username(options, creds) >+ self.realm = self._get_realm(options, creds) > > if TestOptions.Enterprise.is_set(options): > client_name_type = NT_ENTERPRISE_PRINCIPAL >@@ -86,11 +87,14 @@ class TestData: > > self.cname = RawKerberosTest.PrincipalName_create( > name_type=client_name_type, names=[self.user_name]) >- self.sname = RawKerberosTest.PrincipalName_create( >- name_type=NT_SRV_INST, names=["krbtgt", self.realm]) >+ if TestOptions.AsReqSelf.is_set(options): >+ self.sname = self.cname >+ else: >+ self.sname = RawKerberosTest.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", self.realm]) > self.canonicalize = TestOptions.Canonicalize.is_set(options) > >- def get_realm(self, options, creds): >+ def _get_realm(self, options, creds): > realm = creds.get_realm() > if TestOptions.NetbiosRealm.is_set(options): > realm = creds.get_domain() >@@ -100,7 +104,7 @@ class TestData: > realm = realm.lower() > return realm > >- def get_username(self, options, creds): >+ def _get_username(self, options, creds): > name = creds.get_username() > if TestOptions.RemoveDollar.is_set(options) and name.endswith("$"): > name = name[:-1] >@@ -135,6 +139,9 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > if ct != CredentialsType.Machine and\ > TestOptions.RemoveDollar.is_set(options): > return True >+ if ct != CredentialsType.Machine and\ >+ TestOptions.AsReqSelf.is_set(options): >+ return True > return False > > def build_test_name(ct, options): >@@ -448,26 +455,45 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > > def check_sname(self, sname, data): > nt = sname['name-type'] >- self.assertEqual( >- NT_SRV_INST, >- nt, >- "sname name-type, Options {0:08b}".format(data.options)) >- > ns = sname['name-string'] > name = ns[0].decode('ascii') >- self.assertEqual( >- 'krbtgt', >- name, >- "sname principal, Options {0:08b}".format(data.options)) > >- realm = ns[1].decode('ascii') >- expected = data.realm >- if TestOptions.Canonicalize.is_set(data.options): >- expected = data.user_creds.get_realm().upper() >- self.assertEqual( >- expected, >- realm, >- "sname realm, Options {0:08b}".format(data.options)) >+ if TestOptions.AsReqSelf.is_set(data.options): >+ expected_name_type = NT_PRINCIPAL >+ if not TestOptions.Canonicalize.is_set(data.options)\ >+ and TestOptions.Enterprise.is_set(data.options): >+ >+ expected_name_type = NT_ENTERPRISE_PRINCIPAL >+ >+ self.assertEqual( >+ expected_name_type, >+ nt, >+ "sname name-type, Options {0:08b}".format(data.options)) >+ expected = data.user_name >+ if TestOptions.Canonicalize.is_set(data.options): >+ expected = data.user_creds.get_username() >+ self.assertEqual( >+ expected, >+ name, >+ "sname principal, Options {0:08b}".format(data.options)) >+ else: >+ self.assertEqual( >+ NT_SRV_INST, >+ nt, >+ "sname name-type, Options {0:08b}".format(data.options)) >+ self.assertEqual( >+ 'krbtgt', >+ name, >+ "sname principal, Options {0:08b}".format(data.options)) >+ >+ realm = ns[1].decode('ascii') >+ expected = data.realm >+ if TestOptions.Canonicalize.is_set(data.options): >+ expected = data.user_creds.get_realm().upper() >+ self.assertEqual( >+ expected, >+ realm, >+ "sname realm, Options {0:08b}".format(data.options)) > > def check_srealm(self, srealm, data): > realm = data.user_creds.get_realm() >diff --git a/selftest/knownfail.d/kdc-enterprise b/selftest/knownfail.d/kdc-enterprise >index d15d67c8af6..c9b6c98a2ee 100644 >--- a/selftest/knownfail.d/kdc-enterprise >+++ b/selftest/knownfail.d/kdc-enterprise >@@ -35,3 +35,29 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName_UPN\( > >+ >+ >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN_RemoveDollar_AsReqSelf\( >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 9953d51f21d..f1a4971430e 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -174,3 +174,99 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UPN_RemoveDollar\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_RemoveDollar\( > samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_UPN_RemoveDollar\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperRealm_UpperUserName_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\(ad_dc >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_Enterprise_UpperUserName_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperRealm_UpperUserName_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_UpperUserName_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_UpperUserName_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_NetbiosRealm_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_NetbiosRealm_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_RemoveDollar_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_UPN_AsReqSelf\( >+^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_UPN_RemoveDollar_AsReqSelf\( >-- >2.25.1 > > >From 06a7429bd97934a68a916c1a97ce2b9169b624d0 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Thu, 10 Dec 2020 10:15:28 +1300 >Subject: [PATCH 055/380] tests python krb5: Add Authorization data ad-type > constants > >Add constants for the Authorization Data Type values. >RFC 4120 7.5.4. Authorization Data Types > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d74c9dcf3aaa613abfac49288f427484468bf6e1) >--- > python/samba/tests/krb5/rfc4120_constants.py | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) > >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index e939bb75e82..e1d0c5baa68 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -47,3 +47,17 @@ NT_PRINCIPAL = int(krb5_asn1.NameTypeValues('kRB5-NT-PRINCIPAL')) > NT_SRV_INST = int(krb5_asn1.NameTypeValues('kRB5-NT-SRV-INST')) > NT_ENTERPRISE_PRINCIPAL = int(krb5_asn1.NameTypeValues( > 'kRB5-NT-ENTERPRISE-PRINCIPAL')) >+ >+# Authorization data ad-type values >+ >+AD_IF_RELEVANT = 1 >+AD_INTENDED_FOR_SERVER = 2 >+AD_INTENDED_FOR_APPLICATION_CLASS = 3 >+AD_KDC_ISSUED = 4 >+AD_AND_OR = 5 >+AD_MANDATORY_TICKET_EXTENSIONS = 6 >+AD_IN_TICKET_EXTENSIONS = 7 >+AD_MANDATORY_FOR_KDC = 8 >+AD_INITIAL_VERIFIED_CAS = 9 >+AD_WIN2K_PAC = 128 >+AD_SIGNTICKET = 512 >-- >2.25.1 > > >From 6b873cf67d374902b8482f41a42bf9bd8f714d20 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Mon, 30 Nov 2020 14:16:28 +1300 >Subject: [PATCH 056/380] tests python krb5: add test base class > >Add a base class for the KDC tests to reduce the amount of code >duplication in the tests. > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 0f232ed42fb2671d025643cafb19891373562e4a) >--- > python/samba/tests/krb5/kdc_base_test.py | 419 +++++++++++++++++++++++ > 1 file changed, 419 insertions(+) > create mode 100755 python/samba/tests/krb5/kdc_base_test.py > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >new file mode 100755 >index 00000000000..4fc7ee85ba9 >--- /dev/null >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -0,0 +1,419 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# Copyright (C) 2020 Catalyst.Net Ltd >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+from collections import namedtuple >+from ldb import SCOPE_BASE >+from samba import generate_random_password >+from samba.auth import system_session >+from samba.credentials import Credentials >+from samba.dcerpc import krb5pac >+from samba.dsdb import UF_WORKSTATION_TRUST_ACCOUNT, UF_NORMAL_ACCOUNT >+from samba.ndr import ndr_unpack >+from samba.samdb import SamDB >+ >+from samba.tests import delete_force >+from samba.tests.krb5.raw_testcase import RawKerberosTest >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+from samba.tests.krb5.rfc4120_constants import ( >+ AD_IF_RELEVANT, >+ AD_WIN2K_PAC, >+ KDC_ERR_PREAUTH_REQUIRED, >+ KRB_AS_REP, >+ KRB_TGS_REP, >+ KRB_ERROR, >+ PADATA_ENC_TIMESTAMP, >+ PADATA_ETYPE_INFO2, >+) >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class KDCBaseTest(RawKerberosTest): >+ """ Base class for KDC tests. >+ """ >+ >+ @classmethod >+ def setUpClass(cls): >+ cls.lp = cls.get_loadparm(cls) >+ cls.username = os.environ["USERNAME"] >+ cls.password = os.environ["PASSWORD"] >+ cls.host = os.environ["SERVER"] >+ >+ c = Credentials() >+ c.set_username(cls.username) >+ c.set_password(cls.password) >+ try: >+ realm = os.environ["REALM"] >+ c.set_realm(realm) >+ except KeyError: >+ pass >+ try: >+ domain = os.environ["DOMAIN"] >+ c.set_domain(domain) >+ except KeyError: >+ pass >+ >+ c.guess() >+ >+ cls.credentials = c >+ >+ cls.session = system_session() >+ cls.ldb = SamDB(url="ldap://%s" % cls.host, >+ session_info=cls.session, >+ credentials=cls.credentials, >+ lp=cls.lp) >+ # fetch the dnsHostName from the RootDse >+ res = cls.ldb.search( >+ base="", expression="", scope=SCOPE_BASE, attrs=["dnsHostName"]) >+ cls.dns_host_name = str(res[0]['dnsHostName']) >+ >+ def setUp(self): >+ super().setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ self.accounts = [] >+ >+ def tearDown(self): >+ # Clean up any accounts created by create_account >+ for dn in self.accounts: >+ delete_force(self.ldb, dn) >+ >+ def create_account(self, name, machine_account=False, spn=None): >+ '''Create an account for testing. >+ The dn of the created account is added to self.accounts, >+ which is used by tearDown to clean up the created accounts. >+ ''' >+ dn = "cn=%s,%s" % (name, self.ldb.domain_dn()) >+ >+ # remove the account if it exists, this will happen if a previous test >+ # run failed >+ delete_force(self.ldb, dn) >+ if machine_account: >+ object_class = "computer" >+ account_name = "%s$" % name >+ account_control = str(UF_WORKSTATION_TRUST_ACCOUNT) >+ else: >+ object_class = "user" >+ account_name = name >+ account_control = str(UF_NORMAL_ACCOUNT) >+ >+ password = generate_random_password(32, 32) >+ utf16pw = ('"%s"' % password).encode('utf-16-le') >+ >+ details = { >+ "dn": dn, >+ "objectclass": object_class, >+ "sAMAccountName": account_name, >+ "userAccountControl": account_control, >+ "unicodePwd": utf16pw} >+ if spn is not None: >+ details["servicePrincipalName"] = spn >+ self.ldb.add(details) >+ >+ creds = Credentials() >+ creds.guess(self.lp) >+ creds.set_realm(self.ldb.domain_dns_name().upper()) >+ creds.set_domain(self.ldb.domain_netbios_name().upper()) >+ creds.set_password(password) >+ creds.set_username(account_name) >+ if machine_account: >+ creds.set_workstation(name) >+ # >+ # Save the account name so it can be deleted in the tearDown >+ self.accounts.append(dn) >+ >+ return (creds, dn) >+ >+ def as_req(self, cname, sname, realm, etypes, padata=None): >+ '''Send a Kerberos AS_REQ, returns the undecoded response >+ ''' >+ >+ till = self.get_KerberosTime(offset=36000) >+ kdc_options = 0 >+ >+ req = self.AS_REQ_create(padata=padata, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7fffffff, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None) >+ rep = self.send_recv_transaction(req) >+ return rep >+ >+ def get_as_rep_key(self, creds, rep): >+ '''Extract the session key from an AS-REP >+ ''' >+ rep_padata = self.der_decode( >+ rep['e-data'], >+ asn1Spec=krb5_asn1.METHOD_DATA()) >+ >+ for pa in rep_padata: >+ if pa['padata-type'] == PADATA_ETYPE_INFO2: >+ padata_value = pa['padata-value'] >+ break >+ >+ etype_info2 = self.der_decode( >+ padata_value, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ >+ key = self.PasswordKey_from_etype_info2(creds, etype_info2[0]) >+ return key >+ >+ def get_pa_data(self, creds, rep, skew=0): >+ '''generate the pa_data data element for an AS-REQ >+ ''' >+ key = self.get_as_rep_key(creds, rep) >+ >+ (patime, pausec) = self.get_KerberosTimeWithUsec(offset=skew) >+ padata = self.PA_ENC_TS_ENC_create(patime, pausec) >+ padata = self.der_encode(padata, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) >+ >+ usage = 1 >+ padata = self.EncryptedData_create(key, usage, padata) >+ padata = self.der_encode(padata, asn1Spec=krb5_asn1.EncryptedData()) >+ >+ padata = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, padata) >+ >+ return [padata] >+ >+ def get_as_rep_enc_data(self, key, rep): >+ ''' Decrypt and Decode the encrypted data in an AS-REP >+ ''' >+ usage = 3 >+ enc_part = key.decrypt(usage, rep['enc-part']['cipher']) >+ # MIT KDC encodes both EncASRepPart and EncTGSRepPart with >+ # application tag 26 >+ try: >+ enc_part = self.der_decode( >+ enc_part, asn1Spec=krb5_asn1.EncASRepPart()) >+ except Exception: >+ enc_part = self.der_decode( >+ enc_part, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ >+ return enc_part >+ >+ def check_pre_authenication(self, rep): >+ """ Check that the kdc response was pre-authentication required >+ """ >+ self.check_error_rep(rep, KDC_ERR_PREAUTH_REQUIRED) >+ >+ def check_as_reply(self, rep): >+ """ Check that the kdc response is an AS-REP and that the >+ values for: >+ msg-type >+ pvno >+ tkt-pvno >+ kvno >+ match the expected values >+ """ >+ >+ # Should have a reply, and it should an AS-REP message. >+ self.assertIsNotNone(rep) >+ self.assertEqual(rep['msg-type'], KRB_AS_REP, "rep = {%s}" % rep) >+ >+ # Protocol version number should be 5 >+ pvno = int(rep['pvno']) >+ self.assertEqual(5, pvno, "rep = {%s}" % rep) >+ >+ # The ticket version number should be 5 >+ tkt_vno = int(rep['ticket']['tkt-vno']) >+ self.assertEqual(5, tkt_vno, "rep = {%s}" % rep) >+ >+ # Check that the kvno is not an RODC kvno >+ # MIT kerberos does not provide the kvno, so we treat it as optional. >+ # This is tested in compatability_test.py >+ if 'kvno' in rep['enc-part']: >+ kvno = int(rep['enc-part']['kvno']) >+ # If the high order bits are set this is an RODC kvno. >+ self.assertEqual(0, kvno & 0xFFFF0000, "rep = {%s}" % rep) >+ >+ def check_tgs_reply(self, rep): >+ """ Check that the kdc response is an TGS-REP and that the >+ values for: >+ msg-type >+ pvno >+ tkt-pvno >+ kvno >+ match the expected values >+ """ >+ >+ # Should have a reply, and it should an TGS-REP message. >+ self.assertIsNotNone(rep) >+ self.assertEqual(rep['msg-type'], KRB_TGS_REP, "rep = {%s}" % rep) >+ >+ # Protocol version number should be 5 >+ pvno = int(rep['pvno']) >+ self.assertEqual(5, pvno, "rep = {%s}" % rep) >+ >+ # The ticket version number should be 5 >+ tkt_vno = int(rep['ticket']['tkt-vno']) >+ self.assertEqual(5, tkt_vno, "rep = {%s}" % rep) >+ >+ # Check that the kvno is not an RODC kvno >+ # MIT kerberos does not provide the kvno, so we treat it as optional. >+ # This is tested in compatability_test.py >+ if 'kvno' in rep['enc-part']: >+ kvno = int(rep['enc-part']['kvno']) >+ # If the high order bits are set this is an RODC kvno. >+ self.assertEqual(0, kvno & 0xFFFF0000, "rep = {%s}" % rep) >+ >+ def check_error_rep(self, rep, expected): >+ """ Check that the reply is an error message, with the expected >+ error-code specified. >+ """ >+ self.assertIsNotNone(rep) >+ self.assertEqual(rep['msg-type'], KRB_ERROR, "rep = {%s}" % rep) >+ self.assertEqual(rep['error-code'], expected, "rep = {%s}" % rep) >+ >+ def tgs_req(self, cname, sname, realm, ticket, key, etypes): >+ '''Send a TGS-REQ, returns the response and the decrypted and >+ decoded enc-part >+ ''' >+ >+ kdc_options = "0" >+ till = self.get_KerberosTime(offset=36000) >+ padata = [] >+ >+ subkey = self.RandomKey(key.etype) >+ subkey_usage = 9 >+ >+ (ctime, cusec) = self.get_KerberosTimeWithUsec() >+ >+ req = self.TGS_REQ_create(padata=padata, >+ cusec=cusec, >+ ctime=ctime, >+ ticket=ticket, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=None, >+ till_time=till, >+ renew_time=None, >+ nonce=0x7ffffffe, >+ etypes=etypes, >+ addresses=None, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ additional_tickets=None, >+ ticket_session_key=key, >+ authenticator_subkey=subkey) >+ rep = self.send_recv_transaction(req) >+ self.assertIsNotNone(rep) >+ >+ msg_type = rep['msg-type'] >+ enc_part = None >+ if msg_type == KRB_TGS_REP: >+ enc_part = subkey.decrypt(subkey_usage, rep['enc-part']['cipher']) >+ enc_part = self.der_decode( >+ enc_part, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ return (rep, enc_part) >+ >+ # Named tuple to contain values of interest when the PAC is decoded. >+ PacData = namedtuple( >+ "PacData", >+ "account_name account_sid logon_name upn domain_name") >+ PAC_LOGON_INFO = 1 >+ PAC_CREDENTIAL_INFO = 2 >+ PAC_SRV_CHECKSUM = 6 >+ PAC_KDC_CHECKSUM = 7 >+ PAC_LOGON_NAME = 10 >+ PAC_CONSTRAINED_DELEGATION = 11 >+ PAC_UPN_DNS_INFO = 12 >+ >+ def get_pac_data(self, authorization_data): >+ '''Decode the PAC element contained in the authorization-data element >+ ''' >+ account_name = None >+ user_sid = None >+ logon_name = None >+ upn = None >+ domain_name = None >+ >+ # The PAC data will be wrapped in an AD_IF_RELEVANT element >+ ad_if_relevant_elements = ( >+ x for x in authorization_data if x['ad-type'] == AD_IF_RELEVANT) >+ for dt in ad_if_relevant_elements: >+ buf = self.der_decode( >+ dt['ad-data'], asn1Spec=krb5_asn1.AD_IF_RELEVANT()) >+ # The PAC data is further wrapped in a AD_WIN2K_PAC element >+ for ad in (x for x in buf if x['ad-type'] == AD_WIN2K_PAC): >+ pb = ndr_unpack(krb5pac.PAC_DATA, ad['ad-data']) >+ for pac in pb.buffers: >+ if pac.type == self.PAC_LOGON_INFO: >+ account_name = ( >+ pac.info.info.info3.base.account_name) >+ user_sid = ( >+ str(pac.info.info.info3.base.domain_sid) + >+ "-" + str(pac.info.info.info3.base.rid)) >+ elif pac.type == self.PAC_LOGON_NAME: >+ logon_name = pac.info.account_name >+ elif pac.type == self.PAC_UPN_DNS_INFO: >+ upn = pac.info.upn_name >+ domain_name = pac.info.dns_domain_name >+ >+ return self.PacData( >+ account_name, >+ user_sid, >+ logon_name, >+ upn, >+ domain_name) >+ >+ def decode_service_ticket(self, creds, ticket): >+ '''Decrypt and decode a service ticket >+ ''' >+ >+ name = creds.get_username() >+ if name.endswith('$'): >+ name = name[:-1] >+ realm = creds.get_realm() >+ salt = "%s.%s@%s" % (name, realm.lower(), realm.upper()) >+ >+ key = self.PasswordKey_create( >+ ticket['enc-part']['etype'], >+ creds.get_password(), >+ salt, >+ ticket['enc-part']['kvno']) >+ >+ enc_part = key.decrypt(2, ticket['enc-part']['cipher']) >+ enc_ticket_part = self.der_decode( >+ enc_part, asn1Spec=krb5_asn1.EncTicketPart()) >+ return enc_ticket_part >+ >+ def get_objectSid(self, dn): >+ ''' Get the objectSID for a DN >+ Note: performs an Ldb query. >+ ''' >+ res = self.ldb.search(dn, scope=SCOPE_BASE, attrs=["objectSID"]) >+ self.assertTrue(len(res) == 1, "did not get objectSid for %s" % dn) >+ sid = self.ldb.schema_format_value("objectSID", res[0]["objectSID"][0]) >+ return sid.decode('utf8') >-- >2.25.1 > > >From c23166453f549e089d3270ec6d9184a0695a4c40 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Mon, 30 Nov 2020 14:19:15 +1300 >Subject: [PATCH 057/380] tests python krb5: initial TGS tests > >Initial tests on the KDC TGS > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 1ed461a142f68f5de5e21b873ebddfcf5ae0ca1e) >--- > python/samba/tests/krb5/kdc_base_test.py | 1 - > python/samba/tests/krb5/kdc_tgs_tests.py | 210 +++++++++++++++++++ > python/samba/tests/krb5/rfc4120_constants.py | 2 + > python/samba/tests/usage.py | 2 + > selftest/knownfail_mit_kdc | 5 + > source4/selftest/tests.py | 3 + > 6 files changed, 222 insertions(+), 1 deletion(-) > mode change 100755 => 100644 python/samba/tests/krb5/kdc_base_test.py > create mode 100755 python/samba/tests/krb5/kdc_tgs_tests.py > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >old mode 100755 >new mode 100644 >index 4fc7ee85ba9..1a823d173e3 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1,4 +1,3 @@ >-#!/usr/bin/env python3 > # Unix SMB/CIFS implementation. > # Copyright (C) Stefan Metzmacher 2020 > # Copyright (C) 2020 Catalyst.Net Ltd >diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py >new file mode 100755 >index 00000000000..23a1d868a79 >--- /dev/null >+++ b/python/samba/tests/krb5/kdc_tgs_tests.py >@@ -0,0 +1,210 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# Copyright (C) 2020 Catalyst.Net Ltd >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+from samba.tests.krb5.kdc_base_test import KDCBaseTest >+from samba.tests.krb5.rfc4120_constants import ( >+ AES256_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5, >+ KRB_ERROR, >+ KDC_ERR_BADMATCH, >+ NT_PRINCIPAL, >+ NT_SRV_INST, >+) >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class KdcTgsTests(KDCBaseTest): >+ >+ def setUp(self): >+ super().setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ def test_tgs_req_cname_does_not_not_match_authenticator_cname(self): >+ ''' Try and obtain a ticket from the TGS, but supply a cname >+ that differs from that provided to the krbtgt >+ ''' >+ # Create the user account >+ user_name = "tsttktusr" >+ (uc, _) = self.create_account(user_name) >+ realm = uc.get_realm().lower() >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96,) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(uc, rep) >+ key = self.get_as_rep_key(uc, rep) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ # Request a service ticket, but use a cname that does not match >+ # that in the original AS-REQ >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ ticket = rep['ticket'] >+ >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=["Administrator"]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=["host", self.dns_host_name]) >+ >+ (rep, enc_part) = self.tgs_req(cname, sname, realm, ticket, key, etype) >+ >+ self.assertIsNone( >+ enc_part, >+ "rep = {%s}, enc_part = {%s}" % (rep, enc_part)) >+ self.assertEqual(KRB_ERROR, rep['msg-type'], "rep = {%s}" % rep) >+ self.assertEqual( >+ KDC_ERR_BADMATCH, >+ rep['error-code'], >+ "rep = {%s}" % rep) >+ >+ def test_ldap_service_ticket(self): >+ '''Get a ticket to the ldap service >+ ''' >+ # Create the user account >+ user_name = "tsttktusr" >+ (uc, _) = self.create_account(user_name) >+ realm = uc.get_realm().lower() >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96,) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(uc, rep) >+ key = self.get_as_rep_key(uc, rep) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ ticket = rep['ticket'] >+ >+ # Request a ticket to the ldap service >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, >+ names=["ldap", self.dns_host_name]) >+ >+ (rep, _) = self.tgs_req( >+ cname, sname, uc.get_realm(), ticket, key, etype) >+ >+ self.check_tgs_reply(rep) >+ >+ def test_get_ticket_for_host_service_of_machine_account(self): >+ >+ # Create a user and machine account for the test. >+ # >+ user_name = "tsttktusr" >+ (uc, dn) = self.create_account(user_name) >+ (mc, _) = self.create_account("tsttktmac", machine_account=True) >+ realm = uc.get_realm().lower() >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(uc, rep) >+ key = self.get_as_rep_key(uc, rep) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[mc.get_username()]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, uc.get_realm(), ticket, key, etype) >+ self.check_tgs_reply(rep) >+ >+ # Check the contents of the service ticket >+ ticket = rep['ticket'] >+ enc_part = self.decode_service_ticket(mc, ticket) >+ >+ pac_data = self.get_pac_data(enc_part['authorization-data']) >+ sid = self.get_objectSid(dn) >+ upn = "%s@%s" % (uc.get_username(), realm) >+ self.assertEqual( >+ uc.get_username(), >+ str(pac_data.account_name), >+ "rep = {%s},%s" % (rep, pac_data)) >+ self.assertEqual( >+ uc.get_username(), >+ pac_data.logon_name, >+ "rep = {%s},%s" % (rep, pac_data)) >+ self.assertEqual( >+ uc.get_realm(), >+ pac_data.domain_name, >+ "rep = {%s},%s" % (rep, pac_data)) >+ self.assertEqual( >+ upn, >+ pac_data.upn, >+ "rep = {%s},%s" % (rep, pac_data)) >+ self.assertEqual( >+ sid, >+ pac_data.account_sid, >+ "rep = {%s},%s" % (rep, pac_data)) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index e1d0c5baa68..19bb6691d43 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -28,6 +28,7 @@ ARCFOUR_HMAC_MD5 = int( > # Message types > KRB_ERROR = int(krb5_asn1.MessageTypeValues('krb-error')) > KRB_AS_REP = int(krb5_asn1.MessageTypeValues('krb-as-rep')) >+KRB_TGS_REP = int(krb5_asn1.MessageTypeValues('krb-tgs-rep')) > > # PAData types > PADATA_ENC_TIMESTAMP = int( >@@ -39,6 +40,7 @@ PADATA_ETYPE_INFO2 = int( > KDC_ERR_C_PRINCIPAL_UNKNOWN = 6 > KDC_ERR_PREAUTH_FAILED = 24 > KDC_ERR_PREAUTH_REQUIRED = 25 >+KDC_ERR_BADMATCH = 36 > KDC_ERR_SKEW = 37 > > # Name types >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 35abaf2dafa..222d1dbfa41 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -93,6 +93,8 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/compatability_tests.py', > 'python/samba/tests/krb5/rfc4120_constants.py', > 'python/samba/tests/krb5/kdc_tests.py', >+ 'python/samba/tests/krb5/kdc_base_test.py', >+ 'python/samba/tests/krb5/kdc_tgs_tests.py', > } > > EXCLUDE_HELP = { >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index f1a4971430e..e64303c6b0f 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -270,3 +270,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_RemoveDollar_AsReqSelf\( > ^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_UPN_AsReqSelf\( > ^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_UpperUserName_UPN_RemoveDollar_AsReqSelf\( >+# >+# MIT currently returns an error code of 12 KRB5KDC_ERR_POLICY: KDC policy rejects request, to the >+# following tests >+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_ldap_service_ticket\(ad_dc\) >+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_get_ticket_for_host_service_of_machine_account\(ad_dc\) >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index f72060e9870..b2a09b3ecb2 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -1287,6 +1287,9 @@ for env in ["rodc", "promoted_dc", "fl2000dc", "fl2008r2dc"]: > planpythontestsuite("ad_dc", "samba.tests.krb5.as_canonicalization_tests") > planpythontestsuite("ad_dc", "samba.tests.krb5.compatability_tests") > planpythontestsuite("ad_dc", "samba.tests.krb5.kdc_tests") >+planpythontestsuite( >+ "ad_dc", >+ "samba.tests.krb5.kdc_tgs_tests") > > for env in [ > 'vampire_dc', >-- >2.25.1 > > >From 92d6db2c1ac72eead9a6b5b385152c451b02f140 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Thu, 10 Dec 2020 16:26:06 +1300 >Subject: [PATCH 058/380] tests python krb5: Add key usage constants > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d8ed73b75ad67da99be392b2db18fe2e1ffed87f) >--- > python/samba/tests/krb5/rfc4120_constants.py | 50 ++++++++++++++++++++ > 1 file changed, 50 insertions(+) > >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index 19bb6691d43..9de56578c99 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -63,3 +63,53 @@ AD_MANDATORY_FOR_KDC = 8 > AD_INITIAL_VERIFIED_CAS = 9 > AD_WIN2K_PAC = 128 > AD_SIGNTICKET = 512 >+ >+# Key usage numbers >+# RFC 4120 Section 7.5.1. Key Usage Numbers >+KU_PA_ENC_TIMESTAMP = 1 >+''' AS-REQ PA-ENC-TIMESTAMP padata timestamp, encrypted with the >+ client key (section 5.2.7.2) ''' >+KU_TICKET = 2 >+''' AS-REP Ticket and TGS-REP Ticket (includes tgs session key or >+ application session key), encrypted with the service key >+ (section 5.3) ''' >+KU_AS_REP_ENC_PART = 3 >+''' AS-REP encrypted part (includes tgs session key or application >+ session key), encrypted with the client key (section 5.4.2) ''' >+KU_TGS_REQ_AUTH_DAT_SESSION = 4 >+''' TGS-REQ KDC-REQ-BODY AuthorizationData, encrypted with the tgs >+ session key (section 5.4.1) ''' >+KU_TGS_REQ_AUTH_DAT_SUBKEY = 5 >+''' TGS-REQ KDC-REQ-BODY AuthorizationData, encrypted with the tgs >+ authenticator subkey (section 5.4.1) ''' >+KU_TGS_REQ_AUTH_CKSUM = 6 >+''' TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator cksum, keyed >+ with the tgs session key (section 5.5.1) ''' >+KU_TGS_REQ_AUTH = 7 >+''' TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator (includes tgs >+ authenticator subkey), encrypted with the tgs session key >+ (section 5.5.1) ''' >+KU_TGS_REP_ENC_PART_SESSION = 8 >+''' TGS-REP encrypted part (includes application session key), >+ encrypted with the tgs session key (section 5.4.2) ''' >+KU_TGS_REP_ENC_PART_SUB_KEY = 9 >+''' TGS-REP encrypted part (includes application session key), >+ encrypted with the tgs authenticator subkey (section 5.4.2) ''' >+KU_AP_REQ_AUTH_CKSUM = 10 >+''' AP-REQ Authenticator cksum, keyed with the application session >+ key (section 5.5.1) ''' >+KU_AP_REQ_AUTH = 11 >+''' AP-REQ Authenticator (includes application authenticator >+ subkey), encrypted with the application session key (section 5.5.1) ''' >+KU_AP_REQ_ENC_PART = 12 >+''' AP-REP encrypted part (includes application session subkey), >+ encrypted with the application session key (section 5.5.2) ''' >+KU_KRB_PRIV = 13 >+''' KRB-PRIV encrypted part, encrypted with a key chosen by the >+ application (section 5.7.1) ''' >+KU_KRB_CRED = 14 >+''' KRB-CRED encrypted part, encrypted with a key chosen by the >+ application (section 5.8.1) ''' >+KU_KRB_SAFE_CKSUM = 15 >+''' KRB-SAFE cksum, keyed with a key chosen by the application >+ (section 5.6.1) ''' >-- >2.25.1 > > >From 827e21e2653310af463dd1df186065d6b16a74c1 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Thu, 10 Dec 2020 16:27:17 +1300 >Subject: [PATCH 059/380] tests python krb5: use key usage constants > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 03676a4a5c55ab5f4958a86cbd4d7be0f0a8a294) >--- > .../tests/krb5/as_canonicalization_tests.py | 5 ++--- > python/samba/tests/krb5/compatability_tests.py | 7 +++---- > python/samba/tests/krb5/kdc_base_test.py | 16 +++++++++------- > python/samba/tests/krb5/kdc_tests.py | 3 +-- > python/samba/tests/krb5/s4u_tests.py | 15 +++++++++------ > python/samba/tests/krb5/simple_tests.py | 15 +++++++++------ > python/samba/tests/krb5/xrealm_tests.py | 15 +++++++++------ > 7 files changed, 42 insertions(+), 34 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index 6ea3ff0491e..e89b40eab8f 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -367,8 +367,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) > >- enc_pa_ts_usage = 1 >- pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) > > pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts) >@@ -413,7 +412,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > self.assertEqual(msg_type, KRB_AS_REP, "Data {0}".format(str(data))) > > # Decrypt and decode the EncKdcRepPart >- enc = key.decrypt(3, rep['enc-part']['cipher']) >+ enc = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher']) > if enc[0] == 0x7A: > # MIT Kerberos Tags the EncASRepPart as a EncKDCRepPart > # i.e. tag number 26 instead of tag number 25 >diff --git a/python/samba/tests/krb5/compatability_tests.py b/python/samba/tests/krb5/compatability_tests.py >index e4b1453e712..0b3701cd60d 100755 >--- a/python/samba/tests/krb5/compatability_tests.py >+++ b/python/samba/tests/krb5/compatability_tests.py >@@ -178,8 +178,7 @@ class SimpleKerberosTests(RawKerberosTest): > pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) > >- enc_pa_ts_usage = 1 >- pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) > > pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts) >@@ -207,9 +206,9 @@ class SimpleKerberosTests(RawKerberosTest): > msg_type = rep['msg-type'] > self.assertEqual(msg_type, KRB_AS_REP) > >- usage = 3 > enc_part = rep['enc-part'] >- enc_as_rep_part = key.decrypt(usage, rep['enc-part']['cipher']) >+ enc_as_rep_part = key.decrypt( >+ KU_AS_REP_ENC_PART, rep['enc-part']['cipher']) > return (enc_as_rep_part, enc_part) > > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 1a823d173e3..e835d389f1c 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -41,6 +41,10 @@ from samba.tests.krb5.rfc4120_constants import ( > KRB_AS_REP, > KRB_TGS_REP, > KRB_ERROR, >+ KU_AS_REP_ENC_PART, >+ KU_PA_ENC_TIMESTAMP, >+ KU_TGS_REP_ENC_PART_SUB_KEY, >+ KU_TICKET, > PADATA_ENC_TIMESTAMP, > PADATA_ETYPE_INFO2, > ) >@@ -196,8 +200,7 @@ class KDCBaseTest(RawKerberosTest): > padata = self.PA_ENC_TS_ENC_create(patime, pausec) > padata = self.der_encode(padata, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) > >- usage = 1 >- padata = self.EncryptedData_create(key, usage, padata) >+ padata = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, padata) > padata = self.der_encode(padata, asn1Spec=krb5_asn1.EncryptedData()) > > padata = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, padata) >@@ -207,8 +210,7 @@ class KDCBaseTest(RawKerberosTest): > def get_as_rep_enc_data(self, key, rep): > ''' Decrypt and Decode the encrypted data in an AS-REP > ''' >- usage = 3 >- enc_part = key.decrypt(usage, rep['enc-part']['cipher']) >+ enc_part = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher']) > # MIT KDC encodes both EncASRepPart and EncTGSRepPart with > # application tag 26 > try: >@@ -303,7 +305,6 @@ class KDCBaseTest(RawKerberosTest): > padata = [] > > subkey = self.RandomKey(key.etype) >- subkey_usage = 9 > > (ctime, cusec) = self.get_KerberosTimeWithUsec() > >@@ -332,7 +333,8 @@ class KDCBaseTest(RawKerberosTest): > msg_type = rep['msg-type'] > enc_part = None > if msg_type == KRB_TGS_REP: >- enc_part = subkey.decrypt(subkey_usage, rep['enc-part']['cipher']) >+ enc_part = subkey.decrypt( >+ KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher']) > enc_part = self.der_decode( > enc_part, asn1Spec=krb5_asn1.EncTGSRepPart()) > return (rep, enc_part) >@@ -403,7 +405,7 @@ class KDCBaseTest(RawKerberosTest): > salt, > ticket['enc-part']['kvno']) > >- enc_part = key.decrypt(2, ticket['enc-part']['cipher']) >+ enc_part = key.decrypt(KU_TICKET, ticket['enc-part']['cipher']) > enc_ticket_part = self.der_decode( > enc_part, asn1Spec=krb5_asn1.EncTicketPart()) > return enc_ticket_part >diff --git a/python/samba/tests/krb5/kdc_tests.py b/python/samba/tests/krb5/kdc_tests.py >index 57a25448965..17b9d154bd9 100755 >--- a/python/samba/tests/krb5/kdc_tests.py >+++ b/python/samba/tests/krb5/kdc_tests.py >@@ -91,8 +91,7 @@ class KdcTests(RawKerberosTest): > pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) > >- enc_pa_ts_usage = 1 >- pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) > > pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts) >diff --git a/python/samba/tests/krb5/s4u_tests.py b/python/samba/tests/krb5/s4u_tests.py >index ae38635c53b..2e1bd3fbe1f 100755 >--- a/python/samba/tests/krb5/s4u_tests.py >+++ b/python/samba/tests/krb5/s4u_tests.py >@@ -25,6 +25,11 @@ os.environ["PYTHONUNBUFFERED"] = "1" > from samba.tests import env_get_var_value > from samba.tests.krb5.kcrypto import Cksumtype > from samba.tests.krb5.raw_testcase import RawKerberosTest >+from samba.tests.krb5.rfc4120_constants import ( >+ KU_PA_ENC_TIMESTAMP, >+ KU_AS_REP_ENC_PART, >+ KU_TGS_REP_ENC_PART_SUB_KEY, >+) > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > > global_asn1_print = False >@@ -86,8 +91,7 @@ class S4UKerberosTests(RawKerberosTest): > pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) > >- enc_pa_ts_usage = 1 >- pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) > > pa_ts = self.PA_DATA_create(2, pa_ts) >@@ -115,8 +119,7 @@ class S4UKerberosTests(RawKerberosTest): > msg_type = rep['msg-type'] > self.assertEqual(msg_type, 11) > >- usage = 3 >- enc_part2 = key.decrypt(usage, rep['enc-part']['cipher']) >+ enc_part2 = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher']) > enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) > > # S4U2Self Request >@@ -135,7 +138,6 @@ class S4UKerberosTests(RawKerberosTest): > padata = [pa_s4u] > > subkey = self.RandomKey(ticket_session_key.etype) >- subkey_usage = 9 > > (ctime, cusec) = self.get_KerberosTimeWithUsec() > >@@ -163,7 +165,8 @@ class S4UKerberosTests(RawKerberosTest): > > msg_type = rep['msg-type'] > if msg_type == 13: >- enc_part2 = subkey.decrypt(subkey_usage, rep['enc-part']['cipher']) >+ enc_part2 = subkey.decrypt( >+ KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher']) > enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) > > return msg_type >diff --git a/python/samba/tests/krb5/simple_tests.py b/python/samba/tests/krb5/simple_tests.py >index 236fbda1cd5..6c090af3d46 100755 >--- a/python/samba/tests/krb5/simple_tests.py >+++ b/python/samba/tests/krb5/simple_tests.py >@@ -23,6 +23,11 @@ sys.path.insert(0, "bin/python") > os.environ["PYTHONUNBUFFERED"] = "1" > > from samba.tests.krb5.raw_testcase import RawKerberosTest >+from samba.tests.krb5.rfc4120_constants import ( >+ KU_AS_REP_ENC_PART, >+ KU_PA_ENC_TIMESTAMP, >+ KU_TGS_REP_ENC_PART_SUB_KEY, >+) > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > > global_asn1_print = False >@@ -84,8 +89,7 @@ class SimpleKerberosTests(RawKerberosTest): > pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) > >- enc_pa_ts_usage = 1 >- pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) > > pa_ts = self.PA_DATA_create(2, pa_ts) >@@ -113,8 +117,7 @@ class SimpleKerberosTests(RawKerberosTest): > msg_type = rep['msg-type'] > self.assertEqual(msg_type, 11) > >- usage = 3 >- enc_part2 = key.decrypt(usage, rep['enc-part']['cipher']) >+ enc_part2 = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher']) > > # MIT KDC encodes both EncASRepPart and EncTGSRepPart with application tag 26 > try: >@@ -134,7 +137,6 @@ class SimpleKerberosTests(RawKerberosTest): > padata = [] > > subkey = self.RandomKey(ticket_session_key.etype) >- subkey_usage = 9 > > (ctime, cusec) = self.get_KerberosTimeWithUsec() > >@@ -163,7 +165,8 @@ class SimpleKerberosTests(RawKerberosTest): > msg_type = rep['msg-type'] > self.assertEqual(msg_type, 13) > >- enc_part2 = subkey.decrypt(subkey_usage, rep['enc-part']['cipher']) >+ enc_part2 = subkey.decrypt( >+ KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher']) > enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) > > return >diff --git a/python/samba/tests/krb5/xrealm_tests.py b/python/samba/tests/krb5/xrealm_tests.py >index 64064b8a670..b4a02bff33a 100755 >--- a/python/samba/tests/krb5/xrealm_tests.py >+++ b/python/samba/tests/krb5/xrealm_tests.py >@@ -23,6 +23,11 @@ sys.path.insert(0, "bin/python") > os.environ["PYTHONUNBUFFERED"] = "1" > > from samba.tests.krb5.raw_testcase import RawKerberosTest >+from samba.tests.krb5.rfc4120_constants import ( >+ KU_PA_ENC_TIMESTAMP, >+ KU_AS_REP_ENC_PART, >+ KU_TGS_REP_ENC_PART_SUB_KEY, >+) > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > import samba.tests > >@@ -85,8 +90,7 @@ class XrealmKerberosTests(RawKerberosTest): > pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) > >- enc_pa_ts_usage = 1 >- pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts) > pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) > > pa_ts = self.PA_DATA_create(2, pa_ts) >@@ -114,8 +118,7 @@ class XrealmKerberosTests(RawKerberosTest): > msg_type = rep['msg-type'] > self.assertEqual(msg_type, 11) > >- usage = 3 >- enc_part2 = key.decrypt(usage, rep['enc-part']['cipher']) >+ enc_part2 = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher']) > > # MIT KDC encodes both EncASRepPart and EncTGSRepPart with application tag 26 > try: >@@ -134,7 +137,6 @@ class XrealmKerberosTests(RawKerberosTest): > padata = [] > > subkey = self.RandomKey(ticket_session_key.etype) >- subkey_usage = 9 > > (ctime, cusec) = self.get_KerberosTimeWithUsec() > >@@ -163,7 +165,8 @@ class XrealmKerberosTests(RawKerberosTest): > msg_type = rep['msg-type'] > self.assertEqual(msg_type, 13) > >- enc_part2 = subkey.decrypt(subkey_usage, rep['enc-part']['cipher']) >+ enc_part2 = subkey.decrypt( >+ KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher']) > enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) > > # Check the forwardable flag >-- >2.25.1 > > >From c139411bf2beeb3e95025c8ec29788dea7ba006c Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Fri, 11 Dec 2020 11:55:01 +1300 >Subject: [PATCH 060/380] tests python krb5: PEP8 cleanups > >Fix all the PEP8 warnings in samba/tests/krb5. With the exception of >rfc4120_pyasn1.py, which is generated from rfc4120.asn1. > >As these tests are new, it makes sense to ensure that they conform to >PEP8. And set an aspirational goal for the rest of our python code. > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Autobuild-User(master): Gary Lockyer <gary@samba.org> >Autobuild-Date(master): Mon Dec 21 21:29:28 UTC 2020 on sn-devel-184 > >(cherry picked from commit c00d537526ca881c540ff66e703ad9c96dd1face) >--- > .../tests/krb5/as_canonicalization_tests.py | 54 ++- > .../samba/tests/krb5/compatability_tests.py | 24 +- > python/samba/tests/krb5/kcrypto.py | 67 +-- > python/samba/tests/krb5/kdc_base_test.py | 4 +- > python/samba/tests/krb5/kdc_tests.py | 17 +- > python/samba/tests/krb5/raw_testcase.py | 409 +++++++++++------- > python/samba/tests/krb5/rfc4120_constants.py | 32 +- > python/samba/tests/krb5/s4u_tests.py | 19 +- > python/samba/tests/krb5/simple_tests.py | 24 +- > python/samba/tests/krb5/xrealm_tests.py | 26 +- > 10 files changed, 413 insertions(+), 263 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index e89b40eab8f..43f532dc483 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -31,8 +31,6 @@ import samba > from samba.auth import system_session > from samba.credentials import ( > Credentials, >- CLI_CRED_NTLMv2_AUTH, >- CLI_CRED_NTLM_AUTH, > DONT_USE_KERBEROS) > from samba.dcerpc.misc import SEC_CHAN_WKSTA > from samba.dsdb import ( >@@ -41,7 +39,20 @@ from samba.dsdb import ( > UF_NORMAL_ACCOUNT) > from samba.samdb import SamDB > from samba.tests import delete_force, DynamicTestCase >-from samba.tests.krb5.rfc4120_constants import * >+from samba.tests.krb5.rfc4120_constants import ( >+ AES256_CTS_HMAC_SHA1_96, >+ AES128_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5, >+ KDC_ERR_PREAUTH_REQUIRED, >+ KRB_AS_REP, >+ KU_AS_REP_ENC_PART, >+ KRB_ERROR, >+ KU_PA_ENC_TIMESTAMP, >+ PADATA_ENC_TIMESTAMP, >+ NT_ENTERPRISE_PRINCIPAL, >+ NT_PRINCIPAL, >+ NT_SRV_INST, >+) > > global_asn1_print = False > global_hexdump = False >@@ -49,15 +60,15 @@ global_hexdump = False > > @unique > class TestOptions(Enum): >- Canonicalize = 1 >- Enterprise = 2 >- UpperRealm = 4 >- UpperUserName = 8 >- NetbiosRealm = 16 >- UPN = 32 >- RemoveDollar = 64 >- AsReqSelf = 128 >- Last = 256 >+ Canonicalize = 1 >+ Enterprise = 2 >+ UpperRealm = 4 >+ UpperUserName = 8 >+ NetbiosRealm = 16 >+ UPN = 32 >+ RemoveDollar = 64 >+ AsReqSelf = 128 >+ Last = 256 > > def is_set(self, x): > return self.value & x >@@ -65,7 +76,7 @@ class TestOptions(Enum): > > @unique > class CredentialsType(Enum): >- User = 1 >+ User = 1 > Machine = 2 > > def is_set(self, x): >@@ -126,7 +137,8 @@ class TestData: > > > MACHINE_NAME = "tstkrb5cnnmch" >-USER_NAME = "tstkrb5cnnusr" >+USER_NAME = "tstkrb5cnnusr" >+ > > @DynamicTestCase > class KerberosASCanonicalizationTests(RawKerberosTest): >@@ -160,21 +172,21 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > > @classmethod > def setUpClass(cls): >- cls.lp = cls.get_loadparm(cls) >+ cls.lp = cls.get_loadparm(cls) > cls.username = os.environ["USERNAME"] > cls.password = os.environ["PASSWORD"] >- cls.host = os.environ["SERVER"] >+ cls.host = os.environ["SERVER"] > > c = Credentials() > c.set_username(cls.username) > c.set_password(cls.password) > try: >- realm = os.environ["REALM"] >+ realm = os.environ["REALM"] > c.set_realm(realm) > except KeyError: > pass > try: >- domain = os.environ["DOMAIN"] >+ domain = os.environ["DOMAIN"] > c.set_domain(domain) > except KeyError: > pass >@@ -200,7 +212,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > def setUp(self): > super(KerberosASCanonicalizationTests, self).setUp() > self.do_asn1_print = global_asn1_print >- self.do_hexdump = global_hexdump >+ self.do_hexdump = global_hexdump > > # > # Create a test user account >@@ -340,7 +352,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > # > # Check the protocol version, should be 5 > self.assertEqual( >- rep['pvno'], 5, "Data {0}".format(str(data))) >+ rep['pvno'], 5, "Data {0}".format(str(data))) > > self.assertEqual( > rep['msg-type'], KRB_ERROR, "Data {0}".format(str(data))) >@@ -397,7 +409,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > # > # Check the protocol version, should be 5 > self.assertEqual( >- rep['pvno'], 5, "Data {0}".format(str(data))) >+ rep['pvno'], 5, "Data {0}".format(str(data))) > > msg_type = rep['msg-type'] > # Should not have got an error. >diff --git a/python/samba/tests/krb5/compatability_tests.py b/python/samba/tests/krb5/compatability_tests.py >index 0b3701cd60d..5a1ef02ef80 100755 >--- a/python/samba/tests/krb5/compatability_tests.py >+++ b/python/samba/tests/krb5/compatability_tests.py >@@ -25,7 +25,20 @@ os.environ["PYTHONUNBUFFERED"] = "1" > > from samba.tests.krb5.raw_testcase import RawKerberosTest > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >-from samba.tests.krb5.rfc4120_constants import * >+from samba.tests.krb5.rfc4120_constants import ( >+ AES128_CTS_HMAC_SHA1_96, >+ AES256_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5, >+ KDC_ERR_PREAUTH_REQUIRED, >+ KRB_AS_REP, >+ KRB_ERROR, >+ KU_AS_REP_ENC_PART, >+ KU_PA_ENC_TIMESTAMP, >+ PADATA_ENC_TIMESTAMP, >+ PADATA_ETYPE_INFO2, >+ NT_PRINCIPAL, >+ NT_SRV_INST, >+) > > global_asn1_print = False > global_hexdump = False >@@ -112,18 +125,17 @@ class SimpleKerberosTests(RawKerberosTest): > realm = creds.get_realm() > > cname = self.PrincipalName_create( >- name_type=NT_PRINCIPAL, >- names=[user]) >+ name_type=NT_PRINCIPAL, >+ names=[user]) > sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, >- names=["krbtgt", realm]) >+ name_type=NT_SRV_INST, >+ names=["krbtgt", realm]) > > till = self.get_KerberosTime(offset=36000) > > kdc_options = krb5_asn1.KDCOptions('forwardable') > padata = None > >- > req = self.AS_REQ_create(padata=padata, > kdc_options=str(kdc_options), > cname=cname, >diff --git a/python/samba/tests/krb5/kcrypto.py b/python/samba/tests/krb5/kcrypto.py >index 2572fa5bab3..23502d7bb62 100755 >--- a/python/samba/tests/krb5/kcrypto.py >+++ b/python/samba/tests/krb5/kcrypto.py >@@ -64,6 +64,7 @@ from samba.credentials import Credentials > from samba import generate_random_bytes as get_random_bytes > from samba.compat import get_string, get_bytes > >+ > class Enctype(object): > DES_CRC = 1 > DES_MD4 = 2 >@@ -112,26 +113,30 @@ def _mac_equal(mac1, mac2): > res |= x ^ y > return res == 0 > >+ > def SIMPLE_HASH(string, algo_cls): > hash_ctx = hashes.Hash(algo_cls(), default_backend()) > hash_ctx.update(string) > return hash_ctx.finalize() > >+ > def HMAC_HASH(key, string, algo_cls): > hmac_ctx = hmac.HMAC(key, algo_cls(), default_backend()) > hmac_ctx.update(string) > return hmac_ctx.finalize() > >+ > def _nfold(str, nbytes): > # Convert str to a string of length nbytes using the RFC 3961 nfold > # operation. > > # Rotate the bytes in str to the right by nbits bits. > def rotate_right(str, nbits): >- nbytes, remain = (nbits//8) % len(str), nbits % 8 >- return bytes([(str[i-nbytes] >> remain) | >- (str[i-nbytes-1] << (8-remain) & 0xff) >- for i in range(len(str))]) >+ nbytes, remain = (nbits // 8) % len(str), nbits % 8 >+ return bytes([ >+ (str[i - nbytes] >> remain) >+ | (str[i - nbytes - 1] << (8 - remain) & 0xff) >+ for i in range(len(str))]) > > # Add equal-length strings together with end-around carry. > def add_ones_complement(str1, str2): >@@ -139,7 +144,7 @@ def _nfold(str, nbytes): > v = [a + b for a, b in zip(str1, str2)] > # Propagate carry bits to the left until there aren't any left. > while any(x & ~0xff for x in v): >- v = [(v[i-n+1]>>8) + (v[i]&0xff) for i in range(n)] >+ v = [(v[i - n + 1] >> 8) + (v[i] & 0xff) for i in range(n)] > return bytes([x for x in v]) > > # Concatenate copies of str to produce the least common multiple >@@ -150,7 +155,7 @@ def _nfold(str, nbytes): > slen = len(str) > lcm = nbytes * slen // gcd(nbytes, slen) > bigstr = b''.join((rotate_right(str, 13 * i) for i in range(lcm // slen))) >- slices = (bigstr[p:p+nbytes] for p in range(0, lcm, nbytes)) >+ slices = (bigstr[p:p + nbytes] for p in range(0, lcm, nbytes)) > return reduce(add_ones_complement, slices) > > >@@ -275,7 +280,7 @@ class _DES3CBC(_SimplifiedEnctype): > return b if bin(b & ~1).count('1') % 2 else b | 1 > assert len(seed) == 7 > firstbytes = [parity(b & ~1) for b in seed] >- lastbyte = parity(sum((seed[i]&1) << i+1 for i in range(7))) >+ lastbyte = parity(sum((seed[i] & 1) << i + 1 for i in range(7))) > keybytes = bytes([b for b in firstbytes + [lastbyte]]) > if _is_weak_des_key(keybytes): > keybytes[7] = bytes([keybytes[7] ^ 0xF0]) >@@ -369,7 +374,7 @@ class _AESEnctype(_SimplifiedEnctype): > if len(ciphertext) == 16: > return aes_decrypt(ciphertext) > # Split the ciphertext into blocks. The last block may be partial. >- cblocks = [ciphertext[p:p+16] for p in range(0, len(ciphertext), 16)] >+ cblocks = [ciphertext[p:p + 16] for p in range(0, len(ciphertext), 16)] > lastlen = len(cblocks[-1]) > # CBC-decrypt all but the last two blocks. > prev_cblock = bytes(16) >@@ -383,7 +388,7 @@ class _AESEnctype(_SimplifiedEnctype): > # will be the omitted bytes of ciphertext from the final > # block. > b = aes_decrypt(cblocks[-2]) >- lastplaintext =_xorbytes(b[:lastlen], cblocks[-1]) >+ lastplaintext = _xorbytes(b[:lastlen], cblocks[-1]) > omitted = b[lastlen:] > # Decrypt the final cipher block plus the omitted bytes to get > # the second-to-last plaintext block. >@@ -433,7 +438,8 @@ class _RC4(_EnctypeProfile): > cksum = HMAC_HASH(ki, confounder + plaintext, hashes.MD5) > ke = HMAC_HASH(ki, cksum, hashes.MD5) > >- encryptor = Cipher(ciphers.ARC4(ke), None, default_backend()).encryptor() >+ encryptor = Cipher( >+ ciphers.ARC4(ke), None, default_backend()).encryptor() > ctext = encryptor.update(confounder + plaintext) > > return cksum + ctext >@@ -446,7 +452,8 @@ class _RC4(_EnctypeProfile): > ki = HMAC_HASH(key.contents, cls.usage_str(keyusage), hashes.MD5) > ke = HMAC_HASH(ki, cksum, hashes.MD5) > >- decryptor = Cipher(ciphers.ARC4(ke), None, default_backend()).decryptor() >+ decryptor = Cipher( >+ ciphers.ARC4(ke), None, default_backend()).decryptor() > basic_plaintext = decryptor.update(basic_ctext) > > exp_cksum = HMAC_HASH(ki, basic_plaintext, hashes.MD5) >@@ -636,14 +643,14 @@ def verify_checksum(cksumtype, key, keyusage, text, cksum): > c.verify(key, keyusage, text, cksum) > > >-def prfplus(key, pepper, l): >- # Produce l bytes of output using the RFC 6113 PRF+ function. >+def prfplus(key, pepper, ln): >+ # Produce ln bytes of output using the RFC 6113 PRF+ function. > out = b'' > count = 1 >- while len(out) < l: >+ while len(out) < ln: > out += prf(key, bytes([count]) + pepper) > count += 1 >- return out[:l] >+ return out[:ln] > > > def cf2(enctype, key1, key2, pepper1, pepper2): >@@ -653,9 +660,11 @@ def cf2(enctype, key1, key2, pepper1, pepper2): > return e.random_to_key(_xorbytes(prfplus(key1, pepper1, e.seedsize), > prfplus(key2, pepper2, e.seedsize))) > >+ > def h(hexstr): > return bytes.fromhex(hexstr) > >+ > class KcrytoTest(TestCase): > """kcrypto Test case.""" > >@@ -665,20 +674,21 @@ class KcrytoTest(TestCase): > conf = h('94B491F481485B9A0678CD3C4EA386AD') > keyusage = 2 > plain = b'9 bytesss' >- ctxt = h('68FB9679601F45C78857B2BF820FD6E53ECA8D42FD4B1D7024A09205ABB7CD2E' >- 'C26C355D2F') >+ ctxt = h('68FB9679601F45C78857B2BF820FD6E53ECA8D42FD4B1D7024A09205ABB7' >+ 'CD2EC26C355D2F') > k = Key(Enctype.AES128, kb) > self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt) > self.assertEqual(decrypt(k, keyusage, ctxt), plain) > > def test_aes256_crypt(self): > # AES256 encrypt and decrypt >- kb = h('F1C795E9248A09338D82C3F8D5B567040B0110736845041347235B1404231398') >+ kb = h('F1C795E9248A09338D82C3F8D5B567040B0110736845041347235B14042313' >+ '98') > conf = h('E45CA518B42E266AD98E165E706FFB60') > keyusage = 4 > plain = b'30 bytes bytes bytes bytes byt' >- ctxt = h('D1137A4D634CFECE924DBC3BF6790648BD5CFF7DE0E7B99460211D0DAEF3D79A' >- '295C688858F3B34B9CBD6EEBAE81DAF6B734D4D498B6714F1C1D') >+ ctxt = h('D1137A4D634CFECE924DBC3BF6790648BD5CFF7DE0E7B99460211D0DAEF3' >+ 'D79A295C688858F3B34B9CBD6EEBAE81DAF6B734D4D498B6714F1C1D') > k = Key(Enctype.AES256, kb) > self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt) > self.assertEqual(decrypt(k, keyusage, ctxt), plain) >@@ -694,7 +704,8 @@ class KcrytoTest(TestCase): > > def test_aes256_checksum(self): > # AES256 checksum >- kb = h('B1AE4CD8462AFF1677053CC9279AAC30B796FB81CE21474DD3DDBCFEA4EC76D7') >+ kb = h('B1AE4CD8462AFF1677053CC9279AAC30B796FB81CE21474DD3DDBC' >+ 'FEA4EC76D7') > keyusage = 4 > plain = b'fourteen' > cksum = h('E08739E3279E2903EC8E3836') >@@ -715,7 +726,8 @@ class KcrytoTest(TestCase): > string = b'X' * 64 > salt = b'pass phrase equals block size' > params = h('000004B0') >- kb = h('89ADEE3608DB8BC71F1BFBFE459486B05618B70CBAE22092534E56C553BA4B34') >+ kb = h('89ADEE3608DB8BC71F1BFBFE459486B05618B70CBAE22092534E56' >+ 'C553BA4B34') > k = string_to_key(Enctype.AES256, string, salt, params) > self.assertEqual(k.contents, kb) > >@@ -741,7 +753,8 @@ class KcrytoTest(TestCase): > > def test_aes256_cf2(self): > # AES256 cf2 >- kb = h('4D6CA4E629785C1F01BAF55E2E548566B9617AE3A96868C337CB93B5E72B1C7B') >+ kb = h('4D6CA4E629785C1F01BAF55E2E548566B9617AE3A96868C337CB93B5' >+ 'E72B1C7B') > k1 = string_to_key(Enctype.AES256, b'key1', b'key1') > k2 = string_to_key(Enctype.AES256, b'key2', b'key2') > k = cf2(Enctype.AES256, k1, k2, b'a', b'b') >@@ -753,8 +766,8 @@ class KcrytoTest(TestCase): > conf = h('94690A17B2DA3C9B') > keyusage = 3 > plain = b'13 bytes byte' >- ctxt = h('839A17081ECBAFBCDC91B88C6955DD3C4514023CF177B77BF0D0177A16F705E8' >- '49CB7781D76A316B193F8D30') >+ ctxt = h('839A17081ECBAFBCDC91B88C6955DD3C4514023CF177B77BF0D0177A16F7' >+ '05E849CB7781D76A316B193F8D30') > k = Key(Enctype.DES3, kb) > self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt) > self.assertEqual(decrypt(k, keyusage, ctxt), _zeropad(plain, 8)) >@@ -790,8 +803,8 @@ class KcrytoTest(TestCase): > conf = h('37245E73A45FBF72') > keyusage = 4 > plain = b'30 bytes bytes bytes bytes byt' >- ctxt = h('95F9047C3AD75891C2E9B04B16566DC8B6EB9CE4231AFB2542EF87A7B5A0F260' >- 'A99F0460508DE0CECC632D07C354124E46C5D2234EB8') >+ ctxt = h('95F9047C3AD75891C2E9B04B16566DC8B6EB9CE4231AFB2542EF87A7B5A0' >+ 'F260A99F0460508DE0CECC632D07C354124E46C5D2234EB8') > k = Key(Enctype.RC4, kb) > self.assertEqual(encrypt(k, keyusage, plain, conf), ctxt) > self.assertEqual(decrypt(k, keyusage, ctxt), plain) >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index e835d389f1c..bef5458c881 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -374,8 +374,8 @@ class KDCBaseTest(RawKerberosTest): > account_name = ( > pac.info.info.info3.base.account_name) > user_sid = ( >- str(pac.info.info.info3.base.domain_sid) + >- "-" + str(pac.info.info.info3.base.rid)) >+ str(pac.info.info.info3.base.domain_sid) >+ + "-" + str(pac.info.info.info3.base.rid)) > elif pac.type == self.PAC_LOGON_NAME: > logon_name = pac.info.account_name > elif pac.type == self.PAC_UPN_DNS_INFO: >diff --git a/python/samba/tests/krb5/kdc_tests.py b/python/samba/tests/krb5/kdc_tests.py >index 17b9d154bd9..c7c53953a86 100755 >--- a/python/samba/tests/krb5/kdc_tests.py >+++ b/python/samba/tests/krb5/kdc_tests.py >@@ -25,7 +25,20 @@ os.environ["PYTHONUNBUFFERED"] = "1" > > from samba.tests.krb5.raw_testcase import RawKerberosTest > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >-from samba.tests.krb5.rfc4120_constants import * >+from samba.tests.krb5.rfc4120_constants import ( >+ AES256_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5, >+ KDC_ERR_PREAUTH_FAILED, >+ KDC_ERR_PREAUTH_REQUIRED, >+ KDC_ERR_SKEW, >+ KRB_AS_REP, >+ KRB_ERROR, >+ KU_PA_ENC_TIMESTAMP, >+ PADATA_ENC_TIMESTAMP, >+ PADATA_ETYPE_INFO2, >+ NT_PRINCIPAL, >+ NT_SRV_INST, >+) > > global_asn1_print = False > global_hexdump = False >@@ -83,7 +96,7 @@ class KdcTests(RawKerberosTest): > break > > etype_info2 = self.der_decode( >- etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) > > key = self.PasswordKey_from_etype_info2(creds, etype_info2[0]) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index e67f5464e59..82e68ee7019 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -35,7 +35,10 @@ from pyasn1.codec.native.decoder import decode as pyasn1_native_decode > from pyasn1.codec.native.encoder import encode as pyasn1_native_encode > > from pyasn1.codec.ber.encoder import BitStringEncoder as BitStringEncoder >-def BitStringEncoder_encodeValue32(self, value, asn1Spec, encodeFun, **options): >+ >+ >+def BitStringEncoder_encodeValue32( >+ self, value, asn1Spec, encodeFun, **options): > # > # BitStrings like KDCOptions or TicketFlags should at least > # be 32-Bit on the wire >@@ -59,14 +62,17 @@ def BitStringEncoder_encodeValue32(self, value, asn1Spec, encodeFun, **options): > padding = 0 > ret = b'\x00' + substrate + (b'\x00' * padding) > return ret, False, True >+ >+ > BitStringEncoder.encodeValue = BitStringEncoder_encodeValue32 > >+ > def BitString_NamedValues_prettyPrint(self, scope=0): > ret = "%s" % self.asBinary() > bits = [] > highest_bit = 32 > for byte in self.asNumbers(): >- for bit in [7,6,5,4,3,2,1,0]: >+ for bit in [7, 6, 5, 4, 3, 2, 1, 0]: > mask = 1 << bit > if byte & mask: > val = 1 >@@ -89,12 +95,21 @@ def BitString_NamedValues_prettyPrint(self, scope=0): > delim = ",\n%s " % indent > ret += "\n%s)" % indent > return ret >-krb5_asn1.TicketFlags.prettyPrintNamedValues = krb5_asn1.TicketFlagsValues.namedValues >-krb5_asn1.TicketFlags.namedValues = krb5_asn1.TicketFlagsValues.namedValues >-krb5_asn1.TicketFlags.prettyPrint = BitString_NamedValues_prettyPrint >-krb5_asn1.KDCOptions.prettyPrintNamedValues = krb5_asn1.KDCOptionsValues.namedValues >-krb5_asn1.KDCOptions.namedValues = krb5_asn1.KDCOptionsValues.namedValues >-krb5_asn1.KDCOptions.prettyPrint = BitString_NamedValues_prettyPrint >+ >+ >+krb5_asn1.TicketFlags.prettyPrintNamedValues =\ >+ krb5_asn1.TicketFlagsValues.namedValues >+krb5_asn1.TicketFlags.namedValues =\ >+ krb5_asn1.TicketFlagsValues.namedValues >+krb5_asn1.TicketFlags.prettyPrint =\ >+ BitString_NamedValues_prettyPrint >+krb5_asn1.KDCOptions.prettyPrintNamedValues =\ >+ krb5_asn1.KDCOptionsValues.namedValues >+krb5_asn1.KDCOptions.namedValues =\ >+ krb5_asn1.KDCOptionsValues.namedValues >+krb5_asn1.KDCOptions.prettyPrint =\ >+ BitString_NamedValues_prettyPrint >+ > > def Integer_NamedValues_prettyPrint(self, scope=0): > intval = int(self) >@@ -104,16 +119,29 @@ def Integer_NamedValues_prettyPrint(self, scope=0): > name = "<__unknown__>" > ret = "%d (0x%x) %s" % (intval, intval, name) > return ret >-krb5_asn1.NameType.prettyPrintNamedValues = krb5_asn1.NameTypeValues.namedValues >-krb5_asn1.NameType.prettyPrint = Integer_NamedValues_prettyPrint >-krb5_asn1.AuthDataType.prettyPrintNamedValues = krb5_asn1.AuthDataTypeValues.namedValues >-krb5_asn1.AuthDataType.prettyPrint = Integer_NamedValues_prettyPrint >-krb5_asn1.PADataType.prettyPrintNamedValues = krb5_asn1.PADataTypeValues.namedValues >-krb5_asn1.PADataType.prettyPrint = Integer_NamedValues_prettyPrint >-krb5_asn1.EncryptionType.prettyPrintNamedValues = krb5_asn1.EncryptionTypeValues.namedValues >-krb5_asn1.EncryptionType.prettyPrint = Integer_NamedValues_prettyPrint >-krb5_asn1.ChecksumType.prettyPrintNamedValues = krb5_asn1.ChecksumTypeValues.namedValues >-krb5_asn1.ChecksumType.prettyPrint = Integer_NamedValues_prettyPrint >+ >+ >+krb5_asn1.NameType.prettyPrintNamedValues =\ >+ krb5_asn1.NameTypeValues.namedValues >+krb5_asn1.NameType.prettyPrint =\ >+ Integer_NamedValues_prettyPrint >+krb5_asn1.AuthDataType.prettyPrintNamedValues =\ >+ krb5_asn1.AuthDataTypeValues.namedValues >+krb5_asn1.AuthDataType.prettyPrint =\ >+ Integer_NamedValues_prettyPrint >+krb5_asn1.PADataType.prettyPrintNamedValues =\ >+ krb5_asn1.PADataTypeValues.namedValues >+krb5_asn1.PADataType.prettyPrint =\ >+ Integer_NamedValues_prettyPrint >+krb5_asn1.EncryptionType.prettyPrintNamedValues =\ >+ krb5_asn1.EncryptionTypeValues.namedValues >+krb5_asn1.EncryptionType.prettyPrint =\ >+ Integer_NamedValues_prettyPrint >+krb5_asn1.ChecksumType.prettyPrintNamedValues =\ >+ krb5_asn1.ChecksumTypeValues.namedValues >+krb5_asn1.ChecksumType.prettyPrint =\ >+ Integer_NamedValues_prettyPrint >+ > > class Krb5EncryptionKey(object): > def __init__(self, key, kvno): >@@ -146,9 +174,10 @@ class Krb5EncryptionKey(object): > EncryptionKey_obj = { > 'keytype': self.etype, > 'keyvalue': self.key.contents, >- }; >+ } > return EncryptionKey_obj > >+ > class RawKerberosTest(TestCase): > """A raw Kerberos Test case.""" > >@@ -182,13 +211,13 @@ class RawKerberosTest(TestCase): > self.s = socket.socket(self.a[0][0], self.a[0][1], self.a[0][2]) > self.s.settimeout(10) > self.s.connect(self.a[0][4]) >- except socket.error as e: >+ except socket.error: > self.s.close() > raise >- except IOError as e: >+ except IOError: > self.s.close() > raise >- except Exception as e: >+ except Exception: > raise > finally: > pass >@@ -219,8 +248,9 @@ class RawKerberosTest(TestCase): > domain = samba.tests.env_get_var_value('DOMAIN') > realm = samba.tests.env_get_var_value('REALM') > username = samba.tests.env_get_var_value('SERVICE_USERNAME') >- password = samba.tests.env_get_var_value('SERVICE_PASSWORD', >- allow_missing=allow_missing_password) >+ password = samba.tests.env_get_var_value( >+ 'SERVICE_PASSWORD', >+ allow_missing=allow_missing_password) > c.set_domain(domain) > c.set_realm(realm) > c.set_username(username) >@@ -246,21 +276,34 @@ class RawKerberosTest(TestCase): > if hexdump is None: > hexdump = self.do_hexdump > if hexdump: >- sys.stderr.write("%s: %d\n%s" % (name, len(blob), self.hexdump(blob))) >- >- def der_decode(self, blob, asn1Spec=None, native_encode=True, asn1_print=None, hexdump=None): >+ sys.stderr.write( >+ "%s: %d\n%s" % (name, len(blob), self.hexdump(blob))) >+ >+ def der_decode( >+ self, >+ blob, >+ asn1Spec=None, >+ native_encode=True, >+ asn1_print=None, >+ hexdump=None): > if asn1Spec is not None: > class_name = type(asn1Spec).__name__.split(':')[0] > else: > class_name = "<None-asn1Spec>" > self.hex_dump(class_name, blob, hexdump=hexdump) >- obj,_ = pyasn1_der_decode(blob, asn1Spec=asn1Spec) >+ obj, _ = pyasn1_der_decode(blob, asn1Spec=asn1Spec) > self.asn1_dump(None, obj, asn1_print=asn1_print) > if native_encode: > obj = pyasn1_native_encode(obj) > return obj > >- def der_encode(self, obj, asn1Spec=None, native_decode=True, asn1_print=None, hexdump=None): >+ def der_encode( >+ self, >+ obj, >+ asn1Spec=None, >+ native_decode=True, >+ asn1_print=None, >+ hexdump=None): > if native_decode: > obj = pyasn1_native_decode(obj, asn1Spec=asn1Spec) > class_name = type(obj).__name__.split(':')[0] >@@ -273,7 +316,8 @@ class RawKerberosTest(TestCase): > > def send_pdu(self, req, asn1_print=None, hexdump=None): > try: >- k5_pdu = self.der_encode(req, native_decode=False, asn1_print=asn1_print, hexdump=False) >+ k5_pdu = self.der_encode( >+ req, native_decode=False, asn1_print=asn1_print, hexdump=False) > header = struct.pack('>I', len(k5_pdu)) > req_pdu = header > req_pdu += k5_pdu >@@ -304,7 +348,7 @@ class RawKerberosTest(TestCase): > self._disconnect("recv_raw: EOF") > return None > self.hex_dump("recv_raw", rep_pdu, hexdump=hexdump) >- except socket.timeout as e: >+ except socket.timeout: > self.s.settimeout(10) > sys.stderr.write("recv_raw: TIMEOUT\n") > pass >@@ -322,7 +366,8 @@ class RawKerberosTest(TestCase): > rep_pdu = None > rep = None > try: >- raw_pdu = self.recv_raw(num_recv=4, hexdump=hexdump, timeout=timeout) >+ raw_pdu = self.recv_raw( >+ num_recv=4, hexdump=hexdump, timeout=timeout) > if raw_pdu is None: > return (None, None) > header = struct.unpack(">I", raw_pdu[0:4]) >@@ -332,22 +377,27 @@ class RawKerberosTest(TestCase): > missing = k5_len > rep_pdu = b'' > while missing > 0: >- raw_pdu = self.recv_raw(num_recv=missing, hexdump=hexdump, timeout=timeout) >+ raw_pdu = self.recv_raw( >+ num_recv=missing, hexdump=hexdump, timeout=timeout) > self.assertGreaterEqual(len(raw_pdu), 1) > rep_pdu += raw_pdu > missing = k5_len - len(rep_pdu) >- k5_raw = self.der_decode(rep_pdu, asn1Spec=None, native_encode=False, >- asn1_print=False, hexdump=False) >- pvno=k5_raw['field-0'] >+ k5_raw = self.der_decode( >+ rep_pdu, >+ asn1Spec=None, >+ native_encode=False, >+ asn1_print=False, >+ hexdump=False) >+ pvno = k5_raw['field-0'] > self.assertEqual(pvno, 5) >- msg_type=k5_raw['field-1'] >- self.assertIn(msg_type, [11,13,30]) >+ msg_type = k5_raw['field-1'] >+ self.assertIn(msg_type, [11, 13, 30]) > if msg_type == 11: >- asn1Spec=krb5_asn1.AS_REP() >+ asn1Spec = krb5_asn1.AS_REP() > elif msg_type == 13: >- asn1Spec=krb5_asn1.TGS_REP() >+ asn1Spec = krb5_asn1.TGS_REP() > elif msg_type == 30: >- asn1Spec=krb5_asn1.KRB_ERROR() >+ asn1Spec = krb5_asn1.KRB_ERROR() > rep = self.der_decode(rep_pdu, asn1Spec=asn1Spec, > asn1_print=asn1_print, hexdump=False) > finally: >@@ -368,11 +418,17 @@ class RawKerberosTest(TestCase): > self.assertIsNone(self.s, msg="Is connected") > return > >- def send_recv_transaction(self, req, asn1_print=None, hexdump=None, timeout=None): >+ def send_recv_transaction( >+ self, >+ req, >+ asn1_print=None, >+ hexdump=None, >+ timeout=None): > self.connect() > try: > self.send_pdu(req, asn1_print=asn1_print, hexdump=hexdump) >- rep = self.recv_pdu(asn1_print=asn1_print, hexdump=hexdump, timeout=timeout) >+ rep = self.recv_pdu( >+ asn1_print=asn1_print, hexdump=hexdump, timeout=timeout) > except Exception: > self._disconnect("transaction failed") > raise >@@ -389,11 +445,15 @@ class RawKerberosTest(TestCase): > > def assertPrincipalEqual(self, princ1, princ2): > self.assertEqual(princ1['name-type'], princ2['name-type']) >- self.assertEqual(len(princ1['name-string']), len(princ2['name-string']), >- msg="princ1=%s != princ2=%s" % (princ1, princ2)) >+ self.assertEqual( >+ len(princ1['name-string']), >+ len(princ2['name-string']), >+ msg="princ1=%s != princ2=%s" % (princ1, princ2)) > for idx in range(len(princ1['name-string'])): >- self.assertEqual(princ1['name-string'][idx], princ2['name-string'][idx], >- msg="princ1=%s != princ2=%s" % (princ1, princ2)) >+ self.assertEqual( >+ princ1['name-string'][idx], >+ princ2['name-string'][idx], >+ msg="princ1=%s != princ2=%s" % (princ1, princ2)) > return > > def get_KerberosTimeWithUsec(self, epoch=None, offset=None): >@@ -421,7 +481,7 @@ class RawKerberosTest(TestCase): > salt = None > try: > salt = etype_info2['salt'] >- except: >+ except Exception: > pass > > if e == kcrypto.Enctype.RC4: >@@ -429,7 +489,8 @@ class RawKerberosTest(TestCase): > return self.SessionKey_create(etype=e, contents=nthash, kvno=kvno) > > password = creds.get_password() >- return self.PasswordKey_create(etype=e, pwd=password, salt=salt, kvno=kvno) >+ return self.PasswordKey_create( >+ etype=e, pwd=password, salt=salt, kvno=kvno) > > def RandomKey(self, etype): > e = kcrypto._get_enctype_profile(etype) >@@ -452,14 +513,14 @@ class RawKerberosTest(TestCase): > 'cipher': ciphertext > } > if key.kvno is not None: >- EncryptedData_obj['kvno'] = key.kvno >+ EncryptedData_obj['kvno'] = key.kvno > return EncryptedData_obj > > def Checksum_create(self, key, usage, plaintext, ctype=None): >- #Checksum ::= SEQUENCE { >+ # Checksum ::= SEQUENCE { > # cksumtype [0] Int32, > # checksum [1] OCTET STRING >- #} >+ # } > if ctype is None: > ctype = key.ctype > checksum = key.make_checksum(usage, plaintext, ctype=ctype) >@@ -494,10 +555,10 @@ class RawKerberosTest(TestCase): > return PA_DATA_obj > > def PA_ENC_TS_ENC_create(self, ts, usec): >- #PA-ENC-TS-ENC ::= SEQUENCE { >+ # PA-ENC-TS-ENC ::= SEQUENCE { > # patimestamp[0] KerberosTime, -- client's time > # pausec[1] krb5int32 OPTIONAL >- #} >+ # } > PA_ENC_TS_ENC_obj = { > 'patimestamp': ts, > 'pausec': usec, >@@ -520,7 +581,7 @@ class RawKerberosTest(TestCase): > additional_tickets, > asn1_print=None, > hexdump=None): >- #KDC-REQ-BODY ::= SEQUENCE { >+ # KDC-REQ-BODY ::= SEQUENCE { > # kdc-options [0] KDCOptions, > # cname [1] PrincipalName OPTIONAL > # -- Used only in AS-REQ --, >@@ -532,20 +593,23 @@ class RawKerberosTest(TestCase): > # till [5] KerberosTime, > # rtime [6] KerberosTime OPTIONAL, > # nonce [7] UInt32, >- # etype [8] SEQUENCE OF Int32 -- EncryptionType >+ # etype [8] SEQUENCE OF Int32 >+ # -- EncryptionType > # -- in preference order --, > # addresses [9] HostAddresses OPTIONAL, > # enc-authorization-data [10] EncryptedData OPTIONAL > # -- AuthorizationData --, > # additional-tickets [11] SEQUENCE OF Ticket OPTIONAL > # -- NOTE: not empty >- #} >+ # } > if EncAuthorizationData is not None: >- enc_ad_plain = self.der_encode(EncAuthorizationData, >- asn1Spec=krb5_asn1.AuthorizationData(), >- asn1_print=asn1_print, >- hexdump=hexdump) >- enc_ad = self.EncryptedData_create(EncAuthorizationData_key, enc_ad_plain) >+ enc_ad_plain = self.der_encode( >+ EncAuthorizationData, >+ asn1Spec=krb5_asn1.AuthorizationData(), >+ asn1_print=asn1_print, >+ hexdump=hexdump) >+ enc_ad = self.EncryptedData_create( >+ EncAuthorizationData_key, enc_ad_plain) > else: > enc_ad = None > KDC_REQ_BODY_obj = { >@@ -590,14 +654,14 @@ class RawKerberosTest(TestCase): > asn1Spec=None, > asn1_print=None, > hexdump=None): >- #KDC-REQ ::= SEQUENCE { >+ # KDC-REQ ::= SEQUENCE { > # -- NOTE: first tag is [1], not [0] > # pvno [1] INTEGER (5) , > # msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), > # padata [3] SEQUENCE OF PA-DATA OPTIONAL > # -- NOTE: not empty --, > # req-body [4] KDC-REQ-BODY >- #} >+ # } > # > KDC_REQ_BODY_obj = self.KDC_REQ_BODY_create(kdc_options, > cname, >@@ -622,39 +686,40 @@ class RawKerberosTest(TestCase): > if padata is not None: > KDC_REQ_obj['padata'] = padata > if asn1Spec is not None: >- KDC_REQ_decoded = pyasn1_native_decode(KDC_REQ_obj, asn1Spec=asn1Spec) >+ KDC_REQ_decoded = pyasn1_native_decode( >+ KDC_REQ_obj, asn1Spec=asn1Spec) > else: > KDC_REQ_decoded = None > return KDC_REQ_obj, KDC_REQ_decoded > > def AS_REQ_create(self, >- padata, # optional >- kdc_options, # required >- cname, # optional >- realm, # required >- sname, # optional >- from_time, # optional >- till_time, # required >- renew_time, # optional >- nonce, # required >- etypes, # required >- addresses, # optional >+ padata, # optional >+ kdc_options, # required >+ cname, # optional >+ realm, # required >+ sname, # optional >+ from_time, # optional >+ till_time, # required >+ renew_time, # optional >+ nonce, # required >+ etypes, # required >+ addresses, # optional > EncAuthorizationData, > EncAuthorizationData_key, > additional_tickets, > native_decoded_only=True, > asn1_print=None, > hexdump=None): >- #KDC-REQ ::= SEQUENCE { >+ # KDC-REQ ::= SEQUENCE { > # -- NOTE: first tag is [1], not [0] > # pvno [1] INTEGER (5) , > # msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), > # padata [3] SEQUENCE OF PA-DATA OPTIONAL > # -- NOTE: not empty --, > # req-body [4] KDC-REQ-BODY >- #} >+ # } > # >- #KDC-REQ-BODY ::= SEQUENCE { >+ # KDC-REQ-BODY ::= SEQUENCE { > # kdc-options [0] KDCOptions, > # cname [1] PrincipalName OPTIONAL > # -- Used only in AS-REQ --, >@@ -666,32 +731,34 @@ class RawKerberosTest(TestCase): > # till [5] KerberosTime, > # rtime [6] KerberosTime OPTIONAL, > # nonce [7] UInt32, >- # etype [8] SEQUENCE OF Int32 -- EncryptionType >+ # etype [8] SEQUENCE OF Int32 >+ # -- EncryptionType > # -- in preference order --, > # addresses [9] HostAddresses OPTIONAL, > # enc-authorization-data [10] EncryptedData OPTIONAL > # -- AuthorizationData --, > # additional-tickets [11] SEQUENCE OF Ticket OPTIONAL > # -- NOTE: not empty >- #} >- obj,decoded = self.KDC_REQ_create(msg_type=10, >- padata=padata, >- kdc_options=kdc_options, >- cname=cname, >- realm=realm, >- sname=sname, >- from_time=from_time, >- till_time=till_time, >- renew_time=renew_time, >- nonce=nonce, >- etypes=etypes, >- addresses=addresses, >- EncAuthorizationData=EncAuthorizationData, >- EncAuthorizationData_key=EncAuthorizationData_key, >- additional_tickets=additional_tickets, >- asn1Spec=krb5_asn1.AS_REQ(), >- asn1_print=asn1_print, >- hexdump=hexdump) >+ # } >+ obj, decoded = self.KDC_REQ_create( >+ msg_type=10, >+ padata=padata, >+ kdc_options=kdc_options, >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=from_time, >+ till_time=till_time, >+ renew_time=renew_time, >+ nonce=nonce, >+ etypes=etypes, >+ addresses=addresses, >+ EncAuthorizationData=EncAuthorizationData, >+ EncAuthorizationData_key=EncAuthorizationData_key, >+ additional_tickets=additional_tickets, >+ asn1Spec=krb5_asn1.AS_REQ(), >+ asn1_print=asn1_print, >+ hexdump=hexdump) > if native_decoded_only: > return decoded > return decoded, obj >@@ -703,7 +770,7 @@ class RawKerberosTest(TestCase): > # ap-options [2] APOptions, > # ticket [3] Ticket, > # authenticator [4] EncryptedData -- Authenticator >- #} >+ # } > AP_REQ_obj = { > 'pvno': 5, > 'msg-type': 14, >@@ -713,8 +780,9 @@ class RawKerberosTest(TestCase): > } > return AP_REQ_obj > >- def Authenticator_create(self, crealm, cname, cksum, cusec, ctime, subkey, seq_number, >- authorization_data): >+ def Authenticator_create( >+ self, crealm, cname, cksum, cusec, ctime, subkey, seq_number, >+ authorization_data): > # -- Unencrypted authenticator > # Authenticator ::= [APPLICATION 2] SEQUENCE { > # authenticator-vno [0] INTEGER (5), >@@ -726,7 +794,7 @@ class RawKerberosTest(TestCase): > # subkey [6] EncryptionKey OPTIONAL, > # seq-number [7] UInt32 OPTIONAL, > # authorization-data [8] AuthorizationData OPTIONAL >- #} >+ # } > Authenticator_obj = { > 'authenticator-vno': 5, > 'crealm': crealm, >@@ -745,20 +813,20 @@ class RawKerberosTest(TestCase): > return Authenticator_obj > > def TGS_REQ_create(self, >- padata, # optional >+ padata, # optional > cusec, > ctime, > ticket, >- kdc_options, # required >- cname, # optional >- realm, # required >- sname, # optional >- from_time, # optional >- till_time, # required >- renew_time, # optional >- nonce, # required >- etypes, # required >- addresses, # optional >+ kdc_options, # required >+ cname, # optional >+ realm, # required >+ sname, # optional >+ from_time, # optional >+ till_time, # required >+ renew_time, # optional >+ nonce, # required >+ etypes, # required >+ addresses, # optional > EncAuthorizationData, > EncAuthorizationData_key, > additional_tickets, >@@ -768,16 +836,16 @@ class RawKerberosTest(TestCase): > native_decoded_only=True, > asn1_print=None, > hexdump=None): >- #KDC-REQ ::= SEQUENCE { >+ # KDC-REQ ::= SEQUENCE { > # -- NOTE: first tag is [1], not [0] > # pvno [1] INTEGER (5) , > # msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), > # padata [3] SEQUENCE OF PA-DATA OPTIONAL > # -- NOTE: not empty --, > # req-body [4] KDC-REQ-BODY >- #} >+ # } > # >- #KDC-REQ-BODY ::= SEQUENCE { >+ # KDC-REQ-BODY ::= SEQUENCE { > # kdc-options [0] KDCOptions, > # cname [1] PrincipalName OPTIONAL > # -- Used only in AS-REQ --, >@@ -789,50 +857,57 @@ class RawKerberosTest(TestCase): > # till [5] KerberosTime, > # rtime [6] KerberosTime OPTIONAL, > # nonce [7] UInt32, >- # etype [8] SEQUENCE OF Int32 -- EncryptionType >+ # etype [8] SEQUENCE OF Int32 >+ # -- EncryptionType > # -- in preference order --, > # addresses [9] HostAddresses OPTIONAL, > # enc-authorization-data [10] EncryptedData OPTIONAL > # -- AuthorizationData --, > # additional-tickets [11] SEQUENCE OF Ticket OPTIONAL > # -- NOTE: not empty >- #} >- >- req_body = self.KDC_REQ_BODY_create(kdc_options=kdc_options, >- cname=None, >- realm=realm, >- sname=sname, >- from_time=from_time, >- till_time=till_time, >- renew_time=renew_time, >- nonce=nonce, >- etypes=etypes, >- addresses=addresses, >- EncAuthorizationData=EncAuthorizationData, >- EncAuthorizationData_key=EncAuthorizationData_key, >- additional_tickets=additional_tickets) >+ # } >+ >+ req_body = self.KDC_REQ_BODY_create( >+ kdc_options=kdc_options, >+ cname=None, >+ realm=realm, >+ sname=sname, >+ from_time=from_time, >+ till_time=till_time, >+ renew_time=renew_time, >+ nonce=nonce, >+ etypes=etypes, >+ addresses=addresses, >+ EncAuthorizationData=EncAuthorizationData, >+ EncAuthorizationData_key=EncAuthorizationData_key, >+ additional_tickets=additional_tickets) > req_body = self.der_encode(req_body, asn1Spec=krb5_asn1.KDC_REQ_BODY(), > asn1_print=asn1_print, hexdump=hexdump) > >- req_body_checksum = self.Checksum_create(ticket_session_key, 6, req_body, >- ctype=body_checksum_type) >+ req_body_checksum = self.Checksum_create( >+ ticket_session_key, 6, req_body, ctype=body_checksum_type) > > subkey_obj = None > if authenticator_subkey is not None: > subkey_obj = authenticator_subkey.export_obj() > seq_number = random.randint(0, 0xfffffffe) >- authenticator = self.Authenticator_create(crealm=realm, >- cname=cname, >- cksum=req_body_checksum, >- cusec=cusec, >- ctime=ctime, >- subkey=subkey_obj, >- seq_number=seq_number, >- authorization_data=None) >- authenticator = self.der_encode(authenticator, asn1Spec=krb5_asn1.Authenticator(), >- asn1_print=asn1_print, hexdump=hexdump) >- >- authenticator = self.EncryptedData_create(ticket_session_key, 7, authenticator) >+ authenticator = self.Authenticator_create( >+ crealm=realm, >+ cname=cname, >+ cksum=req_body_checksum, >+ cusec=cusec, >+ ctime=ctime, >+ subkey=subkey_obj, >+ seq_number=seq_number, >+ authorization_data=None) >+ authenticator = self.der_encode( >+ authenticator, >+ asn1Spec=krb5_asn1.Authenticator(), >+ asn1_print=asn1_print, >+ hexdump=hexdump) >+ >+ authenticator = self.EncryptedData_create( >+ ticket_session_key, 7, authenticator) > > ap_options = krb5_asn1.APOptions('0') > ap_req = self.AP_REQ_create(ap_options=str(ap_options), >@@ -846,24 +921,25 @@ class RawKerberosTest(TestCase): > else: > padata = [pa_tgs_req] > >- obj,decoded = self.KDC_REQ_create(msg_type=12, >- padata=padata, >- kdc_options=kdc_options, >- cname=None, >- realm=realm, >- sname=sname, >- from_time=from_time, >- till_time=till_time, >- renew_time=renew_time, >- nonce=nonce, >- etypes=etypes, >- addresses=addresses, >- EncAuthorizationData=EncAuthorizationData, >- EncAuthorizationData_key=EncAuthorizationData_key, >- additional_tickets=additional_tickets, >- asn1Spec=krb5_asn1.TGS_REQ(), >- asn1_print=asn1_print, >- hexdump=hexdump) >+ obj, decoded = self.KDC_REQ_create( >+ msg_type=12, >+ padata=padata, >+ kdc_options=kdc_options, >+ cname=None, >+ realm=realm, >+ sname=sname, >+ from_time=from_time, >+ till_time=till_time, >+ renew_time=renew_time, >+ nonce=nonce, >+ etypes=etypes, >+ addresses=addresses, >+ EncAuthorizationData=EncAuthorizationData, >+ EncAuthorizationData_key=EncAuthorizationData_key, >+ additional_tickets=additional_tickets, >+ asn1Spec=krb5_asn1.TGS_REQ(), >+ asn1_print=asn1_print, >+ hexdump=hexdump) > if native_decoded_only: > return decoded > return decoded, obj >@@ -888,5 +964,6 @@ class RawKerberosTest(TestCase): > 'cksum': cksum, > 'auth': "Kerberos", > } >- pa_s4u2self = self.der_encode(PA_S4U2Self_obj, asn1Spec=krb5_asn1.PA_S4U2Self()) >+ pa_s4u2self = self.der_encode( >+ PA_S4U2Self_obj, asn1Spec=krb5_asn1.PA_S4U2Self()) > return self.PA_DATA_create(129, pa_s4u2self) >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index 9de56578c99..5bbf1229d09 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -38,31 +38,31 @@ PADATA_ETYPE_INFO2 = int( > > # Error codes > KDC_ERR_C_PRINCIPAL_UNKNOWN = 6 >-KDC_ERR_PREAUTH_FAILED = 24 >-KDC_ERR_PREAUTH_REQUIRED = 25 >-KDC_ERR_BADMATCH = 36 >-KDC_ERR_SKEW = 37 >+KDC_ERR_PREAUTH_FAILED = 24 >+KDC_ERR_PREAUTH_REQUIRED = 25 >+KDC_ERR_BADMATCH = 36 >+KDC_ERR_SKEW = 37 > > # Name types >-NT_UNKNOWN = int(krb5_asn1.NameTypeValues('kRB5-NT-UNKNOWN')) >+NT_UNKNOWN = int(krb5_asn1.NameTypeValues('kRB5-NT-UNKNOWN')) > NT_PRINCIPAL = int(krb5_asn1.NameTypeValues('kRB5-NT-PRINCIPAL')) >-NT_SRV_INST = int(krb5_asn1.NameTypeValues('kRB5-NT-SRV-INST')) >+NT_SRV_INST = int(krb5_asn1.NameTypeValues('kRB5-NT-SRV-INST')) > NT_ENTERPRISE_PRINCIPAL = int(krb5_asn1.NameTypeValues( > 'kRB5-NT-ENTERPRISE-PRINCIPAL')) > > # Authorization data ad-type values > >-AD_IF_RELEVANT = 1 >-AD_INTENDED_FOR_SERVER = 2 >+AD_IF_RELEVANT = 1 >+AD_INTENDED_FOR_SERVER = 2 > AD_INTENDED_FOR_APPLICATION_CLASS = 3 >-AD_KDC_ISSUED = 4 >-AD_AND_OR = 5 >-AD_MANDATORY_TICKET_EXTENSIONS = 6 >-AD_IN_TICKET_EXTENSIONS = 7 >-AD_MANDATORY_FOR_KDC = 8 >-AD_INITIAL_VERIFIED_CAS = 9 >-AD_WIN2K_PAC = 128 >-AD_SIGNTICKET = 512 >+AD_KDC_ISSUED = 4 >+AD_AND_OR = 5 >+AD_MANDATORY_TICKET_EXTENSIONS = 6 >+AD_IN_TICKET_EXTENSIONS = 7 >+AD_MANDATORY_FOR_KDC = 8 >+AD_INITIAL_VERIFIED_CAS = 9 >+AD_WIN2K_PAC = 128 >+AD_SIGNTICKET = 512 > > # Key usage numbers > # RFC 4120 Section 7.5.1. Key Usage Numbers >diff --git a/python/samba/tests/krb5/s4u_tests.py b/python/samba/tests/krb5/s4u_tests.py >index 2e1bd3fbe1f..30a58d6345a 100755 >--- a/python/samba/tests/krb5/s4u_tests.py >+++ b/python/samba/tests/krb5/s4u_tests.py >@@ -35,6 +35,7 @@ import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > global_asn1_print = False > global_hexdump = False > >+ > class S4UKerberosTests(RawKerberosTest): > > def setUp(self): >@@ -55,7 +56,7 @@ class S4UKerberosTests(RawKerberosTest): > kdc_options = krb5_asn1.KDCOptions('forwardable') > padata = None > >- etypes=(18,17,23) >+ etypes = (18, 17, 23) > > req = self.AS_REQ_create(padata=padata, > kdc_options=str(kdc_options), >@@ -76,14 +77,16 @@ class S4UKerberosTests(RawKerberosTest): > > self.assertEqual(rep['msg-type'], 30) > self.assertEqual(rep['error-code'], 25) >- rep_padata = self.der_decode(rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) >+ rep_padata = self.der_decode( >+ rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) > > for pa in rep_padata: > if pa['padata-type'] == 19: > etype_info2 = pa['padata-value'] > break > >- etype_info2 = self.der_decode(etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ etype_info2 = self.der_decode( >+ etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) > > key = self.PasswordKey_from_etype_info2(service_creds, etype_info2[0]) > >@@ -120,7 +123,8 @@ class S4UKerberosTests(RawKerberosTest): > self.assertEqual(msg_type, 11) > > enc_part2 = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher']) >- enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) >+ enc_part2 = self.der_decode( >+ enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) > > # S4U2Self Request > sname = cname >@@ -167,11 +171,13 @@ class S4UKerberosTests(RawKerberosTest): > if msg_type == 13: > enc_part2 = subkey.decrypt( > KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher']) >- enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ enc_part2 = self.der_decode( >+ enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) > > return msg_type > >- # Using the checksum type from the tgt_session_key happens to work everywhere >+ # Using the checksum type from the tgt_session_key happens to work >+ # everywhere > def test_s4u2self(self): > msg_type = self._test_s4u2self() > self.assertEqual(msg_type, 13) >@@ -193,6 +199,7 @@ class S4UKerberosTests(RawKerberosTest): > msg_type = self._test_s4u2self(pa_s4u2self_ctype=Cksumtype.CRC32) > self.assertEqual(msg_type, 30) > >+ > if __name__ == "__main__": > global_asn1_print = True > global_hexdump = True >diff --git a/python/samba/tests/krb5/simple_tests.py b/python/samba/tests/krb5/simple_tests.py >index 6c090af3d46..889b91a9bf0 100755 >--- a/python/samba/tests/krb5/simple_tests.py >+++ b/python/samba/tests/krb5/simple_tests.py >@@ -33,6 +33,7 @@ import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > global_asn1_print = False > global_hexdump = False > >+ > class SimpleKerberosTests(RawKerberosTest): > > def setUp(self): >@@ -53,7 +54,7 @@ class SimpleKerberosTests(RawKerberosTest): > kdc_options = krb5_asn1.KDCOptions('forwardable') > padata = None > >- etypes=(18,17,23) >+ etypes = (18, 17, 23) > > req = self.AS_REQ_create(padata=padata, > kdc_options=str(kdc_options), >@@ -74,14 +75,16 @@ class SimpleKerberosTests(RawKerberosTest): > > self.assertEqual(rep['msg-type'], 30) > self.assertEqual(rep['error-code'], 25) >- rep_padata = self.der_decode(rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) >+ rep_padata = self.der_decode( >+ rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) > > for pa in rep_padata: > if pa['padata-type'] == 19: > etype_info2 = pa['padata-value'] > break > >- etype_info2 = self.der_decode(etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ etype_info2 = self.der_decode( >+ etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) > > key = self.PasswordKey_from_etype_info2(user_creds, etype_info2[0]) > >@@ -119,17 +122,21 @@ class SimpleKerberosTests(RawKerberosTest): > > enc_part2 = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher']) > >- # MIT KDC encodes both EncASRepPart and EncTGSRepPart with application tag 26 >+ # MIT KDC encodes both EncASRepPart and EncTGSRepPart with >+ # application tag 26 > try: >- enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) >+ enc_part2 = self.der_decode( >+ enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) > except Exception: >- enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ enc_part2 = self.der_decode( >+ enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) > > # TGS Request > service_creds = self.get_service_creds(allow_missing_password=True) > service_name = service_creds.get_username() > >- sname = self.PrincipalName_create(name_type=2, names=["host", service_name]) >+ sname = self.PrincipalName_create( >+ name_type=2, names=["host", service_name]) > kdc_options = krb5_asn1.KDCOptions('forwardable') > till = self.get_KerberosTime(offset=36000) > ticket = rep['ticket'] >@@ -167,7 +174,8 @@ class SimpleKerberosTests(RawKerberosTest): > > enc_part2 = subkey.decrypt( > KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher']) >- enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ enc_part2 = self.der_decode( >+ enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) > > return > >diff --git a/python/samba/tests/krb5/xrealm_tests.py b/python/samba/tests/krb5/xrealm_tests.py >index b4a02bff33a..efb953bdf7e 100755 >--- a/python/samba/tests/krb5/xrealm_tests.py >+++ b/python/samba/tests/krb5/xrealm_tests.py >@@ -34,6 +34,7 @@ import samba.tests > global_asn1_print = False > global_hexdump = False > >+ > class XrealmKerberosTests(RawKerberosTest): > > def setUp(self): >@@ -54,7 +55,7 @@ class XrealmKerberosTests(RawKerberosTest): > kdc_options = krb5_asn1.KDCOptions('forwardable') > padata = None > >- etypes=(18,17,23) >+ etypes = (18, 17, 23) > > req = self.AS_REQ_create(padata=padata, > kdc_options=str(kdc_options), >@@ -75,14 +76,16 @@ class XrealmKerberosTests(RawKerberosTest): > > self.assertEqual(rep['msg-type'], 30) > self.assertEqual(rep['error-code'], 25) >- rep_padata = self.der_decode(rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) >+ rep_padata = self.der_decode( >+ rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) > > for pa in rep_padata: > if pa['padata-type'] == 19: > etype_info2 = pa['padata-value'] > break > >- etype_info2 = self.der_decode(etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ etype_info2 = self.der_decode( >+ etype_info2, asn1Spec=krb5_asn1.ETYPE_INFO2()) > > key = self.PasswordKey_from_etype_info2(user_creds, etype_info2[0]) > >@@ -120,15 +123,19 @@ class XrealmKerberosTests(RawKerberosTest): > > enc_part2 = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher']) > >- # MIT KDC encodes both EncASRepPart and EncTGSRepPart with application tag 26 >+ # MIT KDC encodes both EncASRepPart and EncTGSRepPart with >+ # application tag 26 > try: >- enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) >+ enc_part2 = self.der_decode( >+ enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) > except Exception: >- enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ enc_part2 = self.der_decode( >+ enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) > > # TGS Request (for cross-realm TGT) > trust_realm = samba.tests.env_get_var_value('TRUST_REALM') >- sname = self.PrincipalName_create(name_type=2, names=["krbtgt", trust_realm]) >+ sname = self.PrincipalName_create( >+ name_type=2, names=["krbtgt", trust_realm]) > > kdc_options = krb5_asn1.KDCOptions('forwardable') > till = self.get_KerberosTime(offset=36000) >@@ -167,10 +174,11 @@ class XrealmKerberosTests(RawKerberosTest): > > enc_part2 = subkey.decrypt( > KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher']) >- enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) >+ enc_part2 = self.der_decode( >+ enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) > > # Check the forwardable flag >- fwd_pos = len(tuple(krb5_asn1.TicketFlags('forwardable'))) -1 >+ fwd_pos = len(tuple(krb5_asn1.TicketFlags('forwardable'))) - 1 > assert(krb5_asn1.TicketFlags(enc_part2['flags'])[fwd_pos]) > > return >-- >2.25.1 > > >From 02edeb45860dc5676003dcca9629d7eea96c75ec Mon Sep 17 00:00:00 2001 >From: Volker Lendecke <vl@samba.org> >Date: Fri, 16 Apr 2021 17:22:12 +0200 >Subject: [PATCH 061/380] librpc: Add py_descriptor_richcmp() equality function > >Only a python3 version. Do we still need the python2 flavor? > >Signed-off-by: Volker Lendecke <vl@samba.org> >Reviewed-by: Jeremy Allison <jra@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 439b7ccdc1b1c91c66c1a7c83e340fa044c26377) >--- > source4/librpc/ndr/py_security.c | 37 ++++++++++++++++++++++++++++++++ > 1 file changed, 37 insertions(+) > >diff --git a/source4/librpc/ndr/py_security.c b/source4/librpc/ndr/py_security.c >index 26989c1a433..0b8a1c66b7a 100644 >--- a/source4/librpc/ndr/py_security.c >+++ b/source4/librpc/ndr/py_security.c >@@ -309,9 +309,46 @@ static PyMethodDef py_descriptor_extra_methods[] = { > { NULL } > }; > >+static PyObject *py_descriptor_richcmp( >+ PyObject *py_self, PyObject *py_other, int op) >+{ >+ struct security_descriptor *self = pytalloc_get_ptr(py_self); >+ struct security_descriptor *other = pytalloc_get_ptr(py_other); >+ bool eq; >+ >+ if (other == NULL) { >+ Py_INCREF(Py_NotImplemented); >+ return Py_NotImplemented; >+ } >+ >+ eq = security_descriptor_equal(self, other); >+ >+ switch(op) { >+ case Py_EQ: >+ if (eq) { >+ Py_RETURN_TRUE; >+ } else { >+ Py_RETURN_FALSE; >+ } >+ break; >+ case Py_NE: >+ if (eq) { >+ Py_RETURN_FALSE; >+ } else { >+ Py_RETURN_TRUE; >+ } >+ break; >+ default: >+ break; >+ } >+ >+ return Py_NotImplemented; >+} >+ > static void py_descriptor_patch(PyTypeObject *type) > { > type->tp_new = py_descriptor_new; >+ type->tp_richcompare = py_descriptor_richcmp; > PyType_AddMethods(type, py_descriptor_extra_methods); > } > >-- >2.25.1 > > >From 1590663c4b1971ba1ae7d6636ada646dd6619345 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Wed, 17 Feb 2021 12:15:50 +1300 >Subject: [PATCH 062/380] tests python krb5: MS-KILE client principal look-up > >Tests of [MS-KILE]: Kerberos Protocol Extensions > section 3.3.5.6.1 Client Principal Lookup > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Mon Apr 12 00:38:26 UTC 2021 on sn-devel-184 > >(cherry picked from commit 768d48fca9f8c7527c0d12e7acc8942b5fd36ac2) >--- > python/samba/tests/krb5/kdc_base_test.py | 29 +- > .../ms_kile_client_principal_lookup_tests.py | 814 ++++++++++++++++++ > python/samba/tests/usage.py | 1 + > selftest/knownfail_heimdal_kdc | 12 + > selftest/knownfail_mit_kdc | 16 + > source4/selftest/tests.py | 3 + > 6 files changed, 874 insertions(+), 1 deletion(-) > create mode 100755 python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index bef5458c881..1c7f05dda6d 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -22,6 +22,7 @@ import os > sys.path.insert(0, "bin/python") > os.environ["PYTHONUNBUFFERED"] = "1" > from collections import namedtuple >+import ldb > from ldb import SCOPE_BASE > from samba import generate_random_password > from samba.auth import system_session >@@ -103,7 +104,7 @@ class KDCBaseTest(RawKerberosTest): > for dn in self.accounts: > delete_force(self.ldb, dn) > >- def create_account(self, name, machine_account=False, spn=None): >+ def create_account(self, name, machine_account=False, spn=None, upn=None): > '''Create an account for testing. > The dn of the created account is added to self.accounts, > which is used by tearDown to clean up the created accounts. >@@ -133,6 +134,8 @@ class KDCBaseTest(RawKerberosTest): > "unicodePwd": utf16pw} > if spn is not None: > details["servicePrincipalName"] = spn >+ if upn is not None: >+ details["userPrincipalName"] = upn > self.ldb.add(details) > > creds = Credentials() >@@ -418,3 +421,27 @@ class KDCBaseTest(RawKerberosTest): > self.assertTrue(len(res) == 1, "did not get objectSid for %s" % dn) > sid = self.ldb.schema_format_value("objectSID", res[0]["objectSID"][0]) > return sid.decode('utf8') >+ >+ def add_attribute(self, dn_str, name, value): >+ if isinstance(value, list): >+ values = value >+ else: >+ values = [value] >+ flag = ldb.FLAG_MOD_ADD >+ >+ dn = ldb.Dn(self.ldb, dn_str) >+ msg = ldb.Message(dn) >+ msg[name] = ldb.MessageElement(values, flag, name) >+ self.ldb.modify(msg) >+ >+ def modify_attribute(self, dn_str, name, value): >+ if isinstance(value, list): >+ values = value >+ else: >+ values = [value] >+ flag = ldb.FLAG_MOD_REPLACE >+ >+ dn = ldb.Dn(self.ldb, dn_str) >+ msg = ldb.Message(dn) >+ msg[name] = ldb.MessageElement(values, flag, name) >+ self.ldb.modify(msg) >diff --git a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >new file mode 100755 >index 00000000000..356a25f8e18 >--- /dev/null >+++ b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >@@ -0,0 +1,814 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# Copyright (C) 2020 Catalyst.Net Ltd >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+from samba.dsdb import UF_NORMAL_ACCOUNT, UF_DONT_REQUIRE_PREAUTH >+from samba.tests.krb5.kdc_base_test import KDCBaseTest >+from samba.tests.krb5.rfc4120_constants import ( >+ AES256_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5, >+ NT_ENTERPRISE_PRINCIPAL, >+ NT_PRINCIPAL, >+ NT_SRV_INST, >+ KDC_ERR_C_PRINCIPAL_UNKNOWN, >+) >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): >+ ''' Tests for MS-KILE client principal look-up >+ See [MS-KILE]: Kerberos Protocol Extensions >+ secion 3.3.5.6.1 Client Principal Lookup >+ ''' >+ >+ def setUp(self): >+ super().setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ def check_pac(self, auth_data, dn, uc, name, upn=None): >+ >+ pac_data = self.get_pac_data(auth_data) >+ sid = self.get_objectSid(dn) >+ if upn is None: >+ upn = "%s@%s" % (name, uc.get_realm().lower()) >+ if name.endswith('$'): >+ name = name[:-1] >+ >+ self.assertEqual( >+ uc.get_username(), >+ str(pac_data.account_name), >+ "pac_data = {%s}" % str(pac_data)) >+ self.assertEqual( >+ name, >+ pac_data.logon_name, >+ "pac_data = {%s}" % str(pac_data)) >+ self.assertEqual( >+ uc.get_realm(), >+ pac_data.domain_name, >+ "pac_data = {%s}" % str(pac_data)) >+ self.assertEqual( >+ upn, >+ pac_data.upn, >+ "pac_data = {%s}" % str(pac_data)) >+ self.assertEqual( >+ sid, >+ pac_data.account_sid, >+ "pac_data = {%s}" % str(pac_data)) >+ >+ def test_nt_principal_step_1(self): >+ ''' Step 1 >+ For an NT_PRINCIPAL cname with no realm or the realm matches the >+ DC's domain >+ search for an account with the >+ sAMAccountName matching the cname. >+ ''' >+ >+ # Create user and machine accounts for the test. >+ # >+ user_name = "mskileusr" >+ (uc, dn) = self.create_account(user_name) >+ realm = uc.get_realm().lower() >+ >+ mach_name = "mskilemac" >+ (mc, _) = self.create_account(mach_name, machine_account=True) >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(uc, rep) >+ key = self.get_as_rep_key(uc, rep) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[mc.get_username()]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, uc.get_realm(), ticket, key, etype) >+ self.check_tgs_reply(rep) >+ >+ # Check the contents of the pac, and the ticket >+ ticket = rep['ticket'] >+ enc_part = self.decode_service_ticket(mc, ticket) >+ self.check_pac(enc_part['authorization-data'], dn, uc, user_name) >+ # check the crealm and cname >+ cname = enc_part['cname'] >+ self.assertEqual(NT_PRINCIPAL, cname['name-type']) >+ self.assertEqual(user_name.encode('UTF8'), cname['name-string'][0]) >+ self.assertEqual(realm.upper().encode('UTF8'), enc_part['crealm']) >+ >+ def test_nt_principal_step_2(self): >+ ''' Step 2 >+ If not found >+ search for sAMAccountName equal to the cname + "$" >+ >+ ''' >+ >+ # Create a machine account for the test. >+ # >+ user_name = "mskilemac" >+ (mc, dn) = self.create_account(user_name, machine_account=True) >+ realm = mc.get_realm().lower() >+ >+ mach_name = "mskilemac" >+ (mc, _) = self.create_account(mach_name, machine_account=True) >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(mc, rep) >+ key = self.get_as_rep_key(mc, rep) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[mc.get_username()]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, mc.get_realm(), ticket, key, etype) >+ self.check_tgs_reply(rep) >+ >+ # Check the contents of the pac, and the ticket >+ ticket = rep['ticket'] >+ enc_part = self.decode_service_ticket(mc, ticket) >+ self.check_pac(enc_part['authorization-data'], dn, mc, mach_name + '$') >+ # check the crealm and cname >+ cname = enc_part['cname'] >+ self.assertEqual(NT_PRINCIPAL, cname['name-type']) >+ self.assertEqual(user_name.encode('UTF8'), cname['name-string'][0]) >+ self.assertEqual(realm.upper().encode('UTF8'), enc_part['crealm']) >+ >+ def test_nt_principal_step_3(self): >+ ''' Step 3 >+ >+ If not found >+ search for a matching UPN name where the UPN is set to >+ cname@realm or cname@DC's domain name >+ >+ ''' >+ # Create a user account for the test. >+ # >+ user_name = "mskileusr" >+ upn_name = "mskileupn" >+ upn = upn_name + "@" + self.credentials.get_realm().lower() >+ (uc, dn) = self.create_account(user_name, upn=upn) >+ realm = uc.get_realm().lower() >+ >+ mach_name = "mskilemac" >+ (mc, _) = self.create_account(mach_name, machine_account=True) >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[upn_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(uc, rep) >+ key = self.get_as_rep_key(uc, rep) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[upn_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[mc.get_username()]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, uc.get_realm(), ticket, key, etype) >+ self.check_tgs_reply(rep) >+ >+ # Check the contents of the service ticket >+ ticket = rep['ticket'] >+ enc_part = self.decode_service_ticket(mc, ticket) >+ self.check_pac(enc_part['authorization-data'], dn, uc, upn_name) >+ # check the crealm and cname >+ cname = enc_part['cname'] >+ self.assertEqual(NT_PRINCIPAL, cname['name-type']) >+ self.assertEqual(upn_name.encode('UTF8'), cname['name-string'][0]) >+ self.assertEqual(realm.upper().encode('UTF8'), enc_part['crealm']) >+ >+ def test_nt_principal_step_4_a(self): >+ ''' Step 4, no pre-authentication >+ If not found and no pre-authentication >+ search for a matching altSecurityIdentity >+ ''' >+ # Create a user account for the test. >+ # with an altSecurityIdentity, and with UF_DONT_REQUIRE_PREAUTH >+ # set. >+ # >+ # note that in this case IDL_DRSCrackNames is called with >+ # pmsgIn.formatOffered set to >+ # DS_USER_PRINCIPAL_NAME_AND_ALTSECID >+ # >+ # setting UF_DONT_REQUIRE_PREAUTH seems to be the only way >+ # to trigger the no pre-auth step >+ >+ user_name = "mskileusr" >+ alt_name = "mskilealtsec" >+ (uc, dn) = self.create_account(user_name) >+ realm = uc.get_realm().lower() >+ alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >+ self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ self.modify_attribute( >+ dn, >+ "userAccountControl", >+ str(UF_NORMAL_ACCOUNT | UF_DONT_REQUIRE_PREAUTH)) >+ >+ mach_name = "mskilemac" >+ (mc, _) = self.create_account(mach_name, machine_account=True) >+ >+ # Do the initial AS-REQ, as we've set UF_DONT_REQUIRE_PREAUTH >+ # we should get a valid AS-RESP >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[alt_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_as_reply(rep) >+ salt = "%s%s" % (realm.upper(), user_name) >+ key = self.PasswordKey_create( >+ rep['enc-part']['etype'], >+ uc.get_password(), >+ salt.encode('UTF8'), >+ rep['enc-part']['kvno']) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[alt_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[mc.get_username()]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, uc.get_realm(), ticket, key, etype) >+ self.check_tgs_reply(rep) >+ >+ # Check the contents of the service ticket >+ ticket = rep['ticket'] >+ enc_part = self.decode_service_ticket(mc, ticket) >+ # >+ # We get an empty authorization-data element in the ticket. >+ # i.e. no PAC >+ self.assertEqual([], enc_part['authorization-data']) >+ # check the crealm and cname >+ cname = enc_part['cname'] >+ self.assertEqual(NT_PRINCIPAL, cname['name-type']) >+ self.assertEqual(alt_name.encode('UTF8'), cname['name-string'][0]) >+ self.assertEqual(realm.upper().encode('UTF8'), enc_part['crealm']) >+ >+ def test_nt_principal_step_4_b(self): >+ ''' Step 4, pre-authentication >+ If not found and pre-authentication >+ search for a matching user principal name >+ ''' >+ >+ # Create user and machine accounts for the test. >+ # >+ user_name = "mskileusr" >+ alt_name = "mskilealtsec" >+ (uc, dn) = self.create_account(user_name) >+ realm = uc.get_realm().lower() >+ alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >+ self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ >+ mach_name = "mskilemac" >+ (mc, _) = self.create_account(mach_name, machine_account=True) >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[alt_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(uc, rep) >+ key = self.get_as_rep_key(uc, rep) >+ # Note: although we used the alt security id for the pre-auth >+ # we need to use the username for the auth >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[user_name]) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[mc.get_username()]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, uc.get_realm(), ticket, key, etype) >+ self.check_tgs_reply(rep) >+ >+ # Check the contents of the pac, and the ticket >+ ticket = rep['ticket'] >+ enc_part = self.decode_service_ticket(mc, ticket) >+ self.check_pac(enc_part['authorization-data'], dn, uc, user_name) >+ # check the crealm and cname >+ cname = enc_part['cname'] >+ self.assertEqual(NT_PRINCIPAL, cname['name-type']) >+ self.assertEqual(user_name.encode('UTF8'), cname['name-string'][0]) >+ self.assertEqual(realm.upper().encode('UTF8'), enc_part['crealm']) >+ >+ def test_nt_principal_step_4_c(self): >+ ''' Step 4, pre-authentication >+ If not found and pre-authentication >+ search for a matching user principal name >+ >+ This test uses the altsecid, so the AS-REQ should fail. >+ ''' >+ >+ # Create user and machine accounts for the test. >+ # >+ user_name = "mskileusr" >+ alt_name = "mskilealtsec" >+ (uc, dn) = self.create_account(user_name) >+ realm = uc.get_realm().lower() >+ alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >+ self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ >+ mach_name = "mskilemac" >+ (mc, _) = self.create_account(mach_name, machine_account=True) >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[alt_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(uc, rep) >+ # Use the alternate security identifier >+ # this should fail >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[alt_sec]) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_error_rep(rep, KDC_ERR_C_PRINCIPAL_UNKNOWN) >+ >+ def test_enterprise_principal_step_1_3(self): >+ ''' Steps 1-3 >+ For an NT_ENTERPRISE_PRINCIPAL cname >+ search for a user principal name matching the cname >+ >+ ''' >+ >+ # Create a user account for the test. >+ # >+ user_name = "mskileusr" >+ upn_name = "mskileupn" >+ upn = upn_name + "@" + self.credentials.get_realm().lower() >+ (uc, dn) = self.create_account(user_name, upn=upn) >+ realm = uc.get_realm().lower() >+ >+ mach_name = "mskilemac" >+ (mc, _) = self.create_account(mach_name, machine_account=True) >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[upn]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(uc, rep) >+ key = self.get_as_rep_key(uc, rep) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[upn]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[mc.get_username()]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, uc.get_realm(), ticket, key, etype) >+ self.check_tgs_reply(rep) >+ >+ # Check the contents of the pac, and the ticket >+ ticket = rep['ticket'] >+ enc_part = self.decode_service_ticket(mc, ticket) >+ self.check_pac( >+ enc_part['authorization-data'], dn, uc, upn, upn=upn) >+ # check the crealm and cname >+ cname = enc_part['cname'] >+ crealm = enc_part['crealm'] >+ self.assertEqual(NT_ENTERPRISE_PRINCIPAL, cname['name-type']) >+ self.assertEqual(upn.encode('UTF8'), cname['name-string'][0]) >+ self.assertEqual(realm.upper().encode('UTF8'), crealm) >+ >+ def test_enterprise_principal_step_4(self): >+ ''' Step 4 >+ >+ If that fails >+ search for an account where the sAMAccountName matches >+ the name before the @ >+ >+ ''' >+ >+ # Create a user account for the test. >+ # >+ user_name = "mskileusr" >+ (uc, dn) = self.create_account(user_name) >+ realm = uc.get_realm().lower() >+ ename = user_name + "@" + realm >+ >+ mach_name = "mskilemac" >+ (mc, _) = self.create_account(mach_name, machine_account=True) >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[ename]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(uc, rep) >+ key = self.get_as_rep_key(uc, rep) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[ename]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[mc.get_username()]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, uc.get_realm(), ticket, key, etype) >+ self.check_tgs_reply(rep) >+ >+ # Check the contents of the pac, and the ticket >+ ticket = rep['ticket'] >+ enc_part = self.decode_service_ticket(mc, ticket) >+ self.check_pac( >+ enc_part['authorization-data'], dn, uc, ename, upn=ename) >+ # check the crealm and cname >+ cname = enc_part['cname'] >+ crealm = enc_part['crealm'] >+ self.assertEqual(NT_ENTERPRISE_PRINCIPAL, cname['name-type']) >+ self.assertEqual(ename.encode('UTF8'), cname['name-string'][0]) >+ self.assertEqual(realm.upper().encode('UTF8'), crealm) >+ >+ def test_enterprise_principal_step_5(self): >+ ''' Step 5 >+ >+ If that fails >+ search for an account where the sAMAccountName matches >+ the name before the @ with a $ appended. >+ >+ ''' >+ >+ # Create a user account for the test. >+ # >+ user_name = "mskileusr" >+ (uc, _) = self.create_account(user_name) >+ realm = uc.get_realm().lower() >+ >+ mach_name = "mskilemac" >+ (mc, dn) = self.create_account(mach_name, machine_account=True) >+ ename = mach_name + "@" + realm >+ uname = mach_name + "$@" + realm >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[ename]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(mc, rep) >+ key = self.get_as_rep_key(mc, rep) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[ename]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[mc.get_username()]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, uc.get_realm(), ticket, key, etype) >+ self.check_tgs_reply(rep) >+ >+ # Check the contents of the pac, and the ticket >+ ticket = rep['ticket'] >+ enc_part = self.decode_service_ticket(mc, ticket) >+ self.check_pac( >+ enc_part['authorization-data'], dn, mc, ename, upn=uname) >+ # check the crealm and cname >+ cname = enc_part['cname'] >+ crealm = enc_part['crealm'] >+ self.assertEqual(NT_ENTERPRISE_PRINCIPAL, cname['name-type']) >+ self.assertEqual(ename.encode('UTF8'), cname['name-string'][0]) >+ self.assertEqual(realm.upper().encode('UTF8'), crealm) >+ >+ def test_enterprise_principal_step_6_a(self): >+ ''' Step 6, no pre-authentication >+ If not found and no pre-authentication >+ search for a matching altSecurityIdentity >+ ''' >+ # Create a user account for the test. >+ # with an altSecurityIdentity, and with UF_DONT_REQUIRE_PREAUTH >+ # set. >+ # >+ # note that in this case IDL_DRSCrackNames is called with >+ # pmsgIn.formatOffered set to >+ # DS_USER_PRINCIPAL_NAME_AND_ALTSECID >+ # >+ # setting UF_DONT_REQUIRE_PREAUTH seems to be the only way >+ # to trigger the no pre-auth step >+ >+ user_name = "mskileusr" >+ alt_name = "mskilealtsec" >+ (uc, dn) = self.create_account(user_name) >+ realm = uc.get_realm().lower() >+ alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >+ self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ self.modify_attribute( >+ dn, >+ "userAccountControl", >+ str(UF_NORMAL_ACCOUNT | UF_DONT_REQUIRE_PREAUTH)) >+ ename = alt_name + "@" + realm >+ >+ mach_name = "mskilemac" >+ (mc, _) = self.create_account(mach_name, machine_account=True) >+ >+ # Do the initial AS-REQ, as we've set UF_DONT_REQUIRE_PREAUTH >+ # we should get a valid AS-RESP >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[ename]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_as_reply(rep) >+ salt = "%s%s" % (realm.upper(), user_name) >+ key = self.PasswordKey_create( >+ rep['enc-part']['etype'], >+ uc.get_password(), >+ salt.encode('UTF8'), >+ rep['enc-part']['kvno']) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[ename]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[mc.get_username()]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, uc.get_realm(), ticket, key, etype) >+ self.check_tgs_reply(rep) >+ >+ # Check the contents of the service ticket >+ ticket = rep['ticket'] >+ enc_part = self.decode_service_ticket(mc, ticket) >+ # >+ # We get an empty authorization-data element in the ticket. >+ # i.e. no PAC >+ self.assertEqual([], enc_part['authorization-data']) >+ # check the crealm and cname >+ cname = enc_part['cname'] >+ self.assertEqual(NT_ENTERPRISE_PRINCIPAL, cname['name-type']) >+ self.assertEqual(ename.encode('UTF8'), cname['name-string'][0]) >+ self.assertEqual(realm.upper().encode('UTF8'), enc_part['crealm']) >+ >+ def test_nt_enterprise_principal_step_6_b(self): >+ ''' Step 4, pre-authentication >+ If not found and pre-authentication >+ search for a matching user principal name >+ ''' >+ >+ # Create user and machine accounts for the test. >+ # >+ user_name = "mskileusr" >+ alt_name = "mskilealtsec" >+ (uc, dn) = self.create_account(user_name) >+ realm = uc.get_realm().lower() >+ alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >+ self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ ename = alt_name + "@" + realm >+ uname = user_name + "@" + realm >+ >+ mach_name = "mskilemac" >+ (mc, _) = self.create_account(mach_name, machine_account=True) >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[ename]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(uc, rep) >+ key = self.get_as_rep_key(uc, rep) >+ # Note: although we used the alt security id for the pre-auth >+ # we need to use the username for the auth >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[uname]) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part2 = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part2['key']) >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, >+ names=[uname]) >+ sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, >+ names=[mc.get_username()]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, uc.get_realm(), ticket, key, etype) >+ self.check_tgs_reply(rep) >+ >+ # Check the contents of the pac, and the ticket >+ ticket = rep['ticket'] >+ enc_part = self.decode_service_ticket(mc, ticket) >+ self.check_pac( >+ enc_part['authorization-data'], dn, uc, uname, upn=uname) >+ # check the crealm and cname >+ cname = enc_part['cname'] >+ self.assertEqual(NT_ENTERPRISE_PRINCIPAL, cname['name-type']) >+ self.assertEqual(uname.encode('UTF8'), cname['name-string'][0]) >+ self.assertEqual(realm.upper().encode('UTF8'), enc_part['crealm']) >+ >+ def test_nt_principal_step_6_c(self): >+ ''' Step 4, pre-authentication >+ If not found and pre-authentication >+ search for a matching user principal name >+ >+ This test uses the altsecid, so the AS-REQ should fail. >+ ''' >+ >+ # Create user and machine accounts for the test. >+ # >+ user_name = "mskileusr" >+ alt_name = "mskilealtsec" >+ (uc, dn) = self.create_account(user_name) >+ realm = uc.get_realm().lower() >+ alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >+ self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ ename = alt_name + "@" + realm >+ >+ mach_name = "mskilemac" >+ (mc, _) = self.create_account(mach_name, machine_account=True) >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[ename]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(uc, rep) >+ # Use the alternate security identifier >+ # this should fail >+ cname = self.PrincipalName_create( >+ name_type=NT_ENTERPRISE_PRINCIPAL, names=[ename]) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_error_rep(rep, KDC_ERR_C_PRINCIPAL_UNKNOWN) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = False >+ global_hexdump = False >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 222d1dbfa41..1b22461c735 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -95,6 +95,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/kdc_tests.py', > 'python/samba/tests/krb5/kdc_base_test.py', > 'python/samba/tests/krb5/kdc_tgs_tests.py', >+ 'python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py', > } > > EXCLUDE_HELP = { >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 7ab56b6721b..4e6ee93ce96 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -2,3 +2,15 @@ > # We expect all the MIT specific compatability tests to fail on heimdal > # kerberos > ^samba.tests.krb5.compatability_tests.samba.tests.krb5.compatability_tests.SimpleKerberosTests.test_mit_ >+# >+# Heimdal currently fails the following MS-KILE client principal lookup >+# tests >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_1_3 >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_4 >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_5 >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_6_a >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_enterprise_principal_step_6_b >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_a >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_b >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_c >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_6_c >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index e64303c6b0f..2c2a643944c 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -275,3 +275,19 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > # following tests > ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_ldap_service_ticket\(ad_dc\) > ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_get_ticket_for_host_service_of_machine_account\(ad_dc\) >+# >+# MIT currently fails the following MS-KILE tests. >+# >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_1_3 >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_4 >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_5 >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_6_a >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_enterprise_principal_step_6_b >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_1 >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_2 >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_3 >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_a >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_b >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_c >+^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_6_c >+ >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index b2a09b3ecb2..9bb2ff2e1ed 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -1290,6 +1290,9 @@ planpythontestsuite("ad_dc", "samba.tests.krb5.kdc_tests") > planpythontestsuite( > "ad_dc", > "samba.tests.krb5.kdc_tgs_tests") >+planpythontestsuite( >+ "ad_dc", >+ "samba.tests.krb5.ms_kile_client_principal_lookup_tests") > > for env in [ > 'vampire_dc', >-- >2.25.1 > > >From 7e880971d6fee4ab24b3b23419fa9576397eafbf Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Apr 2021 10:54:05 +1200 >Subject: [PATCH 063/380] auth:creds: Remove unused variable > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 1ea2de561839ad948efab5112fbe4c1eae44d9ee) >--- > auth/credentials/pycredentials.c | 3 --- > 1 file changed, 3 deletions(-) > >diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c >index 7427e286dca..1edb22bd867 100644 >--- a/auth/credentials/pycredentials.c >+++ b/auth/credentials/pycredentials.c >@@ -603,8 +603,6 @@ static PyObject *py_creds_get_forced_sasl_mech(PyObject *self, PyObject *unused) > static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args) > { > char *newval; >- enum credentials_obtained obt = CRED_SPECIFIED; >- int _obt = obt; > struct cli_credentials *creds = PyCredentials_AsCliCredentials(self); > if (creds == NULL) { > PyErr_Format(PyExc_TypeError, "Credentials expected"); >@@ -614,7 +612,6 @@ static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args) > if (!PyArg_ParseTuple(args, "s", &newval)) { > return NULL; > } >- obt = _obt; > > cli_credentials_set_forced_sasl_mech(creds, newval); > Py_RETURN_NONE; >-- >2.25.1 > > >From f7227612a89022789ba48e7cb87ca5dd7629acde Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Apr 2021 10:55:13 +1200 >Subject: [PATCH 064/380] auth:creds: Fix parameter in creds.set_named_ccache() > >Use the passed-in value for 'obtained' rather than always using >CRED_SPECIFIED. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 2d05268aa0904221c452fc650fcdfb680efc20bb) >--- > auth/credentials/pycredentials.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > >diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c >index 1edb22bd867..314f0eba894 100644 >--- a/auth/credentials/pycredentials.c >+++ b/auth/credentials/pycredentials.c >@@ -763,6 +763,7 @@ static PyObject *py_creds_set_named_ccache(PyObject *self, PyObject *args) > > if (!PyArg_ParseTuple(args, "s|iO", &newval, &_obt, &py_lp_ctx)) > return NULL; >+ obt = _obt; > > mem_ctx = talloc_new(NULL); > if (mem_ctx == NULL) { >@@ -778,7 +779,7 @@ static PyObject *py_creds_set_named_ccache(PyObject *self, PyObject *args) > > ret = cli_credentials_set_ccache(creds, > lp_ctx, >- newval, CRED_SPECIFIED, >+ newval, obt, > &error_string); > > if (ret != 0) { >-- >2.25.1 > > >From bbe01ec142411b2b970fb5fe0fa4ffb2d2491773 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Apr 2021 11:07:22 +1200 >Subject: [PATCH 065/380] pygensec: Fix method documentation > >This changes the docstrings to use the correct method names. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 50ade4cadc766a196316fd5c5a57f8c502f0ea22) >--- > source4/auth/gensec/pygensec.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > >diff --git a/source4/auth/gensec/pygensec.c b/source4/auth/gensec/pygensec.c >index 986f32904e7..35b3307ab8f 100644 >--- a/source4/auth/gensec/pygensec.c >+++ b/source4/auth/gensec/pygensec.c >@@ -654,13 +654,13 @@ static PyMethodDef py_gensec_security_methods[] = { > METH_VARARGS|METH_KEYWORDS|METH_CLASS, > "S.start_server(auth_ctx, settings) -> gensec" }, > { "set_credentials", (PyCFunction)py_gensec_set_credentials, METH_VARARGS, >- "S.start_client(credentials)" }, >+ "S.set_credentials(credentials)" }, > { "set_target_hostname", (PyCFunction)py_gensec_set_target_hostname, METH_VARARGS, >- "S.start_target_hostname(target_hostname) \n This sets the Kerberos target hostname to obtain a ticket for." }, >+ "S.set_target_hostname(target_hostname) \n This sets the Kerberos target hostname to obtain a ticket for." }, > { "set_target_service", (PyCFunction)py_gensec_set_target_service, METH_VARARGS, >- "S.start_target_service(target_service) \n This sets the Kerberos target service to obtain a ticket for. The default value is 'host'" }, >+ "S.set_target_service(target_service) \n This sets the Kerberos target service to obtain a ticket for. The default value is 'host'" }, > { "set_target_service_description", (PyCFunction)py_gensec_set_target_service_description, METH_VARARGS, >- "S.start_target_service_description(target_service_description) \n This description is set server-side and used in authentication and authorization logs. The default value is that provided to set_target_service() or None."}, >+ "S.set_target_service_description(target_service_description) \n This description is set server-side and used in authentication and authorization logs. The default value is that provided to set_target_service() or None."}, > { "session_info", (PyCFunction)py_gensec_session_info, METH_NOARGS, > "S.session_info() -> info" }, > { "session_key", (PyCFunction)py_gensec_session_key, METH_NOARGS, >-- >2.25.1 > > >From 19b36346d7498f512295df0e45974ffaec637c40 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 15 Apr 2021 10:32:41 +1200 >Subject: [PATCH 066/380] Revert "s4-test: fixed ndrdump test for top level > build" > >This essentially reverts commit >b84c0a9ed6d556eb2d3797d606edcd03f9766606, but the datapath is now in the >source4 directory. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 6f144d49b5281a08bf7be550b949f4d91e8fe19b) >--- > python/samba/tests/blackbox/ndrdump.py | 8 +------- > 1 file changed, 1 insertion(+), 7 deletions(-) > >diff --git a/python/samba/tests/blackbox/ndrdump.py b/python/samba/tests/blackbox/ndrdump.py >index 6795aed41b7..f9a3bd98862 100644 >--- a/python/samba/tests/blackbox/ndrdump.py >+++ b/python/samba/tests/blackbox/ndrdump.py >@@ -24,13 +24,7 @@ from __future__ import print_function > import os > from samba.tests import BlackboxTestCase, BlackboxProcessError > >-for p in ["../../../../../source4/librpc/tests", >- "../../../../../librpc/tests"]: >- data_path_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), p)) >- print(data_path_dir) >- if os.path.exists(data_path_dir): >- break >- >+data_path_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), "../../../../../source4/librpc/tests")) > > class NdrDumpTests(BlackboxTestCase): > """Blackbox tests for ndrdump.""" >-- >2.25.1 > > >From 4bc1f4d789dae7f6bdb7b50c01ec950ffa2e7c3c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Apr 2021 10:57:00 +1200 >Subject: [PATCH 067/380] krb5ccache.idl: Add definition for a Kerberos > credentials cache > >Based on specifications found at >https://web.mit.edu/kerberos/krb5-devel/doc/formats/ccache_file_format.html > >This is primarily designed for parsing and storing a single Kerberos >ticket, due to the limitations of PIDL. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 74fb2cc473cea0eebf641fc4d32d706bac8aa6f2) >--- > librpc/idl/krb5ccache.idl | 115 +++++++++++++++++++++++++++++++++++ > librpc/idl/wscript_build | 1 + > librpc/wscript_build | 8 ++- > source4/librpc/wscript_build | 7 +++ > 4 files changed, 130 insertions(+), 1 deletion(-) > create mode 100644 librpc/idl/krb5ccache.idl > >diff --git a/librpc/idl/krb5ccache.idl b/librpc/idl/krb5ccache.idl >new file mode 100644 >index 00000000000..1f0cfa752a9 >--- /dev/null >+++ b/librpc/idl/krb5ccache.idl >@@ -0,0 +1,115 @@ >+/* >+ krb5 credentials cache (version 3 or 4) >+ specification: https://web.mit.edu/kerberos/krb5-devel/doc/formats/ccache_file_format.html >+*/ >+ >+#include "idl_types.h" >+ >+[ >+ uuid("1702b695-99ca-4f32-93e4-1e1c4d5ddb53"), >+ version(0.0), >+ pointer_default(unique), >+ helpstring("KRB5 credentials cache") >+] >+interface krb5ccache >+{ >+ typedef struct { >+ uint32 name_type; >+ uint32 component_count; >+ [flag(STR_SIZE4|STR_NOTERM|STR_UTF8)] string realm; >+ [flag(STR_SIZE4|STR_NOTERM|STR_UTF8)] string components[component_count]; >+ } PRINCIPAL; >+ >+ typedef struct { >+ uint16 enctype; >+ DATA_BLOB data; >+ } KEYBLOCK; >+ >+ typedef struct { >+ uint16 addrtype; >+ DATA_BLOB data; >+ } ADDRESS; >+ >+ typedef struct { >+ uint32 count; >+ ADDRESS data[count]; >+ } ADDRESSES; >+ >+ typedef struct { >+ uint16 ad_type; >+ DATA_BLOB data; >+ } AUTHDATUM; >+ >+ typedef struct { >+ uint32 count; >+ AUTHDATUM data[count]; >+ } AUTHDATA; >+ >+ typedef struct { >+ PRINCIPAL client; >+ PRINCIPAL server; >+ KEYBLOCK keyblock; >+ uint32 authtime; >+ uint32 starttime; >+ uint32 endtime; >+ uint32 renew_till; >+ uint8 is_skey; >+ uint32 ticket_flags; >+ ADDRESSES addresses; >+ AUTHDATA authdata; >+ DATA_BLOB ticket; >+ DATA_BLOB second_ticket; >+ } CREDENTIAL; >+ >+ typedef struct { >+ [value(0)] int32 kdc_sec_offset; >+ [value(0)] int32 kdc_usec_offset; >+ } DELTATIME_TAG; >+ >+ typedef [nodiscriminant] union { >+ [case(1)] DELTATIME_TAG deltatime_tag; >+ } FIELD; >+ >+ typedef struct { >+ [value(1)] uint16 tag; >+ [subcontext(2),switch_is(tag)] FIELD field; >+ } V4TAG; >+ >+ typedef struct { >+ V4TAG tag; >+ /* >+ * We should allow for more than one tag to be properly parsed, but that >+ * would require manual parsing. >+ */ >+ [flag(NDR_REMAINING)] DATA_BLOB further_tags; >+ } V4TAGS; >+ >+ typedef struct { >+ [subcontext(2)] V4TAGS v4tags; >+ } V4HEADER; >+ >+ typedef [nodiscriminant] union { >+ /* >+ * We don't attempt to support file format versions 1 and 2 as they >+ * assume native CPU byte order, which makes no sense in PIDL. >+ */ >+ [case(3)] ; >+ [case(4)] V4HEADER v4header; >+ } OPTIONAL_HEADER; >+ >+ /* Public structures. */ >+ >+ typedef [flag(NDR_NOALIGN|NDR_BIG_ENDIAN|NDR_PAHEX),public] struct { >+ [value(5)] uint8 pvno; >+ [value(4)] uint8 version; >+ [switch_is(version)] OPTIONAL_HEADER optional_header; >+ PRINCIPAL principal; >+ CREDENTIAL cred; >+ [flag(NDR_REMAINING)] DATA_BLOB further_creds; >+ } CCACHE; >+ >+ typedef [flag(NDR_NOALIGN|NDR_BIG_ENDIAN|NDR_PAHEX),public] struct { >+ CREDENTIAL cred; >+ [flag(NDR_REMAINING)] DATA_BLOB further_creds; >+ } MULTIPLE_CREDENTIALS; >+} >diff --git a/librpc/idl/wscript_build b/librpc/idl/wscript_build >index b66f27be901..2eb575e6a4c 100644 >--- a/librpc/idl/wscript_build >+++ b/librpc/idl/wscript_build >@@ -147,6 +147,7 @@ bld.SAMBA_PIDL_LIST('PIDL', > drsblobs.idl > idmap.idl > krb5pac.idl >+ krb5ccache.idl > messaging.idl > misc.idl > nbt.idl >diff --git a/librpc/wscript_build b/librpc/wscript_build >index 30763907aaa..08cfc439282 100644 >--- a/librpc/wscript_build >+++ b/librpc/wscript_build >@@ -374,6 +374,11 @@ bld.SAMBA_LIBRARY('ndr-krb5pac', > vnum='0.0.1' > ) > >+bld.SAMBA_SUBSYSTEM('NDR_KRB5CCACHE', >+ source='gen_ndr/ndr_krb5ccache.c', >+ deps='ndr NDR_COMPRESSION NDR_SECURITY ndr-standard asn1util' >+ ) >+ > bld.SAMBA_LIBRARY('ndr-standard', > source='', > vnum='0.0.1', >@@ -616,7 +621,8 @@ bld.SAMBA_LIBRARY('ndr-samba', > source=[], > deps='''NDR_DRSBLOBS NDR_DRSUAPI NDR_IDMAP NDR_NTLMSSP NDR_NEGOEX NDR_SCHANNEL NDR_MGMT > NDR_DNSSERVER NDR_EPMAPPER NDR_XATTR NDR_UNIXINFO NDR_NAMED_PIPE_AUTH NDR_DCOM >- NDR_NTPRINTING NDR_FSRVP NDR_WITNESS NDR_MDSSVC NDR_OPEN_FILES NDR_SMBXSRV''', >+ NDR_NTPRINTING NDR_FSRVP NDR_WITNESS NDR_MDSSVC NDR_OPEN_FILES NDR_SMBXSRV >+ NDR_KRB5CCACHE''', > private_library=True, > grouping_library=True > ) >diff --git a/source4/librpc/wscript_build b/source4/librpc/wscript_build >index 009b2e13d2e..ea9c4853d7a 100644 >--- a/source4/librpc/wscript_build >+++ b/source4/librpc/wscript_build >@@ -229,6 +229,13 @@ bld.SAMBA_PYTHON('python_krb5pac', > cflags_end=gen_cflags > ) > >+bld.SAMBA_PYTHON('python_krb5ccache', >+ source='../../librpc/gen_ndr/py_krb5ccache.c', >+ deps='NDR_KRB5CCACHE %s %s' % (pytalloc_util, pyrpc_util), >+ realname='samba/dcerpc/krb5ccache.so', >+ cflags_end=gen_cflags >+ ) >+ > bld.SAMBA_PYTHON('python_netlogon', > source='../../librpc/gen_ndr/py_netlogon.c', > deps='RPC_NDR_NETLOGON %s %s' % (pytalloc_util, pyrpc_util), >-- >2.25.1 > > >From ec6c8920a0882711d5debe1313dce2a505a8c011 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Apr 2021 10:58:48 +1200 >Subject: [PATCH 068/380] librpc: Test parsing a Kerberos 5 credentials cache > with ndrdump > >This is the format used by the FILE: credentials cache type. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 1f17b1edca9c1638ef404fadce3ca7a4d176de12) >--- > python/samba/tests/blackbox/ndrdump.py | 37 + > source3/selftest/ktest-krb5_ccache-2.txt | 1574 ++++++++++++++++++++++ > source3/selftest/ktest-krb5_ccache-3.txt | 832 ++++++++++++ > 3 files changed, 2443 insertions(+) > create mode 100644 source3/selftest/ktest-krb5_ccache-2.txt > create mode 100644 source3/selftest/ktest-krb5_ccache-3.txt > >diff --git a/python/samba/tests/blackbox/ndrdump.py b/python/samba/tests/blackbox/ndrdump.py >index f9a3bd98862..b8a025b8dce 100644 >--- a/python/samba/tests/blackbox/ndrdump.py >+++ b/python/samba/tests/blackbox/ndrdump.py >@@ -307,6 +307,43 @@ dump OK > # convert expected to bytes for python 3 > self.assertEqual(actual, expected.encode('utf-8')) > >+ def test_ndrdump_Krb5ccache(self): >+ expected = open(self.data_path("../../../source3/selftest/" >+ "ktest-krb5_ccache-2.txt")).read() >+ try: >+ # Specify -d1 to match the generated output file, because ndrdump >+ # only outputs some additional info if this parameter is specified, >+ # and the --configfile parameter gives us an empty smb.conf to avoid >+ # extraneous output. >+ actual = self.check_output( >+ "ndrdump krb5ccache CCACHE struct " >+ "--configfile /dev/null -d1 --validate " + >+ self.data_path("../../../source3/selftest/" >+ "ktest-krb5_ccache-2")) >+ except BlackboxProcessError as e: >+ self.fail(e) >+ # check_output will return bytes >+ # convert expected to bytes for python 3 >+ self.assertEqual(actual, expected.encode('utf-8')) >+ >+ expected = open(self.data_path("../../../source3/selftest/" >+ "ktest-krb5_ccache-3.txt")).read() >+ try: >+ # Specify -d1 to match the generated output file, because ndrdump >+ # only outputs some additional info if this parameter is specified, >+ # and the --configfile parameter gives us an empty smb.conf to avoid >+ # extraneous output. >+ actual = self.check_output( >+ "ndrdump krb5ccache CCACHE struct " >+ "--configfile /dev/null -d1 --validate " + >+ self.data_path("../../../source3/selftest/" >+ "ktest-krb5_ccache-3")) >+ except BlackboxProcessError as e: >+ self.fail(e) >+ # check_output will return bytes >+ # convert expected to bytes for python 3 >+ self.assertEqual(actual, expected.encode('utf-8')) >+ > # This is a good example of a union with an empty default > # and no buffers to parse. > def test_ndrdump_fuzzed_spoolss_EnumForms(self): >diff --git a/source3/selftest/ktest-krb5_ccache-2.txt b/source3/selftest/ktest-krb5_ccache-2.txt >new file mode 100644 >index 00000000000..c86750ae585 >--- /dev/null >+++ b/source3/selftest/ktest-krb5_ccache-2.txt >@@ -0,0 +1,1574 @@ >+pull returned Success >+ CCACHE: struct CCACHE >+ pvno : 0x05 (5) >+ version : 0x04 (4) >+ optional_header : union OPTIONAL_HEADER(case 0x4) >+ v4header: struct V4HEADER >+ v4tags: struct V4TAGS >+ tag: struct V4TAG >+ tag : 0x0001 (1) >+ field : union FIELD(case 0x1) >+ deltatime_tag: struct DELTATIME_TAG >+ kdc_sec_offset : 0 >+ kdc_usec_offset : 0 >+ further_tags : DATA_BLOB length=0 >+ principal: struct PRINCIPAL >+ name_type : 0x00000001 (1) >+ component_count : 0x00000001 (1) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(1) >+ components : 'administrator' >+ cred: struct CREDENTIAL >+ client: struct PRINCIPAL >+ name_type : 0x00000001 (1) >+ component_count : 0x00000001 (1) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(1) >+ components : 'administrator' >+ server: struct PRINCIPAL >+ name_type : 0x00000000 (0) >+ component_count : 0x00000002 (2) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(2) >+ components : 'krbtgt' >+ components : 'KTEST.SAMBA.EXAMPLE.COM' >+ keyblock: struct KEYBLOCK >+ enctype : 0x0017 (23) >+ data : DATA_BLOB length=16 >+[0000] 8B 94 0B 31 51 5B F7 A7 15 E9 EE D7 D7 0C 8C 90 ...1Q[.. ........ >+ authtime : 0x4d994f6a (1301892970) >+ starttime : 0x4d994f6a (1301892970) >+ endtime : 0x7d440b68 (2101611368) >+ renew_till : 0x7d440b68 (2101611368) >+ is_skey : 0x00 (0) >+ ticket_flags : 0x40e00000 (1088421888) >+ addresses: struct ADDRESSES >+ count : 0x00000000 (0) >+ data: ARRAY(0) >+ authdata: struct AUTHDATA >+ count : 0x00000000 (0) >+ data: ARRAY(0) >+ ticket : DATA_BLOB length=1032 >+[0000] 61 82 04 04 30 82 04 00 A0 03 02 01 05 A1 19 1B a...0... ........ >+[0010] 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 .KTEST.S AMBA.EXA >+[0020] 4D 50 4C 45 2E 43 4F 4D A2 2C 30 2A A0 03 02 01 MPLE.COM .,0*.... >+[0030] 00 A1 23 30 21 1B 06 6B 72 62 74 67 74 1B 17 4B ..#0!..k rbtgt..K >+[0040] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[0050] 4C 45 2E 43 4F 4D A3 82 03 AE 30 82 03 AA A0 03 LE.COM.. ..0..... >+[0060] 02 01 17 A1 03 02 01 01 A2 82 03 9C 04 82 03 98 ........ ........ >+[0070] 80 66 8F CF AB 24 9D C8 76 E4 28 F5 25 6B 73 B2 .f...$.. v.(.%ks. >+[0080] 4B 94 ED 09 10 29 05 C4 C0 B8 B9 33 FA C4 46 AB K....).. ...3..F. >+[0090] F4 B5 9E 5B 07 54 D6 58 1D B8 CA 04 41 A6 33 A6 ...[.T.X ....A.3. >+[00A0] 67 9D EB 83 70 65 A9 2D 65 A5 19 8C 55 2A 0F FC g...pe.- e...U*.. >+[00B0] 1B BB 7A BD 86 C0 32 06 F2 2F 0A A5 93 E7 D1 1E ..z...2. ./...... >+[00C0] 16 C4 27 DD 1F A7 61 03 FF 05 81 EF 49 B7 25 A3 ..'...a. ....I.%. >+[00D0] 6E EA E6 E8 15 E3 10 AF A3 F1 21 B3 D9 C0 67 2F n....... ..!...g/ >+[00E0] 0C 0C B7 42 D6 9A 34 8E D4 5E 55 C2 FE 62 03 37 ...B..4. .^U..b.7 >+[00F0] A5 58 9B 43 E7 26 E3 71 B2 E5 F1 91 B4 23 8F AC .X.C.&.q .....#.. >+[0100] 7A 31 3C 4E B4 94 E4 81 36 98 71 3B 98 7B B7 AB z1<N.... 6.q;.{.. >+[0110] D5 AA D3 34 2A 3B C8 D7 61 EE 60 F9 68 9C A0 56 ...4*;.. a.`.h..V >+[0120] 51 E7 85 81 DE EF B9 9F 8B 4A 07 E1 05 93 08 5A Q....... .J.....Z >+[0130] AE B3 92 A5 17 40 B1 1C 42 A9 E4 AD 3C B4 4E D3 .....@.. B...<.N. >+[0140] BE 68 C4 0C 81 C0 AB 2D 3E 81 09 BD 16 82 EB C5 .h.....- >....... >+[0150] 1A 69 EE 8C 4E A4 D8 55 A5 0B 23 0F D0 89 48 C4 .i..N..U ..#...H. >+[0160] 51 FE 32 FD CC F6 71 E1 95 2D CC 1D 0A 0C 8A A2 Q.2...q. .-...... >+[0170] 69 58 3B 65 88 53 EC D0 2E E1 C6 CC 6B BC 09 E5 iX;e.S.. ....k... >+[0180] B9 15 27 8B E4 B2 24 18 61 42 BB 8B 09 1B 8A 7B ..'...$. aB.....{ >+[0190] 13 D8 51 E1 0B 79 12 48 DE A9 54 04 00 6D DD E6 ..Q..y.H ..T..m.. >+[01A0] 5E 03 91 FF C7 6D 0B 7C 91 44 E1 0F C0 7E 32 34 ^....m.| .D...~24 >+[01B0] 82 86 94 F7 CD 53 EC 52 38 18 AA ED FF FC 5C 01 .....S.R 8.....\. >+[01C0] D2 EE 99 45 8E 5B E6 B3 46 B0 F6 3B 22 29 EC 11 ...E.[.. F..;").. >+[01D0] 30 6A F6 A1 1F 9E AE 71 E3 A6 E7 3F F3 7D 2B 75 0j.....q ...?.}+u >+[01E0] 70 4D 63 47 5C 18 2C 8B B1 1A 69 B6 C5 46 01 17 pMcG\.,. ..i..F.. >+[01F0] 8E 64 3D 47 88 20 1C AA D7 60 32 28 11 60 EA 28 .d=G. .. .`2(.`.( >+[0200] 66 99 4C B1 2A 28 96 BF 18 2A 3E F4 D6 84 E5 A0 f.L.*(.. .*>..... >+[0210] F4 4E E7 F9 54 95 22 96 2A 87 01 CC 3E A7 FF 42 .N..T.". *...>..B >+[0220] 6A A4 4A 3A B9 24 10 65 99 53 58 2A 4E 72 E7 1F j.J:.$.e .SX*Nr.. >+[0230] 82 BC BD 3C 6C 9D 33 3A CE C6 6E 72 A2 81 B3 84 ...<l.3: ..nr.... >+[0240] 82 DF 3C 1F 76 E5 B8 08 AD 0A 6C 7D 7B D5 0C 46 ..<.v... ..l}{..F >+[0250] 69 A4 F4 E9 9E 3D D7 2D E1 43 D1 7A 52 16 75 56 i....=.- .C.zR.uV >+[0260] 54 83 D5 2A 2F A7 D2 CB 48 FE FF DB AE 46 F2 5B T..*/... H....F.[ >+[0270] F4 52 BE C8 5E B1 04 95 52 35 3E 92 E0 02 F7 85 .R..^... R5>..... >+[0280] AB F0 D0 93 08 42 E5 37 19 24 4E C1 AF FC 92 A9 .....B.7 .$N..... >+[0290] B1 27 B1 9A 2A 62 34 F1 DC C0 6B 83 AE C3 74 E8 .'..*b4. ..k...t. >+[02A0] A3 05 DD 82 DD A3 D7 90 A8 E3 9C EB 64 16 23 06 ........ ....d.#. >+[02B0] 5D FB E4 35 7C 22 29 78 E3 3B 75 92 91 0C 9D A1 ]..5|")x .;u..... >+[02C0] 87 7C 2E 82 AE 49 9D 4A 50 A9 C2 D5 85 B0 16 5D .|...I.J P......] >+[02D0] A2 CD B0 DD 29 3F 6F 66 C9 C1 9F 5C F0 B6 FC D2 ....)?of ...\.... >+[02E0] 52 BE 7B F0 1F 26 AF 8A FC C3 A6 24 8C C0 10 06 R.{..&.. ...$.... >+[02F0] 73 1E 17 9E 6E 6F 32 44 6A DF 82 5D D0 6B 74 CE s...no2D j..].kt. >+[0300] 58 0B 4C 7B EB A1 13 44 B1 3E D8 F8 BA F4 4E 55 X.L{...D .>....NU >+[0310] 71 3D C1 09 D9 E7 97 9A 14 5C 54 7E 57 81 5F 6B q=...... .\T~W._k >+[0320] 30 BE 9A E1 98 29 47 D4 C0 8F 63 0A F8 27 1F CE 0....)G. ..c..'.. >+[0330] ED D9 BB 7B 12 24 D0 34 2A 7C F0 F7 77 F4 F1 1D ...{.$.4 *|..w... >+[0340] 4C 5D 75 2D 6B 0D 80 35 82 CC D8 7A 6B FA A0 55 L]u-k..5 ...zk..U >+[0350] 34 CD 87 15 61 38 78 D4 69 0F AA 72 D6 AC FA 99 4...a8x. i..r.... >+[0360] BC 70 39 27 A7 25 2E 1B 6F 36 01 FD E9 B4 9A 79 .p9'.%.. o6.....y >+[0370] 6C 19 DD A6 8C 78 B0 40 92 60 58 F0 28 AD 08 78 l....x.@ .`X.(..x >+[0380] 4A 29 06 2C 82 2B 1A E3 91 0B 5F EE D6 B8 66 47 J).,.+.. .._...fG >+[0390] 31 9B A3 DF 9F 79 D7 BB 0E 2C FA 0E C9 66 84 8D 1....y.. .,...f.. >+[03A0] FF BA BB 21 27 9E AD 86 84 55 8D 4C 4C 47 D9 5F ...!'... .U.LLG._ >+[03B0] B2 7D 26 CA B7 49 3C 9D 1B 67 71 11 3A 8A EB EA .}&..I<. .gq.:... >+[03C0] 0F 15 EB F0 1E 46 F7 A4 34 04 D7 E3 50 67 47 D3 .....F.. 4...PgG. >+[03D0] 66 21 17 77 51 A7 1F 1D 84 3B 7C B1 5D 4E B8 D4 f!.wQ... .;|.]N.. >+[03E0] F9 C5 75 06 AA 19 45 1C E9 06 9E AD 23 26 6B 10 ..u...E. ....#&k. >+[03F0] 53 A0 36 D3 58 9F 5E 8C CB A5 F6 BC C9 30 3C BC S.6.X.^. .....0<. >+[0400] AD FF 7C 92 F0 C6 9A 02 ..|..... >+ second_ticket : DATA_BLOB length=0 >+ further_creds : DATA_BLOB length=10683 >+[0000] 00 00 00 01 00 00 00 01 00 00 00 17 4B 54 45 53 ........ ....KTES >+[0010] 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E T.SAMBA. EXAMPLE. >+[0020] 43 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 73 74 72 COM....a dministr >+[0030] 61 74 6F 72 00 00 00 01 00 00 00 02 00 00 00 17 ator.... ........ >+[0040] 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D KTEST.SA MBA.EXAM >+[0050] 50 4C 45 2E 43 4F 4D 00 00 00 04 63 69 66 73 00 PLE.COM. ...cifs. >+[0060] 00 00 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 00 17 ...local ktest6.. >+[0070] 00 00 00 10 00 6E A1 B2 31 6D 48 C7 90 72 3A 0C .....n.. 1mH..r:. >+[0080] 4B 8B 83 8C 4D 99 4F 6A 4D 99 50 85 7D 44 0B 68 K...M.Oj M.P.}D.h >+[0090] 00 00 00 00 00 40 28 00 00 00 00 00 00 00 00 00 .....@(. ........ >+[00A0] 00 00 00 03 FA 61 82 03 F6 30 82 03 F2 A0 03 02 .....a.. .0...... >+[00B0] 01 05 A1 19 1B 17 4B 54 45 53 54 2E 53 41 4D 42 ......KT EST.SAMB >+[00C0] 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D A2 1E 30 A.EXAMPL E.COM..0 >+[00D0] 1C A0 03 02 01 01 A1 15 30 13 1B 04 63 69 66 73 ........ 0...cifs >+[00E0] 1B 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 A3 82 03 ..localk test6... >+[00F0] AE 30 82 03 AA A0 03 02 01 17 A1 03 02 01 02 A2 .0...... ........ >+[0100] 82 03 9C 04 82 03 98 C6 BB 64 A8 31 00 FC 5E 51 ........ .d.1..^Q >+[0110] 3C 87 F8 34 47 3B D0 6F 6F FD 9E A6 91 12 74 2D <..4G;.o o.....t- >+[0120] 44 BB AA 91 A0 2D 46 3E 9E FB FB C4 FB F1 15 FD D....-F> ........ >+[0130] BB DA EE 06 A9 20 6A 38 DC 46 06 27 D9 A2 9D 2D ..... j8 .F.'...- >+[0140] 1F FD 0D 7D 8A BB 0A 7C E8 47 17 BC 7B 70 E4 51 ...}...| .G..{p.Q >+[0150] 6A BA 51 68 62 28 4A 1E 51 D1 0D CD 02 55 75 44 j.Qhb(J. Q....UuD >+[0160] 8A B9 C2 84 F4 17 34 92 9B 31 85 9E 43 C1 0C 3A ......4. .1..C..: >+[0170] B2 69 7F 20 1A 18 1F 65 4F C0 20 C9 B5 AF E1 61 .i. ...e O. ....a >+[0180] 8C 90 10 63 26 A6 5D 05 3C CD 29 BB 7B 74 D5 8F ...c&.]. <.).{t.. >+[0190] 2C 7F 4B E8 84 24 57 37 8A C6 F7 91 FD 22 9A A5 ,.K..$W7 .....".. >+[01A0] 0D E9 4A 78 93 36 FC A8 8C 8A 27 8A C6 28 4B 7B ..Jx.6.. ..'..(K{ >+[01B0] DA 11 42 BC 09 10 81 82 14 0F 9C B8 48 26 91 78 ..B..... ....H&.x >+[01C0] A8 DD 97 6C 24 A1 D2 E8 85 19 B3 D3 85 4D 38 C7 ...l$... .....M8. >+[01D0] 7D 49 55 8E 85 46 E1 EE 7B BA 11 62 63 53 C5 16 }IU..F.. {..bcS.. >+[01E0] 4A 0C 1C 99 7C 0E FB 45 1D B4 98 58 67 7E 40 65 J...|..E ...Xg~@e >+[01F0] 4B 48 E2 89 9C 8B C2 B8 39 D1 04 C0 A8 56 E8 A1 KH...... 9....V.. >+[0200] 04 7A 7A C9 60 18 A0 29 E2 DC 82 4C 8F 18 CE 2F .zz.`..) ...L.../ >+[0210] 14 F0 18 5B 6C FF 85 45 88 73 CB A4 55 08 FC BF ...[l..E .s..U... >+[0220] C7 9F 51 0A DB 2C C1 E3 3C DD F6 F0 A3 2D F1 3B ..Q..,.. <....-.; >+[0230] A0 12 1D FC 2A 67 F5 1A 7F E5 7C 6C FB 8A 18 BD ....*g.. ..|l.... >+[0240] D1 5D E5 5E 68 30 AA 58 9E 10 13 E0 26 7E 7D C4 .].^h0.X ....&~}. >+[0250] E1 A5 B6 86 0F 1C 0F 13 A4 5E 5E 6A ED 42 79 31 ........ .^^j.By1 >+[0260] BB B3 5F 3A 3F DD CB 63 82 FB 06 AE 12 36 C9 1E .._:?..c .....6.. >+[0270] 06 7D 41 82 2E D2 FA 26 EC 17 50 5E D0 DE 26 85 .}A....& ..P^..&. >+[0280] 30 71 BC 45 3B DA 2E 08 8D B2 2A 3C E0 79 8F 77 0q.E;... ..*<.y.w >+[0290] 4C 01 69 7A 09 C7 88 E1 D1 DC FF 78 DB 25 7B B1 L.iz.... ...x.%{. >+[02A0] 3C BB 22 27 80 0D 75 96 18 B6 40 95 6D C8 AB 04 <."'..u. ..@.m... >+[02B0] 05 41 A1 C4 25 71 C4 53 3A A6 9C B2 4D E6 15 2C .A..%q.S :...M.., >+[02C0] B2 47 6C DA A8 7D CC A3 89 8B C9 1E 21 F5 E9 B2 .Gl..}.. ....!... >+[02D0] 42 95 68 28 AF C6 37 22 BA 30 8D 53 FA 08 0D CE B.h(..7" .0.S.... >+[02E0] CA 81 61 0D 84 A5 2D 75 BD 41 85 4C 88 56 72 C6 ..a...-u .A.L.Vr. >+[02F0] B6 10 F8 34 CD B2 F4 5C 94 FA 80 90 82 A0 BD 68 ...4...\ .......h >+[0300] EC 08 32 C3 B6 51 1E 3F 67 CB 7B EB 70 83 84 D4 ..2..Q.? g.{.p... >+[0310] CB 52 55 36 61 1E 60 90 5B 6F FE 9A 62 05 CF 26 .RU6a.`. [o..b..& >+[0320] 8E 65 E2 60 4B ED 63 B4 C4 E6 44 B4 2F B0 B8 07 .e.`K.c. ..D./... >+[0330] FE BE 0D 50 E4 56 A4 2E 0D 25 76 0B 0F 44 09 20 ...P.V.. .%v..D. >+[0340] 80 E5 C4 94 63 E0 54 46 1D AB 5E 0B 09 93 B1 30 ....c.TF ..^....0 >+[0350] 31 7B 04 DC 23 43 3B DB 7D 39 67 FE 9A 1F C1 08 1{..#C;. }9g..... >+[0360] AF 34 24 F6 74 E4 14 DA 34 8F 61 57 6A 7F 1D 4A .4$.t... 4.aWj..J >+[0370] 88 0A 90 78 93 F1 86 54 DB 22 86 D6 69 0F DF 44 ...x...T ."..i..D >+[0380] 7C D3 6B 9D 41 63 50 98 3A 97 B9 7B 4C 53 E3 85 |.k.AcP. :..{LS.. >+[0390] 73 9A C9 08 A0 75 12 50 02 87 B0 CF CC 84 84 D9 s....u.P ........ >+[03A0] BC FC 94 79 AF 6A A6 08 FF 19 7E E9 22 9B EC 5C ...y.j.. ..~."..\ >+[03B0] C1 6B 1D A4 B4 55 32 5E 23 C3 C0 D4 8B 80 E6 67 .k...U2^ #......g >+[03C0] B1 59 EB 9D 5D 9B AD C6 0E 7D E2 FE B1 24 8A B1 .Y..]... .}...$.. >+[03D0] 37 1E 60 7F 83 35 48 32 F7 03 E8 12 E6 21 7C 3D 7.`..5H2 .....!|= >+[03E0] 21 7F 6B 14 31 9C 1A A3 4C 2B 1C 5E EC 34 C1 2D !.k.1... L+.^.4.- >+[03F0] DA 19 6C E6 6D 8D 60 D7 55 9E E6 D0 B5 07 06 72 ..l.m.`. U......r >+[0400] C0 E9 4E 91 94 6B 3E 0B F1 0A 75 4D E8 CB 53 6B ..N..k>. ..uM..Sk >+[0410] 34 A4 2F 96 A5 39 1A 18 6E 27 00 6D 41 B7 D8 F5 4./..9.. n'.mA... >+[0420] 9A E5 01 FC 0B A8 97 56 EE 98 04 1D 98 84 5E 82 .......V ......^. >+[0430] C8 E8 EC 17 D5 FA 96 00 3B E1 98 1C D8 FA 66 A0 ........ ;.....f. >+[0440] DC 32 60 F6 03 46 08 3C E5 16 6F F2 8B 4D 72 9F .2`..F.< ..o..Mr. >+[0450] 0F E0 A9 71 6E 7C AE AA FB A3 4D F1 A1 B6 1B 9F ...qn|.. ..M..... >+[0460] 62 71 E1 2C 82 9B AE E3 07 9B 79 90 F1 C2 69 E5 bq.,.... ..y...i. >+[0470] 7E CB 57 E6 C9 1C 4E A8 C7 12 EA 4F 4C 52 17 03 ~.W...N. ...OLR.. >+[0480] AB D4 FD 34 60 F4 7C BE 9E 36 30 37 88 95 61 2E ...4`.|. .607..a. >+[0490] CF 70 AF 22 70 DB E8 AA 6E 3D 30 F7 4D 84 D5 00 .p."p... n=0.M... >+[04A0] 00 00 00 00 00 00 01 00 00 00 01 00 00 00 17 4B ........ .......K >+[04B0] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[04C0] 4C 45 2E 43 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 LE.COM.. ..admini >+[04D0] 73 74 72 61 74 6F 72 00 00 00 01 00 00 00 02 00 strator. ........ >+[04E0] 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 ...KTEST .SAMBA.E >+[04F0] 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 04 63 69 XAMPLE.C OM....ci >+[0500] 66 73 00 00 00 0B 6C 6F 63 61 6C 6B 74 65 73 74 fs....lo calktest >+[0510] 36 00 17 00 00 00 10 00 6E A1 B2 31 6D 48 C7 90 6....... n..1mH.. >+[0520] 72 3A 0C 4B 8B 83 8C 4D 99 4F 6A 4D 99 50 85 7D r:.K...M .OjM.P.} >+[0530] 44 0B 68 00 00 00 00 00 40 28 00 00 00 00 00 00 D.h..... @(...... >+[0540] 00 00 00 00 00 00 03 FA 61 82 03 F6 30 82 03 F2 ........ a...0... >+[0550] A0 03 02 01 05 A1 19 1B 17 4B 54 45 53 54 2E 53 ........ .KTEST.S >+[0560] 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D AMBA.EXA MPLE.COM >+[0570] A2 1E 30 1C A0 03 02 01 01 A1 15 30 13 1B 04 63 ..0..... ...0...c >+[0580] 69 66 73 1B 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 ifs..loc alktest6 >+[0590] A3 82 03 AE 30 82 03 AA A0 03 02 01 17 A1 03 02 ....0... ........ >+[05A0] 01 02 A2 82 03 9C 04 82 03 98 C6 BB 64 A8 31 00 ........ ....d.1. >+[05B0] FC 5E 51 3C 87 F8 34 47 3B D0 6F 6F FD 9E A6 91 .^Q<..4G ;.oo.... >+[05C0] 12 74 2D 44 BB AA 91 A0 2D 46 3E 9E FB FB C4 FB .t-D.... -F>..... >+[05D0] F1 15 FD BB DA EE 06 A9 20 6A 38 DC 46 06 27 D9 ........ j8.F.'. >+[05E0] A2 9D 2D 1F FD 0D 7D 8A BB 0A 7C E8 47 17 BC 7B ..-...}. ..|.G..{ >+[05F0] 70 E4 51 6A BA 51 68 62 28 4A 1E 51 D1 0D CD 02 p.Qj.Qhb (J.Q.... >+[0600] 55 75 44 8A B9 C2 84 F4 17 34 92 9B 31 85 9E 43 UuD..... .4..1..C >+[0610] C1 0C 3A B2 69 7F 20 1A 18 1F 65 4F C0 20 C9 B5 ..:.i. . ..eO. .. >+[0620] AF E1 61 8C 90 10 63 26 A6 5D 05 3C CD 29 BB 7B ..a...c& .].<.).{ >+[0630] 74 D5 8F 2C 7F 4B E8 84 24 57 37 8A C6 F7 91 FD t..,.K.. $W7..... >+[0640] 22 9A A5 0D E9 4A 78 93 36 FC A8 8C 8A 27 8A C6 "....Jx. 6....'.. >+[0650] 28 4B 7B DA 11 42 BC 09 10 81 82 14 0F 9C B8 48 (K{..B.. .......H >+[0660] 26 91 78 A8 DD 97 6C 24 A1 D2 E8 85 19 B3 D3 85 &.x...l$ ........ >+[0670] 4D 38 C7 7D 49 55 8E 85 46 E1 EE 7B BA 11 62 63 M8.}IU.. F..{..bc >+[0680] 53 C5 16 4A 0C 1C 99 7C 0E FB 45 1D B4 98 58 67 S..J...| ..E...Xg >+[0690] 7E 40 65 4B 48 E2 89 9C 8B C2 B8 39 D1 04 C0 A8 ~@eKH... ...9.... >+[06A0] 56 E8 A1 04 7A 7A C9 60 18 A0 29 E2 DC 82 4C 8F V...zz.` ..)...L. >+[06B0] 18 CE 2F 14 F0 18 5B 6C FF 85 45 88 73 CB A4 55 ../...[l ..E.s..U >+[06C0] 08 FC BF C7 9F 51 0A DB 2C C1 E3 3C DD F6 F0 A3 .....Q.. ,..<.... >+[06D0] 2D F1 3B A0 12 1D FC 2A 67 F5 1A 7F E5 7C 6C FB -.;....* g....|l. >+[06E0] 8A 18 BD D1 5D E5 5E 68 30 AA 58 9E 10 13 E0 26 ....].^h 0.X....& >+[06F0] 7E 7D C4 E1 A5 B6 86 0F 1C 0F 13 A4 5E 5E 6A ED ~}...... ....^^j. >+[0700] 42 79 31 BB B3 5F 3A 3F DD CB 63 82 FB 06 AE 12 By1.._:? ..c..... >+[0710] 36 C9 1E 06 7D 41 82 2E D2 FA 26 EC 17 50 5E D0 6...}A.. ..&..P^. >+[0720] DE 26 85 30 71 BC 45 3B DA 2E 08 8D B2 2A 3C E0 .&.0q.E; .....*<. >+[0730] 79 8F 77 4C 01 69 7A 09 C7 88 E1 D1 DC FF 78 DB y.wL.iz. ......x. >+[0740] 25 7B B1 3C BB 22 27 80 0D 75 96 18 B6 40 95 6D %{.<."'. .u...@.m >+[0750] C8 AB 04 05 41 A1 C4 25 71 C4 53 3A A6 9C B2 4D ....A..% q.S:...M >+[0760] E6 15 2C B2 47 6C DA A8 7D CC A3 89 8B C9 1E 21 ..,.Gl.. }......! >+[0770] F5 E9 B2 42 95 68 28 AF C6 37 22 BA 30 8D 53 FA ...B.h(. .7".0.S. >+[0780] 08 0D CE CA 81 61 0D 84 A5 2D 75 BD 41 85 4C 88 .....a.. .-u.A.L. >+[0790] 56 72 C6 B6 10 F8 34 CD B2 F4 5C 94 FA 80 90 82 Vr....4. ..\..... >+[07A0] A0 BD 68 EC 08 32 C3 B6 51 1E 3F 67 CB 7B EB 70 ..h..2.. Q.?g.{.p >+[07B0] 83 84 D4 CB 52 55 36 61 1E 60 90 5B 6F FE 9A 62 ....RU6a .`.[o..b >+[07C0] 05 CF 26 8E 65 E2 60 4B ED 63 B4 C4 E6 44 B4 2F ..&.e.`K .c...D./ >+[07D0] B0 B8 07 FE BE 0D 50 E4 56 A4 2E 0D 25 76 0B 0F ......P. V...%v.. >+[07E0] 44 09 20 80 E5 C4 94 63 E0 54 46 1D AB 5E 0B 09 D. ....c .TF..^.. >+[07F0] 93 B1 30 31 7B 04 DC 23 43 3B DB 7D 39 67 FE 9A ..01{..# C;.}9g.. >+[0800] 1F C1 08 AF 34 24 F6 74 E4 14 DA 34 8F 61 57 6A ....4$.t ...4.aWj >+[0810] 7F 1D 4A 88 0A 90 78 93 F1 86 54 DB 22 86 D6 69 ..J...x. ..T."..i >+[0820] 0F DF 44 7C D3 6B 9D 41 63 50 98 3A 97 B9 7B 4C ..D|.k.A cP.:..{L >+[0830] 53 E3 85 73 9A C9 08 A0 75 12 50 02 87 B0 CF CC S..s.... u.P..... >+[0840] 84 84 D9 BC FC 94 79 AF 6A A6 08 FF 19 7E E9 22 ......y. j....~." >+[0850] 9B EC 5C C1 6B 1D A4 B4 55 32 5E 23 C3 C0 D4 8B ..\.k... U2^#.... >+[0860] 80 E6 67 B1 59 EB 9D 5D 9B AD C6 0E 7D E2 FE B1 ..g.Y..] ....}... >+[0870] 24 8A B1 37 1E 60 7F 83 35 48 32 F7 03 E8 12 E6 $..7.`.. 5H2..... >+[0880] 21 7C 3D 21 7F 6B 14 31 9C 1A A3 4C 2B 1C 5E EC !|=!.k.1 ...L+.^. >+[0890] 34 C1 2D DA 19 6C E6 6D 8D 60 D7 55 9E E6 D0 B5 4.-..l.m .`.U.... >+[08A0] 07 06 72 C0 E9 4E 91 94 6B 3E 0B F1 0A 75 4D E8 ..r..N.. k>...uM. >+[08B0] CB 53 6B 34 A4 2F 96 A5 39 1A 18 6E 27 00 6D 41 .Sk4./.. 9..n'.mA >+[08C0] B7 D8 F5 9A E5 01 FC 0B A8 97 56 EE 98 04 1D 98 ........ ..V..... >+[08D0] 84 5E 82 C8 E8 EC 17 D5 FA 96 00 3B E1 98 1C D8 .^...... ...;.... >+[08E0] FA 66 A0 DC 32 60 F6 03 46 08 3C E5 16 6F F2 8B .f..2`.. F.<..o.. >+[08F0] 4D 72 9F 0F E0 A9 71 6E 7C AE AA FB A3 4D F1 A1 Mr....qn |....M.. >+[0900] B6 1B 9F 62 71 E1 2C 82 9B AE E3 07 9B 79 90 F1 ...bq.,. .....y.. >+[0910] C2 69 E5 7E CB 57 E6 C9 1C 4E A8 C7 12 EA 4F 4C .i.~.W.. .N....OL >+[0920] 52 17 03 AB D4 FD 34 60 F4 7C BE 9E 36 30 37 88 R.....4` .|..607. >+[0930] 95 61 2E CF 70 AF 22 70 DB E8 AA 6E 3D 30 F7 4D .a..p."p ...n=0.M >+[0940] 84 D5 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ >+[0950] 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 ..KTEST. SAMBA.EX >+[0960] 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D 61 64 6D AMPLE.CO M....adm >+[0970] 69 6E 69 73 74 72 61 74 6F 72 00 00 00 01 00 00 inistrat or...... >+[0980] 00 02 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 ......KT EST.SAMB >+[0990] 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 A.EXAMPL E.COM... >+[09A0] 04 63 69 66 73 00 00 00 0B 6C 6F 63 61 6C 6B 74 .cifs... .localkt >+[09B0] 65 73 74 36 00 17 00 00 00 10 00 6E A1 B2 31 6D est6.... ...n..1m >+[09C0] 48 C7 90 72 3A 0C 4B 8B 83 8C 4D 99 4F 6A 4D 99 H..r:.K. ..M.OjM. >+[09D0] 50 85 7D 44 0B 68 00 00 00 00 00 40 28 00 00 00 P.}D.h.. ...@(... >+[09E0] 00 00 00 00 00 00 00 00 00 03 FA 61 82 03 F6 30 ........ ...a...0 >+[09F0] 82 03 F2 A0 03 02 01 05 A1 19 1B 17 4B 54 45 53 ........ ....KTES >+[0A00] 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E T.SAMBA. EXAMPLE. >+[0A10] 43 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 15 30 13 COM..0.. ......0. >+[0A20] 1B 04 63 69 66 73 1B 0B 6C 6F 63 61 6C 6B 74 65 ..cifs.. localkte >+[0A30] 73 74 36 A3 82 03 AE 30 82 03 AA A0 03 02 01 17 st6....0 ........ >+[0A40] A1 03 02 01 02 A2 82 03 9C 04 82 03 98 C6 BB 64 ........ .......d >+[0A50] A8 31 00 FC 5E 51 3C 87 F8 34 47 3B D0 6F 6F FD .1..^Q<. .4G;.oo. >+[0A60] 9E A6 91 12 74 2D 44 BB AA 91 A0 2D 46 3E 9E FB ....t-D. ...-F>.. >+[0A70] FB C4 FB F1 15 FD BB DA EE 06 A9 20 6A 38 DC 46 ........ ... j8.F >+[0A80] 06 27 D9 A2 9D 2D 1F FD 0D 7D 8A BB 0A 7C E8 47 .'...-.. .}...|.G >+[0A90] 17 BC 7B 70 E4 51 6A BA 51 68 62 28 4A 1E 51 D1 ..{p.Qj. Qhb(J.Q. >+[0AA0] 0D CD 02 55 75 44 8A B9 C2 84 F4 17 34 92 9B 31 ...UuD.. ....4..1 >+[0AB0] 85 9E 43 C1 0C 3A B2 69 7F 20 1A 18 1F 65 4F C0 ..C..:.i . ...eO. >+[0AC0] 20 C9 B5 AF E1 61 8C 90 10 63 26 A6 5D 05 3C CD ....a.. .c&.].<. >+[0AD0] 29 BB 7B 74 D5 8F 2C 7F 4B E8 84 24 57 37 8A C6 ).{t..,. K..$W7.. >+[0AE0] F7 91 FD 22 9A A5 0D E9 4A 78 93 36 FC A8 8C 8A ...".... Jx.6.... >+[0AF0] 27 8A C6 28 4B 7B DA 11 42 BC 09 10 81 82 14 0F '..(K{.. B....... >+[0B00] 9C B8 48 26 91 78 A8 DD 97 6C 24 A1 D2 E8 85 19 ..H&.x.. .l$..... >+[0B10] B3 D3 85 4D 38 C7 7D 49 55 8E 85 46 E1 EE 7B BA ...M8.}I U..F..{. >+[0B20] 11 62 63 53 C5 16 4A 0C 1C 99 7C 0E FB 45 1D B4 .bcS..J. ..|..E.. >+[0B30] 98 58 67 7E 40 65 4B 48 E2 89 9C 8B C2 B8 39 D1 .Xg~@eKH ......9. >+[0B40] 04 C0 A8 56 E8 A1 04 7A 7A C9 60 18 A0 29 E2 DC ...V...z z.`..).. >+[0B50] 82 4C 8F 18 CE 2F 14 F0 18 5B 6C FF 85 45 88 73 .L.../.. .[l..E.s >+[0B60] CB A4 55 08 FC BF C7 9F 51 0A DB 2C C1 E3 3C DD ..U..... Q..,..<. >+[0B70] F6 F0 A3 2D F1 3B A0 12 1D FC 2A 67 F5 1A 7F E5 ...-.;.. ..*g.... >+[0B80] 7C 6C FB 8A 18 BD D1 5D E5 5E 68 30 AA 58 9E 10 |l.....] .^h0.X.. >+[0B90] 13 E0 26 7E 7D C4 E1 A5 B6 86 0F 1C 0F 13 A4 5E ..&~}... .......^ >+[0BA0] 5E 6A ED 42 79 31 BB B3 5F 3A 3F DD CB 63 82 FB ^j.By1.. _:?..c.. >+[0BB0] 06 AE 12 36 C9 1E 06 7D 41 82 2E D2 FA 26 EC 17 ...6...} A....&.. >+[0BC0] 50 5E D0 DE 26 85 30 71 BC 45 3B DA 2E 08 8D B2 P^..&.0q .E;..... >+[0BD0] 2A 3C E0 79 8F 77 4C 01 69 7A 09 C7 88 E1 D1 DC *<.y.wL. iz...... >+[0BE0] FF 78 DB 25 7B B1 3C BB 22 27 80 0D 75 96 18 B6 .x.%{.<. "'..u... >+[0BF0] 40 95 6D C8 AB 04 05 41 A1 C4 25 71 C4 53 3A A6 @.m....A ..%q.S:. >+[0C00] 9C B2 4D E6 15 2C B2 47 6C DA A8 7D CC A3 89 8B ..M..,.G l..}.... >+[0C10] C9 1E 21 F5 E9 B2 42 95 68 28 AF C6 37 22 BA 30 ..!...B. h(..7".0 >+[0C20] 8D 53 FA 08 0D CE CA 81 61 0D 84 A5 2D 75 BD 41 .S...... a...-u.A >+[0C30] 85 4C 88 56 72 C6 B6 10 F8 34 CD B2 F4 5C 94 FA .L.Vr... .4...\.. >+[0C40] 80 90 82 A0 BD 68 EC 08 32 C3 B6 51 1E 3F 67 CB .....h.. 2..Q.?g. >+[0C50] 7B EB 70 83 84 D4 CB 52 55 36 61 1E 60 90 5B 6F {.p....R U6a.`.[o >+[0C60] FE 9A 62 05 CF 26 8E 65 E2 60 4B ED 63 B4 C4 E6 ..b..&.e .`K.c... >+[0C70] 44 B4 2F B0 B8 07 FE BE 0D 50 E4 56 A4 2E 0D 25 D./..... .P.V...% >+[0C80] 76 0B 0F 44 09 20 80 E5 C4 94 63 E0 54 46 1D AB v..D. .. ..c.TF.. >+[0C90] 5E 0B 09 93 B1 30 31 7B 04 DC 23 43 3B DB 7D 39 ^....01{ ..#C;.}9 >+[0CA0] 67 FE 9A 1F C1 08 AF 34 24 F6 74 E4 14 DA 34 8F g......4 $.t...4. >+[0CB0] 61 57 6A 7F 1D 4A 88 0A 90 78 93 F1 86 54 DB 22 aWj..J.. .x...T." >+[0CC0] 86 D6 69 0F DF 44 7C D3 6B 9D 41 63 50 98 3A 97 ..i..D|. k.AcP.:. >+[0CD0] B9 7B 4C 53 E3 85 73 9A C9 08 A0 75 12 50 02 87 .{LS..s. ...u.P.. >+[0CE0] B0 CF CC 84 84 D9 BC FC 94 79 AF 6A A6 08 FF 19 ........ .y.j.... >+[0CF0] 7E E9 22 9B EC 5C C1 6B 1D A4 B4 55 32 5E 23 C3 ~."..\.k ...U2^#. >+[0D00] C0 D4 8B 80 E6 67 B1 59 EB 9D 5D 9B AD C6 0E 7D .....g.Y ..]....} >+[0D10] E2 FE B1 24 8A B1 37 1E 60 7F 83 35 48 32 F7 03 ...$..7. `..5H2.. >+[0D20] E8 12 E6 21 7C 3D 21 7F 6B 14 31 9C 1A A3 4C 2B ...!|=!. k.1...L+ >+[0D30] 1C 5E EC 34 C1 2D DA 19 6C E6 6D 8D 60 D7 55 9E .^.4.-.. l.m.`.U. >+[0D40] E6 D0 B5 07 06 72 C0 E9 4E 91 94 6B 3E 0B F1 0A .....r.. N..k>... >+[0D50] 75 4D E8 CB 53 6B 34 A4 2F 96 A5 39 1A 18 6E 27 uM..Sk4. /..9..n' >+[0D60] 00 6D 41 B7 D8 F5 9A E5 01 FC 0B A8 97 56 EE 98 .mA..... .....V.. >+[0D70] 04 1D 98 84 5E 82 C8 E8 EC 17 D5 FA 96 00 3B E1 ....^... ......;. >+[0D80] 98 1C D8 FA 66 A0 DC 32 60 F6 03 46 08 3C E5 16 ....f..2 `..F.<.. >+[0D90] 6F F2 8B 4D 72 9F 0F E0 A9 71 6E 7C AE AA FB A3 o..Mr... .qn|.... >+[0DA0] 4D F1 A1 B6 1B 9F 62 71 E1 2C 82 9B AE E3 07 9B M.....bq .,...... >+[0DB0] 79 90 F1 C2 69 E5 7E CB 57 E6 C9 1C 4E A8 C7 12 y...i.~. W...N... >+[0DC0] EA 4F 4C 52 17 03 AB D4 FD 34 60 F4 7C BE 9E 36 .OLR.... .4`.|..6 >+[0DD0] 30 37 88 95 61 2E CF 70 AF 22 70 DB E8 AA 6E 3D 07..a..p ."p...n= >+[0DE0] 30 F7 4D 84 D5 00 00 00 00 00 00 00 01 00 00 00 0.M..... ........ >+[0DF0] 01 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 .....KTE ST.SAMBA >+[0E00] 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D .EXAMPLE .COM.... >+[0E10] 61 64 6D 69 6E 69 73 74 72 61 74 6F 72 00 00 00 administ rator... >+[0E20] 01 00 00 00 02 00 00 00 17 4B 54 45 53 54 2E 53 ........ .KTEST.S >+[0E30] 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D AMBA.EXA MPLE.COM >+[0E40] 00 00 00 04 63 69 66 73 00 00 00 0B 4C 4F 43 41 ....cifs ....LOCA >+[0E50] 4C 4B 54 45 53 54 36 00 17 00 00 00 10 1D C8 5E LKTEST6. .......^ >+[0E60] 46 48 82 F9 29 DB C6 A6 F1 72 6D 8D E9 4D 99 4F FH..)... .rm..M.O >+[0E70] 6A 4D 99 85 09 7D 44 0B 68 00 00 00 00 00 40 28 jM...}D. h.....@( >+[0E80] 00 00 00 00 00 00 00 00 00 00 00 00 03 FA 61 82 ........ ......a. >+[0E90] 03 F6 30 82 03 F2 A0 03 02 01 05 A1 19 1B 17 4B ..0..... .......K >+[0EA0] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[0EB0] 4C 45 2E 43 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 LE.COM.. 0....... >+[0EC0] 15 30 13 1B 04 63 69 66 73 1B 0B 4C 4F 43 41 4C .0...cif s..LOCAL >+[0ED0] 4B 54 45 53 54 36 A3 82 03 AE 30 82 03 AA A0 03 KTEST6.. ..0..... >+[0EE0] 02 01 17 A1 03 02 01 02 A2 82 03 9C 04 82 03 98 ........ ........ >+[0EF0] 66 D8 19 46 FA CB 73 2D CF 88 FD 4A EE 07 48 DA f..F..s- ...J..H. >+[0F00] 0E BC 58 30 43 40 A4 9C 00 0F 3B 17 C1 2D F5 9C ..X0C@.. ..;..-.. >+[0F10] 3E D9 2F 1D CA 01 9B D7 2E EC D7 70 ED 8B 8B 1B >./..... ...p.... >+[0F20] 5E F2 4E EE DD 0F C0 8D 61 E5 D7 0A 56 00 32 B1 ^.N..... a...V.2. >+[0F30] DB 91 37 29 0F 2F 85 EE A8 43 BA A5 B8 D4 19 74 ..7)./.. .C.....t >+[0F40] 33 F0 69 52 E1 58 98 83 D6 16 0B 44 A9 63 9B D4 3.iR.X.. ...D.c.. >+[0F50] 4E 6E A7 3E CD 9A 96 4D C4 96 F5 07 6D 29 B6 ED Nn.>...M ....m).. >+[0F60] 2A 62 3D 53 22 33 D1 95 E9 DF 74 4C 2A E2 29 AF *b=S"3.. ..tL*.). >+[0F70] 5B 69 B0 48 2D AD 94 FD A5 1D 54 D8 E2 5E C1 68 [i.H-... ..T..^.h >+[0F80] 6F BA 02 01 79 C3 C9 97 0B 76 66 45 E2 3B 10 17 o...y... .vfE.;.. >+[0F90] 95 40 46 E4 85 B9 87 BB CF CF 19 8C 3A C0 EA 38 .@F..... ....:..8 >+[0FA0] 3B B9 E9 4B 05 89 E5 27 8C 62 95 BC 0D 65 F0 D2 ;..K...' .b...e.. >+[0FB0] C0 5E BC 65 01 D5 0B CB 17 31 0F 06 49 4F A2 4A .^.e.... .1..IO.J >+[0FC0] 70 77 DB BD 92 5B 37 5C EC 06 DF C5 E2 31 C8 40 pw...[7\ .....1.@ >+[0FD0] 09 11 68 14 E7 7D CE 54 4F 52 61 31 2C 1C 53 52 ..h..}.T ORa1,.SR >+[0FE0] DB BE D8 95 39 EE 7D C6 CE C8 22 95 92 97 97 3D ....9.}. .."....= >+[0FF0] 5E 66 0F AD DC C2 4E 2E 2B 9F 63 20 30 DF B7 C1 ^f....N. +.c 0... >+[1000] D4 65 AA 6F 2D 10 24 07 20 8D 88 6E 4B 09 04 31 .e.o-.$. ..nK..1 >+[1010] B6 A3 EB F7 37 32 0E 0C 73 C6 F6 B8 4D D9 0C 4C ....72.. s...M..L >+[1020] 5B EC 10 6A 51 19 EA 3F FF 46 E7 73 16 A7 1F 33 [..jQ..? .F.s...3 >+[1030] 98 7C 9B AD 5A 23 A9 40 7C 0F DF EE 0F AA C7 E8 .|..Z#.@ |....... >+[1040] 63 07 98 3A 4A 0D 18 62 01 21 B2 AE A5 69 B0 C1 c..:J..b .!...i.. >+[1050] 15 51 BA 97 D2 C5 42 5B C5 30 38 18 A9 48 AB D7 .Q....B[ .08..H.. >+[1060] FC A1 BC 9F 71 E7 EA 18 54 42 DA D6 A4 FC C1 DC ....q... TB...... >+[1070] F3 12 30 62 AC 98 E1 7D 2B 34 1E 52 4C 26 67 32 ..0b...} +4.RL&g2 >+[1080] D9 44 1A 08 27 0E DA D0 FC 84 66 35 81 D6 EB 98 .D..'... ..f5.... >+[1090] 46 6F 1E 47 E0 14 31 BE 47 80 65 AA 0B 20 D6 33 Fo.G..1. G.e.. .3 >+[10A0] 36 3B 0D 40 2F 5A 2E 0E 01 BE 00 EB 33 3E 4B 32 6;.@/Z.. ....3>K2 >+[10B0] 91 F4 22 96 E5 5F D4 D5 92 94 CC 5B 59 6A 3E D2 ..".._.. ...[Yj>. >+[10C0] FB A0 4F 99 C4 07 8B 6F 2B 14 37 CD 37 44 C0 1F ..O....o +.7.7D.. >+[10D0] 80 9C 43 46 F2 5E F4 FE D3 39 70 61 BE 72 5B 3A ..CF.^.. .9pa.r[: >+[10E0] 8F 37 95 78 1E AB D9 E7 E9 DA FC 47 09 81 A0 0D .7.x.... ...G.... >+[10F0] 62 E1 F9 34 36 D1 DB E6 98 D8 F4 3E 77 5A 4D E2 b..46... ...>wZM. >+[1100] 5F 20 70 3D 3D 5B 34 D9 FD A8 31 F7 D9 59 F7 A3 _ p==[4. ..1..Y.. >+[1110] F0 66 F7 D9 AD 1C CD D5 85 33 A0 87 22 31 D4 F3 .f...... .3.."1.. >+[1120] 67 80 68 20 A2 90 72 7A 6F 64 FD 68 82 9E 91 B8 g.h ..rz od.h.... >+[1130] E3 F7 6D 6C 38 74 F0 96 A2 F6 25 D7 92 58 14 60 ..ml8t.. ..%..X.` >+[1140] 9F AE 01 4C 0C 09 67 3E 35 67 71 1E 2A 86 21 D3 ...L..g> 5gq.*.!. >+[1150] 60 61 98 16 94 67 0B 52 76 63 93 BD A3 3B A9 F0 `a...g.R vc...;.. >+[1160] A2 6A B7 E6 0F 35 64 DA 6A EA 20 A6 3D 94 71 59 .j...5d. j. .=.qY >+[1170] 5E CB B2 D3 F9 4D FE 1B 4B D8 64 C8 3B 7A A8 E6 ^....M.. K.d.;z.. >+[1180] D2 D5 76 71 26 D4 5C DA 1A 55 17 F2 16 C9 2F 77 ..vq&.\. .U..../w >+[1190] DB 95 19 48 A5 AC D0 C3 31 9C 0A CC 1B 44 11 6B ...H.... 1....D.k >+[11A0] 7C 88 7A 5D CF 6E 12 DA EF C5 C7 34 1D F4 CC EA |.z].n.. ...4.... >+[11B0] 37 24 4B B3 0F C1 A3 F2 29 A0 D8 93 39 C6 16 57 7$K..... )...9..W >+[11C0] D5 BF 57 BF 6C 7E F7 90 E0 EB A3 8B 07 56 9C EC ..W.l~.. .....V.. >+[11D0] 15 3E 21 DA A5 7C 00 3C F9 D2 A7 1C 6F 16 25 31 .>!..|.< ....o.%1 >+[11E0] C5 28 A7 EA F3 47 31 50 DD E1 ED 0A 93 DB 85 CC .(...G1P ........ >+[11F0] 6B 4B 2C 7F E8 F8 2D A9 6D 1D 0A 87 F2 10 8C 82 kK,...-. m....... >+[1200] 2F 9B D4 9B 92 8C 77 40 50 42 1E 42 C4 0A 4F E3 /.....w@ PB.B..O. >+[1210] 6C 6C DC 81 C4 1E BB F0 7D CF 3C 73 22 5B C3 1A ll...... }.<s"[.. >+[1220] 97 35 EE 3A CD 6D F3 68 A3 C5 65 7E E9 54 C0 E3 .5.:.m.h ..e~.T.. >+[1230] 7D 6A 32 4C D1 3E D0 78 4B BF 18 9F A5 25 4A 92 }j2L.>.x K....%J. >+[1240] 1E 6C 8F 01 D6 59 D7 CF 2E A0 CC 98 F6 75 28 2F .l...Y.. .....u(/ >+[1250] F7 2A 70 28 A9 45 1F 75 C2 4E 62 ED D8 C4 A0 8D .*p(.E.u .Nb..... >+[1260] 55 B2 84 1C A4 CE 87 EF 24 EE BC CE 40 09 EB 05 U....... $...@... >+[1270] 0B D1 14 31 50 32 2F B6 A8 97 17 4B A7 95 01 50 ...1P2/. ...K...P >+[1280] 6E 0E 23 49 9C 72 21 91 00 00 00 00 00 00 00 01 n.#I.r!. ........ >+[1290] 00 00 00 01 00 00 00 17 4B 54 45 53 54 2E 53 41 ........ KTEST.SA >+[12A0] 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 MBA.EXAM PLE.COM. >+[12B0] 00 00 0D 61 64 6D 69 6E 69 73 74 72 61 74 6F 72 ...admin istrator >+[12C0] 00 00 00 01 00 00 00 02 00 00 00 17 4B 54 45 53 ........ ....KTES >+[12D0] 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E T.SAMBA. EXAMPLE. >+[12E0] 43 4F 4D 00 00 00 04 63 69 66 73 00 00 00 0B 4C COM....c ifs....L >+[12F0] 4F 43 41 4C 4B 54 45 53 54 36 00 17 00 00 00 10 OCALKTES T6...... >+[1300] 1D C8 5E 46 48 82 F9 29 DB C6 A6 F1 72 6D 8D E9 ..^FH..) ....rm.. >+[1310] 4D 99 4F 6A 4D 99 85 09 7D 44 0B 68 00 00 00 00 M.OjM... }D.h.... >+[1320] 00 40 28 00 00 00 00 00 00 00 00 00 00 00 00 03 .@(..... ........ >+[1330] FA 61 82 03 F6 30 82 03 F2 A0 03 02 01 05 A1 19 .a...0.. ........ >+[1340] 1B 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 ..KTEST. SAMBA.EX >+[1350] 41 4D 50 4C 45 2E 43 4F 4D A2 1E 30 1C A0 03 02 AMPLE.CO M..0.... >+[1360] 01 01 A1 15 30 13 1B 04 63 69 66 73 1B 0B 4C 4F ....0... cifs..LO >+[1370] 43 41 4C 4B 54 45 53 54 36 A3 82 03 AE 30 82 03 CALKTEST 6....0.. >+[1380] AA A0 03 02 01 17 A1 03 02 01 02 A2 82 03 9C 04 ........ ........ >+[1390] 82 03 98 66 D8 19 46 FA CB 73 2D CF 88 FD 4A EE ...f..F. .s-...J. >+[13A0] 07 48 DA 0E BC 58 30 43 40 A4 9C 00 0F 3B 17 C1 .H...X0C @....;.. >+[13B0] 2D F5 9C 3E D9 2F 1D CA 01 9B D7 2E EC D7 70 ED -..>./.. ......p. >+[13C0] 8B 8B 1B 5E F2 4E EE DD 0F C0 8D 61 E5 D7 0A 56 ...^.N.. ...a...V >+[13D0] 00 32 B1 DB 91 37 29 0F 2F 85 EE A8 43 BA A5 B8 .2...7). /...C... >+[13E0] D4 19 74 33 F0 69 52 E1 58 98 83 D6 16 0B 44 A9 ..t3.iR. X.....D. >+[13F0] 63 9B D4 4E 6E A7 3E CD 9A 96 4D C4 96 F5 07 6D c..Nn.>. ..M....m >+[1400] 29 B6 ED 2A 62 3D 53 22 33 D1 95 E9 DF 74 4C 2A )..*b=S" 3....tL* >+[1410] E2 29 AF 5B 69 B0 48 2D AD 94 FD A5 1D 54 D8 E2 .).[i.H- .....T.. >+[1420] 5E C1 68 6F BA 02 01 79 C3 C9 97 0B 76 66 45 E2 ^.ho...y ....vfE. >+[1430] 3B 10 17 95 40 46 E4 85 B9 87 BB CF CF 19 8C 3A ;...@F.. .......: >+[1440] C0 EA 38 3B B9 E9 4B 05 89 E5 27 8C 62 95 BC 0D ..8;..K. ..'.b... >+[1450] 65 F0 D2 C0 5E BC 65 01 D5 0B CB 17 31 0F 06 49 e...^.e. ....1..I >+[1460] 4F A2 4A 70 77 DB BD 92 5B 37 5C EC 06 DF C5 E2 O.Jpw... [7\..... >+[1470] 31 C8 40 09 11 68 14 E7 7D CE 54 4F 52 61 31 2C 1.@..h.. }.TORa1, >+[1480] 1C 53 52 DB BE D8 95 39 EE 7D C6 CE C8 22 95 92 .SR....9 .}...".. >+[1490] 97 97 3D 5E 66 0F AD DC C2 4E 2E 2B 9F 63 20 30 ..=^f... .N.+.c 0 >+[14A0] DF B7 C1 D4 65 AA 6F 2D 10 24 07 20 8D 88 6E 4B ....e.o- .$. ..nK >+[14B0] 09 04 31 B6 A3 EB F7 37 32 0E 0C 73 C6 F6 B8 4D ..1....7 2..s...M >+[14C0] D9 0C 4C 5B EC 10 6A 51 19 EA 3F FF 46 E7 73 16 ..L[..jQ ..?.F.s. >+[14D0] A7 1F 33 98 7C 9B AD 5A 23 A9 40 7C 0F DF EE 0F ..3.|..Z #.@|.... >+[14E0] AA C7 E8 63 07 98 3A 4A 0D 18 62 01 21 B2 AE A5 ...c..:J ..b.!... >+[14F0] 69 B0 C1 15 51 BA 97 D2 C5 42 5B C5 30 38 18 A9 i...Q... .B[.08.. >+[1500] 48 AB D7 FC A1 BC 9F 71 E7 EA 18 54 42 DA D6 A4 H......q ...TB... >+[1510] FC C1 DC F3 12 30 62 AC 98 E1 7D 2B 34 1E 52 4C .....0b. ..}+4.RL >+[1520] 26 67 32 D9 44 1A 08 27 0E DA D0 FC 84 66 35 81 &g2.D..' .....f5. >+[1530] D6 EB 98 46 6F 1E 47 E0 14 31 BE 47 80 65 AA 0B ...Fo.G. .1.G.e.. >+[1540] 20 D6 33 36 3B 0D 40 2F 5A 2E 0E 01 BE 00 EB 33 .36;.@/ Z......3 >+[1550] 3E 4B 32 91 F4 22 96 E5 5F D4 D5 92 94 CC 5B 59 >K2..".. _.....[Y >+[1560] 6A 3E D2 FB A0 4F 99 C4 07 8B 6F 2B 14 37 CD 37 j>...O.. ..o+.7.7 >+[1570] 44 C0 1F 80 9C 43 46 F2 5E F4 FE D3 39 70 61 BE D....CF. ^...9pa. >+[1580] 72 5B 3A 8F 37 95 78 1E AB D9 E7 E9 DA FC 47 09 r[:.7.x. ......G. >+[1590] 81 A0 0D 62 E1 F9 34 36 D1 DB E6 98 D8 F4 3E 77 ...b..46 ......>w >+[15A0] 5A 4D E2 5F 20 70 3D 3D 5B 34 D9 FD A8 31 F7 D9 ZM._ p== [4...1.. >+[15B0] 59 F7 A3 F0 66 F7 D9 AD 1C CD D5 85 33 A0 87 22 Y...f... ....3.." >+[15C0] 31 D4 F3 67 80 68 20 A2 90 72 7A 6F 64 FD 68 82 1..g.h . .rzod.h. >+[15D0] 9E 91 B8 E3 F7 6D 6C 38 74 F0 96 A2 F6 25 D7 92 .....ml8 t....%.. >+[15E0] 58 14 60 9F AE 01 4C 0C 09 67 3E 35 67 71 1E 2A X.`...L. .g>5gq.* >+[15F0] 86 21 D3 60 61 98 16 94 67 0B 52 76 63 93 BD A3 .!.`a... g.Rvc... >+[1600] 3B A9 F0 A2 6A B7 E6 0F 35 64 DA 6A EA 20 A6 3D ;...j... 5d.j. .= >+[1610] 94 71 59 5E CB B2 D3 F9 4D FE 1B 4B D8 64 C8 3B .qY^.... M..K.d.; >+[1620] 7A A8 E6 D2 D5 76 71 26 D4 5C DA 1A 55 17 F2 16 z....vq& .\..U... >+[1630] C9 2F 77 DB 95 19 48 A5 AC D0 C3 31 9C 0A CC 1B ./w...H. ...1.... >+[1640] 44 11 6B 7C 88 7A 5D CF 6E 12 DA EF C5 C7 34 1D D.k|.z]. n.....4. >+[1650] F4 CC EA 37 24 4B B3 0F C1 A3 F2 29 A0 D8 93 39 ...7$K.. ...)...9 >+[1660] C6 16 57 D5 BF 57 BF 6C 7E F7 90 E0 EB A3 8B 07 ..W..W.l ~....... >+[1670] 56 9C EC 15 3E 21 DA A5 7C 00 3C F9 D2 A7 1C 6F V...>!.. |.<....o >+[1680] 16 25 31 C5 28 A7 EA F3 47 31 50 DD E1 ED 0A 93 .%1.(... G1P..... >+[1690] DB 85 CC 6B 4B 2C 7F E8 F8 2D A9 6D 1D 0A 87 F2 ...kK,.. .-.m.... >+[16A0] 10 8C 82 2F 9B D4 9B 92 8C 77 40 50 42 1E 42 C4 .../.... .w@PB.B. >+[16B0] 0A 4F E3 6C 6C DC 81 C4 1E BB F0 7D CF 3C 73 22 .O.ll... ...}.<s" >+[16C0] 5B C3 1A 97 35 EE 3A CD 6D F3 68 A3 C5 65 7E E9 [...5.:. m.h..e~. >+[16D0] 54 C0 E3 7D 6A 32 4C D1 3E D0 78 4B BF 18 9F A5 T..}j2L. >.xK.... >+[16E0] 25 4A 92 1E 6C 8F 01 D6 59 D7 CF 2E A0 CC 98 F6 %J..l... Y....... >+[16F0] 75 28 2F F7 2A 70 28 A9 45 1F 75 C2 4E 62 ED D8 u(/.*p(. E.u.Nb.. >+[1700] C4 A0 8D 55 B2 84 1C A4 CE 87 EF 24 EE BC CE 40 ...U.... ...$...@ >+[1710] 09 EB 05 0B D1 14 31 50 32 2F B6 A8 97 17 4B A7 ......1P 2/....K. >+[1720] 95 01 50 6E 0E 23 49 9C 72 21 91 00 00 00 00 00 ..Pn.#I. r!...... >+[1730] 00 00 01 00 00 00 01 00 00 00 17 4B 54 45 53 54 ........ ...KTEST >+[1740] 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 .SAMBA.E XAMPLE.C >+[1750] 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 73 74 72 61 OM....ad ministra >+[1760] 74 6F 72 00 00 00 01 00 00 00 02 00 00 00 17 4B tor..... .......K >+[1770] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[1780] 4C 45 2E 43 4F 4D 00 00 00 04 63 69 66 73 00 00 LE.COM.. ..cifs.. >+[1790] 00 0B 4C 4F 43 41 4C 4B 54 45 53 54 36 00 17 00 ..LOCALK TEST6... >+[17A0] 00 00 10 1D C8 5E 46 48 82 F9 29 DB C6 A6 F1 72 .....^FH ..)....r >+[17B0] 6D 8D E9 4D 99 4F 6A 4D 99 85 09 7D 44 0B 68 00 m..M.OjM ...}D.h. >+[17C0] 00 00 00 00 40 28 00 00 00 00 00 00 00 00 00 00 ....@(.. ........ >+[17D0] 00 00 03 FA 61 82 03 F6 30 82 03 F2 A0 03 02 01 ....a... 0....... >+[17E0] 05 A1 19 1B 17 4B 54 45 53 54 2E 53 41 4D 42 41 .....KTE ST.SAMBA >+[17F0] 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D A2 1E 30 1C .EXAMPLE .COM..0. >+[1800] A0 03 02 01 01 A1 15 30 13 1B 04 63 69 66 73 1B .......0 ...cifs. >+[1810] 0B 4C 4F 43 41 4C 4B 54 45 53 54 36 A3 82 03 AE .LOCALKT EST6.... >+[1820] 30 82 03 AA A0 03 02 01 17 A1 03 02 01 02 A2 82 0....... ........ >+[1830] 03 9C 04 82 03 98 66 D8 19 46 FA CB 73 2D CF 88 ......f. .F..s-.. >+[1840] FD 4A EE 07 48 DA 0E BC 58 30 43 40 A4 9C 00 0F .J..H... X0C@.... >+[1850] 3B 17 C1 2D F5 9C 3E D9 2F 1D CA 01 9B D7 2E EC ;..-..>. /....... >+[1860] D7 70 ED 8B 8B 1B 5E F2 4E EE DD 0F C0 8D 61 E5 .p....^. N.....a. >+[1870] D7 0A 56 00 32 B1 DB 91 37 29 0F 2F 85 EE A8 43 ..V.2... 7)./...C >+[1880] BA A5 B8 D4 19 74 33 F0 69 52 E1 58 98 83 D6 16 .....t3. iR.X.... >+[1890] 0B 44 A9 63 9B D4 4E 6E A7 3E CD 9A 96 4D C4 96 .D.c..Nn .>...M.. >+[18A0] F5 07 6D 29 B6 ED 2A 62 3D 53 22 33 D1 95 E9 DF ..m)..*b =S"3.... >+[18B0] 74 4C 2A E2 29 AF 5B 69 B0 48 2D AD 94 FD A5 1D tL*.).[i .H-..... >+[18C0] 54 D8 E2 5E C1 68 6F BA 02 01 79 C3 C9 97 0B 76 T..^.ho. ..y....v >+[18D0] 66 45 E2 3B 10 17 95 40 46 E4 85 B9 87 BB CF CF fE.;...@ F....... >+[18E0] 19 8C 3A C0 EA 38 3B B9 E9 4B 05 89 E5 27 8C 62 ..:..8;. .K...'.b >+[18F0] 95 BC 0D 65 F0 D2 C0 5E BC 65 01 D5 0B CB 17 31 ...e...^ .e.....1 >+[1900] 0F 06 49 4F A2 4A 70 77 DB BD 92 5B 37 5C EC 06 ..IO.Jpw ...[7\.. >+[1910] DF C5 E2 31 C8 40 09 11 68 14 E7 7D CE 54 4F 52 ...1.@.. h..}.TOR >+[1920] 61 31 2C 1C 53 52 DB BE D8 95 39 EE 7D C6 CE C8 a1,.SR.. ..9.}... >+[1930] 22 95 92 97 97 3D 5E 66 0F AD DC C2 4E 2E 2B 9F "....=^f ....N.+. >+[1940] 63 20 30 DF B7 C1 D4 65 AA 6F 2D 10 24 07 20 8D c 0....e .o-.$. . >+[1950] 88 6E 4B 09 04 31 B6 A3 EB F7 37 32 0E 0C 73 C6 .nK..1.. ..72..s. >+[1960] F6 B8 4D D9 0C 4C 5B EC 10 6A 51 19 EA 3F FF 46 ..M..L[. .jQ..?.F >+[1970] E7 73 16 A7 1F 33 98 7C 9B AD 5A 23 A9 40 7C 0F .s...3.| ..Z#.@|. >+[1980] DF EE 0F AA C7 E8 63 07 98 3A 4A 0D 18 62 01 21 ......c. .:J..b.! >+[1990] B2 AE A5 69 B0 C1 15 51 BA 97 D2 C5 42 5B C5 30 ...i...Q ....B[.0 >+[19A0] 38 18 A9 48 AB D7 FC A1 BC 9F 71 E7 EA 18 54 42 8..H.... ..q...TB >+[19B0] DA D6 A4 FC C1 DC F3 12 30 62 AC 98 E1 7D 2B 34 ........ 0b...}+4 >+[19C0] 1E 52 4C 26 67 32 D9 44 1A 08 27 0E DA D0 FC 84 .RL&g2.D ..'..... >+[19D0] 66 35 81 D6 EB 98 46 6F 1E 47 E0 14 31 BE 47 80 f5....Fo .G..1.G. >+[19E0] 65 AA 0B 20 D6 33 36 3B 0D 40 2F 5A 2E 0E 01 BE e.. .36; .@/Z.... >+[19F0] 00 EB 33 3E 4B 32 91 F4 22 96 E5 5F D4 D5 92 94 ..3>K2.. ".._.... >+[1A00] CC 5B 59 6A 3E D2 FB A0 4F 99 C4 07 8B 6F 2B 14 .[Yj>... O....o+. >+[1A10] 37 CD 37 44 C0 1F 80 9C 43 46 F2 5E F4 FE D3 39 7.7D.... CF.^...9 >+[1A20] 70 61 BE 72 5B 3A 8F 37 95 78 1E AB D9 E7 E9 DA pa.r[:.7 .x...... >+[1A30] FC 47 09 81 A0 0D 62 E1 F9 34 36 D1 DB E6 98 D8 .G....b. .46..... >+[1A40] F4 3E 77 5A 4D E2 5F 20 70 3D 3D 5B 34 D9 FD A8 .>wZM._ p==[4... >+[1A50] 31 F7 D9 59 F7 A3 F0 66 F7 D9 AD 1C CD D5 85 33 1..Y...f .......3 >+[1A60] A0 87 22 31 D4 F3 67 80 68 20 A2 90 72 7A 6F 64 .."1..g. h ..rzod >+[1A70] FD 68 82 9E 91 B8 E3 F7 6D 6C 38 74 F0 96 A2 F6 .h...... ml8t.... >+[1A80] 25 D7 92 58 14 60 9F AE 01 4C 0C 09 67 3E 35 67 %..X.`.. .L..g>5g >+[1A90] 71 1E 2A 86 21 D3 60 61 98 16 94 67 0B 52 76 63 q.*.!.`a ...g.Rvc >+[1AA0] 93 BD A3 3B A9 F0 A2 6A B7 E6 0F 35 64 DA 6A EA ...;...j ...5d.j. >+[1AB0] 20 A6 3D 94 71 59 5E CB B2 D3 F9 4D FE 1B 4B D8 .=.qY^. ...M..K. >+[1AC0] 64 C8 3B 7A A8 E6 D2 D5 76 71 26 D4 5C DA 1A 55 d.;z.... vq&.\..U >+[1AD0] 17 F2 16 C9 2F 77 DB 95 19 48 A5 AC D0 C3 31 9C ..../w.. .H....1. >+[1AE0] 0A CC 1B 44 11 6B 7C 88 7A 5D CF 6E 12 DA EF C5 ...D.k|. z].n.... >+[1AF0] C7 34 1D F4 CC EA 37 24 4B B3 0F C1 A3 F2 29 A0 .4....7$ K.....). >+[1B00] D8 93 39 C6 16 57 D5 BF 57 BF 6C 7E F7 90 E0 EB ..9..W.. W.l~.... >+[1B10] A3 8B 07 56 9C EC 15 3E 21 DA A5 7C 00 3C F9 D2 ...V...> !..|.<.. >+[1B20] A7 1C 6F 16 25 31 C5 28 A7 EA F3 47 31 50 DD E1 ..o.%1.( ...G1P.. >+[1B30] ED 0A 93 DB 85 CC 6B 4B 2C 7F E8 F8 2D A9 6D 1D ......kK ,...-.m. >+[1B40] 0A 87 F2 10 8C 82 2F 9B D4 9B 92 8C 77 40 50 42 ....../. ....w@PB >+[1B50] 1E 42 C4 0A 4F E3 6C 6C DC 81 C4 1E BB F0 7D CF .B..O.ll ......}. >+[1B60] 3C 73 22 5B C3 1A 97 35 EE 3A CD 6D F3 68 A3 C5 <s"[...5 .:.m.h.. >+[1B70] 65 7E E9 54 C0 E3 7D 6A 32 4C D1 3E D0 78 4B BF e~.T..}j 2L.>.xK. >+[1B80] 18 9F A5 25 4A 92 1E 6C 8F 01 D6 59 D7 CF 2E A0 ...%J..l ...Y.... >+[1B90] CC 98 F6 75 28 2F F7 2A 70 28 A9 45 1F 75 C2 4E ...u(/.* p(.E.u.N >+[1BA0] 62 ED D8 C4 A0 8D 55 B2 84 1C A4 CE 87 EF 24 EE b.....U. ......$. >+[1BB0] BC CE 40 09 EB 05 0B D1 14 31 50 32 2F B6 A8 97 ..@..... .1P2/... >+[1BC0] 17 4B A7 95 01 50 6E 0E 23 49 9C 72 21 91 00 00 .K...Pn. #I.r!... >+[1BD0] 00 00 00 00 00 01 00 00 00 01 00 00 00 17 4B 54 ........ ......KT >+[1BE0] 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C EST.SAMB A.EXAMPL >+[1BF0] 45 2E 43 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 73 E.COM... .adminis >+[1C00] 74 72 61 74 6F 72 00 00 00 01 00 00 00 02 00 00 trator.. ........ >+[1C10] 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 ..KTEST. SAMBA.EX >+[1C20] 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 04 63 69 66 AMPLE.CO M....cif >+[1C30] 73 00 00 00 0B 4C 4F 43 41 4C 4B 54 45 53 54 36 s....LOC ALKTEST6 >+[1C40] 00 17 00 00 00 10 1D C8 5E 46 48 82 F9 29 DB C6 ........ ^FH..).. >+[1C50] A6 F1 72 6D 8D E9 4D 99 4F 6A 4D 99 85 09 7D 44 ..rm..M. OjM...}D >+[1C60] 0B 68 00 00 00 00 00 40 28 00 00 00 00 00 00 00 .h.....@ (....... >+[1C70] 00 00 00 00 00 03 FA 61 82 03 F6 30 82 03 F2 A0 .......a ...0.... >+[1C80] 03 02 01 05 A1 19 1B 17 4B 54 45 53 54 2E 53 41 ........ KTEST.SA >+[1C90] 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D A2 MBA.EXAM PLE.COM. >+[1CA0] 1E 30 1C A0 03 02 01 01 A1 15 30 13 1B 04 63 69 .0...... ..0...ci >+[1CB0] 66 73 1B 0B 4C 4F 43 41 4C 4B 54 45 53 54 36 A3 fs..LOCA LKTEST6. >+[1CC0] 82 03 AE 30 82 03 AA A0 03 02 01 17 A1 03 02 01 ...0.... ........ >+[1CD0] 02 A2 82 03 9C 04 82 03 98 66 D8 19 46 FA CB 73 ........ .f..F..s >+[1CE0] 2D CF 88 FD 4A EE 07 48 DA 0E BC 58 30 43 40 A4 -...J..H ...X0C@. >+[1CF0] 9C 00 0F 3B 17 C1 2D F5 9C 3E D9 2F 1D CA 01 9B ...;..-. .>./.... >+[1D00] D7 2E EC D7 70 ED 8B 8B 1B 5E F2 4E EE DD 0F C0 ....p... .^.N.... >+[1D10] 8D 61 E5 D7 0A 56 00 32 B1 DB 91 37 29 0F 2F 85 .a...V.2 ...7)./. >+[1D20] EE A8 43 BA A5 B8 D4 19 74 33 F0 69 52 E1 58 98 ..C..... t3.iR.X. >+[1D30] 83 D6 16 0B 44 A9 63 9B D4 4E 6E A7 3E CD 9A 96 ....D.c. .Nn.>... >+[1D40] 4D C4 96 F5 07 6D 29 B6 ED 2A 62 3D 53 22 33 D1 M....m). .*b=S"3. >+[1D50] 95 E9 DF 74 4C 2A E2 29 AF 5B 69 B0 48 2D AD 94 ...tL*.) .[i.H-.. >+[1D60] FD A5 1D 54 D8 E2 5E C1 68 6F BA 02 01 79 C3 C9 ...T..^. ho...y.. >+[1D70] 97 0B 76 66 45 E2 3B 10 17 95 40 46 E4 85 B9 87 ..vfE.;. ..@F.... >+[1D80] BB CF CF 19 8C 3A C0 EA 38 3B B9 E9 4B 05 89 E5 .....:.. 8;..K... >+[1D90] 27 8C 62 95 BC 0D 65 F0 D2 C0 5E BC 65 01 D5 0B '.b...e. ..^.e... >+[1DA0] CB 17 31 0F 06 49 4F A2 4A 70 77 DB BD 92 5B 37 ..1..IO. Jpw...[7 >+[1DB0] 5C EC 06 DF C5 E2 31 C8 40 09 11 68 14 E7 7D CE \.....1. @..h..}. >+[1DC0] 54 4F 52 61 31 2C 1C 53 52 DB BE D8 95 39 EE 7D TORa1,.S R....9.} >+[1DD0] C6 CE C8 22 95 92 97 97 3D 5E 66 0F AD DC C2 4E ...".... =^f....N >+[1DE0] 2E 2B 9F 63 20 30 DF B7 C1 D4 65 AA 6F 2D 10 24 .+.c 0.. ..e.o-.$ >+[1DF0] 07 20 8D 88 6E 4B 09 04 31 B6 A3 EB F7 37 32 0E . ..nK.. 1....72. >+[1E00] 0C 73 C6 F6 B8 4D D9 0C 4C 5B EC 10 6A 51 19 EA .s...M.. L[..jQ.. >+[1E10] 3F FF 46 E7 73 16 A7 1F 33 98 7C 9B AD 5A 23 A9 ?.F.s... 3.|..Z#. >+[1E20] 40 7C 0F DF EE 0F AA C7 E8 63 07 98 3A 4A 0D 18 @|...... .c..:J.. >+[1E30] 62 01 21 B2 AE A5 69 B0 C1 15 51 BA 97 D2 C5 42 b.!...i. ..Q....B >+[1E40] 5B C5 30 38 18 A9 48 AB D7 FC A1 BC 9F 71 E7 EA [.08..H. .....q.. >+[1E50] 18 54 42 DA D6 A4 FC C1 DC F3 12 30 62 AC 98 E1 .TB..... ...0b... >+[1E60] 7D 2B 34 1E 52 4C 26 67 32 D9 44 1A 08 27 0E DA }+4.RL&g 2.D..'.. >+[1E70] D0 FC 84 66 35 81 D6 EB 98 46 6F 1E 47 E0 14 31 ...f5... .Fo.G..1 >+[1E80] BE 47 80 65 AA 0B 20 D6 33 36 3B 0D 40 2F 5A 2E .G.e.. . 36;.@/Z. >+[1E90] 0E 01 BE 00 EB 33 3E 4B 32 91 F4 22 96 E5 5F D4 .....3>K 2..".._. >+[1EA0] D5 92 94 CC 5B 59 6A 3E D2 FB A0 4F 99 C4 07 8B ....[Yj> ...O.... >+[1EB0] 6F 2B 14 37 CD 37 44 C0 1F 80 9C 43 46 F2 5E F4 o+.7.7D. ...CF.^. >+[1EC0] FE D3 39 70 61 BE 72 5B 3A 8F 37 95 78 1E AB D9 ..9pa.r[ :.7.x... >+[1ED0] E7 E9 DA FC 47 09 81 A0 0D 62 E1 F9 34 36 D1 DB ....G... .b..46.. >+[1EE0] E6 98 D8 F4 3E 77 5A 4D E2 5F 20 70 3D 3D 5B 34 ....>wZM ._ p==[4 >+[1EF0] D9 FD A8 31 F7 D9 59 F7 A3 F0 66 F7 D9 AD 1C CD ...1..Y. ..f..... >+[1F00] D5 85 33 A0 87 22 31 D4 F3 67 80 68 20 A2 90 72 ..3.."1. .g.h ..r >+[1F10] 7A 6F 64 FD 68 82 9E 91 B8 E3 F7 6D 6C 38 74 F0 zod.h... ...ml8t. >+[1F20] 96 A2 F6 25 D7 92 58 14 60 9F AE 01 4C 0C 09 67 ...%..X. `...L..g >+[1F30] 3E 35 67 71 1E 2A 86 21 D3 60 61 98 16 94 67 0B >5gq.*.! .`a...g. >+[1F40] 52 76 63 93 BD A3 3B A9 F0 A2 6A B7 E6 0F 35 64 Rvc...;. ..j...5d >+[1F50] DA 6A EA 20 A6 3D 94 71 59 5E CB B2 D3 F9 4D FE .j. .=.q Y^....M. >+[1F60] 1B 4B D8 64 C8 3B 7A A8 E6 D2 D5 76 71 26 D4 5C .K.d.;z. ...vq&.\ >+[1F70] DA 1A 55 17 F2 16 C9 2F 77 DB 95 19 48 A5 AC D0 ..U..../ w...H... >+[1F80] C3 31 9C 0A CC 1B 44 11 6B 7C 88 7A 5D CF 6E 12 .1....D. k|.z].n. >+[1F90] DA EF C5 C7 34 1D F4 CC EA 37 24 4B B3 0F C1 A3 ....4... .7$K.... >+[1FA0] F2 29 A0 D8 93 39 C6 16 57 D5 BF 57 BF 6C 7E F7 .)...9.. W..W.l~. >+[1FB0] 90 E0 EB A3 8B 07 56 9C EC 15 3E 21 DA A5 7C 00 ......V. ..>!..|. >+[1FC0] 3C F9 D2 A7 1C 6F 16 25 31 C5 28 A7 EA F3 47 31 <....o.% 1.(...G1 >+[1FD0] 50 DD E1 ED 0A 93 DB 85 CC 6B 4B 2C 7F E8 F8 2D P....... .kK,...- >+[1FE0] A9 6D 1D 0A 87 F2 10 8C 82 2F 9B D4 9B 92 8C 77 .m...... ./.....w >+[1FF0] 40 50 42 1E 42 C4 0A 4F E3 6C 6C DC 81 C4 1E BB @PB.B..O .ll..... >+[2000] F0 7D CF 3C 73 22 5B C3 1A 97 35 EE 3A CD 6D F3 .}.<s"[. ..5.:.m. >+[2010] 68 A3 C5 65 7E E9 54 C0 E3 7D 6A 32 4C D1 3E D0 h..e~.T. .}j2L.>. >+[2020] 78 4B BF 18 9F A5 25 4A 92 1E 6C 8F 01 D6 59 D7 xK....%J ..l...Y. >+[2030] CF 2E A0 CC 98 F6 75 28 2F F7 2A 70 28 A9 45 1F ......u( /.*p(.E. >+[2040] 75 C2 4E 62 ED D8 C4 A0 8D 55 B2 84 1C A4 CE 87 u.Nb.... .U...... >+[2050] EF 24 EE BC CE 40 09 EB 05 0B D1 14 31 50 32 2F .$...@.. ....1P2/ >+[2060] B6 A8 97 17 4B A7 95 01 50 6E 0E 23 49 9C 72 21 ....K... Pn.#I.r! >+[2070] 91 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 ........ ........ >+[2080] 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 .KTEST.S AMBA.EXA >+[2090] 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D 61 64 6D 69 MPLE.COM ....admi >+[20A0] 6E 69 73 74 72 61 74 6F 72 00 00 00 01 00 00 00 nistrato r....... >+[20B0] 02 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 .....KTE ST.SAMBA >+[20C0] 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 04 .EXAMPLE .COM.... >+[20D0] 68 6F 73 74 00 00 00 0B 6C 6F 63 61 6C 6B 74 65 host.... localkte >+[20E0] 73 74 36 00 17 00 00 00 10 72 47 04 38 B6 E6 F0 st6..... .rG.8... >+[20F0] 44 9E 9F 27 66 E1 69 9C 9A 4D 99 4F 6A 4D 99 90 D..'f.i. .M.OjM.. >+[2100] F5 7D 44 0B 68 00 00 00 00 00 40 28 00 00 00 00 .}D.h... ..@(.... >+[2110] 00 00 00 00 00 00 00 00 03 FA 61 82 03 F6 30 82 ........ ..a...0. >+[2120] 03 F2 A0 03 02 01 05 A1 19 1B 17 4B 54 45 53 54 ........ ...KTEST >+[2130] 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 .SAMBA.E XAMPLE.C >+[2140] 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 15 30 13 1B OM..0... .....0.. >+[2150] 04 68 6F 73 74 1B 0B 6C 6F 63 61 6C 6B 74 65 73 .host..l ocalktes >+[2160] 74 36 A3 82 03 AE 30 82 03 AA A0 03 02 01 17 A1 t6....0. ........ >+[2170] 03 02 01 02 A2 82 03 9C 04 82 03 98 58 95 95 EB ........ ....X... >+[2180] CB 8F 68 D4 77 43 0F 3B 44 B4 15 DA 40 6D FD E9 ..h.wC.; D...@m.. >+[2190] 85 D3 2F CD B5 1E 96 CD F6 E9 67 91 36 08 9E B4 ../..... ..g.6... >+[21A0] B3 47 70 7A B3 4E 82 5A 4F 8E 4B F5 8D 04 E4 5C .Gpz.N.Z O.K....\ >+[21B0] C4 D8 0C AF 08 25 F9 C1 64 B2 3A 35 26 E9 B2 72 .....%.. d.:5&..r >+[21C0] 66 B5 E9 81 FC BE 12 1B CC 8A A5 82 31 F6 7F C3 f....... ....1... >+[21D0] 5A 19 A3 31 F2 99 14 1E 64 E4 41 E8 C7 C3 F3 DF Z..1.... d.A..... >+[21E0] F5 65 7D B0 9F DC 5D 25 1D 1A A8 EA AA 88 6D F4 .e}...]% ......m. >+[21F0] 7C 25 9F 53 F6 A6 8F B1 24 AF 98 FE 53 7B 35 3C |%.S.... $...S{5< >+[2200] DB EC 7F 09 74 E9 C4 8D 20 B4 47 08 0E 32 B8 C9 ....t... .G..2.. >+[2210] 45 27 12 F9 8E F5 D6 C2 DD 1A 96 0E 68 5F 39 65 E'...... ....h_9e >+[2220] 72 C7 BD 8E 04 0E 13 E1 03 27 AC 50 80 76 E6 7A r....... .'.P.v.z >+[2230] 8E F4 C2 72 4F 68 B3 34 00 A9 54 41 DA FD 96 94 ...rOh.4 ..TA.... >+[2240] 29 A1 59 15 2F DB 6C 94 85 49 C5 D0 6D 48 B0 C4 ).Y./.l. .I..mH.. >+[2250] 65 D0 95 1D DB 3D 25 D0 75 50 D4 CF FA 2F 71 57 e....=%. uP.../qW >+[2260] BD 6C 1C 59 E1 C3 5B C7 24 95 FF B0 20 EF 6A DB .l.Y..[. $... .j. >+[2270] 79 87 67 91 94 E9 16 E2 BB 74 7A 08 E1 6A 36 5F y.g..... .tz..j6_ >+[2280] DF 11 AB 35 9B 3E 32 48 83 89 41 4E 06 BF F9 BB ...5.>2H ..AN.... >+[2290] EC E4 D7 6D 77 C4 55 22 DF F7 91 4D CB C5 01 A5 ...mw.U" ...M.... >+[22A0] BA 2D 1E 92 76 04 E8 02 2F 5E AF 1C B3 B7 A6 FB .-..v... /^...... >+[22B0] 3A 9F D9 7C 6D DA B4 8F 31 00 A5 30 F2 76 72 9B :..|m... 1..0.vr. >+[22C0] 62 97 E0 56 E5 E4 C7 6B 8B FC 84 75 57 66 6E D7 b..V...k ...uWfn. >+[22D0] B7 41 6F 61 F4 5B 0F 87 68 F6 54 02 26 1B 1F B7 .Aoa.[.. h.T.&... >+[22E0] 60 D6 E7 FA 4F C7 DB 35 58 EC 13 21 D4 C6 A1 27 `...O..5 X..!...' >+[22F0] BA E7 82 DF 29 FB 9D 5D E8 35 28 C9 9C 4E D7 BE ....)..] .5(..N.. >+[2300] 2F 6D F1 E8 0B 5A 74 C9 93 9F AD 42 24 4B B7 3B /m...Zt. ...B$K.; >+[2310] 38 2A 11 CF F0 BD 85 40 48 D8 9D E7 6B 65 70 42 8*.....@ H...kepB >+[2320] 60 DA 9B 65 CB C8 C5 D7 40 3A 12 DC 64 AF 82 54 `..e.... @:..d..T >+[2330] 34 05 38 4F C6 FB 38 E2 73 A9 89 B7 FC 33 15 85 4.8O..8. s....3.. >+[2340] 9E CA E9 E0 89 18 18 84 02 65 B4 74 5B D4 A1 6F ........ .e.t[..o >+[2350] 5F 79 20 CB D7 36 C8 6D 5B 1E 5E 0C 82 16 9F CC _y ..6.m [.^..... >+[2360] 5A 1E 57 C1 B6 94 51 87 A1 3D 12 D4 8B FE 0F 93 Z.W...Q. .=...... >+[2370] ED 53 A3 F4 88 3C 35 05 89 FE AF 0B 36 62 E3 2F .S...<5. ....6b./ >+[2380] 5C 4A 0E 07 67 39 A3 8E C0 45 07 7F 73 32 BC DE \J..g9.. .E..s2.. >+[2390] 2D 00 8B 47 79 3D 1C A1 90 AE B6 8F 83 B2 1B 31 -..Gy=.. .......1 >+[23A0] EE E4 F2 C5 C1 4A E2 4A 2F 28 F0 AA 19 43 6A 14 .....J.J /(...Cj. >+[23B0] B1 42 61 90 34 2E EE 3D 16 9F 5D 9F 7A A2 01 7A .Ba.4..= ..].z..z >+[23C0] 4B 96 FA 4D C9 85 1A 75 27 B7 6B FD 4D 7D 9C 65 K..M...u '.k.M}.e >+[23D0] 97 DB 05 CC 76 68 EA 05 5D 5D BB BD 51 4B 5B F2 ....vh.. ]]..QK[. >+[23E0] 48 59 BD 1E AD 56 D4 69 A5 75 CD ED EC B1 3E AB HY...V.i .u....>. >+[23F0] FA B7 F8 8D 4F BE 95 63 38 1C 4C 70 26 C4 3A 21 ....O..c 8.Lp&.:! >+[2400] 80 61 05 3A D4 E2 28 2C 85 01 5A DA FC 10 60 F3 .a.:..(, ..Z...`. >+[2410] 74 0C FD DB 2F 5B 25 4B 14 E4 7D 8A DB 85 12 D2 t.../[%K ..}..... >+[2420] D7 69 CD B5 B1 93 CE E5 E6 4D 57 D3 C2 D3 2E A0 .i...... .MW..... >+[2430] 08 37 09 CD 19 99 09 FA 33 68 4A E0 92 46 21 0C .7...... 3hJ..F!. >+[2440] 99 9F DA 05 15 20 8B 3D 7C 7B CA D6 81 AC AA 83 ..... .= |{...... >+[2450] 48 C8 24 4C C8 FC A5 14 2C BC 49 1A 1C 49 61 1D H.$L.... ,.I..Ia. >+[2460] 24 86 42 B1 37 6A C8 3A AC 18 CC C0 50 84 12 48 $.B.7j.: ....P..H >+[2470] 8B 29 0A 49 26 A4 E2 B9 E5 96 E7 37 C3 DE 4C 23 .).I&... ...7..L# >+[2480] D2 D4 62 14 8F 1E 72 39 CF 03 BC A3 00 C7 63 51 ..b...r9 ......cQ >+[2490] A9 6B E4 3E B2 65 A1 A2 BB EC 06 41 85 50 22 02 .k.>.e.. ...A.P". >+[24A0] 46 2F 72 2B 32 1A A4 2D 85 94 02 47 69 8D AD 6D F/r+2..- ...Gi..m >+[24B0] 66 AB D4 E4 29 C8 C7 DA F4 18 31 2A DF 50 6A 05 f...)... ..1*.Pj. >+[24C0] D6 47 26 C4 F9 87 0F 35 24 6E 72 D6 23 7D 3A 94 .G&....5 $nr.#}:. >+[24D0] 14 8D E8 57 AA BA D7 CF A9 2D E7 4C 10 7C D8 0D ...W.... .-.L.|.. >+[24E0] 51 30 1F E1 FB E5 E2 6C EE AA 65 2F D8 22 05 67 Q0.....l ..e/.".g >+[24F0] 87 4D 4D D2 11 3D B4 1E AA 20 3F 76 E3 94 93 6D .MM..=.. . ?v...m >+[2500] AC 10 05 AF 09 BD 67 86 C5 83 93 D6 1C D3 81 D9 ......g. ........ >+[2510] B1 3B E1 76 00 00 00 00 00 00 00 01 00 00 00 01 .;.v.... ........ >+[2520] 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E ....KTES T.SAMBA. >+[2530] 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D 61 EXAMPLE. COM....a >+[2540] 64 6D 69 6E 69 73 74 72 61 74 6F 72 00 00 00 01 dministr ator.... >+[2550] 00 00 00 02 00 00 00 17 4B 54 45 53 54 2E 53 41 ........ KTEST.SA >+[2560] 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 MBA.EXAM PLE.COM. >+[2570] 00 00 04 68 6F 73 74 00 00 00 0B 4C 4F 43 41 4C ...host. ...LOCAL >+[2580] 4B 54 45 53 54 36 00 17 00 00 00 10 55 6E 3E FC KTEST6.. ....Un>. >+[2590] E2 F4 40 51 19 E6 6E EB 23 4C 48 8E 4D 99 4F 6A ..@Q..n. #LH.M.Oj >+[25A0] 4D 99 90 FC 7D 44 0B 68 00 00 00 00 00 40 28 00 M...}D.h .....@(. >+[25B0] 00 00 00 00 00 00 00 00 00 00 00 03 FA 61 82 03 ........ .....a.. >+[25C0] F6 30 82 03 F2 A0 03 02 01 05 A1 19 1B 17 4B 54 .0...... ......KT >+[25D0] 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C EST.SAMB A.EXAMPL >+[25E0] 45 2E 43 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 15 E.COM..0 ........ >+[25F0] 30 13 1B 04 68 6F 73 74 1B 0B 4C 4F 43 41 4C 4B 0...host ..LOCALK >+[2600] 54 45 53 54 36 A3 82 03 AE 30 82 03 AA A0 03 02 TEST6... .0...... >+[2610] 01 17 A1 03 02 01 02 A2 82 03 9C 04 82 03 98 6E ........ .......n >+[2620] 87 B7 7B 3A 7E EF 4A 1B 29 C9 E3 C4 1F 42 4F 0E ..{:~.J. )....BO. >+[2630] C8 AC AC 4E A2 77 1D DA 93 37 F1 AF DA A3 75 2D ...N.w.. .7....u- >+[2640] 12 8B 40 34 23 0E 8E A9 90 58 46 42 42 39 31 D6 ..@4#... .XFBB91. >+[2650] 03 9E 5D 81 D9 E8 F6 08 2B D9 96 88 8A 2F F1 CC ..]..... +..../.. >+[2660] F2 EA 9E 9A 4B 31 B6 04 2D 3D 4C 7F 92 DE 3B 04 ....K1.. -=L...;. >+[2670] 19 EE 28 D0 83 81 C3 46 CD 74 23 4C 14 34 DE 62 ..(....F .t#L.4.b >+[2680] 0A AC E5 12 16 75 E9 A8 4B 32 78 CC 8D AE A2 E5 .....u.. K2x..... >+[2690] 6D E8 09 70 76 52 F5 E5 18 F7 E7 91 15 6A 69 AB m..pvR.. .....ji. >+[26A0] B8 62 DD 80 F5 28 6D DF ED 10 DA AC FB 92 27 CF .b...(m. ......'. >+[26B0] 98 B5 77 9D A5 96 E6 9A CC B9 C3 91 78 22 35 9C ..w..... ....x"5. >+[26C0] A1 13 A3 20 28 D1 16 E5 3E 4A 85 1E 12 0B CA 4D ... (... >J.....M >+[26D0] C6 C8 03 C8 28 2C D8 29 5D 9A 76 4A 92 13 43 56 ....(,.) ].vJ..CV >+[26E0] AF F7 C1 71 25 72 5C 38 75 1C 07 F1 5E 86 05 72 ...q%r\8 u...^..r >+[26F0] 6F 69 95 42 B6 F2 DA A9 91 06 9F B9 54 20 33 A5 oi.B.... ....T 3. >+[2700] 31 60 3B 54 DC 3A 95 34 96 26 07 52 6B 0E 1D 3B 1`;T.:.4 .&.Rk..; >+[2710] D9 F8 48 20 AC CD 05 3B 99 F8 EE DB 83 28 CD C7 ..H ...; .....(.. >+[2720] 2F 45 00 7E 2F 0A 65 7A D1 9E 95 4B EE C3 34 93 /E.~/.ez ...K..4. >+[2730] A8 C7 DF 03 8B 14 D0 FC CE 56 90 AC EE 93 C5 D3 ........ .V...... >+[2740] F7 12 24 69 0B 20 8D A2 65 87 55 26 2A F9 9A 88 ..$i. .. e.U&*... >+[2750] D7 0D 86 61 D6 92 B6 FE E5 D1 66 F9 1F 9D F4 04 ...a.... ..f..... >+[2760] 48 A6 39 BC 54 20 EA 10 21 E9 6D 30 46 1D C2 1C H.9.T .. !.m0F... >+[2770] A4 E8 B4 63 85 37 27 25 80 52 41 60 C7 A1 32 21 ...c.7'% .RA`..2! >+[2780] 43 90 02 E6 5F 5A E9 4E AF F9 B5 13 BD 42 BD A3 C..._Z.N .....B.. >+[2790] A5 4D 10 45 83 4D 92 18 1F C9 CF FB 84 29 89 23 .M.E.M.. .....).# >+[27A0] AC 71 4B 89 1B 52 E5 06 8C 3E 7C 88 CB D3 B3 CF .qK..R.. .>|..... >+[27B0] B9 7A 67 D6 24 F4 AC 00 A6 AD 91 30 9A 95 53 F1 .zg.$... ...0..S. >+[27C0] 48 06 A6 39 DB CF DC 9D C9 55 76 26 5E C1 DB 5D H..9.... .Uv&^..] >+[27D0] B3 5B 3E AE 1A A0 10 BA 82 21 83 44 02 E0 99 33 .[>..... .!.D...3 >+[27E0] 40 BA 29 9E 28 E5 73 4C 23 94 A2 4F BF 07 ED 4F @.).(.sL #..O...O >+[27F0] 7C 45 9B 30 C8 41 6B 0A 55 13 6E F5 AD 7A 0C B2 |E.0.Ak. U.n..z.. >+[2800] EA FF D0 06 13 4D F3 24 82 7F F6 51 2F 4A 4F 0D .....M.$ ...Q/JO. >+[2810] 37 F8 14 6B E9 E4 82 BB 3A 75 63 63 12 E8 78 6F 7..k.... :ucc..xo >+[2820] 6F FC 6C D3 4B A6 F1 CC 2A F1 7D EB 82 26 2F D0 o.l.K... *.}..&/. >+[2830] A1 8B 3E 9A 71 D7 91 D3 08 E6 FD 62 1B 84 13 2D ..>.q... ...b...- >+[2840] 8E A0 A0 C3 85 78 2F 0D F8 E7 10 FC CB 05 A7 B9 .....x/. ........ >+[2850] 9A 33 90 B5 9B 26 E3 23 98 B0 91 4B EB 32 37 D6 .3...&.# ...K.27. >+[2860] F4 ED 61 08 D8 75 CC 03 83 2C 3C CF 21 63 9C F6 ..a..u.. .,<.!c.. >+[2870] AF 5B 4F 12 07 74 17 CD 98 BB E7 5E C7 17 2D C4 .[O..t.. ...^..-. >+[2880] 87 A4 74 6D 5E CE DB A3 01 B9 AD 20 73 38 78 22 ..tm^... ... s8x" >+[2890] 3D 45 F5 51 77 C6 47 63 45 61 81 D9 FF 31 90 C4 =E.Qw.Gc Ea...1.. >+[28A0] 6F 5A F8 FE 6A 56 5B D4 EE EC 49 C7 A7 51 AE 5C oZ..jV[. ..I..Q.\ >+[28B0] 85 53 70 3D 1A 49 83 59 CF 65 58 B3 48 7E 04 9E .Sp=.I.Y .eX.H~.. >+[28C0] C7 64 8A 05 73 E3 DC 1A 65 5D 4F 41 01 56 73 90 .d..s... e]OA.Vs. >+[28D0] 61 F3 84 1F FF CF 46 B2 06 46 56 97 93 B9 DB 32 a.....F. .FV....2 >+[28E0] 2A 64 8A 48 02 05 84 E9 FA 76 8B 94 96 89 A0 73 *d.H.... .v.....s >+[28F0] 20 75 4D 52 1D 23 13 D1 83 D7 5D 59 23 6A 87 C1 uMR.#.. ..]Y#j.. >+[2900] 09 3E 01 3A 28 65 42 8C 35 F1 91 EA 6A 1F 83 0D .>.:(eB. 5...j... >+[2910] 8F 57 69 81 D4 A2 D2 EA 0C BF AF 95 A3 F4 90 15 .Wi..... ........ >+[2920] 61 34 F2 6C 8B D0 DA B5 1E 43 AC CE C7 8A 1B 2B a4.l.... .C.....+ >+[2930] 29 2B 89 1C C5 53 C8 04 F7 1E 46 72 F3 A8 CE F7 )+...S.. ..Fr.... >+[2940] 59 76 55 E7 53 1C A2 9F D8 23 F7 EA 71 B0 74 83 YvU.S... .#..q.t. >+[2950] 71 95 3E DC A6 FA 2D A4 42 13 93 8B 2B FA A2 70 q.>...-. B...+..p >+[2960] 25 21 2D F6 E1 26 56 DF 58 79 25 16 E8 C9 03 EC %!-..&V. Xy%..... >+[2970] 72 5F 35 CF 59 6B E1 AD 85 85 7B AB 78 F2 0D AC r_5.Yk.. ..{.x... >+[2980] AB 89 F2 DA 85 E7 DE 09 77 99 EC 7C F3 97 1F 71 ........ w..|...q >+[2990] 3C DB 09 44 7A 3C 69 E5 03 B0 6D 4D 3B 6B 4C D5 <..Dz<i. ..mM;kL. >+[29A0] AB 52 2F 6F 81 2B 51 5B D2 66 44 1E B7 66 5D 7F .R/o.+Q[ .fD..f]. >+[29B0] 09 6A 92 27 27 62 08 00 00 00 00 .j.''b.. ... >+push returned Success >+pull returned Success >+ CCACHE: struct CCACHE >+ pvno : 0x05 (5) >+ version : 0x04 (4) >+ optional_header : union OPTIONAL_HEADER(case 0x4) >+ v4header: struct V4HEADER >+ v4tags: struct V4TAGS >+ tag: struct V4TAG >+ tag : 0x0001 (1) >+ field : union FIELD(case 0x1) >+ deltatime_tag: struct DELTATIME_TAG >+ kdc_sec_offset : 0 >+ kdc_usec_offset : 0 >+ further_tags : DATA_BLOB length=0 >+ principal: struct PRINCIPAL >+ name_type : 0x00000001 (1) >+ component_count : 0x00000001 (1) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(1) >+ components : 'administrator' >+ cred: struct CREDENTIAL >+ client: struct PRINCIPAL >+ name_type : 0x00000001 (1) >+ component_count : 0x00000001 (1) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(1) >+ components : 'administrator' >+ server: struct PRINCIPAL >+ name_type : 0x00000000 (0) >+ component_count : 0x00000002 (2) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(2) >+ components : 'krbtgt' >+ components : 'KTEST.SAMBA.EXAMPLE.COM' >+ keyblock: struct KEYBLOCK >+ enctype : 0x0017 (23) >+ data : DATA_BLOB length=16 >+[0000] 8B 94 0B 31 51 5B F7 A7 15 E9 EE D7 D7 0C 8C 90 ...1Q[.. ........ >+ authtime : 0x4d994f6a (1301892970) >+ starttime : 0x4d994f6a (1301892970) >+ endtime : 0x7d440b68 (2101611368) >+ renew_till : 0x7d440b68 (2101611368) >+ is_skey : 0x00 (0) >+ ticket_flags : 0x40e00000 (1088421888) >+ addresses: struct ADDRESSES >+ count : 0x00000000 (0) >+ data: ARRAY(0) >+ authdata: struct AUTHDATA >+ count : 0x00000000 (0) >+ data: ARRAY(0) >+ ticket : DATA_BLOB length=1032 >+[0000] 61 82 04 04 30 82 04 00 A0 03 02 01 05 A1 19 1B a...0... ........ >+[0010] 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 .KTEST.S AMBA.EXA >+[0020] 4D 50 4C 45 2E 43 4F 4D A2 2C 30 2A A0 03 02 01 MPLE.COM .,0*.... >+[0030] 00 A1 23 30 21 1B 06 6B 72 62 74 67 74 1B 17 4B ..#0!..k rbtgt..K >+[0040] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[0050] 4C 45 2E 43 4F 4D A3 82 03 AE 30 82 03 AA A0 03 LE.COM.. ..0..... >+[0060] 02 01 17 A1 03 02 01 01 A2 82 03 9C 04 82 03 98 ........ ........ >+[0070] 80 66 8F CF AB 24 9D C8 76 E4 28 F5 25 6B 73 B2 .f...$.. v.(.%ks. >+[0080] 4B 94 ED 09 10 29 05 C4 C0 B8 B9 33 FA C4 46 AB K....).. ...3..F. >+[0090] F4 B5 9E 5B 07 54 D6 58 1D B8 CA 04 41 A6 33 A6 ...[.T.X ....A.3. >+[00A0] 67 9D EB 83 70 65 A9 2D 65 A5 19 8C 55 2A 0F FC g...pe.- e...U*.. >+[00B0] 1B BB 7A BD 86 C0 32 06 F2 2F 0A A5 93 E7 D1 1E ..z...2. ./...... >+[00C0] 16 C4 27 DD 1F A7 61 03 FF 05 81 EF 49 B7 25 A3 ..'...a. ....I.%. >+[00D0] 6E EA E6 E8 15 E3 10 AF A3 F1 21 B3 D9 C0 67 2F n....... ..!...g/ >+[00E0] 0C 0C B7 42 D6 9A 34 8E D4 5E 55 C2 FE 62 03 37 ...B..4. .^U..b.7 >+[00F0] A5 58 9B 43 E7 26 E3 71 B2 E5 F1 91 B4 23 8F AC .X.C.&.q .....#.. >+[0100] 7A 31 3C 4E B4 94 E4 81 36 98 71 3B 98 7B B7 AB z1<N.... 6.q;.{.. >+[0110] D5 AA D3 34 2A 3B C8 D7 61 EE 60 F9 68 9C A0 56 ...4*;.. a.`.h..V >+[0120] 51 E7 85 81 DE EF B9 9F 8B 4A 07 E1 05 93 08 5A Q....... .J.....Z >+[0130] AE B3 92 A5 17 40 B1 1C 42 A9 E4 AD 3C B4 4E D3 .....@.. B...<.N. >+[0140] BE 68 C4 0C 81 C0 AB 2D 3E 81 09 BD 16 82 EB C5 .h.....- >....... >+[0150] 1A 69 EE 8C 4E A4 D8 55 A5 0B 23 0F D0 89 48 C4 .i..N..U ..#...H. >+[0160] 51 FE 32 FD CC F6 71 E1 95 2D CC 1D 0A 0C 8A A2 Q.2...q. .-...... >+[0170] 69 58 3B 65 88 53 EC D0 2E E1 C6 CC 6B BC 09 E5 iX;e.S.. ....k... >+[0180] B9 15 27 8B E4 B2 24 18 61 42 BB 8B 09 1B 8A 7B ..'...$. aB.....{ >+[0190] 13 D8 51 E1 0B 79 12 48 DE A9 54 04 00 6D DD E6 ..Q..y.H ..T..m.. >+[01A0] 5E 03 91 FF C7 6D 0B 7C 91 44 E1 0F C0 7E 32 34 ^....m.| .D...~24 >+[01B0] 82 86 94 F7 CD 53 EC 52 38 18 AA ED FF FC 5C 01 .....S.R 8.....\. >+[01C0] D2 EE 99 45 8E 5B E6 B3 46 B0 F6 3B 22 29 EC 11 ...E.[.. F..;").. >+[01D0] 30 6A F6 A1 1F 9E AE 71 E3 A6 E7 3F F3 7D 2B 75 0j.....q ...?.}+u >+[01E0] 70 4D 63 47 5C 18 2C 8B B1 1A 69 B6 C5 46 01 17 pMcG\.,. ..i..F.. >+[01F0] 8E 64 3D 47 88 20 1C AA D7 60 32 28 11 60 EA 28 .d=G. .. .`2(.`.( >+[0200] 66 99 4C B1 2A 28 96 BF 18 2A 3E F4 D6 84 E5 A0 f.L.*(.. .*>..... >+[0210] F4 4E E7 F9 54 95 22 96 2A 87 01 CC 3E A7 FF 42 .N..T.". *...>..B >+[0220] 6A A4 4A 3A B9 24 10 65 99 53 58 2A 4E 72 E7 1F j.J:.$.e .SX*Nr.. >+[0230] 82 BC BD 3C 6C 9D 33 3A CE C6 6E 72 A2 81 B3 84 ...<l.3: ..nr.... >+[0240] 82 DF 3C 1F 76 E5 B8 08 AD 0A 6C 7D 7B D5 0C 46 ..<.v... ..l}{..F >+[0250] 69 A4 F4 E9 9E 3D D7 2D E1 43 D1 7A 52 16 75 56 i....=.- .C.zR.uV >+[0260] 54 83 D5 2A 2F A7 D2 CB 48 FE FF DB AE 46 F2 5B T..*/... H....F.[ >+[0270] F4 52 BE C8 5E B1 04 95 52 35 3E 92 E0 02 F7 85 .R..^... R5>..... >+[0280] AB F0 D0 93 08 42 E5 37 19 24 4E C1 AF FC 92 A9 .....B.7 .$N..... >+[0290] B1 27 B1 9A 2A 62 34 F1 DC C0 6B 83 AE C3 74 E8 .'..*b4. ..k...t. >+[02A0] A3 05 DD 82 DD A3 D7 90 A8 E3 9C EB 64 16 23 06 ........ ....d.#. >+[02B0] 5D FB E4 35 7C 22 29 78 E3 3B 75 92 91 0C 9D A1 ]..5|")x .;u..... >+[02C0] 87 7C 2E 82 AE 49 9D 4A 50 A9 C2 D5 85 B0 16 5D .|...I.J P......] >+[02D0] A2 CD B0 DD 29 3F 6F 66 C9 C1 9F 5C F0 B6 FC D2 ....)?of ...\.... >+[02E0] 52 BE 7B F0 1F 26 AF 8A FC C3 A6 24 8C C0 10 06 R.{..&.. ...$.... >+[02F0] 73 1E 17 9E 6E 6F 32 44 6A DF 82 5D D0 6B 74 CE s...no2D j..].kt. >+[0300] 58 0B 4C 7B EB A1 13 44 B1 3E D8 F8 BA F4 4E 55 X.L{...D .>....NU >+[0310] 71 3D C1 09 D9 E7 97 9A 14 5C 54 7E 57 81 5F 6B q=...... .\T~W._k >+[0320] 30 BE 9A E1 98 29 47 D4 C0 8F 63 0A F8 27 1F CE 0....)G. ..c..'.. >+[0330] ED D9 BB 7B 12 24 D0 34 2A 7C F0 F7 77 F4 F1 1D ...{.$.4 *|..w... >+[0340] 4C 5D 75 2D 6B 0D 80 35 82 CC D8 7A 6B FA A0 55 L]u-k..5 ...zk..U >+[0350] 34 CD 87 15 61 38 78 D4 69 0F AA 72 D6 AC FA 99 4...a8x. i..r.... >+[0360] BC 70 39 27 A7 25 2E 1B 6F 36 01 FD E9 B4 9A 79 .p9'.%.. o6.....y >+[0370] 6C 19 DD A6 8C 78 B0 40 92 60 58 F0 28 AD 08 78 l....x.@ .`X.(..x >+[0380] 4A 29 06 2C 82 2B 1A E3 91 0B 5F EE D6 B8 66 47 J).,.+.. .._...fG >+[0390] 31 9B A3 DF 9F 79 D7 BB 0E 2C FA 0E C9 66 84 8D 1....y.. .,...f.. >+[03A0] FF BA BB 21 27 9E AD 86 84 55 8D 4C 4C 47 D9 5F ...!'... .U.LLG._ >+[03B0] B2 7D 26 CA B7 49 3C 9D 1B 67 71 11 3A 8A EB EA .}&..I<. .gq.:... >+[03C0] 0F 15 EB F0 1E 46 F7 A4 34 04 D7 E3 50 67 47 D3 .....F.. 4...PgG. >+[03D0] 66 21 17 77 51 A7 1F 1D 84 3B 7C B1 5D 4E B8 D4 f!.wQ... .;|.]N.. >+[03E0] F9 C5 75 06 AA 19 45 1C E9 06 9E AD 23 26 6B 10 ..u...E. ....#&k. >+[03F0] 53 A0 36 D3 58 9F 5E 8C CB A5 F6 BC C9 30 3C BC S.6.X.^. .....0<. >+[0400] AD FF 7C 92 F0 C6 9A 02 ..|..... >+ second_ticket : DATA_BLOB length=0 >+ further_creds : DATA_BLOB length=10683 >+[0000] 00 00 00 01 00 00 00 01 00 00 00 17 4B 54 45 53 ........ ....KTES >+[0010] 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E T.SAMBA. EXAMPLE. >+[0020] 43 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 73 74 72 COM....a dministr >+[0030] 61 74 6F 72 00 00 00 01 00 00 00 02 00 00 00 17 ator.... ........ >+[0040] 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D KTEST.SA MBA.EXAM >+[0050] 50 4C 45 2E 43 4F 4D 00 00 00 04 63 69 66 73 00 PLE.COM. ...cifs. >+[0060] 00 00 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 00 17 ...local ktest6.. >+[0070] 00 00 00 10 00 6E A1 B2 31 6D 48 C7 90 72 3A 0C .....n.. 1mH..r:. >+[0080] 4B 8B 83 8C 4D 99 4F 6A 4D 99 50 85 7D 44 0B 68 K...M.Oj M.P.}D.h >+[0090] 00 00 00 00 00 40 28 00 00 00 00 00 00 00 00 00 .....@(. ........ >+[00A0] 00 00 00 03 FA 61 82 03 F6 30 82 03 F2 A0 03 02 .....a.. .0...... >+[00B0] 01 05 A1 19 1B 17 4B 54 45 53 54 2E 53 41 4D 42 ......KT EST.SAMB >+[00C0] 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D A2 1E 30 A.EXAMPL E.COM..0 >+[00D0] 1C A0 03 02 01 01 A1 15 30 13 1B 04 63 69 66 73 ........ 0...cifs >+[00E0] 1B 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 A3 82 03 ..localk test6... >+[00F0] AE 30 82 03 AA A0 03 02 01 17 A1 03 02 01 02 A2 .0...... ........ >+[0100] 82 03 9C 04 82 03 98 C6 BB 64 A8 31 00 FC 5E 51 ........ .d.1..^Q >+[0110] 3C 87 F8 34 47 3B D0 6F 6F FD 9E A6 91 12 74 2D <..4G;.o o.....t- >+[0120] 44 BB AA 91 A0 2D 46 3E 9E FB FB C4 FB F1 15 FD D....-F> ........ >+[0130] BB DA EE 06 A9 20 6A 38 DC 46 06 27 D9 A2 9D 2D ..... j8 .F.'...- >+[0140] 1F FD 0D 7D 8A BB 0A 7C E8 47 17 BC 7B 70 E4 51 ...}...| .G..{p.Q >+[0150] 6A BA 51 68 62 28 4A 1E 51 D1 0D CD 02 55 75 44 j.Qhb(J. Q....UuD >+[0160] 8A B9 C2 84 F4 17 34 92 9B 31 85 9E 43 C1 0C 3A ......4. .1..C..: >+[0170] B2 69 7F 20 1A 18 1F 65 4F C0 20 C9 B5 AF E1 61 .i. ...e O. ....a >+[0180] 8C 90 10 63 26 A6 5D 05 3C CD 29 BB 7B 74 D5 8F ...c&.]. <.).{t.. >+[0190] 2C 7F 4B E8 84 24 57 37 8A C6 F7 91 FD 22 9A A5 ,.K..$W7 .....".. >+[01A0] 0D E9 4A 78 93 36 FC A8 8C 8A 27 8A C6 28 4B 7B ..Jx.6.. ..'..(K{ >+[01B0] DA 11 42 BC 09 10 81 82 14 0F 9C B8 48 26 91 78 ..B..... ....H&.x >+[01C0] A8 DD 97 6C 24 A1 D2 E8 85 19 B3 D3 85 4D 38 C7 ...l$... .....M8. >+[01D0] 7D 49 55 8E 85 46 E1 EE 7B BA 11 62 63 53 C5 16 }IU..F.. {..bcS.. >+[01E0] 4A 0C 1C 99 7C 0E FB 45 1D B4 98 58 67 7E 40 65 J...|..E ...Xg~@e >+[01F0] 4B 48 E2 89 9C 8B C2 B8 39 D1 04 C0 A8 56 E8 A1 KH...... 9....V.. >+[0200] 04 7A 7A C9 60 18 A0 29 E2 DC 82 4C 8F 18 CE 2F .zz.`..) ...L.../ >+[0210] 14 F0 18 5B 6C FF 85 45 88 73 CB A4 55 08 FC BF ...[l..E .s..U... >+[0220] C7 9F 51 0A DB 2C C1 E3 3C DD F6 F0 A3 2D F1 3B ..Q..,.. <....-.; >+[0230] A0 12 1D FC 2A 67 F5 1A 7F E5 7C 6C FB 8A 18 BD ....*g.. ..|l.... >+[0240] D1 5D E5 5E 68 30 AA 58 9E 10 13 E0 26 7E 7D C4 .].^h0.X ....&~}. >+[0250] E1 A5 B6 86 0F 1C 0F 13 A4 5E 5E 6A ED 42 79 31 ........ .^^j.By1 >+[0260] BB B3 5F 3A 3F DD CB 63 82 FB 06 AE 12 36 C9 1E .._:?..c .....6.. >+[0270] 06 7D 41 82 2E D2 FA 26 EC 17 50 5E D0 DE 26 85 .}A....& ..P^..&. >+[0280] 30 71 BC 45 3B DA 2E 08 8D B2 2A 3C E0 79 8F 77 0q.E;... ..*<.y.w >+[0290] 4C 01 69 7A 09 C7 88 E1 D1 DC FF 78 DB 25 7B B1 L.iz.... ...x.%{. >+[02A0] 3C BB 22 27 80 0D 75 96 18 B6 40 95 6D C8 AB 04 <."'..u. ..@.m... >+[02B0] 05 41 A1 C4 25 71 C4 53 3A A6 9C B2 4D E6 15 2C .A..%q.S :...M.., >+[02C0] B2 47 6C DA A8 7D CC A3 89 8B C9 1E 21 F5 E9 B2 .Gl..}.. ....!... >+[02D0] 42 95 68 28 AF C6 37 22 BA 30 8D 53 FA 08 0D CE B.h(..7" .0.S.... >+[02E0] CA 81 61 0D 84 A5 2D 75 BD 41 85 4C 88 56 72 C6 ..a...-u .A.L.Vr. >+[02F0] B6 10 F8 34 CD B2 F4 5C 94 FA 80 90 82 A0 BD 68 ...4...\ .......h >+[0300] EC 08 32 C3 B6 51 1E 3F 67 CB 7B EB 70 83 84 D4 ..2..Q.? g.{.p... >+[0310] CB 52 55 36 61 1E 60 90 5B 6F FE 9A 62 05 CF 26 .RU6a.`. [o..b..& >+[0320] 8E 65 E2 60 4B ED 63 B4 C4 E6 44 B4 2F B0 B8 07 .e.`K.c. ..D./... >+[0330] FE BE 0D 50 E4 56 A4 2E 0D 25 76 0B 0F 44 09 20 ...P.V.. .%v..D. >+[0340] 80 E5 C4 94 63 E0 54 46 1D AB 5E 0B 09 93 B1 30 ....c.TF ..^....0 >+[0350] 31 7B 04 DC 23 43 3B DB 7D 39 67 FE 9A 1F C1 08 1{..#C;. }9g..... >+[0360] AF 34 24 F6 74 E4 14 DA 34 8F 61 57 6A 7F 1D 4A .4$.t... 4.aWj..J >+[0370] 88 0A 90 78 93 F1 86 54 DB 22 86 D6 69 0F DF 44 ...x...T ."..i..D >+[0380] 7C D3 6B 9D 41 63 50 98 3A 97 B9 7B 4C 53 E3 85 |.k.AcP. :..{LS.. >+[0390] 73 9A C9 08 A0 75 12 50 02 87 B0 CF CC 84 84 D9 s....u.P ........ >+[03A0] BC FC 94 79 AF 6A A6 08 FF 19 7E E9 22 9B EC 5C ...y.j.. ..~."..\ >+[03B0] C1 6B 1D A4 B4 55 32 5E 23 C3 C0 D4 8B 80 E6 67 .k...U2^ #......g >+[03C0] B1 59 EB 9D 5D 9B AD C6 0E 7D E2 FE B1 24 8A B1 .Y..]... .}...$.. >+[03D0] 37 1E 60 7F 83 35 48 32 F7 03 E8 12 E6 21 7C 3D 7.`..5H2 .....!|= >+[03E0] 21 7F 6B 14 31 9C 1A A3 4C 2B 1C 5E EC 34 C1 2D !.k.1... L+.^.4.- >+[03F0] DA 19 6C E6 6D 8D 60 D7 55 9E E6 D0 B5 07 06 72 ..l.m.`. U......r >+[0400] C0 E9 4E 91 94 6B 3E 0B F1 0A 75 4D E8 CB 53 6B ..N..k>. ..uM..Sk >+[0410] 34 A4 2F 96 A5 39 1A 18 6E 27 00 6D 41 B7 D8 F5 4./..9.. n'.mA... >+[0420] 9A E5 01 FC 0B A8 97 56 EE 98 04 1D 98 84 5E 82 .......V ......^. >+[0430] C8 E8 EC 17 D5 FA 96 00 3B E1 98 1C D8 FA 66 A0 ........ ;.....f. >+[0440] DC 32 60 F6 03 46 08 3C E5 16 6F F2 8B 4D 72 9F .2`..F.< ..o..Mr. >+[0450] 0F E0 A9 71 6E 7C AE AA FB A3 4D F1 A1 B6 1B 9F ...qn|.. ..M..... >+[0460] 62 71 E1 2C 82 9B AE E3 07 9B 79 90 F1 C2 69 E5 bq.,.... ..y...i. >+[0470] 7E CB 57 E6 C9 1C 4E A8 C7 12 EA 4F 4C 52 17 03 ~.W...N. ...OLR.. >+[0480] AB D4 FD 34 60 F4 7C BE 9E 36 30 37 88 95 61 2E ...4`.|. .607..a. >+[0490] CF 70 AF 22 70 DB E8 AA 6E 3D 30 F7 4D 84 D5 00 .p."p... n=0.M... >+[04A0] 00 00 00 00 00 00 01 00 00 00 01 00 00 00 17 4B ........ .......K >+[04B0] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[04C0] 4C 45 2E 43 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 LE.COM.. ..admini >+[04D0] 73 74 72 61 74 6F 72 00 00 00 01 00 00 00 02 00 strator. ........ >+[04E0] 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 ...KTEST .SAMBA.E >+[04F0] 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 04 63 69 XAMPLE.C OM....ci >+[0500] 66 73 00 00 00 0B 6C 6F 63 61 6C 6B 74 65 73 74 fs....lo calktest >+[0510] 36 00 17 00 00 00 10 00 6E A1 B2 31 6D 48 C7 90 6....... n..1mH.. >+[0520] 72 3A 0C 4B 8B 83 8C 4D 99 4F 6A 4D 99 50 85 7D r:.K...M .OjM.P.} >+[0530] 44 0B 68 00 00 00 00 00 40 28 00 00 00 00 00 00 D.h..... @(...... >+[0540] 00 00 00 00 00 00 03 FA 61 82 03 F6 30 82 03 F2 ........ a...0... >+[0550] A0 03 02 01 05 A1 19 1B 17 4B 54 45 53 54 2E 53 ........ .KTEST.S >+[0560] 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D AMBA.EXA MPLE.COM >+[0570] A2 1E 30 1C A0 03 02 01 01 A1 15 30 13 1B 04 63 ..0..... ...0...c >+[0580] 69 66 73 1B 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 ifs..loc alktest6 >+[0590] A3 82 03 AE 30 82 03 AA A0 03 02 01 17 A1 03 02 ....0... ........ >+[05A0] 01 02 A2 82 03 9C 04 82 03 98 C6 BB 64 A8 31 00 ........ ....d.1. >+[05B0] FC 5E 51 3C 87 F8 34 47 3B D0 6F 6F FD 9E A6 91 .^Q<..4G ;.oo.... >+[05C0] 12 74 2D 44 BB AA 91 A0 2D 46 3E 9E FB FB C4 FB .t-D.... -F>..... >+[05D0] F1 15 FD BB DA EE 06 A9 20 6A 38 DC 46 06 27 D9 ........ j8.F.'. >+[05E0] A2 9D 2D 1F FD 0D 7D 8A BB 0A 7C E8 47 17 BC 7B ..-...}. ..|.G..{ >+[05F0] 70 E4 51 6A BA 51 68 62 28 4A 1E 51 D1 0D CD 02 p.Qj.Qhb (J.Q.... >+[0600] 55 75 44 8A B9 C2 84 F4 17 34 92 9B 31 85 9E 43 UuD..... .4..1..C >+[0610] C1 0C 3A B2 69 7F 20 1A 18 1F 65 4F C0 20 C9 B5 ..:.i. . ..eO. .. >+[0620] AF E1 61 8C 90 10 63 26 A6 5D 05 3C CD 29 BB 7B ..a...c& .].<.).{ >+[0630] 74 D5 8F 2C 7F 4B E8 84 24 57 37 8A C6 F7 91 FD t..,.K.. $W7..... >+[0640] 22 9A A5 0D E9 4A 78 93 36 FC A8 8C 8A 27 8A C6 "....Jx. 6....'.. >+[0650] 28 4B 7B DA 11 42 BC 09 10 81 82 14 0F 9C B8 48 (K{..B.. .......H >+[0660] 26 91 78 A8 DD 97 6C 24 A1 D2 E8 85 19 B3 D3 85 &.x...l$ ........ >+[0670] 4D 38 C7 7D 49 55 8E 85 46 E1 EE 7B BA 11 62 63 M8.}IU.. F..{..bc >+[0680] 53 C5 16 4A 0C 1C 99 7C 0E FB 45 1D B4 98 58 67 S..J...| ..E...Xg >+[0690] 7E 40 65 4B 48 E2 89 9C 8B C2 B8 39 D1 04 C0 A8 ~@eKH... ...9.... >+[06A0] 56 E8 A1 04 7A 7A C9 60 18 A0 29 E2 DC 82 4C 8F V...zz.` ..)...L. >+[06B0] 18 CE 2F 14 F0 18 5B 6C FF 85 45 88 73 CB A4 55 ../...[l ..E.s..U >+[06C0] 08 FC BF C7 9F 51 0A DB 2C C1 E3 3C DD F6 F0 A3 .....Q.. ,..<.... >+[06D0] 2D F1 3B A0 12 1D FC 2A 67 F5 1A 7F E5 7C 6C FB -.;....* g....|l. >+[06E0] 8A 18 BD D1 5D E5 5E 68 30 AA 58 9E 10 13 E0 26 ....].^h 0.X....& >+[06F0] 7E 7D C4 E1 A5 B6 86 0F 1C 0F 13 A4 5E 5E 6A ED ~}...... ....^^j. >+[0700] 42 79 31 BB B3 5F 3A 3F DD CB 63 82 FB 06 AE 12 By1.._:? ..c..... >+[0710] 36 C9 1E 06 7D 41 82 2E D2 FA 26 EC 17 50 5E D0 6...}A.. ..&..P^. >+[0720] DE 26 85 30 71 BC 45 3B DA 2E 08 8D B2 2A 3C E0 .&.0q.E; .....*<. >+[0730] 79 8F 77 4C 01 69 7A 09 C7 88 E1 D1 DC FF 78 DB y.wL.iz. ......x. >+[0740] 25 7B B1 3C BB 22 27 80 0D 75 96 18 B6 40 95 6D %{.<."'. .u...@.m >+[0750] C8 AB 04 05 41 A1 C4 25 71 C4 53 3A A6 9C B2 4D ....A..% q.S:...M >+[0760] E6 15 2C B2 47 6C DA A8 7D CC A3 89 8B C9 1E 21 ..,.Gl.. }......! >+[0770] F5 E9 B2 42 95 68 28 AF C6 37 22 BA 30 8D 53 FA ...B.h(. .7".0.S. >+[0780] 08 0D CE CA 81 61 0D 84 A5 2D 75 BD 41 85 4C 88 .....a.. .-u.A.L. >+[0790] 56 72 C6 B6 10 F8 34 CD B2 F4 5C 94 FA 80 90 82 Vr....4. ..\..... >+[07A0] A0 BD 68 EC 08 32 C3 B6 51 1E 3F 67 CB 7B EB 70 ..h..2.. Q.?g.{.p >+[07B0] 83 84 D4 CB 52 55 36 61 1E 60 90 5B 6F FE 9A 62 ....RU6a .`.[o..b >+[07C0] 05 CF 26 8E 65 E2 60 4B ED 63 B4 C4 E6 44 B4 2F ..&.e.`K .c...D./ >+[07D0] B0 B8 07 FE BE 0D 50 E4 56 A4 2E 0D 25 76 0B 0F ......P. V...%v.. >+[07E0] 44 09 20 80 E5 C4 94 63 E0 54 46 1D AB 5E 0B 09 D. ....c .TF..^.. >+[07F0] 93 B1 30 31 7B 04 DC 23 43 3B DB 7D 39 67 FE 9A ..01{..# C;.}9g.. >+[0800] 1F C1 08 AF 34 24 F6 74 E4 14 DA 34 8F 61 57 6A ....4$.t ...4.aWj >+[0810] 7F 1D 4A 88 0A 90 78 93 F1 86 54 DB 22 86 D6 69 ..J...x. ..T."..i >+[0820] 0F DF 44 7C D3 6B 9D 41 63 50 98 3A 97 B9 7B 4C ..D|.k.A cP.:..{L >+[0830] 53 E3 85 73 9A C9 08 A0 75 12 50 02 87 B0 CF CC S..s.... u.P..... >+[0840] 84 84 D9 BC FC 94 79 AF 6A A6 08 FF 19 7E E9 22 ......y. j....~." >+[0850] 9B EC 5C C1 6B 1D A4 B4 55 32 5E 23 C3 C0 D4 8B ..\.k... U2^#.... >+[0860] 80 E6 67 B1 59 EB 9D 5D 9B AD C6 0E 7D E2 FE B1 ..g.Y..] ....}... >+[0870] 24 8A B1 37 1E 60 7F 83 35 48 32 F7 03 E8 12 E6 $..7.`.. 5H2..... >+[0880] 21 7C 3D 21 7F 6B 14 31 9C 1A A3 4C 2B 1C 5E EC !|=!.k.1 ...L+.^. >+[0890] 34 C1 2D DA 19 6C E6 6D 8D 60 D7 55 9E E6 D0 B5 4.-..l.m .`.U.... >+[08A0] 07 06 72 C0 E9 4E 91 94 6B 3E 0B F1 0A 75 4D E8 ..r..N.. k>...uM. >+[08B0] CB 53 6B 34 A4 2F 96 A5 39 1A 18 6E 27 00 6D 41 .Sk4./.. 9..n'.mA >+[08C0] B7 D8 F5 9A E5 01 FC 0B A8 97 56 EE 98 04 1D 98 ........ ..V..... >+[08D0] 84 5E 82 C8 E8 EC 17 D5 FA 96 00 3B E1 98 1C D8 .^...... ...;.... >+[08E0] FA 66 A0 DC 32 60 F6 03 46 08 3C E5 16 6F F2 8B .f..2`.. F.<..o.. >+[08F0] 4D 72 9F 0F E0 A9 71 6E 7C AE AA FB A3 4D F1 A1 Mr....qn |....M.. >+[0900] B6 1B 9F 62 71 E1 2C 82 9B AE E3 07 9B 79 90 F1 ...bq.,. .....y.. >+[0910] C2 69 E5 7E CB 57 E6 C9 1C 4E A8 C7 12 EA 4F 4C .i.~.W.. .N....OL >+[0920] 52 17 03 AB D4 FD 34 60 F4 7C BE 9E 36 30 37 88 R.....4` .|..607. >+[0930] 95 61 2E CF 70 AF 22 70 DB E8 AA 6E 3D 30 F7 4D .a..p."p ...n=0.M >+[0940] 84 D5 00 00 00 00 00 00 00 01 00 00 00 01 00 00 ........ ........ >+[0950] 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 ..KTEST. SAMBA.EX >+[0960] 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D 61 64 6D AMPLE.CO M....adm >+[0970] 69 6E 69 73 74 72 61 74 6F 72 00 00 00 01 00 00 inistrat or...... >+[0980] 00 02 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 ......KT EST.SAMB >+[0990] 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 A.EXAMPL E.COM... >+[09A0] 04 63 69 66 73 00 00 00 0B 6C 6F 63 61 6C 6B 74 .cifs... .localkt >+[09B0] 65 73 74 36 00 17 00 00 00 10 00 6E A1 B2 31 6D est6.... ...n..1m >+[09C0] 48 C7 90 72 3A 0C 4B 8B 83 8C 4D 99 4F 6A 4D 99 H..r:.K. ..M.OjM. >+[09D0] 50 85 7D 44 0B 68 00 00 00 00 00 40 28 00 00 00 P.}D.h.. ...@(... >+[09E0] 00 00 00 00 00 00 00 00 00 03 FA 61 82 03 F6 30 ........ ...a...0 >+[09F0] 82 03 F2 A0 03 02 01 05 A1 19 1B 17 4B 54 45 53 ........ ....KTES >+[0A00] 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E T.SAMBA. EXAMPLE. >+[0A10] 43 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 15 30 13 COM..0.. ......0. >+[0A20] 1B 04 63 69 66 73 1B 0B 6C 6F 63 61 6C 6B 74 65 ..cifs.. localkte >+[0A30] 73 74 36 A3 82 03 AE 30 82 03 AA A0 03 02 01 17 st6....0 ........ >+[0A40] A1 03 02 01 02 A2 82 03 9C 04 82 03 98 C6 BB 64 ........ .......d >+[0A50] A8 31 00 FC 5E 51 3C 87 F8 34 47 3B D0 6F 6F FD .1..^Q<. .4G;.oo. >+[0A60] 9E A6 91 12 74 2D 44 BB AA 91 A0 2D 46 3E 9E FB ....t-D. ...-F>.. >+[0A70] FB C4 FB F1 15 FD BB DA EE 06 A9 20 6A 38 DC 46 ........ ... j8.F >+[0A80] 06 27 D9 A2 9D 2D 1F FD 0D 7D 8A BB 0A 7C E8 47 .'...-.. .}...|.G >+[0A90] 17 BC 7B 70 E4 51 6A BA 51 68 62 28 4A 1E 51 D1 ..{p.Qj. Qhb(J.Q. >+[0AA0] 0D CD 02 55 75 44 8A B9 C2 84 F4 17 34 92 9B 31 ...UuD.. ....4..1 >+[0AB0] 85 9E 43 C1 0C 3A B2 69 7F 20 1A 18 1F 65 4F C0 ..C..:.i . ...eO. >+[0AC0] 20 C9 B5 AF E1 61 8C 90 10 63 26 A6 5D 05 3C CD ....a.. .c&.].<. >+[0AD0] 29 BB 7B 74 D5 8F 2C 7F 4B E8 84 24 57 37 8A C6 ).{t..,. K..$W7.. >+[0AE0] F7 91 FD 22 9A A5 0D E9 4A 78 93 36 FC A8 8C 8A ...".... Jx.6.... >+[0AF0] 27 8A C6 28 4B 7B DA 11 42 BC 09 10 81 82 14 0F '..(K{.. B....... >+[0B00] 9C B8 48 26 91 78 A8 DD 97 6C 24 A1 D2 E8 85 19 ..H&.x.. .l$..... >+[0B10] B3 D3 85 4D 38 C7 7D 49 55 8E 85 46 E1 EE 7B BA ...M8.}I U..F..{. >+[0B20] 11 62 63 53 C5 16 4A 0C 1C 99 7C 0E FB 45 1D B4 .bcS..J. ..|..E.. >+[0B30] 98 58 67 7E 40 65 4B 48 E2 89 9C 8B C2 B8 39 D1 .Xg~@eKH ......9. >+[0B40] 04 C0 A8 56 E8 A1 04 7A 7A C9 60 18 A0 29 E2 DC ...V...z z.`..).. >+[0B50] 82 4C 8F 18 CE 2F 14 F0 18 5B 6C FF 85 45 88 73 .L.../.. .[l..E.s >+[0B60] CB A4 55 08 FC BF C7 9F 51 0A DB 2C C1 E3 3C DD ..U..... Q..,..<. >+[0B70] F6 F0 A3 2D F1 3B A0 12 1D FC 2A 67 F5 1A 7F E5 ...-.;.. ..*g.... >+[0B80] 7C 6C FB 8A 18 BD D1 5D E5 5E 68 30 AA 58 9E 10 |l.....] .^h0.X.. >+[0B90] 13 E0 26 7E 7D C4 E1 A5 B6 86 0F 1C 0F 13 A4 5E ..&~}... .......^ >+[0BA0] 5E 6A ED 42 79 31 BB B3 5F 3A 3F DD CB 63 82 FB ^j.By1.. _:?..c.. >+[0BB0] 06 AE 12 36 C9 1E 06 7D 41 82 2E D2 FA 26 EC 17 ...6...} A....&.. >+[0BC0] 50 5E D0 DE 26 85 30 71 BC 45 3B DA 2E 08 8D B2 P^..&.0q .E;..... >+[0BD0] 2A 3C E0 79 8F 77 4C 01 69 7A 09 C7 88 E1 D1 DC *<.y.wL. iz...... >+[0BE0] FF 78 DB 25 7B B1 3C BB 22 27 80 0D 75 96 18 B6 .x.%{.<. "'..u... >+[0BF0] 40 95 6D C8 AB 04 05 41 A1 C4 25 71 C4 53 3A A6 @.m....A ..%q.S:. >+[0C00] 9C B2 4D E6 15 2C B2 47 6C DA A8 7D CC A3 89 8B ..M..,.G l..}.... >+[0C10] C9 1E 21 F5 E9 B2 42 95 68 28 AF C6 37 22 BA 30 ..!...B. h(..7".0 >+[0C20] 8D 53 FA 08 0D CE CA 81 61 0D 84 A5 2D 75 BD 41 .S...... a...-u.A >+[0C30] 85 4C 88 56 72 C6 B6 10 F8 34 CD B2 F4 5C 94 FA .L.Vr... .4...\.. >+[0C40] 80 90 82 A0 BD 68 EC 08 32 C3 B6 51 1E 3F 67 CB .....h.. 2..Q.?g. >+[0C50] 7B EB 70 83 84 D4 CB 52 55 36 61 1E 60 90 5B 6F {.p....R U6a.`.[o >+[0C60] FE 9A 62 05 CF 26 8E 65 E2 60 4B ED 63 B4 C4 E6 ..b..&.e .`K.c... >+[0C70] 44 B4 2F B0 B8 07 FE BE 0D 50 E4 56 A4 2E 0D 25 D./..... .P.V...% >+[0C80] 76 0B 0F 44 09 20 80 E5 C4 94 63 E0 54 46 1D AB v..D. .. ..c.TF.. >+[0C90] 5E 0B 09 93 B1 30 31 7B 04 DC 23 43 3B DB 7D 39 ^....01{ ..#C;.}9 >+[0CA0] 67 FE 9A 1F C1 08 AF 34 24 F6 74 E4 14 DA 34 8F g......4 $.t...4. >+[0CB0] 61 57 6A 7F 1D 4A 88 0A 90 78 93 F1 86 54 DB 22 aWj..J.. .x...T." >+[0CC0] 86 D6 69 0F DF 44 7C D3 6B 9D 41 63 50 98 3A 97 ..i..D|. k.AcP.:. >+[0CD0] B9 7B 4C 53 E3 85 73 9A C9 08 A0 75 12 50 02 87 .{LS..s. ...u.P.. >+[0CE0] B0 CF CC 84 84 D9 BC FC 94 79 AF 6A A6 08 FF 19 ........ .y.j.... >+[0CF0] 7E E9 22 9B EC 5C C1 6B 1D A4 B4 55 32 5E 23 C3 ~."..\.k ...U2^#. >+[0D00] C0 D4 8B 80 E6 67 B1 59 EB 9D 5D 9B AD C6 0E 7D .....g.Y ..]....} >+[0D10] E2 FE B1 24 8A B1 37 1E 60 7F 83 35 48 32 F7 03 ...$..7. `..5H2.. >+[0D20] E8 12 E6 21 7C 3D 21 7F 6B 14 31 9C 1A A3 4C 2B ...!|=!. k.1...L+ >+[0D30] 1C 5E EC 34 C1 2D DA 19 6C E6 6D 8D 60 D7 55 9E .^.4.-.. l.m.`.U. >+[0D40] E6 D0 B5 07 06 72 C0 E9 4E 91 94 6B 3E 0B F1 0A .....r.. N..k>... >+[0D50] 75 4D E8 CB 53 6B 34 A4 2F 96 A5 39 1A 18 6E 27 uM..Sk4. /..9..n' >+[0D60] 00 6D 41 B7 D8 F5 9A E5 01 FC 0B A8 97 56 EE 98 .mA..... .....V.. >+[0D70] 04 1D 98 84 5E 82 C8 E8 EC 17 D5 FA 96 00 3B E1 ....^... ......;. >+[0D80] 98 1C D8 FA 66 A0 DC 32 60 F6 03 46 08 3C E5 16 ....f..2 `..F.<.. >+[0D90] 6F F2 8B 4D 72 9F 0F E0 A9 71 6E 7C AE AA FB A3 o..Mr... .qn|.... >+[0DA0] 4D F1 A1 B6 1B 9F 62 71 E1 2C 82 9B AE E3 07 9B M.....bq .,...... >+[0DB0] 79 90 F1 C2 69 E5 7E CB 57 E6 C9 1C 4E A8 C7 12 y...i.~. W...N... >+[0DC0] EA 4F 4C 52 17 03 AB D4 FD 34 60 F4 7C BE 9E 36 .OLR.... .4`.|..6 >+[0DD0] 30 37 88 95 61 2E CF 70 AF 22 70 DB E8 AA 6E 3D 07..a..p ."p...n= >+[0DE0] 30 F7 4D 84 D5 00 00 00 00 00 00 00 01 00 00 00 0.M..... ........ >+[0DF0] 01 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 .....KTE ST.SAMBA >+[0E00] 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D .EXAMPLE .COM.... >+[0E10] 61 64 6D 69 6E 69 73 74 72 61 74 6F 72 00 00 00 administ rator... >+[0E20] 01 00 00 00 02 00 00 00 17 4B 54 45 53 54 2E 53 ........ .KTEST.S >+[0E30] 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D AMBA.EXA MPLE.COM >+[0E40] 00 00 00 04 63 69 66 73 00 00 00 0B 4C 4F 43 41 ....cifs ....LOCA >+[0E50] 4C 4B 54 45 53 54 36 00 17 00 00 00 10 1D C8 5E LKTEST6. .......^ >+[0E60] 46 48 82 F9 29 DB C6 A6 F1 72 6D 8D E9 4D 99 4F FH..)... .rm..M.O >+[0E70] 6A 4D 99 85 09 7D 44 0B 68 00 00 00 00 00 40 28 jM...}D. h.....@( >+[0E80] 00 00 00 00 00 00 00 00 00 00 00 00 03 FA 61 82 ........ ......a. >+[0E90] 03 F6 30 82 03 F2 A0 03 02 01 05 A1 19 1B 17 4B ..0..... .......K >+[0EA0] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[0EB0] 4C 45 2E 43 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 LE.COM.. 0....... >+[0EC0] 15 30 13 1B 04 63 69 66 73 1B 0B 4C 4F 43 41 4C .0...cif s..LOCAL >+[0ED0] 4B 54 45 53 54 36 A3 82 03 AE 30 82 03 AA A0 03 KTEST6.. ..0..... >+[0EE0] 02 01 17 A1 03 02 01 02 A2 82 03 9C 04 82 03 98 ........ ........ >+[0EF0] 66 D8 19 46 FA CB 73 2D CF 88 FD 4A EE 07 48 DA f..F..s- ...J..H. >+[0F00] 0E BC 58 30 43 40 A4 9C 00 0F 3B 17 C1 2D F5 9C ..X0C@.. ..;..-.. >+[0F10] 3E D9 2F 1D CA 01 9B D7 2E EC D7 70 ED 8B 8B 1B >./..... ...p.... >+[0F20] 5E F2 4E EE DD 0F C0 8D 61 E5 D7 0A 56 00 32 B1 ^.N..... a...V.2. >+[0F30] DB 91 37 29 0F 2F 85 EE A8 43 BA A5 B8 D4 19 74 ..7)./.. .C.....t >+[0F40] 33 F0 69 52 E1 58 98 83 D6 16 0B 44 A9 63 9B D4 3.iR.X.. ...D.c.. >+[0F50] 4E 6E A7 3E CD 9A 96 4D C4 96 F5 07 6D 29 B6 ED Nn.>...M ....m).. >+[0F60] 2A 62 3D 53 22 33 D1 95 E9 DF 74 4C 2A E2 29 AF *b=S"3.. ..tL*.). >+[0F70] 5B 69 B0 48 2D AD 94 FD A5 1D 54 D8 E2 5E C1 68 [i.H-... ..T..^.h >+[0F80] 6F BA 02 01 79 C3 C9 97 0B 76 66 45 E2 3B 10 17 o...y... .vfE.;.. >+[0F90] 95 40 46 E4 85 B9 87 BB CF CF 19 8C 3A C0 EA 38 .@F..... ....:..8 >+[0FA0] 3B B9 E9 4B 05 89 E5 27 8C 62 95 BC 0D 65 F0 D2 ;..K...' .b...e.. >+[0FB0] C0 5E BC 65 01 D5 0B CB 17 31 0F 06 49 4F A2 4A .^.e.... .1..IO.J >+[0FC0] 70 77 DB BD 92 5B 37 5C EC 06 DF C5 E2 31 C8 40 pw...[7\ .....1.@ >+[0FD0] 09 11 68 14 E7 7D CE 54 4F 52 61 31 2C 1C 53 52 ..h..}.T ORa1,.SR >+[0FE0] DB BE D8 95 39 EE 7D C6 CE C8 22 95 92 97 97 3D ....9.}. .."....= >+[0FF0] 5E 66 0F AD DC C2 4E 2E 2B 9F 63 20 30 DF B7 C1 ^f....N. +.c 0... >+[1000] D4 65 AA 6F 2D 10 24 07 20 8D 88 6E 4B 09 04 31 .e.o-.$. ..nK..1 >+[1010] B6 A3 EB F7 37 32 0E 0C 73 C6 F6 B8 4D D9 0C 4C ....72.. s...M..L >+[1020] 5B EC 10 6A 51 19 EA 3F FF 46 E7 73 16 A7 1F 33 [..jQ..? .F.s...3 >+[1030] 98 7C 9B AD 5A 23 A9 40 7C 0F DF EE 0F AA C7 E8 .|..Z#.@ |....... >+[1040] 63 07 98 3A 4A 0D 18 62 01 21 B2 AE A5 69 B0 C1 c..:J..b .!...i.. >+[1050] 15 51 BA 97 D2 C5 42 5B C5 30 38 18 A9 48 AB D7 .Q....B[ .08..H.. >+[1060] FC A1 BC 9F 71 E7 EA 18 54 42 DA D6 A4 FC C1 DC ....q... TB...... >+[1070] F3 12 30 62 AC 98 E1 7D 2B 34 1E 52 4C 26 67 32 ..0b...} +4.RL&g2 >+[1080] D9 44 1A 08 27 0E DA D0 FC 84 66 35 81 D6 EB 98 .D..'... ..f5.... >+[1090] 46 6F 1E 47 E0 14 31 BE 47 80 65 AA 0B 20 D6 33 Fo.G..1. G.e.. .3 >+[10A0] 36 3B 0D 40 2F 5A 2E 0E 01 BE 00 EB 33 3E 4B 32 6;.@/Z.. ....3>K2 >+[10B0] 91 F4 22 96 E5 5F D4 D5 92 94 CC 5B 59 6A 3E D2 ..".._.. ...[Yj>. >+[10C0] FB A0 4F 99 C4 07 8B 6F 2B 14 37 CD 37 44 C0 1F ..O....o +.7.7D.. >+[10D0] 80 9C 43 46 F2 5E F4 FE D3 39 70 61 BE 72 5B 3A ..CF.^.. .9pa.r[: >+[10E0] 8F 37 95 78 1E AB D9 E7 E9 DA FC 47 09 81 A0 0D .7.x.... ...G.... >+[10F0] 62 E1 F9 34 36 D1 DB E6 98 D8 F4 3E 77 5A 4D E2 b..46... ...>wZM. >+[1100] 5F 20 70 3D 3D 5B 34 D9 FD A8 31 F7 D9 59 F7 A3 _ p==[4. ..1..Y.. >+[1110] F0 66 F7 D9 AD 1C CD D5 85 33 A0 87 22 31 D4 F3 .f...... .3.."1.. >+[1120] 67 80 68 20 A2 90 72 7A 6F 64 FD 68 82 9E 91 B8 g.h ..rz od.h.... >+[1130] E3 F7 6D 6C 38 74 F0 96 A2 F6 25 D7 92 58 14 60 ..ml8t.. ..%..X.` >+[1140] 9F AE 01 4C 0C 09 67 3E 35 67 71 1E 2A 86 21 D3 ...L..g> 5gq.*.!. >+[1150] 60 61 98 16 94 67 0B 52 76 63 93 BD A3 3B A9 F0 `a...g.R vc...;.. >+[1160] A2 6A B7 E6 0F 35 64 DA 6A EA 20 A6 3D 94 71 59 .j...5d. j. .=.qY >+[1170] 5E CB B2 D3 F9 4D FE 1B 4B D8 64 C8 3B 7A A8 E6 ^....M.. K.d.;z.. >+[1180] D2 D5 76 71 26 D4 5C DA 1A 55 17 F2 16 C9 2F 77 ..vq&.\. .U..../w >+[1190] DB 95 19 48 A5 AC D0 C3 31 9C 0A CC 1B 44 11 6B ...H.... 1....D.k >+[11A0] 7C 88 7A 5D CF 6E 12 DA EF C5 C7 34 1D F4 CC EA |.z].n.. ...4.... >+[11B0] 37 24 4B B3 0F C1 A3 F2 29 A0 D8 93 39 C6 16 57 7$K..... )...9..W >+[11C0] D5 BF 57 BF 6C 7E F7 90 E0 EB A3 8B 07 56 9C EC ..W.l~.. .....V.. >+[11D0] 15 3E 21 DA A5 7C 00 3C F9 D2 A7 1C 6F 16 25 31 .>!..|.< ....o.%1 >+[11E0] C5 28 A7 EA F3 47 31 50 DD E1 ED 0A 93 DB 85 CC .(...G1P ........ >+[11F0] 6B 4B 2C 7F E8 F8 2D A9 6D 1D 0A 87 F2 10 8C 82 kK,...-. m....... >+[1200] 2F 9B D4 9B 92 8C 77 40 50 42 1E 42 C4 0A 4F E3 /.....w@ PB.B..O. >+[1210] 6C 6C DC 81 C4 1E BB F0 7D CF 3C 73 22 5B C3 1A ll...... }.<s"[.. >+[1220] 97 35 EE 3A CD 6D F3 68 A3 C5 65 7E E9 54 C0 E3 .5.:.m.h ..e~.T.. >+[1230] 7D 6A 32 4C D1 3E D0 78 4B BF 18 9F A5 25 4A 92 }j2L.>.x K....%J. >+[1240] 1E 6C 8F 01 D6 59 D7 CF 2E A0 CC 98 F6 75 28 2F .l...Y.. .....u(/ >+[1250] F7 2A 70 28 A9 45 1F 75 C2 4E 62 ED D8 C4 A0 8D .*p(.E.u .Nb..... >+[1260] 55 B2 84 1C A4 CE 87 EF 24 EE BC CE 40 09 EB 05 U....... $...@... >+[1270] 0B D1 14 31 50 32 2F B6 A8 97 17 4B A7 95 01 50 ...1P2/. ...K...P >+[1280] 6E 0E 23 49 9C 72 21 91 00 00 00 00 00 00 00 01 n.#I.r!. ........ >+[1290] 00 00 00 01 00 00 00 17 4B 54 45 53 54 2E 53 41 ........ KTEST.SA >+[12A0] 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 MBA.EXAM PLE.COM. >+[12B0] 00 00 0D 61 64 6D 69 6E 69 73 74 72 61 74 6F 72 ...admin istrator >+[12C0] 00 00 00 01 00 00 00 02 00 00 00 17 4B 54 45 53 ........ ....KTES >+[12D0] 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E T.SAMBA. EXAMPLE. >+[12E0] 43 4F 4D 00 00 00 04 63 69 66 73 00 00 00 0B 4C COM....c ifs....L >+[12F0] 4F 43 41 4C 4B 54 45 53 54 36 00 17 00 00 00 10 OCALKTES T6...... >+[1300] 1D C8 5E 46 48 82 F9 29 DB C6 A6 F1 72 6D 8D E9 ..^FH..) ....rm.. >+[1310] 4D 99 4F 6A 4D 99 85 09 7D 44 0B 68 00 00 00 00 M.OjM... }D.h.... >+[1320] 00 40 28 00 00 00 00 00 00 00 00 00 00 00 00 03 .@(..... ........ >+[1330] FA 61 82 03 F6 30 82 03 F2 A0 03 02 01 05 A1 19 .a...0.. ........ >+[1340] 1B 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 ..KTEST. SAMBA.EX >+[1350] 41 4D 50 4C 45 2E 43 4F 4D A2 1E 30 1C A0 03 02 AMPLE.CO M..0.... >+[1360] 01 01 A1 15 30 13 1B 04 63 69 66 73 1B 0B 4C 4F ....0... cifs..LO >+[1370] 43 41 4C 4B 54 45 53 54 36 A3 82 03 AE 30 82 03 CALKTEST 6....0.. >+[1380] AA A0 03 02 01 17 A1 03 02 01 02 A2 82 03 9C 04 ........ ........ >+[1390] 82 03 98 66 D8 19 46 FA CB 73 2D CF 88 FD 4A EE ...f..F. .s-...J. >+[13A0] 07 48 DA 0E BC 58 30 43 40 A4 9C 00 0F 3B 17 C1 .H...X0C @....;.. >+[13B0] 2D F5 9C 3E D9 2F 1D CA 01 9B D7 2E EC D7 70 ED -..>./.. ......p. >+[13C0] 8B 8B 1B 5E F2 4E EE DD 0F C0 8D 61 E5 D7 0A 56 ...^.N.. ...a...V >+[13D0] 00 32 B1 DB 91 37 29 0F 2F 85 EE A8 43 BA A5 B8 .2...7). /...C... >+[13E0] D4 19 74 33 F0 69 52 E1 58 98 83 D6 16 0B 44 A9 ..t3.iR. X.....D. >+[13F0] 63 9B D4 4E 6E A7 3E CD 9A 96 4D C4 96 F5 07 6D c..Nn.>. ..M....m >+[1400] 29 B6 ED 2A 62 3D 53 22 33 D1 95 E9 DF 74 4C 2A )..*b=S" 3....tL* >+[1410] E2 29 AF 5B 69 B0 48 2D AD 94 FD A5 1D 54 D8 E2 .).[i.H- .....T.. >+[1420] 5E C1 68 6F BA 02 01 79 C3 C9 97 0B 76 66 45 E2 ^.ho...y ....vfE. >+[1430] 3B 10 17 95 40 46 E4 85 B9 87 BB CF CF 19 8C 3A ;...@F.. .......: >+[1440] C0 EA 38 3B B9 E9 4B 05 89 E5 27 8C 62 95 BC 0D ..8;..K. ..'.b... >+[1450] 65 F0 D2 C0 5E BC 65 01 D5 0B CB 17 31 0F 06 49 e...^.e. ....1..I >+[1460] 4F A2 4A 70 77 DB BD 92 5B 37 5C EC 06 DF C5 E2 O.Jpw... [7\..... >+[1470] 31 C8 40 09 11 68 14 E7 7D CE 54 4F 52 61 31 2C 1.@..h.. }.TORa1, >+[1480] 1C 53 52 DB BE D8 95 39 EE 7D C6 CE C8 22 95 92 .SR....9 .}...".. >+[1490] 97 97 3D 5E 66 0F AD DC C2 4E 2E 2B 9F 63 20 30 ..=^f... .N.+.c 0 >+[14A0] DF B7 C1 D4 65 AA 6F 2D 10 24 07 20 8D 88 6E 4B ....e.o- .$. ..nK >+[14B0] 09 04 31 B6 A3 EB F7 37 32 0E 0C 73 C6 F6 B8 4D ..1....7 2..s...M >+[14C0] D9 0C 4C 5B EC 10 6A 51 19 EA 3F FF 46 E7 73 16 ..L[..jQ ..?.F.s. >+[14D0] A7 1F 33 98 7C 9B AD 5A 23 A9 40 7C 0F DF EE 0F ..3.|..Z #.@|.... >+[14E0] AA C7 E8 63 07 98 3A 4A 0D 18 62 01 21 B2 AE A5 ...c..:J ..b.!... >+[14F0] 69 B0 C1 15 51 BA 97 D2 C5 42 5B C5 30 38 18 A9 i...Q... .B[.08.. >+[1500] 48 AB D7 FC A1 BC 9F 71 E7 EA 18 54 42 DA D6 A4 H......q ...TB... >+[1510] FC C1 DC F3 12 30 62 AC 98 E1 7D 2B 34 1E 52 4C .....0b. ..}+4.RL >+[1520] 26 67 32 D9 44 1A 08 27 0E DA D0 FC 84 66 35 81 &g2.D..' .....f5. >+[1530] D6 EB 98 46 6F 1E 47 E0 14 31 BE 47 80 65 AA 0B ...Fo.G. .1.G.e.. >+[1540] 20 D6 33 36 3B 0D 40 2F 5A 2E 0E 01 BE 00 EB 33 .36;.@/ Z......3 >+[1550] 3E 4B 32 91 F4 22 96 E5 5F D4 D5 92 94 CC 5B 59 >K2..".. _.....[Y >+[1560] 6A 3E D2 FB A0 4F 99 C4 07 8B 6F 2B 14 37 CD 37 j>...O.. ..o+.7.7 >+[1570] 44 C0 1F 80 9C 43 46 F2 5E F4 FE D3 39 70 61 BE D....CF. ^...9pa. >+[1580] 72 5B 3A 8F 37 95 78 1E AB D9 E7 E9 DA FC 47 09 r[:.7.x. ......G. >+[1590] 81 A0 0D 62 E1 F9 34 36 D1 DB E6 98 D8 F4 3E 77 ...b..46 ......>w >+[15A0] 5A 4D E2 5F 20 70 3D 3D 5B 34 D9 FD A8 31 F7 D9 ZM._ p== [4...1.. >+[15B0] 59 F7 A3 F0 66 F7 D9 AD 1C CD D5 85 33 A0 87 22 Y...f... ....3.." >+[15C0] 31 D4 F3 67 80 68 20 A2 90 72 7A 6F 64 FD 68 82 1..g.h . .rzod.h. >+[15D0] 9E 91 B8 E3 F7 6D 6C 38 74 F0 96 A2 F6 25 D7 92 .....ml8 t....%.. >+[15E0] 58 14 60 9F AE 01 4C 0C 09 67 3E 35 67 71 1E 2A X.`...L. .g>5gq.* >+[15F0] 86 21 D3 60 61 98 16 94 67 0B 52 76 63 93 BD A3 .!.`a... g.Rvc... >+[1600] 3B A9 F0 A2 6A B7 E6 0F 35 64 DA 6A EA 20 A6 3D ;...j... 5d.j. .= >+[1610] 94 71 59 5E CB B2 D3 F9 4D FE 1B 4B D8 64 C8 3B .qY^.... M..K.d.; >+[1620] 7A A8 E6 D2 D5 76 71 26 D4 5C DA 1A 55 17 F2 16 z....vq& .\..U... >+[1630] C9 2F 77 DB 95 19 48 A5 AC D0 C3 31 9C 0A CC 1B ./w...H. ...1.... >+[1640] 44 11 6B 7C 88 7A 5D CF 6E 12 DA EF C5 C7 34 1D D.k|.z]. n.....4. >+[1650] F4 CC EA 37 24 4B B3 0F C1 A3 F2 29 A0 D8 93 39 ...7$K.. ...)...9 >+[1660] C6 16 57 D5 BF 57 BF 6C 7E F7 90 E0 EB A3 8B 07 ..W..W.l ~....... >+[1670] 56 9C EC 15 3E 21 DA A5 7C 00 3C F9 D2 A7 1C 6F V...>!.. |.<....o >+[1680] 16 25 31 C5 28 A7 EA F3 47 31 50 DD E1 ED 0A 93 .%1.(... G1P..... >+[1690] DB 85 CC 6B 4B 2C 7F E8 F8 2D A9 6D 1D 0A 87 F2 ...kK,.. .-.m.... >+[16A0] 10 8C 82 2F 9B D4 9B 92 8C 77 40 50 42 1E 42 C4 .../.... .w@PB.B. >+[16B0] 0A 4F E3 6C 6C DC 81 C4 1E BB F0 7D CF 3C 73 22 .O.ll... ...}.<s" >+[16C0] 5B C3 1A 97 35 EE 3A CD 6D F3 68 A3 C5 65 7E E9 [...5.:. m.h..e~. >+[16D0] 54 C0 E3 7D 6A 32 4C D1 3E D0 78 4B BF 18 9F A5 T..}j2L. >.xK.... >+[16E0] 25 4A 92 1E 6C 8F 01 D6 59 D7 CF 2E A0 CC 98 F6 %J..l... Y....... >+[16F0] 75 28 2F F7 2A 70 28 A9 45 1F 75 C2 4E 62 ED D8 u(/.*p(. E.u.Nb.. >+[1700] C4 A0 8D 55 B2 84 1C A4 CE 87 EF 24 EE BC CE 40 ...U.... ...$...@ >+[1710] 09 EB 05 0B D1 14 31 50 32 2F B6 A8 97 17 4B A7 ......1P 2/....K. >+[1720] 95 01 50 6E 0E 23 49 9C 72 21 91 00 00 00 00 00 ..Pn.#I. r!...... >+[1730] 00 00 01 00 00 00 01 00 00 00 17 4B 54 45 53 54 ........ ...KTEST >+[1740] 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 .SAMBA.E XAMPLE.C >+[1750] 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 73 74 72 61 OM....ad ministra >+[1760] 74 6F 72 00 00 00 01 00 00 00 02 00 00 00 17 4B tor..... .......K >+[1770] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[1780] 4C 45 2E 43 4F 4D 00 00 00 04 63 69 66 73 00 00 LE.COM.. ..cifs.. >+[1790] 00 0B 4C 4F 43 41 4C 4B 54 45 53 54 36 00 17 00 ..LOCALK TEST6... >+[17A0] 00 00 10 1D C8 5E 46 48 82 F9 29 DB C6 A6 F1 72 .....^FH ..)....r >+[17B0] 6D 8D E9 4D 99 4F 6A 4D 99 85 09 7D 44 0B 68 00 m..M.OjM ...}D.h. >+[17C0] 00 00 00 00 40 28 00 00 00 00 00 00 00 00 00 00 ....@(.. ........ >+[17D0] 00 00 03 FA 61 82 03 F6 30 82 03 F2 A0 03 02 01 ....a... 0....... >+[17E0] 05 A1 19 1B 17 4B 54 45 53 54 2E 53 41 4D 42 41 .....KTE ST.SAMBA >+[17F0] 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D A2 1E 30 1C .EXAMPLE .COM..0. >+[1800] A0 03 02 01 01 A1 15 30 13 1B 04 63 69 66 73 1B .......0 ...cifs. >+[1810] 0B 4C 4F 43 41 4C 4B 54 45 53 54 36 A3 82 03 AE .LOCALKT EST6.... >+[1820] 30 82 03 AA A0 03 02 01 17 A1 03 02 01 02 A2 82 0....... ........ >+[1830] 03 9C 04 82 03 98 66 D8 19 46 FA CB 73 2D CF 88 ......f. .F..s-.. >+[1840] FD 4A EE 07 48 DA 0E BC 58 30 43 40 A4 9C 00 0F .J..H... X0C@.... >+[1850] 3B 17 C1 2D F5 9C 3E D9 2F 1D CA 01 9B D7 2E EC ;..-..>. /....... >+[1860] D7 70 ED 8B 8B 1B 5E F2 4E EE DD 0F C0 8D 61 E5 .p....^. N.....a. >+[1870] D7 0A 56 00 32 B1 DB 91 37 29 0F 2F 85 EE A8 43 ..V.2... 7)./...C >+[1880] BA A5 B8 D4 19 74 33 F0 69 52 E1 58 98 83 D6 16 .....t3. iR.X.... >+[1890] 0B 44 A9 63 9B D4 4E 6E A7 3E CD 9A 96 4D C4 96 .D.c..Nn .>...M.. >+[18A0] F5 07 6D 29 B6 ED 2A 62 3D 53 22 33 D1 95 E9 DF ..m)..*b =S"3.... >+[18B0] 74 4C 2A E2 29 AF 5B 69 B0 48 2D AD 94 FD A5 1D tL*.).[i .H-..... >+[18C0] 54 D8 E2 5E C1 68 6F BA 02 01 79 C3 C9 97 0B 76 T..^.ho. ..y....v >+[18D0] 66 45 E2 3B 10 17 95 40 46 E4 85 B9 87 BB CF CF fE.;...@ F....... >+[18E0] 19 8C 3A C0 EA 38 3B B9 E9 4B 05 89 E5 27 8C 62 ..:..8;. .K...'.b >+[18F0] 95 BC 0D 65 F0 D2 C0 5E BC 65 01 D5 0B CB 17 31 ...e...^ .e.....1 >+[1900] 0F 06 49 4F A2 4A 70 77 DB BD 92 5B 37 5C EC 06 ..IO.Jpw ...[7\.. >+[1910] DF C5 E2 31 C8 40 09 11 68 14 E7 7D CE 54 4F 52 ...1.@.. h..}.TOR >+[1920] 61 31 2C 1C 53 52 DB BE D8 95 39 EE 7D C6 CE C8 a1,.SR.. ..9.}... >+[1930] 22 95 92 97 97 3D 5E 66 0F AD DC C2 4E 2E 2B 9F "....=^f ....N.+. >+[1940] 63 20 30 DF B7 C1 D4 65 AA 6F 2D 10 24 07 20 8D c 0....e .o-.$. . >+[1950] 88 6E 4B 09 04 31 B6 A3 EB F7 37 32 0E 0C 73 C6 .nK..1.. ..72..s. >+[1960] F6 B8 4D D9 0C 4C 5B EC 10 6A 51 19 EA 3F FF 46 ..M..L[. .jQ..?.F >+[1970] E7 73 16 A7 1F 33 98 7C 9B AD 5A 23 A9 40 7C 0F .s...3.| ..Z#.@|. >+[1980] DF EE 0F AA C7 E8 63 07 98 3A 4A 0D 18 62 01 21 ......c. .:J..b.! >+[1990] B2 AE A5 69 B0 C1 15 51 BA 97 D2 C5 42 5B C5 30 ...i...Q ....B[.0 >+[19A0] 38 18 A9 48 AB D7 FC A1 BC 9F 71 E7 EA 18 54 42 8..H.... ..q...TB >+[19B0] DA D6 A4 FC C1 DC F3 12 30 62 AC 98 E1 7D 2B 34 ........ 0b...}+4 >+[19C0] 1E 52 4C 26 67 32 D9 44 1A 08 27 0E DA D0 FC 84 .RL&g2.D ..'..... >+[19D0] 66 35 81 D6 EB 98 46 6F 1E 47 E0 14 31 BE 47 80 f5....Fo .G..1.G. >+[19E0] 65 AA 0B 20 D6 33 36 3B 0D 40 2F 5A 2E 0E 01 BE e.. .36; .@/Z.... >+[19F0] 00 EB 33 3E 4B 32 91 F4 22 96 E5 5F D4 D5 92 94 ..3>K2.. ".._.... >+[1A00] CC 5B 59 6A 3E D2 FB A0 4F 99 C4 07 8B 6F 2B 14 .[Yj>... O....o+. >+[1A10] 37 CD 37 44 C0 1F 80 9C 43 46 F2 5E F4 FE D3 39 7.7D.... CF.^...9 >+[1A20] 70 61 BE 72 5B 3A 8F 37 95 78 1E AB D9 E7 E9 DA pa.r[:.7 .x...... >+[1A30] FC 47 09 81 A0 0D 62 E1 F9 34 36 D1 DB E6 98 D8 .G....b. .46..... >+[1A40] F4 3E 77 5A 4D E2 5F 20 70 3D 3D 5B 34 D9 FD A8 .>wZM._ p==[4... >+[1A50] 31 F7 D9 59 F7 A3 F0 66 F7 D9 AD 1C CD D5 85 33 1..Y...f .......3 >+[1A60] A0 87 22 31 D4 F3 67 80 68 20 A2 90 72 7A 6F 64 .."1..g. h ..rzod >+[1A70] FD 68 82 9E 91 B8 E3 F7 6D 6C 38 74 F0 96 A2 F6 .h...... ml8t.... >+[1A80] 25 D7 92 58 14 60 9F AE 01 4C 0C 09 67 3E 35 67 %..X.`.. .L..g>5g >+[1A90] 71 1E 2A 86 21 D3 60 61 98 16 94 67 0B 52 76 63 q.*.!.`a ...g.Rvc >+[1AA0] 93 BD A3 3B A9 F0 A2 6A B7 E6 0F 35 64 DA 6A EA ...;...j ...5d.j. >+[1AB0] 20 A6 3D 94 71 59 5E CB B2 D3 F9 4D FE 1B 4B D8 .=.qY^. ...M..K. >+[1AC0] 64 C8 3B 7A A8 E6 D2 D5 76 71 26 D4 5C DA 1A 55 d.;z.... vq&.\..U >+[1AD0] 17 F2 16 C9 2F 77 DB 95 19 48 A5 AC D0 C3 31 9C ..../w.. .H....1. >+[1AE0] 0A CC 1B 44 11 6B 7C 88 7A 5D CF 6E 12 DA EF C5 ...D.k|. z].n.... >+[1AF0] C7 34 1D F4 CC EA 37 24 4B B3 0F C1 A3 F2 29 A0 .4....7$ K.....). >+[1B00] D8 93 39 C6 16 57 D5 BF 57 BF 6C 7E F7 90 E0 EB ..9..W.. W.l~.... >+[1B10] A3 8B 07 56 9C EC 15 3E 21 DA A5 7C 00 3C F9 D2 ...V...> !..|.<.. >+[1B20] A7 1C 6F 16 25 31 C5 28 A7 EA F3 47 31 50 DD E1 ..o.%1.( ...G1P.. >+[1B30] ED 0A 93 DB 85 CC 6B 4B 2C 7F E8 F8 2D A9 6D 1D ......kK ,...-.m. >+[1B40] 0A 87 F2 10 8C 82 2F 9B D4 9B 92 8C 77 40 50 42 ....../. ....w@PB >+[1B50] 1E 42 C4 0A 4F E3 6C 6C DC 81 C4 1E BB F0 7D CF .B..O.ll ......}. >+[1B60] 3C 73 22 5B C3 1A 97 35 EE 3A CD 6D F3 68 A3 C5 <s"[...5 .:.m.h.. >+[1B70] 65 7E E9 54 C0 E3 7D 6A 32 4C D1 3E D0 78 4B BF e~.T..}j 2L.>.xK. >+[1B80] 18 9F A5 25 4A 92 1E 6C 8F 01 D6 59 D7 CF 2E A0 ...%J..l ...Y.... >+[1B90] CC 98 F6 75 28 2F F7 2A 70 28 A9 45 1F 75 C2 4E ...u(/.* p(.E.u.N >+[1BA0] 62 ED D8 C4 A0 8D 55 B2 84 1C A4 CE 87 EF 24 EE b.....U. ......$. >+[1BB0] BC CE 40 09 EB 05 0B D1 14 31 50 32 2F B6 A8 97 ..@..... .1P2/... >+[1BC0] 17 4B A7 95 01 50 6E 0E 23 49 9C 72 21 91 00 00 .K...Pn. #I.r!... >+[1BD0] 00 00 00 00 00 01 00 00 00 01 00 00 00 17 4B 54 ........ ......KT >+[1BE0] 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C EST.SAMB A.EXAMPL >+[1BF0] 45 2E 43 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 73 E.COM... .adminis >+[1C00] 74 72 61 74 6F 72 00 00 00 01 00 00 00 02 00 00 trator.. ........ >+[1C10] 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 ..KTEST. SAMBA.EX >+[1C20] 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 04 63 69 66 AMPLE.CO M....cif >+[1C30] 73 00 00 00 0B 4C 4F 43 41 4C 4B 54 45 53 54 36 s....LOC ALKTEST6 >+[1C40] 00 17 00 00 00 10 1D C8 5E 46 48 82 F9 29 DB C6 ........ ^FH..).. >+[1C50] A6 F1 72 6D 8D E9 4D 99 4F 6A 4D 99 85 09 7D 44 ..rm..M. OjM...}D >+[1C60] 0B 68 00 00 00 00 00 40 28 00 00 00 00 00 00 00 .h.....@ (....... >+[1C70] 00 00 00 00 00 03 FA 61 82 03 F6 30 82 03 F2 A0 .......a ...0.... >+[1C80] 03 02 01 05 A1 19 1B 17 4B 54 45 53 54 2E 53 41 ........ KTEST.SA >+[1C90] 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D A2 MBA.EXAM PLE.COM. >+[1CA0] 1E 30 1C A0 03 02 01 01 A1 15 30 13 1B 04 63 69 .0...... ..0...ci >+[1CB0] 66 73 1B 0B 4C 4F 43 41 4C 4B 54 45 53 54 36 A3 fs..LOCA LKTEST6. >+[1CC0] 82 03 AE 30 82 03 AA A0 03 02 01 17 A1 03 02 01 ...0.... ........ >+[1CD0] 02 A2 82 03 9C 04 82 03 98 66 D8 19 46 FA CB 73 ........ .f..F..s >+[1CE0] 2D CF 88 FD 4A EE 07 48 DA 0E BC 58 30 43 40 A4 -...J..H ...X0C@. >+[1CF0] 9C 00 0F 3B 17 C1 2D F5 9C 3E D9 2F 1D CA 01 9B ...;..-. .>./.... >+[1D00] D7 2E EC D7 70 ED 8B 8B 1B 5E F2 4E EE DD 0F C0 ....p... .^.N.... >+[1D10] 8D 61 E5 D7 0A 56 00 32 B1 DB 91 37 29 0F 2F 85 .a...V.2 ...7)./. >+[1D20] EE A8 43 BA A5 B8 D4 19 74 33 F0 69 52 E1 58 98 ..C..... t3.iR.X. >+[1D30] 83 D6 16 0B 44 A9 63 9B D4 4E 6E A7 3E CD 9A 96 ....D.c. .Nn.>... >+[1D40] 4D C4 96 F5 07 6D 29 B6 ED 2A 62 3D 53 22 33 D1 M....m). .*b=S"3. >+[1D50] 95 E9 DF 74 4C 2A E2 29 AF 5B 69 B0 48 2D AD 94 ...tL*.) .[i.H-.. >+[1D60] FD A5 1D 54 D8 E2 5E C1 68 6F BA 02 01 79 C3 C9 ...T..^. ho...y.. >+[1D70] 97 0B 76 66 45 E2 3B 10 17 95 40 46 E4 85 B9 87 ..vfE.;. ..@F.... >+[1D80] BB CF CF 19 8C 3A C0 EA 38 3B B9 E9 4B 05 89 E5 .....:.. 8;..K... >+[1D90] 27 8C 62 95 BC 0D 65 F0 D2 C0 5E BC 65 01 D5 0B '.b...e. ..^.e... >+[1DA0] CB 17 31 0F 06 49 4F A2 4A 70 77 DB BD 92 5B 37 ..1..IO. Jpw...[7 >+[1DB0] 5C EC 06 DF C5 E2 31 C8 40 09 11 68 14 E7 7D CE \.....1. @..h..}. >+[1DC0] 54 4F 52 61 31 2C 1C 53 52 DB BE D8 95 39 EE 7D TORa1,.S R....9.} >+[1DD0] C6 CE C8 22 95 92 97 97 3D 5E 66 0F AD DC C2 4E ...".... =^f....N >+[1DE0] 2E 2B 9F 63 20 30 DF B7 C1 D4 65 AA 6F 2D 10 24 .+.c 0.. ..e.o-.$ >+[1DF0] 07 20 8D 88 6E 4B 09 04 31 B6 A3 EB F7 37 32 0E . ..nK.. 1....72. >+[1E00] 0C 73 C6 F6 B8 4D D9 0C 4C 5B EC 10 6A 51 19 EA .s...M.. L[..jQ.. >+[1E10] 3F FF 46 E7 73 16 A7 1F 33 98 7C 9B AD 5A 23 A9 ?.F.s... 3.|..Z#. >+[1E20] 40 7C 0F DF EE 0F AA C7 E8 63 07 98 3A 4A 0D 18 @|...... .c..:J.. >+[1E30] 62 01 21 B2 AE A5 69 B0 C1 15 51 BA 97 D2 C5 42 b.!...i. ..Q....B >+[1E40] 5B C5 30 38 18 A9 48 AB D7 FC A1 BC 9F 71 E7 EA [.08..H. .....q.. >+[1E50] 18 54 42 DA D6 A4 FC C1 DC F3 12 30 62 AC 98 E1 .TB..... ...0b... >+[1E60] 7D 2B 34 1E 52 4C 26 67 32 D9 44 1A 08 27 0E DA }+4.RL&g 2.D..'.. >+[1E70] D0 FC 84 66 35 81 D6 EB 98 46 6F 1E 47 E0 14 31 ...f5... .Fo.G..1 >+[1E80] BE 47 80 65 AA 0B 20 D6 33 36 3B 0D 40 2F 5A 2E .G.e.. . 36;.@/Z. >+[1E90] 0E 01 BE 00 EB 33 3E 4B 32 91 F4 22 96 E5 5F D4 .....3>K 2..".._. >+[1EA0] D5 92 94 CC 5B 59 6A 3E D2 FB A0 4F 99 C4 07 8B ....[Yj> ...O.... >+[1EB0] 6F 2B 14 37 CD 37 44 C0 1F 80 9C 43 46 F2 5E F4 o+.7.7D. ...CF.^. >+[1EC0] FE D3 39 70 61 BE 72 5B 3A 8F 37 95 78 1E AB D9 ..9pa.r[ :.7.x... >+[1ED0] E7 E9 DA FC 47 09 81 A0 0D 62 E1 F9 34 36 D1 DB ....G... .b..46.. >+[1EE0] E6 98 D8 F4 3E 77 5A 4D E2 5F 20 70 3D 3D 5B 34 ....>wZM ._ p==[4 >+[1EF0] D9 FD A8 31 F7 D9 59 F7 A3 F0 66 F7 D9 AD 1C CD ...1..Y. ..f..... >+[1F00] D5 85 33 A0 87 22 31 D4 F3 67 80 68 20 A2 90 72 ..3.."1. .g.h ..r >+[1F10] 7A 6F 64 FD 68 82 9E 91 B8 E3 F7 6D 6C 38 74 F0 zod.h... ...ml8t. >+[1F20] 96 A2 F6 25 D7 92 58 14 60 9F AE 01 4C 0C 09 67 ...%..X. `...L..g >+[1F30] 3E 35 67 71 1E 2A 86 21 D3 60 61 98 16 94 67 0B >5gq.*.! .`a...g. >+[1F40] 52 76 63 93 BD A3 3B A9 F0 A2 6A B7 E6 0F 35 64 Rvc...;. ..j...5d >+[1F50] DA 6A EA 20 A6 3D 94 71 59 5E CB B2 D3 F9 4D FE .j. .=.q Y^....M. >+[1F60] 1B 4B D8 64 C8 3B 7A A8 E6 D2 D5 76 71 26 D4 5C .K.d.;z. ...vq&.\ >+[1F70] DA 1A 55 17 F2 16 C9 2F 77 DB 95 19 48 A5 AC D0 ..U..../ w...H... >+[1F80] C3 31 9C 0A CC 1B 44 11 6B 7C 88 7A 5D CF 6E 12 .1....D. k|.z].n. >+[1F90] DA EF C5 C7 34 1D F4 CC EA 37 24 4B B3 0F C1 A3 ....4... .7$K.... >+[1FA0] F2 29 A0 D8 93 39 C6 16 57 D5 BF 57 BF 6C 7E F7 .)...9.. W..W.l~. >+[1FB0] 90 E0 EB A3 8B 07 56 9C EC 15 3E 21 DA A5 7C 00 ......V. ..>!..|. >+[1FC0] 3C F9 D2 A7 1C 6F 16 25 31 C5 28 A7 EA F3 47 31 <....o.% 1.(...G1 >+[1FD0] 50 DD E1 ED 0A 93 DB 85 CC 6B 4B 2C 7F E8 F8 2D P....... .kK,...- >+[1FE0] A9 6D 1D 0A 87 F2 10 8C 82 2F 9B D4 9B 92 8C 77 .m...... ./.....w >+[1FF0] 40 50 42 1E 42 C4 0A 4F E3 6C 6C DC 81 C4 1E BB @PB.B..O .ll..... >+[2000] F0 7D CF 3C 73 22 5B C3 1A 97 35 EE 3A CD 6D F3 .}.<s"[. ..5.:.m. >+[2010] 68 A3 C5 65 7E E9 54 C0 E3 7D 6A 32 4C D1 3E D0 h..e~.T. .}j2L.>. >+[2020] 78 4B BF 18 9F A5 25 4A 92 1E 6C 8F 01 D6 59 D7 xK....%J ..l...Y. >+[2030] CF 2E A0 CC 98 F6 75 28 2F F7 2A 70 28 A9 45 1F ......u( /.*p(.E. >+[2040] 75 C2 4E 62 ED D8 C4 A0 8D 55 B2 84 1C A4 CE 87 u.Nb.... .U...... >+[2050] EF 24 EE BC CE 40 09 EB 05 0B D1 14 31 50 32 2F .$...@.. ....1P2/ >+[2060] B6 A8 97 17 4B A7 95 01 50 6E 0E 23 49 9C 72 21 ....K... Pn.#I.r! >+[2070] 91 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 ........ ........ >+[2080] 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 .KTEST.S AMBA.EXA >+[2090] 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D 61 64 6D 69 MPLE.COM ....admi >+[20A0] 6E 69 73 74 72 61 74 6F 72 00 00 00 01 00 00 00 nistrato r....... >+[20B0] 02 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 .....KTE ST.SAMBA >+[20C0] 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 04 .EXAMPLE .COM.... >+[20D0] 68 6F 73 74 00 00 00 0B 6C 6F 63 61 6C 6B 74 65 host.... localkte >+[20E0] 73 74 36 00 17 00 00 00 10 72 47 04 38 B6 E6 F0 st6..... .rG.8... >+[20F0] 44 9E 9F 27 66 E1 69 9C 9A 4D 99 4F 6A 4D 99 90 D..'f.i. .M.OjM.. >+[2100] F5 7D 44 0B 68 00 00 00 00 00 40 28 00 00 00 00 .}D.h... ..@(.... >+[2110] 00 00 00 00 00 00 00 00 03 FA 61 82 03 F6 30 82 ........ ..a...0. >+[2120] 03 F2 A0 03 02 01 05 A1 19 1B 17 4B 54 45 53 54 ........ ...KTEST >+[2130] 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 .SAMBA.E XAMPLE.C >+[2140] 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 15 30 13 1B OM..0... .....0.. >+[2150] 04 68 6F 73 74 1B 0B 6C 6F 63 61 6C 6B 74 65 73 .host..l ocalktes >+[2160] 74 36 A3 82 03 AE 30 82 03 AA A0 03 02 01 17 A1 t6....0. ........ >+[2170] 03 02 01 02 A2 82 03 9C 04 82 03 98 58 95 95 EB ........ ....X... >+[2180] CB 8F 68 D4 77 43 0F 3B 44 B4 15 DA 40 6D FD E9 ..h.wC.; D...@m.. >+[2190] 85 D3 2F CD B5 1E 96 CD F6 E9 67 91 36 08 9E B4 ../..... ..g.6... >+[21A0] B3 47 70 7A B3 4E 82 5A 4F 8E 4B F5 8D 04 E4 5C .Gpz.N.Z O.K....\ >+[21B0] C4 D8 0C AF 08 25 F9 C1 64 B2 3A 35 26 E9 B2 72 .....%.. d.:5&..r >+[21C0] 66 B5 E9 81 FC BE 12 1B CC 8A A5 82 31 F6 7F C3 f....... ....1... >+[21D0] 5A 19 A3 31 F2 99 14 1E 64 E4 41 E8 C7 C3 F3 DF Z..1.... d.A..... >+[21E0] F5 65 7D B0 9F DC 5D 25 1D 1A A8 EA AA 88 6D F4 .e}...]% ......m. >+[21F0] 7C 25 9F 53 F6 A6 8F B1 24 AF 98 FE 53 7B 35 3C |%.S.... $...S{5< >+[2200] DB EC 7F 09 74 E9 C4 8D 20 B4 47 08 0E 32 B8 C9 ....t... .G..2.. >+[2210] 45 27 12 F9 8E F5 D6 C2 DD 1A 96 0E 68 5F 39 65 E'...... ....h_9e >+[2220] 72 C7 BD 8E 04 0E 13 E1 03 27 AC 50 80 76 E6 7A r....... .'.P.v.z >+[2230] 8E F4 C2 72 4F 68 B3 34 00 A9 54 41 DA FD 96 94 ...rOh.4 ..TA.... >+[2240] 29 A1 59 15 2F DB 6C 94 85 49 C5 D0 6D 48 B0 C4 ).Y./.l. .I..mH.. >+[2250] 65 D0 95 1D DB 3D 25 D0 75 50 D4 CF FA 2F 71 57 e....=%. uP.../qW >+[2260] BD 6C 1C 59 E1 C3 5B C7 24 95 FF B0 20 EF 6A DB .l.Y..[. $... .j. >+[2270] 79 87 67 91 94 E9 16 E2 BB 74 7A 08 E1 6A 36 5F y.g..... .tz..j6_ >+[2280] DF 11 AB 35 9B 3E 32 48 83 89 41 4E 06 BF F9 BB ...5.>2H ..AN.... >+[2290] EC E4 D7 6D 77 C4 55 22 DF F7 91 4D CB C5 01 A5 ...mw.U" ...M.... >+[22A0] BA 2D 1E 92 76 04 E8 02 2F 5E AF 1C B3 B7 A6 FB .-..v... /^...... >+[22B0] 3A 9F D9 7C 6D DA B4 8F 31 00 A5 30 F2 76 72 9B :..|m... 1..0.vr. >+[22C0] 62 97 E0 56 E5 E4 C7 6B 8B FC 84 75 57 66 6E D7 b..V...k ...uWfn. >+[22D0] B7 41 6F 61 F4 5B 0F 87 68 F6 54 02 26 1B 1F B7 .Aoa.[.. h.T.&... >+[22E0] 60 D6 E7 FA 4F C7 DB 35 58 EC 13 21 D4 C6 A1 27 `...O..5 X..!...' >+[22F0] BA E7 82 DF 29 FB 9D 5D E8 35 28 C9 9C 4E D7 BE ....)..] .5(..N.. >+[2300] 2F 6D F1 E8 0B 5A 74 C9 93 9F AD 42 24 4B B7 3B /m...Zt. ...B$K.; >+[2310] 38 2A 11 CF F0 BD 85 40 48 D8 9D E7 6B 65 70 42 8*.....@ H...kepB >+[2320] 60 DA 9B 65 CB C8 C5 D7 40 3A 12 DC 64 AF 82 54 `..e.... @:..d..T >+[2330] 34 05 38 4F C6 FB 38 E2 73 A9 89 B7 FC 33 15 85 4.8O..8. s....3.. >+[2340] 9E CA E9 E0 89 18 18 84 02 65 B4 74 5B D4 A1 6F ........ .e.t[..o >+[2350] 5F 79 20 CB D7 36 C8 6D 5B 1E 5E 0C 82 16 9F CC _y ..6.m [.^..... >+[2360] 5A 1E 57 C1 B6 94 51 87 A1 3D 12 D4 8B FE 0F 93 Z.W...Q. .=...... >+[2370] ED 53 A3 F4 88 3C 35 05 89 FE AF 0B 36 62 E3 2F .S...<5. ....6b./ >+[2380] 5C 4A 0E 07 67 39 A3 8E C0 45 07 7F 73 32 BC DE \J..g9.. .E..s2.. >+[2390] 2D 00 8B 47 79 3D 1C A1 90 AE B6 8F 83 B2 1B 31 -..Gy=.. .......1 >+[23A0] EE E4 F2 C5 C1 4A E2 4A 2F 28 F0 AA 19 43 6A 14 .....J.J /(...Cj. >+[23B0] B1 42 61 90 34 2E EE 3D 16 9F 5D 9F 7A A2 01 7A .Ba.4..= ..].z..z >+[23C0] 4B 96 FA 4D C9 85 1A 75 27 B7 6B FD 4D 7D 9C 65 K..M...u '.k.M}.e >+[23D0] 97 DB 05 CC 76 68 EA 05 5D 5D BB BD 51 4B 5B F2 ....vh.. ]]..QK[. >+[23E0] 48 59 BD 1E AD 56 D4 69 A5 75 CD ED EC B1 3E AB HY...V.i .u....>. >+[23F0] FA B7 F8 8D 4F BE 95 63 38 1C 4C 70 26 C4 3A 21 ....O..c 8.Lp&.:! >+[2400] 80 61 05 3A D4 E2 28 2C 85 01 5A DA FC 10 60 F3 .a.:..(, ..Z...`. >+[2410] 74 0C FD DB 2F 5B 25 4B 14 E4 7D 8A DB 85 12 D2 t.../[%K ..}..... >+[2420] D7 69 CD B5 B1 93 CE E5 E6 4D 57 D3 C2 D3 2E A0 .i...... .MW..... >+[2430] 08 37 09 CD 19 99 09 FA 33 68 4A E0 92 46 21 0C .7...... 3hJ..F!. >+[2440] 99 9F DA 05 15 20 8B 3D 7C 7B CA D6 81 AC AA 83 ..... .= |{...... >+[2450] 48 C8 24 4C C8 FC A5 14 2C BC 49 1A 1C 49 61 1D H.$L.... ,.I..Ia. >+[2460] 24 86 42 B1 37 6A C8 3A AC 18 CC C0 50 84 12 48 $.B.7j.: ....P..H >+[2470] 8B 29 0A 49 26 A4 E2 B9 E5 96 E7 37 C3 DE 4C 23 .).I&... ...7..L# >+[2480] D2 D4 62 14 8F 1E 72 39 CF 03 BC A3 00 C7 63 51 ..b...r9 ......cQ >+[2490] A9 6B E4 3E B2 65 A1 A2 BB EC 06 41 85 50 22 02 .k.>.e.. ...A.P". >+[24A0] 46 2F 72 2B 32 1A A4 2D 85 94 02 47 69 8D AD 6D F/r+2..- ...Gi..m >+[24B0] 66 AB D4 E4 29 C8 C7 DA F4 18 31 2A DF 50 6A 05 f...)... ..1*.Pj. >+[24C0] D6 47 26 C4 F9 87 0F 35 24 6E 72 D6 23 7D 3A 94 .G&....5 $nr.#}:. >+[24D0] 14 8D E8 57 AA BA D7 CF A9 2D E7 4C 10 7C D8 0D ...W.... .-.L.|.. >+[24E0] 51 30 1F E1 FB E5 E2 6C EE AA 65 2F D8 22 05 67 Q0.....l ..e/.".g >+[24F0] 87 4D 4D D2 11 3D B4 1E AA 20 3F 76 E3 94 93 6D .MM..=.. . ?v...m >+[2500] AC 10 05 AF 09 BD 67 86 C5 83 93 D6 1C D3 81 D9 ......g. ........ >+[2510] B1 3B E1 76 00 00 00 00 00 00 00 01 00 00 00 01 .;.v.... ........ >+[2520] 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E ....KTES T.SAMBA. >+[2530] 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D 61 EXAMPLE. COM....a >+[2540] 64 6D 69 6E 69 73 74 72 61 74 6F 72 00 00 00 01 dministr ator.... >+[2550] 00 00 00 02 00 00 00 17 4B 54 45 53 54 2E 53 41 ........ KTEST.SA >+[2560] 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 MBA.EXAM PLE.COM. >+[2570] 00 00 04 68 6F 73 74 00 00 00 0B 4C 4F 43 41 4C ...host. ...LOCAL >+[2580] 4B 54 45 53 54 36 00 17 00 00 00 10 55 6E 3E FC KTEST6.. ....Un>. >+[2590] E2 F4 40 51 19 E6 6E EB 23 4C 48 8E 4D 99 4F 6A ..@Q..n. #LH.M.Oj >+[25A0] 4D 99 90 FC 7D 44 0B 68 00 00 00 00 00 40 28 00 M...}D.h .....@(. >+[25B0] 00 00 00 00 00 00 00 00 00 00 00 03 FA 61 82 03 ........ .....a.. >+[25C0] F6 30 82 03 F2 A0 03 02 01 05 A1 19 1B 17 4B 54 .0...... ......KT >+[25D0] 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C EST.SAMB A.EXAMPL >+[25E0] 45 2E 43 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 15 E.COM..0 ........ >+[25F0] 30 13 1B 04 68 6F 73 74 1B 0B 4C 4F 43 41 4C 4B 0...host ..LOCALK >+[2600] 54 45 53 54 36 A3 82 03 AE 30 82 03 AA A0 03 02 TEST6... .0...... >+[2610] 01 17 A1 03 02 01 02 A2 82 03 9C 04 82 03 98 6E ........ .......n >+[2620] 87 B7 7B 3A 7E EF 4A 1B 29 C9 E3 C4 1F 42 4F 0E ..{:~.J. )....BO. >+[2630] C8 AC AC 4E A2 77 1D DA 93 37 F1 AF DA A3 75 2D ...N.w.. .7....u- >+[2640] 12 8B 40 34 23 0E 8E A9 90 58 46 42 42 39 31 D6 ..@4#... .XFBB91. >+[2650] 03 9E 5D 81 D9 E8 F6 08 2B D9 96 88 8A 2F F1 CC ..]..... +..../.. >+[2660] F2 EA 9E 9A 4B 31 B6 04 2D 3D 4C 7F 92 DE 3B 04 ....K1.. -=L...;. >+[2670] 19 EE 28 D0 83 81 C3 46 CD 74 23 4C 14 34 DE 62 ..(....F .t#L.4.b >+[2680] 0A AC E5 12 16 75 E9 A8 4B 32 78 CC 8D AE A2 E5 .....u.. K2x..... >+[2690] 6D E8 09 70 76 52 F5 E5 18 F7 E7 91 15 6A 69 AB m..pvR.. .....ji. >+[26A0] B8 62 DD 80 F5 28 6D DF ED 10 DA AC FB 92 27 CF .b...(m. ......'. >+[26B0] 98 B5 77 9D A5 96 E6 9A CC B9 C3 91 78 22 35 9C ..w..... ....x"5. >+[26C0] A1 13 A3 20 28 D1 16 E5 3E 4A 85 1E 12 0B CA 4D ... (... >J.....M >+[26D0] C6 C8 03 C8 28 2C D8 29 5D 9A 76 4A 92 13 43 56 ....(,.) ].vJ..CV >+[26E0] AF F7 C1 71 25 72 5C 38 75 1C 07 F1 5E 86 05 72 ...q%r\8 u...^..r >+[26F0] 6F 69 95 42 B6 F2 DA A9 91 06 9F B9 54 20 33 A5 oi.B.... ....T 3. >+[2700] 31 60 3B 54 DC 3A 95 34 96 26 07 52 6B 0E 1D 3B 1`;T.:.4 .&.Rk..; >+[2710] D9 F8 48 20 AC CD 05 3B 99 F8 EE DB 83 28 CD C7 ..H ...; .....(.. >+[2720] 2F 45 00 7E 2F 0A 65 7A D1 9E 95 4B EE C3 34 93 /E.~/.ez ...K..4. >+[2730] A8 C7 DF 03 8B 14 D0 FC CE 56 90 AC EE 93 C5 D3 ........ .V...... >+[2740] F7 12 24 69 0B 20 8D A2 65 87 55 26 2A F9 9A 88 ..$i. .. e.U&*... >+[2750] D7 0D 86 61 D6 92 B6 FE E5 D1 66 F9 1F 9D F4 04 ...a.... ..f..... >+[2760] 48 A6 39 BC 54 20 EA 10 21 E9 6D 30 46 1D C2 1C H.9.T .. !.m0F... >+[2770] A4 E8 B4 63 85 37 27 25 80 52 41 60 C7 A1 32 21 ...c.7'% .RA`..2! >+[2780] 43 90 02 E6 5F 5A E9 4E AF F9 B5 13 BD 42 BD A3 C..._Z.N .....B.. >+[2790] A5 4D 10 45 83 4D 92 18 1F C9 CF FB 84 29 89 23 .M.E.M.. .....).# >+[27A0] AC 71 4B 89 1B 52 E5 06 8C 3E 7C 88 CB D3 B3 CF .qK..R.. .>|..... >+[27B0] B9 7A 67 D6 24 F4 AC 00 A6 AD 91 30 9A 95 53 F1 .zg.$... ...0..S. >+[27C0] 48 06 A6 39 DB CF DC 9D C9 55 76 26 5E C1 DB 5D H..9.... .Uv&^..] >+[27D0] B3 5B 3E AE 1A A0 10 BA 82 21 83 44 02 E0 99 33 .[>..... .!.D...3 >+[27E0] 40 BA 29 9E 28 E5 73 4C 23 94 A2 4F BF 07 ED 4F @.).(.sL #..O...O >+[27F0] 7C 45 9B 30 C8 41 6B 0A 55 13 6E F5 AD 7A 0C B2 |E.0.Ak. U.n..z.. >+[2800] EA FF D0 06 13 4D F3 24 82 7F F6 51 2F 4A 4F 0D .....M.$ ...Q/JO. >+[2810] 37 F8 14 6B E9 E4 82 BB 3A 75 63 63 12 E8 78 6F 7..k.... :ucc..xo >+[2820] 6F FC 6C D3 4B A6 F1 CC 2A F1 7D EB 82 26 2F D0 o.l.K... *.}..&/. >+[2830] A1 8B 3E 9A 71 D7 91 D3 08 E6 FD 62 1B 84 13 2D ..>.q... ...b...- >+[2840] 8E A0 A0 C3 85 78 2F 0D F8 E7 10 FC CB 05 A7 B9 .....x/. ........ >+[2850] 9A 33 90 B5 9B 26 E3 23 98 B0 91 4B EB 32 37 D6 .3...&.# ...K.27. >+[2860] F4 ED 61 08 D8 75 CC 03 83 2C 3C CF 21 63 9C F6 ..a..u.. .,<.!c.. >+[2870] AF 5B 4F 12 07 74 17 CD 98 BB E7 5E C7 17 2D C4 .[O..t.. ...^..-. >+[2880] 87 A4 74 6D 5E CE DB A3 01 B9 AD 20 73 38 78 22 ..tm^... ... s8x" >+[2890] 3D 45 F5 51 77 C6 47 63 45 61 81 D9 FF 31 90 C4 =E.Qw.Gc Ea...1.. >+[28A0] 6F 5A F8 FE 6A 56 5B D4 EE EC 49 C7 A7 51 AE 5C oZ..jV[. ..I..Q.\ >+[28B0] 85 53 70 3D 1A 49 83 59 CF 65 58 B3 48 7E 04 9E .Sp=.I.Y .eX.H~.. >+[28C0] C7 64 8A 05 73 E3 DC 1A 65 5D 4F 41 01 56 73 90 .d..s... e]OA.Vs. >+[28D0] 61 F3 84 1F FF CF 46 B2 06 46 56 97 93 B9 DB 32 a.....F. .FV....2 >+[28E0] 2A 64 8A 48 02 05 84 E9 FA 76 8B 94 96 89 A0 73 *d.H.... .v.....s >+[28F0] 20 75 4D 52 1D 23 13 D1 83 D7 5D 59 23 6A 87 C1 uMR.#.. ..]Y#j.. >+[2900] 09 3E 01 3A 28 65 42 8C 35 F1 91 EA 6A 1F 83 0D .>.:(eB. 5...j... >+[2910] 8F 57 69 81 D4 A2 D2 EA 0C BF AF 95 A3 F4 90 15 .Wi..... ........ >+[2920] 61 34 F2 6C 8B D0 DA B5 1E 43 AC CE C7 8A 1B 2B a4.l.... .C.....+ >+[2930] 29 2B 89 1C C5 53 C8 04 F7 1E 46 72 F3 A8 CE F7 )+...S.. ..Fr.... >+[2940] 59 76 55 E7 53 1C A2 9F D8 23 F7 EA 71 B0 74 83 YvU.S... .#..q.t. >+[2950] 71 95 3E DC A6 FA 2D A4 42 13 93 8B 2B FA A2 70 q.>...-. B...+..p >+[2960] 25 21 2D F6 E1 26 56 DF 58 79 25 16 E8 C9 03 EC %!-..&V. Xy%..... >+[2970] 72 5F 35 CF 59 6B E1 AD 85 85 7B AB 78 F2 0D AC r_5.Yk.. ..{.x... >+[2980] AB 89 F2 DA 85 E7 DE 09 77 99 EC 7C F3 97 1F 71 ........ w..|...q >+[2990] 3C DB 09 44 7A 3C 69 E5 03 B0 6D 4D 3B 6B 4C D5 <..Dz<i. ..mM;kL. >+[29A0] AB 52 2F 6F 81 2B 51 5B D2 66 44 1E B7 66 5D 7F .R/o.+Q[ .fD..f]. >+[29B0] 09 6A 92 27 27 62 08 00 00 00 00 .j.''b.. ... >+dump OK >diff --git a/source3/selftest/ktest-krb5_ccache-3.txt b/source3/selftest/ktest-krb5_ccache-3.txt >new file mode 100644 >index 00000000000..76c492cd2b1 >--- /dev/null >+++ b/source3/selftest/ktest-krb5_ccache-3.txt >@@ -0,0 +1,832 @@ >+pull returned Success >+ CCACHE: struct CCACHE >+ pvno : 0x05 (5) >+ version : 0x04 (4) >+ optional_header : union OPTIONAL_HEADER(case 0x4) >+ v4header: struct V4HEADER >+ v4tags: struct V4TAGS >+ tag: struct V4TAG >+ tag : 0x0001 (1) >+ field : union FIELD(case 0x1) >+ deltatime_tag: struct DELTATIME_TAG >+ kdc_sec_offset : 0 >+ kdc_usec_offset : 0 >+ further_tags : DATA_BLOB length=0 >+ principal: struct PRINCIPAL >+ name_type : 0x00000001 (1) >+ component_count : 0x00000001 (1) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(1) >+ components : 'administrator' >+ cred: struct CREDENTIAL >+ client: struct PRINCIPAL >+ name_type : 0x00000001 (1) >+ component_count : 0x00000001 (1) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(1) >+ components : 'administrator' >+ server: struct PRINCIPAL >+ name_type : 0x00000000 (0) >+ component_count : 0x00000002 (2) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(2) >+ components : 'krbtgt' >+ components : 'KTEST.SAMBA.EXAMPLE.COM' >+ keyblock: struct KEYBLOCK >+ enctype : 0x0017 (23) >+ data : DATA_BLOB length=16 >+[0000] E5 E4 15 C8 A8 0F 4D 95 F9 1B E3 B9 98 CA A1 7F ......M. ........ >+ authtime : 0x4d9b9045 (1302040645) >+ starttime : 0x4d9b9045 (1302040645) >+ endtime : 0x7d464c43 (2101759043) >+ renew_till : 0x7d464c43 (2101759043) >+ is_skey : 0x00 (0) >+ ticket_flags : 0x40e00000 (1088421888) >+ addresses: struct ADDRESSES >+ count : 0x00000000 (0) >+ data: ARRAY(0) >+ authdata: struct AUTHDATA >+ count : 0x00000000 (0) >+ data: ARRAY(0) >+ ticket : DATA_BLOB length=1032 >+[0000] 61 82 04 04 30 82 04 00 A0 03 02 01 05 A1 19 1B a...0... ........ >+[0010] 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 .KTEST.S AMBA.EXA >+[0020] 4D 50 4C 45 2E 43 4F 4D A2 2C 30 2A A0 03 02 01 MPLE.COM .,0*.... >+[0030] 00 A1 23 30 21 1B 06 6B 72 62 74 67 74 1B 17 4B ..#0!..k rbtgt..K >+[0040] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[0050] 4C 45 2E 43 4F 4D A3 82 03 AE 30 82 03 AA A0 03 LE.COM.. ..0..... >+[0060] 02 01 17 A1 03 02 01 01 A2 82 03 9C 04 82 03 98 ........ ........ >+[0070] 01 40 48 A6 B8 F0 DA 43 54 A5 18 CF B0 15 CB 68 .@H....C T......h >+[0080] 9F A0 69 44 87 A9 FF 06 25 B9 29 48 59 64 26 48 ..iD.... %.)HYd&H >+[0090] 96 7C 46 6A 79 E5 F0 77 DB 46 6C 20 A1 59 D9 F8 .|Fjy..w .Fl .Y.. >+[00A0] 6A 8A 2D B5 D9 EF A4 54 DE 19 20 C0 7B 93 D4 3D j.-....T .. .{..= >+[00B0] ED 72 35 AF 9D 87 75 9E 44 01 A4 6C D9 EA 94 A3 .r5...u. D..l.... >+[00C0] 18 C6 42 75 E3 0A 0C 76 9A AE 75 BC A3 02 91 BC ..Bu...v ..u..... >+[00D0] 2D BB 3C 23 73 A6 1A A7 8A 3E 85 42 5D 1F 5D 7D -.<#s... .>.B].]} >+[00E0] 0B 1F C3 88 2A 93 40 F9 E9 18 7D 3F 73 DA AC 1F ....*.@. ..}?s... >+[00F0] E7 7B C3 B8 14 56 C3 63 86 5B AF C9 C3 21 9F 94 .{...V.c .[...!.. >+[0100] B4 67 06 60 7F 56 2D F4 C7 22 CD B4 1C 14 B7 5B .g.`.V-. .".....[ >+[0110] 26 67 9D 18 28 B5 5D C2 FC 13 B6 CA 9F AB CD 32 &g..(.]. .......2 >+[0120] 71 D5 51 5F A2 11 5A 5D 4A B3 3B 1D D1 6B 4F 7D q.Q_..Z] J.;..kO} >+[0130] E9 54 F0 B4 AC 80 DE 27 80 C5 64 3C 0B 22 79 1C .T.....' ..d<."y. >+[0140] 9E D1 58 A1 3E 20 5A 9F E3 34 49 D8 16 C6 6B 2D ..X.> Z. .4I...k- >+[0150] 36 0E E2 C2 3F 44 DE 63 32 DB EB 78 50 A2 6F 37 6...?D.c 2..xP.o7 >+[0160] 05 2B 13 D4 31 07 D4 2A C0 53 B1 30 39 79 C3 D8 .+..1..* .S.09y.. >+[0170] C4 4C 30 97 E8 F9 DA ED 10 B0 D0 21 71 8B 56 F3 .L0..... ...!q.V. >+[0180] 0F 3A 2D 26 A2 3D AD 70 27 82 95 59 0A D7 7D 4E .:-&.=.p '..Y..}N >+[0190] 2D 76 96 4D 94 70 2A BB 26 3B 7E FC E1 59 5A 55 -v.M.p*. &;~..YZU >+[01A0] 04 A2 DA 27 AD 46 70 45 43 C0 FB C1 42 7F F0 CB ...'.FpE C...B... >+[01B0] 21 D2 CD 54 35 7C 60 13 EE BB BB 60 6B 91 2B BE !..T5|`. ...`k.+. >+[01C0] 91 8A CF 49 29 F8 60 D1 AB A5 51 B5 5E 4B B2 3A ...I).`. ..Q.^K.: >+[01D0] F4 56 3A 89 2D 88 D0 73 08 A6 FB D8 6E B3 B1 4E .V:.-..s ....n..N >+[01E0] D8 90 27 58 D2 53 40 B2 A0 3C 40 4D E9 21 C6 83 ..'X.S@. .<@M.!.. >+[01F0] FC 15 14 F0 8C 08 46 C5 29 14 E3 84 CC 2C 56 C9 ......F. )....,V. >+[0200] 20 53 45 34 D0 BE E0 CC F7 F1 15 D4 D4 B1 3C 43 SE4.... ......<C >+[0210] EB 5E 9D 33 07 B4 5B E7 D8 24 B0 EB 7B 27 24 6B .^.3..[. .$..{'$k >+[0220] 2A 90 C9 17 D9 24 CF FD 56 28 D7 73 74 03 2F DA *....$.. V(.st./. >+[0230] C4 E0 B3 78 E4 9A 60 4D 5C C7 F5 CF 9C 14 7C B6 ...x..`M \.....|. >+[0240] 1B 5D 76 D1 E3 73 73 2F 41 BD E3 E7 F0 92 B4 5B .]v..ss/ A......[ >+[0250] 07 B4 16 77 DC 3C 28 A4 92 82 C5 7C CA 00 9C 77 ...w.<(. ...|...w >+[0260] B8 28 7F D0 3F EA 2B C1 79 2B 73 FF E0 E0 A5 17 .(..?.+. y+s..... >+[0270] 02 CA 6C B6 02 D2 51 D3 CE 6F 5B 56 E0 7B 38 22 ..l...Q. .o[V.{8" >+[0280] 76 52 48 2D 0A 2F 15 58 A9 FE 03 65 E1 D5 A8 60 vRH-./.X ...e...` >+[0290] E3 5D E6 53 D8 AA 05 D0 90 61 EF B6 28 4A B9 84 .].S.... .a..(J.. >+[02A0] 56 79 80 D2 53 08 1D 17 C4 05 4E F8 04 10 2B CF Vy..S... ..N...+. >+[02B0] 08 DD 61 68 27 21 A5 8A C0 35 6A 0A 94 6D 9E FD ..ah'!.. .5j..m.. >+[02C0] C9 45 AC E3 4F 60 BB 96 AF D4 4E 71 A9 D9 BE 33 .E..O`.. ..Nq...3 >+[02D0] DC 61 8B 14 77 6C A7 72 70 02 65 62 32 9C 8E 53 .a..wl.r p.eb2..S >+[02E0] C9 A3 5B B9 14 3C 00 A2 1D C7 CD 36 5B 5F BE 40 ..[..<.. ...6[_.@ >+[02F0] 28 E2 58 0D D1 05 53 78 F0 86 0F 80 1A 6A 1D DC (.X...Sx .....j.. >+[0300] D4 CD F2 83 0E 25 E1 60 DB C7 F4 B6 05 4F 0D 11 .....%.` .....O.. >+[0310] A4 AE A5 F8 6D 14 CF DF 03 C5 27 75 75 B5 0C F1 ....m... ..'uu... >+[0320] C3 01 F9 A4 FD 2E 0B BD 51 A8 C1 3B DE 48 CF 3A ........ Q..;.H.: >+[0330] CF B3 41 23 9A 9D 0C 79 11 7C 9B D3 71 43 4E 9D ..A#...y .|..qCN. >+[0340] B5 52 19 28 2C A0 4E 0E 8D 7A 84 9A B9 A0 EB FA .R.(,.N. .z...... >+[0350] 6E A1 DF B9 2F 6B FE 5E AE 85 D1 6B A2 C5 BE 07 n.../k.^ ...k.... >+[0360] E7 D6 33 3A 0F 2B ED FB 30 6F 88 1E F9 09 CC C3 ..3:.+.. 0o...... >+[0370] 8F 59 A0 D4 8D 9F A6 08 B0 D3 ED EB 15 13 1B 8E .Y...... ........ >+[0380] 19 C6 14 9C 25 E7 E9 EF 5A 67 7B CD 86 C4 D1 51 ....%... Zg{....Q >+[0390] 2B DE 27 30 D9 F5 6E F9 E4 3E CF 42 54 AE 42 61 +.'0..n. .>.BT.Ba >+[03A0] C5 22 B7 AE 51 76 8F 12 83 7F E1 9F 97 D8 31 38 ."..Qv.. ......18 >+[03B0] A6 B9 11 B4 E1 BA 19 5B E4 A5 A3 6F 4B B3 03 93 .......[ ...oK... >+[03C0] 4C D6 1E 08 FC 94 D1 C5 7C AA 95 EB 9C 7A C2 57 L....... |....z.W >+[03D0] 60 CA 17 FF 8E 66 80 76 CB 35 46 26 C3 BD CA 83 `....f.v .5F&.... >+[03E0] F0 04 08 0D 4C 5D B2 E4 7C 1C 82 28 D7 2C 42 B1 ....L].. |..(.,B. >+[03F0] 36 72 60 5E 26 4A 79 D0 41 94 3C 2C 65 0E 32 18 6r`^&Jy. A.<,e.2. >+[0400] B8 56 26 9D D3 84 78 BB .V&...x. >+ second_ticket : DATA_BLOB length=0 >+ further_creds : DATA_BLOB length=4748 >+[0000] 00 00 00 01 00 00 00 01 00 00 00 17 4B 54 45 53 ........ ....KTES >+[0010] 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E T.SAMBA. EXAMPLE. >+[0020] 43 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 73 74 72 COM....a dministr >+[0030] 61 74 6F 72 00 00 00 01 00 00 00 02 00 00 00 17 ator.... ........ >+[0040] 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D KTEST.SA MBA.EXAM >+[0050] 50 4C 45 2E 43 4F 4D 00 00 00 04 68 6F 73 74 00 PLE.COM. ...host. >+[0060] 00 00 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 00 17 ...local ktest6.. >+[0070] 00 00 00 10 EA 0D 3A 24 41 21 F7 7D 7D A3 C5 BB ......:$ A!.}}... >+[0080] A4 88 F6 17 4D 9B 90 45 4D 9B 90 52 7D 46 4C 43 ....M..E M..R}FLC >+[0090] 00 00 00 00 00 40 28 00 00 00 00 00 00 00 00 00 .....@(. ........ >+[00A0] 00 00 00 03 FA 61 82 03 F6 30 82 03 F2 A0 03 02 .....a.. .0...... >+[00B0] 01 05 A1 19 1B 17 4B 54 45 53 54 2E 53 41 4D 42 ......KT EST.SAMB >+[00C0] 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D A2 1E 30 A.EXAMPL E.COM..0 >+[00D0] 1C A0 03 02 01 01 A1 15 30 13 1B 04 68 6F 73 74 ........ 0...host >+[00E0] 1B 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 A3 82 03 ..localk test6... >+[00F0] AE 30 82 03 AA A0 03 02 01 17 A1 03 02 01 03 A2 .0...... ........ >+[0100] 82 03 9C 04 82 03 98 44 8B C4 7D BA 9F FE 59 F6 .......D ..}...Y. >+[0110] C1 DF 62 89 02 A4 55 54 AB D6 D6 2E 8B 5E 35 3D ..b...UT .....^5= >+[0120] D9 46 9D 8B 49 93 A6 66 5F 1A 8B 81 AD 09 19 E9 .F..I..f _....... >+[0130] 59 CE 58 18 50 63 4A A6 7D 6F 71 21 51 4A 41 C2 Y.X.PcJ. }oq!QJA. >+[0140] A1 FE B0 D5 0A 3D 38 9F E5 3B 72 A2 7A 59 22 A4 .....=8. .;r.zY". >+[0150] B7 1C A3 8D DB EA 5D A5 E2 D3 1D AE 42 D0 7F 75 ......]. ....B..u >+[0160] B5 E9 ED B5 04 7B 67 1E 28 90 7D 3D 1A 3E F6 62 .....{g. (.}=.>.b >+[0170] D0 A1 56 89 28 76 5C 19 1A FD 66 E5 F2 86 E7 58 ..V.(v\. ..f....X >+[0180] 93 31 90 C5 CD F8 71 96 56 21 15 13 F0 EA C2 CC .1....q. V!...... >+[0190] 48 4C B4 50 EF F9 81 44 29 8A 75 C4 31 75 D1 BA HL.P...D ).u.1u.. >+[01A0] E2 0B 05 B2 E0 EA 64 3A 11 45 84 3D 69 55 FF E6 ......d: .E.=iU.. >+[01B0] 32 7E C9 CA C4 28 E8 40 B6 5E F9 26 0F 09 12 1F 2~...(.@ .^.&.... >+[01C0] 1F D4 9C 9A 50 E8 B7 6D F8 4F 55 6E 2A D4 AC 6A ....P..m .OUn*..j >+[01D0] 79 D1 C2 2A 88 99 F8 39 75 36 F1 2D C7 89 0A C6 y..*...9 u6.-.... >+[01E0] B4 C7 A1 7B F1 BF 22 87 A4 B2 93 22 54 A1 72 25 ...{..". ..."T.r% >+[01F0] AF 67 FE 20 D5 C8 29 47 28 FF 51 FB F9 4E 2C 17 .g. ..)G (.Q..N,. >+[0200] 10 BE 2E 13 8B 18 BE 3C A3 BE 50 49 A7 65 DD 2E .......< ..PI.e.. >+[0210] CC EB D6 0F 47 4E DB 7E 08 D5 F0 37 79 36 8F 24 ....GN.~ ...7y6.$ >+[0220] 34 28 86 89 EC A3 84 7F 44 4E 37 03 B5 D8 89 1C 4(...... DN7..... >+[0230] C7 AA AC 42 70 5F 96 73 35 8B 83 D1 16 24 27 C1 ...Bp_.s 5....$'. >+[0240] EC 0E AE 83 59 5A C2 EB C1 91 B6 3D BB 8D 21 49 ....YZ.. ...=..!I >+[0250] 63 41 3C 91 1D E9 01 C2 4F A9 E4 42 C1 FD 54 E3 cA<..... O..B..T. >+[0260] 7B 3B DF 24 3D 98 E9 84 F8 1D 8D CE 4D 85 AC 8A {;.$=... ....M... >+[0270] 12 15 48 C4 DA 1B 3C B8 FC A3 0B AF E2 4D 71 E9 ..H...<. .....Mq. >+[0280] 0A 28 53 DC 4E 6C 23 2C 73 26 50 FE 37 03 BF D1 .(S.Nl#, s&P.7... >+[0290] 5F 8A 39 4F 04 2E 4A CE 3C 90 11 0C DA 84 5C C3 _.9O..J. <.....\. >+[02A0] F8 BE C7 74 ED F4 CF 7E B2 AE 9B 47 D6 2A 1D 93 ...t...~ ...G.*.. >+[02B0] 3F A8 8B 51 E9 A3 A0 59 55 DB E3 52 67 E3 DE FF ?..Q...Y U..Rg... >+[02C0] B1 56 74 A0 87 21 99 23 8C 8E D1 92 A6 3D 93 D6 .Vt..!.# .....=.. >+[02D0] 4D 5B 84 2B B1 8D DD E4 F7 01 A6 6C 4A DF 3C 6E M[.+.... ...lJ.<n >+[02E0] A0 FA 74 93 BE 18 7C 30 29 9D B8 DB 5F D1 AA B7 ..t...|0 )..._... >+[02F0] 51 7C 2A 90 1A 8B 06 95 E1 80 0D 27 B2 6C 52 1C Q|*..... ...'.lR. >+[0300] C7 D1 E9 16 14 F1 6C 57 48 28 BD 13 B5 83 BA A7 ......lW H(...... >+[0310] 75 31 69 52 03 38 69 13 62 ED C6 DC C2 01 C8 F1 u1iR.8i. b....... >+[0320] 45 02 4D 8C 64 CF 96 90 3E C2 08 EC 2B 8D 92 93 E.M.d... >...+... >+[0330] 4B 6D 22 B3 41 DE 85 35 2D 19 09 E5 68 8E 1F 98 Km".A..5 -...h... >+[0340] 1B F2 73 F2 D4 91 08 89 42 0C 05 8B 42 77 6B CC ..s..... B...Bwk. >+[0350] 18 78 43 1A 73 C2 7C E7 C2 23 28 56 F7 A0 19 B3 .xC.s.|. .#(V.... >+[0360] 99 A6 25 4F C3 5E 70 EC 78 BB 30 15 36 77 B3 A6 ..%O.^p. x.0.6w.. >+[0370] 89 98 B6 A0 85 CC 8F E7 41 40 B5 E0 89 93 25 04 ........ A@....%. >+[0380] B8 1D 0B 06 31 1D C7 30 52 E1 64 29 8C 64 B9 89 ....1..0 R.d).d.. >+[0390] 1F 86 5A AD 74 15 1C C8 AF 37 7B 27 E0 C0 DB 73 ..Z.t... .7{'...s >+[03A0] 30 72 65 D3 C0 A5 07 61 E9 0C 07 A1 27 18 8F 50 0re....a ....'..P >+[03B0] DB CE FB 4C DD 75 98 F2 28 D2 76 FF F2 41 9F D5 ...L.u.. (.v..A.. >+[03C0] 74 22 8A 03 73 B1 A8 B3 B8 80 93 E5 E2 CD 4B F2 t"..s... ......K. >+[03D0] 6B 99 DF 5B 5B C7 22 69 81 2A 8A CD 2A F9 9D 08 k..[[."i .*..*... >+[03E0] B8 B0 40 77 D3 43 8B AF 40 DD 0C CB 45 E3 88 CB ..@w.C.. @...E... >+[03F0] 06 AA 63 38 EB DD 72 89 03 0E DC 3E 97 3F 16 D4 ..c8..r. ...>.?.. >+[0400] 1A 21 40 D8 30 BD B0 B4 04 C2 7A 22 43 15 A2 D8 .!@.0... ..z"C... >+[0410] 2F 08 28 3B 63 26 AA B3 1C B6 FC E4 0B 2A CD 0E /.(;c&.. .....*.. >+[0420] A8 7C E8 11 33 03 D3 C5 6C 35 6A 5D 3C 5A 80 1A .|..3... l5j]<Z.. >+[0430] BC 1C 54 DE 5C 6A E2 F3 A1 18 8E 47 88 8B 71 11 ..T.\j.. ...G..q. >+[0440] 09 2F 29 88 D9 BB DC 34 09 E1 2F 7E A7 E8 29 DC ./)....4 ../~..). >+[0450] F9 5A 1D 9E C8 A4 CC 52 8A E6 CB 4A 3F F9 77 F7 .Z.....R ...J?.w. >+[0460] 53 64 62 9E 5F E6 D7 F6 43 E6 9C 03 C9 55 B1 CB Sdb._... C....U.. >+[0470] 25 40 74 AA E9 AB 34 58 E1 E8 9B B3 1D 9E 83 FD %@t...4X ........ >+[0480] 7A BF DC 45 2D A8 9A F8 AF 9C 63 EF 1B 2B 9D CC z..E-... ..c..+.. >+[0490] F3 08 74 EC 6E 40 8E 18 62 BD F3 87 66 87 67 00 ..t.n@.. b...f.g. >+[04A0] 00 00 00 00 00 00 01 00 00 00 01 00 00 00 17 4B ........ .......K >+[04B0] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[04C0] 4C 45 2E 43 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 LE.COM.. ..admini >+[04D0] 73 74 72 61 74 6F 72 00 00 00 01 00 00 00 02 00 strator. ........ >+[04E0] 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 ...KTEST .SAMBA.E >+[04F0] 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 04 63 69 XAMPLE.C OM....ci >+[0500] 66 73 00 00 00 0B 6C 6F 63 61 6C 6B 74 65 73 74 fs....lo calktest >+[0510] 36 00 17 00 00 00 10 92 C6 A1 91 6D 55 01 4E BE 6....... ...mU.N. >+[0520] E4 3F E3 36 B0 D3 28 4D 9B 90 45 4D 9B 90 5A 7D .?.6..(M ..EM..Z} >+[0530] 46 4C 43 00 00 00 00 00 40 28 00 00 00 00 00 00 FLC..... @(...... >+[0540] 00 00 00 00 00 00 03 FA 61 82 03 F6 30 82 03 F2 ........ a...0... >+[0550] A0 03 02 01 05 A1 19 1B 17 4B 54 45 53 54 2E 53 ........ .KTEST.S >+[0560] 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D AMBA.EXA MPLE.COM >+[0570] A2 1E 30 1C A0 03 02 01 01 A1 15 30 13 1B 04 63 ..0..... ...0...c >+[0580] 69 66 73 1B 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 ifs..loc alktest6 >+[0590] A3 82 03 AE 30 82 03 AA A0 03 02 01 17 A1 03 02 ....0... ........ >+[05A0] 01 03 A2 82 03 9C 04 82 03 98 FE 09 00 80 36 35 ........ ......65 >+[05B0] D4 6E 71 0C 33 22 36 9E 89 88 32 E3 34 4A 4C BF .nq.3"6. ..2.4JL. >+[05C0] 80 19 81 CC A0 CB 96 DB 31 F7 2A 19 75 DE 0E DA ........ 1.*.u... >+[05D0] D0 18 FA 9E 75 E6 E4 13 C9 BE 3F C0 1B AD 5B 98 ....u... ..?...[. >+[05E0] E9 FC A3 9D 16 FF C8 91 03 AC 8B E6 2D 15 B3 F1 ........ ....-... >+[05F0] 23 4E 25 9E 45 3A F8 8A 19 B7 71 52 A6 92 1C FB #N%.E:.. ..qR.... >+[0600] 1F D4 4C 51 AF 9C 0E 73 D9 A8 D8 43 F2 64 71 BC ..LQ...s ...C.dq. >+[0610] AD B1 7B 8F BF 8D FF 72 89 0F 5E B6 C2 E3 C0 01 ..{....r ..^..... >+[0620] 98 41 AD 3F 6E DC 87 F5 9A E6 40 0C 17 0F 75 80 .A.?n... ..@...u. >+[0630] 0C 28 62 06 EB BF F8 69 8C 43 48 38 A8 AE F2 5E .(b....i .CH8...^ >+[0640] 45 11 23 FB 6B 85 83 54 BA 60 39 CE 08 00 D1 05 E.#.k..T .`9..... >+[0650] 5F 6F 79 96 30 28 06 DD C7 75 52 8E 3C C4 3F FC _oy.0(.. .uR.<.?. >+[0660] C1 31 28 2C 64 3B D1 7E 2F C2 DB B0 E8 A8 EF C5 .1(,d;.~ /....... >+[0670] F2 DC 43 D0 14 21 C8 D0 D3 15 45 8E 2A 3E 3B 4A ..C..!.. ..E.*>;J >+[0680] 60 25 3D 11 E4 F9 16 02 3E 55 8F CE D2 E9 95 E7 `%=..... >U...... >+[0690] B1 C4 8F C4 0B 3E 3C 14 15 28 1A 21 49 15 CE 8E .....><. .(.!I... >+[06A0] 91 5E 98 71 00 1F 29 D3 12 C8 D0 11 4F E7 14 E3 .^.q..). ....O... >+[06B0] 72 1B 61 6D 7B 8A 00 A6 5E 01 01 50 C2 CF 1A A9 r.am{... ^..P.... >+[06C0] 34 8C BA 33 9E 62 C5 69 97 6A 24 3D E0 C6 3F C6 4..3.b.i .j$=..?. >+[06D0] F4 36 B1 80 D6 5C 44 19 5B 65 C7 CA 47 DE 4B 65 .6...\D. [e..G.Ke >+[06E0] 41 29 9F F8 EA E8 E0 3B E2 C6 98 9D 58 A4 6C 62 A).....; ....X.lb >+[06F0] EF 25 12 C9 0E 97 CE 9D F0 D8 08 AD 13 73 A6 82 .%...... .....s.. >+[0700] C5 54 23 F4 A4 CB 91 35 91 BD 10 B4 04 DD 55 7E .T#....5 ......U~ >+[0710] C9 DE AE CB B0 8F C0 D8 28 AE BD 78 64 91 6C AB ........ (..xd.l. >+[0720] CA 36 EA 0E 0E 97 DC 40 ED 26 1D 09 17 28 30 D3 .6.....@ .&...(0. >+[0730] 78 DC F7 D2 9C 78 DA 6F 6F 57 00 B3 FD 8E 75 A1 x....x.o oW....u. >+[0740] 56 98 5C 4B D8 61 A6 0A 89 27 CD 11 BF 7F 79 53 V.\K.a.. .'....yS >+[0750] D9 50 9A 8D EC DD DB BB B8 23 27 0D 20 5B 53 51 .P...... .#'. [SQ >+[0760] 07 C4 26 31 3B D4 DF ED 3C 40 B4 1C 8B 46 E2 A6 ..&1;... <@...F.. >+[0770] B7 0F 97 D2 B3 1D 19 FD 13 60 7B 38 E6 37 0C 59 ........ .`{8.7.Y >+[0780] B0 A8 47 5D 32 A5 0C 57 76 EF 2C ED 40 9F BF 4B ..G]2..W v.,.@..K >+[0790] 43 99 3C 68 C4 DE 84 9C A1 36 8C CA CB 2A 08 36 C.<h.... .6...*.6 >+[07A0] 4E CD 43 06 9E F8 E7 1D 52 3B 59 37 4F 6F 65 D9 N.C..... R;Y7Ooe. >+[07B0] 2A F9 AD 5A 50 95 71 3F B1 5F C8 8E 2E E9 E4 FE *..ZP.q? ._...... >+[07C0] C8 A9 42 2C EE 18 E0 81 3C 00 E2 80 8D 8A 8B 71 ..B,.... <......q >+[07D0] C7 F5 AC 5C 36 1D E0 BC F0 11 57 67 CB 2C BE F6 ...\6... ..Wg.,.. >+[07E0] 90 4E F9 90 97 14 1F 0C 9D 5D 4D DF 0D D0 C0 C5 .N...... .]M..... >+[07F0] 08 E7 31 72 8E 35 63 17 8D 8B 3D 49 14 C8 A5 90 ..1r.5c. ..=I.... >+[0800] 88 24 AF 75 CA 0A CB 95 8A 2C 70 A6 CE 2F 3F B6 .$.u.... .,p../?. >+[0810] D7 1A 44 AC 05 93 EF 3D 03 C7 C2 8E 0F 31 9F 53 ..D....= .....1.S >+[0820] 67 CA 73 D3 B8 07 76 36 35 6F B5 32 30 38 86 7E g.s...v6 5o.208.~ >+[0830] 7E 95 3F DC F4 6F A9 67 0E 15 E8 4A CA 3F 18 0E ~.?..o.g ...J.?.. >+[0840] C6 E7 20 22 6B F1 39 6A 9C A6 47 64 81 E4 CB A8 .. "k.9j ..Gd.... >+[0850] 31 FF E2 97 13 41 89 45 79 53 2B A8 90 97 DE 7B 1....A.E yS+....{ >+[0860] 18 56 95 02 2A 94 D2 7E 5C D0 A0 BC A0 38 D2 BC .V..*..~ \....8.. >+[0870] 03 91 F7 35 FE 1A 5E 80 10 13 4E 83 CB F6 D7 8A ...5..^. ..N..... >+[0880] 02 A2 E8 1F D8 9B F1 76 F9 18 66 56 9C 4D 9E BF .......v ..fV.M.. >+[0890] 1D F4 66 86 E0 7B 88 EC 9C F7 50 13 7D 34 8A 54 ..f..{.. ..P.}4.T >+[08A0] 7A E1 EC F6 44 12 47 84 7D 16 B4 42 25 E5 A2 CC z...D.G. }..B%... >+[08B0] D8 CA 7A 38 21 85 A3 F8 41 6D 0D AC 1D FA 36 5D ..z8!... Am....6] >+[08C0] 23 EA 20 CC 43 A5 7E D9 25 97 BC 0E 74 F5 3D 98 #. .C.~. %...t.=. >+[08D0] B9 79 C2 65 50 0E 8D E7 7A F3 F3 88 37 A3 40 01 .y.eP... z...7.@. >+[08E0] 96 C6 FC 1D 6E 9E 06 A1 90 A0 78 3C DA 7F E9 C6 ....n... ..x<.... >+[08F0] 23 47 70 04 03 EE C2 4A C3 95 07 44 00 BD 29 2A #Gp....J ...D..)* >+[0900] B5 FA 17 1E D6 BC 00 A0 93 55 E0 82 0A AB 04 D4 ........ .U...... >+[0910] D5 56 84 2A B2 56 51 05 DB 30 E2 83 5A 75 D3 A8 .V.*.VQ. .0..Zu.. >+[0920] 30 B7 3E C4 25 70 A8 34 E4 A2 EB 3E FB D8 2D 10 0.>.%p.4 ...>..-. >+[0930] 72 8E DA 4D 2D 55 EC 49 66 5E 01 96 E4 C1 0C 23 r..M-U.I f^.....# >+[0940] 57 91 00 00 00 00 00 00 00 01 00 00 00 01 00 00 W....... ........ >+[0950] 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 ..KTEST. SAMBA.EX >+[0960] 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D 61 64 6D AMPLE.CO M....adm >+[0970] 69 6E 69 73 74 72 61 74 6F 72 00 00 00 01 00 00 inistrat or...... >+[0980] 00 02 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 ......KT EST.SAMB >+[0990] 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 A.EXAMPL E.COM... >+[09A0] 04 68 6F 73 74 00 00 00 0B 4C 4F 43 41 4C 4B 54 .host... .LOCALKT >+[09B0] 45 53 54 36 00 17 00 00 00 10 9D AE 06 BE 29 E0 EST6.... ......). >+[09C0] F7 9A 46 97 29 E0 69 8E 5A F0 4D 9B 90 45 4D 9B ..F.).i. Z.M..EM. >+[09D0] 90 61 7D 46 4C 43 00 00 00 00 00 40 28 00 00 00 .a}FLC.. ...@(... >+[09E0] 00 00 00 00 00 00 00 00 00 03 FA 61 82 03 F6 30 ........ ...a...0 >+[09F0] 82 03 F2 A0 03 02 01 05 A1 19 1B 17 4B 54 45 53 ........ ....KTES >+[0A00] 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E T.SAMBA. EXAMPLE. >+[0A10] 43 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 15 30 13 COM..0.. ......0. >+[0A20] 1B 04 68 6F 73 74 1B 0B 4C 4F 43 41 4C 4B 54 45 ..host.. LOCALKTE >+[0A30] 53 54 36 A3 82 03 AE 30 82 03 AA A0 03 02 01 17 ST6....0 ........ >+[0A40] A1 03 02 01 03 A2 82 03 9C 04 82 03 98 B9 C5 6E ........ .......n >+[0A50] 77 F9 59 6D 19 F0 A6 56 2F 14 B3 9A A3 17 06 A6 w.Ym...V /....... >+[0A60] AD F5 92 38 6A 1E EA 3D 53 BF 5E 95 13 FF 5D BB ...8j..= S.^...]. >+[0A70] 43 4F 51 AE FB 12 3B 06 67 36 91 B9 E0 C4 C4 F3 COQ...;. g6...... >+[0A80] 45 A0 48 E6 DC 49 E8 EA 6F 55 D2 3F 79 57 54 FF E.H..I.. oU.?yWT. >+[0A90] 10 8D 89 4A A4 E2 B2 80 FD EE 36 C5 D5 4C D0 97 ...J.... ..6..L.. >+[0AA0] B3 EC 96 8B E8 5A 05 F0 13 39 8B 1B B3 C4 32 2A .....Z.. .9....2* >+[0AB0] 9B BB EF 06 C4 1C 53 2F 0A F6 A8 C6 BE 09 57 26 ......S/ ......W& >+[0AC0] B9 39 7B 7B 50 13 2D 6C 52 FF C4 B5 83 28 A8 47 .9{{P.-l R....(.G >+[0AD0] 5A CD 1C DD A7 65 FD 8A 84 2A 10 E7 44 E6 83 E7 Z....e.. .*..D... >+[0AE0] E7 AA B8 E5 0A 8B 7E E1 87 7B 3D C4 9F 68 BD 19 ......~. .{=..h.. >+[0AF0] 2B 59 5E 5A 45 0D B5 71 CC A6 C7 03 3C B3 17 D3 +Y^ZE..q ....<... >+[0B00] AF 99 F6 A2 52 A0 99 F7 39 56 B4 33 B4 C5 F4 CC ....R... 9V.3.... >+[0B10] 74 34 4C 00 76 26 10 D1 3A 87 6E 6A 52 9B 7A BF t4L.v&.. :.njR.z. >+[0B20] 4E 59 36 32 C5 41 29 CF E1 BF 14 E0 54 BF 4A 25 NY62.A). ....T.J% >+[0B30] 1F 0B 6E 9A 8C 0E 5D 47 A9 64 1B A4 9D 99 A9 09 ..n...]G .d...... >+[0B40] 39 14 E7 41 22 98 8C 62 CC E2 B5 91 8E C1 31 EB 9..A"..b ......1. >+[0B50] B2 70 A6 3B 86 FC DD 19 0B 3F 5D C9 B5 1A 95 73 .p.;.... .?]....s >+[0B60] EB 97 89 BE 14 87 85 17 BE 40 F6 80 14 23 4D 66 ........ .@...#Mf >+[0B70] E4 B0 E5 51 46 34 DA 1C C8 CB FF C6 84 A3 DF D2 ...QF4.. ........ >+[0B80] DC 00 AF 7B 27 C8 78 44 CB 6E 7B CC 5C 94 1E 7A ...{'.xD .n{.\..z >+[0B90] 95 29 19 F4 14 BE 5C 23 C3 B9 A4 2C 5D 4D F3 61 .)....\# ...,]M.a >+[0BA0] 63 1F D4 FE 37 EE 44 14 06 B7 14 50 B6 74 37 75 c...7.D. ...P.t7u >+[0BB0] 2C AB 06 F0 93 F9 93 34 75 63 44 7E 12 48 D1 F1 ,......4 ucD~.H.. >+[0BC0] 06 55 14 11 B9 23 43 CE 01 16 3E 6B A3 BD 23 55 .U...#C. ..>k..#U >+[0BD0] DE 48 5D AF E1 2B 89 E8 E7 C2 E2 34 25 A2 09 4A .H]..+.. ...4%..J >+[0BE0] 1F BE 05 AA DE 4B 08 65 27 4C 9B C7 54 96 C2 FB .....K.e 'L..T... >+[0BF0] E2 CE 53 4A 32 93 8D 0B 44 77 8C D3 65 54 F9 0E ..SJ2... Dw..eT.. >+[0C00] 7F 74 1E FE 3D 74 83 0F 2F E7 9F BC A2 B0 2B 25 .t..=t.. /.....+% >+[0C10] BB D2 6F A8 49 C1 3E 9E B5 93 67 74 39 A4 FE 84 ..o.I.>. ..gt9... >+[0C20] 4C 45 5F 30 74 E0 CA 5F F6 46 EC 89 B5 2D C8 14 LE_0t.._ .F...-.. >+[0C30] 69 76 BC 93 15 F4 60 30 5F AB EB 02 DD 12 4C 62 iv....`0 _.....Lb >+[0C40] F9 73 F7 01 E1 7F 2A 6F 09 05 BF 3A 3A 7E 69 A3 .s....*o ...::~i. >+[0C50] 7B FC 20 2B D6 CE C0 74 4F BB 29 E4 BE CE 04 9D {. +...t O.)..... >+[0C60] 24 D4 98 4A ED 94 A8 81 CD 26 A0 63 EA 09 57 42 $..J.... .&.c..WB >+[0C70] 26 B7 B5 4E B5 CB 45 35 A7 84 D8 74 CA C3 9F FF &..N..E5 ...t.... >+[0C80] C8 1E 2A 75 34 01 C5 A7 B4 9D 6F A3 E1 BB 2B F8 ..*u4... ..o...+. >+[0C90] F0 21 D6 77 57 74 2E 80 DB 76 53 01 86 33 17 32 .!.wWt.. .vS..3.2 >+[0CA0] 2E 16 E1 8D 89 3A B2 67 ED A3 ED 39 82 87 26 A6 .....:.g ...9..&. >+[0CB0] DB CE 59 84 E4 0A A6 CA 7E 07 98 F7 02 91 6E 56 ..Y..... ~.....nV >+[0CC0] 9F 60 03 D3 88 B0 FF EB 20 CA 9E 5B 37 26 67 00 .`...... ..[7&g. >+[0CD0] CC BD 9D 53 15 31 53 14 FD 9C E1 28 08 CB C4 0B ...S.1S. ...(.... >+[0CE0] E3 50 D9 DB 0C E2 E4 F9 44 50 E9 28 6E 01 96 AA .P...... DP.(n... >+[0CF0] C1 D2 4E B2 DE 38 A2 F8 94 32 79 AE 49 64 FB 57 ..N..8.. .2y.Id.W >+[0D00] 50 F6 73 E8 98 43 C6 DD 67 3C 91 AC 97 C9 2E 8C P.s..C.. g<...... >+[0D10] 06 59 A1 FC 49 EC 2F BF 6F 64 21 63 ED C8 6C CE .Y..I./. od!c..l. >+[0D20] 37 28 7B 80 7F 5F 85 F6 98 93 C0 66 A8 D6 F1 2C 7({.._.. ...f..., >+[0D30] D8 01 68 B1 C8 EA 82 0D 5B 9B 35 4F 3D B3 47 19 ..h..... [.5O=.G. >+[0D40] 54 7A C6 9F AD D7 54 CF B0 DB 3E 18 BA 2A 39 08 Tz....T. ..>..*9. >+[0D50] 0C C4 98 4B 43 DE 53 68 25 B1 83 93 1D E1 6C BF ...KC.Sh %.....l. >+[0D60] F5 B4 A9 83 17 34 64 8C 2F 91 80 97 4A 48 EC 90 .....4d. /...JH.. >+[0D70] BB FA 92 2C 01 80 E4 99 91 0E 67 88 D5 75 AB 7C ...,.... ..g..u.| >+[0D80] 98 59 98 45 C9 11 A9 8C 02 98 91 DE AB A0 FF 45 .Y.E.... .......E >+[0D90] 11 66 6F C5 DE 61 6D C6 DB C9 CA A3 A0 2B B1 73 .fo..am. .....+.s >+[0DA0] 05 85 37 BF AB CA 43 7A 6F 38 C8 BE ED CE 12 49 ..7...Cz o8.....I >+[0DB0] 93 C7 7C 1A 33 60 52 7A 67 67 AA 60 57 7E C8 FF ..|.3`Rz gg.`W~.. >+[0DC0] DF 91 91 18 45 74 C0 9E 36 19 BC 42 F9 46 CC 84 ....Et.. 6..B.F.. >+[0DD0] 09 2E 8C 59 1A E3 65 51 F4 87 6F 4C 3E 29 38 E6 ...Y..eQ ..oL>)8. >+[0DE0] 77 E8 A9 B7 FA 00 00 00 00 00 00 00 01 00 00 00 w....... ........ >+[0DF0] 01 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 .....KTE ST.SAMBA >+[0E00] 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D .EXAMPLE .COM.... >+[0E10] 61 64 6D 69 6E 69 73 74 72 61 74 6F 72 00 00 00 administ rator... >+[0E20] 01 00 00 00 02 00 00 00 17 4B 54 45 53 54 2E 53 ........ .KTEST.S >+[0E30] 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D AMBA.EXA MPLE.COM >+[0E40] 00 00 00 04 63 69 66 73 00 00 00 0B 4C 4F 43 41 ....cifs ....LOCA >+[0E50] 4C 4B 54 45 53 54 36 00 17 00 00 00 10 01 78 D0 LKTEST6. ......x. >+[0E60] 3B 9B FF F0 88 86 4B 3B FE 41 A9 6B 00 4D 9B 90 ;.....K; .A.k.M.. >+[0E70] 45 4D 9B 90 6B 7D 46 4C 43 00 00 00 00 00 40 28 EM..k}FL C.....@( >+[0E80] 00 00 00 00 00 00 00 00 00 00 00 00 03 FA 61 82 ........ ......a. >+[0E90] 03 F6 30 82 03 F2 A0 03 02 01 05 A1 19 1B 17 4B ..0..... .......K >+[0EA0] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[0EB0] 4C 45 2E 43 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 LE.COM.. 0....... >+[0EC0] 15 30 13 1B 04 63 69 66 73 1B 0B 4C 4F 43 41 4C .0...cif s..LOCAL >+[0ED0] 4B 54 45 53 54 36 A3 82 03 AE 30 82 03 AA A0 03 KTEST6.. ..0..... >+[0EE0] 02 01 17 A1 03 02 01 03 A2 82 03 9C 04 82 03 98 ........ ........ >+[0EF0] CA EA 4D 46 2D D1 E9 58 5D 25 8D 9F DF EA C9 01 ..MF-..X ]%...... >+[0F00] B6 08 27 CD 14 85 02 DC 20 C6 51 AA F9 6A B1 CE ..'..... .Q..j.. >+[0F10] F5 77 84 BF 9A AC 6B A7 B2 F2 1F 60 BF CB C6 FC .w....k. ...`.... >+[0F20] C7 14 B7 41 1C A8 C9 70 7B 86 BC 8E 70 2B 65 4B ...A...p {...p+eK >+[0F30] DC F5 B9 23 F8 08 BF 96 C9 A8 77 F4 54 67 25 F8 ...#.... ..w.Tg%. >+[0F40] 0F A8 C5 D6 D1 BB 46 5E A0 7E D2 98 9C CD AF E0 ......F^ .~...... >+[0F50] 82 62 ED 39 D2 FB F2 E8 9B 1B EE E5 B4 1B C9 0A .b.9.... ........ >+[0F60] 86 27 52 6E 11 8B D7 AD B4 54 F9 C6 69 8D E0 F1 .'Rn.... .T..i... >+[0F70] CD 63 1C 89 7C 8F B6 A0 71 53 A6 DA B1 66 D2 9D .c..|... qS...f.. >+[0F80] D3 4C A8 FB C6 9D 81 74 10 8E 84 D2 3D D8 1C BE .L.....t ....=... >+[0F90] BB 3F F7 BF 91 3E 89 66 43 A1 E0 90 1B 1A 97 FF .?...>.f C....... >+[0FA0] EF CC 35 75 14 62 4F 67 3A 29 F4 F9 C5 2E BE C5 ..5u.bOg :)...... >+[0FB0] C2 2B A8 35 22 D9 92 31 1D 49 2A A5 19 AA 08 0F .+.5"..1 .I*..... >+[0FC0] A8 22 0B 68 D2 A2 D7 07 7B 37 1E A3 AC 9B 4F 0A .".h.... {7....O. >+[0FD0] A4 FA 7F 37 6F 3E 35 79 4E 00 4B B6 28 A3 6A E4 ...7o>5y N.K.(.j. >+[0FE0] 0C 95 53 BA E8 41 07 DA BE E9 08 B9 51 24 91 49 ..S..A.. ....Q$.I >+[0FF0] 78 5D 44 12 BC 85 63 81 B8 E0 88 D5 95 0C D3 A8 x]D...c. ........ >+[1000] 1D 32 4B E4 A0 C8 A7 7D 3C 97 EE D8 59 AC 3A 21 .2K....} <...Y.:! >+[1010] 09 F2 7A CC D0 4A F3 50 10 DC FC 26 BB C2 6A 8E ..z..J.P ...&..j. >+[1020] 8B 14 2B 2D 50 2E B3 1E 9B D2 69 56 22 F2 48 BD ..+-P... ..iV".H. >+[1030] E9 2E 2F 28 DE 77 67 5F 68 AA 29 05 4B 36 58 40 ../(.wg_ h.).K6X@ >+[1040] E5 54 11 C5 4D 68 96 49 9D 53 37 87 5F D2 3A 9B .T..Mh.I .S7._.:. >+[1050] E9 8E 79 BE AE 11 B4 6B AB FD DB 8A F5 A0 9B 29 ..y....k .......) >+[1060] D9 F5 ED CA FA 3F FE 35 FC F4 69 7E E4 D0 44 29 .....?.5 ..i~..D) >+[1070] 48 FF 82 61 26 FC D3 E2 10 EE 14 F7 4A E3 CD F2 H..a&... ....J... >+[1080] 8B BC 8B 43 64 2C DE 40 6E BB E1 56 C0 B6 2C D0 ...Cd,.@ n..V..,. >+[1090] E5 1E E9 B3 FB 38 48 66 ED AF D2 25 D1 35 5C C6 .....8Hf ...%.5\. >+[10A0] F0 4D 36 19 0B EC 33 07 34 D0 27 8D 14 DC 01 45 .M6...3. 4.'....E >+[10B0] DE F8 73 A6 A0 F4 C1 91 9D BD 05 E3 70 25 E1 10 ..s..... ....p%.. >+[10C0] 44 F6 4B 46 F7 24 84 BF 20 96 AD 6A 96 94 81 58 D.KF.$.. ..j...X >+[10D0] 80 95 06 92 F5 7F 17 39 3B 32 47 B2 C5 CE 7B 73 .......9 ;2G...{s >+[10E0] CF 53 AE FA D1 9A 60 5A 98 EC 8C FA BD C0 CE 8D .S....`Z ........ >+[10F0] C5 27 E6 17 1A 4D 47 D8 3F 5D A9 7C FB 2C B3 05 .'...MG. ?].|.,.. >+[1100] 0C 69 20 48 99 80 11 DC 48 AB A7 EA 5B 98 C1 15 .i H.... H...[... >+[1110] 27 AE FA 3E 1E 1E E0 E1 F8 32 C0 54 13 D6 30 34 '..>.... .2.T..04 >+[1120] 71 98 26 61 6C 1C C4 C7 4E C4 A6 7E FE A8 B8 89 q.&al... N..~.... >+[1130] 2A 70 3C 19 58 8D 57 45 55 83 0A C2 B5 F7 89 0E *p<.X.WE U....... >+[1140] 7B 7A 17 0C CF 6E 08 A5 F7 21 4A 62 81 4F 49 CA {z...n.. .!Jb.OI. >+[1150] E2 ED C2 B4 C7 33 5C BC A1 A0 DE 4E 09 37 BE 24 .....3\. ...N.7.$ >+[1160] 62 22 94 55 75 AA 53 DE E0 74 5A B0 B8 E9 BF 2B b".Uu.S. .tZ....+ >+[1170] 12 65 2F 90 6B 84 ED 11 AD F7 CE 19 A1 96 E4 1E .e/.k... ........ >+[1180] 8C EA C8 81 1B 47 4F 5F B1 5D A5 8B E3 0D 5A 80 .....GO_ .]....Z. >+[1190] 89 EC 4B D9 CE ED E8 67 7F 96 FC 1B EF 65 C2 68 ..K....g .....e.h >+[11A0] 40 F7 20 36 83 58 62 F4 CA 02 F4 5C 0D 46 B1 CB @. 6.Xb. ...\.F.. >+[11B0] 50 D2 D8 3D B7 9A 96 48 8C CF EB E6 8C F4 B2 B4 P..=...H ........ >+[11C0] 47 C9 34 C9 DC 14 F1 33 1B 6F 9E 65 27 D7 9D 46 G.4....3 .o.e'..F >+[11D0] 1E 91 FF 2E FB 8E 97 5D 17 8F 48 54 7C 3C A0 11 .......] ..HT|<.. >+[11E0] 9C AA 77 E9 79 DE 26 D1 F0 7C EA 24 73 BE EC 60 ..w.y.&. .|.$s..` >+[11F0] B4 EE BD ED 0D 0A AB 74 60 6E 46 C0 35 5B 65 1A .......t `nF.5[e. >+[1200] A4 4A 5C 22 AC B9 CD B7 56 06 88 09 FC 48 68 55 .J\".... V....HhU >+[1210] B7 5E 39 72 DF 8A 4C CD 79 74 B0 84 0B 78 DA B2 .^9r..L. yt...x.. >+[1220] 55 F8 06 0B 5C 27 06 B3 CA 10 65 6B 04 A3 64 11 U...\'.. ..ek..d. >+[1230] 04 09 DC DF 67 00 70 B1 16 DF 24 E9 27 85 11 91 ....g.p. ..$.'... >+[1240] 31 CB 92 95 50 18 91 08 C2 A1 A3 76 C7 1A FC 64 1...P... ...v...d >+[1250] 9E 2C 3A E7 30 F4 16 0D A0 56 C0 BC D2 FE 2D A0 .,:.0... .V....-. >+[1260] 20 A4 E2 82 AD F0 C5 12 71 09 23 E1 66 52 53 D0 ....... q.#.fRS. >+[1270] 89 30 E7 BE B7 C2 89 F2 1C 7A F6 8E D7 28 F0 A4 .0...... .z...(.. >+[1280] 33 46 7C A2 79 66 DE 26 00 00 00 00 3F|.yf.& .... >+push returned Success >+pull returned Success >+ CCACHE: struct CCACHE >+ pvno : 0x05 (5) >+ version : 0x04 (4) >+ optional_header : union OPTIONAL_HEADER(case 0x4) >+ v4header: struct V4HEADER >+ v4tags: struct V4TAGS >+ tag: struct V4TAG >+ tag : 0x0001 (1) >+ field : union FIELD(case 0x1) >+ deltatime_tag: struct DELTATIME_TAG >+ kdc_sec_offset : 0 >+ kdc_usec_offset : 0 >+ further_tags : DATA_BLOB length=0 >+ principal: struct PRINCIPAL >+ name_type : 0x00000001 (1) >+ component_count : 0x00000001 (1) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(1) >+ components : 'administrator' >+ cred: struct CREDENTIAL >+ client: struct PRINCIPAL >+ name_type : 0x00000001 (1) >+ component_count : 0x00000001 (1) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(1) >+ components : 'administrator' >+ server: struct PRINCIPAL >+ name_type : 0x00000000 (0) >+ component_count : 0x00000002 (2) >+ realm : 'KTEST.SAMBA.EXAMPLE.COM' >+ components: ARRAY(2) >+ components : 'krbtgt' >+ components : 'KTEST.SAMBA.EXAMPLE.COM' >+ keyblock: struct KEYBLOCK >+ enctype : 0x0017 (23) >+ data : DATA_BLOB length=16 >+[0000] E5 E4 15 C8 A8 0F 4D 95 F9 1B E3 B9 98 CA A1 7F ......M. ........ >+ authtime : 0x4d9b9045 (1302040645) >+ starttime : 0x4d9b9045 (1302040645) >+ endtime : 0x7d464c43 (2101759043) >+ renew_till : 0x7d464c43 (2101759043) >+ is_skey : 0x00 (0) >+ ticket_flags : 0x40e00000 (1088421888) >+ addresses: struct ADDRESSES >+ count : 0x00000000 (0) >+ data: ARRAY(0) >+ authdata: struct AUTHDATA >+ count : 0x00000000 (0) >+ data: ARRAY(0) >+ ticket : DATA_BLOB length=1032 >+[0000] 61 82 04 04 30 82 04 00 A0 03 02 01 05 A1 19 1B a...0... ........ >+[0010] 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 .KTEST.S AMBA.EXA >+[0020] 4D 50 4C 45 2E 43 4F 4D A2 2C 30 2A A0 03 02 01 MPLE.COM .,0*.... >+[0030] 00 A1 23 30 21 1B 06 6B 72 62 74 67 74 1B 17 4B ..#0!..k rbtgt..K >+[0040] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[0050] 4C 45 2E 43 4F 4D A3 82 03 AE 30 82 03 AA A0 03 LE.COM.. ..0..... >+[0060] 02 01 17 A1 03 02 01 01 A2 82 03 9C 04 82 03 98 ........ ........ >+[0070] 01 40 48 A6 B8 F0 DA 43 54 A5 18 CF B0 15 CB 68 .@H....C T......h >+[0080] 9F A0 69 44 87 A9 FF 06 25 B9 29 48 59 64 26 48 ..iD.... %.)HYd&H >+[0090] 96 7C 46 6A 79 E5 F0 77 DB 46 6C 20 A1 59 D9 F8 .|Fjy..w .Fl .Y.. >+[00A0] 6A 8A 2D B5 D9 EF A4 54 DE 19 20 C0 7B 93 D4 3D j.-....T .. .{..= >+[00B0] ED 72 35 AF 9D 87 75 9E 44 01 A4 6C D9 EA 94 A3 .r5...u. D..l.... >+[00C0] 18 C6 42 75 E3 0A 0C 76 9A AE 75 BC A3 02 91 BC ..Bu...v ..u..... >+[00D0] 2D BB 3C 23 73 A6 1A A7 8A 3E 85 42 5D 1F 5D 7D -.<#s... .>.B].]} >+[00E0] 0B 1F C3 88 2A 93 40 F9 E9 18 7D 3F 73 DA AC 1F ....*.@. ..}?s... >+[00F0] E7 7B C3 B8 14 56 C3 63 86 5B AF C9 C3 21 9F 94 .{...V.c .[...!.. >+[0100] B4 67 06 60 7F 56 2D F4 C7 22 CD B4 1C 14 B7 5B .g.`.V-. .".....[ >+[0110] 26 67 9D 18 28 B5 5D C2 FC 13 B6 CA 9F AB CD 32 &g..(.]. .......2 >+[0120] 71 D5 51 5F A2 11 5A 5D 4A B3 3B 1D D1 6B 4F 7D q.Q_..Z] J.;..kO} >+[0130] E9 54 F0 B4 AC 80 DE 27 80 C5 64 3C 0B 22 79 1C .T.....' ..d<."y. >+[0140] 9E D1 58 A1 3E 20 5A 9F E3 34 49 D8 16 C6 6B 2D ..X.> Z. .4I...k- >+[0150] 36 0E E2 C2 3F 44 DE 63 32 DB EB 78 50 A2 6F 37 6...?D.c 2..xP.o7 >+[0160] 05 2B 13 D4 31 07 D4 2A C0 53 B1 30 39 79 C3 D8 .+..1..* .S.09y.. >+[0170] C4 4C 30 97 E8 F9 DA ED 10 B0 D0 21 71 8B 56 F3 .L0..... ...!q.V. >+[0180] 0F 3A 2D 26 A2 3D AD 70 27 82 95 59 0A D7 7D 4E .:-&.=.p '..Y..}N >+[0190] 2D 76 96 4D 94 70 2A BB 26 3B 7E FC E1 59 5A 55 -v.M.p*. &;~..YZU >+[01A0] 04 A2 DA 27 AD 46 70 45 43 C0 FB C1 42 7F F0 CB ...'.FpE C...B... >+[01B0] 21 D2 CD 54 35 7C 60 13 EE BB BB 60 6B 91 2B BE !..T5|`. ...`k.+. >+[01C0] 91 8A CF 49 29 F8 60 D1 AB A5 51 B5 5E 4B B2 3A ...I).`. ..Q.^K.: >+[01D0] F4 56 3A 89 2D 88 D0 73 08 A6 FB D8 6E B3 B1 4E .V:.-..s ....n..N >+[01E0] D8 90 27 58 D2 53 40 B2 A0 3C 40 4D E9 21 C6 83 ..'X.S@. .<@M.!.. >+[01F0] FC 15 14 F0 8C 08 46 C5 29 14 E3 84 CC 2C 56 C9 ......F. )....,V. >+[0200] 20 53 45 34 D0 BE E0 CC F7 F1 15 D4 D4 B1 3C 43 SE4.... ......<C >+[0210] EB 5E 9D 33 07 B4 5B E7 D8 24 B0 EB 7B 27 24 6B .^.3..[. .$..{'$k >+[0220] 2A 90 C9 17 D9 24 CF FD 56 28 D7 73 74 03 2F DA *....$.. V(.st./. >+[0230] C4 E0 B3 78 E4 9A 60 4D 5C C7 F5 CF 9C 14 7C B6 ...x..`M \.....|. >+[0240] 1B 5D 76 D1 E3 73 73 2F 41 BD E3 E7 F0 92 B4 5B .]v..ss/ A......[ >+[0250] 07 B4 16 77 DC 3C 28 A4 92 82 C5 7C CA 00 9C 77 ...w.<(. ...|...w >+[0260] B8 28 7F D0 3F EA 2B C1 79 2B 73 FF E0 E0 A5 17 .(..?.+. y+s..... >+[0270] 02 CA 6C B6 02 D2 51 D3 CE 6F 5B 56 E0 7B 38 22 ..l...Q. .o[V.{8" >+[0280] 76 52 48 2D 0A 2F 15 58 A9 FE 03 65 E1 D5 A8 60 vRH-./.X ...e...` >+[0290] E3 5D E6 53 D8 AA 05 D0 90 61 EF B6 28 4A B9 84 .].S.... .a..(J.. >+[02A0] 56 79 80 D2 53 08 1D 17 C4 05 4E F8 04 10 2B CF Vy..S... ..N...+. >+[02B0] 08 DD 61 68 27 21 A5 8A C0 35 6A 0A 94 6D 9E FD ..ah'!.. .5j..m.. >+[02C0] C9 45 AC E3 4F 60 BB 96 AF D4 4E 71 A9 D9 BE 33 .E..O`.. ..Nq...3 >+[02D0] DC 61 8B 14 77 6C A7 72 70 02 65 62 32 9C 8E 53 .a..wl.r p.eb2..S >+[02E0] C9 A3 5B B9 14 3C 00 A2 1D C7 CD 36 5B 5F BE 40 ..[..<.. ...6[_.@ >+[02F0] 28 E2 58 0D D1 05 53 78 F0 86 0F 80 1A 6A 1D DC (.X...Sx .....j.. >+[0300] D4 CD F2 83 0E 25 E1 60 DB C7 F4 B6 05 4F 0D 11 .....%.` .....O.. >+[0310] A4 AE A5 F8 6D 14 CF DF 03 C5 27 75 75 B5 0C F1 ....m... ..'uu... >+[0320] C3 01 F9 A4 FD 2E 0B BD 51 A8 C1 3B DE 48 CF 3A ........ Q..;.H.: >+[0330] CF B3 41 23 9A 9D 0C 79 11 7C 9B D3 71 43 4E 9D ..A#...y .|..qCN. >+[0340] B5 52 19 28 2C A0 4E 0E 8D 7A 84 9A B9 A0 EB FA .R.(,.N. .z...... >+[0350] 6E A1 DF B9 2F 6B FE 5E AE 85 D1 6B A2 C5 BE 07 n.../k.^ ...k.... >+[0360] E7 D6 33 3A 0F 2B ED FB 30 6F 88 1E F9 09 CC C3 ..3:.+.. 0o...... >+[0370] 8F 59 A0 D4 8D 9F A6 08 B0 D3 ED EB 15 13 1B 8E .Y...... ........ >+[0380] 19 C6 14 9C 25 E7 E9 EF 5A 67 7B CD 86 C4 D1 51 ....%... Zg{....Q >+[0390] 2B DE 27 30 D9 F5 6E F9 E4 3E CF 42 54 AE 42 61 +.'0..n. .>.BT.Ba >+[03A0] C5 22 B7 AE 51 76 8F 12 83 7F E1 9F 97 D8 31 38 ."..Qv.. ......18 >+[03B0] A6 B9 11 B4 E1 BA 19 5B E4 A5 A3 6F 4B B3 03 93 .......[ ...oK... >+[03C0] 4C D6 1E 08 FC 94 D1 C5 7C AA 95 EB 9C 7A C2 57 L....... |....z.W >+[03D0] 60 CA 17 FF 8E 66 80 76 CB 35 46 26 C3 BD CA 83 `....f.v .5F&.... >+[03E0] F0 04 08 0D 4C 5D B2 E4 7C 1C 82 28 D7 2C 42 B1 ....L].. |..(.,B. >+[03F0] 36 72 60 5E 26 4A 79 D0 41 94 3C 2C 65 0E 32 18 6r`^&Jy. A.<,e.2. >+[0400] B8 56 26 9D D3 84 78 BB .V&...x. >+ second_ticket : DATA_BLOB length=0 >+ further_creds : DATA_BLOB length=4748 >+[0000] 00 00 00 01 00 00 00 01 00 00 00 17 4B 54 45 53 ........ ....KTES >+[0010] 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E T.SAMBA. EXAMPLE. >+[0020] 43 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 73 74 72 COM....a dministr >+[0030] 61 74 6F 72 00 00 00 01 00 00 00 02 00 00 00 17 ator.... ........ >+[0040] 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D KTEST.SA MBA.EXAM >+[0050] 50 4C 45 2E 43 4F 4D 00 00 00 04 68 6F 73 74 00 PLE.COM. ...host. >+[0060] 00 00 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 00 17 ...local ktest6.. >+[0070] 00 00 00 10 EA 0D 3A 24 41 21 F7 7D 7D A3 C5 BB ......:$ A!.}}... >+[0080] A4 88 F6 17 4D 9B 90 45 4D 9B 90 52 7D 46 4C 43 ....M..E M..R}FLC >+[0090] 00 00 00 00 00 40 28 00 00 00 00 00 00 00 00 00 .....@(. ........ >+[00A0] 00 00 00 03 FA 61 82 03 F6 30 82 03 F2 A0 03 02 .....a.. .0...... >+[00B0] 01 05 A1 19 1B 17 4B 54 45 53 54 2E 53 41 4D 42 ......KT EST.SAMB >+[00C0] 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D A2 1E 30 A.EXAMPL E.COM..0 >+[00D0] 1C A0 03 02 01 01 A1 15 30 13 1B 04 68 6F 73 74 ........ 0...host >+[00E0] 1B 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 A3 82 03 ..localk test6... >+[00F0] AE 30 82 03 AA A0 03 02 01 17 A1 03 02 01 03 A2 .0...... ........ >+[0100] 82 03 9C 04 82 03 98 44 8B C4 7D BA 9F FE 59 F6 .......D ..}...Y. >+[0110] C1 DF 62 89 02 A4 55 54 AB D6 D6 2E 8B 5E 35 3D ..b...UT .....^5= >+[0120] D9 46 9D 8B 49 93 A6 66 5F 1A 8B 81 AD 09 19 E9 .F..I..f _....... >+[0130] 59 CE 58 18 50 63 4A A6 7D 6F 71 21 51 4A 41 C2 Y.X.PcJ. }oq!QJA. >+[0140] A1 FE B0 D5 0A 3D 38 9F E5 3B 72 A2 7A 59 22 A4 .....=8. .;r.zY". >+[0150] B7 1C A3 8D DB EA 5D A5 E2 D3 1D AE 42 D0 7F 75 ......]. ....B..u >+[0160] B5 E9 ED B5 04 7B 67 1E 28 90 7D 3D 1A 3E F6 62 .....{g. (.}=.>.b >+[0170] D0 A1 56 89 28 76 5C 19 1A FD 66 E5 F2 86 E7 58 ..V.(v\. ..f....X >+[0180] 93 31 90 C5 CD F8 71 96 56 21 15 13 F0 EA C2 CC .1....q. V!...... >+[0190] 48 4C B4 50 EF F9 81 44 29 8A 75 C4 31 75 D1 BA HL.P...D ).u.1u.. >+[01A0] E2 0B 05 B2 E0 EA 64 3A 11 45 84 3D 69 55 FF E6 ......d: .E.=iU.. >+[01B0] 32 7E C9 CA C4 28 E8 40 B6 5E F9 26 0F 09 12 1F 2~...(.@ .^.&.... >+[01C0] 1F D4 9C 9A 50 E8 B7 6D F8 4F 55 6E 2A D4 AC 6A ....P..m .OUn*..j >+[01D0] 79 D1 C2 2A 88 99 F8 39 75 36 F1 2D C7 89 0A C6 y..*...9 u6.-.... >+[01E0] B4 C7 A1 7B F1 BF 22 87 A4 B2 93 22 54 A1 72 25 ...{..". ..."T.r% >+[01F0] AF 67 FE 20 D5 C8 29 47 28 FF 51 FB F9 4E 2C 17 .g. ..)G (.Q..N,. >+[0200] 10 BE 2E 13 8B 18 BE 3C A3 BE 50 49 A7 65 DD 2E .......< ..PI.e.. >+[0210] CC EB D6 0F 47 4E DB 7E 08 D5 F0 37 79 36 8F 24 ....GN.~ ...7y6.$ >+[0220] 34 28 86 89 EC A3 84 7F 44 4E 37 03 B5 D8 89 1C 4(...... DN7..... >+[0230] C7 AA AC 42 70 5F 96 73 35 8B 83 D1 16 24 27 C1 ...Bp_.s 5....$'. >+[0240] EC 0E AE 83 59 5A C2 EB C1 91 B6 3D BB 8D 21 49 ....YZ.. ...=..!I >+[0250] 63 41 3C 91 1D E9 01 C2 4F A9 E4 42 C1 FD 54 E3 cA<..... O..B..T. >+[0260] 7B 3B DF 24 3D 98 E9 84 F8 1D 8D CE 4D 85 AC 8A {;.$=... ....M... >+[0270] 12 15 48 C4 DA 1B 3C B8 FC A3 0B AF E2 4D 71 E9 ..H...<. .....Mq. >+[0280] 0A 28 53 DC 4E 6C 23 2C 73 26 50 FE 37 03 BF D1 .(S.Nl#, s&P.7... >+[0290] 5F 8A 39 4F 04 2E 4A CE 3C 90 11 0C DA 84 5C C3 _.9O..J. <.....\. >+[02A0] F8 BE C7 74 ED F4 CF 7E B2 AE 9B 47 D6 2A 1D 93 ...t...~ ...G.*.. >+[02B0] 3F A8 8B 51 E9 A3 A0 59 55 DB E3 52 67 E3 DE FF ?..Q...Y U..Rg... >+[02C0] B1 56 74 A0 87 21 99 23 8C 8E D1 92 A6 3D 93 D6 .Vt..!.# .....=.. >+[02D0] 4D 5B 84 2B B1 8D DD E4 F7 01 A6 6C 4A DF 3C 6E M[.+.... ...lJ.<n >+[02E0] A0 FA 74 93 BE 18 7C 30 29 9D B8 DB 5F D1 AA B7 ..t...|0 )..._... >+[02F0] 51 7C 2A 90 1A 8B 06 95 E1 80 0D 27 B2 6C 52 1C Q|*..... ...'.lR. >+[0300] C7 D1 E9 16 14 F1 6C 57 48 28 BD 13 B5 83 BA A7 ......lW H(...... >+[0310] 75 31 69 52 03 38 69 13 62 ED C6 DC C2 01 C8 F1 u1iR.8i. b....... >+[0320] 45 02 4D 8C 64 CF 96 90 3E C2 08 EC 2B 8D 92 93 E.M.d... >...+... >+[0330] 4B 6D 22 B3 41 DE 85 35 2D 19 09 E5 68 8E 1F 98 Km".A..5 -...h... >+[0340] 1B F2 73 F2 D4 91 08 89 42 0C 05 8B 42 77 6B CC ..s..... B...Bwk. >+[0350] 18 78 43 1A 73 C2 7C E7 C2 23 28 56 F7 A0 19 B3 .xC.s.|. .#(V.... >+[0360] 99 A6 25 4F C3 5E 70 EC 78 BB 30 15 36 77 B3 A6 ..%O.^p. x.0.6w.. >+[0370] 89 98 B6 A0 85 CC 8F E7 41 40 B5 E0 89 93 25 04 ........ A@....%. >+[0380] B8 1D 0B 06 31 1D C7 30 52 E1 64 29 8C 64 B9 89 ....1..0 R.d).d.. >+[0390] 1F 86 5A AD 74 15 1C C8 AF 37 7B 27 E0 C0 DB 73 ..Z.t... .7{'...s >+[03A0] 30 72 65 D3 C0 A5 07 61 E9 0C 07 A1 27 18 8F 50 0re....a ....'..P >+[03B0] DB CE FB 4C DD 75 98 F2 28 D2 76 FF F2 41 9F D5 ...L.u.. (.v..A.. >+[03C0] 74 22 8A 03 73 B1 A8 B3 B8 80 93 E5 E2 CD 4B F2 t"..s... ......K. >+[03D0] 6B 99 DF 5B 5B C7 22 69 81 2A 8A CD 2A F9 9D 08 k..[[."i .*..*... >+[03E0] B8 B0 40 77 D3 43 8B AF 40 DD 0C CB 45 E3 88 CB ..@w.C.. @...E... >+[03F0] 06 AA 63 38 EB DD 72 89 03 0E DC 3E 97 3F 16 D4 ..c8..r. ...>.?.. >+[0400] 1A 21 40 D8 30 BD B0 B4 04 C2 7A 22 43 15 A2 D8 .!@.0... ..z"C... >+[0410] 2F 08 28 3B 63 26 AA B3 1C B6 FC E4 0B 2A CD 0E /.(;c&.. .....*.. >+[0420] A8 7C E8 11 33 03 D3 C5 6C 35 6A 5D 3C 5A 80 1A .|..3... l5j]<Z.. >+[0430] BC 1C 54 DE 5C 6A E2 F3 A1 18 8E 47 88 8B 71 11 ..T.\j.. ...G..q. >+[0440] 09 2F 29 88 D9 BB DC 34 09 E1 2F 7E A7 E8 29 DC ./)....4 ../~..). >+[0450] F9 5A 1D 9E C8 A4 CC 52 8A E6 CB 4A 3F F9 77 F7 .Z.....R ...J?.w. >+[0460] 53 64 62 9E 5F E6 D7 F6 43 E6 9C 03 C9 55 B1 CB Sdb._... C....U.. >+[0470] 25 40 74 AA E9 AB 34 58 E1 E8 9B B3 1D 9E 83 FD %@t...4X ........ >+[0480] 7A BF DC 45 2D A8 9A F8 AF 9C 63 EF 1B 2B 9D CC z..E-... ..c..+.. >+[0490] F3 08 74 EC 6E 40 8E 18 62 BD F3 87 66 87 67 00 ..t.n@.. b...f.g. >+[04A0] 00 00 00 00 00 00 01 00 00 00 01 00 00 00 17 4B ........ .......K >+[04B0] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[04C0] 4C 45 2E 43 4F 4D 00 00 00 0D 61 64 6D 69 6E 69 LE.COM.. ..admini >+[04D0] 73 74 72 61 74 6F 72 00 00 00 01 00 00 00 02 00 strator. ........ >+[04E0] 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 ...KTEST .SAMBA.E >+[04F0] 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 04 63 69 XAMPLE.C OM....ci >+[0500] 66 73 00 00 00 0B 6C 6F 63 61 6C 6B 74 65 73 74 fs....lo calktest >+[0510] 36 00 17 00 00 00 10 92 C6 A1 91 6D 55 01 4E BE 6....... ...mU.N. >+[0520] E4 3F E3 36 B0 D3 28 4D 9B 90 45 4D 9B 90 5A 7D .?.6..(M ..EM..Z} >+[0530] 46 4C 43 00 00 00 00 00 40 28 00 00 00 00 00 00 FLC..... @(...... >+[0540] 00 00 00 00 00 00 03 FA 61 82 03 F6 30 82 03 F2 ........ a...0... >+[0550] A0 03 02 01 05 A1 19 1B 17 4B 54 45 53 54 2E 53 ........ .KTEST.S >+[0560] 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D AMBA.EXA MPLE.COM >+[0570] A2 1E 30 1C A0 03 02 01 01 A1 15 30 13 1B 04 63 ..0..... ...0...c >+[0580] 69 66 73 1B 0B 6C 6F 63 61 6C 6B 74 65 73 74 36 ifs..loc alktest6 >+[0590] A3 82 03 AE 30 82 03 AA A0 03 02 01 17 A1 03 02 ....0... ........ >+[05A0] 01 03 A2 82 03 9C 04 82 03 98 FE 09 00 80 36 35 ........ ......65 >+[05B0] D4 6E 71 0C 33 22 36 9E 89 88 32 E3 34 4A 4C BF .nq.3"6. ..2.4JL. >+[05C0] 80 19 81 CC A0 CB 96 DB 31 F7 2A 19 75 DE 0E DA ........ 1.*.u... >+[05D0] D0 18 FA 9E 75 E6 E4 13 C9 BE 3F C0 1B AD 5B 98 ....u... ..?...[. >+[05E0] E9 FC A3 9D 16 FF C8 91 03 AC 8B E6 2D 15 B3 F1 ........ ....-... >+[05F0] 23 4E 25 9E 45 3A F8 8A 19 B7 71 52 A6 92 1C FB #N%.E:.. ..qR.... >+[0600] 1F D4 4C 51 AF 9C 0E 73 D9 A8 D8 43 F2 64 71 BC ..LQ...s ...C.dq. >+[0610] AD B1 7B 8F BF 8D FF 72 89 0F 5E B6 C2 E3 C0 01 ..{....r ..^..... >+[0620] 98 41 AD 3F 6E DC 87 F5 9A E6 40 0C 17 0F 75 80 .A.?n... ..@...u. >+[0630] 0C 28 62 06 EB BF F8 69 8C 43 48 38 A8 AE F2 5E .(b....i .CH8...^ >+[0640] 45 11 23 FB 6B 85 83 54 BA 60 39 CE 08 00 D1 05 E.#.k..T .`9..... >+[0650] 5F 6F 79 96 30 28 06 DD C7 75 52 8E 3C C4 3F FC _oy.0(.. .uR.<.?. >+[0660] C1 31 28 2C 64 3B D1 7E 2F C2 DB B0 E8 A8 EF C5 .1(,d;.~ /....... >+[0670] F2 DC 43 D0 14 21 C8 D0 D3 15 45 8E 2A 3E 3B 4A ..C..!.. ..E.*>;J >+[0680] 60 25 3D 11 E4 F9 16 02 3E 55 8F CE D2 E9 95 E7 `%=..... >U...... >+[0690] B1 C4 8F C4 0B 3E 3C 14 15 28 1A 21 49 15 CE 8E .....><. .(.!I... >+[06A0] 91 5E 98 71 00 1F 29 D3 12 C8 D0 11 4F E7 14 E3 .^.q..). ....O... >+[06B0] 72 1B 61 6D 7B 8A 00 A6 5E 01 01 50 C2 CF 1A A9 r.am{... ^..P.... >+[06C0] 34 8C BA 33 9E 62 C5 69 97 6A 24 3D E0 C6 3F C6 4..3.b.i .j$=..?. >+[06D0] F4 36 B1 80 D6 5C 44 19 5B 65 C7 CA 47 DE 4B 65 .6...\D. [e..G.Ke >+[06E0] 41 29 9F F8 EA E8 E0 3B E2 C6 98 9D 58 A4 6C 62 A).....; ....X.lb >+[06F0] EF 25 12 C9 0E 97 CE 9D F0 D8 08 AD 13 73 A6 82 .%...... .....s.. >+[0700] C5 54 23 F4 A4 CB 91 35 91 BD 10 B4 04 DD 55 7E .T#....5 ......U~ >+[0710] C9 DE AE CB B0 8F C0 D8 28 AE BD 78 64 91 6C AB ........ (..xd.l. >+[0720] CA 36 EA 0E 0E 97 DC 40 ED 26 1D 09 17 28 30 D3 .6.....@ .&...(0. >+[0730] 78 DC F7 D2 9C 78 DA 6F 6F 57 00 B3 FD 8E 75 A1 x....x.o oW....u. >+[0740] 56 98 5C 4B D8 61 A6 0A 89 27 CD 11 BF 7F 79 53 V.\K.a.. .'....yS >+[0750] D9 50 9A 8D EC DD DB BB B8 23 27 0D 20 5B 53 51 .P...... .#'. [SQ >+[0760] 07 C4 26 31 3B D4 DF ED 3C 40 B4 1C 8B 46 E2 A6 ..&1;... <@...F.. >+[0770] B7 0F 97 D2 B3 1D 19 FD 13 60 7B 38 E6 37 0C 59 ........ .`{8.7.Y >+[0780] B0 A8 47 5D 32 A5 0C 57 76 EF 2C ED 40 9F BF 4B ..G]2..W v.,.@..K >+[0790] 43 99 3C 68 C4 DE 84 9C A1 36 8C CA CB 2A 08 36 C.<h.... .6...*.6 >+[07A0] 4E CD 43 06 9E F8 E7 1D 52 3B 59 37 4F 6F 65 D9 N.C..... R;Y7Ooe. >+[07B0] 2A F9 AD 5A 50 95 71 3F B1 5F C8 8E 2E E9 E4 FE *..ZP.q? ._...... >+[07C0] C8 A9 42 2C EE 18 E0 81 3C 00 E2 80 8D 8A 8B 71 ..B,.... <......q >+[07D0] C7 F5 AC 5C 36 1D E0 BC F0 11 57 67 CB 2C BE F6 ...\6... ..Wg.,.. >+[07E0] 90 4E F9 90 97 14 1F 0C 9D 5D 4D DF 0D D0 C0 C5 .N...... .]M..... >+[07F0] 08 E7 31 72 8E 35 63 17 8D 8B 3D 49 14 C8 A5 90 ..1r.5c. ..=I.... >+[0800] 88 24 AF 75 CA 0A CB 95 8A 2C 70 A6 CE 2F 3F B6 .$.u.... .,p../?. >+[0810] D7 1A 44 AC 05 93 EF 3D 03 C7 C2 8E 0F 31 9F 53 ..D....= .....1.S >+[0820] 67 CA 73 D3 B8 07 76 36 35 6F B5 32 30 38 86 7E g.s...v6 5o.208.~ >+[0830] 7E 95 3F DC F4 6F A9 67 0E 15 E8 4A CA 3F 18 0E ~.?..o.g ...J.?.. >+[0840] C6 E7 20 22 6B F1 39 6A 9C A6 47 64 81 E4 CB A8 .. "k.9j ..Gd.... >+[0850] 31 FF E2 97 13 41 89 45 79 53 2B A8 90 97 DE 7B 1....A.E yS+....{ >+[0860] 18 56 95 02 2A 94 D2 7E 5C D0 A0 BC A0 38 D2 BC .V..*..~ \....8.. >+[0870] 03 91 F7 35 FE 1A 5E 80 10 13 4E 83 CB F6 D7 8A ...5..^. ..N..... >+[0880] 02 A2 E8 1F D8 9B F1 76 F9 18 66 56 9C 4D 9E BF .......v ..fV.M.. >+[0890] 1D F4 66 86 E0 7B 88 EC 9C F7 50 13 7D 34 8A 54 ..f..{.. ..P.}4.T >+[08A0] 7A E1 EC F6 44 12 47 84 7D 16 B4 42 25 E5 A2 CC z...D.G. }..B%... >+[08B0] D8 CA 7A 38 21 85 A3 F8 41 6D 0D AC 1D FA 36 5D ..z8!... Am....6] >+[08C0] 23 EA 20 CC 43 A5 7E D9 25 97 BC 0E 74 F5 3D 98 #. .C.~. %...t.=. >+[08D0] B9 79 C2 65 50 0E 8D E7 7A F3 F3 88 37 A3 40 01 .y.eP... z...7.@. >+[08E0] 96 C6 FC 1D 6E 9E 06 A1 90 A0 78 3C DA 7F E9 C6 ....n... ..x<.... >+[08F0] 23 47 70 04 03 EE C2 4A C3 95 07 44 00 BD 29 2A #Gp....J ...D..)* >+[0900] B5 FA 17 1E D6 BC 00 A0 93 55 E0 82 0A AB 04 D4 ........ .U...... >+[0910] D5 56 84 2A B2 56 51 05 DB 30 E2 83 5A 75 D3 A8 .V.*.VQ. .0..Zu.. >+[0920] 30 B7 3E C4 25 70 A8 34 E4 A2 EB 3E FB D8 2D 10 0.>.%p.4 ...>..-. >+[0930] 72 8E DA 4D 2D 55 EC 49 66 5E 01 96 E4 C1 0C 23 r..M-U.I f^.....# >+[0940] 57 91 00 00 00 00 00 00 00 01 00 00 00 01 00 00 W....... ........ >+[0950] 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 ..KTEST. SAMBA.EX >+[0960] 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D 61 64 6D AMPLE.CO M....adm >+[0970] 69 6E 69 73 74 72 61 74 6F 72 00 00 00 01 00 00 inistrat or...... >+[0980] 00 02 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 ......KT EST.SAMB >+[0990] 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 A.EXAMPL E.COM... >+[09A0] 04 68 6F 73 74 00 00 00 0B 4C 4F 43 41 4C 4B 54 .host... .LOCALKT >+[09B0] 45 53 54 36 00 17 00 00 00 10 9D AE 06 BE 29 E0 EST6.... ......). >+[09C0] F7 9A 46 97 29 E0 69 8E 5A F0 4D 9B 90 45 4D 9B ..F.).i. Z.M..EM. >+[09D0] 90 61 7D 46 4C 43 00 00 00 00 00 40 28 00 00 00 .a}FLC.. ...@(... >+[09E0] 00 00 00 00 00 00 00 00 00 03 FA 61 82 03 F6 30 ........ ...a...0 >+[09F0] 82 03 F2 A0 03 02 01 05 A1 19 1B 17 4B 54 45 53 ........ ....KTES >+[0A00] 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E T.SAMBA. EXAMPLE. >+[0A10] 43 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 15 30 13 COM..0.. ......0. >+[0A20] 1B 04 68 6F 73 74 1B 0B 4C 4F 43 41 4C 4B 54 45 ..host.. LOCALKTE >+[0A30] 53 54 36 A3 82 03 AE 30 82 03 AA A0 03 02 01 17 ST6....0 ........ >+[0A40] A1 03 02 01 03 A2 82 03 9C 04 82 03 98 B9 C5 6E ........ .......n >+[0A50] 77 F9 59 6D 19 F0 A6 56 2F 14 B3 9A A3 17 06 A6 w.Ym...V /....... >+[0A60] AD F5 92 38 6A 1E EA 3D 53 BF 5E 95 13 FF 5D BB ...8j..= S.^...]. >+[0A70] 43 4F 51 AE FB 12 3B 06 67 36 91 B9 E0 C4 C4 F3 COQ...;. g6...... >+[0A80] 45 A0 48 E6 DC 49 E8 EA 6F 55 D2 3F 79 57 54 FF E.H..I.. oU.?yWT. >+[0A90] 10 8D 89 4A A4 E2 B2 80 FD EE 36 C5 D5 4C D0 97 ...J.... ..6..L.. >+[0AA0] B3 EC 96 8B E8 5A 05 F0 13 39 8B 1B B3 C4 32 2A .....Z.. .9....2* >+[0AB0] 9B BB EF 06 C4 1C 53 2F 0A F6 A8 C6 BE 09 57 26 ......S/ ......W& >+[0AC0] B9 39 7B 7B 50 13 2D 6C 52 FF C4 B5 83 28 A8 47 .9{{P.-l R....(.G >+[0AD0] 5A CD 1C DD A7 65 FD 8A 84 2A 10 E7 44 E6 83 E7 Z....e.. .*..D... >+[0AE0] E7 AA B8 E5 0A 8B 7E E1 87 7B 3D C4 9F 68 BD 19 ......~. .{=..h.. >+[0AF0] 2B 59 5E 5A 45 0D B5 71 CC A6 C7 03 3C B3 17 D3 +Y^ZE..q ....<... >+[0B00] AF 99 F6 A2 52 A0 99 F7 39 56 B4 33 B4 C5 F4 CC ....R... 9V.3.... >+[0B10] 74 34 4C 00 76 26 10 D1 3A 87 6E 6A 52 9B 7A BF t4L.v&.. :.njR.z. >+[0B20] 4E 59 36 32 C5 41 29 CF E1 BF 14 E0 54 BF 4A 25 NY62.A). ....T.J% >+[0B30] 1F 0B 6E 9A 8C 0E 5D 47 A9 64 1B A4 9D 99 A9 09 ..n...]G .d...... >+[0B40] 39 14 E7 41 22 98 8C 62 CC E2 B5 91 8E C1 31 EB 9..A"..b ......1. >+[0B50] B2 70 A6 3B 86 FC DD 19 0B 3F 5D C9 B5 1A 95 73 .p.;.... .?]....s >+[0B60] EB 97 89 BE 14 87 85 17 BE 40 F6 80 14 23 4D 66 ........ .@...#Mf >+[0B70] E4 B0 E5 51 46 34 DA 1C C8 CB FF C6 84 A3 DF D2 ...QF4.. ........ >+[0B80] DC 00 AF 7B 27 C8 78 44 CB 6E 7B CC 5C 94 1E 7A ...{'.xD .n{.\..z >+[0B90] 95 29 19 F4 14 BE 5C 23 C3 B9 A4 2C 5D 4D F3 61 .)....\# ...,]M.a >+[0BA0] 63 1F D4 FE 37 EE 44 14 06 B7 14 50 B6 74 37 75 c...7.D. ...P.t7u >+[0BB0] 2C AB 06 F0 93 F9 93 34 75 63 44 7E 12 48 D1 F1 ,......4 ucD~.H.. >+[0BC0] 06 55 14 11 B9 23 43 CE 01 16 3E 6B A3 BD 23 55 .U...#C. ..>k..#U >+[0BD0] DE 48 5D AF E1 2B 89 E8 E7 C2 E2 34 25 A2 09 4A .H]..+.. ...4%..J >+[0BE0] 1F BE 05 AA DE 4B 08 65 27 4C 9B C7 54 96 C2 FB .....K.e 'L..T... >+[0BF0] E2 CE 53 4A 32 93 8D 0B 44 77 8C D3 65 54 F9 0E ..SJ2... Dw..eT.. >+[0C00] 7F 74 1E FE 3D 74 83 0F 2F E7 9F BC A2 B0 2B 25 .t..=t.. /.....+% >+[0C10] BB D2 6F A8 49 C1 3E 9E B5 93 67 74 39 A4 FE 84 ..o.I.>. ..gt9... >+[0C20] 4C 45 5F 30 74 E0 CA 5F F6 46 EC 89 B5 2D C8 14 LE_0t.._ .F...-.. >+[0C30] 69 76 BC 93 15 F4 60 30 5F AB EB 02 DD 12 4C 62 iv....`0 _.....Lb >+[0C40] F9 73 F7 01 E1 7F 2A 6F 09 05 BF 3A 3A 7E 69 A3 .s....*o ...::~i. >+[0C50] 7B FC 20 2B D6 CE C0 74 4F BB 29 E4 BE CE 04 9D {. +...t O.)..... >+[0C60] 24 D4 98 4A ED 94 A8 81 CD 26 A0 63 EA 09 57 42 $..J.... .&.c..WB >+[0C70] 26 B7 B5 4E B5 CB 45 35 A7 84 D8 74 CA C3 9F FF &..N..E5 ...t.... >+[0C80] C8 1E 2A 75 34 01 C5 A7 B4 9D 6F A3 E1 BB 2B F8 ..*u4... ..o...+. >+[0C90] F0 21 D6 77 57 74 2E 80 DB 76 53 01 86 33 17 32 .!.wWt.. .vS..3.2 >+[0CA0] 2E 16 E1 8D 89 3A B2 67 ED A3 ED 39 82 87 26 A6 .....:.g ...9..&. >+[0CB0] DB CE 59 84 E4 0A A6 CA 7E 07 98 F7 02 91 6E 56 ..Y..... ~.....nV >+[0CC0] 9F 60 03 D3 88 B0 FF EB 20 CA 9E 5B 37 26 67 00 .`...... ..[7&g. >+[0CD0] CC BD 9D 53 15 31 53 14 FD 9C E1 28 08 CB C4 0B ...S.1S. ...(.... >+[0CE0] E3 50 D9 DB 0C E2 E4 F9 44 50 E9 28 6E 01 96 AA .P...... DP.(n... >+[0CF0] C1 D2 4E B2 DE 38 A2 F8 94 32 79 AE 49 64 FB 57 ..N..8.. .2y.Id.W >+[0D00] 50 F6 73 E8 98 43 C6 DD 67 3C 91 AC 97 C9 2E 8C P.s..C.. g<...... >+[0D10] 06 59 A1 FC 49 EC 2F BF 6F 64 21 63 ED C8 6C CE .Y..I./. od!c..l. >+[0D20] 37 28 7B 80 7F 5F 85 F6 98 93 C0 66 A8 D6 F1 2C 7({.._.. ...f..., >+[0D30] D8 01 68 B1 C8 EA 82 0D 5B 9B 35 4F 3D B3 47 19 ..h..... [.5O=.G. >+[0D40] 54 7A C6 9F AD D7 54 CF B0 DB 3E 18 BA 2A 39 08 Tz....T. ..>..*9. >+[0D50] 0C C4 98 4B 43 DE 53 68 25 B1 83 93 1D E1 6C BF ...KC.Sh %.....l. >+[0D60] F5 B4 A9 83 17 34 64 8C 2F 91 80 97 4A 48 EC 90 .....4d. /...JH.. >+[0D70] BB FA 92 2C 01 80 E4 99 91 0E 67 88 D5 75 AB 7C ...,.... ..g..u.| >+[0D80] 98 59 98 45 C9 11 A9 8C 02 98 91 DE AB A0 FF 45 .Y.E.... .......E >+[0D90] 11 66 6F C5 DE 61 6D C6 DB C9 CA A3 A0 2B B1 73 .fo..am. .....+.s >+[0DA0] 05 85 37 BF AB CA 43 7A 6F 38 C8 BE ED CE 12 49 ..7...Cz o8.....I >+[0DB0] 93 C7 7C 1A 33 60 52 7A 67 67 AA 60 57 7E C8 FF ..|.3`Rz gg.`W~.. >+[0DC0] DF 91 91 18 45 74 C0 9E 36 19 BC 42 F9 46 CC 84 ....Et.. 6..B.F.. >+[0DD0] 09 2E 8C 59 1A E3 65 51 F4 87 6F 4C 3E 29 38 E6 ...Y..eQ ..oL>)8. >+[0DE0] 77 E8 A9 B7 FA 00 00 00 00 00 00 00 01 00 00 00 w....... ........ >+[0DF0] 01 00 00 00 17 4B 54 45 53 54 2E 53 41 4D 42 41 .....KTE ST.SAMBA >+[0E00] 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D 00 00 00 0D .EXAMPLE .COM.... >+[0E10] 61 64 6D 69 6E 69 73 74 72 61 74 6F 72 00 00 00 administ rator... >+[0E20] 01 00 00 00 02 00 00 00 17 4B 54 45 53 54 2E 53 ........ .KTEST.S >+[0E30] 41 4D 42 41 2E 45 58 41 4D 50 4C 45 2E 43 4F 4D AMBA.EXA MPLE.COM >+[0E40] 00 00 00 04 63 69 66 73 00 00 00 0B 4C 4F 43 41 ....cifs ....LOCA >+[0E50] 4C 4B 54 45 53 54 36 00 17 00 00 00 10 01 78 D0 LKTEST6. ......x. >+[0E60] 3B 9B FF F0 88 86 4B 3B FE 41 A9 6B 00 4D 9B 90 ;.....K; .A.k.M.. >+[0E70] 45 4D 9B 90 6B 7D 46 4C 43 00 00 00 00 00 40 28 EM..k}FL C.....@( >+[0E80] 00 00 00 00 00 00 00 00 00 00 00 00 03 FA 61 82 ........ ......a. >+[0E90] 03 F6 30 82 03 F2 A0 03 02 01 05 A1 19 1B 17 4B ..0..... .......K >+[0EA0] 54 45 53 54 2E 53 41 4D 42 41 2E 45 58 41 4D 50 TEST.SAM BA.EXAMP >+[0EB0] 4C 45 2E 43 4F 4D A2 1E 30 1C A0 03 02 01 01 A1 LE.COM.. 0....... >+[0EC0] 15 30 13 1B 04 63 69 66 73 1B 0B 4C 4F 43 41 4C .0...cif s..LOCAL >+[0ED0] 4B 54 45 53 54 36 A3 82 03 AE 30 82 03 AA A0 03 KTEST6.. ..0..... >+[0EE0] 02 01 17 A1 03 02 01 03 A2 82 03 9C 04 82 03 98 ........ ........ >+[0EF0] CA EA 4D 46 2D D1 E9 58 5D 25 8D 9F DF EA C9 01 ..MF-..X ]%...... >+[0F00] B6 08 27 CD 14 85 02 DC 20 C6 51 AA F9 6A B1 CE ..'..... .Q..j.. >+[0F10] F5 77 84 BF 9A AC 6B A7 B2 F2 1F 60 BF CB C6 FC .w....k. ...`.... >+[0F20] C7 14 B7 41 1C A8 C9 70 7B 86 BC 8E 70 2B 65 4B ...A...p {...p+eK >+[0F30] DC F5 B9 23 F8 08 BF 96 C9 A8 77 F4 54 67 25 F8 ...#.... ..w.Tg%. >+[0F40] 0F A8 C5 D6 D1 BB 46 5E A0 7E D2 98 9C CD AF E0 ......F^ .~...... >+[0F50] 82 62 ED 39 D2 FB F2 E8 9B 1B EE E5 B4 1B C9 0A .b.9.... ........ >+[0F60] 86 27 52 6E 11 8B D7 AD B4 54 F9 C6 69 8D E0 F1 .'Rn.... .T..i... >+[0F70] CD 63 1C 89 7C 8F B6 A0 71 53 A6 DA B1 66 D2 9D .c..|... qS...f.. >+[0F80] D3 4C A8 FB C6 9D 81 74 10 8E 84 D2 3D D8 1C BE .L.....t ....=... >+[0F90] BB 3F F7 BF 91 3E 89 66 43 A1 E0 90 1B 1A 97 FF .?...>.f C....... >+[0FA0] EF CC 35 75 14 62 4F 67 3A 29 F4 F9 C5 2E BE C5 ..5u.bOg :)...... >+[0FB0] C2 2B A8 35 22 D9 92 31 1D 49 2A A5 19 AA 08 0F .+.5"..1 .I*..... >+[0FC0] A8 22 0B 68 D2 A2 D7 07 7B 37 1E A3 AC 9B 4F 0A .".h.... {7....O. >+[0FD0] A4 FA 7F 37 6F 3E 35 79 4E 00 4B B6 28 A3 6A E4 ...7o>5y N.K.(.j. >+[0FE0] 0C 95 53 BA E8 41 07 DA BE E9 08 B9 51 24 91 49 ..S..A.. ....Q$.I >+[0FF0] 78 5D 44 12 BC 85 63 81 B8 E0 88 D5 95 0C D3 A8 x]D...c. ........ >+[1000] 1D 32 4B E4 A0 C8 A7 7D 3C 97 EE D8 59 AC 3A 21 .2K....} <...Y.:! >+[1010] 09 F2 7A CC D0 4A F3 50 10 DC FC 26 BB C2 6A 8E ..z..J.P ...&..j. >+[1020] 8B 14 2B 2D 50 2E B3 1E 9B D2 69 56 22 F2 48 BD ..+-P... ..iV".H. >+[1030] E9 2E 2F 28 DE 77 67 5F 68 AA 29 05 4B 36 58 40 ../(.wg_ h.).K6X@ >+[1040] E5 54 11 C5 4D 68 96 49 9D 53 37 87 5F D2 3A 9B .T..Mh.I .S7._.:. >+[1050] E9 8E 79 BE AE 11 B4 6B AB FD DB 8A F5 A0 9B 29 ..y....k .......) >+[1060] D9 F5 ED CA FA 3F FE 35 FC F4 69 7E E4 D0 44 29 .....?.5 ..i~..D) >+[1070] 48 FF 82 61 26 FC D3 E2 10 EE 14 F7 4A E3 CD F2 H..a&... ....J... >+[1080] 8B BC 8B 43 64 2C DE 40 6E BB E1 56 C0 B6 2C D0 ...Cd,.@ n..V..,. >+[1090] E5 1E E9 B3 FB 38 48 66 ED AF D2 25 D1 35 5C C6 .....8Hf ...%.5\. >+[10A0] F0 4D 36 19 0B EC 33 07 34 D0 27 8D 14 DC 01 45 .M6...3. 4.'....E >+[10B0] DE F8 73 A6 A0 F4 C1 91 9D BD 05 E3 70 25 E1 10 ..s..... ....p%.. >+[10C0] 44 F6 4B 46 F7 24 84 BF 20 96 AD 6A 96 94 81 58 D.KF.$.. ..j...X >+[10D0] 80 95 06 92 F5 7F 17 39 3B 32 47 B2 C5 CE 7B 73 .......9 ;2G...{s >+[10E0] CF 53 AE FA D1 9A 60 5A 98 EC 8C FA BD C0 CE 8D .S....`Z ........ >+[10F0] C5 27 E6 17 1A 4D 47 D8 3F 5D A9 7C FB 2C B3 05 .'...MG. ?].|.,.. >+[1100] 0C 69 20 48 99 80 11 DC 48 AB A7 EA 5B 98 C1 15 .i H.... H...[... >+[1110] 27 AE FA 3E 1E 1E E0 E1 F8 32 C0 54 13 D6 30 34 '..>.... .2.T..04 >+[1120] 71 98 26 61 6C 1C C4 C7 4E C4 A6 7E FE A8 B8 89 q.&al... N..~.... >+[1130] 2A 70 3C 19 58 8D 57 45 55 83 0A C2 B5 F7 89 0E *p<.X.WE U....... >+[1140] 7B 7A 17 0C CF 6E 08 A5 F7 21 4A 62 81 4F 49 CA {z...n.. .!Jb.OI. >+[1150] E2 ED C2 B4 C7 33 5C BC A1 A0 DE 4E 09 37 BE 24 .....3\. ...N.7.$ >+[1160] 62 22 94 55 75 AA 53 DE E0 74 5A B0 B8 E9 BF 2B b".Uu.S. .tZ....+ >+[1170] 12 65 2F 90 6B 84 ED 11 AD F7 CE 19 A1 96 E4 1E .e/.k... ........ >+[1180] 8C EA C8 81 1B 47 4F 5F B1 5D A5 8B E3 0D 5A 80 .....GO_ .]....Z. >+[1190] 89 EC 4B D9 CE ED E8 67 7F 96 FC 1B EF 65 C2 68 ..K....g .....e.h >+[11A0] 40 F7 20 36 83 58 62 F4 CA 02 F4 5C 0D 46 B1 CB @. 6.Xb. ...\.F.. >+[11B0] 50 D2 D8 3D B7 9A 96 48 8C CF EB E6 8C F4 B2 B4 P..=...H ........ >+[11C0] 47 C9 34 C9 DC 14 F1 33 1B 6F 9E 65 27 D7 9D 46 G.4....3 .o.e'..F >+[11D0] 1E 91 FF 2E FB 8E 97 5D 17 8F 48 54 7C 3C A0 11 .......] ..HT|<.. >+[11E0] 9C AA 77 E9 79 DE 26 D1 F0 7C EA 24 73 BE EC 60 ..w.y.&. .|.$s..` >+[11F0] B4 EE BD ED 0D 0A AB 74 60 6E 46 C0 35 5B 65 1A .......t `nF.5[e. >+[1200] A4 4A 5C 22 AC B9 CD B7 56 06 88 09 FC 48 68 55 .J\".... V....HhU >+[1210] B7 5E 39 72 DF 8A 4C CD 79 74 B0 84 0B 78 DA B2 .^9r..L. yt...x.. >+[1220] 55 F8 06 0B 5C 27 06 B3 CA 10 65 6B 04 A3 64 11 U...\'.. ..ek..d. >+[1230] 04 09 DC DF 67 00 70 B1 16 DF 24 E9 27 85 11 91 ....g.p. ..$.'... >+[1240] 31 CB 92 95 50 18 91 08 C2 A1 A3 76 C7 1A FC 64 1...P... ...v...d >+[1250] 9E 2C 3A E7 30 F4 16 0D A0 56 C0 BC D2 FE 2D A0 .,:.0... .V....-. >+[1260] 20 A4 E2 82 AD F0 C5 12 71 09 23 E1 66 52 53 D0 ....... q.#.fRS. >+[1270] 89 30 E7 BE B7 C2 89 F2 1C 7A F6 8E D7 28 F0 A4 .0...... .z...(.. >+[1280] 33 46 7C A2 79 66 DE 26 00 00 00 00 3F|.yf.& .... >+dump OK >-- >2.25.1 > > >From 722c46e13c61c5a08f49ee7975a3ebafaf356a1c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Apr 2021 11:02:47 +1200 >Subject: [PATCH 069/380] krb5: Add Python functions to create a credentials > cache containing a service ticket > >This is a FILE: format credentials cache readable by the MIT/Heimdal >Kerberos libraries. This allows us to glue the Python ASN1 Kerberos >system to the MIT/Heimdal one. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 2d88a6ff3dbcf650b09ef9c8c37170ca6663b533) >--- > python/samba/tests/krb5/kdc_base_test.py | 167 ++++++++++++++++++++++- > 1 file changed, 163 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 1c7f05dda6d..d8193ae9cdc 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1,6 +1,6 @@ > # Unix SMB/CIFS implementation. > # Copyright (C) Stefan Metzmacher 2020 >-# Copyright (C) 2020 Catalyst.Net Ltd >+# Copyright (C) 2020-2021 Catalyst.Net Ltd > # > # This program is free software; you can redistribute it and/or modify > # it under the terms of the GNU General Public License as published by >@@ -18,6 +18,8 @@ > > import sys > import os >+from datetime import datetime >+import tempfile > > sys.path.insert(0, "bin/python") > os.environ["PYTHONUNBUFFERED"] = "1" >@@ -26,10 +28,10 @@ import ldb > from ldb import SCOPE_BASE > from samba import generate_random_password > from samba.auth import system_session >-from samba.credentials import Credentials >-from samba.dcerpc import krb5pac >+from samba.credentials import Credentials, SPECIFIED, MUST_USE_KERBEROS >+from samba.dcerpc import krb5pac, krb5ccache > from samba.dsdb import UF_WORKSTATION_TRUST_ACCOUNT, UF_NORMAL_ACCOUNT >-from samba.ndr import ndr_unpack >+from samba.ndr import ndr_pack, ndr_unpack > from samba.samdb import SamDB > > from samba.tests import delete_force >@@ -38,6 +40,8 @@ import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( > AD_IF_RELEVANT, > AD_WIN2K_PAC, >+ AES256_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5, > KDC_ERR_PREAUTH_REQUIRED, > KRB_AS_REP, > KRB_TGS_REP, >@@ -46,6 +50,8 @@ from samba.tests.krb5.rfc4120_constants import ( > KU_PA_ENC_TIMESTAMP, > KU_TGS_REP_ENC_PART_SUB_KEY, > KU_TICKET, >+ NT_PRINCIPAL, >+ NT_SRV_HST, > PADATA_ENC_TIMESTAMP, > PADATA_ETYPE_INFO2, > ) >@@ -445,3 +451,156 @@ class KDCBaseTest(RawKerberosTest): > msg = ldb.Message(dn) > msg[name] = ldb.MessageElement(values, flag, name) > self.ldb.modify(msg) >+ >+ def create_ccache(self, cname, ticket, enc_part): >+ """ Lay out a version 4 on-disk credentials cache, to be read using the >+ FILE: protocol. >+ """ >+ >+ field = krb5ccache.DELTATIME_TAG() >+ field.kdc_sec_offset = 0 >+ field.kdc_usec_offset = 0 >+ >+ v4tag = krb5ccache.V4TAG() >+ v4tag.tag = 1 >+ v4tag.field = field >+ >+ v4tags = krb5ccache.V4TAGS() >+ v4tags.tag = v4tag >+ v4tags.further_tags = b'' >+ >+ optional_header = krb5ccache.V4HEADER() >+ optional_header.v4tags = v4tags >+ >+ cname_string = cname['name-string'] >+ >+ cprincipal = krb5ccache.PRINCIPAL() >+ cprincipal.name_type = cname['name-type'] >+ cprincipal.component_count = len(cname_string) >+ cprincipal.realm = ticket['realm'] >+ cprincipal.components = cname_string >+ >+ sname = ticket['sname'] >+ sname_string = sname['name-string'] >+ >+ sprincipal = krb5ccache.PRINCIPAL() >+ sprincipal.name_type = sname['name-type'] >+ sprincipal.component_count = len(sname_string) >+ sprincipal.realm = ticket['realm'] >+ sprincipal.components = sname_string >+ >+ key = self.EncryptionKey_import(enc_part['key']) >+ >+ key_data = key.export_obj() >+ keyblock = krb5ccache.KEYBLOCK() >+ keyblock.enctype = key_data['keytype'] >+ keyblock.data = key_data['keyvalue'] >+ >+ addresses = krb5ccache.ADDRESSES() >+ addresses.count = 0 >+ addresses.data = [] >+ >+ authdata = krb5ccache.AUTHDATA() >+ authdata.count = 0 >+ authdata.data = [] >+ >+ # Re-encode the ticket, since it was decoded by another layer. >+ ticket_data = self.der_encode(ticket, asn1Spec=krb5_asn1.Ticket()) >+ >+ authtime = enc_part['authtime'] >+ try: >+ starttime = enc_part['starttime'] >+ except KeyError: >+ starttime = authtime >+ endtime = enc_part['endtime'] >+ >+ cred = krb5ccache.CREDENTIAL() >+ cred.client = cprincipal >+ cred.server = sprincipal >+ cred.keyblock = keyblock >+ cred.authtime = int(datetime.strptime(authtime.decode(), >+ "%Y%m%d%H%M%SZ").timestamp()) >+ cred.starttime = int(datetime.strptime(starttime.decode(), >+ "%Y%m%d%H%M%SZ").timestamp()) >+ cred.endtime = int(datetime.strptime(endtime.decode(), >+ "%Y%m%d%H%M%SZ").timestamp()) >+ cred.renew_till = cred.endtime >+ cred.is_skey = 0 >+ cred.ticket_flags = int(enc_part['flags'], 2) >+ cred.addresses = addresses >+ cred.authdata = authdata >+ cred.ticket = ticket_data >+ cred.second_ticket = b'' >+ >+ ccache = krb5ccache.CCACHE() >+ ccache.pvno = 5 >+ ccache.version = 4 >+ ccache.optional_header = optional_header >+ ccache.principal = cprincipal >+ ccache.cred = cred >+ >+ # Serialise the credentials cache structure. >+ result = ndr_pack(ccache) >+ >+ # Create a temporary file and write the credentials. >+ cachefile = tempfile.NamedTemporaryFile(dir=self.tempdir, delete=False) >+ cachefile.write(result) >+ cachefile.close() >+ >+ return cachefile >+ >+ def create_ccache_with_user(self, user_credentials, mach_name, >+ service="host"): >+ # Obtain a service ticket authorising the user and place it into a >+ # newly created credentials cache file. >+ >+ user_name = user_credentials.get_username() >+ realm = user_credentials.get_realm() >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[user_name]) >+ sname = self.PrincipalName_create(name_type=NT_SRV_HST, >+ names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.check_pre_authenication(rep) >+ >+ # Do the next AS-REQ >+ padata = self.get_pa_data(user_credentials, rep) >+ key = self.get_as_rep_key(user_credentials, rep) >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ # Request a ticket to the host service on the machine account >+ ticket = rep['ticket'] >+ enc_part = self.get_as_rep_enc_data(key, rep) >+ key = self.EncryptionKey_import(enc_part['key']) >+ cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[user_name]) >+ sname = self.PrincipalName_create(name_type=NT_SRV_HST, >+ names=[service, mach_name]) >+ >+ (rep, enc_part) = self.tgs_req( >+ cname, sname, realm, ticket, key, etype) >+ self.check_tgs_reply(rep) >+ key = self.EncryptionKey_import(enc_part['key']) >+ >+ # Check the contents of the pac, and the ticket >+ ticket = rep['ticket'] >+ >+ # Write the ticket into a credentials cache file that can be ingested >+ # by the main credentials code. >+ cachefile = self.create_ccache(cname, ticket, enc_part) >+ >+ # Create a credentials object to reference the credentials cache. >+ creds = Credentials() >+ creds.set_kerberos_state(MUST_USE_KERBEROS) >+ creds.set_username(user_name, SPECIFIED) >+ creds.set_realm(realm) >+ creds.set_named_ccache(cachefile.name, SPECIFIED, self.lp) >+ >+ # Return the credentials along with the cache file. >+ return (creds, cachefile) >-- >2.25.1 > > >From ffbd4d841e90df64a9ed50503a347a0708d80fce Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Apr 2021 11:06:33 +1200 >Subject: [PATCH 070/380] python: Add credentials cache test > >Test that we can use a credentials cache with a user's service ticket >obtained with our Python code to connect to a service using the normal >credentials system backed on to MIT/Heimdal Kerberos 5 libraries. This >will allow us to validate the output of the MIT/Heimdal libraries in the >future. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit c15f26ec40860782b22e862f9bdf665745387718) >--- > python/samba/tests/krb5/raw_testcase.py | 8 +- > python/samba/tests/krb5/rfc4120_constants.py | 1 + > python/samba/tests/krb5/test_ccache.py | 127 +++++++++++++++++++ > python/samba/tests/usage.py | 1 + > source4/selftest/tests.py | 2 + > 5 files changed, 135 insertions(+), 4 deletions(-) > create mode 100755 python/samba/tests/krb5/test_ccache.py > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 82e68ee7019..27ab89ecf99 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -25,7 +25,7 @@ import random > > import samba.tests > from samba.credentials import Credentials >-from samba.tests import TestCase >+from samba.tests import TestCaseInTempDir > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > import samba.tests.krb5.kcrypto as kcrypto > >@@ -178,11 +178,11 @@ class Krb5EncryptionKey(object): > return EncryptionKey_obj > > >-class RawKerberosTest(TestCase): >+class RawKerberosTest(TestCaseInTempDir): > """A raw Kerberos Test case.""" > > def setUp(self): >- super(RawKerberosTest, self).setUp() >+ super().setUp() > self.do_asn1_print = False > self.do_hexdump = False > >@@ -192,7 +192,7 @@ class RawKerberosTest(TestCase): > > def tearDown(self): > self._disconnect("tearDown") >- super(TestCase, self).tearDown() >+ super().tearDown() > > def _disconnect(self, reason): > if self.s is None: >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index 5bbf1229d09..702f6084217 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -46,6 +46,7 @@ KDC_ERR_SKEW = 37 > # Name types > NT_UNKNOWN = int(krb5_asn1.NameTypeValues('kRB5-NT-UNKNOWN')) > NT_PRINCIPAL = int(krb5_asn1.NameTypeValues('kRB5-NT-PRINCIPAL')) >+NT_SRV_HST = int(krb5_asn1.NameTypeValues('kRB5-NT-SRV-HST')) > NT_SRV_INST = int(krb5_asn1.NameTypeValues('kRB5-NT-SRV-INST')) > NT_ENTERPRISE_PRINCIPAL = int(krb5_asn1.NameTypeValues( > 'kRB5-NT-ENTERPRISE-PRINCIPAL')) >diff --git a/python/samba/tests/krb5/test_ccache.py b/python/samba/tests/krb5/test_ccache.py >new file mode 100755 >index 00000000000..e0998a4c43f >--- /dev/null >+++ b/python/samba/tests/krb5/test_ccache.py >@@ -0,0 +1,127 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# Copyright (C) 2021 Catalyst.Net Ltd >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+from ldb import SCOPE_SUBTREE >+from samba import gensec >+from samba.auth import AuthContext >+from samba.dcerpc import security >+from samba.ndr import ndr_unpack >+ >+from samba.tests.krb5.kdc_base_test import KDCBaseTest >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class CcacheTests(KDCBaseTest): >+ """Test for authentication using Kerberos credentials stored in a >+ credentials cache file. >+ """ >+ >+ def test_ccache(self): >+ # Create a user account and a machine account, along with a Kerberos >+ # credentials cache file where the service ticket authenticating the >+ # user are stored. >+ >+ user_name = "ccacheusr" >+ mach_name = "ccachemac" >+ >+ # Create the user account. >+ (user_credentials, _) = self.create_account(user_name) >+ >+ # Create the machine account. >+ (mach_credentials, _) = self.create_account(mach_name, >+ machine_account=True) >+ >+ # Talk to the KDC to obtain the service ticket, which gets placed into >+ # the cache. The machine account name has to match the name in the >+ # ticket, to ensure that the krbtgt ticket doesn't also need to be >+ # stored. >+ (creds, cachefile) = self.create_ccache_with_user(user_credentials, >+ mach_name) >+ >+ # Authenticate in-process to the machine account using the user's >+ # cached credentials. >+ >+ settings = {} >+ settings["lp_ctx"] = self.lp >+ settings["target_hostname"] = mach_name >+ >+ gensec_client = gensec.Security.start_client(settings) >+ gensec_client.set_credentials(creds) >+ gensec_client.want_feature(gensec.FEATURE_SEAL) >+ gensec_client.start_mech_by_sasl_name("GSSAPI") >+ >+ auth_context = AuthContext(lp_ctx=self.lp, ldb=self.ldb, methods=[]) >+ >+ gensec_server = gensec.Security.start_server(settings, auth_context) >+ gensec_server.set_credentials(mach_credentials) >+ >+ gensec_server.start_mech_by_sasl_name("GSSAPI") >+ >+ client_finished = False >+ server_finished = False >+ server_to_client = b'' >+ >+ # Operate as both the client and the server to verify the user's >+ # credentials. >+ while not client_finished or not server_finished: >+ if not client_finished: >+ print("running client gensec_update") >+ (client_finished, client_to_server) = gensec_client.update( >+ server_to_client) >+ if not server_finished: >+ print("running server gensec_update") >+ (server_finished, server_to_client) = gensec_server.update( >+ client_to_server) >+ >+ # Ensure that the first SID contained within the obtained security >+ # token is the SID of the user we created. >+ >+ # Retrieve the user account's SID. >+ ldb_res = self.ldb.search(scope=SCOPE_SUBTREE, >+ expression="(sAMAccountName=%s)" % user_name, >+ attrs=["objectSid"]) >+ self.assertEqual(1, len(ldb_res)) >+ sid = ndr_unpack(security.dom_sid, ldb_res[0]["objectSid"][0]) >+ >+ # Retrieve the SIDs from the security token. >+ session = gensec_server.session_info() >+ token = session.security_token >+ token_sids = token.sids >+ self.assertGreater(len(token_sids), 0) >+ >+ # Ensure that they match. >+ self.assertEqual(sid, token_sids[0]) >+ >+ # Remove the cached credentials file. >+ os.remove(cachefile.name) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 1b22461c735..2ca1e0215ce 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -95,6 +95,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/kdc_tests.py', > 'python/samba/tests/krb5/kdc_base_test.py', > 'python/samba/tests/krb5/kdc_tgs_tests.py', >+ 'python/samba/tests/krb5/test_ccache.py', > 'python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py', > } > >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 9bb2ff2e1ed..d5b51ad3a3a 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -752,6 +752,8 @@ planoldpythontestsuite("ad_dc_default:local", "samba.tests.krb5.s4u_tests", > > planoldpythontestsuite("fl2008r2dc:local", "samba.tests.krb5.xrealm_tests") > >+planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ccache") >+ > for env in ["ad_dc", smbv1_disabled_testenv]: > planoldpythontestsuite(env, "samba.tests.smb", extra_args=['-U"$USERNAME%$PASSWORD"']) > planoldpythontestsuite(env + ":local", "samba.tests.ntacls_backup", >-- >2.25.1 > > >From 31d3ac2bcb162869c6932f0c2e49e002c3ab009c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 29 Apr 2021 20:58:11 +1200 >Subject: [PATCH 071/380] python: Add LDAP credentials cache test > >Test that we can use a credentials cache with a user's service ticket >obtained with our Python code to connect to a service through LDAP. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 7663b5c37fa3413f7c67c018107322494e4a6fd9) >--- > python/samba/tests/krb5/test_ldap.py | 94 ++++++++++++++++++++++++++++ > python/samba/tests/usage.py | 1 + > source4/selftest/tests.py | 1 + > 3 files changed, 96 insertions(+) > create mode 100755 python/samba/tests/krb5/test_ldap.py > >diff --git a/python/samba/tests/krb5/test_ldap.py b/python/samba/tests/krb5/test_ldap.py >new file mode 100755 >index 00000000000..6a4bf52d77f >--- /dev/null >+++ b/python/samba/tests/krb5/test_ldap.py >@@ -0,0 +1,94 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# Copyright (C) 2021 Catalyst.Net Ltd >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+from ldb import SCOPE_BASE, SCOPE_SUBTREE >+from samba.dcerpc import security >+from samba.ndr import ndr_unpack >+from samba.samdb import SamDB >+ >+from samba.tests.krb5.kdc_base_test import KDCBaseTest >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class LdapTests(KDCBaseTest): >+ """Test for LDAP authentication using Kerberos credentials stored in a >+ credentials cache file. >+ """ >+ >+ def test_ldap(self): >+ # Create a user account and a machine account, along with a Kerberos >+ # credentials cache file where the service ticket authenticating the >+ # user are stored. >+ >+ user_name = "ldapusr" >+ mach_name = self.dns_host_name >+ service = "ldap" >+ >+ # Create the user account. >+ (user_credentials, _) = self.create_account(user_name) >+ >+ # Talk to the KDC to obtain the service ticket, which gets placed into >+ # the cache. The machine account name has to match the name in the >+ # ticket, to ensure that the krbtgt ticket doesn't also need to be >+ # stored. >+ (creds, cachefile) = self.create_ccache_with_user(user_credentials, >+ mach_name, >+ service) >+ >+ # Authenticate in-process to the machine account using the user's >+ # cached credentials. >+ >+ # Retrieve the user account's SID. >+ ldb_res = self.ldb.search(scope=SCOPE_SUBTREE, >+ expression="(sAMAccountName=%s)" % user_name, >+ attrs=["objectSid"]) >+ self.assertEqual(1, len(ldb_res)) >+ sid = ndr_unpack(security.dom_sid, ldb_res[0]["objectSid"][0]) >+ >+ # Connect to the machine account and retrieve the user SID. >+ ldb_as_user = SamDB(url="ldap://%s" % mach_name, >+ credentials=creds, >+ lp=self.lp) >+ ldb_res = ldb_as_user.search('', >+ scope=SCOPE_BASE, >+ attrs=["tokenGroups"]) >+ self.assertEqual(1, len(ldb_res)) >+ >+ token_sid = ndr_unpack(security.dom_sid, ldb_res[0]["tokenGroups"][0]) >+ >+ # Ensure that they match. >+ self.assertEqual(sid, token_sid) >+ >+ # Remove the cached credentials file. >+ os.remove(cachefile.name) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 2ca1e0215ce..45636f3d3a3 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -96,6 +96,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/kdc_base_test.py', > 'python/samba/tests/krb5/kdc_tgs_tests.py', > 'python/samba/tests/krb5/test_ccache.py', >+ 'python/samba/tests/krb5/test_ldap.py', > 'python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py', > } > >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index d5b51ad3a3a..83fe47cbc20 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -753,6 +753,7 @@ planoldpythontestsuite("ad_dc_default:local", "samba.tests.krb5.s4u_tests", > planoldpythontestsuite("fl2008r2dc:local", "samba.tests.krb5.xrealm_tests") > > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ccache") >+planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ldap") > > for env in ["ad_dc", smbv1_disabled_testenv]: > planoldpythontestsuite(env, "samba.tests.smb", extra_args=['-U"$USERNAME%$PASSWORD"']) >-- >2.25.1 > > >From 13cfa898cc5ec314710eca97631320d5df53b9aa Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 29 Apr 2021 21:04:25 +1200 >Subject: [PATCH 072/380] python: Add RPC credentials cache test > >Test that we can use a credentials cache with a user's service ticket >obtained with our Python code to connect to a service through RPC. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 072451a033da07c0cdaa005dd1020ef1c7951e99) >--- > python/samba/tests/krb5/test_rpc.py | 77 +++++++++++++++++++++++++++++ > python/samba/tests/usage.py | 1 + > source4/selftest/tests.py | 1 + > 3 files changed, 79 insertions(+) > create mode 100755 python/samba/tests/krb5/test_rpc.py > >diff --git a/python/samba/tests/krb5/test_rpc.py b/python/samba/tests/krb5/test_rpc.py >new file mode 100755 >index 00000000000..da1c4eb88ac >--- /dev/null >+++ b/python/samba/tests/krb5/test_rpc.py >@@ -0,0 +1,77 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# Copyright (C) 2021 Catalyst.Net Ltd >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+from samba.dcerpc import lsa >+ >+from samba.tests.krb5.kdc_base_test import KDCBaseTest >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class RpcTests(KDCBaseTest): >+ """Test for RPC authentication using Kerberos credentials stored in a >+ credentials cache file. >+ """ >+ >+ def test_rpc(self): >+ # Create a user account and a machine account, along with a Kerberos >+ # credentials cache file where the service ticket authenticating the >+ # user are stored. >+ >+ user_name = "rpcusr" >+ mach_name = self.dns_host_name >+ service = "cifs" >+ >+ # Create the user account. >+ (user_credentials, _) = self.create_account(user_name) >+ >+ # Talk to the KDC to obtain the service ticket, which gets placed into >+ # the cache. The machine account name has to match the name in the >+ # ticket, to ensure that the krbtgt ticket doesn't also need to be >+ # stored. >+ (creds, cachefile) = self.create_ccache_with_user(user_credentials, >+ mach_name, >+ service) >+ >+ # Authenticate in-process to the machine account using the user's >+ # cached credentials. >+ >+ binding_str = "ncacn_np:%s[\\pipe\\lsarpc]" % mach_name >+ conn = lsa.lsarpc(binding_str, self.lp, creds) >+ >+ (account_name, _) = conn.GetUserName(None, None, None) >+ >+ self.assertEqual(user_name, account_name.string) >+ >+ # Remove the cached credentials file. >+ os.remove(cachefile.name) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 45636f3d3a3..eb7c003b48b 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -97,6 +97,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/kdc_tgs_tests.py', > 'python/samba/tests/krb5/test_ccache.py', > 'python/samba/tests/krb5/test_ldap.py', >+ 'python/samba/tests/krb5/test_rpc.py', > 'python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py', > } > >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 83fe47cbc20..5acbeda6bbe 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -754,6 +754,7 @@ planoldpythontestsuite("fl2008r2dc:local", "samba.tests.krb5.xrealm_tests") > > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ccache") > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ldap") >+planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_rpc") > > for env in ["ad_dc", smbv1_disabled_testenv]: > planoldpythontestsuite(env, "samba.tests.smb", extra_args=['-U"$USERNAME%$PASSWORD"']) >-- >2.25.1 > > >From 4f807efdad0d00d3c3a52d29234a8107cf8d6ff0 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 3 May 2021 15:48:43 +1200 >Subject: [PATCH 073/380] Revert "libsmb: Use sid_parse()" > >This reverts commit afd5d34f5e1d13ba88448b3b94d353aa8361d1a9. > >This code originally used ndr_pull_struct_blob() to pull one SID from a >buffer potentially containing multiple SIDs. When this was changed to >use sid_parse(), it was now attempting to parse the whole buffer as a >single SID with ndr_pull_struct_blob_all(), which would cause it to fail >if more than one SID was present. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 2b487890d946df88abce67c3d07d74559f70f069) >--- > source3/libsmb/clifsinfo.c | 19 ++++++++++++++++--- > 1 file changed, 16 insertions(+), 3 deletions(-) > >diff --git a/source3/libsmb/clifsinfo.c b/source3/libsmb/clifsinfo.c >index 1c140ebbd59..09c0d9535f1 100644 >--- a/source3/libsmb/clifsinfo.c >+++ b/source3/libsmb/clifsinfo.c >@@ -29,7 +29,6 @@ > #include "../libcli/smb/smbXcli_base.h" > #include "auth/credentials/credentials.h" > #include "../librpc/gen_ndr/ndr_security.h" >-#include "libcli/security/dom_sid.h" > > /**************************************************************************** > Get UNIX extensions version info. >@@ -686,9 +685,23 @@ static void cli_posix_whoami_done(struct tevent_req *subreq) > num_rdata -= (p - rdata); > > for (i = 0; i < state->num_sids; i++) { >- ssize_t sid_size = sid_parse(p, num_rdata, &state->sids[i]); >+ size_t sid_size; >+ DATA_BLOB in = data_blob_const(p, num_rdata); >+ enum ndr_err_code ndr_err; > >- if ((sid_size == -1) || (sid_size > num_rdata)) { >+ ndr_err = ndr_pull_struct_blob(&in, >+ state, >+ &state->sids[i], >+ (ndr_pull_flags_fn_t)ndr_pull_dom_sid); >+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { >+ tevent_req_nterror(req, >+ NT_STATUS_INVALID_NETWORK_RESPONSE); >+ return; >+ } >+ >+ sid_size = ndr_size_dom_sid(&state->sids[i], 0); >+ >+ if (sid_size > num_rdata) { > tevent_req_nterror(req, > NT_STATUS_INVALID_NETWORK_RESPONSE); > return; >-- >2.25.1 > > >From 468548531aeb4cbe225541ad4654669e56992f0e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 3 May 2021 15:55:01 +1200 >Subject: [PATCH 074/380] libsmb: Remove overflow check > >Pointer overflow is undefined, so this check does not accomplish >anything. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit db5b34c7682e36630908356cf674fddd18d8fa1f) >--- > source3/libsmb/clifsinfo.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/source3/libsmb/clifsinfo.c b/source3/libsmb/clifsinfo.c >index 09c0d9535f1..cc9f7382d49 100644 >--- a/source3/libsmb/clifsinfo.c >+++ b/source3/libsmb/clifsinfo.c >@@ -650,7 +650,7 @@ static void cli_posix_whoami_done(struct tevent_req *subreq) > * parsing network packets in C. > */ > >- if (num_rdata < 40 || rdata + num_rdata < rdata) { >+ if (num_rdata < 40) { > tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE); > return; > } >-- >2.25.1 > > >From 88e0b2d428c3ea3fe3a3c5d9aab510ac2619cc50 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 3 May 2021 16:16:51 +1200 >Subject: [PATCH 075/380] libsmb: Avoid undefined behaviour when parsing whoami > state > >If num_gids is such that the gids array would overflow the rdata buffer, >'p + 8' could produce a result pointing outside the buffer, and thus >result in undefined behaviour. To avoid this, we check num_gids against >the size of the buffer beforehand. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 9d8aeed33d8edf7a5dc96dbe35e4e164e2baeeeb) >--- > source3/libsmb/clifsinfo.c | 12 +++++++----- > 1 file changed, 7 insertions(+), 5 deletions(-) > >diff --git a/source3/libsmb/clifsinfo.c b/source3/libsmb/clifsinfo.c >index cc9f7382d49..aca559d153b 100644 >--- a/source3/libsmb/clifsinfo.c >+++ b/source3/libsmb/clifsinfo.c >@@ -661,6 +661,13 @@ static void cli_posix_whoami_done(struct tevent_req *subreq) > state->num_gids = IVAL(rdata, 24); > state->num_sids = IVAL(rdata, 28); > >+ /* Ensure the gid array doesn't overflow */ >+ if (state->num_gids > (num_rdata - 40) / sizeof(uint64_t)) { >+ tevent_req_nterror(req, >+ NT_STATUS_INVALID_NETWORK_RESPONSE); >+ return; >+ } >+ > state->gids = talloc_array(state, uint64_t, state->num_gids); > if (tevent_req_nomem(state->gids, req)) { > return; >@@ -673,11 +680,6 @@ static void cli_posix_whoami_done(struct tevent_req *subreq) > p = rdata + 40; > > for (i = 0; i < state->num_gids; i++) { >- if (p + 8 > rdata + num_rdata) { >- tevent_req_nterror(req, >- NT_STATUS_INVALID_NETWORK_RESPONSE); >- return; >- } > state->gids[i] = BVAL(p, 0); > p += 8; > } >-- >2.25.1 > > >From 1d830b72140fa95a708cf08443e3abc6efb7c546 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 3 May 2021 16:22:43 +1200 >Subject: [PATCH 076/380] libsmb: Check to see that whoami is not receiving > more data than it requested > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 9e414233c84d2f2fa4a9415be9ee975eca8b9bfd) >--- > source3/libsmb/clifsinfo.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > >diff --git a/source3/libsmb/clifsinfo.c b/source3/libsmb/clifsinfo.c >index aca559d153b..6f3c07a8a7e 100644 >--- a/source3/libsmb/clifsinfo.c >+++ b/source3/libsmb/clifsinfo.c >@@ -570,6 +570,8 @@ struct posix_whoami_state { > > static void cli_posix_whoami_done(struct tevent_req *subreq); > >+static const uint32_t posix_whoami_max_rdata = 62*1024; >+ > struct tevent_req *cli_posix_whoami_send(TALLOC_CTX *mem_ctx, > struct tevent_context *ev, > struct cli_state *cli) >@@ -586,7 +588,7 @@ struct tevent_req *cli_posix_whoami_send(TALLOC_CTX *mem_ctx, > SSVAL(state->setup, 0, TRANSACT2_QFSINFO); > SSVAL(state->param, 0, SMB_QUERY_POSIX_WHOAMI); > >- state->max_rdata = 62*1024; >+ state->max_rdata = posix_whoami_max_rdata; > > subreq = cli_trans_send(state, /* mem ctx. */ > ev, /* event ctx. */ >@@ -650,7 +652,7 @@ static void cli_posix_whoami_done(struct tevent_req *subreq) > * parsing network packets in C. > */ > >- if (num_rdata < 40) { >+ if (num_rdata < 40 || num_rdata > posix_whoami_max_rdata) { > tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE); > return; > } >-- >2.25.1 > > >From c9d13bc9d0f368858b4e04f4fd6ec326b101a9ce Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 3 May 2021 16:24:42 +1200 >Subject: [PATCH 077/380] libsmb: Ensure that whoami parses all the data > provided to it > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 9b96ebea5c6966b096cf1100a0895a9c41f2aa1d) >--- > source3/libsmb/clifsinfo.c | 7 +++++++ > 1 file changed, 7 insertions(+) > >diff --git a/source3/libsmb/clifsinfo.c b/source3/libsmb/clifsinfo.c >index 6f3c07a8a7e..f09428bdbcb 100644 >--- a/source3/libsmb/clifsinfo.c >+++ b/source3/libsmb/clifsinfo.c >@@ -714,6 +714,13 @@ static void cli_posix_whoami_done(struct tevent_req *subreq) > p += sid_size; > num_rdata -= sid_size; > } >+ >+ if (num_rdata != 0) { >+ tevent_req_nterror(req, >+ NT_STATUS_INVALID_NETWORK_RESPONSE); >+ return; >+ } >+ > tevent_req_done(req); > } > >-- >2.25.1 > > >From a4df60363edb107d0a1287b394ace2f7fccbaea6 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 30 Apr 2021 12:49:24 +1200 >Subject: [PATCH 078/380] pylibsmb: Add posix_whoami() > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >[abartlet@samba.org backport from commit >482559436f12a85adb3409433aac3ab06baa82b1 as the 4.13 backport >doesn't have ealier pylibsmb changes including >752a8f870de2bb087802a1287d7fb6c7624ac631 >(s3:pylibsmb: remove unused SECINFO_DEFAULT_FLAGS)] >--- > source3/libsmb/pylibsmb.c | 138 +++++++++++++++++++++++++++++++++++++- > 1 file changed, 137 insertions(+), 1 deletion(-) > >diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c >index c09df917251..a882fe2f2a7 100644 >--- a/source3/libsmb/pylibsmb.c >+++ b/source3/libsmb/pylibsmb.c >@@ -43,6 +43,8 @@ > SECINFO_DACL | SECINFO_PROTECTED_DACL | SECINFO_UNPROTECTED_DACL | \ > SECINFO_SACL | SECINFO_PROTECTED_SACL | SECINFO_UNPROTECTED_SACL) > >+static PyTypeObject *dom_sid_Type = NULL; >+ > static PyTypeObject *get_pytype(const char *module, const char *type) > { > PyObject *mod; >@@ -1357,6 +1359,123 @@ static PyObject *py_smb_mkdir(struct py_cli_state *self, PyObject *args) > Py_RETURN_NONE; > } > >+/* >+ * Does a whoami call >+ */ >+static PyObject *py_smb_posix_whoami(struct py_cli_state *self, >+ PyObject *Py_UNUSED(ignored)) >+{ >+ TALLOC_CTX *frame = talloc_stackframe(); >+ NTSTATUS status; >+ struct tevent_req *req = NULL; >+ uint64_t uid; >+ uint64_t gid; >+ uint32_t num_gids; >+ uint64_t *gids = NULL; >+ uint32_t num_sids; >+ struct dom_sid *sids = NULL; >+ bool guest; >+ PyObject *py_gids = NULL; >+ PyObject *py_sids = NULL; >+ PyObject *py_guest = NULL; >+ PyObject *py_ret = NULL; >+ Py_ssize_t i; >+ >+ req = cli_posix_whoami_send(frame, self->ev, self->cli); >+ if (!py_tevent_req_wait_exc(self, req)) { >+ goto fail; >+ } >+ status = cli_posix_whoami_recv(req, >+ frame, >+ &uid, >+ &gid, >+ &num_gids, >+ &gids, >+ &num_sids, >+ &sids, >+ &guest); >+ if (!NT_STATUS_IS_OK(status)) { >+ PyErr_SetNTSTATUS(status); >+ goto fail; >+ } >+ if (num_gids > PY_SSIZE_T_MAX) { >+ PyErr_SetString(PyExc_OverflowError, "posix_whoami: Too many GIDs"); >+ goto fail; >+ } >+ if (num_sids > PY_SSIZE_T_MAX) { >+ PyErr_SetString(PyExc_OverflowError, "posix_whoami: Too many SIDs"); >+ goto fail; >+ } >+ >+ py_gids = PyList_New(num_gids); >+ if (!py_gids) { >+ goto fail; >+ } >+ for (i = 0; i < num_gids; ++i) { >+ int ret; >+ PyObject *py_item = PyLong_FromUnsignedLongLong(gids[i]); >+ if (!py_item) { >+ goto fail2; >+ } >+ >+ ret = PyList_SetItem(py_gids, i, py_item); >+ if (ret) { >+ goto fail2; >+ } >+ } >+ py_sids = PyList_New(num_sids); >+ if (!py_sids) { >+ goto fail2; >+ } >+ for (i = 0; i < num_sids; ++i) { >+ int ret; >+ struct dom_sid *sid; >+ PyObject *py_item; >+ >+ sid = dom_sid_dup(frame, &sids[i]); >+ if (!sid) { >+ PyErr_NoMemory(); >+ goto fail3; >+ } >+ >+ py_item = pytalloc_steal(dom_sid_Type, sid); >+ if (!py_item) { >+ PyErr_NoMemory(); >+ goto fail3; >+ } >+ >+ ret = PyList_SetItem(py_sids, i, py_item); >+ if (ret) { >+ goto fail3; >+ } >+ } >+ >+ py_guest = guest ? Py_True : Py_False; >+ >+ py_ret = Py_BuildValue("KKNNO", >+ uid, >+ gid, >+ py_gids, >+ py_sids, >+ py_guest); >+ if (!py_ret) { >+ goto fail3; >+ } >+ >+ TALLOC_FREE(frame); >+ return py_ret; >+ >+fail3: >+ Py_CLEAR(py_sids); >+ >+fail2: >+ Py_CLEAR(py_gids); >+ >+fail: >+ TALLOC_FREE(frame); >+ return NULL; >+} >+ > /* > * Checks existence of a directory > */ >@@ -1618,6 +1737,8 @@ static PyMethodDef py_cli_state_methods[] = { > "unlink(path) -> None\n\n \t\tDelete a file." }, > { "mkdir", (PyCFunction)py_smb_mkdir, METH_VARARGS, > "mkdir(path) -> None\n\n \t\tCreate a directory." }, >+ { "posix_whoami", (PyCFunction)py_smb_posix_whoami, METH_NOARGS, >+ "posix_whoami() -> (uid, gid, gids, sids, guest)" }, > { "rmdir", (PyCFunction)py_smb_rmdir, METH_VARARGS, > "rmdir(path) -> None\n\n \t\tDelete a directory." }, > { "chkpath", (PyCFunction)py_smb_chkpath, METH_VARARGS, >@@ -1670,16 +1791,31 @@ static struct PyModuleDef moduledef = { > MODULE_INIT_FUNC(libsmb_samba_internal) > { > PyObject *m = NULL; >+ PyObject *mod = NULL; > > talloc_stackframe(); > >+ if (PyType_Ready(&py_cli_state_type) < 0) { >+ return NULL; >+ } >+ > m = PyModule_Create(&moduledef); > if (m == NULL) { > return m; > } >- if (PyType_Ready(&py_cli_state_type) < 0) { >+ >+ /* Import dom_sid type from dcerpc.security */ >+ mod = PyImport_ImportModule("samba.dcerpc.security"); >+ if (mod == NULL) { > return NULL; > } >+ >+ dom_sid_Type = (PyTypeObject *)PyObject_GetAttrString(mod, "dom_sid"); >+ if (dom_sid_Type == NULL) { >+ Py_DECREF(mod); >+ return NULL; >+ } >+ > Py_INCREF(&py_cli_state_type); > PyModule_AddObject(m, "Conn", (PyObject *)&py_cli_state_type); > >-- >2.25.1 > > >From b1467c9533ce11aa5c3436564780764974648a1b Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 30 Apr 2021 08:58:11 +1200 >Subject: [PATCH 079/380] python: Add SMB credentials cache test > >Test that we can use a credentials cache with a user's service ticket >obtained with our Python code to connect to a service through SMB. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 78a0b57b51642df07deed8aeb6e39e608fafda60) >--- > python/samba/tests/krb5/test_smb.py | 108 ++++++++++++++++++++++++++++ > python/samba/tests/usage.py | 1 + > source4/selftest/tests.py | 1 + > 3 files changed, 110 insertions(+) > create mode 100755 python/samba/tests/krb5/test_smb.py > >diff --git a/python/samba/tests/krb5/test_smb.py b/python/samba/tests/krb5/test_smb.py >new file mode 100755 >index 00000000000..0262a37ebb5 >--- /dev/null >+++ b/python/samba/tests/krb5/test_smb.py >@@ -0,0 +1,108 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# Copyright (C) 2021 Catalyst.Net Ltd >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+from ldb import SCOPE_SUBTREE >+from samba.dcerpc import security >+from samba.ndr import ndr_unpack >+from samba.samba3 import libsmb_samba_internal as libsmb >+from samba.samba3 import param as s3param >+ >+from samba.tests.krb5.kdc_base_test import KDCBaseTest >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class SmbTests(KDCBaseTest): >+ """Test for SMB authentication using Kerberos credentials stored in a >+ credentials cache file. >+ """ >+ >+ def test_smb(self): >+ # Create a user account and a machine account, along with a Kerberos >+ # credentials cache file where the service ticket authenticating the >+ # user are stored. >+ >+ user_name = "smbusr" >+ mach_name = self.dns_host_name >+ service = "cifs" >+ share = "tmp" >+ >+ # Create the user account. >+ (user_credentials, _) = self.create_account(user_name) >+ >+ # Talk to the KDC to obtain the service ticket, which gets placed into >+ # the cache. The machine account name has to match the name in the >+ # ticket, to ensure that the krbtgt ticket doesn't also need to be >+ # stored. >+ (creds, cachefile) = self.create_ccache_with_user(user_credentials, >+ mach_name, >+ service) >+ >+ # Set the Kerberos 5 credentials cache environment variable. This is >+ # required because the codepath that gets run (gse_krb5) looks for it >+ # in here and not in the credentials object. >+ krb5_ccname = os.environ.get("KRB5CCNAME", "") >+ self.addCleanup(os.environ.__setitem__, "KRB5CCNAME", krb5_ccname) >+ os.environ["KRB5CCNAME"] = "FILE:" + cachefile.name >+ >+ # Authenticate in-process to the machine account using the user's >+ # cached credentials. >+ >+ # Retrieve the user account's SID. >+ ldb_res = self.ldb.search(scope=SCOPE_SUBTREE, >+ expression="(sAMAccountName=%s)" % user_name, >+ attrs=["objectSid"]) >+ self.assertEqual(1, len(ldb_res)) >+ sid = ndr_unpack(security.dom_sid, ldb_res[0]["objectSid"][0]) >+ >+ # Connect to a share and retrieve the user SID. >+ s3_lp = s3param.get_context() >+ s3_lp.load(self.lp.configfile) >+ >+ min_protocol = s3_lp.get("client min protocol") >+ self.addCleanup(s3_lp.set, "client min protocol", min_protocol) >+ s3_lp.set("client min protocol", "NT1") >+ >+ max_protocol = s3_lp.get("client max protocol") >+ self.addCleanup(s3_lp.set, "client max protocol", max_protocol) >+ s3_lp.set("client max protocol", "NT1") >+ >+ conn = libsmb.Conn(mach_name, share, lp=s3_lp, creds=creds) >+ >+ (uid, gid, gids, sids, guest) = conn.posix_whoami() >+ >+ # Ensure that they match. >+ self.assertEqual(sid, sids[0]) >+ >+ # Remove the cached credentials file. >+ os.remove(cachefile.name) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index eb7c003b48b..e8eda7d6896 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -98,6 +98,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/test_ccache.py', > 'python/samba/tests/krb5/test_ldap.py', > 'python/samba/tests/krb5/test_rpc.py', >+ 'python/samba/tests/krb5/test_smb.py', > 'python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py', > } > >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 5acbeda6bbe..f26bdc2bf6f 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -755,6 +755,7 @@ planoldpythontestsuite("fl2008r2dc:local", "samba.tests.krb5.xrealm_tests") > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ccache") > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ldap") > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_rpc") >+planoldpythontestsuite("ad_dc_smb1", "samba.tests.krb5.test_smb") > > for env in ["ad_dc", smbv1_disabled_testenv]: > planoldpythontestsuite(env, "samba.tests.smb", extra_args=['-U"$USERNAME%$PASSWORD"']) >-- >2.25.1 > > >From b42676c2d97e77b7ec107a949af52d68fa771ac0 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 3 May 2021 14:42:10 +1200 >Subject: [PATCH 080/380] python: Ensure reference counts are properly > incremented > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 290c1dc0975867a71c02e911708323d1f38b6f96) >--- > lib/talloc/pytalloc.c | 4 ++-- > libgpo/pygpo.c | 2 +- > source4/auth/gensec/pygensec.c | 4 ++-- > source4/librpc/ndr/py_security.c | 2 +- > source4/ntvfs/posix/python/pyposix_eadb.c | 2 +- > source4/ntvfs/posix/python/pyxattr_native.c | 4 ++-- > source4/ntvfs/posix/python/pyxattr_tdb.c | 2 +- > 7 files changed, 10 insertions(+), 10 deletions(-) > >diff --git a/lib/talloc/pytalloc.c b/lib/talloc/pytalloc.c >index 12c7325fcac..700e0f7f2af 100644 >--- a/lib/talloc/pytalloc.c >+++ b/lib/talloc/pytalloc.c >@@ -37,7 +37,7 @@ static PyObject *pytalloc_report_full(PyObject *self, PyObject *args) > } else { > talloc_report_full(pytalloc_get_mem_ctx(py_obj), stdout); > } >- return Py_None; >+ Py_RETURN_NONE; > } > > /* enable null tracking */ >@@ -45,7 +45,7 @@ static PyObject *pytalloc_enable_null_tracking(PyObject *self, > PyObject *Py_UNUSED(ignored)) > { > talloc_enable_null_tracking(); >- return Py_None; >+ Py_RETURN_NONE; > } > > /* return the number of talloc blocks */ >diff --git a/libgpo/pygpo.c b/libgpo/pygpo.c >index 97bbb3ec528..ddfb5c76ef9 100644 >--- a/libgpo/pygpo.c >+++ b/libgpo/pygpo.c >@@ -41,7 +41,7 @@ static PyObject* GPO_get_##ATTR(PyObject *self, void *closure) \ > if (gpo_ptr->ATTR) \ > return PyUnicode_FromString(gpo_ptr->ATTR); \ > else \ >- return Py_None; \ >+ Py_RETURN_NONE; \ > } > GPO_getter(ds_path) > GPO_getter(file_sys_path) >diff --git a/source4/auth/gensec/pygensec.c b/source4/auth/gensec/pygensec.c >index 35b3307ab8f..35095344168 100644 >--- a/source4/auth/gensec/pygensec.c >+++ b/source4/auth/gensec/pygensec.c >@@ -426,9 +426,9 @@ static PyObject *py_gensec_have_feature(PyObject *self, PyObject *args) > return NULL; > > if (gensec_have_feature(security, feature)) { >- return Py_True; >+ Py_RETURN_TRUE; > } >- return Py_False; >+ Py_RETURN_FALSE; > } > > static PyObject *py_gensec_set_max_update_size(PyObject *self, PyObject *args) >diff --git a/source4/librpc/ndr/py_security.c b/source4/librpc/ndr/py_security.c >index 0b8a1c66b7a..fc0aea99c3b 100644 >--- a/source4/librpc/ndr/py_security.c >+++ b/source4/librpc/ndr/py_security.c >@@ -342,7 +342,7 @@ static PyObject *py_descriptor_richcmp( > break; > } > >- return Py_NotImplemented; >+ Py_RETURN_NOTIMPLEMENTED; > } > > static void py_descriptor_patch(PyTypeObject *type) >diff --git a/source4/ntvfs/posix/python/pyposix_eadb.c b/source4/ntvfs/posix/python/pyposix_eadb.c >index ef4db0e867a..14979b95a58 100644 >--- a/source4/ntvfs/posix/python/pyposix_eadb.c >+++ b/source4/ntvfs/posix/python/pyposix_eadb.c >@@ -32,7 +32,7 @@ > static PyObject *py_is_xattr_supported(PyObject *self, > PyObject *Py_UNUSED(ignored)) > { >- return Py_True; >+ Py_RETURN_TRUE; > } > > static PyObject *py_wrap_setxattr(PyObject *self, PyObject *args) >diff --git a/source4/ntvfs/posix/python/pyxattr_native.c b/source4/ntvfs/posix/python/pyxattr_native.c >index 7d5bee0c37c..c479be66a65 100644 >--- a/source4/ntvfs/posix/python/pyxattr_native.c >+++ b/source4/ntvfs/posix/python/pyxattr_native.c >@@ -29,9 +29,9 @@ static PyObject *py_is_xattr_supported(PyObject *self, > PyObject *Py_UNUSED(ignored)) > { > #if !defined(HAVE_XATTR_SUPPORT) >- return Py_False; >+ Py_RETURN_FALSE; > #else >- return Py_True; >+ Py_RETURN_TRUE; > #endif > } > >diff --git a/source4/ntvfs/posix/python/pyxattr_tdb.c b/source4/ntvfs/posix/python/pyxattr_tdb.c >index 397cae77bc9..133c7089d5f 100644 >--- a/source4/ntvfs/posix/python/pyxattr_tdb.c >+++ b/source4/ntvfs/posix/python/pyxattr_tdb.c >@@ -36,7 +36,7 @@ > static PyObject *py_is_xattr_supported(PyObject *self, > PyObject *Py_UNUSED(ignored)) > { >- return Py_True; >+ Py_RETURN_TRUE; > } > > static PyObject *py_wrap_setxattr(PyObject *self, PyObject *args) >-- >2.25.1 > > >From 683872460d45cd18327e40d475f4245cd7b6f3d8 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 3 May 2021 14:43:04 +1200 >Subject: [PATCH 081/380] python: Fix erroneous increments of reference counts > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 66695f0f94775c4db24fb625fe78ff44d964b5ad) >--- > source3/passdb/py_passdb.c | 4 ---- > 1 file changed, 4 deletions(-) > >diff --git a/source3/passdb/py_passdb.c b/source3/passdb/py_passdb.c >index f7e80c47397..c323adf2969 100644 >--- a/source3/passdb/py_passdb.c >+++ b/source3/passdb/py_passdb.c >@@ -2075,8 +2075,6 @@ static PyObject *py_pdb_enum_group_mapping(PyObject *self, PyObject *args) > PyObject *py_gmap_list, *py_group_map; > int i; > >- Py_INCREF(Py_None); >- > if (!PyArg_ParseTuple(args, "|O!ii:enum_group_mapping", dom_sid_Type, &py_domain_sid, > &lsa_sidtype_value, &unix_only)) { > talloc_free(frame); >@@ -2816,8 +2814,6 @@ static PyObject *py_pdb_search_aliases(PyObject *self, PyObject *args) > PyObject *py_domain_sid = Py_None; > struct dom_sid *domain_sid = NULL; > >- Py_INCREF(Py_None); >- > if (!PyArg_ParseTuple(args, "|O!:search_aliases", dom_sid_Type, &py_domain_sid)) { > talloc_free(frame); > return NULL; >-- >2.25.1 > > >From c10f2a41b0d6b22d39af2095b9881ea97b18f8dd Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 10 May 2021 16:43:03 +1200 >Subject: [PATCH 082/380] python: Fix ticket timestamp conversion when local > timezone is not UTC > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit b9006f33343ba8bb82ef8ffe1fd90c780961b41e) >--- > python/samba/tests/krb5/kdc_base_test.py | 23 +++++++++++++++++++---- > 1 file changed, 19 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index d8193ae9cdc..e345f739e1c 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -18,7 +18,7 @@ > > import sys > import os >-from datetime import datetime >+from datetime import datetime, timezone > import tempfile > > sys.path.insert(0, "bin/python") >@@ -519,11 +519,26 @@ class KDCBaseTest(RawKerberosTest): > cred.server = sprincipal > cred.keyblock = keyblock > cred.authtime = int(datetime.strptime(authtime.decode(), >- "%Y%m%d%H%M%SZ").timestamp()) >+ "%Y%m%d%H%M%SZ") >+ .replace(tzinfo=timezone.utc).timestamp()) > cred.starttime = int(datetime.strptime(starttime.decode(), >- "%Y%m%d%H%M%SZ").timestamp()) >+ "%Y%m%d%H%M%SZ") >+ .replace(tzinfo=timezone.utc).timestamp()) > cred.endtime = int(datetime.strptime(endtime.decode(), >- "%Y%m%d%H%M%SZ").timestamp()) >+ "%Y%m%d%H%M%SZ") >+ .replace(tzinfo=timezone.utc).timestamp()) >+ >+ # Account for clock skew of up to five minutes. >+ self.assertLess(cred.authtime - 5*60, >+ datetime.now(timezone.utc).timestamp(), >+ "Ticket not yet valid - clocks may be out of sync.") >+ self.assertLess(cred.starttime - 5*60, >+ datetime.now(timezone.utc).timestamp(), >+ "Ticket not yet valid - clocks may be out of sync.") >+ self.assertGreater(cred.endtime - 60*60, >+ datetime.now(timezone.utc).timestamp(), >+ "Ticket already expired/about to expire - clocks may be out of sync.") >+ > cred.renew_till = cred.endtime > cred.is_skey = 0 > cred.ticket_flags = int(enc_part['flags'], 2) >-- >2.25.1 > > >From 391b4538fa0c2064a32f3f4dba61b4b8fc419bf3 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 10 May 2021 15:06:06 +1200 >Subject: [PATCH 083/380] python: Make credentials cache test run against > Windows > >Windows, unlike Samba, requires the service principal name to be set >when requesting a ticket to that service. > >Additionally, default_realm from the libdefaults section of krb5.conf >should be set so that the correct realm is used. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Autobuild-User(master): Jeremy Allison <jra@samba.org> >Autobuild-Date(master): Wed May 19 02:22:01 UTC 2021 on sn-devel-184 > >(cherry picked from commit 7791acb074b84ec7b571a81f15b56d33e2214ce9) >--- > python/samba/tests/krb5/test_ccache.py | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/test_ccache.py b/python/samba/tests/krb5/test_ccache.py >index e0998a4c43f..32c9e3cce6b 100755 >--- a/python/samba/tests/krb5/test_ccache.py >+++ b/python/samba/tests/krb5/test_ccache.py >@@ -47,13 +47,16 @@ class CcacheTests(KDCBaseTest): > > user_name = "ccacheusr" > mach_name = "ccachemac" >+ service = "host" > > # Create the user account. > (user_credentials, _) = self.create_account(user_name) > > # Create the machine account. > (mach_credentials, _) = self.create_account(mach_name, >- machine_account=True) >+ machine_account=True, >+ spn="%s/%s" % (service, >+ mach_name)) > > # Talk to the KDC to obtain the service ticket, which gets placed into > # the cache. The machine account name has to match the name in the >-- >2.25.1 > > >From b3fe7ab0c493db72c38318d828e067045232abd9 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Thu, 9 Apr 2020 21:04:44 +0200 >Subject: [PATCH 084/380] auth/credentials: allow credentials.Credentials to > act as base class > >In tests it's useful to add more details. > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 1f413b2b2977687884781ca2399dadf6611ab461) >--- > auth/credentials/pycredentials.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c >index 314f0eba894..ad39fe13925 100644 >--- a/auth/credentials/pycredentials.c >+++ b/auth/credentials/pycredentials.c >@@ -1221,7 +1221,7 @@ static struct PyModuleDef moduledef = { > PyTypeObject PyCredentials = { > .tp_name = "credentials.Credentials", > .tp_new = py_creds_new, >- .tp_flags = Py_TPFLAGS_DEFAULT, >+ .tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, > .tp_methods = py_creds_methods, > }; > >-- >2.25.1 > > >From 9ccd5f89d624a4a7dacac79e5b42f8afb851b6f6 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Wed, 15 Apr 2020 16:50:55 +0200 >Subject: [PATCH 085/380] Rename > python/samba/tests/krb5/{rfc4120_pyasn1_regen.sh => pyasn1_regen.sh} > >This is a clearer name for the script > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit fef08add9ec324fb0c3902e96c2a91c07646d499) >--- > .../samba/tests/krb5/{rfc4120_pyasn1_regen.sh => pyasn1_regen.sh} | 0 > 1 file changed, 0 insertions(+), 0 deletions(-) > rename python/samba/tests/krb5/{rfc4120_pyasn1_regen.sh => pyasn1_regen.sh} (100%) > >diff --git a/python/samba/tests/krb5/rfc4120_pyasn1_regen.sh b/python/samba/tests/krb5/pyasn1_regen.sh >similarity index 100% >rename from python/samba/tests/krb5/rfc4120_pyasn1_regen.sh >rename to python/samba/tests/krb5/pyasn1_regen.sh >-- >2.25.1 > > >From f0a34678d518b488b9f21c9c5d11265a31b737a4 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Thu, 9 Apr 2020 11:10:11 +0200 >Subject: [PATCH 086/380] tests/krb5/rfc4120.asn1: Improve definitions to allow > expanded testing > >Update and re-generate the ASN.1 to allow an improved testsuite. > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d4492a8aaaf70cbe81af7e6703b4ea9fc1f24162) >--- > python/samba/tests/krb5/rfc4120.asn1 | 70 ++++++++++- > python/samba/tests/krb5/rfc4120_pyasn1.py | 134 +++++++++++++++++++++- > 2 files changed, 199 insertions(+), 5 deletions(-) > >diff --git a/python/samba/tests/krb5/rfc4120.asn1 b/python/samba/tests/krb5/rfc4120.asn1 >index 654f9788ca7..d81d06ad6f7 100644 >--- a/python/samba/tests/krb5/rfc4120.asn1 >+++ b/python/samba/tests/krb5/rfc4120.asn1 >@@ -386,14 +386,14 @@ PA-ENC-TS-ENC ::= SEQUENCE { > } > > ETYPE-INFO-ENTRY ::= SEQUENCE { >- etype [0] Int32, >+ etype [0] EncryptionType, --Int32 EncryptionType -- > salt [1] OCTET STRING OPTIONAL > } > > ETYPE-INFO ::= SEQUENCE OF ETYPE-INFO-ENTRY > > ETYPE-INFO2-ENTRY ::= SEQUENCE { >- etype [0] Int32, >+ etype [0] EncryptionType, --Int32 EncryptionType -- > salt [1] KerberosString OPTIONAL, > s2kparams [2] OCTET STRING OPTIONAL > } >@@ -425,9 +425,48 @@ PA-S4U2Self ::= SEQUENCE { > auth [3] KerberosString > } > >+-- >+-- >+-- MS-KILE Start >+ >+KERB-ERROR-DATA ::= SEQUENCE { >+ data-type [1] KerbErrorDataType, >+ data-value [2] OCTET STRING OPTIONAL >+} >+ >+KerbErrorDataType ::= INTEGER >+ >+KERB-PA-PAC-REQUEST ::= SEQUENCE { >+ include-pac[0] BOOLEAN --If TRUE, and no pac present, include PAC. >+ --If FALSE, and PAC present, remove PAC >+} >+ >+KERB-LOCAL ::= OCTET STRING -- Implementation-specific data which MUST be >+ -- ignored if Kerberos client is not local. >+ >+KERB-AD-RESTRICTION-ENTRY ::= SEQUENCE { >+ restriction-type [0] Int32, >+ restriction [1] OCTET STRING -- LSAP_TOKEN_INFO_INTEGRITY structure >+} >+ >+PA-SUPPORTED-ENCTYPES ::= Int32 -- Supported Encryption Types Bit Field -- > >+PACOptionFlags ::= KerberosFlags -- Claims (0) >+ -- Branch Aware (1) >+ -- Forward to Full DC (2) >+ -- Resource Based Constrained Delegation (3) >+PA-PAC-OPTIONS ::= SEQUENCE { >+ options [0] PACOptionFlags >+} >+-- Note: KerberosFlags ::= BIT STRING (SIZE (32..MAX)) >+-- minimum number of bits shall be sent, but no fewer than 32 > >+KERB-KEY-LIST-REQ ::= SEQUENCE OF EncryptionType -- Int32 encryption type -- >+KERB-KEY-LIST-REP ::= SEQUENCE OF EncryptionKey > >+-- MS-KILE End >+-- >+-- > > -- > -- >@@ -504,6 +543,15 @@ KDCOptionsSequence ::= SEQUENCE { > dummy [0] KDCOptionsValues > } > >+APOptionsValues ::= BIT STRING { -- KerberosFlags >+ reserved(0), >+ use-session-key(1), >+ mutual-required(2) >+} >+APOptionsSequence ::= SEQUENCE { >+ dummy [0] APOptionsValues >+} >+ > MessageTypeValues ::= INTEGER { > krb-as-req(10), -- Request for initial authentication > krb-as-rep(11), -- Response to KRB_AS_REQ request >@@ -669,4 +717,22 @@ EncryptionTypeSequence ::= SEQUENCE { > dummy [0] EncryptionTypeValues > } > >+KerbErrorDataTypeValues ::= INTEGER { >+ kERB-AP-ERR-TYPE-SKEW-RECOVERY(2), >+ kERB-ERR-TYPE-EXTENDED(3) >+} >+KerbErrorDataTypeSequence ::= SEQUENCE { >+ dummy [0] KerbErrorDataTypeValues >+} >+ >+PACOptionFlagsValues ::= BIT STRING { -- KerberosFlags >+ claims(0), >+ branch-aware(1), >+ forward-to-full-dc(2), >+ resource-based-constrained-delegation(3) >+} >+PACOptionFlagsSequence ::= SEQUENCE { >+ dummy [0] PACOptionFlagsValues >+} >+ > END >diff --git a/python/samba/tests/krb5/rfc4120_pyasn1.py b/python/samba/tests/krb5/rfc4120_pyasn1.py >index 1d89f94adf1..56fe02a68f0 100644 >--- a/python/samba/tests/krb5/rfc4120_pyasn1.py >+++ b/python/samba/tests/krb5/rfc4120_pyasn1.py >@@ -1,5 +1,5 @@ > # Auto-generated by asn1ate v.0.6.1.dev0 from rfc4120.asn1 >-# (last modified on 2020-11-06 11:30:42.476808) >+# (last modified on 2021-06-16 08:54:13.969508) > > # KerberosV5Spec2 > from pyasn1.type import univ, char, namedtype, namedval, tag, constraint, useful >@@ -175,6 +175,26 @@ AP_REQ.componentType = namedtype.NamedTypes( > ) > > >+class APOptionsValues(univ.BitString): >+ pass >+ >+ >+APOptionsValues.namedValues = namedval.NamedValues( >+ ('reserved', 0), >+ ('use-session-key', 1), >+ ('mutual-required', 2) >+) >+ >+ >+class APOptionsSequence(univ.Sequence): >+ pass >+ >+ >+APOptionsSequence.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('dummy', APOptionsValues().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ > class PADataType(Int32): > pass > >@@ -384,7 +404,7 @@ class ETYPE_INFO_ENTRY(univ.Sequence): > > > ETYPE_INFO_ENTRY.componentType = namedtype.NamedTypes( >- namedtype.NamedType('etype', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('etype', EncryptionType().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), > namedtype.OptionalNamedType('salt', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) > ) > >@@ -401,7 +421,7 @@ class ETYPE_INFO2_ENTRY(univ.Sequence): > > > ETYPE_INFO2_ENTRY.componentType = namedtype.NamedTypes( >- namedtype.NamedType('etype', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('etype', EncryptionType().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), > namedtype.OptionalNamedType('salt', KerberosString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), > namedtype.OptionalNamedType('s2kparams', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))) > ) >@@ -636,6 +656,57 @@ KDCOptionsSequence.componentType = namedtype.NamedTypes( > ) > > >+class KERB_AD_RESTRICTION_ENTRY(univ.Sequence): >+ pass >+ >+ >+KERB_AD_RESTRICTION_ENTRY.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('restriction-type', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('restriction', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+) >+ >+ >+class KerbErrorDataType(univ.Integer): >+ pass >+ >+ >+class KERB_ERROR_DATA(univ.Sequence): >+ pass >+ >+ >+KERB_ERROR_DATA.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('data-type', KerbErrorDataType().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.OptionalNamedType('data-value', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))) >+) >+ >+ >+class KERB_KEY_LIST_REP(univ.SequenceOf): >+ pass >+ >+ >+KERB_KEY_LIST_REP.componentType = EncryptionKey() >+ >+ >+class KERB_KEY_LIST_REQ(univ.SequenceOf): >+ pass >+ >+ >+KERB_KEY_LIST_REQ.componentType = EncryptionType() >+ >+ >+class KERB_LOCAL(univ.OctetString): >+ pass >+ >+ >+class KERB_PA_PAC_REQUEST(univ.Sequence): >+ pass >+ >+ >+KERB_PA_PAC_REQUEST.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('include-pac', univ.Boolean().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ > class KRB_CRED(univ.Sequence): > pass > >@@ -710,6 +781,25 @@ KRB_SAFE.componentType = namedtype.NamedTypes( > ) > > >+class KerbErrorDataTypeValues(univ.Integer): >+ pass >+ >+ >+KerbErrorDataTypeValues.namedValues = namedval.NamedValues( >+ ('kERB-AP-ERR-TYPE-SKEW-RECOVERY', 2), >+ ('kERB-ERR-TYPE-EXTENDED', 3) >+) >+ >+ >+class KerbErrorDataTypeSequence(univ.Sequence): >+ pass >+ >+ >+KerbErrorDataTypeSequence.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('dummy', KerbErrorDataTypeValues().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ > class MessageTypeValues(univ.Integer): > pass > >@@ -781,6 +871,19 @@ PA_ENC_TS_ENC.componentType = namedtype.NamedTypes( > ) > > >+class PACOptionFlags(KerberosFlags): >+ pass >+ >+ >+class PA_PAC_OPTIONS(univ.Sequence): >+ pass >+ >+ >+PA_PAC_OPTIONS.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('options', PACOptionFlags().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ > class PA_S4U2Self(univ.Sequence): > pass > >@@ -793,6 +896,31 @@ PA_S4U2Self.componentType = namedtype.NamedTypes( > ) > > >+class PA_SUPPORTED_ENCTYPES(Int32): >+ pass >+ >+ >+class PACOptionFlagsValues(univ.BitString): >+ pass >+ >+ >+PACOptionFlagsValues.namedValues = namedval.NamedValues( >+ ('claims', 0), >+ ('branch-aware', 1), >+ ('forward-to-full-dc', 2), >+ ('resource-based-constrained-delegation', 3) >+) >+ >+ >+class PACOptionFlagsSequence(univ.Sequence): >+ pass >+ >+ >+PACOptionFlagsSequence.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('dummy', PACOptionFlagsValues().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) >+) >+ >+ > class PADataTypeValues(univ.Integer): > pass > >-- >2.25.1 > > >From 1bc06fdf8758e3a70d70cdd2048550eea2a0deae Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Thu, 9 Apr 2020 10:55:28 +0200 >Subject: [PATCH 087/380] tests/krb5/raw_testcase.py: Add > get_{client,server,krbtgt}_creds() > >These helpful functions allow us to build the various credentials >that we will use in validating the KDC responses in this test. > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit c3222870b92db7f867557c2896b7bf39915d469a) >--- > python/samba/tests/krb5/raw_testcase.py | 199 +++++++++++++++++++++--- > python/samba/tests/krb5/simple_tests.py | 6 +- > 2 files changed, 183 insertions(+), 22 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 27ab89ecf99..b28939f0388 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -22,10 +22,12 @@ import struct > import time > import datetime > import random >+import binascii > > import samba.tests > from samba.credentials import Credentials > from samba.tests import TestCaseInTempDir >+from samba.dcerpc import security > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > import samba.tests.krb5.kcrypto as kcrypto > >@@ -177,6 +179,81 @@ class Krb5EncryptionKey(object): > } > return EncryptionKey_obj > >+class KerberosCredentials(Credentials): >+ def __init__(self): >+ super(KerberosCredentials, self).__init__() >+ all_enc_types = 0 >+ all_enc_types |= security.KERB_ENCTYPE_RC4_HMAC_MD5 >+ all_enc_types |= security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96 >+ all_enc_types |= security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96 >+ >+ self.as_supported_enctypes = all_enc_types >+ self.tgs_supported_enctypes = all_enc_types >+ self.ap_supported_enctypes = all_enc_types >+ >+ self.kvno = None >+ self.forced_keys = {} >+ >+ self.forced_salt = None >+ return >+ >+ def set_as_supported_enctypes(self, value): >+ self.as_supported_enctypes = int(value) >+ return >+ >+ def set_tgs_supported_enctypes(self, value): >+ self.tgs_supported_enctypes = int(value) >+ return >+ >+ def set_ap_supported_enctypes(self, value): >+ self.ap_supported_enctypes = int(value) >+ return >+ >+ def _get_krb5_etypes(self, supported_enctypes): >+ etypes = () >+ >+ if supported_enctypes & security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96: >+ etypes += (kcrypto.Enctype.AES256,) >+ if supported_enctypes & security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96: >+ etypes += (kcrypto.Enctype.AES128,) >+ if supported_enctypes & security.KERB_ENCTYPE_RC4_HMAC_MD5: >+ etypes += (kcrypto.Enctype.RC4,) >+ >+ return etypes >+ >+ def get_as_krb5_etypes(self): >+ return self._get_krb5_etypes(self.as_supported_enctypes) >+ >+ def get_tgs_krb5_etypes(self): >+ return self._get_krb5_etypes(self.tgs_supported_enctypes) >+ >+ def get_ap_krb5_etypes(self): >+ return self._get_krb5_etypes(self.ap_supported_enctypes) >+ >+ def set_kvno(self, kvno): >+ self.kvno = kvno >+ >+ def get_kvno(self): >+ return self.kvno >+ >+ def set_forced_key(self, etype, hexkey): >+ etype = int(etype) >+ contents = binascii.a2b_hex(hexkey) >+ key = kcrypto.Key(etype, contents) >+ self.forced_keys[etype] = Krb5EncryptionKey(key, self.kvno) >+ >+ def get_forced_key(self, etype): >+ etype = int(etype) >+ if etype in self.forced_keys: >+ return self.forced_keys[etype] >+ return None >+ >+ def set_forced_salt(self, salt): >+ self.forced_salt = bytes(salt) >+ return >+ >+ def get_forced_salt(self): >+ return self.forced_salt > > class RawKerberosTest(TestCaseInTempDir): > """A raw Kerberos Test case.""" >@@ -229,33 +306,113 @@ class RawKerberosTest(TestCaseInTempDir): > sys.stderr.write("connected[%s]\n" % self.host) > return > >- def get_user_creds(self): >- c = Credentials() >+ def _get_krb5_creds(self, prefix, >+ default_username=None, >+ allow_missing_password=False, >+ require_strongest_key=False): >+ c = KerberosCredentials() > c.guess() >- domain = samba.tests.env_get_var_value('DOMAIN') >- realm = samba.tests.env_get_var_value('REALM') >- username = samba.tests.env_get_var_value('USERNAME') >- password = samba.tests.env_get_var_value('PASSWORD') >- c.set_domain(domain) >- c.set_realm(realm) >- c.set_username(username) >- c.set_password(password) >- return c > >- def get_service_creds(self, allow_missing_password=False): >- c = Credentials() >- c.guess() >- domain = samba.tests.env_get_var_value('DOMAIN') >- realm = samba.tests.env_get_var_value('REALM') >- username = samba.tests.env_get_var_value('SERVICE_USERNAME') >- password = samba.tests.env_get_var_value( >- 'SERVICE_PASSWORD', >- allow_missing=allow_missing_password) >+ def env_get_var(varname, prefix, fallback_default=True, allow_missing=False): >+ val = None >+ if prefix is not None: >+ allow_missing_prefix = allow_missing >+ if fallback_default: >+ allow_missing_prefix = True >+ val = samba.tests.env_get_var_value('%s_%s' % (prefix, varname), >+ allow_missing=allow_missing_prefix) >+ else: >+ fallback_default = True >+ if val is None and fallback_default: >+ val = samba.tests.env_get_var_value(varname, >+ allow_missing=allow_missing) >+ return val >+ >+ domain = env_get_var('DOMAIN', prefix) >+ realm = env_get_var('REALM', prefix) >+ allow_missing_username = False >+ if default_username is not None: >+ allow_missing_username = True >+ username = env_get_var('USERNAME', prefix, >+ fallback_default=False, >+ allow_missing=allow_missing_username) >+ if username is None: >+ username = default_username >+ password = env_get_var('PASSWORD', prefix, >+ fallback_default=False, >+ allow_missing=allow_missing_password) > c.set_domain(domain) > c.set_realm(realm) > c.set_username(username) > if password is not None: > c.set_password(password) >+ as_supported_enctypes = env_get_var('AS_SUPPORTED_ENCTYPES', >+ prefix, allow_missing=True) >+ if as_supported_enctypes is not None: >+ c.set_as_supported_enctypes(as_supported_enctypes) >+ tgs_supported_enctypes = env_get_var('TGS_SUPPORTED_ENCTYPES', >+ prefix, allow_missing=True) >+ if tgs_supported_enctypes is not None: >+ c.set_tgs_supported_enctypes(tgs_supported_enctypes) >+ ap_supported_enctypes = env_get_var('AP_SUPPORTED_ENCTYPES', >+ prefix, allow_missing=True) >+ if ap_supported_enctypes is not None: >+ c.set_ap_supported_enctypes(ap_supported_enctypes) >+ >+ if require_strongest_key: >+ kvno_allow_missing = False >+ if password is None: >+ aes256_allow_missing = False >+ else: >+ aes256_allow_missing = True >+ else: >+ kvno_allow_missing = True >+ aes256_allow_missing = True >+ kvno = env_get_var('KVNO', prefix, >+ fallback_default=False, >+ allow_missing=kvno_allow_missing) >+ if kvno is not None: >+ c.set_kvno(kvno) >+ aes256_key = env_get_var('AES256_KEY_HEX', prefix, >+ fallback_default=False, >+ allow_missing=aes256_allow_missing) >+ if aes256_key is not None: >+ c.set_forced_key(kcrypto.Enctype.AES256, aes256_key) >+ aes128_key = env_get_var('AES128_KEY_HEX', prefix, >+ fallback_default=False, allow_missing=True) >+ if aes128_key is not None: >+ c.set_forced_key(kcrypto.Enctype.AES128, aes128_key) >+ rc4_key = env_get_var('RC4_KEY_HEX', prefix, >+ fallback_default=False, allow_missing=True) >+ if rc4_key is not None: >+ c.set_forced_key(kcrypto.Enctype.RC4, rc4_key) >+ return c >+ >+ def get_user_creds(self, allow_missing_password=False): >+ c = self._get_krb5_creds(prefix=None, >+ allow_missing_password=allow_missing_password) >+ return c >+ >+ def get_service_creds(self, allow_missing_password=False): >+ c = self._get_krb5_creds(prefix='SERVICE', >+ allow_missing_password=allow_missing_password) >+ return c >+ >+ def get_client_creds(self, allow_missing_password=False): >+ c = self._get_krb5_creds(prefix='CLIENT', >+ allow_missing_password=allow_missing_password) >+ return c >+ >+ def get_server_creds(self, allow_missing_password=False): >+ c = self._get_krb5_creds(prefix='SERVER', >+ allow_missing_password=allow_missing_password) >+ return c >+ >+ def get_krbtgt_creds(self, require_strongest_key=False): >+ c = self._get_krb5_creds(prefix='KRBTGT', >+ default_username='krbtgt', >+ allow_missing_password=True, >+ require_strongest_key=require_strongest_key) > return c > > def get_anon_creds(self): >@@ -473,6 +630,8 @@ class RawKerberosTest(TestCaseInTempDir): > return Krb5EncryptionKey(key, kvno) > > def PasswordKey_create(self, etype=None, pwd=None, salt=None, kvno=None): >+ self.assertIsNotNone(pwd) >+ self.assertIsNotNone(salt) > key = kcrypto.string_to_key(etype, pwd, salt) > return Krb5EncryptionKey(key, kvno) > >diff --git a/python/samba/tests/krb5/simple_tests.py b/python/samba/tests/krb5/simple_tests.py >index 889b91a9bf0..2da76a3cf5e 100755 >--- a/python/samba/tests/krb5/simple_tests.py >+++ b/python/samba/tests/krb5/simple_tests.py >@@ -44,10 +44,12 @@ class SimpleKerberosTests(RawKerberosTest): > def test_simple(self): > user_creds = self.get_user_creds() > user = user_creds.get_username() >- realm = user_creds.get_realm() >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_account = krbtgt_creds.get_username() >+ realm = krbtgt_creds.get_realm() > > cname = self.PrincipalName_create(name_type=1, names=[user]) >- sname = self.PrincipalName_create(name_type=2, names=["krbtgt", realm]) >+ sname = self.PrincipalName_create(name_type=2, names=[krbtgt_account, realm]) > > till = self.get_KerberosTime(offset=36000) > >-- >2.25.1 > > >From fdb3ce889cb3aa4a654672f92276b339bbecb899 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Thu, 9 Apr 2020 22:28:32 +0200 >Subject: [PATCH 088/380] tests/krb5/raw_testcase.py: introduce > STRICT_CHECKING=0 in order to relax the checks in future > >We should write tests as strict as possible in order to let them run >against Windows servers. > >But at the same time we want to allow tests to be useful for Samba >too... > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit dff611976d6a067614e37add99edae214815a68b) >--- > python/samba/tests/krb5/raw_testcase.py | 5 +++++ > 1 file changed, 5 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index b28939f0388..333aab70c8e 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -263,6 +263,11 @@ class RawKerberosTest(TestCaseInTempDir): > self.do_asn1_print = False > self.do_hexdump = False > >+ strict_checking = samba.tests.env_get_var_value('STRICT_CHECKING', allow_missing=True) >+ if strict_checking is None: >+ strict_checking = '1' >+ self.strict_checking = bool(int(strict_checking)) >+ > self.host = samba.tests.env_get_var_value('SERVER') > > self.s = None >-- >2.25.1 > > >From 8b374617205234af3f72dd4c864848d1a96533a2 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Wed, 15 Apr 2020 13:49:52 +0200 >Subject: [PATCH 089/380] tests/krb5/raw_testcase.py: add assertElement*() > >These helper functions make writing subsequent Kerberos test >clearer. > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 61e1b179812e48797146584998afc5bd0168beae) >--- > python/samba/tests/krb5/raw_testcase.py | 54 +++++++++++++++++++++++++ > 1 file changed, 54 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 333aab70c8e..eb294a75a95 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -605,6 +605,36 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(value) > return > >+ def getElementValue(self, obj, elem): >+ v = None >+ try: >+ v = obj[elem] >+ except KeyError: >+ pass >+ return v >+ >+ def assertElementMissing(self, obj, elem): >+ v = self.getElementValue(obj, elem) >+ self.assertIsNone(v) >+ return >+ >+ def assertElementPresent(self, obj, elem): >+ v = self.getElementValue(obj, elem) >+ self.assertIsNotNone(v) >+ return >+ >+ def assertElementEqual(self, obj, elem, value): >+ v = self.getElementValue(obj, elem) >+ self.assertIsNotNone(v) >+ self.assertEqual(v, value) >+ return >+ >+ def assertElementEqualUTF8(self, obj, elem, value): >+ v = self.getElementValue(obj, elem) >+ self.assertIsNotNone(v) >+ self.assertEqual(v, bytes(value, 'utf8')) >+ return >+ > def assertPrincipalEqual(self, princ1, princ2): > self.assertEqual(princ1['name-type'], princ2['name-type']) > self.assertEqual( >@@ -618,6 +648,30 @@ class RawKerberosTest(TestCaseInTempDir): > msg="princ1=%s != princ2=%s" % (princ1, princ2)) > return > >+ def assertElementEqualPrincipal(self, obj, elem, value): >+ v = self.getElementValue(obj, elem) >+ self.assertIsNotNone(v) >+ v = pyasn1_native_decode(v, asn1Spec=krb5_asn1.PrincipalName()) >+ self.assertPrincipalEqual(v, value) >+ return >+ >+ def assertElementKVNO(self, obj, elem, value): >+ v = self.getElementValue(obj, elem) >+ if value == "autodetect": >+ value = v >+ if value is not None: >+ self.assertIsNotNone(v) >+ # The value on the wire should never be 0 >+ self.assertNotEqual(v, 0) >+ # value == 0 means we don't know the kvno >+ # but enforce at any value != 0 is present >+ value = int(value) >+ if value != 0: >+ self.assertEqual(v, value) >+ else: >+ self.assertIsNone(v) >+ return >+ > def get_KerberosTimeWithUsec(self, epoch=None, offset=None): > if epoch is None: > epoch = time.time() >-- >2.25.1 > > >From c73566933c23b1ce7ff57c1d5678b7a1155bd4b4 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Wed, 15 Apr 2020 17:50:00 +0200 >Subject: [PATCH 090/380] tests/krb5/raw_testcase.py: Allow prettyPrint of more > RFC-defined values > >By setting krb5_asn1.APOptions.prettyPrint = BitString_NamedValues_prettyPrint >we allow the BitString_NamedValues_prettyPrint() routine to show more named values. > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 34e079ce9a232a765fb3a2b25441434df35df54c) >--- > python/samba/tests/krb5/raw_testcase.py | 6 ++++++ > 1 file changed, 6 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index eb294a75a95..29745fa4089 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -111,6 +111,12 @@ krb5_asn1.KDCOptions.namedValues =\ > krb5_asn1.KDCOptionsValues.namedValues > krb5_asn1.KDCOptions.prettyPrint =\ > BitString_NamedValues_prettyPrint >+krb5_asn1.APOptions.prettyPrintNamedValues =\ >+ krb5_asn1.APOptionsValues.namedValues >+krb5_asn1.APOptions.namedValues =\ >+ krb5_asn1.APOptionsValues.namedValues >+krb5_asn1.APOptions.prettyPrint =\ >+ BitString_NamedValues_prettyPrint > > > def Integer_NamedValues_prettyPrint(self, scope=0): >-- >2.25.1 > > >From 026f7a75b40b469a9990281e61813e6a37346cc5 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Wed, 15 Apr 2020 17:57:37 +0200 >Subject: [PATCH 091/380] tests/krb5/raw_testcase.py: Allow prettyPrint of more > MS-KILE-defined values > >By setting krb5_asn1.APOptions.prettyPrint = BitString_NamedValues_prettyPrint >we allow the BitString_NamedValues_prettyPrint() routine to show more named values. > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 3abb3b41368666535a216a98c3e7d15a5d498f7e) >--- > python/samba/tests/krb5/raw_testcase.py | 10 ++++++++++ > 1 file changed, 10 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 29745fa4089..1ef15db9f8c 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -117,6 +117,12 @@ krb5_asn1.APOptions.namedValues =\ > krb5_asn1.APOptionsValues.namedValues > krb5_asn1.APOptions.prettyPrint =\ > BitString_NamedValues_prettyPrint >+krb5_asn1.PACOptionFlags.prettyPrintNamedValues =\ >+ krb5_asn1.PACOptionFlagsValues.namedValues >+krb5_asn1.PACOptionFlags.namedValues =\ >+ krb5_asn1.PACOptionFlagsValues.namedValues >+krb5_asn1.PACOptionFlags.prettyPrint =\ >+ BitString_NamedValues_prettyPrint > > > def Integer_NamedValues_prettyPrint(self, scope=0): >@@ -149,6 +155,10 @@ krb5_asn1.ChecksumType.prettyPrintNamedValues =\ > krb5_asn1.ChecksumTypeValues.namedValues > krb5_asn1.ChecksumType.prettyPrint =\ > Integer_NamedValues_prettyPrint >+krb5_asn1.KerbErrorDataType.prettyPrintNamedValues =\ >+ krb5_asn1.KerbErrorDataTypeValues.namedValues >+krb5_asn1.KerbErrorDataType.prettyPrint =\ >+ Integer_NamedValues_prettyPrint > > > class Krb5EncryptionKey(object): >-- >2.25.1 > > >From f3c559f4d276a1e56a70aae8ee8f146c52172ff2 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Tue, 21 Apr 2020 14:45:01 +0200 >Subject: [PATCH 092/380] tests/krb5/raw_testcase.py: split > KDC_REQ_BODY_create() from KDC_REQ_create() > >This allows us to reuse body in future and calculate checksums on it. > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit b03fcfeb6c005936818ce50d511e9f9cc75aa9fb) >--- > python/samba/tests/krb5/raw_testcase.py | 81 +++++++------------------ > 1 file changed, 23 insertions(+), 58 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 1ef15db9f8c..71a4753717f 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -872,19 +872,7 @@ class RawKerberosTest(TestCaseInTempDir): > def KDC_REQ_create(self, > msg_type, > padata, >- kdc_options, >- cname, >- realm, >- sname, >- from_time, >- till_time, >- renew_time, >- nonce, >- etypes, >- addresses, >- EncAuthorizationData, >- EncAuthorizationData_key, >- additional_tickets, >+ req_body, > asn1Spec=None, > asn1_print=None, > hexdump=None): >@@ -897,25 +885,10 @@ class RawKerberosTest(TestCaseInTempDir): > # req-body [4] KDC-REQ-BODY > # } > # >- KDC_REQ_BODY_obj = self.KDC_REQ_BODY_create(kdc_options, >- cname, >- realm, >- sname, >- from_time, >- till_time, >- renew_time, >- nonce, >- etypes, >- addresses, >- EncAuthorizationData, >- EncAuthorizationData_key, >- additional_tickets, >- asn1_print=asn1_print, >- hexdump=hexdump) > KDC_REQ_obj = { > 'pvno': 5, > 'msg-type': msg_type, >- 'req-body': KDC_REQ_BODY_obj, >+ 'req-body': req_body, > } > if padata is not None: > KDC_REQ_obj['padata'] = padata >@@ -974,22 +947,26 @@ class RawKerberosTest(TestCaseInTempDir): > # additional-tickets [11] SEQUENCE OF Ticket OPTIONAL > # -- NOTE: not empty > # } >+ KDC_REQ_BODY_obj = self.KDC_REQ_BODY_create( >+ kdc_options, >+ cname, >+ realm, >+ sname, >+ from_time, >+ till_time, >+ renew_time, >+ nonce, >+ etypes, >+ addresses, >+ EncAuthorizationData, >+ EncAuthorizationData_key, >+ additional_tickets, >+ asn1_print=asn1_print, >+ hexdump=hexdump) > obj, decoded = self.KDC_REQ_create( > msg_type=10, > padata=padata, >- kdc_options=kdc_options, >- cname=cname, >- realm=realm, >- sname=sname, >- from_time=from_time, >- till_time=till_time, >- renew_time=renew_time, >- nonce=nonce, >- etypes=etypes, >- addresses=addresses, >- EncAuthorizationData=EncAuthorizationData, >- EncAuthorizationData_key=EncAuthorizationData_key, >- additional_tickets=additional_tickets, >+ req_body=KDC_REQ_BODY_obj, > asn1Spec=krb5_asn1.AS_REQ(), > asn1_print=asn1_print, > hexdump=hexdump) >@@ -1115,11 +1092,11 @@ class RawKerberosTest(TestCaseInTempDir): > EncAuthorizationData=EncAuthorizationData, > EncAuthorizationData_key=EncAuthorizationData_key, > additional_tickets=additional_tickets) >- req_body = self.der_encode(req_body, asn1Spec=krb5_asn1.KDC_REQ_BODY(), >- asn1_print=asn1_print, hexdump=hexdump) >+ req_body_blob = self.der_encode(req_body, asn1Spec=krb5_asn1.KDC_REQ_BODY(), >+ asn1_print=asn1_print, hexdump=hexdump) > > req_body_checksum = self.Checksum_create( >- ticket_session_key, 6, req_body, ctype=body_checksum_type) >+ ticket_session_key, 6, req_body_blob, ctype=body_checksum_type) > > subkey_obj = None > if authenticator_subkey is not None: >@@ -1158,19 +1135,7 @@ class RawKerberosTest(TestCaseInTempDir): > obj, decoded = self.KDC_REQ_create( > msg_type=12, > padata=padata, >- kdc_options=kdc_options, >- cname=None, >- realm=realm, >- sname=sname, >- from_time=from_time, >- till_time=till_time, >- renew_time=renew_time, >- nonce=nonce, >- etypes=etypes, >- addresses=addresses, >- EncAuthorizationData=EncAuthorizationData, >- EncAuthorizationData_key=EncAuthorizationData_key, >- additional_tickets=additional_tickets, >+ req_body=req_body, > asn1Spec=krb5_asn1.TGS_REQ(), > asn1_print=asn1_print, > hexdump=hexdump) >-- >2.25.1 > > >From 351483fc139e648bbc7cab25d1584c1cf377e087 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Thu, 16 Apr 2020 10:43:54 +0200 >Subject: [PATCH 093/380] tests/krb5/raw_testcase.py: add > KERB_PA_PAC_REQUEST_create() > >This allows building the pre-authentication data that encodes >the request for the KDC (or more likely a request not to include) >the KRB5 PAC in the resulting ticket. > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit ee2ac2b8ccafe3e6d560d893a4135a28e393914d) >--- > python/samba/tests/krb5/raw_testcase.py | 15 +++++++++++++++ > 1 file changed, 15 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 71a4753717f..f341911ef53 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -799,6 +799,21 @@ class RawKerberosTest(TestCaseInTempDir): > } > return PA_ENC_TS_ENC_obj > >+ def KERB_PA_PAC_REQUEST_create(self, include_pac, pa_data_create=True): >+ #KERB-PA-PAC-REQUEST ::= SEQUENCE { >+ # include-pac[0] BOOLEAN --If TRUE, and no pac present, include PAC. >+ # --If FALSE, and PAC present, remove PAC >+ #} >+ KERB_PA_PAC_REQUEST_obj = { >+ 'include-pac': include_pac, >+ } >+ if not pa_data_create: >+ return KERB_PA_PAC_REQUEST_obj >+ pa_pac = self.der_encode(KERB_PA_PAC_REQUEST_obj, >+ asn1Spec=krb5_asn1.KERB_PA_PAC_REQUEST()) >+ pa_data = self.PA_DATA_create(128, pa_pac) # PA-PAC-REQUEST >+ return pa_data >+ > def KDC_REQ_BODY_create(self, > kdc_options, > cname, >-- >2.25.1 > > >From d1fb21b58e7be6f7b60f1be702c968ab9961a916 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Mon, 20 Apr 2020 20:02:52 +0200 >Subject: [PATCH 094/380] tests/krb5/raw_testcase.py: add methods to iterate > over etype permutations > >It's often useful to run tests over a lot of input parameter >permutations. > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit e3905035847a5268c1a65366830cc739280ae437) >--- > python/samba/tests/krb5/raw_testcase.py | 58 +++++++++++++++++++++++++ > 1 file changed, 58 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index f341911ef53..a002a442d03 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -23,6 +23,7 @@ import time > import datetime > import random > import binascii >+import itertools > > import samba.tests > from samba.credentials import Credentials >@@ -274,6 +275,63 @@ class KerberosCredentials(Credentials): > class RawKerberosTest(TestCaseInTempDir): > """A raw Kerberos Test case.""" > >+ etypes_to_test = ( >+ { "value": -1111, "name": "dummy", }, >+ { "value": kcrypto.Enctype.AES256, "name": "aes128", }, >+ { "value": kcrypto.Enctype.AES128, "name": "aes256", }, >+ { "value": kcrypto.Enctype.RC4, "name": "rc4", }, >+ ) >+ >+ setup_etype_test_permutations_done = False >+ >+ @classmethod >+ def setup_etype_test_permutations(cls): >+ if cls.setup_etype_test_permutations_done: >+ return >+ >+ res = [] >+ >+ num_idxs = len(cls.etypes_to_test) >+ permutations = [] >+ for num in range(1, num_idxs+1): >+ chunk = list(itertools.permutations(range(num_idxs), num)) >+ for e in chunk: >+ el = list(e) >+ permutations.append(el) >+ >+ for p in permutations: >+ name = None >+ etypes = () >+ for idx in p: >+ n = cls.etypes_to_test[idx]["name"] >+ if name is None: >+ name = n >+ else: >+ name += "_%s" % n >+ etypes += (cls.etypes_to_test[idx]["value"],) >+ >+ r = { "name": name, "etypes": etypes, } >+ res.append(r) >+ >+ cls.etype_test_permutations = res >+ cls.setup_etype_test_permutations_done = True >+ return >+ >+ @classmethod >+ def etype_test_permutation_name_idx(cls): >+ cls.setup_etype_test_permutations() >+ res = [] >+ idx = 0 >+ for e in cls.etype_test_permutations: >+ r = (e['name'], idx) >+ idx += 1 >+ res.append(r) >+ return res >+ >+ def etype_test_permutation_by_idx(self, idx): >+ e = self.etype_test_permutations[idx] >+ return (e['name'], e['etypes']) >+ > def setUp(self): > super().setUp() > self.do_asn1_print = False >-- >2.25.1 > > >From f59be60ee4ef250e98398907a596506e21439f61 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Thu, 16 Apr 2020 17:13:35 +0200 >Subject: [PATCH 095/380] tests/krb5/raw_testcase.py: Add > TicketDecryptionKey_from_creds() > >This will allow building test_as_req_enc_timestamp() > >It also introduces ways to specify keys in hex formated environment >variables ${PREFIX}_{AES256,AES128,RC4}_KEY_HEX. > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 69ce2a6408f78d41eb865b89726021ad7643b065) >--- > python/samba/tests/krb5/raw_testcase.py | 29 +++++++++++++++++++++++++ > 1 file changed, 29 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index a002a442d03..7d0dc9c9609 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -784,6 +784,35 @@ class RawKerberosTest(TestCaseInTempDir): > return self.PasswordKey_create( > etype=e, pwd=password, salt=salt, kvno=kvno) > >+ def TicketDecryptionKey_from_creds(self, creds, etype=None): >+ >+ if etype is None: >+ etypes = creds.get_tgs_krb5_etypes() >+ etype = etypes[0] >+ >+ forced_key = creds.get_forced_key(etype) >+ if forced_key is not None: >+ return forced_key >+ >+ kvno = creds.get_kvno() >+ >+ fail_msg = ("%s has no fixed key for etype[%s] kvno[%s] " >+ "nor a password specified, " % ( >+ creds.get_username(), etype, kvno)) >+ >+ if etype == kcrypto.Enctype.RC4: >+ nthash = creds.get_nt_hash() >+ self.assertIsNotNone(nthash, msg=fail_msg) >+ return self.SessionKey_create(etype=etype, contents=nthash, kvno=kvno) >+ >+ password = creds.get_password() >+ self.assertIsNotNone(password, msg=fail_msg) >+ salt = creds.get_forced_salt() >+ if salt is None: >+ salt = bytes("%s%s" % (creds.get_realm(), creds.get_username()), >+ encoding='utf-8') >+ return self.PasswordKey_create(etype=etype, pwd=password, salt=salt, kvno=kvno) >+ > def RandomKey(self, etype): > e = kcrypto._get_enctype_profile(etype) > contents = samba.generate_random_bytes(e.keysize) >-- >2.25.1 > > >From d11a7b65038870d0d38129f6601a0fc3ae303f6f Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Tue, 21 Apr 2020 11:07:45 +0200 >Subject: [PATCH 096/380] tests/krb5/raw_testcase.py: introduce a > _generic_kdc_exchange() infrastructure > >This will allow us to write tests, which will all cross check almost >every aspect of the KDC response (including encrypted parts). > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 6e2f2adc8e825634780077e24a9e437bdc68155a) >--- > python/samba/tests/krb5/raw_testcase.py | 634 +++++++++++++++++++ > python/samba/tests/krb5/rfc4120_constants.py | 11 + > 2 files changed, 645 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 7d0dc9c9609..8c8926b0ad2 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -30,6 +30,27 @@ from samba.credentials import Credentials > from samba.tests import TestCaseInTempDir > from samba.dcerpc import security > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+from samba.tests.krb5.rfc4120_constants import ( >+ KDC_ERR_ETYPE_NOSUPP, >+ KDC_ERR_PREAUTH_REQUIRED, >+ KRB_AS_REP, >+ KRB_AS_REQ, >+ KRB_ERROR, >+ KRB_TGS_REP, >+ KRB_TGS_REQ, >+ KU_AS_REP_ENC_PART, >+ KU_TGS_REP_ENC_PART_SESSION, >+ KU_TGS_REP_ENC_PART_SUB_KEY, >+ KU_TGS_REQ_AUTH, >+ KU_TGS_REQ_AUTH_CKSUM, >+ KU_TICKET, >+ PADATA_ENC_TIMESTAMP, >+ PADATA_ETYPE_INFO, >+ PADATA_ETYPE_INFO2, >+ PADATA_KDC_REQ, >+ PADATA_PK_AS_REQ, >+ PADATA_PK_AS_REP_19 >+) > import samba.tests.krb5.kcrypto as kcrypto > > from pyasn1.codec.der.decoder import decode as pyasn1_der_decode >@@ -272,6 +293,24 @@ class KerberosCredentials(Credentials): > def get_forced_salt(self): > return self.forced_salt > >+class KerberosTicketCreds(object): >+ def __init__(self, ticket, session_key, >+ crealm=None, cname=None, >+ srealm=None, sname=None, >+ decryption_key=None, >+ ticket_private=None, >+ encpart_private=None): >+ self.ticket = ticket >+ self.session_key = session_key >+ self.crealm = crealm >+ self.cname = cname >+ self.srealm = srealm >+ self.sname = sname >+ self.decryption_key = decryption_key >+ self.ticket_private = ticket_private >+ self.encpart_private = encpart_private >+ return >+ > class RawKerberosTest(TestCaseInTempDir): > """A raw Kerberos Test case.""" > >@@ -758,6 +797,12 @@ class RawKerberosTest(TestCaseInTempDir): > (s, _) = self.get_KerberosTimeWithUsec(epoch=epoch, offset=offset) > return s > >+ def get_Nonce(self): >+ nonce_min=0x7f000000 >+ nonce_max=0x7fffffff >+ v = random.randint(nonce_min, nonce_max) >+ return v >+ > def SessionKey_create(self, etype, contents, kvno=None): > key = kcrypto.Key(etype, contents) > return Krb5EncryptionKey(key, kvno) >@@ -1268,3 +1313,592 @@ class RawKerberosTest(TestCaseInTempDir): > pa_s4u2self = self.der_encode( > PA_S4U2Self_obj, asn1Spec=krb5_asn1.PA_S4U2Self()) > return self.PA_DATA_create(129, pa_s4u2self) >+ >+ def _generic_kdc_exchange(self, >+ kdc_exchange_dict, # required >+ kdc_options=None, # required >+ cname=None, # optional >+ realm=None, # required >+ sname=None, # optional >+ from_time=None, # optional >+ till_time=None, # required >+ renew_time=None, # optional >+ nonce=None, # required >+ etypes=None, # required >+ addresses=None, # optional >+ EncAuthorizationData=None, # optional >+ EncAuthorizationData_key=None, # optional >+ additional_tickets=None): # optional >+ >+ check_error_fn = kdc_exchange_dict['check_error_fn'] >+ check_rep_fn = kdc_exchange_dict['check_rep_fn'] >+ generate_padata_fn = kdc_exchange_dict['generate_padata_fn'] >+ callback_dict = kdc_exchange_dict['callback_dict'] >+ req_msg_type = kdc_exchange_dict['req_msg_type'] >+ req_asn1Spec = kdc_exchange_dict['req_asn1Spec'] >+ rep_msg_type = kdc_exchange_dict['rep_msg_type'] >+ >+ if till_time is None: >+ till_time = self.get_KerberosTime(offset=36000) >+ if nonce is None: >+ nonce = self.get_Nonce() >+ >+ req_body = self.KDC_REQ_BODY_create(kdc_options=kdc_options, >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=from_time, >+ till_time=till_time, >+ renew_time=renew_time, >+ nonce=nonce, >+ etypes=etypes, >+ addresses=addresses, >+ EncAuthorizationData=EncAuthorizationData, >+ EncAuthorizationData_key=EncAuthorizationData_key, >+ additional_tickets=additional_tickets) >+ if generate_padata_fn is not None: >+ # This can alter req_body... >+ padata, req_body = generate_padata_fn(kdc_exchange_dict, >+ callback_dict, >+ req_body) >+ else: >+ padata = None >+ >+ kdc_exchange_dict['req_padata'] = padata >+ kdc_exchange_dict['req_body'] = req_body >+ >+ req_obj,req_decoded = self.KDC_REQ_create(msg_type=req_msg_type, >+ padata=padata, >+ req_body=req_body, >+ asn1Spec=req_asn1Spec()) >+ >+ rep = self.send_recv_transaction(req_decoded) >+ self.assertIsNotNone(rep) >+ >+ msg_type = self.getElementValue(rep, 'msg-type') >+ self.assertIsNotNone(msg_type) >+ >+ allowed_msg_types = () >+ if check_error_fn is not None: >+ allowed_msg_types = (KRB_ERROR,) >+ if check_rep_fn is not None: >+ allowed_msg_types += (rep_msg_type,) >+ self.assertIn(msg_type, allowed_msg_types) >+ >+ if msg_type == KRB_ERROR: >+ return check_error_fn(kdc_exchange_dict, >+ callback_dict, >+ rep) >+ >+ return check_rep_fn(kdc_exchange_dict, callback_dict, rep) >+ >+ def as_exchange_dict(self, >+ expected_crealm=None, >+ expected_cname=None, >+ expected_srealm=None, >+ expected_sname=None, >+ ticket_decryption_key=None, >+ generate_padata_fn=None, >+ check_error_fn=None, >+ check_rep_fn=None, >+ check_padata_fn=None, >+ check_kdc_private_fn=None, >+ callback_dict=dict(), >+ expected_error_mode=None, >+ client_as_etypes=None, >+ expected_salt=None): >+ kdc_exchange_dict = { >+ 'req_msg_type': KRB_AS_REQ, >+ 'req_asn1Spec': krb5_asn1.AS_REQ, >+ 'rep_msg_type': KRB_AS_REP, >+ 'rep_asn1Spec': krb5_asn1.AS_REP, >+ 'rep_encpart_asn1Spec': krb5_asn1.EncASRepPart, >+ 'expected_crealm': expected_crealm, >+ 'expected_cname': expected_cname, >+ 'expected_srealm': expected_srealm, >+ 'expected_sname': expected_sname, >+ 'ticket_decryption_key': ticket_decryption_key, >+ 'generate_padata_fn': generate_padata_fn, >+ 'check_error_fn': check_error_fn, >+ 'check_rep_fn': check_rep_fn, >+ 'check_padata_fn': check_padata_fn, >+ 'check_kdc_private_fn': check_kdc_private_fn, >+ 'callback_dict': callback_dict, >+ 'expected_error_mode': expected_error_mode, >+ 'client_as_etypes': client_as_etypes, >+ 'expected_salt': expected_salt, >+ } >+ return kdc_exchange_dict >+ >+ def tgs_exchange_dict(self, >+ expected_crealm=None, >+ expected_cname=None, >+ expected_srealm=None, >+ expected_sname=None, >+ ticket_decryption_key=None, >+ generate_padata_fn=None, >+ check_error_fn=None, >+ check_rep_fn=None, >+ check_padata_fn=None, >+ check_kdc_private_fn=None, >+ callback_dict=dict(), >+ tgt=None, >+ authenticator_subkey=None, >+ body_checksum_type=None): >+ kdc_exchange_dict = { >+ 'req_msg_type': KRB_TGS_REQ, >+ 'req_asn1Spec': krb5_asn1.TGS_REQ, >+ 'rep_msg_type': KRB_TGS_REP, >+ 'rep_asn1Spec': krb5_asn1.TGS_REP, >+ 'rep_encpart_asn1Spec': krb5_asn1.EncTGSRepPart, >+ 'expected_crealm': expected_crealm, >+ 'expected_cname': expected_cname, >+ 'expected_srealm': expected_srealm, >+ 'expected_sname': expected_sname, >+ 'ticket_decryption_key': ticket_decryption_key, >+ 'generate_padata_fn': generate_padata_fn, >+ 'check_error_fn': check_error_fn, >+ 'check_rep_fn': check_rep_fn, >+ 'check_padata_fn': check_padata_fn, >+ 'check_kdc_private_fn': check_kdc_private_fn, >+ 'callback_dict': callback_dict, >+ 'tgt': tgt, >+ 'body_checksum_type': body_checksum_type, >+ 'authenticator_subkey': authenticator_subkey, >+ } >+ return kdc_exchange_dict >+ >+ def generic_check_kdc_rep(self, >+ kdc_exchange_dict, >+ callback_dict, >+ rep): >+ >+ expected_crealm = kdc_exchange_dict['expected_crealm'] >+ expected_cname = kdc_exchange_dict['expected_cname'] >+ expected_srealm = kdc_exchange_dict['expected_srealm'] >+ expected_sname = kdc_exchange_dict['expected_sname'] >+ ticket_decryption_key = kdc_exchange_dict['ticket_decryption_key'] >+ check_padata_fn = kdc_exchange_dict['check_padata_fn'] >+ check_kdc_private_fn = kdc_exchange_dict['check_kdc_private_fn'] >+ rep_encpart_asn1Spec = kdc_exchange_dict['rep_encpart_asn1Spec'] >+ msg_type = kdc_exchange_dict['rep_msg_type'] >+ >+ self.assertElementEqual(rep, 'msg-type', msg_type) # AS-REP | TGS-REP >+ padata = self.getElementValue(rep, 'padata') >+ self.assertElementEqualUTF8(rep, 'crealm', expected_crealm) >+ self.assertElementEqualPrincipal(rep, 'cname', expected_cname) >+ self.assertElementPresent(rep, 'ticket') >+ ticket = self.getElementValue(rep, 'ticket') >+ ticket_encpart = None >+ ticket_cipher = None >+ if ticket is not None: # Never None, but gives indentation >+ self.assertElementPresent(ticket, 'tkt-vno') >+ self.assertElementEqualUTF8(ticket, 'realm', expected_srealm) >+ self.assertElementEqualPrincipal(ticket, 'sname', expected_sname) >+ self.assertElementPresent(ticket, 'enc-part') >+ ticket_encpart = self.getElementValue(ticket, 'enc-part') >+ if ticket_encpart is not None: # Never None, but gives indentation >+ self.assertElementPresent(ticket_encpart, 'etype') >+ # 0 means present, with any value != 0 >+ self.assertElementKVNO(ticket_encpart, 'kvno', 0) >+ self.assertElementPresent(ticket_encpart, 'cipher') >+ ticket_cipher = self.getElementValue(ticket_encpart, 'cipher') >+ self.assertElementPresent(rep, 'enc-part') >+ encpart = self.getElementValue(rep, 'enc-part') >+ encpart_cipher = None >+ if encpart is not None: # Never None, but gives indentation >+ self.assertElementPresent(encpart, 'etype') >+ self.assertElementKVNO(ticket_encpart, 'kvno', 'autodetect') >+ self.assertElementPresent(encpart, 'cipher') >+ encpart_cipher = self.getElementValue(encpart, 'cipher') >+ >+ encpart_decryption_key = None >+ if check_padata_fn is not None: >+ # See if get the decryption key from the preauth phase >+ encpart_decryption_key,encpart_decryption_usage = \ >+ check_padata_fn(kdc_exchange_dict, callback_dict, >+ rep, padata) >+ >+ ticket_private = None >+ if ticket_decryption_key is not None: >+ self.assertElementEqual(ticket_encpart, 'etype', ticket_decryption_key.etype) >+ self.assertElementKVNO(ticket_encpart, 'kvno', ticket_decryption_key.kvno) >+ ticket_decpart = ticket_decryption_key.decrypt(KU_TICKET, ticket_cipher) >+ ticket_private = self.der_decode(ticket_decpart, asn1Spec=krb5_asn1.EncTicketPart()) >+ >+ encpart_private = None >+ if encpart_decryption_key is not None: >+ self.assertElementEqual(encpart, 'etype', encpart_decryption_key.etype) >+ self.assertElementKVNO(encpart, 'kvno', encpart_decryption_key.kvno) >+ rep_decpart = encpart_decryption_key.decrypt(encpart_decryption_usage, encpart_cipher) >+ encpart_private = self.der_decode(rep_decpart, asn1Spec=rep_encpart_asn1Spec()) >+ >+ if check_kdc_private_fn is not None: >+ check_kdc_private_fn(kdc_exchange_dict, callback_dict, >+ rep, ticket_private, encpart_private) >+ >+ return rep >+ >+ def generic_check_kdc_private(self, >+ kdc_exchange_dict, >+ callback_dict, >+ rep, >+ ticket_private, >+ encpart_private): >+ >+ expected_crealm = kdc_exchange_dict['expected_crealm'] >+ expected_cname = kdc_exchange_dict['expected_cname'] >+ expected_srealm = kdc_exchange_dict['expected_srealm'] >+ expected_sname = kdc_exchange_dict['expected_sname'] >+ ticket_decryption_key = kdc_exchange_dict['ticket_decryption_key'] >+ >+ ticket = self.getElementValue(rep, 'ticket') >+ >+ ticket_session_key = None >+ if ticket_private is not None: >+ self.assertElementPresent(ticket_private, 'flags') >+ self.assertElementPresent(ticket_private, 'key') >+ ticket_key = self.getElementValue(ticket_private, 'key') >+ if ticket_key is not None: # Never None, but gives indentation >+ self.assertElementPresent(ticket_key, 'keytype') >+ self.assertElementPresent(ticket_key, 'keyvalue') >+ ticket_session_key = self.EncryptionKey_import(ticket_key) >+ self.assertElementEqualUTF8(ticket_private, 'crealm', expected_crealm) >+ self.assertElementEqualPrincipal(ticket_private, 'cname', expected_cname) >+ self.assertElementPresent(ticket_private, 'transited') >+ self.assertElementPresent(ticket_private, 'authtime') >+ if self.strict_checking: >+ self.assertElementPresent(ticket_private, 'starttime') >+ self.assertElementPresent(ticket_private, 'endtime') >+ # TODO self.assertElementPresent(ticket_private, 'renew-till') >+ # TODO self.assertElementMissing(ticket_private, 'caddr') >+ self.assertElementPresent(ticket_private, 'authorization-data') >+ >+ encpart_session_key = None >+ if encpart_private is not None: >+ self.assertElementPresent(encpart_private, 'key') >+ encpart_key = self.getElementValue(encpart_private, 'key') >+ if encpart_key is not None: # Never None, but gives indentation >+ self.assertElementPresent(encpart_key, 'keytype') >+ self.assertElementPresent(encpart_key, 'keyvalue') >+ encpart_session_key = self.EncryptionKey_import(encpart_key) >+ self.assertElementPresent(encpart_private, 'last-req') >+ self.assertElementPresent(encpart_private, 'nonce') >+ # TODO self.assertElementPresent(encpart_private, 'key-expiration') >+ self.assertElementPresent(encpart_private, 'flags') >+ self.assertElementPresent(encpart_private, 'authtime') >+ if self.strict_checking: >+ self.assertElementPresent(encpart_private, 'starttime') >+ self.assertElementPresent(encpart_private, 'endtime') >+ # TODO self.assertElementPresent(encpart_private, 'renew-till') >+ self.assertElementEqualUTF8(encpart_private, 'srealm', expected_srealm) >+ self.assertElementEqualPrincipal(encpart_private, 'sname', expected_sname) >+ # TODO self.assertElementMissing(encpart_private, 'caddr') >+ >+ if ticket_session_key is not None and encpart_session_key is not None: >+ self.assertEqual(ticket_session_key.etype, encpart_session_key.etype) >+ self.assertEqual(ticket_session_key.key.contents, encpart_session_key.key.contents) >+ if encpart_session_key is not None: >+ session_key = encpart_session_key >+ else: >+ session_key = ticket_session_key >+ ticket_creds = KerberosTicketCreds(ticket, >+ session_key, >+ crealm=expected_crealm, >+ cname=expected_cname, >+ srealm=expected_srealm, >+ sname=expected_sname, >+ decryption_key=ticket_decryption_key, >+ ticket_private=ticket_private, >+ encpart_private=encpart_private) >+ >+ kdc_exchange_dict['rep_ticket_creds'] = ticket_creds >+ return >+ >+ def generic_check_as_error(self, >+ kdc_exchange_dict, >+ callback_dict, >+ rep): >+ >+ expected_crealm = kdc_exchange_dict['expected_crealm'] >+ expected_cname = kdc_exchange_dict['expected_cname'] >+ expected_srealm = kdc_exchange_dict['expected_srealm'] >+ expected_sname = kdc_exchange_dict['expected_sname'] >+ expected_salt = kdc_exchange_dict['expected_salt'] >+ client_as_etypes = kdc_exchange_dict['client_as_etypes'] >+ expected_error_mode = kdc_exchange_dict['expected_error_mode'] >+ req_body = kdc_exchange_dict['req_body'] >+ proposed_etypes = req_body['etype'] >+ >+ kdc_exchange_dict['preauth_etype_info2'] = None >+ >+ expect_etype_info2 = () >+ expect_etype_info = False >+ unexpect_etype_info = True >+ expected_aes_type = 0 >+ expected_rc4_type = 0 >+ if kcrypto.Enctype.RC4 in proposed_etypes: >+ expect_etype_info = True >+ for etype in proposed_etypes: >+ if etype in (kcrypto.Enctype.AES256,kcrypto.Enctype.AES128): >+ expect_etype_info = False >+ if etype not in client_as_etypes: >+ continue >+ if etype in (kcrypto.Enctype.AES256,kcrypto.Enctype.AES128): >+ if etype > expected_aes_type: >+ expected_aes_type = etype >+ if etype in (kcrypto.Enctype.RC4,): >+ unexpect_etype_info = False >+ if etype > expected_rc4_type: >+ expected_rc4_type = etype >+ >+ if expected_aes_type != 0: >+ expect_etype_info2 += (expected_aes_type,) >+ if expected_rc4_type != 0: >+ expect_etype_info2 += (expected_rc4_type,) >+ >+ expected_error = KDC_ERR_ETYPE_NOSUPP >+ expected_patypes = () >+ if expect_etype_info: >+ self.assertGreater(len(expect_etype_info2), 0) >+ expected_patypes += (PADATA_ETYPE_INFO,) >+ if len(expect_etype_info2) != 0: >+ expected_error = KDC_ERR_PREAUTH_REQUIRED >+ expected_patypes += (PADATA_ETYPE_INFO2,) >+ >+ expected_patypes += (PADATA_ENC_TIMESTAMP,) >+ expected_patypes += (PADATA_PK_AS_REQ,) >+ expected_patypes += (PADATA_PK_AS_REP_19,) >+ >+ self.assertElementEqual(rep, 'msg-type', KRB_ERROR) >+ self.assertElementEqual(rep, 'error-code', expected_error) >+ self.assertElementMissing(rep, 'ctime') >+ self.assertElementMissing(rep, 'cusec') >+ self.assertElementPresent(rep, 'stime') >+ self.assertElementPresent(rep, 'susec') >+ # error-code checked above >+ if self.strict_checking: >+ self.assertElementMissing(rep, 'crealm') >+ self.assertElementMissing(rep, 'cname') >+ self.assertElementEqualUTF8(rep, 'realm', expected_srealm) >+ self.assertElementEqualPrincipal(rep, 'sname', expected_sname) >+ if self.strict_checking: >+ self.assertElementMissing(rep, 'e-text') >+ if expected_error_mode != KDC_ERR_PREAUTH_REQUIRED: >+ self.assertElementMissing(rep, 'e-data') >+ return >+ edata = self.getElementValue(rep, 'e-data') >+ if self.strict_checking: >+ self.assertIsNotNone(edata) >+ if edata is not None: >+ rep_padata = self.der_decode(edata, asn1Spec=krb5_asn1.METHOD_DATA()) >+ self.assertGreater(len(rep_padata), 0) >+ else: >+ rep_padata = [] >+ >+ if self.strict_checking: >+ for i in range(0, len(expected_patypes)): >+ self.assertElementEqual(rep_padata[i], 'padata-type', expected_patypes[i]) >+ self.assertEqual(len(rep_padata), len(expected_patypes)) >+ >+ etype_info2 = None >+ etype_info = None >+ enc_timestamp = None >+ pk_as_req = None >+ pk_as_rep19 = None >+ for pa in rep_padata: >+ patype = self.getElementValue(pa, 'padata-type') >+ pavalue = self.getElementValue(pa, 'padata-value') >+ if patype == PADATA_ETYPE_INFO2: >+ self.assertIsNone(etype_info2) >+ etype_info2 = self.der_decode(pavalue, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ continue >+ if patype == PADATA_ETYPE_INFO: >+ self.assertIsNone(etype_info) >+ etype_info = self.der_decode(pavalue, asn1Spec=krb5_asn1.ETYPE_INFO()) >+ continue >+ if patype == PADATA_ENC_TIMESTAMP: >+ self.assertIsNone(enc_timestamp) >+ enc_timestamp = pavalue >+ self.assertEqual(len(enc_timestamp), 0) >+ continue >+ if patype == PADATA_PK_AS_REQ: >+ self.assertIsNone(pk_as_req) >+ pk_as_req = pavalue >+ self.assertEqual(len(pk_as_req), 0) >+ continue >+ if patype == PADATA_PK_AS_REP_19: >+ self.assertIsNone(pk_as_rep19) >+ pk_as_rep19 = pavalue >+ self.assertEqual(len(pk_as_rep19), 0) >+ continue >+ >+ if expected_error == KDC_ERR_ETYPE_NOSUPP: >+ self.assertIsNone(etype_info2) >+ self.assertIsNone(etype_info) >+ if self.strict_checking: >+ self.assertIsNotNone(enc_timestamp) >+ self.assertIsNotNone(pk_as_req) >+ self.assertIsNotNone(pk_as_rep19) >+ return >+ >+ self.assertIsNotNone(etype_info2) >+ if expect_etype_info: >+ self.assertIsNotNone(etype_info) >+ else: >+ if self.strict_checking: >+ self.assertIsNone(etype_info) >+ if unexpect_etype_info: >+ self.assertIsNone(etype_info) >+ >+ self.assertGreaterEqual(len(etype_info2), 1) >+ self.assertLessEqual(len(etype_info2), len(expect_etype_info2)) >+ if self.strict_checking: >+ self.assertEqual(len(etype_info2), len(expect_etype_info2)) >+ for i in range(0, len(etype_info2)): >+ e = self.getElementValue(etype_info2[i], 'etype') >+ self.assertEqual(e, expect_etype_info2[i]) >+ salt = self.getElementValue(etype_info2[i], 'salt') >+ if e == kcrypto.Enctype.RC4: >+ self.assertIsNone(salt) >+ else: >+ self.assertIsNotNone(salt) >+ if expected_salt is not None: >+ self.assertEqual(salt, expected_salt) >+ s2kparams = self.getElementValue(etype_info2[i], 's2kparams') >+ if self.strict_checking: >+ self.assertIsNone(s2kparams) >+ if etype_info is not None: >+ self.assertEqual(len(etype_info), 1) >+ e = self.getElementValue(etype_info[0], 'etype') >+ self.assertEqual(e, kcrypto.Enctype.RC4) >+ self.assertEqual(e, expect_etype_info2[0]) >+ salt = self.getElementValue(etype_info[0], 'salt') >+ if self.strict_checking: >+ self.assertIsNotNone(salt) >+ self.assertEqual(len(salt), 0) >+ >+ self.assertIsNotNone(enc_timestamp) >+ self.assertIsNotNone(pk_as_req) >+ self.assertIsNotNone(pk_as_rep19) >+ >+ kdc_exchange_dict['preauth_etype_info2'] = etype_info2 >+ return >+ >+ def generate_simple_tgs_padata(self, >+ kdc_exchange_dict, >+ callback_dict, >+ req_body): >+ tgt = kdc_exchange_dict['tgt'] >+ authenticator_subkey = kdc_exchange_dict['authenticator_subkey'] >+ body_checksum_type = kdc_exchange_dict['body_checksum_type'] >+ >+ req_body_blob = self.der_encode(req_body, asn1Spec=krb5_asn1.KDC_REQ_BODY()) >+ >+ req_body_checksum = self.Checksum_create(tgt.session_key, >+ KU_TGS_REQ_AUTH_CKSUM, >+ req_body_blob, >+ ctype=body_checksum_type) >+ >+ subkey_obj = None >+ if authenticator_subkey is not None: >+ subkey_obj = authenticator_subkey.export_obj() >+ seq_number = random.randint(0, 0xfffffffe) >+ (ctime, cusec) = self.get_KerberosTimeWithUsec() >+ authenticator_obj = self.Authenticator_create(crealm=tgt.crealm, >+ cname=tgt.cname, >+ cksum=req_body_checksum, >+ cusec=cusec, >+ ctime=ctime, >+ subkey=subkey_obj, >+ seq_number=seq_number, >+ authorization_data=None) >+ authenticator_blob = self.der_encode(authenticator_obj, asn1Spec=krb5_asn1.Authenticator()) >+ >+ authenticator = self.EncryptedData_create(tgt.session_key, >+ KU_TGS_REQ_AUTH, >+ authenticator_blob) >+ >+ ap_options = krb5_asn1.APOptions('0') >+ ap_req_obj = self.AP_REQ_create(ap_options=str(ap_options), >+ ticket=tgt.ticket, >+ authenticator=authenticator) >+ ap_req = self.der_encode(ap_req_obj, asn1Spec=krb5_asn1.AP_REQ()) >+ pa_tgs_req = self.PA_DATA_create(PADATA_KDC_REQ, ap_req) >+ padata = [pa_tgs_req] >+ >+ return padata, req_body >+ >+ def check_simple_tgs_padata(self, >+ kdc_exchange_dict, >+ callback_dict, >+ rep, >+ padata): >+ tgt = kdc_exchange_dict['tgt'] >+ authenticator_subkey = kdc_exchange_dict['authenticator_subkey'] >+ if authenticator_subkey is not None: >+ subkey = authenticator_subkey >+ subkey_usage = KU_TGS_REP_ENC_PART_SUB_KEY >+ else: >+ subkey = tgt.session_key >+ subkey_usage = KU_TGS_REP_ENC_PART_SESSION >+ >+ return subkey, subkey_usage >+ >+ def _test_as_exchange(self, >+ cname, >+ realm, >+ sname, >+ till, >+ client_as_etypes, >+ expected_error_mode, >+ expected_crealm, >+ expected_cname, >+ expected_srealm, >+ expected_sname, >+ expected_salt, >+ etypes, >+ padata, >+ kdc_options, >+ preauth_key=None, >+ ticket_decryption_key=None): >+ >+ def _generate_padata_copy(_kdc_exchange_dict, >+ _callback_dict, >+ req_body): >+ return padata, req_body >+ >+ def _check_padata_preauth_key(_kdc_exchange_dict, >+ _callback_dict, >+ rep, >+ padata): >+ as_rep_usage = KU_AS_REP_ENC_PART >+ return preauth_key, as_rep_usage >+ >+ kdc_exchange_dict = self.as_exchange_dict( >+ expected_crealm=expected_crealm, >+ expected_cname=expected_cname, >+ expected_srealm=expected_srealm, >+ expected_sname=expected_sname, >+ ticket_decryption_key=ticket_decryption_key, >+ generate_padata_fn=_generate_padata_copy, >+ check_error_fn=self.generic_check_as_error, >+ check_rep_fn=self.generic_check_kdc_rep, >+ check_padata_fn=_check_padata_preauth_key, >+ check_kdc_private_fn=self.generic_check_kdc_private, >+ expected_error_mode=expected_error_mode, >+ client_as_etypes=client_as_etypes, >+ expected_salt=expected_salt) >+ >+ rep = self._generic_kdc_exchange(kdc_exchange_dict, >+ kdc_options=str(kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ till_time=till, >+ etypes=etypes) >+ >+ if expected_error_mode == 0: # AS-REP >+ return rep >+ >+ return kdc_exchange_dict['preauth_etype_info2'] >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index 702f6084217..a4c5e079b66 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -28,16 +28,27 @@ ARCFOUR_HMAC_MD5 = int( > # Message types > KRB_ERROR = int(krb5_asn1.MessageTypeValues('krb-error')) > KRB_AS_REP = int(krb5_asn1.MessageTypeValues('krb-as-rep')) >+KRB_AS_REQ = int(krb5_asn1.MessageTypeValues('krb-as-req')) > KRB_TGS_REP = int(krb5_asn1.MessageTypeValues('krb-tgs-rep')) >+KRB_TGS_REQ = int(krb5_asn1.MessageTypeValues('krb-tgs-req')) > > # PAData types > PADATA_ENC_TIMESTAMP = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-ENC-TIMESTAMP')) >+PADATA_ETYPE_INFO = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-ETYPE-INFO')) > PADATA_ETYPE_INFO2 = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-ETYPE-INFO2')) >+PADATA_KDC_REQ = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-KDC-REQ')) >+PADATA_PK_AS_REQ = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-PK-AS-REQ')) >+PADATA_PK_AS_REP_19 = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-PK-AS-REP-19')) > > # Error codes > KDC_ERR_C_PRINCIPAL_UNKNOWN = 6 >+KDC_ERR_ETYPE_NOSUPP = 14 > KDC_ERR_PREAUTH_FAILED = 24 > KDC_ERR_PREAUTH_REQUIRED = 25 > KDC_ERR_BADMATCH = 36 >-- >2.25.1 > > >From 81ac9bcca2e1ddae0a18b4ac85c8777772f16faa Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Tue, 21 Apr 2020 11:07:45 +0200 >Subject: [PATCH 097/380] tests/krb5/as_req_tests.py: add new tests to cover > more of the AS-REQ protocol > >Example commands: > >Windows 2012R2: >SERVER=172.31.9.188 STRICT_CHECKING=1 DOMAIN=W2012R2-L6 REALM=W2012R2-L6.BASE CLIENT_USERNAME=ldaptestuser CLIENT_PASSWORD=a1B2c3D4 CLIENT_AS_SUPPORTED_ENCTYPES=28 python/samba/tests/krb5/as_req_tests.py AsReqKerberosTests >SERVER=172.31.9.188 STRICT_CHECKING=1 DOMAIN=W2012R2-L6 REALM=W2012R2-L6.BASE CLIENT_USERNAME=administrator CLIENT_PASSWORD=A1b2C3d4 CLIENT_AS_SUPPORTED_ENCTYPES=4 python/samba/tests/krb5/as_req_tests.py AsReqKerberosTests > >Windows 2008R2: >SERVER=172.31.9.133 STRICT_CHECKING=1 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE CLIENT_USERNAME=cifsmount CLIENT_PASSWORD=A1b2C3d4-08 CLIENT_AS_SUPPORTED_ENCTYPES=28 python/samba/tests/krb5/as_req_tests.py AsReqKerberosTests >SERVER=172.31.9.133 STRICT_CHECKING=1 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE CLIENT_USERNAME=administrator CLIENT_PASSWORD=A1b2C3d4 CLIENT_AS_SUPPORTED_ENCTYPES=4 python/samba/tests/krb5/as_req_tests.py AsReqKerberosTests > >Samba 4.14: >SERVER=172.31.9.163 STRICT_CHECKING=0 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE CLIENT_USERNAME=cifsmount CLIENT_PASSWORD=A1b2C3d4-08 CLIENT_AS_SUPPORTED_ENCTYPES=28 python/samba/tests/krb5/as_req_tests.py AsReqKerberosTests >SERVER=172.31.9.163 STRICT_CHECKING=0 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE CLIENT_USERNAME=administrator CLIENT_PASSWORD=A1b2C3d4 CLIENT_AS_SUPPORTED_ENCTYPES=4 python/samba/tests/krb5/as_req_tests.py AsReqKerberosTests > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 01d86954d217e38be333aa1ce7db1d3d9059cd4c) >--- > python/samba/tests/krb5/as_req_tests.py | 121 ++++++++++++++++++++++++ > python/samba/tests/usage.py | 1 + > 2 files changed, 122 insertions(+) > create mode 100755 python/samba/tests/krb5/as_req_tests.py > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >new file mode 100755 >index 00000000000..3ad37c6bdf2 >--- /dev/null >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -0,0 +1,121 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+from samba.tests import DynamicTestCase >+from samba.tests.krb5.raw_testcase import RawKerberosTest >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+from samba.tests.krb5.rfc4120_constants import ( >+ KDC_ERR_PREAUTH_REQUIRED, >+ NT_PRINCIPAL, >+ NT_SRV_INST >+) >+ >+global_asn1_print = False >+global_hexdump = False >+ >+@DynamicTestCase >+class AsReqKerberosTests(RawKerberosTest): >+ >+ @classmethod >+ def setUpDynamicTestCases(cls): >+ for (name, idx) in cls.etype_test_permutation_name_idx(): >+ for pac in [None, True, False]: >+ tname = "%s_pac_%s" % (name, pac) >+ targs = (idx, pac) >+ cls.generate_dynamic_test("test_as_req_no_preauth", tname, *targs) >+ return >+ >+ def setUp(self): >+ super(AsReqKerberosTests, self).setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ def _test_as_req_nopreauth(self, >+ initial_etypes, >+ initial_padata=None, >+ initial_kdc_options=None): >+ client_creds = self.get_client_creds() >+ client_account = client_creds.get_username() >+ client_as_etypes = client_creds.get_as_krb5_etypes() >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_account = krbtgt_creds.get_username() >+ realm = krbtgt_creds.get_realm() >+ >+ cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[client_account]) >+ sname = self.PrincipalName_create(name_type=NT_SRV_INST, >+ names=[krbtgt_account, realm]) >+ >+ expected_error_mode = KDC_ERR_PREAUTH_REQUIRED >+ expected_crealm = realm >+ expected_cname = cname >+ expected_srealm = realm >+ expected_sname = sname >+ expected_salt = client_creds.get_forced_salt() >+ >+ def _generate_padata_copy(_kdc_exchange_dict, >+ _callback_dict, >+ req_body): >+ return initial_padata, req_body >+ >+ kdc_exchange_dict = self.as_exchange_dict( >+ expected_crealm=expected_crealm, >+ expected_cname=expected_cname, >+ expected_srealm=expected_srealm, >+ expected_sname=expected_sname, >+ generate_padata_fn=_generate_padata_copy, >+ check_error_fn=self.generic_check_as_error, >+ check_rep_fn=self.generic_check_kdc_rep, >+ expected_error_mode=expected_error_mode, >+ client_as_etypes=client_as_etypes, >+ expected_salt=expected_salt) >+ >+ rep = self._generic_kdc_exchange(kdc_exchange_dict, >+ kdc_options=str(initial_kdc_options), >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ etypes=initial_etypes) >+ >+ return kdc_exchange_dict['preauth_etype_info2'] >+ >+ def _test_as_req_no_preauth_with_args(self, etype_idx, pac): >+ name, etypes = self.etype_test_permutation_by_idx(etype_idx) >+ if pac is None: >+ padata = None >+ else: >+ pa_pac = self.KERB_PA_PAC_REQUEST_create(pac) >+ padata = [pa_pac] >+ return self._test_as_req_nopreauth( >+ initial_padata=padata, >+ initial_etypes=etypes, >+ initial_kdc_options=krb5_asn1.KDCOptions('forwardable')) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = True >+ global_hexdump = True >+ import unittest >+ unittest.main() >+ >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index e8eda7d6896..11170a2d241 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -100,6 +100,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/test_rpc.py', > 'python/samba/tests/krb5/test_smb.py', > 'python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py', >+ 'python/samba/tests/krb5/as_req_tests.py', > } > > EXCLUDE_HELP = { >-- >2.25.1 > > >From 2c24daaefcba0339ec569462a78361de2aef8be0 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Tue, 21 Apr 2020 11:07:45 +0200 >Subject: [PATCH 098/380] selftest: run new as_req_tests against fl2008r2dc and > fl2003dc > >There are a lot of things we should improve in our KDC >in order to work like a Windows KDC. > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d91665d33130aed11fa82d8d2796ab1627e04dc4) >--- > .../knownfail.d/samba.tests.krb5.as_req_tests | 276 +++++++++++++ > selftest/knownfail_mit_kdc | 389 +++++++++++++++++- > selftest/target/Samba.pm | 1 + > selftest/target/Samba4.pm | 6 +- > source4/selftest/tests.py | 10 + > 5 files changed, 680 insertions(+), 2 deletions(-) > create mode 100644 selftest/knownfail.d/samba.tests.krb5.as_req_tests > >diff --git a/selftest/knownfail.d/samba.tests.krb5.as_req_tests b/selftest/knownfail.d/samba.tests.krb5.as_req_tests >new file mode 100644 >index 00000000000..390d6cd0ab6 >--- /dev/null >+++ b/selftest/knownfail.d/samba.tests.krb5.as_req_tests >@@ -0,0 +1,276 @@ >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2003dc >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 2c2a643944c..b610929a8dd 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -290,4 +290,391 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_b > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_c > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_6_c >- >+# >+# MIT currently fails some as_req_no_preauth tests. >+# >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_False >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_False.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_None.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_True.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_True.fl2008r2dc >diff --git a/selftest/target/Samba.pm b/selftest/target/Samba.pm >index 9319f301327..4b4da053d83 100644 >--- a/selftest/target/Samba.pm >+++ b/selftest/target/Samba.pm >@@ -714,6 +714,7 @@ my @exported_envvars = ( > "DNSNAME", > "REALM", > "DOMSID", >+ "SUPPORTED_ENCTYPE_BITS", > > # stuff related to a trusted domain > "TRUST_SERVER", >diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm >index 927638cb7c4..193b2456cb4 100755 >--- a/selftest/target/Samba4.pm >+++ b/selftest/target/Samba4.pm >@@ -510,7 +510,10 @@ sub provision_raw_prepare($$$$$$$$$$$$) > $ctx->{kdc_ipv6} = $kdc_ipv6; > $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}"; > if ($functional_level eq "2000") { >- $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc" >+ $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc"; >+ $ctx->{supported_enctypes_bits} = "4"; >+ } else { >+ $ctx->{supported_enctypes_bits} = "28"; > } > > # >@@ -812,6 +815,7 @@ nogroup:x:65534:nobody > KRB5_CONFIG => $ctx->{krb5_conf}, > KRB5_CCACHE => $ctx->{krb5_ccache}, > MITKDC_CONFIG => $ctx->{mitkdc_conf}, >+ SUPPORTED_ENCTYPE_BITS => $ctx->{supported_enctypes_bits}, > PIDDIR => $ctx->{piddir}, > SERVER => $ctx->{hostname}, > DC_SERVER => $ctx->{hostname}, >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index f26bdc2bf6f..a3113e6b77e 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -1273,6 +1273,16 @@ plansmbtorture4testsuite('krb5.kdc', env, ['ncacn_np:$SERVER_IP', "-k", "yes", ' > '--option=torture:krb5-hostname=testupnspn.$DNSNAME', > '--option=torture:krb5-service=http'], > "samba4.krb5.kdc with account having identical UPN and SPN") >+for env in ["fl2008r2dc", "fl2003dc"]: >+ planoldpythontestsuite(env, "samba.tests.krb5.as_req_tests", >+ environ={ >+ 'CLIENT_USERNAME': '$USERNAME', >+ 'CLIENT_PASSWORD': '$PASSWORD', >+ 'CLIENT_AS_SUPPORTED_ENCTYPES': '$SUPPORTED_ENCTYPE_BITS', >+ 'SERVER_USERNAME': '$SERVER', >+ 'SERVER_PASSWORD': 'machine$PASSWORD', >+ 'STRICT_CHECKING': '0', >+ }) > > > for env in ["rodc", "promoted_dc", "fl2000dc", "fl2008r2dc"]: >-- >2.25.1 > > >From bdf3b11abb830cd9196b1db8b043599ec8cea92e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 15:38:28 +1200 >Subject: [PATCH 099/380] tests/krb5/kdc_base_test.py: Defer account deletion > until tearDownClass() is called > >This allows accounts created for permutation tests to be reused, rather >than having to be recreated for every test. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 5412bffb9b4fc13023e650bbc9436a79b60b6fa2) >--- > python/samba/tests/krb5/kdc_base_test.py | 24 +++++++++++++++--------- > 1 file changed, 15 insertions(+), 9 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index e345f739e1c..578736574ae 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -99,21 +99,27 @@ class KDCBaseTest(RawKerberosTest): > base="", expression="", scope=SCOPE_BASE, attrs=["dnsHostName"]) > cls.dns_host_name = str(res[0]['dnsHostName']) > >+ # A set containing DNs of accounts created as part of testing. >+ cls.accounts = set() >+ >+ @classmethod >+ def tearDownClass(cls): >+ # Clean up any accounts created by create_account. This is >+ # done in tearDownClass() rather than tearDown(), so that >+ # accounts need only be created once for permutation tests. >+ for dn in cls.accounts: >+ delete_force(cls.ldb, dn) >+ super().tearDownClass() >+ > def setUp(self): > super().setUp() > self.do_asn1_print = global_asn1_print > self.do_hexdump = global_hexdump >- self.accounts = [] >- >- def tearDown(self): >- # Clean up any accounts created by create_account >- for dn in self.accounts: >- delete_force(self.ldb, dn) > > def create_account(self, name, machine_account=False, spn=None, upn=None): > '''Create an account for testing. > The dn of the created account is added to self.accounts, >- which is used by tearDown to clean up the created accounts. >+ which is used by tearDownClass to clean up the created accounts. > ''' > dn = "cn=%s,%s" % (name, self.ldb.domain_dn()) > >@@ -153,8 +159,8 @@ class KDCBaseTest(RawKerberosTest): > if machine_account: > creds.set_workstation(name) > # >- # Save the account name so it can be deleted in the tearDown >- self.accounts.append(dn) >+ # Save the account name so it can be deleted in tearDownClass >+ self.accounts.add(dn) > > return (creds, dn) > >-- >2.25.1 > > >From de3d2e294ffdb9de934282a61c9d0685cc7c4a24 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 13:14:33 +1200 >Subject: [PATCH 100/380] tests/krb5/raw_testcase.py: Add get_admin_creds() > >This method allows obtaining credentials that can be used for >administrative tasks such as creating accounts. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 5afae39da0ab408bb36dde3a7801634bd9cc24f6) >--- > python/samba/tests/krb5/raw_testcase.py | 5 +++++ > 1 file changed, 5 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 8c8926b0ad2..7e41245f706 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -526,6 +526,11 @@ class RawKerberosTest(TestCaseInTempDir): > allow_missing_password=allow_missing_password) > return c > >+ def get_admin_creds(self, allow_missing_password=False): >+ c = self._get_krb5_creds(prefix='ADMIN', >+ allow_missing_password=allow_missing_password) >+ return c >+ > def get_krbtgt_creds(self, require_strongest_key=False): > c = self._get_krb5_creds(prefix='KRBTGT', > default_username='krbtgt', >-- >2.25.1 > > >From af1d02ea0154e017ecaf8470cf1feb64db1ce762 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 16 Jun 2021 11:04:00 +1200 >Subject: [PATCH 101/380] tests/krb5/kdc_base_test.py: Create database > connection only when needed > >Now the database connection is only created on its first use, which >means database credentials are no longer required for tests that don't >make use of it. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 4f5566be4839838e0e3e501a030bcf6e85ff5159) >--- > python/samba/tests/krb5/kdc_base_test.py | 56 +++++++------ > python/samba/tests/krb5/kdc_tgs_tests.py | 17 ++-- > .../ms_kile_client_principal_lookup_tests.py | 84 +++++++++++-------- > python/samba/tests/krb5/test_ccache.py | 15 ++-- > python/samba/tests/krb5/test_ldap.py | 12 +-- > python/samba/tests/krb5/test_rpc.py | 6 +- > python/samba/tests/krb5/test_smb.py | 12 +-- > 7 files changed, 116 insertions(+), 86 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 578736574ae..b191f905366 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -89,15 +89,7 @@ class KDCBaseTest(RawKerberosTest): > > cls.credentials = c > >- cls.session = system_session() >- cls.ldb = SamDB(url="ldap://%s" % cls.host, >- session_info=cls.session, >- credentials=cls.credentials, >- lp=cls.lp) >- # fetch the dnsHostName from the RootDse >- res = cls.ldb.search( >- base="", expression="", scope=SCOPE_BASE, attrs=["dnsHostName"]) >- cls.dns_host_name = str(res[0]['dnsHostName']) >+ cls._ldb = None > > # A set containing DNs of accounts created as part of testing. > cls.accounts = set() >@@ -107,8 +99,9 @@ class KDCBaseTest(RawKerberosTest): > # Clean up any accounts created by create_account. This is > # done in tearDownClass() rather than tearDown(), so that > # accounts need only be created once for permutation tests. >- for dn in cls.accounts: >- delete_force(cls.ldb, dn) >+ if cls._ldb is not None: >+ for dn in cls.accounts: >+ delete_force(cls._ldb, dn) > super().tearDownClass() > > def setUp(self): >@@ -116,16 +109,27 @@ class KDCBaseTest(RawKerberosTest): > self.do_asn1_print = global_asn1_print > self.do_hexdump = global_hexdump > >- def create_account(self, name, machine_account=False, spn=None, upn=None): >+ def get_samdb(self): >+ if self._ldb is None: >+ session = system_session() >+ type(self)._ldb = SamDB(url="ldap://%s" % self.host, >+ session_info=session, >+ credentials=self.credentials, >+ lp=self.lp) >+ >+ return self._ldb >+ >+ def create_account(self, ldb, name, machine_account=False, >+ spn=None, upn=None): > '''Create an account for testing. > The dn of the created account is added to self.accounts, > which is used by tearDownClass to clean up the created accounts. > ''' >- dn = "cn=%s,%s" % (name, self.ldb.domain_dn()) >+ dn = "cn=%s,%s" % (name, ldb.domain_dn()) > > # remove the account if it exists, this will happen if a previous test > # run failed >- delete_force(self.ldb, dn) >+ delete_force(ldb, dn) > if machine_account: > object_class = "computer" > account_name = "%s$" % name >@@ -148,12 +152,12 @@ class KDCBaseTest(RawKerberosTest): > details["servicePrincipalName"] = spn > if upn is not None: > details["userPrincipalName"] = upn >- self.ldb.add(details) >+ ldb.add(details) > > creds = Credentials() > creds.guess(self.lp) >- creds.set_realm(self.ldb.domain_dns_name().upper()) >- creds.set_domain(self.ldb.domain_netbios_name().upper()) >+ creds.set_realm(ldb.domain_dns_name().upper()) >+ creds.set_domain(ldb.domain_netbios_name().upper()) > creds.set_password(password) > creds.set_username(account_name) > if machine_account: >@@ -425,38 +429,38 @@ class KDCBaseTest(RawKerberosTest): > enc_part, asn1Spec=krb5_asn1.EncTicketPart()) > return enc_ticket_part > >- def get_objectSid(self, dn): >+ def get_objectSid(self, samdb, dn): > ''' Get the objectSID for a DN > Note: performs an Ldb query. > ''' >- res = self.ldb.search(dn, scope=SCOPE_BASE, attrs=["objectSID"]) >+ res = samdb.search(dn, scope=SCOPE_BASE, attrs=["objectSID"]) > self.assertTrue(len(res) == 1, "did not get objectSid for %s" % dn) >- sid = self.ldb.schema_format_value("objectSID", res[0]["objectSID"][0]) >+ sid = samdb.schema_format_value("objectSID", res[0]["objectSID"][0]) > return sid.decode('utf8') > >- def add_attribute(self, dn_str, name, value): >+ def add_attribute(self, samdb, dn_str, name, value): > if isinstance(value, list): > values = value > else: > values = [value] > flag = ldb.FLAG_MOD_ADD > >- dn = ldb.Dn(self.ldb, dn_str) >+ dn = ldb.Dn(samdb, dn_str) > msg = ldb.Message(dn) > msg[name] = ldb.MessageElement(values, flag, name) >- self.ldb.modify(msg) >+ samdb.modify(msg) > >- def modify_attribute(self, dn_str, name, value): >+ def modify_attribute(self, samdb, dn_str, name, value): > if isinstance(value, list): > values = value > else: > values = [value] > flag = ldb.FLAG_MOD_REPLACE > >- dn = ldb.Dn(self.ldb, dn_str) >+ dn = ldb.Dn(samdb, dn_str) > msg = ldb.Message(dn) > msg[name] = ldb.MessageElement(values, flag, name) >- self.ldb.modify(msg) >+ samdb.modify(msg) > > def create_ccache(self, cname, ticket, enc_part): > """ Lay out a version 4 on-disk credentials cache, to be read using the >diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py >index 23a1d868a79..0c757bd5e5f 100755 >--- a/python/samba/tests/krb5/kdc_tgs_tests.py >+++ b/python/samba/tests/krb5/kdc_tgs_tests.py >@@ -49,8 +49,9 @@ class KdcTgsTests(KDCBaseTest): > that differs from that provided to the krbtgt > ''' > # Create the user account >+ samdb = self.get_samdb() > user_name = "tsttktusr" >- (uc, _) = self.create_account(user_name) >+ (uc, _) = self.create_account(samdb, user_name) > realm = uc.get_realm().lower() > > # Do the initial AS-REQ, should get a pre-authentication required >@@ -81,7 +82,7 @@ class KdcTgsTests(KDCBaseTest): > names=["Administrator"]) > sname = self.PrincipalName_create( > name_type=NT_PRINCIPAL, >- names=["host", self.dns_host_name]) >+ names=["host", samdb.host_dns_name()]) > > (rep, enc_part) = self.tgs_req(cname, sname, realm, ticket, key, etype) > >@@ -98,8 +99,9 @@ class KdcTgsTests(KDCBaseTest): > '''Get a ticket to the ldap service > ''' > # Create the user account >+ samdb = self.get_samdb() > user_name = "tsttktusr" >- (uc, _) = self.create_account(user_name) >+ (uc, _) = self.create_account(samdb, user_name) > realm = uc.get_realm().lower() > > # Do the initial AS-REQ, should get a pre-authentication required >@@ -126,7 +128,7 @@ class KdcTgsTests(KDCBaseTest): > # Request a ticket to the ldap service > sname = self.PrincipalName_create( > name_type=NT_SRV_INST, >- names=["ldap", self.dns_host_name]) >+ names=["ldap", samdb.host_dns_name()]) > > (rep, _) = self.tgs_req( > cname, sname, uc.get_realm(), ticket, key, etype) >@@ -137,9 +139,10 @@ class KdcTgsTests(KDCBaseTest): > > # Create a user and machine account for the test. > # >+ samdb = self.get_samdb() > user_name = "tsttktusr" >- (uc, dn) = self.create_account(user_name) >- (mc, _) = self.create_account("tsttktmac", machine_account=True) >+ (uc, dn) = self.create_account(samdb, user_name) >+ (mc, _) = self.create_account(samdb, "tsttktmac", machine_account=True) > realm = uc.get_realm().lower() > > # Do the initial AS-REQ, should get a pre-authentication required >@@ -179,7 +182,7 @@ class KdcTgsTests(KDCBaseTest): > enc_part = self.decode_service_ticket(mc, ticket) > > pac_data = self.get_pac_data(enc_part['authorization-data']) >- sid = self.get_objectSid(dn) >+ sid = self.get_objectSid(samdb, dn) > upn = "%s@%s" % (uc.get_username(), realm) > self.assertEqual( > uc.get_username(), >diff --git a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >index 356a25f8e18..63f67b09c4c 100755 >--- a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >+++ b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >@@ -49,10 +49,10 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.do_asn1_print = global_asn1_print > self.do_hexdump = global_hexdump > >- def check_pac(self, auth_data, dn, uc, name, upn=None): >+ def check_pac(self, samdb, auth_data, dn, uc, name, upn=None): > > pac_data = self.get_pac_data(auth_data) >- sid = self.get_objectSid(dn) >+ sid = self.get_objectSid(samdb, dn) > if upn is None: > upn = "%s@%s" % (name, uc.get_realm().lower()) > if name.endswith('$'): >@@ -89,12 +89,13 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > > # Create user and machine accounts for the test. > # >+ samdb = self.get_samdb() > user_name = "mskileusr" >- (uc, dn) = self.create_account(user_name) >+ (uc, dn) = self.create_account(samdb, user_name) > realm = uc.get_realm().lower() > > mach_name = "mskilemac" >- (mc, _) = self.create_account(mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, machine_account=True) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -131,7 +132,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > # Check the contents of the pac, and the ticket > ticket = rep['ticket'] > enc_part = self.decode_service_ticket(mc, ticket) >- self.check_pac(enc_part['authorization-data'], dn, uc, user_name) >+ self.check_pac(samdb, enc_part['authorization-data'], dn, uc, user_name) > # check the crealm and cname > cname = enc_part['cname'] > self.assertEqual(NT_PRINCIPAL, cname['name-type']) >@@ -147,12 +148,13 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > > # Create a machine account for the test. > # >+ samdb = self.get_samdb() > user_name = "mskilemac" >- (mc, dn) = self.create_account(user_name, machine_account=True) >+ (mc, dn) = self.create_account(samdb, user_name, machine_account=True) > realm = mc.get_realm().lower() > > mach_name = "mskilemac" >- (mc, _) = self.create_account(mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, machine_account=True) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -189,7 +191,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > # Check the contents of the pac, and the ticket > ticket = rep['ticket'] > enc_part = self.decode_service_ticket(mc, ticket) >- self.check_pac(enc_part['authorization-data'], dn, mc, mach_name + '$') >+ self.check_pac(samdb, enc_part['authorization-data'], dn, mc, mach_name + '$') > # check the crealm and cname > cname = enc_part['cname'] > self.assertEqual(NT_PRINCIPAL, cname['name-type']) >@@ -206,14 +208,15 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > ''' > # Create a user account for the test. > # >+ samdb = self.get_samdb() > user_name = "mskileusr" > upn_name = "mskileupn" > upn = upn_name + "@" + self.credentials.get_realm().lower() >- (uc, dn) = self.create_account(user_name, upn=upn) >+ (uc, dn) = self.create_account(samdb, user_name, upn=upn) > realm = uc.get_realm().lower() > > mach_name = "mskilemac" >- (mc, _) = self.create_account(mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, machine_account=True) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -250,7 +253,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > # Check the contents of the service ticket > ticket = rep['ticket'] > enc_part = self.decode_service_ticket(mc, ticket) >- self.check_pac(enc_part['authorization-data'], dn, uc, upn_name) >+ self.check_pac(samdb, enc_part['authorization-data'], dn, uc, upn_name) > # check the crealm and cname > cname = enc_part['cname'] > self.assertEqual(NT_PRINCIPAL, cname['name-type']) >@@ -273,19 +276,21 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > # setting UF_DONT_REQUIRE_PREAUTH seems to be the only way > # to trigger the no pre-auth step > >+ samdb = self.get_samdb() > user_name = "mskileusr" > alt_name = "mskilealtsec" >- (uc, dn) = self.create_account(user_name) >+ (uc, dn) = self.create_account(samdb, user_name) > realm = uc.get_realm().lower() > alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >- self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ self.add_attribute(samdb, dn, "altSecurityIdentities", alt_sec) > self.modify_attribute( >+ samdb, > dn, > "userAccountControl", > str(UF_NORMAL_ACCOUNT | UF_DONT_REQUIRE_PREAUTH)) > > mach_name = "mskilemac" >- (mc, _) = self.create_account(mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, machine_account=True) > > # Do the initial AS-REQ, as we've set UF_DONT_REQUIRE_PREAUTH > # we should get a valid AS-RESP >@@ -340,15 +345,16 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > > # Create user and machine accounts for the test. > # >+ samdb = self.get_samdb() > user_name = "mskileusr" > alt_name = "mskilealtsec" >- (uc, dn) = self.create_account(user_name) >+ (uc, dn) = self.create_account(samdb, user_name) > realm = uc.get_realm().lower() > alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >- self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ self.add_attribute(samdb, dn, "altSecurityIdentities", alt_sec) > > mach_name = "mskilemac" >- (mc, _) = self.create_account(mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, machine_account=True) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -406,15 +412,16 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > > # Create user and machine accounts for the test. > # >+ samdb = self.get_samdb() > user_name = "mskileusr" > alt_name = "mskilealtsec" >- (uc, dn) = self.create_account(user_name) >+ (uc, dn) = self.create_account(samdb, user_name) > realm = uc.get_realm().lower() > alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >- self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ self.add_attribute(samdb, dn, "altSecurityIdentities", alt_sec) > > mach_name = "mskilemac" >- (mc, _) = self.create_account(mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, machine_account=True) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -445,14 +452,15 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > > # Create a user account for the test. > # >+ samdb = self.get_samdb() > user_name = "mskileusr" > upn_name = "mskileupn" > upn = upn_name + "@" + self.credentials.get_realm().lower() >- (uc, dn) = self.create_account(user_name, upn=upn) >+ (uc, dn) = self.create_account(samdb, user_name, upn=upn) > realm = uc.get_realm().lower() > > mach_name = "mskilemac" >- (mc, _) = self.create_account(mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, machine_account=True) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -508,13 +516,14 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > > # Create a user account for the test. > # >+ samdb = self.get_samdb() > user_name = "mskileusr" >- (uc, dn) = self.create_account(user_name) >+ (uc, dn) = self.create_account(samdb, user_name) > realm = uc.get_realm().lower() > ename = user_name + "@" + realm > > mach_name = "mskilemac" >- (mc, _) = self.create_account(mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, machine_account=True) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -570,12 +579,13 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > > # Create a user account for the test. > # >+ samdb = self.get_samdb() > user_name = "mskileusr" >- (uc, _) = self.create_account(user_name) >+ (uc, _) = self.create_account(samdb, user_name) > realm = uc.get_realm().lower() > > mach_name = "mskilemac" >- (mc, dn) = self.create_account(mach_name, machine_account=True) >+ (mc, dn) = self.create_account(samdb, mach_name, machine_account=True) > ename = mach_name + "@" + realm > uname = mach_name + "$@" + realm > >@@ -638,20 +648,22 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > # setting UF_DONT_REQUIRE_PREAUTH seems to be the only way > # to trigger the no pre-auth step > >+ samdb = self.get_samdb() > user_name = "mskileusr" > alt_name = "mskilealtsec" >- (uc, dn) = self.create_account(user_name) >+ (uc, dn) = self.create_account(samdb, user_name) > realm = uc.get_realm().lower() > alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >- self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ self.add_attribute(samdb, dn, "altSecurityIdentities", alt_sec) > self.modify_attribute( >+ samdb, > dn, > "userAccountControl", > str(UF_NORMAL_ACCOUNT | UF_DONT_REQUIRE_PREAUTH)) > ename = alt_name + "@" + realm > > mach_name = "mskilemac" >- (mc, _) = self.create_account(mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, machine_account=True) > > # Do the initial AS-REQ, as we've set UF_DONT_REQUIRE_PREAUTH > # we should get a valid AS-RESP >@@ -706,17 +718,18 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > > # Create user and machine accounts for the test. > # >+ samdb = self.get_samdb() > user_name = "mskileusr" > alt_name = "mskilealtsec" >- (uc, dn) = self.create_account(user_name) >+ (uc, dn) = self.create_account(samdb, user_name) > realm = uc.get_realm().lower() > alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >- self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ self.add_attribute(samdb, dn, "altSecurityIdentities", alt_sec) > ename = alt_name + "@" + realm > uname = user_name + "@" + realm > > mach_name = "mskilemac" >- (mc, _) = self.create_account(mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, machine_account=True) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -775,16 +788,17 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > > # Create user and machine accounts for the test. > # >+ samdb = self.get_samdb() > user_name = "mskileusr" > alt_name = "mskilealtsec" >- (uc, dn) = self.create_account(user_name) >+ (uc, dn) = self.create_account(samdb, user_name) > realm = uc.get_realm().lower() > alt_sec = "Kerberos:%s@%s" % (alt_name, realm) >- self.add_attribute(dn, "altSecurityIdentities", alt_sec) >+ self.add_attribute(samdb, dn, "altSecurityIdentities", alt_sec) > ename = alt_name + "@" + realm > > mach_name = "mskilemac" >- (mc, _) = self.create_account(mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, machine_account=True) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >diff --git a/python/samba/tests/krb5/test_ccache.py b/python/samba/tests/krb5/test_ccache.py >index 32c9e3cce6b..c7857a6cf0e 100755 >--- a/python/samba/tests/krb5/test_ccache.py >+++ b/python/samba/tests/krb5/test_ccache.py >@@ -49,11 +49,14 @@ class CcacheTests(KDCBaseTest): > mach_name = "ccachemac" > service = "host" > >+ samdb = self.get_samdb() >+ > # Create the user account. >- (user_credentials, _) = self.create_account(user_name) >+ (user_credentials, _) = self.create_account(samdb, user_name) > > # Create the machine account. >- (mach_credentials, _) = self.create_account(mach_name, >+ (mach_credentials, _) = self.create_account(samdb, >+ mach_name, > machine_account=True, > spn="%s/%s" % (service, > mach_name)) >@@ -77,7 +80,7 @@ class CcacheTests(KDCBaseTest): > gensec_client.want_feature(gensec.FEATURE_SEAL) > gensec_client.start_mech_by_sasl_name("GSSAPI") > >- auth_context = AuthContext(lp_ctx=self.lp, ldb=self.ldb, methods=[]) >+ auth_context = AuthContext(lp_ctx=self.lp, ldb=samdb, methods=[]) > > gensec_server = gensec.Security.start_server(settings, auth_context) > gensec_server.set_credentials(mach_credentials) >@@ -104,9 +107,9 @@ class CcacheTests(KDCBaseTest): > # token is the SID of the user we created. > > # Retrieve the user account's SID. >- ldb_res = self.ldb.search(scope=SCOPE_SUBTREE, >- expression="(sAMAccountName=%s)" % user_name, >- attrs=["objectSid"]) >+ ldb_res = samdb.search(scope=SCOPE_SUBTREE, >+ expression="(sAMAccountName=%s)" % user_name, >+ attrs=["objectSid"]) > self.assertEqual(1, len(ldb_res)) > sid = ndr_unpack(security.dom_sid, ldb_res[0]["objectSid"][0]) > >diff --git a/python/samba/tests/krb5/test_ldap.py b/python/samba/tests/krb5/test_ldap.py >index 6a4bf52d77f..7e9405a8a92 100755 >--- a/python/samba/tests/krb5/test_ldap.py >+++ b/python/samba/tests/krb5/test_ldap.py >@@ -44,12 +44,14 @@ class LdapTests(KDCBaseTest): > # credentials cache file where the service ticket authenticating the > # user are stored. > >+ samdb = self.get_samdb() >+ > user_name = "ldapusr" >- mach_name = self.dns_host_name >+ mach_name = samdb.host_dns_name() > service = "ldap" > > # Create the user account. >- (user_credentials, _) = self.create_account(user_name) >+ (user_credentials, _) = self.create_account(samdb, user_name) > > # Talk to the KDC to obtain the service ticket, which gets placed into > # the cache. The machine account name has to match the name in the >@@ -63,9 +65,9 @@ class LdapTests(KDCBaseTest): > # cached credentials. > > # Retrieve the user account's SID. >- ldb_res = self.ldb.search(scope=SCOPE_SUBTREE, >- expression="(sAMAccountName=%s)" % user_name, >- attrs=["objectSid"]) >+ ldb_res = samdb.search(scope=SCOPE_SUBTREE, >+ expression="(sAMAccountName=%s)" % user_name, >+ attrs=["objectSid"]) > self.assertEqual(1, len(ldb_res)) > sid = ndr_unpack(security.dom_sid, ldb_res[0]["objectSid"][0]) > >diff --git a/python/samba/tests/krb5/test_rpc.py b/python/samba/tests/krb5/test_rpc.py >index da1c4eb88ac..c474e479d81 100755 >--- a/python/samba/tests/krb5/test_rpc.py >+++ b/python/samba/tests/krb5/test_rpc.py >@@ -41,12 +41,14 @@ class RpcTests(KDCBaseTest): > # credentials cache file where the service ticket authenticating the > # user are stored. > >+ samdb = self.get_samdb() >+ > user_name = "rpcusr" >- mach_name = self.dns_host_name >+ mach_name = samdb.host_dns_name() > service = "cifs" > > # Create the user account. >- (user_credentials, _) = self.create_account(user_name) >+ (user_credentials, _) = self.create_account(samdb, user_name) > > # Talk to the KDC to obtain the service ticket, which gets placed into > # the cache. The machine account name has to match the name in the >diff --git a/python/samba/tests/krb5/test_smb.py b/python/samba/tests/krb5/test_smb.py >index 0262a37ebb5..8f76e78afe3 100755 >--- a/python/samba/tests/krb5/test_smb.py >+++ b/python/samba/tests/krb5/test_smb.py >@@ -45,13 +45,15 @@ class SmbTests(KDCBaseTest): > # credentials cache file where the service ticket authenticating the > # user are stored. > >+ samdb = self.get_samdb() >+ > user_name = "smbusr" >- mach_name = self.dns_host_name >+ mach_name = samdb.host_dns_name() > service = "cifs" > share = "tmp" > > # Create the user account. >- (user_credentials, _) = self.create_account(user_name) >+ (user_credentials, _) = self.create_account(samdb, user_name) > > # Talk to the KDC to obtain the service ticket, which gets placed into > # the cache. The machine account name has to match the name in the >@@ -72,9 +74,9 @@ class SmbTests(KDCBaseTest): > # cached credentials. > > # Retrieve the user account's SID. >- ldb_res = self.ldb.search(scope=SCOPE_SUBTREE, >- expression="(sAMAccountName=%s)" % user_name, >- attrs=["objectSid"]) >+ ldb_res = samdb.search(scope=SCOPE_SUBTREE, >+ expression="(sAMAccountName=%s)" % user_name, >+ attrs=["objectSid"]) > self.assertEqual(1, len(ldb_res)) > sid = ndr_unpack(security.dom_sid, ldb_res[0]["objectSid"][0]) > >-- >2.25.1 > > >From 63d604c0c50dbe98c908aa10f2389205606edc87 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 16 Jun 2021 11:31:26 +1200 >Subject: [PATCH 102/380] tests/krb5/kdc_base_test.py: Remove 'credentials' > class attribute > >Credentials for tests are now obtained using the get_user_creds() >method. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 364f1ce8d8221cb8926635fc864db782cee61cf9) >--- > python/samba/tests/krb5/kdc_base_test.py | 24 +++---------------- > .../ms_kile_client_principal_lookup_tests.py | 4 ++-- > 2 files changed, 5 insertions(+), 23 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index b191f905366..f3c6b37d29f 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -67,28 +67,8 @@ class KDCBaseTest(RawKerberosTest): > @classmethod > def setUpClass(cls): > cls.lp = cls.get_loadparm(cls) >- cls.username = os.environ["USERNAME"] >- cls.password = os.environ["PASSWORD"] > cls.host = os.environ["SERVER"] > >- c = Credentials() >- c.set_username(cls.username) >- c.set_password(cls.password) >- try: >- realm = os.environ["REALM"] >- c.set_realm(realm) >- except KeyError: >- pass >- try: >- domain = os.environ["DOMAIN"] >- c.set_domain(domain) >- except KeyError: >- pass >- >- c.guess() >- >- cls.credentials = c >- > cls._ldb = None > > # A set containing DNs of accounts created as part of testing. >@@ -111,10 +91,12 @@ class KDCBaseTest(RawKerberosTest): > > def get_samdb(self): > if self._ldb is None: >+ creds = self.get_user_creds() >+ > session = system_session() > type(self)._ldb = SamDB(url="ldap://%s" % self.host, > session_info=session, >- credentials=self.credentials, >+ credentials=creds, > lp=self.lp) > > return self._ldb >diff --git a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >index 63f67b09c4c..e9d251e72f6 100755 >--- a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >+++ b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >@@ -211,7 +211,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > samdb = self.get_samdb() > user_name = "mskileusr" > upn_name = "mskileupn" >- upn = upn_name + "@" + self.credentials.get_realm().lower() >+ upn = upn_name + "@" + self.get_user_creds().get_realm().lower() > (uc, dn) = self.create_account(samdb, user_name, upn=upn) > realm = uc.get_realm().lower() > >@@ -455,7 +455,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > samdb = self.get_samdb() > user_name = "mskileusr" > upn_name = "mskileupn" >- upn = upn_name + "@" + self.credentials.get_realm().lower() >+ upn = upn_name + "@" + self.get_user_creds().get_realm().lower() > (uc, dn) = self.create_account(samdb, user_name, upn=upn) > realm = uc.get_realm().lower() > >-- >2.25.1 > > >From a3b3fd25d1b92d9c22a94d0a017c199e9891cb23 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 16 Jun 2021 11:40:41 +1200 >Subject: [PATCH 103/380] tests/krb5/kdc_base_test.py: Create loadparm only > when needed > >Now the .conf file is only loaded on its first use, which means that >SMB_CONF_PATH need not be defined for tests that don't make use of it. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 210e544016a3a4de1cdb76ce28a2148811ff07eb) >--- > python/samba/tests/krb5/kdc_base_test.py | 15 +++++++++++---- > python/samba/tests/krb5/test_ccache.py | 6 ++++-- > python/samba/tests/krb5/test_ldap.py | 2 +- > python/samba/tests/krb5/test_rpc.py | 2 +- > python/samba/tests/krb5/test_smb.py | 2 +- > 5 files changed, 18 insertions(+), 9 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index f3c6b37d29f..59ce546a181 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -66,7 +66,7 @@ class KDCBaseTest(RawKerberosTest): > > @classmethod > def setUpClass(cls): >- cls.lp = cls.get_loadparm(cls) >+ cls._lp = None > cls.host = os.environ["SERVER"] > > cls._ldb = None >@@ -89,15 +89,22 @@ class KDCBaseTest(RawKerberosTest): > self.do_asn1_print = global_asn1_print > self.do_hexdump = global_hexdump > >+ def get_lp(self): >+ if self._lp is None: >+ type(self)._lp = self.get_loadparm() >+ >+ return self._lp >+ > def get_samdb(self): > if self._ldb is None: > creds = self.get_user_creds() >+ lp = self.get_lp() > > session = system_session() > type(self)._ldb = SamDB(url="ldap://%s" % self.host, > session_info=session, > credentials=creds, >- lp=self.lp) >+ lp=lp) > > return self._ldb > >@@ -137,7 +144,7 @@ class KDCBaseTest(RawKerberosTest): > ldb.add(details) > > creds = Credentials() >- creds.guess(self.lp) >+ creds.guess(self.get_lp()) > creds.set_realm(ldb.domain_dns_name().upper()) > creds.set_domain(ldb.domain_netbios_name().upper()) > creds.set_password(password) >@@ -607,7 +614,7 @@ class KDCBaseTest(RawKerberosTest): > creds.set_kerberos_state(MUST_USE_KERBEROS) > creds.set_username(user_name, SPECIFIED) > creds.set_realm(realm) >- creds.set_named_ccache(cachefile.name, SPECIFIED, self.lp) >+ creds.set_named_ccache(cachefile.name, SPECIFIED, self.get_lp()) > > # Return the credentials along with the cache file. > return (creds, cachefile) >diff --git a/python/samba/tests/krb5/test_ccache.py b/python/samba/tests/krb5/test_ccache.py >index c7857a6cf0e..feb7a7bd9be 100755 >--- a/python/samba/tests/krb5/test_ccache.py >+++ b/python/samba/tests/krb5/test_ccache.py >@@ -71,8 +71,10 @@ class CcacheTests(KDCBaseTest): > # Authenticate in-process to the machine account using the user's > # cached credentials. > >+ lp = self.get_lp() >+ > settings = {} >- settings["lp_ctx"] = self.lp >+ settings["lp_ctx"] = lp > settings["target_hostname"] = mach_name > > gensec_client = gensec.Security.start_client(settings) >@@ -80,7 +82,7 @@ class CcacheTests(KDCBaseTest): > gensec_client.want_feature(gensec.FEATURE_SEAL) > gensec_client.start_mech_by_sasl_name("GSSAPI") > >- auth_context = AuthContext(lp_ctx=self.lp, ldb=samdb, methods=[]) >+ auth_context = AuthContext(lp_ctx=lp, ldb=samdb, methods=[]) > > gensec_server = gensec.Security.start_server(settings, auth_context) > gensec_server.set_credentials(mach_credentials) >diff --git a/python/samba/tests/krb5/test_ldap.py b/python/samba/tests/krb5/test_ldap.py >index 7e9405a8a92..d304fb9d71e 100755 >--- a/python/samba/tests/krb5/test_ldap.py >+++ b/python/samba/tests/krb5/test_ldap.py >@@ -74,7 +74,7 @@ class LdapTests(KDCBaseTest): > # Connect to the machine account and retrieve the user SID. > ldb_as_user = SamDB(url="ldap://%s" % mach_name, > credentials=creds, >- lp=self.lp) >+ lp=self.get_lp()) > ldb_res = ldb_as_user.search('', > scope=SCOPE_BASE, > attrs=["tokenGroups"]) >diff --git a/python/samba/tests/krb5/test_rpc.py b/python/samba/tests/krb5/test_rpc.py >index c474e479d81..324b57f2847 100755 >--- a/python/samba/tests/krb5/test_rpc.py >+++ b/python/samba/tests/krb5/test_rpc.py >@@ -62,7 +62,7 @@ class RpcTests(KDCBaseTest): > # cached credentials. > > binding_str = "ncacn_np:%s[\\pipe\\lsarpc]" % mach_name >- conn = lsa.lsarpc(binding_str, self.lp, creds) >+ conn = lsa.lsarpc(binding_str, self.get_lp(), creds) > > (account_name, _) = conn.GetUserName(None, None, None) > >diff --git a/python/samba/tests/krb5/test_smb.py b/python/samba/tests/krb5/test_smb.py >index 8f76e78afe3..45d4fe5e0c1 100755 >--- a/python/samba/tests/krb5/test_smb.py >+++ b/python/samba/tests/krb5/test_smb.py >@@ -82,7 +82,7 @@ class SmbTests(KDCBaseTest): > > # Connect to a share and retrieve the user SID. > s3_lp = s3param.get_context() >- s3_lp.load(self.lp.configfile) >+ s3_lp.load(self.get_lp().configfile) > > min_protocol = s3_lp.get("client min protocol") > self.addCleanup(s3_lp.set, "client min protocol", min_protocol) >-- >2.25.1 > > >From 8e0f990d7bd8520a971d348d56eb473a2e15f298 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 15:12:38 +1200 >Subject: [PATCH 104/380] tests/krb5/kdc_base_test.py: Add methods to determine > supported encryption types > >This is done based on the domain functional level, which corresponds to >the logic Samba uses to decide whether or not to generate a >Primary:Kerberos-Newer-Keys element for the supplementalCredentials >attribute. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 7d4a0ed21be49d13c2b815582f2d04f0c058bf3a) >--- > python/samba/tests/krb5/kdc_base_test.py | 38 ++++++++++++++++++++++-- > 1 file changed, 36 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 59ce546a181..e1b73dd8ff7 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -29,8 +29,13 @@ from ldb import SCOPE_BASE > from samba import generate_random_password > from samba.auth import system_session > from samba.credentials import Credentials, SPECIFIED, MUST_USE_KERBEROS >-from samba.dcerpc import krb5pac, krb5ccache >-from samba.dsdb import UF_WORKSTATION_TRUST_ACCOUNT, UF_NORMAL_ACCOUNT >+from samba.dcerpc import krb5pac, krb5ccache, security >+from samba.dsdb import ( >+ DS_DOMAIN_FUNCTION_2000, >+ DS_DOMAIN_FUNCTION_2008, >+ UF_WORKSTATION_TRUST_ACCOUNT, >+ UF_NORMAL_ACCOUNT >+) > from samba.ndr import ndr_pack, ndr_unpack > from samba.samdb import SamDB > >@@ -71,6 +76,8 @@ class KDCBaseTest(RawKerberosTest): > > cls._ldb = None > >+ cls._functional_level = None >+ > # A set containing DNs of accounts created as part of testing. > cls.accounts = set() > >@@ -108,6 +115,33 @@ class KDCBaseTest(RawKerberosTest): > > return self._ldb > >+ def get_domain_functional_level(self, ldb): >+ if self._functional_level is None: >+ res = ldb.search(base='', >+ scope=SCOPE_BASE, >+ attrs=['domainFunctionality']) >+ try: >+ functional_level = int(res[0]['domainFunctionality'][0]) >+ except KeyError: >+ functional_level = DS_DOMAIN_FUNCTION_2000 >+ >+ type(self)._functional_level = functional_level >+ >+ return self._functional_level >+ >+ def get_default_enctypes(self): >+ samdb = self.get_samdb() >+ functional_level = self.get_domain_functional_level(samdb) >+ >+ # RC4 should always be supported >+ default_enctypes = security.KERB_ENCTYPE_RC4_HMAC_MD5 >+ if functional_level >= DS_DOMAIN_FUNCTION_2008: >+ # AES is only supported at functional level 2008 or higher >+ default_enctypes |= security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96 >+ default_enctypes |= security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96 >+ >+ return default_enctypes >+ > def create_account(self, ldb, name, machine_account=False, > spn=None, upn=None): > '''Create an account for testing. >-- >2.25.1 > > >From 5dce9cba31253ca38a65a296789e7a9c7a52c8f3 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 13:15:10 +1200 >Subject: [PATCH 105/380] tests/krb5/raw_testcase.py: Add method to obtain > Kerberos keys over DRS > >This requires admin credentials, and removes the need to pass these keys >as environment variables. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 1f2ddd3c97e3ff243c8bd0c17299f27b761f5e7f) >--- > python/samba/tests/krb5/kdc_base_test.py | 100 ++++++++++++++++++++++- > 1 file changed, 99 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index e1b73dd8ff7..7ae22bc5929 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -20,6 +20,8 @@ import sys > import os > from datetime import datetime, timezone > import tempfile >+import binascii >+import struct > > sys.path.insert(0, "bin/python") > os.environ["PYTHONUNBUFFERED"] = "1" >@@ -29,7 +31,8 @@ from ldb import SCOPE_BASE > from samba import generate_random_password > from samba.auth import system_session > from samba.credentials import Credentials, SPECIFIED, MUST_USE_KERBEROS >-from samba.dcerpc import krb5pac, krb5ccache, security >+from samba.dcerpc import drsblobs, drsuapi, misc, krb5pac, krb5ccache, security >+from samba.drs_utils import drsuapi_connect > from samba.dsdb import ( > DS_DOMAIN_FUNCTION_2000, > DS_DOMAIN_FUNCTION_2008, >@@ -37,6 +40,7 @@ from samba.dsdb import ( > UF_NORMAL_ACCOUNT > ) > from samba.ndr import ndr_pack, ndr_unpack >+from samba import net > from samba.samdb import SamDB > > from samba.tests import delete_force >@@ -191,6 +195,100 @@ class KDCBaseTest(RawKerberosTest): > > return (creds, dn) > >+ def get_keys(self, samdb, dn): >+ admin_creds = self.get_admin_creds() >+ >+ dns_hostname = samdb.host_dns_name() >+ (bind, handle, _) = drsuapi_connect(dns_hostname, >+ self.get_lp(), >+ admin_creds) >+ >+ destination_dsa_guid = misc.GUID(samdb.get_ntds_GUID()) >+ >+ req = drsuapi.DsGetNCChangesRequest8() >+ >+ req.destination_dsa_guid = destination_dsa_guid >+ req.source_dsa_invocation_id = misc.GUID() >+ >+ naming_context = drsuapi.DsReplicaObjectIdentifier() >+ naming_context.dn = str(dn) >+ >+ req.naming_context = naming_context >+ >+ hwm = drsuapi.DsReplicaHighWaterMark() >+ hwm.tmp_highest_usn = 0 >+ hwm.reserved_usn = 0 >+ hwm.highest_usn = 0 >+ >+ req.highwatermark = hwm >+ req.uptodateness_vector = None >+ >+ req.replica_flags = 0 >+ >+ req.max_object_count = 1 >+ req.max_ndr_size = 402116 >+ req.extended_op = drsuapi.DRSUAPI_EXOP_REPL_SECRET >+ >+ attids = [drsuapi.DRSUAPI_ATTID_supplementalCredentials, >+ drsuapi.DRSUAPI_ATTID_unicodePwd] >+ >+ partial_attribute_set = drsuapi.DsPartialAttributeSet() >+ partial_attribute_set.version = 1 >+ partial_attribute_set.attids = attids >+ partial_attribute_set.num_attids = len(attids) >+ >+ req.partial_attribute_set = partial_attribute_set >+ >+ req.partial_attribute_set_ex = None >+ req.mapping_ctr.num_mappings = 0 >+ req.mapping_ctr.mappings = None >+ >+ _, ctr = bind.DsGetNCChanges(handle, 8, req) >+ identifier = ctr.first_object.object.identifier >+ attributes = ctr.first_object.object.attribute_ctr.attributes >+ >+ rid = identifier.sid.split()[1] >+ >+ forced_keys = dict() >+ >+ net_ctx = net.Net(admin_creds) >+ >+ keys = {} >+ >+ for attr in attributes: >+ if attr.attid == drsuapi.DRSUAPI_ATTID_supplementalCredentials: >+ net_ctx.replicate_decrypt(bind, attr, rid) >+ attr_val = attr.value_ctr.values[0].blob >+ >+ spl = ndr_unpack(drsblobs.supplementalCredentialsBlob, >+ attr_val) >+ for pkg in spl.sub.packages: >+ if pkg.name == 'Primary:Kerberos-Newer-Keys': >+ krb5_new_keys_raw = binascii.a2b_hex(pkg.data) >+ krb5_new_keys = ndr_unpack( >+ drsblobs.package_PrimaryKerberosBlob, >+ krb5_new_keys_raw) >+ for key in krb5_new_keys.ctr.keys: >+ keytype = key.keytype >+ if keytype in (kcrypto.Enctype.AES256, >+ kcrypto.Enctype.AES128): >+ keys[keytype] = key.value.hex() >+ elif attr.attid == drsuapi.DRSUAPI_ATTID_unicodePwd: >+ net_ctx.replicate_decrypt(bind, attr, rid) >+ pwd = attr.value_ctr.values[0].blob >+ keys[kcrypto.Enctype.RC4] = pwd.hex() >+ >+ default_enctypes = self.get_default_enctypes() >+ >+ if default_enctypes & security.KERB_ENCTYPE_RC4_HMAC_MD5: >+ self.assertIn(kcrypto.Enctype.RC4, keys) >+ if default_enctypes & security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96: >+ self.assertIn(kcrypto.Enctype.AES256, keys) >+ if default_enctypes & security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96: >+ self.assertIn(kcrypto.Enctype.AES128, keys) >+ >+ return keys >+ > def as_req(self, cname, sname, realm, etypes, padata=None): > '''Send a Kerberos AS_REQ, returns the undecoded response > ''' >-- >2.25.1 > > >From 3d3f6170e285fcfe8d94354958ebb2300fc34ee7 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 15:59:11 +1200 >Subject: [PATCH 106/380] tests/krb5/raw_testcase.py: Make env_get_var() a > standalone method > >This allows it to be used elsewhere in the tests. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 948bbc9cecbfc1b33a338891d26a4a706864b9c6) >--- > python/samba/tests/krb5/raw_testcase.py | 80 +++++++++++++------------ > 1 file changed, 41 insertions(+), 39 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 7e41245f706..7d9f0cd94f9 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -424,6 +424,23 @@ class RawKerberosTest(TestCaseInTempDir): > sys.stderr.write("connected[%s]\n" % self.host) > return > >+ def env_get_var(self, varname, prefix, >+ fallback_default=True, >+ allow_missing=False): >+ val = None >+ if prefix is not None: >+ allow_missing_prefix = allow_missing >+ if fallback_default: >+ allow_missing_prefix = True >+ val = samba.tests.env_get_var_value('%s_%s' % (prefix, varname), >+ allow_missing=allow_missing_prefix) >+ else: >+ fallback_default = True >+ if val is None and fallback_default: >+ val = samba.tests.env_get_var_value(varname, >+ allow_missing=allow_missing) >+ return val >+ > def _get_krb5_creds(self, prefix, > default_username=None, > allow_missing_password=False, >@@ -431,49 +448,34 @@ class RawKerberosTest(TestCaseInTempDir): > c = KerberosCredentials() > c.guess() > >- def env_get_var(varname, prefix, fallback_default=True, allow_missing=False): >- val = None >- if prefix is not None: >- allow_missing_prefix = allow_missing >- if fallback_default: >- allow_missing_prefix = True >- val = samba.tests.env_get_var_value('%s_%s' % (prefix, varname), >- allow_missing=allow_missing_prefix) >- else: >- fallback_default = True >- if val is None and fallback_default: >- val = samba.tests.env_get_var_value(varname, >- allow_missing=allow_missing) >- return val >- >- domain = env_get_var('DOMAIN', prefix) >- realm = env_get_var('REALM', prefix) >+ domain = self.env_get_var('DOMAIN', prefix) >+ realm = self.env_get_var('REALM', prefix) > allow_missing_username = False > if default_username is not None: > allow_missing_username = True >- username = env_get_var('USERNAME', prefix, >- fallback_default=False, >- allow_missing=allow_missing_username) >+ username = self.env_get_var('USERNAME', prefix, >+ fallback_default=False, >+ allow_missing=allow_missing_username) > if username is None: > username = default_username >- password = env_get_var('PASSWORD', prefix, >- fallback_default=False, >- allow_missing=allow_missing_password) >+ password = self.env_get_var('PASSWORD', prefix, >+ fallback_default=False, >+ allow_missing=allow_missing_password) > c.set_domain(domain) > c.set_realm(realm) > c.set_username(username) > if password is not None: > c.set_password(password) >- as_supported_enctypes = env_get_var('AS_SUPPORTED_ENCTYPES', >- prefix, allow_missing=True) >+ as_supported_enctypes = self.env_get_var('AS_SUPPORTED_ENCTYPES', >+ prefix, allow_missing=True) > if as_supported_enctypes is not None: > c.set_as_supported_enctypes(as_supported_enctypes) >- tgs_supported_enctypes = env_get_var('TGS_SUPPORTED_ENCTYPES', >- prefix, allow_missing=True) >+ tgs_supported_enctypes = self.env_get_var('TGS_SUPPORTED_ENCTYPES', >+ prefix, allow_missing=True) > if tgs_supported_enctypes is not None: > c.set_tgs_supported_enctypes(tgs_supported_enctypes) >- ap_supported_enctypes = env_get_var('AP_SUPPORTED_ENCTYPES', >- prefix, allow_missing=True) >+ ap_supported_enctypes = self.env_get_var('AP_SUPPORTED_ENCTYPES', >+ prefix, allow_missing=True) > if ap_supported_enctypes is not None: > c.set_ap_supported_enctypes(ap_supported_enctypes) > >@@ -486,22 +488,22 @@ class RawKerberosTest(TestCaseInTempDir): > else: > kvno_allow_missing = True > aes256_allow_missing = True >- kvno = env_get_var('KVNO', prefix, >- fallback_default=False, >- allow_missing=kvno_allow_missing) >+ kvno = self.env_get_var('KVNO', prefix, >+ fallback_default=False, >+ allow_missing=kvno_allow_missing) > if kvno is not None: > c.set_kvno(kvno) >- aes256_key = env_get_var('AES256_KEY_HEX', prefix, >- fallback_default=False, >- allow_missing=aes256_allow_missing) >+ aes256_key = self.env_get_var('AES256_KEY_HEX', prefix, >+ fallback_default=False, >+ allow_missing=aes256_allow_missing) > if aes256_key is not None: > c.set_forced_key(kcrypto.Enctype.AES256, aes256_key) >- aes128_key = env_get_var('AES128_KEY_HEX', prefix, >- fallback_default=False, allow_missing=True) >+ aes128_key = self.env_get_var('AES128_KEY_HEX', prefix, >+ fallback_default=False, allow_missing=True) > if aes128_key is not None: > c.set_forced_key(kcrypto.Enctype.AES128, aes128_key) >- rc4_key = env_get_var('RC4_KEY_HEX', prefix, >- fallback_default=False, allow_missing=True) >+ rc4_key = self.env_get_var('RC4_KEY_HEX', prefix, >+ fallback_default=False, allow_missing=True) > if rc4_key is not None: > c.set_forced_key(kcrypto.Enctype.RC4, rc4_key) > return c >-- >2.25.1 > > >From d3b08e517d576397766ad41c2b67cd05bd1d8f26 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 16:55:02 +1200 >Subject: [PATCH 107/380] tests/krb5/raw_testcase.py: Add allow_missing_keys > parameter for getting creds > >This allows us to require encryption keys in the case that a password >would not be required, such as for the krbtgt account. > >Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 6a77c2b93315503008627ce786388f281bd6bb87) >--- > python/samba/tests/krb5/as_req_tests.py | 2 +- > python/samba/tests/krb5/raw_testcase.py | 53 +++++++++++++++++++------ > python/samba/tests/krb5/simple_tests.py | 2 +- > 3 files changed, 42 insertions(+), 15 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 3ad37c6bdf2..3099c224c18 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -58,7 +58,7 @@ class AsReqKerberosTests(RawKerberosTest): > client_creds = self.get_client_creds() > client_account = client_creds.get_username() > client_as_etypes = client_creds.get_as_krb5_etypes() >- krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_creds = self.get_krbtgt_creds(require_keys=False) > krbtgt_account = krbtgt_creds.get_username() > realm = krbtgt_creds.get_realm() > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 7d9f0cd94f9..9c0f5800b42 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -444,6 +444,7 @@ class RawKerberosTest(TestCaseInTempDir): > def _get_krb5_creds(self, prefix, > default_username=None, > allow_missing_password=False, >+ allow_missing_keys=True, > require_strongest_key=False): > c = KerberosCredentials() > c.guess() >@@ -486,8 +487,8 @@ class RawKerberosTest(TestCaseInTempDir): > else: > aes256_allow_missing = True > else: >- kvno_allow_missing = True >- aes256_allow_missing = True >+ kvno_allow_missing = allow_missing_keys >+ aes256_allow_missing = allow_missing_keys > kvno = self.env_get_var('KVNO', prefix, > fallback_default=False, > allow_missing=kvno_allow_missing) >@@ -506,37 +507,63 @@ class RawKerberosTest(TestCaseInTempDir): > fallback_default=False, allow_missing=True) > if rc4_key is not None: > c.set_forced_key(kcrypto.Enctype.RC4, rc4_key) >+ >+ if not allow_missing_keys: >+ self.assertTrue(c.forced_keys, >+ 'Please supply %s encryption keys ' >+ 'in environment' % prefix) >+ > return c > >- def get_user_creds(self, allow_missing_password=False): >+ def get_user_creds(self, >+ allow_missing_password=False, >+ allow_missing_keys=True): > c = self._get_krb5_creds(prefix=None, >- allow_missing_password=allow_missing_password) >+ allow_missing_password=allow_missing_password, >+ allow_missing_keys=allow_missing_keys) > return c > >- def get_service_creds(self, allow_missing_password=False): >+ def get_service_creds(self, >+ allow_missing_password=False, >+ allow_missing_keys=True): > c = self._get_krb5_creds(prefix='SERVICE', >- allow_missing_password=allow_missing_password) >+ allow_missing_password=allow_missing_password, >+ allow_missing_keys=allow_missing_keys) > return c > >- def get_client_creds(self, allow_missing_password=False): >+ def get_client_creds(self, >+ allow_missing_password=False, >+ allow_missing_keys=True): > c = self._get_krb5_creds(prefix='CLIENT', >- allow_missing_password=allow_missing_password) >+ allow_missing_password=allow_missing_password, >+ allow_missing_keys=allow_missing_keys) > return c > >- def get_server_creds(self, allow_missing_password=False): >+ def get_server_creds(self, >+ allow_missing_password=False, >+ allow_missing_keys=True): > c = self._get_krb5_creds(prefix='SERVER', >- allow_missing_password=allow_missing_password) >+ allow_missing_password=allow_missing_password, >+ allow_missing_keys=allow_missing_keys) > return c > >- def get_admin_creds(self, allow_missing_password=False): >+ def get_admin_creds(self, >+ allow_missing_password=False, >+ allow_missing_keys=True): > c = self._get_krb5_creds(prefix='ADMIN', >- allow_missing_password=allow_missing_password) >+ allow_missing_password=allow_missing_password, >+ allow_missing_keys=allow_missing_keys) > return c > >- def get_krbtgt_creds(self, require_strongest_key=False): >+ def get_krbtgt_creds(self, >+ require_keys=True, >+ require_strongest_key=False): >+ if require_strongest_key: >+ self.assertTrue(require_keys) > c = self._get_krb5_creds(prefix='KRBTGT', > default_username='krbtgt', > allow_missing_password=True, >+ allow_missing_keys=not require_keys, > require_strongest_key=require_strongest_key) > return c > >diff --git a/python/samba/tests/krb5/simple_tests.py b/python/samba/tests/krb5/simple_tests.py >index 2da76a3cf5e..9650702c6c6 100755 >--- a/python/samba/tests/krb5/simple_tests.py >+++ b/python/samba/tests/krb5/simple_tests.py >@@ -44,7 +44,7 @@ class SimpleKerberosTests(RawKerberosTest): > def test_simple(self): > user_creds = self.get_user_creds() > user = user_creds.get_username() >- krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_creds = self.get_krbtgt_creds(require_keys=False) > krbtgt_account = krbtgt_creds.get_username() > realm = krbtgt_creds.get_realm() > >-- >2.25.1 > > >From d5ab76d1488ff8b605173a6a17994b09cf895707 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 17:10:44 +1200 >Subject: [PATCH 108/380] tests/krb5/raw_testcase.py: Cache obtained > credentials > >If credentials are used more than once, we can now use the credentials >that we already obtained and so avoid fetching them again. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 22a90aea82ba6ef86bde835f2369daa6e23ed2fd) >--- > python/samba/tests/krb5/kdc_base_test.py | 1 + > python/samba/tests/krb5/raw_testcase.py | 38 ++++++++++++++++++++---- > 2 files changed, 34 insertions(+), 5 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 7ae22bc5929..120084616e9 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -75,6 +75,7 @@ class KDCBaseTest(RawKerberosTest): > > @classmethod > def setUpClass(cls): >+ super().setUpClass() > cls._lp = None > cls.host = os.environ["SERVER"] > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 9c0f5800b42..5b59eede806 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -371,6 +371,14 @@ class RawKerberosTest(TestCaseInTempDir): > e = self.etype_test_permutations[idx] > return (e['name'], e['etypes']) > >+ @classmethod >+ def setUpClass(cls): >+ super().setUpClass() >+ >+ # A dictionary containing credentials that have already been >+ # obtained. >+ cls.creds_dict = {} >+ > def setUp(self): > super().setUp() > self.do_asn1_print = False >@@ -441,11 +449,11 @@ class RawKerberosTest(TestCaseInTempDir): > allow_missing=allow_missing) > return val > >- def _get_krb5_creds(self, prefix, >- default_username=None, >- allow_missing_password=False, >- allow_missing_keys=True, >- require_strongest_key=False): >+ def _get_krb5_creds_from_env(self, prefix, >+ default_username=None, >+ allow_missing_password=False, >+ allow_missing_keys=True, >+ require_strongest_key=False): > c = KerberosCredentials() > c.guess() > >@@ -515,6 +523,26 @@ class RawKerberosTest(TestCaseInTempDir): > > return c > >+ def _get_krb5_creds(self, >+ prefix, >+ default_username=None, >+ allow_missing_password=False, >+ allow_missing_keys=True, >+ require_strongest_key=False): >+ if prefix not in self.creds_dict: >+ # We don't have the credentials already >+ creds = self._get_krb5_creds_from_env(prefix, >+ default_username=default_username, >+ allow_missing_password=allow_missing_password, >+ allow_missing_keys=allow_missing_keys, >+ require_strongest_key=require_strongest_key) >+ self.assertIsNotNone(creds) >+ >+ # Save the obtained credentials >+ self.creds_dict[prefix] = creds >+ >+ return self.creds_dict[prefix] >+ > def get_user_creds(self, > allow_missing_password=False, > allow_missing_keys=True): >-- >2.25.1 > > >From 608a62715cddb0f29b024f8827b3b2360ebea6a6 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 17:12:39 +1200 >Subject: [PATCH 109/380] tests/krb5/raw_testcase.py: Allow specifying a > fallback credentials function > >This allows us to use other methods of obtaining credentials if getting >them from the environment fails. > >Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit e1601f2b56f09a944c5cfb119502fdcf49a03c99) >--- > python/samba/tests/krb5/raw_testcase.py | 39 +++++++++++++++++++++---- > 1 file changed, 33 insertions(+), 6 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 5b59eede806..ade980cb46d 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -528,20 +528,47 @@ class RawKerberosTest(TestCaseInTempDir): > default_username=None, > allow_missing_password=False, > allow_missing_keys=True, >- require_strongest_key=False): >- if prefix not in self.creds_dict: >- # We don't have the credentials already >+ require_strongest_key=False, >+ fallback_creds_fn=None): >+ if prefix in self.creds_dict: >+ return self.creds_dict[prefix] >+ >+ # We don't have the credentials already >+ creds = None >+ env_err = None >+ try: >+ # Try to obtain them from the environment > creds = self._get_krb5_creds_from_env(prefix, > default_username=default_username, > allow_missing_password=allow_missing_password, > allow_missing_keys=allow_missing_keys, > require_strongest_key=require_strongest_key) >+ except Exception as err: >+ # An error occurred, so save it for later >+ env_err = err >+ else: > self.assertIsNotNone(creds) >- > # Save the obtained credentials > self.creds_dict[prefix] = creds >- >- return self.creds_dict[prefix] >+ return creds >+ >+ if fallback_creds_fn is not None: >+ try: >+ # Try to use the fallback method >+ creds = fallback_creds_fn() >+ except Exception as err: >+ print("ERROR FROM ENV: %r" % (env_err)) >+ print("FALLBACK-FN: %s" % (fallback_creds_fn)) >+ print("FALLBACK-ERROR: %r" % (err)) >+ else: >+ self.assertIsNotNone(creds) >+ # Save the obtained credentials >+ self.creds_dict[prefix] = creds >+ return creds >+ >+ # Both methods failed, so raise the exception from the >+ # environment method >+ raise env_err > > def get_user_creds(self, > allow_missing_password=False, >-- >2.25.1 > > >From 86e3641758678dc16363fd3d11117b88c6f3e651 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 15:55:17 +1200 >Subject: [PATCH 110/380] tests/krb5/raw_testcase.py: Simplify conditionals > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit ec5c2b040b63d06a17bcd7bd133c2d68d07df587) >--- > python/samba/tests/krb5/raw_testcase.py | 8 ++------ > 1 file changed, 2 insertions(+), 6 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index ade980cb46d..0e08f0ef7d2 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -437,9 +437,7 @@ class RawKerberosTest(TestCaseInTempDir): > allow_missing=False): > val = None > if prefix is not None: >- allow_missing_prefix = allow_missing >- if fallback_default: >- allow_missing_prefix = True >+ allow_missing_prefix = allow_missing or fallback_default > val = samba.tests.env_get_var_value('%s_%s' % (prefix, varname), > allow_missing=allow_missing_prefix) > else: >@@ -459,9 +457,7 @@ class RawKerberosTest(TestCaseInTempDir): > > domain = self.env_get_var('DOMAIN', prefix) > realm = self.env_get_var('REALM', prefix) >- allow_missing_username = False >- if default_username is not None: >- allow_missing_username = True >+ allow_missing_username = default_username is not None > username = self.env_get_var('USERNAME', prefix, > fallback_default=False, > allow_missing=allow_missing_username) >-- >2.25.1 > > >From 1d05a6da0d8bcdbe82f07233ab466a2b5cde8194 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 16:07:16 +1200 >Subject: [PATCH 111/380] tests/krb5/kdc_base_test.py: Add fallback methods to > obtain client and krbtgt credentials > >Now if the client credentials are not supplied in the environment, we >can fall back to creating a new user account. Similarly, if the krbtgt >credentials are not supplied, we can fetch the credentials of the >existing krbtgt account. > >Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit fd45bea7a88837cbe4f99adf3a6b3f69ce32f34c) >--- > python/samba/tests/krb5/kdc_base_test.py | 86 +++++++++++++++++++++++- > 1 file changed, 84 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 120084616e9..1f042aa78aa 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -44,7 +44,8 @@ from samba import net > from samba.samdb import SamDB > > from samba.tests import delete_force >-from samba.tests.krb5.raw_testcase import RawKerberosTest >+import samba.tests.krb5.kcrypto as kcrypto >+from samba.tests.krb5.raw_testcase import KerberosCredentials, RawKerberosTest > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( > AD_IF_RELEVANT, >@@ -182,7 +183,7 @@ class KDCBaseTest(RawKerberosTest): > details["userPrincipalName"] = upn > ldb.add(details) > >- creds = Credentials() >+ creds = KerberosCredentials() > creds.guess(self.get_lp()) > creds.set_realm(ldb.domain_dns_name().upper()) > creds.set_domain(ldb.domain_netbios_name().upper()) >@@ -290,6 +291,87 @@ class KDCBaseTest(RawKerberosTest): > > return keys > >+ def creds_set_keys(self, creds, keys): >+ if keys is not None: >+ for enctype, key in keys.items(): >+ creds.set_forced_key(enctype, key) >+ >+ supported_enctypes = 0 >+ if kcrypto.Enctype.AES256 in keys: >+ supported_enctypes |= security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96 >+ if kcrypto.Enctype.AES128 in keys: >+ supported_enctypes |= security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96 >+ if kcrypto.Enctype.RC4 in keys: >+ supported_enctypes |= security.KERB_ENCTYPE_RC4_HMAC_MD5 >+ >+ creds.set_as_supported_enctypes(supported_enctypes) >+ creds.set_tgs_supported_enctypes(supported_enctypes) >+ creds.set_ap_supported_enctypes(supported_enctypes) >+ >+ def get_client_creds(self, >+ allow_missing_password=False, >+ allow_missing_keys=True): >+ def create_client_account(): >+ samdb = self.get_samdb() >+ >+ creds, dn = self.create_account(samdb, 'kdctestclient') >+ >+ res = samdb.search(base=dn, >+ scope=ldb.SCOPE_BASE, >+ attrs=['msDS-KeyVersionNumber']) >+ kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >+ creds.set_kvno(kvno) >+ >+ keys = self.get_keys(samdb, dn) >+ self.creds_set_keys(creds, keys) >+ >+ return creds >+ >+ c = self._get_krb5_creds(prefix='CLIENT', >+ allow_missing_password=allow_missing_password, >+ allow_missing_keys=allow_missing_keys, >+ fallback_creds_fn=create_client_account) >+ return c >+ >+ def get_krbtgt_creds(self, >+ require_keys=True, >+ require_strongest_key=False): >+ if require_strongest_key: >+ self.assertTrue(require_keys) >+ def download_krbtgt_creds(): >+ samdb = self.get_samdb() >+ >+ krbtgt_rid = 502 >+ krbtgt_sid = '%s-%d' % (samdb.get_domain_sid(), krbtgt_rid) >+ >+ res = samdb.search(base='<SID=%s>' % krbtgt_sid, >+ scope=ldb.SCOPE_BASE, >+ attrs=['sAMAccountName', >+ 'msDS-KeyVersionNumber']) >+ dn = res[0].dn >+ username = str(res[0]['sAMAccountName']) >+ >+ creds = KerberosCredentials() >+ creds.set_domain(self.env_get_var('DOMAIN', 'KRBTGT')) >+ creds.set_realm(self.env_get_var('REALM', 'KRBTGT')) >+ creds.set_username(username) >+ >+ kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >+ creds.set_kvno(kvno) >+ >+ keys = self.get_keys(samdb, dn) >+ self.creds_set_keys(creds, keys) >+ >+ return creds >+ >+ c = self._get_krb5_creds(prefix='KRBTGT', >+ default_username='krbtgt', >+ allow_missing_password=True, >+ allow_missing_keys=not require_keys, >+ require_strongest_key=require_strongest_key, >+ fallback_creds_fn=download_krbtgt_creds) >+ return c >+ > def as_req(self, cname, sname, realm, etypes, padata=None): > '''Send a Kerberos AS_REQ, returns the undecoded response > ''' >-- >2.25.1 > > >From f879426d6f839d9ddede8e77718f9e5d232dc77c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 16 Jun 2021 14:51:22 +1200 >Subject: [PATCH 112/380] tests/krb5/as_req_tests.py: Automatically obtain > credentials > >The credentials for the client and krbtgt accounts are now fetched >automatically rather than using environment variables, and the client >account is now automatically created. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 0fd71ed3c37c8cf326f9f676b7fddda3d2d24072) >--- > python/samba/tests/krb5/as_req_tests.py | 4 +- > .../knownfail.d/samba.tests.krb5.as_req_tests | 180 ------------------ > selftest/knownfail_mit_kdc | 42 ---- > selftest/target/Samba.pm | 1 - > selftest/target/Samba4.pm | 4 - > source4/selftest/tests.py | 7 +- > 6 files changed, 4 insertions(+), 234 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 3099c224c18..e8c2a29221d 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -23,7 +23,7 @@ sys.path.insert(0, "bin/python") > os.environ["PYTHONUNBUFFERED"] = "1" > > from samba.tests import DynamicTestCase >-from samba.tests.krb5.raw_testcase import RawKerberosTest >+from samba.tests.krb5.kdc_base_test import KDCBaseTest > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( > KDC_ERR_PREAUTH_REQUIRED, >@@ -35,7 +35,7 @@ global_asn1_print = False > global_hexdump = False > > @DynamicTestCase >-class AsReqKerberosTests(RawKerberosTest): >+class AsReqKerberosTests(KDCBaseTest): > > @classmethod > def setUpDynamicTestCases(cls): >diff --git a/selftest/knownfail.d/samba.tests.krb5.as_req_tests b/selftest/knownfail.d/samba.tests.krb5.as_req_tests >index 390d6cd0ab6..f395bdc553b 100644 >--- a/selftest/knownfail.d/samba.tests.krb5.as_req_tests >+++ b/selftest/knownfail.d/samba.tests.krb5.as_req_tests >@@ -94,183 +94,3 @@ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2003dc >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index b610929a8dd..776148314d1 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -294,11 +294,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > # MIT currently fails some as_req_no_preauth tests. > # > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_False > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_False.fl2003dc >@@ -306,11 +303,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_False.fl2008r2dc >@@ -324,11 +318,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_False.fl2008r2dc >@@ -336,11 +327,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_False.fl2008r2dc >@@ -354,11 +342,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_False.fl2003dc >@@ -391,11 +376,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_False.fl2008r2dc >@@ -403,11 +385,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_False.fl2003dc >@@ -422,11 +401,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_False.fl2008r2dc >@@ -434,11 +410,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_False.fl2008r2dc >@@ -452,11 +425,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_False.fl2008r2dc >@@ -488,11 +458,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_False.fl2008r2dc >@@ -500,11 +467,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_False.fl2008r2dc >@@ -518,11 +482,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_False.fl2008r2dc >@@ -530,11 +491,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_None.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_False.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_False.fl2008r2dc >diff --git a/selftest/target/Samba.pm b/selftest/target/Samba.pm >index 4b4da053d83..9319f301327 100644 >--- a/selftest/target/Samba.pm >+++ b/selftest/target/Samba.pm >@@ -714,7 +714,6 @@ my @exported_envvars = ( > "DNSNAME", > "REALM", > "DOMSID", >- "SUPPORTED_ENCTYPE_BITS", > > # stuff related to a trusted domain > "TRUST_SERVER", >diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm >index 193b2456cb4..aaadd946e03 100755 >--- a/selftest/target/Samba4.pm >+++ b/selftest/target/Samba4.pm >@@ -511,9 +511,6 @@ sub provision_raw_prepare($$$$$$$$$$$$) > $ctx->{krb5_ccname} = "$prefix_abs/krb5cc_%{uid}"; > if ($functional_level eq "2000") { > $ctx->{supported_enctypes} = "arcfour-hmac-md5 des-cbc-md5 des-cbc-crc"; >- $ctx->{supported_enctypes_bits} = "4"; >- } else { >- $ctx->{supported_enctypes_bits} = "28"; > } > > # >@@ -815,7 +812,6 @@ nogroup:x:65534:nobody > KRB5_CONFIG => $ctx->{krb5_conf}, > KRB5_CCACHE => $ctx->{krb5_ccache}, > MITKDC_CONFIG => $ctx->{mitkdc_conf}, >- SUPPORTED_ENCTYPE_BITS => $ctx->{supported_enctypes_bits}, > PIDDIR => $ctx->{piddir}, > SERVER => $ctx->{hostname}, > DC_SERVER => $ctx->{hostname}, >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index a3113e6b77e..71e4bf73a4e 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -1276,11 +1276,8 @@ plansmbtorture4testsuite('krb5.kdc', env, ['ncacn_np:$SERVER_IP', "-k", "yes", ' > for env in ["fl2008r2dc", "fl2003dc"]: > planoldpythontestsuite(env, "samba.tests.krb5.as_req_tests", > environ={ >- 'CLIENT_USERNAME': '$USERNAME', >- 'CLIENT_PASSWORD': '$PASSWORD', >- 'CLIENT_AS_SUPPORTED_ENCTYPES': '$SUPPORTED_ENCTYPE_BITS', >- 'SERVER_USERNAME': '$SERVER', >- 'SERVER_PASSWORD': 'machine$PASSWORD', >+ 'ADMIN_USERNAME': '$USERNAME', >+ 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', > }) > >-- >2.25.1 > > >From b2c15428165a469faf59a3c9c71627541a80da44 Mon Sep 17 00:00:00 2001 >From: Stefan Metzmacher <metze@samba.org> >Date: Tue, 21 Apr 2020 11:07:45 +0200 >Subject: [PATCH 113/380] tests/krb5/as_req_tests.py: add simple > test_as_req_enc_timestamp test > >Example commands: > >Windows 2012R2: >SERVER=172.31.9.188 SMB_CONF_PATH=/dev/null STRICT_CHECKING=1 DOMAIN=W2012R2-L6 REALM=W2012R2-L6.BASE CLIENT_USERNAME=ldaptestuser CLIENT_PASSWORD=a1B2c3D4 CLIENT_AS_SUPPORTED_ENCTYPES=28 KRBTGT_KVNO=2 KRBTGT_AES256_KEY_HEX=2eb6d146a2653d333cdbfb641a4efbc3de81af49e878e112bb4f6cbdd73fca52 KRBTGT_RC4_KEY_HEX=4e6d99c30e5fab901ea71f8894289d3b python/samba/tests/krb5/as_req_tests.py AsReqKerberosTests >SERVER=172.31.9.188 SMB_CONF_PATH=/dev/null STRICT_CHECKING=1 DOMAIN=W2012R2-L6 REALM=W2012R2-L6.BASE CLIENT_USERNAME=administrator CLIENT_PASSWORD=A1b2C3d4 CLIENT_AS_SUPPORTED_ENCTYPES=4 KRBTGT_KVNO=2 KRBTGT_AES256_KEY_HEX=2eb6d146a2653d333cdbfb641a4efbc3de81af49e878e112bb4f6cbdd73fca52 KRBTGT_RC4_KEY_HEX=4e6d99c30e5fab901ea71f8894289d3b python/samba/tests/krb5/as_req_tests.py AsReqKerberosTests >SERVER=172.31.9.188 SMB_CONF_PATH=/dev/null STRICT_CHECKING=1 DOMAIN=W2012R2-L6 REALM=W2012R2-L6.BASE ADMIN_USERNAME=administrator ADMIN_PASSWORD=A1b2C3d4 python/samba/tests/krb5/as_req_tests.py >SERVER=172.31.9.188 SMB_CONF_PATH=/dev/null STRICT_CHECKING=1 DOMAIN=W2012R2-L6 REALM=W2012R2-L6.BASE ADMIN_USERNAME=administrator ADMIN_PASSWORD=A1b2C3d4 CLIENT_USERNAME=administrator CLIENT_PASSWORD=A1b2C3d4 CLIENT_AS_SUPPORTED_ENCTYPES=4 CLIENT_KVNO=1 python/samba/tests/krb5/as_req_tests.py >SERVER=172.31.9.188 SMB_CONF_PATH=/dev/null STRICT_CHECKING=1 DOMAIN=W2012R2-L6 REALM=W2012R2-L6.BASE ADMIN_USERNAME=administrator ADMIN_PASSWORD=A1b2C3d4 CLIENT_USERNAME=ldaptestuser CLIENT_PASSWORD=a1B2c3D4 CLIENT_AS_SUPPORTED_ENCTYPES=28 CLIENT_KVNO=4 python/samba/tests/krb5/as_req_tests.py > >Windows 2008R2: >SERVER=172.31.9.133 SMB_CONF_PATH=/dev/null STRICT_CHECKING=1 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE CLIENT_USERNAME=cifsmount CLIENT_PASSWORD=A1b2C3d4-08 CLIENT_AS_SUPPORTED_ENCTYPES=28 CLIENT_KVNO=17 KRBTGT_KVNO=2 KRBTGT_AES256_KEY_HEX=550aea2ea2719cb81c87692569796d1b3a099d433a93438f53bee798cc2f83be KRBTGT_RC4_KEY_HEX=dbc0d1feaaca3d5abc6794857b7f6fe0 python/samba/tests/krb5/as_req_tests.py >SERVER=172.31.9.133 SMB_CONF_PATH=/dev/null STRICT_CHECKING=1 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE CLIENT_USERNAME=administrator CLIENT_PASSWORD=A1b2C3d4 CLIENT_AS_SUPPORTED_ENCTYPES=4 CLIENT_KVNO=1 KRBTGT_KVNO=2 KRBTGT_AES256_KEY_HEX=550aea2ea2719cb81c87692569796d1b3a099d433a93438f53bee798cc2f83be KRBTGT_RC4_KEY_HEX=dbc0d1feaaca3d5abc6794857b7f6fe0 python/samba/tests/krb5/as_req_tests.py >SERVER=172.31.9.133 SMB_CONF_PATH=/dev/null STRICT_CHECKING=1 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE ADMIN_USERNAME=administrator ADMIN_PASSWORD=A1b2C3d4 CLIENT_USERNAME=administrator CLIENT_PASSWORD=A1b2C3d4 CLIENT_AS_SUPPORTED_ENCTYPES=4 CLIENT_KVNO=1 python/samba/tests/krb5/as_req_tests.py >SERVER=172.31.9.133 SMB_CONF_PATH=/dev/null STRICT_CHECKING=1 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE ADMIN_USERNAME=administrator ADMIN_PASSWORD=A1b2C3d4 CLIENT_USERNAME=cifsmount CLIENT_PASSWORD=A1b2C3d4-08 CLIENT_AS_SUPPORTED_ENCTYPES=28 CLIENT_KVNO=17 python/samba/tests/krb5/as_req_tests.py >SERVER=172.31.9.133 SMB_CONF_PATH=/dev/null STRICT_CHECKING=1 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE ADMIN_USERNAME=administrator ADMIN_PASSWORD=A1b2C3d4 python/samba/tests/krb5/as_req_tests.py > >Samba: >SERVER=172.31.9.163 SMB_CONF_PATH=/dev/null STRICT_CHECKING=0 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE CLIENT_USERNAME=cifsmount CLIENT_PASSWORD=A1b2C3d4-08 CLIENT_AS_SUPPORTED_ENCTYPES=28 CLIENT_KVNO=17 KRBTGT_KVNO=2 KRBTGT_AES256_KEY_HEX=550aea2ea2719cb81c87692569796d1b3a099d433a93438f53bee798cc2f83be KRBTGT_RC4_KEY_HEX=dbc0d1feaaca3d5abc6794857b7f6fe0 python/samba/tests/krb5/as_req_tests.py >SERVER=172.31.9.163 SMB_CONF_PATH=/dev/null STRICT_CHECKING=0 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE CLIENT_USERNAME=administrator CLIENT_PASSWORD=A1b2C3d4 CLIENT_AS_SUPPORTED_ENCTYPES=4 CLIENT_KVNO=1 KRBTGT_KVNO=2 KRBTGT_AES256_KEY_HEX=550aea2ea2719cb81c87692569796d1b3a099d433a93438f53bee798cc2f83be KRBTGT_RC4_KEY_HEX=dbc0d1feaaca3d5abc6794857b7f6fe0 python/samba/tests/krb5/as_req_tests.py >SERVER=172.31.9.163 SMB_CONF_PATH=/dev/null STRICT_CHECKING=0 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE ADMIN_USERNAME=administrator ADMIN_PASSWORD=A1b2C3d4 CLIENT_USERNAME=administrator CLIENT_PASSWORD=A1b2C3d4 CLIENT_AS_SUPPORTED_ENCTYPES=4 CLIENT_KVNO=1 python/samba/tests/krb5/as_req_tests.py >SERVER=172.31.9.163 SMB_CONF_PATH=/dev/null STRICT_CHECKING=0 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE ADMIN_USERNAME=administrator ADMIN_PASSWORD=A1b2C3d4 CLIENT_USERNAME=cifsmount CLIENT_PASSWORD=A1b2C3d4-08 CLIENT_AS_SUPPORTED_ENCTYPES=28 CLIENT_KVNO=17 python/samba/tests/krb5/as_req_tests.py >SERVER=172.31.9.163 SMB_CONF_PATH=/dev/null STRICT_CHECKING=0 DOMAIN=W4EDOM-L4 REALM=W4EDOM-L4.BASE ADMIN_USERNAME=administrator ADMIN_PASSWORD=A1b2C3d4 python/samba/tests/krb5/as_req_tests.py > >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d5e350a4a490fecf570f1c248c9dde1466796166) >--- > python/samba/tests/krb5/as_req_tests.py | 85 ++++++++++++++++++++++++- > selftest/knownfail_mit_kdc | 5 ++ > 2 files changed, 89 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index e8c2a29221d..be33748dfb6 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -27,8 +27,10 @@ from samba.tests.krb5.kdc_base_test import KDCBaseTest > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( > KDC_ERR_PREAUTH_REQUIRED, >+ KU_PA_ENC_TIMESTAMP, > NT_PRINCIPAL, >- NT_SRV_INST >+ NT_SRV_INST, >+ PADATA_ENC_TIMESTAMP > ) > > global_asn1_print = False >@@ -112,6 +114,87 @@ class AsReqKerberosTests(KDCBaseTest): > initial_etypes=etypes, > initial_kdc_options=krb5_asn1.KDCOptions('forwardable')) > >+ def test_as_req_enc_timestamp(self): >+ client_creds = self.get_client_creds() >+ client_account = client_creds.get_username() >+ client_as_etypes = client_creds.get_as_krb5_etypes() >+ krbtgt_creds = self.get_krbtgt_creds(require_strongest_key=True) >+ krbtgt_account = krbtgt_creds.get_username() >+ realm = krbtgt_creds.get_realm() >+ >+ cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[client_account]) >+ sname = self.PrincipalName_create(name_type=NT_SRV_INST, >+ names=[krbtgt_account, realm]) >+ >+ expected_crealm = realm >+ expected_cname = cname >+ expected_srealm = realm >+ expected_sname = sname >+ expected_salt = client_creds.get_forced_salt() >+ >+ till = self.get_KerberosTime(offset=36000) >+ >+ pa_pac = self.KERB_PA_PAC_REQUEST_create(True) >+ initial_padata = [pa_pac] >+ initial_etypes = client_as_etypes >+ initial_kdc_options = krb5_asn1.KDCOptions('forwardable') >+ initial_error_mode = KDC_ERR_PREAUTH_REQUIRED >+ >+ etype_info2 = self._test_as_exchange(cname, >+ realm, >+ sname, >+ till, >+ client_as_etypes, >+ initial_error_mode, >+ expected_crealm, >+ expected_cname, >+ expected_srealm, >+ expected_sname, >+ expected_salt, >+ initial_etypes, >+ initial_padata, >+ initial_kdc_options) >+ self.assertIsNotNone(etype_info2) >+ >+ preauth_key = self.PasswordKey_from_etype_info2(client_creds, etype_info2[0], kvno=0) >+ >+ (patime, pausec) = self.get_KerberosTimeWithUsec() >+ pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) >+ >+ enc_pa_ts_usage = KU_PA_ENC_TIMESTAMP >+ pa_ts = self.EncryptedData_create(preauth_key, enc_pa_ts_usage, pa_ts) >+ pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData()) >+ >+ pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts) >+ >+ preauth_padata = [pa_ts, pa_pac] >+ preauth_etypes = client_as_etypes >+ preauth_kdc_options = krb5_asn1.KDCOptions('forwardable') >+ preauth_error_mode = 0 # AS-REP >+ >+ krbtgt_decryption_key = ( >+ self.TicketDecryptionKey_from_creds(krbtgt_creds)) >+ >+ as_rep = self._test_as_exchange(cname, >+ realm, >+ sname, >+ till, >+ client_as_etypes, >+ preauth_error_mode, >+ expected_crealm, >+ expected_cname, >+ expected_srealm, >+ expected_sname, >+ expected_salt, >+ preauth_etypes, >+ preauth_padata, >+ preauth_kdc_options, >+ preauth_key=preauth_key, >+ ticket_decryption_key=krbtgt_decryption_key) >+ self.assertIsNotNone(as_rep) >+ return > > if __name__ == "__main__": > global_asn1_print = True >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 776148314d1..db40b0614fa 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -291,6 +291,11 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_c > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_6_c > # >+# MIT currently fails the test_as_req_enc_timestamp test. >+# >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_enc_timestamp.fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_enc_timestamp.fl2008r2dc >+# > # MIT currently fails some as_req_no_preauth tests. > # > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256.fl2008r2dc >-- >2.25.1 > > >From 1de246fbb5d07cf004df5c340df154d037ac5855 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 13:24:22 +1200 >Subject: [PATCH 114/380] tests/krb5/as_req_tests.py: Check the client kvno > >Ensure we have the correct kvno for the client, rather than an 'unknown' >value. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d4c38678e0cc782965edfe40a0423fafb7d5a5ff) >--- > python/samba/tests/krb5/as_req_tests.py | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index be33748dfb6..10e7b603609 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -118,6 +118,7 @@ class AsReqKerberosTests(KDCBaseTest): > client_creds = self.get_client_creds() > client_account = client_creds.get_username() > client_as_etypes = client_creds.get_as_krb5_etypes() >+ client_kvno = client_creds.get_kvno() > krbtgt_creds = self.get_krbtgt_creds(require_strongest_key=True) > krbtgt_account = krbtgt_creds.get_username() > realm = krbtgt_creds.get_realm() >@@ -157,7 +158,9 @@ class AsReqKerberosTests(KDCBaseTest): > initial_kdc_options) > self.assertIsNotNone(etype_info2) > >- preauth_key = self.PasswordKey_from_etype_info2(client_creds, etype_info2[0], kvno=0) >+ preauth_key = self.PasswordKey_from_etype_info2(client_creds, >+ etype_info2[0], >+ kvno=client_kvno) > > (patime, pausec) = self.get_KerberosTimeWithUsec() > pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec) >-- >2.25.1 > > >From c054c736b080464ec57f982bc39d5010d9f1c627 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 15 Jun 2021 13:25:34 +1200 >Subject: [PATCH 115/380] tests/krb5/raw_testcase.py: Check for an explicit > 'unspecified kvno' value > >This is clearer than using the constant zero, which could be mistaken >for a valid kvno value. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 381223117e0bae4c348d538bffaa8227b18ef3d1) >--- > python/samba/tests/krb5/raw_testcase.py | 15 +++++++++------ > 1 file changed, 9 insertions(+), 6 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 0e08f0ef7d2..b7044546cbd 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -393,6 +393,8 @@ class RawKerberosTest(TestCaseInTempDir): > > self.s = None > >+ self.unspecified_kvno = object() >+ > def tearDown(self): > self._disconnect("tearDown") > super().tearDown() >@@ -861,10 +863,11 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(v) > # The value on the wire should never be 0 > self.assertNotEqual(v, 0) >- # value == 0 means we don't know the kvno >- # but enforce at any value != 0 is present >- value = int(value) >- if value != 0: >+ # unspecified_kvno means we don't know the kvno, >+ # but want to enforce its presense >+ if value is not self.unspecified_kvno: >+ value = int(value) >+ self.assertNotEqual(value, 0) > self.assertEqual(v, value) > else: > self.assertIsNone(v) >@@ -1584,8 +1587,8 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_encpart = self.getElementValue(ticket, 'enc-part') > if ticket_encpart is not None: # Never None, but gives indentation > self.assertElementPresent(ticket_encpart, 'etype') >- # 0 means present, with any value != 0 >- self.assertElementKVNO(ticket_encpart, 'kvno', 0) >+ # 'unspecified' means present, with any value != 0 >+ self.assertElementKVNO(ticket_encpart, 'kvno', self.unspecified_kvno) > self.assertElementPresent(ticket_encpart, 'cipher') > ticket_cipher = self.getElementValue(ticket_encpart, 'cipher') > self.assertElementPresent(rep, 'enc-part') >-- >2.25.1 > > >From a359a0df39f46c5f23cc81c0303b3d62576796fc Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 16 Jun 2021 11:01:50 +1200 >Subject: [PATCH 116/380] tests/krb5: Deduplicate 'host' attribute > initialisation > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 3e621dcb6966f75034bb948a2705358d43454202) >--- > python/samba/tests/krb5/kdc_base_test.py | 1 - > python/samba/tests/krb5/raw_testcase.py | 4 ++-- > 2 files changed, 2 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 1f042aa78aa..89d374fc5cc 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -78,7 +78,6 @@ class KDCBaseTest(RawKerberosTest): > def setUpClass(cls): > super().setUpClass() > cls._lp = None >- cls.host = os.environ["SERVER"] > > cls._ldb = None > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index b7044546cbd..b9bc08d1fa9 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -375,6 +375,8 @@ class RawKerberosTest(TestCaseInTempDir): > def setUpClass(cls): > super().setUpClass() > >+ cls.host = samba.tests.env_get_var_value('SERVER') >+ > # A dictionary containing credentials that have already been > # obtained. > cls.creds_dict = {} >@@ -389,8 +391,6 @@ class RawKerberosTest(TestCaseInTempDir): > strict_checking = '1' > self.strict_checking = bool(int(strict_checking)) > >- self.host = samba.tests.env_get_var_value('SERVER') >- > self.s = None > > self.unspecified_kvno = object() >-- >2.25.1 > > >From ae2075ec6d2f808c9d84afffbb803921fedfa251 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 16 Jun 2021 11:49:05 +1200 >Subject: [PATCH 117/380] tests/krb5/as_canonicalization_tests.py: Refactor > account creation > >Making this test a subclass of KDCBaseTest allows us to make use of its >methods for obtaining credentials and creating accounts, which helps to >eliminate some duplicated code. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit fc857ea60e2a66d20d4174cb121e0a6949f8a0c1) >--- > .../tests/krb5/as_canonicalization_tests.py | 136 ++++-------------- > 1 file changed, 25 insertions(+), 111 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index 43f532dc483..abb3f96a1e6 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -25,20 +25,11 @@ import pyasn1 > sys.path.insert(0, "bin/python") > os.environ["PYTHONUNBUFFERED"] = "1" > >-from samba.tests.krb5.raw_testcase import RawKerberosTest >+from samba.tests.krb5.kdc_base_test import KDCBaseTest > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >-import samba >-from samba.auth import system_session >-from samba.credentials import ( >- Credentials, >- DONT_USE_KERBEROS) >+from samba.credentials import DONT_USE_KERBEROS > from samba.dcerpc.misc import SEC_CHAN_WKSTA >-from samba.dsdb import ( >- UF_WORKSTATION_TRUST_ACCOUNT, >- UF_PASSWD_NOTREQD, >- UF_NORMAL_ACCOUNT) >-from samba.samdb import SamDB >-from samba.tests import delete_force, DynamicTestCase >+from samba.tests import DynamicTestCase > from samba.tests.krb5.rfc4120_constants import ( > AES256_CTS_HMAC_SHA1_96, > AES128_CTS_HMAC_SHA1_96, >@@ -96,12 +87,12 @@ class TestData: > else: > client_name_type = NT_PRINCIPAL > >- self.cname = RawKerberosTest.PrincipalName_create( >+ self.cname = KDCBaseTest.PrincipalName_create( > name_type=client_name_type, names=[self.user_name]) > if TestOptions.AsReqSelf.is_set(options): > self.sname = self.cname > else: >- self.sname = RawKerberosTest.PrincipalName_create( >+ self.sname = KDCBaseTest.PrincipalName_create( > name_type=NT_SRV_INST, names=["krbtgt", self.realm]) > self.canonicalize = TestOptions.Canonicalize.is_set(options) > >@@ -141,7 +132,7 @@ USER_NAME = "tstkrb5cnnusr" > > > @DynamicTestCase >-class KerberosASCanonicalizationTests(RawKerberosTest): >+class KerberosASCanonicalizationTests(KDCBaseTest): > > @classmethod > def setUpDynamicTestCases(cls): >@@ -170,114 +161,37 @@ class KerberosASCanonicalizationTests(RawKerberosTest): > name = build_test_name(ct, x) > cls.generate_dynamic_test("test", name, x, ct) > >- @classmethod >- def setUpClass(cls): >- cls.lp = cls.get_loadparm(cls) >- cls.username = os.environ["USERNAME"] >- cls.password = os.environ["PASSWORD"] >- cls.host = os.environ["SERVER"] >- >- c = Credentials() >- c.set_username(cls.username) >- c.set_password(cls.password) >- try: >- realm = os.environ["REALM"] >- c.set_realm(realm) >- except KeyError: >- pass >- try: >- domain = os.environ["DOMAIN"] >- c.set_domain(domain) >- except KeyError: >- pass >+ def user_account_creds(self): >+ if self.user_creds is None: >+ samdb = self.get_samdb() >+ self.user_creds, _ = self.create_account(samdb, USER_NAME) > >- c.guess() >+ return self.user_creds > >- cls.credentials = c >+ def machine_account_creds(self): >+ if self.machine_creds is None: >+ samdb = self.get_samdb() >+ self.machine_creds, _ = self.create_account(samdb, >+ MACHINE_NAME, >+ machine_account=True) >+ self.machine_creds.set_secure_channel_type(SEC_CHAN_WKSTA) >+ self.machine_creds.set_kerberos_state(DONT_USE_KERBEROS) > >- cls.session = system_session() >- cls.ldb = SamDB(url="ldap://%s" % cls.host, >- session_info=cls.session, >- credentials=cls.credentials, >- lp=cls.lp) >- cls.create_machine_account() >- cls.create_user_account() >- >- @classmethod >- def tearDownClass(cls): >- super(KerberosASCanonicalizationTests, cls).tearDownClass() >- delete_force(cls.ldb, cls.machine_dn) >- delete_force(cls.ldb, cls.user_dn) >+ return self.machine_creds > > def setUp(self): >- super(KerberosASCanonicalizationTests, self).setUp() >+ super().setUp() > self.do_asn1_print = global_asn1_print > self.do_hexdump = global_hexdump > >- # >- # Create a test user account >- @classmethod >- def create_user_account(cls): >- cls.user_pass = samba.generate_random_password(32, 32) >- cls.user_name = USER_NAME >- cls.user_dn = "cn=%s,%s" % (cls.user_name, cls.ldb.domain_dn()) >- >- # remove the account if it exists, this will happen if a previous test >- # run failed >- delete_force(cls.ldb, cls.user_dn) >- >- utf16pw = ('"%s"' % cls.user_pass).encode('utf-16-le') >- cls.ldb.add({ >- "dn": cls.user_dn, >- "objectclass": "user", >- "sAMAccountName": "%s" % cls.user_name, >- "userAccountControl": str(UF_NORMAL_ACCOUNT), >- "unicodePwd": utf16pw}) >- >- cls.user_creds = Credentials() >- cls.user_creds.guess(cls.lp) >- cls.user_creds.set_realm(cls.ldb.domain_dns_name().upper()) >- cls.user_creds.set_domain(cls.ldb.domain_netbios_name().upper()) >- cls.user_creds.set_password(cls.user_pass) >- cls.user_creds.set_username(cls.user_name) >- cls.user_creds.set_workstation(cls.machine_name) >- >- # >- # Create the machine account >- @classmethod >- def create_machine_account(cls): >- cls.machine_pass = samba.generate_random_password(32, 32) >- cls.machine_name = MACHINE_NAME >- cls.machine_dn = "cn=%s,%s" % (cls.machine_name, cls.ldb.domain_dn()) >- >- # remove the account if it exists, this will happen if a previous test >- # run failed >- delete_force(cls.ldb, cls.machine_dn) >- >- utf16pw = ('"%s"' % cls.machine_pass).encode('utf-16-le') >- cls.ldb.add({ >- "dn": cls.machine_dn, >- "objectclass": "computer", >- "sAMAccountName": "%s$" % cls.machine_name, >- "userAccountControl": >- str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), >- "unicodePwd": utf16pw}) >- >- cls.machine_creds = Credentials() >- cls.machine_creds.guess(cls.lp) >- cls.machine_creds.set_realm(cls.ldb.domain_dns_name().upper()) >- cls.machine_creds.set_domain(cls.ldb.domain_netbios_name().upper()) >- cls.machine_creds.set_secure_channel_type(SEC_CHAN_WKSTA) >- cls.machine_creds.set_kerberos_state(DONT_USE_KERBEROS) >- cls.machine_creds.set_password(cls.machine_pass) >- cls.machine_creds.set_username(cls.machine_name + "$") >- cls.machine_creds.set_workstation(cls.machine_name) >+ self.user_creds = None >+ self.machine_creds = None > > def _test_with_args(self, x, ct): > if ct == CredentialsType.User: >- creds = self.user_creds >+ creds = self.user_account_creds() > elif ct == CredentialsType.Machine: >- creds = self.machine_creds >+ creds = self.machine_account_creds() > else: > raise Exception("Unexpected credential type") > data = TestData(x, creds) >-- >2.25.1 > > >From 6020a456a8bf86831bfb55ae82c682fee6380bf8 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 16 Jun 2021 12:52:11 +1200 >Subject: [PATCH 118/380] tests/krb5: Use admin creds for SamDB rather than > user creds > >This makes the purpose of each set of credentials more consistent, and >makes some tests more convenient to run standalone as they no longer >require user credentials. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit ab221c1b3e24696aa0eed6aa970f310447657069) >--- > python/samba/tests/krb5/kdc_base_test.py | 2 +- > source4/selftest/tests.py | 42 ++++++++++++++++++++---- > 2 files changed, 36 insertions(+), 8 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 89d374fc5cc..0f5238a3de9 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -109,7 +109,7 @@ class KDCBaseTest(RawKerberosTest): > > def get_samdb(self): > if self._ldb is None: >- creds = self.get_user_creds() >+ creds = self.get_admin_creds() > lp = self.get_lp() > > session = system_session() >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 71e4bf73a4e..d99f08899de 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -752,10 +752,26 @@ planoldpythontestsuite("ad_dc_default:local", "samba.tests.krb5.s4u_tests", > > planoldpythontestsuite("fl2008r2dc:local", "samba.tests.krb5.xrealm_tests") > >-planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ccache") >-planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ldap") >-planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_rpc") >-planoldpythontestsuite("ad_dc_smb1", "samba.tests.krb5.test_smb") >+planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ccache", >+ environ={ >+ 'ADMIN_USERNAME': '$USERNAME', >+ 'ADMIN_PASSWORD': '$PASSWORD' >+ }) >+planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ldap", >+ environ={ >+ 'ADMIN_USERNAME': '$USERNAME', >+ 'ADMIN_PASSWORD': '$PASSWORD' >+ }) >+planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_rpc", >+ environ={ >+ 'ADMIN_USERNAME': '$USERNAME', >+ 'ADMIN_PASSWORD': '$PASSWORD' >+ }) >+planoldpythontestsuite("ad_dc_smb1", "samba.tests.krb5.test_smb", >+ environ={ >+ 'ADMIN_USERNAME': '$USERNAME', >+ 'ADMIN_PASSWORD': '$PASSWORD' >+ }) > > for env in ["ad_dc", smbv1_disabled_testenv]: > planoldpythontestsuite(env, "samba.tests.smb", extra_args=['-U"$USERNAME%$PASSWORD"']) >@@ -1296,15 +1312,27 @@ for env in ["rodc", "promoted_dc", "fl2000dc", "fl2008r2dc"]: > '--option=torture:expect_machine_account=true'] + extra_options, > "samba4.krb5.kdc with machine account") > >-planpythontestsuite("ad_dc", "samba.tests.krb5.as_canonicalization_tests") >+planpythontestsuite("ad_dc", "samba.tests.krb5.as_canonicalization_tests", >+ environ={ >+ 'ADMIN_USERNAME': '$USERNAME', >+ 'ADMIN_PASSWORD': '$PASSWORD' >+ }) > planpythontestsuite("ad_dc", "samba.tests.krb5.compatability_tests") > planpythontestsuite("ad_dc", "samba.tests.krb5.kdc_tests") > planpythontestsuite( > "ad_dc", >- "samba.tests.krb5.kdc_tgs_tests") >+ "samba.tests.krb5.kdc_tgs_tests", >+ environ={ >+ 'ADMIN_USERNAME': '$USERNAME', >+ 'ADMIN_PASSWORD': '$PASSWORD' >+ }) > planpythontestsuite( > "ad_dc", >- "samba.tests.krb5.ms_kile_client_principal_lookup_tests") >+ "samba.tests.krb5.ms_kile_client_principal_lookup_tests", >+ environ={ >+ 'ADMIN_USERNAME': '$USERNAME', >+ 'ADMIN_PASSWORD': '$PASSWORD' >+ }) > > for env in [ > 'vampire_dc', >-- >2.25.1 > > >From 28899ea7794fa1e080688f8553c9edac96ea4eb3 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 21 Jun 2021 14:14:48 +1200 >Subject: [PATCH 119/380] s4:torture/krb5/kdc-heimdal: Automatically determine > AS-REP enctype to check against > >This enables us to more easily switch to a different algorithm to find >the strongest key in _kdc_find_etype(). > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit bf71fa038e9b97f770e06e88226e885d67342d47) >--- > selftest/knownfail | 6 +- > selftest/knownfail_mit_kdc | 6 ++ > source4/torture/krb5/kdc-heimdal.c | 104 +++++++++++++++++++++++++++-- > 3 files changed, 104 insertions(+), 12 deletions(-) > >diff --git a/selftest/knownfail b/selftest/knownfail >index 44ab3e59069..0d114d32f02 100644 >--- a/selftest/knownfail >+++ b/selftest/knownfail >@@ -281,10 +281,6 @@ > ^samba4.winbind.struct.lookup_name_sid\(ad_member:local\) > ^samba4.winbind.struct.getdcname\(nt4_member:local\) # Works in other modes, just not against the classic/NT4 DC > # >-# Differences in our KDC compared to windows >-# >-^samba4.krb5.kdc .*.as-req-pac-request # We should reply to a request for a PAC over UDP with KRB5KRB_ERR_RESPONSE_TOO_BIG unconditionally >-# > # This will fail against the classic DC, because it requires kerberos > # > ^samba4.winbind.pac.*\(nt4_member:local\) # No KDC on a classic DC >@@ -323,7 +319,7 @@ > # > ^samba4.smb.signing.*disabled.*signing=off.*\(ad_dc\) > # fl2000dc doesn't support AES >-^samba4.krb5.kdc.*as-req-aes.*fl2000dc >+^samba4.krb5.kdc.*as-req-aes.fl2000dc > # nt4_member and ad_member don't support ntlmv1 (not even over SMB1) > ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.member.creds.*as.user.*_member > ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user.*_member >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index db40b0614fa..fffa5c3cd7e 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -641,3 +641,9 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_True.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_True.fl2008r2dc >+# Differences in our KDC compared to windows >+# >+^samba4.krb5.kdc .*.as-req-pac-request # We should reply to a request for a PAC over UDP with KRB5KRB_ERR_RESPONSE_TOO_BIG unconditionally >+# >+# fl2000dc doesn't support AES >+^samba4.krb5.kdc.*as-req-aes.*fl2000dc >diff --git a/source4/torture/krb5/kdc-heimdal.c b/source4/torture/krb5/kdc-heimdal.c >index cc70c9eda67..ccd9919b33a 100644 >--- a/source4/torture/krb5/kdc-heimdal.c >+++ b/source4/torture/krb5/kdc-heimdal.c >@@ -204,11 +204,12 @@ static bool torture_check_krb5_error(struct torture_krb5_context *test_context, > > static bool torture_check_krb5_as_rep_enctype(struct torture_krb5_context *test_context, > const krb5_data *reply, >- krb5_enctype expected_enctype) >+ const krb5_enctype* allowed_enctypes) > { > ENCTYPE reply_enctype = { 0 }; > size_t used = 0; > int rc; >+ int expected_enctype = ETYPE_NULL; > > rc = decode_AS_REP(reply->data, > reply->length, >@@ -230,8 +231,84 @@ static bool torture_check_krb5_as_rep_enctype(struct torture_krb5_context *test_ > test_context->as_rep.ticket.enc_part.kvno, > "Did not get a KVNO in test_context->as_rep.ticket.enc_part.kvno"); > >- reply_enctype = test_context->as_rep.enc_part.etype; >+ if (test_context->as_req.padata) { >+ /* >+ * If the AS-REQ contains a PA-ENC-TIMESTAMP, then >+ * that encryption type is used to determine the reply >+ * enctype. >+ */ >+ int i = 0; >+ const PA_DATA *pa = krb5_find_padata(test_context->as_req.padata->val, >+ test_context->as_req.padata->len, >+ KRB5_PADATA_ENC_TIMESTAMP, >+ &i); >+ if (pa) { >+ EncryptedData ed; >+ size_t len; >+ krb5_error_code ret = decode_EncryptedData(pa->padata_value.data, >+ pa->padata_value.length, >+ &ed, &len); >+ torture_assert_int_equal(test_context->tctx, >+ ret, >+ 0, >+ "decode_EncryptedData failed"); >+ expected_enctype = ed.etype; >+ free_EncryptedData(&ed); >+ } >+ } >+ if (expected_enctype == ETYPE_NULL) { >+ /* >+ * Otherwise, find the strongest enctype contained in >+ * the AS-REQ supported enctypes list. >+ */ >+ const krb5_enctype *p = NULL; >+ >+ for (p = krb5_kerberos_enctypes(NULL); *p != (krb5_enctype)ETYPE_NULL; ++p) { >+ int j; >+ >+ if ((*p == (krb5_enctype)ETYPE_AES256_CTS_HMAC_SHA1_96 || >+ *p == (krb5_enctype)ETYPE_AES128_CTS_HMAC_SHA1_96) && >+ !test_context->as_req.req_body.kdc_options.canonicalize) >+ { >+ /* >+ * AES encryption types are only used here when >+ * we set the canonicalize flag, as the salt >+ * needs to match. >+ */ >+ continue; >+ } >+ >+ for (j = 0; j < test_context->as_req.req_body.etype.len; ++j) { >+ krb5_enctype etype = test_context->as_req.req_body.etype.val[j]; >+ if (*p == etype) { >+ expected_enctype = etype; >+ break; >+ } >+ } >+ >+ if (expected_enctype != (krb5_enctype)ETYPE_NULL) { >+ break; >+ } >+ } >+ } >+ >+ { >+ /* Ensure the enctype to check against is an expected type. */ >+ const krb5_enctype *p = NULL; >+ bool found = false; >+ for (p = allowed_enctypes; *p != (krb5_enctype)ETYPE_NULL; ++p) { >+ if (*p == expected_enctype) { >+ found = true; >+ break; >+ } >+ } > >+ torture_assert(test_context->tctx, >+ found, >+ "Calculated enctype not in allowed list"); >+ } >+ >+ reply_enctype = test_context->as_rep.enc_part.etype; > torture_assert_int_equal(test_context->tctx, > reply_enctype, expected_enctype, > "Ticket encrypted with invalid algorithm"); >@@ -310,7 +387,7 @@ static bool torture_krb5_post_recv_test(struct torture_krb5_context *test_contex > if (test_context->packet_count == 0) { > ok = torture_check_krb5_error(test_context, > recv_buf, >- KRB5KRB_ERR_RESPONSE_TOO_BIG, >+ KRB5KDC_ERR_PREAUTH_REQUIRED, > false); > torture_assert(test_context->tctx, > ok, >@@ -318,7 +395,7 @@ static bool torture_krb5_post_recv_test(struct torture_krb5_context *test_contex > } else if (test_context->packet_count == 1) { > ok = torture_check_krb5_error(test_context, > recv_buf, >- KRB5KDC_ERR_PREAUTH_REQUIRED, >+ KRB5KRB_ERR_RESPONSE_TOO_BIG, > false); > torture_assert(test_context->tctx, > ok, >@@ -411,9 +488,13 @@ static bool torture_krb5_post_recv_test(struct torture_krb5_context *test_contex > ok, > "torture_check_krb5_error failed"); > } else { >+ const krb5_enctype allowed_enctypes[] = { >+ KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96, >+ ETYPE_NULL >+ }; > ok = torture_check_krb5_as_rep_enctype(test_context, > recv_buf, >- KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96); >+ allowed_enctypes); > torture_assert(test_context->tctx, > ok, > "torture_check_krb5_as_rep_enctype failed"); >@@ -443,9 +524,13 @@ static bool torture_krb5_post_recv_test(struct torture_krb5_context *test_contex > ok, > "torture_check_krb5_error failed"); > } else { >+ const krb5_enctype allowed_enctypes[] = { >+ KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, >+ ETYPE_NULL >+ }; > ok = torture_check_krb5_as_rep_enctype(test_context, > recv_buf, >- KRB5_ENCTYPE_ARCFOUR_HMAC_MD5); >+ allowed_enctypes); > torture_assert(test_context->tctx, > ok, > "torture_check_krb5_as_rep_enctype failed"); >@@ -475,9 +560,14 @@ static bool torture_krb5_post_recv_test(struct torture_krb5_context *test_contex > ok, > "torture_check_krb5_error failed"); > } else { >+ const krb5_enctype allowed_enctypes[] = { >+ KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96, >+ KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, >+ ETYPE_NULL >+ }; > ok = torture_check_krb5_as_rep_enctype(test_context, > recv_buf, >- KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96); >+ allowed_enctypes); > torture_assert(test_context->tctx, > ok, > "torture_check_krb5_as_rep_enctype failed"); >-- >2.25.1 > > >From 47c119c6d32194dd6f381b41fac80734bf5217ca Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 7 Sep 2021 09:08:58 +1200 >Subject: [PATCH 120/380] selftest: add space after --list in output of > selftesthelpers.py > >Selected and backported from: > >commit b113a3bbcd03ab6a62883fbca85ee8749e038887 >Author: Volker Lendecke <vl@samba.org> >Date: Mon Apr 19 16:04:00 2021 +0200 > > torture: Show sddl_decode() failure for "GWFX" access mask > > Signed-off-by: Volker Lendecke <vl@samba.org> > Reviewed-by: Jeremy Allison <jra@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >(This allows subsequent patches to be cherry-picked cleanly) > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >--- > selftest/selftesthelpers.py | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/selftest/selftesthelpers.py b/selftest/selftesthelpers.py >index 1afabf3cdca..c2a74a30614 100644 >--- a/selftest/selftesthelpers.py >+++ b/selftest/selftesthelpers.py >@@ -109,7 +109,7 @@ def plantestsuite_loadlist(name, env, cmdline): > raise AssertionError("loadlist test %s does not support not --list" % name) > if "$LOADLIST" not in cmdline: > raise AssertionError("loadlist test %s does not support --load-list" % name) >- print(("%s | %s" % (cmdline.replace("$LOADLIST", ""), add_prefix(name, env, support_list))).replace("$LISTOPT", "--list")) >+ print(("%s | %s" % (cmdline.replace("$LOADLIST", ""), add_prefix(name, env, support_list))).replace("$LISTOPT", "--list ")) > print(cmdline.replace("$LISTOPT", "") + " 2>&1 " + " | " + add_prefix(name, env, False)) > > >-- >2.25.1 > > >From 0a13806fb0041724fedfdc974365ac1d1818fc6b Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Tue, 27 Jul 2021 08:50:54 +0200 >Subject: [PATCH 121/380] selftest: Re-format long lines in selftesthelpers.py > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 18976a9568b23759060377d09304e9d7badb143a) >--- > selftest/selftesthelpers.py | 18 +++++++++++++----- > 1 file changed, 13 insertions(+), 5 deletions(-) > >diff --git a/selftest/selftesthelpers.py b/selftest/selftesthelpers.py >index c2a74a30614..3c544a0057c 100644 >--- a/selftest/selftesthelpers.py >+++ b/selftest/selftesthelpers.py >@@ -1,4 +1,5 @@ >-#!/usr/bin/python >+#!/usr/bin/env python3 >+# > # This script generates a list of testsuites that should be run as part of > # the Samba 4 test suite. > >@@ -25,7 +26,8 @@ import sys > > > def srcdir(): >- return os.path.normpath(os.getenv("SRCDIR", os.path.join(os.path.dirname(os.path.abspath(__file__)), ".."))) >+ alternate_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..") >+ return os.path.normpath(os.getenv("SRCDIR", alternate_path)) > > > def source4dir(): >@@ -91,7 +93,8 @@ def add_prefix(prefix, env, support_list=False): > listopt = "$LISTOPT " > else: > listopt = "" >- return "%s %s/selftest/filter-subunit %s--fail-on-empty --prefix=\"%s.\" --suffix=\"(%s)\"" % (python, srcdir(), listopt, prefix, env) >+ return ("%s %s/selftest/filter-subunit %s--fail-on-empty --prefix=\"%s.\" --suffix=\"(%s)\"" % >+ (python, srcdir(), listopt, prefix, env)) > > > def plantestsuite_loadlist(name, env, cmdline): >@@ -109,7 +112,9 @@ def plantestsuite_loadlist(name, env, cmdline): > raise AssertionError("loadlist test %s does not support not --list" % name) > if "$LOADLIST" not in cmdline: > raise AssertionError("loadlist test %s does not support --load-list" % name) >- print(("%s | %s" % (cmdline.replace("$LOADLIST", ""), add_prefix(name, env, support_list))).replace("$LISTOPT", "--list ")) >+ print(("%s | %s" % >+ (cmdline.replace("$LOADLIST", ""), >+ add_prefix(name, env, support_list))).replace("$LISTOPT", "--list ")) > print(cmdline.replace("$LISTOPT", "") + " 2>&1 " + " | " + add_prefix(name, env, False)) > > >@@ -162,7 +167,10 @@ bbdir = os.path.join(srcdir(), "testprogs/blackbox") > configuration = "--configfile=$SMB_CONF_PATH" > > smbtorture4 = binpath("smbtorture") >-smbtorture4_testsuite_list = subprocess.Popen([smbtorture4, "--list-suites"], stdout=subprocess.PIPE, stderr=subprocess.PIPE).communicate("")[0].decode('utf8').splitlines() >+smbtorture4_testsuite_list = subprocess.Popen( >+ [smbtorture4, "--list-suites"], >+ stdout=subprocess.PIPE, >+ stderr=subprocess.PIPE).communicate("")[0].decode('utf8').splitlines() > > smbtorture4_options = [ > configuration, >-- >2.25.1 > > >From 63eaa376844fae152f923beb47c445f5e66958e9 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Tue, 27 Jul 2021 13:25:59 +0200 >Subject: [PATCH 122/380] selftest: Add support for setting ENV variables in > plansmbtorture4testsuite() > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 3db299e586fd9464b6e1b145f29b10c8ae325d3a) >--- > selftest/selftesthelpers.py | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > >diff --git a/selftest/selftesthelpers.py b/selftest/selftesthelpers.py >index 3c544a0057c..697a4d08abb 100644 >--- a/selftest/selftesthelpers.py >+++ b/selftest/selftesthelpers.py >@@ -181,13 +181,14 @@ smbtorture4_options = [ > ] + get_env_torture_options() > > >-def plansmbtorture4testsuite(name, env, options, target, modname=None): >+def plansmbtorture4testsuite(name, env, options, target, environ={}, modname=None): > if modname is None: > modname = "samba4.%s" % name > if isinstance(options, list): > options = " ".join(options) > options = " ".join(smbtorture4_options + ["--target=%s" % target]) + " " + options >- cmdline = "%s $LISTOPT $LOADLIST %s %s" % (valgrindify(smbtorture4), options, name) >+ cmdline = ["%s=%s" % item for item in environ.items()] >+ cmdline += "%s $LISTOPT $LOADLIST %s %s" % (valgrindify(smbtorture4), options, name) > plantestsuite_loadlist(modname, env, cmdline) > > >-- >2.25.1 > > >From 50ff113a636c9f0b15756e848ce5165cd7dc2d98 Mon Sep 17 00:00:00 2001 >From: Andreas Schneider <asn@samba.org> >Date: Tue, 27 Jul 2021 13:45:03 +0200 >Subject: [PATCH 123/380] selftest: Add support for setting ENV variables in > plantestsuite() > >Signed-off-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 48289b6964d28e153fec885aceca02c6a9b436ef) >--- > selftest/selftesthelpers.py | 25 +++++++++++++++++++------ > 1 file changed, 19 insertions(+), 6 deletions(-) > >diff --git a/selftest/selftesthelpers.py b/selftest/selftesthelpers.py >index 697a4d08abb..167777e3d47 100644 >--- a/selftest/selftesthelpers.py >+++ b/selftest/selftesthelpers.py >@@ -67,7 +67,7 @@ def valgrindify(cmdline): > return valgrind + " " + cmdline > > >-def plantestsuite(name, env, cmdline): >+def plantestsuite(name, env, cmd, environ={}): > """Plan a test suite. > > :param name: Testsuite name >@@ -81,8 +81,18 @@ def plantestsuite(name, env, cmdline): > fullname = "%s(%s)" % (name, env) > print(fullname) > print(env) >- if isinstance(cmdline, list): >- cmdline = " ".join(cmdline) >+ >+ cmdline = "" >+ if environ: >+ environ = dict(environ) >+ cmdline_env = ["%s=%s" % item for item in environ.items()] >+ cmdline = " ".join(cmdline_env) + " " >+ >+ if isinstance(cmd, list): >+ cmdline += " ".join(cmd) >+ else: >+ cmdline += cmd >+ > if "$LISTOPT" in cmdline: > raise AssertionError("test %s supports --list, but not --load-list" % name) > print(cmdline + " 2>&1 " + " | " + add_prefix(name, env)) >@@ -181,14 +191,17 @@ smbtorture4_options = [ > ] + get_env_torture_options() > > >-def plansmbtorture4testsuite(name, env, options, target, environ={}, modname=None): >+def plansmbtorture4testsuite(name, env, options, target, modname=None, environ={}): > if modname is None: > modname = "samba4.%s" % name > if isinstance(options, list): > options = " ".join(options) > options = " ".join(smbtorture4_options + ["--target=%s" % target]) + " " + options >- cmdline = ["%s=%s" % item for item in environ.items()] >- cmdline += "%s $LISTOPT $LOADLIST %s %s" % (valgrindify(smbtorture4), options, name) >+ cmdline = "" >+ if environ: >+ environ = dict(environ) >+ cmdline = ["%s=%s" % item for item in environ.items()] >+ cmdline += " %s $LISTOPT $LOADLIST %s %s" % (valgrindify(smbtorture4), options, name) > plantestsuite_loadlist(modname, env, cmdline) > > >-- >2.25.1 > > >From 6906a5325a156d7bca42788b9f016f440c7d1c71 Mon Sep 17 00:00:00 2001 >From: =?UTF-8?q?Bj=C3=B6rn=20Baumbach?= <bb@sernet.de> >Date: Fri, 24 Jul 2020 12:18:11 +0200 >Subject: [PATCH 124/380] selftest: add option to pass args to tests to > planpythontestsuite() >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >The logic is basically a copy from planoldpythontestsuite(). > >Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> > >Signed-off-by: Björn Baumbach <bb@sernet.de> >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Jeremy Allison <jra@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 3e9f0e97255de1b4235c4dca6912635386328746) >--- > selftest/selftesthelpers.py | 16 +++++++++------- > 1 file changed, 9 insertions(+), 7 deletions(-) > >diff --git a/selftest/selftesthelpers.py b/selftest/selftesthelpers.py >index 167777e3d47..1dd30b01ea7 100644 >--- a/selftest/selftesthelpers.py >+++ b/selftest/selftesthelpers.py >@@ -150,16 +150,18 @@ def planperltestsuite(name, path): > skiptestsuite(name, "Test::More not available") > > >-def planpythontestsuite(env, module, name=None, extra_path=None): >+def planpythontestsuite(env, module, name=None, extra_path=[], environ={}, extra_args=[]): >+ environ = dict(environ) >+ py_path = list(extra_path) >+ if py_path is not None: >+ environ["PYTHONPATH"] = ":".join(["$PYTHONPATH"] + py_path) >+ args = ["%s=%s" % item for item in environ.items()] >+ args += [python, "-m", "samba.subunit.run", "$LISTOPT", "$LOADLIST", module] >+ args += extra_args > if name is None: > name = module >- args = [python, "-m", "samba.subunit.run", "$LISTOPT", "$LOADLIST", module] >- if extra_path: >- pypath = ["PYTHONPATH=$PYTHONPATH:%s" % ":".join(extra_path)] >- else: >- pypath = [] > >- plantestsuite_loadlist(name, env, pypath + args) >+ plantestsuite_loadlist(name, env, args) > > > def get_env_torture_options(): >-- >2.25.1 > > >From ec1aa53eeaa408e77faee8d7f10a0fddf22fed5d Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 19 Jul 2021 17:29:39 +1200 >Subject: [PATCH 125/380] pygensec: Fix memory leaks > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 814df05f8c10e9d82e6082d42ece1df569db4385) >--- > source4/auth/gensec/pygensec.c | 23 +++++++++++++++++++++++ > 1 file changed, 23 insertions(+) > >diff --git a/source4/auth/gensec/pygensec.c b/source4/auth/gensec/pygensec.c >index 35095344168..cf522f76385 100644 >--- a/source4/auth/gensec/pygensec.c >+++ b/source4/auth/gensec/pygensec.c >@@ -310,9 +310,13 @@ static PyObject *py_gensec_session_info(PyObject *self, > return NULL; > } > mem_ctx = talloc_new(NULL); >+ if (mem_ctx == NULL) { >+ return PyErr_NoMemory(); >+ } > > status = gensec_session_info(security, mem_ctx, &info); > if (NT_STATUS_IS_ERR(status)) { >+ talloc_free(mem_ctx); > PyErr_SetNTSTATUS(status); > return NULL; > } >@@ -337,6 +341,9 @@ static PyObject *py_gensec_session_key(PyObject *self, > return NULL; > } > mem_ctx = talloc_new(NULL); >+ if (mem_ctx == NULL) { >+ return PyErr_NoMemory(); >+ } > > status = gensec_session_key(security, mem_ctx, &session_key); > if (!NT_STATUS_IS_OK(status)) { >@@ -466,7 +473,12 @@ static PyObject *py_gensec_update(PyObject *self, PyObject *args) > return NULL; > > mem_ctx = talloc_new(NULL); >+ if (mem_ctx == NULL) { >+ return PyErr_NoMemory(); >+ } >+ > if (!PyBytes_Check(py_in)) { >+ talloc_free(mem_ctx); > PyErr_Format(PyExc_TypeError, "bytes expected"); > return NULL; > } >@@ -510,8 +522,12 @@ static PyObject *py_gensec_wrap(PyObject *self, PyObject *args) > return NULL; > > mem_ctx = talloc_new(NULL); >+ if (mem_ctx == NULL) { >+ return PyErr_NoMemory(); >+ } > > if (!PyBytes_Check(py_in)) { >+ talloc_free(mem_ctx); > PyErr_Format(PyExc_TypeError, "bytes expected"); > return NULL; > } >@@ -545,8 +561,12 @@ static PyObject *py_gensec_unwrap(PyObject *self, PyObject *args) > return NULL; > > mem_ctx = talloc_new(NULL); >+ if (mem_ctx == NULL) { >+ return PyErr_NoMemory(); >+ } > > if (!PyBytes_Check(py_in)) { >+ talloc_free(mem_ctx); > PyErr_Format(PyExc_TypeError, "bytes expected"); > return NULL; > } >@@ -599,6 +619,9 @@ static PyObject *py_gensec_sign_packet(PyObject *self, PyObject *args) > pdu.length = pdu_length; > > mem_ctx = talloc_new(NULL); >+ if (mem_ctx == NULL) { >+ return PyErr_NoMemory(); >+ } > > status = gensec_sign_packet(security, mem_ctx, > data.data, data.length, >-- >2.25.1 > > >From 3e9daaa73bbc94894d5ac4f696b04d2cfdae2e48 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 20 Jul 2021 10:48:41 +1200 >Subject: [PATCH 126/380] pygensec: Don't modify Python bytes objects > >gensec_update() and gensec_unwrap() can both modify their input buffers >(for example, during the inplace RRC operation on GSSAPI tokens). >However, buffers obtained from Python bytes objects must not be modified >in any way. Create a copy of the input buffer so the original isn't >modified. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 6818d204897d0b7946dcfbedf79cd53fb9b3f159) >--- > source4/auth/gensec/gensec_gssapi.c | 4 ++++ > source4/auth/gensec/pygensec.c | 36 ++++++++++++++++++++++------- > 2 files changed, 32 insertions(+), 8 deletions(-) > >diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c >index d66abf32a7f..dbda18ede09 100644 >--- a/source4/auth/gensec/gensec_gssapi.c >+++ b/source4/auth/gensec/gensec_gssapi.c >@@ -1167,6 +1167,10 @@ static NTSTATUS gensec_gssapi_unwrap(struct gensec_security *gensec_security, > } > } > >+ /* >+ * FIXME: input_message_buffer is marked const, but gss_unwrap() may >+ * modify it (see calls to rrc_rotate() in _gssapi_unwrap_cfx()). >+ */ > maj_stat = gss_unwrap(&min_stat, > gensec_gssapi_state->gssapi_context, > &input_token, >diff --git a/source4/auth/gensec/pygensec.c b/source4/auth/gensec/pygensec.c >index cf522f76385..1a8d7b0489f 100644 >--- a/source4/auth/gensec/pygensec.c >+++ b/source4/auth/gensec/pygensec.c >@@ -468,6 +468,9 @@ static PyObject *py_gensec_update(PyObject *self, PyObject *args) > PyObject *py_bytes, *result, *py_in; > struct gensec_security *security = pytalloc_get_type(self, struct gensec_security); > PyObject *finished_processing; >+ char *data = NULL; >+ Py_ssize_t len; >+ int err; > > if (!PyArg_ParseTuple(args, "O", &py_in)) > return NULL; >@@ -477,14 +480,21 @@ static PyObject *py_gensec_update(PyObject *self, PyObject *args) > return PyErr_NoMemory(); > } > >- if (!PyBytes_Check(py_in)) { >+ err = PyBytes_AsStringAndSize(py_in, &data, &len); >+ if (err) { > talloc_free(mem_ctx); >- PyErr_Format(PyExc_TypeError, "bytes expected"); > return NULL; > } > >- in.data = (uint8_t *)PyBytes_AsString(py_in); >- in.length = PyBytes_Size(py_in); >+ /* >+ * Make a copy of the input buffer, as gensec_update may modify its >+ * input argument. >+ */ >+ in = data_blob_talloc(mem_ctx, data, len); >+ if (!in.data) { >+ talloc_free(mem_ctx); >+ return PyErr_NoMemory(); >+ } > > status = gensec_update(security, mem_ctx, in, &out); > >@@ -556,6 +566,9 @@ static PyObject *py_gensec_unwrap(PyObject *self, PyObject *args) > DATA_BLOB in, out; > PyObject *ret, *py_in; > struct gensec_security *security = pytalloc_get_type(self, struct gensec_security); >+ char *data = NULL; >+ Py_ssize_t len; >+ int err; > > if (!PyArg_ParseTuple(args, "O", &py_in)) > return NULL; >@@ -565,14 +578,21 @@ static PyObject *py_gensec_unwrap(PyObject *self, PyObject *args) > return PyErr_NoMemory(); > } > >- if (!PyBytes_Check(py_in)) { >+ err = PyBytes_AsStringAndSize(py_in, &data, &len); >+ if (err) { > talloc_free(mem_ctx); >- PyErr_Format(PyExc_TypeError, "bytes expected"); > return NULL; > } > >- in.data = (uint8_t *)PyBytes_AsString(py_in); >- in.length = PyBytes_Size(py_in); >+ /* >+ * Make a copy of the input buffer, as gensec_unwrap may modify its >+ * input argument. >+ */ >+ in = data_blob_talloc(mem_ctx, data, len); >+ if (!in.data) { >+ talloc_free(mem_ctx); >+ return PyErr_NoMemory(); >+ } > > status = gensec_unwrap(security, mem_ctx, &in, &out); > >-- >2.25.1 > > >From 53ce6d1330b7bd479fac0ff7d6132e737f9bd414 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 26 Jul 2021 17:15:23 +1200 >Subject: [PATCH 127/380] tests/krb5: Fix ms_kile_client_principal_lookup_test > errors > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 4797ced89095155c01e44727cf8b66ee4fb39710) >--- > .../krb5/ms_kile_client_principal_lookup_tests.py | 11 ++++++----- > 1 file changed, 6 insertions(+), 5 deletions(-) > >diff --git a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >index e9d251e72f6..1598959a18c 100755 >--- a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >+++ b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >@@ -395,7 +395,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > # Check the contents of the pac, and the ticket > ticket = rep['ticket'] > enc_part = self.decode_service_ticket(mc, ticket) >- self.check_pac(enc_part['authorization-data'], dn, uc, user_name) >+ self.check_pac(samdb, >+ enc_part['authorization-data'], dn, uc, user_name) > # check the crealm and cname > cname = enc_part['cname'] > self.assertEqual(NT_PRINCIPAL, cname['name-type']) >@@ -497,7 +498,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > ticket = rep['ticket'] > enc_part = self.decode_service_ticket(mc, ticket) > self.check_pac( >- enc_part['authorization-data'], dn, uc, upn, upn=upn) >+ samdb, enc_part['authorization-data'], dn, uc, upn, upn=upn) > # check the crealm and cname > cname = enc_part['cname'] > crealm = enc_part['crealm'] >@@ -560,7 +561,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > ticket = rep['ticket'] > enc_part = self.decode_service_ticket(mc, ticket) > self.check_pac( >- enc_part['authorization-data'], dn, uc, ename, upn=ename) >+ samdb, enc_part['authorization-data'], dn, uc, ename, upn=ename) > # check the crealm and cname > cname = enc_part['cname'] > crealm = enc_part['crealm'] >@@ -624,7 +625,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > ticket = rep['ticket'] > enc_part = self.decode_service_ticket(mc, ticket) > self.check_pac( >- enc_part['authorization-data'], dn, mc, ename, upn=uname) >+ samdb, enc_part['authorization-data'], dn, mc, ename, upn=uname) > # check the crealm and cname > cname = enc_part['cname'] > crealm = enc_part['crealm'] >@@ -771,7 +772,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > ticket = rep['ticket'] > enc_part = self.decode_service_ticket(mc, ticket) > self.check_pac( >- enc_part['authorization-data'], dn, uc, uname, upn=uname) >+ samdb, enc_part['authorization-data'], dn, uc, uname, upn=uname) > # check the crealm and cname > cname = enc_part['cname'] > self.assertEqual(NT_ENTERPRISE_PRINCIPAL, cname['name-type']) >-- >2.25.1 > > >From 6a0fa4f9575d61881ac6a75f4d23aac39f284da7 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 22 Jul 2021 16:26:17 +1200 >Subject: [PATCH 128/380] tests/krb5: Fix comment typo > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 9eb4c4b7b1c2e8d124456e6a57262dc9c02d67d4) >--- > python/samba/tests/krb5/raw_testcase.py | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index b9bc08d1fa9..9c090e4d005 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -864,7 +864,7 @@ class RawKerberosTest(TestCaseInTempDir): > # The value on the wire should never be 0 > self.assertNotEqual(v, 0) > # unspecified_kvno means we don't know the kvno, >- # but want to enforce its presense >+ # but want to enforce its presence > if value is not self.unspecified_kvno: > value = int(value) > self.assertNotEqual(value, 0) >-- >2.25.1 > > >From 8c1fa29e924e7bde36ee99e3686e2cdd010319c9 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 6 Jul 2021 10:17:52 +1200 >Subject: [PATCH 129/380] tests/krb5: Fix method name typo > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 7013a8edd1f628b8659f0836f3b37ccf13156ae2) >--- > python/samba/tests/krb5/kdc_base_test.py | 4 ++-- > python/samba/tests/krb5/kdc_tgs_tests.py | 6 +++--- > .../ms_kile_client_principal_lookup_tests.py | 20 +++++++++---------- > 3 files changed, 15 insertions(+), 15 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 0f5238a3de9..4bd856b217e 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -444,7 +444,7 @@ class KDCBaseTest(RawKerberosTest): > > return enc_part > >- def check_pre_authenication(self, rep): >+ def check_pre_authentication(self, rep): > """ Check that the kdc response was pre-authentication required > """ > self.check_error_rep(rep, KDC_ERR_PREAUTH_REQUIRED) >@@ -794,7 +794,7 @@ class KDCBaseTest(RawKerberosTest): > names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(user_credentials, rep) >diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py >index 0c757bd5e5f..25a1f5f3ed8 100755 >--- a/python/samba/tests/krb5/kdc_tgs_tests.py >+++ b/python/samba/tests/krb5/kdc_tgs_tests.py >@@ -63,7 +63,7 @@ class KdcTgsTests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(uc, rep) >@@ -113,7 +113,7 @@ class KdcTgsTests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(uc, rep) >@@ -154,7 +154,7 @@ class KdcTgsTests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(uc, rep) >diff --git a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >index 1598959a18c..e42b643b357 100755 >--- a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >+++ b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >@@ -106,7 +106,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(uc, rep) >@@ -165,7 +165,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(mc, rep) >@@ -227,7 +227,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(uc, rep) >@@ -365,7 +365,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(uc, rep) >@@ -433,7 +433,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(uc, rep) >@@ -472,7 +472,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(uc, rep) >@@ -535,7 +535,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(uc, rep) >@@ -599,7 +599,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(mc, rep) >@@ -741,7 +741,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(uc, rep) >@@ -810,7 +810,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=["krbtgt", realm]) > > rep = self.as_req(cname, sname, realm, etype) >- self.check_pre_authenication(rep) >+ self.check_pre_authentication(rep) > > # Do the next AS-REQ > padata = self.get_pa_data(uc, rep) >-- >2.25.1 > > >From 43ec869b1d7da701c993c98bc0a39968b2142e9e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 2 Aug 2021 17:00:09 +1200 >Subject: [PATCH 130/380] tests/krb5: formatting > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit df6623363a7ec1a13af48a09e1d29fa8784e825c) >--- > python/samba/tests/krb5/as_req_tests.py | 20 +- > python/samba/tests/krb5/kdc_base_test.py | 22 +- > python/samba/tests/krb5/raw_testcase.py | 323 +++++++++++++---------- > 3 files changed, 209 insertions(+), 156 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 10e7b603609..09cfc9e1fc8 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -82,16 +82,16 @@ class AsReqKerberosTests(KDCBaseTest): > return initial_padata, req_body > > kdc_exchange_dict = self.as_exchange_dict( >- expected_crealm=expected_crealm, >- expected_cname=expected_cname, >- expected_srealm=expected_srealm, >- expected_sname=expected_sname, >- generate_padata_fn=_generate_padata_copy, >- check_error_fn=self.generic_check_as_error, >- check_rep_fn=self.generic_check_kdc_rep, >- expected_error_mode=expected_error_mode, >- client_as_etypes=client_as_etypes, >- expected_salt=expected_salt) >+ expected_crealm=expected_crealm, >+ expected_cname=expected_cname, >+ expected_srealm=expected_srealm, >+ expected_sname=expected_sname, >+ generate_padata_fn=_generate_padata_copy, >+ check_error_fn=self.generic_check_as_error, >+ check_rep_fn=self.generic_check_kdc_rep, >+ expected_error_mode=expected_error_mode, >+ client_as_etypes=client_as_etypes, >+ expected_salt=expected_salt) > > rep = self._generic_kdc_exchange(kdc_exchange_dict, > kdc_options=str(initial_kdc_options), >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 4bd856b217e..c23c71e1d74 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -21,10 +21,7 @@ import os > from datetime import datetime, timezone > import tempfile > import binascii >-import struct > >-sys.path.insert(0, "bin/python") >-os.environ["PYTHONUNBUFFERED"] = "1" > from collections import namedtuple > import ldb > from ldb import SCOPE_BASE >@@ -66,6 +63,9 @@ from samba.tests.krb5.rfc4120_constants import ( > PADATA_ETYPE_INFO2, > ) > >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ > global_asn1_print = False > global_hexdump = False > >@@ -114,9 +114,9 @@ class KDCBaseTest(RawKerberosTest): > > session = system_session() > type(self)._ldb = SamDB(url="ldap://%s" % self.host, >- session_info=session, >- credentials=creds, >- lp=lp) >+ session_info=session, >+ credentials=creds, >+ lp=lp) > > return self._ldb > >@@ -337,6 +337,7 @@ class KDCBaseTest(RawKerberosTest): > require_strongest_key=False): > if require_strongest_key: > self.assertTrue(require_keys) >+ > def download_krbtgt_creds(): > samdb = self.get_samdb() > >@@ -742,15 +743,16 @@ class KDCBaseTest(RawKerberosTest): > .replace(tzinfo=timezone.utc).timestamp()) > > # Account for clock skew of up to five minutes. >- self.assertLess(cred.authtime - 5*60, >+ self.assertLess(cred.authtime - 5 * 60, > datetime.now(timezone.utc).timestamp(), > "Ticket not yet valid - clocks may be out of sync.") >- self.assertLess(cred.starttime - 5*60, >+ self.assertLess(cred.starttime - 5 * 60, > datetime.now(timezone.utc).timestamp(), > "Ticket not yet valid - clocks may be out of sync.") >- self.assertGreater(cred.endtime - 60*60, >+ self.assertGreater(cred.endtime - 60 * 60, > datetime.now(timezone.utc).timestamp(), >- "Ticket already expired/about to expire - clocks may be out of sync.") >+ "Ticket already expired/about to expire - " >+ "clocks may be out of sync.") > > cred.renew_till = cred.endtime > cred.is_skey = 0 >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 9c090e4d005..de9c25751d2 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -24,11 +24,19 @@ import datetime > import random > import binascii > import itertools >+from pyasn1.codec.der.decoder import decode as pyasn1_der_decode >+from pyasn1.codec.der.encoder import encode as pyasn1_der_encode >+from pyasn1.codec.native.decoder import decode as pyasn1_native_decode >+from pyasn1.codec.native.encoder import encode as pyasn1_native_encode >+ >+from pyasn1.codec.ber.encoder import BitStringEncoder > >-import samba.tests > from samba.credentials import Credentials >-from samba.tests import TestCaseInTempDir > from samba.dcerpc import security >+ >+import samba.tests >+from samba.tests import TestCaseInTempDir >+ > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( > KDC_ERR_ETYPE_NOSUPP, >@@ -53,13 +61,6 @@ from samba.tests.krb5.rfc4120_constants import ( > ) > import samba.tests.krb5.kcrypto as kcrypto > >-from pyasn1.codec.der.decoder import decode as pyasn1_der_decode >-from pyasn1.codec.der.encoder import encode as pyasn1_der_encode >-from pyasn1.codec.native.decoder import decode as pyasn1_native_decode >-from pyasn1.codec.native.encoder import encode as pyasn1_native_encode >- >-from pyasn1.codec.ber.encoder import BitStringEncoder as BitStringEncoder >- > > def BitStringEncoder_encodeValue32( > self, value, asn1Spec, encodeFun, **options): >@@ -217,6 +218,7 @@ class Krb5EncryptionKey(object): > } > return EncryptionKey_obj > >+ > class KerberosCredentials(Credentials): > def __init__(self): > super(KerberosCredentials, self).__init__() >@@ -293,6 +295,7 @@ class KerberosCredentials(Credentials): > def get_forced_salt(self): > return self.forced_salt > >+ > class KerberosTicketCreds(object): > def __init__(self, ticket, session_key, > crealm=None, cname=None, >@@ -311,14 +314,15 @@ class KerberosTicketCreds(object): > self.encpart_private = encpart_private > return > >+ > class RawKerberosTest(TestCaseInTempDir): > """A raw Kerberos Test case.""" > > etypes_to_test = ( >- { "value": -1111, "name": "dummy", }, >- { "value": kcrypto.Enctype.AES256, "name": "aes128", }, >- { "value": kcrypto.Enctype.AES128, "name": "aes256", }, >- { "value": kcrypto.Enctype.RC4, "name": "rc4", }, >+ {"value": -1111, "name": "dummy", }, >+ {"value": kcrypto.Enctype.AES256, "name": "aes128", }, >+ {"value": kcrypto.Enctype.AES128, "name": "aes256", }, >+ {"value": kcrypto.Enctype.RC4, "name": "rc4", }, > ) > > setup_etype_test_permutations_done = False >@@ -332,7 +336,7 @@ class RawKerberosTest(TestCaseInTempDir): > > num_idxs = len(cls.etypes_to_test) > permutations = [] >- for num in range(1, num_idxs+1): >+ for num in range(1, num_idxs + 1): > chunk = list(itertools.permutations(range(num_idxs), num)) > for e in chunk: > el = list(e) >@@ -349,7 +353,7 @@ class RawKerberosTest(TestCaseInTempDir): > name += "_%s" % n > etypes += (cls.etypes_to_test[idx]["value"],) > >- r = { "name": name, "etypes": etypes, } >+ r = {"name": name, "etypes": etypes, } > res.append(r) > > cls.etype_test_permutations = res >@@ -386,7 +390,8 @@ class RawKerberosTest(TestCaseInTempDir): > self.do_asn1_print = False > self.do_hexdump = False > >- strict_checking = samba.tests.env_get_var_value('STRICT_CHECKING', allow_missing=True) >+ strict_checking = samba.tests.env_get_var_value('STRICT_CHECKING', >+ allow_missing=True) > if strict_checking is None: > strict_checking = '1' > self.strict_checking = bool(int(strict_checking)) >@@ -440,8 +445,9 @@ class RawKerberosTest(TestCaseInTempDir): > val = None > if prefix is not None: > allow_missing_prefix = allow_missing or fallback_default >- val = samba.tests.env_get_var_value('%s_%s' % (prefix, varname), >- allow_missing=allow_missing_prefix) >+ val = samba.tests.env_get_var_value( >+ '%s_%s' % (prefix, varname), >+ allow_missing=allow_missing_prefix) > else: > fallback_default = True > if val is None and fallback_default: >@@ -506,7 +512,8 @@ class RawKerberosTest(TestCaseInTempDir): > if aes256_key is not None: > c.set_forced_key(kcrypto.Enctype.AES256, aes256_key) > aes128_key = self.env_get_var('AES128_KEY_HEX', prefix, >- fallback_default=False, allow_missing=True) >+ fallback_default=False, >+ allow_missing=True) > if aes128_key is not None: > c.set_forced_key(kcrypto.Enctype.AES128, aes128_key) > rc4_key = self.env_get_var('RC4_KEY_HEX', prefix, >@@ -536,11 +543,12 @@ class RawKerberosTest(TestCaseInTempDir): > env_err = None > try: > # Try to obtain them from the environment >- creds = self._get_krb5_creds_from_env(prefix, >- default_username=default_username, >- allow_missing_password=allow_missing_password, >- allow_missing_keys=allow_missing_keys, >- require_strongest_key=require_strongest_key) >+ creds = self._get_krb5_creds_from_env( >+ prefix, >+ default_username=default_username, >+ allow_missing_password=allow_missing_password, >+ allow_missing_keys=allow_missing_keys, >+ require_strongest_key=require_strongest_key) > except Exception as err: > # An error occurred, so save it for later > env_err = err >@@ -886,8 +894,8 @@ class RawKerberosTest(TestCaseInTempDir): > return s > > def get_Nonce(self): >- nonce_min=0x7f000000 >- nonce_max=0x7fffffff >+ nonce_min = 0x7f000000 >+ nonce_max = 0x7fffffff > v = random.randint(nonce_min, nonce_max) > return v > >@@ -936,15 +944,20 @@ class RawKerberosTest(TestCaseInTempDir): > if etype == kcrypto.Enctype.RC4: > nthash = creds.get_nt_hash() > self.assertIsNotNone(nthash, msg=fail_msg) >- return self.SessionKey_create(etype=etype, contents=nthash, kvno=kvno) >+ return self.SessionKey_create(etype=etype, >+ contents=nthash, >+ kvno=kvno) > > password = creds.get_password() > self.assertIsNotNone(password, msg=fail_msg) > salt = creds.get_forced_salt() > if salt is None: > salt = bytes("%s%s" % (creds.get_realm(), creds.get_username()), >- encoding='utf-8') >- return self.PasswordKey_create(etype=etype, pwd=password, salt=salt, kvno=kvno) >+ encoding='utf-8') >+ return self.PasswordKey_create(etype=etype, >+ pwd=password, >+ salt=salt, >+ kvno=kvno) > > def RandomKey(self, etype): > e = kcrypto._get_enctype_profile(etype) >@@ -1020,10 +1033,12 @@ class RawKerberosTest(TestCaseInTempDir): > return PA_ENC_TS_ENC_obj > > def KERB_PA_PAC_REQUEST_create(self, include_pac, pa_data_create=True): >- #KERB-PA-PAC-REQUEST ::= SEQUENCE { >- # include-pac[0] BOOLEAN --If TRUE, and no pac present, include PAC. >- # --If FALSE, and PAC present, remove PAC >- #} >+ # KERB-PA-PAC-REQUEST ::= SEQUENCE { >+ # include-pac[0] BOOLEAN --If TRUE, and no pac present, >+ # -- include PAC. >+ # --If FALSE, and PAC present, >+ # -- remove PAC. >+ # } > KERB_PA_PAC_REQUEST_obj = { > 'include-pac': include_pac, > } >@@ -1031,7 +1046,7 @@ class RawKerberosTest(TestCaseInTempDir): > return KERB_PA_PAC_REQUEST_obj > pa_pac = self.der_encode(KERB_PA_PAC_REQUEST_obj, > asn1Spec=krb5_asn1.KERB_PA_PAC_REQUEST()) >- pa_data = self.PA_DATA_create(128, pa_pac) # PA-PAC-REQUEST >+ pa_data = self.PA_DATA_create(128, pa_pac) # PA-PAC-REQUEST > return pa_data > > def KDC_REQ_BODY_create(self, >@@ -1327,11 +1342,14 @@ class RawKerberosTest(TestCaseInTempDir): > EncAuthorizationData=EncAuthorizationData, > EncAuthorizationData_key=EncAuthorizationData_key, > additional_tickets=additional_tickets) >- req_body_blob = self.der_encode(req_body, asn1Spec=krb5_asn1.KDC_REQ_BODY(), >+ req_body_blob = self.der_encode(req_body, >+ asn1Spec=krb5_asn1.KDC_REQ_BODY(), > asn1_print=asn1_print, hexdump=hexdump) > >- req_body_checksum = self.Checksum_create( >- ticket_session_key, 6, req_body_blob, ctype=body_checksum_type) >+ req_body_checksum = self.Checksum_create(ticket_session_key, >+ 6, >+ req_body_blob, >+ ctype=body_checksum_type) > > subkey_obj = None > if authenticator_subkey is not None: >@@ -1390,7 +1408,10 @@ class RawKerberosTest(TestCaseInTempDir): > cksum_data += n.encode() > cksum_data += realm.encode() > cksum_data += "Kerberos".encode() >- cksum = self.Checksum_create(tgt_session_key, 17, cksum_data, ctype) >+ cksum = self.Checksum_create(tgt_session_key, >+ 17, >+ cksum_data, >+ ctype) > > PA_S4U2Self_obj = { > 'name': name, >@@ -1403,20 +1424,20 @@ class RawKerberosTest(TestCaseInTempDir): > return self.PA_DATA_create(129, pa_s4u2self) > > def _generic_kdc_exchange(self, >- kdc_exchange_dict, # required >- kdc_options=None, # required >- cname=None, # optional >- realm=None, # required >- sname=None, # optional >- from_time=None, # optional >- till_time=None, # required >- renew_time=None, # optional >- nonce=None, # required >- etypes=None, # required >- addresses=None, # optional >- EncAuthorizationData=None, # optional >- EncAuthorizationData_key=None, # optional >- additional_tickets=None): # optional >+ kdc_exchange_dict, # required >+ kdc_options=None, # required >+ cname=None, # optional >+ realm=None, # required >+ sname=None, # optional >+ from_time=None, # optional >+ till_time=None, # required >+ renew_time=None, # optional >+ nonce=None, # required >+ etypes=None, # required >+ addresses=None, # optional >+ EncAuthorizationData=None, # optional >+ EncAuthorizationData_key=None, # optional >+ additional_tickets=None): # optional > > check_error_fn = kdc_exchange_dict['check_error_fn'] > check_rep_fn = kdc_exchange_dict['check_rep_fn'] >@@ -1431,19 +1452,20 @@ class RawKerberosTest(TestCaseInTempDir): > if nonce is None: > nonce = self.get_Nonce() > >- req_body = self.KDC_REQ_BODY_create(kdc_options=kdc_options, >- cname=cname, >- realm=realm, >- sname=sname, >- from_time=from_time, >- till_time=till_time, >- renew_time=renew_time, >- nonce=nonce, >- etypes=etypes, >- addresses=addresses, >- EncAuthorizationData=EncAuthorizationData, >- EncAuthorizationData_key=EncAuthorizationData_key, >- additional_tickets=additional_tickets) >+ req_body = self.KDC_REQ_BODY_create( >+ kdc_options=kdc_options, >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ from_time=from_time, >+ till_time=till_time, >+ renew_time=renew_time, >+ nonce=nonce, >+ etypes=etypes, >+ addresses=addresses, >+ EncAuthorizationData=EncAuthorizationData, >+ EncAuthorizationData_key=EncAuthorizationData_key, >+ additional_tickets=additional_tickets) > if generate_padata_fn is not None: > # This can alter req_body... > padata, req_body = generate_padata_fn(kdc_exchange_dict, >@@ -1455,10 +1477,10 @@ class RawKerberosTest(TestCaseInTempDir): > kdc_exchange_dict['req_padata'] = padata > kdc_exchange_dict['req_body'] = req_body > >- req_obj,req_decoded = self.KDC_REQ_create(msg_type=req_msg_type, >- padata=padata, >- req_body=req_body, >- asn1Spec=req_asn1Spec()) >+ req_obj, req_decoded = self.KDC_REQ_create(msg_type=req_msg_type, >+ padata=padata, >+ req_body=req_body, >+ asn1Spec=req_asn1Spec()) > > rep = self.send_recv_transaction(req_decoded) > self.assertIsNotNone(rep) >@@ -1571,7 +1593,7 @@ class RawKerberosTest(TestCaseInTempDir): > rep_encpart_asn1Spec = kdc_exchange_dict['rep_encpart_asn1Spec'] > msg_type = kdc_exchange_dict['rep_msg_type'] > >- self.assertElementEqual(rep, 'msg-type', msg_type) # AS-REP | TGS-REP >+ self.assertElementEqual(rep, 'msg-type', msg_type) # AS-REP | TGS-REP > padata = self.getElementValue(rep, 'padata') > self.assertElementEqualUTF8(rep, 'crealm', expected_crealm) > self.assertElementEqualPrincipal(rep, 'cname', expected_cname) >@@ -1579,22 +1601,23 @@ class RawKerberosTest(TestCaseInTempDir): > ticket = self.getElementValue(rep, 'ticket') > ticket_encpart = None > ticket_cipher = None >- if ticket is not None: # Never None, but gives indentation >+ if ticket is not None: # Never None, but gives indentation > self.assertElementPresent(ticket, 'tkt-vno') > self.assertElementEqualUTF8(ticket, 'realm', expected_srealm) > self.assertElementEqualPrincipal(ticket, 'sname', expected_sname) > self.assertElementPresent(ticket, 'enc-part') > ticket_encpart = self.getElementValue(ticket, 'enc-part') >- if ticket_encpart is not None: # Never None, but gives indentation >+ if ticket_encpart is not None: # Never None, but gives indentation > self.assertElementPresent(ticket_encpart, 'etype') > # 'unspecified' means present, with any value != 0 >- self.assertElementKVNO(ticket_encpart, 'kvno', self.unspecified_kvno) >+ self.assertElementKVNO(ticket_encpart, 'kvno', >+ self.unspecified_kvno) > self.assertElementPresent(ticket_encpart, 'cipher') > ticket_cipher = self.getElementValue(ticket_encpart, 'cipher') > self.assertElementPresent(rep, 'enc-part') > encpart = self.getElementValue(rep, 'enc-part') > encpart_cipher = None >- if encpart is not None: # Never None, but gives indentation >+ if encpart is not None: # Never None, but gives indentation > self.assertElementPresent(encpart, 'etype') > self.assertElementKVNO(ticket_encpart, 'kvno', 'autodetect') > self.assertElementPresent(encpart, 'cipher') >@@ -1602,24 +1625,35 @@ class RawKerberosTest(TestCaseInTempDir): > > encpart_decryption_key = None > if check_padata_fn is not None: >- # See if get the decryption key from the preauth phase >- encpart_decryption_key,encpart_decryption_usage = \ >- check_padata_fn(kdc_exchange_dict, callback_dict, >- rep, padata) >+ # See if we can get the decryption key from the preauth phase >+ encpart_decryption_key, encpart_decryption_usage = ( >+ check_padata_fn(kdc_exchange_dict, callback_dict, >+ rep, padata)) > > ticket_private = None > if ticket_decryption_key is not None: >- self.assertElementEqual(ticket_encpart, 'etype', ticket_decryption_key.etype) >- self.assertElementKVNO(ticket_encpart, 'kvno', ticket_decryption_key.kvno) >- ticket_decpart = ticket_decryption_key.decrypt(KU_TICKET, ticket_cipher) >- ticket_private = self.der_decode(ticket_decpart, asn1Spec=krb5_asn1.EncTicketPart()) >+ self.assertElementEqual(ticket_encpart, 'etype', >+ ticket_decryption_key.etype) >+ self.assertElementKVNO(ticket_encpart, 'kvno', >+ ticket_decryption_key.kvno) >+ ticket_decpart = ticket_decryption_key.decrypt(KU_TICKET, >+ ticket_cipher) >+ ticket_private = self.der_decode( >+ ticket_decpart, >+ asn1Spec=krb5_asn1.EncTicketPart()) > > encpart_private = None > if encpart_decryption_key is not None: >- self.assertElementEqual(encpart, 'etype', encpart_decryption_key.etype) >- self.assertElementKVNO(encpart, 'kvno', encpart_decryption_key.kvno) >- rep_decpart = encpart_decryption_key.decrypt(encpart_decryption_usage, encpart_cipher) >- encpart_private = self.der_decode(rep_decpart, asn1Spec=rep_encpart_asn1Spec()) >+ self.assertElementEqual(encpart, 'etype', >+ encpart_decryption_key.etype) >+ self.assertElementKVNO(encpart, 'kvno', >+ encpart_decryption_key.kvno) >+ rep_decpart = encpart_decryption_key.decrypt( >+ encpart_decryption_usage, >+ encpart_cipher) >+ encpart_private = self.der_decode( >+ rep_decpart, >+ asn1Spec=rep_encpart_asn1Spec()) > > if check_kdc_private_fn is not None: > check_kdc_private_fn(kdc_exchange_dict, callback_dict, >@@ -1647,12 +1681,14 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementPresent(ticket_private, 'flags') > self.assertElementPresent(ticket_private, 'key') > ticket_key = self.getElementValue(ticket_private, 'key') >- if ticket_key is not None: # Never None, but gives indentation >+ if ticket_key is not None: # Never None, but gives indentation > self.assertElementPresent(ticket_key, 'keytype') > self.assertElementPresent(ticket_key, 'keyvalue') > ticket_session_key = self.EncryptionKey_import(ticket_key) >- self.assertElementEqualUTF8(ticket_private, 'crealm', expected_crealm) >- self.assertElementEqualPrincipal(ticket_private, 'cname', expected_cname) >+ self.assertElementEqualUTF8(ticket_private, 'crealm', >+ expected_crealm) >+ self.assertElementEqualPrincipal(ticket_private, 'cname', >+ expected_cname) > self.assertElementPresent(ticket_private, 'transited') > self.assertElementPresent(ticket_private, 'authtime') > if self.strict_checking: >@@ -1666,39 +1702,45 @@ class RawKerberosTest(TestCaseInTempDir): > if encpart_private is not None: > self.assertElementPresent(encpart_private, 'key') > encpart_key = self.getElementValue(encpart_private, 'key') >- if encpart_key is not None: # Never None, but gives indentation >+ if encpart_key is not None: # Never None, but gives indentation > self.assertElementPresent(encpart_key, 'keytype') > self.assertElementPresent(encpart_key, 'keyvalue') > encpart_session_key = self.EncryptionKey_import(encpart_key) > self.assertElementPresent(encpart_private, 'last-req') > self.assertElementPresent(encpart_private, 'nonce') >- # TODO self.assertElementPresent(encpart_private, 'key-expiration') >+ # TODO self.assertElementPresent(encpart_private, >+ # 'key-expiration') > self.assertElementPresent(encpart_private, 'flags') > self.assertElementPresent(encpart_private, 'authtime') > if self.strict_checking: > self.assertElementPresent(encpart_private, 'starttime') > self.assertElementPresent(encpart_private, 'endtime') > # TODO self.assertElementPresent(encpart_private, 'renew-till') >- self.assertElementEqualUTF8(encpart_private, 'srealm', expected_srealm) >- self.assertElementEqualPrincipal(encpart_private, 'sname', expected_sname) >+ self.assertElementEqualUTF8(encpart_private, 'srealm', >+ expected_srealm) >+ self.assertElementEqualPrincipal(encpart_private, 'sname', >+ expected_sname) > # TODO self.assertElementMissing(encpart_private, 'caddr') > > if ticket_session_key is not None and encpart_session_key is not None: >- self.assertEqual(ticket_session_key.etype, encpart_session_key.etype) >- self.assertEqual(ticket_session_key.key.contents, encpart_session_key.key.contents) >+ self.assertEqual(ticket_session_key.etype, >+ encpart_session_key.etype) >+ self.assertEqual(ticket_session_key.key.contents, >+ encpart_session_key.key.contents) > if encpart_session_key is not None: > session_key = encpart_session_key > else: > session_key = ticket_session_key >- ticket_creds = KerberosTicketCreds(ticket, >- session_key, >- crealm=expected_crealm, >- cname=expected_cname, >- srealm=expected_srealm, >- sname=expected_sname, >- decryption_key=ticket_decryption_key, >- ticket_private=ticket_private, >- encpart_private=encpart_private) >+ ticket_creds = KerberosTicketCreds( >+ ticket, >+ session_key, >+ crealm=expected_crealm, >+ cname=expected_cname, >+ srealm=expected_srealm, >+ sname=expected_sname, >+ decryption_key=ticket_decryption_key, >+ ticket_private=ticket_private, >+ encpart_private=encpart_private) > > kdc_exchange_dict['rep_ticket_creds'] = ticket_creds > return >@@ -1728,11 +1770,11 @@ class RawKerberosTest(TestCaseInTempDir): > if kcrypto.Enctype.RC4 in proposed_etypes: > expect_etype_info = True > for etype in proposed_etypes: >- if etype in (kcrypto.Enctype.AES256,kcrypto.Enctype.AES128): >+ if etype in (kcrypto.Enctype.AES256, kcrypto.Enctype.AES128): > expect_etype_info = False > if etype not in client_as_etypes: > continue >- if etype in (kcrypto.Enctype.AES256,kcrypto.Enctype.AES128): >+ if etype in (kcrypto.Enctype.AES256, kcrypto.Enctype.AES128): > if etype > expected_aes_type: > expected_aes_type = etype > if etype in (kcrypto.Enctype.RC4,): >@@ -1779,14 +1821,17 @@ class RawKerberosTest(TestCaseInTempDir): > if self.strict_checking: > self.assertIsNotNone(edata) > if edata is not None: >- rep_padata = self.der_decode(edata, asn1Spec=krb5_asn1.METHOD_DATA()) >+ rep_padata = self.der_decode(edata, >+ asn1Spec=krb5_asn1.METHOD_DATA()) > self.assertGreater(len(rep_padata), 0) > else: > rep_padata = [] > > if self.strict_checking: > for i in range(0, len(expected_patypes)): >- self.assertElementEqual(rep_padata[i], 'padata-type', expected_patypes[i]) >+ self.assertElementEqual(rep_padata[i], >+ 'padata-type', >+ expected_patypes[i]) > self.assertEqual(len(rep_padata), len(expected_patypes)) > > etype_info2 = None >@@ -1799,11 +1844,13 @@ class RawKerberosTest(TestCaseInTempDir): > pavalue = self.getElementValue(pa, 'padata-value') > if patype == PADATA_ETYPE_INFO2: > self.assertIsNone(etype_info2) >- etype_info2 = self.der_decode(pavalue, asn1Spec=krb5_asn1.ETYPE_INFO2()) >+ etype_info2 = self.der_decode(pavalue, >+ asn1Spec=krb5_asn1.ETYPE_INFO2()) > continue > if patype == PADATA_ETYPE_INFO: > self.assertIsNone(etype_info) >- etype_info = self.der_decode(pavalue, asn1Spec=krb5_asn1.ETYPE_INFO()) >+ etype_info = self.der_decode(pavalue, >+ asn1Spec=krb5_asn1.ETYPE_INFO()) > continue > if patype == PADATA_ENC_TIMESTAMP: > self.assertIsNone(enc_timestamp) >@@ -1881,7 +1928,8 @@ class RawKerberosTest(TestCaseInTempDir): > authenticator_subkey = kdc_exchange_dict['authenticator_subkey'] > body_checksum_type = kdc_exchange_dict['body_checksum_type'] > >- req_body_blob = self.der_encode(req_body, asn1Spec=krb5_asn1.KDC_REQ_BODY()) >+ req_body_blob = self.der_encode(req_body, >+ asn1Spec=krb5_asn1.KDC_REQ_BODY()) > > req_body_checksum = self.Checksum_create(tgt.session_key, > KU_TGS_REQ_AUTH_CKSUM, >@@ -1893,15 +1941,18 @@ class RawKerberosTest(TestCaseInTempDir): > subkey_obj = authenticator_subkey.export_obj() > seq_number = random.randint(0, 0xfffffffe) > (ctime, cusec) = self.get_KerberosTimeWithUsec() >- authenticator_obj = self.Authenticator_create(crealm=tgt.crealm, >- cname=tgt.cname, >- cksum=req_body_checksum, >- cusec=cusec, >- ctime=ctime, >- subkey=subkey_obj, >- seq_number=seq_number, >- authorization_data=None) >- authenticator_blob = self.der_encode(authenticator_obj, asn1Spec=krb5_asn1.Authenticator()) >+ authenticator_obj = self.Authenticator_create( >+ crealm=tgt.crealm, >+ cname=tgt.cname, >+ cksum=req_body_checksum, >+ cusec=cusec, >+ ctime=ctime, >+ subkey=subkey_obj, >+ seq_number=seq_number, >+ authorization_data=None) >+ authenticator_blob = self.der_encode( >+ authenticator_obj, >+ asn1Spec=krb5_asn1.Authenticator()) > > authenticator = self.EncryptedData_create(tgt.session_key, > KU_TGS_REQ_AUTH, >@@ -1909,8 +1960,8 @@ class RawKerberosTest(TestCaseInTempDir): > > ap_options = krb5_asn1.APOptions('0') > ap_req_obj = self.AP_REQ_create(ap_options=str(ap_options), >- ticket=tgt.ticket, >- authenticator=authenticator) >+ ticket=tgt.ticket, >+ authenticator=authenticator) > ap_req = self.der_encode(ap_req_obj, asn1Spec=krb5_asn1.AP_REQ()) > pa_tgs_req = self.PA_DATA_create(PADATA_KDC_REQ, ap_req) > padata = [pa_tgs_req] >@@ -1964,19 +2015,19 @@ class RawKerberosTest(TestCaseInTempDir): > return preauth_key, as_rep_usage > > kdc_exchange_dict = self.as_exchange_dict( >- expected_crealm=expected_crealm, >- expected_cname=expected_cname, >- expected_srealm=expected_srealm, >- expected_sname=expected_sname, >- ticket_decryption_key=ticket_decryption_key, >- generate_padata_fn=_generate_padata_copy, >- check_error_fn=self.generic_check_as_error, >- check_rep_fn=self.generic_check_kdc_rep, >- check_padata_fn=_check_padata_preauth_key, >- check_kdc_private_fn=self.generic_check_kdc_private, >- expected_error_mode=expected_error_mode, >- client_as_etypes=client_as_etypes, >- expected_salt=expected_salt) >+ expected_crealm=expected_crealm, >+ expected_cname=expected_cname, >+ expected_srealm=expected_srealm, >+ expected_sname=expected_sname, >+ ticket_decryption_key=ticket_decryption_key, >+ generate_padata_fn=_generate_padata_copy, >+ check_error_fn=self.generic_check_as_error, >+ check_rep_fn=self.generic_check_kdc_rep, >+ check_padata_fn=_check_padata_preauth_key, >+ check_kdc_private_fn=self.generic_check_kdc_private, >+ expected_error_mode=expected_error_mode, >+ client_as_etypes=client_as_etypes, >+ expected_salt=expected_salt) > > rep = self._generic_kdc_exchange(kdc_exchange_dict, > kdc_options=str(kdc_options), >@@ -1986,7 +2037,7 @@ class RawKerberosTest(TestCaseInTempDir): > till_time=till, > etypes=etypes) > >- if expected_error_mode == 0: # AS-REP >+ if expected_error_mode == 0: # AS-REP > return rep > > return kdc_exchange_dict['preauth_etype_info2'] >-- >2.25.1 > > >From cb33cb52d930054f68f23102c7236efff77ddea8 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 2 Aug 2021 17:01:39 +1200 >Subject: [PATCH 131/380] tests/krb5: Remove unneeded statements > >A return statement is redundant as the last statement in a method, as >methods will otherwise return None. Also, code blocks consisting of a >single 'pass' statement can be safely omitted. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 1320ac0f91a9b0fc8156840ec498059ee10b5a2d) >--- > python/samba/tests/krb5/as_req_tests.py | 2 - > python/samba/tests/krb5/raw_testcase.py | 99 +++++++++---------------- > 2 files changed, 33 insertions(+), 68 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 09cfc9e1fc8..106c7489e9c 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -46,7 +46,6 @@ class AsReqKerberosTests(KDCBaseTest): > tname = "%s_pac_%s" % (name, pac) > targs = (idx, pac) > cls.generate_dynamic_test("test_as_req_no_preauth", tname, *targs) >- return > > def setUp(self): > super(AsReqKerberosTests, self).setUp() >@@ -197,7 +196,6 @@ class AsReqKerberosTests(KDCBaseTest): > preauth_key=preauth_key, > ticket_decryption_key=krbtgt_decryption_key) > self.assertIsNotNone(as_rep) >- return > > if __name__ == "__main__": > global_asn1_print = True >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index de9c25751d2..34eae177882 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -195,7 +195,6 @@ class Krb5EncryptionKey(object): > self.etype = key.enctype > self.ctype = EncTypeChecksum[self.etype] > self.kvno = kvno >- return > > def encrypt(self, usage, plaintext): > ciphertext = kcrypto.encrypt(self.key, usage, plaintext) >@@ -235,19 +234,15 @@ class KerberosCredentials(Credentials): > self.forced_keys = {} > > self.forced_salt = None >- return > > def set_as_supported_enctypes(self, value): > self.as_supported_enctypes = int(value) >- return > > def set_tgs_supported_enctypes(self, value): > self.tgs_supported_enctypes = int(value) >- return > > def set_ap_supported_enctypes(self, value): > self.ap_supported_enctypes = int(value) >- return > > def _get_krb5_etypes(self, supported_enctypes): > etypes = () >@@ -290,7 +285,6 @@ class KerberosCredentials(Credentials): > > def set_forced_salt(self, salt): > self.forced_salt = bytes(salt) >- return > > def get_forced_salt(self): > return self.forced_salt >@@ -312,7 +306,6 @@ class KerberosTicketCreds(object): > self.decryption_key = decryption_key > self.ticket_private = ticket_private > self.encpart_private = encpart_private >- return > > > class RawKerberosTest(TestCaseInTempDir): >@@ -358,7 +351,6 @@ class RawKerberosTest(TestCaseInTempDir): > > cls.etype_test_permutations = res > cls.setup_etype_test_permutations_done = True >- return > > @classmethod > def etype_test_permutation_name_idx(cls): >@@ -427,17 +419,12 @@ class RawKerberosTest(TestCaseInTempDir): > except IOError: > self.s.close() > raise >- except Exception: >- raise >- finally: >- pass > > def connect(self): > self.assertNotConnected() > self._connect_tcp() > if self.do_hexdump: > sys.stderr.write("connected[%s]\n" % self.host) >- return > > def env_get_var(self, varname, prefix, > fallback_default=True, >@@ -704,8 +691,6 @@ class RawKerberosTest(TestCaseInTempDir): > except IOError as e: > self._disconnect("send_pdu: %s" % e) > raise >- finally: >- pass > > def recv_raw(self, num_recv=0xffff, hexdump=None, timeout=None): > rep_pdu = None >@@ -721,57 +706,51 @@ class RawKerberosTest(TestCaseInTempDir): > except socket.timeout: > self.s.settimeout(10) > sys.stderr.write("recv_raw: TIMEOUT\n") >- pass > except socket.error as e: > self._disconnect("recv_raw: %s" % e) > raise > except IOError as e: > self._disconnect("recv_raw: %s" % e) > raise >- finally: >- pass > return rep_pdu > > def recv_pdu_raw(self, asn1_print=None, hexdump=None, timeout=None): > rep_pdu = None > rep = None >- try: >+ raw_pdu = self.recv_raw( >+ num_recv=4, hexdump=hexdump, timeout=timeout) >+ if raw_pdu is None: >+ return (None, None) >+ header = struct.unpack(">I", raw_pdu[0:4]) >+ k5_len = header[0] >+ if k5_len == 0: >+ return (None, "") >+ missing = k5_len >+ rep_pdu = b'' >+ while missing > 0: > raw_pdu = self.recv_raw( >- num_recv=4, hexdump=hexdump, timeout=timeout) >- if raw_pdu is None: >- return (None, None) >- header = struct.unpack(">I", raw_pdu[0:4]) >- k5_len = header[0] >- if k5_len == 0: >- return (None, "") >- missing = k5_len >- rep_pdu = b'' >- while missing > 0: >- raw_pdu = self.recv_raw( >- num_recv=missing, hexdump=hexdump, timeout=timeout) >- self.assertGreaterEqual(len(raw_pdu), 1) >- rep_pdu += raw_pdu >- missing = k5_len - len(rep_pdu) >- k5_raw = self.der_decode( >- rep_pdu, >- asn1Spec=None, >- native_encode=False, >- asn1_print=False, >- hexdump=False) >- pvno = k5_raw['field-0'] >- self.assertEqual(pvno, 5) >- msg_type = k5_raw['field-1'] >- self.assertIn(msg_type, [11, 13, 30]) >- if msg_type == 11: >- asn1Spec = krb5_asn1.AS_REP() >- elif msg_type == 13: >- asn1Spec = krb5_asn1.TGS_REP() >- elif msg_type == 30: >- asn1Spec = krb5_asn1.KRB_ERROR() >- rep = self.der_decode(rep_pdu, asn1Spec=asn1Spec, >- asn1_print=asn1_print, hexdump=False) >- finally: >- pass >+ num_recv=missing, hexdump=hexdump, timeout=timeout) >+ self.assertGreaterEqual(len(raw_pdu), 1) >+ rep_pdu += raw_pdu >+ missing = k5_len - len(rep_pdu) >+ k5_raw = self.der_decode( >+ rep_pdu, >+ asn1Spec=None, >+ native_encode=False, >+ asn1_print=False, >+ hexdump=False) >+ pvno = k5_raw['field-0'] >+ self.assertEqual(pvno, 5) >+ msg_type = k5_raw['field-1'] >+ self.assertIn(msg_type, [11, 13, 30]) >+ if msg_type == 11: >+ asn1Spec = krb5_asn1.AS_REP() >+ elif msg_type == 13: >+ asn1Spec = krb5_asn1.TGS_REP() >+ elif msg_type == 30: >+ asn1Spec = krb5_asn1.KRB_ERROR() >+ rep = self.der_decode(rep_pdu, asn1Spec=asn1Spec, >+ asn1_print=asn1_print, hexdump=False) > return (rep, rep_pdu) > > def recv_pdu(self, asn1_print=None, hexdump=None, timeout=None): >@@ -782,11 +761,9 @@ class RawKerberosTest(TestCaseInTempDir): > > def assertIsConnected(self): > self.assertIsNotNone(self.s, msg="Not connected") >- return > > def assertNotConnected(self): > self.assertIsNone(self.s, msg="Is connected") >- return > > def send_recv_transaction( > self, >@@ -807,11 +784,9 @@ class RawKerberosTest(TestCaseInTempDir): > > def assertNoValue(self, value): > self.assertTrue(value.isNoValue) >- return > > def assertHasValue(self, value): > self.assertIsNotNone(value) >- return > > def getElementValue(self, obj, elem): > v = None >@@ -824,24 +799,20 @@ class RawKerberosTest(TestCaseInTempDir): > def assertElementMissing(self, obj, elem): > v = self.getElementValue(obj, elem) > self.assertIsNone(v) >- return > > def assertElementPresent(self, obj, elem): > v = self.getElementValue(obj, elem) > self.assertIsNotNone(v) >- return > > def assertElementEqual(self, obj, elem, value): > v = self.getElementValue(obj, elem) > self.assertIsNotNone(v) > self.assertEqual(v, value) >- return > > def assertElementEqualUTF8(self, obj, elem, value): > v = self.getElementValue(obj, elem) > self.assertIsNotNone(v) > self.assertEqual(v, bytes(value, 'utf8')) >- return > > def assertPrincipalEqual(self, princ1, princ2): > self.assertEqual(princ1['name-type'], princ2['name-type']) >@@ -854,14 +825,12 @@ class RawKerberosTest(TestCaseInTempDir): > princ1['name-string'][idx], > princ2['name-string'][idx], > msg="princ1=%s != princ2=%s" % (princ1, princ2)) >- return > > def assertElementEqualPrincipal(self, obj, elem, value): > v = self.getElementValue(obj, elem) > self.assertIsNotNone(v) > v = pyasn1_native_decode(v, asn1Spec=krb5_asn1.PrincipalName()) > self.assertPrincipalEqual(v, value) >- return > > def assertElementKVNO(self, obj, elem, value): > v = self.getElementValue(obj, elem) >@@ -879,7 +848,6 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertEqual(v, value) > else: > self.assertIsNone(v) >- return > > def get_KerberosTimeWithUsec(self, epoch=None, offset=None): > if epoch is None: >@@ -1743,7 +1711,6 @@ class RawKerberosTest(TestCaseInTempDir): > encpart_private=encpart_private) > > kdc_exchange_dict['rep_ticket_creds'] = ticket_creds >- return > > def generic_check_as_error(self, > kdc_exchange_dict, >-- >2.25.1 > > >From 6df8a91d59f89d1b8dce5fca6c8d3f5fab778f93 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 2 Aug 2021 17:10:32 +1200 >Subject: [PATCH 132/380] tests/krb5: Use more compact dict lookup > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 38b3a361819c716adb773fb3b4507c28d7d26c0d) >--- > python/samba/tests/krb5/kdc_base_test.py | 5 +---- > python/samba/tests/krb5/raw_testcase.py | 18 ++++-------------- > 2 files changed, 5 insertions(+), 18 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index c23c71e1d74..79efc68254e 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -722,10 +722,7 @@ class KDCBaseTest(RawKerberosTest): > ticket_data = self.der_encode(ticket, asn1Spec=krb5_asn1.Ticket()) > > authtime = enc_part['authtime'] >- try: >- starttime = enc_part['starttime'] >- except KeyError: >- starttime = authtime >+ starttime = enc_part.get('starttime', authtime) > endtime = enc_part['endtime'] > > cred = krb5ccache.CREDENTIAL() >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 34eae177882..15bbd9ec999 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -279,9 +279,7 @@ class KerberosCredentials(Credentials): > > def get_forced_key(self, etype): > etype = int(etype) >- if etype in self.forced_keys: >- return self.forced_keys[etype] >- return None >+ return self.forced_keys.get(etype, None) > > def set_forced_salt(self, salt): > self.forced_salt = bytes(salt) >@@ -789,12 +787,7 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(value) > > def getElementValue(self, obj, elem): >- v = None >- try: >- v = obj[elem] >- except KeyError: >- pass >- return v >+ return obj.get(elem, None) > > def assertElementMissing(self, obj, elem): > v = self.getElementValue(obj, elem) >@@ -879,11 +872,8 @@ class RawKerberosTest(TestCaseInTempDir): > > def PasswordKey_from_etype_info2(self, creds, etype_info2, kvno=None): > e = etype_info2['etype'] >- salt = None >- try: >- salt = etype_info2['salt'] >- except Exception: >- pass >+ >+ salt = etype_info2.get('salt', None) > > if e == kcrypto.Enctype.RC4: > nthash = creds.get_nt_hash() >-- >2.25.1 > > >From fee1632b6ce52e62a7500af3985713e6a0b5a876 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 3 Aug 2021 15:03:00 +1200 >Subject: [PATCH 133/380] tests/krb5: Simplify Python syntax > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 41c3e410344280d691e5a21fa5240ef52e71bd2d) >--- > python/samba/tests/krb5/raw_testcase.py | 12 +++++------- > 1 file changed, 5 insertions(+), 7 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 15bbd9ec999..31731a6547c 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -184,7 +184,7 @@ krb5_asn1.KerbErrorDataType.prettyPrint =\ > Integer_NamedValues_prettyPrint > > >-class Krb5EncryptionKey(object): >+class Krb5EncryptionKey: > def __init__(self, key, kvno): > EncTypeChecksum = { > kcrypto.Enctype.AES256: kcrypto.Cksumtype.SHA1_AES256, >@@ -288,7 +288,7 @@ class KerberosCredentials(Credentials): > return self.forced_salt > > >-class KerberosTicketCreds(object): >+class KerberosTicketCreds: > def __init__(self, ticket, session_key, > crealm=None, cname=None, > srealm=None, sname=None, >@@ -956,7 +956,7 @@ class RawKerberosTest(TestCaseInTempDir): > return Checksum_obj > > @classmethod >- def PrincipalName_create(self, name_type, names): >+ def PrincipalName_create(cls, name_type, names): > # PrincipalName ::= SEQUENCE { > # name-type [0] Int32, > # name-string [1] SEQUENCE OF KerberosString >@@ -1785,10 +1785,8 @@ class RawKerberosTest(TestCaseInTempDir): > rep_padata = [] > > if self.strict_checking: >- for i in range(0, len(expected_patypes)): >- self.assertElementEqual(rep_padata[i], >- 'padata-type', >- expected_patypes[i]) >+ for i, patype in enumerate(expected_patypes): >+ self.assertElementEqual(rep_padata[i], 'padata-type', patype) > self.assertEqual(len(rep_padata), len(expected_patypes)) > > etype_info2 = None >-- >2.25.1 > > >From 7619178cc86d700ca53dab5c3355cd0dd600a5d6 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 13:49:27 +1200 >Subject: [PATCH 134/380] tests/krb5: Remove magic constants > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit a2b183c179e74634438c85a4b35518836ba59e47) >--- > python/samba/tests/krb5/raw_testcase.py | 30 +++++++++++--------- > python/samba/tests/krb5/rfc4120_constants.py | 7 +++++ > 2 files changed, 24 insertions(+), 13 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 31731a6547c..dfa6a71467a 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -41,12 +41,14 @@ import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( > KDC_ERR_ETYPE_NOSUPP, > KDC_ERR_PREAUTH_REQUIRED, >+ KRB_AP_REQ, > KRB_AS_REP, > KRB_AS_REQ, > KRB_ERROR, > KRB_TGS_REP, > KRB_TGS_REQ, > KU_AS_REP_ENC_PART, >+ KU_NON_KERB_CKSUM_SALT, > KU_TGS_REP_ENC_PART_SESSION, > KU_TGS_REP_ENC_PART_SUB_KEY, > KU_TGS_REQ_AUTH, >@@ -55,7 +57,9 @@ from samba.tests.krb5.rfc4120_constants import ( > PADATA_ENC_TIMESTAMP, > PADATA_ETYPE_INFO, > PADATA_ETYPE_INFO2, >+ PADATA_FOR_USER, > PADATA_KDC_REQ, >+ PADATA_PAC_REQUEST, > PADATA_PK_AS_REQ, > PADATA_PK_AS_REP_19 > ) >@@ -740,12 +744,12 @@ class RawKerberosTest(TestCaseInTempDir): > pvno = k5_raw['field-0'] > self.assertEqual(pvno, 5) > msg_type = k5_raw['field-1'] >- self.assertIn(msg_type, [11, 13, 30]) >- if msg_type == 11: >+ self.assertIn(msg_type, [KRB_AS_REP, KRB_TGS_REP, KRB_ERROR]) >+ if msg_type == KRB_AS_REP: > asn1Spec = krb5_asn1.AS_REP() >- elif msg_type == 13: >+ elif msg_type == KRB_TGS_REP: > asn1Spec = krb5_asn1.TGS_REP() >- elif msg_type == 30: >+ elif msg_type == KRB_ERROR: > asn1Spec = krb5_asn1.KRB_ERROR() > rep = self.der_decode(rep_pdu, asn1Spec=asn1Spec, > asn1_print=asn1_print, hexdump=False) >@@ -1004,7 +1008,7 @@ class RawKerberosTest(TestCaseInTempDir): > return KERB_PA_PAC_REQUEST_obj > pa_pac = self.der_encode(KERB_PA_PAC_REQUEST_obj, > asn1Spec=krb5_asn1.KERB_PA_PAC_REQUEST()) >- pa_data = self.PA_DATA_create(128, pa_pac) # PA-PAC-REQUEST >+ pa_data = self.PA_DATA_create(PADATA_PAC_REQUEST, pa_pac) > return pa_data > > def KDC_REQ_BODY_create(self, >@@ -1172,7 +1176,7 @@ class RawKerberosTest(TestCaseInTempDir): > asn1_print=asn1_print, > hexdump=hexdump) > obj, decoded = self.KDC_REQ_create( >- msg_type=10, >+ msg_type=KRB_AS_REQ, > padata=padata, > req_body=KDC_REQ_BODY_obj, > asn1Spec=krb5_asn1.AS_REQ(), >@@ -1192,7 +1196,7 @@ class RawKerberosTest(TestCaseInTempDir): > # } > AP_REQ_obj = { > 'pvno': 5, >- 'msg-type': 14, >+ 'msg-type': KRB_AP_REQ, > 'ap-options': ap_options, > 'ticket': ticket, > 'authenticator': authenticator, >@@ -1305,7 +1309,7 @@ class RawKerberosTest(TestCaseInTempDir): > asn1_print=asn1_print, hexdump=hexdump) > > req_body_checksum = self.Checksum_create(ticket_session_key, >- 6, >+ KU_TGS_REQ_AUTH_CKSUM, > req_body_blob, > ctype=body_checksum_type) > >@@ -1329,7 +1333,7 @@ class RawKerberosTest(TestCaseInTempDir): > hexdump=hexdump) > > authenticator = self.EncryptedData_create( >- ticket_session_key, 7, authenticator) >+ ticket_session_key, KU_TGS_REQ_AUTH, authenticator) > > ap_options = krb5_asn1.APOptions('0') > ap_req = self.AP_REQ_create(ap_options=str(ap_options), >@@ -1337,14 +1341,14 @@ class RawKerberosTest(TestCaseInTempDir): > authenticator=authenticator) > ap_req = self.der_encode(ap_req, asn1Spec=krb5_asn1.AP_REQ(), > asn1_print=asn1_print, hexdump=hexdump) >- pa_tgs_req = self.PA_DATA_create(1, ap_req) >+ pa_tgs_req = self.PA_DATA_create(PADATA_KDC_REQ, ap_req) > if padata is not None: > padata.append(pa_tgs_req) > else: > padata = [pa_tgs_req] > > obj, decoded = self.KDC_REQ_create( >- msg_type=12, >+ msg_type=KRB_TGS_REQ, > padata=padata, > req_body=req_body, > asn1Spec=krb5_asn1.TGS_REQ(), >@@ -1367,7 +1371,7 @@ class RawKerberosTest(TestCaseInTempDir): > cksum_data += realm.encode() > cksum_data += "Kerberos".encode() > cksum = self.Checksum_create(tgt_session_key, >- 17, >+ KU_NON_KERB_CKSUM_SALT, > cksum_data, > ctype) > >@@ -1379,7 +1383,7 @@ class RawKerberosTest(TestCaseInTempDir): > } > pa_s4u2self = self.der_encode( > PA_S4U2Self_obj, asn1Spec=krb5_asn1.PA_S4U2Self()) >- return self.PA_DATA_create(129, pa_s4u2self) >+ return self.PA_DATA_create(PADATA_FOR_USER, pa_s4u2self) > > def _generic_kdc_exchange(self, > kdc_exchange_dict, # required >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index a4c5e079b66..adcc93e1d6b 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -27,6 +27,7 @@ ARCFOUR_HMAC_MD5 = int( > > # Message types > KRB_ERROR = int(krb5_asn1.MessageTypeValues('krb-error')) >+KRB_AP_REQ = int(krb5_asn1.MessageTypeValues('krb-ap-req')) > KRB_AS_REP = int(krb5_asn1.MessageTypeValues('krb-as-rep')) > KRB_AS_REQ = int(krb5_asn1.MessageTypeValues('krb-as-req')) > KRB_TGS_REP = int(krb5_asn1.MessageTypeValues('krb-tgs-rep')) >@@ -39,8 +40,12 @@ PADATA_ETYPE_INFO = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-ETYPE-INFO')) > PADATA_ETYPE_INFO2 = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-ETYPE-INFO2')) >+PADATA_FOR_USER = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-FOR-USER')) > PADATA_KDC_REQ = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-KDC-REQ')) >+PADATA_PAC_REQUEST = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-PA-PAC-REQUEST')) > PADATA_PK_AS_REQ = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-PK-AS-REQ')) > PADATA_PK_AS_REP_19 = int( >@@ -125,3 +130,5 @@ KU_KRB_CRED = 14 > KU_KRB_SAFE_CKSUM = 15 > ''' KRB-SAFE cksum, keyed with a key chosen by the application > (section 5.6.1) ''' >+KU_NON_KERB_SALT = 16 >+KU_NON_KERB_CKSUM_SALT = 17 >-- >2.25.1 > > >From 7b51e09e38dd2128e11cf654b8b5446e233d103c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 26 Jul 2021 17:14:08 +1200 >Subject: [PATCH 135/380] tests/krb5: Fix including enc-authorization-data > >Remove the EncAuthorizationData parameters from AS_REQ_create(), since >it should only be present in the TGS-REQ form. Also, fix a call to >EncryptedData_create() to supply the key usage when creating >enc-authorization-data. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 67ff72395cec2e5170c0ebae8db416a1f226df72) >--- > .../tests/krb5/as_canonicalization_tests.py | 4 --- > .../samba/tests/krb5/compatability_tests.py | 4 --- > python/samba/tests/krb5/kdc_base_test.py | 2 -- > python/samba/tests/krb5/kdc_tests.py | 2 -- > python/samba/tests/krb5/raw_testcase.py | 31 +++++++++++++------ > python/samba/tests/krb5/s4u_tests.py | 4 --- > python/samba/tests/krb5/simple_tests.py | 4 --- > python/samba/tests/krb5/xrealm_tests.py | 4 --- > 8 files changed, 21 insertions(+), 34 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index abb3f96a1e6..29d8cf418f5 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -257,8 +257,6 @@ class KerberosASCanonicalizationTests(KDCBaseTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > self.assertIsNotNone(rep) >@@ -314,8 +312,6 @@ class KerberosASCanonicalizationTests(KDCBaseTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > self.assertIsNotNone(rep) >diff --git a/python/samba/tests/krb5/compatability_tests.py b/python/samba/tests/krb5/compatability_tests.py >index 5a1ef02ef80..cd67549212a 100755 >--- a/python/samba/tests/krb5/compatability_tests.py >+++ b/python/samba/tests/krb5/compatability_tests.py >@@ -147,8 +147,6 @@ class SimpleKerberosTests(RawKerberosTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > >@@ -209,8 +207,6 @@ class SimpleKerberosTests(RawKerberosTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > self.assertIsNotNone(rep) >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 79efc68254e..7874562d32d 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -390,8 +390,6 @@ class KDCBaseTest(RawKerberosTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > return rep >diff --git a/python/samba/tests/krb5/kdc_tests.py b/python/samba/tests/krb5/kdc_tests.py >index c7c53953a86..930edd0a63e 100755 >--- a/python/samba/tests/krb5/kdc_tests.py >+++ b/python/samba/tests/krb5/kdc_tests.py >@@ -79,8 +79,6 @@ class KdcTests(RawKerberosTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > return rep >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index dfa6a71467a..f39656d5e03 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -53,6 +53,8 @@ from samba.tests.krb5.rfc4120_constants import ( > KU_TGS_REP_ENC_PART_SUB_KEY, > KU_TGS_REQ_AUTH, > KU_TGS_REQ_AUTH_CKSUM, >+ KU_TGS_REQ_AUTH_DAT_SESSION, >+ KU_TGS_REQ_AUTH_DAT_SUBKEY, > KU_TICKET, > PADATA_ENC_TIMESTAMP, > PADATA_ETYPE_INFO, >@@ -1022,9 +1024,10 @@ class RawKerberosTest(TestCaseInTempDir): > nonce, > etypes, > addresses, >+ additional_tickets, > EncAuthorizationData, > EncAuthorizationData_key, >- additional_tickets, >+ EncAuthorizationData_usage, > asn1_print=None, > hexdump=None): > # KDC-REQ-BODY ::= SEQUENCE { >@@ -1054,8 +1057,9 @@ class RawKerberosTest(TestCaseInTempDir): > asn1Spec=krb5_asn1.AuthorizationData(), > asn1_print=asn1_print, > hexdump=hexdump) >- enc_ad = self.EncryptedData_create( >- EncAuthorizationData_key, enc_ad_plain) >+ enc_ad = self.EncryptedData_create(EncAuthorizationData_key, >+ EncAuthorizationData_usage, >+ enc_ad_plain) > else: > enc_ad = None > KDC_REQ_BODY_obj = { >@@ -1123,8 +1127,6 @@ class RawKerberosTest(TestCaseInTempDir): > nonce, # required > etypes, # required > addresses, # optional >- EncAuthorizationData, >- EncAuthorizationData_key, > additional_tickets, > native_decoded_only=True, > asn1_print=None, >@@ -1170,9 +1172,10 @@ class RawKerberosTest(TestCaseInTempDir): > nonce, > etypes, > addresses, >- EncAuthorizationData, >- EncAuthorizationData_key, > additional_tickets, >+ EncAuthorizationData=None, >+ EncAuthorizationData_key=None, >+ EncAuthorizationData_usage=None, > asn1_print=asn1_print, > hexdump=hexdump) > obj, decoded = self.KDC_REQ_create( >@@ -1290,6 +1293,11 @@ class RawKerberosTest(TestCaseInTempDir): > # -- NOTE: not empty > # } > >+ if authenticator_subkey is not None: >+ EncAuthorizationData_usage = KU_TGS_REQ_AUTH_DAT_SUBKEY >+ else: >+ EncAuthorizationData_usage = KU_TGS_REQ_AUTH_DAT_SESSION >+ > req_body = self.KDC_REQ_BODY_create( > kdc_options=kdc_options, > cname=None, >@@ -1301,9 +1309,10 @@ class RawKerberosTest(TestCaseInTempDir): > nonce=nonce, > etypes=etypes, > addresses=addresses, >+ additional_tickets=additional_tickets, > EncAuthorizationData=EncAuthorizationData, > EncAuthorizationData_key=EncAuthorizationData_key, >- additional_tickets=additional_tickets) >+ EncAuthorizationData_usage=EncAuthorizationData_usage) > req_body_blob = self.der_encode(req_body, > asn1Spec=krb5_asn1.KDC_REQ_BODY(), > asn1_print=asn1_print, hexdump=hexdump) >@@ -1397,9 +1406,10 @@ class RawKerberosTest(TestCaseInTempDir): > nonce=None, # required > etypes=None, # required > addresses=None, # optional >+ additional_tickets=None, # optional > EncAuthorizationData=None, # optional > EncAuthorizationData_key=None, # optional >- additional_tickets=None): # optional >+ EncAuthorizationData_usage=None): # optional > > check_error_fn = kdc_exchange_dict['check_error_fn'] > check_rep_fn = kdc_exchange_dict['check_rep_fn'] >@@ -1425,9 +1435,10 @@ class RawKerberosTest(TestCaseInTempDir): > nonce=nonce, > etypes=etypes, > addresses=addresses, >+ additional_tickets=additional_tickets, > EncAuthorizationData=EncAuthorizationData, > EncAuthorizationData_key=EncAuthorizationData_key, >- additional_tickets=additional_tickets) >+ EncAuthorizationData_usage=EncAuthorizationData_usage) > if generate_padata_fn is not None: > # This can alter req_body... > padata, req_body = generate_padata_fn(kdc_exchange_dict, >diff --git a/python/samba/tests/krb5/s4u_tests.py b/python/samba/tests/krb5/s4u_tests.py >index 30a58d6345a..57575f0595d 100755 >--- a/python/samba/tests/krb5/s4u_tests.py >+++ b/python/samba/tests/krb5/s4u_tests.py >@@ -69,8 +69,6 @@ class S4UKerberosTests(RawKerberosTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > self.assertIsNotNone(rep) >@@ -113,8 +111,6 @@ class S4UKerberosTests(RawKerberosTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > self.assertIsNotNone(rep) >diff --git a/python/samba/tests/krb5/simple_tests.py b/python/samba/tests/krb5/simple_tests.py >index 9650702c6c6..795d753b4f7 100755 >--- a/python/samba/tests/krb5/simple_tests.py >+++ b/python/samba/tests/krb5/simple_tests.py >@@ -69,8 +69,6 @@ class SimpleKerberosTests(RawKerberosTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > self.assertIsNotNone(rep) >@@ -113,8 +111,6 @@ class SimpleKerberosTests(RawKerberosTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > self.assertIsNotNone(rep) >diff --git a/python/samba/tests/krb5/xrealm_tests.py b/python/samba/tests/krb5/xrealm_tests.py >index efb953bdf7e..073cb755b46 100755 >--- a/python/samba/tests/krb5/xrealm_tests.py >+++ b/python/samba/tests/krb5/xrealm_tests.py >@@ -68,8 +68,6 @@ class XrealmKerberosTests(RawKerberosTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > self.assertIsNotNone(rep) >@@ -112,8 +110,6 @@ class XrealmKerberosTests(RawKerberosTest): > nonce=0x7fffffff, > etypes=etypes, > addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, > additional_tickets=None) > rep = self.send_recv_transaction(req) > self.assertIsNotNone(rep) >-- >2.25.1 > > >From d7d149dd8d8b3edf729b81511aab227959b4ce84 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 11:12:34 +1200 >Subject: [PATCH 136/380] tests/krb5: Fix callback_dict parameter > >Items contained in a default-created callback_dict should not be carried >over between unrelated calls to {as,tgs}_as_exchange_dict(). > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit bad5f4ee5fdf64ca9d775233fec24975e0b510bf) >--- > python/samba/tests/krb5/raw_testcase.py | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index f39656d5e03..fc8e6990834 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1486,7 +1486,7 @@ class RawKerberosTest(TestCaseInTempDir): > check_rep_fn=None, > check_padata_fn=None, > check_kdc_private_fn=None, >- callback_dict=dict(), >+ callback_dict=None, > expected_error_mode=None, > client_as_etypes=None, > expected_salt=None): >@@ -1511,6 +1511,9 @@ class RawKerberosTest(TestCaseInTempDir): > 'client_as_etypes': client_as_etypes, > 'expected_salt': expected_salt, > } >+ if callback_dict is None: >+ callback_dict = {} >+ > return kdc_exchange_dict > > def tgs_exchange_dict(self, >@@ -1524,7 +1527,7 @@ class RawKerberosTest(TestCaseInTempDir): > check_rep_fn=None, > check_padata_fn=None, > check_kdc_private_fn=None, >- callback_dict=dict(), >+ callback_dict=None, > tgt=None, > authenticator_subkey=None, > body_checksum_type=None): >@@ -1549,6 +1552,9 @@ class RawKerberosTest(TestCaseInTempDir): > 'body_checksum_type': body_checksum_type, > 'authenticator_subkey': authenticator_subkey, > } >+ if callback_dict is None: >+ callback_dict = {} >+ > return kdc_exchange_dict > > def generic_check_kdc_rep(self, >-- >2.25.1 > > >From acfde071110f702a2f85d40b1373a94e2d31b0da Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:06:29 +1200 >Subject: [PATCH 137/380] tests/krb5: Fix encpart_decryption_key with MIT KDC > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit a0c6538a97126671f9c7bcf3b581f3d98cbc7fd1) >--- > python/samba/tests/krb5/raw_testcase.py | 13 ++++++++++--- > 1 file changed, 10 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index fc8e6990834..1c08b76061f 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1630,9 +1630,16 @@ class RawKerberosTest(TestCaseInTempDir): > rep_decpart = encpart_decryption_key.decrypt( > encpart_decryption_usage, > encpart_cipher) >- encpart_private = self.der_decode( >- rep_decpart, >- asn1Spec=rep_encpart_asn1Spec()) >+ # MIT KDC encodes both EncASRepPart and EncTGSRepPart with >+ # application tag 26 >+ try: >+ encpart_private = self.der_decode( >+ rep_decpart, >+ asn1Spec=rep_encpart_asn1Spec()) >+ except Exception: >+ encpart_private = self.der_decode( >+ rep_decpart, >+ asn1Spec=krb5_asn1.EncTGSRepPart()) > > if check_kdc_private_fn is not None: > check_kdc_private_fn(kdc_exchange_dict, callback_dict, >-- >2.25.1 > > >From b5ab4662b563dd380b4a05b12d4dc77410549fbe Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Jul 2021 17:00:09 +1200 >Subject: [PATCH 138/380] tests/krb5: Expect e-data except when the error code > is KDC_ERR_GENERIC > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 8194b2a2611c6b1db2d29ec22c70e14decd1784b) >--- > python/samba/tests/krb5/raw_testcase.py | 3 ++- > python/samba/tests/krb5/rfc4120_constants.py | 1 + > 2 files changed, 3 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 1c08b76061f..c0e997a86a1 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -40,6 +40,7 @@ from samba.tests import TestCaseInTempDir > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( > KDC_ERR_ETYPE_NOSUPP, >+ KDC_ERR_GENERIC, > KDC_ERR_PREAUTH_REQUIRED, > KRB_AP_REQ, > KRB_AS_REP, >@@ -1799,7 +1800,7 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementEqualPrincipal(rep, 'sname', expected_sname) > if self.strict_checking: > self.assertElementMissing(rep, 'e-text') >- if expected_error_mode != KDC_ERR_PREAUTH_REQUIRED: >+ if expected_error_mode == KDC_ERR_GENERIC: > self.assertElementMissing(rep, 'e-data') > return > edata = self.getElementValue(rep, 'e-data') >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index adcc93e1d6b..b00b8b48ae5 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -58,6 +58,7 @@ KDC_ERR_PREAUTH_FAILED = 24 > KDC_ERR_PREAUTH_REQUIRED = 25 > KDC_ERR_BADMATCH = 36 > KDC_ERR_SKEW = 37 >+KDC_ERR_GENERIC = 60 > > # Name types > NT_UNKNOWN = int(krb5_asn1.NameTypeValues('kRB5-NT-UNKNOWN')) >-- >2.25.1 > > >From 9acf691827a5c488c407f31296b5a2b14605daf3 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 15:07:59 +1200 >Subject: [PATCH 139/380] tests/krb5: Check Kerberos protocol version number > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d6a242e20004217a0ce02dc4ef620a121e5944da) >--- > python/samba/tests/krb5/raw_testcase.py | 1 + > 1 file changed, 1 insertion(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index c0e997a86a1..693f196940c 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1786,6 +1786,7 @@ class RawKerberosTest(TestCaseInTempDir): > expected_patypes += (PADATA_PK_AS_REQ,) > expected_patypes += (PADATA_PK_AS_REP_19,) > >+ self.assertElementEqual(rep, 'pvno', 5) > self.assertElementEqual(rep, 'msg-type', KRB_ERROR) > self.assertElementEqual(rep, 'error-code', expected_error) > self.assertElementMissing(rep, 'ctime') >-- >2.25.1 > > >From a0ec3204d4697630b69bfc3ee0ee69de3d0c265a Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 6 Jul 2021 11:28:37 +1200 >Subject: [PATCH 140/380] tests/krb5: Use credentials kvno when creating > password key > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 17d5a267298ccd7272e86fd24c2c608511cf46b7) >--- > python/samba/tests/krb5/kdc_base_test.py | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 7874562d32d..aa172640399 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -409,7 +409,8 @@ class KDCBaseTest(RawKerberosTest): > etype_info2 = self.der_decode( > padata_value, asn1Spec=krb5_asn1.ETYPE_INFO2()) > >- key = self.PasswordKey_from_etype_info2(creds, etype_info2[0]) >+ key = self.PasswordKey_from_etype_info2(creds, etype_info2[0], >+ creds.get_kvno()) > return key > > def get_pa_data(self, creds, rep, skew=0): >-- >2.25.1 > > >From 2bac1a05b33bd8630f12ae883290a846e6bfafd3 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 6 Jul 2021 10:24:52 +1200 >Subject: [PATCH 141/380] tests/krb5: Allow cf2 to automatically use the > enctype of the first key > >RFC6113 states: "Unless otherwise specified, the resulting enctype of >KRB-FX-CF2 is the enctype of k1." This change means the enctype no >longer has to be specified manually. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit a5e5f8fdfe8b6952592d7d682af893c79080826f) >--- > python/samba/tests/krb5/kcrypto.py | 12 +++++++----- > 1 file changed, 7 insertions(+), 5 deletions(-) > >diff --git a/python/samba/tests/krb5/kcrypto.py b/python/samba/tests/krb5/kcrypto.py >index 23502d7bb62..c861e3cc96e 100755 >--- a/python/samba/tests/krb5/kcrypto.py >+++ b/python/samba/tests/krb5/kcrypto.py >@@ -653,9 +653,11 @@ def prfplus(key, pepper, ln): > return out[:ln] > > >-def cf2(enctype, key1, key2, pepper1, pepper2): >+def cf2(key1, key2, pepper1, pepper2, enctype=None): > # Combine two keys and two pepper strings to produce a result key > # of type enctype, using the RFC 6113 KRB-FX-CF2 function. >+ if enctype is None: >+ enctype = key1.enctype > e = _get_enctype_profile(enctype) > return e.random_to_key(_xorbytes(prfplus(key1, pepper1, e.seedsize), > prfplus(key2, pepper2, e.seedsize))) >@@ -748,7 +750,7 @@ class KcrytoTest(TestCase): > kb = h('97DF97E4B798B29EB31ED7280287A92A') > k1 = string_to_key(Enctype.AES128, b'key1', b'key1') > k2 = string_to_key(Enctype.AES128, b'key2', b'key2') >- k = cf2(Enctype.AES128, k1, k2, b'a', b'b') >+ k = cf2(k1, k2, b'a', b'b') > self.assertEqual(k.contents, kb) > > def test_aes256_cf2(self): >@@ -757,7 +759,7 @@ class KcrytoTest(TestCase): > 'E72B1C7B') > k1 = string_to_key(Enctype.AES256, b'key1', b'key1') > k2 = string_to_key(Enctype.AES256, b'key2', b'key2') >- k = cf2(Enctype.AES256, k1, k2, b'a', b'b') >+ k = cf2(k1, k2, b'a', b'b') > self.assertEqual(k.contents, kb) > > def test_des3_crypt(self): >@@ -794,7 +796,7 @@ class KcrytoTest(TestCase): > kb = h('E58F9EB643862C13AD38E529313462A7F73E62834FE54A01') > k1 = string_to_key(Enctype.DES3, b'key1', b'key1') > k2 = string_to_key(Enctype.DES3, b'key2', b'key2') >- k = cf2(Enctype.DES3, k1, k2, b'a', b'b') >+ k = cf2(k1, k2, b'a', b'b') > self.assertEqual(k.contents, kb) > > def test_rc4_crypt(self): >@@ -830,7 +832,7 @@ class KcrytoTest(TestCase): > kb = h('24D7F6B6BAE4E5C00D2082C5EBAB3672') > k1 = string_to_key(Enctype.RC4, b'key1', b'key1') > k2 = string_to_key(Enctype.RC4, b'key2', b'key2') >- k = cf2(Enctype.RC4, k1, k2, b'a', b'b') >+ k = cf2(k1, k2, b'a', b'b') > self.assertEqual(k.contents, kb) > > def _test_md5_unkeyed_checksum(self, etype, usage): >-- >2.25.1 > > >From aa0e2a2424c78bd45feb92ee3dd0716c7ad7710c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 6 Jul 2021 10:16:01 +1200 >Subject: [PATCH 142/380] tests/krb5: Refactor get_pa_data() > >The function now returns a single padata object rather than a list, >making it easier to combine multiple padata elements into a request. The >new name 'get_enc_timestamp_pa_data' also makes it clearer as to what >the method generates. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 2c80f7f851a7a4ffbcde2c42b2c383b683b67731) >--- > python/samba/tests/krb5/kdc_base_test.py | 8 ++-- > python/samba/tests/krb5/kdc_tests.py | 25 ++++++------ > python/samba/tests/krb5/kdc_tgs_tests.py | 12 +++--- > .../ms_kile_client_principal_lookup_tests.py | 40 +++++++++---------- > 4 files changed, 42 insertions(+), 43 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index aa172640399..7748eae6225 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -413,7 +413,7 @@ class KDCBaseTest(RawKerberosTest): > creds.get_kvno()) > return key > >- def get_pa_data(self, creds, rep, skew=0): >+ def get_enc_timestamp_pa_data(self, creds, rep, skew=0): > '''generate the pa_data data element for an AS-REQ > ''' > key = self.get_as_rep_key(creds, rep) >@@ -427,7 +427,7 @@ class KDCBaseTest(RawKerberosTest): > > padata = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, padata) > >- return [padata] >+ return padata > > def get_as_rep_enc_data(self, key, rep): > ''' Decrypt and Decode the encrypted data in an AS-REP >@@ -795,9 +795,9 @@ class KDCBaseTest(RawKerberosTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(user_credentials, rep) >+ padata = self.get_enc_timestamp_pa_data(user_credentials, rep) > key = self.get_as_rep_key(user_credentials, rep) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > # Request a ticket to the host service on the machine account >diff --git a/python/samba/tests/krb5/kdc_tests.py b/python/samba/tests/krb5/kdc_tests.py >index 930edd0a63e..928f3c25c0f 100755 >--- a/python/samba/tests/krb5/kdc_tests.py >+++ b/python/samba/tests/krb5/kdc_tests.py >@@ -83,7 +83,7 @@ class KdcTests(RawKerberosTest): > rep = self.send_recv_transaction(req) > return rep > >- def get_pa_data(self, creds, rep, skew=0): >+ def get_enc_timestamp_pa_data(self, creds, rep, skew=0): > rep_padata = self.der_decode( > rep['e-data'], > asn1Spec=krb5_asn1.METHOD_DATA()) >@@ -107,8 +107,7 @@ class KdcTests(RawKerberosTest): > > pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts) > >- padata = [pa_ts] >- return padata >+ return pa_ts > > def check_pre_authenication(self, rep): > """ Check that the kdc response was pre-authentication required >@@ -160,8 +159,8 @@ class KdcTests(RawKerberosTest): > rep = self.as_req(creds, etype) > self.check_pre_authenication(rep) > >- padata = self.get_pa_data(creds, rep) >- rep = self.as_req(creds, etype, padata=padata) >+ padata = self.get_enc_timestamp_pa_data(creds, rep) >+ rep = self.as_req(creds, etype, padata=[padata]) > self.check_as_reply(rep) > > etype = rep['enc-part']['etype'] >@@ -174,8 +173,8 @@ class KdcTests(RawKerberosTest): > rep = self.as_req(creds, etype) > self.check_pre_authenication(rep) > >- padata = self.get_pa_data(creds, rep) >- rep = self.as_req(creds, etype, padata=padata) >+ padata = self.get_enc_timestamp_pa_data(creds, rep) >+ rep = self.as_req(creds, etype, padata=[padata]) > self.check_as_reply(rep) > > etype = rep['enc-part']['etype'] >@@ -188,8 +187,8 @@ class KdcTests(RawKerberosTest): > rep = self.as_req(creds, etype) > self.check_pre_authenication(rep) > >- padata = self.get_pa_data(creds, rep) >- rep = self.as_req(creds, etype, padata=padata) >+ padata = self.get_enc_timestamp_pa_data(creds, rep) >+ rep = self.as_req(creds, etype, padata=[padata]) > self.check_as_reply(rep) > > etype = rep['enc-part']['etype'] >@@ -202,8 +201,8 @@ class KdcTests(RawKerberosTest): > rep = self.as_req(creds, etype) > self.check_pre_authenication(rep) > >- padata = self.get_pa_data(creds, rep, skew=3600) >- rep = self.as_req(creds, etype, padata=padata) >+ padata = self.get_enc_timestamp_pa_data(creds, rep, skew=3600) >+ rep = self.as_req(creds, etype, padata=[padata]) > > self.check_error_rep(rep, KDC_ERR_SKEW) > >@@ -216,8 +215,8 @@ class KdcTests(RawKerberosTest): > rep = self.as_req(creds, etype) > self.check_pre_authenication(rep) > >- padata = self.get_pa_data(creds, rep) >- rep = self.as_req(creds, etype, padata=padata) >+ padata = self.get_enc_timestamp_pa_data(creds, rep) >+ rep = self.as_req(creds, etype, padata=[padata]) > > self.check_error_rep(rep, KDC_ERR_PREAUTH_FAILED) > >diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py >index 25a1f5f3ed8..97f9dd41339 100755 >--- a/python/samba/tests/krb5/kdc_tgs_tests.py >+++ b/python/samba/tests/krb5/kdc_tgs_tests.py >@@ -66,9 +66,9 @@ class KdcTgsTests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(uc, rep) >+ padata = self.get_enc_timestamp_pa_data(uc, rep) > key = self.get_as_rep_key(uc, rep) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > # Request a service ticket, but use a cname that does not match >@@ -116,9 +116,9 @@ class KdcTgsTests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(uc, rep) >+ padata = self.get_enc_timestamp_pa_data(uc, rep) > key = self.get_as_rep_key(uc, rep) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > enc_part2 = self.get_as_rep_enc_data(key, rep) >@@ -157,9 +157,9 @@ class KdcTgsTests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(uc, rep) >+ padata = self.get_enc_timestamp_pa_data(uc, rep) > key = self.get_as_rep_key(uc, rep) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > # Request a ticket to the host service on the machine account >diff --git a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >index e42b643b357..99c842701ea 100755 >--- a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >+++ b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >@@ -109,9 +109,9 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(uc, rep) >+ padata = self.get_enc_timestamp_pa_data(uc, rep) > key = self.get_as_rep_key(uc, rep) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > # Request a ticket to the host service on the machine account >@@ -168,9 +168,9 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(mc, rep) >+ padata = self.get_enc_timestamp_pa_data(mc, rep) > key = self.get_as_rep_key(mc, rep) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > # Request a ticket to the host service on the machine account >@@ -230,9 +230,9 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(uc, rep) >+ padata = self.get_enc_timestamp_pa_data(uc, rep) > key = self.get_as_rep_key(uc, rep) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > # Request a ticket to the host service on the machine account >@@ -368,13 +368,13 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(uc, rep) >+ padata = self.get_enc_timestamp_pa_data(uc, rep) > key = self.get_as_rep_key(uc, rep) > # Note: although we used the alt security id for the pre-auth > # we need to use the username for the auth > cname = self.PrincipalName_create( > name_type=NT_PRINCIPAL, names=[user_name]) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > # Request a ticket to the host service on the machine account >@@ -436,12 +436,12 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(uc, rep) >+ padata = self.get_enc_timestamp_pa_data(uc, rep) > # Use the alternate security identifier > # this should fail > cname = self.PrincipalName_create( > name_type=NT_PRINCIPAL, names=[alt_sec]) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_error_rep(rep, KDC_ERR_C_PRINCIPAL_UNKNOWN) > > def test_enterprise_principal_step_1_3(self): >@@ -475,9 +475,9 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(uc, rep) >+ padata = self.get_enc_timestamp_pa_data(uc, rep) > key = self.get_as_rep_key(uc, rep) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > # Request a ticket to the host service on the machine account >@@ -538,9 +538,9 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(uc, rep) >+ padata = self.get_enc_timestamp_pa_data(uc, rep) > key = self.get_as_rep_key(uc, rep) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > # Request a ticket to the host service on the machine account >@@ -602,9 +602,9 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(mc, rep) >+ padata = self.get_enc_timestamp_pa_data(mc, rep) > key = self.get_as_rep_key(mc, rep) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > # Request a ticket to the host service on the machine account >@@ -744,13 +744,13 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(uc, rep) >+ padata = self.get_enc_timestamp_pa_data(uc, rep) > key = self.get_as_rep_key(uc, rep) > # Note: although we used the alt security id for the pre-auth > # we need to use the username for the auth > cname = self.PrincipalName_create( > name_type=NT_ENTERPRISE_PRINCIPAL, names=[uname]) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_as_reply(rep) > > # Request a ticket to the host service on the machine account >@@ -813,12 +813,12 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.check_pre_authentication(rep) > > # Do the next AS-REQ >- padata = self.get_pa_data(uc, rep) >+ padata = self.get_enc_timestamp_pa_data(uc, rep) > # Use the alternate security identifier > # this should fail > cname = self.PrincipalName_create( > name_type=NT_ENTERPRISE_PRINCIPAL, names=[ename]) >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ rep = self.as_req(cname, sname, realm, etype, padata=[padata]) > self.check_error_rep(rep, KDC_ERR_C_PRINCIPAL_UNKNOWN) > > >-- >2.25.1 > > >From 1f29d0e4f0d39ba23c0825bc3384b563e1029d2f Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 26 Jul 2021 17:18:38 +1200 >Subject: [PATCH 143/380] tests/krb5: Add get_enc_timestamp_pa_data_from_key() > >This makes it easier to create encrypted timestamp padata when the key >has already been obtained. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit f5a906f74f9665a894db3c13722022f732180620) >--- > python/samba/tests/krb5/kdc_base_test.py | 4 ++++ > 1 file changed, 4 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 7748eae6225..64d9e627672 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -416,8 +416,12 @@ class KDCBaseTest(RawKerberosTest): > def get_enc_timestamp_pa_data(self, creds, rep, skew=0): > '''generate the pa_data data element for an AS-REQ > ''' >+ > key = self.get_as_rep_key(creds, rep) > >+ return self.get_enc_timestamp_pa_data_from_key(key, skew=skew) >+ >+ def get_enc_timestamp_pa_data_from_key(self, key, skew=0): > (patime, pausec) = self.get_KerberosTimeWithUsec(offset=skew) > padata = self.PA_ENC_TS_ENC_create(patime, pausec) > padata = self.der_encode(padata, asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) >-- >2.25.1 > > >From 8d8d171d6c8f7c6d5ace696d81a59ac34172d49d Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 6 Jul 2021 12:51:54 +1200 >Subject: [PATCH 144/380] tests/krb5: Add method to return dict containing > padata elements > >This makes checking multiple padata elements easier. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit cb332d83008aa97a60eaca9e008054f641d514d6) >--- > python/samba/tests/krb5/raw_testcase.py | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 693f196940c..9b0b953e565 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -867,6 +867,18 @@ class RawKerberosTest(TestCaseInTempDir): > v = random.randint(nonce_min, nonce_max) > return v > >+ def get_pa_dict(self, pa_data): >+ pa_dict = {} >+ >+ if pa_data is not None: >+ for pa in pa_data: >+ pa_type = pa['padata-type'] >+ if pa_type in pa_dict: >+ raise RuntimeError(f'Duplicate type {pa_type}') >+ pa_dict[pa_type] = pa['padata-value'] >+ >+ return pa_dict >+ > def SessionKey_create(self, etype, contents, kvno=None): > key = kcrypto.Key(etype, contents) > return Krb5EncryptionKey(key, kvno) >-- >2.25.1 > > >From ca7e54bf1dee7fd68cf5fc1b1cae9561d7ae86de Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:27:47 +1200 >Subject: [PATCH 145/380] tests/krb5: Make _test_as_exchange() return value > more consistent > >Always return the reply and the kdc_exchange_dict so that the caller has >more potentially useful information. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit fe8912e4a85c5fd614ad3079b041c0e1975958e3) >--- > python/samba/tests/krb5/as_req_tests.py | 62 +++++++++++++------------ > python/samba/tests/krb5/raw_testcase.py | 5 +- > 2 files changed, 33 insertions(+), 34 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 106c7489e9c..3b7841243c5 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -141,20 +141,21 @@ class AsReqKerberosTests(KDCBaseTest): > initial_kdc_options = krb5_asn1.KDCOptions('forwardable') > initial_error_mode = KDC_ERR_PREAUTH_REQUIRED > >- etype_info2 = self._test_as_exchange(cname, >- realm, >- sname, >- till, >- client_as_etypes, >- initial_error_mode, >- expected_crealm, >- expected_cname, >- expected_srealm, >- expected_sname, >- expected_salt, >- initial_etypes, >- initial_padata, >- initial_kdc_options) >+ rep, kdc_exchange_dict = self._test_as_exchange(cname, >+ realm, >+ sname, >+ till, >+ client_as_etypes, >+ initial_error_mode, >+ expected_crealm, >+ expected_cname, >+ expected_srealm, >+ expected_sname, >+ expected_salt, >+ initial_etypes, >+ initial_padata, >+ initial_kdc_options) >+ etype_info2 = kdc_exchange_dict['preauth_etype_info2'] > self.assertIsNotNone(etype_info2) > > preauth_key = self.PasswordKey_from_etype_info2(client_creds, >@@ -179,22 +180,23 @@ class AsReqKerberosTests(KDCBaseTest): > krbtgt_decryption_key = ( > self.TicketDecryptionKey_from_creds(krbtgt_creds)) > >- as_rep = self._test_as_exchange(cname, >- realm, >- sname, >- till, >- client_as_etypes, >- preauth_error_mode, >- expected_crealm, >- expected_cname, >- expected_srealm, >- expected_sname, >- expected_salt, >- preauth_etypes, >- preauth_padata, >- preauth_kdc_options, >- preauth_key=preauth_key, >- ticket_decryption_key=krbtgt_decryption_key) >+ as_rep, kdc_exchange_dict = self._test_as_exchange( >+ cname, >+ realm, >+ sname, >+ till, >+ client_as_etypes, >+ preauth_error_mode, >+ expected_crealm, >+ expected_cname, >+ expected_srealm, >+ expected_sname, >+ expected_salt, >+ preauth_etypes, >+ preauth_padata, >+ preauth_kdc_options, >+ preauth_key=preauth_key, >+ ticket_decryption_key=krbtgt_decryption_key) > self.assertIsNotNone(as_rep) > > if __name__ == "__main__": >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 9b0b953e565..e9b4c6c9efa 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2034,7 +2034,4 @@ class RawKerberosTest(TestCaseInTempDir): > till_time=till, > etypes=etypes) > >- if expected_error_mode == 0: # AS-REP >- return rep >- >- return kdc_exchange_dict['preauth_etype_info2'] >+ return rep, kdc_exchange_dict >-- >2.25.1 > > >From d7891a7099ca6122deb4a6492994d72bbc4a1026 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 22 Jul 2021 16:27:17 +1200 >Subject: [PATCH 146/380] tests/krb5: Add get_EpochFromKerberosTime() > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit bab7503e3043002b1422b00f40cd03a0a29538aa) >--- > python/samba/tests/krb5/kdc_base_test.py | 12 +++--------- > python/samba/tests/krb5/raw_testcase.py | 11 +++++++++++ > 2 files changed, 14 insertions(+), 9 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 64d9e627672..f0a9e7311a5 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -732,15 +732,9 @@ class KDCBaseTest(RawKerberosTest): > cred.client = cprincipal > cred.server = sprincipal > cred.keyblock = keyblock >- cred.authtime = int(datetime.strptime(authtime.decode(), >- "%Y%m%d%H%M%SZ") >- .replace(tzinfo=timezone.utc).timestamp()) >- cred.starttime = int(datetime.strptime(starttime.decode(), >- "%Y%m%d%H%M%SZ") >- .replace(tzinfo=timezone.utc).timestamp()) >- cred.endtime = int(datetime.strptime(endtime.decode(), >- "%Y%m%d%H%M%SZ") >- .replace(tzinfo=timezone.utc).timestamp()) >+ cred.authtime = self.get_EpochFromKerberosTime(authtime) >+ cred.starttime = self.get_EpochFromKerberosTime(starttime) >+ cred.endtime = self.get_EpochFromKerberosTime(endtime) > > # Account for clock skew of up to five minutes. > self.assertLess(cred.authtime - 5 * 60, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index e9b4c6c9efa..3ab63cd01d0 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -861,6 +861,17 @@ class RawKerberosTest(TestCaseInTempDir): > (s, _) = self.get_KerberosTimeWithUsec(epoch=epoch, offset=offset) > return s > >+ def get_EpochFromKerberosTime(self, kerberos_time): >+ if isinstance(kerberos_time, bytes): >+ kerberos_time = kerberos_time.decode() >+ >+ epoch = datetime.datetime.strptime(kerberos_time, >+ '%Y%m%d%H%M%SZ') >+ epoch = epoch.replace(tzinfo=datetime.timezone.utc) >+ epoch = int(epoch.timestamp()) >+ >+ return epoch >+ > def get_Nonce(self): > nonce_min = 0x7f000000 > nonce_max = 0x7fffffff >-- >2.25.1 > > >From f63324ec1ccc65a7fbde1ba74f038ed34a736b1b Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 3 Aug 2021 15:58:19 +1200 >Subject: [PATCH 147/380] tests/krb5: Use encryption with admin credentials > >This ensures that account creation using admin credentials succeeds. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit ce379edf2e135b105b18d35e24d732389de94291) >--- > python/samba/tests/krb5/raw_testcase.py | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 3ab63cd01d0..e48d501ad19 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -33,6 +33,7 @@ from pyasn1.codec.ber.encoder import BitStringEncoder > > from samba.credentials import Credentials > from samba.dcerpc import security >+from samba.gensec import FEATURE_SEAL > > import samba.tests > from samba.tests import TestCaseInTempDir >@@ -606,6 +607,7 @@ class RawKerberosTest(TestCaseInTempDir): > c = self._get_krb5_creds(prefix='ADMIN', > allow_missing_password=allow_missing_password, > allow_missing_keys=allow_missing_keys) >+ c.set_gensec_features(c.get_gensec_features() | FEATURE_SEAL) > return c > > def get_krbtgt_creds(self, >-- >2.25.1 > > >From af394abfffb834518f03e757195f2d377e6a72c9 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 6 Jul 2021 11:25:55 +1200 >Subject: [PATCH 148/380] tests/krb5: Allow specifying additional details when > creating an account > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 4790b6b04ae145a2ebb418dd734487a6ba28a30c) >--- > python/samba/tests/krb5/kdc_base_test.py | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index f0a9e7311a5..279e15c13ce 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -148,7 +148,7 @@ class KDCBaseTest(RawKerberosTest): > return default_enctypes > > def create_account(self, ldb, name, machine_account=False, >- spn=None, upn=None): >+ spn=None, upn=None, additional_details=None): > '''Create an account for testing. > The dn of the created account is added to self.accounts, > which is used by tearDownClass to clean up the created accounts. >@@ -180,6 +180,8 @@ class KDCBaseTest(RawKerberosTest): > details["servicePrincipalName"] = spn > if upn is not None: > details["userPrincipalName"] = upn >+ if additional_details is not None: >+ details.update(additional_details) > ldb.add(details) > > creds = KerberosCredentials() >-- >2.25.1 > > >From 0e8a2fa8c43bcfd61e3ae6a816e1cb05b65b645a Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 6 Jul 2021 10:19:57 +1200 >Subject: [PATCH 149/380] tests/krb5: Add more methods for obtaining machine > and service credentials > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 50d743bafc7aa9f7b4688bae652a501001e9fdbb) >--- > python/samba/tests/krb5/kdc_base_test.py | 74 ++++++++++++++++++++++++ > 1 file changed, 74 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 279e15c13ce..21e2c04cea1 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -334,6 +334,80 @@ class KDCBaseTest(RawKerberosTest): > fallback_creds_fn=create_client_account) > return c > >+ def get_mach_creds(self, >+ allow_missing_password=False, >+ allow_missing_keys=True): >+ def create_mach_account(): >+ samdb = self.get_samdb() >+ >+ mach_name = 'kdctestmac' >+ details = { >+ 'msDS-SupportedEncryptionTypes': str( >+ security.KERB_ENCTYPE_FAST_SUPPORTED | >+ security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED | >+ security.KERB_ENCTYPE_CLAIMS_SUPPORTED >+ ) >+ } >+ >+ creds, dn = self.create_account(samdb, mach_name, >+ machine_account=True, >+ spn='host/' + mach_name, >+ additional_details=details) >+ >+ res = samdb.search(base=dn, >+ scope=ldb.SCOPE_BASE, >+ attrs=['msDS-KeyVersionNumber']) >+ kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >+ creds.set_kvno(kvno) >+ >+ keys = self.get_keys(samdb, dn) >+ self.creds_set_keys(creds, keys) >+ >+ return creds >+ >+ c = self._get_krb5_creds(prefix='MAC', >+ allow_missing_password=allow_missing_password, >+ allow_missing_keys=allow_missing_keys, >+ fallback_creds_fn=create_mach_account) >+ return c >+ >+ def get_service_creds(self, >+ allow_missing_password=False, >+ allow_missing_keys=True): >+ def create_service_account(): >+ samdb = self.get_samdb() >+ >+ mach_name = 'kdctestservice' >+ details = { >+ 'msDS-SupportedEncryptionTypes': str( >+ security.KERB_ENCTYPE_FAST_SUPPORTED | >+ security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED | >+ security.KERB_ENCTYPE_CLAIMS_SUPPORTED >+ ) >+ } >+ >+ creds, dn = self.create_account(samdb, mach_name, >+ machine_account=True, >+ spn='host/' + mach_name, >+ additional_details=details) >+ >+ res = samdb.search(base=dn, >+ scope=ldb.SCOPE_BASE, >+ attrs=['msDS-KeyVersionNumber']) >+ kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >+ creds.set_kvno(kvno) >+ >+ keys = self.get_keys(samdb, dn) >+ self.creds_set_keys(creds, keys) >+ >+ return creds >+ >+ c = self._get_krb5_creds(prefix='SERVICE', >+ allow_missing_password=allow_missing_password, >+ allow_missing_keys=allow_missing_keys, >+ fallback_creds_fn=create_service_account) >+ return c >+ > def get_krbtgt_creds(self, > require_keys=True, > require_strongest_key=False): >-- >2.25.1 > > >From 2c4b1a172b81dd465b96bc4098bfbfcfee4cc244 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 22 Jul 2021 16:22:09 +1200 >Subject: [PATCH 150/380] tests/krb5: Add method to calculate account salt > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit f5689bb8fab82d5fcbdbd3c63b86e7618834aac5) >--- > python/samba/tests/krb5/kdc_base_test.py | 2 ++ > python/samba/tests/krb5/raw_testcase.py | 19 +++++++++++++++---- > 2 files changed, 17 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 21e2c04cea1..0dbaeab4a0e 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -192,6 +192,8 @@ class KDCBaseTest(RawKerberosTest): > creds.set_username(account_name) > if machine_account: > creds.set_workstation(name) >+ else: >+ creds.set_workstation('') > # > # Save the account name so it can be deleted in tearDownClass > self.accounts.add(dn) >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index e48d501ad19..2dbcc39114a 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -295,6 +295,20 @@ class KerberosCredentials(Credentials): > def get_forced_salt(self): > return self.forced_salt > >+ def get_salt(self): >+ if self.forced_salt is not None: >+ return self.forced_salt >+ >+ if self.get_workstation(): >+ salt_string = '%shost%s.%s' % ( >+ self.get_realm().upper(), >+ self.get_username().lower().rsplit('$', 1)[0], >+ self.get_realm().lower()) >+ else: >+ salt_string = self.get_realm().upper() + self.get_username() >+ >+ return salt_string.encode('utf-8') >+ > > class KerberosTicketCreds: > def __init__(self, ticket, session_key, >@@ -940,10 +954,7 @@ class RawKerberosTest(TestCaseInTempDir): > > password = creds.get_password() > self.assertIsNotNone(password, msg=fail_msg) >- salt = creds.get_forced_salt() >- if salt is None: >- salt = bytes("%s%s" % (creds.get_realm(), creds.get_username()), >- encoding='utf-8') >+ salt = creds.get_salt() > return self.PasswordKey_create(etype=etype, > pwd=password, > salt=salt, >-- >2.25.1 > > >From af64b9158ee9a55883a3a451a50c2af2e93cac61 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 26 Jul 2021 17:19:04 +1200 >Subject: [PATCH 151/380] tests/krb5: Add check_reply() method to check for AS > or TGS reply > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 28fb50f511f3f693709aa9b41c001d6a5f9c3329) >--- > python/samba/tests/krb5/kdc_base_test.py | 26 +++++------------------- > 1 file changed, 5 insertions(+), 21 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 0dbaeab4a0e..1b550179e0e 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -540,26 +540,7 @@ class KDCBaseTest(RawKerberosTest): > kvno > match the expected values > """ >- >- # Should have a reply, and it should an AS-REP message. >- self.assertIsNotNone(rep) >- self.assertEqual(rep['msg-type'], KRB_AS_REP, "rep = {%s}" % rep) >- >- # Protocol version number should be 5 >- pvno = int(rep['pvno']) >- self.assertEqual(5, pvno, "rep = {%s}" % rep) >- >- # The ticket version number should be 5 >- tkt_vno = int(rep['ticket']['tkt-vno']) >- self.assertEqual(5, tkt_vno, "rep = {%s}" % rep) >- >- # Check that the kvno is not an RODC kvno >- # MIT kerberos does not provide the kvno, so we treat it as optional. >- # This is tested in compatability_test.py >- if 'kvno' in rep['enc-part']: >- kvno = int(rep['enc-part']['kvno']) >- # If the high order bits are set this is an RODC kvno. >- self.assertEqual(0, kvno & 0xFFFF0000, "rep = {%s}" % rep) >+ self.check_reply(rep, msg_type=KRB_AS_REP) > > def check_tgs_reply(self, rep): > """ Check that the kdc response is an TGS-REP and that the >@@ -570,10 +551,13 @@ class KDCBaseTest(RawKerberosTest): > kvno > match the expected values > """ >+ self.check_reply(rep, msg_type=KRB_TGS_REP) >+ >+ def check_reply(self, rep, msg_type): > > # Should have a reply, and it should an TGS-REP message. > self.assertIsNotNone(rep) >- self.assertEqual(rep['msg-type'], KRB_TGS_REP, "rep = {%s}" % rep) >+ self.assertEqual(rep['msg-type'], msg_type, "rep = {%s}" % rep) > > # Protocol version number should be 5 > pvno = int(rep['pvno']) >-- >2.25.1 > > >From 547e1232ab436c58c0c8bf4d984bc8941ccbb076 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 10:32:52 +1200 >Subject: [PATCH 152/380] tests/krb5: Always specify expected error code > >Now the expected error code is always determined by the test code itself >rather than by generic_check_as_error(). > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 21c64fda8f98d451e028ea483dbe351b1280390c) >--- > python/samba/tests/krb5/as_req_tests.py | 11 ++++++++++- > python/samba/tests/krb5/raw_testcase.py | 13 ++++++------- > 2 files changed, 16 insertions(+), 8 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 3b7841243c5..861d2371b75 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -24,8 +24,10 @@ os.environ["PYTHONUNBUFFERED"] = "1" > > from samba.tests import DynamicTestCase > from samba.tests.krb5.kdc_base_test import KDCBaseTest >+import samba.tests.krb5.kcrypto as kcrypto > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( >+ KDC_ERR_ETYPE_NOSUPP, > KDC_ERR_PREAUTH_REQUIRED, > KU_PA_ENC_TIMESTAMP, > NT_PRINCIPAL, >@@ -68,13 +70,20 @@ class AsReqKerberosTests(KDCBaseTest): > sname = self.PrincipalName_create(name_type=NT_SRV_INST, > names=[krbtgt_account, realm]) > >- expected_error_mode = KDC_ERR_PREAUTH_REQUIRED > expected_crealm = realm > expected_cname = cname > expected_srealm = realm > expected_sname = sname > expected_salt = client_creds.get_forced_salt() > >+ if any(etype in client_as_etypes and etype in initial_etypes >+ for etype in (kcrypto.Enctype.AES256, >+ kcrypto.Enctype.AES128, >+ kcrypto.Enctype.RC4)): >+ expected_error_mode = KDC_ERR_PREAUTH_REQUIRED >+ else: >+ expected_error_mode = KDC_ERR_ETYPE_NOSUPP >+ > def _generate_padata_copy(_kdc_exchange_dict, > _callback_dict, > req_body): >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 2dbcc39114a..5579e989d1c 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -40,9 +40,7 @@ from samba.tests import TestCaseInTempDir > > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( >- KDC_ERR_ETYPE_NOSUPP, > KDC_ERR_GENERIC, >- KDC_ERR_PREAUTH_REQUIRED, > KRB_AP_REQ, > KRB_AS_REP, > KRB_AS_REQ, >@@ -1524,7 +1522,7 @@ class RawKerberosTest(TestCaseInTempDir): > check_padata_fn=None, > check_kdc_private_fn=None, > callback_dict=None, >- expected_error_mode=None, >+ expected_error_mode=0, > client_as_etypes=None, > expected_salt=None): > kdc_exchange_dict = { >@@ -1809,13 +1807,11 @@ class RawKerberosTest(TestCaseInTempDir): > if expected_rc4_type != 0: > expect_etype_info2 += (expected_rc4_type,) > >- expected_error = KDC_ERR_ETYPE_NOSUPP > expected_patypes = () > if expect_etype_info: > self.assertGreater(len(expect_etype_info2), 0) > expected_patypes += (PADATA_ETYPE_INFO,) > if len(expect_etype_info2) != 0: >- expected_error = KDC_ERR_PREAUTH_REQUIRED > expected_patypes += (PADATA_ETYPE_INFO2,) > > expected_patypes += (PADATA_ENC_TIMESTAMP,) >@@ -1824,7 +1820,7 @@ class RawKerberosTest(TestCaseInTempDir): > > self.assertElementEqual(rep, 'pvno', 5) > self.assertElementEqual(rep, 'msg-type', KRB_ERROR) >- self.assertElementEqual(rep, 'error-code', expected_error) >+ self.assertElementEqual(rep, 'error-code', expected_error_mode) > self.assertElementMissing(rep, 'ctime') > self.assertElementMissing(rep, 'cusec') > self.assertElementPresent(rep, 'stime') >@@ -1889,7 +1885,10 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertEqual(len(pk_as_rep19), 0) > continue > >- if expected_error == KDC_ERR_ETYPE_NOSUPP: >+ if all(etype not in client_as_etypes or etype not in proposed_etypes >+ for etype in (kcrypto.Enctype.AES256, >+ kcrypto.Enctype.AES128, >+ kcrypto.Enctype.RC4)): > self.assertIsNone(etype_info2) > self.assertIsNone(etype_info) > if self.strict_checking: >-- >2.25.1 > > >From f228a66b3f1e5ac459c9ab3355f9015728e909b5 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 10:35:40 +1200 >Subject: [PATCH 153/380] tests/krb5: Include kdc_options in kdc_exchange_dict > >Make kdc_options an element of kdc_exchange_dict instead of a parameter >to _generic_kdc_exchange(). This allows testing code to adjust the reply >checking based on the options that were specified in the request. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 8fe9589da2d8fe6f5c47770c618ebabe028f6a95) >--- > python/samba/tests/krb5/as_req_tests.py | 4 ++-- > python/samba/tests/krb5/raw_testcase.py | 15 ++++++++++----- > 2 files changed, 12 insertions(+), 7 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 861d2371b75..ed97a10b616 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -99,10 +99,10 @@ class AsReqKerberosTests(KDCBaseTest): > check_rep_fn=self.generic_check_kdc_rep, > expected_error_mode=expected_error_mode, > client_as_etypes=client_as_etypes, >- expected_salt=expected_salt) >+ expected_salt=expected_salt, >+ kdc_options=str(initial_kdc_options)) > > rep = self._generic_kdc_exchange(kdc_exchange_dict, >- kdc_options=str(initial_kdc_options), > cname=cname, > realm=realm, > sname=sname, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 5579e989d1c..00f90c5dea9 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1431,7 +1431,6 @@ class RawKerberosTest(TestCaseInTempDir): > > def _generic_kdc_exchange(self, > kdc_exchange_dict, # required >- kdc_options=None, # required > cname=None, # optional > realm=None, # required > sname=None, # optional >@@ -1454,6 +1453,8 @@ class RawKerberosTest(TestCaseInTempDir): > req_asn1Spec = kdc_exchange_dict['req_asn1Spec'] > rep_msg_type = kdc_exchange_dict['rep_msg_type'] > >+ kdc_options = kdc_exchange_dict['kdc_options'] >+ > if till_time is None: > till_time = self.get_KerberosTime(offset=36000) > if nonce is None: >@@ -1524,7 +1525,8 @@ class RawKerberosTest(TestCaseInTempDir): > callback_dict=None, > expected_error_mode=0, > client_as_etypes=None, >- expected_salt=None): >+ expected_salt=None, >+ kdc_options=''): > kdc_exchange_dict = { > 'req_msg_type': KRB_AS_REQ, > 'req_asn1Spec': krb5_asn1.AS_REQ, >@@ -1545,6 +1547,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'expected_error_mode': expected_error_mode, > 'client_as_etypes': client_as_etypes, > 'expected_salt': expected_salt, >+ 'kdc_options': kdc_options, > } > if callback_dict is None: > callback_dict = {} >@@ -1565,7 +1568,8 @@ class RawKerberosTest(TestCaseInTempDir): > callback_dict=None, > tgt=None, > authenticator_subkey=None, >- body_checksum_type=None): >+ body_checksum_type=None, >+ kdc_options=''): > kdc_exchange_dict = { > 'req_msg_type': KRB_TGS_REQ, > 'req_asn1Spec': krb5_asn1.TGS_REQ, >@@ -1586,6 +1590,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'tgt': tgt, > 'body_checksum_type': body_checksum_type, > 'authenticator_subkey': authenticator_subkey, >+ 'kdc_options': kdc_options > } > if callback_dict is None: > callback_dict = {} >@@ -2047,10 +2052,10 @@ class RawKerberosTest(TestCaseInTempDir): > check_kdc_private_fn=self.generic_check_kdc_private, > expected_error_mode=expected_error_mode, > client_as_etypes=client_as_etypes, >- expected_salt=expected_salt) >+ expected_salt=expected_salt, >+ kdc_options=str(kdc_options)) > > rep = self._generic_kdc_exchange(kdc_exchange_dict, >- kdc_options=str(kdc_options), > cname=cname, > realm=realm, > sname=sname, >-- >2.25.1 > > >From da83932a3ac3ef6fcbd12f5a311cb245566a944c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 11:06:15 +1200 >Subject: [PATCH 154/380] tests/krb5: Only allow specifying one of check_rep_fn > and check_error_fn > >This means that there can no longer be surprises where a test receives a >reply when it was expecting an error, or vice versa. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 78818655505b3183251940e86270cd40bae73206) >--- > python/samba/tests/krb5/as_req_tests.py | 2 +- > python/samba/tests/krb5/raw_testcase.py | 25 +++++++++++++++++++------ > 2 files changed, 20 insertions(+), 7 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index ed97a10b616..d9a66f99ecf 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -96,7 +96,7 @@ class AsReqKerberosTests(KDCBaseTest): > expected_sname=expected_sname, > generate_padata_fn=_generate_padata_copy, > check_error_fn=self.generic_check_as_error, >- check_rep_fn=self.generic_check_kdc_rep, >+ check_rep_fn=None, > expected_error_mode=expected_error_mode, > client_as_etypes=client_as_etypes, > expected_salt=expected_salt, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 00f90c5dea9..d7813387941 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1453,6 +1453,7 @@ class RawKerberosTest(TestCaseInTempDir): > req_asn1Spec = kdc_exchange_dict['req_asn1Spec'] > rep_msg_type = kdc_exchange_dict['rep_msg_type'] > >+ expected_error_mode = kdc_exchange_dict['expected_error_mode'] > kdc_options = kdc_exchange_dict['kdc_options'] > > if till_time is None: >@@ -1497,12 +1498,17 @@ class RawKerberosTest(TestCaseInTempDir): > msg_type = self.getElementValue(rep, 'msg-type') > self.assertIsNotNone(msg_type) > >- allowed_msg_types = () >+ expected_msg_type = None > if check_error_fn is not None: >- allowed_msg_types = (KRB_ERROR,) >+ expected_msg_type = KRB_ERROR >+ self.assertIsNone(check_rep_fn) >+ self.assertNotEqual(0, expected_error_mode) > if check_rep_fn is not None: >- allowed_msg_types += (rep_msg_type,) >- self.assertIn(msg_type, allowed_msg_types) >+ expected_msg_type = rep_msg_type >+ self.assertIsNone(check_error_fn) >+ self.assertEqual(0, expected_error_mode) >+ self.assertIsNotNone(expected_msg_type) >+ self.assertEqual(msg_type, expected_msg_type) > > if msg_type == KRB_ERROR: > return check_error_fn(kdc_exchange_dict, >@@ -2039,6 +2045,13 @@ class RawKerberosTest(TestCaseInTempDir): > as_rep_usage = KU_AS_REP_ENC_PART > return preauth_key, as_rep_usage > >+ if expected_error_mode == 0: >+ check_error_fn = None >+ check_rep_fn = self.generic_check_kdc_rep >+ else: >+ check_error_fn = self.generic_check_as_error >+ check_rep_fn = None >+ > kdc_exchange_dict = self.as_exchange_dict( > expected_crealm=expected_crealm, > expected_cname=expected_cname, >@@ -2046,8 +2059,8 @@ class RawKerberosTest(TestCaseInTempDir): > expected_sname=expected_sname, > ticket_decryption_key=ticket_decryption_key, > generate_padata_fn=_generate_padata_copy, >- check_error_fn=self.generic_check_as_error, >- check_rep_fn=self.generic_check_kdc_rep, >+ check_error_fn=check_error_fn, >+ check_rep_fn=check_rep_fn, > check_padata_fn=_check_padata_preauth_key, > check_kdc_private_fn=self.generic_check_kdc_private, > expected_error_mode=expected_error_mode, >-- >2.25.1 > > >From c476ef0a42719c7dd29223423219317e8faa4ad4 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 10:37:48 +1200 >Subject: [PATCH 155/380] tests/krb5: Ensure in assertElementPresent() that > container elements are not empty > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit ba3c92f77b20e1e0d298cd92399dc69535739c27) >--- > python/samba/tests/krb5/raw_testcase.py | 5 +++++ > 1 file changed, 5 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index d7813387941..e1baf0ce943 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -24,6 +24,8 @@ import datetime > import random > import binascii > import itertools >+import collections >+ > from pyasn1.codec.der.decoder import decode as pyasn1_der_decode > from pyasn1.codec.der.encoder import encode as pyasn1_der_encode > from pyasn1.codec.native.decoder import decode as pyasn1_native_decode >@@ -817,6 +819,9 @@ class RawKerberosTest(TestCaseInTempDir): > def assertElementPresent(self, obj, elem): > v = self.getElementValue(obj, elem) > self.assertIsNotNone(v) >+ if self.strict_checking: >+ if isinstance(v, collections.abc.Container): >+ self.assertNotEqual(0, len(v)) > > def assertElementEqual(self, obj, elem, value): > v = self.getElementValue(obj, elem) >-- >2.25.1 > > >From 3b0c6ce42a7da754255b628fa32f3b588a6822f2 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:39:42 +1200 >Subject: [PATCH 156/380] tests/krb5: Assert that more variables are not None > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 3d1066e923815782036bd11524fda110a2528951) >--- > python/samba/tests/krb5/raw_testcase.py | 9 +++++++++ > 1 file changed, 9 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index e1baf0ce943..3a178f4bce3 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1631,12 +1631,14 @@ class RawKerberosTest(TestCaseInTempDir): > ticket = self.getElementValue(rep, 'ticket') > ticket_encpart = None > ticket_cipher = None >+ self.assertIsNotNone(ticket) > if ticket is not None: # Never None, but gives indentation > self.assertElementPresent(ticket, 'tkt-vno') > self.assertElementEqualUTF8(ticket, 'realm', expected_srealm) > self.assertElementEqualPrincipal(ticket, 'sname', expected_sname) > self.assertElementPresent(ticket, 'enc-part') > ticket_encpart = self.getElementValue(ticket, 'enc-part') >+ self.assertIsNotNone(ticket_encpart) > if ticket_encpart is not None: # Never None, but gives indentation > self.assertElementPresent(ticket_encpart, 'etype') > # 'unspecified' means present, with any value != 0 >@@ -1647,6 +1649,7 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementPresent(rep, 'enc-part') > encpart = self.getElementValue(rep, 'enc-part') > encpart_cipher = None >+ self.assertIsNotNone(encpart) > if encpart is not None: # Never None, but gives indentation > self.assertElementPresent(encpart, 'etype') > self.assertElementKVNO(ticket_encpart, 'kvno', 'autodetect') >@@ -1654,6 +1657,7 @@ class RawKerberosTest(TestCaseInTempDir): > encpart_cipher = self.getElementValue(encpart, 'cipher') > > encpart_decryption_key = None >+ self.assertIsNotNone(check_padata_fn) > if check_padata_fn is not None: > # See if we can get the decryption key from the preauth phase > encpart_decryption_key, encpart_decryption_usage = ( >@@ -1661,6 +1665,7 @@ class RawKerberosTest(TestCaseInTempDir): > rep, padata)) > > ticket_private = None >+ self.assertIsNotNone(ticket_decryption_key) > if ticket_decryption_key is not None: > self.assertElementEqual(ticket_encpart, 'etype', > ticket_decryption_key.etype) >@@ -1673,6 +1678,7 @@ class RawKerberosTest(TestCaseInTempDir): > asn1Spec=krb5_asn1.EncTicketPart()) > > encpart_private = None >+ self.assertIsNotNone(encpart_decryption_key) > if encpart_decryption_key is not None: > self.assertElementEqual(encpart, 'etype', > encpart_decryption_key.etype) >@@ -1692,6 +1698,7 @@ class RawKerberosTest(TestCaseInTempDir): > rep_decpart, > asn1Spec=krb5_asn1.EncTGSRepPart()) > >+ self.assertIsNotNone(check_kdc_private_fn) > if check_kdc_private_fn is not None: > check_kdc_private_fn(kdc_exchange_dict, callback_dict, > rep, ticket_private, encpart_private) >@@ -1718,6 +1725,7 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementPresent(ticket_private, 'flags') > self.assertElementPresent(ticket_private, 'key') > ticket_key = self.getElementValue(ticket_private, 'key') >+ self.assertIsNotNone(ticket_key) > if ticket_key is not None: # Never None, but gives indentation > self.assertElementPresent(ticket_key, 'keytype') > self.assertElementPresent(ticket_key, 'keyvalue') >@@ -1739,6 +1747,7 @@ class RawKerberosTest(TestCaseInTempDir): > if encpart_private is not None: > self.assertElementPresent(encpart_private, 'key') > encpart_key = self.getElementValue(encpart_private, 'key') >+ self.assertIsNotNone(encpart_key) > if encpart_key is not None: # Never None, but gives indentation > self.assertElementPresent(encpart_key, 'keytype') > self.assertElementPresent(encpart_key, 'keyvalue') >-- >2.25.1 > > >From c6e7e5226dec6e4559bf73014bbe51bed4538145 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 11:34:19 +1200 >Subject: [PATCH 157/380] tests/krb5: Check version number of obtained ticket > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 98dc19e8c817fc66e253e544874a45b17b8bfa7b) >--- > python/samba/tests/krb5/raw_testcase.py | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 3a178f4bce3..70062ca338a 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1633,7 +1633,7 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_cipher = None > self.assertIsNotNone(ticket) > if ticket is not None: # Never None, but gives indentation >- self.assertElementPresent(ticket, 'tkt-vno') >+ self.assertElementEqual(ticket, 'tkt-vno', 5) > self.assertElementEqualUTF8(ticket, 'realm', expected_srealm) > self.assertElementEqualPrincipal(ticket, 'sname', expected_sname) > self.assertElementPresent(ticket, 'enc-part') >-- >2.25.1 > > >From c58104db34b0ccfd2d300fa0650fa7d06f43ae36 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 11:39:37 +1200 >Subject: [PATCH 158/380] tests/krb5: Make checking less strict > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 6df0e406f1f823bf4d65cd478eb6f2424b69adcc) > >[abartlet@samba.org Adapted to add knownfail because in this >Samba 4.14 backport we do not include >b3ee034b4d457607ef25a5b01da64e1eaf5906dd >(s4:kdc: prefer newer enctypes for preauth responses)] >--- > python/samba/tests/krb5/raw_testcase.py | 52 ++++++++++--------- > .../knownfail.d/samba.tests.krb5.as_req_tests | 42 --------------- > 2 files changed, 27 insertions(+), 67 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 70062ca338a..69b7c7adc9b 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1625,8 +1625,9 @@ class RawKerberosTest(TestCaseInTempDir): > > self.assertElementEqual(rep, 'msg-type', msg_type) # AS-REP | TGS-REP > padata = self.getElementValue(rep, 'padata') >- self.assertElementEqualUTF8(rep, 'crealm', expected_crealm) >- self.assertElementEqualPrincipal(rep, 'cname', expected_cname) >+ if self.strict_checking: >+ self.assertElementEqualUTF8(rep, 'crealm', expected_crealm) >+ self.assertElementEqualPrincipal(rep, 'cname', expected_cname) > self.assertElementPresent(rep, 'ticket') > ticket = self.getElementValue(rep, 'ticket') > ticket_encpart = None >@@ -1682,8 +1683,9 @@ class RawKerberosTest(TestCaseInTempDir): > if encpart_decryption_key is not None: > self.assertElementEqual(encpart, 'etype', > encpart_decryption_key.etype) >- self.assertElementKVNO(encpart, 'kvno', >- encpart_decryption_key.kvno) >+ if self.strict_checking: >+ self.assertElementKVNO(encpart, 'kvno', >+ encpart_decryption_key.kvno) > rep_decpart = encpart_decryption_key.decrypt( > encpart_decryption_usage, > encpart_cipher) >@@ -1846,17 +1848,17 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementEqual(rep, 'pvno', 5) > self.assertElementEqual(rep, 'msg-type', KRB_ERROR) > self.assertElementEqual(rep, 'error-code', expected_error_mode) >- self.assertElementMissing(rep, 'ctime') >- self.assertElementMissing(rep, 'cusec') >+ if self.strict_checking: >+ self.assertElementMissing(rep, 'ctime') >+ self.assertElementMissing(rep, 'cusec') > self.assertElementPresent(rep, 'stime') > self.assertElementPresent(rep, 'susec') > # error-code checked above > if self.strict_checking: > self.assertElementMissing(rep, 'crealm') > self.assertElementMissing(rep, 'cname') >- self.assertElementEqualUTF8(rep, 'realm', expected_srealm) >- self.assertElementEqualPrincipal(rep, 'sname', expected_sname) >- if self.strict_checking: >+ self.assertElementEqualUTF8(rep, 'realm', expected_srealm) >+ self.assertElementEqualPrincipal(rep, 'sname', expected_sname) > self.assertElementMissing(rep, 'e-text') > if expected_error_mode == KDC_ERR_GENERIC: > self.assertElementMissing(rep, 'e-data') >@@ -1922,7 +1924,8 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(pk_as_rep19) > return > >- self.assertIsNotNone(etype_info2) >+ if self.strict_checking: >+ self.assertIsNotNone(etype_info2) > if expect_etype_info: > self.assertIsNotNone(etype_info) > else: >@@ -1931,23 +1934,22 @@ class RawKerberosTest(TestCaseInTempDir): > if unexpect_etype_info: > self.assertIsNone(etype_info) > >- self.assertGreaterEqual(len(etype_info2), 1) >- self.assertLessEqual(len(etype_info2), len(expect_etype_info2)) > if self.strict_checking: >+ self.assertGreaterEqual(len(etype_info2), 1) > self.assertEqual(len(etype_info2), len(expect_etype_info2)) >- for i in range(0, len(etype_info2)): >- e = self.getElementValue(etype_info2[i], 'etype') >- self.assertEqual(e, expect_etype_info2[i]) >- salt = self.getElementValue(etype_info2[i], 'salt') >- if e == kcrypto.Enctype.RC4: >- self.assertIsNone(salt) >- else: >- self.assertIsNotNone(salt) >- if expected_salt is not None: >- self.assertEqual(salt, expected_salt) >- s2kparams = self.getElementValue(etype_info2[i], 's2kparams') >- if self.strict_checking: >- self.assertIsNone(s2kparams) >+ for i in range(0, len(etype_info2)): >+ e = self.getElementValue(etype_info2[i], 'etype') >+ self.assertEqual(e, expect_etype_info2[i]) >+ salt = self.getElementValue(etype_info2[i], 'salt') >+ if e == kcrypto.Enctype.RC4: >+ self.assertIsNone(salt) >+ else: >+ self.assertIsNotNone(salt) >+ if expected_salt is not None: >+ self.assertEqual(salt, expected_salt) >+ s2kparams = self.getElementValue(etype_info2[i], 's2kparams') >+ if self.strict_checking: >+ self.assertIsNone(s2kparams) > if etype_info is not None: > self.assertEqual(len(etype_info), 1) > e = self.getElementValue(etype_info[0], 'etype') >diff --git a/selftest/knownfail.d/samba.tests.krb5.as_req_tests b/selftest/knownfail.d/samba.tests.krb5.as_req_tests >index f395bdc553b..35375dfcc8e 100644 >--- a/selftest/knownfail.d/samba.tests.krb5.as_req_tests >+++ b/selftest/knownfail.d/samba.tests.krb5.as_req_tests >@@ -1,45 +1,3 @@ >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2008r2dc >-- >2.25.1 > > >From 61bf6453b5d0a9971db10b5156db1aa9affc69cc Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 12:52:42 +1200 >Subject: [PATCH 159/380] tests/krb5: Check nonce in EncKDCRepPart > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 4951a105b0448854115a7ecc3d867be6f34b0dcf) >--- > python/samba/tests/krb5/raw_testcase.py | 10 +++++++--- > 1 file changed, 7 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 69b7c7adc9b..60e589464f3 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1442,7 +1442,6 @@ class RawKerberosTest(TestCaseInTempDir): > from_time=None, # optional > till_time=None, # required > renew_time=None, # optional >- nonce=None, # required > etypes=None, # required > addresses=None, # optional > additional_tickets=None, # optional >@@ -1463,8 +1462,12 @@ class RawKerberosTest(TestCaseInTempDir): > > if till_time is None: > till_time = self.get_KerberosTime(offset=36000) >- if nonce is None: >+ >+ if 'nonce' in kdc_exchange_dict: >+ nonce = kdc_exchange_dict['nonce'] >+ else: > nonce = self.get_Nonce() >+ kdc_exchange_dict['nonce'] = nonce > > req_body = self.KDC_REQ_BODY_create( > kdc_options=kdc_options, >@@ -1755,7 +1758,8 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementPresent(encpart_key, 'keyvalue') > encpart_session_key = self.EncryptionKey_import(encpart_key) > self.assertElementPresent(encpart_private, 'last-req') >- self.assertElementPresent(encpart_private, 'nonce') >+ self.assertElementEqual(encpart_private, 'nonce', >+ kdc_exchange_dict['nonce']) > # TODO self.assertElementPresent(encpart_private, > # 'key-expiration') > self.assertElementPresent(encpart_private, 'flags') >-- >2.25.1 > > >From de50b98999c3d1db3acf97be545d7443163bbaeb Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Jul 2021 19:27:02 +1200 >Subject: [PATCH 160/380] tests/krb5: Add generate_ap_req() method > >This method will be useful to generate an AP-REQ for use as FAST armor. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 4824dd4e9f40abcbd4134b79e2b2b8fb960f47e7) >--- > python/samba/tests/krb5/raw_testcase.py | 18 ++++++++++++++---- > 1 file changed, 14 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 60e589464f3..67b359f07d8 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1971,10 +1971,10 @@ class RawKerberosTest(TestCaseInTempDir): > kdc_exchange_dict['preauth_etype_info2'] = etype_info2 > return > >- def generate_simple_tgs_padata(self, >- kdc_exchange_dict, >- callback_dict, >- req_body): >+ def generate_ap_req(self, >+ kdc_exchange_dict, >+ _callback_dict, >+ req_body): > tgt = kdc_exchange_dict['tgt'] > authenticator_subkey = kdc_exchange_dict['authenticator_subkey'] > body_checksum_type = kdc_exchange_dict['body_checksum_type'] >@@ -2014,6 +2014,16 @@ class RawKerberosTest(TestCaseInTempDir): > ticket=tgt.ticket, > authenticator=authenticator) > ap_req = self.der_encode(ap_req_obj, asn1Spec=krb5_asn1.AP_REQ()) >+ >+ return ap_req >+ >+ def generate_simple_tgs_padata(self, >+ kdc_exchange_dict, >+ callback_dict, >+ req_body): >+ ap_req = self.generate_ap_req(kdc_exchange_dict, >+ callback_dict, >+ req_body) > pa_tgs_req = self.PA_DATA_create(PADATA_KDC_REQ, ap_req) > padata = [pa_tgs_req] > >-- >2.25.1 > > >From ab91d706e848a74e7a0652d0b3a58edd7d60f580 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 11:06:35 +1200 >Subject: [PATCH 161/380] tests/krb5: Ensure generated padata is not None > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit b6f96dd6395a30e15fa906959cbe665757aaba8d) >--- > python/samba/tests/krb5/as_req_tests.py | 6 +++++- > python/samba/tests/krb5/raw_testcase.py | 8 +++++++- > 2 files changed, 12 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index d9a66f99ecf..b5a6cfd31c7 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -89,12 +89,16 @@ class AsReqKerberosTests(KDCBaseTest): > req_body): > return initial_padata, req_body > >+ generate_padata_fn = (_generate_padata_copy >+ if initial_padata is not None >+ else None) >+ > kdc_exchange_dict = self.as_exchange_dict( > expected_crealm=expected_crealm, > expected_cname=expected_cname, > expected_srealm=expected_srealm, > expected_sname=expected_sname, >- generate_padata_fn=_generate_padata_copy, >+ generate_padata_fn=generate_padata_fn, > check_error_fn=self.generic_check_as_error, > check_rep_fn=None, > expected_error_mode=expected_error_mode, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 67b359f07d8..e15fc44a962 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1489,6 +1489,7 @@ class RawKerberosTest(TestCaseInTempDir): > padata, req_body = generate_padata_fn(kdc_exchange_dict, > callback_dict, > req_body) >+ self.assertIsNotNone(padata) > else: > padata = None > >@@ -2082,13 +2083,18 @@ class RawKerberosTest(TestCaseInTempDir): > check_error_fn = self.generic_check_as_error > check_rep_fn = None > >+ if padata is not None: >+ generate_padata_fn = _generate_padata_copy >+ else: >+ generate_padata_fn = None >+ > kdc_exchange_dict = self.as_exchange_dict( > expected_crealm=expected_crealm, > expected_cname=expected_cname, > expected_srealm=expected_srealm, > expected_sname=expected_sname, > ticket_decryption_key=ticket_decryption_key, >- generate_padata_fn=_generate_padata_copy, >+ generate_padata_fn=generate_padata_fn, > check_error_fn=check_error_fn, > check_rep_fn=check_rep_fn, > check_padata_fn=_check_padata_preauth_key, >-- >2.25.1 > > >From 3e0cf5233537cfbff4818c4a810087d78fcc51f5 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 13:59:36 +1200 >Subject: [PATCH 162/380] tests/krb5: Generate AP-REQ for TGS request in > _generic_kdc_exchange() > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 025737deb5325d25b2ae4c57583c24ae1d0eca33) >--- > python/samba/tests/krb5/raw_testcase.py | 21 +++++++++++++++++++++ > 1 file changed, 21 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index e15fc44a962..4f399467cfe 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1484,13 +1484,34 @@ class RawKerberosTest(TestCaseInTempDir): > EncAuthorizationData=EncAuthorizationData, > EncAuthorizationData_key=EncAuthorizationData_key, > EncAuthorizationData_usage=EncAuthorizationData_usage) >+ >+ if req_msg_type == KRB_AS_REQ: >+ tgs_req = None >+ tgs_req_padata = None >+ else: >+ self.assertEqual(KRB_TGS_REQ, req_msg_type) >+ >+ tgs_req = self.generate_ap_req(kdc_exchange_dict, >+ callback_dict, >+ req_body) >+ tgs_req_padata = self.PA_DATA_create(PADATA_KDC_REQ, tgs_req) >+ > if generate_padata_fn is not None: > # This can alter req_body... > padata, req_body = generate_padata_fn(kdc_exchange_dict, > callback_dict, > req_body) > self.assertIsNotNone(padata) >+ self.assertNotIn(PADATA_KDC_REQ, >+ [pa['padata-type'] for pa in padata], >+ 'Don\'t create TGS-REQ manually') > else: >+ padata = [] >+ >+ if tgs_req_padata is not None: >+ padata.insert(0, tgs_req_padata) >+ >+ if not padata: > padata = None > > kdc_exchange_dict['req_padata'] = padata >-- >2.25.1 > > >From c93576b53b7f5e01b5fe794a710b4bfbf7afc65b Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 6 Jul 2021 10:21:07 +1200 >Subject: [PATCH 163/380] tests/krb5: Add more ASN1 definitions for FAST > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit ec702900295100ae4e48ba57242eee6670bf30d6) >--- > python/samba/tests/krb5/rfc4120.asn1 | 106 ++++++++++++++++++- > python/samba/tests/krb5/rfc4120_constants.py | 33 ++++++ > python/samba/tests/krb5/rfc4120_pyasn1.py | 100 ++++++++++++++++- > 3 files changed, 236 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/rfc4120.asn1 b/python/samba/tests/krb5/rfc4120.asn1 >index d81d06ad6f7..f47c1d00202 100644 >--- a/python/samba/tests/krb5/rfc4120.asn1 >+++ b/python/samba/tests/krb5/rfc4120.asn1 >@@ -1,3 +1,43 @@ >+-- Portions of these ASN.1 modules are structures are from RFC6113 >+-- authored by S. Hartman (Painless Security) and L. Zhu (Microsoft) >+-- >+-- Copyright (c) 2011 IETF Trust and the persons identified as authors of the >+-- code. All rights reserved. >+-- >+-- Redistribution and use in source and binary forms, with or without >+-- modification, is permitted pursuant to, and subject to the license terms >+-- contained in, the Simplified BSD License set forth in Section 4.c of the IETF >+-- Trustâs Legal Provisions Relating to IETF Documents >+-- (http://trustee.ietf.org/license-info). >+-- >+-- BSD License: >+-- >+-- Copyright (c) 2011 IETF Trust and the persons identified as authors of the code. All rights reserved. >+-- Redistribution and use in source and binary forms, with or without modification, are permitted provided >+-- that the following conditions are met: >+-- ⢠Redistributions of source code must retain the above copyright notice, this list of conditions and >+-- the following disclaimer. >+-- >+-- ⢠Redistributions in binary form must reproduce the above copyright notice, this list of conditions >+-- and the following disclaimer in the documentation and/or other materials provided with the >+-- distribution. >+-- >+-- ⢠Neither the name of Internet Society, IETF or IETF Trust, nor the names of specific contributors, >+-- may be used to endorse or promote products derived from this software without specific prior written >+-- permission. >+-- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS âAS ISâ >+-- AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE >+-- IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE >+-- ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE >+-- LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR >+-- CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF >+-- SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS >+-- INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN >+-- CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) >+-- ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE >+-- POSSIBILITY OF SUCH DAMAGE. >+-- >+ > KerberosV5Spec2 { > iso(1) identified-organization(3) dod(6) internet(1) > security(5) kerberosV5(2) modules(4) krb5spec2(2) >@@ -464,6 +504,69 @@ PA-PAC-OPTIONS ::= SEQUENCE { > KERB-KEY-LIST-REQ ::= SEQUENCE OF EncryptionType -- Int32 encryption type -- > KERB-KEY-LIST-REP ::= SEQUENCE OF EncryptionKey > >+FastOptions ::= BIT STRING { >+ reserved(0), >+ hide-client-names(1), >+ kdc-follow-referrals(16) >+} >+ >+KrbFastReq ::= SEQUENCE { >+ fast-options [0] FastOptions, >+ padata [1] SEQUENCE OF PA-DATA, >+ req-body [2] KDC-REQ-BODY, >+ ... >+} >+ >+KrbFastArmor ::= SEQUENCE { >+ armor-type [0] Int32, >+ armor-value [1] OCTET STRING, >+ ... >+} >+ >+KrbFastArmoredReq ::= SEQUENCE { >+ armor [0] KrbFastArmor OPTIONAL, >+ req-checksum [1] Checksum, >+ enc-fast-req [2] EncryptedData -- KrbFastReq -- >+} >+ >+PA-FX-FAST-REQUEST ::= CHOICE { >+ armored-data [0] KrbFastArmoredReq, >+ ... >+} >+ >+KrbFastFinished ::= SEQUENCE { >+ timestamp [0] KerberosTime, >+ usec [1] Int32, >+ crealm [2] Realm, >+ cname [3] PrincipalName, >+ ticket-checksum [4] Checksum, >+ ... >+} >+ >+KrbFastResponse ::= SEQUENCE { >+ padata [0] SEQUENCE OF PA-DATA, >+ -- padata typed holes. >+ strengthen-key [1] EncryptionKey OPTIONAL, >+ -- This, if present, strengthens the reply key for AS and >+ -- TGS. MUST be present for TGS. >+ -- MUST be absent in KRB-ERROR. >+ finished [2] KrbFastFinished OPTIONAL, >+ -- Present in AS or TGS reply; absent otherwise. >+ nonce [3] UInt32, >+ -- Nonce from the client request. >+ ... >+} >+ >+KrbFastArmoredRep ::= SEQUENCE { >+ enc-fast-rep [0] EncryptedData, -- KrbFastResponse -- >+ ... >+} >+ >+PA-FX-FAST-REPLY ::= CHOICE { >+ armored-data [0] KrbFastArmoredRep, >+ ... >+} >+ > -- MS-KILE End > -- > -- >@@ -631,7 +734,8 @@ PADataTypeValues ::= INTEGER { > kRB5-PADATA-PKINIT-KX(147), -- krb-wg-anon > kRB5-PADATA-PKU2U-NAME(148), -- zhu-pku2u > kRB5-PADATA-REQ-ENC-PA-REP(149), -- >- kRB5-PADATA-SUPPORTED-ETYPES(165) -- MS-KILE >+ kRB5-PADATA-SUPPORTED-ETYPES(165), -- MS-KILE >+ kRB5-PADATA-PAC-OPTIONS(167) -- MS-KILE > } > PADataTypeSequence ::= SEQUENCE { > dummy [0] PADataTypeValues >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index b00b8b48ae5..e1a688991a7 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -36,29 +36,44 @@ KRB_TGS_REQ = int(krb5_asn1.MessageTypeValues('krb-tgs-req')) > # PAData types > PADATA_ENC_TIMESTAMP = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-ENC-TIMESTAMP')) >+PADATA_ENCRYPTED_CHALLENGE = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-ENCRYPTED-CHALLENGE')) > PADATA_ETYPE_INFO = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-ETYPE-INFO')) > PADATA_ETYPE_INFO2 = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-ETYPE-INFO2')) > PADATA_FOR_USER = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-FOR-USER')) >+PADATA_FX_COOKIE = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-FX-COOKIE')) >+PADATA_FX_ERROR = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-FX-ERROR')) >+PADATA_FX_FAST = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-FX-FAST')) > PADATA_KDC_REQ = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-KDC-REQ')) >+PADATA_PAC_OPTIONS = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-PAC-OPTIONS')) > PADATA_PAC_REQUEST = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-PA-PAC-REQUEST')) > PADATA_PK_AS_REQ = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-PK-AS-REQ')) > PADATA_PK_AS_REP_19 = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-PK-AS-REP-19')) >+PADATA_SUPPORTED_ETYPES = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-SUPPORTED-ETYPES')) > > # Error codes > KDC_ERR_C_PRINCIPAL_UNKNOWN = 6 >+KDC_ERR_POLICY = 12 > KDC_ERR_ETYPE_NOSUPP = 14 > KDC_ERR_PREAUTH_FAILED = 24 > KDC_ERR_PREAUTH_REQUIRED = 25 >+KDC_ERR_NOT_US = 35 > KDC_ERR_BADMATCH = 36 > KDC_ERR_SKEW = 37 > KDC_ERR_GENERIC = 60 >+KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS = 93 > > # Name types > NT_UNKNOWN = int(krb5_asn1.NameTypeValues('kRB5-NT-UNKNOWN')) >@@ -67,6 +82,7 @@ NT_SRV_HST = int(krb5_asn1.NameTypeValues('kRB5-NT-SRV-HST')) > NT_SRV_INST = int(krb5_asn1.NameTypeValues('kRB5-NT-SRV-INST')) > NT_ENTERPRISE_PRINCIPAL = int(krb5_asn1.NameTypeValues( > 'kRB5-NT-ENTERPRISE-PRINCIPAL')) >+NT_WELLKNOWN = int(krb5_asn1.NameTypeValues('kRB5-NT-WELLKNOWN')) > > # Authorization data ad-type values > >@@ -79,6 +95,8 @@ AD_MANDATORY_TICKET_EXTENSIONS = 6 > AD_IN_TICKET_EXTENSIONS = 7 > AD_MANDATORY_FOR_KDC = 8 > AD_INITIAL_VERIFIED_CAS = 9 >+AD_FX_FAST_ARMOR = 71 >+AD_FX_FAST_USED = 72 > AD_WIN2K_PAC = 128 > AD_SIGNTICKET = 512 > >@@ -133,3 +151,18 @@ KU_KRB_SAFE_CKSUM = 15 > (section 5.6.1) ''' > KU_NON_KERB_SALT = 16 > KU_NON_KERB_CKSUM_SALT = 17 >+ >+KU_ACCEPTOR_SEAL = 22 >+KU_ACCEPTOR_SIGN = 23 >+KU_INITIATOR_SEAL = 24 >+KU_INITIATOR_SIGN = 25 >+ >+KU_FAST_REQ_CHKSUM = 50 >+KU_FAST_ENC = 51 >+KU_FAST_REP = 52 >+KU_FAST_FINISHED = 53 >+KU_ENC_CHALLENGE_CLIENT = 54 >+KU_ENC_CHALLENGE_KDC = 55 >+ >+# Armor types >+FX_FAST_ARMOR_AP_REQUEST = 1 >diff --git a/python/samba/tests/krb5/rfc4120_pyasn1.py b/python/samba/tests/krb5/rfc4120_pyasn1.py >index 56fe02a68f0..39ec8ed7982 100644 >--- a/python/samba/tests/krb5/rfc4120_pyasn1.py >+++ b/python/samba/tests/krb5/rfc4120_pyasn1.py >@@ -1,5 +1,5 @@ > # Auto-generated by asn1ate v.0.6.1.dev0 from rfc4120.asn1 >-# (last modified on 2021-06-16 08:54:13.969508) >+# (last modified on 2021-06-25 12:10:34.484667) > > # KerberosV5Spec2 > from pyasn1.type import univ, char, namedtype, namedval, tag, constraint, useful >@@ -619,6 +619,17 @@ EncryptionTypeSequence.componentType = namedtype.NamedTypes( > ) > > >+class FastOptions(univ.BitString): >+ pass >+ >+ >+FastOptions.namedValues = namedval.NamedValues( >+ ('reserved', 0), >+ ('hide-client-names', 1), >+ ('kdc-follow-referrals', 16) >+) >+ >+ > class KDCOptionsValues(univ.BitString): > pass > >@@ -800,6 +811,72 @@ KerbErrorDataTypeSequence.componentType = namedtype.NamedTypes( > ) > > >+class KrbFastArmor(univ.Sequence): >+ pass >+ >+ >+KrbFastArmor.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('armor-type', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('armor-value', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) >+) >+ >+ >+class KrbFastArmoredRep(univ.Sequence): >+ pass >+ >+ >+KrbFastArmoredRep.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('enc-fast-rep', EncryptedData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))) >+) >+ >+ >+class KrbFastArmoredReq(univ.Sequence): >+ pass >+ >+ >+KrbFastArmoredReq.componentType = namedtype.NamedTypes( >+ namedtype.OptionalNamedType('armor', KrbFastArmor().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))), >+ namedtype.NamedType('req-checksum', Checksum().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1))), >+ namedtype.NamedType('enc-fast-req', EncryptedData().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))) >+) >+ >+ >+class KrbFastFinished(univ.Sequence): >+ pass >+ >+ >+KrbFastFinished.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('timestamp', KerberosTime().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('usec', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('crealm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))), >+ namedtype.NamedType('cname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))), >+ namedtype.NamedType('ticket-checksum', Checksum().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4))) >+) >+ >+ >+class KrbFastReq(univ.Sequence): >+ pass >+ >+ >+KrbFastReq.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('fast-options', FastOptions().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.NamedType('padata', univ.SequenceOf(componentType=PA_DATA()).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.NamedType('req-body', KDC_REQ_BODY().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))) >+) >+ >+ >+class KrbFastResponse(univ.Sequence): >+ pass >+ >+ >+KrbFastResponse.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('padata', univ.SequenceOf(componentType=PA_DATA()).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >+ namedtype.OptionalNamedType('strengthen-key', EncryptionKey().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1))), >+ namedtype.OptionalNamedType('finished', KrbFastFinished().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))), >+ namedtype.NamedType('nonce', UInt32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))) >+) >+ >+ > class MessageTypeValues(univ.Integer): > pass > >@@ -871,6 +948,24 @@ PA_ENC_TS_ENC.componentType = namedtype.NamedTypes( > ) > > >+class PA_FX_FAST_REPLY(univ.Choice): >+ pass >+ >+ >+PA_FX_FAST_REPLY.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('armored-data', KrbFastArmoredRep().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))) >+) >+ >+ >+class PA_FX_FAST_REQUEST(univ.Choice): >+ pass >+ >+ >+PA_FX_FAST_REQUEST.componentType = namedtype.NamedTypes( >+ namedtype.NamedType('armored-data', KrbFastArmoredReq().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))) >+) >+ >+ > class PACOptionFlags(KerberosFlags): > pass > >@@ -980,7 +1075,8 @@ PADataTypeValues.namedValues = namedval.NamedValues( > ('kRB5-PADATA-PKINIT-KX', 147), > ('kRB5-PADATA-PKU2U-NAME', 148), > ('kRB5-PADATA-REQ-ENC-PA-REP', 149), >- ('kRB5-PADATA-SUPPORTED-ETYPES', 165) >+ ('kRB5-PADATA-SUPPORTED-ETYPES', 165), >+ ('kRB5-PADATA-PAC-OPTIONS', 167) > ) > > >-- >2.25.1 > > >From 3655819f95e7075dd6a85af17f5d5105fe26731e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 6 Jul 2021 10:23:26 +1200 >Subject: [PATCH 164/380] tests/krb5: Add more methods to create ASN1 objects > for FAST > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 69a66c0d2a7ed415c8d8acdb8da0f2f3d1abf60d) >--- > python/samba/tests/krb5/raw_testcase.py | 70 +++++++++++++++++++++++++ > 1 file changed, 70 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 4f399467cfe..46ce7605edf 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1013,6 +1013,17 @@ class RawKerberosTest(TestCaseInTempDir): > } > return PrincipalName_obj > >+ def AuthorizationData_create(self, ad_type, ad_data): >+ # AuthorizationData ::= SEQUENCE { >+ # ad-type [0] Int32, >+ # ad-data [1] OCTET STRING >+ # } >+ AUTH_DATA_obj = { >+ 'ad-type': ad_type, >+ 'ad-data': ad_data >+ } >+ return AUTH_DATA_obj >+ > def PA_DATA_create(self, padata_type, padata_value): > # PA-DATA ::= SEQUENCE { > # -- NOTE: first tag is [1], not [0] >@@ -1036,6 +1047,65 @@ class RawKerberosTest(TestCaseInTempDir): > } > return PA_ENC_TS_ENC_obj > >+ def PA_PAC_OPTIONS_create(self, options): >+ # PA-PAC-OPTIONS ::= SEQUENCE { >+ # options [0] PACOptionFlags >+ # } >+ PA_PAC_OPTIONS_obj = { >+ 'options': options >+ } >+ return PA_PAC_OPTIONS_obj >+ >+ def KRB_FAST_ARMOR_create(self, armor_type, armor_value): >+ # KrbFastArmor ::= SEQUENCE { >+ # armor-type [0] Int32, >+ # armor-value [1] OCTET STRING, >+ # ... >+ # } >+ KRB_FAST_ARMOR_obj = { >+ 'armor-type': armor_type, >+ 'armor-value': armor_value >+ } >+ return KRB_FAST_ARMOR_obj >+ >+ def KRB_FAST_REQ_create(self, fast_options, padata, req_body): >+ # KrbFastReq ::= SEQUENCE { >+ # fast-options [0] FastOptions, >+ # padata [1] SEQUENCE OF PA-DATA, >+ # req-body [2] KDC-REQ-BODY, >+ # ... >+ # } >+ KRB_FAST_REQ_obj = { >+ 'fast-options': fast_options, >+ 'padata': padata, >+ 'req-body': req_body >+ } >+ return KRB_FAST_REQ_obj >+ >+ def KRB_FAST_ARMORED_REQ_create(self, armor, req_checksum, enc_fast_req): >+ # KrbFastArmoredReq ::= SEQUENCE { >+ # armor [0] KrbFastArmor OPTIONAL, >+ # req-checksum [1] Checksum, >+ # enc-fast-req [2] EncryptedData -- KrbFastReq -- >+ # } >+ KRB_FAST_ARMORED_REQ_obj = { >+ 'req-checksum': req_checksum, >+ 'enc-fast-req': enc_fast_req >+ } >+ if armor is not None: >+ KRB_FAST_ARMORED_REQ_obj['armor'] = armor >+ return KRB_FAST_ARMORED_REQ_obj >+ >+ def PA_FX_FAST_REQUEST_create(self, armored_data): >+ # PA-FX-FAST-REQUEST ::= CHOICE { >+ # armored-data [0] KrbFastArmoredReq, >+ # ... >+ # } >+ PA_FX_FAST_REQUEST_obj = { >+ 'armored-data': armored_data >+ } >+ return PA_FX_FAST_REQUEST_obj >+ > def KERB_PA_PAC_REQUEST_create(self, include_pac, pa_data_create=True): > # KERB-PA-PAC-REQUEST ::= SEQUENCE { > # include-pac[0] BOOLEAN --If TRUE, and no pac present, >-- >2.25.1 > > >From 9a15a294f4c5d9204d00d9bf67ebe5ba85099856 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 6 Jul 2021 12:47:18 +1200 >Subject: [PATCH 165/380] tests/krb5: Add method to generate FAST encrypted > challenge padata > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit aafc86896969d02ff1daecdf2668bfa642860082) >--- > python/samba/tests/krb5/kdc_base_test.py | 19 +++++++++++++++++++ > 1 file changed, 19 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 1b550179e0e..24a1e7cfbc8 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -54,11 +54,13 @@ from samba.tests.krb5.rfc4120_constants import ( > KRB_TGS_REP, > KRB_ERROR, > KU_AS_REP_ENC_PART, >+ KU_ENC_CHALLENGE_CLIENT, > KU_PA_ENC_TIMESTAMP, > KU_TGS_REP_ENC_PART_SUB_KEY, > KU_TICKET, > NT_PRINCIPAL, > NT_SRV_HST, >+ PADATA_ENCRYPTED_CHALLENGE, > PADATA_ENC_TIMESTAMP, > PADATA_ETYPE_INFO2, > ) >@@ -511,6 +513,23 @@ class KDCBaseTest(RawKerberosTest): > > return padata > >+ def get_challenge_pa_data(self, client_challenge_key, skew=0): >+ patime, pausec = self.get_KerberosTimeWithUsec(offset=skew) >+ padata = self.PA_ENC_TS_ENC_create(patime, pausec) >+ padata = self.der_encode(padata, >+ asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) >+ >+ padata = self.EncryptedData_create(client_challenge_key, >+ KU_ENC_CHALLENGE_CLIENT, >+ padata) >+ padata = self.der_encode(padata, >+ asn1Spec=krb5_asn1.EncryptedData()) >+ >+ padata = self.PA_DATA_create(PADATA_ENCRYPTED_CHALLENGE, >+ padata) >+ >+ return padata >+ > def get_as_rep_enc_data(self, key, rep): > ''' Decrypt and Decode the encrypted data in an AS-REP > ''' >-- >2.25.1 > > >From 6d273dc87ed6ccf3e95ac5418aeb9831e6608ec5 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 6 Jul 2021 12:49:05 +1200 >Subject: [PATCH 166/380] tests/krb5: Add methods to calculate keys for FAST > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 080894067469d60e2c71961c2d1c1990ba15b917) >--- > python/samba/tests/krb5/raw_testcase.py | 37 +++++++++++++++++++++++++ > 1 file changed, 37 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 46ce7605edf..113f08628b6 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2137,6 +2137,43 @@ class RawKerberosTest(TestCaseInTempDir): > > return subkey, subkey_usage > >+ def generate_armor_key(self, subkey, session_key): >+ armor_key = kcrypto.cf2(subkey.key, >+ session_key.key, >+ b'subkeyarmor', >+ b'ticketarmor') >+ armor_key = Krb5EncryptionKey(armor_key, None) >+ >+ return armor_key >+ >+ def generate_strengthen_reply_key(self, strengthen_key, reply_key): >+ strengthen_reply_key = kcrypto.cf2(strengthen_key.key, >+ reply_key.key, >+ b'strengthenkey', >+ b'replykey') >+ strengthen_reply_key = Krb5EncryptionKey(strengthen_reply_key, >+ reply_key.kvno) >+ >+ return strengthen_reply_key >+ >+ def generate_client_challenge_key(self, armor_key, longterm_key): >+ client_challenge_key = kcrypto.cf2(armor_key.key, >+ longterm_key.key, >+ b'clientchallengearmor', >+ b'challengelongterm') >+ client_challenge_key = Krb5EncryptionKey(client_challenge_key, None) >+ >+ return client_challenge_key >+ >+ def generate_kdc_challenge_key(self, armor_key, longterm_key): >+ kdc_challenge_key = kcrypto.cf2(armor_key.key, >+ longterm_key.key, >+ b'kdcchallengearmor', >+ b'challengelongterm') >+ kdc_challenge_key = Krb5EncryptionKey(kdc_challenge_key, None) >+ >+ return kdc_challenge_key >+ > def _test_as_exchange(self, > cname, > realm, >-- >2.25.1 > > >From 7b5450a30e03fed96c45572ecdc98e3696e7b698 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Jul 2021 20:49:12 +1200 >Subject: [PATCH 167/380] tests/krb5: Rename generic_check_as_error() to > generic_check_kdc_error() > >This method will also be useful in checking TGS-REP error replies. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 74f332c6f9e31b933837cefee69b219054970713) >--- > python/samba/tests/krb5/as_req_tests.py | 2 +- > python/samba/tests/krb5/raw_testcase.py | 10 +++++----- > 2 files changed, 6 insertions(+), 6 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index b5a6cfd31c7..fd258e8164a 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -99,7 +99,7 @@ class AsReqKerberosTests(KDCBaseTest): > expected_srealm=expected_srealm, > expected_sname=expected_sname, > generate_padata_fn=generate_padata_fn, >- check_error_fn=self.generic_check_as_error, >+ check_error_fn=self.generic_check_kdc_error, > check_rep_fn=None, > expected_error_mode=expected_error_mode, > client_as_etypes=client_as_etypes, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 113f08628b6..047bf413b34 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1888,10 +1888,10 @@ class RawKerberosTest(TestCaseInTempDir): > > kdc_exchange_dict['rep_ticket_creds'] = ticket_creds > >- def generic_check_as_error(self, >- kdc_exchange_dict, >- callback_dict, >- rep): >+ def generic_check_kdc_error(self, >+ kdc_exchange_dict, >+ callback_dict, >+ rep): > > expected_crealm = kdc_exchange_dict['expected_crealm'] > expected_cname = kdc_exchange_dict['expected_cname'] >@@ -2208,7 +2208,7 @@ class RawKerberosTest(TestCaseInTempDir): > check_error_fn = None > check_rep_fn = self.generic_check_kdc_rep > else: >- check_error_fn = self.generic_check_as_error >+ check_error_fn = self.generic_check_kdc_error > check_rep_fn = None > > if padata is not None: >-- >2.25.1 > > >From 2e4cb2a76a88b2cc9260147d5e81cd451d935fac Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 29 Jul 2021 10:19:46 +1200 >Subject: [PATCH 168/380] tests/krb5: Include authenticator_subkey in AS-REQ > exchange dict > >This is needed for FAST. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d554b6dc0f4e14d154e487dc2a842321aa746155) >--- > python/samba/tests/krb5/raw_testcase.py | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 047bf413b34..9375f39937e 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1632,6 +1632,7 @@ class RawKerberosTest(TestCaseInTempDir): > expected_error_mode=0, > client_as_etypes=None, > expected_salt=None, >+ authenticator_subkey=None, > kdc_options=''): > kdc_exchange_dict = { > 'req_msg_type': KRB_AS_REQ, >@@ -1653,6 +1654,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'expected_error_mode': expected_error_mode, > 'client_as_etypes': client_as_etypes, > 'expected_salt': expected_salt, >+ 'authenticator_subkey': authenticator_subkey, > 'kdc_options': kdc_options, > } > if callback_dict is None: >-- >2.25.1 > > >From 3104ed28289999f88bf3c6f7d1b6c8ed23758a98 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 29 Jul 2021 10:33:10 +1200 >Subject: [PATCH 169/380] tests/krb5: Modify generate_ap_req() to also generate > FAST armor AP-REQ > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 5c2cd71ae704b853a886c8af5e3cf50b53af7f9e) >--- > python/samba/tests/krb5/raw_testcase.py | 45 ++++++++++++++++++------- > 1 file changed, 32 insertions(+), 13 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 9375f39937e..29ea41ec92b 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -49,6 +49,7 @@ from samba.tests.krb5.rfc4120_constants import ( > KRB_ERROR, > KRB_TGS_REP, > KRB_TGS_REQ, >+ KU_AP_REQ_AUTH, > KU_AS_REP_ENC_PART, > KU_NON_KERB_CKSUM_SALT, > KU_TGS_REP_ENC_PART_SESSION, >@@ -1563,7 +1564,8 @@ class RawKerberosTest(TestCaseInTempDir): > > tgs_req = self.generate_ap_req(kdc_exchange_dict, > callback_dict, >- req_body) >+ req_body, >+ armor=False) > tgs_req_padata = self.PA_DATA_create(PADATA_KDC_REQ, tgs_req) > > if generate_padata_fn is not None: >@@ -1633,6 +1635,8 @@ class RawKerberosTest(TestCaseInTempDir): > client_as_etypes=None, > expected_salt=None, > authenticator_subkey=None, >+ armor_tgt=None, >+ armor_subkey=None, > kdc_options=''): > kdc_exchange_dict = { > 'req_msg_type': KRB_AS_REQ, >@@ -1655,6 +1659,8 @@ class RawKerberosTest(TestCaseInTempDir): > 'client_as_etypes': client_as_etypes, > 'expected_salt': expected_salt, > 'authenticator_subkey': authenticator_subkey, >+ 'armor_tgt': armor_tgt, >+ 'armor_subkey': armor_subkey, > 'kdc_options': kdc_options, > } > if callback_dict is None: >@@ -1675,6 +1681,8 @@ class RawKerberosTest(TestCaseInTempDir): > check_kdc_private_fn=None, > callback_dict=None, > tgt=None, >+ armor_tgt=None, >+ armor_subkey=None, > authenticator_subkey=None, > body_checksum_type=None, > kdc_options=''): >@@ -1697,6 +1705,8 @@ class RawKerberosTest(TestCaseInTempDir): > 'callback_dict': callback_dict, > 'tgt': tgt, > 'body_checksum_type': body_checksum_type, >+ 'armor_tgt': armor_tgt, >+ 'armor_subkey': armor_subkey, > 'authenticator_subkey': authenticator_subkey, > 'kdc_options': kdc_options > } >@@ -2068,18 +2078,25 @@ class RawKerberosTest(TestCaseInTempDir): > def generate_ap_req(self, > kdc_exchange_dict, > _callback_dict, >- req_body): >- tgt = kdc_exchange_dict['tgt'] >- authenticator_subkey = kdc_exchange_dict['authenticator_subkey'] >- body_checksum_type = kdc_exchange_dict['body_checksum_type'] >+ req_body, >+ armor): >+ if armor: >+ tgt = kdc_exchange_dict['armor_tgt'] >+ authenticator_subkey = kdc_exchange_dict['armor_subkey'] > >- req_body_blob = self.der_encode(req_body, >- asn1Spec=krb5_asn1.KDC_REQ_BODY()) >+ req_body_checksum = None >+ else: >+ tgt = kdc_exchange_dict['tgt'] >+ authenticator_subkey = kdc_exchange_dict['authenticator_subkey'] >+ body_checksum_type = kdc_exchange_dict['body_checksum_type'] > >- req_body_checksum = self.Checksum_create(tgt.session_key, >- KU_TGS_REQ_AUTH_CKSUM, >- req_body_blob, >- ctype=body_checksum_type) >+ req_body_blob = self.der_encode(req_body, >+ asn1Spec=krb5_asn1.KDC_REQ_BODY()) >+ >+ req_body_checksum = self.Checksum_create(tgt.session_key, >+ KU_TGS_REQ_AUTH_CKSUM, >+ req_body_blob, >+ ctype=body_checksum_type) > > subkey_obj = None > if authenticator_subkey is not None: >@@ -2099,8 +2116,9 @@ class RawKerberosTest(TestCaseInTempDir): > authenticator_obj, > asn1Spec=krb5_asn1.Authenticator()) > >+ usage = KU_AP_REQ_AUTH if armor else KU_TGS_REQ_AUTH > authenticator = self.EncryptedData_create(tgt.session_key, >- KU_TGS_REQ_AUTH, >+ usage, > authenticator_blob) > > ap_options = krb5_asn1.APOptions('0') >@@ -2117,7 +2135,8 @@ class RawKerberosTest(TestCaseInTempDir): > req_body): > ap_req = self.generate_ap_req(kdc_exchange_dict, > callback_dict, >- req_body) >+ req_body, >+ armor=False) > pa_tgs_req = self.PA_DATA_create(PADATA_KDC_REQ, ap_req) > padata = [pa_tgs_req] > >-- >2.25.1 > > >From 87e2203840aa4e78af2f07fddf1345ce402af74d Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 29 Jul 2021 10:33:24 +1200 >Subject: [PATCH 170/380] tests/krb5: Add FAST armor generation to > _generic_kdc_exchange() > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 0df385fc49cc2693c195209936a29e31216df16d) >--- > python/samba/tests/krb5/raw_testcase.py | 95 +++++++++++++++++++++++-- > 1 file changed, 88 insertions(+), 7 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 29ea41ec92b..151dc0355a3 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -42,6 +42,7 @@ from samba.tests import TestCaseInTempDir > > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( >+ FX_FAST_ARMOR_AP_REQUEST, > KDC_ERR_GENERIC, > KRB_AP_REQ, > KRB_AS_REP, >@@ -51,6 +52,7 @@ from samba.tests.krb5.rfc4120_constants import ( > KRB_TGS_REQ, > KU_AP_REQ_AUTH, > KU_AS_REP_ENC_PART, >+ KU_FAST_REQ_CHKSUM, > KU_NON_KERB_CKSUM_SALT, > KU_TGS_REP_ENC_PART_SESSION, > KU_TGS_REP_ENC_PART_SUB_KEY, >@@ -1522,6 +1524,9 @@ class RawKerberosTest(TestCaseInTempDir): > > check_error_fn = kdc_exchange_dict['check_error_fn'] > check_rep_fn = kdc_exchange_dict['check_rep_fn'] >+ generate_fast_fn = kdc_exchange_dict['generate_fast_fn'] >+ generate_fast_armor_fn = kdc_exchange_dict['generate_fast_armor_fn'] >+ generate_fast_padata_fn = kdc_exchange_dict['generate_fast_padata_fn'] > generate_padata_fn = kdc_exchange_dict['generate_padata_fn'] > callback_dict = kdc_exchange_dict['callback_dict'] > req_msg_type = kdc_exchange_dict['req_msg_type'] >@@ -1568,25 +1573,81 @@ class RawKerberosTest(TestCaseInTempDir): > armor=False) > tgs_req_padata = self.PA_DATA_create(PADATA_KDC_REQ, tgs_req) > >+ if generate_fast_padata_fn is not None: >+ self.assertIsNotNone(generate_fast_fn) >+ # This can alter req_body... >+ fast_padata, req_body = generate_fast_padata_fn(kdc_exchange_dict, >+ callback_dict, >+ req_body) >+ else: >+ fast_padata = [] >+ >+ if generate_fast_armor_fn is not None: >+ self.assertIsNotNone(generate_fast_fn) >+ fast_ap_req = generate_fast_armor_fn(kdc_exchange_dict, >+ callback_dict, >+ req_body, >+ armor=True) >+ >+ fast_armor_type = kdc_exchange_dict['fast_armor_type'] >+ fast_armor = self.KRB_FAST_ARMOR_create(fast_armor_type, >+ fast_ap_req) >+ else: >+ fast_armor = None >+ > if generate_padata_fn is not None: > # This can alter req_body... >- padata, req_body = generate_padata_fn(kdc_exchange_dict, >- callback_dict, >- req_body) >- self.assertIsNotNone(padata) >+ outer_padata, req_body = generate_padata_fn(kdc_exchange_dict, >+ callback_dict, >+ req_body) >+ self.assertIsNotNone(outer_padata) > self.assertNotIn(PADATA_KDC_REQ, >- [pa['padata-type'] for pa in padata], >+ [pa['padata-type'] for pa in outer_padata], > 'Don\'t create TGS-REQ manually') > else: >- padata = [] >+ outer_padata = None >+ >+ if generate_fast_fn is not None: >+ armor_key = kdc_exchange_dict['armor_key'] >+ self.assertIsNotNone(armor_key) >+ >+ if req_msg_type == KRB_AS_REQ: >+ checksum_blob = self.der_encode( >+ req_body, >+ asn1Spec=krb5_asn1.KDC_REQ_BODY()) >+ else: >+ self.assertEqual(KRB_TGS_REQ, req_msg_type) >+ checksum_blob = tgs_req >+ >+ checksum = self.Checksum_create(armor_key, >+ KU_FAST_REQ_CHKSUM, >+ checksum_blob) >+ >+ fast = generate_fast_fn(kdc_exchange_dict, >+ callback_dict, >+ req_body, >+ fast_padata, >+ fast_armor, >+ checksum) >+ else: >+ fast = None >+ >+ padata = [] > > if tgs_req_padata is not None: >- padata.insert(0, tgs_req_padata) >+ padata.append(tgs_req_padata) >+ >+ if fast is not None: >+ padata.append(fast) >+ >+ if outer_padata is not None: >+ padata += outer_padata > > if not padata: > padata = None > > kdc_exchange_dict['req_padata'] = padata >+ kdc_exchange_dict['fast_padata'] = fast_padata > kdc_exchange_dict['req_body'] = req_body > > req_obj, req_decoded = self.KDC_REQ_create(msg_type=req_msg_type, >@@ -1625,6 +1686,10 @@ class RawKerberosTest(TestCaseInTempDir): > expected_srealm=None, > expected_sname=None, > ticket_decryption_key=None, >+ generate_fast_fn=None, >+ generate_fast_armor_fn=None, >+ generate_fast_padata_fn=None, >+ fast_armor_type=FX_FAST_ARMOR_AP_REQUEST, > generate_padata_fn=None, > check_error_fn=None, > check_rep_fn=None, >@@ -1635,6 +1700,7 @@ class RawKerberosTest(TestCaseInTempDir): > client_as_etypes=None, > expected_salt=None, > authenticator_subkey=None, >+ armor_key=None, > armor_tgt=None, > armor_subkey=None, > kdc_options=''): >@@ -1649,6 +1715,10 @@ class RawKerberosTest(TestCaseInTempDir): > 'expected_srealm': expected_srealm, > 'expected_sname': expected_sname, > 'ticket_decryption_key': ticket_decryption_key, >+ 'generate_fast_fn': generate_fast_fn, >+ 'generate_fast_armor_fn': generate_fast_armor_fn, >+ 'generate_fast_padata_fn': generate_fast_padata_fn, >+ 'fast_armor_type': fast_armor_type, > 'generate_padata_fn': generate_padata_fn, > 'check_error_fn': check_error_fn, > 'check_rep_fn': check_rep_fn, >@@ -1659,6 +1729,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'client_as_etypes': client_as_etypes, > 'expected_salt': expected_salt, > 'authenticator_subkey': authenticator_subkey, >+ 'armor_key': armor_key, > 'armor_tgt': armor_tgt, > 'armor_subkey': armor_subkey, > 'kdc_options': kdc_options, >@@ -1674,6 +1745,10 @@ class RawKerberosTest(TestCaseInTempDir): > expected_srealm=None, > expected_sname=None, > ticket_decryption_key=None, >+ generate_fast_fn=None, >+ generate_fast_armor_fn=None, >+ generate_fast_padata_fn=None, >+ fast_armor_type=FX_FAST_ARMOR_AP_REQUEST, > generate_padata_fn=None, > check_error_fn=None, > check_rep_fn=None, >@@ -1681,6 +1756,7 @@ class RawKerberosTest(TestCaseInTempDir): > check_kdc_private_fn=None, > callback_dict=None, > tgt=None, >+ armor_key=None, > armor_tgt=None, > armor_subkey=None, > authenticator_subkey=None, >@@ -1697,6 +1773,10 @@ class RawKerberosTest(TestCaseInTempDir): > 'expected_srealm': expected_srealm, > 'expected_sname': expected_sname, > 'ticket_decryption_key': ticket_decryption_key, >+ 'generate_fast_fn': generate_fast_fn, >+ 'generate_fast_armor_fn': generate_fast_armor_fn, >+ 'generate_fast_padata_fn': generate_fast_padata_fn, >+ 'fast_armor_type': fast_armor_type, > 'generate_padata_fn': generate_padata_fn, > 'check_error_fn': check_error_fn, > 'check_rep_fn': check_rep_fn, >@@ -1705,6 +1785,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'callback_dict': callback_dict, > 'tgt': tgt, > 'body_checksum_type': body_checksum_type, >+ 'armor_key': armor_key, > 'armor_tgt': armor_tgt, > 'armor_subkey': armor_subkey, > 'authenticator_subkey': authenticator_subkey, >-- >2.25.1 > > >From 5638b13a769711e412f180afb291c56fc2356e8c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:01:36 +1200 >Subject: [PATCH 171/380] tests/krb5: Allow specifying parameters specific to > the outer request body > >This is useful for testing FAST. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 16ce1a1d304b87ed5b390fb87a4542c7c9a484fb) >--- > python/samba/tests/krb5/raw_testcase.py | 25 ++++++++++++++++++++----- > 1 file changed, 20 insertions(+), 5 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 151dc0355a3..a173caf98d1 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1536,6 +1536,9 @@ class RawKerberosTest(TestCaseInTempDir): > expected_error_mode = kdc_exchange_dict['expected_error_mode'] > kdc_options = kdc_exchange_dict['kdc_options'] > >+ # Parameters specific to the outer request body >+ outer_req = kdc_exchange_dict['outer_req'] >+ > if till_time is None: > till_time = self.get_KerberosTime(offset=36000) > >@@ -1561,6 +1564,14 @@ class RawKerberosTest(TestCaseInTempDir): > EncAuthorizationData_key=EncAuthorizationData_key, > EncAuthorizationData_usage=EncAuthorizationData_usage) > >+ inner_req_body = dict(req_body) >+ if outer_req is not None: >+ for key, value in outer_req.items(): >+ if value is not None: >+ req_body[key] = value >+ else: >+ del req_body[key] >+ > if req_msg_type == KRB_AS_REQ: > tgs_req = None > tgs_req_padata = None >@@ -1625,7 +1636,7 @@ class RawKerberosTest(TestCaseInTempDir): > > fast = generate_fast_fn(kdc_exchange_dict, > callback_dict, >- req_body, >+ inner_req_body, > fast_padata, > fast_armor, > checksum) >@@ -1648,7 +1659,7 @@ class RawKerberosTest(TestCaseInTempDir): > > kdc_exchange_dict['req_padata'] = padata > kdc_exchange_dict['fast_padata'] = fast_padata >- kdc_exchange_dict['req_body'] = req_body >+ kdc_exchange_dict['req_body'] = inner_req_body > > req_obj, req_decoded = self.KDC_REQ_create(msg_type=req_msg_type, > padata=padata, >@@ -1703,7 +1714,8 @@ class RawKerberosTest(TestCaseInTempDir): > armor_key=None, > armor_tgt=None, > armor_subkey=None, >- kdc_options=''): >+ kdc_options='', >+ outer_req=None): > kdc_exchange_dict = { > 'req_msg_type': KRB_AS_REQ, > 'req_asn1Spec': krb5_asn1.AS_REQ, >@@ -1733,6 +1745,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'armor_tgt': armor_tgt, > 'armor_subkey': armor_subkey, > 'kdc_options': kdc_options, >+ 'outer_req': outer_req > } > if callback_dict is None: > callback_dict = {} >@@ -1761,7 +1774,8 @@ class RawKerberosTest(TestCaseInTempDir): > armor_subkey=None, > authenticator_subkey=None, > body_checksum_type=None, >- kdc_options=''): >+ kdc_options='', >+ outer_req=None): > kdc_exchange_dict = { > 'req_msg_type': KRB_TGS_REQ, > 'req_asn1Spec': krb5_asn1.TGS_REQ, >@@ -1789,7 +1803,8 @@ class RawKerberosTest(TestCaseInTempDir): > 'armor_tgt': armor_tgt, > 'armor_subkey': armor_subkey, > 'authenticator_subkey': authenticator_subkey, >- 'kdc_options': kdc_options >+ 'kdc_options': kdc_options, >+ 'outer_req': outer_req > } > if callback_dict is None: > callback_dict = {} >-- >2.25.1 > > >From a9aaae2bee2403eea8acebaf45d2cca251dd73de Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:04:37 +1200 >Subject: [PATCH 172/380] tests/krb5: Add method to check PA-FX-FAST-REPLY > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit b62488113f6053755f9be9faa9b757e7193074fa) >--- > python/samba/tests/krb5/raw_testcase.py | 31 +++++++++++++++++++++++++ > 1 file changed, 31 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index a173caf98d1..dd733aea09b 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -52,6 +52,7 @@ from samba.tests.krb5.rfc4120_constants import ( > KRB_TGS_REQ, > KU_AP_REQ_AUTH, > KU_AS_REP_ENC_PART, >+ KU_FAST_REP, > KU_FAST_REQ_CHKSUM, > KU_NON_KERB_CKSUM_SALT, > KU_TGS_REP_ENC_PART_SESSION, >@@ -1910,6 +1911,36 @@ class RawKerberosTest(TestCaseInTempDir): > > return rep > >+ def check_fx_fast_data(self, >+ kdc_exchange_dict, >+ fx_fast_data, >+ armor_key, >+ finished=False, >+ expect_strengthen_key=True): >+ fx_fast_data = self.der_decode(fx_fast_data, >+ asn1Spec=krb5_asn1.PA_FX_FAST_REPLY()) >+ >+ enc_fast_rep = fx_fast_data['armored-data']['enc-fast-rep'] >+ self.assertEqual(enc_fast_rep['etype'], armor_key.etype) >+ >+ fast_rep = armor_key.decrypt(KU_FAST_REP, enc_fast_rep['cipher']) >+ >+ fast_response = self.der_decode(fast_rep, >+ asn1Spec=krb5_asn1.KrbFastResponse()) >+ >+ if expect_strengthen_key and self.strict_checking: >+ self.assertIn('strengthen-key', fast_response) >+ >+ if finished: >+ self.assertIn('finished', fast_response) >+ >+ # Ensure that the nonce matches the nonce in the body of the request >+ # (RFC6113 5.4.3). >+ nonce = kdc_exchange_dict['nonce'] >+ self.assertEqual(nonce, fast_response['nonce']) >+ >+ return fast_response >+ > def generic_check_kdc_private(self, > kdc_exchange_dict, > callback_dict, >-- >2.25.1 > > >From 7a0aed4f3a4caa553e1edf2e9bd0f0febf8fc21c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:10:13 +1200 >Subject: [PATCH 173/380] tests/krb5: Add method to verify ticket checksum for > FAST > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 4ca05402b36ba13a987b07b2402906764d3cd49b) >--- > python/samba/tests/krb5/raw_testcase.py | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index dd733aea09b..da38a9dfa62 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -52,6 +52,7 @@ from samba.tests.krb5.rfc4120_constants import ( > KRB_TGS_REQ, > KU_AP_REQ_AUTH, > KU_AS_REP_ENC_PART, >+ KU_FAST_FINISHED, > KU_FAST_REP, > KU_FAST_REQ_CHKSUM, > KU_NON_KERB_CKSUM_SALT, >@@ -2322,6 +2323,17 @@ class RawKerberosTest(TestCaseInTempDir): > > return kdc_challenge_key > >+ def verify_ticket_checksum(self, ticket, expected_checksum, armor_key): >+ expected_type = expected_checksum['cksumtype'] >+ self.assertEqual(armor_key.ctype, expected_type) >+ >+ ticket_blob = self.der_encode(ticket, >+ asn1Spec=krb5_asn1.Ticket()) >+ checksum = self.Checksum_create(armor_key, >+ KU_FAST_FINISHED, >+ ticket_blob) >+ self.assertEqual(expected_checksum, checksum) >+ > def _test_as_exchange(self, > cname, > realm, >-- >2.25.1 > > >From c57537fade29c4d67cddc953c3a8f4902599e173 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:42:57 +1200 >Subject: [PATCH 174/380] tests/krb5: Check FAST response > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit d878bd6404d26c8be45bb2016ec206ed79d4ef6e) >--- > python/samba/tests/krb5/raw_testcase.py | 41 +++++++++++++++++++++++-- > 1 file changed, 39 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index da38a9dfa62..ab1f711cde1 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -67,6 +67,7 @@ from samba.tests.krb5.rfc4120_constants import ( > PADATA_ETYPE_INFO, > PADATA_ETYPE_INFO2, > PADATA_FOR_USER, >+ PADATA_FX_FAST, > PADATA_KDC_REQ, > PADATA_PAC_REQUEST, > PADATA_PK_AS_REQ, >@@ -1827,6 +1828,7 @@ class RawKerberosTest(TestCaseInTempDir): > check_kdc_private_fn = kdc_exchange_dict['check_kdc_private_fn'] > rep_encpart_asn1Spec = kdc_exchange_dict['rep_encpart_asn1Spec'] > msg_type = kdc_exchange_dict['rep_msg_type'] >+ armor_key = kdc_exchange_dict['armor_key'] > > self.assertElementEqual(rep, 'msg-type', msg_type) # AS-REP | TGS-REP > padata = self.getElementValue(rep, 'padata') >@@ -1862,6 +1864,8 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementPresent(encpart, 'cipher') > encpart_cipher = self.getElementValue(encpart, 'cipher') > >+ ticket_checksum = None >+ > encpart_decryption_key = None > self.assertIsNotNone(check_padata_fn) > if check_padata_fn is not None: >@@ -1870,6 +1874,33 @@ class RawKerberosTest(TestCaseInTempDir): > check_padata_fn(kdc_exchange_dict, callback_dict, > rep, padata)) > >+ if armor_key is not None: >+ pa_dict = self.get_pa_dict(padata) >+ >+ if PADATA_FX_FAST in pa_dict: >+ fx_fast_data = pa_dict[PADATA_FX_FAST] >+ fast_response = self.check_fx_fast_data(kdc_exchange_dict, >+ fx_fast_data, >+ armor_key, >+ finished=True) >+ >+ if 'strengthen-key' in fast_response: >+ strengthen_key = self.EncryptionKey_import( >+ fast_response['strengthen-key']) >+ encpart_decryption_key = ( >+ self.generate_strengthen_reply_key( >+ strengthen_key, >+ encpart_decryption_key)) >+ >+ fast_finished = fast_response.get('finished', None) >+ if fast_finished is not None: >+ ticket_checksum = fast_finished['ticket-checksum'] >+ >+ self.check_rep_padata(kdc_exchange_dict, >+ callback_dict, >+ rep, >+ fast_response['padata']) >+ > ticket_private = None > self.assertIsNotNone(ticket_decryption_key) > if ticket_decryption_key is not None: >@@ -1908,7 +1939,8 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(check_kdc_private_fn) > if check_kdc_private_fn is not None: > check_kdc_private_fn(kdc_exchange_dict, callback_dict, >- rep, ticket_private, encpart_private) >+ rep, ticket_private, encpart_private, >+ ticket_checksum) > > return rep > >@@ -1947,7 +1979,8 @@ class RawKerberosTest(TestCaseInTempDir): > callback_dict, > rep, > ticket_private, >- encpart_private): >+ encpart_private, >+ ticket_checksum): > > expected_crealm = kdc_exchange_dict['expected_crealm'] > expected_cname = kdc_exchange_dict['expected_cname'] >@@ -1957,6 +1990,10 @@ class RawKerberosTest(TestCaseInTempDir): > > ticket = self.getElementValue(rep, 'ticket') > >+ if ticket_checksum is not None: >+ armor_key = kdc_exchange_dict['armor_key'] >+ self.verify_ticket_checksum(ticket, ticket_checksum, armor_key) >+ > ticket_session_key = None > if ticket_private is not None: > self.assertElementPresent(ticket_private, 'flags') >-- >2.25.1 > > >From b23f606205d922a11def96f2c5fdae1b3c4eab27 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 15:20:44 +1200 >Subject: [PATCH 175/380] tests/krb5: Add functions to get dicts of request > padata > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit dc7dac95ec509d90d8372005cd7b13fabd8e64c6) >--- > python/samba/tests/krb5/raw_testcase.py | 11 +++++++++++ > 1 file changed, 11 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index ab1f711cde1..2963df70003 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2371,6 +2371,17 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_blob) > self.assertEqual(expected_checksum, checksum) > >+ def get_outer_pa_dict(self, kdc_exchange_dict): >+ return self.get_pa_dict(kdc_exchange_dict['req_padata']) >+ >+ def get_fast_pa_dict(self, kdc_exchange_dict): >+ req_pa_dict = self.get_pa_dict(kdc_exchange_dict['fast_padata']) >+ >+ if req_pa_dict: >+ return req_pa_dict >+ >+ return self.get_outer_pa_dict(kdc_exchange_dict) >+ > def _test_as_exchange(self, > cname, > realm, >-- >2.25.1 > > >From 693845aa93a3025eb18013b05a96f1bde5005a55 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 15:21:01 +1200 >Subject: [PATCH 176/380] tests/krb5: Add methods to determine whether elements > were included in the request > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 99e3b909edf27c751b959a3d0b672ddd2b7140e2) >--- > python/samba/tests/krb5/raw_testcase.py | 25 +++++++++++++++++++++++++ > 1 file changed, 25 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 2963df70003..d96cd1cfc15 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -69,6 +69,7 @@ from samba.tests.krb5.rfc4120_constants import ( > PADATA_FOR_USER, > PADATA_FX_FAST, > PADATA_KDC_REQ, >+ PADATA_PAC_OPTIONS, > PADATA_PAC_REQUEST, > PADATA_PK_AS_REQ, > PADATA_PK_AS_REP_19 >@@ -2382,6 +2383,30 @@ class RawKerberosTest(TestCaseInTempDir): > > return self.get_outer_pa_dict(kdc_exchange_dict) > >+ def sent_fast(self, kdc_exchange_dict): >+ outer_pa_dict = self.get_outer_pa_dict(kdc_exchange_dict) >+ >+ return PADATA_FX_FAST in outer_pa_dict >+ >+ def sent_enc_challenge(self, kdc_exchange_dict): >+ fast_pa_dict = self.get_fast_pa_dict(kdc_exchange_dict) >+ >+ return PADATA_ENCRYPTED_CHALLENGE in fast_pa_dict >+ >+ def sent_claims(self, kdc_exchange_dict): >+ fast_pa_dict = self.get_fast_pa_dict(kdc_exchange_dict) >+ >+ if PADATA_PAC_OPTIONS not in fast_pa_dict: >+ return False >+ >+ pac_options = self.der_decode(fast_pa_dict[PADATA_PAC_OPTIONS], >+ asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) >+ pac_options = pac_options['options'] >+ claims_pos = len(tuple(krb5_asn1.PACOptionFlags('claims'))) - 1 >+ >+ return (claims_pos < len(pac_options) >+ and pac_options[claims_pos] == '1') >+ > def _test_as_exchange(self, > cname, > realm, >-- >2.25.1 > > >From 22a7433fb60132a707d6e3ff52ff233c7897e42e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:34:49 +1200 >Subject: [PATCH 177/380] tests/krb5: Check encrypted-pa-data > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 0c029e780cf16a49c674593e8329eaf3b87aec69) >--- > python/samba/tests/krb5/raw_testcase.py | 52 ++++++++++++++++++++++++- > 1 file changed, 51 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index d96cd1cfc15..2512ee1b99f 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -72,7 +72,8 @@ from samba.tests.krb5.rfc4120_constants import ( > PADATA_PAC_OPTIONS, > PADATA_PAC_REQUEST, > PADATA_PK_AS_REQ, >- PADATA_PK_AS_REP_19 >+ PADATA_PK_AS_REP_19, >+ PADATA_SUPPORTED_ETYPES > ) > import samba.tests.krb5.kcrypto as kcrypto > >@@ -1982,6 +1983,10 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_private, > encpart_private, > ticket_checksum): >+ kdc_options = kdc_exchange_dict['kdc_options'] >+ canon_pos = len(tuple(krb5_asn1.KDCOptions('canonicalize'))) - 1 >+ canonicalize = (canon_pos < len(kdc_options) >+ and kdc_options[canon_pos] == '1') > > expected_crealm = kdc_exchange_dict['expected_crealm'] > expected_cname = kdc_exchange_dict['expected_cname'] >@@ -2044,6 +2049,46 @@ class RawKerberosTest(TestCaseInTempDir): > expected_sname) > # TODO self.assertElementMissing(encpart_private, 'caddr') > >+ sent_claims = self.sent_claims(kdc_exchange_dict) >+ >+ if self.strict_checking: >+ if sent_claims or canonicalize: >+ self.assertElementPresent(encpart_private, >+ 'encrypted-pa-data') >+ enc_pa_dict = self.get_pa_dict( >+ encpart_private['encrypted-pa-data']) >+ if canonicalize: >+ self.assertIn(PADATA_SUPPORTED_ETYPES, enc_pa_dict) >+ >+ (supported_etypes,) = struct.unpack( >+ '<L', >+ enc_pa_dict[PADATA_SUPPORTED_ETYPES]) >+ >+ self.assertTrue( >+ security.KERB_ENCTYPE_FAST_SUPPORTED >+ & supported_etypes) >+ self.assertTrue( >+ security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED >+ & supported_etypes) >+ self.assertTrue( >+ security.KERB_ENCTYPE_CLAIMS_SUPPORTED >+ & supported_etypes) >+ else: >+ self.assertNotIn(PADATA_SUPPORTED_ETYPES, enc_pa_dict) >+ >+ # ClaimsCompIdFASTSupported registry key >+ if sent_claims: >+ self.assertIn(PADATA_PAC_OPTIONS, enc_pa_dict) >+ >+ self.check_pac_options_claims_support( >+ enc_pa_dict[PADATA_PAC_OPTIONS]) >+ else: >+ self.assertNotIn(PADATA_PAC_OPTIONS, enc_pa_dict) >+ else: >+ self.assertElementEqual(encpart_private, >+ 'encrypted-pa-data', >+ []) >+ > if ticket_session_key is not None and encpart_session_key is not None: > self.assertEqual(ticket_session_key.etype, > encpart_session_key.etype) >@@ -2066,6 +2111,11 @@ class RawKerberosTest(TestCaseInTempDir): > > kdc_exchange_dict['rep_ticket_creds'] = ticket_creds > >+ def check_pac_options_claims_support(self, pac_options): >+ pac_options = self.der_decode(pac_options, >+ asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) >+ self.assertEqual('1', pac_options['options'][0]) # claims bit >+ > def generic_check_kdc_error(self, > kdc_exchange_dict, > callback_dict, >-- >2.25.1 > > >From f756e00e5dcb5a9fa16f4e7a57554ddcd595893d Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:05:59 +1200 >Subject: [PATCH 178/380] tests/krb5: Add expected_cname_private parameter to > kdc_exchange_dict > >This is useful for testing the 'hide client names' FAST option. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 2ee87dbf08e66e1dc812430026bfe214f9f5503d) >--- > python/samba/tests/krb5/raw_testcase.py | 16 +++++++++++++++- > 1 file changed, 15 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 2512ee1b99f..b79b84686a6 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1699,6 +1699,7 @@ class RawKerberosTest(TestCaseInTempDir): > def as_exchange_dict(self, > expected_crealm=None, > expected_cname=None, >+ expected_cname_private=None, > expected_srealm=None, > expected_sname=None, > ticket_decryption_key=None, >@@ -1752,6 +1753,10 @@ class RawKerberosTest(TestCaseInTempDir): > 'kdc_options': kdc_options, > 'outer_req': outer_req > } >+ if expected_cname_private is not None: >+ kdc_exchange_dict['expected_cname_private'] = ( >+ expected_cname_private) >+ > if callback_dict is None: > callback_dict = {} > >@@ -1760,6 +1765,7 @@ class RawKerberosTest(TestCaseInTempDir): > def tgs_exchange_dict(self, > expected_crealm=None, > expected_cname=None, >+ expected_cname_private=None, > expected_srealm=None, > expected_sname=None, > ticket_decryption_key=None, >@@ -1811,6 +1817,10 @@ class RawKerberosTest(TestCaseInTempDir): > 'kdc_options': kdc_options, > 'outer_req': outer_req > } >+ if expected_cname_private is not None: >+ kdc_exchange_dict['expected_cname_private'] = ( >+ expected_cname_private) >+ > if callback_dict is None: > callback_dict = {} > >@@ -1989,11 +1999,15 @@ class RawKerberosTest(TestCaseInTempDir): > and kdc_options[canon_pos] == '1') > > expected_crealm = kdc_exchange_dict['expected_crealm'] >- expected_cname = kdc_exchange_dict['expected_cname'] > expected_srealm = kdc_exchange_dict['expected_srealm'] > expected_sname = kdc_exchange_dict['expected_sname'] > ticket_decryption_key = kdc_exchange_dict['ticket_decryption_key'] > >+ try: >+ expected_cname = kdc_exchange_dict['expected_cname_private'] >+ except KeyError: >+ expected_cname = kdc_exchange_dict['expected_cname'] >+ > ticket = self.getElementValue(rep, 'ticket') > > if ticket_checksum is not None: >-- >2.25.1 > > >From 95041ddc48a3acce492f7f166d9fd95eb2be776d Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:18:29 +1200 >Subject: [PATCH 179/380] tests/krb5: Include authdata in kdc_exchange_dict > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit ea1ed63e8819926db1cf15974009601c7d37e944) >--- > python/samba/tests/krb5/raw_testcase.py | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index b79b84686a6..c1dfe44dfd1 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1720,6 +1720,7 @@ class RawKerberosTest(TestCaseInTempDir): > armor_key=None, > armor_tgt=None, > armor_subkey=None, >+ auth_data=None, > kdc_options='', > outer_req=None): > kdc_exchange_dict = { >@@ -1750,6 +1751,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'armor_key': armor_key, > 'armor_tgt': armor_tgt, > 'armor_subkey': armor_subkey, >+ 'auth_data': auth_data, > 'kdc_options': kdc_options, > 'outer_req': outer_req > } >@@ -1784,6 +1786,7 @@ class RawKerberosTest(TestCaseInTempDir): > armor_tgt=None, > armor_subkey=None, > authenticator_subkey=None, >+ auth_data=None, > body_checksum_type=None, > kdc_options='', > outer_req=None): >@@ -1813,6 +1816,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'armor_key': armor_key, > 'armor_tgt': armor_tgt, > 'armor_subkey': armor_subkey, >+ 'auth_data': auth_data, > 'authenticator_subkey': authenticator_subkey, > 'kdc_options': kdc_options, > 'outer_req': outer_req >@@ -2328,6 +2332,8 @@ class RawKerberosTest(TestCaseInTempDir): > req_body_blob, > ctype=body_checksum_type) > >+ auth_data = kdc_exchange_dict['auth_data'] >+ > subkey_obj = None > if authenticator_subkey is not None: > subkey_obj = authenticator_subkey.export_obj() >@@ -2341,7 +2347,7 @@ class RawKerberosTest(TestCaseInTempDir): > ctime=ctime, > subkey=subkey_obj, > seq_number=seq_number, >- authorization_data=None) >+ authorization_data=auth_data) > authenticator_blob = self.der_encode( > authenticator_obj, > asn1Spec=krb5_asn1.Authenticator()) >-- >2.25.1 > > >From 4aab7ff97e3684a574a40400491db0ef5ca35ada Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 15:20:09 +1200 >Subject: [PATCH 180/380] tests/krb5: Add generate_simple_fast() method to > generate FX-FAST padata > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 1389ba346df81c9ea1e1143c4e819212939f6aeb) >--- > python/samba/tests/krb5/raw_testcase.py | 34 +++++++++++++++++++++++++ > 1 file changed, 34 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index c1dfe44dfd1..a557c424527 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -52,6 +52,7 @@ from samba.tests.krb5.rfc4120_constants import ( > KRB_TGS_REQ, > KU_AP_REQ_AUTH, > KU_AS_REP_ENC_PART, >+ KU_FAST_ENC, > KU_FAST_FINISHED, > KU_FAST_REP, > KU_FAST_REQ_CHKSUM, >@@ -2309,6 +2310,39 @@ class RawKerberosTest(TestCaseInTempDir): > kdc_exchange_dict['preauth_etype_info2'] = etype_info2 > return > >+ def generate_simple_fast(self, >+ kdc_exchange_dict, >+ _callback_dict, >+ req_body, >+ fast_padata, >+ fast_armor, >+ checksum, >+ fast_options=''): >+ armor_key = kdc_exchange_dict['armor_key'] >+ >+ fast_req = self.KRB_FAST_REQ_create(fast_options, >+ fast_padata, >+ req_body) >+ fast_req = self.der_encode(fast_req, >+ asn1Spec=krb5_asn1.KrbFastReq()) >+ fast_req = self.EncryptedData_create(armor_key, >+ KU_FAST_ENC, >+ fast_req) >+ >+ fast_armored_req = self.KRB_FAST_ARMORED_REQ_create(fast_armor, >+ checksum, >+ fast_req) >+ >+ fx_fast_request = self.PA_FX_FAST_REQUEST_create(fast_armored_req) >+ fx_fast_request = self.der_encode( >+ fx_fast_request, >+ asn1Spec=krb5_asn1.PA_FX_FAST_REQUEST()) >+ >+ fast_padata = self.PA_DATA_create(PADATA_FX_FAST, >+ fx_fast_request) >+ >+ return fast_padata >+ > def generate_ap_req(self, > kdc_exchange_dict, > _callback_dict, >-- >2.25.1 > > >From a22927095101015a6d6e219b641d61bde2d547ba Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 16:21:14 +1200 >Subject: [PATCH 181/380] tests/krb5: Add check_rep_padata() method to check > padata in reply > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 79b9aac65b7dbdc58275368eae9feb7d87bf6dab) >--- > python/samba/tests/krb5/raw_testcase.py | 83 ++++++++++++++----------- > 1 file changed, 48 insertions(+), 35 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index a557c424527..80c60682bd1 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2144,13 +2144,54 @@ class RawKerberosTest(TestCaseInTempDir): > expected_cname = kdc_exchange_dict['expected_cname'] > expected_srealm = kdc_exchange_dict['expected_srealm'] > expected_sname = kdc_exchange_dict['expected_sname'] >- expected_salt = kdc_exchange_dict['expected_salt'] >- client_as_etypes = kdc_exchange_dict['client_as_etypes'] >+ expected_error_mode = kdc_exchange_dict['expected_error_mode'] >+ >+ self.assertElementEqual(rep, 'pvno', 5) >+ self.assertElementEqual(rep, 'msg-type', KRB_ERROR) >+ self.assertElementEqual(rep, 'error-code', expected_error_mode) >+ if self.strict_checking: >+ self.assertElementMissing(rep, 'ctime') >+ self.assertElementMissing(rep, 'cusec') >+ self.assertElementPresent(rep, 'stime') >+ self.assertElementPresent(rep, 'susec') >+ # error-code checked above >+ if self.strict_checking: >+ self.assertElementMissing(rep, 'crealm') >+ self.assertElementMissing(rep, 'cname') >+ self.assertElementEqualUTF8(rep, 'realm', expected_srealm) >+ self.assertElementEqualPrincipal(rep, 'sname', expected_sname) >+ self.assertElementMissing(rep, 'e-text') >+ if expected_error_mode == KDC_ERR_GENERIC: >+ self.assertElementMissing(rep, 'e-data') >+ return rep >+ edata = self.getElementValue(rep, 'e-data') >+ if self.strict_checking: >+ self.assertIsNotNone(edata) >+ if edata is not None: >+ rep_padata = self.der_decode(edata, >+ asn1Spec=krb5_asn1.METHOD_DATA()) >+ self.assertGreater(len(rep_padata), 0) >+ else: >+ rep_padata = [] >+ >+ etype_info2 = self.check_rep_padata(kdc_exchange_dict, >+ callback_dict, >+ rep, >+ rep_padata) >+ >+ kdc_exchange_dict['preauth_etype_info2'] = etype_info2 >+ >+ return rep >+ >+ def check_rep_padata(self, >+ kdc_exchange_dict, >+ callback_dict, >+ rep, >+ rep_padata): > expected_error_mode = kdc_exchange_dict['expected_error_mode'] > req_body = kdc_exchange_dict['req_body'] > proposed_etypes = req_body['etype'] >- >- kdc_exchange_dict['preauth_etype_info2'] = None >+ client_as_etypes = kdc_exchange_dict.get('client_as_etypes', []) > > expect_etype_info2 = () > expect_etype_info = False >@@ -2188,34 +2229,6 @@ class RawKerberosTest(TestCaseInTempDir): > expected_patypes += (PADATA_PK_AS_REQ,) > expected_patypes += (PADATA_PK_AS_REP_19,) > >- self.assertElementEqual(rep, 'pvno', 5) >- self.assertElementEqual(rep, 'msg-type', KRB_ERROR) >- self.assertElementEqual(rep, 'error-code', expected_error_mode) >- if self.strict_checking: >- self.assertElementMissing(rep, 'ctime') >- self.assertElementMissing(rep, 'cusec') >- self.assertElementPresent(rep, 'stime') >- self.assertElementPresent(rep, 'susec') >- # error-code checked above >- if self.strict_checking: >- self.assertElementMissing(rep, 'crealm') >- self.assertElementMissing(rep, 'cname') >- self.assertElementEqualUTF8(rep, 'realm', expected_srealm) >- self.assertElementEqualPrincipal(rep, 'sname', expected_sname) >- self.assertElementMissing(rep, 'e-text') >- if expected_error_mode == KDC_ERR_GENERIC: >- self.assertElementMissing(rep, 'e-data') >- return >- edata = self.getElementValue(rep, 'e-data') >- if self.strict_checking: >- self.assertIsNotNone(edata) >- if edata is not None: >- rep_padata = self.der_decode(edata, >- asn1Spec=krb5_asn1.METHOD_DATA()) >- self.assertGreater(len(rep_padata), 0) >- else: >- rep_padata = [] >- > if self.strict_checking: > for i, patype in enumerate(expected_patypes): > self.assertElementEqual(rep_padata[i], 'padata-type', patype) >@@ -2265,7 +2278,7 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(enc_timestamp) > self.assertIsNotNone(pk_as_req) > self.assertIsNotNone(pk_as_rep19) >- return >+ return None > > if self.strict_checking: > self.assertIsNotNone(etype_info2) >@@ -2288,6 +2301,7 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNone(salt) > else: > self.assertIsNotNone(salt) >+ expected_salt = kdc_exchange_dict['expected_salt'] > if expected_salt is not None: > self.assertEqual(salt, expected_salt) > s2kparams = self.getElementValue(etype_info2[i], 's2kparams') >@@ -2307,8 +2321,7 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(pk_as_req) > self.assertIsNotNone(pk_as_rep19) > >- kdc_exchange_dict['preauth_etype_info2'] = etype_info2 >- return >+ return etype_info2 > > def generate_simple_fast(self, > kdc_exchange_dict, >-- >2.25.1 > > >From 0544feced6a78a4afb2636e9412b5ecae3eef604 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 16:35:32 +1200 >Subject: [PATCH 182/380] tests/krb5: Don't expect RC4 in ETYPE-INFO2 for a > non-error reply > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 705e45e37f4752e283a80626be10c38b29232359) >--- > python/samba/tests/krb5/raw_testcase.py | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 80c60682bd1..7a66b74adfe 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2208,7 +2208,7 @@ class RawKerberosTest(TestCaseInTempDir): > if etype in (kcrypto.Enctype.AES256, kcrypto.Enctype.AES128): > if etype > expected_aes_type: > expected_aes_type = etype >- if etype in (kcrypto.Enctype.RC4,): >+ if etype in (kcrypto.Enctype.RC4,) and expected_error_mode != 0: > unexpect_etype_info = False > if etype > expected_rc4_type: > expected_rc4_type = etype >-- >2.25.1 > > >From 243487a1a78545167eebe3665d1ba1542927a6bc Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 16:26:06 +1200 >Subject: [PATCH 183/380] tests/krb5: Remove unused variables > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 5edbabeb26e110648d4588c90843e4715ec1ac5c) >--- > python/samba/tests/krb5/kdc_base_test.py | 2 -- > python/samba/tests/krb5/raw_testcase.py | 1 - > 2 files changed, 3 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 24a1e7cfbc8..b148fa01f65 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -256,8 +256,6 @@ class KDCBaseTest(RawKerberosTest): > > rid = identifier.sid.split()[1] > >- forced_keys = dict() >- > net_ctx = net.Net(admin_creds) > > keys = {} >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 7a66b74adfe..60d35923b35 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2140,7 +2140,6 @@ class RawKerberosTest(TestCaseInTempDir): > callback_dict, > rep): > >- expected_crealm = kdc_exchange_dict['expected_crealm'] > expected_cname = kdc_exchange_dict['expected_cname'] > expected_srealm = kdc_exchange_dict['expected_srealm'] > expected_sname = kdc_exchange_dict['expected_sname'] >-- >2.25.1 > > >From c88307575b020ba947f9cea7108c5cafa526c6b6 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 11:15:00 +1200 >Subject: [PATCH 184/380] tests/krb5: Add get_krbtgt_sname() method > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit dbe98005d5873440063b91e56679937149535be7) >--- > python/samba/tests/krb5/raw_testcase.py | 10 ++++++++++ > 1 file changed, 10 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 60d35923b35..8351de1e6e3 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -64,6 +64,7 @@ from samba.tests.krb5.rfc4120_constants import ( > KU_TGS_REQ_AUTH_DAT_SESSION, > KU_TGS_REQ_AUTH_DAT_SUBKEY, > KU_TICKET, >+ NT_SRV_INST, > PADATA_ENC_TIMESTAMP, > PADATA_ETYPE_INFO, > PADATA_ETYPE_INFO2, >@@ -2523,6 +2524,15 @@ class RawKerberosTest(TestCaseInTempDir): > return (claims_pos < len(pac_options) > and pac_options[claims_pos] == '1') > >+ def get_krbtgt_sname(self): >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_username = krbtgt_creds.get_username() >+ krbtgt_realm = krbtgt_creds.get_realm() >+ krbtgt_sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=[krbtgt_username, krbtgt_realm]) >+ >+ return krbtgt_sname >+ > def _test_as_exchange(self, > cname, > realm, >-- >2.25.1 > > >From 5f1b9ef294b169d6db98cb5c0ac3bd012d0f8246 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 16:25:39 +1200 >Subject: [PATCH 185/380] tests/krb5: Check sname is krbtgt for FAST generic > error > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 7a27b75621908a4a6449efaecb54eb20fa45aca0) >--- > python/samba/tests/krb5/raw_testcase.py | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 8351de1e6e3..77b682e57ea 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2146,6 +2146,8 @@ class RawKerberosTest(TestCaseInTempDir): > expected_sname = kdc_exchange_dict['expected_sname'] > expected_error_mode = kdc_exchange_dict['expected_error_mode'] > >+ sent_fast = self.sent_fast(kdc_exchange_dict) >+ > self.assertElementEqual(rep, 'pvno', 5) > self.assertElementEqual(rep, 'msg-type', KRB_ERROR) > self.assertElementEqual(rep, 'error-code', expected_error_mode) >@@ -2159,7 +2161,11 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementMissing(rep, 'crealm') > self.assertElementMissing(rep, 'cname') > self.assertElementEqualUTF8(rep, 'realm', expected_srealm) >- self.assertElementEqualPrincipal(rep, 'sname', expected_sname) >+ if sent_fast and expected_error_mode == KDC_ERR_GENERIC: >+ self.assertElementEqualPrincipal(rep, 'sname', >+ self.get_krbtgt_sname()) >+ else: >+ self.assertElementEqualPrincipal(rep, 'sname', expected_sname) > self.assertElementMissing(rep, 'e-text') > if expected_error_mode == KDC_ERR_GENERIC: > self.assertElementMissing(rep, 'e-data') >-- >2.25.1 > > >From 0997e700b78f2fcfd64efbcb07521e82d23dd4ed Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 16:31:39 +1200 >Subject: [PATCH 186/380] tests/krb5: Check reply FAST padata if request > included FAST > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 056fb71832e7aa16132c58ff393ab8b752ef6a93) >--- > python/samba/tests/krb5/raw_testcase.py | 15 +++++++++++++++ > 1 file changed, 15 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 77b682e57ea..965a8f9fb00 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2177,6 +2177,21 @@ class RawKerberosTest(TestCaseInTempDir): > rep_padata = self.der_decode(edata, > asn1Spec=krb5_asn1.METHOD_DATA()) > self.assertGreater(len(rep_padata), 0) >+ >+ if sent_fast: >+ self.assertEqual(1, len(rep_padata)) >+ rep_pa_dict = self.get_pa_dict(rep_padata) >+ self.assertIn(PADATA_FX_FAST, rep_pa_dict) >+ >+ armor_key = kdc_exchange_dict['armor_key'] >+ self.assertIsNotNone(armor_key) >+ fast_response = self.check_fx_fast_data( >+ kdc_exchange_dict, >+ rep_pa_dict[PADATA_FX_FAST], >+ armor_key, >+ expect_strengthen_key=False) >+ >+ rep_padata = fast_response['padata'] > else: > rep_padata = [] > >-- >2.25.1 > > >From 24cf1667a4ae3180b402d5f7496f2674dc0cbaee Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 16:42:26 +1200 >Subject: [PATCH 187/380] tests/krb5: Adjust reply padata checking depending on > whether FAST was sent > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 44a44109db96eab08a3da3683c34446bc13b295b) >--- > python/samba/tests/krb5/raw_testcase.py | 62 ++++++++++++++++++++++--- > 1 file changed, 55 insertions(+), 7 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 965a8f9fb00..529d4d925e6 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -44,6 +44,7 @@ import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( > FX_FAST_ARMOR_AP_REQUEST, > KDC_ERR_GENERIC, >+ KDC_ERR_PREAUTH_FAILED, > KRB_AP_REQ, > KRB_AS_REP, > KRB_AS_REQ, >@@ -65,10 +66,13 @@ from samba.tests.krb5.rfc4120_constants import ( > KU_TGS_REQ_AUTH_DAT_SUBKEY, > KU_TICKET, > NT_SRV_INST, >+ PADATA_ENCRYPTED_CHALLENGE, > PADATA_ENC_TIMESTAMP, > PADATA_ETYPE_INFO, > PADATA_ETYPE_INFO2, > PADATA_FOR_USER, >+ PADATA_FX_COOKIE, >+ PADATA_FX_ERROR, > PADATA_FX_FAST, > PADATA_KDC_REQ, > PADATA_PAC_OPTIONS, >@@ -407,6 +411,8 @@ class RawKerberosTest(TestCaseInTempDir): > # obtained. > cls.creds_dict = {} > >+ cls.kdc_fast_support = False >+ > def setUp(self): > super().setUp() > self.do_asn1_print = False >@@ -2214,6 +2220,9 @@ class RawKerberosTest(TestCaseInTempDir): > proposed_etypes = req_body['etype'] > client_as_etypes = kdc_exchange_dict.get('client_as_etypes', []) > >+ sent_fast = self.sent_fast(kdc_exchange_dict) >+ sent_enc_challenge = self.sent_enc_challenge(kdc_exchange_dict) >+ > expect_etype_info2 = () > expect_etype_info = False > unexpect_etype_info = True >@@ -2240,15 +2249,31 @@ class RawKerberosTest(TestCaseInTempDir): > expect_etype_info2 += (expected_rc4_type,) > > expected_patypes = () >+ if sent_fast and expected_error_mode != 0: >+ expected_patypes += (PADATA_FX_ERROR,) >+ expected_patypes += (PADATA_FX_COOKIE,) >+ > if expect_etype_info: > self.assertGreater(len(expect_etype_info2), 0) > expected_patypes += (PADATA_ETYPE_INFO,) > if len(expect_etype_info2) != 0: > expected_patypes += (PADATA_ETYPE_INFO2,) > >- expected_patypes += (PADATA_ENC_TIMESTAMP,) >- expected_patypes += (PADATA_PK_AS_REQ,) >- expected_patypes += (PADATA_PK_AS_REP_19,) >+ if expected_error_mode != KDC_ERR_PREAUTH_FAILED: >+ if sent_fast: >+ expected_patypes += (PADATA_ENCRYPTED_CHALLENGE,) >+ else: >+ expected_patypes += (PADATA_ENC_TIMESTAMP,) >+ >+ if not sent_enc_challenge: >+ expected_patypes += (PADATA_PK_AS_REQ,) >+ expected_patypes += (PADATA_PK_AS_REP_19,) >+ >+ if (self.kdc_fast_support >+ and not sent_fast >+ and not sent_enc_challenge): >+ expected_patypes += (PADATA_FX_FAST,) >+ expected_patypes += (PADATA_FX_COOKIE,) > > if self.strict_checking: > for i, patype in enumerate(expected_patypes): >@@ -2296,7 +2321,12 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNone(etype_info2) > self.assertIsNone(etype_info) > if self.strict_checking: >- self.assertIsNotNone(enc_timestamp) >+ if sent_fast: >+ self.assertIsNotNone(enc_challenge) >+ self.assertIsNone(enc_timestamp) >+ else: >+ self.assertIsNotNone(enc_timestamp) >+ self.assertIsNone(enc_challenge) > self.assertIsNotNone(pk_as_req) > self.assertIsNotNone(pk_as_rep19) > return None >@@ -2338,9 +2368,27 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(salt) > self.assertEqual(len(salt), 0) > >- self.assertIsNotNone(enc_timestamp) >- self.assertIsNotNone(pk_as_req) >- self.assertIsNotNone(pk_as_rep19) >+ if expected_error_mode != KDC_ERR_PREAUTH_FAILED: >+ if sent_fast: >+ self.assertIsNotNone(enc_challenge) >+ if self.strict_checking: >+ self.assertIsNone(enc_timestamp) >+ else: >+ self.assertIsNotNone(enc_timestamp) >+ if self.strict_checking: >+ self.assertIsNone(enc_challenge) >+ if not sent_enc_challenge: >+ self.assertIsNotNone(pk_as_req) >+ self.assertIsNotNone(pk_as_rep19) >+ else: >+ self.assertIsNone(pk_as_req) >+ self.assertIsNone(pk_as_rep19) >+ else: >+ if self.strict_checking: >+ self.assertIsNone(enc_timestamp) >+ self.assertIsNone(enc_challenge) >+ self.assertIsNone(pk_as_req) >+ self.assertIsNone(pk_as_rep19) > > return etype_info2 > >-- >2.25.1 > > >From de8dd266fa5ccc230ae3a51d133dd05d4a7be0a3 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:36:56 +1200 >Subject: [PATCH 188/380] tests/krb5: Check PADATA-ENCRYPTED-CHALLENGE in reply > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 2f7919db395c24f6890ffe4ee46a5e34df95fccd) >--- > python/samba/tests/krb5/raw_testcase.py | 54 +++++++++++++++++++++++++ > 1 file changed, 54 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 529d4d925e6..ca967c1ac13 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -53,6 +53,7 @@ from samba.tests.krb5.rfc4120_constants import ( > KRB_TGS_REQ, > KU_AP_REQ_AUTH, > KU_AS_REP_ENC_PART, >+ KU_ENC_CHALLENGE_KDC, > KU_FAST_ENC, > KU_FAST_FINISHED, > KU_FAST_REP, >@@ -2283,6 +2284,7 @@ class RawKerberosTest(TestCaseInTempDir): > etype_info2 = None > etype_info = None > enc_timestamp = None >+ enc_challenge = None > pk_as_req = None > pk_as_rep19 = None > for pa in rep_padata: >@@ -2303,6 +2305,10 @@ class RawKerberosTest(TestCaseInTempDir): > enc_timestamp = pavalue > self.assertEqual(len(enc_timestamp), 0) > continue >+ if patype == PADATA_ENCRYPTED_CHALLENGE: >+ self.assertIsNone(enc_challenge) >+ enc_challenge = pavalue >+ continue > if patype == PADATA_PK_AS_REQ: > self.assertIsNone(pk_as_req) > pk_as_req = pavalue >@@ -2314,6 +2320,54 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertEqual(len(pk_as_rep19), 0) > continue > >+ if enc_challenge is not None: >+ if not sent_enc_challenge: >+ self.assertEqual(len(enc_challenge), 0) >+ else: >+ armor_key = kdc_exchange_dict['armor_key'] >+ self.assertIsNotNone(armor_key) >+ >+ check_padata_fn = kdc_exchange_dict['check_padata_fn'] >+ padata = self.getElementValue(rep, 'padata') >+ self.assertIsNotNone(check_padata_fn) >+ preauth_key, _ = check_padata_fn(kdc_exchange_dict, >+ callback_dict, >+ rep, >+ padata) >+ >+ kdc_challenge_key = self.generate_kdc_challenge_key( >+ armor_key, preauth_key) >+ >+ # Ensure that the encrypted challenge FAST factor is supported >+ # (RFC6113 5.4.6). >+ if self.strict_checking: >+ self.assertNotEqual(len(enc_challenge), 0) >+ if len(enc_challenge) != 0: >+ encrypted_challenge = self.der_decode( >+ enc_challenge, >+ asn1Spec=krb5_asn1.EncryptedData()) >+ self.assertEqual(encrypted_challenge['etype'], >+ kdc_challenge_key.etype) >+ >+ challenge = kdc_challenge_key.decrypt( >+ KU_ENC_CHALLENGE_KDC, >+ encrypted_challenge['cipher']) >+ challenge = self.der_decode( >+ challenge, >+ asn1Spec=krb5_asn1.PA_ENC_TS_ENC()) >+ >+ # Retrieve the returned timestamp. >+ rep_patime = challenge['patimestamp'] >+ self.assertIn('pausec', challenge) >+ >+ # Ensure the returned time is within five minutes of the >+ # current time. >+ rep_time = self.get_EpochFromKerberosTime(rep_patime) >+ current_time = time.time() >+ >+ self.assertLess(current_time - 300, rep_time) >+ self.assertLess(rep_time, current_time) >+ > if all(etype not in client_as_etypes or etype not in proposed_etypes > for etype in (kcrypto.Enctype.AES256, > kcrypto.Enctype.AES128, >-- >2.25.1 > > >From d4213b15830c17aad188e7cdc66a97440a666a48 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:49:12 +1200 >Subject: [PATCH 189/380] tests/krb5: Check PADATA-FX-COOKIE in reply > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 95b54078c2f82179283dfc397c4ec1f36d5edfe7) >--- > python/samba/tests/krb5/raw_testcase.py | 15 +++++++++++++++ > 1 file changed, 15 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index ca967c1ac13..23a4e70c22f 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2287,6 +2287,8 @@ class RawKerberosTest(TestCaseInTempDir): > enc_challenge = None > pk_as_req = None > pk_as_rep19 = None >+ fast_cookie = None >+ fx_fast = None > for pa in rep_padata: > patype = self.getElementValue(pa, 'padata-type') > pavalue = self.getElementValue(pa, 'padata-value') >@@ -2319,6 +2321,19 @@ class RawKerberosTest(TestCaseInTempDir): > pk_as_rep19 = pavalue > self.assertEqual(len(pk_as_rep19), 0) > continue >+ if patype == PADATA_FX_COOKIE: >+ self.assertIsNone(fast_cookie) >+ fast_cookie = pavalue >+ self.assertIsNotNone(fast_cookie) >+ continue >+ if patype == PADATA_FX_FAST: >+ self.assertIsNone(fx_fast) >+ fx_fast = pavalue >+ self.assertEqual(len(fx_fast), 0) >+ continue >+ >+ if fast_cookie is not None: >+ kdc_exchange_dict['fast_cookie'] = fast_cookie > > if enc_challenge is not None: > if not sent_enc_challenge: >-- >2.25.1 > > >From f439bff779890ac0e08c40c9222c9a343f90c083 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Jul 2021 20:49:25 +1200 >Subject: [PATCH 190/380] tests/krb5: Make check_rep_padata() also work for > checking TGS replies > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit ab4e7028a6ac01eab9531c8a26507a912df54278) >--- > python/samba/tests/krb5/raw_testcase.py | 72 +++++++++++++++---------- > 1 file changed, 45 insertions(+), 27 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 23a4e70c22f..14f86fb87a8 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1789,6 +1789,7 @@ class RawKerberosTest(TestCaseInTempDir): > check_rep_fn=None, > check_padata_fn=None, > check_kdc_private_fn=None, >+ expected_error_mode=0, > callback_dict=None, > tgt=None, > armor_key=None, >@@ -1820,6 +1821,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'check_padata_fn': check_padata_fn, > 'check_kdc_private_fn': check_kdc_private_fn, > 'callback_dict': callback_dict, >+ 'expected_error_mode': expected_error_mode, > 'tgt': tgt, > 'body_checksum_type': body_checksum_type, > 'armor_key': armor_key, >@@ -2216,6 +2218,8 @@ class RawKerberosTest(TestCaseInTempDir): > callback_dict, > rep, > rep_padata): >+ rep_msg_type = kdc_exchange_dict['rep_msg_type'] >+ > expected_error_mode = kdc_exchange_dict['expected_error_mode'] > req_body = kdc_exchange_dict['req_body'] > proposed_etypes = req_body['etype'] >@@ -2224,6 +2228,9 @@ class RawKerberosTest(TestCaseInTempDir): > sent_fast = self.sent_fast(kdc_exchange_dict) > sent_enc_challenge = self.sent_enc_challenge(kdc_exchange_dict) > >+ if rep_msg_type == KRB_TGS_REP: >+ self.assertTrue(sent_fast) >+ > expect_etype_info2 = () > expect_etype_info = False > unexpect_etype_info = True >@@ -2254,27 +2261,32 @@ class RawKerberosTest(TestCaseInTempDir): > expected_patypes += (PADATA_FX_ERROR,) > expected_patypes += (PADATA_FX_COOKIE,) > >- if expect_etype_info: >- self.assertGreater(len(expect_etype_info2), 0) >- expected_patypes += (PADATA_ETYPE_INFO,) >- if len(expect_etype_info2) != 0: >- expected_patypes += (PADATA_ETYPE_INFO2,) >+ if rep_msg_type == KRB_TGS_REP: >+ sent_claims = self.sent_claims(kdc_exchange_dict) >+ if sent_claims and expected_error_mode != 0: >+ expected_patypes += (PADATA_PAC_OPTIONS,) >+ else: >+ if expect_etype_info: >+ self.assertGreater(len(expect_etype_info2), 0) >+ expected_patypes += (PADATA_ETYPE_INFO,) >+ if len(expect_etype_info2) != 0: >+ expected_patypes += (PADATA_ETYPE_INFO2,) > >- if expected_error_mode != KDC_ERR_PREAUTH_FAILED: >- if sent_fast: >- expected_patypes += (PADATA_ENCRYPTED_CHALLENGE,) >- else: >- expected_patypes += (PADATA_ENC_TIMESTAMP,) >+ if expected_error_mode != KDC_ERR_PREAUTH_FAILED: >+ if sent_fast: >+ expected_patypes += (PADATA_ENCRYPTED_CHALLENGE,) >+ else: >+ expected_patypes += (PADATA_ENC_TIMESTAMP,) > >- if not sent_enc_challenge: >- expected_patypes += (PADATA_PK_AS_REQ,) >- expected_patypes += (PADATA_PK_AS_REP_19,) >+ if not sent_enc_challenge: >+ expected_patypes += (PADATA_PK_AS_REQ,) >+ expected_patypes += (PADATA_PK_AS_REP_19,) > >- if (self.kdc_fast_support >- and not sent_fast >- and not sent_enc_challenge): >- expected_patypes += (PADATA_FX_FAST,) >- expected_patypes += (PADATA_FX_COOKIE,) >+ if (self.kdc_fast_support >+ and not sent_fast >+ and not sent_enc_challenge): >+ expected_patypes += (PADATA_FX_FAST,) >+ expected_patypes += (PADATA_FX_COOKIE,) > > if self.strict_checking: > for i, patype in enumerate(expected_patypes): >@@ -2389,15 +2401,21 @@ class RawKerberosTest(TestCaseInTempDir): > kcrypto.Enctype.RC4)): > self.assertIsNone(etype_info2) > self.assertIsNone(etype_info) >- if self.strict_checking: >- if sent_fast: >- self.assertIsNotNone(enc_challenge) >- self.assertIsNone(enc_timestamp) >- else: >- self.assertIsNotNone(enc_timestamp) >- self.assertIsNone(enc_challenge) >- self.assertIsNotNone(pk_as_req) >- self.assertIsNotNone(pk_as_rep19) >+ if rep_msg_type == KRB_AS_REP: >+ if self.strict_checking: >+ if sent_fast: >+ self.assertIsNotNone(enc_challenge) >+ self.assertIsNone(enc_timestamp) >+ else: >+ self.assertIsNotNone(enc_timestamp) >+ self.assertIsNone(enc_challenge) >+ self.assertIsNotNone(pk_as_req) >+ self.assertIsNotNone(pk_as_rep19) >+ else: >+ self.assertIsNone(enc_timestamp) >+ self.assertIsNone(enc_challenge) >+ self.assertIsNone(pk_as_req) >+ self.assertIsNone(pk_as_rep19) > return None > > if self.strict_checking: >-- >2.25.1 > > >From 61ded35b866f59acf8371fa1700d6527cd75e492 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 16:29:39 +1200 >Subject: [PATCH 191/380] tests/krb5: Make generic_check_kdc_error() also work > for checking TGS replies > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 29070e74baa18d94642efcd36930b9bab216e10c) >--- > python/samba/tests/krb5/raw_testcase.py | 12 +++++++++++- > 1 file changed, 11 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 14f86fb87a8..8cbf3edbbab 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -45,6 +45,7 @@ from samba.tests.krb5.rfc4120_constants import ( > FX_FAST_ARMOR_AP_REQUEST, > KDC_ERR_GENERIC, > KDC_ERR_PREAUTH_FAILED, >+ KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS, > KRB_AP_REQ, > KRB_AS_REP, > KRB_AS_REQ, >@@ -2150,6 +2151,8 @@ class RawKerberosTest(TestCaseInTempDir): > callback_dict, > rep): > >+ rep_msg_type = kdc_exchange_dict['rep_msg_type'] >+ > expected_cname = kdc_exchange_dict['expected_cname'] > expected_srealm = kdc_exchange_dict['expected_srealm'] > expected_sname = kdc_exchange_dict['expected_sname'] >@@ -2157,6 +2160,8 @@ class RawKerberosTest(TestCaseInTempDir): > > sent_fast = self.sent_fast(kdc_exchange_dict) > >+ fast_armor_type = kdc_exchange_dict['fast_armor_type'] >+ > self.assertElementEqual(rep, 'pvno', 5) > self.assertElementEqual(rep, 'msg-type', KRB_ERROR) > self.assertElementEqual(rep, 'error-code', expected_error_mode) >@@ -2176,7 +2181,12 @@ class RawKerberosTest(TestCaseInTempDir): > else: > self.assertElementEqualPrincipal(rep, 'sname', expected_sname) > self.assertElementMissing(rep, 'e-text') >- if expected_error_mode == KDC_ERR_GENERIC: >+ if (expected_error_mode in (KDC_ERR_GENERIC, >+ KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS) >+ or (rep_msg_type == KRB_TGS_REP >+ and not sent_fast) >+ or (sent_fast and fast_armor_type is not None >+ and fast_armor_type != FX_FAST_ARMOR_AP_REQUEST)): > self.assertElementMissing(rep, 'e-data') > return rep > edata = self.getElementValue(rep, 'e-data') >-- >2.25.1 > > >From d2c16d365deb3b8872ec8c26f0c5ffdbf19bb464 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:50:20 +1200 >Subject: [PATCH 192/380] tests/krb5: Check PADATA-PAC-OPTIONS in reply > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 0c857f67a3a4a27aa4b799c9a61a1a1b59932c07) >--- > python/samba/tests/krb5/raw_testcase.py | 9 +++++++++ > 1 file changed, 9 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 8cbf3edbbab..5016e14783c 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2311,6 +2311,7 @@ class RawKerberosTest(TestCaseInTempDir): > pk_as_rep19 = None > fast_cookie = None > fx_fast = None >+ pac_options = None > for pa in rep_padata: > patype = self.getElementValue(pa, 'padata-type') > pavalue = self.getElementValue(pa, 'padata-value') >@@ -2353,10 +2354,18 @@ class RawKerberosTest(TestCaseInTempDir): > fx_fast = pavalue > self.assertEqual(len(fx_fast), 0) > continue >+ if patype == PADATA_PAC_OPTIONS: >+ self.assertIsNone(pac_options) >+ pac_options = pavalue >+ self.assertIsNotNone(pac_options) >+ continue > > if fast_cookie is not None: > kdc_exchange_dict['fast_cookie'] = fast_cookie > >+ if pac_options is not None: >+ self.check_pac_options_claims_support(pac_options) >+ > if enc_challenge is not None: > if not sent_enc_challenge: > self.assertEqual(len(enc_challenge), 0) >-- >2.25.1 > > >From a26cd82ca76fa02614e96e9262387123b8bce1ea Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 29 Jul 2021 11:50:16 +1200 >Subject: [PATCH 193/380] tests/krb5: Allow generic_check_kdc_error() to check > inner FAST errors > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit 66e1eb58bedf036ad25a868993d44480c4e0e055) >--- > python/samba/tests/krb5/raw_testcase.py | 12 +++++++++--- > 1 file changed, 9 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 5016e14783c..4ebab367141 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -68,6 +68,7 @@ from samba.tests.krb5.rfc4120_constants import ( > KU_TGS_REQ_AUTH_DAT_SUBKEY, > KU_TICKET, > NT_SRV_INST, >+ NT_WELLKNOWN, > PADATA_ENCRYPTED_CHALLENGE, > PADATA_ENC_TIMESTAMP, > PADATA_ETYPE_INFO, >@@ -2149,7 +2150,8 @@ class RawKerberosTest(TestCaseInTempDir): > def generic_check_kdc_error(self, > kdc_exchange_dict, > callback_dict, >- rep): >+ rep, >+ inner=False): > > rep_msg_type = kdc_exchange_dict['rep_msg_type'] > >@@ -2173,7 +2175,10 @@ class RawKerberosTest(TestCaseInTempDir): > # error-code checked above > if self.strict_checking: > self.assertElementMissing(rep, 'crealm') >- self.assertElementMissing(rep, 'cname') >+ if expected_cname['name-type'] == NT_WELLKNOWN and not inner: >+ self.assertElementEqualPrincipal(rep, 'cname', expected_cname) >+ else: >+ self.assertElementMissing(rep, 'cname') > self.assertElementEqualUTF8(rep, 'realm', expected_srealm) > if sent_fast and expected_error_mode == KDC_ERR_GENERIC: > self.assertElementEqualPrincipal(rep, 'sname', >@@ -2186,7 +2191,8 @@ class RawKerberosTest(TestCaseInTempDir): > or (rep_msg_type == KRB_TGS_REP > and not sent_fast) > or (sent_fast and fast_armor_type is not None >- and fast_armor_type != FX_FAST_ARMOR_AP_REQUEST)): >+ and fast_armor_type != FX_FAST_ARMOR_AP_REQUEST) >+ or inner): > self.assertElementMissing(rep, 'e-data') > return rep > edata = self.getElementValue(rep, 'e-data') >-- >2.25.1 > > >From 097a5bfb74780a39e5853026e54cf5d3b70d15ac Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 27 Jul 2021 14:49:58 +1200 >Subject: [PATCH 194/380] tests/krb5: Check PADATA-FX-ERROR in reply > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit aa2c221f4e1bfc3403de857e62eaeaee1577560c) >--- > python/samba/tests/krb5/raw_testcase.py | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 4ebab367141..17ef8df5daa 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2316,6 +2316,7 @@ class RawKerberosTest(TestCaseInTempDir): > pk_as_req = None > pk_as_rep19 = None > fast_cookie = None >+ fast_error = None > fx_fast = None > pac_options = None > for pa in rep_padata: >@@ -2355,6 +2356,11 @@ class RawKerberosTest(TestCaseInTempDir): > fast_cookie = pavalue > self.assertIsNotNone(fast_cookie) > continue >+ if patype == PADATA_FX_ERROR: >+ self.assertIsNone(fast_error) >+ fast_error = pavalue >+ self.assertIsNotNone(fast_error) >+ continue > if patype == PADATA_FX_FAST: > self.assertIsNone(fx_fast) > fx_fast = pavalue >@@ -2369,6 +2375,14 @@ class RawKerberosTest(TestCaseInTempDir): > if fast_cookie is not None: > kdc_exchange_dict['fast_cookie'] = fast_cookie > >+ if fast_error is not None: >+ fast_error = self.der_decode(fast_error, >+ asn1Spec=krb5_asn1.KRB_ERROR()) >+ self.generic_check_kdc_error(kdc_exchange_dict, >+ callback_dict, >+ fast_error, >+ inner=True) >+ > if pac_options is not None: > self.check_pac_options_claims_support(pac_options) > >-- >2.25.1 > > >From 75ce25df5464d53e81e15e83b9e5910a8c4d97c3 Mon Sep 17 00:00:00 2001 >From: Gary Lockyer <gary@catalyst.net.nz> >Date: Thu, 10 Jun 2021 09:56:58 +1200 >Subject: [PATCH 195/380] initial FAST tests > >Currently incomplete, and tested only against MIT Kerberos. > >[abartlet@samba.org > Originally "WIP inital FAST tests" > > Samba's general policy that we don't push WIP patches, we polish > into a 'perfect' patch stream. > > However, I think there are good reasons to keep this patch distinct > in this particular case. > > Gary is being modest in titling this WIP (now removed from the title > to avoid confusion). They are not WIP in the normal sense of > partially or untested code or random unfinished thoughts. The primary > issue is that at that point where Gary had to finish up he had > trouble getting FAST support enabled on Windows, so couldn't test > against our standard reference. They are instead good, working > initial tests written against the RFC and tested against Samba's AD DC > in the mode backed by MIT Kerberos. > > This preserves clear authorship for the two distinct bodies of work, > as in the next patch Joseph was able to extend and improve the tests > significantly. ] > >Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >(cherry picked from commit b7b62957bdce9929fabd3812b9378bdbd6c12966) >--- > python/samba/tests/krb5/fast_tests.py | 245 ++++++++++++++++++++++++++ > python/samba/tests/usage.py | 1 + > selftest/knownfail_heimdal_kdc | 8 + > source4/selftest/tests.py | 8 + > 4 files changed, 262 insertions(+) > create mode 100755 python/samba/tests/krb5/fast_tests.py > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >new file mode 100755 >index 00000000000..c4d1c2c5d82 >--- /dev/null >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -0,0 +1,245 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# Copyright (C) 2020 Catalyst.Net Ltd >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+from samba.tests.krb5.kdc_base_test import KDCBaseTest >+from samba.tests.krb5.rfc4120_constants import ( >+ AES256_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5, >+ NT_PRINCIPAL, >+ NT_SRV_INST, >+ PADATA_FX_COOKIE, >+ PADATA_FX_FAST, >+) >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class FAST_Tests(KDCBaseTest): >+ ''' >+ ''' >+ >+ def setUp(self): >+ super().setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ def get_padata_element(self, rep, padata_type): >+ rep_padata = self.der_decode( >+ rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) >+ for pa in rep_padata: >+ if pa['padata-type'] == padata_type: >+ return pa['padata-value'] >+ return None >+ >+ def test_fast_supported(self): >+ '''Confirm that the kdc supports FAST >+ The KDC SHOULD return an empty PA-FX-FAST in a >+ PREAUTH_REQUIRED error if FAST is supported >+ >+ >+ ''' >+ >+ # Create a user account for the test. >+ # >+ samdb = self.get_samdb() >+ user_name = "krb5fastusr" >+ (uc, dn) = self.create_account(samdb, user_name) >+ realm = uc.get_realm().lower() >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.assertIsNotNone(rep) >+ self.assertEqual(rep['msg-type'], 30) >+ self.assertEqual(rep['error-code'], 25) >+ >+ fx_fast = self.get_padata_element(rep, PADATA_FX_FAST) >+ self.assertIsNotNone(fx_fast, "No PADATA_FX_FAST element") >+ >+ def test_explicit_PA_FX_FAST_in_as_req(self): >+ ''' >+ Add an empty PA-FX-FAST in the initial AS-REQ >+ This should get rejected with a Generic error. >+ >+ ''' >+ >+ # Create a user account for the test. >+ # >+ samdb = self.get_samdb() >+ user_name = "krb5fastusr" >+ (uc, dn) = self.create_account(samdb, user_name) >+ realm = uc.get_realm().lower() >+ >+ # Do the initial AS-REQ, should get a generic error response >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ x = self.PA_DATA_create(PADATA_FX_FAST, b'') >+ padata = [x] >+ rep = self.as_req(cname, sname, realm, etype, padata) >+ >+ self.assertIsNotNone(rep) >+ self.assertEqual(rep['msg-type'], 30) >+ self.assertEqual(rep['error-code'], 60) >+ >+ def test_fast_cookie_retured_in_pre_auth(self): >+ '''Confirm that the kdc returns PA-FX-COOKIE >+ ''' >+ >+ # Create a user account for the test. >+ # >+ samdb = self.get_samdb() >+ user_name = "krb5fastusr" >+ (uc, dn) = self.create_account(samdb, user_name) >+ realm = uc.get_realm().lower() >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.assertIsNotNone(rep) >+ self.assertEqual(rep['msg-type'], 30) >+ self.assertEqual(rep['error-code'], 25) >+ >+ fx_fast = self.get_padata_element(rep, PADATA_FX_FAST) >+ self.assertIsNotNone(fx_fast, "No PADATA_FX_FAST element") >+ >+ fx_cookie = self.get_padata_element(rep, PADATA_FX_COOKIE) >+ self.assertIsNotNone(fx_cookie, "No PADATA_FX_COOKIE element") >+ >+ def test_ignore_fast(self): >+ ''' >+ TODO reword this >+ Attempt to authenticate with out FAST, i.e. ignoring the >+ FAST advertised in the pre-auth >+ ''' >+ >+ # Create a user account for the test. >+ # >+ samdb = self.get_samdb() >+ user_name = "krb5fastusr" >+ (uc, dn) = self.create_account(samdb, user_name) >+ realm = uc.get_realm().lower() >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.assertIsNotNone(rep) >+ self.assertEqual(rep['msg-type'], 30) >+ self.assertEqual(rep['error-code'], 25) >+ >+ fx_fast = self.get_padata_element(rep, PADATA_FX_FAST) >+ self.assertIsNotNone(fx_fast, "No PADATA_FX_FAST element") >+ >+ fx_cookie = self.get_padata_element(rep, PADATA_FX_COOKIE) >+ self.assertIsNotNone(fx_cookie, "No PADATA_FX_COOKIE element") >+ >+ # Do the next AS-REQ >+ padata = [self.get_enc_timestamp_pa_data(uc, rep)] >+ rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ self.check_as_reply(rep) >+ >+ def test_fast(self): >+ ''' >+ Attempt to authenticate with >+ ''' >+ >+ # Create a user account for the test. >+ # >+ samdb = self.get_samdb() >+ user_name = "krb5fastusr" >+ (uc, dn) = self.create_account(samdb, user_name) >+ realm = uc.get_realm().lower() >+ >+ # Do the initial AS-REQ, should get a pre-authentication required >+ # response >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[user_name]) >+ sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ >+ rep = self.as_req(cname, sname, realm, etype) >+ self.assertIsNotNone(rep) >+ self.assertEqual(rep['msg-type'], 30) >+ self.assertEqual(rep['error-code'], 25) >+ >+ fx_fast = self.get_padata_element(rep, PADATA_FX_FAST) >+ self.assertIsNotNone(fx_fast, "No PADATA_FX_FAST element") >+ >+ fx_cookie = self.get_padata_element(rep, PADATA_FX_COOKIE) >+ self.assertIsNotNone(fx_cookie, "No PADATA_FX_COOKIE element") >+ >+ cookie = self.PA_DATA_create(PADATA_FX_COOKIE, fx_cookie) >+ >+ # Do the next AS-REQ >+ padata = [self.get_enc_timestamp_pa_data(uc, rep)] >+ padata.append(cookie) >+ # req = self.AS_REQ_create(padata=padata, >+ # kdc_options=str(kdc_options), >+ # cname=cname, >+ # realm=realm, >+ # sname=sname, >+ # from_time=None, >+ # till_time=till, >+ # renew_time=None, >+ # nonce=0x7fffffff, >+ # etypes=etypes, >+ # addresses=None, >+ # EncAuthorizationData=None, >+ # EncAuthorizationData_key=None, >+ # additional_tickets=None) >+ # rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ # self.check_as_reply(rep) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = False >+ global_hexdump = False >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 11170a2d241..29990ec9511 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -101,6 +101,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/test_smb.py', > 'python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py', > 'python/samba/tests/krb5/as_req_tests.py', >+ 'python/samba/tests/krb5/fast_tests.py', > } > > EXCLUDE_HELP = { >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 4e6ee93ce96..66f07cebc14 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -14,3 +14,11 @@ > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_b > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_c > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_6_c >+# >+# MIT specific FAST tests, >+# >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_explicit_PA_FX_FAST_in_as_req\(ad_dc\) >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast\(ad_dc\) >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_cookie_retured_in_pre_auth\(ad_dc\) >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_supported\(ad_dc\) >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_ignore_fast\(ad_dc\) >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index d99f08899de..d091eaaecf9 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -1326,6 +1326,14 @@ planpythontestsuite( > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD' > }) >+planpythontestsuite( >+ "ad_dc", >+ "samba.tests.krb5.fast_tests", >+ environ={ >+ 'ADMIN_USERNAME': '$USERNAME', >+ 'ADMIN_PASSWORD': '$PASSWORD', >+ 'SERVICE_USERNAME': '$SERVER' >+ }) > planpythontestsuite( > "ad_dc", > "samba.tests.krb5.ms_kile_client_principal_lookup_tests", >-- >2.25.1 > > >From b4e55395d96d6fded9099f5a18c9f56b6c8b24cd Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 29 Jul 2021 10:58:44 +1200 >Subject: [PATCH 196/380] tests/krb5: Add FAST tests > >Example command: > >SERVER=addc STRICT_CHECKING=0 SMB_CONF_PATH=/dev/null \ >KRB5_CONFIG=krb5.conf DOMAIN=ADDOMAIN REALM=ADDOM.SAMBA.EXAMPLE.COM \ >ADMIN_USERNAME=Administrator ADMIN_PASSWORD=locDCpass1 \ >PYTHONPATH=bin/python python/samba/tests/krb5/fast_tests.py > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Wed Aug 18 23:20:14 UTC 2021 on sn-devel-184 > >(cherry picked from commit 984a0db00c3f2e38b568a75eb1944f4d7bb7f854) >--- > python/samba/tests/krb5/fast_tests.py | 1649 ++++++++++++++++++++++--- > selftest/knownfail_heimdal_kdc | 54 +- > selftest/knownfail_mit_kdc | 53 + > source4/selftest/tests.py | 2 +- > 4 files changed, 1585 insertions(+), 173 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index c4d1c2c5d82..e38b2e0a6e1 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -17,225 +17,1542 @@ > # along with this program. If not, see <http://www.gnu.org/licenses/>. > # > >-import sys >+import functools > import os >+import sys > >-sys.path.insert(0, "bin/python") >-os.environ["PYTHONUNBUFFERED"] = "1" >+import ldb > >+from samba.dcerpc import security >+from samba.tests.krb5.raw_testcase import ( >+ KerberosTicketCreds, >+ Krb5EncryptionKey >+) > from samba.tests.krb5.kdc_base_test import KDCBaseTest > from samba.tests.krb5.rfc4120_constants import ( >+ AD_FX_FAST_ARMOR, >+ AD_FX_FAST_USED, > AES256_CTS_HMAC_SHA1_96, > ARCFOUR_HMAC_MD5, >+ FX_FAST_ARMOR_AP_REQUEST, >+ KDC_ERR_ETYPE_NOSUPP, >+ KDC_ERR_GENERIC, >+ KDC_ERR_NOT_US, >+ KDC_ERR_PREAUTH_FAILED, >+ KDC_ERR_PREAUTH_REQUIRED, >+ KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS, >+ KRB_AS_REP, >+ KRB_TGS_REP, >+ KU_AS_REP_ENC_PART, >+ KU_TICKET, > NT_PRINCIPAL, > NT_SRV_INST, >+ NT_WELLKNOWN, > PADATA_FX_COOKIE, > PADATA_FX_FAST, >+ PADATA_PAC_OPTIONS > ) > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 >+import samba.tests.krb5.kcrypto as kcrypto >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" > > global_asn1_print = False > global_hexdump = False > > > class FAST_Tests(KDCBaseTest): >- ''' >- ''' >+ @classmethod >+ def setUpClass(cls): >+ super().setUpClass() >+ >+ cls.user_tgt = None >+ cls.user_enc_part = None >+ cls.user_service_ticket = None >+ >+ cls.mach_tgt = None >+ cls.mach_enc_part = None >+ cls.mach_service_ticket = None > > def setUp(self): > super().setUp() > self.do_asn1_print = global_asn1_print > self.do_hexdump = global_hexdump > >- def get_padata_element(self, rep, padata_type): >- rep_padata = self.der_decode( >- rep['e-data'], asn1Spec=krb5_asn1.METHOD_DATA()) >- for pa in rep_padata: >- if pa['padata-type'] == padata_type: >- return pa['padata-value'] >- return None >+ def test_simple(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': False >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': False, >+ 'gen_padata_fn': self.generate_enc_timestamp_padata >+ } >+ ]) > >- def test_fast_supported(self): >- '''Confirm that the kdc supports FAST >- The KDC SHOULD return an empty PA-FX-FAST in a >- PREAUTH_REQUIRED error if FAST is supported >+ def test_simple_tgs(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': False, >+ 'gen_tgt_fn': self.get_user_tgt >+ } >+ ]) > >+ def test_simple_tgs_wrong_principal(self): >+ mach_creds = self.get_mach_creds() >+ mach_name = mach_creds.get_username() >+ expected_cname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[mach_name]) > >- ''' >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': False, >+ 'gen_tgt_fn': self.get_mach_tgt, >+ 'expected_cname': expected_cname >+ } >+ ]) > >- # Create a user account for the test. >- # >- samdb = self.get_samdb() >- user_name = "krb5fastusr" >- (uc, dn) = self.create_account(samdb, user_name) >- realm = uc.get_realm().lower() >+ def test_simple_tgs_service_ticket(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_NOT_US, >+ 'use_fast': False, >+ 'gen_tgt_fn': self.get_user_service_ticket, >+ } >+ ]) > >- # Do the initial AS-REQ, should get a pre-authentication required >- # response >- etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >- cname = self.PrincipalName_create( >- name_type=NT_PRINCIPAL, names=[user_name]) >- sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ def test_simple_tgs_service_ticket_mach(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_NOT_US, >+ 'use_fast': False, >+ 'gen_tgt_fn': self.get_mach_service_ticket, >+ } >+ ]) > >- rep = self.as_req(cname, sname, realm, etype) >- self.assertIsNotNone(rep) >- self.assertEqual(rep['msg-type'], 30) >- self.assertEqual(rep['error-code'], 25) >+ def test_fast_no_claims(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'pac_options': '0' >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'pac_options': '0' >+ } >+ ]) > >- fx_fast = self.get_padata_element(rep, PADATA_FX_FAST) >- self.assertIsNotNone(fx_fast, "No PADATA_FX_FAST element") >+ def test_fast_tgs_no_claims(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None, >+ 'pac_options': '0' >+ } >+ ]) > >- def test_explicit_PA_FX_FAST_in_as_req(self): >- ''' >- Add an empty PA-FX-FAST in the initial AS-REQ >- This should get rejected with a Generic error. >+ def test_fast_no_claims_or_canon(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'pac_options': '0', >+ 'kdc_options': '0' >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'pac_options': '0', >+ 'kdc_options': '0' >+ } >+ ]) > >- ''' >+ def test_fast_tgs_no_claims_or_canon(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None, >+ 'pac_options': '0', >+ 'kdc_options': '0' >+ } >+ ]) > >- # Create a user account for the test. >- # >- samdb = self.get_samdb() >- user_name = "krb5fastusr" >- (uc, dn) = self.create_account(samdb, user_name) >- realm = uc.get_realm().lower() >+ def test_fast_no_canon(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'kdc_options': '0' >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'kdc_options': '0' >+ } >+ ]) > >- # Do the initial AS-REQ, should get a generic error response >- # response >- etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >- cname = self.PrincipalName_create( >- name_type=NT_PRINCIPAL, names=[user_name]) >- sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ def test_fast_tgs_no_canon(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None, >+ 'kdc_options': '0' >+ } >+ ]) >+ >+ def test_simple_tgs_no_etypes(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_ETYPE_NOSUPP, >+ 'use_fast': False, >+ 'gen_tgt_fn': self.get_mach_tgt, >+ 'etypes': () >+ } >+ ]) >+ >+ def test_fast_tgs_no_etypes(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_ETYPE_NOSUPP, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_mach_tgt, >+ 'fast_armor': None, >+ 'etypes': () >+ } >+ ]) >+ >+ def test_simple_no_etypes(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_ETYPE_NOSUPP, >+ 'use_fast': False, >+ 'etypes': () >+ } >+ ]) >+ >+ def test_simple_fast_no_etypes(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_ETYPE_NOSUPP, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'etypes': () >+ } >+ ]) >+ >+ def test_empty_fast(self): >+ # Add an empty PA-FX-FAST in the initial AS-REQ. This should get >+ # rejected with a Generic error. >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ 'use_fast': True, >+ 'gen_fast_fn': self.generate_empty_fast, >+ 'fast_armor': None, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_fast_unknown_critical_option(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS, >+ 'use_fast': True, >+ 'fast_options': '001', # unsupported critical option >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_unarmored_as_req(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ 'use_fast': True, >+ 'fast_armor': None, # no armor, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_fast_invalid_armor_type(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_FAILED, >+ 'use_fast': True, >+ 'fast_armor': 0, # invalid armor type >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_fast_invalid_armor_type2(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_FAILED, >+ 'use_fast': True, >+ 'fast_armor': 2, # invalid armor type >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_fast_encrypted_challenge(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_fast_encrypted_challenge_wrong_key(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_FAILED, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata_wrong_key, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_fast_encrypted_challenge_wrong_key_kdc(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_FAILED, >+ 'use_fast': True, >+ 'gen_padata_fn': >+ self.generate_enc_challenge_padata_wrong_key_kdc, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_fast_encrypted_challenge_clock_skew(self): >+ # The KDC is supposed to confirm that the timestamp is within its >+ # current clock skew, and return KRB_APP_ERR_SKEW if it is not (RFC6113 >+ # 5.4.6). However, Windows accepts a skewed timestamp in the encrypted >+ # challenge. >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': functools.partial( >+ self.generate_enc_challenge_padata, >+ skew=10000), >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_fast_invalid_tgt(self): >+ # The armor ticket 'sname' field is required to identify the target >+ # realm TGS (RFC6113 5.4.1.1). However, Windows will still accept a >+ # service ticket identifying a different server principal. >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_user_service_ticket >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_user_service_ticket >+ # ticket not identifying TGS of current >+ # realm >+ } >+ ]) >+ >+ def test_fast_invalid_tgt_mach(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_service_ticket >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_service_ticket >+ # ticket not identifying TGS of current >+ # realm >+ } >+ ]) >+ >+ def test_fast_enc_timestamp(self): >+ # Provide ENC-TIMESTAMP as FAST padata when we should be providing >+ # ENCRYPTED-CHALLENGE - ensure that we get PREAUTH_REQUIRED. >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_timestamp_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_fast(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_fast_tgs(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None >+ } >+ ]) >+ >+ def test_fast_tgs_armor(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST >+ } >+ ]) >+ >+ def test_fast_outer_wrong_realm(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'outer_req': { >+ 'realm': 'TEST' # should be ignored >+ } >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'outer_req': { >+ 'realm': 'TEST' # should be ignored >+ } >+ } >+ ]) >+ >+ def test_fast_tgs_outer_wrong_realm(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None, >+ 'outer_req': { >+ 'realm': 'TEST' # should be ignored >+ } >+ } >+ ]) >+ >+ def test_fast_outer_wrong_nonce(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'outer_req': { >+ 'nonce': '123' # should be ignored >+ } >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'outer_req': { >+ 'nonce': '123' # should be ignored >+ } >+ } >+ ]) >+ >+ def test_fast_tgs_outer_wrong_nonce(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None, >+ 'outer_req': { >+ 'nonce': '123' # should be ignored >+ } >+ } >+ ]) >+ >+ def test_fast_outer_wrong_flags(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'outer_req': { >+ 'kdc-options': '11111111111111111' # should be ignored >+ } >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'outer_req': { >+ 'kdc-options': '11111111111111111' # should be ignored >+ } >+ } >+ ]) >+ >+ def test_fast_tgs_outer_wrong_flags(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None, >+ 'outer_req': { >+ 'kdc-options': '11111111111111111' # should be ignored >+ } >+ } >+ ]) >+ >+ def test_fast_outer_wrong_till(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'outer_req': { >+ 'till': '15000101000000Z' # should be ignored >+ } >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'outer_req': { >+ 'till': '15000101000000Z' # should be ignored >+ } >+ } >+ ]) >+ >+ def test_fast_tgs_outer_wrong_till(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None, >+ 'outer_req': { >+ 'till': '15000101000000Z' # should be ignored >+ } >+ } >+ ]) >+ >+ def test_fast_authdata_fast_used(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_authdata_fn': self.generate_fast_used_auth_data, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None >+ } >+ ]) >+ >+ def test_fast_authdata_fast_not_used(self): >+ # The AD-fx-fast-used authdata type can be included in the >+ # authenticator or the TGT authentication data to indicate that FAST >+ # must be used. The KDC must return KRB_APP_ERR_MODIFIED if it receives >+ # this authdata type in a request not using FAST (RFC6113 5.4.2). >+ self._run_test_sequence([ >+ # This request works without FAST. >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': False, >+ 'gen_tgt_fn': self.get_user_tgt >+ }, >+ # Add the 'FAST used' auth data and it now fails. >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ # should be KRB_APP_ERR_MODIFIED >+ 'use_fast': False, >+ 'gen_authdata_fn': self.generate_fast_used_auth_data, >+ 'gen_tgt_fn': self.get_user_tgt >+ } >+ ]) >+ >+ def test_fast_ad_fx_fast_armor(self): >+ # If the authenticator or TGT authentication data contains the >+ # AD-fx-fast-armor authdata type, the KDC must reject the request >+ # (RFC6113 5.4.1.1). >+ self._run_test_sequence([ >+ # This request works. >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None >+ }, >+ # Add the 'FAST armor' auth data and it now fails. >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ 'use_fast': True, >+ 'gen_authdata_fn': self.generate_fast_armor_auth_data, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None >+ } >+ ]) >+ >+ def test_fast_ad_fx_fast_armor2(self): >+ # Show that we can still use the AD-fx-fast-armor authorization data in >+ # FAST armor tickets. >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'gen_authdata_fn': self.generate_fast_armor_auth_data, >+ # include the auth data in the FAST armor. >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ } >+ ]) >+ >+ def test_fast_ad_fx_fast_armor_ticket(self): >+ # If the authenticator or TGT authentication data contains the >+ # AD-fx-fast-armor authdata type, the KDC must reject the request >+ # (RFC6113 5.4.2). >+ self._run_test_sequence([ >+ # This request works. >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None >+ }, >+ # Add AD-fx-fast-armor authdata element to user TGT. This request >+ # fails. >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.gen_tgt_fast_armor_auth_data, >+ 'fast_armor': None >+ } >+ ]) >+ >+ def test_fast_ad_fx_fast_armor_ticket2(self): >+ self._run_test_sequence([ >+ # Show that we can still use the modified ticket as armor. >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.gen_tgt_fast_armor_auth_data >+ } >+ ]) >+ >+ def test_fast_tgs_service_ticket(self): >+ # Try to use a non-TGT ticket to establish an armor key, which fails >+ # (RFC6113 5.4.2). >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_NOT_US, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_service_ticket, # fails >+ 'fast_armor': None >+ } >+ ]) >+ >+ def test_fast_tgs_service_ticket_mach(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_NOT_US, # fails >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_mach_service_ticket, >+ 'fast_armor': None >+ } >+ ]) >+ >+ def test_simple_tgs_no_subkey(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': False, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'include_subkey': False >+ } >+ ]) >+ >+ def test_fast_tgs_no_subkey(self): >+ # Show that omitting the subkey in the TGS-REQ authenticator fails >+ # (RFC6113 5.4.2). >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None, >+ 'include_subkey': False >+ } >+ ]) >+ >+ def test_fast_hide_client_names(self): >+ user_creds = self.get_client_creds() >+ user_name = user_creds.get_username() >+ user_cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[user_name]) >+ >+ expected_cname = self.PrincipalName_create( >+ name_type=NT_WELLKNOWN, names=['WELLKNOWN', 'ANONYMOUS']) >+ >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'fast_options': '01', # hide client names >+ 'expected_cname': expected_cname >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'fast_options': '01', # hide client names >+ 'expected_cname': expected_cname, >+ 'expected_cname_private': user_cname >+ } >+ ]) >+ >+ def test_fast_tgs_hide_client_names(self): >+ user_creds = self.get_client_creds() >+ user_name = user_creds.get_username() >+ user_cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[user_name]) >+ >+ expected_cname = self.PrincipalName_create( >+ name_type=NT_WELLKNOWN, names=['WELLKNOWN', 'ANONYMOUS']) >+ >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None, >+ 'fast_options': '01', # hide client names >+ 'expected_cname': expected_cname, >+ 'expected_cname_private': user_cname >+ } >+ ]) >+ >+ def test_fast_encrypted_challenge_replay(self): >+ # The KDC is supposed to check that encrypted challenges are not >+ # replays (RFC6113 5.4.6), but timestamps may be reused; an encrypted >+ # challenge is only considered a replay if the ciphertext is identical >+ # to a previous challenge. Windows does not perform this check. >+ >+ class GenerateEncChallengePadataReplay: >+ def __init__(replay): >+ replay._padata = None >+ >+ def __call__(replay, key, armor_key): >+ if replay._padata is None: >+ client_challenge_key = ( >+ self.generate_client_challenge_key(armor_key, key)) >+ replay._padata = self.get_challenge_pa_data( >+ client_challenge_key) >+ >+ return replay._padata >+ >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': GenerateEncChallengePadataReplay(), >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'repeat': 2 >+ } >+ ]) >+ >+ def generate_enc_timestamp_padata(self, key, _armor_key): >+ return self.get_enc_timestamp_pa_data_from_key(key) >+ >+ def generate_enc_challenge_padata(self, key, armor_key, skew=0): >+ client_challenge_key = ( >+ self.generate_client_challenge_key(armor_key, key)) >+ return self.get_challenge_pa_data(client_challenge_key, skew=skew) >+ >+ def generate_enc_challenge_padata_wrong_key_kdc(self, key, armor_key): >+ kdc_challenge_key = ( >+ self.generate_kdc_challenge_key(armor_key, key)) >+ return self.get_challenge_pa_data(kdc_challenge_key) >+ >+ def generate_enc_challenge_padata_wrong_key(self, key, _armor_key): >+ return self.get_challenge_pa_data(key) >+ >+ def generate_empty_fast(self, >+ _kdc_exchange_dict, >+ _callback_dict, >+ _req_body, >+ _fast_padata, >+ _fast_armor, >+ _checksum, >+ _fast_options=''): >+ fast_padata = self.PA_DATA_create(PADATA_FX_FAST, b'') >+ >+ return fast_padata >+ >+ def _run_test_sequence(self, test_sequence): >+ if self.strict_checking: >+ self.check_kdc_fast_support() >+ >+ kdc_options_default = str(krb5_asn1.KDCOptions('forwardable,' >+ 'renewable,' >+ 'canonicalize,' >+ 'renewable-ok')) >+ >+ pac_request = self.get_pa_pac_request() >+ >+ client_creds = self.get_client_creds() >+ target_creds = self.get_service_creds() >+ krbtgt_creds = self.get_krbtgt_creds() >+ >+ client_username = client_creds.get_username() >+ client_realm = client_creds.get_realm() >+ client_cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[client_username]) >+ >+ krbtgt_username = krbtgt_creds.get_username() >+ krbtgt_realm = krbtgt_creds.get_realm() >+ krbtgt_sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=[krbtgt_username, krbtgt_realm]) >+ krbtgt_decryption_key = self.TicketDecryptionKey_from_creds( >+ krbtgt_creds) >+ >+ target_username = target_creds.get_username()[:-1] >+ target_realm = target_creds.get_realm() >+ target_service = 'host' >+ target_sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=[target_service, target_username]) >+ target_decryption_key = self.TicketDecryptionKey_from_creds( >+ target_creds, etype=kcrypto.Enctype.RC4) >+ >+ fast_cookie = None >+ preauth_etype_info2 = None >+ >+ preauth_key = None >+ >+ for kdc_dict in test_sequence: >+ rep_type = kdc_dict.pop('rep_type') >+ self.assertIn(rep_type, (KRB_AS_REP, KRB_TGS_REP)) >+ >+ expected_error_mode = kdc_dict.pop('expected_error_mode') >+ self.assertIn(expected_error_mode, range(240)) >+ >+ use_fast = kdc_dict.pop('use_fast') >+ self.assertIs(type(use_fast), bool) >+ >+ if use_fast: >+ self.assertIn('fast_armor', kdc_dict) >+ fast_armor_type = kdc_dict.pop('fast_armor') >+ >+ if fast_armor_type is not None: >+ self.assertIn('gen_armor_tgt_fn', kdc_dict) >+ elif expected_error_mode != KDC_ERR_GENERIC: >+ self.assertNotIn('gen_armor_tgt_fn', kdc_dict) >+ >+ gen_armor_tgt_fn = kdc_dict.pop('gen_armor_tgt_fn', None) >+ if gen_armor_tgt_fn is not None: >+ armor_tgt = gen_armor_tgt_fn() >+ else: >+ armor_tgt = None > >- x = self.PA_DATA_create(PADATA_FX_FAST, b'') >- padata = [x] >- rep = self.as_req(cname, sname, realm, etype, padata) >+ fast_options = kdc_dict.pop('fast_options', '') >+ else: >+ fast_armor_type = None >+ armor_tgt = None > >- self.assertIsNotNone(rep) >- self.assertEqual(rep['msg-type'], 30) >- self.assertEqual(rep['error-code'], 60) >+ self.assertNotIn('fast_options', kdc_dict) >+ fast_options = None > >- def test_fast_cookie_retured_in_pre_auth(self): >- '''Confirm that the kdc returns PA-FX-COOKIE >- ''' >+ if rep_type == KRB_TGS_REP: >+ gen_tgt_fn = kdc_dict.pop('gen_tgt_fn') >+ tgt = gen_tgt_fn() >+ else: >+ self.assertNotIn('gen_tgt_fn', kdc_dict) >+ tgt = None >+ >+ if expected_error_mode != 0: >+ check_error_fn = self.generic_check_kdc_error >+ check_rep_fn = None >+ else: >+ check_error_fn = None >+ check_rep_fn = self.generic_check_kdc_rep >+ >+ etypes = kdc_dict.pop('etypes', (AES256_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5)) >+ >+ cname = client_cname if rep_type == KRB_AS_REP else None >+ crealm = client_realm >+ >+ if rep_type == KRB_AS_REP: >+ sname = krbtgt_sname >+ srealm = krbtgt_realm >+ else: # KRB_TGS_REP >+ sname = target_sname >+ srealm = target_realm >+ >+ expected_cname = kdc_dict.pop('expected_cname', client_cname) >+ expected_cname_private = kdc_dict.pop('expected_cname_private', >+ None) >+ expected_crealm = kdc_dict.pop('expected_crealm', client_realm) >+ expected_sname = kdc_dict.pop('expected_sname', sname) >+ expected_srealm = kdc_dict.pop('expected_srealm', srealm) >+ >+ expected_salt = client_creds.get_salt() >+ >+ authenticator_subkey = self.RandomKey(kcrypto.Enctype.AES256) >+ if rep_type == KRB_AS_REP: >+ if use_fast: >+ armor_key = self.generate_armor_key(authenticator_subkey, >+ armor_tgt.session_key) >+ armor_subkey = authenticator_subkey >+ else: >+ armor_key = None >+ armor_subkey = authenticator_subkey >+ else: # KRB_TGS_REP >+ if fast_armor_type is not None: >+ armor_subkey = self.RandomKey(kcrypto.Enctype.AES256) >+ explicit_armor_key = self.generate_armor_key( >+ armor_subkey, >+ armor_tgt.session_key) >+ armor_key = kcrypto.cf2(explicit_armor_key.key, >+ authenticator_subkey.key, >+ b'explicitarmor', >+ b'tgsarmor') >+ armor_key = Krb5EncryptionKey(armor_key, None) >+ else: >+ armor_key = self.generate_armor_key(authenticator_subkey, >+ tgt.session_key) >+ armor_subkey = authenticator_subkey >+ >+ if not kdc_dict.pop('include_subkey', True): >+ authenticator_subkey = None >+ >+ if use_fast: >+ generate_fast_fn = kdc_dict.pop('gen_fast_fn', None) >+ if generate_fast_fn is None: >+ generate_fast_fn = functools.partial( >+ self.generate_simple_fast, >+ fast_options=fast_options) >+ else: >+ generate_fast_fn = None >+ >+ generate_fast_armor_fn = ( >+ self.generate_ap_req >+ if fast_armor_type is not None >+ else None) >+ >+ def _generate_padata_copy(_kdc_exchange_dict, >+ _callback_dict, >+ req_body, >+ padata): >+ return padata, req_body >+ >+ def _check_padata_preauth_key(_kdc_exchange_dict, >+ _callback_dict, >+ _rep, >+ _padata): >+ as_rep_usage = KU_AS_REP_ENC_PART >+ return preauth_key, as_rep_usage >+ >+ pac_options = kdc_dict.pop('pac_options', '1') # claims support >+ pac_options = self.get_pa_pac_options(pac_options) >+ >+ kdc_options = kdc_dict.pop('kdc_options', kdc_options_default) >+ >+ if rep_type == KRB_AS_REP: >+ padata = [pac_request, pac_options] >+ else: >+ padata = [pac_options] >+ >+ gen_padata_fn = kdc_dict.pop('gen_padata_fn', None) >+ if gen_padata_fn is not None: >+ self.assertEqual(KRB_AS_REP, rep_type) >+ self.assertIsNotNone(preauth_etype_info2) >+ >+ preauth_key = self.PasswordKey_from_etype_info2( >+ client_creds, >+ preauth_etype_info2[0], >+ client_creds.get_kvno()) >+ gen_padata = gen_padata_fn(preauth_key, armor_key) >+ padata.insert(0, gen_padata) >+ else: >+ preauth_key = None >+ >+ if rep_type == KRB_AS_REP: >+ check_padata_fn = _check_padata_preauth_key >+ else: >+ check_padata_fn = self.check_simple_tgs_padata >+ >+ if use_fast: >+ inner_padata = padata >+ outer_padata = [] >+ else: >+ inner_padata = [] >+ outer_padata = padata >+ >+ if use_fast and fast_cookie is not None: >+ outer_padata.append(fast_cookie) >+ >+ generate_fast_padata_fn = (functools.partial(_generate_padata_copy, >+ padata=inner_padata) >+ if inner_padata else None) >+ generate_padata_fn = (functools.partial(_generate_padata_copy, >+ padata=outer_padata) >+ if outer_padata else None) >+ >+ gen_authdata_fn = kdc_dict.pop('gen_authdata_fn', None) >+ if gen_authdata_fn is not None: >+ auth_data = [gen_authdata_fn()] >+ else: >+ auth_data = None >+ >+ if not use_fast: >+ self.assertNotIn('outer_req', kdc_dict) >+ outer_req = kdc_dict.pop('outer_req', None) >+ >+ if rep_type == KRB_AS_REP: >+ kdc_exchange_dict = self.as_exchange_dict( >+ expected_crealm=expected_crealm, >+ expected_cname=expected_cname, >+ expected_cname_private=expected_cname_private, >+ expected_srealm=expected_srealm, >+ expected_sname=expected_sname, >+ ticket_decryption_key=krbtgt_decryption_key, >+ generate_fast_fn=generate_fast_fn, >+ generate_fast_armor_fn=generate_fast_armor_fn, >+ generate_fast_padata_fn=generate_fast_padata_fn, >+ fast_armor_type=fast_armor_type, >+ generate_padata_fn=generate_padata_fn, >+ check_error_fn=check_error_fn, >+ check_rep_fn=check_rep_fn, >+ check_padata_fn=check_padata_fn, >+ check_kdc_private_fn=self.generic_check_kdc_private, >+ callback_dict={}, >+ expected_error_mode=expected_error_mode, >+ client_as_etypes=etypes, >+ expected_salt=expected_salt, >+ authenticator_subkey=authenticator_subkey, >+ auth_data=auth_data, >+ armor_key=armor_key, >+ armor_tgt=armor_tgt, >+ armor_subkey=armor_subkey, >+ kdc_options=kdc_options, >+ outer_req=outer_req) >+ else: # KRB_TGS_REP >+ kdc_exchange_dict = self.tgs_exchange_dict( >+ expected_crealm=expected_crealm, >+ expected_cname=expected_cname, >+ expected_cname_private=expected_cname_private, >+ expected_srealm=expected_srealm, >+ expected_sname=expected_sname, >+ ticket_decryption_key=target_decryption_key, >+ generate_fast_fn=generate_fast_fn, >+ generate_fast_armor_fn=generate_fast_armor_fn, >+ generate_fast_padata_fn=generate_fast_padata_fn, >+ fast_armor_type=fast_armor_type, >+ generate_padata_fn=generate_padata_fn, >+ check_error_fn=check_error_fn, >+ check_rep_fn=check_rep_fn, >+ check_padata_fn=check_padata_fn, >+ check_kdc_private_fn=self.generic_check_kdc_private, >+ expected_error_mode=expected_error_mode, >+ callback_dict={}, >+ tgt=tgt, >+ armor_key=armor_key, >+ armor_tgt=armor_tgt, >+ armor_subkey=armor_subkey, >+ authenticator_subkey=authenticator_subkey, >+ auth_data=auth_data, >+ body_checksum_type=None, >+ kdc_options=kdc_options, >+ outer_req=outer_req) >+ >+ repeat = kdc_dict.pop('repeat', 1) >+ for _ in range(repeat): >+ rep = self._generic_kdc_exchange(kdc_exchange_dict, >+ cname=cname, >+ realm=crealm, >+ sname=sname, >+ etypes=etypes) >+ if expected_error_mode == 0: >+ self.check_reply(rep, rep_type) >+ >+ fast_cookie = None >+ preauth_etype_info2 = None >+ else: >+ self.check_error_rep(rep, expected_error_mode) >+ >+ if 'fast_cookie' in kdc_exchange_dict: >+ fast_cookie = self.create_fast_cookie( >+ kdc_exchange_dict['fast_cookie']) >+ else: >+ fast_cookie = None >+ >+ if expected_error_mode == KDC_ERR_PREAUTH_REQUIRED: >+ preauth_etype_info2 = ( >+ kdc_exchange_dict['preauth_etype_info2']) >+ else: >+ preauth_etype_info2 = None >+ >+ # Ensure we used all the parameters given to us. >+ self.assertEqual({}, kdc_dict) >+ >+ def generate_fast_armor_auth_data(self): >+ auth_data = self.AuthorizationData_create(AD_FX_FAST_ARMOR, b'') >+ >+ return auth_data >+ >+ def generate_fast_used_auth_data(self): >+ auth_data = self.AuthorizationData_create(AD_FX_FAST_USED, b'') >+ >+ return auth_data >+ >+ def gen_tgt_fast_armor_auth_data(self): >+ user_tgt = self.get_user_tgt() >+ >+ ticket_decryption_key = user_tgt.decryption_key >+ >+ tgt_encpart = self.getElementValue(user_tgt.ticket, 'enc-part') >+ self.assertElementEqual(tgt_encpart, 'etype', >+ ticket_decryption_key.etype) >+ self.assertElementKVNO(tgt_encpart, 'kvno', >+ ticket_decryption_key.kvno) >+ tgt_cipher = self.getElementValue(tgt_encpart, 'cipher') >+ tgt_decpart = ticket_decryption_key.decrypt(KU_TICKET, tgt_cipher) >+ tgt_private = self.der_decode(tgt_decpart, >+ asn1Spec=krb5_asn1.EncTicketPart()) >+ >+ auth_data = self.generate_fast_armor_auth_data() >+ tgt_private['authorization-data'].append(auth_data) >+ >+ # Re-encrypt the user TGT. >+ tgt_private_new = self.der_encode( >+ tgt_private, >+ asn1Spec=krb5_asn1.EncTicketPart()) >+ tgt_encpart = self.EncryptedData_create(ticket_decryption_key, >+ KU_TICKET, >+ tgt_private_new) >+ user_ticket = user_tgt.ticket.copy() >+ user_ticket['enc-part'] = tgt_encpart >+ >+ user_tgt = KerberosTicketCreds( >+ user_ticket, >+ session_key=user_tgt.session_key, >+ crealm=user_tgt.crealm, >+ cname=user_tgt.cname, >+ srealm=user_tgt.srealm, >+ sname=user_tgt.sname, >+ decryption_key=user_tgt.decryption_key, >+ ticket_private=tgt_private, >+ encpart_private=user_tgt.encpart_private) >+ >+ # Use our modifed TGT to replace the one in the request. >+ return user_tgt >+ >+ def create_fast_cookie(self, cookie): >+ self.assertIsNotNone(cookie) >+ if self.strict_checking: >+ self.assertNotEqual(0, len(cookie)) >+ >+ return self.PA_DATA_create(PADATA_FX_COOKIE, cookie) >+ >+ def get_pa_pac_request(self, request_pac=True): >+ pac_request = self.KERB_PA_PAC_REQUEST_create(request_pac) >+ >+ return pac_request >+ >+ def get_pa_pac_options(self, options): >+ pac_options = self.PA_PAC_OPTIONS_create(options) >+ pac_options = self.der_encode(pac_options, >+ asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) >+ pac_options = self.PA_DATA_create(PADATA_PAC_OPTIONS, pac_options) >+ >+ return pac_options >+ >+ def check_kdc_fast_support(self): >+ # Check that the KDC supports FAST > >- # Create a user account for the test. >- # > samdb = self.get_samdb() >- user_name = "krb5fastusr" >- (uc, dn) = self.create_account(samdb, user_name) >- realm = uc.get_realm().lower() > >- # Do the initial AS-REQ, should get a pre-authentication required >- # response >+ krbtgt_rid = 502 >+ krbtgt_sid = '%s-%d' % (samdb.get_domain_sid(), krbtgt_rid) >+ >+ res = samdb.search(base='<SID=%s>' % krbtgt_sid, >+ scope=ldb.SCOPE_BASE, >+ attrs=['msDS-SupportedEncryptionTypes']) >+ >+ krbtgt_etypes = int(res[0]['msDS-SupportedEncryptionTypes'][0]) >+ >+ self.assertTrue( >+ security.KERB_ENCTYPE_FAST_SUPPORTED & krbtgt_etypes) >+ self.assertTrue( >+ security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED & krbtgt_etypes) >+ self.assertTrue( >+ security.KERB_ENCTYPE_CLAIMS_SUPPORTED & krbtgt_etypes) >+ >+ def get_service_ticket(self, tgt, target_creds, service='host'): > etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >- cname = self.PrincipalName_create( >- name_type=NT_PRINCIPAL, names=[user_name]) >- sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, names=["krbtgt", realm]) >- >- rep = self.as_req(cname, sname, realm, etype) >- self.assertIsNotNone(rep) >- self.assertEqual(rep['msg-type'], 30) >- self.assertEqual(rep['error-code'], 25) >- >- fx_fast = self.get_padata_element(rep, PADATA_FX_FAST) >- self.assertIsNotNone(fx_fast, "No PADATA_FX_FAST element") >- >- fx_cookie = self.get_padata_element(rep, PADATA_FX_COOKIE) >- self.assertIsNotNone(fx_cookie, "No PADATA_FX_COOKIE element") >- >- def test_ignore_fast(self): >- ''' >- TODO reword this >- Attempt to authenticate with out FAST, i.e. ignoring the >- FAST advertised in the pre-auth >- ''' >- >- # Create a user account for the test. >- # >- samdb = self.get_samdb() >- user_name = "krb5fastusr" >- (uc, dn) = self.create_account(samdb, user_name) >- realm = uc.get_realm().lower() > >- # Do the initial AS-REQ, should get a pre-authentication required >- # response >+ key = tgt.session_key >+ ticket = tgt.ticket >+ >+ cname = tgt.cname >+ realm = tgt.crealm >+ >+ target_name = target_creds.get_username()[:-1] >+ sname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[service, target_name]) >+ >+ rep, enc_part = self.tgs_req(cname, sname, realm, ticket, key, etype) >+ >+ service_ticket = rep['ticket'] >+ >+ ticket_etype = service_ticket['enc-part']['etype'] >+ target_key = self.TicketDecryptionKey_from_creds(target_creds, >+ etype=ticket_etype) >+ >+ session_key = self.EncryptionKey_import(enc_part['key']) >+ >+ service_ticket_creds = KerberosTicketCreds(service_ticket, >+ session_key, >+ crealm=realm, >+ cname=cname, >+ srealm=realm, >+ sname=sname, >+ decryption_key=target_key) >+ >+ return service_ticket_creds >+ >+ def get_tgt(self, creds): >+ user_name = creds.get_username() >+ realm = creds.get_realm() >+ >+ salt = creds.get_salt() >+ > etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >- cname = self.PrincipalName_create( >- name_type=NT_PRINCIPAL, names=[user_name]) >- sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, names=["krbtgt", realm]) >+ cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[user_name]) >+ sname = self.PrincipalName_create(name_type=NT_SRV_INST, >+ names=['krbtgt', realm]) > >- rep = self.as_req(cname, sname, realm, etype) >- self.assertIsNotNone(rep) >- self.assertEqual(rep['msg-type'], 30) >- self.assertEqual(rep['error-code'], 25) >+ till = self.get_KerberosTime(offset=36000) > >- fx_fast = self.get_padata_element(rep, PADATA_FX_FAST) >- self.assertIsNotNone(fx_fast, "No PADATA_FX_FAST element") >+ krbtgt_creds = self.get_krbtgt_creds() >+ ticket_decryption_key = ( >+ self.TicketDecryptionKey_from_creds(krbtgt_creds)) > >- fx_cookie = self.get_padata_element(rep, PADATA_FX_COOKIE) >- self.assertIsNotNone(fx_cookie, "No PADATA_FX_COOKIE element") >+ kdc_options = str(krb5_asn1.KDCOptions('forwardable,' >+ 'renewable,' >+ 'canonicalize,' >+ 'renewable-ok')) > >- # Do the next AS-REQ >- padata = [self.get_enc_timestamp_pa_data(uc, rep)] >- rep = self.as_req(cname, sname, realm, etype, padata=padata) >+ pac_request = self.get_pa_pac_request() >+ pac_options = self.get_pa_pac_options('1') # supports claims >+ >+ padata = [pac_request, pac_options] >+ >+ rep, kdc_exchange_dict = self._test_as_exchange( >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ till=till, >+ client_as_etypes=etype, >+ expected_error_mode=KDC_ERR_PREAUTH_REQUIRED, >+ expected_crealm=realm, >+ expected_cname=cname, >+ expected_srealm=realm, >+ expected_sname=sname, >+ expected_salt=salt, >+ etypes=etype, >+ padata=padata, >+ kdc_options=kdc_options, >+ preauth_key=None, >+ ticket_decryption_key=ticket_decryption_key) >+ self.check_pre_authentication(rep) >+ >+ etype_info2 = kdc_exchange_dict['preauth_etype_info2'] >+ >+ preauth_key = self.PasswordKey_from_etype_info2(creds, >+ etype_info2[0], >+ creds.get_kvno()) >+ >+ ts_enc_padata = self.get_enc_timestamp_pa_data(creds, rep) >+ >+ padata = [ts_enc_padata, pac_request, pac_options] >+ >+ expected_realm = realm.upper() >+ >+ expected_sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=['krbtgt', realm.upper()]) >+ >+ rep, kdc_exchange_dict = self._test_as_exchange( >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ till=till, >+ client_as_etypes=etype, >+ expected_error_mode=0, >+ expected_crealm=expected_realm, >+ expected_cname=cname, >+ expected_srealm=expected_realm, >+ expected_sname=expected_sname, >+ expected_salt=salt, >+ etypes=etype, >+ padata=padata, >+ kdc_options=kdc_options, >+ preauth_key=preauth_key, >+ ticket_decryption_key=ticket_decryption_key) > self.check_as_reply(rep) > >- def test_fast(self): >- ''' >- Attempt to authenticate with >- ''' >+ tgt = rep['ticket'] > >- # Create a user account for the test. >- # >- samdb = self.get_samdb() >- user_name = "krb5fastusr" >- (uc, dn) = self.create_account(samdb, user_name) >- realm = uc.get_realm().lower() >+ enc_part = self.get_as_rep_enc_data(preauth_key, rep) >+ session_key = self.EncryptionKey_import(enc_part['key']) > >- # Do the initial AS-REQ, should get a pre-authentication required >- # response >- etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >- cname = self.PrincipalName_create( >- name_type=NT_PRINCIPAL, names=[user_name]) >- sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, names=["krbtgt", realm]) >- >- rep = self.as_req(cname, sname, realm, etype) >- self.assertIsNotNone(rep) >- self.assertEqual(rep['msg-type'], 30) >- self.assertEqual(rep['error-code'], 25) >- >- fx_fast = self.get_padata_element(rep, PADATA_FX_FAST) >- self.assertIsNotNone(fx_fast, "No PADATA_FX_FAST element") >- >- fx_cookie = self.get_padata_element(rep, PADATA_FX_COOKIE) >- self.assertIsNotNone(fx_cookie, "No PADATA_FX_COOKIE element") >- >- cookie = self.PA_DATA_create(PADATA_FX_COOKIE, fx_cookie) >- >- # Do the next AS-REQ >- padata = [self.get_enc_timestamp_pa_data(uc, rep)] >- padata.append(cookie) >- # req = self.AS_REQ_create(padata=padata, >- # kdc_options=str(kdc_options), >- # cname=cname, >- # realm=realm, >- # sname=sname, >- # from_time=None, >- # till_time=till, >- # renew_time=None, >- # nonce=0x7fffffff, >- # etypes=etypes, >- # addresses=None, >- # EncAuthorizationData=None, >- # EncAuthorizationData_key=None, >- # additional_tickets=None) >- # rep = self.as_req(cname, sname, realm, etype, padata=padata) >- # self.check_as_reply(rep) >+ ticket_creds = KerberosTicketCreds( >+ tgt, >+ session_key, >+ crealm=realm, >+ cname=cname, >+ srealm=realm, >+ sname=sname, >+ decryption_key=ticket_decryption_key) >+ >+ return ticket_creds, enc_part >+ >+ def get_mach_tgt(self): >+ if self.mach_tgt is None: >+ mach_creds = self.get_mach_creds() >+ type(self).mach_tgt, type(self).mach_enc_part = ( >+ self.get_tgt(mach_creds)) >+ >+ return self.mach_tgt >+ >+ def get_user_tgt(self): >+ if self.user_tgt is None: >+ user_creds = self.get_client_creds() >+ type(self).user_tgt, type(self).user_enc_part = ( >+ self.get_tgt(user_creds)) >+ >+ return self.user_tgt >+ >+ def get_user_service_ticket(self): >+ if self.user_service_ticket is None: >+ user_tgt = self.get_user_tgt() >+ service_creds = self.get_service_creds() >+ type(self).user_service_ticket = ( >+ self.get_service_ticket(user_tgt, service_creds)) >+ >+ return self.user_service_ticket >+ >+ def get_mach_service_ticket(self): >+ if self.mach_service_ticket is None: >+ mach_tgt = self.get_mach_tgt() >+ service_creds = self.get_service_creds() >+ type(self).mach_service_ticket = ( >+ self.get_service_ticket(mach_tgt, service_creds)) >+ >+ return self.mach_service_ticket > > > if __name__ == "__main__": >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 66f07cebc14..02a3db1a3cd 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -15,10 +15,52 @@ > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_c > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_6_c > # >-# MIT specific FAST tests, >+# FAST tests > # >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_explicit_PA_FX_FAST_in_as_req\(ad_dc\) >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast\(ad_dc\) >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_cookie_retured_in_pre_auth\(ad_dc\) >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_supported\(ad_dc\) >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_ignore_fast\(ad_dc\) >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_empty_fast.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor2.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor_ticket.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor_ticket2.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_authdata_fast_not_used.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_authdata_fast_used.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_enc_timestamp.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_clock_skew.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_replay.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_wrong_key.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_wrong_key_kdc.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_hide_client_names.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_armor_type.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_armor_type2.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_tgt.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_tgt_mach.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_canon.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_claims.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_claims_or_canon.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_flags.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_nonce.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_realm.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_till.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_armor.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_hide_client_names.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_claims.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_etypes.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_subkey.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_flags.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_nonce.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_realm.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_till.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_service_ticket.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_service_ticket_mach.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_unknown_critical_option.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_fast_no_etypes.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_etypes.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_subkey.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_service_ticket.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_service_ticket_mach.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_wrong_principal.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_unarmored_as_req.ad_dc >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index fffa5c3cd7e..0e302343111 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -647,3 +647,56 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > # > # fl2000dc doesn't support AES > ^samba4.krb5.kdc.*as-req-aes.*fl2000dc >+# >+# FAST tests >+# >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_empty_fast.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor2.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor_ticket.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor_ticket2.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_authdata_fast_not_used.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_authdata_fast_used.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_enc_timestamp.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_clock_skew.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_replay.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_wrong_key.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_wrong_key_kdc.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_hide_client_names.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_armor_type.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_armor_type2.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_tgt.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_tgt_mach.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_canon.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_claims.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_claims_or_canon.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_flags.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_nonce.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_realm.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_till.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_armor.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_hide_client_names.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_canon.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_claims.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_claims_or_canon.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_etypes.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_subkey.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_flags.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_nonce.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_realm.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_till.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_service_ticket.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_service_ticket_mach.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_unknown_critical_option.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_fast_no_etypes.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_etypes.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_subkey.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_service_ticket.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_service_ticket_mach.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_wrong_principal.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_unarmored_as_req.ad_dc >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index d091eaaecf9..4de8f84f72e 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -1332,7 +1332,7 @@ planpythontestsuite( > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', >- 'SERVICE_USERNAME': '$SERVER' >+ 'STRICT_CHECKING': '0', > }) > planpythontestsuite( > "ad_dc", >-- >2.25.1 > > >From bd129ab664d4d68d6e1e67fa96a1620ff3a49a49 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 7 Sep 2021 17:23:32 +1200 >Subject: [PATCH 197/380] selftest: Remove knownfail for no_etypes FAST tests > >These test pass because b3ee034b4d457607ef25a5b01da64e1eaf5906dd >(s4:kdc: prefer newer enctypes for preauth responses) is not included >in the 4.13 backport. > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >--- > selftest/knownfail_heimdal_kdc | 3 --- > 1 file changed, 3 deletions(-) > >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 02a3db1a3cd..9a61f476469 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -47,7 +47,6 @@ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_armor.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_hide_client_names.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_claims.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_etypes.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_subkey.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_flags.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_nonce.ad_dc >@@ -56,9 +55,7 @@ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_service_ticket.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_service_ticket_mach.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_unknown_critical_option.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_fast_no_etypes.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_etypes.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_subkey.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_service_ticket.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_service_ticket_mach.ad_dc >-- >2.25.1 > > >From c1389f0e25daf838331fcc19e1f8dd0e02933a64 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 27 Aug 2021 13:35:59 +1200 >Subject: [PATCH 198/380] tests/krb5: Make e-data checking less strict > >Without this additional 'self.strict_checking' check, the tests in the >following patches do not get far enough to trigger a crash with the MIT >KDC, instead failing when obtaining a TGT for the user or machine. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> > >[abartlet@samba.org Backported from commit > 79dda329f2a8382f1e46b50f4b9692e78d687826 as knownfail needed splitting > into only failing in the Heimdal case due likely because > b3ee034b4d457607ef25a5b01da64e1eaf5906dd > (s4:kdc: prefer newer enctypes for preauth responses) is not included > in the 4.14 backport. ] >--- > python/samba/tests/krb5/raw_testcase.py | 5 +- > .../knownfail.d/samba.tests.krb5.as_req_tests | 54 --- > selftest/knownfail_heimdal_kdc | 57 +++ > selftest/knownfail_mit_kdc | 341 ------------------ > 4 files changed, 60 insertions(+), 397 deletions(-) > delete mode 100644 selftest/knownfail.d/samba.tests.krb5.as_req_tests > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 17ef8df5daa..22f64f25f14 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2504,8 +2504,9 @@ class RawKerberosTest(TestCaseInTempDir): > if self.strict_checking: > self.assertIsNone(enc_challenge) > if not sent_enc_challenge: >- self.assertIsNotNone(pk_as_req) >- self.assertIsNotNone(pk_as_rep19) >+ if self.strict_checking: >+ self.assertIsNotNone(pk_as_req) >+ self.assertIsNotNone(pk_as_rep19) > else: > self.assertIsNone(pk_as_req) > self.assertIsNone(pk_as_rep19) >diff --git a/selftest/knownfail.d/samba.tests.krb5.as_req_tests b/selftest/knownfail.d/samba.tests.krb5.as_req_tests >deleted file mode 100644 >index 35375dfcc8e..00000000000 >--- a/selftest/knownfail.d/samba.tests.krb5.as_req_tests >+++ /dev/null >@@ -1,54 +0,0 @@ >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2008r2dc >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 9a61f476469..6a36640233e 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -15,6 +15,63 @@ > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_c > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_6_c > # >+# Heimdal (not MIT) still fails these after 'Make e-data checking less strict' >+# >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2008r2dc >+# > # FAST tests > # > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_empty_fast.ad_dc >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 0e302343111..025504c1268 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -291,356 +291,15 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_c > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_6_c > # >-# MIT currently fails the test_as_req_enc_timestamp test. >-# >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_enc_timestamp.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_enc_timestamp.fl2008r2dc >-# > # MIT currently fails some as_req_no_preauth tests. > # > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_False >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_dummy_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_aes256_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_dummy_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_dummy_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_dummy_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_aes128_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes256_rc4_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_pac_True.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128.fl2003dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_pac_True.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_False.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_False.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_None.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_None.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_True.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_pac_True.fl2008r2dc > # Differences in our KDC compared to windows > # > ^samba4.krb5.kdc .*.as-req-pac-request # We should reply to a request for a PAC over UDP with KRB5KRB_ERR_RESPONSE_TOO_BIG unconditionally >-- >2.25.1 > > >From 61576e53a9439704f77efdbf155adfb670cd9e3f Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 14:43:53 +1200 >Subject: [PATCH 199/380] tests/krb5: Make cname checking less strict > >Without this additional 'self.strict_checking' check, the tests in the >following patches do not get far enough to trigger a crash with the MIT >KDC. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 >[abartlet@samba.org backported from commit > 36798f5b651a02b74b6844c024101f7a026f1f68 as Samba 4.14 is tested > on MIT 1.16 and so the knownfails need to match this version] >--- > python/samba/tests/krb5/raw_testcase.py | 5 ++-- > selftest/knownfail_mit_kdc | 35 ------------------------- > 2 files changed, 3 insertions(+), 37 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 22f64f25f14..32de51c2da4 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2043,8 +2043,9 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_session_key = self.EncryptionKey_import(ticket_key) > self.assertElementEqualUTF8(ticket_private, 'crealm', > expected_crealm) >- self.assertElementEqualPrincipal(ticket_private, 'cname', >- expected_cname) >+ if self.strict_checking: >+ self.assertElementEqualPrincipal(ticket_private, 'cname', >+ expected_cname) > self.assertElementPresent(ticket_private, 'transited') > self.assertElementPresent(ticket_private, 'authtime') > if self.strict_checking: >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 025504c1268..d2114136ddb 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -309,53 +309,18 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > # > # FAST tests > # >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_empty_fast.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor2.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor_ticket.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_ad_fx_fast_armor_ticket2.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_authdata_fast_not_used.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_authdata_fast_used.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_enc_timestamp.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_clock_skew.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_replay.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_wrong_key.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_wrong_key_kdc.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_hide_client_names.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_armor_type.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_armor_type2.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_tgt.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_tgt_mach.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_canon.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_claims.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_claims_or_canon.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_flags.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_nonce.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_realm.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_wrong_till.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_armor.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_hide_client_names.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_canon.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_claims.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_claims_or_canon.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_etypes.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_subkey.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_flags.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_nonce.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_realm.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_wrong_till.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_service_ticket.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_service_ticket_mach.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_unknown_critical_option.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_fast_no_etypes.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_etypes.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_subkey.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_service_ticket.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_service_ticket_mach.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_wrong_principal.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_unarmored_as_req.ad_dc >-- >2.25.1 > > >From c7bedb6cee3e4bed206877b910ed30f9048948c2 Mon Sep 17 00:00:00 2001 >From: Luke Howard <lukeh@padl.com> >Date: Fri, 27 Aug 2021 11:42:48 +1000 >Subject: [PATCH 200/380] CVE-2021-3671 HEIMDAL kdc: validate sname in TGS-REQ > >In tgs_build_reply(), validate the server name in the TGS-REQ is present before >dereferencing. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >[abartlet@samba.org backported from from Heimdal >commit 04171147948d0a3636bc6374181926f0fb2ec83a via reference >to an earlier patch by Joseph Sutton] > >RN: An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ > >Reviewed-by: Andreas Schneider <asn@samba.org> >(cherry picked from commit 0cb4b939f192376bf5e33637863a91a20f74c5a5) >--- > source4/heimdal/kdc/krb5tgs.c | 4 ++++ > 1 file changed, 4 insertions(+) > >diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c >index efbdd6ed77f..ef337ea4faf 100644 >--- a/source4/heimdal/kdc/krb5tgs.c >+++ b/source4/heimdal/kdc/krb5tgs.c >@@ -1603,6 +1603,10 @@ tgs_build_reply(krb5_context context, > > s = &adtkt.cname; > r = adtkt.crealm; >+ } else if (s == NULL) { >+ ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; >+ krb5_set_error_message(context, ret, "No server in request"); >+ goto out; > } > > _krb5_principalname2krb5_principal(context, &sp, *s, r); >-- >2.25.1 > > >From 4179ff720f9d9a0c3ea66d3f1f3eda7d6ad76ff5 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 29 Jul 2021 12:25:06 +1200 >Subject: [PATCH 201/380] CVE-2021-3671 tests/krb5: Add tests for omitting > sname in outer request > >Note: Without the previous patch, 'test_fast_tgs_outer_no_sname' would >crash the Heimdal KDC. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >(cherry picked from commit b8e2515552ffa158fab1e86a39004de4cc419da5) >--- > python/samba/tests/krb5/fast_tests.py | 39 +++++++++++++++++++++++++++ > selftest/knownfail_heimdal_kdc | 2 ++ > selftest/knownfail_mit_kdc | 2 ++ > 3 files changed, 43 insertions(+) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index e38b2e0a6e1..5189411e94f 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -655,6 +655,45 @@ class FAST_Tests(KDCBaseTest): > } > ]) > >+ def test_fast_outer_no_sname(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'outer_req': { >+ 'sname': None # should be ignored >+ } >+ }, >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_padata_fn': self.generate_enc_challenge_padata, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'outer_req': { >+ 'sname': None # should be ignored >+ } >+ } >+ ]) >+ >+ def test_fast_tgs_outer_no_sname(self): >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': 0, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None, >+ 'outer_req': { >+ 'sname': None # should be ignored >+ } >+ } >+ ]) >+ > def test_fast_outer_wrong_till(self): > self._run_test_sequence([ > { >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 6a36640233e..4a4e98f6727 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -118,3 +118,5 @@ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_service_ticket_mach.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_wrong_principal.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_unarmored_as_req.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_no_sname.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_no_sname.ad_dc >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index d2114136ddb..41142defe6c 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -324,3 +324,5 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_service_ticket.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_service_ticket_mach.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_unarmored_as_req.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_no_sname.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_no_sname.ad_dc >-- >2.25.1 > > >From 24c87d4e30019828bffd92fe978b4c2ad123512a Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Wed, 1 Sep 2021 10:43:06 +1200 >Subject: [PATCH 202/380] tests/krb5: Remove harmful and a-typical return in > as_req testcase > >A test in a TestCase class should not return a value, the >test is determined by the assertions raised. > >Other changes will shortly cause kdc_exchange_dict[preauth_etype_info2] >to not always be filled, so we need to remove this >rudundent code. > >This also fixes a *lot* of tests against the MIT KDC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >(cherry picked from commit 3330eaf39c6174f2d90fe4d8e016efb97005d1e5) >--- > python/samba/tests/krb5/as_req_tests.py | 14 ++++++-------- > selftest/knownfail_mit_kdc | 10 ---------- > 2 files changed, 6 insertions(+), 18 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index fd258e8164a..82ff3f4845c 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -106,13 +106,11 @@ class AsReqKerberosTests(KDCBaseTest): > expected_salt=expected_salt, > kdc_options=str(initial_kdc_options)) > >- rep = self._generic_kdc_exchange(kdc_exchange_dict, >- cname=cname, >- realm=realm, >- sname=sname, >- etypes=initial_etypes) >- >- return kdc_exchange_dict['preauth_etype_info2'] >+ self._generic_kdc_exchange(kdc_exchange_dict, >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ etypes=initial_etypes) > > def _test_as_req_no_preauth_with_args(self, etype_idx, pac): > name, etypes = self.etype_test_permutation_by_idx(etype_idx) >@@ -121,7 +119,7 @@ class AsReqKerberosTests(KDCBaseTest): > else: > pa_pac = self.KERB_PA_PAC_REQUEST_create(pac) > padata = [pa_pac] >- return self._test_as_req_nopreauth( >+ self._test_as_req_nopreauth( > initial_padata=padata, > initial_etypes=etypes, > initial_kdc_options=krb5_asn1.KDCOptions('forwardable')) >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 41142defe6c..59db6e80c09 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -290,16 +290,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_b > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_c > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_6_c >-# >-# MIT currently fails some as_req_no_preauth tests. >-# >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_aes256.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes128_rc4.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_aes256_aes128_rc4.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4.fl2008r2dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128.fl2003dc >-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128.fl2008r2dc > # Differences in our KDC compared to windows > # > ^samba4.krb5.kdc .*.as-req-pac-request # We should reply to a request for a PAC over UDP with KRB5KRB_ERR_RESPONSE_TOO_BIG unconditionally >-- >2.25.1 > > >From 20a4545df62df7439aa6864cf45641172a638cad Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 27 Aug 2021 13:00:21 +1200 >Subject: [PATCH 203/380] tests/krb5: Check e-data element for TGS-REP errors > without FAST > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >(cherry picked from commit e373c6461a88c44303ea8cdbebc2d78dd15dec4a) >--- > python/samba/tests/krb5/raw_testcase.py | 52 ++++++++++++-------- > python/samba/tests/krb5/rfc4120_constants.py | 2 + > 2 files changed, 34 insertions(+), 20 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 32de51c2da4..ba6d07ce465 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -82,6 +82,7 @@ from samba.tests.krb5.rfc4120_constants import ( > PADATA_PAC_REQUEST, > PADATA_PK_AS_REQ, > PADATA_PK_AS_REP_19, >+ PADATA_PW_SALT, > PADATA_SUPPORTED_ETYPES > ) > import samba.tests.krb5.kcrypto as kcrypto >@@ -2187,8 +2188,7 @@ class RawKerberosTest(TestCaseInTempDir): > else: > self.assertElementEqualPrincipal(rep, 'sname', expected_sname) > self.assertElementMissing(rep, 'e-text') >- if (expected_error_mode in (KDC_ERR_GENERIC, >- KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS) >+ if (expected_error_mode == KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS > or (rep_msg_type == KRB_TGS_REP > and not sent_fast) > or (sent_fast and fast_armor_type is not None >@@ -2198,10 +2198,17 @@ class RawKerberosTest(TestCaseInTempDir): > return rep > edata = self.getElementValue(rep, 'e-data') > if self.strict_checking: >- self.assertIsNotNone(edata) >+ if expected_error_mode != KDC_ERR_GENERIC: >+ # Predicting whether an ERR_GENERIC error contains e-data is >+ # more complicated. >+ self.assertIsNotNone(edata) > if edata is not None: >- rep_padata = self.der_decode(edata, >- asn1Spec=krb5_asn1.METHOD_DATA()) >+ if rep_msg_type == KRB_TGS_REP and not sent_fast: >+ rep_padata = [self.der_decode(edata, >+ asn1Spec=krb5_asn1.PA_DATA())] >+ else: >+ rep_padata = self.der_decode(edata, >+ asn1Spec=krb5_asn1.METHOD_DATA()) > self.assertGreater(len(rep_padata), 0) > > if sent_fast: >@@ -2218,15 +2225,13 @@ class RawKerberosTest(TestCaseInTempDir): > expect_strengthen_key=False) > > rep_padata = fast_response['padata'] >- else: >- rep_padata = [] > >- etype_info2 = self.check_rep_padata(kdc_exchange_dict, >- callback_dict, >- rep, >- rep_padata) >+ etype_info2 = self.check_rep_padata(kdc_exchange_dict, >+ callback_dict, >+ rep, >+ rep_padata) > >- kdc_exchange_dict['preauth_etype_info2'] = etype_info2 >+ kdc_exchange_dict['preauth_etype_info2'] = etype_info2 > > return rep > >@@ -2279,10 +2284,13 @@ class RawKerberosTest(TestCaseInTempDir): > expected_patypes += (PADATA_FX_COOKIE,) > > if rep_msg_type == KRB_TGS_REP: >- sent_claims = self.sent_claims(kdc_exchange_dict) >- if sent_claims and expected_error_mode != 0: >- expected_patypes += (PADATA_PAC_OPTIONS,) >- else: >+ if not sent_fast and expected_error_mode != 0: >+ expected_patypes += (PADATA_PW_SALT,) >+ else: >+ sent_claims = self.sent_claims(kdc_exchange_dict) >+ if sent_claims and expected_error_mode not in (0, KDC_ERR_GENERIC): >+ expected_patypes += (PADATA_PAC_OPTIONS,) >+ elif expected_error_mode != KDC_ERR_GENERIC: > if expect_etype_info: > self.assertGreater(len(expect_etype_info2), 0) > expected_patypes += (PADATA_ETYPE_INFO,) >@@ -2458,8 +2466,11 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNone(pk_as_rep19) > return None > >- if self.strict_checking: >- self.assertIsNotNone(etype_info2) >+ if expected_error_mode != KDC_ERR_GENERIC: >+ if self.strict_checking: >+ self.assertIsNotNone(etype_info2) >+ else: >+ self.assertIsNone(etype_info2) > if expect_etype_info: > self.assertIsNotNone(etype_info) > else: >@@ -2468,7 +2479,7 @@ class RawKerberosTest(TestCaseInTempDir): > if unexpect_etype_info: > self.assertIsNone(etype_info) > >- if self.strict_checking: >+ if expected_error_mode != KDC_ERR_GENERIC and self.strict_checking: > self.assertGreaterEqual(len(etype_info2), 1) > self.assertEqual(len(etype_info2), len(expect_etype_info2)) > for i in range(0, len(etype_info2)): >@@ -2495,7 +2506,8 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(salt) > self.assertEqual(len(salt), 0) > >- if expected_error_mode != KDC_ERR_PREAUTH_FAILED: >+ if expected_error_mode not in (KDC_ERR_PREAUTH_FAILED, >+ KDC_ERR_GENERIC): > if sent_fast: > self.assertIsNotNone(enc_challenge) > if self.strict_checking: >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index e1a688991a7..c70ce309b95 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -60,6 +60,8 @@ PADATA_PK_AS_REQ = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-PK-AS-REQ')) > PADATA_PK_AS_REP_19 = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-PK-AS-REP-19')) >+PADATA_PW_SALT = int( >+ krb5_asn1.PADataTypeValues('kRB5-PADATA-PW-SALT')) > PADATA_SUPPORTED_ETYPES = int( > krb5_asn1.PADataTypeValues('kRB5-PADATA-SUPPORTED-ETYPES')) > >-- >2.25.1 > > >From 21f1a7c40181daa7cfa9fdbe815ed62d4fb8d101 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 27 Aug 2021 13:00:37 +1200 >Subject: [PATCH 204/380] tests/krb5: Check PADATA-PW-SALT element in e-data > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >(cherry picked from commit 1e4d757394a0bbda587d5ff91801f88539b712b1) >--- > python/samba/tests/krb5/raw_testcase.py | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index ba6d07ce465..4e7891ae89a 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2328,6 +2328,7 @@ class RawKerberosTest(TestCaseInTempDir): > fast_error = None > fx_fast = None > pac_options = None >+ pw_salt = None > for pa in rep_padata: > patype = self.getElementValue(pa, 'padata-type') > pavalue = self.getElementValue(pa, 'padata-value') >@@ -2380,6 +2381,11 @@ class RawKerberosTest(TestCaseInTempDir): > pac_options = pavalue > self.assertIsNotNone(pac_options) > continue >+ if patype == PADATA_PW_SALT: >+ self.assertIsNone(pw_salt) >+ pw_salt = pavalue >+ self.assertIsNotNone(pw_salt) >+ continue > > if fast_cookie is not None: > kdc_exchange_dict['fast_cookie'] = fast_cookie >@@ -2395,6 +2401,14 @@ class RawKerberosTest(TestCaseInTempDir): > if pac_options is not None: > self.check_pac_options_claims_support(pac_options) > >+ if pw_salt is not None: >+ self.assertEqual(12, len(pw_salt)) >+ >+ status = int.from_bytes(pw_salt[:4], 'little') >+ flags = int.from_bytes(pw_salt[8:], 'little') >+ >+ self.assertEqual(3, flags) >+ > if enc_challenge is not None: > if not sent_enc_challenge: > self.assertEqual(len(enc_challenge), 0) >-- >2.25.1 > > >From 5d235a3ed53892eedf413e105d93d7474416a968 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 27 Aug 2021 13:02:04 +1200 >Subject: [PATCH 205/380] tests/krb5: Add tests for omitting sname in request > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >(cherry picked from commit bbbb13caf7bd2440c80f4f4775725b7863d16a5b) >--- > python/samba/tests/krb5/fast_tests.py | 83 ++++++++++++++++++++++++++- > selftest/knownfail_heimdal_kdc | 3 + > selftest/knownfail_mit_kdc | 4 ++ > 3 files changed, 88 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 5189411e94f..e0fd3cc4d5e 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -105,6 +105,79 @@ class FAST_Tests(KDCBaseTest): > } > ]) > >+ def test_simple_no_sname(self): >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_username = krbtgt_creds.get_username() >+ krbtgt_realm = krbtgt_creds.get_realm() >+ expected_sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=[krbtgt_username, krbtgt_realm]) >+ >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ 'use_fast': False, >+ 'sname': None, >+ 'expected_sname': expected_sname >+ } >+ ]) >+ >+ def test_simple_tgs_no_sname(self): >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_username = krbtgt_creds.get_username() >+ krbtgt_realm = krbtgt_creds.get_realm() >+ expected_sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=[krbtgt_username, krbtgt_realm]) >+ >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ 'use_fast': False, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'sname': None, >+ 'expected_sname': expected_sname >+ } >+ ]) >+ >+ def test_fast_no_sname(self): >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_username = krbtgt_creds.get_username() >+ krbtgt_realm = krbtgt_creds.get_realm() >+ expected_sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=[krbtgt_username, krbtgt_realm]) >+ >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_AS_REP, >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ 'use_fast': True, >+ 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'sname': None, >+ 'expected_sname': expected_sname >+ } >+ ]) >+ >+ def test_fast_tgs_no_sname(self): >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_username = krbtgt_creds.get_username() >+ krbtgt_realm = krbtgt_creds.get_realm() >+ expected_sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=[krbtgt_username, krbtgt_realm]) >+ >+ self._run_test_sequence([ >+ { >+ 'rep_type': KRB_TGS_REP, >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ 'use_fast': True, >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'fast_armor': None, >+ 'sname': None, >+ 'expected_sname': expected_sname >+ } >+ ]) >+ > def test_simple_tgs_wrong_principal(self): > mach_creds = self.get_mach_creds() > mach_name = mach_creds.get_username() >@@ -1122,11 +1195,17 @@ class FAST_Tests(KDCBaseTest): > cname = client_cname if rep_type == KRB_AS_REP else None > crealm = client_realm > >+ if 'sname' in kdc_dict: >+ sname = kdc_dict.pop('sname') >+ else: >+ if rep_type == KRB_AS_REP: >+ sname = krbtgt_sname >+ else: # KRB_TGS_REP >+ sname = target_sname >+ > if rep_type == KRB_AS_REP: >- sname = krbtgt_sname > srealm = krbtgt_realm > else: # KRB_TGS_REP >- sname = target_sname > srealm = target_realm > > expected_cname = kdc_dict.pop('expected_cname', client_cname) >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 4a4e98f6727..b0981a06002 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -120,3 +120,6 @@ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_unarmored_as_req.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_no_sname.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_sname.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_sname.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_sname.ad_dc >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 59db6e80c09..f167c2bf856 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -316,3 +316,7 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_unarmored_as_req.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_no_sname.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_sname.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_sname.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_no_sname.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_sname.ad_dc >-- >2.25.1 > > >From 1f7316f1286b21571ad98f16f7af8c5550d9d5f4 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 27 Aug 2021 13:26:45 +1200 >Subject: [PATCH 206/380] tests/krb5: Allow specifying parameters specific to > the inner FAST request body > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >(cherry picked from commit c6d7e19ecfb264c6f79df5a20e830e4ea6fdb340) >--- > python/samba/tests/krb5/fast_tests.py | 4 ++++ > python/samba/tests/krb5/raw_testcase.py | 13 +++++++++++++ > 2 files changed, 17 insertions(+) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index e0fd3cc4d5e..551790a3e42 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1325,7 +1325,9 @@ class FAST_Tests(KDCBaseTest): > auth_data = None > > if not use_fast: >+ self.assertNotIn('inner_req', kdc_dict) > self.assertNotIn('outer_req', kdc_dict) >+ inner_req = kdc_dict.pop('inner_req', None) > outer_req = kdc_dict.pop('outer_req', None) > > if rep_type == KRB_AS_REP: >@@ -1355,6 +1357,7 @@ class FAST_Tests(KDCBaseTest): > armor_tgt=armor_tgt, > armor_subkey=armor_subkey, > kdc_options=kdc_options, >+ inner_req=inner_req, > outer_req=outer_req) > else: # KRB_TGS_REP > kdc_exchange_dict = self.tgs_exchange_dict( >@@ -1383,6 +1386,7 @@ class FAST_Tests(KDCBaseTest): > auth_data=auth_data, > body_checksum_type=None, > kdc_options=kdc_options, >+ inner_req=inner_req, > outer_req=outer_req) > > repeat = kdc_dict.pop('repeat', 1) >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 4e7891ae89a..15873d69fa6 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1553,6 +1553,9 @@ class RawKerberosTest(TestCaseInTempDir): > expected_error_mode = kdc_exchange_dict['expected_error_mode'] > kdc_options = kdc_exchange_dict['kdc_options'] > >+ # Parameters specific to the inner request body >+ inner_req = kdc_exchange_dict['inner_req'] >+ > # Parameters specific to the outer request body > outer_req = kdc_exchange_dict['outer_req'] > >@@ -1582,6 +1585,12 @@ class RawKerberosTest(TestCaseInTempDir): > EncAuthorizationData_usage=EncAuthorizationData_usage) > > inner_req_body = dict(req_body) >+ if inner_req is not None: >+ for key, value in inner_req.items(): >+ if value is not None: >+ inner_req_body[key] = value >+ else: >+ del inner_req_body[key] > if outer_req is not None: > for key, value in outer_req.items(): > if value is not None: >@@ -1734,6 +1743,7 @@ class RawKerberosTest(TestCaseInTempDir): > armor_subkey=None, > auth_data=None, > kdc_options='', >+ inner_req=None, > outer_req=None): > kdc_exchange_dict = { > 'req_msg_type': KRB_AS_REQ, >@@ -1765,6 +1775,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'armor_subkey': armor_subkey, > 'auth_data': auth_data, > 'kdc_options': kdc_options, >+ 'inner_req': inner_req, > 'outer_req': outer_req > } > if expected_cname_private is not None: >@@ -1802,6 +1813,7 @@ class RawKerberosTest(TestCaseInTempDir): > auth_data=None, > body_checksum_type=None, > kdc_options='', >+ inner_req=None, > outer_req=None): > kdc_exchange_dict = { > 'req_msg_type': KRB_TGS_REQ, >@@ -1833,6 +1845,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'auth_data': auth_data, > 'authenticator_subkey': authenticator_subkey, > 'kdc_options': kdc_options, >+ 'inner_req': inner_req, > 'outer_req': outer_req > } > if expected_cname_private is not None: >-- >2.25.1 > > >From cef685068460d2b8d6cef42bcab8692c28d86ac6 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 31 Aug 2021 19:42:33 +1200 >Subject: [PATCH 207/380] tests/krb5: Allow expected_error_mode to be a > container type > >This allows a range of possible error codes to be checked against, for >cases when the particular error code returned is not so important. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >(cherry picked from commit ebd673e976aea5dd481a75f180fd526995c4fda0) >--- > python/samba/tests/krb5/raw_testcase.py | 56 +++++++++++++++---------- > 1 file changed, 35 insertions(+), 21 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 15873d69fa6..6db17f2a118 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1702,11 +1702,12 @@ class RawKerberosTest(TestCaseInTempDir): > if check_error_fn is not None: > expected_msg_type = KRB_ERROR > self.assertIsNone(check_rep_fn) >- self.assertNotEqual(0, expected_error_mode) >+ self.assertNotEqual(0, len(expected_error_mode)) >+ self.assertNotIn(0, expected_error_mode) > if check_rep_fn is not None: > expected_msg_type = rep_msg_type > self.assertIsNone(check_error_fn) >- self.assertEqual(0, expected_error_mode) >+ self.assertEqual(0, len(expected_error_mode)) > self.assertIsNotNone(expected_msg_type) > self.assertEqual(msg_type, expected_msg_type) > >@@ -1745,6 +1746,11 @@ class RawKerberosTest(TestCaseInTempDir): > kdc_options='', > inner_req=None, > outer_req=None): >+ if expected_error_mode == 0: >+ expected_error_mode = () >+ elif not isinstance(expected_error_mode, collections.abc.Container): >+ expected_error_mode = (expected_error_mode,) >+ > kdc_exchange_dict = { > 'req_msg_type': KRB_AS_REQ, > 'req_asn1Spec': krb5_asn1.AS_REQ, >@@ -1815,6 +1821,11 @@ class RawKerberosTest(TestCaseInTempDir): > kdc_options='', > inner_req=None, > outer_req=None): >+ if expected_error_mode == 0: >+ expected_error_mode = () >+ elif not isinstance(expected_error_mode, collections.abc.Container): >+ expected_error_mode = (expected_error_mode,) >+ > kdc_exchange_dict = { > 'req_msg_type': KRB_TGS_REQ, > 'req_asn1Spec': krb5_asn1.TGS_REQ, >@@ -1942,7 +1953,8 @@ class RawKerberosTest(TestCaseInTempDir): > self.check_rep_padata(kdc_exchange_dict, > callback_dict, > rep, >- fast_response['padata']) >+ fast_response['padata'], >+ error_code=0) > > ticket_private = None > self.assertIsNotNone(ticket_decryption_key) >@@ -2181,7 +2193,8 @@ class RawKerberosTest(TestCaseInTempDir): > > self.assertElementEqual(rep, 'pvno', 5) > self.assertElementEqual(rep, 'msg-type', KRB_ERROR) >- self.assertElementEqual(rep, 'error-code', expected_error_mode) >+ error_code = self.getElementValue(rep, 'error-code') >+ self.assertIn(error_code, expected_error_mode) > if self.strict_checking: > self.assertElementMissing(rep, 'ctime') > self.assertElementMissing(rep, 'cusec') >@@ -2195,13 +2208,13 @@ class RawKerberosTest(TestCaseInTempDir): > else: > self.assertElementMissing(rep, 'cname') > self.assertElementEqualUTF8(rep, 'realm', expected_srealm) >- if sent_fast and expected_error_mode == KDC_ERR_GENERIC: >+ if sent_fast and error_code == KDC_ERR_GENERIC: > self.assertElementEqualPrincipal(rep, 'sname', > self.get_krbtgt_sname()) > else: > self.assertElementEqualPrincipal(rep, 'sname', expected_sname) > self.assertElementMissing(rep, 'e-text') >- if (expected_error_mode == KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS >+ if (error_code == KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS > or (rep_msg_type == KRB_TGS_REP > and not sent_fast) > or (sent_fast and fast_armor_type is not None >@@ -2211,7 +2224,7 @@ class RawKerberosTest(TestCaseInTempDir): > return rep > edata = self.getElementValue(rep, 'e-data') > if self.strict_checking: >- if expected_error_mode != KDC_ERR_GENERIC: >+ if error_code != KDC_ERR_GENERIC: > # Predicting whether an ERR_GENERIC error contains e-data is > # more complicated. > self.assertIsNotNone(edata) >@@ -2242,7 +2255,8 @@ class RawKerberosTest(TestCaseInTempDir): > etype_info2 = self.check_rep_padata(kdc_exchange_dict, > callback_dict, > rep, >- rep_padata) >+ rep_padata, >+ error_code) > > kdc_exchange_dict['preauth_etype_info2'] = etype_info2 > >@@ -2252,10 +2266,10 @@ class RawKerberosTest(TestCaseInTempDir): > kdc_exchange_dict, > callback_dict, > rep, >- rep_padata): >+ rep_padata, >+ error_code): > rep_msg_type = kdc_exchange_dict['rep_msg_type'] > >- expected_error_mode = kdc_exchange_dict['expected_error_mode'] > req_body = kdc_exchange_dict['req_body'] > proposed_etypes = req_body['etype'] > client_as_etypes = kdc_exchange_dict.get('client_as_etypes', []) >@@ -2281,7 +2295,7 @@ class RawKerberosTest(TestCaseInTempDir): > if etype in (kcrypto.Enctype.AES256, kcrypto.Enctype.AES128): > if etype > expected_aes_type: > expected_aes_type = etype >- if etype in (kcrypto.Enctype.RC4,) and expected_error_mode != 0: >+ if etype in (kcrypto.Enctype.RC4,) and error_code != 0: > unexpect_etype_info = False > if etype > expected_rc4_type: > expected_rc4_type = etype >@@ -2292,25 +2306,25 @@ class RawKerberosTest(TestCaseInTempDir): > expect_etype_info2 += (expected_rc4_type,) > > expected_patypes = () >- if sent_fast and expected_error_mode != 0: >+ if sent_fast and error_code != 0: > expected_patypes += (PADATA_FX_ERROR,) > expected_patypes += (PADATA_FX_COOKIE,) > > if rep_msg_type == KRB_TGS_REP: >- if not sent_fast and expected_error_mode != 0: >+ if not sent_fast and error_code != 0: > expected_patypes += (PADATA_PW_SALT,) > else: > sent_claims = self.sent_claims(kdc_exchange_dict) >- if sent_claims and expected_error_mode not in (0, KDC_ERR_GENERIC): >+ if sent_claims and error_code not in (0, KDC_ERR_GENERIC): > expected_patypes += (PADATA_PAC_OPTIONS,) >- elif expected_error_mode != KDC_ERR_GENERIC: >+ elif error_code != KDC_ERR_GENERIC: > if expect_etype_info: > self.assertGreater(len(expect_etype_info2), 0) > expected_patypes += (PADATA_ETYPE_INFO,) > if len(expect_etype_info2) != 0: > expected_patypes += (PADATA_ETYPE_INFO2,) > >- if expected_error_mode != KDC_ERR_PREAUTH_FAILED: >+ if error_code != KDC_ERR_PREAUTH_FAILED: > if sent_fast: > expected_patypes += (PADATA_ENCRYPTED_CHALLENGE,) > else: >@@ -2493,7 +2507,7 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNone(pk_as_rep19) > return None > >- if expected_error_mode != KDC_ERR_GENERIC: >+ if error_code != KDC_ERR_GENERIC: > if self.strict_checking: > self.assertIsNotNone(etype_info2) > else: >@@ -2506,7 +2520,7 @@ class RawKerberosTest(TestCaseInTempDir): > if unexpect_etype_info: > self.assertIsNone(etype_info) > >- if expected_error_mode != KDC_ERR_GENERIC and self.strict_checking: >+ if error_code != KDC_ERR_GENERIC and self.strict_checking: > self.assertGreaterEqual(len(etype_info2), 1) > self.assertEqual(len(etype_info2), len(expect_etype_info2)) > for i in range(0, len(etype_info2)): >@@ -2533,8 +2547,8 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(salt) > self.assertEqual(len(salt), 0) > >- if expected_error_mode not in (KDC_ERR_PREAUTH_FAILED, >- KDC_ERR_GENERIC): >+ if error_code not in (KDC_ERR_PREAUTH_FAILED, >+ KDC_ERR_GENERIC): > if sent_fast: > self.assertIsNotNone(enc_challenge) > if self.strict_checking: >@@ -2799,7 +2813,7 @@ class RawKerberosTest(TestCaseInTempDir): > as_rep_usage = KU_AS_REP_ENC_PART > return preauth_key, as_rep_usage > >- if expected_error_mode == 0: >+ if not expected_error_mode: > check_error_fn = None > check_rep_fn = self.generic_check_kdc_rep > else: >-- >2.25.1 > > >From f9a9114656f9a444252ade792af4912346d4924f Mon Sep 17 00:00:00 2001 >From: Luke Howard <lukeh@padl.com> >Date: Tue, 31 Aug 2021 17:38:16 +1200 >Subject: [PATCH 208/380] kdc: KRB5KDC_ERR_{C,S}_PRINCIPAL_UNKNOWN if missing > field > >If missing cname or sname in AS-REQ, return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN and >KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN. This matches MIT behaviour. > >[abartlet@samba.org Backported from Heimdal commit 892a1ffcaad98157e945c540b81f65edb14d29bd >and knownfail added. Further adapted knownfail for 4.14 due to conflicts >as the patch that adds a test which crashes old MIT versions is >omitted] > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> >--- > selftest/knownfail_heimdal_kdc | 1 + > source4/heimdal/kdc/kerberos5.c | 4 ++-- > 2 files changed, 3 insertions(+), 2 deletions(-) > >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index b0981a06002..f5ac4fa2e2b 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -123,3 +123,4 @@ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_sname.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_no_sname.ad_dc >diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c >index 27d38ad84b7..0fa336e871c 100644 >--- a/source4/heimdal/kdc/kerberos5.c >+++ b/source4/heimdal/kdc/kerberos5.c >@@ -996,7 +996,7 @@ _kdc_as_rep(krb5_context context, > flags |= HDB_F_CANON; > > if(b->sname == NULL){ >- ret = KRB5KRB_ERR_GENERIC; >+ ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; > e_text = "No server in request"; > } else{ > ret = _krb5_principalname2krb5_principal (context, >@@ -1012,7 +1012,7 @@ _kdc_as_rep(krb5_context context, > goto out; > } > if(b->cname == NULL){ >- ret = KRB5KRB_ERR_GENERIC; >+ ret = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN; > e_text = "No client in request"; > } else { > ret = _krb5_principalname2krb5_principal (context, >-- >2.25.1 > > >From 6131fbe28b0fb4d878776726af04b1841a34425a Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 31 Aug 2021 22:38:01 +1200 >Subject: [PATCH 209/380] tests/krb5: Allow KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN for > a missing sname > >This allows our code to still pass with the error code that >MIT and Heimdal have chosen > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14770 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14817 > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> > >Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> >Autobuild-Date(master): Thu Sep 2 14:28:31 UTC 2021 on sn-devel-184 > >[abartlet@samba.org: Backported from 10baaf08523200e47451aa1862430977b0365b59 > to Samba 4.14 due to conflicts in > knownfail as the test which crashes older MIT KDC versions is > omitted] > >Autobuild-User(v4-13-test): Jule Anger <janger@samba.org> >Autobuild-Date(v4-13-test): Thu Sep 16 08:54:13 UTC 2021 on sn-devel-184 >--- > python/samba/tests/krb5/fast_tests.py | 23 +++++++++++++------- > python/samba/tests/krb5/kdc_base_test.py | 6 ++++- > python/samba/tests/krb5/rfc4120_constants.py | 1 + > selftest/knownfail_heimdal_kdc | 3 --- > 4 files changed, 21 insertions(+), 12 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 551790a3e42..2d4b69f8590 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -20,6 +20,7 @@ > import functools > import os > import sys >+import collections > > import ldb > >@@ -37,6 +38,7 @@ from samba.tests.krb5.rfc4120_constants import ( > FX_FAST_ARMOR_AP_REQUEST, > KDC_ERR_ETYPE_NOSUPP, > KDC_ERR_GENERIC, >+ KDC_ERR_S_PRINCIPAL_UNKNOWN, > KDC_ERR_NOT_US, > KDC_ERR_PREAUTH_FAILED, > KDC_ERR_PREAUTH_REQUIRED, >@@ -115,7 +117,7 @@ class FAST_Tests(KDCBaseTest): > self._run_test_sequence([ > { > 'rep_type': KRB_AS_REP, >- 'expected_error_mode': KDC_ERR_GENERIC, >+ 'expected_error_mode': (KDC_ERR_GENERIC, KDC_ERR_S_PRINCIPAL_UNKNOWN), > 'use_fast': False, > 'sname': None, > 'expected_sname': expected_sname >@@ -132,7 +134,7 @@ class FAST_Tests(KDCBaseTest): > self._run_test_sequence([ > { > 'rep_type': KRB_TGS_REP, >- 'expected_error_mode': KDC_ERR_GENERIC, >+ 'expected_error_mode': (KDC_ERR_GENERIC, KDC_ERR_S_PRINCIPAL_UNKNOWN), > 'use_fast': False, > 'gen_tgt_fn': self.get_user_tgt, > 'sname': None, >@@ -169,7 +171,7 @@ class FAST_Tests(KDCBaseTest): > self._run_test_sequence([ > { > 'rep_type': KRB_TGS_REP, >- 'expected_error_mode': KDC_ERR_GENERIC, >+ 'expected_error_mode': (KDC_ERR_GENERIC, KDC_ERR_S_PRINCIPAL_UNKNOWN), > 'use_fast': True, > 'gen_tgt_fn': self.get_user_tgt, > 'fast_armor': None, >@@ -1147,7 +1149,12 @@ class FAST_Tests(KDCBaseTest): > self.assertIn(rep_type, (KRB_AS_REP, KRB_TGS_REP)) > > expected_error_mode = kdc_dict.pop('expected_error_mode') >- self.assertIn(expected_error_mode, range(240)) >+ if expected_error_mode == 0: >+ expected_error_mode = () >+ elif not isinstance(expected_error_mode, collections.abc.Container): >+ expected_error_mode = (expected_error_mode,) >+ for error in expected_error_mode: >+ self.assertIn(error, range(240)) > > use_fast = kdc_dict.pop('use_fast') > self.assertIs(type(use_fast), bool) >@@ -1158,7 +1165,7 @@ class FAST_Tests(KDCBaseTest): > > if fast_armor_type is not None: > self.assertIn('gen_armor_tgt_fn', kdc_dict) >- elif expected_error_mode != KDC_ERR_GENERIC: >+ elif KDC_ERR_GENERIC not in expected_error_mode: > self.assertNotIn('gen_armor_tgt_fn', kdc_dict) > > gen_armor_tgt_fn = kdc_dict.pop('gen_armor_tgt_fn', None) >@@ -1182,7 +1189,7 @@ class FAST_Tests(KDCBaseTest): > self.assertNotIn('gen_tgt_fn', kdc_dict) > tgt = None > >- if expected_error_mode != 0: >+ if len(expected_error_mode) != 0: > check_error_fn = self.generic_check_kdc_error > check_rep_fn = None > else: >@@ -1396,7 +1403,7 @@ class FAST_Tests(KDCBaseTest): > realm=crealm, > sname=sname, > etypes=etypes) >- if expected_error_mode == 0: >+ if len(expected_error_mode) == 0: > self.check_reply(rep, rep_type) > > fast_cookie = None >@@ -1410,7 +1417,7 @@ class FAST_Tests(KDCBaseTest): > else: > fast_cookie = None > >- if expected_error_mode == KDC_ERR_PREAUTH_REQUIRED: >+ if KDC_ERR_PREAUTH_REQUIRED in expected_error_mode: > preauth_etype_info2 = ( > kdc_exchange_dict['preauth_etype_info2']) > else: >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index b148fa01f65..f5c1eba9151 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -21,6 +21,7 @@ import os > from datetime import datetime, timezone > import tempfile > import binascii >+import collections > > from collections import namedtuple > import ldb >@@ -598,7 +599,10 @@ class KDCBaseTest(RawKerberosTest): > """ > self.assertIsNotNone(rep) > self.assertEqual(rep['msg-type'], KRB_ERROR, "rep = {%s}" % rep) >- self.assertEqual(rep['error-code'], expected, "rep = {%s}" % rep) >+ if isinstance(expected, collections.abc.Container): >+ self.assertIn(rep['error-code'], expected, "rep = {%s}" % rep) >+ else: >+ self.assertEqual(rep['error-code'], expected, "rep = {%s}" % rep) > > def tgs_req(self, cname, sname, realm, ticket, key, etypes): > '''Send a TGS-REQ, returns the response and the decrypted and >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index c70ce309b95..ac2bac4d91e 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -67,6 +67,7 @@ PADATA_SUPPORTED_ETYPES = int( > > # Error codes > KDC_ERR_C_PRINCIPAL_UNKNOWN = 6 >+KDC_ERR_S_PRINCIPAL_UNKNOWN = 7 > KDC_ERR_POLICY = 12 > KDC_ERR_ETYPE_NOSUPP = 14 > KDC_ERR_PREAUTH_FAILED = 24 >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index f5ac4fa2e2b..80b8224f015 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -121,6 +121,3 @@ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_sname.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_sname.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_sname.ad_dc >-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_no_sname.ad_dc >-- >2.25.1 > > >From 2fc27940fb9db01f61867f664955e55e44669518 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 13 Sep 2021 11:34:56 +1200 >Subject: [PATCH 210/380] pytest:segfault: Add test for ldb.msg_diff() > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14645 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14836 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> > >[abartlet@samba.org backported form from commit >a99a76722d6046a5d63032e3d2bb3f791da948a6 due to conflicts >with other new segfault tests] >--- > python/samba/tests/segfault.py | 11 +++++++++++ > selftest/knownfail.d/python-segfaults | 1 + > 2 files changed, 12 insertions(+) > >diff --git a/python/samba/tests/segfault.py b/python/samba/tests/segfault.py >index 07e2d46d56a..eac314982a8 100644 >--- a/python/samba/tests/segfault.py >+++ b/python/samba/tests/segfault.py >@@ -174,3 +174,14 @@ class SegfaultTests(samba.tests.TestCase): > def test_dcerpc_idl_inline_arrays(self): > """Inline arrays were incorrectly handled.""" > dnsserver.DNS_RPC_SERVER_INFO_DOTNET().pExtensions >+ >+ @segfault_detector >+ def test_ldb_msg_diff(self): >+ samdb = self.get_samdb() >+ >+ msg = ldb.Message() >+ msg.dn = ldb.Dn(samdb, '') >+ diff = samdb.msg_diff(msg, msg) >+ >+ del msg >+ diff.dn >diff --git a/selftest/knownfail.d/python-segfaults b/selftest/knownfail.d/python-segfaults >index 1be0566dcb1..b7229fc7229 100644 >--- a/selftest/knownfail.d/python-segfaults >+++ b/selftest/knownfail.d/python-segfaults >@@ -1 +1,2 @@ > samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_net_replicate_init__3 >+samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_ldb_msg_diff >-- >2.25.1 > > >From f4777b9045a7e864a0fa037f0781db5960141b67 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 14 Sep 2021 11:08:41 +1200 >Subject: [PATCH 211/380] ldb_msg: Don't fail in ldb_msg_copy() if source DN is > NULL > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14645 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14836 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit c2bbe774ce03661666a1f48922a9ab681ef4f64b) >--- > lib/ldb/common/ldb_msg.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > >diff --git a/lib/ldb/common/ldb_msg.c b/lib/ldb/common/ldb_msg.c >index 2346e66ec39..7131f013f71 100644 >--- a/lib/ldb/common/ldb_msg.c >+++ b/lib/ldb/common/ldb_msg.c >@@ -876,8 +876,10 @@ struct ldb_message *ldb_msg_copy(TALLOC_CTX *mem_ctx, > msg2 = ldb_msg_copy_shallow(mem_ctx, msg); > if (msg2 == NULL) return NULL; > >- msg2->dn = ldb_dn_copy(msg2, msg2->dn); >- if (msg2->dn == NULL) goto failed; >+ if (msg2->dn != NULL) { >+ msg2->dn = ldb_dn_copy(msg2, msg2->dn); >+ if (msg2->dn == NULL) goto failed; >+ } > > for (i=0;i<msg2->num_elements;i++) { > struct ldb_message_element *el = &msg2->elements[i]; >-- >2.25.1 > > >From 845baab629064bf34bd0fa773419319d10b4b676 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 13 Sep 2021 11:15:17 +1200 >Subject: [PATCH 212/380] pyldb: Avoid use-after-free in msg_diff() > >Make a deep copy of the message elements in msg_diff() so that if either >of the input messages are deallocated early, the result does not refer >to non-existing elements. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14645 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14836 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> > >[abartlet@samba.org backported from commit > 19a2af02f57d99db8ed3c6b028c3abdf4b553700 due to conflicts in > the knownfail.d/python-segfaults file] > >Autobuild-User(v4-14-test): Jule Anger <janger@samba.org> >Autobuild-Date(v4-14-test): Wed Sep 29 13:14:22 UTC 2021 on sn-devel-184 >--- > lib/ldb/pyldb.c | 18 ++++++++++++++++-- > selftest/knownfail.d/python-segfaults | 1 - > 2 files changed, 16 insertions(+), 3 deletions(-) > >diff --git a/lib/ldb/pyldb.c b/lib/ldb/pyldb.c >index a6069be46a9..59a5d89dd9d 100644 >--- a/lib/ldb/pyldb.c >+++ b/lib/ldb/pyldb.c >@@ -1805,6 +1805,7 @@ static PyObject *py_ldb_msg_diff(PyLdbObject *self, PyObject *args) > struct ldb_message *diff; > struct ldb_context *ldb; > PyObject *py_ret; >+ TALLOC_CTX *mem_ctx = NULL; > > if (!PyArg_ParseTuple(args, "OO", &py_msg_old, &py_msg_new)) > return NULL; >@@ -1819,19 +1820,32 @@ static PyObject *py_ldb_msg_diff(PyLdbObject *self, PyObject *args) > return NULL; > } > >+ mem_ctx = talloc_new(NULL); >+ if (mem_ctx == NULL) { >+ PyErr_NoMemory(); >+ return NULL; >+ } >+ > ldb = pyldb_Ldb_AS_LDBCONTEXT(self); >- ldb_ret = ldb_msg_difference(ldb, ldb, >+ ldb_ret = ldb_msg_difference(ldb, mem_ctx, > pyldb_Message_AsMessage(py_msg_old), > pyldb_Message_AsMessage(py_msg_new), > &diff); > if (ldb_ret != LDB_SUCCESS) { >+ talloc_free(mem_ctx); > PyErr_SetString(PyExc_RuntimeError, "Failed to generate the Ldb Message diff"); > return NULL; > } > >+ diff = ldb_msg_copy(mem_ctx, diff); >+ if (diff == NULL) { >+ PyErr_NoMemory(); >+ return NULL; >+ } >+ > py_ret = PyLdbMessage_FromMessage(diff); > >- talloc_unlink(ldb, diff); >+ talloc_free(mem_ctx); > > return py_ret; > } >diff --git a/selftest/knownfail.d/python-segfaults b/selftest/knownfail.d/python-segfaults >index b7229fc7229..1be0566dcb1 100644 >--- a/selftest/knownfail.d/python-segfaults >+++ b/selftest/knownfail.d/python-segfaults >@@ -1,2 +1 @@ > samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_net_replicate_init__3 >-samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_ldb_msg_diff >-- >2.25.1 > > >From d6aa44dbf5af04f0a255dc38aa695b270d3ac62e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 28 Apr 2021 16:48:55 +1200 >Subject: [PATCH 213/380] Fix Python docstrings > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Jeremy Allison <jra@samba.org> > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Autobuild-User(master): Jeremy Allison <jra@samba.org> >Autobuild-Date(master): Sat Sep 4 00:55:32 UTC 2021 on sn-devel-184 > >(cherry picked from commit 02b187303369d3ce0c19dfb72ffa78f86a3911f0) >--- > lib/ldb/pyldb.c | 2 +- > lib/tdb/pytdb.c | 2 +- > lib/tevent/pytevent.c | 2 +- > source4/librpc/ndr/py_security.c | 2 +- > 4 files changed, 4 insertions(+), 4 deletions(-) > >diff --git a/lib/ldb/pyldb.c b/lib/ldb/pyldb.c >index 59a5d89dd9d..2eda1c77a3d 100644 >--- a/lib/ldb/pyldb.c >+++ b/lib/ldb/pyldb.c >@@ -840,7 +840,7 @@ static PyMethodDef py_ldb_dn_methods[] = { > "S.get_component_value(num) -> string\n" > "get the attribute value of the specified component as a binary string" }, > { "set_component", (PyCFunction)py_ldb_dn_set_component, METH_VARARGS, >- "S.get_component_value(num, name, value) -> None\n" >+ "S.set_component(num, name, value) -> None\n" > "set the attribute name and value of the specified component" }, > { "get_rdn_name", (PyCFunction)py_ldb_dn_get_rdn_name, METH_NOARGS, > "S.get_rdn_name() -> string\n" >diff --git a/lib/tdb/pytdb.c b/lib/tdb/pytdb.c >index 74e80f95ec5..9fb1d84c0d8 100644 >--- a/lib/tdb/pytdb.c >+++ b/lib/tdb/pytdb.c >@@ -531,7 +531,7 @@ static PyMethodDef tdb_object_methods[] = { > { "add_flags", (PyCFunction)obj_add_flags, METH_VARARGS, "S.add_flags(flags) -> None" }, > { "remove_flags", (PyCFunction)obj_remove_flags, METH_VARARGS, "S.remove_flags(flags) -> None" }, > #if PY_MAJOR_VERSION >= 3 >- { "keys", (PyCFunction)tdb_object_iter, METH_NOARGS, "S.iterkeys() -> iterator" }, >+ { "keys", (PyCFunction)tdb_object_iter, METH_NOARGS, "S.keys() -> iterator" }, > #else > { "iterkeys", (PyCFunction)tdb_object_iter, METH_NOARGS, "S.iterkeys() -> iterator" }, > #endif >diff --git a/lib/tevent/pytevent.c b/lib/tevent/pytevent.c >index 73a9bd736e7..33a8c3bd64a 100644 >--- a/lib/tevent/pytevent.c >+++ b/lib/tevent/pytevent.c >@@ -573,7 +573,7 @@ static PyMethodDef py_tevent_context_methods[] = { > { "add_timer", (PyCFunction)py_tevent_context_add_timer, > METH_VARARGS, "S.add_timer(next_event, handler) -> timer" }, > { "add_timer_offset", (PyCFunction)py_tevent_context_add_timer_offset, >- METH_VARARGS, "S.add_timer(offset_seconds, handler) -> timer" }, >+ METH_VARARGS, "S.add_timer_offset(offset_seconds, handler) -> timer" }, > { "add_fd", (PyCFunction)py_tevent_context_add_fd, > METH_VARARGS, "S.add_fd(fd, flags, handler) -> fd" }, > { NULL }, >diff --git a/source4/librpc/ndr/py_security.c b/source4/librpc/ndr/py_security.c >index fc0aea99c3b..d957aa613b6 100644 >--- a/source4/librpc/ndr/py_security.c >+++ b/source4/librpc/ndr/py_security.c >@@ -447,7 +447,7 @@ static PyMethodDef py_token_extra_methods[] = { > { "has_sid", (PyCFunction)py_token_has_sid, METH_VARARGS, > NULL }, > { "is_anonymous", (PyCFunction)py_token_is_anonymous, METH_NOARGS, >- "S.is_anonymus() -> bool\n" >+ "S.is_anonymous() -> bool\n" > "Check whether this is an anonymous token." }, > { "is_system", (PyCFunction)py_token_is_system, METH_NOARGS, > NULL }, >-- >2.25.1 > > >From e3796d6fcdff7c737b432d66a901d5d95a54e860 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Sat, 25 Sep 2021 10:56:25 +1200 >Subject: [PATCH 214/380] pytest:segfault: Add test for deleting an ldb.Message > dn > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >[abartlet@samba.org backported from commit 6a041f6a99c39632d5c32e9d53b06719c20bef2c > as other segfaulting tests are listed in knownfail.d/python-segfaults > and @no_gdb_backtrace is not in 4.14] >--- > python/samba/tests/segfault.py | 5 +++++ > selftest/knownfail.d/python-segfaults | 1 + > 2 files changed, 6 insertions(+) > >diff --git a/python/samba/tests/segfault.py b/python/samba/tests/segfault.py >index eac314982a8..24add6f3b6e 100644 >--- a/python/samba/tests/segfault.py >+++ b/python/samba/tests/segfault.py >@@ -185,3 +185,8 @@ class SegfaultTests(samba.tests.TestCase): > > del msg > diff.dn >+ >+ @segfault_detector >+ def test_ldb_msg_del_dn(self): >+ msg = ldb.Message() >+ del msg.dn >diff --git a/selftest/knownfail.d/python-segfaults b/selftest/knownfail.d/python-segfaults >index 1be0566dcb1..c0bd391714b 100644 >--- a/selftest/knownfail.d/python-segfaults >+++ b/selftest/knownfail.d/python-segfaults >@@ -1 +1,2 @@ > samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_net_replicate_init__3 >+samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_ldb_msg_del_dn >-- >2.25.1 > > >From 98125d68fcc266f8271df3c15216f32dfb23476a Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Sat, 25 Sep 2021 11:12:16 +1200 >Subject: [PATCH 215/380] pyldb: Fix deleting an ldb.Message dn > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >[abartlet@samba.org backported from commit d7af772de88885f46708329ff7bb5798da91d2c7 > due to conflicts in knownfail.d/python-segfaults] >--- > lib/ldb/pyldb.c | 4 ++++ > selftest/knownfail.d/python-segfaults | 3 ++- > 2 files changed, 6 insertions(+), 1 deletion(-) > >diff --git a/lib/ldb/pyldb.c b/lib/ldb/pyldb.c >index 2eda1c77a3d..7e858a32a44 100644 >--- a/lib/ldb/pyldb.c >+++ b/lib/ldb/pyldb.c >@@ -3742,6 +3742,10 @@ static PyObject *py_ldb_msg_get_dn(PyLdbMessageObject *self, void *closure) > static int py_ldb_msg_set_dn(PyLdbMessageObject *self, PyObject *value, void *closure) > { > struct ldb_message *msg = pyldb_Message_AsMessage(self); >+ if (value == NULL) { >+ PyErr_SetString(PyExc_AttributeError, "cannot delete dn"); >+ return -1; >+ } > if (!pyldb_Dn_Check(value)) { > PyErr_SetString(PyExc_TypeError, "expected dn"); > return -1; >diff --git a/selftest/knownfail.d/python-segfaults b/selftest/knownfail.d/python-segfaults >index c0bd391714b..d129dab7d47 100644 >--- a/selftest/knownfail.d/python-segfaults >+++ b/selftest/knownfail.d/python-segfaults >@@ -1,2 +1,3 @@ > samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_net_replicate_init__3 >-samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_ldb_msg_del_dn >+samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_dnsp_string_list >+samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_dns_record >-- >2.25.1 > > >From ed1429f40526048115ce147fd3d3531dba0d2adc Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Sat, 25 Sep 2021 11:13:02 +1200 >Subject: [PATCH 216/380] pytest:segfault: Add test for deleting an ldb.Control > critical flag > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >[abartlet@samba.org backported from commit b1adaa517c1237a473bdcf818523f5107df3d6b0 > as @no_gdb_backtrace is not in Samba 4.14] >--- > python/samba/tests/segfault.py | 7 +++++++ > selftest/knownfail.d/python-segfaults | 1 + > 2 files changed, 8 insertions(+) > >diff --git a/python/samba/tests/segfault.py b/python/samba/tests/segfault.py >index 24add6f3b6e..62b51e71794 100644 >--- a/python/samba/tests/segfault.py >+++ b/python/samba/tests/segfault.py >@@ -190,3 +190,10 @@ class SegfaultTests(samba.tests.TestCase): > def test_ldb_msg_del_dn(self): > msg = ldb.Message() > del msg.dn >+ >+ @segfault_detector >+ def test_ldb_control_del_critical(self): >+ samdb = self.get_samdb() >+ >+ c = ldb.Control(samdb, 'relax:1') >+ del c.critical >diff --git a/selftest/knownfail.d/python-segfaults b/selftest/knownfail.d/python-segfaults >index d129dab7d47..0c6e52d63d4 100644 >--- a/selftest/knownfail.d/python-segfaults >+++ b/selftest/knownfail.d/python-segfaults >@@ -1,3 +1,4 @@ > samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_net_replicate_init__3 > samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_dnsp_string_list > samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_dns_record >+samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_ldb_control_del_critical >-- >2.25.1 > > >From d59e89418f924412a02ed337bb30e211e19b8835 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Sat, 25 Sep 2021 11:16:09 +1200 >Subject: [PATCH 217/380] pyldb: Fix deleting an ldb.Control critical flag > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 9d25a21d6024c6c2f8e4634f45e3944d8acbf8b8) >--- > lib/ldb/pyldb.c | 4 ++++ > selftest/knownfail.d/python-segfaults | 1 - > 2 files changed, 4 insertions(+), 1 deletion(-) > >diff --git a/lib/ldb/pyldb.c b/lib/ldb/pyldb.c >index 7e858a32a44..5934b1ad142 100644 >--- a/lib/ldb/pyldb.c >+++ b/lib/ldb/pyldb.c >@@ -183,6 +183,10 @@ static PyObject *py_ldb_control_get_critical(PyLdbControlObject *self, > > static int py_ldb_control_set_critical(PyLdbControlObject *self, PyObject *value, void *closure) > { >+ if (value == NULL) { >+ PyErr_SetString(PyExc_AttributeError, "cannot delete critical flag"); >+ return -1; >+ } > if (PyObject_IsTrue(value)) { > self->data->critical = true; > } else { >diff --git a/selftest/knownfail.d/python-segfaults b/selftest/knownfail.d/python-segfaults >index 0c6e52d63d4..d129dab7d47 100644 >--- a/selftest/knownfail.d/python-segfaults >+++ b/selftest/knownfail.d/python-segfaults >@@ -1,4 +1,3 @@ > samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_net_replicate_init__3 > samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_dnsp_string_list > samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_dns_record >-samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_ldb_control_del_critical >-- >2.25.1 > > >From 9873932520a10a9be0d5c5ac10a630051ed62d40 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Sat, 25 Sep 2021 19:18:39 +1200 >Subject: [PATCH 218/380] s4/torture/drs/python: Fix attribute existence check > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >[abartlet@samba.org backported from commit fb758c32e7633178f42dc2c031667b10c2ca6e90 > due to assertEquals vs assertEqual on the previous line] >--- > source4/torture/drs/python/replica_sync.py | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/source4/torture/drs/python/replica_sync.py b/source4/torture/drs/python/replica_sync.py >index 03292b57805..f787c8f0f11 100644 >--- a/source4/torture/drs/python/replica_sync.py >+++ b/source4/torture/drs/python/replica_sync.py >@@ -140,7 +140,7 @@ objectClass: organizationalUnit > # now check properties of the user > name_cur = ou_cur["ou"][0] > self.assertEquals(ou_cur["isDeleted"][0], b"TRUE") >- self.assertTrue(not(b"objectCategory" in ou_cur)) >+ self.assertTrue(not("objectCategory" in ou_cur)) > self.assertTrue(dodn in str(ou_cur["dn"]), > "OU %s is deleted but it is not located under %s!" % (name_cur, dodn)) > >-- >2.25.1 > > >From 3b3b0b7d4f0524d3f536b869c746a301e290b8ba Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Sat, 25 Sep 2021 13:22:05 +1200 >Subject: [PATCH 219/380] pyldb: Add test for an invalid ldb.Message index type > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit b018e51d2725a23b2fedd3058644b8021f6a6a06) >--- > lib/ldb/tests/python/api.py | 6 ++++++ > selftest/knownfail.d/pyldb | 1 + > 2 files changed, 7 insertions(+) > create mode 100644 selftest/knownfail.d/pyldb > >diff --git a/lib/ldb/tests/python/api.py b/lib/ldb/tests/python/api.py >index 1d3d765e607..bcb01e15f56 100755 >--- a/lib/ldb/tests/python/api.py >+++ b/lib/ldb/tests/python/api.py >@@ -3056,6 +3056,12 @@ class LdbMsgTests(TestCase): > def test_notpresent(self): > self.assertRaises(KeyError, lambda: self.msg["foo"]) > >+ def test_invalid(self): >+ try: >+ self.assertRaises(TypeError, lambda: self.msg[42]) >+ except KeyError: >+ self.fail() >+ > def test_del(self): > del self.msg["foo"] > >diff --git a/selftest/knownfail.d/pyldb b/selftest/knownfail.d/pyldb >new file mode 100644 >index 00000000000..8d24c4515d3 >--- /dev/null >+++ b/selftest/knownfail.d/pyldb >@@ -0,0 +1 @@ >+^ldb.python.api.LdbMsgTests.test_invalid >-- >2.25.1 > > >From f1cc78cc3aafdcd7697083fb8a0ec148fd0d1b1a Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Sat, 25 Sep 2021 13:39:56 +1200 >Subject: [PATCH 220/380] pyldb: Raise TypeError for an invalid ldb.Message > index > >Previously, a TypeError was raised and subsequently overridden by a >KeyError. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 22353767ca75af9d9e8fa1e7da372dcb5eddfcb7) >--- > lib/ldb/pyldb.c | 22 +++++++--------------- > selftest/knownfail.d/pyldb | 1 - > 2 files changed, 7 insertions(+), 16 deletions(-) > delete mode 100644 selftest/knownfail.d/pyldb > >diff --git a/lib/ldb/pyldb.c b/lib/ldb/pyldb.c >index 5934b1ad142..187e3b63448 100644 >--- a/lib/ldb/pyldb.c >+++ b/lib/ldb/pyldb.c >@@ -3434,33 +3434,25 @@ static PyObject *py_ldb_msg_keys(PyLdbMessageObject *self, > return obj; > } > >-static PyObject *py_ldb_msg_getitem_helper(PyLdbMessageObject *self, PyObject *py_name) >+static PyObject *py_ldb_msg_getitem(PyLdbMessageObject *self, PyObject *py_name) > { >- struct ldb_message_element *el; >- const char *name; >+ struct ldb_message_element *el = NULL; >+ const char *name = NULL; > struct ldb_message *msg = pyldb_Message_AsMessage(self); > name = PyUnicode_AsUTF8(py_name); > if (name == NULL) { >- PyErr_SetNone(PyExc_TypeError); > return NULL; > } >- if (!ldb_attr_cmp(name, "dn")) >+ if (!ldb_attr_cmp(name, "dn")) { > return pyldb_Dn_FromDn(msg->dn); >+ } > el = ldb_msg_find_element(msg, name); > if (el == NULL) { >- return NULL; >- } >- return (PyObject *)PyLdbMessageElement_FromMessageElement(el, msg->elements); >-} >- >-static PyObject *py_ldb_msg_getitem(PyLdbMessageObject *self, PyObject *py_name) >-{ >- PyObject *ret = py_ldb_msg_getitem_helper(self, py_name); >- if (ret == NULL) { > PyErr_SetString(PyExc_KeyError, "No such element"); > return NULL; > } >- return ret; >+ >+ return PyLdbMessageElement_FromMessageElement(el, msg->elements); > } > > static PyObject *py_ldb_msg_get(PyLdbMessageObject *self, PyObject *args, PyObject *kwargs) >diff --git a/selftest/knownfail.d/pyldb b/selftest/knownfail.d/pyldb >deleted file mode 100644 >index 8d24c4515d3..00000000000 >--- a/selftest/knownfail.d/pyldb >+++ /dev/null >@@ -1 +0,0 @@ >-^ldb.python.api.LdbMsgTests.test_invalid >-- >2.25.1 > > >From 654b480510d877bb5f75687960e5137db9b7a556 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Sat, 25 Sep 2021 13:48:57 +1200 >Subject: [PATCH 221/380] pyldb: Add tests for ldb.Message containment testing > >These tests verify that the 'in' operator on ldb.Message is consistent >with indexing and the get() method. This means that the 'dn' element >should always be present, lookups should be case-insensitive, and use of >an invalid type should result in a TypeError. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 865fe238599a732360b77e06e592cb85d459acf8) >--- > lib/ldb/tests/python/api.py | 23 +++++++++++++++++++++++ > selftest/knownfail.d/pyldb | 4 ++++ > 2 files changed, 27 insertions(+) > create mode 100644 selftest/knownfail.d/pyldb > >diff --git a/lib/ldb/tests/python/api.py b/lib/ldb/tests/python/api.py >index bcb01e15f56..675b5859af8 100755 >--- a/lib/ldb/tests/python/api.py >+++ b/lib/ldb/tests/python/api.py >@@ -3177,6 +3177,29 @@ class LdbMsgTests(TestCase): > def test_get_unknown_text(self): > self.assertEqual(None, self.msg.text.get("lalalala")) > >+ def test_contains(self): >+ self.msg['foo'] = ['bar'] >+ self.assertIn('foo', self.msg) >+ >+ self.msg['Foo'] = ['bar'] >+ self.assertIn('Foo', self.msg) >+ >+ def test_contains_case(self): >+ self.msg['foo'] = ['bar'] >+ self.assertIn('Foo', self.msg) >+ >+ self.msg['Foo'] = ['bar'] >+ self.assertIn('foo', self.msg) >+ >+ def test_contains_dn(self): >+ self.assertIn('dn', self.msg) >+ >+ def test_contains_dn_case(self): >+ self.assertIn('DN', self.msg) >+ >+ def test_contains_invalid(self): >+ self.assertRaises(TypeError, lambda: None in self.msg) >+ > def test_msg_diff(self): > l = ldb.Ldb() > msgs = l.parse_ldif("dn: foo=bar\nfoo: bar\nbaz: do\n\ndn: foo=bar\nfoo: bar\nbaz: dont\n") >diff --git a/selftest/knownfail.d/pyldb b/selftest/knownfail.d/pyldb >new file mode 100644 >index 00000000000..34bdac4f682 >--- /dev/null >+++ b/selftest/knownfail.d/pyldb >@@ -0,0 +1,4 @@ >+^ldb.python.api.LdbMsgTests.test_contains_case >+^ldb.python.api.LdbMsgTests.test_contains_dn >+^ldb.python.api.LdbMsgTests.test_contains_dn_case >+^ldb.python.api.LdbMsgTests.test_contains_invalid >-- >2.25.1 > > >From 89e5384d17b6db0751d259366de5aa4d9edffd4a Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Sat, 25 Sep 2021 14:39:59 +1200 >Subject: [PATCH 222/380] pyldb: Make ldb.Message containment testing > consistent with indexing > >Previously, containment testing using the 'in' operator was handled by >performing an equality comparison between the chosen object and each of >the message's keys in turn. This behaviour was prone to errors due to >not considering differences in case between otherwise equal elements, as >the indexing operations do. > >Containment testing should now be more consistent with the indexing >operations and with the get() method of ldb.Message. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 860d8902a9c502d4be83396598cf4a53c80fea69) >--- > lib/ldb/pyldb.c | 21 +++++++++++++++++++++ > selftest/knownfail.d/pyldb | 4 ---- > 2 files changed, 21 insertions(+), 4 deletions(-) > delete mode 100644 selftest/knownfail.d/pyldb > >diff --git a/lib/ldb/pyldb.c b/lib/ldb/pyldb.c >index 187e3b63448..0fa444cf985 100644 >--- a/lib/ldb/pyldb.c >+++ b/lib/ldb/pyldb.c >@@ -3434,6 +3434,22 @@ static PyObject *py_ldb_msg_keys(PyLdbMessageObject *self, > return obj; > } > >+static int py_ldb_msg_contains(PyLdbMessageObject *self, PyObject *py_name) >+{ >+ struct ldb_message_element *el = NULL; >+ const char *name = NULL; >+ struct ldb_message *msg = pyldb_Message_AsMessage(self); >+ name = PyUnicode_AsUTF8(py_name); >+ if (name == NULL) { >+ return -1; >+ } >+ if (!ldb_attr_cmp(name, "dn")) { >+ return 1; >+ } >+ el = ldb_msg_find_element(msg, name); >+ return el != NULL ? 1 : 0; >+} >+ > static PyObject *py_ldb_msg_getitem(PyLdbMessageObject *self, PyObject *py_name) > { > struct ldb_message_element *el = NULL; >@@ -3662,6 +3678,10 @@ static Py_ssize_t py_ldb_msg_length(PyLdbMessageObject *self) > return pyldb_Message_AsMessage(self)->num_elements; > } > >+static PySequenceMethods py_ldb_msg_sequence = { >+ .sq_contains = (objobjproc)py_ldb_msg_contains, >+}; >+ > static PyMappingMethods py_ldb_msg_mapping = { > .mp_length = (lenfunc)py_ldb_msg_length, > .mp_subscript = (binaryfunc)py_ldb_msg_getitem, >@@ -3839,6 +3859,7 @@ static PyTypeObject PyLdbMessage = { > .tp_name = "ldb.Message", > .tp_methods = py_ldb_msg_methods, > .tp_getset = py_ldb_msg_getset, >+ .tp_as_sequence = &py_ldb_msg_sequence, > .tp_as_mapping = &py_ldb_msg_mapping, > .tp_basicsize = sizeof(PyLdbMessageObject), > .tp_dealloc = (destructor)py_ldb_msg_dealloc, >diff --git a/selftest/knownfail.d/pyldb b/selftest/knownfail.d/pyldb >deleted file mode 100644 >index 34bdac4f682..00000000000 >--- a/selftest/knownfail.d/pyldb >+++ /dev/null >@@ -1,4 +0,0 @@ >-^ldb.python.api.LdbMsgTests.test_contains_case >-^ldb.python.api.LdbMsgTests.test_contains_dn >-^ldb.python.api.LdbMsgTests.test_contains_dn_case >-^ldb.python.api.LdbMsgTests.test_contains_invalid >-- >2.25.1 > > >From 56749638cfb9cfee64af7f644c6c84e91ce678e1 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Mon, 4 Oct 2021 21:57:25 +1300 >Subject: [PATCH 223/380] ldb: Release ldb 2.1.6 > >* Corrected python behaviour for 'in' for LDAP attributes > contained as part of ldb.Message (bug 14845) >* Fix memory handling in ldb.msg_diff (bug 14836) >* Corrected python docstrings > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14845 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14836 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14848 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> > >Autobuild-User(v4-14-test): Stefan Metzmacher <metze@samba.org> >Autobuild-Date(v4-14-test): Tue Oct 26 13:03:37 UTC 2021 on sn-devel-184 >--- > lib/ldb/ABI/ldb-2.2.2.sigs | 283 ++++++++++++++++++++++++++++++ > lib/ldb/ABI/pyldb-util-2.2.2.sigs | 3 + > lib/ldb/wscript | 2 +- > 3 files changed, 287 insertions(+), 1 deletion(-) > create mode 100644 lib/ldb/ABI/ldb-2.2.2.sigs > create mode 100644 lib/ldb/ABI/pyldb-util-2.2.2.sigs > >diff --git a/lib/ldb/ABI/ldb-2.2.2.sigs b/lib/ldb/ABI/ldb-2.2.2.sigs >new file mode 100644 >index 00000000000..5049dc64ce1 >--- /dev/null >+++ b/lib/ldb/ABI/ldb-2.2.2.sigs >@@ -0,0 +1,283 @@ >+ldb_add: int (struct ldb_context *, const struct ldb_message *) >+ldb_any_comparison: int (struct ldb_context *, void *, ldb_attr_handler_t, const struct ldb_val *, const struct ldb_val *) >+ldb_asprintf_errstring: void (struct ldb_context *, const char *, ...) >+ldb_attr_casefold: char *(TALLOC_CTX *, const char *) >+ldb_attr_dn: int (const char *) >+ldb_attr_in_list: int (const char * const *, const char *) >+ldb_attr_list_copy: const char **(TALLOC_CTX *, const char * const *) >+ldb_attr_list_copy_add: const char **(TALLOC_CTX *, const char * const *, const char *) >+ldb_base64_decode: int (char *) >+ldb_base64_encode: char *(TALLOC_CTX *, const char *, int) >+ldb_binary_decode: struct ldb_val (TALLOC_CTX *, const char *) >+ldb_binary_encode: char *(TALLOC_CTX *, struct ldb_val) >+ldb_binary_encode_string: char *(TALLOC_CTX *, const char *) >+ldb_build_add_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *) >+ldb_build_del_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *) >+ldb_build_extended_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, const char *, void *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *) >+ldb_build_mod_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *) >+ldb_build_rename_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, struct ldb_dn *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *) >+ldb_build_search_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, enum ldb_scope, const char *, const char * const *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *) >+ldb_build_search_req_ex: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, enum ldb_scope, struct ldb_parse_tree *, const char * const *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *) >+ldb_casefold: char *(struct ldb_context *, TALLOC_CTX *, const char *, size_t) >+ldb_casefold_default: char *(void *, TALLOC_CTX *, const char *, size_t) >+ldb_check_critical_controls: int (struct ldb_control **) >+ldb_comparison_binary: int (struct ldb_context *, void *, const struct ldb_val *, const struct ldb_val *) >+ldb_comparison_fold: int (struct ldb_context *, void *, const struct ldb_val *, const struct ldb_val *) >+ldb_connect: int (struct ldb_context *, const char *, unsigned int, const char **) >+ldb_control_to_string: char *(TALLOC_CTX *, const struct ldb_control *) >+ldb_controls_except_specified: struct ldb_control **(struct ldb_control **, TALLOC_CTX *, struct ldb_control *) >+ldb_debug: void (struct ldb_context *, enum ldb_debug_level, const char *, ...) >+ldb_debug_add: void (struct ldb_context *, const char *, ...) >+ldb_debug_end: void (struct ldb_context *, enum ldb_debug_level) >+ldb_debug_set: void (struct ldb_context *, enum ldb_debug_level, const char *, ...) >+ldb_delete: int (struct ldb_context *, struct ldb_dn *) >+ldb_dn_add_base: bool (struct ldb_dn *, struct ldb_dn *) >+ldb_dn_add_base_fmt: bool (struct ldb_dn *, const char *, ...) >+ldb_dn_add_child: bool (struct ldb_dn *, struct ldb_dn *) >+ldb_dn_add_child_fmt: bool (struct ldb_dn *, const char *, ...) >+ldb_dn_add_child_val: bool (struct ldb_dn *, const char *, struct ldb_val) >+ldb_dn_alloc_casefold: char *(TALLOC_CTX *, struct ldb_dn *) >+ldb_dn_alloc_linearized: char *(TALLOC_CTX *, struct ldb_dn *) >+ldb_dn_canonical_ex_string: char *(TALLOC_CTX *, struct ldb_dn *) >+ldb_dn_canonical_string: char *(TALLOC_CTX *, struct ldb_dn *) >+ldb_dn_check_local: bool (struct ldb_module *, struct ldb_dn *) >+ldb_dn_check_special: bool (struct ldb_dn *, const char *) >+ldb_dn_compare: int (struct ldb_dn *, struct ldb_dn *) >+ldb_dn_compare_base: int (struct ldb_dn *, struct ldb_dn *) >+ldb_dn_copy: struct ldb_dn *(TALLOC_CTX *, struct ldb_dn *) >+ldb_dn_escape_value: char *(TALLOC_CTX *, struct ldb_val) >+ldb_dn_extended_add_syntax: int (struct ldb_context *, unsigned int, const struct ldb_dn_extended_syntax *) >+ldb_dn_extended_filter: void (struct ldb_dn *, const char * const *) >+ldb_dn_extended_syntax_by_name: const struct ldb_dn_extended_syntax *(struct ldb_context *, const char *) >+ldb_dn_from_ldb_val: struct ldb_dn *(TALLOC_CTX *, struct ldb_context *, const struct ldb_val *) >+ldb_dn_get_casefold: const char *(struct ldb_dn *) >+ldb_dn_get_comp_num: int (struct ldb_dn *) >+ldb_dn_get_component_name: const char *(struct ldb_dn *, unsigned int) >+ldb_dn_get_component_val: const struct ldb_val *(struct ldb_dn *, unsigned int) >+ldb_dn_get_extended_comp_num: int (struct ldb_dn *) >+ldb_dn_get_extended_component: const struct ldb_val *(struct ldb_dn *, const char *) >+ldb_dn_get_extended_linearized: char *(TALLOC_CTX *, struct ldb_dn *, int) >+ldb_dn_get_ldb_context: struct ldb_context *(struct ldb_dn *) >+ldb_dn_get_linearized: const char *(struct ldb_dn *) >+ldb_dn_get_parent: struct ldb_dn *(TALLOC_CTX *, struct ldb_dn *) >+ldb_dn_get_rdn_name: const char *(struct ldb_dn *) >+ldb_dn_get_rdn_val: const struct ldb_val *(struct ldb_dn *) >+ldb_dn_has_extended: bool (struct ldb_dn *) >+ldb_dn_is_null: bool (struct ldb_dn *) >+ldb_dn_is_special: bool (struct ldb_dn *) >+ldb_dn_is_valid: bool (struct ldb_dn *) >+ldb_dn_map_local: struct ldb_dn *(struct ldb_module *, void *, struct ldb_dn *) >+ldb_dn_map_rebase_remote: struct ldb_dn *(struct ldb_module *, void *, struct ldb_dn *) >+ldb_dn_map_remote: struct ldb_dn *(struct ldb_module *, void *, struct ldb_dn *) >+ldb_dn_minimise: bool (struct ldb_dn *) >+ldb_dn_new: struct ldb_dn *(TALLOC_CTX *, struct ldb_context *, const char *) >+ldb_dn_new_fmt: struct ldb_dn *(TALLOC_CTX *, struct ldb_context *, const char *, ...) >+ldb_dn_remove_base_components: bool (struct ldb_dn *, unsigned int) >+ldb_dn_remove_child_components: bool (struct ldb_dn *, unsigned int) >+ldb_dn_remove_extended_components: void (struct ldb_dn *) >+ldb_dn_replace_components: bool (struct ldb_dn *, struct ldb_dn *) >+ldb_dn_set_component: int (struct ldb_dn *, int, const char *, const struct ldb_val) >+ldb_dn_set_extended_component: int (struct ldb_dn *, const char *, const struct ldb_val *) >+ldb_dn_update_components: int (struct ldb_dn *, const struct ldb_dn *) >+ldb_dn_validate: bool (struct ldb_dn *) >+ldb_dump_results: void (struct ldb_context *, struct ldb_result *, FILE *) >+ldb_error_at: int (struct ldb_context *, int, const char *, const char *, int) >+ldb_errstring: const char *(struct ldb_context *) >+ldb_extended: int (struct ldb_context *, const char *, void *, struct ldb_result **) >+ldb_extended_default_callback: int (struct ldb_request *, struct ldb_reply *) >+ldb_filter_attrs: int (struct ldb_context *, const struct ldb_message *, const char * const *, struct ldb_message *) >+ldb_filter_from_tree: char *(TALLOC_CTX *, const struct ldb_parse_tree *) >+ldb_get_config_basedn: struct ldb_dn *(struct ldb_context *) >+ldb_get_create_perms: unsigned int (struct ldb_context *) >+ldb_get_default_basedn: struct ldb_dn *(struct ldb_context *) >+ldb_get_event_context: struct tevent_context *(struct ldb_context *) >+ldb_get_flags: unsigned int (struct ldb_context *) >+ldb_get_opaque: void *(struct ldb_context *, const char *) >+ldb_get_root_basedn: struct ldb_dn *(struct ldb_context *) >+ldb_get_schema_basedn: struct ldb_dn *(struct ldb_context *) >+ldb_global_init: int (void) >+ldb_handle_get_event_context: struct tevent_context *(struct ldb_handle *) >+ldb_handle_new: struct ldb_handle *(TALLOC_CTX *, struct ldb_context *) >+ldb_handle_use_global_event_context: void (struct ldb_handle *) >+ldb_handler_copy: int (struct ldb_context *, void *, const struct ldb_val *, struct ldb_val *) >+ldb_handler_fold: int (struct ldb_context *, void *, const struct ldb_val *, struct ldb_val *) >+ldb_init: struct ldb_context *(TALLOC_CTX *, struct tevent_context *) >+ldb_ldif_message_redacted_string: char *(struct ldb_context *, TALLOC_CTX *, enum ldb_changetype, const struct ldb_message *) >+ldb_ldif_message_string: char *(struct ldb_context *, TALLOC_CTX *, enum ldb_changetype, const struct ldb_message *) >+ldb_ldif_parse_modrdn: int (struct ldb_context *, const struct ldb_ldif *, TALLOC_CTX *, struct ldb_dn **, struct ldb_dn **, bool *, struct ldb_dn **, struct ldb_dn **) >+ldb_ldif_read: struct ldb_ldif *(struct ldb_context *, int (*)(void *), void *) >+ldb_ldif_read_file: struct ldb_ldif *(struct ldb_context *, FILE *) >+ldb_ldif_read_file_state: struct ldb_ldif *(struct ldb_context *, struct ldif_read_file_state *) >+ldb_ldif_read_free: void (struct ldb_context *, struct ldb_ldif *) >+ldb_ldif_read_string: struct ldb_ldif *(struct ldb_context *, const char **) >+ldb_ldif_write: int (struct ldb_context *, int (*)(void *, const char *, ...), void *, const struct ldb_ldif *) >+ldb_ldif_write_file: int (struct ldb_context *, FILE *, const struct ldb_ldif *) >+ldb_ldif_write_redacted_trace_string: char *(struct ldb_context *, TALLOC_CTX *, const struct ldb_ldif *) >+ldb_ldif_write_string: char *(struct ldb_context *, TALLOC_CTX *, const struct ldb_ldif *) >+ldb_load_modules: int (struct ldb_context *, const char **) >+ldb_map_add: int (struct ldb_module *, struct ldb_request *) >+ldb_map_delete: int (struct ldb_module *, struct ldb_request *) >+ldb_map_init: int (struct ldb_module *, const struct ldb_map_attribute *, const struct ldb_map_objectclass *, const char * const *, const char *, const char *) >+ldb_map_modify: int (struct ldb_module *, struct ldb_request *) >+ldb_map_rename: int (struct ldb_module *, struct ldb_request *) >+ldb_map_search: int (struct ldb_module *, struct ldb_request *) >+ldb_match_message: int (struct ldb_context *, const struct ldb_message *, const struct ldb_parse_tree *, enum ldb_scope, bool *) >+ldb_match_msg: int (struct ldb_context *, const struct ldb_message *, const struct ldb_parse_tree *, struct ldb_dn *, enum ldb_scope) >+ldb_match_msg_error: int (struct ldb_context *, const struct ldb_message *, const struct ldb_parse_tree *, struct ldb_dn *, enum ldb_scope, bool *) >+ldb_match_msg_objectclass: int (const struct ldb_message *, const char *) >+ldb_mod_register_control: int (struct ldb_module *, const char *) >+ldb_modify: int (struct ldb_context *, const struct ldb_message *) >+ldb_modify_default_callback: int (struct ldb_request *, struct ldb_reply *) >+ldb_module_call_chain: char *(struct ldb_request *, TALLOC_CTX *) >+ldb_module_connect_backend: int (struct ldb_context *, const char *, const char **, struct ldb_module **) >+ldb_module_done: int (struct ldb_request *, struct ldb_control **, struct ldb_extended *, int) >+ldb_module_flags: uint32_t (struct ldb_context *) >+ldb_module_get_ctx: struct ldb_context *(struct ldb_module *) >+ldb_module_get_name: const char *(struct ldb_module *) >+ldb_module_get_ops: const struct ldb_module_ops *(struct ldb_module *) >+ldb_module_get_private: void *(struct ldb_module *) >+ldb_module_init_chain: int (struct ldb_context *, struct ldb_module *) >+ldb_module_load_list: int (struct ldb_context *, const char **, struct ldb_module *, struct ldb_module **) >+ldb_module_new: struct ldb_module *(TALLOC_CTX *, struct ldb_context *, const char *, const struct ldb_module_ops *) >+ldb_module_next: struct ldb_module *(struct ldb_module *) >+ldb_module_popt_options: struct poptOption **(struct ldb_context *) >+ldb_module_send_entry: int (struct ldb_request *, struct ldb_message *, struct ldb_control **) >+ldb_module_send_referral: int (struct ldb_request *, char *) >+ldb_module_set_next: void (struct ldb_module *, struct ldb_module *) >+ldb_module_set_private: void (struct ldb_module *, void *) >+ldb_modules_hook: int (struct ldb_context *, enum ldb_module_hook_type) >+ldb_modules_list_from_string: const char **(struct ldb_context *, TALLOC_CTX *, const char *) >+ldb_modules_load: int (const char *, const char *) >+ldb_msg_add: int (struct ldb_message *, const struct ldb_message_element *, int) >+ldb_msg_add_empty: int (struct ldb_message *, const char *, int, struct ldb_message_element **) >+ldb_msg_add_fmt: int (struct ldb_message *, const char *, const char *, ...) >+ldb_msg_add_linearized_dn: int (struct ldb_message *, const char *, struct ldb_dn *) >+ldb_msg_add_steal_string: int (struct ldb_message *, const char *, char *) >+ldb_msg_add_steal_value: int (struct ldb_message *, const char *, struct ldb_val *) >+ldb_msg_add_string: int (struct ldb_message *, const char *, const char *) >+ldb_msg_add_value: int (struct ldb_message *, const char *, const struct ldb_val *, struct ldb_message_element **) >+ldb_msg_canonicalize: struct ldb_message *(struct ldb_context *, const struct ldb_message *) >+ldb_msg_check_string_attribute: int (const struct ldb_message *, const char *, const char *) >+ldb_msg_copy: struct ldb_message *(TALLOC_CTX *, const struct ldb_message *) >+ldb_msg_copy_attr: int (struct ldb_message *, const char *, const char *) >+ldb_msg_copy_shallow: struct ldb_message *(TALLOC_CTX *, const struct ldb_message *) >+ldb_msg_diff: struct ldb_message *(struct ldb_context *, struct ldb_message *, struct ldb_message *) >+ldb_msg_difference: int (struct ldb_context *, TALLOC_CTX *, struct ldb_message *, struct ldb_message *, struct ldb_message **) >+ldb_msg_element_compare: int (struct ldb_message_element *, struct ldb_message_element *) >+ldb_msg_element_compare_name: int (struct ldb_message_element *, struct ldb_message_element *) >+ldb_msg_element_equal_ordered: bool (const struct ldb_message_element *, const struct ldb_message_element *) >+ldb_msg_find_attr_as_bool: int (const struct ldb_message *, const char *, int) >+ldb_msg_find_attr_as_dn: struct ldb_dn *(struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, const char *) >+ldb_msg_find_attr_as_double: double (const struct ldb_message *, const char *, double) >+ldb_msg_find_attr_as_int: int (const struct ldb_message *, const char *, int) >+ldb_msg_find_attr_as_int64: int64_t (const struct ldb_message *, const char *, int64_t) >+ldb_msg_find_attr_as_string: const char *(const struct ldb_message *, const char *, const char *) >+ldb_msg_find_attr_as_uint: unsigned int (const struct ldb_message *, const char *, unsigned int) >+ldb_msg_find_attr_as_uint64: uint64_t (const struct ldb_message *, const char *, uint64_t) >+ldb_msg_find_common_values: int (struct ldb_context *, TALLOC_CTX *, struct ldb_message_element *, struct ldb_message_element *, uint32_t) >+ldb_msg_find_duplicate_val: int (struct ldb_context *, TALLOC_CTX *, const struct ldb_message_element *, struct ldb_val **, uint32_t) >+ldb_msg_find_element: struct ldb_message_element *(const struct ldb_message *, const char *) >+ldb_msg_find_ldb_val: const struct ldb_val *(const struct ldb_message *, const char *) >+ldb_msg_find_val: struct ldb_val *(const struct ldb_message_element *, struct ldb_val *) >+ldb_msg_new: struct ldb_message *(TALLOC_CTX *) >+ldb_msg_normalize: int (struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, struct ldb_message **) >+ldb_msg_remove_attr: void (struct ldb_message *, const char *) >+ldb_msg_remove_element: void (struct ldb_message *, struct ldb_message_element *) >+ldb_msg_rename_attr: int (struct ldb_message *, const char *, const char *) >+ldb_msg_sanity_check: int (struct ldb_context *, const struct ldb_message *) >+ldb_msg_sort_elements: void (struct ldb_message *) >+ldb_next_del_trans: int (struct ldb_module *) >+ldb_next_end_trans: int (struct ldb_module *) >+ldb_next_init: int (struct ldb_module *) >+ldb_next_prepare_commit: int (struct ldb_module *) >+ldb_next_read_lock: int (struct ldb_module *) >+ldb_next_read_unlock: int (struct ldb_module *) >+ldb_next_remote_request: int (struct ldb_module *, struct ldb_request *) >+ldb_next_request: int (struct ldb_module *, struct ldb_request *) >+ldb_next_start_trans: int (struct ldb_module *) >+ldb_op_default_callback: int (struct ldb_request *, struct ldb_reply *) >+ldb_options_copy: const char **(TALLOC_CTX *, const char **) >+ldb_options_find: const char *(struct ldb_context *, const char **, const char *) >+ldb_options_get: const char **(struct ldb_context *) >+ldb_pack_data: int (struct ldb_context *, const struct ldb_message *, struct ldb_val *, uint32_t) >+ldb_parse_control_from_string: struct ldb_control *(struct ldb_context *, TALLOC_CTX *, const char *) >+ldb_parse_control_strings: struct ldb_control **(struct ldb_context *, TALLOC_CTX *, const char **) >+ldb_parse_tree: struct ldb_parse_tree *(TALLOC_CTX *, const char *) >+ldb_parse_tree_attr_replace: void (struct ldb_parse_tree *, const char *, const char *) >+ldb_parse_tree_copy_shallow: struct ldb_parse_tree *(TALLOC_CTX *, const struct ldb_parse_tree *) >+ldb_parse_tree_walk: int (struct ldb_parse_tree *, int (*)(struct ldb_parse_tree *, void *), void *) >+ldb_qsort: void (void * const, size_t, size_t, void *, ldb_qsort_cmp_fn_t) >+ldb_register_backend: int (const char *, ldb_connect_fn, bool) >+ldb_register_extended_match_rule: int (struct ldb_context *, const struct ldb_extended_match_rule *) >+ldb_register_hook: int (ldb_hook_fn) >+ldb_register_module: int (const struct ldb_module_ops *) >+ldb_rename: int (struct ldb_context *, struct ldb_dn *, struct ldb_dn *) >+ldb_reply_add_control: int (struct ldb_reply *, const char *, bool, void *) >+ldb_reply_get_control: struct ldb_control *(struct ldb_reply *, const char *) >+ldb_req_get_custom_flags: uint32_t (struct ldb_request *) >+ldb_req_is_untrusted: bool (struct ldb_request *) >+ldb_req_location: const char *(struct ldb_request *) >+ldb_req_mark_trusted: void (struct ldb_request *) >+ldb_req_mark_untrusted: void (struct ldb_request *) >+ldb_req_set_custom_flags: void (struct ldb_request *, uint32_t) >+ldb_req_set_location: void (struct ldb_request *, const char *) >+ldb_request: int (struct ldb_context *, struct ldb_request *) >+ldb_request_add_control: int (struct ldb_request *, const char *, bool, void *) >+ldb_request_done: int (struct ldb_request *, int) >+ldb_request_get_control: struct ldb_control *(struct ldb_request *, const char *) >+ldb_request_get_status: int (struct ldb_request *) >+ldb_request_replace_control: int (struct ldb_request *, const char *, bool, void *) >+ldb_request_set_state: void (struct ldb_request *, int) >+ldb_reset_err_string: void (struct ldb_context *) >+ldb_save_controls: int (struct ldb_control *, struct ldb_request *, struct ldb_control ***) >+ldb_schema_attribute_add: int (struct ldb_context *, const char *, unsigned int, const char *) >+ldb_schema_attribute_add_with_syntax: int (struct ldb_context *, const char *, unsigned int, const struct ldb_schema_syntax *) >+ldb_schema_attribute_by_name: const struct ldb_schema_attribute *(struct ldb_context *, const char *) >+ldb_schema_attribute_fill_with_syntax: int (struct ldb_context *, TALLOC_CTX *, const char *, unsigned int, const struct ldb_schema_syntax *, struct ldb_schema_attribute *) >+ldb_schema_attribute_remove: void (struct ldb_context *, const char *) >+ldb_schema_attribute_remove_flagged: void (struct ldb_context *, unsigned int) >+ldb_schema_attribute_set_override_handler: void (struct ldb_context *, ldb_attribute_handler_override_fn_t, void *) >+ldb_schema_set_override_GUID_index: void (struct ldb_context *, const char *, const char *) >+ldb_schema_set_override_indexlist: void (struct ldb_context *, bool) >+ldb_search: int (struct ldb_context *, TALLOC_CTX *, struct ldb_result **, struct ldb_dn *, enum ldb_scope, const char * const *, const char *, ...) >+ldb_search_default_callback: int (struct ldb_request *, struct ldb_reply *) >+ldb_sequence_number: int (struct ldb_context *, enum ldb_sequence_type, uint64_t *) >+ldb_set_create_perms: void (struct ldb_context *, unsigned int) >+ldb_set_debug: int (struct ldb_context *, void (*)(void *, enum ldb_debug_level, const char *, va_list), void *) >+ldb_set_debug_stderr: int (struct ldb_context *) >+ldb_set_default_dns: void (struct ldb_context *) >+ldb_set_errstring: void (struct ldb_context *, const char *) >+ldb_set_event_context: void (struct ldb_context *, struct tevent_context *) >+ldb_set_flags: void (struct ldb_context *, unsigned int) >+ldb_set_modules_dir: void (struct ldb_context *, const char *) >+ldb_set_opaque: int (struct ldb_context *, const char *, void *) >+ldb_set_require_private_event_context: void (struct ldb_context *) >+ldb_set_timeout: int (struct ldb_context *, struct ldb_request *, int) >+ldb_set_timeout_from_prev_req: int (struct ldb_context *, struct ldb_request *, struct ldb_request *) >+ldb_set_utf8_default: void (struct ldb_context *) >+ldb_set_utf8_fns: void (struct ldb_context *, void *, char *(*)(void *, void *, const char *, size_t)) >+ldb_setup_wellknown_attributes: int (struct ldb_context *) >+ldb_should_b64_encode: int (struct ldb_context *, const struct ldb_val *) >+ldb_standard_syntax_by_name: const struct ldb_schema_syntax *(struct ldb_context *, const char *) >+ldb_strerror: const char *(int) >+ldb_string_to_time: time_t (const char *) >+ldb_string_utc_to_time: time_t (const char *) >+ldb_timestring: char *(TALLOC_CTX *, time_t) >+ldb_timestring_utc: char *(TALLOC_CTX *, time_t) >+ldb_transaction_cancel: int (struct ldb_context *) >+ldb_transaction_cancel_noerr: int (struct ldb_context *) >+ldb_transaction_commit: int (struct ldb_context *) >+ldb_transaction_prepare_commit: int (struct ldb_context *) >+ldb_transaction_start: int (struct ldb_context *) >+ldb_unpack_data: int (struct ldb_context *, const struct ldb_val *, struct ldb_message *) >+ldb_unpack_data_flags: int (struct ldb_context *, const struct ldb_val *, struct ldb_message *, unsigned int) >+ldb_unpack_get_format: int (const struct ldb_val *, uint32_t *) >+ldb_val_dup: struct ldb_val (TALLOC_CTX *, const struct ldb_val *) >+ldb_val_equal_exact: int (const struct ldb_val *, const struct ldb_val *) >+ldb_val_map_local: struct ldb_val (struct ldb_module *, void *, const struct ldb_map_attribute *, const struct ldb_val *) >+ldb_val_map_remote: struct ldb_val (struct ldb_module *, void *, const struct ldb_map_attribute *, const struct ldb_val *) >+ldb_val_string_cmp: int (const struct ldb_val *, const char *) >+ldb_val_to_time: int (const struct ldb_val *, time_t *) >+ldb_valid_attr_name: int (const char *) >+ldb_vdebug: void (struct ldb_context *, enum ldb_debug_level, const char *, va_list) >+ldb_wait: int (struct ldb_handle *, enum ldb_wait_type) >diff --git a/lib/ldb/ABI/pyldb-util-2.2.2.sigs b/lib/ldb/ABI/pyldb-util-2.2.2.sigs >new file mode 100644 >index 00000000000..164a806b2ff >--- /dev/null >+++ b/lib/ldb/ABI/pyldb-util-2.2.2.sigs >@@ -0,0 +1,3 @@ >+pyldb_Dn_FromDn: PyObject *(struct ldb_dn *) >+pyldb_Object_AsDn: bool (TALLOC_CTX *, PyObject *, struct ldb_context *, struct ldb_dn **) >+pyldb_check_type: bool (PyObject *, const char *) >diff --git a/lib/ldb/wscript b/lib/ldb/wscript >index 493fd7c5d77..764480b0ff3 100644 >--- a/lib/ldb/wscript >+++ b/lib/ldb/wscript >@@ -1,7 +1,7 @@ > #!/usr/bin/env python > > APPNAME = 'ldb' >-VERSION = '2.1.5' >+VERSION = '2.1.6' > > import sys, os > >-- >2.25.1 > > >From fc04f4908fc08797faf7ddf50a6e75f24bb778c3 Mon Sep 17 00:00:00 2001 >From: David Mulder <dmulder@suse.com> >Date: Mon, 14 Sep 2020 11:12:37 -0600 >Subject: [PATCH 224/380] python: Move dsdb_Dn to samdb > >The import dsdb needed for dsdb_Dn causes import >errors when trying to import get_bytes/get_string >in some places. > >Signed-off-by: David Mulder <dmulder@suse.com> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >[abartlet@samba.org backported from commit 85d2ff2f0003b106ca84866b7e7893723f1dd93c > as the PY2 compat code is still in place in Samba 4.13] >--- > python/samba/common.py | 79 ------------------------- > python/samba/dbchecker.py | 2 +- > python/samba/kcc/kcc_utils.py | 2 +- > python/samba/kcc/ldif_import_export.py | 3 +- > python/samba/samdb.py | 75 +++++++++++++++++++++++ > python/samba/tests/common.py | 4 +- > source4/torture/drs/python/repl_rodc.py | 2 +- > 7 files changed, 81 insertions(+), 86 deletions(-) > >diff --git a/python/samba/common.py b/python/samba/common.py >index 8876e4f4faa..a8faa90065d 100644 >--- a/python/samba/common.py >+++ b/python/samba/common.py >@@ -16,13 +16,6 @@ > # along with this program. If not, see <http://www.gnu.org/licenses/>. > # > >- >-import ldb >-from samba import dsdb >-from samba.ndr import ndr_pack >-from samba.dcerpc import misc >-import binascii >- > from samba.compat import PY3 > > >@@ -74,75 +67,3 @@ def normalise_int32(ivalue): > return str(ivalue) > > >-class dsdb_Dn(object): >- '''a class for binary DN''' >- >- def __init__(self, samdb, dnstring, syntax_oid=None): >- '''create a dsdb_Dn''' >- if syntax_oid is None: >- # auto-detect based on string >- if dnstring.startswith("B:"): >- syntax_oid = dsdb.DSDB_SYNTAX_BINARY_DN >- elif dnstring.startswith("S:"): >- syntax_oid = dsdb.DSDB_SYNTAX_STRING_DN >- else: >- syntax_oid = dsdb.DSDB_SYNTAX_OR_NAME >- if syntax_oid in [dsdb.DSDB_SYNTAX_BINARY_DN, dsdb.DSDB_SYNTAX_STRING_DN]: >- # it is a binary DN >- colons = dnstring.split(':') >- if len(colons) < 4: >- raise RuntimeError("Invalid DN %s" % dnstring) >- prefix_len = 4 + len(colons[1]) + int(colons[1]) >- self.prefix = dnstring[0:prefix_len] >- self.binary = self.prefix[3 + len(colons[1]):-1] >- self.dnstring = dnstring[prefix_len:] >- else: >- self.dnstring = dnstring >- self.prefix = '' >- self.binary = '' >- self.dn = ldb.Dn(samdb, self.dnstring) >- >- def __str__(self): >- return self.prefix + str(self.dn.extended_str(mode=1)) >- >- def __cmp__(self, other): >- ''' compare dsdb_Dn values similar to parsed_dn_compare()''' >- dn1 = self >- dn2 = other >- guid1 = dn1.dn.get_extended_component("GUID") >- guid2 = dn2.dn.get_extended_component("GUID") >- >- v = cmp(guid1, guid2) >- if v != 0: >- return v >- v = cmp(dn1.binary, dn2.binary) >- return v >- >- # In Python3, __cmp__ is replaced by these 6 methods >- def __eq__(self, other): >- return self.__cmp__(other) == 0 >- >- def __ne__(self, other): >- return self.__cmp__(other) != 0 >- >- def __lt__(self, other): >- return self.__cmp__(other) < 0 >- >- def __le__(self, other): >- return self.__cmp__(other) <= 0 >- >- def __gt__(self, other): >- return self.__cmp__(other) > 0 >- >- def __ge__(self, other): >- return self.__cmp__(other) >= 0 >- >- def get_binary_integer(self): >- '''return binary part of a dsdb_Dn as an integer, or None''' >- if self.prefix == '': >- return None >- return int(self.binary, 16) >- >- def get_bytes(self): >- '''return binary as a byte string''' >- return binascii.unhexlify(self.binary) >diff --git a/python/samba/dbchecker.py b/python/samba/dbchecker.py >index 593aa8cf6d2..a50880da497 100644 >--- a/python/samba/dbchecker.py >+++ b/python/samba/dbchecker.py >@@ -28,7 +28,7 @@ from samba.dcerpc import misc > from samba.dcerpc import drsuapi > from samba.ndr import ndr_unpack, ndr_pack > from samba.dcerpc import drsblobs >-from samba.common import dsdb_Dn >+from samba.samdb import dsdb_Dn > from samba.dcerpc import security > from samba.descriptor import get_wellknown_sds, get_diff_sds > from samba.auth import system_session, admin_session >diff --git a/python/samba/kcc/kcc_utils.py b/python/samba/kcc/kcc_utils.py >index e0712e49c82..9b4a894b743 100644 >--- a/python/samba/kcc/kcc_utils.py >+++ b/python/samba/kcc/kcc_utils.py >@@ -30,7 +30,7 @@ from samba.dcerpc import ( > drsuapi, > misc, > ) >-from samba.common import dsdb_Dn >+from samba.samdb import dsdb_Dn > from samba.ndr import ndr_unpack, ndr_pack > from collections import Counter > >diff --git a/python/samba/kcc/ldif_import_export.py b/python/samba/kcc/ldif_import_export.py >index 86453f1e5c9..7ec553edcb9 100644 >--- a/python/samba/kcc/ldif_import_export.py >+++ b/python/samba/kcc/ldif_import_export.py >@@ -23,8 +23,7 @@ import os > > from samba import Ldb, ldb, read_and_sub_file > from samba.auth import system_session >-from samba.samdb import SamDB >-from samba.common import dsdb_Dn >+from samba.samdb import SamDB, dsdb_Dn > > > class LdifError(Exception): >diff --git a/python/samba/samdb.py b/python/samba/samdb.py >index e4030099b5c..47310f716f6 100644 >--- a/python/samba/samdb.py >+++ b/python/samba/samdb.py >@@ -35,7 +35,9 @@ from samba.common import normalise_int32 > from samba.compat import text_type > from samba.compat import binary_type > from samba.compat import get_bytes >+from samba.common import cmp > from samba.dcerpc import security >+import binascii > > __docformat__ = "restructuredText" > >@@ -1317,3 +1319,76 @@ schemaUpdateNow: 1 > if not full_dn.is_child_of(domain_dn): > full_dn.add_base(domain_dn) > return full_dn >+ >+class dsdb_Dn(object): >+ '''a class for binary DN''' >+ >+ def __init__(self, samdb, dnstring, syntax_oid=None): >+ '''create a dsdb_Dn''' >+ if syntax_oid is None: >+ # auto-detect based on string >+ if dnstring.startswith("B:"): >+ syntax_oid = dsdb.DSDB_SYNTAX_BINARY_DN >+ elif dnstring.startswith("S:"): >+ syntax_oid = dsdb.DSDB_SYNTAX_STRING_DN >+ else: >+ syntax_oid = dsdb.DSDB_SYNTAX_OR_NAME >+ if syntax_oid in [dsdb.DSDB_SYNTAX_BINARY_DN, dsdb.DSDB_SYNTAX_STRING_DN]: >+ # it is a binary DN >+ colons = dnstring.split(':') >+ if len(colons) < 4: >+ raise RuntimeError("Invalid DN %s" % dnstring) >+ prefix_len = 4 + len(colons[1]) + int(colons[1]) >+ self.prefix = dnstring[0:prefix_len] >+ self.binary = self.prefix[3 + len(colons[1]):-1] >+ self.dnstring = dnstring[prefix_len:] >+ else: >+ self.dnstring = dnstring >+ self.prefix = '' >+ self.binary = '' >+ self.dn = ldb.Dn(samdb, self.dnstring) >+ >+ def __str__(self): >+ return self.prefix + str(self.dn.extended_str(mode=1)) >+ >+ def __cmp__(self, other): >+ ''' compare dsdb_Dn values similar to parsed_dn_compare()''' >+ dn1 = self >+ dn2 = other >+ guid1 = dn1.dn.get_extended_component("GUID") >+ guid2 = dn2.dn.get_extended_component("GUID") >+ >+ v = cmp(guid1, guid2) >+ if v != 0: >+ return v >+ v = cmp(dn1.binary, dn2.binary) >+ return v >+ >+ # In Python3, __cmp__ is replaced by these 6 methods >+ def __eq__(self, other): >+ return self.__cmp__(other) == 0 >+ >+ def __ne__(self, other): >+ return self.__cmp__(other) != 0 >+ >+ def __lt__(self, other): >+ return self.__cmp__(other) < 0 >+ >+ def __le__(self, other): >+ return self.__cmp__(other) <= 0 >+ >+ def __gt__(self, other): >+ return self.__cmp__(other) > 0 >+ >+ def __ge__(self, other): >+ return self.__cmp__(other) >= 0 >+ >+ def get_binary_integer(self): >+ '''return binary part of a dsdb_Dn as an integer, or None''' >+ if self.prefix == '': >+ return None >+ return int(self.binary, 16) >+ >+ def get_bytes(self): >+ '''return binary as a byte string''' >+ return binascii.unhexlify(self.binary) >diff --git a/python/samba/tests/common.py b/python/samba/tests/common.py >index 13f3ba2bc7a..2b7d22fd629 100644 >--- a/python/samba/tests/common.py >+++ b/python/samba/tests/common.py >@@ -20,8 +20,8 @@ > import samba > import os > import samba.tests >-from samba.common import normalise_int32, dsdb_Dn >-from samba.samdb import SamDB >+from samba.common import normalise_int32 >+from samba.samdb import SamDB, dsdb_Dn > > > class CommonTests(samba.tests.TestCaseInTempDir): >diff --git a/source4/torture/drs/python/repl_rodc.py b/source4/torture/drs/python/repl_rodc.py >index 8e2b2ef51cf..f27f02814af 100644 >--- a/source4/torture/drs/python/repl_rodc.py >+++ b/source4/torture/drs/python/repl_rodc.py >@@ -37,7 +37,7 @@ from samba.join import DCJoinContext > from samba.dcerpc import drsuapi, misc, drsblobs, security > from samba.drs_utils import drs_DsBind, drs_Replicate > from samba.ndr import ndr_unpack, ndr_pack >-from samba.common import dsdb_Dn >+from samba.samdb import dsdb_Dn > from samba.credentials import Credentials > > import random >-- >2.25.1 > > >From bf59fb5bd25de6dbfbcbc6ea0cb949791452e6d1 Mon Sep 17 00:00:00 2001 >From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >Date: Thu, 11 Oct 2018 13:08:38 +1300 >Subject: [PATCH 225/380] python/join: use the provided krbtgt link in > cleanup_old_accounts > >Before we were putting it in an otherwise unused variable, and >deleting the previous krbtgt_dn, if any. > >Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >Reviewed-by: Andreas Schneider <asn@samba.org> >Reviewed-by: David Mulder <dmulder@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 98f6ece5ad03a822180796873197383c17c3c6d9) >--- > python/samba/join.py | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/python/samba/join.py b/python/samba/join.py >index 40920f4f8e5..0cffa3055df 100644 >--- a/python/samba/join.py >+++ b/python/samba/join.py >@@ -259,7 +259,7 @@ class DCJoinContext(object): > ctx.del_noerror(res[0].dn, recursive=True) > > if "msDS-Krbtgtlink" in res[0]: >- new_krbtgt_dn = res[0]["msDS-Krbtgtlink"][0] >+ ctx.new_krbtgt_dn = res[0]["msDS-Krbtgtlink"][0] > ctx.del_noerror(ctx.new_krbtgt_dn) > > res = ctx.samdb.search(base=ctx.samdb.get_default_basedn(), >-- >2.25.1 > > >From cb940a25370b53cfcedea4dc74886209037be84c Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Fri, 17 Sep 2021 16:43:00 +1200 >Subject: [PATCH 226/380] autobuild: allow AUTOBUILD_FAIL_IMMEDIATELY=0 (say > from a gitlab variable) > >This allows making a push to do a full test ignoring errors without >needing "HACK!!!" commits on top. > >Use like this: > >git push -o ci.variable='AUTOBUILD_FAIL_IMMEDIATELY=0' > >RN: Samba CI runs can now continue past the first error if AUTOBUILD_FAIL_IMMEDIATELY=0 is set > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14841 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Michael Adam <obnox@samba.org >Reviewed-by: Noel Power <npower@samba.org> > >[abartlet@samba.org backported from commit b81f6f3d71487085bb355392ce7f8eff2db5bb4d > due to changes in 4.15 and later for the autobuild dependent jobs work > that avoids rebuilding Samba in each task] > >Autobuild-User(v4-14-test): Jule Anger <janger@samba.org> >Autobuild-Date(v4-14-test): Thu Sep 23 08:54:03 UTC 2021 on sn-devel-184 > >(cherry picked from commit f53c532c2292d07ab3374920bd83c1266663038e) >--- > script/autobuild.py | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > >diff --git a/script/autobuild.py b/script/autobuild.py >index b1a1b4800d1..cc34a5e2cc0 100755 >--- a/script/autobuild.py >+++ b/script/autobuild.py >@@ -153,7 +153,6 @@ def format_option(name, value=None): > > def make_test( > cmd='make test', >- FAIL_IMMEDIATELY=1, > TESTS='', > include_envs=None, > exclude_envs=None): >@@ -168,7 +167,13 @@ def make_test( > TESTS = (TESTS + ' ' + ' '.join(test_options)).strip() > > _options = [] >- if FAIL_IMMEDIATELY: >+ >+ # Allow getting a full CI with >+ # git push -o ci.variable='AUTOBUILD_FAIL_IMMEDIATELY=0' >+ >+ FAIL_IMMEDIATELY = os.getenv("AUTOBUILD_FAIL_IMMEDIATELY", "1") >+ >+ if int(FAIL_IMMEDIATELY): > _options.append('FAIL_IMMEDIATELY=1') > if TESTS: > _options.append("TESTS='{}'".format(TESTS)) >-- >2.25.1 > > >From 6d6846c91b5821e4140740fab2ea62e9767ee3f5 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 15:39:19 +1200 >Subject: [PATCH 227/380] krb5pac.idl: Add ticket checksum PAC buffer type > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit ff2f38fae79220e16765e17671972f9a55eb7cce) >--- > librpc/idl/krb5pac.idl | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > >diff --git a/librpc/idl/krb5pac.idl b/librpc/idl/krb5pac.idl >index fb360c1257f..3239d7656b6 100644 >--- a/librpc/idl/krb5pac.idl >+++ b/librpc/idl/krb5pac.idl >@@ -112,7 +112,8 @@ interface krb5pac > PAC_TYPE_KDC_CHECKSUM = 7, > PAC_TYPE_LOGON_NAME = 10, > PAC_TYPE_CONSTRAINED_DELEGATION = 11, >- PAC_TYPE_UPN_DNS_INFO = 12 >+ PAC_TYPE_UPN_DNS_INFO = 12, >+ PAC_TYPE_TICKET_CHECKSUM = 16 > } PAC_TYPE; > > typedef struct { >@@ -128,6 +129,7 @@ interface krb5pac > [case(PAC_TYPE_CONSTRAINED_DELEGATION)][subcontext(0xFFFFFC01)] > PAC_CONSTRAINED_DELEGATION_CTR constrained_delegation; > [case(PAC_TYPE_UPN_DNS_INFO)] PAC_UPN_DNS_INFO upn_dns_info; >+ [case(PAC_TYPE_TICKET_CHECKSUM)] PAC_SIGNATURE_DATA ticket_checksum; > /* when new PAC info types are added they are supposed to be done > in such a way that they are backwards compatible with existing > servers. This makes it safe to just use a [default] for >-- >2.25.1 > > >From f839c90c34cc4a410c711702f7561fb329138ca5 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 15:40:59 +1200 >Subject: [PATCH 228/380] security.idl: Add well-known SIDs for FAST > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 0092b4a3ed58b2c256d4dd9117cce927a3edde12) >--- > librpc/idl/security.idl | 3 +++ > 1 file changed, 3 insertions(+) > >diff --git a/librpc/idl/security.idl b/librpc/idl/security.idl >index a92e8f1518e..9845becd826 100644 >--- a/librpc/idl/security.idl >+++ b/librpc/idl/security.idl >@@ -292,6 +292,9 @@ interface security > const string SID_AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITY = "S-1-18-1"; > const string SID_SERVICE_ASSERTED_IDENTITY = "S-1-18-2"; > >+ const string SID_COMPOUNDED_AUTHENTICATION = "S-1-5-21-0-0-0-496"; >+ const string SID_CLAIMS_VALID = "S-1-5-21-0-0-0-497"; >+ > /* > * http://technet.microsoft.com/en-us/library/hh509017(v=ws.10).aspx > */ >-- >2.25.1 > > >From 79591fd7374d76c98adfc27f95d3c9aaa09a82f1 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 15:46:42 +1200 >Subject: [PATCH 229/380] tests/krb5: Calculate expected salt if not given > explicitly > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit c6badf818e9db44461979a931c74fc5ab6e80132) >--- > python/samba/tests/krb5/as_req_tests.py | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 82ff3f4845c..09160bf6814 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -74,7 +74,7 @@ class AsReqKerberosTests(KDCBaseTest): > expected_cname = cname > expected_srealm = realm > expected_sname = sname >- expected_salt = client_creds.get_forced_salt() >+ expected_salt = client_creds.get_salt() > > if any(etype in client_as_etypes and etype in initial_etypes > for etype in (kcrypto.Enctype.AES256, >@@ -142,7 +142,7 @@ class AsReqKerberosTests(KDCBaseTest): > expected_cname = cname > expected_srealm = realm > expected_sname = sname >- expected_salt = client_creds.get_forced_salt() >+ expected_salt = client_creds.get_salt() > > till = self.get_KerberosTime(offset=36000) > >-- >2.25.1 > > >From 6801d6bbc7f94a3294c3db653cb090ea2322eedc Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 15:50:26 +1200 >Subject: [PATCH 230/380] tests/krb5: Add methods to obtain the length of > checksum types > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 9924dd976183ea62b08f116f8b8bacc698bb9b95) >--- > python/samba/tests/krb5/kcrypto.py | 26 ++++++++++++++++++++++++++ > 1 file changed, 26 insertions(+) > >diff --git a/python/samba/tests/krb5/kcrypto.py b/python/samba/tests/krb5/kcrypto.py >index c861e3cc96e..2a72969de00 100755 >--- a/python/samba/tests/krb5/kcrypto.py >+++ b/python/samba/tests/krb5/kcrypto.py >@@ -478,6 +478,7 @@ class _ChecksumProfile(object): > # define: > # * checksum > # * verify (if verification is not just checksum-and-compare) >+ # * checksum_len > @classmethod > def verify(cls, key, keyusage, text, cksum): > expected = cls.checksum(key, keyusage, text) >@@ -504,6 +505,10 @@ class _SimplifiedChecksum(_ChecksumProfile): > raise ValueError('Wrong key type for checksum') > super(_SimplifiedChecksum, cls).verify(key, keyusage, text, cksum) > >+ @classmethod >+ def checksum_len(cls): >+ return cls.macsize >+ > > class _SHA1AES128(_SimplifiedChecksum): > macsize = 12 >@@ -533,6 +538,10 @@ class _HMACMD5(_ChecksumProfile): > raise ValueError('Wrong key type for checksum') > super(_HMACMD5, cls).verify(key, keyusage, text, cksum) > >+ @classmethod >+ def checksum_len(cls): >+ return hashes.MD5.digest_size >+ > > class _MD5(_ChecksumProfile): > @classmethod >@@ -540,6 +549,10 @@ class _MD5(_ChecksumProfile): > # This is unkeyed! > return SIMPLE_HASH(text, hashes.MD5) > >+ @classmethod >+ def checksum_len(cls): >+ return hashes.MD5.digest_size >+ > > class _SHA1(_ChecksumProfile): > @classmethod >@@ -547,6 +560,10 @@ class _SHA1(_ChecksumProfile): > # This is unkeyed! > return SIMPLE_HASH(text, hashes.SHA1) > >+ @classmethod >+ def checksum_len(cls): >+ return hashes.SHA1.digest_size >+ > > class _CRC32(_ChecksumProfile): > @classmethod >@@ -555,6 +572,10 @@ class _CRC32(_ChecksumProfile): > cksum = (~crc32(text, 0xffffffff)) & 0xffffffff > return pack('<I', cksum) > >+ @classmethod >+ def checksum_len(cls): >+ return 4 >+ > > _enctype_table = { > Enctype.DES3: _DES3CBC, >@@ -643,6 +664,11 @@ def verify_checksum(cksumtype, key, keyusage, text, cksum): > c.verify(key, keyusage, text, cksum) > > >+def checksum_len(cksumtype): >+ c = _get_checksum_profile(cksumtype) >+ return c.checksum_len() >+ >+ > def prfplus(key, pepper, ln): > # Produce ln bytes of output using the RFC 6113 PRF+ function. > out = b'' >-- >2.25.1 > > >From 99d5841abfc0e2a3ac1371e017a4b0c8ad29bbe3 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 15:57:26 +1200 >Subject: [PATCH 231/380] tests/krb5: Use signed integers to represent key > version numbers in ASN.1 > >As specified in 'MS-KILE 3.1.5.8: Key Version Numbers', Windows uses >signed 32-bit integers to represent key version numbers. This makes a >difference for an RODC with a msDS-SecondaryKrbTgtNumber greater than >32767, where the kvno should be encoded in four bytes rather than five. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 448b661bf8815a05f534926d8ee8d6f57d123c2c) >--- > python/samba/tests/krb5/raw_testcase.py | 2 +- > python/samba/tests/krb5/rfc4120.asn1 | 2 +- > python/samba/tests/krb5/rfc4120_pyasn1.py | 2 +- > 3 files changed, 3 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 6db17f2a118..c5ee5eb6083 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -995,7 +995,7 @@ class RawKerberosTest(TestCaseInTempDir): > def EncryptedData_create(self, key, usage, plaintext): > # EncryptedData ::= SEQUENCE { > # etype [0] Int32 -- EncryptionType --, >- # kvno [1] UInt32 OPTIONAL, >+ # kvno [1] Int32 OPTIONAL, > # cipher [2] OCTET STRING -- ciphertext > # } > ciphertext = key.encrypt(usage, plaintext) >diff --git a/python/samba/tests/krb5/rfc4120.asn1 b/python/samba/tests/krb5/rfc4120.asn1 >index f47c1d00202..a37011ae932 100644 >--- a/python/samba/tests/krb5/rfc4120.asn1 >+++ b/python/samba/tests/krb5/rfc4120.asn1 >@@ -124,7 +124,7 @@ KerberosFlags ::= BIT STRING (SIZE (1..32)) > > EncryptedData ::= SEQUENCE { > etype [0] EncryptionType, --Int32 EncryptionType -- >- kvno [1] UInt32 OPTIONAL, >+ kvno [1] Int32 OPTIONAL, > cipher [2] OCTET STRING -- ciphertext > } > >diff --git a/python/samba/tests/krb5/rfc4120_pyasn1.py b/python/samba/tests/krb5/rfc4120_pyasn1.py >index 39ec8ed7982..a9e4bcbb18f 100644 >--- a/python/samba/tests/krb5/rfc4120_pyasn1.py >+++ b/python/samba/tests/krb5/rfc4120_pyasn1.py >@@ -120,7 +120,7 @@ class EncryptedData(univ.Sequence): > > EncryptedData.componentType = namedtype.NamedTypes( > namedtype.NamedType('etype', EncryptionType().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), >- namedtype.OptionalNamedType('kvno', UInt32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), >+ namedtype.OptionalNamedType('kvno', Int32().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), > namedtype.NamedType('cipher', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))) > ) > >-- >2.25.1 > > >From 31687e44e7848274f5a5b8c16e2297960d989916 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 16:05:39 +1200 >Subject: [PATCH 232/380] tests/krb5: Add KDCOptions flag for constrained > delegation > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 08086c43987abecc588ebd32ec846ff7e27a83b6) >--- > python/samba/tests/krb5/rfc4120.asn1 | 1 + > python/samba/tests/krb5/rfc4120_pyasn1.py | 1 + > 2 files changed, 2 insertions(+) > >diff --git a/python/samba/tests/krb5/rfc4120.asn1 b/python/samba/tests/krb5/rfc4120.asn1 >index a37011ae932..e0831e1f86f 100644 >--- a/python/samba/tests/krb5/rfc4120.asn1 >+++ b/python/samba/tests/krb5/rfc4120.asn1 >@@ -632,6 +632,7 @@ KDCOptionsValues ::= BIT STRING { -- KerberosFlags > opt-hardware-auth(11), > unused12(12), > unused13(13), >+ cname-in-addl-tkt(14), > -- Canonicalize is used by RFC 6806 > canonicalize(15), > -- 26 was unused in 1510 >diff --git a/python/samba/tests/krb5/rfc4120_pyasn1.py b/python/samba/tests/krb5/rfc4120_pyasn1.py >index a9e4bcbb18f..348dd8c63fb 100644 >--- a/python/samba/tests/krb5/rfc4120_pyasn1.py >+++ b/python/samba/tests/krb5/rfc4120_pyasn1.py >@@ -649,6 +649,7 @@ KDCOptionsValues.namedValues = namedval.NamedValues( > ('opt-hardware-auth', 11), > ('unused12', 12), > ('unused13', 13), >+ ('cname-in-addl-tkt', 14), > ('canonicalize', 15), > ('disable-transited-check', 26), > ('renewable-ok', 27), >-- >2.25.1 > > >From b6953c102c5c7edbb8204134f085bcc39a39158e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 16:21:55 +1200 >Subject: [PATCH 233/380] tests/krb5: Use more compact dict lookup > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 3fd73b65a3db405db5a0a82cca6c808763d4f437) >--- > python/samba/tests/krb5/raw_testcase.py | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index c5ee5eb6083..0ec0f65c6d6 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -305,7 +305,7 @@ class KerberosCredentials(Credentials): > > def get_forced_key(self, etype): > etype = int(etype) >- return self.forced_keys.get(etype, None) >+ return self.forced_keys.get(etype) > > def set_forced_salt(self, salt): > self.forced_salt = bytes(salt) >@@ -830,7 +830,7 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(value) > > def getElementValue(self, obj, elem): >- return obj.get(elem, None) >+ return obj.get(elem) > > def assertElementMissing(self, obj, elem): > v = self.getElementValue(obj, elem) >@@ -942,7 +942,7 @@ class RawKerberosTest(TestCaseInTempDir): > def PasswordKey_from_etype_info2(self, creds, etype_info2, kvno=None): > e = etype_info2['etype'] > >- salt = etype_info2.get('salt', None) >+ salt = etype_info2.get('salt') > > if e == kcrypto.Enctype.RC4: > nthash = creds.get_nt_hash() >-- >2.25.1 > > >From 8aab3b65d7a574d5fce5ced796d4a3eca748c542 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 16:31:56 +1200 >Subject: [PATCH 234/380] tests/krb5: Replace expected_cname_private with > expected_anon parameter > >This is used in the case where the KDC returns 'WELLKNOWN/ANONYMOUS' as >the cname, and makes the reply checking logic easier to follow. This >also removes the need to fetch the client credentials in the test >methods. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit bf55786fcd9a96daa9002661d6f5d9b3502ed8a7) >--- > python/samba/tests/krb5/fast_tests.py | 33 +++++------------------- > python/samba/tests/krb5/raw_testcase.py | 34 ++++++++++++------------- > 2 files changed, 24 insertions(+), 43 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 2d4b69f8590..b371ab617aa 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -49,7 +49,6 @@ from samba.tests.krb5.rfc4120_constants import ( > KU_TICKET, > NT_PRINCIPAL, > NT_SRV_INST, >- NT_WELLKNOWN, > PADATA_FX_COOKIE, > PADATA_FX_FAST, > PADATA_PAC_OPTIONS >@@ -985,14 +984,6 @@ class FAST_Tests(KDCBaseTest): > ]) > > def test_fast_hide_client_names(self): >- user_creds = self.get_client_creds() >- user_name = user_creds.get_username() >- user_cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >- names=[user_name]) >- >- expected_cname = self.PrincipalName_create( >- name_type=NT_WELLKNOWN, names=['WELLKNOWN', 'ANONYMOUS']) >- > self._run_test_sequence([ > { > 'rep_type': KRB_AS_REP, >@@ -1001,7 +992,7 @@ class FAST_Tests(KDCBaseTest): > 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, > 'gen_armor_tgt_fn': self.get_mach_tgt, > 'fast_options': '01', # hide client names >- 'expected_cname': expected_cname >+ 'expected_anon': True > }, > { > 'rep_type': KRB_AS_REP, >@@ -1011,20 +1002,11 @@ class FAST_Tests(KDCBaseTest): > 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, > 'gen_armor_tgt_fn': self.get_mach_tgt, > 'fast_options': '01', # hide client names >- 'expected_cname': expected_cname, >- 'expected_cname_private': user_cname >+ 'expected_anon': True > } > ]) > > def test_fast_tgs_hide_client_names(self): >- user_creds = self.get_client_creds() >- user_name = user_creds.get_username() >- user_cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >- names=[user_name]) >- >- expected_cname = self.PrincipalName_create( >- name_type=NT_WELLKNOWN, names=['WELLKNOWN', 'ANONYMOUS']) >- > self._run_test_sequence([ > { > 'rep_type': KRB_TGS_REP, >@@ -1033,8 +1015,7 @@ class FAST_Tests(KDCBaseTest): > 'gen_tgt_fn': self.get_user_tgt, > 'fast_armor': None, > 'fast_options': '01', # hide client names >- 'expected_cname': expected_cname, >- 'expected_cname_private': user_cname >+ 'expected_anon': True > } > ]) > >@@ -1216,8 +1197,8 @@ class FAST_Tests(KDCBaseTest): > srealm = target_realm > > expected_cname = kdc_dict.pop('expected_cname', client_cname) >- expected_cname_private = kdc_dict.pop('expected_cname_private', >- None) >+ expected_anon = kdc_dict.pop('expected_anon', >+ False) > expected_crealm = kdc_dict.pop('expected_crealm', client_realm) > expected_sname = kdc_dict.pop('expected_sname', sname) > expected_srealm = kdc_dict.pop('expected_srealm', srealm) >@@ -1341,7 +1322,7 @@ class FAST_Tests(KDCBaseTest): > kdc_exchange_dict = self.as_exchange_dict( > expected_crealm=expected_crealm, > expected_cname=expected_cname, >- expected_cname_private=expected_cname_private, >+ expected_anon=expected_anon, > expected_srealm=expected_srealm, > expected_sname=expected_sname, > ticket_decryption_key=krbtgt_decryption_key, >@@ -1370,7 +1351,7 @@ class FAST_Tests(KDCBaseTest): > kdc_exchange_dict = self.tgs_exchange_dict( > expected_crealm=expected_crealm, > expected_cname=expected_cname, >- expected_cname_private=expected_cname_private, >+ expected_anon=expected_anon, > expected_srealm=expected_srealm, > expected_sname=expected_sname, > ticket_decryption_key=target_decryption_key, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 0ec0f65c6d6..e4dbb10d135 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1721,7 +1721,7 @@ class RawKerberosTest(TestCaseInTempDir): > def as_exchange_dict(self, > expected_crealm=None, > expected_cname=None, >- expected_cname_private=None, >+ expected_anon=False, > expected_srealm=None, > expected_sname=None, > ticket_decryption_key=None, >@@ -1759,6 +1759,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'rep_encpart_asn1Spec': krb5_asn1.EncASRepPart, > 'expected_crealm': expected_crealm, > 'expected_cname': expected_cname, >+ 'expected_anon': expected_anon, > 'expected_srealm': expected_srealm, > 'expected_sname': expected_sname, > 'ticket_decryption_key': ticket_decryption_key, >@@ -1784,10 +1785,6 @@ class RawKerberosTest(TestCaseInTempDir): > 'inner_req': inner_req, > 'outer_req': outer_req > } >- if expected_cname_private is not None: >- kdc_exchange_dict['expected_cname_private'] = ( >- expected_cname_private) >- > if callback_dict is None: > callback_dict = {} > >@@ -1796,7 +1793,7 @@ class RawKerberosTest(TestCaseInTempDir): > def tgs_exchange_dict(self, > expected_crealm=None, > expected_cname=None, >- expected_cname_private=None, >+ expected_anon=False, > expected_srealm=None, > expected_sname=None, > ticket_decryption_key=None, >@@ -1834,6 +1831,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'rep_encpart_asn1Spec': krb5_asn1.EncTGSRepPart, > 'expected_crealm': expected_crealm, > 'expected_cname': expected_cname, >+ 'expected_anon': expected_anon, > 'expected_srealm': expected_srealm, > 'expected_sname': expected_sname, > 'ticket_decryption_key': ticket_decryption_key, >@@ -1859,10 +1857,6 @@ class RawKerberosTest(TestCaseInTempDir): > 'inner_req': inner_req, > 'outer_req': outer_req > } >- if expected_cname_private is not None: >- kdc_exchange_dict['expected_cname_private'] = ( >- expected_cname_private) >- > if callback_dict is None: > callback_dict = {} > >@@ -1874,7 +1868,7 @@ class RawKerberosTest(TestCaseInTempDir): > rep): > > expected_crealm = kdc_exchange_dict['expected_crealm'] >- expected_cname = kdc_exchange_dict['expected_cname'] >+ expected_anon = kdc_exchange_dict['expected_anon'] > expected_srealm = kdc_exchange_dict['expected_srealm'] > expected_sname = kdc_exchange_dict['expected_sname'] > ticket_decryption_key = kdc_exchange_dict['ticket_decryption_key'] >@@ -1888,6 +1882,12 @@ class RawKerberosTest(TestCaseInTempDir): > padata = self.getElementValue(rep, 'padata') > if self.strict_checking: > self.assertElementEqualUTF8(rep, 'crealm', expected_crealm) >+ if expected_anon: >+ expected_cname = self.PrincipalName_create( >+ name_type=NT_WELLKNOWN, >+ names=['WELLKNOWN', 'ANONYMOUS']) >+ else: >+ expected_cname = kdc_exchange_dict['expected_cname'] > self.assertElementEqualPrincipal(rep, 'cname', expected_cname) > self.assertElementPresent(rep, 'ticket') > ticket = self.getElementValue(rep, 'ticket') >@@ -2042,14 +2042,11 @@ class RawKerberosTest(TestCaseInTempDir): > and kdc_options[canon_pos] == '1') > > expected_crealm = kdc_exchange_dict['expected_crealm'] >+ expected_cname = kdc_exchange_dict['expected_cname'] > expected_srealm = kdc_exchange_dict['expected_srealm'] > expected_sname = kdc_exchange_dict['expected_sname'] > ticket_decryption_key = kdc_exchange_dict['ticket_decryption_key'] > >- try: >- expected_cname = kdc_exchange_dict['expected_cname_private'] >- except KeyError: >- expected_cname = kdc_exchange_dict['expected_cname'] > > ticket = self.getElementValue(rep, 'ticket') > >@@ -2182,7 +2179,7 @@ class RawKerberosTest(TestCaseInTempDir): > > rep_msg_type = kdc_exchange_dict['rep_msg_type'] > >- expected_cname = kdc_exchange_dict['expected_cname'] >+ expected_anon = kdc_exchange_dict['expected_anon'] > expected_srealm = kdc_exchange_dict['expected_srealm'] > expected_sname = kdc_exchange_dict['expected_sname'] > expected_error_mode = kdc_exchange_dict['expected_error_mode'] >@@ -2203,7 +2200,10 @@ class RawKerberosTest(TestCaseInTempDir): > # error-code checked above > if self.strict_checking: > self.assertElementMissing(rep, 'crealm') >- if expected_cname['name-type'] == NT_WELLKNOWN and not inner: >+ if expected_anon and not inner: >+ expected_cname = self.PrincipalName_create( >+ name_type=NT_WELLKNOWN, >+ names=['WELLKNOWN', 'ANONYMOUS']) > self.assertElementEqualPrincipal(rep, 'cname', expected_cname) > else: > self.assertElementMissing(rep, 'cname') >-- >2.25.1 > > >From f042252c49236f90df749bda71a122dad765751c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 16:34:02 +1200 >Subject: [PATCH 235/380] tests/krb5: Allow specifying an OU to create accounts > in > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 7aae0e9b100b8cb7d1da78b8cb9a4a5c20acffbd) >--- > python/samba/tests/krb5/kdc_base_test.py | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index f5c1eba9151..efe11da8468 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -151,12 +151,16 @@ class KDCBaseTest(RawKerberosTest): > return default_enctypes > > def create_account(self, ldb, name, machine_account=False, >- spn=None, upn=None, additional_details=None): >+ spn=None, upn=None, additional_details=None, >+ ou=None): > '''Create an account for testing. > The dn of the created account is added to self.accounts, > which is used by tearDownClass to clean up the created accounts. > ''' >- dn = "cn=%s,%s" % (name, ldb.domain_dn()) >+ if ou is None: >+ ou = ldb.domain_dn() >+ >+ dn = "CN=%s,%s" % (name, ou) > > # remove the account if it exists, this will happen if a previous test > # run failed >-- >2.25.1 > > >From 66a7189fd158e1cae8cf48e3619afc335dd15e52 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 16:34:46 +1200 >Subject: [PATCH 236/380] tests/krb5: Allow specifying additional User Account > Control flags for account > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 9aa900857441ea7e1c2d6c60bfa1ddeb142bf3e3) >--- > python/samba/tests/krb5/kdc_base_test.py | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index efe11da8468..bd5bacfaca1 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -152,7 +152,7 @@ class KDCBaseTest(RawKerberosTest): > > def create_account(self, ldb, name, machine_account=False, > spn=None, upn=None, additional_details=None, >- ou=None): >+ ou=None, account_control=0): > '''Create an account for testing. > The dn of the created account is added to self.accounts, > which is used by tearDownClass to clean up the created accounts. >@@ -168,11 +168,11 @@ class KDCBaseTest(RawKerberosTest): > if machine_account: > object_class = "computer" > account_name = "%s$" % name >- account_control = str(UF_WORKSTATION_TRUST_ACCOUNT) >+ account_control |= UF_WORKSTATION_TRUST_ACCOUNT > else: > object_class = "user" > account_name = name >- account_control = str(UF_NORMAL_ACCOUNT) >+ account_control |= UF_NORMAL_ACCOUNT > > password = generate_random_password(32, 32) > utf16pw = ('"%s"' % password).encode('utf-16-le') >@@ -181,7 +181,7 @@ class KDCBaseTest(RawKerberosTest): > "dn": dn, > "objectclass": object_class, > "sAMAccountName": account_name, >- "userAccountControl": account_control, >+ "userAccountControl": str(account_control), > "unicodePwd": utf16pw} > if spn is not None: > details["servicePrincipalName"] = spn >-- >2.25.1 > > >From f21fc2ea02bd942c770c0816e410cc6c86702512 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 16:35:58 +1200 >Subject: [PATCH 237/380] tests/krb5: Keep track of account DN in credentials > object > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 9973b51e48a5d5f3e33c6e0da46e6231a42bd77a) >--- > python/samba/tests/krb5/kdc_base_test.py | 2 ++ > python/samba/tests/krb5/raw_testcase.py | 8 ++++++++ > 2 files changed, 10 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index bd5bacfaca1..b52452358cc 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -201,6 +201,7 @@ class KDCBaseTest(RawKerberosTest): > creds.set_workstation(name) > else: > creds.set_workstation('') >+ creds.set_dn(dn) > # > # Save the account name so it can be deleted in tearDownClass > self.accounts.add(dn) >@@ -441,6 +442,7 @@ class KDCBaseTest(RawKerberosTest): > > kvno = int(res[0]['msDS-KeyVersionNumber'][0]) > creds.set_kvno(kvno) >+ creds.set_dn(dn) > > keys = self.get_keys(samdb, dn) > self.creds_set_keys(creds, keys) >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index e4dbb10d135..e62fad3d187 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -261,6 +261,8 @@ class KerberosCredentials(Credentials): > > self.forced_salt = None > >+ self.dn = None >+ > def set_as_supported_enctypes(self, value): > self.as_supported_enctypes = int(value) > >@@ -327,6 +329,12 @@ class KerberosCredentials(Credentials): > > return salt_string.encode('utf-8') > >+ def set_dn(self, dn): >+ self.dn = dn >+ >+ def get_dn(self): >+ return self.dn >+ > > class KerberosTicketCreds: > def __init__(self, ticket, session_key, >-- >2.25.1 > > >From f062486b3ec7129b33c7bb759541c30593dc562f Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 2 Sep 2021 14:27:00 +1200 >Subject: [PATCH 238/380] tests/krb5: Move padata generation methods to base > class > >This allows them to be used directly from RawKerberosTest. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 1f23b16ef3a900a1bda01bf2a5a3a3847e2e79d1) >--- > python/samba/tests/krb5/fast_tests.py | 14 -------------- > python/samba/tests/krb5/raw_testcase.py | 13 +++++++++++++ > 2 files changed, 13 insertions(+), 14 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index b371ab617aa..4fc297c1e34 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -51,7 +51,6 @@ from samba.tests.krb5.rfc4120_constants import ( > NT_SRV_INST, > PADATA_FX_COOKIE, > PADATA_FX_FAST, >- PADATA_PAC_OPTIONS > ) > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > import samba.tests.krb5.kcrypto as kcrypto >@@ -1466,19 +1465,6 @@ class FAST_Tests(KDCBaseTest): > > return self.PA_DATA_create(PADATA_FX_COOKIE, cookie) > >- def get_pa_pac_request(self, request_pac=True): >- pac_request = self.KERB_PA_PAC_REQUEST_create(request_pac) >- >- return pac_request >- >- def get_pa_pac_options(self, options): >- pac_options = self.PA_PAC_OPTIONS_create(options) >- pac_options = self.der_encode(pac_options, >- asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) >- pac_options = self.PA_DATA_create(PADATA_PAC_OPTIONS, pac_options) >- >- return pac_options >- > def check_kdc_fast_support(self): > # Check that the KDC supports FAST > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index e62fad3d187..b724baf5cf8 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1151,6 +1151,19 @@ class RawKerberosTest(TestCaseInTempDir): > pa_data = self.PA_DATA_create(PADATA_PAC_REQUEST, pa_pac) > return pa_data > >+ def get_pa_pac_request(self, request_pac=True): >+ pac_request = self.KERB_PA_PAC_REQUEST_create(request_pac) >+ >+ return pac_request >+ >+ def get_pa_pac_options(self, options): >+ pac_options = self.PA_PAC_OPTIONS_create(options) >+ pac_options = self.der_encode(pac_options, >+ asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) >+ pac_options = self.PA_DATA_create(PADATA_PAC_OPTIONS, pac_options) >+ >+ return pac_options >+ > def KDC_REQ_BODY_create(self, > kdc_options, > cname, >-- >2.25.1 > > >From b87287bc8727893ad531a649b3124649a629c32e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 2 Sep 2021 14:36:42 +1200 >Subject: [PATCH 239/380] tests/krb5: add options to kdc_exchange_dict to > specify including PAC-REQUEST or PAC-OPTIONS > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit c0db1ba54d238d4b2da8895215d8314b068ce09c) >--- > python/samba/tests/krb5/raw_testcase.py | 40 +++++++++++++++++++++---- > 1 file changed, 34 insertions(+), 6 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index b724baf5cf8..58f246606d7 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1574,6 +1574,9 @@ class RawKerberosTest(TestCaseInTempDir): > expected_error_mode = kdc_exchange_dict['expected_error_mode'] > kdc_options = kdc_exchange_dict['kdc_options'] > >+ pac_request = kdc_exchange_dict['pac_request'] >+ pac_options = kdc_exchange_dict['pac_options'] >+ > # Parameters specific to the inner request body > inner_req = kdc_exchange_dict['inner_req'] > >@@ -1619,6 +1622,14 @@ class RawKerberosTest(TestCaseInTempDir): > else: > del req_body[key] > >+ additional_padata = [] >+ if pac_request is not None: >+ pa_pac_request = self.KERB_PA_PAC_REQUEST_create(pac_request) >+ additional_padata.append(pa_pac_request) >+ if pac_options is not None: >+ pa_pac_options = self.get_pa_pac_options(pac_options) >+ additional_padata.append(pa_pac_options) >+ > if req_msg_type == KRB_AS_REQ: > tgs_req = None > tgs_req_padata = None >@@ -1637,6 +1648,8 @@ class RawKerberosTest(TestCaseInTempDir): > fast_padata, req_body = generate_fast_padata_fn(kdc_exchange_dict, > callback_dict, > req_body) >+ >+ fast_padata += additional_padata > else: > fast_padata = [] > >@@ -1701,6 +1714,9 @@ class RawKerberosTest(TestCaseInTempDir): > if outer_padata is not None: > padata += outer_padata > >+ if fast is None: >+ padata += additional_padata >+ > if not padata: > padata = None > >@@ -1766,7 +1782,9 @@ class RawKerberosTest(TestCaseInTempDir): > auth_data=None, > kdc_options='', > inner_req=None, >- outer_req=None): >+ outer_req=None, >+ pac_request=None, >+ pac_options=None): > if expected_error_mode == 0: > expected_error_mode = () > elif not isinstance(expected_error_mode, collections.abc.Container): >@@ -1804,7 +1822,9 @@ class RawKerberosTest(TestCaseInTempDir): > 'auth_data': auth_data, > 'kdc_options': kdc_options, > 'inner_req': inner_req, >- 'outer_req': outer_req >+ 'outer_req': outer_req, >+ 'pac_request': pac_request, >+ 'pac_options': pac_options > } > if callback_dict is None: > callback_dict = {} >@@ -1838,7 +1858,9 @@ class RawKerberosTest(TestCaseInTempDir): > body_checksum_type=None, > kdc_options='', > inner_req=None, >- outer_req=None): >+ outer_req=None, >+ pac_request=None, >+ pac_options=None): > if expected_error_mode == 0: > expected_error_mode = () > elif not isinstance(expected_error_mode, collections.abc.Container): >@@ -1876,7 +1898,9 @@ class RawKerberosTest(TestCaseInTempDir): > 'authenticator_subkey': authenticator_subkey, > 'kdc_options': kdc_options, > 'inner_req': inner_req, >- 'outer_req': outer_req >+ 'outer_req': outer_req, >+ 'pac_request': pac_request, >+ 'pac_options': pac_options > } > if callback_dict is None: > callback_dict = {} >@@ -2820,7 +2844,9 @@ class RawKerberosTest(TestCaseInTempDir): > padata, > kdc_options, > preauth_key=None, >- ticket_decryption_key=None): >+ ticket_decryption_key=None, >+ pac_request=None, >+ pac_options=None): > > def _generate_padata_copy(_kdc_exchange_dict, > _callback_dict, >@@ -2860,7 +2886,9 @@ class RawKerberosTest(TestCaseInTempDir): > expected_error_mode=expected_error_mode, > client_as_etypes=client_as_etypes, > expected_salt=expected_salt, >- kdc_options=str(kdc_options)) >+ kdc_options=str(kdc_options), >+ pac_request=pac_request, >+ pac_options=pac_options) > > rep = self._generic_kdc_exchange(kdc_exchange_dict, > cname=cname, >-- >2.25.1 > > >From d8ad5239012b211546eeed261614f7a2e5214352 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 2 Sep 2021 14:37:27 +1200 >Subject: [PATCH 240/380] tests/krb5: Don't create PAC request manually in > as_req_tests > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit bc21ba2592093c765751ed3e8083dcd3512997f8) >--- > python/samba/tests/krb5/as_req_tests.py | 35 ++++++++----------------- > 1 file changed, 11 insertions(+), 24 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 09160bf6814..35f88a0c920 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -56,7 +56,7 @@ class AsReqKerberosTests(KDCBaseTest): > > def _test_as_req_nopreauth(self, > initial_etypes, >- initial_padata=None, >+ pac=None, > initial_kdc_options=None): > client_creds = self.get_client_creds() > client_account = client_creds.get_username() >@@ -84,27 +84,19 @@ class AsReqKerberosTests(KDCBaseTest): > else: > expected_error_mode = KDC_ERR_ETYPE_NOSUPP > >- def _generate_padata_copy(_kdc_exchange_dict, >- _callback_dict, >- req_body): >- return initial_padata, req_body >- >- generate_padata_fn = (_generate_padata_copy >- if initial_padata is not None >- else None) >- > kdc_exchange_dict = self.as_exchange_dict( > expected_crealm=expected_crealm, > expected_cname=expected_cname, > expected_srealm=expected_srealm, > expected_sname=expected_sname, >- generate_padata_fn=generate_padata_fn, >+ generate_padata_fn=None, > check_error_fn=self.generic_check_kdc_error, > check_rep_fn=None, > expected_error_mode=expected_error_mode, > client_as_etypes=client_as_etypes, > expected_salt=expected_salt, >- kdc_options=str(initial_kdc_options)) >+ kdc_options=str(initial_kdc_options), >+ pac_request=pac) > > self._generic_kdc_exchange(kdc_exchange_dict, > cname=cname, >@@ -114,13 +106,8 @@ class AsReqKerberosTests(KDCBaseTest): > > def _test_as_req_no_preauth_with_args(self, etype_idx, pac): > name, etypes = self.etype_test_permutation_by_idx(etype_idx) >- if pac is None: >- padata = None >- else: >- pa_pac = self.KERB_PA_PAC_REQUEST_create(pac) >- padata = [pa_pac] > self._test_as_req_nopreauth( >- initial_padata=padata, >+ pac=pac, > initial_etypes=etypes, > initial_kdc_options=krb5_asn1.KDCOptions('forwardable')) > >@@ -146,8 +133,6 @@ class AsReqKerberosTests(KDCBaseTest): > > till = self.get_KerberosTime(offset=36000) > >- pa_pac = self.KERB_PA_PAC_REQUEST_create(True) >- initial_padata = [pa_pac] > initial_etypes = client_as_etypes > initial_kdc_options = krb5_asn1.KDCOptions('forwardable') > initial_error_mode = KDC_ERR_PREAUTH_REQUIRED >@@ -164,8 +149,9 @@ class AsReqKerberosTests(KDCBaseTest): > expected_sname, > expected_salt, > initial_etypes, >- initial_padata, >- initial_kdc_options) >+ None, >+ initial_kdc_options, >+ pac_request=True) > etype_info2 = kdc_exchange_dict['preauth_etype_info2'] > self.assertIsNotNone(etype_info2) > >@@ -183,7 +169,7 @@ class AsReqKerberosTests(KDCBaseTest): > > pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts) > >- preauth_padata = [pa_ts, pa_pac] >+ preauth_padata = [pa_ts] > preauth_etypes = client_as_etypes > preauth_kdc_options = krb5_asn1.KDCOptions('forwardable') > preauth_error_mode = 0 # AS-REP >@@ -207,7 +193,8 @@ class AsReqKerberosTests(KDCBaseTest): > preauth_padata, > preauth_kdc_options, > preauth_key=preauth_key, >- ticket_decryption_key=krbtgt_decryption_key) >+ ticket_decryption_key=krbtgt_decryption_key, >+ pac_request=True) > self.assertIsNotNone(as_rep) > > if __name__ == "__main__": >-- >2.25.1 > > >From 7b74ea8d76e58e179715d4a1d3a864cd689df128 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 2 Sep 2021 14:38:33 +1200 >Subject: [PATCH 241/380] tests/krb5: Don't create PAC request or options > manually in fast_tests > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 7556a4dfa64650939aef14a2fc4d10b9ed3d29f7) >--- > python/samba/tests/krb5/fast_tests.py | 22 +++++++++------------- > 1 file changed, 9 insertions(+), 13 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 4fc297c1e34..e10db90a57e 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1093,8 +1093,6 @@ class FAST_Tests(KDCBaseTest): > 'canonicalize,' > 'renewable-ok')) > >- pac_request = self.get_pa_pac_request() >- > client_creds = self.get_client_creds() > target_creds = self.get_service_creds() > krbtgt_creds = self.get_krbtgt_creds() >@@ -1250,7 +1248,7 @@ class FAST_Tests(KDCBaseTest): > _callback_dict, > req_body, > padata): >- return padata, req_body >+ return list(padata), req_body > > def _check_padata_preauth_key(_kdc_exchange_dict, > _callback_dict, >@@ -1260,15 +1258,9 @@ class FAST_Tests(KDCBaseTest): > return preauth_key, as_rep_usage > > pac_options = kdc_dict.pop('pac_options', '1') # claims support >- pac_options = self.get_pa_pac_options(pac_options) > > kdc_options = kdc_dict.pop('kdc_options', kdc_options_default) > >- if rep_type == KRB_AS_REP: >- padata = [pac_request, pac_options] >- else: >- padata = [pac_options] >- > gen_padata_fn = kdc_dict.pop('gen_padata_fn', None) > if gen_padata_fn is not None: > self.assertEqual(KRB_AS_REP, rep_type) >@@ -1278,10 +1270,10 @@ class FAST_Tests(KDCBaseTest): > client_creds, > preauth_etype_info2[0], > client_creds.get_kvno()) >- gen_padata = gen_padata_fn(preauth_key, armor_key) >- padata.insert(0, gen_padata) >+ padata = [gen_padata_fn(preauth_key, armor_key)] > else: > preauth_key = None >+ padata = [] > > if rep_type == KRB_AS_REP: > check_padata_fn = _check_padata_preauth_key >@@ -1345,7 +1337,9 @@ class FAST_Tests(KDCBaseTest): > armor_subkey=armor_subkey, > kdc_options=kdc_options, > inner_req=inner_req, >- outer_req=outer_req) >+ outer_req=outer_req, >+ pac_request=True, >+ pac_options=pac_options) > else: # KRB_TGS_REP > kdc_exchange_dict = self.tgs_exchange_dict( > expected_crealm=expected_crealm, >@@ -1374,7 +1368,9 @@ class FAST_Tests(KDCBaseTest): > body_checksum_type=None, > kdc_options=kdc_options, > inner_req=inner_req, >- outer_req=outer_req) >+ outer_req=outer_req, >+ pac_request=None, >+ pac_options=pac_options) > > repeat = kdc_dict.pop('repeat', 1) > for _ in range(repeat): >-- >2.25.1 > > >From d435e0a623f135896b6b75a39d696043aca44e62 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 17:46:02 +1200 >Subject: [PATCH 242/380] tests/krb5: Remove magic constants > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 571265257f335ba7f6f1b46daa0d657b8a8dff2b) >--- > python/samba/tests/krb5/fast_tests.py | 2 +- > python/samba/tests/krb5/kdc_base_test.py | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index e10db90a57e..29a666aad5e 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1466,7 +1466,7 @@ class FAST_Tests(KDCBaseTest): > > samdb = self.get_samdb() > >- krbtgt_rid = 502 >+ krbtgt_rid = security.DOMAIN_RID_KRBTGT > krbtgt_sid = '%s-%d' % (samdb.get_domain_sid(), krbtgt_rid) > > res = samdb.search(base='<SID=%s>' % krbtgt_sid, >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index b52452358cc..ac43b2eae1a 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -425,7 +425,7 @@ class KDCBaseTest(RawKerberosTest): > def download_krbtgt_creds(): > samdb = self.get_samdb() > >- krbtgt_rid = 502 >+ krbtgt_rid = security.DOMAIN_RID_KRBTGT > krbtgt_sid = '%s-%d' % (samdb.get_domain_sid(), krbtgt_rid) > > res = samdb.search(base='<SID=%s>' % krbtgt_sid, >-- >2.25.1 > > >From 0255dec126166901282a3a7644142865183a6f01 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 19:13:11 +1200 >Subject: [PATCH 243/380] tests/krb5: Allow specifying ticket flags expected to > be set or reset > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 85ddfc1afcf21797dab15431a5f375444c4d316e) >--- > python/samba/tests/krb5/fast_tests.py | 11 +++++++ > python/samba/tests/krb5/raw_testcase.py | 40 +++++++++++++++++++++++-- > 2 files changed, 49 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 29a666aad5e..687f7532a64 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1309,6 +1309,13 @@ class FAST_Tests(KDCBaseTest): > inner_req = kdc_dict.pop('inner_req', None) > outer_req = kdc_dict.pop('outer_req', None) > >+ expected_flags = kdc_dict.pop('expected_flags', None) >+ if expected_flags is not None: >+ expected_flags = krb5_asn1.KDCOptions(expected_flags) >+ unexpected_flags = kdc_dict.pop('unexpected_flags', None) >+ if unexpected_flags is not None: >+ unexpected_flags = krb5_asn1.KDCOptions(unexpected_flags) >+ > if rep_type == KRB_AS_REP: > kdc_exchange_dict = self.as_exchange_dict( > expected_crealm=expected_crealm, >@@ -1316,6 +1323,8 @@ class FAST_Tests(KDCBaseTest): > expected_anon=expected_anon, > expected_srealm=expected_srealm, > expected_sname=expected_sname, >+ expected_flags=expected_flags, >+ unexpected_flags=unexpected_flags, > ticket_decryption_key=krbtgt_decryption_key, > generate_fast_fn=generate_fast_fn, > generate_fast_armor_fn=generate_fast_armor_fn, >@@ -1347,6 +1356,8 @@ class FAST_Tests(KDCBaseTest): > expected_anon=expected_anon, > expected_srealm=expected_srealm, > expected_sname=expected_sname, >+ expected_flags=expected_flags, >+ unexpected_flags=unexpected_flags, > ticket_decryption_key=target_decryption_key, > generate_fast_fn=generate_fast_fn, > generate_fast_armor_fn=generate_fast_armor_fn, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 58f246606d7..268f6ccc6bb 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -896,6 +896,24 @@ class RawKerberosTest(TestCaseInTempDir): > else: > self.assertIsNone(v) > >+ def assertElementFlags(self, obj, elem, expected, unexpected): >+ v = self.getElementValue(obj, elem) >+ self.assertIsNotNone(v) >+ if expected is not None: >+ self.assertIsInstance(expected, krb5_asn1.KDCOptions) >+ for i, flag in enumerate(expected): >+ if flag == 1: >+ self.assertEqual('1', v[i], >+ f"'{expected.namedValues[i]}' " >+ f"expected in {v}") >+ if unexpected is not None: >+ self.assertIsInstance(unexpected, krb5_asn1.KDCOptions) >+ for i, flag in enumerate(unexpected): >+ if flag == 1: >+ self.assertEqual('0', v[i], >+ f"'{unexpected.namedValues[i]}' " >+ f"unexpected in {v}") >+ > def get_KerberosTimeWithUsec(self, epoch=None, offset=None): > if epoch is None: > epoch = time.time() >@@ -1761,6 +1779,8 @@ class RawKerberosTest(TestCaseInTempDir): > expected_anon=False, > expected_srealm=None, > expected_sname=None, >+ expected_flags=None, >+ unexpected_flags=None, > ticket_decryption_key=None, > generate_fast_fn=None, > generate_fast_armor_fn=None, >@@ -1801,6 +1821,8 @@ class RawKerberosTest(TestCaseInTempDir): > 'expected_anon': expected_anon, > 'expected_srealm': expected_srealm, > 'expected_sname': expected_sname, >+ 'expected_flags': expected_flags, >+ 'unexpected_flags': unexpected_flags, > 'ticket_decryption_key': ticket_decryption_key, > 'generate_fast_fn': generate_fast_fn, > 'generate_fast_armor_fn': generate_fast_armor_fn, >@@ -1837,6 +1859,8 @@ class RawKerberosTest(TestCaseInTempDir): > expected_anon=False, > expected_srealm=None, > expected_sname=None, >+ expected_flags=None, >+ unexpected_flags=None, > ticket_decryption_key=None, > generate_fast_fn=None, > generate_fast_armor_fn=None, >@@ -1877,6 +1901,8 @@ class RawKerberosTest(TestCaseInTempDir): > 'expected_anon': expected_anon, > 'expected_srealm': expected_srealm, > 'expected_sname': expected_sname, >+ 'expected_flags': expected_flags, >+ 'unexpected_flags': unexpected_flags, > 'ticket_decryption_key': ticket_decryption_key, > 'generate_fast_fn': generate_fast_fn, > 'generate_fast_armor_fn': generate_fast_armor_fn, >@@ -2092,6 +2118,8 @@ class RawKerberosTest(TestCaseInTempDir): > expected_sname = kdc_exchange_dict['expected_sname'] > ticket_decryption_key = kdc_exchange_dict['ticket_decryption_key'] > >+ expected_flags = kdc_exchange_dict.get('expected_flags') >+ unexpected_flags = kdc_exchange_dict.get('unexpected_flags') > > ticket = self.getElementValue(rep, 'ticket') > >@@ -2101,7 +2129,9 @@ class RawKerberosTest(TestCaseInTempDir): > > ticket_session_key = None > if ticket_private is not None: >- self.assertElementPresent(ticket_private, 'flags') >+ self.assertElementFlags(ticket_private, 'flags', >+ expected_flags, >+ unexpected_flags) > self.assertElementPresent(ticket_private, 'key') > ticket_key = self.getElementValue(ticket_private, 'key') > self.assertIsNotNone(ticket_key) >@@ -2137,7 +2167,9 @@ class RawKerberosTest(TestCaseInTempDir): > kdc_exchange_dict['nonce']) > # TODO self.assertElementPresent(encpart_private, > # 'key-expiration') >- self.assertElementPresent(encpart_private, 'flags') >+ self.assertElementFlags(ticket_private, 'flags', >+ expected_flags, >+ unexpected_flags) > self.assertElementPresent(encpart_private, 'authtime') > if self.strict_checking: > self.assertElementPresent(encpart_private, 'starttime') >@@ -2843,6 +2875,8 @@ class RawKerberosTest(TestCaseInTempDir): > etypes, > padata, > kdc_options, >+ expected_flags=None, >+ unexpected_flags=None, > preauth_key=None, > ticket_decryption_key=None, > pac_request=None, >@@ -2886,6 +2920,8 @@ class RawKerberosTest(TestCaseInTempDir): > expected_error_mode=expected_error_mode, > client_as_etypes=client_as_etypes, > expected_salt=expected_salt, >+ expected_flags=expected_flags, >+ unexpected_flags=unexpected_flags, > kdc_options=str(kdc_options), > pac_request=pac_request, > pac_options=pac_options) >-- >2.25.1 > > >From e1482ace39966ada1c210afe10d354d38fdf5c0a Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 19:15:17 +1200 >Subject: [PATCH 244/380] tests/krb5: Make time assertion less strict > >This assertion could fail if there was a time difference between the KDC >and the client. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 1974b872fb5a7da052305d01e2f1efc8d0637078) >--- > python/samba/tests/krb5/raw_testcase.py | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 268f6ccc6bb..5ae8fe4ba41 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2559,7 +2559,7 @@ class RawKerberosTest(TestCaseInTempDir): > current_time = time.time() > > self.assertLess(current_time - 300, rep_time) >- self.assertLess(rep_time, current_time) >+ self.assertLess(rep_time, current_time + 300) > > if all(etype not in client_as_etypes or etype not in proposed_etypes > for etype in (kcrypto.Enctype.AES256, >-- >2.25.1 > > >From 3d8cc19d62012366ff66aeddb45393b9a07c1c7e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 19:34:20 +1200 >Subject: [PATCH 245/380] tests/krb5: Allow Kerberos requests to be sent to DC > or RODC > >If run inside the 'rodc' testing environment, 'DC_SERVER' and 'SERVER' >refer to the hostnames of the DC and RODC respectively, and this commit >allows either one of them to be used as the KDC for Kerberos exchanges. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 0afb548a0a3221730c4a81d51bc31e99ec90e334) >--- > python/samba/tests/krb5/kdc_base_test.py | 2 +- > python/samba/tests/krb5/raw_testcase.py | 39 +++++++++++++++--------- > 2 files changed, 26 insertions(+), 15 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index ac43b2eae1a..0755040a87a 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -116,7 +116,7 @@ class KDCBaseTest(RawKerberosTest): > lp = self.get_lp() > > session = system_session() >- type(self)._ldb = SamDB(url="ldap://%s" % self.host, >+ type(self)._ldb = SamDB(url="ldap://%s" % self.dc_host, > session_info=session, > credentials=creds, > lp=lp) >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 5ae8fe4ba41..c03600f765b 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -418,6 +418,7 @@ class RawKerberosTest(TestCaseInTempDir): > super().setUpClass() > > cls.host = samba.tests.env_get_var_value('SERVER') >+ cls.dc_host = samba.tests.env_get_var_value('DC_SERVER') > > # A dictionary containing credentials that have already been > # obtained. >@@ -452,10 +453,10 @@ class RawKerberosTest(TestCaseInTempDir): > if self.do_hexdump: > sys.stderr.write("disconnect[%s]\n" % reason) > >- def _connect_tcp(self): >+ def _connect_tcp(self, host): > tcp_port = 88 > try: >- self.a = socket.getaddrinfo(self.host, tcp_port, socket.AF_UNSPEC, >+ self.a = socket.getaddrinfo(host, tcp_port, socket.AF_UNSPEC, > socket.SOCK_STREAM, socket.SOL_TCP, > 0) > self.s = socket.socket(self.a[0][0], self.a[0][1], self.a[0][2]) >@@ -468,11 +469,11 @@ class RawKerberosTest(TestCaseInTempDir): > self.s.close() > raise > >- def connect(self): >+ def connect(self, host): > self.assertNotConnected() >- self._connect_tcp() >+ self._connect_tcp(host) > if self.do_hexdump: >- sys.stderr.write("connected[%s]\n" % self.host) >+ sys.stderr.write("connected[%s]\n" % host) > > def env_get_var(self, varname, prefix, > fallback_default=True, >@@ -819,8 +820,10 @@ class RawKerberosTest(TestCaseInTempDir): > req, > asn1_print=None, > hexdump=None, >- timeout=None): >- self.connect() >+ timeout=None, >+ to_rodc=False): >+ host = self.host if to_rodc else self.dc_host >+ self.connect(host) > try: > self.send_pdu(req, asn1_print=asn1_print, hexdump=hexdump) > rep = self.recv_pdu( >@@ -1747,7 +1750,9 @@ class RawKerberosTest(TestCaseInTempDir): > req_body=req_body, > asn1Spec=req_asn1Spec()) > >- rep = self.send_recv_transaction(req_decoded) >+ to_rodc = kdc_exchange_dict['to_rodc'] >+ >+ rep = self.send_recv_transaction(req_decoded, to_rodc=to_rodc) > self.assertIsNotNone(rep) > > msg_type = self.getElementValue(rep, 'msg-type') >@@ -1804,7 +1809,8 @@ class RawKerberosTest(TestCaseInTempDir): > inner_req=None, > outer_req=None, > pac_request=None, >- pac_options=None): >+ pac_options=None, >+ to_rodc=False): > if expected_error_mode == 0: > expected_error_mode = () > elif not isinstance(expected_error_mode, collections.abc.Container): >@@ -1846,7 +1852,8 @@ class RawKerberosTest(TestCaseInTempDir): > 'inner_req': inner_req, > 'outer_req': outer_req, > 'pac_request': pac_request, >- 'pac_options': pac_options >+ 'pac_options': pac_options, >+ 'to_rodc': to_rodc > } > if callback_dict is None: > callback_dict = {} >@@ -1884,7 +1891,8 @@ class RawKerberosTest(TestCaseInTempDir): > inner_req=None, > outer_req=None, > pac_request=None, >- pac_options=None): >+ pac_options=None, >+ to_rodc=False): > if expected_error_mode == 0: > expected_error_mode = () > elif not isinstance(expected_error_mode, collections.abc.Container): >@@ -1926,7 +1934,8 @@ class RawKerberosTest(TestCaseInTempDir): > 'inner_req': inner_req, > 'outer_req': outer_req, > 'pac_request': pac_request, >- 'pac_options': pac_options >+ 'pac_options': pac_options, >+ 'to_rodc': to_rodc > } > if callback_dict is None: > callback_dict = {} >@@ -2880,7 +2889,8 @@ class RawKerberosTest(TestCaseInTempDir): > preauth_key=None, > ticket_decryption_key=None, > pac_request=None, >- pac_options=None): >+ pac_options=None, >+ to_rodc=False): > > def _generate_padata_copy(_kdc_exchange_dict, > _callback_dict, >@@ -2924,7 +2934,8 @@ class RawKerberosTest(TestCaseInTempDir): > unexpected_flags=unexpected_flags, > kdc_options=str(kdc_options), > pac_request=pac_request, >- pac_options=pac_options) >+ pac_options=pac_options, >+ to_rodc=to_rodc) > > rep = self._generic_kdc_exchange(kdc_exchange_dict, > cname=cname, >-- >2.25.1 > > >From da2a51fe379c6769720d00911b0b324293db2767 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 19:43:41 +1200 >Subject: [PATCH 246/380] tests/krb5: Check for presence of 'renew-till' > element > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 9cba5f9a1b098e49315e2e3d4c0b626884c04a64) >--- > python/samba/tests/krb5/raw_testcase.py | 15 +++++++++++++-- > 1 file changed, 13 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index c03600f765b..45ce3c092ad 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2120,6 +2120,9 @@ class RawKerberosTest(TestCaseInTempDir): > canon_pos = len(tuple(krb5_asn1.KDCOptions('canonicalize'))) - 1 > canonicalize = (canon_pos < len(kdc_options) > and kdc_options[canon_pos] == '1') >+ renewable_pos = len(tuple(krb5_asn1.KDCOptions('renewable'))) - 1 >+ renewable = (renewable_pos < len(kdc_options) >+ and kdc_options[renewable_pos] == '1') > > expected_crealm = kdc_exchange_dict['expected_crealm'] > expected_cname = kdc_exchange_dict['expected_cname'] >@@ -2158,7 +2161,11 @@ class RawKerberosTest(TestCaseInTempDir): > if self.strict_checking: > self.assertElementPresent(ticket_private, 'starttime') > self.assertElementPresent(ticket_private, 'endtime') >- # TODO self.assertElementPresent(ticket_private, 'renew-till') >+ if renewable: >+ if self.strict_checking: >+ self.assertElementPresent(ticket_private, 'renew-till') >+ else: >+ self.assertElementMissing(ticket_private, 'renew-till') > # TODO self.assertElementMissing(ticket_private, 'caddr') > self.assertElementPresent(ticket_private, 'authorization-data') > >@@ -2183,7 +2190,11 @@ class RawKerberosTest(TestCaseInTempDir): > if self.strict_checking: > self.assertElementPresent(encpart_private, 'starttime') > self.assertElementPresent(encpart_private, 'endtime') >- # TODO self.assertElementPresent(encpart_private, 'renew-till') >+ if renewable: >+ if self.strict_checking: >+ self.assertElementPresent(encpart_private, 'renew-till') >+ else: >+ self.assertElementMissing(encpart_private, 'renew-till') > self.assertElementEqualUTF8(encpart_private, 'srealm', > expected_srealm) > self.assertElementEqualPrincipal(encpart_private, 'sname', >-- >2.25.1 > > >From 8f3773fe197b6d5998db8fdc1d98eeaf2dbba750 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 19:45:57 +1200 >Subject: [PATCH 247/380] tests/krb5: Check 'caddr' element > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit d3106a8d35225e826d548d3bea0d42edc3998c38) >--- > python/samba/tests/krb5/raw_testcase.py | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 45ce3c092ad..9e47897dd76 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2166,7 +2166,8 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementPresent(ticket_private, 'renew-till') > else: > self.assertElementMissing(ticket_private, 'renew-till') >- # TODO self.assertElementMissing(ticket_private, 'caddr') >+ if self.strict_checking: >+ self.assertElementEqual(ticket_private, 'caddr', []) > self.assertElementPresent(ticket_private, 'authorization-data') > > encpart_session_key = None >@@ -2199,7 +2200,8 @@ class RawKerberosTest(TestCaseInTempDir): > expected_srealm) > self.assertElementEqualPrincipal(encpart_private, 'sname', > expected_sname) >- # TODO self.assertElementMissing(encpart_private, 'caddr') >+ if self.strict_checking: >+ self.assertElementEqual(encpart_private, 'caddr', []) > > sent_claims = self.sent_claims(kdc_exchange_dict) > >-- >2.25.1 > > >From 0b0d97f432787e028fb30bdc8a3847384a95cb57 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 19:47:27 +1200 >Subject: [PATCH 248/380] tests/krb5: Check for presence of 'key-expiration' > element > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit c3b746290278f7b5c1dea676e3fa28b9f15bcf94) >--- > python/samba/tests/krb5/raw_testcase.py | 11 +++++++++-- > 1 file changed, 9 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 9e47897dd76..e754794e48b 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2130,6 +2130,8 @@ class RawKerberosTest(TestCaseInTempDir): > expected_sname = kdc_exchange_dict['expected_sname'] > ticket_decryption_key = kdc_exchange_dict['ticket_decryption_key'] > >+ rep_msg_type = kdc_exchange_dict['rep_msg_type'] >+ > expected_flags = kdc_exchange_dict.get('expected_flags') > unexpected_flags = kdc_exchange_dict.get('unexpected_flags') > >@@ -2182,8 +2184,13 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementPresent(encpart_private, 'last-req') > self.assertElementEqual(encpart_private, 'nonce', > kdc_exchange_dict['nonce']) >- # TODO self.assertElementPresent(encpart_private, >- # 'key-expiration') >+ if rep_msg_type == KRB_AS_REP: >+ if self.strict_checking: >+ self.assertElementPresent(encpart_private, >+ 'key-expiration') >+ else: >+ self.assertElementMissing(encpart_private, >+ 'key-expiration') > self.assertElementFlags(ticket_private, 'flags', > expected_flags, > unexpected_flags) >-- >2.25.1 > > >From 906bb6e5598f9776c5776b6e0e4f2615b5a3ba1b Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 3 Sep 2021 09:18:32 +1200 >Subject: [PATCH 249/380] tests/krb5: Create testing accounts in appropriate > containers > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Tue Sep 14 00:01:44 UTC 2021 on sn-devel-184 > >(cherry picked from commit 01378a52a1cf0b6855492673455013d5719be45b) >--- > python/samba/tests/krb5/kdc_base_test.py | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 0755040a87a..49a3227c26e 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -34,6 +34,8 @@ from samba.drs_utils import drsuapi_connect > from samba.dsdb import ( > DS_DOMAIN_FUNCTION_2000, > DS_DOMAIN_FUNCTION_2008, >+ DS_GUID_COMPUTERS_CONTAINER, >+ DS_GUID_USERS_CONTAINER, > UF_WORKSTATION_TRUST_ACCOUNT, > UF_NORMAL_ACCOUNT > ) >@@ -158,7 +160,10 @@ class KDCBaseTest(RawKerberosTest): > which is used by tearDownClass to clean up the created accounts. > ''' > if ou is None: >- ou = ldb.domain_dn() >+ guid = (DS_GUID_COMPUTERS_CONTAINER if machine_account >+ else DS_GUID_USERS_CONTAINER) >+ >+ ou = ldb.get_wellknown_dn(ldb.get_default_basedn(), guid) > > dn = "CN=%s,%s" % (name, ou) > >-- >2.25.1 > > >From 98e5c82e7519031c76c944aff421c8924e040d08 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 19:26:43 +1200 >Subject: [PATCH 250/380] tests/krb5: Allow specifying status code to be > checked > >This allows us to check the status code that may be sent in an error >reply to a TGS-REQ message. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit 4ba5e82ae53410ec9a0bc7d47b181a88c15d9387) >--- > python/samba/tests/krb5/raw_testcase.py | 9 +++++++++ > 1 file changed, 9 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index e754794e48b..f65811243ba 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1798,6 +1798,7 @@ class RawKerberosTest(TestCaseInTempDir): > check_kdc_private_fn=None, > callback_dict=None, > expected_error_mode=0, >+ expected_status=None, > client_as_etypes=None, > expected_salt=None, > authenticator_subkey=None, >@@ -1841,6 +1842,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'check_kdc_private_fn': check_kdc_private_fn, > 'callback_dict': callback_dict, > 'expected_error_mode': expected_error_mode, >+ 'expected_status': expected_status, > 'client_as_etypes': client_as_etypes, > 'expected_salt': expected_salt, > 'authenticator_subkey': authenticator_subkey, >@@ -1879,6 +1881,7 @@ class RawKerberosTest(TestCaseInTempDir): > check_padata_fn=None, > check_kdc_private_fn=None, > expected_error_mode=0, >+ expected_status=None, > callback_dict=None, > tgt=None, > armor_key=None, >@@ -1923,6 +1926,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'check_kdc_private_fn': check_kdc_private_fn, > 'callback_dict': callback_dict, > 'expected_error_mode': expected_error_mode, >+ 'expected_status': expected_status, > 'tgt': tgt, > 'body_checksum_type': body_checksum_type, > 'armor_key': armor_key, >@@ -2540,7 +2544,12 @@ class RawKerberosTest(TestCaseInTempDir): > status = int.from_bytes(pw_salt[:4], 'little') > flags = int.from_bytes(pw_salt[8:], 'little') > >+ expected_status = kdc_exchange_dict['expected_status'] >+ self.assertEqual(expected_status, status) >+ > self.assertEqual(3, flags) >+ else: >+ self.assertIsNone(kdc_exchange_dict.get('expected_status')) > > if enc_challenge is not None: > if not sent_enc_challenge: >-- >2.25.1 > > >From 6d902b4452dde484aa4d7e220288e5d3fb84086b Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 3 Sep 2021 09:40:02 +1200 >Subject: [PATCH 251/380] tests/krb5: Get expected cname from TGT for TGS-REQ > messages > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit a5186f92803009c81eca2957e1bf2eb0ff7b6dff) >--- > python/samba/tests/krb5/fast_tests.py | 15 +++++++-------- > 1 file changed, 7 insertions(+), 8 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 687f7532a64..e1ba4628994 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -179,18 +179,12 @@ class FAST_Tests(KDCBaseTest): > ]) > > def test_simple_tgs_wrong_principal(self): >- mach_creds = self.get_mach_creds() >- mach_name = mach_creds.get_username() >- expected_cname = self.PrincipalName_create( >- name_type=NT_PRINCIPAL, names=[mach_name]) >- > self._run_test_sequence([ > { > 'rep_type': KRB_TGS_REP, > 'expected_error_mode': 0, > 'use_fast': False, >- 'gen_tgt_fn': self.get_mach_tgt, >- 'expected_cname': expected_cname >+ 'gen_tgt_fn': self.get_mach_tgt > } > ]) > >@@ -1193,7 +1187,12 @@ class FAST_Tests(KDCBaseTest): > else: # KRB_TGS_REP > srealm = target_realm > >- expected_cname = kdc_dict.pop('expected_cname', client_cname) >+ if rep_type == KRB_TGS_REP: >+ tgt_cname = tgt.cname >+ else: >+ tgt_cname = client_cname >+ >+ expected_cname = kdc_dict.pop('expected_cname', tgt_cname) > expected_anon = kdc_dict.pop('expected_anon', > False) > expected_crealm = kdc_dict.pop('expected_crealm', client_realm) >-- >2.25.1 > > >From eb68c88830ab19dfdb5469d2c953ad1041688c81 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 3 Sep 2021 09:55:10 +1200 >Subject: [PATCH 252/380] tests/krb5: Get encpart decryption key from > kdc_exchange_dict > >Instead of using check_padata_fn to get the encpart decryption key, we >can get the key from the AS-REQ preauth phase or from the TGT, depending >on whether the message is an AS-REQ or a TGS-REQ. This allows removal of >check_padata_fn and some duplicated code. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit 0e99382d73f44eed7e19e83e430938d587e762d0) >--- > python/samba/tests/krb5/fast_tests.py | 18 +--- > python/samba/tests/krb5/raw_testcase.py | 122 ++++++++++-------------- > 2 files changed, 54 insertions(+), 86 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index e1ba4628994..12235cd439e 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -45,7 +45,6 @@ from samba.tests.krb5.rfc4120_constants import ( > KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS, > KRB_AS_REP, > KRB_TGS_REP, >- KU_AS_REP_ENC_PART, > KU_TICKET, > NT_PRINCIPAL, > NT_SRV_INST, >@@ -1114,8 +1113,6 @@ class FAST_Tests(KDCBaseTest): > fast_cookie = None > preauth_etype_info2 = None > >- preauth_key = None >- > for kdc_dict in test_sequence: > rep_type = kdc_dict.pop('rep_type') > self.assertIn(rep_type, (KRB_AS_REP, KRB_TGS_REP)) >@@ -1249,13 +1246,6 @@ class FAST_Tests(KDCBaseTest): > padata): > return list(padata), req_body > >- def _check_padata_preauth_key(_kdc_exchange_dict, >- _callback_dict, >- _rep, >- _padata): >- as_rep_usage = KU_AS_REP_ENC_PART >- return preauth_key, as_rep_usage >- > pac_options = kdc_dict.pop('pac_options', '1') # claims support > > kdc_options = kdc_dict.pop('kdc_options', kdc_options_default) >@@ -1274,11 +1264,6 @@ class FAST_Tests(KDCBaseTest): > preauth_key = None > padata = [] > >- if rep_type == KRB_AS_REP: >- check_padata_fn = _check_padata_preauth_key >- else: >- check_padata_fn = self.check_simple_tgs_padata >- > if use_fast: > inner_padata = padata > outer_padata = [] >@@ -1332,13 +1317,13 @@ class FAST_Tests(KDCBaseTest): > generate_padata_fn=generate_padata_fn, > check_error_fn=check_error_fn, > check_rep_fn=check_rep_fn, >- check_padata_fn=check_padata_fn, > check_kdc_private_fn=self.generic_check_kdc_private, > callback_dict={}, > expected_error_mode=expected_error_mode, > client_as_etypes=etypes, > expected_salt=expected_salt, > authenticator_subkey=authenticator_subkey, >+ preauth_key=preauth_key, > auth_data=auth_data, > armor_key=armor_key, > armor_tgt=armor_tgt, >@@ -1365,7 +1350,6 @@ class FAST_Tests(KDCBaseTest): > generate_padata_fn=generate_padata_fn, > check_error_fn=check_error_fn, > check_rep_fn=check_rep_fn, >- check_padata_fn=check_padata_fn, > check_kdc_private_fn=self.generic_check_kdc_private, > expected_error_mode=expected_error_mode, > callback_dict={}, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index f65811243ba..164d06b9788 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1794,7 +1794,6 @@ class RawKerberosTest(TestCaseInTempDir): > generate_padata_fn=None, > check_error_fn=None, > check_rep_fn=None, >- check_padata_fn=None, > check_kdc_private_fn=None, > callback_dict=None, > expected_error_mode=0, >@@ -1802,6 +1801,7 @@ class RawKerberosTest(TestCaseInTempDir): > client_as_etypes=None, > expected_salt=None, > authenticator_subkey=None, >+ preauth_key=None, > armor_key=None, > armor_tgt=None, > armor_subkey=None, >@@ -1838,7 +1838,6 @@ class RawKerberosTest(TestCaseInTempDir): > 'generate_padata_fn': generate_padata_fn, > 'check_error_fn': check_error_fn, > 'check_rep_fn': check_rep_fn, >- 'check_padata_fn': check_padata_fn, > 'check_kdc_private_fn': check_kdc_private_fn, > 'callback_dict': callback_dict, > 'expected_error_mode': expected_error_mode, >@@ -1846,6 +1845,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'client_as_etypes': client_as_etypes, > 'expected_salt': expected_salt, > 'authenticator_subkey': authenticator_subkey, >+ 'preauth_key': preauth_key, > 'armor_key': armor_key, > 'armor_tgt': armor_tgt, > 'armor_subkey': armor_subkey, >@@ -1878,7 +1878,6 @@ class RawKerberosTest(TestCaseInTempDir): > generate_padata_fn=None, > check_error_fn=None, > check_rep_fn=None, >- check_padata_fn=None, > check_kdc_private_fn=None, > expected_error_mode=0, > expected_status=None, >@@ -1922,7 +1921,6 @@ class RawKerberosTest(TestCaseInTempDir): > 'generate_padata_fn': generate_padata_fn, > 'check_error_fn': check_error_fn, > 'check_rep_fn': check_rep_fn, >- 'check_padata_fn': check_padata_fn, > 'check_kdc_private_fn': check_kdc_private_fn, > 'callback_dict': callback_dict, > 'expected_error_mode': expected_error_mode, >@@ -1956,7 +1954,6 @@ class RawKerberosTest(TestCaseInTempDir): > expected_srealm = kdc_exchange_dict['expected_srealm'] > expected_sname = kdc_exchange_dict['expected_sname'] > ticket_decryption_key = kdc_exchange_dict['ticket_decryption_key'] >- check_padata_fn = kdc_exchange_dict['check_padata_fn'] > check_kdc_private_fn = kdc_exchange_dict['check_kdc_private_fn'] > rep_encpart_asn1Spec = kdc_exchange_dict['rep_encpart_asn1Spec'] > msg_type = kdc_exchange_dict['rep_msg_type'] >@@ -2004,41 +2001,37 @@ class RawKerberosTest(TestCaseInTempDir): > > ticket_checksum = None > >- encpart_decryption_key = None >- self.assertIsNotNone(check_padata_fn) >- if check_padata_fn is not None: >- # See if we can get the decryption key from the preauth phase >- encpart_decryption_key, encpart_decryption_usage = ( >- check_padata_fn(kdc_exchange_dict, callback_dict, >- rep, padata)) >- >- if armor_key is not None: >- pa_dict = self.get_pa_dict(padata) >- >- if PADATA_FX_FAST in pa_dict: >- fx_fast_data = pa_dict[PADATA_FX_FAST] >- fast_response = self.check_fx_fast_data(kdc_exchange_dict, >- fx_fast_data, >- armor_key, >- finished=True) >- >- if 'strengthen-key' in fast_response: >- strengthen_key = self.EncryptionKey_import( >- fast_response['strengthen-key']) >- encpart_decryption_key = ( >- self.generate_strengthen_reply_key( >- strengthen_key, >- encpart_decryption_key)) >- >- fast_finished = fast_response.get('finished', None) >- if fast_finished is not None: >- ticket_checksum = fast_finished['ticket-checksum'] >- >- self.check_rep_padata(kdc_exchange_dict, >- callback_dict, >- rep, >- fast_response['padata'], >- error_code=0) >+ # Get the decryption key for the encrypted part >+ encpart_decryption_key, encpart_decryption_usage = ( >+ self.get_preauth_key(kdc_exchange_dict)) >+ >+ if armor_key is not None: >+ pa_dict = self.get_pa_dict(padata) >+ >+ if PADATA_FX_FAST in pa_dict: >+ fx_fast_data = pa_dict[PADATA_FX_FAST] >+ fast_response = self.check_fx_fast_data(kdc_exchange_dict, >+ fx_fast_data, >+ armor_key, >+ finished=True) >+ >+ if 'strengthen-key' in fast_response: >+ strengthen_key = self.EncryptionKey_import( >+ fast_response['strengthen-key']) >+ encpart_decryption_key = ( >+ self.generate_strengthen_reply_key( >+ strengthen_key, >+ encpart_decryption_key)) >+ >+ fast_finished = fast_response.get('finished') >+ if fast_finished is not None: >+ ticket_checksum = fast_finished['ticket-checksum'] >+ >+ self.check_rep_padata(kdc_exchange_dict, >+ callback_dict, >+ rep, >+ fast_response['padata'], >+ error_code=0) > > ticket_private = None > self.assertIsNotNone(ticket_decryption_key) >@@ -2558,13 +2551,7 @@ class RawKerberosTest(TestCaseInTempDir): > armor_key = kdc_exchange_dict['armor_key'] > self.assertIsNotNone(armor_key) > >- check_padata_fn = kdc_exchange_dict['check_padata_fn'] >- padata = self.getElementValue(rep, 'padata') >- self.assertIsNotNone(check_padata_fn) >- preauth_key, _ = check_padata_fn(kdc_exchange_dict, >- callback_dict, >- rep, >- padata) >+ preauth_key, _ = self.get_preauth_key(kdc_exchange_dict) > > kdc_challenge_key = self.generate_kdc_challenge_key( > armor_key, preauth_key) >@@ -2790,21 +2777,25 @@ class RawKerberosTest(TestCaseInTempDir): > > return padata, req_body > >- def check_simple_tgs_padata(self, >- kdc_exchange_dict, >- callback_dict, >- rep, >- padata): >- tgt = kdc_exchange_dict['tgt'] >- authenticator_subkey = kdc_exchange_dict['authenticator_subkey'] >- if authenticator_subkey is not None: >- subkey = authenticator_subkey >- subkey_usage = KU_TGS_REP_ENC_PART_SUB_KEY >- else: >- subkey = tgt.session_key >- subkey_usage = KU_TGS_REP_ENC_PART_SESSION >+ def get_preauth_key(self, kdc_exchange_dict): >+ msg_type = kdc_exchange_dict['rep_msg_type'] >+ >+ if msg_type == KRB_AS_REP: >+ key = kdc_exchange_dict['preauth_key'] >+ usage = KU_AS_REP_ENC_PART >+ else: # KRB_TGS_REP >+ authenticator_subkey = kdc_exchange_dict['authenticator_subkey'] >+ if authenticator_subkey is not None: >+ key = authenticator_subkey >+ usage = KU_TGS_REP_ENC_PART_SUB_KEY >+ else: >+ tgt = kdc_exchange_dict['tgt'] >+ key = tgt.session_key >+ usage = KU_TGS_REP_ENC_PART_SESSION >+ >+ self.assertIsNotNone(key) > >- return subkey, subkey_usage >+ return key, usage > > def generate_armor_key(self, subkey, session_key): > armor_key = kcrypto.cf2(subkey.key, >@@ -2926,13 +2917,6 @@ class RawKerberosTest(TestCaseInTempDir): > req_body): > return padata, req_body > >- def _check_padata_preauth_key(_kdc_exchange_dict, >- _callback_dict, >- rep, >- padata): >- as_rep_usage = KU_AS_REP_ENC_PART >- return preauth_key, as_rep_usage >- > if not expected_error_mode: > check_error_fn = None > check_rep_fn = self.generic_check_kdc_rep >@@ -2954,13 +2938,13 @@ class RawKerberosTest(TestCaseInTempDir): > generate_padata_fn=generate_padata_fn, > check_error_fn=check_error_fn, > check_rep_fn=check_rep_fn, >- check_padata_fn=_check_padata_preauth_key, > check_kdc_private_fn=self.generic_check_kdc_private, > expected_error_mode=expected_error_mode, > client_as_etypes=client_as_etypes, > expected_salt=expected_salt, > expected_flags=expected_flags, > unexpected_flags=unexpected_flags, >+ preauth_key=preauth_key, > kdc_options=str(kdc_options), > pac_request=pac_request, > pac_options=pac_options, >-- >2.25.1 > > >From 4b5d8671021a6efcdfef274514efb0632288169d Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 3 Sep 2021 15:36:24 +1200 >Subject: [PATCH 253/380] tests/krb5: Add get_cached_creds() method to create > persistent accounts for testing > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit c9fd8ffd8927ef42fd555e690f966f65aa01332e) >--- > python/samba/tests/krb5/fast_tests.py | 2 +- > python/samba/tests/krb5/kdc_base_test.py | 191 +++++++++++++++-------- > 2 files changed, 125 insertions(+), 68 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 12235cd439e..106b9b1fb78 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1108,7 +1108,7 @@ class FAST_Tests(KDCBaseTest): > target_sname = self.PrincipalName_create( > name_type=NT_SRV_INST, names=[target_service, target_username]) > target_decryption_key = self.TicketDecryptionKey_from_creds( >- target_creds, etype=kcrypto.Enctype.RC4) >+ target_creds) > > fast_cookie = None > preauth_etype_info2 = None >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 49a3227c26e..b2b9d87c3af 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -22,6 +22,7 @@ from datetime import datetime, timezone > import tempfile > import binascii > import collections >+import secrets > > from collections import namedtuple > import ldb >@@ -37,7 +38,10 @@ from samba.dsdb import ( > DS_GUID_COMPUTERS_CONTAINER, > DS_GUID_USERS_CONTAINER, > UF_WORKSTATION_TRUST_ACCOUNT, >- UF_NORMAL_ACCOUNT >+ UF_NO_AUTH_DATA_REQUIRED, >+ UF_NORMAL_ACCOUNT, >+ UF_NOT_DELEGATED, >+ UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION > ) > from samba.ndr import ndr_pack, ndr_unpack > from samba import net >@@ -88,9 +92,17 @@ class KDCBaseTest(RawKerberosTest): > > cls._functional_level = None > >+ # An identifier to ensure created accounts have unique names. Windows >+ # caches accounts based on usernames, so account names being different >+ # across test runs avoids previous test runs affecting the results. >+ cls.account_base = f'krb5_{secrets.token_hex(5)}_' >+ cls.account_id = 0 >+ > # A set containing DNs of accounts created as part of testing. > cls.accounts = set() > >+ cls.account_cache = {} >+ > @classmethod > def tearDownClass(cls): > # Clean up any accounts created by create_account. This is >@@ -322,24 +334,113 @@ class KDCBaseTest(RawKerberosTest): > creds.set_tgs_supported_enctypes(supported_enctypes) > creds.set_ap_supported_enctypes(supported_enctypes) > >- def get_client_creds(self, >- allow_missing_password=False, >- allow_missing_keys=True): >- def create_client_account(): >- samdb = self.get_samdb() >+ def get_cached_creds(self, *, >+ machine_account, >+ opts=None): >+ if opts is None: >+ opts = {} >+ >+ opts_default = { >+ 'no_auth_data_required': False, >+ 'supported_enctypes': None, >+ 'not_delegated': False, >+ 'allowed_to_delegate_to': None, >+ 'trusted_to_auth_for_delegation': False, >+ 'fast_support': False >+ } >+ >+ account_opts = { >+ 'machine_account': machine_account, >+ **opts_default, >+ **opts >+ } >+ >+ cache_key = tuple(sorted(account_opts.items())) >+ >+ creds = self.account_cache.get(cache_key) >+ if creds is None: >+ creds = self.create_account_opts(**account_opts) >+ self.account_cache[cache_key] = creds >+ >+ return creds >+ >+ def create_account_opts(self, *, >+ machine_account, >+ no_auth_data_required, >+ supported_enctypes, >+ not_delegated, >+ allowed_to_delegate_to, >+ trusted_to_auth_for_delegation, >+ fast_support): >+ if machine_account: >+ self.assertFalse(not_delegated) >+ else: >+ self.assertIsNone(allowed_to_delegate_to) >+ self.assertFalse(trusted_to_auth_for_delegation) > >- creds, dn = self.create_account(samdb, 'kdctestclient') >+ samdb = self.get_samdb() > >- res = samdb.search(base=dn, >- scope=ldb.SCOPE_BASE, >- attrs=['msDS-KeyVersionNumber']) >- kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >- creds.set_kvno(kvno) >+ user_name = self.account_base + str(self.account_id) >+ type(self).account_id += 1 > >- keys = self.get_keys(samdb, dn) >- self.creds_set_keys(creds, keys) >+ user_account_control = 0 >+ if trusted_to_auth_for_delegation: >+ user_account_control |= UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION >+ if not_delegated: >+ user_account_control |= UF_NOT_DELEGATED >+ if no_auth_data_required: >+ user_account_control |= UF_NO_AUTH_DATA_REQUIRED > >- return creds >+ details = {} >+ >+ enctypes = supported_enctypes >+ if fast_support: >+ fast_bits = (security.KERB_ENCTYPE_FAST_SUPPORTED | >+ security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED | >+ security.KERB_ENCTYPE_CLAIMS_SUPPORTED) >+ enctypes = (enctypes or 0) | fast_bits >+ >+ if enctypes is not None: >+ details['msDS-SupportedEncryptionTypes'] = str(enctypes) >+ >+ if allowed_to_delegate_to: >+ details['msDS-AllowedToDelegateTo'] = allowed_to_delegate_to >+ >+ if machine_account: >+ spn = 'host/' + user_name >+ else: >+ spn = None >+ >+ creds, dn = self.create_account(samdb, user_name, >+ machine_account=machine_account, >+ spn=spn, >+ additional_details=details, >+ account_control=user_account_control) >+ >+ res = samdb.search(base=dn, >+ scope=ldb.SCOPE_BASE, >+ attrs=['msDS-KeyVersionNumber']) >+ kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >+ creds.set_kvno(kvno) >+ >+ keys = self.get_keys(samdb, dn) >+ self.creds_set_keys(creds, keys) >+ >+ if machine_account: >+ if supported_enctypes is not None: >+ tgs_enctypes = supported_enctypes >+ else: >+ tgs_enctypes = security.KERB_ENCTYPE_RC4_HMAC_MD5 >+ >+ creds.set_tgs_supported_enctypes(tgs_enctypes) >+ >+ return creds >+ >+ def get_client_creds(self, >+ allow_missing_password=False, >+ allow_missing_keys=True): >+ def create_client_account(): >+ return self.get_cached_creds(machine_account=False) > > c = self._get_krb5_creds(prefix='CLIENT', > allow_missing_password=allow_missing_password, >@@ -351,32 +452,8 @@ class KDCBaseTest(RawKerberosTest): > allow_missing_password=False, > allow_missing_keys=True): > def create_mach_account(): >- samdb = self.get_samdb() >- >- mach_name = 'kdctestmac' >- details = { >- 'msDS-SupportedEncryptionTypes': str( >- security.KERB_ENCTYPE_FAST_SUPPORTED | >- security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED | >- security.KERB_ENCTYPE_CLAIMS_SUPPORTED >- ) >- } >- >- creds, dn = self.create_account(samdb, mach_name, >- machine_account=True, >- spn='host/' + mach_name, >- additional_details=details) >- >- res = samdb.search(base=dn, >- scope=ldb.SCOPE_BASE, >- attrs=['msDS-KeyVersionNumber']) >- kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >- creds.set_kvno(kvno) >- >- keys = self.get_keys(samdb, dn) >- self.creds_set_keys(creds, keys) >- >- return creds >+ return self.get_cached_creds(machine_account=True, >+ opts={'fast_support': True}) > > c = self._get_krb5_creds(prefix='MAC', > allow_missing_password=allow_missing_password, >@@ -388,32 +465,12 @@ class KDCBaseTest(RawKerberosTest): > allow_missing_password=False, > allow_missing_keys=True): > def create_service_account(): >- samdb = self.get_samdb() >- >- mach_name = 'kdctestservice' >- details = { >- 'msDS-SupportedEncryptionTypes': str( >- security.KERB_ENCTYPE_FAST_SUPPORTED | >- security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED | >- security.KERB_ENCTYPE_CLAIMS_SUPPORTED >- ) >- } >- >- creds, dn = self.create_account(samdb, mach_name, >- machine_account=True, >- spn='host/' + mach_name, >- additional_details=details) >- >- res = samdb.search(base=dn, >- scope=ldb.SCOPE_BASE, >- attrs=['msDS-KeyVersionNumber']) >- kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >- creds.set_kvno(kvno) >- >- keys = self.get_keys(samdb, dn) >- self.creds_set_keys(creds, keys) >- >- return creds >+ return self.get_cached_creds( >+ machine_account=True, >+ opts={ >+ 'trusted_to_auth_for_delegation': True, >+ 'fast_support': True >+ }) > > c = self._get_krb5_creds(prefix='SERVICE', > allow_missing_password=allow_missing_password, >-- >2.25.1 > > >From 1474c38fa96f1604dd5f875a1c91f2c1329b0c4d Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 8 Sep 2021 11:28:52 +1200 >Subject: [PATCH 254/380] tests/krb5: Generate padata for FAST tests > >This gives us access to parameters of kdc_exchange_dict and enables us >to simplify the logic. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit 943079fd94fec66cdc2ba4ea1b2beb2971473004) >--- > python/samba/tests/krb5/fast_tests.py | 101 ++++++++++++++++---------- > 1 file changed, 61 insertions(+), 40 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 106b9b1fb78..8024b92f445 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1017,19 +1017,6 @@ class FAST_Tests(KDCBaseTest): > # challenge is only considered a replay if the ciphertext is identical > # to a previous challenge. Windows does not perform this check. > >- class GenerateEncChallengePadataReplay: >- def __init__(replay): >- replay._padata = None >- >- def __call__(replay, key, armor_key): >- if replay._padata is None: >- client_challenge_key = ( >- self.generate_client_challenge_key(armor_key, key)) >- replay._padata = self.get_challenge_pa_data( >- client_challenge_key) >- >- return replay._padata >- > self._run_test_sequence([ > { > 'rep_type': KRB_AS_REP, >@@ -1042,28 +1029,72 @@ class FAST_Tests(KDCBaseTest): > 'rep_type': KRB_AS_REP, > 'expected_error_mode': 0, > 'use_fast': True, >- 'gen_padata_fn': GenerateEncChallengePadataReplay(), >+ 'gen_padata_fn': self.generate_enc_challenge_padata_replay, > 'fast_armor': FX_FAST_ARMOR_AP_REQUEST, > 'gen_armor_tgt_fn': self.get_mach_tgt, > 'repeat': 2 > } > ]) > >- def generate_enc_timestamp_padata(self, key, _armor_key): >- return self.get_enc_timestamp_pa_data_from_key(key) >+ def generate_enc_timestamp_padata(self, >+ kdc_exchange_dict, >+ callback_dict, >+ req_body): >+ key = kdc_exchange_dict['preauth_key'] >+ >+ padata = self.get_enc_timestamp_pa_data_from_key(key) >+ return [padata], req_body >+ >+ def generate_enc_challenge_padata(self, >+ kdc_exchange_dict, >+ callback_dict, >+ req_body, >+ skew=0): >+ armor_key = kdc_exchange_dict['armor_key'] >+ key = kdc_exchange_dict['preauth_key'] > >- def generate_enc_challenge_padata(self, key, armor_key, skew=0): > client_challenge_key = ( > self.generate_client_challenge_key(armor_key, key)) >- return self.get_challenge_pa_data(client_challenge_key, skew=skew) >+ padata = self.get_challenge_pa_data(client_challenge_key, skew=skew) >+ return [padata], req_body >+ >+ def generate_enc_challenge_padata_wrong_key_kdc(self, >+ kdc_exchange_dict, >+ callback_dict, >+ req_body): >+ armor_key = kdc_exchange_dict['armor_key'] >+ key = kdc_exchange_dict['preauth_key'] > >- def generate_enc_challenge_padata_wrong_key_kdc(self, key, armor_key): > kdc_challenge_key = ( > self.generate_kdc_challenge_key(armor_key, key)) >- return self.get_challenge_pa_data(kdc_challenge_key) >+ padata = self.get_challenge_pa_data(kdc_challenge_key) >+ return [padata], req_body > >- def generate_enc_challenge_padata_wrong_key(self, key, _armor_key): >- return self.get_challenge_pa_data(key) >+ def generate_enc_challenge_padata_wrong_key(self, >+ kdc_exchange_dict, >+ callback_dict, >+ req_body): >+ key = kdc_exchange_dict['preauth_key'] >+ >+ padata = self.get_challenge_pa_data(key) >+ return [padata], req_body >+ >+ def generate_enc_challenge_padata_replay(self, >+ kdc_exchange_dict, >+ callback_dict, >+ req_body): >+ padata = callback_dict.get('replay_padata') >+ >+ if padata is None: >+ armor_key = kdc_exchange_dict['armor_key'] >+ key = kdc_exchange_dict['preauth_key'] >+ >+ client_challenge_key = ( >+ self.generate_client_challenge_key(armor_key, key)) >+ padata = self.get_challenge_pa_data(client_challenge_key) >+ callback_dict['replay_padata'] = padata >+ >+ return [padata], req_body > > def generate_empty_fast(self, > _kdc_exchange_dict, >@@ -1251,35 +1282,25 @@ class FAST_Tests(KDCBaseTest): > kdc_options = kdc_dict.pop('kdc_options', kdc_options_default) > > gen_padata_fn = kdc_dict.pop('gen_padata_fn', None) >- if gen_padata_fn is not None: >- self.assertEqual(KRB_AS_REP, rep_type) >+ >+ if rep_type == KRB_AS_REP and gen_padata_fn is not None: > self.assertIsNotNone(preauth_etype_info2) > > preauth_key = self.PasswordKey_from_etype_info2( > client_creds, > preauth_etype_info2[0], > client_creds.get_kvno()) >- padata = [gen_padata_fn(preauth_key, armor_key)] > else: > preauth_key = None >- padata = [] > > if use_fast: >- inner_padata = padata >- outer_padata = [] >+ generate_fast_padata_fn = gen_padata_fn >+ generate_padata_fn = (functools.partial(_generate_padata_copy, >+ padata=[fast_cookie]) >+ if fast_cookie is not None else None) > else: >- inner_padata = [] >- outer_padata = padata >- >- if use_fast and fast_cookie is not None: >- outer_padata.append(fast_cookie) >- >- generate_fast_padata_fn = (functools.partial(_generate_padata_copy, >- padata=inner_padata) >- if inner_padata else None) >- generate_padata_fn = (functools.partial(_generate_padata_copy, >- padata=outer_padata) >- if outer_padata else None) >+ generate_fast_padata_fn = None >+ generate_padata_fn = gen_padata_fn > > gen_authdata_fn = kdc_dict.pop('gen_authdata_fn', None) > if gen_authdata_fn is not None: >-- >2.25.1 > > >From 4df6f1237e7fe42e00d33607af2bc57dd24a136d Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 13 Sep 2021 21:14:18 +1200 >Subject: [PATCH 255/380] tests/krb5: Sign-extend kvno from 32-bit integer > >This helps to avoid problems with RODC kvnos that have the high bit set. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit 7bc52cecb442c4bcbd39372a8b98bb033e4d1540) >--- > python/samba/tests/krb5/raw_testcase.py | 3 +++ > 1 file changed, 3 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 164d06b9788..cca38fb9480 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -294,6 +294,9 @@ class KerberosCredentials(Credentials): > return self._get_krb5_etypes(self.ap_supported_enctypes) > > def set_kvno(self, kvno): >+ # Sign-extend from 32 bits. >+ if kvno & 1 << 31: >+ kvno |= -1 << 31 > self.kvno = kvno > > def get_kvno(self): >-- >2.25.1 > > >From c8e76b229ee4a6464ae8fabf526517b65f586e5b Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 13 Sep 2021 20:20:23 +1200 >Subject: [PATCH 256/380] tests/krb5: Add method to get RODC krbtgt credentials > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit a5bf7aad54b7053417a24ae0918ee42ceed7bf21) >--- > python/samba/tests/krb5/kdc_base_test.py | 74 ++++++++++++++++++++++++ > 1 file changed, 74 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index b2b9d87c3af..fd2e4d08cd3 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -89,6 +89,7 @@ class KDCBaseTest(RawKerberosTest): > cls._lp = None > > cls._ldb = None >+ cls._rodc_ldb = None > > cls._functional_level = None > >@@ -137,6 +138,30 @@ class KDCBaseTest(RawKerberosTest): > > return self._ldb > >+ def get_rodc_samdb(self): >+ if self._rodc_ldb is None: >+ creds = self.get_admin_creds() >+ lp = self.get_lp() >+ >+ session = system_session() >+ type(self)._rodc_ldb = SamDB(url="ldap://%s" % self.host, >+ session_info=session, >+ credentials=creds, >+ lp=lp, >+ am_rodc=True) >+ >+ return self._rodc_ldb >+ >+ def get_server_dn(self, samdb): >+ server = samdb.get_serverName() >+ >+ res = samdb.search(base=server, >+ scope=ldb.SCOPE_BASE, >+ attrs=['serverReference']) >+ dn = ldb.Dn(samdb, res[0]['serverReference'][0].decode('utf8')) >+ >+ return dn >+ > def get_domain_functional_level(self, ldb): > if self._functional_level is None: > res = ldb.search(base='', >@@ -478,6 +503,55 @@ class KDCBaseTest(RawKerberosTest): > fallback_creds_fn=create_service_account) > return c > >+ def get_rodc_krbtgt_creds(self, >+ require_keys=True, >+ require_strongest_key=False): >+ if require_strongest_key: >+ self.assertTrue(require_keys) >+ >+ def download_rodc_krbtgt_creds(): >+ samdb = self.get_samdb() >+ rodc_samdb = self.get_rodc_samdb() >+ >+ rodc_dn = self.get_server_dn(rodc_samdb) >+ >+ res = samdb.search(rodc_dn, >+ scope=ldb.SCOPE_BASE, >+ attrs=['msDS-KrbTgtLink']) >+ krbtgt_dn = res[0]['msDS-KrbTgtLink'][0] >+ >+ res = samdb.search(krbtgt_dn, >+ scope=ldb.SCOPE_BASE, >+ attrs=['sAMAccountName', >+ 'msDS-KeyVersionNumber', >+ 'msDS-SecondaryKrbTgtNumber']) >+ krbtgt_dn = res[0].dn >+ username = str(res[0]['sAMAccountName']) >+ >+ creds = KerberosCredentials() >+ creds.set_domain(self.env_get_var('DOMAIN', 'RODC_KRBTGT')) >+ creds.set_realm(self.env_get_var('REALM', 'RODC_KRBTGT')) >+ creds.set_username(username) >+ >+ kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >+ krbtgt_number = int(res[0]['msDS-SecondaryKrbTgtNumber'][0]) >+ >+ rodc_kvno = krbtgt_number << 16 | kvno >+ creds.set_kvno(rodc_kvno) >+ creds.set_dn(krbtgt_dn) >+ >+ keys = self.get_keys(samdb, krbtgt_dn) >+ self.creds_set_keys(creds, keys) >+ >+ return creds >+ >+ c = self._get_krb5_creds(prefix='RODC_KRBTGT', >+ allow_missing_password=True, >+ allow_missing_keys=not require_keys, >+ require_strongest_key=require_strongest_key, >+ fallback_creds_fn=download_rodc_krbtgt_creds) >+ return c >+ > def get_krbtgt_creds(self, > require_keys=True, > require_strongest_key=False): >-- >2.25.1 > > >From a4c78391a2b0fb9e85d886ddd0b6b1ae08549bb1 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 13 Sep 2021 20:58:01 +1200 >Subject: [PATCH 257/380] tests/krb5: Add get_secrets() method to get the > secret attributes of a DN > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit af633992e31e839cdd7f77740c1f25d129be2f79) >--- > python/samba/tests/krb5/kdc_base_test.py | 26 +++++++++++++++++++----- > 1 file changed, 21 insertions(+), 5 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index fd2e4d08cd3..3681d26bb83 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -250,7 +250,9 @@ class KDCBaseTest(RawKerberosTest): > > return (creds, dn) > >- def get_keys(self, samdb, dn): >+ def get_secrets(self, samdb, dn, >+ destination_dsa_guid, >+ source_dsa_invocation_id): > admin_creds = self.get_admin_creds() > > dns_hostname = samdb.host_dns_name() >@@ -258,15 +260,13 @@ class KDCBaseTest(RawKerberosTest): > self.get_lp(), > admin_creds) > >- destination_dsa_guid = misc.GUID(samdb.get_ntds_GUID()) >- > req = drsuapi.DsGetNCChangesRequest8() > > req.destination_dsa_guid = destination_dsa_guid >- req.source_dsa_invocation_id = misc.GUID() >+ req.source_dsa_invocation_id = source_dsa_invocation_id > > naming_context = drsuapi.DsReplicaObjectIdentifier() >- naming_context.dn = str(dn) >+ naming_context.dn = dn > > req.naming_context = naming_context > >@@ -299,9 +299,25 @@ class KDCBaseTest(RawKerberosTest): > req.mapping_ctr.mappings = None > > _, ctr = bind.DsGetNCChanges(handle, 8, req) >+ >+ self.assertEqual(1, ctr.object_count) >+ > identifier = ctr.first_object.object.identifier > attributes = ctr.first_object.object.attribute_ctr.attributes > >+ self.assertEqual(dn, identifier.dn) >+ >+ return bind, identifier, attributes >+ >+ def get_keys(self, samdb, dn): >+ admin_creds = self.get_admin_creds() >+ >+ bind, identifier, attributes = self.get_secrets( >+ samdb, >+ str(dn), >+ destination_dsa_guid=misc.GUID(samdb.get_ntds_GUID()), >+ source_dsa_invocation_id=misc.GUID()) >+ > rid = identifier.sid.split()[1] > > net_ctx = net.Net(admin_creds) >-- >2.25.1 > > >From 500e3b8a6edca6cdcdaf591f658588d0d7cbc203 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 13 Sep 2021 22:13:24 +1200 >Subject: [PATCH 258/380] tests/krb5: Allow replicating accounts to the RODC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit 3cc9e77f38f6698aa01abca4285a520c7c0cd2ac) >--- > python/samba/tests/krb5/kdc_base_test.py | 141 ++++++++++++++++++++++- > 1 file changed, 139 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 3681d26bb83..56102cfc4ea 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -31,8 +31,9 @@ from samba import generate_random_password > from samba.auth import system_session > from samba.credentials import Credentials, SPECIFIED, MUST_USE_KERBEROS > from samba.dcerpc import drsblobs, drsuapi, misc, krb5pac, krb5ccache, security >-from samba.drs_utils import drsuapi_connect >+from samba.drs_utils import drs_Replicate, drsuapi_connect > from samba.dsdb import ( >+ DSDB_SYNTAX_BINARY_DN, > DS_DOMAIN_FUNCTION_2000, > DS_DOMAIN_FUNCTION_2008, > DS_GUID_COMPUTERS_CONTAINER, >@@ -45,7 +46,7 @@ from samba.dsdb import ( > ) > from samba.ndr import ndr_pack, ndr_unpack > from samba import net >-from samba.samdb import SamDB >+from samba.samdb import SamDB, dsdb_Dn > > from samba.tests import delete_force > import samba.tests.krb5.kcrypto as kcrypto >@@ -104,12 +105,20 @@ class KDCBaseTest(RawKerberosTest): > > cls.account_cache = {} > >+ cls.ldb_cleanups = [] >+ > @classmethod > def tearDownClass(cls): > # Clean up any accounts created by create_account. This is > # done in tearDownClass() rather than tearDown(), so that > # accounts need only be created once for permutation tests. > if cls._ldb is not None: >+ for cleanup in reversed(cls.ldb_cleanups): >+ try: >+ cls._ldb.modify(cleanup) >+ except ldb.LdbError: >+ pass >+ > for dn in cls.accounts: > delete_force(cls._ldb, dn) > super().tearDownClass() >@@ -250,6 +259,76 @@ class KDCBaseTest(RawKerberosTest): > > return (creds, dn) > >+ def replicate_account_to_rodc(self, dn): >+ samdb = self.get_samdb() >+ rodc_samdb = self.get_rodc_samdb() >+ >+ repl_val = f'{samdb.get_dsServiceName()}:{dn}:SECRETS_ONLY' >+ >+ msg = ldb.Message() >+ msg.dn = ldb.Dn(rodc_samdb, '') >+ msg['replicateSingleObject'] = ldb.MessageElement( >+ repl_val, >+ ldb.FLAG_MOD_REPLACE, >+ 'replicateSingleObject') >+ >+ try: >+ # Try replication using the replicateSingleObject rootDSE >+ # operation. >+ rodc_samdb.modify(msg) >+ except ldb.LdbError as err: >+ enum, estr = err.args >+ self.assertEqual(enum, ldb.ERR_UNWILLING_TO_PERFORM) >+ self.assertIn('rootdse_modify: unknown attribute to change!', >+ estr) >+ >+ # If that method wasn't supported, we may be in the rodc:local test >+ # environment, where we can try replicating to the local database. >+ >+ lp = self.get_lp() >+ >+ rodc_creds = Credentials() >+ rodc_creds.guess(lp) >+ rodc_creds.set_machine_account(lp) >+ >+ local_samdb = SamDB(url=None, session_info=system_session(), >+ credentials=rodc_creds, lp=lp) >+ >+ destination_dsa_guid = misc.GUID(local_samdb.get_ntds_GUID()) >+ >+ repl = drs_Replicate(f'ncacn_ip_tcp:{self.dc_host}[seal]', >+ lp, rodc_creds, >+ local_samdb, destination_dsa_guid) >+ >+ source_dsa_invocation_id = misc.GUID(samdb.invocation_id) >+ >+ repl.replicate(dn, >+ source_dsa_invocation_id, >+ destination_dsa_guid, >+ exop=drsuapi.DRSUAPI_EXOP_REPL_SECRET, >+ rodc=True) >+ >+ def check_revealed(self, dn, rodc_dn, revealed=True): >+ samdb = self.get_samdb() >+ >+ res = samdb.search(base=rodc_dn, >+ scope=ldb.SCOPE_BASE, >+ attrs=['msDS-RevealedUsers']) >+ >+ revealed_users = res[0].get('msDS-RevealedUsers') >+ if revealed_users is None: >+ self.assertFalse(revealed) >+ return >+ >+ revealed_dns = set(str(dsdb_Dn(samdb, str(user), >+ syntax_oid=DSDB_SYNTAX_BINARY_DN).dn) >+ for user in revealed_users) >+ >+ if revealed: >+ self.assertIn(str(dn), revealed_dns) >+ else: >+ self.assertNotIn(str(dn), revealed_dns) >+ > def get_secrets(self, samdb, dn, > destination_dsa_guid, > source_dsa_invocation_id): >@@ -375,6 +454,29 @@ class KDCBaseTest(RawKerberosTest): > creds.set_tgs_supported_enctypes(supported_enctypes) > creds.set_ap_supported_enctypes(supported_enctypes) > >+ def add_to_group(self, account_dn, group_dn, group_attr): >+ samdb = self.get_samdb() >+ >+ res = samdb.search(base=group_dn, >+ scope=ldb.SCOPE_BASE, >+ attrs=[group_attr]) >+ orig_msg = res[0] >+ >+ members = list(orig_msg[group_attr]) >+ members.append(account_dn) >+ >+ msg = ldb.Message() >+ msg.dn = group_dn >+ msg[group_attr] = ldb.MessageElement(members, >+ ldb.FLAG_MOD_REPLACE, >+ group_attr) >+ >+ cleanup = samdb.msg_diff(msg, orig_msg) >+ self.ldb_cleanups.append(cleanup) >+ samdb.modify(msg) >+ >+ return cleanup >+ > def get_cached_creds(self, *, > machine_account, > opts=None): >@@ -382,6 +484,9 @@ class KDCBaseTest(RawKerberosTest): > opts = {} > > opts_default = { >+ 'allowed_replication': False, >+ 'denied_replication': False, >+ 'revealed_to_rodc': False, > 'no_auth_data_required': False, > 'supported_enctypes': None, > 'not_delegated': False, >@@ -407,6 +512,9 @@ class KDCBaseTest(RawKerberosTest): > > def create_account_opts(self, *, > machine_account, >+ allowed_replication, >+ denied_replication, >+ revealed_to_rodc, > no_auth_data_required, > supported_enctypes, > not_delegated, >@@ -420,6 +528,9 @@ class KDCBaseTest(RawKerberosTest): > self.assertFalse(trusted_to_auth_for_delegation) > > samdb = self.get_samdb() >+ rodc_samdb = self.get_rodc_samdb() >+ >+ rodc_dn = self.get_server_dn(rodc_samdb) > > user_name = self.account_base + str(self.account_id) > type(self).account_id += 1 >@@ -475,6 +586,32 @@ class KDCBaseTest(RawKerberosTest): > > creds.set_tgs_supported_enctypes(tgs_enctypes) > >+ # Handle secret replication to the RODC. >+ >+ if allowed_replication or revealed_to_rodc: >+ # Allow replicating this account's secrets if requested, or allow >+ # it only temporarily if we're about to replicate them. >+ allowed_cleanup = self.add_to_group( >+ dn, rodc_dn, >+ 'msDS-RevealOnDemandGroup') >+ >+ if revealed_to_rodc: >+ # Replicate this account's secrets to the RODC. >+ self.replicate_account_to_rodc(dn) >+ >+ if not allowed_replication: >+ # If we don't want replicating secrets to be allowed for this >+ # account, disable it again. >+ samdb.modify(allowed_cleanup) >+ >+ self.check_revealed(dn, >+ rodc_dn, >+ revealed=revealed_to_rodc) >+ >+ if denied_replication: >+ # Deny replicating this account's secrets to the RODC. >+ self.add_to_group(dn, rodc_dn, 'msDS-NeverRevealGroup') >+ > return creds > > def get_client_creds(self, >-- >2.25.1 > > >From ee5b6a8122993bac45c95490f551ef58b44b7e1e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 13 Sep 2021 21:24:05 +1200 >Subject: [PATCH 259/380] tests/krb5: Create RODC account for testing > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit ef5666bc51ca80e1acdadd525a9c61762756c8e3) >--- > python/samba/tests/krb5/kdc_base_test.py | 114 +++++++++++++++++++++++ > 1 file changed, 114 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 56102cfc4ea..892d3aaf41f 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -42,8 +42,10 @@ from samba.dsdb import ( > UF_NO_AUTH_DATA_REQUIRED, > UF_NORMAL_ACCOUNT, > UF_NOT_DELEGATED, >+ UF_PARTIAL_SECRETS_ACCOUNT, > UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION > ) >+from samba.join import DCJoinContext > from samba.ndr import ndr_pack, ndr_unpack > from samba import net > from samba.samdb import SamDB, dsdb_Dn >@@ -105,6 +107,8 @@ class KDCBaseTest(RawKerberosTest): > > cls.account_cache = {} > >+ cls._rodc_ctx = None >+ > cls.ldb_cleanups = [] > > @classmethod >@@ -121,6 +125,10 @@ class KDCBaseTest(RawKerberosTest): > > for dn in cls.accounts: > delete_force(cls._ldb, dn) >+ >+ if cls._rodc_ctx is not None: >+ cls._rodc_ctx.cleanup_old_join(force=True) >+ > super().tearDownClass() > > def setUp(self): >@@ -171,6 +179,25 @@ class KDCBaseTest(RawKerberosTest): > > return dn > >+ def get_mock_rodc_ctx(self): >+ if self._rodc_ctx is None: >+ admin_creds = self.get_admin_creds() >+ lp = self.get_lp() >+ >+ rodc_name = 'KRB5RODC' >+ site_name = 'Default-First-Site-Name' >+ >+ type(self)._rodc_ctx = DCJoinContext(server=self.dc_host, >+ creds=admin_creds, >+ lp=lp, >+ site=site_name, >+ netbios_name=rodc_name, >+ targetdir=None, >+ domain=None) >+ self.create_rodc(self._rodc_ctx) >+ >+ return self._rodc_ctx >+ > def get_domain_functional_level(self, ldb): > if self._functional_level is None: > res = ldb.search(base='', >@@ -259,6 +286,49 @@ class KDCBaseTest(RawKerberosTest): > > return (creds, dn) > >+ def create_rodc(self, ctx): >+ ctx.nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn] >+ ctx.full_nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn] >+ ctx.krbtgt_dn = f'CN=krbtgt_{ctx.myname},CN=Users,{ctx.base_dn}' >+ >+ ctx.never_reveal_sid = [f'<SID={ctx.domsid}-{security.DOMAIN_RID_RODC_DENY}>', >+ f'<SID={security.SID_BUILTIN_ADMINISTRATORS}>', >+ f'<SID={security.SID_BUILTIN_SERVER_OPERATORS}>', >+ f'<SID={security.SID_BUILTIN_BACKUP_OPERATORS}>', >+ f'<SID={security.SID_BUILTIN_ACCOUNT_OPERATORS}>'] >+ ctx.reveal_sid = f'<SID={ctx.domsid}-{security.DOMAIN_RID_RODC_ALLOW}>' >+ >+ mysid = ctx.get_mysid() >+ admin_dn = f'<SID={mysid}>' >+ ctx.managedby = admin_dn >+ >+ ctx.userAccountControl = (UF_WORKSTATION_TRUST_ACCOUNT | >+ UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION | >+ UF_PARTIAL_SECRETS_ACCOUNT) >+ >+ ctx.connection_dn = f'CN=RODC Connection (FRS),{ctx.ntds_dn}' >+ ctx.secure_channel_type = misc.SEC_CHAN_RODC >+ ctx.RODC = True >+ ctx.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC | >+ drsuapi.DRSUAPI_DRS_PER_SYNC | >+ drsuapi.DRSUAPI_DRS_GET_ANC | >+ drsuapi.DRSUAPI_DRS_NEVER_SYNCED | >+ drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) >+ ctx.domain_replica_flags = ctx.replica_flags | drsuapi.DRSUAPI_DRS_CRITICAL_ONLY >+ >+ ctx.build_nc_lists() >+ >+ ctx.cleanup_old_join() >+ >+ try: >+ ctx.join_add_objects() >+ except Exception: >+ # cleanup the failed join (checking we still have a live LDB >+ # connection to the remote DC first) >+ ctx.refresh_ldb_connection() >+ ctx.cleanup_old_join() >+ raise >+ > def replicate_account_to_rodc(self, dn): > samdb = self.get_samdb() > rodc_samdb = self.get_rodc_samdb() >@@ -705,6 +775,50 @@ class KDCBaseTest(RawKerberosTest): > fallback_creds_fn=download_rodc_krbtgt_creds) > return c > >+ def get_mock_rodc_krbtgt_creds(self, >+ require_keys=True, >+ require_strongest_key=False): >+ if require_strongest_key: >+ self.assertTrue(require_keys) >+ >+ def create_rodc_krbtgt_account(): >+ samdb = self.get_samdb() >+ >+ rodc_ctx = self.get_mock_rodc_ctx() >+ >+ krbtgt_dn = rodc_ctx.new_krbtgt_dn >+ >+ res = samdb.search(base=ldb.Dn(samdb, krbtgt_dn), >+ scope=ldb.SCOPE_BASE, >+ attrs=['msDS-KeyVersionNumber', >+ 'msDS-SecondaryKrbTgtNumber']) >+ dn = res[0].dn >+ username = str(rodc_ctx.krbtgt_name) >+ >+ creds = KerberosCredentials() >+ creds.set_domain(self.env_get_var('DOMAIN', 'RODC_KRBTGT')) >+ creds.set_realm(self.env_get_var('REALM', 'RODC_KRBTGT')) >+ creds.set_username(username) >+ >+ kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >+ krbtgt_number = int(res[0]['msDS-SecondaryKrbTgtNumber'][0]) >+ >+ rodc_kvno = krbtgt_number << 16 | kvno >+ creds.set_kvno(rodc_kvno) >+ creds.set_dn(dn) >+ >+ keys = self.get_keys(samdb, dn) >+ self.creds_set_keys(creds, keys) >+ >+ return creds >+ >+ c = self._get_krb5_creds(prefix='MOCK_RODC_KRBTGT', >+ allow_missing_password=True, >+ allow_missing_keys=not require_keys, >+ require_strongest_key=require_strongest_key, >+ fallback_creds_fn=create_rodc_krbtgt_account) >+ return c >+ > def get_krbtgt_creds(self, > require_keys=True, > require_strongest_key=False): >-- >2.25.1 > > >From 19156c90a8b4ed356ca66a58c25b4344551fabf0 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 13 Sep 2021 21:24:31 +1200 >Subject: [PATCH 260/380] tests/krb5: Allow replicating accounts to the created > RODC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >(cherry picked from commit 35292bd32225b39ad7a03c3aa53027458f0671eb) >--- > python/samba/tests/krb5/kdc_base_test.py | 50 ++++++++++++++++++++++++ > 1 file changed, 50 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 892d3aaf41f..0e138352b06 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -378,6 +378,16 @@ class KDCBaseTest(RawKerberosTest): > exop=drsuapi.DRSUAPI_EXOP_REPL_SECRET, > rodc=True) > >+ def reveal_account_to_mock_rodc(self, dn): >+ samdb = self.get_samdb() >+ rodc_ctx = self.get_mock_rodc_ctx() >+ >+ self.get_secrets( >+ samdb, >+ dn, >+ destination_dsa_guid=rodc_ctx.ntds_guid, >+ source_dsa_invocation_id=misc.GUID(samdb.invocation_id)) >+ > def check_revealed(self, dn, rodc_dn, revealed=True): > samdb = self.get_samdb() > >@@ -555,8 +565,11 @@ class KDCBaseTest(RawKerberosTest): > > opts_default = { > 'allowed_replication': False, >+ 'allowed_replication_mock': False, > 'denied_replication': False, >+ 'denied_replication_mock': False, > 'revealed_to_rodc': False, >+ 'revealed_to_mock_rodc': False, > 'no_auth_data_required': False, > 'supported_enctypes': None, > 'not_delegated': False, >@@ -583,8 +596,11 @@ class KDCBaseTest(RawKerberosTest): > def create_account_opts(self, *, > machine_account, > allowed_replication, >+ allowed_replication_mock, > denied_replication, >+ denied_replication_mock, > revealed_to_rodc, >+ revealed_to_mock_rodc, > no_auth_data_required, > supported_enctypes, > not_delegated, >@@ -682,6 +698,40 @@ class KDCBaseTest(RawKerberosTest): > # Deny replicating this account's secrets to the RODC. > self.add_to_group(dn, rodc_dn, 'msDS-NeverRevealGroup') > >+ # Handle secret replication to the mock RODC. >+ >+ if allowed_replication_mock or revealed_to_mock_rodc: >+ # Allow replicating this account's secrets if requested, or allow >+ # it only temporarily if we want to add the account to the mock >+ # RODC's msDS-RevealedUsers. >+ rodc_ctx = self.get_mock_rodc_ctx() >+ mock_rodc_dn = ldb.Dn(samdb, rodc_ctx.acct_dn) >+ >+ allowed_mock_cleanup = self.add_to_group( >+ dn, mock_rodc_dn, >+ 'msDS-RevealOnDemandGroup') >+ >+ if revealed_to_mock_rodc: >+ # Request replicating this account's secrets to the mock RODC, >+ # which updates msDS-RevealedUsers. >+ self.reveal_account_to_mock_rodc(dn) >+ >+ if not allowed_replication_mock: >+ # If we don't want replicating secrets to be allowed for this >+ # account, disable it again. >+ samdb.modify(allowed_mock_cleanup) >+ >+ self.check_revealed(dn, >+ mock_rodc_dn, >+ revealed=revealed_to_mock_rodc) >+ >+ if denied_replication_mock: >+ # Deny replicating this account's secrets to the mock RODC. >+ rodc_ctx = self.get_mock_rodc_ctx() >+ mock_rodc_dn = ldb.Dn(samdb, rodc_ctx.acct_dn) >+ >+ self.add_to_group(dn, mock_rodc_dn, 'msDS-NeverRevealGroup') >+ > return creds > > def get_client_creds(self, >-- >2.25.1 > > >From cffc3746b572cd29d9bb6c70f4922074b6366e5b Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 1 Sep 2021 15:42:28 +1200 >Subject: [PATCH 261/380] python: Don't leak file handles > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Noel Power <npower@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit cde38d36b98f1d40e7b58cd4c4b4bedfab76c390) >--- > python/samba/__init__.py | 12 +++++++----- > python/samba/ms_schema.py | 6 +++--- > python/samba/schema.py | 9 +++++++-- > 3 files changed, 17 insertions(+), 10 deletions(-) > >diff --git a/python/samba/__init__.py b/python/samba/__init__.py >index d851bf3606c..e87e9c1b371 100644 >--- a/python/samba/__init__.py >+++ b/python/samba/__init__.py >@@ -218,7 +218,8 @@ class Ldb(_Ldb): > > :param ldif_path: Path to LDIF file. > """ >- self.add_ldif(open(ldif_path, 'r').read()) >+ with open(ldif_path, 'r') as ldif_file: >+ self.add_ldif(ldif_file.read()) > > def add_ldif(self, ldif, controls=None): > """Add data based on a LDIF string. >@@ -280,10 +281,11 @@ def read_and_sub_file(file_name, subst_vars): > :param file_name: File to be read (typically from setup directory) > param subst_vars: Optional variables to subsitute in the file. > """ >- data = open(file_name, 'r', encoding="utf-8").read() >- if subst_vars is not None: >- data = substitute_var(data, subst_vars) >- check_all_substituted(data) >+ with open(file_name, 'r', encoding="utf-8") as data_file: >+ data = data_file.read() >+ if subst_vars is not None: >+ data = substitute_var(data, subst_vars) >+ check_all_substituted(data) > return data > > >diff --git a/python/samba/ms_schema.py b/python/samba/ms_schema.py >index 4946636cbd4..09dfbdde0f7 100644 >--- a/python/samba/ms_schema.py >+++ b/python/samba/ms_schema.py >@@ -296,9 +296,9 @@ def __parse_schema_file(filename, objectClass): > out = [] > > from io import open >- f = open(filename, "r", encoding='latin-1') >- for entry in __read_raw_entries(f): >- out.append(__write_ldif_one(__transform_entry(entry, objectClass))) >+ with open(filename, "r", encoding='latin-1') as f: >+ for entry in __read_raw_entries(f): >+ out.append(__write_ldif_one(__transform_entry(entry, objectClass))) > > return "\n\n".join(out) > >diff --git a/python/samba/schema.py b/python/samba/schema.py >index caea7e358ae..083af5f44b0 100644 >--- a/python/samba/schema.py >+++ b/python/samba/schema.py >@@ -110,8 +110,13 @@ class Schema(object): > setup_path('ad-schema/%s' % Schema.base_schemas[base_schema][0]), > setup_path('ad-schema/%s' % Schema.base_schemas[base_schema][1])) > >+ def read_file(file): >+ with open(file, 'rb') as data_file: >+ return data_file.read() >+ > if files is not None: >- self.schema_data = "".join(get_string(open(file, 'rb').read()) for file in files) >+ self.schema_data = "".join(get_string(read_file(file)) >+ for file in files) > > self.schema_data = substitute_var(self.schema_data, > {"SCHEMADN": schemadn}) >@@ -130,7 +135,7 @@ class Schema(object): > if override_prefixmap is not None: > self.prefixmap_data = override_prefixmap > else: >- self.prefixmap_data = open(setup_path("prefixMap.txt"), 'rb').read() >+ self.prefixmap_data = read_file(setup_path("prefixMap.txt")) > > if additional_prefixmap is not None: > self.prefixmap_data += "".join("%s\n" % map for map in additional_prefixmap) >-- >2.25.1 > > >From 6ffb9e5e666c990455dc81bc52377efeba20f4bb Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 10 Sep 2021 14:02:22 +1200 >Subject: [PATCH 262/380] python/join: Check for correct msDS-KrbTgtLink > attribute > >Previously, the wrong case was used when checking for this attribute, >which meant krbtgt accounts were not being cleaned up. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Noel Power <npower@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 21a7717359082feaddfdf42788648c3d7574c28e) >--- > python/samba/join.py | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > >diff --git a/python/samba/join.py b/python/samba/join.py >index 0cffa3055df..4dab3ca2a9c 100644 >--- a/python/samba/join.py >+++ b/python/samba/join.py >@@ -258,8 +258,9 @@ class DCJoinContext(object): > > ctx.del_noerror(res[0].dn, recursive=True) > >- if "msDS-Krbtgtlink" in res[0]: >- ctx.new_krbtgt_dn = res[0]["msDS-Krbtgtlink"][0] >+ krbtgt_dn = res[0].get('msDS-KrbTgtLink', idx=0) >+ if krbtgt_dn is not None: >+ ctx.new_krbtgt_dn = krbtgt_dn > ctx.del_noerror(ctx.new_krbtgt_dn) > > res = ctx.samdb.search(base=ctx.samdb.get_default_basedn(), >@@ -338,7 +339,7 @@ class DCJoinContext(object): > attrs=["msDS-krbTgtLink", "userAccountControl", "serverReferenceBL", "rIDSetReferences"]) > if len(res) == 0: > raise Exception("Could not find domain member account '%s' to promote to a DC, use 'samba-tool domain join' instead'" % ctx.samname) >- if "msDS-krbTgtLink" in res[0] or "serverReferenceBL" in res[0] or "rIDSetReferences" in res[0]: >+ if "msDS-KrbTgtLink" in res[0] or "serverReferenceBL" in res[0] or "rIDSetReferences" in res[0]: > raise Exception("Account '%s' appears to be an active DC, use 'samba-tool domain join' if you must re-create this account" % ctx.samname) > if (int(res[0]["userAccountControl"][0]) & (samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT | > samba.dsdb.UF_SERVER_TRUST_ACCOUNT) == 0): >-- >2.25.1 > > >From ce2f191881dba4af17a19d10f0fb9b836f746d99 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 15 Sep 2021 20:56:28 +1200 >Subject: [PATCH 263/380] tests/krb5: Add helper method for modifying PACs > >This method can remove or replace a PAC in an authorization-data >container, while additionally returning the original PAC. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit a281ae09bcf35277c830c4112567c72233fd66b8) >--- > python/samba/tests/krb5/raw_testcase.py | 45 +++++++++++++++++++++++++ > 1 file changed, 45 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index cca38fb9480..b7df1ac0879 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -42,6 +42,8 @@ from samba.tests import TestCaseInTempDir > > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( >+ AD_IF_RELEVANT, >+ AD_WIN2K_PAC, > FX_FAST_ARMOR_AP_REQUEST, > KDC_ERR_GENERIC, > KDC_ERR_PREAUTH_FAILED, >@@ -2848,6 +2850,49 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_blob) > self.assertEqual(expected_checksum, checksum) > >+ def replace_pac(self, auth_data, new_pac, expect_pac=True): >+ if new_pac is not None: >+ self.assertElementEqual(new_pac, 'ad-type', AD_WIN2K_PAC) >+ self.assertElementPresent(new_pac, 'ad-data') >+ >+ new_auth_data = [] >+ >+ ad_relevant = None >+ old_pac = None >+ >+ for authdata_elem in auth_data: >+ if authdata_elem['ad-type'] == AD_IF_RELEVANT: >+ ad_relevant = self.der_decode( >+ authdata_elem['ad-data'], >+ asn1Spec=krb5_asn1.AD_IF_RELEVANT()) >+ >+ relevant_elems = [] >+ for relevant_elem in ad_relevant: >+ if relevant_elem['ad-type'] == AD_WIN2K_PAC: >+ self.assertIsNone(old_pac, 'Multiple PACs detected') >+ old_pac = relevant_elem['ad-data'] >+ >+ if new_pac is not None: >+ relevant_elems.append(new_pac) >+ else: >+ relevant_elems.append(relevant_elem) >+ if expect_pac: >+ self.assertIsNotNone(old_pac, 'Expected PAC') >+ >+ ad_relevant = self.der_encode( >+ relevant_elems, >+ asn1Spec=krb5_asn1.AD_IF_RELEVANT()) >+ >+ authdata_elem = self.AuthorizationData_create(AD_IF_RELEVANT, >+ ad_relevant) >+ >+ new_auth_data.append(authdata_elem) >+ >+ if expect_pac: >+ self.assertIsNotNone(ad_relevant, 'Expected AD-RELEVANT') >+ >+ return new_auth_data, old_pac >+ > def get_outer_pa_dict(self, kdc_exchange_dict): > return self.get_pa_dict(kdc_exchange_dict['req_padata']) > >-- >2.25.1 > > >From 8b9bb188c0de7da94d04683e261fc76721b1e660 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 11:22:28 +1200 >Subject: [PATCH 264/380] tests/krb5: Check correct flags element > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 0061fa2c2a26d990ed2e47441bca8797fc9be356) >--- > python/samba/tests/krb5/raw_testcase.py | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index b7df1ac0879..632f69794e6 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2193,7 +2193,7 @@ class RawKerberosTest(TestCaseInTempDir): > else: > self.assertElementMissing(encpart_private, > 'key-expiration') >- self.assertElementFlags(ticket_private, 'flags', >+ self.assertElementFlags(encpart_private, 'flags', > expected_flags, > unexpected_flags) > self.assertElementPresent(encpart_private, 'authtime') >-- >2.25.1 > > >From d477e01612a06e2d045c7c423edbaeab385c703b Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 11:13:09 +1200 >Subject: [PATCH 265/380] tests/krb5: Refactor tgs_req() to use > _generic_kdc_exchange > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 2a4d53dc12aa785f696e53ae3376f67375ce455f) >--- > python/samba/tests/krb5/kdc_base_test.py | 78 +++++++++++++----------- > python/samba/tests/krb5/kdc_tgs_tests.py | 3 +- > python/samba/tests/krb5/raw_testcase.py | 1 - > source4/selftest/tests.py | 18 ++++-- > 4 files changed, 58 insertions(+), 42 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 0e138352b06..6a370d3036e 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -52,7 +52,11 @@ from samba.samdb import SamDB, dsdb_Dn > > from samba.tests import delete_force > import samba.tests.krb5.kcrypto as kcrypto >-from samba.tests.krb5.raw_testcase import KerberosCredentials, RawKerberosTest >+from samba.tests.krb5.raw_testcase import ( >+ KerberosCredentials, >+ KerberosTicketCreds, >+ RawKerberosTest >+) > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( > AD_IF_RELEVANT, >@@ -66,7 +70,6 @@ from samba.tests.krb5.rfc4120_constants import ( > KU_AS_REP_ENC_PART, > KU_ENC_CHALLENGE_CLIENT, > KU_PA_ENC_TIMESTAMP, >- KU_TGS_REP_ENC_PART_SUB_KEY, > KU_TICKET, > NT_PRINCIPAL, > NT_SRV_HST, >@@ -1063,49 +1066,56 @@ class KDCBaseTest(RawKerberosTest): > else: > self.assertEqual(rep['error-code'], expected, "rep = {%s}" % rep) > >- def tgs_req(self, cname, sname, realm, ticket, key, etypes): >+ def tgs_req(self, cname, sname, realm, ticket, key, etypes, >+ expected_error_mode=0): > '''Send a TGS-REQ, returns the response and the decrypted and > decoded enc-part > ''' > > kdc_options = "0" >- till = self.get_KerberosTime(offset=36000) >- padata = [] > > subkey = self.RandomKey(key.etype) > > (ctime, cusec) = self.get_KerberosTimeWithUsec() > >- req = self.TGS_REQ_create(padata=padata, >- cusec=cusec, >- ctime=ctime, >- ticket=ticket, >- kdc_options=str(kdc_options), >- cname=cname, >- realm=realm, >- sname=sname, >- from_time=None, >- till_time=till, >- renew_time=None, >- nonce=0x7ffffffe, >- etypes=etypes, >- addresses=None, >- EncAuthorizationData=None, >- EncAuthorizationData_key=None, >- additional_tickets=None, >- ticket_session_key=key, >- authenticator_subkey=subkey) >- rep = self.send_recv_transaction(req) >- self.assertIsNotNone(rep) >+ tgt = KerberosTicketCreds(ticket, >+ key, >+ crealm=realm, >+ cname=cname) > >- msg_type = rep['msg-type'] >- enc_part = None >- if msg_type == KRB_TGS_REP: >- enc_part = subkey.decrypt( >- KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher']) >- enc_part = self.der_decode( >- enc_part, asn1Spec=krb5_asn1.EncTGSRepPart()) >- return (rep, enc_part) >+ if not expected_error_mode: >+ check_error_fn = None >+ check_rep_fn = self.generic_check_kdc_rep >+ else: >+ check_error_fn = self.generic_check_kdc_error >+ check_rep_fn = None >+ >+ kdc_exchange_dict = self.tgs_exchange_dict( >+ expected_crealm=realm, >+ expected_cname=cname, >+ expected_srealm=realm, >+ expected_sname=sname, >+ expected_error_mode=expected_error_mode, >+ check_error_fn=check_error_fn, >+ check_rep_fn=check_rep_fn, >+ check_kdc_private_fn=self.generic_check_kdc_private, >+ tgt=tgt, >+ authenticator_subkey=subkey, >+ kdc_options=str(kdc_options)) >+ >+ rep = self._generic_kdc_exchange(kdc_exchange_dict, >+ cname=None, >+ realm=realm, >+ sname=sname, >+ etypes=etypes) >+ >+ if expected_error_mode: >+ enc_part = None >+ else: >+ ticket_creds = kdc_exchange_dict['rep_ticket_creds'] >+ enc_part = ticket_creds.encpart_private >+ >+ return rep, enc_part > > # Named tuple to contain values of interest when the PAC is decoded. > PacData = namedtuple( >diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py >index 97f9dd41339..dad9e6b88df 100755 >--- a/python/samba/tests/krb5/kdc_tgs_tests.py >+++ b/python/samba/tests/krb5/kdc_tgs_tests.py >@@ -84,7 +84,8 @@ class KdcTgsTests(KDCBaseTest): > name_type=NT_PRINCIPAL, > names=["host", samdb.host_dns_name()]) > >- (rep, enc_part) = self.tgs_req(cname, sname, realm, ticket, key, etype) >+ (rep, enc_part) = self.tgs_req(cname, sname, realm, ticket, key, etype, >+ expected_error_mode=KDC_ERR_BADMATCH) > > self.assertIsNone( > enc_part, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 632f69794e6..7eba62b4022 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2039,7 +2039,6 @@ class RawKerberosTest(TestCaseInTempDir): > error_code=0) > > ticket_private = None >- self.assertIsNotNone(ticket_decryption_key) > if ticket_decryption_key is not None: > self.assertElementEqual(ticket_encpart, 'etype', > ticket_decryption_key.etype) >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 4de8f84f72e..86d018a0919 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -755,22 +755,26 @@ planoldpythontestsuite("fl2008r2dc:local", "samba.tests.krb5.xrealm_tests") > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ccache", > environ={ > 'ADMIN_USERNAME': '$USERNAME', >- 'ADMIN_PASSWORD': '$PASSWORD' >+ 'ADMIN_PASSWORD': '$PASSWORD', >+ 'STRICT_CHECKING': '0' > }) > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ldap", > environ={ > 'ADMIN_USERNAME': '$USERNAME', >- 'ADMIN_PASSWORD': '$PASSWORD' >+ 'ADMIN_PASSWORD': '$PASSWORD', >+ 'STRICT_CHECKING': '0' > }) > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_rpc", > environ={ > 'ADMIN_USERNAME': '$USERNAME', >- 'ADMIN_PASSWORD': '$PASSWORD' >+ 'ADMIN_PASSWORD': '$PASSWORD', >+ 'STRICT_CHECKING': '0' > }) > planoldpythontestsuite("ad_dc_smb1", "samba.tests.krb5.test_smb", > environ={ > 'ADMIN_USERNAME': '$USERNAME', >- 'ADMIN_PASSWORD': '$PASSWORD' >+ 'ADMIN_PASSWORD': '$PASSWORD', >+ 'STRICT_CHECKING': '0' > }) > > for env in ["ad_dc", smbv1_disabled_testenv]: >@@ -1324,7 +1328,8 @@ planpythontestsuite( > "samba.tests.krb5.kdc_tgs_tests", > environ={ > 'ADMIN_USERNAME': '$USERNAME', >- 'ADMIN_PASSWORD': '$PASSWORD' >+ 'ADMIN_PASSWORD': '$PASSWORD', >+ 'STRICT_CHECKING': '0' > }) > planpythontestsuite( > "ad_dc", >@@ -1339,7 +1344,8 @@ planpythontestsuite( > "samba.tests.krb5.ms_kile_client_principal_lookup_tests", > environ={ > 'ADMIN_USERNAME': '$USERNAME', >- 'ADMIN_PASSWORD': '$PASSWORD' >+ 'ADMIN_PASSWORD': '$PASSWORD', >+ 'STRICT_CHECKING': '0' > }) > > for env in [ >-- >2.25.1 > > >From 6d1d0144c597ca0b518563ef7a13062aa923e3b8 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 11:16:27 +1200 >Subject: [PATCH 266/380] tests/krb5: Allow tgs_req() to send additional padata > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 1f0654b8facf3b9b2288d2569a573ff3a5ca4a82) >--- > python/samba/tests/krb5/kdc_base_test.py | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 6a370d3036e..57ef1bceb49 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1067,7 +1067,7 @@ class KDCBaseTest(RawKerberosTest): > self.assertEqual(rep['error-code'], expected, "rep = {%s}" % rep) > > def tgs_req(self, cname, sname, realm, ticket, key, etypes, >- expected_error_mode=0): >+ expected_error_mode=0, padata=None): > '''Send a TGS-REQ, returns the response and the decrypted and > decoded enc-part > ''' >@@ -1090,6 +1090,12 @@ class KDCBaseTest(RawKerberosTest): > check_error_fn = self.generic_check_kdc_error > check_rep_fn = None > >+ def generate_padata(_kdc_exchange_dict, >+ _callback_dict, >+ req_body): >+ >+ return padata, req_body >+ > kdc_exchange_dict = self.tgs_exchange_dict( > expected_crealm=realm, > expected_cname=cname, >@@ -1099,6 +1105,7 @@ class KDCBaseTest(RawKerberosTest): > check_error_fn=check_error_fn, > check_rep_fn=check_rep_fn, > check_kdc_private_fn=self.generic_check_kdc_private, >+ generate_padata_fn=generate_padata if padata is not None else None, > tgt=tgt, > authenticator_subkey=subkey, > kdc_options=str(kdc_options)) >-- >2.25.1 > > >From 2211d10eb2b5e22b80d523ff41ac6bf6fa18e4cc Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 11:18:12 +1200 >Subject: [PATCH 267/380] tests/krb5: Allow tgs_req() to specify different > kdc-options > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 1a3426da54463c3e454c1b76c3df4e96882e6aa9) >--- > python/samba/tests/krb5/kdc_base_test.py | 4 +--- > 1 file changed, 1 insertion(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 57ef1bceb49..c448f127c0c 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1067,13 +1067,11 @@ class KDCBaseTest(RawKerberosTest): > self.assertEqual(rep['error-code'], expected, "rep = {%s}" % rep) > > def tgs_req(self, cname, sname, realm, ticket, key, etypes, >- expected_error_mode=0, padata=None): >+ expected_error_mode=0, padata=None, kdc_options=0): > '''Send a TGS-REQ, returns the response and the decrypted and > decoded enc-part > ''' > >- kdc_options = "0" >- > subkey = self.RandomKey(key.etype) > > (ctime, cusec) = self.get_KerberosTimeWithUsec() >-- >2.25.1 > > >From fa653313891d63df207fcf0b934cba46a6804c90 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 11:25:01 +1200 >Subject: [PATCH 268/380] tests/krb5: Allow tgs_req() to send requests to the > RODC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 6403a09d94ab54f89d6e50601ae6b19ab7e6aae7) >--- > python/samba/tests/krb5/kdc_base_test.py | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index c448f127c0c..5ef08eb32fe 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1067,7 +1067,8 @@ class KDCBaseTest(RawKerberosTest): > self.assertEqual(rep['error-code'], expected, "rep = {%s}" % rep) > > def tgs_req(self, cname, sname, realm, ticket, key, etypes, >- expected_error_mode=0, padata=None, kdc_options=0): >+ expected_error_mode=0, padata=None, kdc_options=0, >+ to_rodc=False): > '''Send a TGS-REQ, returns the response and the decrypted and > decoded enc-part > ''' >@@ -1106,7 +1107,8 @@ class KDCBaseTest(RawKerberosTest): > generate_padata_fn=generate_padata if padata is not None else None, > tgt=tgt, > authenticator_subkey=subkey, >- kdc_options=str(kdc_options)) >+ kdc_options=str(kdc_options), >+ to_rodc=to_rodc) > > rep = self._generic_kdc_exchange(kdc_exchange_dict, > cname=None, >-- >2.25.1 > > >From a54de045535a8d0423fdaba0ce0b464942814eaa Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 11:52:46 +1200 >Subject: [PATCH 269/380] tests/krb5: Allow as_req() to specify different > kdc-options > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit a5e62d681d81a422bac7bd89dc27ef2314d77457) >--- > python/samba/tests/krb5/kdc_base_test.py | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 5ef08eb32fe..ae62c9d5fc6 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -913,12 +913,11 @@ class KDCBaseTest(RawKerberosTest): > fallback_creds_fn=download_krbtgt_creds) > return c > >- def as_req(self, cname, sname, realm, etypes, padata=None): >+ def as_req(self, cname, sname, realm, etypes, padata=None, kdc_options=0): > '''Send a Kerberos AS_REQ, returns the undecoded response > ''' > > till = self.get_KerberosTime(offset=36000) >- kdc_options = 0 > > req = self.AS_REQ_create(padata=padata, > kdc_options=str(kdc_options), >-- >2.25.1 > > >From af09523fe0b32a46612e0badfb3471ea6618b71f Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 12:06:51 +1200 >Subject: [PATCH 270/380] tests/krb5: Use PAC buffer type constants from > krb5pac.idl > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 3504e99dc5bcc206ca2964012b7fdca541555416) >--- > python/samba/tests/krb5/kdc_base_test.py | 13 +++---------- > 1 file changed, 3 insertions(+), 10 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index ae62c9d5fc6..2cebd9ef0cf 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1127,13 +1127,6 @@ class KDCBaseTest(RawKerberosTest): > PacData = namedtuple( > "PacData", > "account_name account_sid logon_name upn domain_name") >- PAC_LOGON_INFO = 1 >- PAC_CREDENTIAL_INFO = 2 >- PAC_SRV_CHECKSUM = 6 >- PAC_KDC_CHECKSUM = 7 >- PAC_LOGON_NAME = 10 >- PAC_CONSTRAINED_DELEGATION = 11 >- PAC_UPN_DNS_INFO = 12 > > def get_pac_data(self, authorization_data): > '''Decode the PAC element contained in the authorization-data element >@@ -1154,15 +1147,15 @@ class KDCBaseTest(RawKerberosTest): > for ad in (x for x in buf if x['ad-type'] == AD_WIN2K_PAC): > pb = ndr_unpack(krb5pac.PAC_DATA, ad['ad-data']) > for pac in pb.buffers: >- if pac.type == self.PAC_LOGON_INFO: >+ if pac.type == krb5pac.PAC_TYPE_LOGON_INFO: > account_name = ( > pac.info.info.info3.base.account_name) > user_sid = ( > str(pac.info.info.info3.base.domain_sid) > + "-" + str(pac.info.info.info3.base.rid)) >- elif pac.type == self.PAC_LOGON_NAME: >+ elif pac.type == krb5pac.PAC_TYPE_LOGON_NAME: > logon_name = pac.info.account_name >- elif pac.type == self.PAC_UPN_DNS_INFO: >+ elif pac.type == krb5pac.PAC_TYPE_UPN_DNS_INFO: > upn = pac.info.upn_name > domain_name = pac.info.dns_domain_name > >-- >2.25.1 > > >From 48b4bc9cfa1a4032a8d6acf446f771c48e0fdd8e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 12:13:51 +1200 >Subject: [PATCH 271/380] tests/krb5: Don't manually create PAC request and > options in fast_tests > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit c226029655ca361560d93298a6729a021f2f6b75) >--- > python/samba/tests/krb5/fast_tests.py | 17 +++++++++-------- > python/samba/tests/krb5/raw_testcase.py | 5 ----- > 2 files changed, 9 insertions(+), 13 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 8024b92f445..dedf7a57a4b 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1553,10 +1553,7 @@ class FAST_Tests(KDCBaseTest): > 'canonicalize,' > 'renewable-ok')) > >- pac_request = self.get_pa_pac_request() >- pac_options = self.get_pa_pac_options('1') # supports claims >- >- padata = [pac_request, pac_options] >+ pac_options = '1' # supports claims > > rep, kdc_exchange_dict = self._test_as_exchange( > cname=cname, >@@ -1571,10 +1568,12 @@ class FAST_Tests(KDCBaseTest): > expected_sname=sname, > expected_salt=salt, > etypes=etype, >- padata=padata, >+ padata=None, > kdc_options=kdc_options, > preauth_key=None, >- ticket_decryption_key=ticket_decryption_key) >+ ticket_decryption_key=ticket_decryption_key, >+ pac_request=True, >+ pac_options=pac_options) > self.check_pre_authentication(rep) > > etype_info2 = kdc_exchange_dict['preauth_etype_info2'] >@@ -1585,7 +1584,7 @@ class FAST_Tests(KDCBaseTest): > > ts_enc_padata = self.get_enc_timestamp_pa_data(creds, rep) > >- padata = [ts_enc_padata, pac_request, pac_options] >+ padata = [ts_enc_padata] > > expected_realm = realm.upper() > >@@ -1608,7 +1607,9 @@ class FAST_Tests(KDCBaseTest): > padata=padata, > kdc_options=kdc_options, > preauth_key=preauth_key, >- ticket_decryption_key=ticket_decryption_key) >+ ticket_decryption_key=ticket_decryption_key, >+ pac_request=True, >+ pac_options=pac_options) > self.check_as_reply(rep) > > tgt = rep['ticket'] >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 7eba62b4022..39821240941 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1177,11 +1177,6 @@ class RawKerberosTest(TestCaseInTempDir): > pa_data = self.PA_DATA_create(PADATA_PAC_REQUEST, pa_pac) > return pa_data > >- def get_pa_pac_request(self, request_pac=True): >- pac_request = self.KERB_PA_PAC_REQUEST_create(request_pac) >- >- return pac_request >- > def get_pa_pac_options(self, options): > pac_options = self.PA_PAC_OPTIONS_create(options) > pac_options = self.der_encode(pac_options, >-- >2.25.1 > > >From 675b2b12d3ab0374ba97fe35c61d1327b98237c2 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 12:19:28 +1200 >Subject: [PATCH 272/380] tests/krb5: Set DN of created accounts to ldb.Dn type > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 7645dfa5bedee7ef3f7debbf0fa7600bd1c4bd79) >--- > python/samba/tests/krb5/kdc_base_test.py | 14 +++++++------- > 1 file changed, 7 insertions(+), 7 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 2cebd9ef0cf..e510ccbe46e 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -228,7 +228,7 @@ class KDCBaseTest(RawKerberosTest): > > return default_enctypes > >- def create_account(self, ldb, name, machine_account=False, >+ def create_account(self, samdb, name, machine_account=False, > spn=None, upn=None, additional_details=None, > ou=None, account_control=0): > '''Create an account for testing. >@@ -239,13 +239,13 @@ class KDCBaseTest(RawKerberosTest): > guid = (DS_GUID_COMPUTERS_CONTAINER if machine_account > else DS_GUID_USERS_CONTAINER) > >- ou = ldb.get_wellknown_dn(ldb.get_default_basedn(), guid) >+ ou = samdb.get_wellknown_dn(samdb.get_default_basedn(), guid) > > dn = "CN=%s,%s" % (name, ou) > > # remove the account if it exists, this will happen if a previous test > # run failed >- delete_force(ldb, dn) >+ delete_force(samdb, dn) > if machine_account: > object_class = "computer" > account_name = "%s$" % name >@@ -270,19 +270,19 @@ class KDCBaseTest(RawKerberosTest): > details["userPrincipalName"] = upn > if additional_details is not None: > details.update(additional_details) >- ldb.add(details) >+ samdb.add(details) > > creds = KerberosCredentials() > creds.guess(self.get_lp()) >- creds.set_realm(ldb.domain_dns_name().upper()) >- creds.set_domain(ldb.domain_netbios_name().upper()) >+ creds.set_realm(samdb.domain_dns_name().upper()) >+ creds.set_domain(samdb.domain_netbios_name().upper()) > creds.set_password(password) > creds.set_username(account_name) > if machine_account: > creds.set_workstation(name) > else: > creds.set_workstation('') >- creds.set_dn(dn) >+ creds.set_dn(ldb.Dn(samdb, dn)) > # > # Save the account name so it can be deleted in tearDownClass > self.accounts.add(dn) >-- >2.25.1 > > >From 3ac18d9734fca752da3c742968aa52969e923160 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 12:38:38 +1200 >Subject: [PATCH 273/380] tests/krb5: Allow get_service_ticket() to get tickets > from the RODC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 5d3a135c2326edc9ca8f56bea24d2f52320f4fd6) >--- > python/samba/tests/krb5/fast_tests.py | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index dedf7a57a4b..74fe11c5a90 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1497,7 +1497,7 @@ class FAST_Tests(KDCBaseTest): > self.assertTrue( > security.KERB_ENCTYPE_CLAIMS_SUPPORTED & krbtgt_etypes) > >- def get_service_ticket(self, tgt, target_creds, service='host'): >+ def get_service_ticket(self, tgt, target_creds, service='host', to_rodc=False): > etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) > > key = tgt.session_key >@@ -1510,7 +1510,7 @@ class FAST_Tests(KDCBaseTest): > sname = self.PrincipalName_create(name_type=NT_PRINCIPAL, > names=[service, target_name]) > >- rep, enc_part = self.tgs_req(cname, sname, realm, ticket, key, etype) >+ rep, enc_part = self.tgs_req(cname, sname, realm, ticket, key, etype, to_rodc=to_rodc) > > service_ticket = rep['ticket'] > >-- >2.25.1 > > >From 1a51cae00b238aa8e82bae04f006a5d8a5cc86b0 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 12:41:46 +1200 >Subject: [PATCH 274/380] tests/krb5: Allow get_tgt() to get tickets from the > RODC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 2d69805b1e3a8022f1418605e5f29ae0bbaa4a06) >--- > python/samba/tests/krb5/fast_tests.py | 13 +++++++++---- > 1 file changed, 9 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 74fe11c5a90..9109a63d704 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1530,7 +1530,7 @@ class FAST_Tests(KDCBaseTest): > > return service_ticket_creds > >- def get_tgt(self, creds): >+ def get_tgt(self, creds, to_rodc=False): > user_name = creds.get_username() > realm = creds.get_realm() > >@@ -1544,7 +1544,10 @@ class FAST_Tests(KDCBaseTest): > > till = self.get_KerberosTime(offset=36000) > >- krbtgt_creds = self.get_krbtgt_creds() >+ if to_rodc: >+ krbtgt_creds = self.get_rodc_krbtgt_creds() >+ else: >+ krbtgt_creds = self.get_krbtgt_creds() > ticket_decryption_key = ( > self.TicketDecryptionKey_from_creds(krbtgt_creds)) > >@@ -1573,7 +1576,8 @@ class FAST_Tests(KDCBaseTest): > preauth_key=None, > ticket_decryption_key=ticket_decryption_key, > pac_request=True, >- pac_options=pac_options) >+ pac_options=pac_options, >+ to_rodc=to_rodc) > self.check_pre_authentication(rep) > > etype_info2 = kdc_exchange_dict['preauth_etype_info2'] >@@ -1609,7 +1613,8 @@ class FAST_Tests(KDCBaseTest): > preauth_key=preauth_key, > ticket_decryption_key=ticket_decryption_key, > pac_request=True, >- pac_options=pac_options) >+ pac_options=pac_options, >+ to_rodc=to_rodc) > self.check_as_reply(rep) > > tgt = rep['ticket'] >-- >2.25.1 > > >From 3bedfdf76b531d3e8e35af58e23762870d55d526 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 13:14:06 +1200 >Subject: [PATCH 275/380] tests/krb5: Allow get_tgt() to specify different > kdc-options > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 4ecfa82e71b0dd5b71aa97973033c5c72257a0c3) >--- > python/samba/tests/krb5/fast_tests.py | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 9109a63d704..826c3536fb9 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1530,7 +1530,7 @@ class FAST_Tests(KDCBaseTest): > > return service_ticket_creds > >- def get_tgt(self, creds, to_rodc=False): >+ def get_tgt(self, creds, to_rodc=False, kdc_options=None): > user_name = creds.get_username() > realm = creds.get_realm() > >@@ -1551,10 +1551,12 @@ class FAST_Tests(KDCBaseTest): > ticket_decryption_key = ( > self.TicketDecryptionKey_from_creds(krbtgt_creds)) > >- kdc_options = str(krb5_asn1.KDCOptions('forwardable,' >+ if kdc_options is None: >+ kdc_options = krb5_asn1.KDCOptions('forwardable,' > 'renewable,' > 'canonicalize,' >- 'renewable-ok')) >+ 'renewable-ok') >+ kdc_options = str(kdc_options) > > pac_options = '1' # supports claims > >-- >2.25.1 > > >From 8f6bb405f1bd1a350b81b3f5b8a0639f30a940ea Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 13:14:45 +1200 >Subject: [PATCH 276/380] tests/krb5: Allow get_tgt() to specify expected and > unexpected flags > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 035a8f198555ad1eedf8e2e6c565fbbbe4fbe7ce) >--- > python/samba/tests/krb5/fast_tests.py | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 826c3536fb9..fd96c2b9c1a 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1530,7 +1530,8 @@ class FAST_Tests(KDCBaseTest): > > return service_ticket_creds > >- def get_tgt(self, creds, to_rodc=False, kdc_options=None): >+ def get_tgt(self, creds, to_rodc=False, kdc_options=None, >+ expected_flags=None, unexpected_flags=None): > user_name = creds.get_username() > realm = creds.get_realm() > >@@ -1572,6 +1573,8 @@ class FAST_Tests(KDCBaseTest): > expected_srealm=realm, > expected_sname=sname, > expected_salt=salt, >+ expected_flags=expected_flags, >+ unexpected_flags=unexpected_flags, > etypes=etype, > padata=None, > kdc_options=kdc_options, >-- >2.25.1 > > >From 7a0eda5ce513e42de3c34dfbc51bf0e87695c9fe Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 13:24:46 +1200 >Subject: [PATCH 277/380] tests/krb5: Move get_tgt() and get_service_ticket() > to kdc_base_test > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 59c1043be25b92db75ab5676601cb15426ef37a3) >--- > python/samba/tests/krb5/fast_tests.py | 141 ---------------------- > python/samba/tests/krb5/kdc_base_test.py | 144 +++++++++++++++++++++++ > 2 files changed, 144 insertions(+), 141 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index fd96c2b9c1a..a74dc2a3cd0 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1497,147 +1497,6 @@ class FAST_Tests(KDCBaseTest): > self.assertTrue( > security.KERB_ENCTYPE_CLAIMS_SUPPORTED & krbtgt_etypes) > >- def get_service_ticket(self, tgt, target_creds, service='host', to_rodc=False): >- etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >- >- key = tgt.session_key >- ticket = tgt.ticket >- >- cname = tgt.cname >- realm = tgt.crealm >- >- target_name = target_creds.get_username()[:-1] >- sname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >- names=[service, target_name]) >- >- rep, enc_part = self.tgs_req(cname, sname, realm, ticket, key, etype, to_rodc=to_rodc) >- >- service_ticket = rep['ticket'] >- >- ticket_etype = service_ticket['enc-part']['etype'] >- target_key = self.TicketDecryptionKey_from_creds(target_creds, >- etype=ticket_etype) >- >- session_key = self.EncryptionKey_import(enc_part['key']) >- >- service_ticket_creds = KerberosTicketCreds(service_ticket, >- session_key, >- crealm=realm, >- cname=cname, >- srealm=realm, >- sname=sname, >- decryption_key=target_key) >- >- return service_ticket_creds >- >- def get_tgt(self, creds, to_rodc=False, kdc_options=None, >- expected_flags=None, unexpected_flags=None): >- user_name = creds.get_username() >- realm = creds.get_realm() >- >- salt = creds.get_salt() >- >- etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >- cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >- names=[user_name]) >- sname = self.PrincipalName_create(name_type=NT_SRV_INST, >- names=['krbtgt', realm]) >- >- till = self.get_KerberosTime(offset=36000) >- >- if to_rodc: >- krbtgt_creds = self.get_rodc_krbtgt_creds() >- else: >- krbtgt_creds = self.get_krbtgt_creds() >- ticket_decryption_key = ( >- self.TicketDecryptionKey_from_creds(krbtgt_creds)) >- >- if kdc_options is None: >- kdc_options = krb5_asn1.KDCOptions('forwardable,' >- 'renewable,' >- 'canonicalize,' >- 'renewable-ok') >- kdc_options = str(kdc_options) >- >- pac_options = '1' # supports claims >- >- rep, kdc_exchange_dict = self._test_as_exchange( >- cname=cname, >- realm=realm, >- sname=sname, >- till=till, >- client_as_etypes=etype, >- expected_error_mode=KDC_ERR_PREAUTH_REQUIRED, >- expected_crealm=realm, >- expected_cname=cname, >- expected_srealm=realm, >- expected_sname=sname, >- expected_salt=salt, >- expected_flags=expected_flags, >- unexpected_flags=unexpected_flags, >- etypes=etype, >- padata=None, >- kdc_options=kdc_options, >- preauth_key=None, >- ticket_decryption_key=ticket_decryption_key, >- pac_request=True, >- pac_options=pac_options, >- to_rodc=to_rodc) >- self.check_pre_authentication(rep) >- >- etype_info2 = kdc_exchange_dict['preauth_etype_info2'] >- >- preauth_key = self.PasswordKey_from_etype_info2(creds, >- etype_info2[0], >- creds.get_kvno()) >- >- ts_enc_padata = self.get_enc_timestamp_pa_data(creds, rep) >- >- padata = [ts_enc_padata] >- >- expected_realm = realm.upper() >- >- expected_sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, names=['krbtgt', realm.upper()]) >- >- rep, kdc_exchange_dict = self._test_as_exchange( >- cname=cname, >- realm=realm, >- sname=sname, >- till=till, >- client_as_etypes=etype, >- expected_error_mode=0, >- expected_crealm=expected_realm, >- expected_cname=cname, >- expected_srealm=expected_realm, >- expected_sname=expected_sname, >- expected_salt=salt, >- etypes=etype, >- padata=padata, >- kdc_options=kdc_options, >- preauth_key=preauth_key, >- ticket_decryption_key=ticket_decryption_key, >- pac_request=True, >- pac_options=pac_options, >- to_rodc=to_rodc) >- self.check_as_reply(rep) >- >- tgt = rep['ticket'] >- >- enc_part = self.get_as_rep_enc_data(preauth_key, rep) >- session_key = self.EncryptionKey_import(enc_part['key']) >- >- ticket_creds = KerberosTicketCreds( >- tgt, >- session_key, >- crealm=realm, >- cname=cname, >- srealm=realm, >- sname=sname, >- decryption_key=ticket_decryption_key) >- >- return ticket_creds, enc_part >- > def get_mach_tgt(self): > if self.mach_tgt is None: > mach_creds = self.get_mach_creds() >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index e510ccbe46e..fbcc89a9b31 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -73,6 +73,7 @@ from samba.tests.krb5.rfc4120_constants import ( > KU_TICKET, > NT_PRINCIPAL, > NT_SRV_HST, >+ NT_SRV_INST, > PADATA_ENCRYPTED_CHALLENGE, > PADATA_ENC_TIMESTAMP, > PADATA_ETYPE_INFO2, >@@ -1123,6 +1124,149 @@ class KDCBaseTest(RawKerberosTest): > > return rep, enc_part > >+ def get_service_ticket(self, tgt, target_creds, service='host', >+ to_rodc=False): >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ >+ key = tgt.session_key >+ ticket = tgt.ticket >+ >+ cname = tgt.cname >+ realm = tgt.crealm >+ >+ target_name = target_creds.get_username()[:-1] >+ sname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[service, target_name]) >+ >+ rep, enc_part = self.tgs_req(cname, sname, realm, ticket, key, etype, >+ to_rodc=to_rodc) >+ >+ service_ticket = rep['ticket'] >+ >+ ticket_etype = service_ticket['enc-part']['etype'] >+ target_key = self.TicketDecryptionKey_from_creds(target_creds, >+ etype=ticket_etype) >+ >+ session_key = self.EncryptionKey_import(enc_part['key']) >+ >+ service_ticket_creds = KerberosTicketCreds(service_ticket, >+ session_key, >+ crealm=realm, >+ cname=cname, >+ srealm=realm, >+ sname=sname, >+ decryption_key=target_key) >+ >+ return service_ticket_creds >+ >+ def get_tgt(self, creds, to_rodc=False, kdc_options=None, >+ expected_flags=None, unexpected_flags=None): >+ user_name = creds.get_username() >+ realm = creds.get_realm() >+ >+ salt = creds.get_salt() >+ >+ etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[user_name]) >+ sname = self.PrincipalName_create(name_type=NT_SRV_INST, >+ names=['krbtgt', realm]) >+ >+ till = self.get_KerberosTime(offset=36000) >+ >+ if to_rodc: >+ krbtgt_creds = self.get_rodc_krbtgt_creds() >+ else: >+ krbtgt_creds = self.get_krbtgt_creds() >+ ticket_decryption_key = ( >+ self.TicketDecryptionKey_from_creds(krbtgt_creds)) >+ >+ if kdc_options is None: >+ kdc_options = krb5_asn1.KDCOptions('forwardable,' >+ 'renewable,' >+ 'canonicalize,' >+ 'renewable-ok') >+ kdc_options = str(kdc_options) >+ >+ pac_options = '1' # supports claims >+ >+ rep, kdc_exchange_dict = self._test_as_exchange( >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ till=till, >+ client_as_etypes=etype, >+ expected_error_mode=KDC_ERR_PREAUTH_REQUIRED, >+ expected_crealm=realm, >+ expected_cname=cname, >+ expected_srealm=realm, >+ expected_sname=sname, >+ expected_salt=salt, >+ expected_flags=expected_flags, >+ unexpected_flags=unexpected_flags, >+ etypes=etype, >+ padata=None, >+ kdc_options=kdc_options, >+ preauth_key=None, >+ ticket_decryption_key=ticket_decryption_key, >+ pac_request=True, >+ pac_options=pac_options, >+ to_rodc=to_rodc) >+ self.check_pre_authentication(rep) >+ >+ etype_info2 = kdc_exchange_dict['preauth_etype_info2'] >+ >+ preauth_key = self.PasswordKey_from_etype_info2(creds, >+ etype_info2[0], >+ creds.get_kvno()) >+ >+ ts_enc_padata = self.get_enc_timestamp_pa_data(creds, rep) >+ >+ padata = [ts_enc_padata] >+ >+ expected_realm = realm.upper() >+ >+ expected_sname = self.PrincipalName_create( >+ name_type=NT_SRV_INST, names=['krbtgt', realm.upper()]) >+ >+ rep, kdc_exchange_dict = self._test_as_exchange( >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ till=till, >+ client_as_etypes=etype, >+ expected_error_mode=0, >+ expected_crealm=expected_realm, >+ expected_cname=cname, >+ expected_srealm=expected_realm, >+ expected_sname=expected_sname, >+ expected_salt=salt, >+ etypes=etype, >+ padata=padata, >+ kdc_options=kdc_options, >+ preauth_key=preauth_key, >+ ticket_decryption_key=ticket_decryption_key, >+ pac_request=True, >+ pac_options=pac_options, >+ to_rodc=to_rodc) >+ self.check_as_reply(rep) >+ >+ tgt = rep['ticket'] >+ >+ enc_part = self.get_as_rep_enc_data(preauth_key, rep) >+ session_key = self.EncryptionKey_import(enc_part['key']) >+ >+ ticket_creds = KerberosTicketCreds( >+ tgt, >+ session_key, >+ crealm=realm, >+ cname=cname, >+ srealm=realm, >+ sname=sname, >+ decryption_key=ticket_decryption_key) >+ >+ return ticket_creds, enc_part >+ > # Named tuple to contain values of interest when the PAC is decoded. > PacData = namedtuple( > "PacData", >-- >2.25.1 > > >From e30ba00ae7ca53e562fe2f3c7aa510ea8cc9cd62 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 21 Sep 2021 11:51:05 +1200 >Subject: [PATCH 278/380] tests/krb5: Return encpart from get_tgt() as part of > KerberosTicketCreds > >The encpart is already contained in ticket_creds, so it no longer needs >to be returned as a separate value. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 6193f7433b15579aa32b26a146287923c9d3844d) >--- > python/samba/tests/krb5/fast_tests.py | 8 ++------ > python/samba/tests/krb5/kdc_base_test.py | 16 ++-------------- > 2 files changed, 4 insertions(+), 20 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index a74dc2a3cd0..42e75e7513c 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -67,11 +67,9 @@ class FAST_Tests(KDCBaseTest): > super().setUpClass() > > cls.user_tgt = None >- cls.user_enc_part = None > cls.user_service_ticket = None > > cls.mach_tgt = None >- cls.mach_enc_part = None > cls.mach_service_ticket = None > > def setUp(self): >@@ -1500,16 +1498,14 @@ class FAST_Tests(KDCBaseTest): > def get_mach_tgt(self): > if self.mach_tgt is None: > mach_creds = self.get_mach_creds() >- type(self).mach_tgt, type(self).mach_enc_part = ( >- self.get_tgt(mach_creds)) >+ type(self).mach_tgt = self.get_tgt(mach_creds) > > return self.mach_tgt > > def get_user_tgt(self): > if self.user_tgt is None: > user_creds = self.get_client_creds() >- type(self).user_tgt, type(self).user_enc_part = ( >- self.get_tgt(user_creds)) >+ type(self).user_tgt = self.get_tgt(user_creds) > > return self.user_tgt > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index fbcc89a9b31..28d34210fce 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1251,21 +1251,9 @@ class KDCBaseTest(RawKerberosTest): > to_rodc=to_rodc) > self.check_as_reply(rep) > >- tgt = rep['ticket'] >+ ticket_creds = kdc_exchange_dict['rep_ticket_creds'] > >- enc_part = self.get_as_rep_enc_data(preauth_key, rep) >- session_key = self.EncryptionKey_import(enc_part['key']) >- >- ticket_creds = KerberosTicketCreds( >- tgt, >- session_key, >- crealm=realm, >- cname=cname, >- srealm=realm, >- sname=sname, >- decryption_key=ticket_decryption_key) >- >- return ticket_creds, enc_part >+ return ticket_creds > > # Named tuple to contain values of interest when the PAC is decoded. > PacData = namedtuple( >-- >2.25.1 > > >From a1a8e0bb3ec0ffffa0b284c35fbdae37aa1148ee Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 21 Sep 2021 11:51:20 +1200 >Subject: [PATCH 279/380] tests/krb5: Cache obtained tickets > >Now tickets obtained with get_tgt() and get_service_ticket() make use of >a cache so they can be reused, unless the 'fresh' parameter is specified >as true. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 419e4061ced466ec7e5e23f815823b540ef4751c) >--- > python/samba/tests/krb5/kdc_base_test.py | 29 ++++++++++++++++++++++-- > 1 file changed, 27 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 28d34210fce..59175c7bb2f 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -110,6 +110,7 @@ class KDCBaseTest(RawKerberosTest): > cls.accounts = set() > > cls.account_cache = {} >+ cls.tkt_cache = {} > > cls._rodc_ctx = None > >@@ -1125,7 +1126,17 @@ class KDCBaseTest(RawKerberosTest): > return rep, enc_part > > def get_service_ticket(self, tgt, target_creds, service='host', >- to_rodc=False): >+ to_rodc=False, fresh=False): >+ user_name = tgt.cname['name-string'][0] >+ target_name = target_creds.get_username() >+ cache_key = (user_name, target_name, service, to_rodc) >+ >+ if not fresh: >+ ticket = self.tkt_cache.get(cache_key) >+ >+ if ticket is not None: >+ return ticket >+ > etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) > > key = tgt.session_key >@@ -1157,11 +1168,23 @@ class KDCBaseTest(RawKerberosTest): > sname=sname, > decryption_key=target_key) > >+ self.tkt_cache[cache_key] = service_ticket_creds >+ > return service_ticket_creds > > def get_tgt(self, creds, to_rodc=False, kdc_options=None, >- expected_flags=None, unexpected_flags=None): >+ expected_flags=None, unexpected_flags=None, >+ fresh=False): > user_name = creds.get_username() >+ cache_key = (user_name, to_rodc, kdc_options, >+ expected_flags, unexpected_flags) >+ >+ if not fresh: >+ tgt = self.tkt_cache.get(cache_key) >+ >+ if tgt is not None: >+ return tgt >+ > realm = creds.get_realm() > > salt = creds.get_salt() >@@ -1253,6 +1276,8 @@ class KDCBaseTest(RawKerberosTest): > > ticket_creds = kdc_exchange_dict['rep_ticket_creds'] > >+ self.tkt_cache[cache_key] = ticket_creds >+ > return ticket_creds > > # Named tuple to contain values of interest when the PAC is decoded. >-- >2.25.1 > > >From 95ac393f9482e2a66770d950ef7995a7a94fd06b Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 16:54:57 +1200 >Subject: [PATCH 280/380] tests/krb5: Add methods for creating zeroed checksums > and verifying checksums > >Creating a zeroed checksum is needed for signing a PAC. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit a562882b15125902c5d89f094b8c9b1150f5d010) >--- > python/samba/tests/krb5/raw_testcase.py | 17 +++++++++++++++++ > 1 file changed, 17 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 39821240941..be49f16b1f7 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -232,12 +232,29 @@ class Krb5EncryptionKey: > plaintext = kcrypto.decrypt(self.key, usage, ciphertext) > return plaintext > >+ def make_zeroed_checksum(self, ctype=None): >+ if ctype is None: >+ ctype = self.ctype >+ >+ checksum_len = kcrypto.checksum_len(ctype) >+ return bytes(checksum_len) >+ > def make_checksum(self, usage, plaintext, ctype=None): > if ctype is None: > ctype = self.ctype > cksum = kcrypto.make_checksum(ctype, self.key, usage, plaintext) > return cksum > >+ def verify_checksum(self, usage, plaintext, ctype, cksum): >+ if self.ctype != ctype: >+ raise AssertionError(f'{self.ctype} != {ctype}') >+ >+ kcrypto.verify_checksum(ctype, >+ self.key, >+ usage, >+ plaintext, >+ cksum) >+ > def export_obj(self): > EncryptionKey_obj = { > 'keytype': self.etype, >-- >2.25.1 > > >From b63e7eb87c1f2f7e1ed153d3f17c4c406132e1a2 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 16 Sep 2021 17:20:22 +1200 >Subject: [PATCH 281/380] tests/krb5: Add RodcPacEncryptionKey type allowing > for RODC PAC signatures > >Signatures created by an RODC have an RODCIdentifier appended to them >identifying the RODC's krbtgt account. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Isaac Boukris <iboukris@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Tue Sep 21 23:55:39 UTC 2021 on sn-devel-184 > >(cherry picked from commit ec95b3042bf2649c0600cafb12818c27242b5098) >--- > python/samba/tests/krb5/raw_testcase.py | 45 +++++++++++++++++++++++-- > 1 file changed, 42 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index be49f16b1f7..e213b5eef9b 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -263,6 +263,45 @@ class Krb5EncryptionKey: > return EncryptionKey_obj > > >+class RodcPacEncryptionKey(Krb5EncryptionKey): >+ def __init__(self, key, kvno, rodc_id=None): >+ super().__init__(key, kvno) >+ >+ if rodc_id is None: >+ kvno = self.kvno >+ if kvno is not None: >+ kvno >>= 16 >+ kvno &= (1 << 16) - 1 >+ >+ rodc_id = kvno or None >+ >+ if rodc_id is not None: >+ self.rodc_id = rodc_id.to_bytes(2, byteorder='little') >+ else: >+ self.rodc_id = b'' >+ >+ def make_zeroed_checksum(self, ctype=None): >+ checksum = super().make_zeroed_checksum(ctype) >+ return checksum + bytes(len(self.rodc_id)) >+ >+ def make_checksum(self, usage, plaintext, ctype=None): >+ checksum = super().make_checksum(usage, plaintext, ctype) >+ return checksum + self.rodc_id >+ >+ def verify_checksum(self, usage, plaintext, ctype, cksum): >+ if self.rodc_id: >+ cksum, cksum_rodc_id = cksum[:-2], cksum[-2:] >+ >+ if self.rodc_id != cksum_rodc_id: >+ raise AssertionError(f'{self.rodc_id.hex()} != ' >+ f'{cksum_rodc_id.hex()}') >+ >+ super().verify_checksum(usage, >+ plaintext, >+ ctype, >+ cksum) >+ >+ > class KerberosCredentials(Credentials): > def __init__(self): > super(KerberosCredentials, self).__init__() >@@ -325,7 +364,7 @@ class KerberosCredentials(Credentials): > etype = int(etype) > contents = binascii.a2b_hex(hexkey) > key = kcrypto.Key(etype, contents) >- self.forced_keys[etype] = Krb5EncryptionKey(key, self.kvno) >+ self.forced_keys[etype] = RodcPacEncryptionKey(key, self.kvno) > > def get_forced_key(self, etype): > etype = int(etype) >@@ -982,13 +1021,13 @@ class RawKerberosTest(TestCaseInTempDir): > > def SessionKey_create(self, etype, contents, kvno=None): > key = kcrypto.Key(etype, contents) >- return Krb5EncryptionKey(key, kvno) >+ return RodcPacEncryptionKey(key, kvno) > > def PasswordKey_create(self, etype=None, pwd=None, salt=None, kvno=None): > self.assertIsNotNone(pwd) > self.assertIsNotNone(salt) > key = kcrypto.string_to_key(etype, pwd, salt) >- return Krb5EncryptionKey(key, kvno) >+ return RodcPacEncryptionKey(key, kvno) > > def PasswordKey_from_etype_info2(self, creds, etype_info2, kvno=None): > e = etype_info2['etype'] >-- >2.25.1 > > >From 3a6bf1bab4f8495a58c4d42446868f7d679ffdcd Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 17 Sep 2021 14:56:51 +1200 >Subject: [PATCH 282/380] tests/krb5: Add method to verify ticket PAC checksums > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 12b5e72a35d632516980f6c051a5d83f913079e7) >--- > python/samba/tests/krb5/raw_testcase.py | 118 +++++++++++++++++++++++- > 1 file changed, 117 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index e213b5eef9b..265789cdb26 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -34,8 +34,9 @@ from pyasn1.codec.native.encoder import encode as pyasn1_native_encode > from pyasn1.codec.ber.encoder import BitStringEncoder > > from samba.credentials import Credentials >-from samba.dcerpc import security >+from samba.dcerpc import krb5pac, security > from samba.gensec import FEATURE_SEAL >+from samba.ndr import ndr_pack, ndr_unpack > > import samba.tests > from samba.tests import TestCaseInTempDir >@@ -418,6 +419,10 @@ class KerberosTicketCreds: > class RawKerberosTest(TestCaseInTempDir): > """A raw Kerberos Test case.""" > >+ pac_checksum_types = {krb5pac.PAC_TYPE_SRV_CHECKSUM, >+ krb5pac.PAC_TYPE_KDC_CHECKSUM, >+ krb5pac.PAC_TYPE_TICKET_CHECKSUM} >+ > etypes_to_test = ( > {"value": -1111, "name": "dummy", }, > {"value": kcrypto.Enctype.AES256, "name": "aes128", }, >@@ -2900,6 +2905,114 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_blob) > self.assertEqual(expected_checksum, checksum) > >+ def verify_ticket(self, ticket, krbtgt_key, expect_pac=True): >+ # Check if the ticket is a TGT. >+ sname = ticket.ticket['sname'] >+ is_tgt = sname['name-string'][0] == b'krbtgt' >+ >+ # Decrypt the ticket. >+ >+ key = ticket.decryption_key >+ enc_part = ticket.ticket['enc-part'] >+ >+ self.assertElementEqual(enc_part, 'etype', key.etype) >+ self.assertElementKVNO(enc_part, 'kvno', key.kvno) >+ >+ enc_part = key.decrypt(KU_TICKET, enc_part['cipher']) >+ enc_part = self.der_decode( >+ enc_part, asn1Spec=krb5_asn1.EncTicketPart()) >+ >+ # Fetch the authorization data from the ticket. >+ auth_data = enc_part.get('authorization-data') >+ if expect_pac: >+ self.assertIsNotNone(auth_data) >+ elif auth_data is None: >+ return >+ >+ # Get a copy of the authdata with an empty PAC, and the existing PAC >+ # (if present). >+ empty_pac = self.get_empty_pac() >+ auth_data, pac_data = self.replace_pac(auth_data, >+ empty_pac, >+ expect_pac=expect_pac) >+ if not expect_pac: >+ return >+ >+ # Unpack the PAC as both PAC_DATA and PAC_DATA_RAW types. We use the >+ # raw type to create a new PAC with zeroed signatures for >+ # verification. This is because on Windows, the resource_groups field >+ # is added to PAC_LOGON_INFO after the info3 field has been created, >+ # which results in a different ordering of pointer values than Samba >+ # (see commit 0e201ecdc53). Using the raw type avoids changing >+ # PAC_LOGON_INFO, so verification against Windows can work. We still >+ # need the PAC_DATA type to retrieve the actual checksums, because the >+ # signatures in the raw type may contain padding bytes. >+ pac = ndr_unpack(krb5pac.PAC_DATA, >+ pac_data) >+ raw_pac = ndr_unpack(krb5pac.PAC_DATA_RAW, >+ pac_data) >+ >+ checksums = {} >+ >+ for pac_buffer, raw_pac_buffer in zip(pac.buffers, raw_pac.buffers): >+ buffer_type = pac_buffer.type >+ if buffer_type in self.pac_checksum_types: >+ self.assertNotIn(buffer_type, checksums, >+ f'Duplicate checksum type {buffer_type}') >+ >+ # Fetch the checksum and the checksum type from the PAC buffer. >+ checksum = pac_buffer.info.signature >+ ctype = pac_buffer.info.type >+ if ctype & 1 << 31: >+ ctype |= -1 << 31 >+ >+ checksums[buffer_type] = checksum, ctype >+ >+ if buffer_type != krb5pac.PAC_TYPE_TICKET_CHECKSUM: >+ # Zero the checksum field so that we can later verify the >+ # checksums. The ticket checksum field is not zeroed. >+ >+ signature = ndr_unpack( >+ krb5pac.PAC_SIGNATURE_DATA, >+ raw_pac_buffer.info.remaining) >+ signature.signature = bytes(len(checksum)) >+ raw_pac_buffer.info.remaining = ndr_pack( >+ signature) >+ >+ # Re-encode the PAC. >+ pac_data = ndr_pack(raw_pac) >+ >+ # Verify the signatures. >+ >+ server_checksum, server_ctype = checksums[ >+ krb5pac.PAC_TYPE_SRV_CHECKSUM] >+ Krb5EncryptionKey.verify_checksum(key, >+ KU_NON_KERB_CKSUM_SALT, >+ pac_data, >+ server_ctype, >+ server_checksum) >+ >+ kdc_checksum, kdc_ctype = checksums[ >+ krb5pac.PAC_TYPE_KDC_CHECKSUM] >+ krbtgt_key.verify_checksum(KU_NON_KERB_CKSUM_SALT, >+ server_checksum, >+ kdc_ctype, >+ kdc_checksum) >+ >+ if is_tgt: >+ self.assertNotIn(krb5pac.PAC_TYPE_TICKET_CHECKSUM, checksums) >+ else: >+ ticket_checksum, ticket_ctype = checksums[ >+ krb5pac.PAC_TYPE_TICKET_CHECKSUM] >+ enc_part['authorization-data'] = auth_data >+ enc_part = self.der_encode(enc_part, >+ asn1Spec=krb5_asn1.EncTicketPart()) >+ >+ krbtgt_key.verify_checksum(KU_NON_KERB_CKSUM_SALT, >+ enc_part, >+ ticket_ctype, >+ ticket_checksum) >+ > def replace_pac(self, auth_data, new_pac, expect_pac=True): > if new_pac is not None: > self.assertElementEqual(new_pac, 'ad-type', AD_WIN2K_PAC) >@@ -2943,6 +3056,9 @@ class RawKerberosTest(TestCaseInTempDir): > > return new_auth_data, old_pac > >+ def get_empty_pac(self): >+ return self.AuthorizationData_create(AD_WIN2K_PAC, bytes(1)) >+ > def get_outer_pa_dict(self, kdc_exchange_dict): > return self.get_pa_dict(kdc_exchange_dict['req_padata']) > >-- >2.25.1 > > >From 67e13779512e8464f8577595359458b1ecfe409c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 17 Sep 2021 15:26:12 +1200 >Subject: [PATCH 283/380] tests/krb5: Add method for modifying a ticket and > creating PAC checksums > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 1fcde7cb6ce50e0a08097841e92476f320560664) >--- > python/samba/tests/krb5/raw_testcase.py | 234 ++++++++++++++++++++++++ > 1 file changed, 234 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 265789cdb26..4ac7698ffab 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -3013,6 +3013,240 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_ctype, > ticket_checksum) > >+ def modified_ticket(self, >+ ticket, *, >+ new_ticket_key=None, >+ modify_fn=None, >+ modify_pac_fn=None, >+ exclude_pac=False, >+ update_pac_checksums=True, >+ checksum_keys=None, >+ include_checksums=None): >+ if checksum_keys is None: >+ # A dict containing a key for each checksum type to be created in >+ # the PAC. >+ checksum_keys = {} >+ >+ if include_checksums is None: >+ # A dict containing a value for each checksum type; True if the >+ # checksum type is to be included in the PAC, False if it is to be >+ # excluded, or None/not present if the checksum is to be included >+ # based on its presence in the original PAC. >+ include_checksums = {} >+ >+ # Check that the values passed in by the caller make sense. >+ >+ self.assertLessEqual(checksum_keys.keys(), self.pac_checksum_types) >+ self.assertLessEqual(include_checksums.keys(), self.pac_checksum_types) >+ >+ if exclude_pac: >+ self.assertIsNone(modify_pac_fn) >+ >+ update_pac_checksums = False >+ >+ if not update_pac_checksums: >+ self.assertFalse(checksum_keys) >+ self.assertFalse(include_checksums) >+ >+ expect_pac = update_pac_checksums or modify_pac_fn is not None >+ >+ key = ticket.decryption_key >+ >+ if new_ticket_key is None: >+ # Use the same key to re-encrypt the ticket. >+ new_ticket_key = key >+ >+ if krb5pac.PAC_TYPE_SRV_CHECKSUM not in checksum_keys: >+ # If the server signature key is not present, fall back to the key >+ # used to encrypt the ticket. >+ checksum_keys[krb5pac.PAC_TYPE_SRV_CHECKSUM] = new_ticket_key >+ >+ if krb5pac.PAC_TYPE_TICKET_CHECKSUM not in checksum_keys: >+ # If the ticket signature key is not present, fall back to the key >+ # used for the KDC signature. >+ kdc_checksum_key = checksum_keys.get(krb5pac.PAC_TYPE_KDC_CHECKSUM) >+ if kdc_checksum_key is not None: >+ checksum_keys[krb5pac.PAC_TYPE_TICKET_CHECKSUM] = ( >+ kdc_checksum_key) >+ >+ # Decrypt the ticket. >+ >+ enc_part = ticket.ticket['enc-part'] >+ >+ self.assertElementEqual(enc_part, 'etype', key.etype) >+ self.assertElementKVNO(enc_part, 'kvno', key.kvno) >+ >+ enc_part = key.decrypt(KU_TICKET, enc_part['cipher']) >+ enc_part = self.der_decode( >+ enc_part, asn1Spec=krb5_asn1.EncTicketPart()) >+ >+ # Modify the ticket here. >+ if modify_fn is not None: >+ enc_part = modify_fn(enc_part) >+ >+ auth_data = enc_part.get('authorization-data') >+ if expect_pac: >+ self.assertIsNotNone(auth_data) >+ if auth_data is not None: >+ new_pac = None >+ if not exclude_pac: >+ # Get a copy of the authdata with an empty PAC, and the >+ # existing PAC (if present). >+ empty_pac = self.get_empty_pac() >+ empty_pac_auth_data, pac_data = self.replace_pac(auth_data, >+ empty_pac) >+ >+ if expect_pac: >+ self.assertIsNotNone(pac_data) >+ if pac_data is not None: >+ pac = ndr_unpack(krb5pac.PAC_DATA, pac_data) >+ >+ # Modify the PAC here. >+ if modify_pac_fn is not None: >+ pac = modify_pac_fn(pac) >+ >+ if update_pac_checksums: >+ # Get the enc-part with an empty PAC, which is needed >+ # to create a ticket signature. >+ enc_part_to_sign = enc_part.copy() >+ enc_part_to_sign['authorization-data'] = ( >+ empty_pac_auth_data) >+ enc_part_to_sign = self.der_encode( >+ enc_part_to_sign, >+ asn1Spec=krb5_asn1.EncTicketPart()) >+ >+ self.update_pac_checksums(pac, >+ checksum_keys, >+ include_checksums, >+ enc_part_to_sign) >+ >+ # Re-encode the PAC. >+ pac_data = ndr_pack(pac) >+ new_pac = self.AuthorizationData_create(AD_WIN2K_PAC, >+ pac_data) >+ >+ # Replace the PAC in the authorization data and re-add it to the >+ # ticket enc-part. >+ auth_data, _ = self.replace_pac(auth_data, new_pac) >+ enc_part['authorization-data'] = auth_data >+ >+ # Re-encrypt the ticket enc-part with the new key. >+ enc_part_new = self.der_encode(enc_part, >+ asn1Spec=krb5_asn1.EncTicketPart()) >+ enc_part_new = self.EncryptedData_create(new_ticket_key, >+ KU_TICKET, >+ enc_part_new) >+ >+ # Create a copy of the ticket with the new enc-part. >+ new_ticket = ticket.ticket.copy() >+ new_ticket['enc-part'] = enc_part_new >+ >+ new_ticket_creds = KerberosTicketCreds( >+ new_ticket, >+ session_key=ticket.session_key, >+ crealm=ticket.crealm, >+ cname=ticket.cname, >+ srealm=ticket.srealm, >+ sname=ticket.sname, >+ decryption_key=new_ticket_key, >+ ticket_private=enc_part, >+ encpart_private=ticket.encpart_private) >+ >+ return new_ticket_creds >+ >+ def update_pac_checksums(self, >+ pac, >+ checksum_keys, >+ include_checksums, >+ enc_part=None): >+ pac_buffers = pac.buffers >+ checksum_buffers = {} >+ >+ # Find the relevant PAC checksum buffers. >+ for pac_buffer in pac_buffers: >+ buffer_type = pac_buffer.type >+ if buffer_type in self.pac_checksum_types: >+ self.assertNotIn(buffer_type, checksum_buffers, >+ f'Duplicate checksum type {buffer_type}') >+ >+ checksum_buffers[buffer_type] = pac_buffer >+ >+ # Create any additional buffers that were requested but not >+ # present. Conversely, remove any buffers that were requested to be >+ # removed. >+ for buffer_type in self.pac_checksum_types: >+ if buffer_type in checksum_buffers: >+ if include_checksums.get(buffer_type) is False: >+ checksum_buffer = checksum_buffers.pop(buffer_type) >+ >+ pac.num_buffers -= 1 >+ pac_buffers.remove(checksum_buffer) >+ >+ elif include_checksums.get(buffer_type) is True: >+ info = krb5pac.PAC_SIGNATURE_DATA() >+ >+ checksum_buffer = krb5pac.PAC_BUFFER() >+ checksum_buffer.type = buffer_type >+ checksum_buffer.info = info >+ >+ pac_buffers.append(checksum_buffer) >+ pac.num_buffers += 1 >+ >+ checksum_buffers[buffer_type] = checksum_buffer >+ >+ # Fill the relevant checksum buffers. >+ for buffer_type, checksum_buffer in checksum_buffers.items(): >+ checksum_key = checksum_keys[buffer_type] >+ ctype = checksum_key.ctype & ((1 << 32) - 1) >+ >+ if buffer_type == krb5pac.PAC_TYPE_TICKET_CHECKSUM: >+ self.assertIsNotNone(enc_part) >+ >+ signature = checksum_key.make_checksum( >+ KU_NON_KERB_CKSUM_SALT, >+ enc_part) >+ >+ elif buffer_type == krb5pac.PAC_TYPE_SRV_CHECKSUM: >+ signature = Krb5EncryptionKey.make_zeroed_checksum( >+ checksum_key) >+ >+ else: >+ signature = checksum_key.make_zeroed_checksum() >+ >+ checksum_buffer.info.signature = signature >+ checksum_buffer.info.type = ctype >+ >+ # Add the new checksum buffers to the PAC. >+ pac.buffers = pac_buffers >+ >+ # Calculate the server and KDC checksums and insert them into the PAC. >+ >+ server_checksum_buffer = checksum_buffers.get( >+ krb5pac.PAC_TYPE_SRV_CHECKSUM) >+ if server_checksum_buffer is not None: >+ server_checksum_key = checksum_keys[krb5pac.PAC_TYPE_SRV_CHECKSUM] >+ >+ pac_data = ndr_pack(pac) >+ server_checksum = Krb5EncryptionKey.make_checksum( >+ server_checksum_key, >+ KU_NON_KERB_CKSUM_SALT, >+ pac_data) >+ >+ server_checksum_buffer.info.signature = server_checksum >+ >+ kdc_checksum_buffer = checksum_buffers.get( >+ krb5pac.PAC_TYPE_KDC_CHECKSUM) >+ if kdc_checksum_buffer is not None: >+ self.assertIsNotNone(server_checksum_buffer) >+ >+ kdc_checksum_key = checksum_keys[krb5pac.PAC_TYPE_KDC_CHECKSUM] >+ >+ kdc_checksum = kdc_checksum_key.make_checksum( >+ KU_NON_KERB_CKSUM_SALT, >+ server_checksum) >+ >+ kdc_checksum_buffer.info.signature = kdc_checksum >+ > def replace_pac(self, auth_data, new_pac, expect_pac=True): > if new_pac is not None: > self.assertElementEqual(new_pac, 'ad-type', AD_WIN2K_PAC) >-- >2.25.1 > > >From f5f870929c038ed7279186f9c17442f545ebdcd8 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 21 Sep 2021 13:33:16 +1200 >Subject: [PATCH 284/380] tests/krb5: Simplify adding authdata to ticket by > using modified_ticket() > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 4c67a53cdca206a118e82b356db0faf0ddc011ab) >--- > python/samba/tests/krb5/fast_tests.py | 49 +++++-------------------- > python/samba/tests/krb5/raw_testcase.py | 8 ++++ > 2 files changed, 18 insertions(+), 39 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 42e75e7513c..d8ccfaee325 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -25,10 +25,7 @@ import collections > import ldb > > from samba.dcerpc import security >-from samba.tests.krb5.raw_testcase import ( >- KerberosTicketCreds, >- Krb5EncryptionKey >-) >+from samba.tests.krb5.raw_testcase import Krb5EncryptionKey > from samba.tests.krb5.kdc_base_test import KDCBaseTest > from samba.tests.krb5.rfc4120_constants import ( > AD_FX_FAST_ARMOR, >@@ -45,7 +42,6 @@ from samba.tests.krb5.rfc4120_constants import ( > KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS, > KRB_AS_REP, > KRB_TGS_REP, >- KU_TICKET, > NT_PRINCIPAL, > NT_SRV_INST, > PADATA_FX_COOKIE, >@@ -1428,44 +1424,19 @@ class FAST_Tests(KDCBaseTest): > def gen_tgt_fast_armor_auth_data(self): > user_tgt = self.get_user_tgt() > >- ticket_decryption_key = user_tgt.decryption_key >+ auth_data = self.generate_fast_armor_auth_data() >+ >+ def modify_fn(enc_part): >+ enc_part['authorization-data'].append(auth_data) > >- tgt_encpart = self.getElementValue(user_tgt.ticket, 'enc-part') >- self.assertElementEqual(tgt_encpart, 'etype', >- ticket_decryption_key.etype) >- self.assertElementKVNO(tgt_encpart, 'kvno', >- ticket_decryption_key.kvno) >- tgt_cipher = self.getElementValue(tgt_encpart, 'cipher') >- tgt_decpart = ticket_decryption_key.decrypt(KU_TICKET, tgt_cipher) >- tgt_private = self.der_decode(tgt_decpart, >- asn1Spec=krb5_asn1.EncTicketPart()) >+ return enc_part > >- auth_data = self.generate_fast_armor_auth_data() >- tgt_private['authorization-data'].append(auth_data) >- >- # Re-encrypt the user TGT. >- tgt_private_new = self.der_encode( >- tgt_private, >- asn1Spec=krb5_asn1.EncTicketPart()) >- tgt_encpart = self.EncryptedData_create(ticket_decryption_key, >- KU_TICKET, >- tgt_private_new) >- user_ticket = user_tgt.ticket.copy() >- user_ticket['enc-part'] = tgt_encpart >- >- user_tgt = KerberosTicketCreds( >- user_ticket, >- session_key=user_tgt.session_key, >- crealm=user_tgt.crealm, >- cname=user_tgt.cname, >- srealm=user_tgt.srealm, >- sname=user_tgt.sname, >- decryption_key=user_tgt.decryption_key, >- ticket_private=tgt_private, >- encpart_private=user_tgt.encpart_private) >+ checksum_keys = self.get_krbtgt_checksum_key() > > # Use our modifed TGT to replace the one in the request. >- return user_tgt >+ return self.modified_ticket(user_tgt, >+ modify_fn=modify_fn, >+ checksum_keys=checksum_keys) > > def create_fast_cookie(self, cookie): > self.assertIsNotNone(cookie) >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 4ac7698ffab..57013caafb1 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -3290,6 +3290,14 @@ class RawKerberosTest(TestCaseInTempDir): > > return new_auth_data, old_pac > >+ def get_krbtgt_checksum_key(self): >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_key = self.TicketDecryptionKey_from_creds(krbtgt_creds) >+ >+ return { >+ krb5pac.PAC_TYPE_KDC_CHECKSUM: krbtgt_key >+ } >+ > def get_empty_pac(self): > return self.AuthorizationData_create(AD_WIN2K_PAC, bytes(1)) > >-- >2.25.1 > > >From 75af2c6c089b471c996af4b51919951541b54b71 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 21 Sep 2021 17:01:12 +1200 >Subject: [PATCH 285/380] tests/krb5: Make get_default_enctypes() return a set > of enctype constants > >This is often more convenient than a bitfield. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 7cedd383bcc1b5652ea65817b464d6e0485c7b8b) >--- > python/samba/tests/krb5/kdc_base_test.py | 13 ++++--------- > 1 file changed, 4 insertions(+), 9 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 59175c7bb2f..3d2d20cb65b 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -222,11 +222,11 @@ class KDCBaseTest(RawKerberosTest): > functional_level = self.get_domain_functional_level(samdb) > > # RC4 should always be supported >- default_enctypes = security.KERB_ENCTYPE_RC4_HMAC_MD5 >+ default_enctypes = {kcrypto.Enctype.RC4} > if functional_level >= DS_DOMAIN_FUNCTION_2008: > # AES is only supported at functional level 2008 or higher >- default_enctypes |= security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96 >- default_enctypes |= security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96 >+ default_enctypes.add(kcrypto.Enctype.AES256) >+ default_enctypes.add(kcrypto.Enctype.AES128) > > return default_enctypes > >@@ -513,12 +513,7 @@ class KDCBaseTest(RawKerberosTest): > > default_enctypes = self.get_default_enctypes() > >- if default_enctypes & security.KERB_ENCTYPE_RC4_HMAC_MD5: >- self.assertIn(kcrypto.Enctype.RC4, keys) >- if default_enctypes & security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96: >- self.assertIn(kcrypto.Enctype.AES256, keys) >- if default_enctypes & security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96: >- self.assertIn(kcrypto.Enctype.AES128, keys) >+ self.assertCountEqual(default_enctypes, keys) > > return keys > >-- >2.25.1 > > >From 4fa85269eb95f8d8d9eb5db4b08d9d3791d358ee Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 21 Sep 2021 21:01:46 +1200 >Subject: [PATCH 286/380] tests/krb5: Add methods to convert between enctypes > and bitfields > >These methods are useful for converting a collection of encryption types >into msDS-SupportedEncryptionTypes bit flags, and vice versa. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 432eba9e09849e74f4c0f2d7826d45cbd2b7ce42) >--- > python/samba/tests/krb5/kdc_base_test.py | 6 +-- > python/samba/tests/krb5/raw_testcase.py | 51 +++++++++++++++++++----- > 2 files changed, 43 insertions(+), 14 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 3d2d20cb65b..10ad9e6961f 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -633,10 +633,8 @@ class KDCBaseTest(RawKerberosTest): > > enctypes = supported_enctypes > if fast_support: >- fast_bits = (security.KERB_ENCTYPE_FAST_SUPPORTED | >- security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED | >- security.KERB_ENCTYPE_CLAIMS_SUPPORTED) >- enctypes = (enctypes or 0) | fast_bits >+ enctypes = enctypes or 0 >+ enctypes |= KerberosCredentials.fast_supported_bits > > if enctypes is not None: > details['msDS-SupportedEncryptionTypes'] = str(enctypes) >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 57013caafb1..57579126f8a 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -304,6 +304,11 @@ class RodcPacEncryptionKey(Krb5EncryptionKey): > > > class KerberosCredentials(Credentials): >+ >+ fast_supported_bits = (security.KERB_ENCTYPE_FAST_SUPPORTED | >+ security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED | >+ security.KERB_ENCTYPE_CLAIMS_SUPPORTED) >+ > def __init__(self): > super(KerberosCredentials, self).__init__() > all_enc_types = 0 >@@ -331,26 +336,52 @@ class KerberosCredentials(Credentials): > def set_ap_supported_enctypes(self, value): > self.ap_supported_enctypes = int(value) > >- def _get_krb5_etypes(self, supported_enctypes): >+ etype_map = collections.OrderedDict([ >+ (kcrypto.Enctype.AES256, >+ security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96), >+ (kcrypto.Enctype.AES128, >+ security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96), >+ (kcrypto.Enctype.RC4, >+ security.KERB_ENCTYPE_RC4_HMAC_MD5), >+ (kcrypto.Enctype.DES_MD5, >+ security.KERB_ENCTYPE_DES_CBC_MD5), >+ (kcrypto.Enctype.DES_CRC, >+ security.KERB_ENCTYPE_DES_CBC_CRC) >+ ]) >+ >+ @classmethod >+ def etypes_to_bits(self, etypes): >+ bits = 0 >+ for etype in etypes: >+ bit = self.etype_map[etype] >+ if bits & bit: >+ raise ValueError(f'Got duplicate etype: {etype}') >+ bits |= bit >+ >+ return bits >+ >+ @classmethod >+ def bits_to_etypes(self, bits): > etypes = () >+ for etype, bit in self.etype_map.items(): >+ if bit & bits: >+ bits &= ~bit >+ etypes += (etype,) > >- if supported_enctypes & security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96: >- etypes += (kcrypto.Enctype.AES256,) >- if supported_enctypes & security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96: >- etypes += (kcrypto.Enctype.AES128,) >- if supported_enctypes & security.KERB_ENCTYPE_RC4_HMAC_MD5: >- etypes += (kcrypto.Enctype.RC4,) >+ bits &= ~self.fast_supported_bits >+ if bits != 0: >+ raise ValueError(f'Unsupported etype bits: {bits}') > > return etypes > > def get_as_krb5_etypes(self): >- return self._get_krb5_etypes(self.as_supported_enctypes) >+ return self.bits_to_etypes(self.as_supported_enctypes) > > def get_tgs_krb5_etypes(self): >- return self._get_krb5_etypes(self.tgs_supported_enctypes) >+ return self.bits_to_etypes(self.tgs_supported_enctypes) > > def get_ap_krb5_etypes(self): >- return self._get_krb5_etypes(self.ap_supported_enctypes) >+ return self.bits_to_etypes(self.ap_supported_enctypes) > > def set_kvno(self, kvno): > # Sign-extend from 32 bits. >-- >2.25.1 > > >From d93ace257e43b9e54003af265376f8247de09dc2 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 21 Sep 2021 17:10:49 +1200 >Subject: [PATCH 287/380] tests/krb5: Get supported enctypes for credentials > from database > >Look up the account's msDS-SupportedEncryptionTypes attribute to get the >encryption types that it supports. Move the fallback to RC4 to when the >ticket decryption key is obtained. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit b6eaf2cf44fb66d8f302d4cab050827a67de3ea4) >--- > python/samba/tests/krb5/as_req_tests.py | 4 +- > python/samba/tests/krb5/kdc_base_test.py | 52 +++++++++++++++++------- > python/samba/tests/krb5/raw_testcase.py | 5 ++- > 3 files changed, 43 insertions(+), 18 deletions(-) > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 35f88a0c920..8d9b90fee69 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -60,7 +60,7 @@ class AsReqKerberosTests(KDCBaseTest): > initial_kdc_options=None): > client_creds = self.get_client_creds() > client_account = client_creds.get_username() >- client_as_etypes = client_creds.get_as_krb5_etypes() >+ client_as_etypes = self.get_default_enctypes() > krbtgt_creds = self.get_krbtgt_creds(require_keys=False) > krbtgt_account = krbtgt_creds.get_username() > realm = krbtgt_creds.get_realm() >@@ -114,7 +114,7 @@ class AsReqKerberosTests(KDCBaseTest): > def test_as_req_enc_timestamp(self): > client_creds = self.get_client_creds() > client_account = client_creds.get_username() >- client_as_etypes = client_creds.get_as_krb5_etypes() >+ client_as_etypes = self.get_default_enctypes() > client_kvno = client_creds.get_kvno() > krbtgt_creds = self.get_krbtgt_creds(require_strongest_key=True) > krbtgt_account = krbtgt_creds.get_username() >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 10ad9e6961f..cdaeaf9f3e1 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -289,6 +289,8 @@ class KDCBaseTest(RawKerberosTest): > # Save the account name so it can be deleted in tearDownClass > self.accounts.add(dn) > >+ self.creds_set_enctypes(creds) >+ > return (creds, dn) > > def create_rodc(self, ctx): >@@ -522,13 +524,28 @@ class KDCBaseTest(RawKerberosTest): > for enctype, key in keys.items(): > creds.set_forced_key(enctype, key) > >- supported_enctypes = 0 >- if kcrypto.Enctype.AES256 in keys: >- supported_enctypes |= security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96 >- if kcrypto.Enctype.AES128 in keys: >- supported_enctypes |= security.KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96 >- if kcrypto.Enctype.RC4 in keys: >- supported_enctypes |= security.KERB_ENCTYPE_RC4_HMAC_MD5 >+ def creds_set_enctypes(self, creds): >+ samdb = self.get_samdb() >+ >+ res = samdb.search(creds.get_dn(), >+ scope=ldb.SCOPE_BASE, >+ attrs=['msDS-SupportedEncryptionTypes']) >+ supported_enctypes = res[0].get('msDS-SupportedEncryptionTypes', idx=0) >+ >+ if supported_enctypes is None: >+ supported_enctypes = 0 >+ >+ creds.set_as_supported_enctypes(supported_enctypes) >+ creds.set_tgs_supported_enctypes(supported_enctypes) >+ creds.set_ap_supported_enctypes(supported_enctypes) >+ >+ def creds_set_default_enctypes(self, creds, fast_support=False): >+ default_enctypes = self.get_default_enctypes() >+ supported_enctypes = KerberosCredentials.etypes_to_bits( >+ default_enctypes) >+ >+ if fast_support: >+ supported_enctypes |= KerberosCredentials.fast_supported_bits > > creds.set_as_supported_enctypes(supported_enctypes) > creds.set_tgs_supported_enctypes(supported_enctypes) >@@ -662,14 +679,6 @@ class KDCBaseTest(RawKerberosTest): > keys = self.get_keys(samdb, dn) > self.creds_set_keys(creds, keys) > >- if machine_account: >- if supported_enctypes is not None: >- tgs_enctypes = supported_enctypes >- else: >- tgs_enctypes = security.KERB_ENCTYPE_RC4_HMAC_MD5 >- >- creds.set_tgs_supported_enctypes(tgs_enctypes) >- > # Handle secret replication to the RODC. > > if allowed_replication or revealed_to_rodc: >@@ -814,6 +823,11 @@ class KDCBaseTest(RawKerberosTest): > keys = self.get_keys(samdb, krbtgt_dn) > self.creds_set_keys(creds, keys) > >+ # The RODC krbtgt account should support the default enctypes, >+ # although it might not have the msDS-SupportedEncryptionTypes >+ # attribute. >+ self.creds_set_default_enctypes(creds) >+ > return creds > > c = self._get_krb5_creds(prefix='RODC_KRBTGT', >@@ -858,6 +872,8 @@ class KDCBaseTest(RawKerberosTest): > keys = self.get_keys(samdb, dn) > self.creds_set_keys(creds, keys) > >+ self.creds_set_enctypes(creds) >+ > return creds > > c = self._get_krb5_creds(prefix='MOCK_RODC_KRBTGT', >@@ -898,6 +914,12 @@ class KDCBaseTest(RawKerberosTest): > keys = self.get_keys(samdb, dn) > self.creds_set_keys(creds, keys) > >+ # The krbtgt account should support the default enctypes, although >+ # it might not (on Samba) have the msDS-SupportedEncryptionTypes >+ # attribute. >+ self.creds_set_default_enctypes(creds, >+ fast_support=self.kdc_fast_support) >+ > return creds > > c = self._get_krb5_creds(prefix='KRBTGT', >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 57579126f8a..8d7778602f5 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1082,7 +1082,10 @@ class RawKerberosTest(TestCaseInTempDir): > > if etype is None: > etypes = creds.get_tgs_krb5_etypes() >- etype = etypes[0] >+ if etypes: >+ etype = etypes[0] >+ else: >+ etype = kcrypto.Enctype.RC4 > > forced_key = creds.get_forced_key(etype) > if forced_key is not None: >-- >2.25.1 > > >From 211aea7d8ddd07e1ee9e511d93469cdc531d81c7 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 21 Sep 2021 17:11:28 +1200 >Subject: [PATCH 288/380] tests/krb5: Correctly check PA-SUPPORTED-ENCTYPES > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 14cd933a9d6af08deb680c9f688b166138d45ed9) >--- > python/samba/tests/krb5/fast_tests.py | 4 ++++ > python/samba/tests/krb5/kdc_base_test.py | 3 +++ > python/samba/tests/krb5/raw_testcase.py | 24 +++++++++++++++--------- > 3 files changed, 22 insertions(+), 9 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index d8ccfaee325..431b48f00d6 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1126,6 +1126,7 @@ class FAST_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=[krbtgt_username, krbtgt_realm]) > krbtgt_decryption_key = self.TicketDecryptionKey_from_creds( > krbtgt_creds) >+ krbtgt_etypes = krbtgt_creds.tgs_supported_enctypes > > target_username = target_creds.get_username()[:-1] > target_realm = target_creds.get_realm() >@@ -1134,6 +1135,7 @@ class FAST_Tests(KDCBaseTest): > name_type=NT_SRV_INST, names=[target_service, target_username]) > target_decryption_key = self.TicketDecryptionKey_from_creds( > target_creds) >+ target_etypes = target_creds.tgs_supported_enctypes > > fast_cookie = None > preauth_etype_info2 = None >@@ -1322,6 +1324,7 @@ class FAST_Tests(KDCBaseTest): > expected_anon=expected_anon, > expected_srealm=expected_srealm, > expected_sname=expected_sname, >+ expected_supported_etypes=krbtgt_etypes, > expected_flags=expected_flags, > unexpected_flags=unexpected_flags, > ticket_decryption_key=krbtgt_decryption_key, >@@ -1355,6 +1358,7 @@ class FAST_Tests(KDCBaseTest): > expected_anon=expected_anon, > expected_srealm=expected_srealm, > expected_sname=expected_sname, >+ expected_supported_etypes=target_etypes, > expected_flags=expected_flags, > unexpected_flags=unexpected_flags, > ticket_decryption_key=target_decryption_key, >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index cdaeaf9f3e1..646859e85b3 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1267,6 +1267,8 @@ class KDCBaseTest(RawKerberosTest): > expected_sname = self.PrincipalName_create( > name_type=NT_SRV_INST, names=['krbtgt', realm.upper()]) > >+ expected_etypes = krbtgt_creds.tgs_supported_enctypes >+ > rep, kdc_exchange_dict = self._test_as_exchange( > cname=cname, > realm=realm, >@@ -1279,6 +1281,7 @@ class KDCBaseTest(RawKerberosTest): > expected_srealm=expected_realm, > expected_sname=expected_sname, > expected_salt=salt, >+ expected_supported_etypes=expected_etypes, > etypes=etype, > padata=padata, > kdc_options=kdc_options, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 8d7778602f5..c6bc3e553ad 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1879,6 +1879,7 @@ class RawKerberosTest(TestCaseInTempDir): > expected_anon=False, > expected_srealm=None, > expected_sname=None, >+ expected_supported_etypes=None, > expected_flags=None, > unexpected_flags=None, > ticket_decryption_key=None, >@@ -1923,6 +1924,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'expected_anon': expected_anon, > 'expected_srealm': expected_srealm, > 'expected_sname': expected_sname, >+ 'expected_supported_etypes': expected_supported_etypes, > 'expected_flags': expected_flags, > 'unexpected_flags': unexpected_flags, > 'ticket_decryption_key': ticket_decryption_key, >@@ -1963,6 +1965,7 @@ class RawKerberosTest(TestCaseInTempDir): > expected_anon=False, > expected_srealm=None, > expected_sname=None, >+ expected_supported_etypes=None, > expected_flags=None, > unexpected_flags=None, > ticket_decryption_key=None, >@@ -2006,6 +2009,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'expected_anon': expected_anon, > 'expected_srealm': expected_srealm, > 'expected_sname': expected_sname, >+ 'expected_supported_etypes': expected_supported_etypes, > 'expected_flags': expected_flags, > 'unexpected_flags': unexpected_flags, > 'ticket_decryption_key': ticket_decryption_key, >@@ -2312,19 +2316,19 @@ class RawKerberosTest(TestCaseInTempDir): > if canonicalize: > self.assertIn(PADATA_SUPPORTED_ETYPES, enc_pa_dict) > >+ expected_supported_etypes = kdc_exchange_dict[ >+ 'expected_supported_etypes'] >+ expected_supported_etypes |= ( >+ security.KERB_ENCTYPE_DES_CBC_CRC | >+ security.KERB_ENCTYPE_DES_CBC_MD5 | >+ security.KERB_ENCTYPE_RC4_HMAC_MD5) >+ > (supported_etypes,) = struct.unpack( > '<L', > enc_pa_dict[PADATA_SUPPORTED_ETYPES]) > >- self.assertTrue( >- security.KERB_ENCTYPE_FAST_SUPPORTED >- & supported_etypes) >- self.assertTrue( >- security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED >- & supported_etypes) >- self.assertTrue( >- security.KERB_ENCTYPE_CLAIMS_SUPPORTED >- & supported_etypes) >+ self.assertEqual(supported_etypes, >+ expected_supported_etypes) > else: > self.assertNotIn(PADATA_SUPPORTED_ETYPES, enc_pa_dict) > >@@ -3396,6 +3400,7 @@ class RawKerberosTest(TestCaseInTempDir): > kdc_options, > expected_flags=None, > unexpected_flags=None, >+ expected_supported_etypes=None, > preauth_key=None, > ticket_decryption_key=None, > pac_request=None, >@@ -3424,6 +3429,7 @@ class RawKerberosTest(TestCaseInTempDir): > expected_cname=expected_cname, > expected_srealm=expected_srealm, > expected_sname=expected_sname, >+ expected_supported_etypes=expected_supported_etypes, > ticket_decryption_key=ticket_decryption_key, > generate_padata_fn=generate_padata_fn, > check_error_fn=check_error_fn, >-- >2.25.1 > > >From 6f0569336a52585748bca626e4b4f75c4d44d07f Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 20 Sep 2021 13:54:39 +1200 >Subject: [PATCH 289/380] tests/krb5: Set key version number for all accounts > created with create_account() > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 054ec1a8cc4ae42918c7c06ef9c66c8a81242655) >--- > python/samba/tests/krb5/kdc_base_test.py | 12 ++++++------ > 1 file changed, 6 insertions(+), 6 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 646859e85b3..91034a10e15 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -291,6 +291,12 @@ class KDCBaseTest(RawKerberosTest): > > self.creds_set_enctypes(creds) > >+ res = samdb.search(base=dn, >+ scope=ldb.SCOPE_BASE, >+ attrs=['msDS-KeyVersionNumber']) >+ kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >+ creds.set_kvno(kvno) >+ > return (creds, dn) > > def create_rodc(self, ctx): >@@ -670,12 +676,6 @@ class KDCBaseTest(RawKerberosTest): > additional_details=details, > account_control=user_account_control) > >- res = samdb.search(base=dn, >- scope=ldb.SCOPE_BASE, >- attrs=['msDS-KeyVersionNumber']) >- kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >- creds.set_kvno(kvno) >- > keys = self.get_keys(samdb, dn) > self.creds_set_keys(creds, keys) > >-- >2.25.1 > > >From 682abec96158dc041028ac1d9e2f927a1d379633 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 20 Sep 2021 13:59:24 +1200 >Subject: [PATCH 290/380] tests/krb5: Allow tgs_req() to check the returned > ticket enc-part > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 38b4b334caf1b32f1479db3ada48b2028946f5e6) >--- > python/samba/tests/krb5/kdc_base_test.py | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 91034a10e15..914112fdfc7 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1084,7 +1084,7 @@ class KDCBaseTest(RawKerberosTest): > > def tgs_req(self, cname, sname, realm, ticket, key, etypes, > expected_error_mode=0, padata=None, kdc_options=0, >- to_rodc=False): >+ to_rodc=False, service_creds=None): > '''Send a TGS-REQ, returns the response and the decrypted and > decoded enc-part > ''' >@@ -1098,6 +1098,12 @@ class KDCBaseTest(RawKerberosTest): > crealm=realm, > cname=cname) > >+ if service_creds is not None: >+ decryption_key = self.TicketDecryptionKey_from_creds( >+ service_creds) >+ else: >+ decryption_key = None >+ > if not expected_error_mode: > check_error_fn = None > check_rep_fn = self.generic_check_kdc_rep >@@ -1120,6 +1126,7 @@ class KDCBaseTest(RawKerberosTest): > check_error_fn=check_error_fn, > check_rep_fn=check_rep_fn, > check_kdc_private_fn=self.generic_check_kdc_private, >+ ticket_decryption_key=decryption_key, > generate_padata_fn=generate_padata if padata is not None else None, > tgt=tgt, > authenticator_subkey=subkey, >-- >2.25.1 > > >From 29a6de385cd28cfc9571fe038b6f4e9b4e1e5d04 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 20 Sep 2021 13:58:09 +1200 >Subject: [PATCH 291/380] tests/krb5: Add method to get DC credentials > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 9d01043042f1caac98a23cf4d9aa9a02a31a9239) >--- > python/samba/tests/krb5/kdc_base_test.py | 42 ++++++++++++++++++++++++ > 1 file changed, 42 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 914112fdfc7..5de9907d02b 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -930,6 +930,48 @@ class KDCBaseTest(RawKerberosTest): > fallback_creds_fn=download_krbtgt_creds) > return c > >+ def get_dc_creds(self, >+ require_keys=True, >+ require_strongest_key=False): >+ if require_strongest_key: >+ self.assertTrue(require_keys) >+ >+ def download_dc_creds(): >+ samdb = self.get_samdb() >+ >+ dc_rid = 1000 >+ dc_sid = '%s-%d' % (samdb.get_domain_sid(), dc_rid) >+ >+ res = samdb.search(base='<SID=%s>' % dc_sid, >+ scope=ldb.SCOPE_BASE, >+ attrs=['sAMAccountName', >+ 'msDS-KeyVersionNumber']) >+ dn = res[0].dn >+ username = str(res[0]['sAMAccountName']) >+ >+ creds = KerberosCredentials() >+ creds.set_domain(self.env_get_var('DOMAIN', 'DC')) >+ creds.set_realm(self.env_get_var('REALM', 'DC')) >+ creds.set_username(username) >+ >+ kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >+ creds.set_kvno(kvno) >+ creds.set_dn(dn) >+ >+ keys = self.get_keys(samdb, dn) >+ self.creds_set_keys(creds, keys) >+ >+ self.creds_set_enctypes(creds) >+ >+ return creds >+ >+ c = self._get_krb5_creds(prefix='DC', >+ allow_missing_password=True, >+ allow_missing_keys=not require_keys, >+ require_strongest_key=require_strongest_key, >+ fallback_creds_fn=download_dc_creds) >+ return c >+ > def as_req(self, cname, sname, realm, etypes, padata=None, kdc_options=0): > '''Send a Kerberos AS_REQ, returns the undecoded response > ''' >-- >2.25.1 > > >From cde8071498c259e8b6c70c48575bf068a1d3a023 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 20 Sep 2021 14:08:16 +1200 >Subject: [PATCH 292/380] tests/krb5: Fix checking for presence of > authorization data > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit f9284d8517edd9ffd96f0c24166a16366f97de8f) >--- > python/samba/tests/krb5/kdc_base_test.py | 3 ++- > .../ms_kile_client_principal_lookup_tests.py | 6 ++++-- > python/samba/tests/krb5/raw_testcase.py | 16 +++++++++++++--- > 3 files changed, 19 insertions(+), 6 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 5de9907d02b..b4d3739aa11 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1126,7 +1126,7 @@ class KDCBaseTest(RawKerberosTest): > > def tgs_req(self, cname, sname, realm, ticket, key, etypes, > expected_error_mode=0, padata=None, kdc_options=0, >- to_rodc=False, service_creds=None): >+ to_rodc=False, service_creds=None, expect_pac=True): > '''Send a TGS-REQ, returns the response and the decrypted and > decoded enc-part > ''' >@@ -1173,6 +1173,7 @@ class KDCBaseTest(RawKerberosTest): > tgt=tgt, > authenticator_subkey=subkey, > kdc_options=str(kdc_options), >+ expect_pac=expect_pac, > to_rodc=to_rodc) > > rep = self._generic_kdc_exchange(kdc_exchange_dict, >diff --git a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >index 99c842701ea..64ebe15ad70 100755 >--- a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >+++ b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >@@ -321,7 +321,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > names=[mc.get_username()]) > > (rep, enc_part) = self.tgs_req( >- cname, sname, uc.get_realm(), ticket, key, etype) >+ cname, sname, uc.get_realm(), ticket, key, etype, >+ expect_pac=False) > self.check_tgs_reply(rep) > > # Check the contents of the service ticket >@@ -695,7 +696,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > names=[mc.get_username()]) > > (rep, enc_part) = self.tgs_req( >- cname, sname, uc.get_realm(), ticket, key, etype) >+ cname, sname, uc.get_realm(), ticket, key, etype, >+ expect_pac=False) > self.check_tgs_reply(rep) > > # Check the contents of the service ticket >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index c6bc3e553ad..b531e33041d 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -944,12 +944,15 @@ class RawKerberosTest(TestCaseInTempDir): > v = self.getElementValue(obj, elem) > self.assertIsNone(v) > >- def assertElementPresent(self, obj, elem): >+ def assertElementPresent(self, obj, elem, expect_empty=False): > v = self.getElementValue(obj, elem) > self.assertIsNotNone(v) > if self.strict_checking: > if isinstance(v, collections.abc.Container): >- self.assertNotEqual(0, len(v)) >+ if expect_empty: >+ self.assertEqual(0, len(v)) >+ else: >+ self.assertNotEqual(0, len(v)) > > def assertElementEqual(self, obj, elem, value): > v = self.getElementValue(obj, elem) >@@ -1907,6 +1910,7 @@ class RawKerberosTest(TestCaseInTempDir): > outer_req=None, > pac_request=None, > pac_options=None, >+ expect_pac=True, > to_rodc=False): > if expected_error_mode == 0: > expected_error_mode = () >@@ -1952,6 +1956,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'outer_req': outer_req, > 'pac_request': pac_request, > 'pac_options': pac_options, >+ 'expect_pac': expect_pac, > 'to_rodc': to_rodc > } > if callback_dict is None: >@@ -1992,6 +1997,7 @@ class RawKerberosTest(TestCaseInTempDir): > outer_req=None, > pac_request=None, > pac_options=None, >+ expect_pac=True, > to_rodc=False): > if expected_error_mode == 0: > expected_error_mode = () >@@ -2036,6 +2042,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'outer_req': outer_req, > 'pac_request': pac_request, > 'pac_options': pac_options, >+ 'expect_pac': expect_pac, > 'to_rodc': to_rodc > } > if callback_dict is None: >@@ -2236,6 +2243,8 @@ class RawKerberosTest(TestCaseInTempDir): > armor_key = kdc_exchange_dict['armor_key'] > self.verify_ticket_checksum(ticket, ticket_checksum, armor_key) > >+ expect_pac = kdc_exchange_dict['expect_pac'] >+ > ticket_session_key = None > if ticket_private is not None: > self.assertElementFlags(ticket_private, 'flags', >@@ -2265,7 +2274,8 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementMissing(ticket_private, 'renew-till') > if self.strict_checking: > self.assertElementEqual(ticket_private, 'caddr', []) >- self.assertElementPresent(ticket_private, 'authorization-data') >+ self.assertElementPresent(ticket_private, 'authorization-data', >+ expect_empty=not expect_pac) > > encpart_session_key = None > if encpart_private is not None: >-- >2.25.1 > > >From cc40ca191c1f681fe974193bf90d081db3b912a8 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 22 Sep 2021 11:41:45 +1200 >Subject: [PATCH 293/380] tests/krb5: Provide ticket enc-part key to tgs_req() > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit f2f1f3a1e9269f0e7b93006bba2368a6ffbecc7c) >--- > python/samba/tests/krb5/kdc_base_test.py | 3 +- > python/samba/tests/krb5/kdc_tgs_tests.py | 6 ++-- > .../ms_kile_client_principal_lookup_tests.py | 28 ++++++++++++------- > 3 files changed, 24 insertions(+), 13 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index b4d3739aa11..b71ae66bf54 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1215,7 +1215,8 @@ class KDCBaseTest(RawKerberosTest): > names=[service, target_name]) > > rep, enc_part = self.tgs_req(cname, sname, realm, ticket, key, etype, >- to_rodc=to_rodc) >+ to_rodc=to_rodc, >+ service_creds=target_creds) > > service_ticket = rep['ticket'] > >diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py >index dad9e6b88df..0904233b01f 100755 >--- a/python/samba/tests/krb5/kdc_tgs_tests.py >+++ b/python/samba/tests/krb5/kdc_tgs_tests.py >@@ -132,7 +132,8 @@ class KdcTgsTests(KDCBaseTest): > names=["ldap", samdb.host_dns_name()]) > > (rep, _) = self.tgs_req( >- cname, sname, uc.get_realm(), ticket, key, etype) >+ cname, sname, uc.get_realm(), ticket, key, etype, >+ service_creds=self.get_dc_creds()) > > self.check_tgs_reply(rep) > >@@ -175,7 +176,8 @@ class KdcTgsTests(KDCBaseTest): > names=[mc.get_username()]) > > (rep, enc_part) = self.tgs_req( >- cname, sname, uc.get_realm(), ticket, key, etype) >+ cname, sname, uc.get_realm(), ticket, key, etype, >+ service_creds=mc) > self.check_tgs_reply(rep) > > # Check the contents of the service ticket >diff --git a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >index 64ebe15ad70..ce796f63ac2 100755 >--- a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >+++ b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >@@ -126,7 +126,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > names=[mc.get_username()]) > > (rep, enc_part) = self.tgs_req( >- cname, sname, uc.get_realm(), ticket, key, etype) >+ cname, sname, uc.get_realm(), ticket, key, etype, >+ service_creds=mc) > self.check_tgs_reply(rep) > > # Check the contents of the pac, and the ticket >@@ -185,7 +186,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > names=[mc.get_username()]) > > (rep, enc_part) = self.tgs_req( >- cname, sname, mc.get_realm(), ticket, key, etype) >+ cname, sname, mc.get_realm(), ticket, key, etype, >+ service_creds=mc) > self.check_tgs_reply(rep) > > # Check the contents of the pac, and the ticket >@@ -247,7 +249,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > names=[mc.get_username()]) > > (rep, enc_part) = self.tgs_req( >- cname, sname, uc.get_realm(), ticket, key, etype) >+ cname, sname, uc.get_realm(), ticket, key, etype, >+ service_creds=mc) > self.check_tgs_reply(rep) > > # Check the contents of the service ticket >@@ -322,7 +325,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > > (rep, enc_part) = self.tgs_req( > cname, sname, uc.get_realm(), ticket, key, etype, >- expect_pac=False) >+ service_creds=mc, expect_pac=False) > self.check_tgs_reply(rep) > > # Check the contents of the service ticket >@@ -390,7 +393,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > names=[mc.get_username()]) > > (rep, enc_part) = self.tgs_req( >- cname, sname, uc.get_realm(), ticket, key, etype) >+ cname, sname, uc.get_realm(), ticket, key, etype, >+ service_creds=mc) > self.check_tgs_reply(rep) > > # Check the contents of the pac, and the ticket >@@ -492,7 +496,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > names=[mc.get_username()]) > > (rep, enc_part) = self.tgs_req( >- cname, sname, uc.get_realm(), ticket, key, etype) >+ cname, sname, uc.get_realm(), ticket, key, etype, >+ service_creds=mc) > self.check_tgs_reply(rep) > > # Check the contents of the pac, and the ticket >@@ -555,7 +560,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > names=[mc.get_username()]) > > (rep, enc_part) = self.tgs_req( >- cname, sname, uc.get_realm(), ticket, key, etype) >+ cname, sname, uc.get_realm(), ticket, key, etype, >+ service_creds=mc) > self.check_tgs_reply(rep) > > # Check the contents of the pac, and the ticket >@@ -619,7 +625,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > names=[mc.get_username()]) > > (rep, enc_part) = self.tgs_req( >- cname, sname, uc.get_realm(), ticket, key, etype) >+ cname, sname, uc.get_realm(), ticket, key, etype, >+ service_creds=mc) > self.check_tgs_reply(rep) > > # Check the contents of the pac, and the ticket >@@ -697,7 +704,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > > (rep, enc_part) = self.tgs_req( > cname, sname, uc.get_realm(), ticket, key, etype, >- expect_pac=False) >+ service_creds=mc, expect_pac=False) > self.check_tgs_reply(rep) > > # Check the contents of the service ticket >@@ -767,7 +774,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > names=[mc.get_username()]) > > (rep, enc_part) = self.tgs_req( >- cname, sname, uc.get_realm(), ticket, key, etype) >+ cname, sname, uc.get_realm(), ticket, key, etype, >+ service_creds=mc) > self.check_tgs_reply(rep) > > # Check the contents of the pac, and the ticket >-- >2.25.1 > > >From 51cd9a916bca9702b5200c5b0d7abb3b338bdb0c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 20 Sep 2021 14:05:58 +1200 >Subject: [PATCH 294/380] tests/krb5: Simplify account creation > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 394e8db261b10d130c5e5730989bf68f9bf4f85f) >--- > .../ms_kile_client_principal_lookup_tests.py | 16 ++++------------ > 1 file changed, 4 insertions(+), 12 deletions(-) > >diff --git a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >index ce796f63ac2..501bc4892f4 100755 >--- a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >+++ b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >@@ -282,15 +282,11 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > samdb = self.get_samdb() > user_name = "mskileusr" > alt_name = "mskilealtsec" >- (uc, dn) = self.create_account(samdb, user_name) >+ (uc, dn) = self.create_account(samdb, user_name, >+ account_control=UF_DONT_REQUIRE_PREAUTH) > realm = uc.get_realm().lower() > alt_sec = "Kerberos:%s@%s" % (alt_name, realm) > self.add_attribute(samdb, dn, "altSecurityIdentities", alt_sec) >- self.modify_attribute( >- samdb, >- dn, >- "userAccountControl", >- str(UF_NORMAL_ACCOUNT | UF_DONT_REQUIRE_PREAUTH)) > > mach_name = "mskilemac" > (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >@@ -660,15 +656,11 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > samdb = self.get_samdb() > user_name = "mskileusr" > alt_name = "mskilealtsec" >- (uc, dn) = self.create_account(samdb, user_name) >+ (uc, dn) = self.create_account(samdb, user_name, >+ account_control=UF_DONT_REQUIRE_PREAUTH) > realm = uc.get_realm().lower() > alt_sec = "Kerberos:%s@%s" % (alt_name, realm) > self.add_attribute(samdb, dn, "altSecurityIdentities", alt_sec) >- self.modify_attribute( >- samdb, >- dn, >- "userAccountControl", >- str(UF_NORMAL_ACCOUNT | UF_DONT_REQUIRE_PREAUTH)) > ename = alt_name + "@" + realm > > mach_name = "mskilemac" >-- >2.25.1 > > >From 7e4027b04a269aba974ab00eecf4863fcdbef62d Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 21 Sep 2021 13:54:47 +1200 >Subject: [PATCH 295/380] tests/krb5: Add get_rodc_krbtgt_creds() to > RawKerberosTest > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 1458cd9065de34c42bd5ec63feb2f66c25103982) >--- > python/samba/tests/krb5/raw_testcase.py | 11 +++++++++++ > 1 file changed, 11 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index b531e33041d..59882e44173 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -750,6 +750,17 @@ class RawKerberosTest(TestCaseInTempDir): > c.set_gensec_features(c.get_gensec_features() | FEATURE_SEAL) > return c > >+ def get_rodc_krbtgt_creds(self, >+ require_keys=True, >+ require_strongest_key=False): >+ if require_strongest_key: >+ self.assertTrue(require_keys) >+ c = self._get_krb5_creds(prefix='RODC_KRBTGT', >+ allow_missing_password=True, >+ allow_missing_keys=not require_keys, >+ require_strongest_key=require_strongest_key) >+ return c >+ > def get_krbtgt_creds(self, > require_keys=True, > require_strongest_key=False): >-- >2.25.1 > > >From ff527fab7deec398491e67f01158e5569065190b Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 20 Sep 2021 14:10:07 +1200 >Subject: [PATCH 296/380] tests/krb5: Verify checksums of tickets obtained from > the KDC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit ea7b550a500d9e458498d37688b67dafd3d9509d) >--- > python/samba/tests/krb5/raw_testcase.py | 34 +++++++++++++++++-------- > 1 file changed, 24 insertions(+), 10 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 59882e44173..985792887ca 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2254,6 +2254,13 @@ class RawKerberosTest(TestCaseInTempDir): > armor_key = kdc_exchange_dict['armor_key'] > self.verify_ticket_checksum(ticket, ticket_checksum, armor_key) > >+ to_rodc = kdc_exchange_dict['to_rodc'] >+ if to_rodc: >+ krbtgt_creds = self.get_rodc_krbtgt_creds() >+ else: >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_key = self.TicketDecryptionKey_from_creds(krbtgt_creds) >+ > expect_pac = kdc_exchange_dict['expect_pac'] > > ticket_session_key = None >@@ -2386,6 +2393,9 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_private=ticket_private, > encpart_private=encpart_private) > >+ if ticket_decryption_key is not None: >+ self.verify_ticket(ticket_creds, krbtgt_key, expect_pac=expect_pac) >+ > kdc_exchange_dict['rep_ticket_creds'] = ticket_creds > > def check_pac_options_claims_support(self, pac_options): >@@ -3061,16 +3071,20 @@ class RawKerberosTest(TestCaseInTempDir): > if is_tgt: > self.assertNotIn(krb5pac.PAC_TYPE_TICKET_CHECKSUM, checksums) > else: >- ticket_checksum, ticket_ctype = checksums[ >- krb5pac.PAC_TYPE_TICKET_CHECKSUM] >- enc_part['authorization-data'] = auth_data >- enc_part = self.der_encode(enc_part, >- asn1Spec=krb5_asn1.EncTicketPart()) >- >- krbtgt_key.verify_checksum(KU_NON_KERB_CKSUM_SALT, >- enc_part, >- ticket_ctype, >- ticket_checksum) >+ ticket_checksum, ticket_ctype = checksums.get( >+ krb5pac.PAC_TYPE_TICKET_CHECKSUM, >+ (None, None)) >+ if self.strict_checking: >+ self.assertIsNotNone(ticket_checksum) >+ if ticket_checksum is not None: >+ enc_part['authorization-data'] = auth_data >+ enc_part = self.der_encode(enc_part, >+ asn1Spec=krb5_asn1.EncTicketPart()) >+ >+ krbtgt_key.verify_checksum(KU_NON_KERB_CKSUM_SALT, >+ enc_part, >+ ticket_ctype, >+ ticket_checksum) > > def modified_ticket(self, > ticket, *, >-- >2.25.1 > > >From 8f5e27882c92282a1c658e01f42d499e7b25f8ab Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 20 Sep 2021 15:06:18 +1200 >Subject: [PATCH 297/380] tests/krb5: Add method to determine if principal is > krbtgt > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit c0b81f0dd54d0d71b5d0f5a870b505e82d0e85b8) >--- > python/samba/tests/krb5/raw_testcase.py | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 985792887ca..cadf2b50dc9 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2977,7 +2977,7 @@ class RawKerberosTest(TestCaseInTempDir): > def verify_ticket(self, ticket, krbtgt_key, expect_pac=True): > # Check if the ticket is a TGT. > sname = ticket.ticket['sname'] >- is_tgt = sname['name-string'][0] == b'krbtgt' >+ is_tgt = self.is_tgs(sname) > > # Decrypt the ticket. > >@@ -3371,6 +3371,10 @@ class RawKerberosTest(TestCaseInTempDir): > krb5pac.PAC_TYPE_KDC_CHECKSUM: krbtgt_key > } > >+ def is_tgs(self, principal): >+ name = principal['name-string'][0] >+ return name in ('krbtgt', b'krbtgt') >+ > def get_empty_pac(self): > return self.AuthorizationData_create(AD_WIN2K_PAC, bytes(1)) > >-- >2.25.1 > > >From 7839f38cb15dbf9dc114136b1eb7ad5cf57be122 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 20 Sep 2021 15:10:35 +1200 >Subject: [PATCH 298/380] tests/krb5: Add classes for testing invalid checksums > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Thu Sep 23 19:28:44 UTC 2021 on sn-devel-184 > >(cherry picked from commit 5b331443d0698256ee7fcc040a1ab8137efe925d) >--- > python/samba/tests/krb5/raw_testcase.py | 23 +++++++++++++++++++++++ > 1 file changed, 23 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index cadf2b50dc9..579d52b3e92 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -303,6 +303,29 @@ class RodcPacEncryptionKey(Krb5EncryptionKey): > cksum) > > >+class ZeroedChecksumKey(Krb5EncryptionKey): >+ def make_checksum(self, usage, plaintext, ctype=None): >+ return self.make_zeroed_checksum(ctype) >+ >+ >+class WrongLengthChecksumKey(Krb5EncryptionKey): >+ def __init__(self, key, kvno, length): >+ super().__init__(key, kvno) >+ >+ self._length = length >+ >+ def make_checksum(self, usage, plaintext, ctype=None): >+ checksum = super().make_checksum(usage, plaintext, ctype) >+ >+ diff = self._length - len(checksum) >+ if diff > 0: >+ checksum += bytes(diff) >+ elif diff < 0: >+ checksum = checksum[:self._length] >+ >+ return checksum >+ >+ > class KerberosCredentials(Credentials): > > fast_supported_bits = (security.KERB_ENCTYPE_FAST_SUPPORTED | >-- >2.25.1 > > >From 02812f9a55ba1c0902bc1e8e6f4c6d3f6a6e2a56 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 11:16:24 +1300 >Subject: [PATCH 299/380] tests/krb5: Rename method parameter > >For class methods, the name given to the first parameter is generally 'cls' >rather than 'self'. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit d501ddca3b7b9c39c0b3eccf19176e3122cf5b9d) >--- > python/samba/tests/krb5/raw_testcase.py | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 579d52b3e92..11c0e308e3d 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -373,10 +373,10 @@ class KerberosCredentials(Credentials): > ]) > > @classmethod >- def etypes_to_bits(self, etypes): >+ def etypes_to_bits(cls, etypes): > bits = 0 > for etype in etypes: >- bit = self.etype_map[etype] >+ bit = cls.etype_map[etype] > if bits & bit: > raise ValueError(f'Got duplicate etype: {etype}') > bits |= bit >@@ -384,14 +384,14 @@ class KerberosCredentials(Credentials): > return bits > > @classmethod >- def bits_to_etypes(self, bits): >+ def bits_to_etypes(cls, bits): > etypes = () >- for etype, bit in self.etype_map.items(): >+ for etype, bit in cls.etype_map.items(): > if bit & bits: > bits &= ~bit > etypes += (etype,) > >- bits &= ~self.fast_supported_bits >+ bits &= ~cls.fast_supported_bits > if bits != 0: > raise ValueError(f'Unsupported etype bits: {bits}') > >-- >2.25.1 > > >From 5a5851bda9ba74427e91ecee63e7affd267941e7 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 11:16:51 +1300 >Subject: [PATCH 300/380] tests/krb5: Remove unused parameter > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 8e4b21590836dab02c1864f6ac12b3879c4bd69c) >--- > python/samba/tests/krb5/raw_testcase.py | 3 --- > 1 file changed, 3 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 11c0e308e3d..1119c9926d7 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2169,7 +2169,6 @@ class RawKerberosTest(TestCaseInTempDir): > > self.check_rep_padata(kdc_exchange_dict, > callback_dict, >- rep, > fast_response['padata'], > error_code=0) > >@@ -2509,7 +2508,6 @@ class RawKerberosTest(TestCaseInTempDir): > > etype_info2 = self.check_rep_padata(kdc_exchange_dict, > callback_dict, >- rep, > rep_padata, > error_code) > >@@ -2520,7 +2518,6 @@ class RawKerberosTest(TestCaseInTempDir): > def check_rep_padata(self, > kdc_exchange_dict, > callback_dict, >- rep, > rep_padata, > error_code): > rep_msg_type = kdc_exchange_dict['rep_msg_type'] >-- >2.25.1 > > >From 2617083a1abc0d7d833a40e0b9255d90524f6345 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 11:23:17 +1300 >Subject: [PATCH 301/380] tests/krb5: Allow for missing msDS-KeyVersionNumber > attribute > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit ce433ff868d3cdf8e8a6e4995d89d6e036335fb6) >--- > python/samba/tests/krb5/kdc_base_test.py | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index b71ae66bf54..bb92bbd65e5 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -294,8 +294,10 @@ class KDCBaseTest(RawKerberosTest): > res = samdb.search(base=dn, > scope=ldb.SCOPE_BASE, > attrs=['msDS-KeyVersionNumber']) >- kvno = int(res[0]['msDS-KeyVersionNumber'][0]) >- creds.set_kvno(kvno) >+ kvno = res[0].get('msDS-KeyVersionNumber', idx=0) >+ if kvno is not None: >+ self.assertEqual(int(kvno), 1) >+ creds.set_kvno(1) > > return (creds, dn) > >-- >2.25.1 > > >From ebc4b781006a073adfd9b933d3fd1618752ebdd3 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 30 Sep 2021 10:51:01 +1300 >Subject: [PATCH 302/380] tests/krb5: Fix sending PA-PAC-OPTIONS and > PA-PAC-REQUEST > >These padata were not being sent if other FAST padata was not specified. > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 >(cherry picked from commit 6f1282e8d34073d8499ce919908b39645b017cb8) >--- > python/samba/tests/krb5/raw_testcase.py | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 1119c9926d7..ceff1b6220e 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1801,8 +1801,6 @@ class RawKerberosTest(TestCaseInTempDir): > fast_padata, req_body = generate_fast_padata_fn(kdc_exchange_dict, > callback_dict, > req_body) >- >- fast_padata += additional_padata > else: > fast_padata = [] > >@@ -1847,6 +1845,7 @@ class RawKerberosTest(TestCaseInTempDir): > KU_FAST_REQ_CHKSUM, > checksum_blob) > >+ fast_padata += additional_padata > fast = generate_fast_fn(kdc_exchange_dict, > callback_dict, > inner_req_body, >-- >2.25.1 > > >From ff196bee8998557443c5070c47ebf4b50b47bbd4 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 30 Sep 2021 10:54:33 +1300 >Subject: [PATCH 303/380] tests/krb5: Fix PA-PAC-OPTIONS checking > >Make the check work correctly if bits other than the claims bit are >specified. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 1fd00135fa4dff4331d86b228ccc01f834476997) >--- > python/samba/tests/krb5/raw_testcase.py | 44 +++++++++++++------------ > 1 file changed, 23 insertions(+), 21 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index ceff1b6220e..0217674ed2d 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2354,10 +2354,10 @@ class RawKerberosTest(TestCaseInTempDir): > if self.strict_checking: > self.assertElementEqual(encpart_private, 'caddr', []) > >- sent_claims = self.sent_claims(kdc_exchange_dict) >+ sent_pac_options = self.get_sent_pac_options(kdc_exchange_dict) > > if self.strict_checking: >- if sent_claims or canonicalize: >+ if canonicalize or '1' in sent_pac_options: > self.assertElementPresent(encpart_private, > 'encrypted-pa-data') > enc_pa_dict = self.get_pa_dict( >@@ -2381,12 +2381,15 @@ class RawKerberosTest(TestCaseInTempDir): > else: > self.assertNotIn(PADATA_SUPPORTED_ETYPES, enc_pa_dict) > >- # ClaimsCompIdFASTSupported registry key >- if sent_claims: >+ if '1' in sent_pac_options: > self.assertIn(PADATA_PAC_OPTIONS, enc_pa_dict) > >- self.check_pac_options_claims_support( >- enc_pa_dict[PADATA_PAC_OPTIONS]) >+ pac_options = self.der_decode( >+ enc_pa_dict[PADATA_PAC_OPTIONS], >+ asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) >+ >+ self.assertElementEqual(pac_options, 'options', >+ sent_pac_options) > else: > self.assertNotIn(PADATA_PAC_OPTIONS, enc_pa_dict) > else: >@@ -2419,11 +2422,6 @@ class RawKerberosTest(TestCaseInTempDir): > > kdc_exchange_dict['rep_ticket_creds'] = ticket_creds > >- def check_pac_options_claims_support(self, pac_options): >- pac_options = self.der_decode(pac_options, >- asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) >- self.assertEqual('1', pac_options['options'][0]) # claims bit >- > def generic_check_kdc_error(self, > kdc_exchange_dict, > callback_dict, >@@ -2565,8 +2563,9 @@ class RawKerberosTest(TestCaseInTempDir): > if not sent_fast and error_code != 0: > expected_patypes += (PADATA_PW_SALT,) > else: >- sent_claims = self.sent_claims(kdc_exchange_dict) >- if sent_claims and error_code not in (0, KDC_ERR_GENERIC): >+ sent_pac_options = self.get_sent_pac_options(kdc_exchange_dict) >+ if ('1' in sent_pac_options >+ and error_code not in (0, KDC_ERR_GENERIC)): > expected_patypes += (PADATA_PAC_OPTIONS,) > elif error_code != KDC_ERR_GENERIC: > if expect_etype_info: >@@ -2656,8 +2655,9 @@ class RawKerberosTest(TestCaseInTempDir): > continue > if patype == PADATA_PAC_OPTIONS: > self.assertIsNone(pac_options) >- pac_options = pavalue >- self.assertIsNotNone(pac_options) >+ pac_options = self.der_decode( >+ pavalue, >+ asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) > continue > if patype == PADATA_PW_SALT: > self.assertIsNone(pw_salt) >@@ -2677,7 +2677,7 @@ class RawKerberosTest(TestCaseInTempDir): > inner=True) > > if pac_options is not None: >- self.check_pac_options_claims_support(pac_options) >+ self.assertElementEqual(pac_options, 'options', sent_pac_options) > > if pw_salt is not None: > self.assertEqual(12, len(pw_salt)) >@@ -3418,19 +3418,21 @@ class RawKerberosTest(TestCaseInTempDir): > > return PADATA_ENCRYPTED_CHALLENGE in fast_pa_dict > >- def sent_claims(self, kdc_exchange_dict): >+ def get_sent_pac_options(self, kdc_exchange_dict): > fast_pa_dict = self.get_fast_pa_dict(kdc_exchange_dict) > > if PADATA_PAC_OPTIONS not in fast_pa_dict: >- return False >+ return '' > > pac_options = self.der_decode(fast_pa_dict[PADATA_PAC_OPTIONS], > asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) > pac_options = pac_options['options'] >- claims_pos = len(tuple(krb5_asn1.PACOptionFlags('claims'))) - 1 > >- return (claims_pos < len(pac_options) >- and pac_options[claims_pos] == '1') >+ # Mask out unsupported bits. >+ pac_options, remaining = pac_options[:4], pac_options[4:] >+ pac_options += '0' * len(remaining) >+ >+ return pac_options > > def get_krbtgt_sname(self): > krbtgt_creds = self.get_krbtgt_creds() >-- >2.25.1 > > >From fd039275f12a32a5286088d1b9c30ea8d305f380 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 11:47:39 +1300 >Subject: [PATCH 304/380] tests/krb5: Rename allowed_to_delegate_to parameter > for clarity > >This helps to distinguish resourced-based and non-resource-based >constrained delegation. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 31817c383c2014224b1397fde610624663313246) >--- > python/samba/tests/krb5/kdc_base_test.py | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index bb92bbd65e5..e6639270f69 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -598,7 +598,7 @@ class KDCBaseTest(RawKerberosTest): > 'no_auth_data_required': False, > 'supported_enctypes': None, > 'not_delegated': False, >- 'allowed_to_delegate_to': None, >+ 'delegation_to_spn': None, > 'trusted_to_auth_for_delegation': False, > 'fast_support': False > } >@@ -629,13 +629,13 @@ class KDCBaseTest(RawKerberosTest): > no_auth_data_required, > supported_enctypes, > not_delegated, >- allowed_to_delegate_to, >+ delegation_to_spn, > trusted_to_auth_for_delegation, > fast_support): > if machine_account: > self.assertFalse(not_delegated) > else: >- self.assertIsNone(allowed_to_delegate_to) >+ self.assertIsNone(delegation_to_spn) > self.assertFalse(trusted_to_auth_for_delegation) > > samdb = self.get_samdb() >@@ -664,8 +664,8 @@ class KDCBaseTest(RawKerberosTest): > if enctypes is not None: > details['msDS-SupportedEncryptionTypes'] = str(enctypes) > >- if allowed_to_delegate_to: >- details['msDS-AllowedToDelegateTo'] = allowed_to_delegate_to >+ if delegation_to_spn: >+ details['msDS-AllowedToDelegateTo'] = delegation_to_spn > > if machine_account: > spn = 'host/' + user_name >-- >2.25.1 > > >From b43e7ed18f836027f718ff6a6d70902bd1bb4f29 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 11:50:36 +1300 >Subject: [PATCH 305/380] tests/krb5: Allow created accounts to use > resource-based constrained delegation > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit bba8cb8dce19e47a7b813efd9a7527e38856435e) >--- > python/samba/tests/krb5/kdc_base_test.py | 33 ++++++++++++++++++++++++ > 1 file changed, 33 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index e6639270f69..918e04a1dbe 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -301,6 +301,30 @@ class KDCBaseTest(RawKerberosTest): > > return (creds, dn) > >+ def get_security_descriptor(self, dn): >+ samdb = self.get_samdb() >+ >+ sid = self.get_objectSid(samdb, dn) >+ >+ owner_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS) >+ >+ ace = security.ace() >+ ace.access_mask = security.SEC_ADS_GENERIC_ALL >+ >+ ace.trustee = security.dom_sid(sid) >+ >+ dacl = security.acl() >+ dacl.revision = security.SECURITY_ACL_REVISION_ADS >+ dacl.aces = [ace] >+ dacl.num_aces = 1 >+ >+ security_desc = security.descriptor() >+ security_desc.type |= security.SEC_DESC_DACL_PRESENT >+ security_desc.owner_sid = owner_sid >+ security_desc.dacl = dacl >+ >+ return ndr_pack(security_desc) >+ > def create_rodc(self, ctx): > ctx.nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn] > ctx.full_nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn] >@@ -599,6 +623,7 @@ class KDCBaseTest(RawKerberosTest): > 'supported_enctypes': None, > 'not_delegated': False, > 'delegation_to_spn': None, >+ 'delegation_from_dn': None, > 'trusted_to_auth_for_delegation': False, > 'fast_support': False > } >@@ -630,12 +655,14 @@ class KDCBaseTest(RawKerberosTest): > supported_enctypes, > not_delegated, > delegation_to_spn, >+ delegation_from_dn, > trusted_to_auth_for_delegation, > fast_support): > if machine_account: > self.assertFalse(not_delegated) > else: > self.assertIsNone(delegation_to_spn) >+ self.assertIsNone(delegation_from_dn) > self.assertFalse(trusted_to_auth_for_delegation) > > samdb = self.get_samdb() >@@ -667,6 +694,12 @@ class KDCBaseTest(RawKerberosTest): > if delegation_to_spn: > details['msDS-AllowedToDelegateTo'] = delegation_to_spn > >+ if delegation_from_dn: >+ security_descriptor = self.get_security_descriptor( >+ delegation_from_dn) >+ details['msDS-AllowedToActOnBehalfOfOtherIdentity'] = ( >+ security_descriptor) >+ > if machine_account: > spn = 'host/' + user_name > else: >-- >2.25.1 > > >From 030e2ff6f5bd7d8e715f3a945690b6945cbfb1bc Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 11:52:17 +1300 >Subject: [PATCH 306/380] tests/krb5: Add assertion to make failures clearer > >These failures may occur if tests are not run against an RODC. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit cda50b5c505072989abf84c209e16ff4efe2e628) >--- > python/samba/tests/krb5/kdc_base_test.py | 1 + > 1 file changed, 1 insertion(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 918e04a1dbe..25433ba1069 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -590,6 +590,7 @@ class KDCBaseTest(RawKerberosTest): > scope=ldb.SCOPE_BASE, > attrs=[group_attr]) > orig_msg = res[0] >+ self.assertIn(group_attr, orig_msg) > > members = list(orig_msg[group_attr]) > members.append(account_dn) >-- >2.25.1 > > >From 88320905f5bcd53d31edf7b5f8f94cad98dbfebc Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 11:54:49 +1300 >Subject: [PATCH 307/380] tests/krb5: Introduce helper method for creating > invalid length checksums > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 9d142dc3a452b0f06efc66f422402ee6e553ee7c) >--- > python/samba/tests/krb5/raw_testcase.py | 13 ++++++++----- > 1 file changed, 8 insertions(+), 5 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 0217674ed2d..6107442409f 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -314,17 +314,20 @@ class WrongLengthChecksumKey(Krb5EncryptionKey): > > self._length = length > >- def make_checksum(self, usage, plaintext, ctype=None): >- checksum = super().make_checksum(usage, plaintext, ctype) >- >- diff = self._length - len(checksum) >+ @classmethod >+ def _adjust_to_length(cls, checksum, length): >+ diff = length - len(checksum) > if diff > 0: > checksum += bytes(diff) > elif diff < 0: >- checksum = checksum[:self._length] >+ checksum = checksum[:length] > > return checksum > >+ def make_checksum(self, usage, plaintext, ctype=None): >+ checksum = super().make_checksum(usage, plaintext, ctype) >+ return self._adjust_to_length(checksum, self._length) >+ > > class KerberosCredentials(Credentials): > >-- >2.25.1 > > >From fe05543877ba3ea62ef76046aa666eab6fe744a8 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 11:56:21 +1300 >Subject: [PATCH 308/380] tests/krb5: Fix method for creating invalid length > zeroed checksum > >Previously the base class method was being used. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit ae09219c3a1c6d47817f51baf3784e8986c7478d) >--- > python/samba/tests/krb5/raw_testcase.py | 3 +++ > 1 file changed, 3 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 6107442409f..a3f17e4dc4a 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -324,6 +324,9 @@ class WrongLengthChecksumKey(Krb5EncryptionKey): > > return checksum > >+ def make_zeroed_checksum(self, ctype=None): >+ return bytes(self._length) >+ > def make_checksum(self, usage, plaintext, ctype=None): > checksum = super().make_checksum(usage, plaintext, ctype) > return self._adjust_to_length(checksum, self._length) >-- >2.25.1 > > >From 13d27a772a5f8e5fdc44ad956212521a53993656 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 11:59:42 +1300 >Subject: [PATCH 309/380] tests/krb5: Fix checksum generation and verification > >The KDC and server checksums may be generated using the same key, but >only the KDC checksum should have an RODCIdentifier. To fix this, >instead of overriding the existing methods, add additional ones for >RODC-specific signatures, so that both types of signatures can be >generated or verified. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit a927cecafdd5ad6dc5189fa98cb42684c9c3b033) >--- > python/samba/tests/krb5/raw_testcase.py | 57 ++++++++++++++----------- > 1 file changed, 32 insertions(+), 25 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index a3f17e4dc4a..aefbdd6d761 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -281,15 +281,15 @@ class RodcPacEncryptionKey(Krb5EncryptionKey): > else: > self.rodc_id = b'' > >- def make_zeroed_checksum(self, ctype=None): >+ def make_rodc_zeroed_checksum(self, ctype=None): > checksum = super().make_zeroed_checksum(ctype) > return checksum + bytes(len(self.rodc_id)) > >- def make_checksum(self, usage, plaintext, ctype=None): >+ def make_rodc_checksum(self, usage, plaintext, ctype=None): > checksum = super().make_checksum(usage, plaintext, ctype) > return checksum + self.rodc_id > >- def verify_checksum(self, usage, plaintext, ctype, cksum): >+ def verify_rodc_checksum(self, usage, plaintext, ctype, cksum): > if self.rodc_id: > cksum, cksum_rodc_id = cksum[:-2], cksum[-2:] > >@@ -303,12 +303,15 @@ class RodcPacEncryptionKey(Krb5EncryptionKey): > cksum) > > >-class ZeroedChecksumKey(Krb5EncryptionKey): >+class ZeroedChecksumKey(RodcPacEncryptionKey): > def make_checksum(self, usage, plaintext, ctype=None): > return self.make_zeroed_checksum(ctype) > >+ def make_rodc_checksum(self, usage, plaintext, ctype=None): >+ return self.make_rodc_zeroed_checksum(ctype) > >-class WrongLengthChecksumKey(Krb5EncryptionKey): >+ >+class WrongLengthChecksumKey(RodcPacEncryptionKey): > def __init__(self, key, kvno, length): > super().__init__(key, kvno) > >@@ -331,6 +334,13 @@ class WrongLengthChecksumKey(Krb5EncryptionKey): > checksum = super().make_checksum(usage, plaintext, ctype) > return self._adjust_to_length(checksum, self._length) > >+ def make_rodc_zeroed_checksum(self, ctype=None): >+ return bytes(self._length) >+ >+ def make_rodc_checksum(self, usage, plaintext, ctype=None): >+ checksum = super().make_rodc_checksum(usage, plaintext, ctype) >+ return self._adjust_to_length(checksum, self._length) >+ > > class KerberosCredentials(Credentials): > >@@ -3080,18 +3090,17 @@ class RawKerberosTest(TestCaseInTempDir): > > server_checksum, server_ctype = checksums[ > krb5pac.PAC_TYPE_SRV_CHECKSUM] >- Krb5EncryptionKey.verify_checksum(key, >- KU_NON_KERB_CKSUM_SALT, >- pac_data, >- server_ctype, >- server_checksum) >+ key.verify_checksum(KU_NON_KERB_CKSUM_SALT, >+ pac_data, >+ server_ctype, >+ server_checksum) > > kdc_checksum, kdc_ctype = checksums[ > krb5pac.PAC_TYPE_KDC_CHECKSUM] >- krbtgt_key.verify_checksum(KU_NON_KERB_CKSUM_SALT, >- server_checksum, >- kdc_ctype, >- kdc_checksum) >+ krbtgt_key.verify_rodc_checksum(KU_NON_KERB_CKSUM_SALT, >+ server_checksum, >+ kdc_ctype, >+ kdc_checksum) > > if is_tgt: > self.assertNotIn(krb5pac.PAC_TYPE_TICKET_CHECKSUM, checksums) >@@ -3106,10 +3115,10 @@ class RawKerberosTest(TestCaseInTempDir): > enc_part = self.der_encode(enc_part, > asn1Spec=krb5_asn1.EncTicketPart()) > >- krbtgt_key.verify_checksum(KU_NON_KERB_CKSUM_SALT, >- enc_part, >- ticket_ctype, >- ticket_checksum) >+ krbtgt_key.verify_rodc_checksum(KU_NON_KERB_CKSUM_SALT, >+ enc_part, >+ ticket_ctype, >+ ticket_checksum) > > def modified_ticket(self, > ticket, *, >@@ -3300,16 +3309,15 @@ class RawKerberosTest(TestCaseInTempDir): > if buffer_type == krb5pac.PAC_TYPE_TICKET_CHECKSUM: > self.assertIsNotNone(enc_part) > >- signature = checksum_key.make_checksum( >+ signature = checksum_key.make_rodc_checksum( > KU_NON_KERB_CKSUM_SALT, > enc_part) > > elif buffer_type == krb5pac.PAC_TYPE_SRV_CHECKSUM: >- signature = Krb5EncryptionKey.make_zeroed_checksum( >- checksum_key) >+ signature = checksum_key.make_zeroed_checksum() > > else: >- signature = checksum_key.make_zeroed_checksum() >+ signature = checksum_key.make_rodc_zeroed_checksum() > > checksum_buffer.info.signature = signature > checksum_buffer.info.type = ctype >@@ -3325,8 +3333,7 @@ class RawKerberosTest(TestCaseInTempDir): > server_checksum_key = checksum_keys[krb5pac.PAC_TYPE_SRV_CHECKSUM] > > pac_data = ndr_pack(pac) >- server_checksum = Krb5EncryptionKey.make_checksum( >- server_checksum_key, >+ server_checksum = server_checksum_key.make_checksum( > KU_NON_KERB_CKSUM_SALT, > pac_data) > >@@ -3339,7 +3346,7 @@ class RawKerberosTest(TestCaseInTempDir): > > kdc_checksum_key = checksum_keys[krb5pac.PAC_TYPE_KDC_CHECKSUM] > >- kdc_checksum = kdc_checksum_key.make_checksum( >+ kdc_checksum = kdc_checksum_key.make_rodc_checksum( > KU_NON_KERB_CKSUM_SALT, > server_checksum) > >-- >2.25.1 > > >From 9b99916c6097faceca75c8756cf07098a0bb4c2a Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 12:03:33 +1300 >Subject: [PATCH 310/380] tests/krb5: Allow excluding the PAC server checksum > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit dcf45a151a198f7165cd332a26db78a5d8e8f8c5) >--- > python/samba/tests/krb5/raw_testcase.py | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index aefbdd6d761..4c1aedbca0f 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -3342,7 +3342,10 @@ class RawKerberosTest(TestCaseInTempDir): > kdc_checksum_buffer = checksum_buffers.get( > krb5pac.PAC_TYPE_KDC_CHECKSUM) > if kdc_checksum_buffer is not None: >- self.assertIsNotNone(server_checksum_buffer) >+ if server_checksum_buffer is None: >+ # There's no server signature to make the checksum over, so >+ # just make the checksum over an empty bytes object. >+ server_checksum = bytes() > > kdc_checksum_key = checksum_keys[krb5pac.PAC_TYPE_KDC_CHECKSUM] > >-- >2.25.1 > > >From bfdf051ade5c89ef0c6ec037e1932af4401724aa Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 12:06:03 +1300 >Subject: [PATCH 311/380] tests/krb5: Fix handling authdata with missing PAC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit a4bc712ee02f32c2d04dfc2d99d58931344e5ceb) >--- > python/samba/tests/krb5/raw_testcase.py | 11 ++++++----- > 1 file changed, 6 insertions(+), 5 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 4c1aedbca0f..b9895e547c4 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -3200,11 +3200,11 @@ class RawKerberosTest(TestCaseInTempDir): > # Get a copy of the authdata with an empty PAC, and the > # existing PAC (if present). > empty_pac = self.get_empty_pac() >- empty_pac_auth_data, pac_data = self.replace_pac(auth_data, >- empty_pac) >+ empty_pac_auth_data, pac_data = self.replace_pac( >+ auth_data, >+ empty_pac, >+ expect_pac=expect_pac) > >- if expect_pac: >- self.assertIsNotNone(pac_data) > if pac_data is not None: > pac = ndr_unpack(krb5pac.PAC_DATA, pac_data) > >@@ -3234,7 +3234,8 @@ class RawKerberosTest(TestCaseInTempDir): > > # Replace the PAC in the authorization data and re-add it to the > # ticket enc-part. >- auth_data, _ = self.replace_pac(auth_data, new_pac) >+ auth_data, _ = self.replace_pac(auth_data, new_pac, >+ expect_pac=expect_pac) > enc_part['authorization-data'] = auth_data > > # Re-encrypt the ticket enc-part with the new key. >-- >2.25.1 > > >From 8b5d6631bc8f34218384ccb57a8badcff7c66641 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 12:16:58 +1300 >Subject: [PATCH 312/380] tests/krb5: Fix status code checking > >The type used to encode the status code is actually KERB-ERROR-DATA, >rather than PA-DATA. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 012b6fcd1976c6570e9b92c133d8c21e543e5a4f) >--- > python/samba/tests/krb5/raw_testcase.py | 89 +++++++++----------- > python/samba/tests/krb5/rfc4120_constants.py | 6 ++ > 2 files changed, 48 insertions(+), 47 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index b9895e547c4..db7db28cac5 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -49,6 +49,7 @@ from samba.tests.krb5.rfc4120_constants import ( > KDC_ERR_GENERIC, > KDC_ERR_PREAUTH_FAILED, > KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS, >+ KERB_ERR_TYPE_EXTENDED, > KRB_AP_REQ, > KRB_AS_REP, > KRB_AS_REQ, >@@ -85,7 +86,6 @@ from samba.tests.krb5.rfc4120_constants import ( > PADATA_PAC_REQUEST, > PADATA_PK_AS_REQ, > PADATA_PK_AS_REP_19, >- PADATA_PW_SALT, > PADATA_SUPPORTED_ETYPES > ) > import samba.tests.krb5.kcrypto as kcrypto >@@ -2497,34 +2497,51 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(edata) > if edata is not None: > if rep_msg_type == KRB_TGS_REP and not sent_fast: >- rep_padata = [self.der_decode(edata, >- asn1Spec=krb5_asn1.PA_DATA())] >+ error_data = self.der_decode( >+ edata, >+ asn1Spec=krb5_asn1.KERB_ERROR_DATA()) >+ self.assertEqual(KERB_ERR_TYPE_EXTENDED, >+ error_data['data-type']) >+ >+ extended_error = error_data['data-value'] >+ >+ self.assertEqual(12, len(extended_error)) >+ >+ status = int.from_bytes(extended_error[:4], 'little') >+ flags = int.from_bytes(extended_error[8:], 'little') >+ >+ expected_status = kdc_exchange_dict['expected_status'] >+ self.assertEqual(expected_status, status) >+ >+ self.assertEqual(3, flags) > else: >+ self.assertIsNone(kdc_exchange_dict['expected_status']) >+ > rep_padata = self.der_decode(edata, > asn1Spec=krb5_asn1.METHOD_DATA()) >- self.assertGreater(len(rep_padata), 0) >+ self.assertGreater(len(rep_padata), 0) > >- if sent_fast: >- self.assertEqual(1, len(rep_padata)) >- rep_pa_dict = self.get_pa_dict(rep_padata) >- self.assertIn(PADATA_FX_FAST, rep_pa_dict) >+ if sent_fast: >+ self.assertEqual(1, len(rep_padata)) >+ rep_pa_dict = self.get_pa_dict(rep_padata) >+ self.assertIn(PADATA_FX_FAST, rep_pa_dict) > >- armor_key = kdc_exchange_dict['armor_key'] >- self.assertIsNotNone(armor_key) >- fast_response = self.check_fx_fast_data( >- kdc_exchange_dict, >- rep_pa_dict[PADATA_FX_FAST], >- armor_key, >- expect_strengthen_key=False) >+ armor_key = kdc_exchange_dict['armor_key'] >+ self.assertIsNotNone(armor_key) >+ fast_response = self.check_fx_fast_data( >+ kdc_exchange_dict, >+ rep_pa_dict[PADATA_FX_FAST], >+ armor_key, >+ expect_strengthen_key=False) > >- rep_padata = fast_response['padata'] >+ rep_padata = fast_response['padata'] > >- etype_info2 = self.check_rep_padata(kdc_exchange_dict, >- callback_dict, >- rep_padata, >- error_code) >+ etype_info2 = self.check_rep_padata(kdc_exchange_dict, >+ callback_dict, >+ rep_padata, >+ error_code) > >- kdc_exchange_dict['preauth_etype_info2'] = etype_info2 >+ kdc_exchange_dict['preauth_etype_info2'] = etype_info2 > > return rep > >@@ -2576,13 +2593,10 @@ class RawKerberosTest(TestCaseInTempDir): > expected_patypes += (PADATA_FX_COOKIE,) > > if rep_msg_type == KRB_TGS_REP: >- if not sent_fast and error_code != 0: >- expected_patypes += (PADATA_PW_SALT,) >- else: >- sent_pac_options = self.get_sent_pac_options(kdc_exchange_dict) >- if ('1' in sent_pac_options >- and error_code not in (0, KDC_ERR_GENERIC)): >- expected_patypes += (PADATA_PAC_OPTIONS,) >+ sent_pac_options = self.get_sent_pac_options(kdc_exchange_dict) >+ if ('1' in sent_pac_options >+ and error_code not in (0, KDC_ERR_GENERIC)): >+ expected_patypes += (PADATA_PAC_OPTIONS,) > elif error_code != KDC_ERR_GENERIC: > if expect_etype_info: > self.assertGreater(len(expect_etype_info2), 0) >@@ -2621,7 +2635,6 @@ class RawKerberosTest(TestCaseInTempDir): > fast_error = None > fx_fast = None > pac_options = None >- pw_salt = None > for pa in rep_padata: > patype = self.getElementValue(pa, 'padata-type') > pavalue = self.getElementValue(pa, 'padata-value') >@@ -2675,11 +2688,6 @@ class RawKerberosTest(TestCaseInTempDir): > pavalue, > asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) > continue >- if patype == PADATA_PW_SALT: >- self.assertIsNone(pw_salt) >- pw_salt = pavalue >- self.assertIsNotNone(pw_salt) >- continue > > if fast_cookie is not None: > kdc_exchange_dict['fast_cookie'] = fast_cookie >@@ -2695,19 +2703,6 @@ class RawKerberosTest(TestCaseInTempDir): > if pac_options is not None: > self.assertElementEqual(pac_options, 'options', sent_pac_options) > >- if pw_salt is not None: >- self.assertEqual(12, len(pw_salt)) >- >- status = int.from_bytes(pw_salt[:4], 'little') >- flags = int.from_bytes(pw_salt[8:], 'little') >- >- expected_status = kdc_exchange_dict['expected_status'] >- self.assertEqual(expected_status, status) >- >- self.assertEqual(3, flags) >- else: >- self.assertIsNone(kdc_exchange_dict.get('expected_status')) >- > if enc_challenge is not None: > if not sent_enc_challenge: > self.assertEqual(len(enc_challenge), 0) >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index ac2bac4d91e..76f2b75d94e 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -78,6 +78,12 @@ KDC_ERR_SKEW = 37 > KDC_ERR_GENERIC = 60 > KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS = 93 > >+# Extended error types >+KERB_AP_ERR_TYPE_SKEW_RECOVERY = int( >+ krb5_asn1.KerbErrorDataTypeValues('kERB-AP-ERR-TYPE-SKEW-RECOVERY')) >+KERB_ERR_TYPE_EXTENDED = int( >+ krb5_asn1.KerbErrorDataTypeValues('kERB-ERR-TYPE-EXTENDED')) >+ > # Name types > NT_UNKNOWN = int(krb5_asn1.NameTypeValues('kRB5-NT-UNKNOWN')) > NT_PRINCIPAL = int(krb5_asn1.NameTypeValues('kRB5-NT-PRINCIPAL')) >-- >2.25.1 > > >From 09e5c925d6214b5190992b937bd44a02d25add47 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 13:01:30 +1300 >Subject: [PATCH 313/380] tests/krb5: Make expected_sname checking more > explicit > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >[abartlet@samba.org backported from commit 8f6d369d709614e2f5c0684882c62f0476bcafa2 > as Samba 4.14 as the test which crashes older MIT KDC versions is > omitted] >--- > python/samba/tests/krb5/fast_tests.py | 39 ++++++++++--------------- > python/samba/tests/krb5/raw_testcase.py | 6 +--- > 2 files changed, 17 insertions(+), 28 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 431b48f00d6..5180eb57563 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -99,11 +99,7 @@ class FAST_Tests(KDCBaseTest): > ]) > > def test_simple_no_sname(self): >- krbtgt_creds = self.get_krbtgt_creds() >- krbtgt_username = krbtgt_creds.get_username() >- krbtgt_realm = krbtgt_creds.get_realm() >- expected_sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, names=[krbtgt_username, krbtgt_realm]) >+ expected_sname = self.get_krbtgt_sname() > > self._run_test_sequence([ > { >@@ -116,11 +112,7 @@ class FAST_Tests(KDCBaseTest): > ]) > > def test_simple_tgs_no_sname(self): >- krbtgt_creds = self.get_krbtgt_creds() >- krbtgt_username = krbtgt_creds.get_username() >- krbtgt_realm = krbtgt_creds.get_realm() >- expected_sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, names=[krbtgt_username, krbtgt_realm]) >+ expected_sname = self.get_krbtgt_sname() > > self._run_test_sequence([ > { >@@ -134,11 +126,7 @@ class FAST_Tests(KDCBaseTest): > ]) > > def test_fast_no_sname(self): >- krbtgt_creds = self.get_krbtgt_creds() >- krbtgt_username = krbtgt_creds.get_username() >- krbtgt_realm = krbtgt_creds.get_realm() >- expected_sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, names=[krbtgt_username, krbtgt_realm]) >+ expected_sname = self.get_krbtgt_sname() > > self._run_test_sequence([ > { >@@ -153,11 +141,7 @@ class FAST_Tests(KDCBaseTest): > ]) > > def test_fast_tgs_no_sname(self): >- krbtgt_creds = self.get_krbtgt_creds() >- krbtgt_username = krbtgt_creds.get_username() >- krbtgt_realm = krbtgt_creds.get_realm() >- expected_sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, names=[krbtgt_username, krbtgt_realm]) >+ expected_sname = self.get_krbtgt_sname() > > self._run_test_sequence([ > { >@@ -830,6 +814,8 @@ class FAST_Tests(KDCBaseTest): > ]) > > def test_fast_ad_fx_fast_armor(self): >+ expected_sname = self.get_krbtgt_sname() >+ > # If the authenticator or TGT authentication data contains the > # AD-fx-fast-armor authdata type, the KDC must reject the request > # (RFC6113 5.4.1.1). >@@ -849,7 +835,8 @@ class FAST_Tests(KDCBaseTest): > 'use_fast': True, > 'gen_authdata_fn': self.generate_fast_armor_auth_data, > 'gen_tgt_fn': self.get_user_tgt, >- 'fast_armor': None >+ 'fast_armor': None, >+ 'expected_sname': expected_sname > } > ]) > >@@ -877,6 +864,8 @@ class FAST_Tests(KDCBaseTest): > ]) > > def test_fast_ad_fx_fast_armor_ticket(self): >+ expected_sname = self.get_krbtgt_sname() >+ > # If the authenticator or TGT authentication data contains the > # AD-fx-fast-armor authdata type, the KDC must reject the request > # (RFC6113 5.4.2). >@@ -896,7 +885,8 @@ class FAST_Tests(KDCBaseTest): > 'expected_error_mode': KDC_ERR_GENERIC, > 'use_fast': True, > 'gen_tgt_fn': self.gen_tgt_fast_armor_auth_data, >- 'fast_armor': None >+ 'fast_armor': None, >+ 'expected_sname': expected_sname > } > ]) > >@@ -956,6 +946,8 @@ class FAST_Tests(KDCBaseTest): > ]) > > def test_fast_tgs_no_subkey(self): >+ expected_sname = self.get_krbtgt_sname() >+ > # Show that omitting the subkey in the TGS-REQ authenticator fails > # (RFC6113 5.4.2). > self._run_test_sequence([ >@@ -965,7 +957,8 @@ class FAST_Tests(KDCBaseTest): > 'use_fast': True, > 'gen_tgt_fn': self.get_user_tgt, > 'fast_armor': None, >- 'include_subkey': False >+ 'include_subkey': False, >+ 'expected_sname': expected_sname > } > ]) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index db7db28cac5..f6aeb00dc8f 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2475,11 +2475,7 @@ class RawKerberosTest(TestCaseInTempDir): > else: > self.assertElementMissing(rep, 'cname') > self.assertElementEqualUTF8(rep, 'realm', expected_srealm) >- if sent_fast and error_code == KDC_ERR_GENERIC: >- self.assertElementEqualPrincipal(rep, 'sname', >- self.get_krbtgt_sname()) >- else: >- self.assertElementEqualPrincipal(rep, 'sname', expected_sname) >+ self.assertElementEqualPrincipal(rep, 'sname', expected_sname) > self.assertElementMissing(rep, 'e-text') > if (error_code == KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS > or (rep_msg_type == KRB_TGS_REP >-- >2.25.1 > > >From 3ca408608b07461c0fc7bca122a9986ace535824 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 13:03:49 +1300 >Subject: [PATCH 314/380] tests/krb5: Fix assertElementFlags() > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 788b3a29eea62f9f38ca8865c7cb7860bdc94bec) >--- > python/samba/tests/krb5/fast_tests.py | 4 ++-- > python/samba/tests/krb5/raw_testcase.py | 4 ++-- > 2 files changed, 4 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 5180eb57563..cf9b9d718bb 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -1305,10 +1305,10 @@ class FAST_Tests(KDCBaseTest): > > expected_flags = kdc_dict.pop('expected_flags', None) > if expected_flags is not None: >- expected_flags = krb5_asn1.KDCOptions(expected_flags) >+ expected_flags = krb5_asn1.TicketFlags(expected_flags) > unexpected_flags = kdc_dict.pop('unexpected_flags', None) > if unexpected_flags is not None: >- unexpected_flags = krb5_asn1.KDCOptions(unexpected_flags) >+ unexpected_flags = krb5_asn1.TicketFlags(unexpected_flags) > > if rep_type == KRB_AS_REP: > kdc_exchange_dict = self.as_exchange_dict( >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index f6aeb00dc8f..a24faf1d060 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1053,14 +1053,14 @@ class RawKerberosTest(TestCaseInTempDir): > v = self.getElementValue(obj, elem) > self.assertIsNotNone(v) > if expected is not None: >- self.assertIsInstance(expected, krb5_asn1.KDCOptions) >+ self.assertIsInstance(expected, krb5_asn1.TicketFlags) > for i, flag in enumerate(expected): > if flag == 1: > self.assertEqual('1', v[i], > f"'{expected.namedValues[i]}' " > f"expected in {v}") > if unexpected is not None: >- self.assertIsInstance(unexpected, krb5_asn1.KDCOptions) >+ self.assertIsInstance(unexpected, krb5_asn1.TicketFlags) > for i, flag in enumerate(unexpected): > if flag == 1: > self.assertEqual('0', v[i], >-- >2.25.1 > > >From f9d79e9555c29289ace80eb9281d1da788edbe53 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 14:02:37 +1300 >Subject: [PATCH 315/380] tests/krb5: Remove unneeded parameters from ticket > cache key > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 7fba83c6c6309a525742c38e904d3e473db99ef1) >--- > python/samba/tests/krb5/kdc_base_test.py | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 25433ba1069..7ddaa53b541 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1278,8 +1278,7 @@ class KDCBaseTest(RawKerberosTest): > expected_flags=None, unexpected_flags=None, > fresh=False): > user_name = creds.get_username() >- cache_key = (user_name, to_rodc, kdc_options, >- expected_flags, unexpected_flags) >+ cache_key = (user_name, to_rodc, kdc_options) > > if not fresh: > tgt = self.tkt_cache.get(cache_key) >-- >2.25.1 > > >From a26596301eee6e7e3179b23761ed4ca04c2806a0 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 15:48:58 +1300 >Subject: [PATCH 316/380] tests/krb5: Fix checking for presence of error data > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit ab92dc16d20b0996b8c46714652c15019c795095) >--- > python/samba/tests/krb5/fast_tests.py | 39 +++++++++++++++++------- > python/samba/tests/krb5/kdc_base_test.py | 4 ++- > python/samba/tests/krb5/kdc_tgs_tests.py | 3 +- > python/samba/tests/krb5/raw_testcase.py | 27 ++++++++-------- > 4 files changed, 48 insertions(+), 25 deletions(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index cf9b9d718bb..28fe0686335 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -107,7 +107,8 @@ class FAST_Tests(KDCBaseTest): > 'expected_error_mode': (KDC_ERR_GENERIC, KDC_ERR_S_PRINCIPAL_UNKNOWN), > 'use_fast': False, > 'sname': None, >- 'expected_sname': expected_sname >+ 'expected_sname': expected_sname, >+ 'expect_edata': False > } > ]) > >@@ -121,7 +122,8 @@ class FAST_Tests(KDCBaseTest): > 'use_fast': False, > 'gen_tgt_fn': self.get_user_tgt, > 'sname': None, >- 'expected_sname': expected_sname >+ 'expected_sname': expected_sname, >+ 'expect_edata': False > } > ]) > >@@ -172,6 +174,7 @@ class FAST_Tests(KDCBaseTest): > 'expected_error_mode': KDC_ERR_NOT_US, > 'use_fast': False, > 'gen_tgt_fn': self.get_user_service_ticket, >+ 'expect_edata': False > } > ]) > >@@ -182,6 +185,7 @@ class FAST_Tests(KDCBaseTest): > 'expected_error_mode': KDC_ERR_NOT_US, > 'use_fast': False, > 'gen_tgt_fn': self.get_mach_service_ticket, >+ 'expect_edata': False > } > ]) > >@@ -294,7 +298,8 @@ class FAST_Tests(KDCBaseTest): > 'expected_error_mode': KDC_ERR_ETYPE_NOSUPP, > 'use_fast': False, > 'gen_tgt_fn': self.get_mach_tgt, >- 'etypes': () >+ 'etypes': (), >+ 'expect_edata': False > } > ]) > >@@ -342,7 +347,8 @@ class FAST_Tests(KDCBaseTest): > 'use_fast': True, > 'gen_fast_fn': self.generate_empty_fast, > 'fast_armor': None, >- 'gen_armor_tgt_fn': self.get_mach_tgt >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'expect_edata': False > } > ]) > >@@ -365,7 +371,8 @@ class FAST_Tests(KDCBaseTest): > 'expected_error_mode': KDC_ERR_GENERIC, > 'use_fast': True, > 'fast_armor': None, # no armor, >- 'gen_armor_tgt_fn': self.get_mach_tgt >+ 'gen_armor_tgt_fn': self.get_mach_tgt, >+ 'expect_edata': False > } > ]) > >@@ -809,7 +816,8 @@ class FAST_Tests(KDCBaseTest): > # should be KRB_APP_ERR_MODIFIED > 'use_fast': False, > 'gen_authdata_fn': self.generate_fast_used_auth_data, >- 'gen_tgt_fn': self.get_user_tgt >+ 'gen_tgt_fn': self.get_user_tgt, >+ 'expect_edata': False > } > ]) > >@@ -836,7 +844,8 @@ class FAST_Tests(KDCBaseTest): > 'gen_authdata_fn': self.generate_fast_armor_auth_data, > 'gen_tgt_fn': self.get_user_tgt, > 'fast_armor': None, >- 'expected_sname': expected_sname >+ 'expected_sname': expected_sname, >+ 'expect_edata': False > } > ]) > >@@ -886,7 +895,8 @@ class FAST_Tests(KDCBaseTest): > 'use_fast': True, > 'gen_tgt_fn': self.gen_tgt_fast_armor_auth_data, > 'fast_armor': None, >- 'expected_sname': expected_sname >+ 'expected_sname': expected_sname, >+ 'expect_edata': False > } > ]) > >@@ -958,7 +968,8 @@ class FAST_Tests(KDCBaseTest): > 'gen_tgt_fn': self.get_user_tgt, > 'fast_armor': None, > 'include_subkey': False, >- 'expected_sname': expected_sname >+ 'expected_sname': expected_sname, >+ 'expect_edata': False > } > ]) > >@@ -1209,6 +1220,10 @@ class FAST_Tests(KDCBaseTest): > else: > tgt_cname = client_cname > >+ expect_edata = kdc_dict.pop('expect_edata', None) >+ if expect_edata is not None: >+ self.assertTrue(expected_error_mode) >+ > expected_cname = kdc_dict.pop('expected_cname', tgt_cname) > expected_anon = kdc_dict.pop('expected_anon', > False) >@@ -1343,7 +1358,8 @@ class FAST_Tests(KDCBaseTest): > inner_req=inner_req, > outer_req=outer_req, > pac_request=True, >- pac_options=pac_options) >+ pac_options=pac_options, >+ expect_edata=expect_edata) > else: # KRB_TGS_REP > kdc_exchange_dict = self.tgs_exchange_dict( > expected_crealm=expected_crealm, >@@ -1376,7 +1392,8 @@ class FAST_Tests(KDCBaseTest): > inner_req=inner_req, > outer_req=outer_req, > pac_request=None, >- pac_options=pac_options) >+ pac_options=pac_options, >+ expect_edata=expect_edata) > > repeat = kdc_dict.pop('repeat', 1) > for _ in range(repeat): >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 7ddaa53b541..d25fc0b42b2 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1162,7 +1162,8 @@ class KDCBaseTest(RawKerberosTest): > > def tgs_req(self, cname, sname, realm, ticket, key, etypes, > expected_error_mode=0, padata=None, kdc_options=0, >- to_rodc=False, service_creds=None, expect_pac=True): >+ to_rodc=False, service_creds=None, expect_pac=True, >+ expect_edata=None): > '''Send a TGS-REQ, returns the response and the decrypted and > decoded enc-part > ''' >@@ -1209,6 +1210,7 @@ class KDCBaseTest(RawKerberosTest): > tgt=tgt, > authenticator_subkey=subkey, > kdc_options=str(kdc_options), >+ expect_edata=expect_edata, > expect_pac=expect_pac, > to_rodc=to_rodc) > >diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py >index 0904233b01f..2b55ba8a376 100755 >--- a/python/samba/tests/krb5/kdc_tgs_tests.py >+++ b/python/samba/tests/krb5/kdc_tgs_tests.py >@@ -85,7 +85,8 @@ class KdcTgsTests(KDCBaseTest): > names=["host", samdb.host_dns_name()]) > > (rep, enc_part) = self.tgs_req(cname, sname, realm, ticket, key, etype, >- expected_error_mode=KDC_ERR_BADMATCH) >+ expected_error_mode=KDC_ERR_BADMATCH, >+ expect_edata=False) > > self.assertIsNone( > enc_part, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index a24faf1d060..1a3aedbd436 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1959,6 +1959,7 @@ class RawKerberosTest(TestCaseInTempDir): > outer_req=None, > pac_request=None, > pac_options=None, >+ expect_edata=None, > expect_pac=True, > to_rodc=False): > if expected_error_mode == 0: >@@ -2005,6 +2006,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'outer_req': outer_req, > 'pac_request': pac_request, > 'pac_options': pac_options, >+ 'expect_edata': expect_edata, > 'expect_pac': expect_pac, > 'to_rodc': to_rodc > } >@@ -2046,6 +2048,7 @@ class RawKerberosTest(TestCaseInTempDir): > outer_req=None, > pac_request=None, > pac_options=None, >+ expect_edata=None, > expect_pac=True, > to_rodc=False): > if expected_error_mode == 0: >@@ -2091,6 +2094,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'outer_req': outer_req, > 'pac_request': pac_request, > 'pac_options': pac_options, >+ 'expect_edata': expect_edata, > 'expect_pac': expect_pac, > 'to_rodc': to_rodc > } >@@ -2477,20 +2481,20 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementEqualUTF8(rep, 'realm', expected_srealm) > self.assertElementEqualPrincipal(rep, 'sname', expected_sname) > self.assertElementMissing(rep, 'e-text') >- if (error_code == KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS >- or (rep_msg_type == KRB_TGS_REP >- and not sent_fast) >- or (sent_fast and fast_armor_type is not None >- and fast_armor_type != FX_FAST_ARMOR_AP_REQUEST) >- or inner): >+ expected_status = kdc_exchange_dict['expected_status'] >+ expect_edata = kdc_exchange_dict['expect_edata'] >+ if expect_edata is None: >+ expect_edata = (error_code != KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS >+ and (not sent_fast or fast_armor_type is None >+ or fast_armor_type == FX_FAST_ARMOR_AP_REQUEST) >+ and not inner) >+ if not expect_edata: >+ self.assertIsNone(expected_status) > self.assertElementMissing(rep, 'e-data') > return rep > edata = self.getElementValue(rep, 'e-data') > if self.strict_checking: >- if error_code != KDC_ERR_GENERIC: >- # Predicting whether an ERR_GENERIC error contains e-data is >- # more complicated. >- self.assertIsNotNone(edata) >+ self.assertIsNotNone(edata) > if edata is not None: > if rep_msg_type == KRB_TGS_REP and not sent_fast: > error_data = self.der_decode( >@@ -2506,12 +2510,11 @@ class RawKerberosTest(TestCaseInTempDir): > status = int.from_bytes(extended_error[:4], 'little') > flags = int.from_bytes(extended_error[8:], 'little') > >- expected_status = kdc_exchange_dict['expected_status'] > self.assertEqual(expected_status, status) > > self.assertEqual(3, flags) > else: >- self.assertIsNone(kdc_exchange_dict['expected_status']) >+ self.assertIsNone(expected_status) > > rep_padata = self.der_decode(edata, > asn1Spec=krb5_asn1.METHOD_DATA()) >-- >2.25.1 > > >From 7bc8fa26127f8841772104d717d7736288c0e9f1 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 16:10:07 +1300 >Subject: [PATCH 317/380] tests/krb5: Add expect_claims parameter to > kdc_exchange_dict > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 7cfc225b549108739bd86e222f2f35eb96af4ea3) >--- > python/samba/tests/krb5/raw_testcase.py | 4 ++++ > 1 file changed, 4 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 1a3aedbd436..0415f1ff6e6 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1961,6 +1961,7 @@ class RawKerberosTest(TestCaseInTempDir): > pac_options=None, > expect_edata=None, > expect_pac=True, >+ expect_claims=True, > to_rodc=False): > if expected_error_mode == 0: > expected_error_mode = () >@@ -2008,6 +2009,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'pac_options': pac_options, > 'expect_edata': expect_edata, > 'expect_pac': expect_pac, >+ 'expect_claims': expect_claims, > 'to_rodc': to_rodc > } > if callback_dict is None: >@@ -2050,6 +2052,7 @@ class RawKerberosTest(TestCaseInTempDir): > pac_options=None, > expect_edata=None, > expect_pac=True, >+ expect_claims=True, > to_rodc=False): > if expected_error_mode == 0: > expected_error_mode = () >@@ -2096,6 +2099,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'pac_options': pac_options, > 'expect_edata': expect_edata, > 'expect_pac': expect_pac, >+ 'expect_claims': expect_claims, > 'to_rodc': to_rodc > } > if callback_dict is None: >-- >2.25.1 > > >From 64d6ff76c128ffb5a91e8afe44b8ddee232dcfc7 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 16:15:26 +1300 >Subject: [PATCH 318/380] tests/krb5: Check buffer types in PAC with > STRICT_CHECKING=1 > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit aa2e583fdea4fd93e4e71c54630e32a1035d1e2a) >--- > librpc/idl/krb5pac.idl | 3 ++ > python/samba/tests/krb5/raw_testcase.py | 52 +++++++++++++++++++++++++ > 2 files changed, 55 insertions(+) > >diff --git a/librpc/idl/krb5pac.idl b/librpc/idl/krb5pac.idl >index 3239d7656b6..515150ab9cd 100644 >--- a/librpc/idl/krb5pac.idl >+++ b/librpc/idl/krb5pac.idl >@@ -113,6 +113,9 @@ interface krb5pac > PAC_TYPE_LOGON_NAME = 10, > PAC_TYPE_CONSTRAINED_DELEGATION = 11, > PAC_TYPE_UPN_DNS_INFO = 12, >+ PAC_TYPE_CLIENT_CLAIMS_INFO = 13, >+ PAC_TYPE_DEVICE_INFO = 14, >+ PAC_TYPE_DEVICE_CLAIMS_INFO = 15, > PAC_TYPE_TICKET_CHECKSUM = 16 > } PAC_TYPE; > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 0415f1ff6e6..320de0a4dbe 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2340,6 +2340,13 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementPresent(ticket_private, 'authorization-data', > expect_empty=not expect_pac) > >+ if expect_pac: >+ authorization_data = self.getElementValue(ticket_private, >+ 'authorization-data') >+ pac_data = self.get_pac(authorization_data) >+ >+ self.check_pac_buffers(pac_data, kdc_exchange_dict) >+ > encpart_session_key = None > if encpart_private is not None: > self.assertElementPresent(encpart_private, 'key') >@@ -2446,6 +2453,47 @@ class RawKerberosTest(TestCaseInTempDir): > > kdc_exchange_dict['rep_ticket_creds'] = ticket_creds > >+ def check_pac_buffers(self, pac_data, kdc_exchange_dict): >+ pac = ndr_unpack(krb5pac.PAC_DATA, pac_data) >+ >+ rep_msg_type = kdc_exchange_dict['rep_msg_type'] >+ armor_tgt = kdc_exchange_dict['armor_tgt'] >+ >+ expected_sname = kdc_exchange_dict['expected_sname'] >+ expect_claims = kdc_exchange_dict['expect_claims'] >+ >+ expected_types = [krb5pac.PAC_TYPE_LOGON_INFO, >+ krb5pac.PAC_TYPE_SRV_CHECKSUM, >+ krb5pac.PAC_TYPE_KDC_CHECKSUM, >+ krb5pac.PAC_TYPE_LOGON_NAME, >+ krb5pac.PAC_TYPE_UPN_DNS_INFO] >+ >+ kdc_options = kdc_exchange_dict['kdc_options'] >+ pos = len(tuple(krb5_asn1.KDCOptions('cname-in-addl-tkt'))) - 1 >+ constrained_delegation = (pos < len(kdc_options) >+ and kdc_options[pos] == '1') >+ if constrained_delegation: >+ expected_types.append(krb5pac.PAC_TYPE_CONSTRAINED_DELEGATION) >+ >+ if self.kdc_fast_support: >+ if expect_claims: >+ expected_types.append(krb5pac.PAC_TYPE_CLIENT_CLAIMS_INFO) >+ >+ if (rep_msg_type == KRB_TGS_REP >+ and armor_tgt is not None): >+ expected_types.append(krb5pac.PAC_TYPE_DEVICE_INFO) >+ expected_types.append(krb5pac.PAC_TYPE_DEVICE_CLAIMS_INFO) >+ >+ if not self.is_tgs(expected_sname): >+ expected_types.append(krb5pac.PAC_TYPE_TICKET_CHECKSUM) >+ >+ if self.strict_checking: >+ buffer_types = [pac_buffer.type >+ for pac_buffer in pac.buffers] >+ self.assertCountEqual(expected_types, buffer_types, >+ f'expected: {expected_types} ' >+ f'got: {buffer_types}') >+ > def generic_check_kdc_error(self, > kdc_exchange_dict, > callback_dict, >@@ -3397,6 +3445,10 @@ class RawKerberosTest(TestCaseInTempDir): > > return new_auth_data, old_pac > >+ def get_pac(self, auth_data, expect_pac=True): >+ _, pac = self.replace_pac(auth_data, None, expect_pac) >+ return pac >+ > def get_krbtgt_checksum_key(self): > krbtgt_creds = self.get_krbtgt_creds() > krbtgt_key = self.TicketDecryptionKey_from_creds(krbtgt_creds) >-- >2.25.1 > > >From 401b89fa2bc7a94d631c715bdff1329bdd46171e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 16:26:54 +1300 >Subject: [PATCH 319/380] tests/krb5: Check constrained delegation PAC buffer > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 0e232fa1c9e5760ae6b9a99b5e7aa5513b84aa8b) >--- > python/samba/tests/krb5/raw_testcase.py | 21 +++++++++++++++++++++ > 1 file changed, 21 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 320de0a4dbe..8144bd37b2f 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2053,6 +2053,8 @@ class RawKerberosTest(TestCaseInTempDir): > expect_edata=None, > expect_pac=True, > expect_claims=True, >+ expected_proxy_target=None, >+ expected_transited_services=None, > to_rodc=False): > if expected_error_mode == 0: > expected_error_mode = () >@@ -2100,6 +2102,8 @@ class RawKerberosTest(TestCaseInTempDir): > 'expect_edata': expect_edata, > 'expect_pac': expect_pac, > 'expect_claims': expect_claims, >+ 'expected_proxy_target': expected_proxy_target, >+ 'expected_transited_services': expected_transited_services, > 'to_rodc': to_rodc > } > if callback_dict is None: >@@ -2494,6 +2498,23 @@ class RawKerberosTest(TestCaseInTempDir): > f'expected: {expected_types} ' > f'got: {buffer_types}') > >+ for pac_buffer in pac.buffers: >+ if pac_buffer.type == krb5pac.PAC_TYPE_CONSTRAINED_DELEGATION: >+ expected_proxy_target = kdc_exchange_dict[ >+ 'expected_proxy_target'] >+ expected_transited_services = kdc_exchange_dict[ >+ 'expected_transited_services'] >+ >+ delegation_info = pac_buffer.info.info >+ >+ self.assertEqual(expected_proxy_target, >+ str(delegation_info.proxy_target)) >+ >+ transited_services = list(map( >+ str, delegation_info.transited_services)) >+ self.assertEqual(expected_transited_services, >+ transited_services) >+ > def generic_check_kdc_error(self, > kdc_exchange_dict, > callback_dict, >-- >2.25.1 > > >From 381a853d576090d6a6290b7a8f07bb6d841eb5bc Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 16:41:23 +1300 >Subject: [PATCH 320/380] tests/krb5: Save account SPN > >This is useful for testing delegation. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit bb58b4b58c66a6ada79e886dd0c44401e1c5878c) >--- > python/samba/tests/krb5/kdc_base_test.py | 1 + > python/samba/tests/krb5/raw_testcase.py | 7 +++++++ > 2 files changed, 8 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index d25fc0b42b2..70ab14786da 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -285,6 +285,7 @@ class KDCBaseTest(RawKerberosTest): > else: > creds.set_workstation('') > creds.set_dn(ldb.Dn(samdb, dn)) >+ creds.set_spn(spn) > # > # Save the account name so it can be deleted in tearDownClass > self.accounts.add(dn) >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 8144bd37b2f..c34ffb848e1 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -365,6 +365,7 @@ class KerberosCredentials(Credentials): > self.forced_salt = None > > self.dn = None >+ self.spn = None > > def set_as_supported_enctypes(self, value): > self.as_supported_enctypes = int(value) >@@ -467,6 +468,12 @@ class KerberosCredentials(Credentials): > def get_dn(self): > return self.dn > >+ def set_spn(self, spn): >+ self.spn = spn >+ >+ def get_spn(self): >+ return self.spn >+ > > class KerberosTicketCreds: > def __init__(self, ticket, session_key, >-- >2.25.1 > > >From e4b485b7456f322b06c2d22abb631a9f4aa38112 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 16:48:50 +1300 >Subject: [PATCH 321/380] tests/krb5: Allow specifying options and expected > flags when obtaining a ticket > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 34020766bb7094d1ab5d4fc4c0ee89ccb81f39f1) >--- > python/samba/tests/krb5/kdc_base_test.py | 31 +++++++++++++++++------- > 1 file changed, 22 insertions(+), 9 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 70ab14786da..34a23b3b876 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1164,7 +1164,7 @@ class KDCBaseTest(RawKerberosTest): > def tgs_req(self, cname, sname, realm, ticket, key, etypes, > expected_error_mode=0, padata=None, kdc_options=0, > to_rodc=False, service_creds=None, expect_pac=True, >- expect_edata=None): >+ expect_edata=None, expected_flags=None, unexpected_flags=None): > '''Send a TGS-REQ, returns the response and the decrypted and > decoded enc-part > ''' >@@ -1203,6 +1203,8 @@ class KDCBaseTest(RawKerberosTest): > expected_srealm=realm, > expected_sname=sname, > expected_error_mode=expected_error_mode, >+ expected_flags=expected_flags, >+ unexpected_flags=unexpected_flags, > check_error_fn=check_error_fn, > check_rep_fn=check_rep_fn, > check_kdc_private_fn=self.generic_check_kdc_private, >@@ -1230,10 +1232,12 @@ class KDCBaseTest(RawKerberosTest): > return rep, enc_part > > def get_service_ticket(self, tgt, target_creds, service='host', >- to_rodc=False, fresh=False): >+ to_rodc=False, kdc_options=None, >+ expected_flags=None, unexpected_flags=None, >+ fresh=False): > user_name = tgt.cname['name-string'][0] > target_name = target_creds.get_username() >- cache_key = (user_name, target_name, service, to_rodc) >+ cache_key = (user_name, target_name, service, to_rodc, kdc_options) > > if not fresh: > ticket = self.tkt_cache.get(cache_key) >@@ -1243,6 +1247,10 @@ class KDCBaseTest(RawKerberosTest): > > etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) > >+ if kdc_options is None: >+ kdc_options = '0' >+ kdc_options = krb5_asn1.KDCOptions(kdc_options) >+ > key = tgt.session_key > ticket = tgt.ticket > >@@ -1255,7 +1263,10 @@ class KDCBaseTest(RawKerberosTest): > > rep, enc_part = self.tgs_req(cname, sname, realm, ticket, key, etype, > to_rodc=to_rodc, >- service_creds=target_creds) >+ service_creds=target_creds, >+ kdc_options=kdc_options, >+ expected_flags=expected_flags, >+ unexpected_flags=unexpected_flags) > > service_ticket = rep['ticket'] > >@@ -1309,11 +1320,11 @@ class KDCBaseTest(RawKerberosTest): > self.TicketDecryptionKey_from_creds(krbtgt_creds)) > > if kdc_options is None: >- kdc_options = krb5_asn1.KDCOptions('forwardable,' >- 'renewable,' >- 'canonicalize,' >- 'renewable-ok') >- kdc_options = str(kdc_options) >+ kdc_options = ('forwardable,' >+ 'renewable,' >+ 'canonicalize,' >+ 'renewable-ok') >+ kdc_options = krb5_asn1.KDCOptions(kdc_options) > > pac_options = '1' # supports claims > >@@ -1370,6 +1381,8 @@ class KDCBaseTest(RawKerberosTest): > expected_srealm=expected_realm, > expected_sname=expected_sname, > expected_salt=salt, >+ expected_flags=expected_flags, >+ unexpected_flags=unexpected_flags, > expected_supported_etypes=expected_etypes, > etypes=etype, > padata=padata, >-- >2.25.1 > > >From 8e4409ea3493c850543364aabd3a69f2e3a03a01 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 16:52:01 +1300 >Subject: [PATCH 322/380] tests/krb5: Supply supported account enctypes in > tgs_req() > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 248249dc0acac89d1495c3572cbd2cbe8bdca362) >--- > python/samba/tests/krb5/kdc_base_test.py | 3 +++ > 1 file changed, 3 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 34a23b3b876..93951586cc7 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1181,8 +1181,10 @@ class KDCBaseTest(RawKerberosTest): > if service_creds is not None: > decryption_key = self.TicketDecryptionKey_from_creds( > service_creds) >+ expected_supported_etypes = service_creds.tgs_supported_enctypes > else: > decryption_key = None >+ expected_supported_etypes = None > > if not expected_error_mode: > check_error_fn = None >@@ -1205,6 +1207,7 @@ class KDCBaseTest(RawKerberosTest): > expected_error_mode=expected_error_mode, > expected_flags=expected_flags, > unexpected_flags=unexpected_flags, >+ expected_supported_etypes=expected_supported_etypes, > check_error_fn=check_error_fn, > check_rep_fn=check_rep_fn, > check_kdc_private_fn=self.generic_check_kdc_private, >-- >2.25.1 > > >From b990ae1586a2f859a3cb51e6001f01df841e8239 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 30 Sep 2021 16:53:35 +1300 >Subject: [PATCH 323/380] tests/krb5: Add parameter to enforce presence of > ticket checksums > >This allows existing tests to pass before this functionality is >implemented. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit ef24fe982d750a42be81808379b0254d8488c559) >--- > python/samba/tests/krb5/raw_testcase.py | 20 +++++++++++++++++--- > 1 file changed, 17 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index c34ffb848e1..72a39b23b0e 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1942,6 +1942,7 @@ class RawKerberosTest(TestCaseInTempDir): > expected_flags=None, > unexpected_flags=None, > ticket_decryption_key=None, >+ expect_ticket_checksum=None, > generate_fast_fn=None, > generate_fast_armor_fn=None, > generate_fast_padata_fn=None, >@@ -1990,6 +1991,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'expected_flags': expected_flags, > 'unexpected_flags': unexpected_flags, > 'ticket_decryption_key': ticket_decryption_key, >+ 'expect_ticket_checksum': expect_ticket_checksum, > 'generate_fast_fn': generate_fast_fn, > 'generate_fast_armor_fn': generate_fast_armor_fn, > 'generate_fast_padata_fn': generate_fast_padata_fn, >@@ -2034,6 +2036,7 @@ class RawKerberosTest(TestCaseInTempDir): > expected_flags=None, > unexpected_flags=None, > ticket_decryption_key=None, >+ expect_ticket_checksum=None, > generate_fast_fn=None, > generate_fast_armor_fn=None, > generate_fast_padata_fn=None, >@@ -2083,6 +2086,7 @@ class RawKerberosTest(TestCaseInTempDir): > 'expected_flags': expected_flags, > 'unexpected_flags': unexpected_flags, > 'ticket_decryption_key': ticket_decryption_key, >+ 'expect_ticket_checksum': expect_ticket_checksum, > 'generate_fast_fn': generate_fast_fn, > 'generate_fast_armor_fn': generate_fast_armor_fn, > 'generate_fast_padata_fn': generate_fast_padata_fn, >@@ -2459,8 +2463,15 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_private=ticket_private, > encpart_private=encpart_private) > >+ # TODO: This parameter should be removed when all service tickets are >+ # issued with ticket checksums. >+ expect_ticket_checksum = kdc_exchange_dict['expect_ticket_checksum'] >+ if expect_ticket_checksum: >+ self.assertIsNotNone(ticket_decryption_key) >+ > if ticket_decryption_key is not None: >- self.verify_ticket(ticket_creds, krbtgt_key, expect_pac=expect_pac) >+ self.verify_ticket(ticket_creds, krbtgt_key, expect_pac=expect_pac, >+ expect_ticket_checksum=expect_ticket_checksum) > > kdc_exchange_dict['rep_ticket_creds'] = ticket_creds > >@@ -3083,7 +3094,8 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_blob) > self.assertEqual(expected_checksum, checksum) > >- def verify_ticket(self, ticket, krbtgt_key, expect_pac=True): >+ def verify_ticket(self, ticket, krbtgt_key, expect_pac=True, >+ expect_ticket_checksum=True): > # Check if the ticket is a TGT. > sname = ticket.ticket['sname'] > is_tgt = self.is_tgs(sname) >@@ -3182,8 +3194,10 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_checksum, ticket_ctype = checksums.get( > krb5pac.PAC_TYPE_TICKET_CHECKSUM, > (None, None)) >- if self.strict_checking: >+ if expect_ticket_checksum: > self.assertIsNotNone(ticket_checksum) >+ elif expect_ticket_checksum is False: >+ self.assertIsNone(ticket_checksum) > if ticket_checksum is not None: > enc_part['authorization-data'] = auth_data > enc_part = self.der_encode(enc_part, >-- >2.25.1 > > >From cad310b84a239be99ff272db0ade0b6942c56ae5 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 14 Oct 2021 16:43:05 +1300 >Subject: [PATCH 324/380] tests/krb5: Add compatability tests for ticket > checksums > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >[abartlet@samba.org: Backported from ec4b264bdf9ab64a728212580b344fbf35c3c673 > to Samba 4.14 due to conflicts in > knownfail as the test which crashes older MIT KDC versions is > omitted] >--- > .../samba/tests/krb5/compatability_tests.py | 44 ++++++++++++++++++- > selftest/knownfail_heimdal_kdc | 6 ++- > source4/selftest/tests.py | 7 ++- > 3 files changed, 53 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/compatability_tests.py b/python/samba/tests/krb5/compatability_tests.py >index cd67549212a..0da72796894 100755 >--- a/python/samba/tests/krb5/compatability_tests.py >+++ b/python/samba/tests/krb5/compatability_tests.py >@@ -23,7 +23,7 @@ import os > sys.path.insert(0, "bin/python") > os.environ["PYTHONUNBUFFERED"] = "1" > >-from samba.tests.krb5.raw_testcase import RawKerberosTest >+from samba.tests.krb5.kdc_base_test import KDCBaseTest > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > from samba.tests.krb5.rfc4120_constants import ( > AES128_CTS_HMAC_SHA1_96, >@@ -50,7 +50,7 @@ MIT_ENC_AS_REP_PART_TYPE_TAG = 0x7A > ENC_PA_REP_FLAG = 0x00010000 > > >-class SimpleKerberosTests(RawKerberosTest): >+class SimpleKerberosTests(KDCBaseTest): > > def setUp(self): > super(SimpleKerberosTests, self).setUp() >@@ -120,6 +120,46 @@ class SimpleKerberosTests(RawKerberosTest): > self.fail( > "(Heimdal) Salt populated for ARCFOUR_HMAC_MD5 encryption") > >+ def test_heimdal_ticket_signature(self): >+ # Ensure that a DC correctly issues tickets signed with its krbtgt key. >+ user_creds = self.get_client_creds() >+ target_creds = self.get_service_creds() >+ >+ krbtgt_creds = self.get_krbtgt_creds() >+ key = self.TicketDecryptionKey_from_creds(krbtgt_creds) >+ >+ # Get a TGT from the DC. >+ tgt = self.get_tgt(user_creds) >+ >+ # Ensure the PAC contains the expected checksums. >+ self.verify_ticket(tgt, key) >+ >+ # Get a service ticket from the DC. >+ service_ticket = self.get_service_ticket(tgt, target_creds) >+ >+ # Ensure the PAC contains the expected checksums. >+ self.verify_ticket(service_ticket, key, expect_ticket_checksum=True) >+ >+ def test_mit_ticket_signature(self): >+ # Ensure that a DC does not issue tickets signed with its krbtgt key. >+ user_creds = self.get_client_creds() >+ target_creds = self.get_service_creds() >+ >+ krbtgt_creds = self.get_krbtgt_creds() >+ key = self.TicketDecryptionKey_from_creds(krbtgt_creds) >+ >+ # Get a TGT from the DC. >+ tgt = self.get_tgt(user_creds) >+ >+ # Ensure the PAC contains the expected checksums. >+ self.verify_ticket(tgt, key) >+ >+ # Get a service ticket from the DC. >+ service_ticket = self.get_service_ticket(tgt, target_creds) >+ >+ # Ensure the PAC does not contain the expected checksums. >+ self.verify_ticket(service_ticket, key, expect_ticket_checksum=False) >+ > def as_pre_auth_req(self, creds, etypes): > user = creds.get_username() > realm = creds.get_realm() >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 80b8224f015..6eb667f8969 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -1,7 +1,7 @@ > # > # We expect all the MIT specific compatability tests to fail on heimdal > # kerberos >-^samba.tests.krb5.compatability_tests.samba.tests.krb5.compatability_tests.SimpleKerberosTests.test_mit_ >+^samba.tests.krb5.compatability_tests.samba.tests.krb5.compatability_tests.SimpleKerberosTests.test_mit_(?!ticket_signature) > # > # Heimdal currently fails the following MS-KILE client principal lookup > # tests >@@ -121,3 +121,7 @@ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_sname.ad_dc >+# >+# Heimdal currently does not generate ticket signatures >+# >+^samba.tests.krb5.compatability_tests.samba.tests.krb5.compatability_tests.SimpleKerberosTests.test_heimdal_ticket_signature >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 86d018a0919..67024b4b200 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -1321,7 +1321,12 @@ planpythontestsuite("ad_dc", "samba.tests.krb5.as_canonicalization_tests", > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD' > }) >-planpythontestsuite("ad_dc", "samba.tests.krb5.compatability_tests") >+planpythontestsuite("ad_dc", "samba.tests.krb5.compatability_tests", >+ environ={ >+ 'ADMIN_USERNAME': '$USERNAME', >+ 'ADMIN_PASSWORD': '$PASSWORD', >+ 'STRICT_CHECKING': '0', >+ }) > planpythontestsuite("ad_dc", "samba.tests.krb5.kdc_tests") > planpythontestsuite( > "ad_dc", >-- >2.25.1 > > >From bdb618e8f2ff915dcaf0566490c47aa9ce954b0f Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 11 Oct 2021 14:37:03 +1300 >Subject: [PATCH 325/380] tests/krb5: Use correct principal name type > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 687c8f94c68af9f1e44771dfd7219eeb41382bba) >--- > python/samba/tests/krb5/fast_tests.py | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py >index 28fe0686335..1cdfd5e20c4 100755 >--- a/python/samba/tests/krb5/fast_tests.py >+++ b/python/samba/tests/krb5/fast_tests.py >@@ -43,6 +43,7 @@ from samba.tests.krb5.rfc4120_constants import ( > KRB_AS_REP, > KRB_TGS_REP, > NT_PRINCIPAL, >+ NT_SRV_HST, > NT_SRV_INST, > PADATA_FX_COOKIE, > PADATA_FX_FAST, >@@ -1136,7 +1137,7 @@ class FAST_Tests(KDCBaseTest): > target_realm = target_creds.get_realm() > target_service = 'host' > target_sname = self.PrincipalName_create( >- name_type=NT_SRV_INST, names=[target_service, target_username]) >+ name_type=NT_SRV_HST, names=[target_service, target_username]) > target_decryption_key = self.TicketDecryptionKey_from_creds( > target_creds) > target_etypes = target_creds.tgs_supported_enctypes >-- >2.25.1 > > >From b0ece29d1d1a0b228fafca15845a8e40afbb8342 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 11 Oct 2021 14:39:26 +1300 >Subject: [PATCH 326/380] tests/krb5: Clarify checksum type assertion message > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit ee2b7e2c77f021984ec583fa0c4c756979197b0f) >--- > python/samba/tests/krb5/raw_testcase.py | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 72a39b23b0e..e52eb5ae5b9 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -248,7 +248,8 @@ class Krb5EncryptionKey: > > def verify_checksum(self, usage, plaintext, ctype, cksum): > if self.ctype != ctype: >- raise AssertionError(f'{self.ctype} != {ctype}') >+ raise AssertionError(f'key checksum type ({self.ctype}) != ' >+ f'checksum type ({ctype})') > > kcrypto.verify_checksum(ctype, > self.key, >-- >2.25.1 > > >From 747da63b759c286b76c66fe958dad5c1c90936be Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 11 Oct 2021 16:15:43 +1300 >Subject: [PATCH 327/380] tests/krb5: Fix padata checking at functional level > 2003 > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 72265227e9c2037b63cdfb01a456a86ac8932f59) >--- > python/samba/tests/krb5/raw_testcase.py | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index e52eb5ae5b9..bb9d414da5b 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2661,11 +2661,10 @@ class RawKerberosTest(TestCaseInTempDir): > if kcrypto.Enctype.RC4 in proposed_etypes: > expect_etype_info = True > for etype in proposed_etypes: >- if etype in (kcrypto.Enctype.AES256, kcrypto.Enctype.AES128): >- expect_etype_info = False > if etype not in client_as_etypes: > continue > if etype in (kcrypto.Enctype.AES256, kcrypto.Enctype.AES128): >+ expect_etype_info = False > if etype > expected_aes_type: > expected_aes_type = etype > if etype in (kcrypto.Enctype.RC4,) and error_code != 0: >@@ -2865,7 +2864,8 @@ class RawKerberosTest(TestCaseInTempDir): > else: > self.assertIsNone(etype_info2) > if expect_etype_info: >- self.assertIsNotNone(etype_info) >+ if self.strict_checking: >+ self.assertIsNotNone(etype_info) > else: > if self.strict_checking: > self.assertIsNone(etype_info) >-- >2.25.1 > > >From 1927a89df74056fe74f437b9a9487ad7a6a8ed9c Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 12 Oct 2021 11:34:59 +1300 >Subject: [PATCH 328/380] tests/krb5: Add environment variable to specify KDC > FAST support > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >[abartlet@samba.org backportd from commit 238f52bad811688624e9fd4b1595266e2149094a > because tests.py changed in more recent releases with new tests nearby] >--- > python/samba/tests/krb5/raw_testcase.py | 6 +++- > source4/selftest/tests.py | 37 +++++++++++++++++-------- > 2 files changed, 31 insertions(+), 12 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index bb9d414da5b..fbddb7f83b1 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -568,7 +568,11 @@ class RawKerberosTest(TestCaseInTempDir): > # obtained. > cls.creds_dict = {} > >- cls.kdc_fast_support = False >+ kdc_fast_support = samba.tests.env_get_var_value('FAST_SUPPORT', >+ allow_missing=True) >+ if kdc_fast_support is None: >+ kdc_fast_support = '0' >+ cls.kdc_fast_support = bool(int(kdc_fast_support)) > > def setUp(self): > super().setUp() >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 67024b4b200..bdcbfcb4ab6 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -742,39 +742,47 @@ planoldpythontestsuite("nt4_dc", "samba.tests.netbios", extra_args=['-U"$USERNAM > planoldpythontestsuite("ad_dc:local", "samba.tests.gpo", extra_args=['-U"$USERNAME%$PASSWORD"']) > planoldpythontestsuite("ad_dc:local", "samba.tests.dckeytab", extra_args=['-U"$USERNAME%$PASSWORD"']) > >+have_fast_support = int('SAMBA_USES_MITKDC' in config_hash) > planoldpythontestsuite("none", "samba.tests.krb5.kcrypto") > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.simple_tests", >- environ={'SERVICE_USERNAME':'$SERVER'}) >+ environ={'SERVICE_USERNAME':'$SERVER', >+ 'FAST_SUPPORT': have_fast_support}) > planoldpythontestsuite("ad_dc_default:local", "samba.tests.krb5.s4u_tests", > environ={'SERVICE_USERNAME':'srv_account', > 'SERVICE_PASSWORD':'$PASSWORD', >- 'FOR_USER':'$USERNAME'}) >+ 'FOR_USER':'$USERNAME', >+ 'FAST_SUPPORT': have_fast_support}) > >-planoldpythontestsuite("fl2008r2dc:local", "samba.tests.krb5.xrealm_tests") >+planoldpythontestsuite("fl2008r2dc:local", "samba.tests.krb5.xrealm_tests", >+ environ={'FAST_SUPPORT': have_fast_support}) > > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ccache", > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', >- 'STRICT_CHECKING': '0' >+ 'STRICT_CHECKING': '0', >+ 'FAST_SUPPORT': have_fast_support > }) > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ldap", > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', >- 'STRICT_CHECKING': '0' >+ 'STRICT_CHECKING': '0', >+ 'FAST_SUPPORT': have_fast_support > }) > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_rpc", > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', >- 'STRICT_CHECKING': '0' >+ 'STRICT_CHECKING': '0', >+ 'FAST_SUPPORT': have_fast_support > }) > planoldpythontestsuite("ad_dc_smb1", "samba.tests.krb5.test_smb", > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', >- 'STRICT_CHECKING': '0' >+ 'STRICT_CHECKING': '0', >+ 'FAST_SUPPORT': have_fast_support > }) > > for env in ["ad_dc", smbv1_disabled_testenv]: >@@ -1299,6 +1307,7 @@ for env in ["fl2008r2dc", "fl2003dc"]: > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', >+ 'FAST_SUPPORT': have_fast_support > }) > > >@@ -1319,22 +1328,26 @@ for env in ["rodc", "promoted_dc", "fl2000dc", "fl2008r2dc"]: > planpythontestsuite("ad_dc", "samba.tests.krb5.as_canonicalization_tests", > environ={ > 'ADMIN_USERNAME': '$USERNAME', >- 'ADMIN_PASSWORD': '$PASSWORD' >+ 'ADMIN_PASSWORD': '$PASSWORD', >+ 'FAST_SUPPORT': have_fast_support > }) > planpythontestsuite("ad_dc", "samba.tests.krb5.compatability_tests", > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', >+ 'FAST_SUPPORT': have_fast_support, > }) >-planpythontestsuite("ad_dc", "samba.tests.krb5.kdc_tests") >+planpythontestsuite("ad_dc", "samba.tests.krb5.kdc_tests", >+ environ={'FAST_SUPPORT': have_fast_support}) > planpythontestsuite( > "ad_dc", > "samba.tests.krb5.kdc_tgs_tests", > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', >- 'STRICT_CHECKING': '0' >+ 'STRICT_CHECKING': '0', >+ 'FAST_SUPPORT': have_fast_support > }) > planpythontestsuite( > "ad_dc", >@@ -1343,6 +1356,7 @@ planpythontestsuite( > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', >+ 'FAST_SUPPORT': have_fast_support > }) > planpythontestsuite( > "ad_dc", >@@ -1350,7 +1364,8 @@ planpythontestsuite( > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', >- 'STRICT_CHECKING': '0' >+ 'STRICT_CHECKING': '0', >+ 'FAST_SUPPORT': have_fast_support > }) > > for env in [ >-- >2.25.1 > > >From d914cbee749048c5a9d08eab320c1fc038c01c97 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 11 Oct 2021 14:45:45 +1300 >Subject: [PATCH 329/380] tests/krb5: Check padata types when STRICT_CHECKING=0 > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >[abartlet@samba.org backported from commit bd22dcd9cc4dfda827f892224eb2da4a16564176 > to Samba 4.14 due to conflicts in > knownfail as the test which crashes older MIT KDC versions is > omitted] >--- > python/samba/tests/krb5/raw_testcase.py | 25 +++++++++++++++++++++---- > selftest/knownfail_mit_kdc | 9 +++++++++ > 2 files changed, 30 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index fbddb7f83b1..dbcff787f70 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1079,6 +1079,20 @@ class RawKerberosTest(TestCaseInTempDir): > f"'{unexpected.namedValues[i]}' " > f"unexpected in {v}") > >+ def assertSequenceElementsEqual(self, expected, got, *, >+ require_strict=None): >+ if self.strict_checking: >+ self.assertEqual(expected, got) >+ else: >+ fail_msg = f'expected: {expected} got: {got}' >+ >+ if require_strict is not None: >+ fail_msg += f' (ignoring: {require_strict})' >+ expected = (x for x in expected if x not in require_strict) >+ got = (x for x in got if x not in require_strict) >+ >+ self.assertCountEqual(expected, got, fail_msg) >+ > def get_KerberosTimeWithUsec(self, epoch=None, offset=None): > if epoch is None: > epoch = time.time() >@@ -2714,10 +2728,13 @@ class RawKerberosTest(TestCaseInTempDir): > expected_patypes += (PADATA_FX_FAST,) > expected_patypes += (PADATA_FX_COOKIE,) > >- if self.strict_checking: >- for i, patype in enumerate(expected_patypes): >- self.assertElementEqual(rep_padata[i], 'padata-type', patype) >- self.assertEqual(len(rep_padata), len(expected_patypes)) >+ got_patypes = tuple(pa['padata-type'] for pa in rep_padata) >+ self.assertSequenceElementsEqual(expected_patypes, got_patypes, >+ require_strict={PADATA_FX_COOKIE, >+ PADATA_FX_FAST, >+ PADATA_PAC_OPTIONS, >+ PADATA_PK_AS_REP_19, >+ PADATA_PK_AS_REQ}) > > etype_info2 = None > etype_info = None >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index f167c2bf856..4e0b20c5c80 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -290,6 +290,11 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_b > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_c > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_6_c >+# >+# MIT currently fails some as_req_no_preauth tests. >+# >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth.*aes.*rc4.*fl2003dc >+^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth.*rc4.*aes.*fl2003dc > # Differences in our KDC compared to windows > # > ^samba4.krb5.kdc .*.as-req-pac-request # We should reply to a request for a PAC over UDP with KRB5KRB_ERR_RESPONSE_TOO_BIG unconditionally >@@ -304,6 +309,9 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_authdata_fast_not_used.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_enc_timestamp.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_clock_skew.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_no_fast.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_wrong_key.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_encrypted_challenge_wrong_key_kdc.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_tgt.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_tgt_mach.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_armor.ad_dc >@@ -318,5 +326,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_sname.ad_dc >+^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_fast_no_etypes.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_sname.ad_dc >-- >2.25.1 > > >From 6806642b441708551077ae51f7d2c68a5f66c00f Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 11 Oct 2021 14:48:03 +1300 >Subject: [PATCH 330/380] tests/krb5: Check logon name in PAC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit e7c39cc44f2e16aecb01c0afc195911a474ef0b9) >--- > python/samba/tests/krb5/raw_testcase.py | 6 ++++++ > 1 file changed, 6 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index dbcff787f70..b0cd2bfdf0f 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2552,6 +2552,12 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertEqual(expected_transited_services, > transited_services) > >+ elif pac_buffer.type == krb5pac.PAC_TYPE_LOGON_NAME: >+ expected_cname = kdc_exchange_dict['expected_cname'] >+ account_name = expected_cname['name-string'][0] >+ >+ self.assertEqual(account_name, pac_buffer.info.account_name) >+ > def generic_check_kdc_error(self, > kdc_exchange_dict, > callback_dict, >-- >2.25.1 > > >From 3a45eab9ae8679e9402ee414a816c981e4c89163 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 11 Oct 2021 14:49:34 +1300 >Subject: [PATCH 331/380] tests/krb5: Simplify padata checking > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit cf3ca6ac4567d7c7954ea4ecc8cc9dd5effcc094) >--- > python/samba/tests/krb5/raw_testcase.py | 169 ++++++------------------ > 1 file changed, 41 insertions(+), 128 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index b0cd2bfdf0f..b51ad499192 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2742,73 +2742,32 @@ class RawKerberosTest(TestCaseInTempDir): > PADATA_PK_AS_REP_19, > PADATA_PK_AS_REQ}) > >- etype_info2 = None >- etype_info = None >- enc_timestamp = None >- enc_challenge = None >- pk_as_req = None >- pk_as_rep19 = None >- fast_cookie = None >- fast_error = None >- fx_fast = None >- pac_options = None >- for pa in rep_padata: >- patype = self.getElementValue(pa, 'padata-type') >- pavalue = self.getElementValue(pa, 'padata-value') >- if patype == PADATA_ETYPE_INFO2: >- self.assertIsNone(etype_info2) >- etype_info2 = self.der_decode(pavalue, >- asn1Spec=krb5_asn1.ETYPE_INFO2()) >- continue >- if patype == PADATA_ETYPE_INFO: >- self.assertIsNone(etype_info) >- etype_info = self.der_decode(pavalue, >- asn1Spec=krb5_asn1.ETYPE_INFO()) >- continue >- if patype == PADATA_ENC_TIMESTAMP: >- self.assertIsNone(enc_timestamp) >- enc_timestamp = pavalue >- self.assertEqual(len(enc_timestamp), 0) >- continue >- if patype == PADATA_ENCRYPTED_CHALLENGE: >- self.assertIsNone(enc_challenge) >- enc_challenge = pavalue >- continue >- if patype == PADATA_PK_AS_REQ: >- self.assertIsNone(pk_as_req) >- pk_as_req = pavalue >- self.assertEqual(len(pk_as_req), 0) >- continue >- if patype == PADATA_PK_AS_REP_19: >- self.assertIsNone(pk_as_rep19) >- pk_as_rep19 = pavalue >- self.assertEqual(len(pk_as_rep19), 0) >- continue >- if patype == PADATA_FX_COOKIE: >- self.assertIsNone(fast_cookie) >- fast_cookie = pavalue >- self.assertIsNotNone(fast_cookie) >- continue >- if patype == PADATA_FX_ERROR: >- self.assertIsNone(fast_error) >- fast_error = pavalue >- self.assertIsNotNone(fast_error) >- continue >- if patype == PADATA_FX_FAST: >- self.assertIsNone(fx_fast) >- fx_fast = pavalue >- self.assertEqual(len(fx_fast), 0) >- continue >- if patype == PADATA_PAC_OPTIONS: >- self.assertIsNone(pac_options) >- pac_options = self.der_decode( >- pavalue, >- asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) >- continue >+ if not expected_patypes: >+ return None >+ >+ pa_dict = self.get_pa_dict(rep_padata) >+ >+ enc_timestamp = pa_dict.get(PADATA_ENC_TIMESTAMP) >+ if enc_timestamp is not None: >+ self.assertEqual(len(enc_timestamp), 0) >+ >+ pk_as_req = pa_dict.get(PADATA_PK_AS_REQ) >+ if pk_as_req is not None: >+ self.assertEqual(len(pk_as_req), 0) >+ >+ pk_as_rep19 = pa_dict.get(PADATA_PK_AS_REP_19) >+ if pk_as_rep19 is not None: >+ self.assertEqual(len(pk_as_rep19), 0) > >+ fx_fast = pa_dict.get(PADATA_FX_FAST) >+ if fx_fast is not None: >+ self.assertEqual(len(fx_fast), 0) >+ >+ fast_cookie = pa_dict.get(PADATA_FX_COOKIE) > if fast_cookie is not None: > kdc_exchange_dict['fast_cookie'] = fast_cookie > >+ fast_error = pa_dict.get(PADATA_FX_ERROR) > if fast_error is not None: > fast_error = self.der_decode(fast_error, > asn1Spec=krb5_asn1.KRB_ERROR()) >@@ -2817,9 +2776,14 @@ class RawKerberosTest(TestCaseInTempDir): > fast_error, > inner=True) > >+ pac_options = pa_dict.get(PADATA_PAC_OPTIONS) > if pac_options is not None: >+ pac_options = self.der_decode( >+ pac_options, >+ asn1Spec=krb5_asn1.PA_PAC_OPTIONS()) > self.assertElementEqual(pac_options, 'options', sent_pac_options) > >+ enc_challenge = pa_dict.get(PADATA_ENCRYPTED_CHALLENGE) > if enc_challenge is not None: > if not sent_enc_challenge: > self.assertEqual(len(enc_challenge), 0) >@@ -2862,52 +2826,21 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertLess(current_time - 300, rep_time) > self.assertLess(rep_time, current_time + 300) > >- if all(etype not in client_as_etypes or etype not in proposed_etypes >- for etype in (kcrypto.Enctype.AES256, >- kcrypto.Enctype.AES128, >- kcrypto.Enctype.RC4)): >- self.assertIsNone(etype_info2) >- self.assertIsNone(etype_info) >- if rep_msg_type == KRB_AS_REP: >- if self.strict_checking: >- if sent_fast: >- self.assertIsNotNone(enc_challenge) >- self.assertIsNone(enc_timestamp) >- else: >- self.assertIsNotNone(enc_timestamp) >- self.assertIsNone(enc_challenge) >- self.assertIsNotNone(pk_as_req) >- self.assertIsNotNone(pk_as_rep19) >- else: >- self.assertIsNone(enc_timestamp) >- self.assertIsNone(enc_challenge) >- self.assertIsNone(pk_as_req) >- self.assertIsNone(pk_as_rep19) >- return None >- >- if error_code != KDC_ERR_GENERIC: >- if self.strict_checking: >- self.assertIsNotNone(etype_info2) >- else: >- self.assertIsNone(etype_info2) >- if expect_etype_info: >- if self.strict_checking: >- self.assertIsNotNone(etype_info) >- else: >- if self.strict_checking: >- self.assertIsNone(etype_info) >- if unexpect_etype_info: >- self.assertIsNone(etype_info) >- >- if error_code != KDC_ERR_GENERIC and self.strict_checking: >+ etype_info2 = pa_dict.get(PADATA_ETYPE_INFO2) >+ if etype_info2 is not None: >+ etype_info2 = self.der_decode(etype_info2, >+ asn1Spec=krb5_asn1.ETYPE_INFO2()) > self.assertGreaterEqual(len(etype_info2), 1) >- self.assertEqual(len(etype_info2), len(expect_etype_info2)) >+ if self.strict_checking: >+ self.assertEqual(len(etype_info2), len(expect_etype_info2)) > for i in range(0, len(etype_info2)): > e = self.getElementValue(etype_info2[i], 'etype') >- self.assertEqual(e, expect_etype_info2[i]) >+ if self.strict_checking: >+ self.assertEqual(e, expect_etype_info2[i]) > salt = self.getElementValue(etype_info2[i], 'salt') > if e == kcrypto.Enctype.RC4: >- self.assertIsNone(salt) >+ if self.strict_checking: >+ self.assertIsNone(salt) > else: > self.assertIsNotNone(salt) > expected_salt = kdc_exchange_dict['expected_salt'] >@@ -2916,7 +2849,11 @@ class RawKerberosTest(TestCaseInTempDir): > s2kparams = self.getElementValue(etype_info2[i], 's2kparams') > if self.strict_checking: > self.assertIsNone(s2kparams) >+ >+ etype_info = pa_dict.get(PADATA_ETYPE_INFO) > if etype_info is not None: >+ etype_info = self.der_decode(etype_info, >+ asn1Spec=krb5_asn1.ETYPE_INFO()) > self.assertEqual(len(etype_info), 1) > e = self.getElementValue(etype_info[0], 'etype') > self.assertEqual(e, kcrypto.Enctype.RC4) >@@ -2926,30 +2863,6 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNotNone(salt) > self.assertEqual(len(salt), 0) > >- if error_code not in (KDC_ERR_PREAUTH_FAILED, >- KDC_ERR_GENERIC): >- if sent_fast: >- self.assertIsNotNone(enc_challenge) >- if self.strict_checking: >- self.assertIsNone(enc_timestamp) >- else: >- self.assertIsNotNone(enc_timestamp) >- if self.strict_checking: >- self.assertIsNone(enc_challenge) >- if not sent_enc_challenge: >- if self.strict_checking: >- self.assertIsNotNone(pk_as_req) >- self.assertIsNotNone(pk_as_rep19) >- else: >- self.assertIsNone(pk_as_req) >- self.assertIsNone(pk_as_rep19) >- else: >- if self.strict_checking: >- self.assertIsNone(enc_timestamp) >- self.assertIsNone(enc_challenge) >- self.assertIsNone(pk_as_req) >- self.assertIsNone(pk_as_rep19) >- > return etype_info2 > > def generate_simple_fast(self, >-- >2.25.1 > > >From 705a4ca4aa4e255a1c96a558cac41f52d85ce5a6 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 8 Oct 2021 11:48:41 +1300 >Subject: [PATCH 332/380] tests/krb5: Disable debugging output for tests > >This reduces the time spent running the tests in a testenv. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit dfd613661eec4b81e162f2d86a8fa9266c2fdc03) >--- > python/samba/tests/krb5/as_canonicalization_tests.py | 4 ++-- > python/samba/tests/krb5/as_req_tests.py | 4 ++-- > python/samba/tests/krb5/compatability_tests.py | 4 ++-- > python/samba/tests/krb5/kdc_tests.py | 4 ++-- > python/samba/tests/krb5/kdc_tgs_tests.py | 4 ++-- > python/samba/tests/krb5/s4u_tests.py | 4 ++-- > python/samba/tests/krb5/simple_tests.py | 4 ++-- > python/samba/tests/krb5/test_ccache.py | 4 ++-- > python/samba/tests/krb5/test_ldap.py | 4 ++-- > python/samba/tests/krb5/test_rpc.py | 4 ++-- > python/samba/tests/krb5/test_smb.py | 4 ++-- > python/samba/tests/krb5/xrealm_tests.py | 4 ++-- > 12 files changed, 24 insertions(+), 24 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index 29d8cf418f5..9538d0ae3cf 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -427,8 +427,8 @@ class KerberosASCanonicalizationTests(KDCBaseTest): > > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > > unittest.main() >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 8d9b90fee69..7d7baaebf24 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -198,8 +198,8 @@ class AsReqKerberosTests(KDCBaseTest): > self.assertIsNotNone(as_rep) > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > unittest.main() > >diff --git a/python/samba/tests/krb5/compatability_tests.py b/python/samba/tests/krb5/compatability_tests.py >index 0da72796894..ed2dc565b6d 100755 >--- a/python/samba/tests/krb5/compatability_tests.py >+++ b/python/samba/tests/krb5/compatability_tests.py >@@ -261,7 +261,7 @@ class SimpleKerberosTests(KDCBaseTest): > > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > unittest.main() >diff --git a/python/samba/tests/krb5/kdc_tests.py b/python/samba/tests/krb5/kdc_tests.py >index 928f3c25c0f..b7c8566a1ec 100755 >--- a/python/samba/tests/krb5/kdc_tests.py >+++ b/python/samba/tests/krb5/kdc_tests.py >@@ -222,7 +222,7 @@ class KdcTests(RawKerberosTest): > > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > unittest.main() >diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py >index 2b55ba8a376..3075cc6b0a9 100755 >--- a/python/samba/tests/krb5/kdc_tgs_tests.py >+++ b/python/samba/tests/krb5/kdc_tgs_tests.py >@@ -211,7 +211,7 @@ class KdcTgsTests(KDCBaseTest): > > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > unittest.main() >diff --git a/python/samba/tests/krb5/s4u_tests.py b/python/samba/tests/krb5/s4u_tests.py >index 57575f0595d..bbddef4d6e0 100755 >--- a/python/samba/tests/krb5/s4u_tests.py >+++ b/python/samba/tests/krb5/s4u_tests.py >@@ -197,7 +197,7 @@ class S4UKerberosTests(RawKerberosTest): > > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > unittest.main() >diff --git a/python/samba/tests/krb5/simple_tests.py b/python/samba/tests/krb5/simple_tests.py >index 795d753b4f7..3cd3b17bb31 100755 >--- a/python/samba/tests/krb5/simple_tests.py >+++ b/python/samba/tests/krb5/simple_tests.py >@@ -179,7 +179,7 @@ class SimpleKerberosTests(RawKerberosTest): > > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > unittest.main() >diff --git a/python/samba/tests/krb5/test_ccache.py b/python/samba/tests/krb5/test_ccache.py >index feb7a7bd9be..c44ea02d504 100755 >--- a/python/samba/tests/krb5/test_ccache.py >+++ b/python/samba/tests/krb5/test_ccache.py >@@ -129,7 +129,7 @@ class CcacheTests(KDCBaseTest): > > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > unittest.main() >diff --git a/python/samba/tests/krb5/test_ldap.py b/python/samba/tests/krb5/test_ldap.py >index d304fb9d71e..95b2d24221a 100755 >--- a/python/samba/tests/krb5/test_ldap.py >+++ b/python/samba/tests/krb5/test_ldap.py >@@ -90,7 +90,7 @@ class LdapTests(KDCBaseTest): > > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > unittest.main() >diff --git a/python/samba/tests/krb5/test_rpc.py b/python/samba/tests/krb5/test_rpc.py >index 324b57f2847..40ac6df7a35 100755 >--- a/python/samba/tests/krb5/test_rpc.py >+++ b/python/samba/tests/krb5/test_rpc.py >@@ -73,7 +73,7 @@ class RpcTests(KDCBaseTest): > > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > unittest.main() >diff --git a/python/samba/tests/krb5/test_smb.py b/python/samba/tests/krb5/test_smb.py >index 45d4fe5e0c1..eebc9a9d4fe 100755 >--- a/python/samba/tests/krb5/test_smb.py >+++ b/python/samba/tests/krb5/test_smb.py >@@ -104,7 +104,7 @@ class SmbTests(KDCBaseTest): > > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > unittest.main() >diff --git a/python/samba/tests/krb5/xrealm_tests.py b/python/samba/tests/krb5/xrealm_tests.py >index 073cb755b46..73a6b3cf52d 100755 >--- a/python/samba/tests/krb5/xrealm_tests.py >+++ b/python/samba/tests/krb5/xrealm_tests.py >@@ -181,7 +181,7 @@ class XrealmKerberosTests(RawKerberosTest): > > > if __name__ == "__main__": >- global_asn1_print = True >- global_hexdump = True >+ global_asn1_print = False >+ global_hexdump = False > import unittest > unittest.main() >-- >2.25.1 > > >From ba6f0e34ed422febba0f3fcf59f639a7d28e7251 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 5 Oct 2021 19:47:22 +1300 >Subject: [PATCH 333/380] tests/krb5: Provide clearer assertion messages for > test failures > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 5233f002000f196875af488b4f4d1df26fca90de) >--- > python/samba/tests/krb5/raw_testcase.py | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index b51ad499192..188a54451d3 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -1942,7 +1942,12 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertIsNone(check_error_fn) > self.assertEqual(0, len(expected_error_mode)) > self.assertIsNotNone(expected_msg_type) >- self.assertEqual(msg_type, expected_msg_type) >+ if msg_type == KRB_ERROR: >+ error_code = self.getElementValue(rep, 'error-code') >+ fail_msg = f'Got unexpected error: {error_code}' >+ else: >+ fail_msg = f'Expected to fail with error: {expected_error_mode}' >+ self.assertEqual(msg_type, expected_msg_type, fail_msg) > > if msg_type == KRB_ERROR: > return check_error_fn(kdc_exchange_dict, >-- >2.25.1 > > >From 59bfe90424f31ff9dbd72f018256ceb1cc30e959 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 5 Oct 2021 16:32:01 +1300 >Subject: [PATCH 334/380] tests/krb5: Fix sha1 checksum type > >Previously, sha1 signatures were being designated as rsa-md5-des3 >signatures. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit ebe729786806c69e95b26ffc410e887e203accb8) >--- > python/samba/tests/krb5/kcrypto.py | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/kcrypto.py b/python/samba/tests/krb5/kcrypto.py >index 2a72969de00..a919b785ad1 100755 >--- a/python/samba/tests/krb5/kcrypto.py >+++ b/python/samba/tests/krb5/kcrypto.py >@@ -81,8 +81,8 @@ class Cksumtype(object): > MD4_DES = 3 > MD5 = 7 > MD5_DES = 8 >- SHA1 = 9 > SHA1_DES3 = 12 >+ SHA1 = 14 > SHA1_AES128 = 15 > SHA1_AES256 = 16 > HMAC_MD5 = -138 >-- >2.25.1 > > >From c78b0578cadda49841c5a89faf9ca1d1aa158d00 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 13 Oct 2021 12:26:22 +1300 >Subject: [PATCH 335/380] selftest/dbcheck: Fix up RODC one-way links > >Test accounts were replicated to the RODC and then deleted, causing >state links to remain in the database. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 40e5db4aabcd32834ee524857b77d36921f6bdfe) >--- > testprogs/blackbox/dbcheck.sh | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/testprogs/blackbox/dbcheck.sh b/testprogs/blackbox/dbcheck.sh >index caf89ca402b..e2ba987e2de 100755 >--- a/testprogs/blackbox/dbcheck.sh >+++ b/testprogs/blackbox/dbcheck.sh >@@ -19,7 +19,7 @@ dbcheck() { > > # This list of attributes can be freely extended > dbcheck_fix_one_way_links() { >- $PYTHON $BINDIR/samba-tool dbcheck --quiet --fix --yes fix_all_old_dn_string_component_mismatch --attrs="lastKnownParent defaultObjectCategory fromServer rIDSetReferences" --cross-ncs $ARGS >+ $PYTHON $BINDIR/samba-tool dbcheck --quiet --fix --yes fix_all_old_dn_string_component_mismatch --attrs="lastKnownParent defaultObjectCategory fromServer rIDSetReferences msDS-RevealOnDemandGroup msDS-NeverRevealGroup" --cross-ncs $ARGS > } > > # This list of attributes can be freely extended >-- >2.25.1 > > >From faf813da30f1f1acf22b2b5d5262b58d3042a20b Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 14 Oct 2021 16:58:15 +1300 >Subject: [PATCH 336/380] tests/krb5: Add TKT_SIG_SUPPORT environment variable > >This lets us indicate that service tickets should be issued with ticket >checksums in the PAC. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >[abartlet@samba.org backported from commit ae2c57fb0332f94ac44d0886c5edbed707ef52fe > due to changes in other tests nearby in tests.py] >--- > python/samba/tests/krb5/raw_testcase.py | 6 ++++ > source4/selftest/tests.py | 41 +++++++++++++++++-------- > 2 files changed, 34 insertions(+), 13 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 188a54451d3..1f7c51c07a5 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -574,6 +574,12 @@ class RawKerberosTest(TestCaseInTempDir): > kdc_fast_support = '0' > cls.kdc_fast_support = bool(int(kdc_fast_support)) > >+ tkt_sig_support = samba.tests.env_get_var_value('TKT_SIG_SUPPORT', >+ allow_missing=True) >+ if tkt_sig_support is None: >+ tkt_sig_support = '0' >+ cls.tkt_sig_support = bool(int(tkt_sig_support)) >+ > def setUp(self): > super().setUp() > self.do_asn1_print = False >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index bdcbfcb4ab6..2fa725e837c 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -743,46 +743,54 @@ planoldpythontestsuite("ad_dc:local", "samba.tests.gpo", extra_args=['-U"$USERNA > planoldpythontestsuite("ad_dc:local", "samba.tests.dckeytab", extra_args=['-U"$USERNAME%$PASSWORD"']) > > have_fast_support = int('SAMBA_USES_MITKDC' in config_hash) >+tkt_sig_support = 0 > planoldpythontestsuite("none", "samba.tests.krb5.kcrypto") > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.simple_tests", > environ={'SERVICE_USERNAME':'$SERVER', >- 'FAST_SUPPORT': have_fast_support}) >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support}) > planoldpythontestsuite("ad_dc_default:local", "samba.tests.krb5.s4u_tests", > environ={'SERVICE_USERNAME':'srv_account', > 'SERVICE_PASSWORD':'$PASSWORD', > 'FOR_USER':'$USERNAME', >- 'FAST_SUPPORT': have_fast_support}) >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support}) > > planoldpythontestsuite("fl2008r2dc:local", "samba.tests.krb5.xrealm_tests", >- environ={'FAST_SUPPORT': have_fast_support}) >+ environ={'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support}) > > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ccache", > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', >- 'FAST_SUPPORT': have_fast_support >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support > }) > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_ldap", > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', >- 'FAST_SUPPORT': have_fast_support >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support > }) > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.test_rpc", > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', >- 'FAST_SUPPORT': have_fast_support >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support > }) > planoldpythontestsuite("ad_dc_smb1", "samba.tests.krb5.test_smb", > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', >- 'FAST_SUPPORT': have_fast_support >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support > }) > > for env in ["ad_dc", smbv1_disabled_testenv]: >@@ -1307,7 +1315,8 @@ for env in ["fl2008r2dc", "fl2003dc"]: > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', >- 'FAST_SUPPORT': have_fast_support >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support > }) > > >@@ -1329,7 +1338,8 @@ planpythontestsuite("ad_dc", "samba.tests.krb5.as_canonicalization_tests", > environ={ > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', >- 'FAST_SUPPORT': have_fast_support >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support > }) > planpythontestsuite("ad_dc", "samba.tests.krb5.compatability_tests", > environ={ >@@ -1337,9 +1347,11 @@ planpythontestsuite("ad_dc", "samba.tests.krb5.compatability_tests", > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', > 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support > }) > planpythontestsuite("ad_dc", "samba.tests.krb5.kdc_tests", >- environ={'FAST_SUPPORT': have_fast_support}) >+ environ={'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support}) > planpythontestsuite( > "ad_dc", > "samba.tests.krb5.kdc_tgs_tests", >@@ -1347,7 +1359,8 @@ planpythontestsuite( > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', >- 'FAST_SUPPORT': have_fast_support >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support > }) > planpythontestsuite( > "ad_dc", >@@ -1356,7 +1369,8 @@ planpythontestsuite( > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', >- 'FAST_SUPPORT': have_fast_support >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support > }) > planpythontestsuite( > "ad_dc", >@@ -1365,7 +1379,8 @@ planpythontestsuite( > 'ADMIN_USERNAME': '$USERNAME', > 'ADMIN_PASSWORD': '$PASSWORD', > 'STRICT_CHECKING': '0', >- 'FAST_SUPPORT': have_fast_support >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support > }) > > for env in [ >-- >2.25.1 > > >From cbb6def8313221a43bcdc4eb7eb65d6147cc42fc Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Tue, 5 Oct 2021 15:39:11 +1300 >Subject: [PATCH 337/380] tests/krb5: Require ticket checksums if decryption > key is available > >We perform this check conditionally, because MIT doesn't currently add >ticket checksums. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit bf63221722903665e7b20991021fb5cdf4e4327e) >--- > python/samba/tests/krb5/raw_testcase.py | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 1f7c51c07a5..2e289c90ce7 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2493,15 +2493,14 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_private=ticket_private, > encpart_private=encpart_private) > >- # TODO: This parameter should be removed when all service tickets are >- # issued with ticket checksums. > expect_ticket_checksum = kdc_exchange_dict['expect_ticket_checksum'] > if expect_ticket_checksum: > self.assertIsNotNone(ticket_decryption_key) > > if ticket_decryption_key is not None: > self.verify_ticket(ticket_creds, krbtgt_key, expect_pac=expect_pac, >- expect_ticket_checksum=expect_ticket_checksum) >+ expect_ticket_checksum=expect_ticket_checksum >+ or self.tkt_sig_support) > > kdc_exchange_dict['rep_ticket_creds'] = ticket_creds > >-- >2.25.1 > > >From ba0446f9ad337575e1f8cfd14e5f4677f1818ba5 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 6 Oct 2021 16:35:47 +1300 >Subject: [PATCH 338/380] tests/krb5: Verify tickets obtained with > get_service_ticket() > >We only require the ticket checksum with Heimdal, because MIT currently >doesn't add it. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit d86eee2fd0fb72e52d878ceba0c476ca58abe6cf) >--- > python/samba/tests/krb5/kdc_base_test.py | 8 ++++++++ > 1 file changed, 8 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 93951586cc7..8a5e12bbed4 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1287,6 +1287,14 @@ class KDCBaseTest(RawKerberosTest): > sname=sname, > decryption_key=target_key) > >+ if to_rodc: >+ krbtgt_creds = self.get_rodc_krbtgt_creds() >+ else: >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_key = self.TicketDecryptionKey_from_creds(krbtgt_creds) >+ self.verify_ticket(service_ticket_creds, krbtgt_key, >+ expect_ticket_checksum=self.tkt_sig_support) >+ > self.tkt_cache[cache_key] = service_ticket_creds > > return service_ticket_creds >-- >2.25.1 > > >From 066033bb477986eb0774ef762ab524a1aa4a2c7e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Thu, 30 Sep 2021 15:03:04 +1300 >Subject: [PATCH 339/380] tests/krb5: Add constrained delegation tests > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 56ccdba54e0c7cf3409d8430ea1012e5d3d9b092) >--- > python/samba/tests/krb5/rfc4120_constants.py | 5 + > python/samba/tests/krb5/rodc_tests.py | 73 ++ > python/samba/tests/krb5/s4u_tests.py | 958 ++++++++++++++++++- > python/samba/tests/usage.py | 1 + > selftest/knownfail_heimdal_kdc | 29 + > source4/selftest/tests.py | 11 +- > 6 files changed, 1070 insertions(+), 7 deletions(-) > create mode 100755 python/samba/tests/krb5/rodc_tests.py > >diff --git a/python/samba/tests/krb5/rfc4120_constants.py b/python/samba/tests/krb5/rfc4120_constants.py >index 76f2b75d94e..39bb2db8e32 100644 >--- a/python/samba/tests/krb5/rfc4120_constants.py >+++ b/python/samba/tests/krb5/rfc4120_constants.py >@@ -69,12 +69,17 @@ PADATA_SUPPORTED_ETYPES = int( > KDC_ERR_C_PRINCIPAL_UNKNOWN = 6 > KDC_ERR_S_PRINCIPAL_UNKNOWN = 7 > KDC_ERR_POLICY = 12 >+KDC_ERR_BADOPTION = 13 > KDC_ERR_ETYPE_NOSUPP = 14 >+KDC_ERR_SUMTYPE_NOSUPP = 15 > KDC_ERR_PREAUTH_FAILED = 24 > KDC_ERR_PREAUTH_REQUIRED = 25 >+KDC_ERR_BAD_INTEGRITY = 31 > KDC_ERR_NOT_US = 35 > KDC_ERR_BADMATCH = 36 > KDC_ERR_SKEW = 37 >+KDC_ERR_MODIFIED = 41 >+KDC_ERR_INAPP_CKSUM = 50 > KDC_ERR_GENERIC = 60 > KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS = 93 > >diff --git a/python/samba/tests/krb5/rodc_tests.py b/python/samba/tests/krb5/rodc_tests.py >new file mode 100755 >index 00000000000..4579f9eb552 >--- /dev/null >+++ b/python/samba/tests/krb5/rodc_tests.py >@@ -0,0 +1,73 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+from samba.tests.krb5.kdc_base_test import KDCBaseTest >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class RodcKerberosTests(KDCBaseTest): >+ >+ def setUp(self): >+ super().setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ # Ensure that an RODC correctly issues tickets signed with its krbtgt key >+ # and including the RODCIdentifier. >+ def test_rodc_ticket_signature(self): >+ user_creds = self.get_cached_creds( >+ machine_account=False, >+ opts={ >+ 'revealed_to_rodc': True >+ }) >+ target_creds = self.get_cached_creds( >+ machine_account=True, >+ opts={ >+ 'revealed_to_rodc': True >+ }) >+ >+ krbtgt_creds = self.get_rodc_krbtgt_creds() >+ rodc_key = self.TicketDecryptionKey_from_creds(krbtgt_creds) >+ >+ # Get a TGT from the RODC. >+ tgt = self.get_tgt(user_creds, to_rodc=True) >+ >+ # Ensure the PAC contains the expected checksums. >+ self.verify_ticket(tgt, rodc_key) >+ >+ # Get a service ticket from the RODC. >+ service_ticket = self.get_service_ticket(tgt, target_creds, >+ to_rodc=True) >+ >+ # Ensure the PAC contains the expected checksums. >+ self.verify_ticket(service_ticket, rodc_key) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = False >+ global_hexdump = False >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/krb5/s4u_tests.py b/python/samba/tests/krb5/s4u_tests.py >index bbddef4d6e0..9a25256081a 100755 >--- a/python/samba/tests/krb5/s4u_tests.py >+++ b/python/samba/tests/krb5/s4u_tests.py >@@ -18,17 +18,34 @@ > > import sys > import os >+import functools > > sys.path.insert(0, "bin/python") > os.environ["PYTHONUNBUFFERED"] = "1" > >+from samba import ntstatus >+from samba.dcerpc import krb5pac, lsa >+ > from samba.tests import env_get_var_value >-from samba.tests.krb5.kcrypto import Cksumtype >-from samba.tests.krb5.raw_testcase import RawKerberosTest >+from samba.tests.krb5.kcrypto import Cksumtype, Enctype >+from samba.tests.krb5.kdc_base_test import KDCBaseTest >+from samba.tests.krb5.raw_testcase import ( >+ RodcPacEncryptionKey, >+ ZeroedChecksumKey >+) > from samba.tests.krb5.rfc4120_constants import ( >+ AES256_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5, >+ KDC_ERR_BADOPTION, >+ KDC_ERR_BAD_INTEGRITY, >+ KDC_ERR_GENERIC, >+ KDC_ERR_INAPP_CKSUM, >+ KDC_ERR_MODIFIED, >+ KDC_ERR_SUMTYPE_NOSUPP, > KU_PA_ENC_TIMESTAMP, > KU_AS_REP_ENC_PART, > KU_TGS_REP_ENC_PART_SUB_KEY, >+ NT_PRINCIPAL > ) > import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > >@@ -36,7 +53,7 @@ global_asn1_print = False > global_hexdump = False > > >-class S4UKerberosTests(RawKerberosTest): >+class S4UKerberosTests(KDCBaseTest): > > def setUp(self): > super(S4UKerberosTests, self).setUp() >@@ -119,8 +136,14 @@ class S4UKerberosTests(RawKerberosTest): > self.assertEqual(msg_type, 11) > > enc_part2 = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher']) >- enc_part2 = self.der_decode( >- enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) >+ # MIT KDC encodes both EncASRepPart and EncTGSRepPart with >+ # application tag 26 >+ try: >+ enc_part2 = self.der_decode( >+ enc_part2, asn1Spec=krb5_asn1.EncASRepPart()) >+ except Exception: >+ enc_part2 = self.der_decode( >+ enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart()) > > # S4U2Self Request > sname = cname >@@ -195,6 +218,931 @@ class S4UKerberosTests(RawKerberosTest): > msg_type = self._test_s4u2self(pa_s4u2self_ctype=Cksumtype.CRC32) > self.assertEqual(msg_type, 30) > >+ def _run_s4u2self_test(self, kdc_dict): >+ client_opts = kdc_dict.pop('client_opts', None) >+ client_creds = self.get_cached_creds(machine_account=False, >+ opts=client_opts) >+ >+ service_opts = kdc_dict.pop('service_opts', None) >+ service_creds = self.get_cached_creds(machine_account=True, >+ opts=service_opts) >+ >+ service_tgt = self.get_tgt(service_creds) >+ modify_service_tgt_fn = kdc_dict.pop('modify_service_tgt_fn', None) >+ if modify_service_tgt_fn is not None: >+ service_tgt = modify_service_tgt_fn(service_tgt) >+ >+ client_name = client_creds.get_username() >+ client_cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[client_name]) >+ >+ service_name = service_creds.get_username()[:-1] >+ service_sname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=['host', service_name]) >+ >+ realm = client_creds.get_realm() >+ >+ expected_flags = kdc_dict.pop('expected_flags', None) >+ if expected_flags is not None: >+ expected_flags = krb5_asn1.TicketFlags(expected_flags) >+ >+ unexpected_flags = kdc_dict.pop('unexpected_flags', None) >+ if unexpected_flags is not None: >+ unexpected_flags = krb5_asn1.TicketFlags(unexpected_flags) >+ >+ kdc_options = kdc_dict.pop('kdc_options', '0') >+ kdc_options = krb5_asn1.KDCOptions(kdc_options) >+ >+ service_decryption_key = self.TicketDecryptionKey_from_creds( >+ service_creds) >+ >+ authenticator_subkey = self.RandomKey(Enctype.AES256) >+ >+ etypes = kdc_dict.pop('etypes', (AES256_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5)) >+ >+ def generate_s4u2self_padata(_kdc_exchange_dict, >+ _callback_dict, >+ req_body): >+ pa_s4u = self.PA_S4U2Self_create( >+ name=client_cname, >+ realm=realm, >+ tgt_session_key=service_tgt.session_key, >+ ctype=None) >+ >+ return [pa_s4u], req_body >+ >+ kdc_exchange_dict = self.tgs_exchange_dict( >+ expected_crealm=realm, >+ expected_cname=client_cname, >+ expected_srealm=realm, >+ expected_sname=service_sname, >+ expected_flags=expected_flags, >+ unexpected_flags=unexpected_flags, >+ ticket_decryption_key=service_decryption_key, >+ expect_ticket_checksum=True, >+ generate_padata_fn=generate_s4u2self_padata, >+ check_rep_fn=self.generic_check_kdc_rep, >+ check_kdc_private_fn=self.generic_check_kdc_private, >+ expected_error_mode=0, >+ tgt=service_tgt, >+ authenticator_subkey=authenticator_subkey, >+ kdc_options=str(kdc_options), >+ expect_claims=False) >+ >+ self._generic_kdc_exchange(kdc_exchange_dict, >+ cname=None, >+ realm=realm, >+ sname=service_sname, >+ etypes=etypes) >+ >+ # Ensure we used all the parameters given to us. >+ self.assertEqual({}, kdc_dict) >+ >+ # Test performing an S4U2Self operation with a forwardable ticket. The >+ # resulting ticket should have the 'forwardable' flag set. >+ def test_s4u2self_forwardable(self): >+ self._run_s4u2self_test( >+ { >+ 'client_opts': { >+ 'not_delegated': False >+ }, >+ 'kdc_options': 'forwardable', >+ 'modify_service_tgt_fn': functools.partial( >+ self.set_ticket_forwardable, flag=True), >+ 'expected_flags': 'forwardable' >+ }) >+ >+ # Test performing an S4U2Self operation without requesting a forwardable >+ # ticket. The resulting ticket should not have the 'forwardable' flag set. >+ def test_s4u2self_without_forwardable(self): >+ self._run_s4u2self_test( >+ { >+ 'client_opts': { >+ 'not_delegated': False >+ }, >+ 'modify_service_tgt_fn': functools.partial( >+ self.set_ticket_forwardable, flag=True), >+ 'unexpected_flags': 'forwardable' >+ }) >+ >+ # Do an S4U2Self with a non-forwardable TGT. The 'forwardable' flag should >+ # not be set on the ticket. >+ def test_s4u2self_not_forwardable(self): >+ self._run_s4u2self_test( >+ { >+ 'client_opts': { >+ 'not_delegated': False >+ }, >+ 'kdc_options': 'forwardable', >+ 'modify_service_tgt_fn': functools.partial( >+ self.set_ticket_forwardable, flag=False), >+ 'unexpected_flags': 'forwardable' >+ }) >+ >+ # Do an S4U2Self with the not_delegated flag set on the client. The >+ # 'forwardable' flag should not be set on the ticket. >+ def test_s4u2self_client_not_delegated(self): >+ self._run_s4u2self_test( >+ { >+ 'client_opts': { >+ 'not_delegated': True >+ }, >+ 'kdc_options': 'forwardable', >+ 'modify_service_tgt_fn': functools.partial( >+ self.set_ticket_forwardable, flag=True), >+ 'unexpected_flags': 'forwardable' >+ }) >+ >+ # Do an S4U2Self with a service not trusted to authenticate for delegation, >+ # but having an empty msDS-AllowedToDelegateTo attribute. The 'forwardable' >+ # flag should be set on the ticket. >+ def test_s4u2self_not_trusted_empty_allowed(self): >+ self._run_s4u2self_test( >+ { >+ 'client_opts': { >+ 'not_delegated': False >+ }, >+ 'service_opts': { >+ 'trusted_to_auth_for_delegation': False, >+ 'delegation_to_spn': () >+ }, >+ 'kdc_options': 'forwardable', >+ 'modify_service_tgt_fn': functools.partial( >+ self.set_ticket_forwardable, flag=True), >+ 'expected_flags': 'forwardable' >+ }) >+ >+ # Do an S4U2Self with a service not trusted to authenticate for delegation >+ # and having a non-empty msDS-AllowedToDelegateTo attribute. The >+ # 'forwardable' flag should not be set on the ticket. >+ def test_s4u2self_not_trusted_nonempty_allowed(self): >+ self._run_s4u2self_test( >+ { >+ 'client_opts': { >+ 'not_delegated': False >+ }, >+ 'service_opts': { >+ 'trusted_to_auth_for_delegation': False, >+ 'delegation_to_spn': ('test',) >+ }, >+ 'kdc_options': 'forwardable', >+ 'modify_service_tgt_fn': functools.partial( >+ self.set_ticket_forwardable, flag=True), >+ 'unexpected_flags': 'forwardable' >+ }) >+ >+ # Do an S4U2Self with a service trusted to authenticate for delegation and >+ # having an empty msDS-AllowedToDelegateTo attribute. The 'forwardable' >+ # flag should be set on the ticket. >+ def test_s4u2self_trusted_empty_allowed(self): >+ self._run_s4u2self_test( >+ { >+ 'client_opts': { >+ 'not_delegated': False >+ }, >+ 'service_opts': { >+ 'trusted_to_auth_for_delegation': True, >+ 'delegation_to_spn': () >+ }, >+ 'kdc_options': 'forwardable', >+ 'modify_service_tgt_fn': functools.partial( >+ self.set_ticket_forwardable, flag=True), >+ 'expected_flags': 'forwardable' >+ }) >+ >+ # Do an S4U2Self with a service trusted to authenticate for delegation and >+ # having a non-empty msDS-AllowedToDelegateTo attribute. The 'forwardable' >+ # flag should be set on the ticket. >+ def test_s4u2self_trusted_nonempty_allowed(self): >+ self._run_s4u2self_test( >+ { >+ 'client_opts': { >+ 'not_delegated': False >+ }, >+ 'service_opts': { >+ 'trusted_to_auth_for_delegation': True, >+ 'delegation_to_spn': ('test',) >+ }, >+ 'kdc_options': 'forwardable', >+ 'modify_service_tgt_fn': functools.partial( >+ self.set_ticket_forwardable, flag=True), >+ 'expected_flags': 'forwardable' >+ }) >+ >+ def _run_delegation_test(self, kdc_dict): >+ client_opts = kdc_dict.pop('client_opts', None) >+ client_creds = self.get_cached_creds(machine_account=False, >+ opts=client_opts) >+ >+ service1_opts = kdc_dict.pop('service1_opts', {}) >+ service2_opts = kdc_dict.pop('service2_opts', {}) >+ >+ allow_delegation = kdc_dict.pop('allow_delegation', False) >+ allow_rbcd = kdc_dict.pop('allow_rbcd', False) >+ self.assertFalse(allow_delegation and allow_rbcd) >+ >+ if allow_rbcd: >+ service1_creds = self.get_cached_creds(machine_account=True, >+ opts=service1_opts) >+ >+ self.assertNotIn('delegation_from_dn', service2_opts) >+ service2_opts['delegation_from_dn'] = str(service1_creds.get_dn()) >+ >+ service2_creds = self.get_cached_creds(machine_account=True, >+ opts=service2_opts) >+ else: >+ service2_creds = self.get_cached_creds(machine_account=True, >+ opts=service2_opts) >+ >+ if allow_delegation: >+ self.assertNotIn('delegation_to_spn', service1_opts) >+ service1_opts['delegation_to_spn'] = service2_creds.get_spn() >+ >+ service1_creds = self.get_cached_creds(machine_account=True, >+ opts=service1_opts) >+ >+ client_tkt_options = kdc_dict.pop('client_tkt_options', 'forwardable') >+ expected_flags = krb5_asn1.TicketFlags(client_tkt_options) >+ >+ client_tgt = self.get_tgt(client_creds, >+ kdc_options=client_tkt_options, >+ expected_flags=expected_flags) >+ client_service_tkt = self.get_service_ticket( >+ client_tgt, >+ service1_creds, >+ kdc_options=client_tkt_options, >+ expected_flags=expected_flags) >+ >+ service1_tgt = self.get_tgt(service1_creds) >+ >+ modify_client_tkt_fn = kdc_dict.pop('modify_client_tkt_fn', None) >+ if modify_client_tkt_fn is not None: >+ client_service_tkt = modify_client_tkt_fn(client_service_tkt) >+ >+ additional_tickets = [client_service_tkt.ticket] >+ >+ modify_service_tgt_fn = kdc_dict.pop('modify_service_tgt_fn', None) >+ if modify_service_tgt_fn is not None: >+ service1_tgt = modify_service_tgt_fn(service1_tgt) >+ >+ kdc_options = kdc_dict.pop('kdc_options', None) >+ if kdc_options is None: >+ kdc_options = str(krb5_asn1.KDCOptions('cname-in-addl-tkt')) >+ >+ client_username = client_creds.get_username() >+ client_realm = client_creds.get_realm() >+ client_cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[client_username]) >+ >+ service1_name = service1_creds.get_username()[:-1] >+ service1_realm = service1_creds.get_realm() >+ >+ service2_name = service2_creds.get_username()[:-1] >+ service2_realm = service2_creds.get_realm() >+ service2_service = 'host' >+ service2_sname = self.PrincipalName_create( >+ name_type=NT_PRINCIPAL, names=[service2_service, >+ service2_name]) >+ service2_decryption_key = self.TicketDecryptionKey_from_creds( >+ service2_creds) >+ service2_etypes = service2_creds.tgs_supported_enctypes >+ >+ expected_error_mode = kdc_dict.pop('expected_error_mode') >+ expected_status = kdc_dict.pop('expected_status', None) >+ if expected_error_mode: >+ check_error_fn = self.generic_check_kdc_error >+ check_rep_fn = None >+ else: >+ check_error_fn = None >+ check_rep_fn = self.generic_check_kdc_rep >+ >+ self.assertIsNone(expected_status) >+ >+ expect_edata = kdc_dict.pop('expect_edata', None) >+ if expect_edata is not None: >+ self.assertTrue(expected_error_mode) >+ >+ pac_options = kdc_dict.pop('pac_options', None) >+ >+ authenticator_subkey = self.RandomKey(Enctype.AES256) >+ >+ etypes = kdc_dict.pop('etypes', (AES256_CTS_HMAC_SHA1_96, >+ ARCFOUR_HMAC_MD5)) >+ >+ expected_proxy_target = service2_creds.get_spn() >+ >+ expected_transited_services = kdc_dict.pop( >+ 'expected_transited_services', []) >+ >+ transited_service = f'host/{service1_name}@{service1_realm}' >+ expected_transited_services.append(transited_service) >+ >+ kdc_exchange_dict = self.tgs_exchange_dict( >+ expected_crealm=client_realm, >+ expected_cname=client_cname, >+ expected_srealm=service2_realm, >+ expected_sname=service2_sname, >+ expected_supported_etypes=service2_etypes, >+ ticket_decryption_key=service2_decryption_key, >+ check_error_fn=check_error_fn, >+ check_rep_fn=check_rep_fn, >+ check_kdc_private_fn=self.generic_check_kdc_private, >+ expected_error_mode=expected_error_mode, >+ expected_status=expected_status, >+ callback_dict={}, >+ tgt=service1_tgt, >+ authenticator_subkey=authenticator_subkey, >+ kdc_options=kdc_options, >+ pac_options=pac_options, >+ expect_edata=expect_edata, >+ expected_proxy_target=expected_proxy_target, >+ expected_transited_services=expected_transited_services) >+ >+ self._generic_kdc_exchange(kdc_exchange_dict, >+ cname=None, >+ realm=service2_realm, >+ sname=service2_sname, >+ etypes=etypes, >+ additional_tickets=additional_tickets) >+ >+ # Ensure we used all the parameters given to us. >+ self.assertEqual({}, kdc_dict) >+ >+ def test_constrained_delegation(self): >+ # Test constrained delegation. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': 0, >+ 'allow_delegation': True >+ }) >+ >+ def test_constrained_delegation_existing_delegation_info(self): >+ # Test constrained delegation with an existing S4U_DELEGATION_INFO >+ # structure in the PAC. >+ >+ services = ['service1', 'service2', 'service3'] >+ >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': 0, >+ 'allow_delegation': True, >+ 'modify_client_tkt_fn': functools.partial( >+ self.add_delegation_info, services=services), >+ 'expected_transited_services': services >+ }) >+ >+ def test_constrained_delegation_not_allowed(self): >+ # Test constrained delegation when the delegating service does not >+ # allow it. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_BADOPTION, >+ 'expected_status': ntstatus.NT_STATUS_NOT_SUPPORTED, >+ 'allow_delegation': False >+ }) >+ >+ def test_constrained_delegation_no_client_pac(self): >+ # Test constrained delegation when the client service ticket does not >+ # contain a PAC. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': (KDC_ERR_BADOPTION, >+ KDC_ERR_MODIFIED), >+ 'allow_delegation': True, >+ 'modify_client_tkt_fn': self.remove_ticket_pac, >+ 'expect_edata': False >+ }) >+ >+ def test_constrained_delegation_no_service_pac(self): >+ # Test constrained delegation when the service TGT does not contain a >+ # PAC. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': 0, >+ 'allow_delegation': True, >+ 'modify_service_tgt_fn': self.remove_ticket_pac >+ }) >+ >+ def test_constrained_delegation_non_forwardable(self): >+ # Test constrained delegation with a non-forwardable ticket. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_BADOPTION, >+ 'expected_status': ntstatus.NT_STATUS_ACCOUNT_RESTRICTION, >+ 'allow_delegation': True, >+ 'modify_client_tkt_fn': functools.partial( >+ self.set_ticket_forwardable, flag=False) >+ }) >+ >+ def test_constrained_delegation_pac_options_rbcd(self): >+ # Test constrained delegation, but with the RBCD bit set in the PAC >+ # options. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': 0, >+ 'pac_options': '0001', # supports RBCD >+ 'allow_delegation': True >+ }) >+ >+ def test_rbcd_existing_delegation_info(self): >+ # Test constrained delegation with an existing S4U_DELEGATION_INFO >+ # structure in the PAC. >+ >+ services = ['service1', 'service2', 'service3'] >+ >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': 0, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_client_tkt_fn': functools.partial( >+ self.add_delegation_info, services=services), >+ 'expected_transited_services': services >+ }) >+ >+ def test_rbcd_not_allowed(self): >+ # Test resource-based constrained delegation when the target service >+ # does not allow it. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_BADOPTION, >+ 'expected_status': ntstatus.NT_STATUS_NOT_FOUND, >+ 'allow_rbcd': False, >+ 'pac_options': '0001' # supports RBCD >+ }) >+ >+ def test_rbcd_no_client_pac_a(self): >+ # Test constrained delegation when the client service ticket does not >+ # contain a PAC, and an empty msDS-AllowedToDelegateTo attribute. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_MODIFIED, >+ 'expected_status': ntstatus.NT_STATUS_NOT_SUPPORTED, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_client_tkt_fn': self.remove_ticket_pac >+ }) >+ >+ def test_rbcd_no_client_pac_b(self): >+ # Test constrained delegation when the client service ticket does not >+ # contain a PAC, and a non-empty msDS-AllowedToDelegateTo attribute. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_MODIFIED, >+ 'expected_status': ntstatus.NT_STATUS_NO_MATCH, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_client_tkt_fn': self.remove_ticket_pac, >+ 'service1_opts': { >+ 'delegation_to_spn': ('host/test') >+ } >+ }) >+ >+ def test_rbcd_no_service_pac(self): >+ # Test constrained delegation when the service TGT does not contain a >+ # PAC. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_BADOPTION, >+ 'expected_status': >+ ntstatus.NT_STATUS_NOT_FOUND, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_service_tgt_fn': self.remove_ticket_pac >+ }) >+ >+ def test_rbcd_non_forwardable(self): >+ # Test resource-based constrained delegation with a non-forwardable >+ # ticket. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_BADOPTION, >+ 'expected_status': ntstatus.NT_STATUS_ACCOUNT_RESTRICTION, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_client_tkt_fn': functools.partial( >+ self.set_ticket_forwardable, flag=False) >+ }) >+ >+ def test_rbcd_no_pac_options_a(self): >+ # Test resource-based constrained delegation without the RBCD bit set >+ # in the PAC options, and an empty msDS-AllowedToDelegateTo attribute. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_BADOPTION, >+ 'expected_status': ntstatus.NT_STATUS_NOT_SUPPORTED, >+ 'allow_rbcd': True, >+ 'pac_options': '1' # does not support RBCD >+ }) >+ >+ def test_rbcd_no_pac_options_b(self): >+ # Test resource-based constrained delegation without the RBCD bit set >+ # in the PAC options, and a non-empty msDS-AllowedToDelegateTo >+ # attribute. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_BADOPTION, >+ 'expected_status': ntstatus.NT_STATUS_NO_MATCH, >+ 'allow_rbcd': True, >+ 'pac_options': '1', # does not support RBCD >+ 'service1_opts': { >+ 'delegation_to_spn': ('host/test') >+ } >+ }) >+ >+ def test_bronze_bit_constrained_delegation_old_checksum(self): >+ # Attempt to modify the ticket without updating the PAC checksums. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': (KDC_ERR_MODIFIED, >+ KDC_ERR_BAD_INTEGRITY), >+ 'allow_delegation': True, >+ 'client_tkt_options': '0', # non-forwardable ticket >+ 'modify_client_tkt_fn': functools.partial( >+ self.set_ticket_forwardable, >+ flag=True, update_pac_checksums=False), >+ 'expect_edata': False >+ }) >+ >+ def test_bronze_bit_rbcd_old_checksum(self): >+ # Attempt to modify the ticket without updating the PAC checksums. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_MODIFIED, >+ 'expected_status': ntstatus.NT_STATUS_NOT_SUPPORTED, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'client_tkt_options': '0', # non-forwardable ticket >+ 'modify_client_tkt_fn': functools.partial( >+ self.set_ticket_forwardable, >+ flag=True, update_pac_checksums=False) >+ }) >+ >+ def test_constrained_delegation_missing_client_checksum(self): >+ # Present a user ticket without the required checksums. >+ for checksum in self.pac_checksum_types: >+ with self.subTest(checksum=checksum): >+ if checksum == krb5pac.PAC_TYPE_TICKET_CHECKSUM: >+ expected_error_mode = (KDC_ERR_BADOPTION, >+ KDC_ERR_MODIFIED) >+ else: >+ expected_error_mode = KDC_ERR_GENERIC >+ >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': expected_error_mode, >+ 'allow_delegation': True, >+ 'modify_client_tkt_fn': functools.partial( >+ self.remove_pac_checksum, checksum=checksum), >+ 'expect_edata': False >+ }) >+ >+ def test_constrained_delegation_missing_service_checksum(self): >+ # Present the service's ticket without the required checksums. >+ for checksum in filter(lambda x: x != krb5pac.PAC_TYPE_TICKET_CHECKSUM, >+ self.pac_checksum_types): >+ with self.subTest(checksum=checksum): >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ 'expected_status': >+ ntstatus.NT_STATUS_INSUFFICIENT_RESOURCES, >+ 'allow_delegation': True, >+ 'modify_service_tgt_fn': functools.partial( >+ self.remove_pac_checksum, checksum=checksum) >+ }) >+ >+ def test_rbcd_missing_client_checksum(self): >+ # Present a user ticket without the required checksums. >+ for checksum in self.pac_checksum_types: >+ with self.subTest(checksum=checksum): >+ if checksum == krb5pac.PAC_TYPE_TICKET_CHECKSUM: >+ expected_error_mode = KDC_ERR_MODIFIED >+ else: >+ expected_error_mode = KDC_ERR_GENERIC >+ >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': expected_error_mode, >+ 'expected_status': >+ ntstatus.NT_STATUS_NOT_SUPPORTED, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_client_tkt_fn': functools.partial( >+ self.remove_pac_checksum, checksum=checksum) >+ }) >+ >+ def test_rbcd_missing_service_checksum(self): >+ # Present the service's ticket without the required checksums. >+ for checksum in filter(lambda x: x != krb5pac.PAC_TYPE_TICKET_CHECKSUM, >+ self.pac_checksum_types): >+ with self.subTest(checksum=checksum): >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_GENERIC, >+ 'expected_status': >+ ntstatus.NT_STATUS_INSUFFICIENT_RESOURCES, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_service_tgt_fn': functools.partial( >+ self.remove_pac_checksum, checksum=checksum) >+ }) >+ >+ def test_constrained_delegation_zeroed_client_checksum(self): >+ # Present a user ticket with invalid checksums. >+ for checksum in self.pac_checksum_types: >+ with self.subTest(checksum=checksum): >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': (KDC_ERR_MODIFIED, >+ KDC_ERR_BAD_INTEGRITY), >+ 'allow_delegation': True, >+ 'modify_client_tkt_fn': functools.partial( >+ self.zeroed_pac_checksum, checksum=checksum), >+ 'expect_edata': False >+ }) >+ >+ def test_constrained_delegation_zeroed_service_checksum(self): >+ # Present the service's ticket with invalid checksums. >+ for checksum in self.pac_checksum_types: >+ with self.subTest(checksum=checksum): >+ if checksum == krb5pac.PAC_TYPE_SRV_CHECKSUM: >+ expected_error_mode = (KDC_ERR_MODIFIED, >+ KDC_ERR_BAD_INTEGRITY) >+ expected_status = ntstatus.NT_STATUS_WRONG_PASSWORD >+ else: >+ expected_error_mode = 0 >+ expected_status = None >+ >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': expected_error_mode, >+ 'expected_status': expected_status, >+ 'allow_delegation': True, >+ 'modify_service_tgt_fn': functools.partial( >+ self.zeroed_pac_checksum, checksum=checksum) >+ }) >+ >+ def test_rbcd_zeroed_client_checksum(self): >+ # Present a user ticket with invalid checksums. >+ for checksum in self.pac_checksum_types: >+ with self.subTest(checksum=checksum): >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_MODIFIED, >+ 'expected_status': >+ ntstatus.NT_STATUS_NOT_SUPPORTED, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_client_tkt_fn': functools.partial( >+ self.zeroed_pac_checksum, checksum=checksum) >+ }) >+ >+ def test_rbcd_zeroed_service_checksum(self): >+ # Present the service's ticket with invalid checksums. >+ for checksum in self.pac_checksum_types: >+ with self.subTest(checksum=checksum): >+ if checksum == krb5pac.PAC_TYPE_SRV_CHECKSUM: >+ expected_error_mode = (KDC_ERR_MODIFIED, >+ KDC_ERR_BAD_INTEGRITY) >+ expected_status = ntstatus.NT_STATUS_WRONG_PASSWORD >+ else: >+ expected_error_mode = 0 >+ expected_status = None >+ >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': expected_error_mode, >+ 'expected_status': expected_status, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_service_tgt_fn': functools.partial( >+ self.zeroed_pac_checksum, checksum=checksum) >+ }) >+ >+ unkeyed_ctypes = {Cksumtype.MD5, Cksumtype.SHA1, Cksumtype.CRC32} >+ >+ def test_constrained_delegation_unkeyed_client_checksum(self): >+ # Present a user ticket with invalid checksums. >+ for checksum in self.pac_checksum_types: >+ for ctype in self.unkeyed_ctypes: >+ with self.subTest(checksum=checksum, ctype=ctype): >+ if (checksum == krb5pac.PAC_TYPE_SRV_CHECKSUM >+ and ctype == Cksumtype.SHA1): >+ expected_error_mode = (KDC_ERR_SUMTYPE_NOSUPP, >+ KDC_ERR_INAPP_CKSUM) >+ else: >+ expected_error_mode = (KDC_ERR_GENERIC, >+ KDC_ERR_INAPP_CKSUM) >+ >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': expected_error_mode, >+ 'allow_delegation': True, >+ 'modify_client_tkt_fn': functools.partial( >+ self.unkeyed_pac_checksum, >+ checksum=checksum, ctype=ctype), >+ 'expect_edata': False >+ }) >+ >+ def test_constrained_delegation_unkeyed_service_checksum(self): >+ # Present the service's ticket with invalid checksums. >+ for checksum in self.pac_checksum_types: >+ for ctype in self.unkeyed_ctypes: >+ with self.subTest(checksum=checksum, ctype=ctype): >+ if checksum == krb5pac.PAC_TYPE_SRV_CHECKSUM: >+ if ctype == Cksumtype.SHA1: >+ expected_error_mode = (KDC_ERR_SUMTYPE_NOSUPP, >+ KDC_ERR_INAPP_CKSUM) >+ expected_status = ntstatus.NT_STATUS_LOGON_FAILURE >+ else: >+ expected_error_mode = (KDC_ERR_GENERIC, >+ KDC_ERR_INAPP_CKSUM) >+ expected_status = ( >+ ntstatus.NT_STATUS_INSUFFICIENT_RESOURCES) >+ else: >+ expected_error_mode = 0 >+ expected_status = None >+ >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': expected_error_mode, >+ 'expected_status': expected_status, >+ 'allow_delegation': True, >+ 'modify_service_tgt_fn': functools.partial( >+ self.unkeyed_pac_checksum, >+ checksum=checksum, ctype=ctype) >+ }) >+ >+ def test_rbcd_unkeyed_client_checksum(self): >+ # Present a user ticket with invalid checksums. >+ for checksum in self.pac_checksum_types: >+ for ctype in self.unkeyed_ctypes: >+ with self.subTest(checksum=checksum, ctype=ctype): >+ if (checksum == krb5pac.PAC_TYPE_SRV_CHECKSUM >+ and ctype == Cksumtype.SHA1): >+ expected_error_mode = KDC_ERR_SUMTYPE_NOSUPP >+ else: >+ expected_error_mode = KDC_ERR_GENERIC >+ >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': expected_error_mode, >+ 'expected_status': >+ ntstatus.NT_STATUS_NOT_SUPPORTED, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_client_tkt_fn': functools.partial( >+ self.unkeyed_pac_checksum, >+ checksum=checksum, ctype=ctype) >+ }) >+ >+ def test_rbcd_unkeyed_service_checksum(self): >+ # Present the service's ticket with invalid checksums. >+ for checksum in self.pac_checksum_types: >+ for ctype in self.unkeyed_ctypes: >+ with self.subTest(checksum=checksum, ctype=ctype): >+ if checksum == krb5pac.PAC_TYPE_SRV_CHECKSUM: >+ if ctype == Cksumtype.SHA1: >+ expected_error_mode = (KDC_ERR_SUMTYPE_NOSUPP, >+ KDC_ERR_BAD_INTEGRITY) >+ expected_status = ntstatus.NT_STATUS_LOGON_FAILURE >+ else: >+ expected_error_mode = KDC_ERR_GENERIC >+ expected_status = ( >+ ntstatus.NT_STATUS_INSUFFICIENT_RESOURCES) >+ else: >+ expected_error_mode = 0 >+ expected_status = None >+ >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': expected_error_mode, >+ 'expected_status': expected_status, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_service_tgt_fn': functools.partial( >+ self.unkeyed_pac_checksum, >+ checksum=checksum, ctype=ctype) >+ }) >+ >+ def remove_pac_checksum(self, ticket, checksum): >+ checksum_keys = self.get_krbtgt_checksum_key() >+ >+ return self.modified_ticket(ticket, >+ checksum_keys=checksum_keys, >+ include_checksums={checksum: False}) >+ >+ def zeroed_pac_checksum(self, ticket, checksum): >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_key = self.TicketDecryptionKey_from_creds(krbtgt_creds) >+ >+ server_key = ticket.decryption_key >+ >+ checksum_keys = { >+ krb5pac.PAC_TYPE_SRV_CHECKSUM: server_key, >+ krb5pac.PAC_TYPE_KDC_CHECKSUM: krbtgt_key, >+ krb5pac.PAC_TYPE_TICKET_CHECKSUM: krbtgt_key, >+ } >+ >+ if checksum == krb5pac.PAC_TYPE_SRV_CHECKSUM: >+ zeroed_key = server_key >+ else: >+ zeroed_key = krbtgt_key >+ >+ checksum_keys[checksum] = ZeroedChecksumKey(zeroed_key.key, >+ zeroed_key.kvno) >+ >+ return self.modified_ticket(ticket, >+ checksum_keys=checksum_keys, >+ include_checksums={checksum: True}) >+ >+ def unkeyed_pac_checksum(self, ticket, checksum, ctype): >+ krbtgt_creds = self.get_krbtgt_creds() >+ krbtgt_key = self.TicketDecryptionKey_from_creds(krbtgt_creds) >+ >+ server_key = ticket.decryption_key >+ >+ checksum_keys = { >+ krb5pac.PAC_TYPE_SRV_CHECKSUM: server_key, >+ krb5pac.PAC_TYPE_KDC_CHECKSUM: krbtgt_key, >+ krb5pac.PAC_TYPE_TICKET_CHECKSUM: krbtgt_key, >+ } >+ >+ # Make a copy of the existing key and change the ctype. >+ key = checksum_keys[checksum] >+ new_key = RodcPacEncryptionKey(key.key, key.kvno) >+ new_key.ctype = ctype >+ checksum_keys[checksum] = new_key >+ >+ return self.modified_ticket(ticket, >+ checksum_keys=checksum_keys, >+ include_checksums={checksum: True}) >+ >+ def add_delegation_info(self, ticket, services=None): >+ def modify_pac_fn(pac): >+ pac_buffers = pac.buffers >+ self.assertNotIn(krb5pac.PAC_TYPE_CONSTRAINED_DELEGATION, >+ (buffer.type for buffer in pac_buffers)) >+ >+ transited_services = list(map(lsa.String, services)) >+ >+ delegation = krb5pac.PAC_CONSTRAINED_DELEGATION() >+ delegation.proxy_target = lsa.String('test_proxy_target') >+ delegation.transited_services = transited_services >+ delegation.num_transited_services = len(transited_services) >+ >+ info = krb5pac.PAC_CONSTRAINED_DELEGATION_CTR() >+ info.info = delegation >+ >+ pac_buffer = krb5pac.PAC_BUFFER() >+ pac_buffer.type = krb5pac.PAC_TYPE_CONSTRAINED_DELEGATION >+ pac_buffer.info = info >+ >+ pac_buffers.append(pac_buffer) >+ >+ pac.buffers = pac_buffers >+ pac.num_buffers += 1 >+ >+ return pac >+ >+ checksum_keys = self.get_krbtgt_checksum_key() >+ >+ return self.modified_ticket(ticket, >+ checksum_keys=checksum_keys, >+ modify_pac_fn=modify_pac_fn) >+ >+ def set_ticket_forwardable(self, ticket, flag, update_pac_checksums=True): >+ flag = '1' if flag else '0' >+ >+ def modify_fn(enc_part): >+ # Reset the forwardable flag >+ forwardable_pos = (len(tuple(krb5_asn1.TicketFlags('forwardable'))) >+ - 1) >+ >+ flags = enc_part['flags'] >+ self.assertLessEqual(forwardable_pos, len(flags)) >+ enc_part['flags'] = (flags[:forwardable_pos] + >+ flag + >+ flags[forwardable_pos+1:]) >+ >+ return enc_part >+ >+ if update_pac_checksums: >+ checksum_keys = self.get_krbtgt_checksum_key() >+ else: >+ checksum_keys = None >+ >+ return self.modified_ticket(ticket, >+ modify_fn=modify_fn, >+ checksum_keys=checksum_keys, >+ update_pac_checksums=update_pac_checksums) >+ >+ def remove_ticket_pac(self, ticket): >+ return self.modified_ticket(ticket, >+ exclude_pac=True) >+ > > if __name__ == "__main__": > global_asn1_print = False >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index 29990ec9511..e1711b532d7 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -102,6 +102,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py', > 'python/samba/tests/krb5/as_req_tests.py', > 'python/samba/tests/krb5/fast_tests.py', >+ 'python/samba/tests/krb5/rodc_tests.py', > } > > EXCLUDE_HELP = { >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 6eb667f8969..0b8e83f1f3f 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -125,3 +125,32 @@ > # Heimdal currently does not generate ticket signatures > # > ^samba.tests.krb5.compatability_tests.samba.tests.krb5.compatability_tests.SimpleKerberosTests.test_heimdal_ticket_signature >+# >+# S4U tests >+# >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_bronze_bit_rbcd_old_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_missing_client_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_unkeyed_client_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_unkeyed_service_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_zeroed_client_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_zeroed_service_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_existing_delegation_info >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_missing_client_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_client_pac_a >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_client_pac_b >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_unkeyed_client_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_unkeyed_service_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_client_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_service_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_client_not_delegated >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_forwardable >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_nonempty_allowed >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_trusted_empty_allowed >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_trusted_nonempty_allowed >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_without_forwardable >+# >+# RODC tests >+# >+^samba.tests.krb5.rodc_tests.samba.tests.krb5.rodc_tests.RodcKerberosTests.test_rodc_ticket_signature >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 2fa725e837c..1f8554155bf 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -750,9 +750,16 @@ planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.simple_tests", > 'FAST_SUPPORT': have_fast_support, > 'TKT_SIG_SUPPORT': tkt_sig_support}) > planoldpythontestsuite("ad_dc_default:local", "samba.tests.krb5.s4u_tests", >- environ={'SERVICE_USERNAME':'srv_account', >- 'SERVICE_PASSWORD':'$PASSWORD', >+ environ={'ADMIN_USERNAME':'$USERNAME', >+ 'ADMIN_PASSWORD':'$PASSWORD', > 'FOR_USER':'$USERNAME', >+ 'STRICT_CHECKING':'0', >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support}) >+planoldpythontestsuite("rodc:local", "samba.tests.krb5.rodc_tests", >+ environ={'ADMIN_USERNAME':'$USERNAME', >+ 'ADMIN_PASSWORD':'$PASSWORD', >+ 'STRICT_CHECKING':'0', > 'FAST_SUPPORT': have_fast_support, > 'TKT_SIG_SUPPORT': tkt_sig_support}) > >-- >2.25.1 > > >From b3221bf28a95469874ed686317627f4703cfcc41 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 29 Sep 2021 12:07:40 +1300 >Subject: [PATCH 340/380] tests/krb5: Don't include empty AD-IF-RELEVANT > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 1a08399cd8169a525cc9e7aed99da84ef20e5b9c) >--- > python/samba/tests/krb5/raw_testcase.py | 19 ++++++++++++------- > 1 file changed, 12 insertions(+), 7 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 2e289c90ce7..e008223eb23 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -3424,14 +3424,19 @@ class RawKerberosTest(TestCaseInTempDir): > if expect_pac: > self.assertIsNotNone(old_pac, 'Expected PAC') > >- ad_relevant = self.der_encode( >- relevant_elems, >- asn1Spec=krb5_asn1.AD_IF_RELEVANT()) >- >- authdata_elem = self.AuthorizationData_create(AD_IF_RELEVANT, >- ad_relevant) >+ if relevant_elems: >+ ad_relevant = self.der_encode( >+ relevant_elems, >+ asn1Spec=krb5_asn1.AD_IF_RELEVANT()) >+ >+ authdata_elem = self.AuthorizationData_create( >+ AD_IF_RELEVANT, >+ ad_relevant) >+ else: >+ authdata_elem = None > >- new_auth_data.append(authdata_elem) >+ if authdata_elem is not None: >+ new_auth_data.append(authdata_elem) > > if expect_pac: > self.assertIsNotNone(ad_relevant, 'Expected AD-RELEVANT') >-- >2.25.1 > > >From 8ec61d94726f38a11cd6e43deec25154dcdeaaba Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 8 Oct 2021 15:41:35 +1300 >Subject: [PATCH 341/380] tests/krb5: Allow bypassing cache when creating > accounts > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 3948701f1d0f3ccd06f6dad56ca72833d66b1d84) >--- > python/samba/tests/krb5/kdc_base_test.py | 13 +++++++++---- > 1 file changed, 9 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 8a5e12bbed4..87160f675ae 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -610,7 +610,8 @@ class KDCBaseTest(RawKerberosTest): > > def get_cached_creds(self, *, > machine_account, >- opts=None): >+ opts=None, >+ use_cache=True): > if opts is None: > opts = {} > >@@ -638,9 +639,13 @@ class KDCBaseTest(RawKerberosTest): > > cache_key = tuple(sorted(account_opts.items())) > >- creds = self.account_cache.get(cache_key) >- if creds is None: >- creds = self.create_account_opts(**account_opts) >+ if use_cache: >+ creds = self.account_cache.get(cache_key) >+ if creds is not None: >+ return creds >+ >+ creds = self.create_account_opts(**account_opts) >+ if use_cache: > self.account_cache[cache_key] = creds > > return creds >-- >2.25.1 > > >From 75a52e91cd921d37080f3a42e70470c7deb2d09f Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 8 Oct 2021 15:40:39 +1300 >Subject: [PATCH 342/380] tests/krb5: Fix duplicate account creation > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 3dede18c5a1801023a60cc55b99022b033428350) >--- > .../krb5/ms_kile_client_principal_lookup_tests.py | 13 +++++-------- > 1 file changed, 5 insertions(+), 8 deletions(-) > >diff --git a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >index 501bc4892f4..2ee3d4a2a83 100755 >--- a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >+++ b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >@@ -150,18 +150,15 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > # Create a machine account for the test. > # > samdb = self.get_samdb() >- user_name = "mskilemac" >- (mc, dn) = self.create_account(samdb, user_name, machine_account=True) >- realm = mc.get_realm().lower() >- > mach_name = "mskilemac" >- (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, dn) = self.create_account(samdb, mach_name, machine_account=True) >+ realm = mc.get_realm().lower() > > # Do the initial AS-REQ, should get a pre-authentication required > # response > etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) > cname = self.PrincipalName_create( >- name_type=NT_PRINCIPAL, names=[user_name]) >+ name_type=NT_PRINCIPAL, names=[mach_name]) > sname = self.PrincipalName_create( > name_type=NT_SRV_INST, names=["krbtgt", realm]) > >@@ -180,7 +177,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > key = self.EncryptionKey_import(enc_part2['key']) > cname = self.PrincipalName_create( > name_type=NT_PRINCIPAL, >- names=[user_name]) >+ names=[mach_name]) > sname = self.PrincipalName_create( > name_type=NT_PRINCIPAL, > names=[mc.get_username()]) >@@ -197,7 +194,7 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > # check the crealm and cname > cname = enc_part['cname'] > self.assertEqual(NT_PRINCIPAL, cname['name-type']) >- self.assertEqual(user_name.encode('UTF8'), cname['name-string'][0]) >+ self.assertEqual(mach_name.encode('UTF8'), cname['name-string'][0]) > self.assertEqual(realm.upper().encode('UTF8'), enc_part['crealm']) > > def test_nt_principal_step_3(self): >-- >2.25.1 > > >From c2334ae43d6832403a2c589f6f1aa16b8ed0386e Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 8 Oct 2021 16:06:58 +1300 >Subject: [PATCH 343/380] s4:kdc: Simplify samba_kdc_update_pac_blob() to take > ldb_context as parameter > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 7149eeaceb426470b1b8181749d2d081c2fb83a4) >--- > source4/kdc/mit_samba.c | 7 +------ > source4/kdc/pac-glue.c | 5 ++--- > source4/kdc/pac-glue.h | 3 +-- > source4/kdc/wdc-samba4.c | 2 +- > 4 files changed, 5 insertions(+), 12 deletions(-) > >diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c >index 54dcd545ea1..2936fe2d18a 100644 >--- a/source4/kdc/mit_samba.c >+++ b/source4/kdc/mit_samba.c >@@ -482,7 +482,6 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, > DATA_BLOB *deleg_blob = NULL; > struct samba_kdc_entry *client_skdc_entry = NULL; > struct samba_kdc_entry *krbtgt_skdc_entry = NULL; >- struct samba_kdc_entry *server_skdc_entry = NULL; > bool is_in_db = false; > bool is_untrusted = false; > size_t num_types = 0; >@@ -513,9 +512,6 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, > if (server == NULL) { > return EINVAL; > } >- server_skdc_entry = >- talloc_get_type_abort(server->e_data, >- struct samba_kdc_entry); > > if (krbtgt == NULL) { > return EINVAL; >@@ -575,8 +571,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, > > nt_status = samba_kdc_update_pac_blob(tmp_ctx, > context, >- krbtgt_skdc_entry, >- server_skdc_entry, >+ krbtgt_skdc_entry->kdc_db_ctx->samdb, > *pac, > pac_blob, > pac_srv_sig, >diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c >index 04fbc5cf487..88bcb734fc5 100644 >--- a/source4/kdc/pac-glue.c >+++ b/source4/kdc/pac-glue.c >@@ -747,8 +747,7 @@ NTSTATUS samba_kdc_get_pac_blob(TALLOC_CTX *mem_ctx, > > NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx, > krb5_context context, >- struct samba_kdc_entry *krbtgt, >- struct samba_kdc_entry *server, >+ struct ldb_context *samdb, > const krb5_pac pac, DATA_BLOB *pac_blob, > struct PAC_SIGNATURE_DATA *pac_srv_sig, > struct PAC_SIGNATURE_DATA *pac_kdc_sig) >@@ -768,7 +767,7 @@ NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx, > * as the token might be generated by a trusted domain. > */ > nt_status = authsam_update_user_info_dc(mem_ctx, >- krbtgt->kdc_db_ctx->samdb, >+ samdb, > user_info_dc); > if (!NT_STATUS_IS_OK(nt_status)) { > return nt_status; >diff --git a/source4/kdc/pac-glue.h b/source4/kdc/pac-glue.h >index 2eb7fd3b755..7b51b0389f5 100644 >--- a/source4/kdc/pac-glue.h >+++ b/source4/kdc/pac-glue.h >@@ -51,8 +51,7 @@ NTSTATUS samba_kdc_get_pac_blob(TALLOC_CTX *mem_ctx, > > NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx, > krb5_context context, >- struct samba_kdc_entry *krbtgt, >- struct samba_kdc_entry *server, >+ struct ldb_context *samdb, > const krb5_pac pac, DATA_BLOB *pac_blob, > struct PAC_SIGNATURE_DATA *pac_srv_sig, > struct PAC_SIGNATURE_DATA *pac_kdc_sig); >diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c >index a7d8de1f417..68c8a8aa572 100644 >--- a/source4/kdc/wdc-samba4.c >+++ b/source4/kdc/wdc-samba4.c >@@ -186,7 +186,7 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > } > > nt_status = samba_kdc_update_pac_blob(mem_ctx, context, >- krbtgt_skdc_entry, p, >+ krbtgt_skdc_entry->kdc_db_ctx->samdb, > *pac, pac_blob, > pac_srv_sig, pac_kdc_sig); > if (!NT_STATUS_IS_OK(nt_status)) { >-- >2.25.1 > > >From b98af3f6a926f64e8f1ffee4223fae1bbb77b70a Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 6 Oct 2021 16:40:21 +1300 >Subject: [PATCH 344/380] s4:kdc: Fix debugging messages > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit c14c61748b5a2d2a4f4de00615c476fcf381309e) >--- > source4/kdc/wdc-samba4.c | 48 ++++++++++++++++++++-------------------- > 1 file changed, 24 insertions(+), 24 deletions(-) > >diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c >index 68c8a8aa572..037db40ce46 100644 >--- a/source4/kdc/wdc-samba4.c >+++ b/source4/kdc/wdc-samba4.c >@@ -238,10 +238,10 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > switch (types[i]) { > case PAC_TYPE_LOGON_INFO: > if (logon_info_idx != -1) { >- DEBUG(1, ("logon type[%d] twice [%d] and [%d]: \n", >- (int)types[i], >- (int)logon_info_idx, >- (int)i)); >+ DEBUG(1, ("logon info type[%"PRIu32"] twice [%zd] and [%zu]: \n", >+ types[i], >+ logon_info_idx, >+ i)); > SAFE_FREE(types); > talloc_free(mem_ctx); > return EINVAL; >@@ -250,10 +250,10 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > break; > case PAC_TYPE_CONSTRAINED_DELEGATION: > if (delegation_idx != -1) { >- DEBUG(1, ("logon type[%d] twice [%d] and [%d]: \n", >- (int)types[i], >- (int)logon_info_idx, >- (int)i)); >+ DEBUG(1, ("constrained delegation type[%"PRIu32"] twice [%zd] and [%zu]: \n", >+ types[i], >+ delegation_idx, >+ i)); > SAFE_FREE(types); > talloc_free(mem_ctx); > return EINVAL; >@@ -262,10 +262,10 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > break; > case PAC_TYPE_LOGON_NAME: > if (logon_name_idx != -1) { >- DEBUG(1, ("logon type[%d] twice [%d] and [%d]: \n", >- (int)types[i], >- (int)logon_info_idx, >- (int)i)); >+ DEBUG(1, ("logon name type[%"PRIu32"] twice [%zd] and [%zu]: \n", >+ types[i], >+ logon_name_idx, >+ i)); > SAFE_FREE(types); > talloc_free(mem_ctx); > return EINVAL; >@@ -274,10 +274,10 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > break; > case PAC_TYPE_UPN_DNS_INFO: > if (upn_dns_info_idx != -1) { >- DEBUG(1, ("logon type[%d] twice [%d] and [%d]: \n", >- (int)types[i], >- (int)logon_info_idx, >- (int)i)); >+ DEBUG(1, ("upn dns info type[%"PRIu32"] twice [%zd] and [%zu]: \n", >+ types[i], >+ upn_dns_info_idx, >+ i)); > SAFE_FREE(types); > talloc_free(mem_ctx); > return EINVAL; >@@ -286,10 +286,10 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > break; > case PAC_TYPE_SRV_CHECKSUM: > if (srv_checksum_idx != -1) { >- DEBUG(1, ("logon type[%d] twice [%d] and [%d]: \n", >- (int)types[i], >- (int)logon_info_idx, >- (int)i)); >+ DEBUG(1, ("server checksum type[%"PRIu32"] twice [%zd] and [%zu]: \n", >+ types[i], >+ srv_checksum_idx, >+ i)); > SAFE_FREE(types); > talloc_free(mem_ctx); > return EINVAL; >@@ -298,10 +298,10 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > break; > case PAC_TYPE_KDC_CHECKSUM: > if (kdc_checksum_idx != -1) { >- DEBUG(1, ("logon type[%d] twice [%d] and [%d]: \n", >- (int)types[i], >- (int)logon_info_idx, >- (int)i)); >+ DEBUG(1, ("kdc checksum type[%"PRIu32"] twice [%zd] and [%zu]: \n", >+ types[i], >+ kdc_checksum_idx, >+ i)); > SAFE_FREE(types); > talloc_free(mem_ctx); > return EINVAL; >-- >2.25.1 > > >From 2eb8aa96ad3f2fb16f0986d04d185e08ee5e1d9f Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 8 Oct 2021 15:42:29 +1300 >Subject: [PATCH 345/380] s4/torture: Expect ticket checksum PAC buffer > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >[abartlet@samba.org backported from commit d5002c34ce1ffef795dc83af3175ca0e04d17dfd > due to missing tests in Samba 4.14 that crashed the MIT KDC] >--- > selftest/knownfail_heimdal_kdc | 41 ++++++++++++++++++++++++++++++++ > selftest/knownfail_mit_kdc | 41 ++++++++++++++++++++++++++++++++ > source4/torture/rpc/remote_pac.c | 14 +++++++++-- > 3 files changed, 94 insertions(+), 2 deletions(-) > >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 0b8e83f1f3f..31572067ad4 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -154,3 +154,44 @@ > # RODC tests > # > ^samba.tests.krb5.rodc_tests.samba.tests.krb5.rodc_tests.RodcKerberosTests.test_rodc_ticket_signature >+# >+# PAC tests >+# >+^netr-bdc-arcfour.verify-sig-arcfour >+^netr-bdc-arcfour.verify-sig-arcfour >+^samba4.blackbox.pkinit_pac.STEP1 remote.pac verification.ad_dc:local >+^samba4.blackbox.pkinit_pac.STEP1 remote.pac verification.ad_dc_ntvfs:local >+^samba4.blackbox.pkinit_pac.netr-bdc-aes.verify-sig-aes.ad_dc:local >+^samba4.blackbox.pkinit_pac.netr-bdc-aes.verify-sig-aes.ad_dc_ntvfs:local >+^samba4.blackbox.pkinit_pac.netr-mem-aes.s4u2proxy-aes.ad_dc:local >+^samba4.blackbox.pkinit_pac.netr-mem-aes.s4u2proxy-aes.ad_dc_ntvfs:local >+^samba4.blackbox.pkinit_pac.netr-mem-aes.verify-sig-aes.ad_dc:local >+^samba4.blackbox.pkinit_pac.netr-mem-aes.verify-sig-aes.ad_dc_ntvfs:local >+^samba4.blackbox.pkinit_pac.netr-mem-arcfour.s4u2proxy-arcfour.ad_dc:local >+^samba4.blackbox.pkinit_pac.netr-mem-arcfour.s4u2proxy-arcfour.ad_dc_ntvfs:local >+^samba4.blackbox.pkinit_pac.netr-mem-arcfour.verify-sig-arcfour.ad_dc:local >+^samba4.blackbox.pkinit_pac.netr-mem-arcfour.verify-sig-arcfour.ad_dc_ntvfs:local >+^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2008r2dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2008r2dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2008r2dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2008r2dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2008r2dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008r2dc >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 4e0b20c5c80..09efbc7b590 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -329,3 +329,44 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_fast_no_etypes.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_sname.ad_dc >+# >+# PAC tests >+# >+^netr-bdc-arcfour.verify-sig-arcfour >+^netr-bdc-arcfour.verify-sig-arcfour >+^samba4.blackbox.pkinit_pac.STEP1 remote.pac verification.ad_dc:local >+^samba4.blackbox.pkinit_pac.STEP1 remote.pac verification.ad_dc_ntvfs:local >+^samba4.blackbox.pkinit_pac.netr-bdc-aes.verify-sig-aes.ad_dc:local >+^samba4.blackbox.pkinit_pac.netr-bdc-aes.verify-sig-aes.ad_dc_ntvfs:local >+^samba4.blackbox.pkinit_pac.netr-mem-aes.s4u2proxy-aes.ad_dc:local >+^samba4.blackbox.pkinit_pac.netr-mem-aes.s4u2proxy-aes.ad_dc_ntvfs:local >+^samba4.blackbox.pkinit_pac.netr-mem-aes.verify-sig-aes.ad_dc:local >+^samba4.blackbox.pkinit_pac.netr-mem-aes.verify-sig-aes.ad_dc_ntvfs:local >+^samba4.blackbox.pkinit_pac.netr-mem-arcfour.s4u2proxy-arcfour.ad_dc:local >+^samba4.blackbox.pkinit_pac.netr-mem-arcfour.s4u2proxy-arcfour.ad_dc_ntvfs:local >+^samba4.blackbox.pkinit_pac.netr-mem-arcfour.verify-sig-arcfour.ad_dc:local >+^samba4.blackbox.pkinit_pac.netr-mem-arcfour.verify-sig-arcfour.ad_dc_ntvfs:local >+^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2008r2dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2008r2dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2008r2dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2008r2dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2008r2dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2000dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2003dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008dc >+^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008r2dc >diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c >index c74746123fe..14c23f674f1 100644 >--- a/source4/torture/rpc/remote_pac.c >+++ b/source4/torture/rpc/remote_pac.c >@@ -266,7 +266,7 @@ static bool test_PACVerify(struct torture_context *tctx, > (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA); > torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_pull_struct_blob of PAC_DATA structure failed"); > >- num_pac_buffers = 4; >+ num_pac_buffers = 5; > if (expect_pac_upn_dns_info) { > num_pac_buffers += 1; > } >@@ -317,6 +317,12 @@ static bool test_PACVerify(struct torture_context *tctx, > pac_buf->info != NULL, > "PAC_TYPE_KDC_CHECKSUM info"); > >+ pac_buf = get_pac_buffer(&pac_data_struct, PAC_TYPE_TICKET_CHECKSUM); >+ torture_assert_not_null(tctx, pac_buf, "PAC_TYPE_TICKET_CHECKSUM"); >+ torture_assert(tctx, >+ pac_buf->info != NULL, >+ "PAC_TYPE_TICKET_CHECKSUM info"); >+ > ok = netlogon_validate_pac(tctx, p, server_creds, secure_channel_type, test_machine_name, > negotiate_flags, pac_data, session_info); > >@@ -1076,7 +1082,7 @@ static bool test_S4U2Proxy(struct torture_context *tctx, > (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA); > torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_pull_struct_blob of PAC_DATA structure failed"); > >- num_pac_buffers = 6; >+ num_pac_buffers = 7; > > torture_assert_int_equal(tctx, pac_data_struct.version, 0, "version"); > torture_assert_int_equal(tctx, pac_data_struct.num_buffers, num_pac_buffers, "num_buffers"); >@@ -1101,6 +1107,10 @@ static bool test_S4U2Proxy(struct torture_context *tctx, > torture_assert_not_null(tctx, pac_buf, "PAC_TYPE_KDC_CHECKSUM"); > torture_assert_not_null(tctx, pac_buf->info, "PAC_TYPE_KDC_CHECKSUM info"); > >+ pac_buf = get_pac_buffer(&pac_data_struct, PAC_TYPE_TICKET_CHECKSUM); >+ torture_assert_not_null(tctx, pac_buf, "PAC_TYPE_TICKET_CHECKSUM"); >+ torture_assert_not_null(tctx, pac_buf->info, "PAC_TYPE_TICKET_CHECKSUM info"); >+ > pac_buf = get_pac_buffer(&pac_data_struct, PAC_TYPE_CONSTRAINED_DELEGATION); > torture_assert_not_null(tctx, pac_buf, "PAC_TYPE_CONSTRAINED_DELEGATION"); > torture_assert_not_null(tctx, pac_buf->info, "PAC_TYPE_CONSTRAINED_DELEGATION info"); >-- >2.25.1 > > >From c75676e7dfe36052605af19fcf33dc4c9b5d066a Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Mon, 28 Dec 2020 22:07:10 +0200 >Subject: [PATCH 346/380] kdc: remove KRB5SignedPath, to be replaced with PAC > >KRB5SignedPath was a Heimdal-specific authorization data element used to >protect the authenticity of evidence tickets when used in constrained >delegation (without a Windows PAC). > >Remove this, to be replaced with the Windows PAC which itself now supports >signing the entire ticket in the TGS key. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >[jsutton@samba.org Backported from Heimdal commit > bb1d8f2a8c2545bccdf2c9179ce9259bf1050086 > - Removed tests > - Removed auditing hook (only present in Heimdal master) > - Added knownfails >] > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit ccabc7f16cca5b0dcb46233e934e708167f1071b) >--- > selftest/knownfail_heimdal_kdc | 6 + > source4/heimdal/kdc/kerberos5.c | 12 -- > source4/heimdal/kdc/krb5tgs.c | 297 ----------------------------- > source4/heimdal/lib/asn1/krb5.asn1 | 21 -- > 4 files changed, 6 insertions(+), 330 deletions(-) > >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 31572067ad4..f0263133eee 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -130,6 +130,7 @@ > # > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_bronze_bit_rbcd_old_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_missing_client_checksum >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_service_pac > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_unkeyed_client_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_unkeyed_service_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_zeroed_client_checksum >@@ -195,3 +196,8 @@ > ^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2003dc > ^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008dc > ^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008r2dc >+# >+# The lack of KRB5SignedPath means we no longer return >+# KRB5KRB_ERR_RESPONSE_TOO_BIG in this specific case >+# >+^samba4.krb5.kdc with machine account.as-req-pac-request.fl2000dc:local >diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c >index 0fa336e871c..a400b21a652 100644 >--- a/source4/heimdal/kdc/kerberos5.c >+++ b/source4/heimdal/kdc/kerberos5.c >@@ -1744,18 +1744,6 @@ _kdc_as_rep(krb5_context context, > _kdc_log_timestamp(context, config, "AS-REQ", et.authtime, et.starttime, > et.endtime, et.renew_till); > >- /* do this as the last thing since this signs the EncTicketPart */ >- ret = _kdc_add_KRB5SignedPath(context, >- config, >- server, >- setype, >- client->entry.principal, >- NULL, >- NULL, >- &et); >- if (ret) >- goto out; >- > log_as_req(context, config, reply_key->keytype, setype, b); > > ret = _kdc_encode_reply(context, config, >diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c >index ef337ea4faf..fcdebede3a9 100644 >--- a/source4/heimdal/kdc/krb5tgs.c >+++ b/source4/heimdal/kdc/krb5tgs.c >@@ -47,230 +47,6 @@ get_krbtgt_realm(const PrincipalName *p) > return NULL; > } > >-/* >- * The KDC might add a signed path to the ticket authorization data >- * field. This is to avoid server impersonating clients and the >- * request constrained delegation. >- * >- * This is done by storing a KRB5_AUTHDATA_IF_RELEVANT with a single >- * entry of type KRB5SignedPath. >- */ >- >-static krb5_error_code >-find_KRB5SignedPath(krb5_context context, >- const AuthorizationData *ad, >- krb5_data *data) >-{ >- AuthorizationData child; >- krb5_error_code ret; >- int pos; >- >- if (ad == NULL || ad->len == 0) >- return KRB5KDC_ERR_PADATA_TYPE_NOSUPP; >- >- pos = ad->len - 1; >- >- if (ad->val[pos].ad_type != KRB5_AUTHDATA_IF_RELEVANT) >- return KRB5KDC_ERR_PADATA_TYPE_NOSUPP; >- >- ret = decode_AuthorizationData(ad->val[pos].ad_data.data, >- ad->val[pos].ad_data.length, >- &child, >- NULL); >- if (ret) { >- krb5_set_error_message(context, ret, "Failed to decode " >- "IF_RELEVANT with %d", ret); >- return ret; >- } >- >- if (child.len != 1) { >- free_AuthorizationData(&child); >- return KRB5KDC_ERR_PADATA_TYPE_NOSUPP; >- } >- >- if (child.val[0].ad_type != KRB5_AUTHDATA_SIGNTICKET) { >- free_AuthorizationData(&child); >- return KRB5KDC_ERR_PADATA_TYPE_NOSUPP; >- } >- >- if (data) >- ret = der_copy_octet_string(&child.val[0].ad_data, data); >- free_AuthorizationData(&child); >- return ret; >-} >- >-krb5_error_code >-_kdc_add_KRB5SignedPath(krb5_context context, >- krb5_kdc_configuration *config, >- hdb_entry_ex *krbtgt, >- krb5_enctype enctype, >- krb5_principal client, >- krb5_const_principal server, >- krb5_principals principals, >- EncTicketPart *tkt) >-{ >- krb5_error_code ret; >- KRB5SignedPath sp; >- krb5_data data; >- krb5_crypto crypto = NULL; >- size_t size = 0; >- >- if (server && principals) { >- ret = add_Principals(principals, server); >- if (ret) >- return ret; >- } >- >- { >- KRB5SignedPathData spd; >- >- spd.client = client; >- spd.authtime = tkt->authtime; >- spd.delegated = principals; >- spd.method_data = NULL; >- >- ASN1_MALLOC_ENCODE(KRB5SignedPathData, data.data, data.length, >- &spd, &size, ret); >- if (ret) >- return ret; >- if (data.length != size) >- krb5_abortx(context, "internal asn.1 encoder error"); >- } >- >- { >- Key *key; >- ret = hdb_enctype2key(context, &krbtgt->entry, enctype, &key); >- if (ret == 0) >- ret = krb5_crypto_init(context, &key->key, 0, &crypto); >- if (ret) { >- free(data.data); >- return ret; >- } >- } >- >- /* >- * Fill in KRB5SignedPath >- */ >- >- sp.etype = enctype; >- sp.delegated = principals; >- sp.method_data = NULL; >- >- ret = krb5_create_checksum(context, crypto, KRB5_KU_KRB5SIGNEDPATH, 0, >- data.data, data.length, &sp.cksum); >- krb5_crypto_destroy(context, crypto); >- free(data.data); >- if (ret) >- return ret; >- >- ASN1_MALLOC_ENCODE(KRB5SignedPath, data.data, data.length, &sp, &size, ret); >- free_Checksum(&sp.cksum); >- if (ret) >- return ret; >- if (data.length != size) >- krb5_abortx(context, "internal asn.1 encoder error"); >- >- >- /* >- * Add IF-RELEVANT(KRB5SignedPath) to the last slot in >- * authorization data field. >- */ >- >- ret = _kdc_tkt_add_if_relevant_ad(context, tkt, >- KRB5_AUTHDATA_SIGNTICKET, &data); >- krb5_data_free(&data); >- >- return ret; >-} >- >-static krb5_error_code >-check_KRB5SignedPath(krb5_context context, >- krb5_kdc_configuration *config, >- hdb_entry_ex *krbtgt, >- krb5_principal cp, >- EncTicketPart *tkt, >- krb5_principals *delegated, >- int *signedpath) >-{ >- krb5_error_code ret; >- krb5_data data; >- krb5_crypto crypto = NULL; >- >- if (delegated) >- *delegated = NULL; >- >- ret = find_KRB5SignedPath(context, tkt->authorization_data, &data); >- if (ret == 0) { >- KRB5SignedPathData spd; >- KRB5SignedPath sp; >- size_t size = 0; >- >- ret = decode_KRB5SignedPath(data.data, data.length, &sp, NULL); >- krb5_data_free(&data); >- if (ret) >- return ret; >- >- spd.client = cp; >- spd.authtime = tkt->authtime; >- spd.delegated = sp.delegated; >- spd.method_data = sp.method_data; >- >- ASN1_MALLOC_ENCODE(KRB5SignedPathData, data.data, data.length, >- &spd, &size, ret); >- if (ret) { >- free_KRB5SignedPath(&sp); >- return ret; >- } >- if (data.length != size) >- krb5_abortx(context, "internal asn.1 encoder error"); >- >- { >- Key *key; >- ret = hdb_enctype2key(context, &krbtgt->entry, sp.etype, &key); >- if (ret == 0) >- ret = krb5_crypto_init(context, &key->key, 0, &crypto); >- if (ret) { >- free(data.data); >- free_KRB5SignedPath(&sp); >- return ret; >- } >- } >- ret = krb5_verify_checksum(context, crypto, KRB5_KU_KRB5SIGNEDPATH, >- data.data, data.length, >- &sp.cksum); >- krb5_crypto_destroy(context, crypto); >- free(data.data); >- if (ret) { >- free_KRB5SignedPath(&sp); >- kdc_log(context, config, 5, >- "KRB5SignedPath not signed correctly, not marking as signed"); >- return 0; >- } >- >- if (delegated && sp.delegated) { >- >- *delegated = malloc(sizeof(*sp.delegated)); >- if (*delegated == NULL) { >- free_KRB5SignedPath(&sp); >- return ENOMEM; >- } >- >- ret = copy_Principals(*delegated, sp.delegated); >- if (ret) { >- free_KRB5SignedPath(&sp); >- free(*delegated); >- *delegated = NULL; >- return ret; >- } >- } >- free_KRB5SignedPath(&sp); >- >- *signedpath = 1; >- } >- >- return 0; >-} >- > /* > * > */ >@@ -738,7 +514,6 @@ tgs_make_reply(krb5_context context, > krb5_principal client_principal, > hdb_entry_ex *krbtgt, > krb5_enctype krbtgt_etype, >- krb5_principals spp, > const krb5_data *rspac, > const METHOD_DATA *enc_pa_data, > const char **e_text, >@@ -903,20 +678,6 @@ tgs_make_reply(krb5_context context, > goto out; > } > } >- >- /* Filter out type KRB5SignedPath */ >- ret = find_KRB5SignedPath(context, et.authorization_data, NULL); >- if (ret == 0) { >- if (et.authorization_data->len == 1) { >- free_AuthorizationData(et.authorization_data); >- free(et.authorization_data); >- et.authorization_data = NULL; >- } else { >- AuthorizationData *ad = et.authorization_data; >- free_AuthorizationDataElement(&ad->val[ad->len - 1]); >- ad->len--; >- } >- } > } > > ret = krb5_copy_keyblock_contents(context, sessionkey, &et.key); >@@ -945,24 +706,6 @@ tgs_make_reply(krb5_context context, > _kdc_log_timestamp(context, config, "TGS-REQ", et.authtime, et.starttime, > et.endtime, et.renew_till); > >- /* Don't sign cross realm tickets, they can't be checked anyway */ >- { >- char *r = get_krbtgt_realm(&ek.sname); >- >- if (r == NULL || strcmp(r, ek.srealm) == 0) { >- ret = _kdc_add_KRB5SignedPath(context, >- config, >- krbtgt, >- krbtgt_etype, >- client_principal, >- NULL, >- spp, >- &et); >- if (ret) >- goto out; >- } >- } >- > if (enc_pa_data->len) { > rep.padata = calloc(1, sizeof(*rep.padata)); > if (rep.padata == NULL) { >@@ -1517,7 +1260,6 @@ tgs_build_reply(krb5_context context, > HDB *clientdb, *s4u2self_impersonated_clientdb; > krb5_realm ref_realm = NULL; > EncTicketPart *tgt = &ticket->ticket; >- krb5_principals spp = NULL; > const EncryptionKey *ekey; > krb5_keyblock sessionkey; > krb5_kvno kvno; >@@ -1891,23 +1633,6 @@ server_lookup: > goto out; > } > >- /* also check the krbtgt for signature */ >- ret = check_KRB5SignedPath(context, >- config, >- krbtgt, >- cp, >- tgt, >- &spp, >- &signedpath); >- if (ret) { >- const char *msg = krb5_get_error_message(context, ret); >- kdc_log(context, config, 0, >- "KRB5SignedPath check failed for %s (%s) from %s with %s", >- spn, cpn, from, msg); >- krb5_free_error_message(context, msg); >- goto out; >- } >- > /* > * Process request > */ >@@ -2183,27 +1908,6 @@ server_lookup: > goto out; > } > >- /* >- * Check that the KDC issued the user's ticket. >- */ >- ret = check_KRB5SignedPath(context, >- config, >- krbtgt, >- cp, >- &adtkt, >- NULL, >- &ad_signedpath); >- if (ret) { >- const char *msg = krb5_get_error_message(context, ret); >- kdc_log(context, config, 0, >- "KRB5SignedPath check from service %s failed " >- "for delegation to %s for client %s (%s)" >- "from %s failed with %s", >- spn, tpn, dpn, cpn, from, msg); >- krb5_free_error_message(context, msg); >- goto out; >- } >- > if (!ad_signedpath) { > ret = KRB5KDC_ERR_BADOPTION; > kdc_log(context, config, 0, >@@ -2301,7 +2005,6 @@ server_lookup: > cp, > krbtgt_out, > krbtgt_etype, >- spp, > &rspac, > &enc_pa_data, > e_text, >diff --git a/source4/heimdal/lib/asn1/krb5.asn1 b/source4/heimdal/lib/asn1/krb5.asn1 >index c2f40c0ecd6..155d51d4ac8 100644 >--- a/source4/heimdal/lib/asn1/krb5.asn1 >+++ b/source4/heimdal/lib/asn1/krb5.asn1 >@@ -43,9 +43,6 @@ EXPORTS > KRB-PRIV, > KRB-SAFE, > KRB-SAFE-BODY, >- KRB5SignedPath, >- KRB5SignedPathData, >- KRB5SignedPathPrincipals, > KerberosString, > KerberosTime, > KrbCredInfo, >@@ -713,24 +710,6 @@ PA-S4U2Self ::= SEQUENCE { > auth[3] GeneralString > } > >--- never encoded on the wire, just used to checksum over >-KRB5SignedPathData ::= SEQUENCE { >- client[0] Principal OPTIONAL, >- authtime[1] KerberosTime, >- delegated[2] Principals OPTIONAL, >- method_data[3] METHOD-DATA OPTIONAL >-} >- >-KRB5SignedPath ::= SEQUENCE { >- -- DERcoded KRB5SignedPathData >- -- krbtgt key (etype), KeyUsage = XXX >- etype[0] ENCTYPE, >- cksum[1] Checksum, >- -- srvs delegated though >- delegated[2] Principals OPTIONAL, >- method_data[3] METHOD-DATA OPTIONAL >-} >- > AD-LoginAlias ::= SEQUENCE { -- ad-type number TBD -- > login-alias [0] PrincipalName, > checksum [1] Checksum >-- >2.25.1 > > >From 888e9fb1c0de7f110d511ff2af27e5590c53cad6 Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Fri, 13 Aug 2021 12:44:37 +0300 >Subject: [PATCH 347/380] kdc: sign ticket using Windows PAC > >Split Windows PAC signing and verification logic, as the signing has to be when >the ticket is ready. > >Create sign and verify the PAC KDC signature if the plugin did not, allowing >for S4U2Proxy to work, instead of KRB5SignedPath. > >Use the header key to verify PAC server signature, as the same key used to >encrypt/decrypt the ticket should be used for PAC server signature, like U2U >tickets are signed witht the tgt session-key and not with the longterm key, >and so krbtgt should be no different and the header key should be used. > >Lookup the delegated client in DB instead of passing the delegator DB entry. > >Add PAC ticket-signatures and related functions. > >Note: due to the change from KRB5SignedPath to PAC, S4U2Proxy requests >against new KDC will not work if the evidence ticket was acquired from >an old KDC, and vide versa. > >Closes: #767 > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >[jsutton@samba.org Backported from Heimdal commit > 2ffaba9401d19c718764d4bd24180960290238e9 > - Removed tests > - Adapted to Samba's version of Heimdal > - Addressed build failures with -O3 > - Added knownfails >] > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >[abartlet@samba.org backported from commit d7b03394a9012960d71489e775d40d10fd6f5232 > due to conflicts in knownfail due to missing tests that crash the > MIT KDC] >--- > selftest/knownfail_heimdal_kdc | 54 +-- > source4/heimdal/kdc/kerberos5.c | 69 +--- > source4/heimdal/kdc/krb5tgs.c | 354 +++++++++--------- > source4/heimdal/kdc/windc.c | 15 +- > source4/heimdal/kdc/windc_plugin.h | 5 +- > source4/heimdal/lib/krb5/authdata.c | 124 +++++++ > source4/heimdal/lib/krb5/pac.c | 376 ++++++++++++++++++-- > source4/heimdal/lib/krb5/version-script.map | 5 + > source4/heimdal_build/wscript_build | 2 +- > source4/selftest/tests.py | 2 +- > 10 files changed, 687 insertions(+), 319 deletions(-) > create mode 100644 source4/heimdal/lib/krb5/authdata.c > >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index f0263133eee..4ec682c01d0 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -1,7 +1,7 @@ > # > # We expect all the MIT specific compatability tests to fail on heimdal > # kerberos >-^samba.tests.krb5.compatability_tests.samba.tests.krb5.compatability_tests.SimpleKerberosTests.test_mit_(?!ticket_signature) >+^samba.tests.krb5.compatability_tests.samba.tests.krb5.compatability_tests.SimpleKerberosTests.test_mit_ > # > # Heimdal currently fails the following MS-KILE client principal lookup > # tests >@@ -122,14 +122,9 @@ > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_no_sname.ad_dc > ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_sname.ad_dc > # >-# Heimdal currently does not generate ticket signatures >-# >-^samba.tests.krb5.compatability_tests.samba.tests.krb5.compatability_tests.SimpleKerberosTests.test_heimdal_ticket_signature >-# > # S4U tests > # > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_bronze_bit_rbcd_old_checksum >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_missing_client_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_service_pac > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_unkeyed_client_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_unkeyed_service_checksum >@@ -143,60 +138,13 @@ > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_unkeyed_service_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_client_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_service_checksum >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_client_not_delegated > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_forwardable > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_nonempty_allowed >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_trusted_empty_allowed >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_trusted_nonempty_allowed >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_without_forwardable > # > # RODC tests > # > ^samba.tests.krb5.rodc_tests.samba.tests.krb5.rodc_tests.RodcKerberosTests.test_rodc_ticket_signature > # >-# PAC tests >-# >-^netr-bdc-arcfour.verify-sig-arcfour >-^netr-bdc-arcfour.verify-sig-arcfour >-^samba4.blackbox.pkinit_pac.STEP1 remote.pac verification.ad_dc:local >-^samba4.blackbox.pkinit_pac.STEP1 remote.pac verification.ad_dc_ntvfs:local >-^samba4.blackbox.pkinit_pac.netr-bdc-aes.verify-sig-aes.ad_dc:local >-^samba4.blackbox.pkinit_pac.netr-bdc-aes.verify-sig-aes.ad_dc_ntvfs:local >-^samba4.blackbox.pkinit_pac.netr-mem-aes.s4u2proxy-aes.ad_dc:local >-^samba4.blackbox.pkinit_pac.netr-mem-aes.s4u2proxy-aes.ad_dc_ntvfs:local >-^samba4.blackbox.pkinit_pac.netr-mem-aes.verify-sig-aes.ad_dc:local >-^samba4.blackbox.pkinit_pac.netr-mem-aes.verify-sig-aes.ad_dc_ntvfs:local >-^samba4.blackbox.pkinit_pac.netr-mem-arcfour.s4u2proxy-arcfour.ad_dc:local >-^samba4.blackbox.pkinit_pac.netr-mem-arcfour.s4u2proxy-arcfour.ad_dc_ntvfs:local >-^samba4.blackbox.pkinit_pac.netr-mem-arcfour.verify-sig-arcfour.ad_dc:local >-^samba4.blackbox.pkinit_pac.netr-mem-arcfour.verify-sig-arcfour.ad_dc_ntvfs:local >-^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2000dc >-^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2003dc >-^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2008dc >-^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2008r2dc >-^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2000dc >-^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2003dc >-^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2008dc >-^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2008r2dc >-^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2000dc >-^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2003dc >-^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2008dc >-^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2008r2dc >-^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2000dc >-^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2003dc >-^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2008dc >-^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2008r2dc >-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2000dc >-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2003dc >-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2008dc >-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2008r2dc >-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2000dc >-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2003dc >-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008dc >-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008r2dc >-# > # The lack of KRB5SignedPath means we no longer return > # KRB5KRB_ERR_RESPONSE_TOO_BIG in this specific case > # >diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c >index a400b21a652..7b17d2539ce 100644 >--- a/source4/heimdal/kdc/kerberos5.c >+++ b/source4/heimdal/kdc/kerberos5.c >@@ -1712,6 +1712,7 @@ _kdc_as_rep(krb5_context context, > if (send_pac_p(context, req)) { > krb5_pac p = NULL; > krb5_data data; >+ uint16_t rodc_id; > > ret = _kdc_pac_generate(context, client, pk_reply_key, &p); > if (ret) { >@@ -1720,10 +1721,13 @@ _kdc_as_rep(krb5_context context, > goto out; > } > if (p != NULL) { >+ rodc_id = server->entry.kvno >> 16; >+ > ret = _krb5_pac_sign(context, p, et.authtime, > client->entry.principal, > &skey->key, /* Server key */ > &skey->key, /* FIXME: should be krbtgt key */ >+ rodc_id, > &data); > krb5_pac_free(context, p); > if (ret) { >@@ -1732,9 +1736,7 @@ _kdc_as_rep(krb5_context context, > goto out; > } > >- ret = _kdc_tkt_add_if_relevant_ad(context, &et, >- KRB5_AUTHDATA_WIN2K_PAC, >- &data); >+ ret = _kdc_tkt_insert_pac(context, &et, &data); > krb5_data_free(&data); > if (ret) > goto out; >@@ -1888,64 +1890,3 @@ prepare_enc_data(krb5_context context, > > return TRUE; > } >- >-/* >- * Add the AuthorizationData `data´ of `type´ to the last element in >- * the sequence of authorization_data in `tkt´ wrapped in an IF_RELEVANT >- */ >- >-krb5_error_code >-_kdc_tkt_add_if_relevant_ad(krb5_context context, >- EncTicketPart *tkt, >- int type, >- const krb5_data *data) >-{ >- krb5_error_code ret; >- size_t size = 0; >- >- if (tkt->authorization_data == NULL) { >- tkt->authorization_data = calloc(1, sizeof(*tkt->authorization_data)); >- if (tkt->authorization_data == NULL) { >- krb5_set_error_message(context, ENOMEM, "out of memory"); >- return ENOMEM; >- } >- } >- >- /* add the entry to the last element */ >- { >- AuthorizationData ad = { 0, NULL }; >- AuthorizationDataElement ade; >- >- ade.ad_type = type; >- ade.ad_data = *data; >- >- ret = add_AuthorizationData(&ad, &ade); >- if (ret) { >- krb5_set_error_message(context, ret, "add AuthorizationData failed"); >- return ret; >- } >- >- ade.ad_type = KRB5_AUTHDATA_IF_RELEVANT; >- >- ASN1_MALLOC_ENCODE(AuthorizationData, >- ade.ad_data.data, ade.ad_data.length, >- &ad, &size, ret); >- free_AuthorizationData(&ad); >- if (ret) { >- krb5_set_error_message(context, ret, "ASN.1 encode of " >- "AuthorizationData failed"); >- return ret; >- } >- if (ade.ad_data.length != size) >- krb5_abortx(context, "internal asn.1 encoder error"); >- >- ret = add_AuthorizationData(tkt->authorization_data, &ade); >- der_free_octet_string(&ade.ad_data); >- if (ret) { >- krb5_set_error_message(context, ret, "add AuthorizationData failed"); >- return ret; >- } >- } >- >- return 0; >-} >diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c >index fcdebede3a9..e8bbb42465f 100644 >--- a/source4/heimdal/kdc/krb5tgs.c >+++ b/source4/heimdal/kdc/krb5tgs.c >@@ -59,85 +59,64 @@ check_PAC(krb5_context context, > hdb_entry_ex *client, > hdb_entry_ex *server, > hdb_entry_ex *krbtgt, >+ hdb_entry_ex *ticket_server, > const EncryptionKey *server_check_key, >- const EncryptionKey *server_sign_key, >- const EncryptionKey *krbtgt_sign_key, >+ const EncryptionKey *krbtgt_check_key, > EncTicketPart *tkt, >- krb5_data *rspac, >- int *signedpath) >+ krb5_boolean *kdc_issued, >+ krb5_pac *ppac) > { >- AuthorizationData *ad = tkt->authorization_data; >- unsigned i, j; >+ krb5_pac pac = NULL; > krb5_error_code ret; >+ krb5_boolean signedticket; > >- if (ad == NULL || ad->len == 0) >- return 0; >- >- for (i = 0; i < ad->len; i++) { >- AuthorizationData child; >- >- if (ad->val[i].ad_type != KRB5_AUTHDATA_IF_RELEVANT) >- continue; >- >- ret = decode_AuthorizationData(ad->val[i].ad_data.data, >- ad->val[i].ad_data.length, >- &child, >- NULL); >- if (ret) { >- krb5_set_error_message(context, ret, "Failed to decode " >- "IF_RELEVANT with %d", ret); >- return ret; >- } >- for (j = 0; j < child.len; j++) { >- >- if (child.val[j].ad_type == KRB5_AUTHDATA_WIN2K_PAC) { >- int signed_pac = 0; >- krb5_pac pac; >- >- /* Found PAC */ >- ret = krb5_pac_parse(context, >- child.val[j].ad_data.data, >- child.val[j].ad_data.length, >- &pac); >- free_AuthorizationData(&child); >- if (ret) >- return ret; >+ *kdc_issued = FALSE; >+ *ppac = NULL; > >- ret = krb5_pac_verify(context, pac, tkt->authtime, >- client_principal, >- server_check_key, NULL); >- if (ret) { >- krb5_pac_free(context, pac); >- return ret; >- } >+ ret = _krb5_kdc_pac_ticket_parse(context, tkt, &signedticket, &pac); >+ if (ret || pac == NULL) >+ return ret; > >- ret = _kdc_pac_verify(context, client_principal, >- delegated_proxy_principal, >- client, server, krbtgt, &pac, &signed_pac); >- if (ret) { >- krb5_pac_free(context, pac); >- return ret; >- } >+ /* Verify the server signature. */ >+ ret = krb5_pac_verify(context, pac, tkt->authtime, client_principal, >+ server_check_key, NULL); >+ if (ret) { >+ krb5_pac_free(context, pac); >+ return ret; >+ } > >- /* >- * Only re-sign PAC if we could verify it with the PAC >- * function. The no-verify case happens when we get in >- * a PAC from cross realm from a Windows domain and >- * that there is no PAC verification function. >- */ >- if (signed_pac) { >- *signedpath = 1; >- ret = _krb5_pac_sign(context, pac, tkt->authtime, >- client_principal, >- server_sign_key, krbtgt_sign_key, rspac); >- } >+ /* Verify the KDC signatures. */ >+ ret = _kdc_pac_verify(context, client_principal, delegated_proxy_principal, >+ client, server, krbtgt, &pac); >+ if (ret == KRB5_PLUGIN_NO_HANDLE) { >+ /* >+ * We can't verify the KDC signatures if the ticket was issued by >+ * another realm's KDC. >+ */ >+ if (krb5_realm_compare(context, server->entry.principal, >+ ticket_server->entry.principal)) { >+ ret = krb5_pac_verify(context, pac, 0, NULL, NULL, >+ krbtgt_check_key); >+ if (ret) { > krb5_pac_free(context, pac); >- > return ret; > } > } >- free_AuthorizationData(&child); >+ /* Discard the PAC if the plugin didn't handle it */ >+ krb5_pac_free(context, pac); >+ ret = krb5_pac_init(context, &pac); >+ if (ret) >+ return ret; >+ } else if (ret) { >+ krb5_pac_free(context, pac); >+ return ret; > } >+ >+ *kdc_issued = signedticket || >+ krb5_principal_is_krbtgt(context, >+ ticket_server->entry.principal); >+ *ppac = pac; >+ > return 0; > } > >@@ -499,11 +478,12 @@ static krb5_error_code > tgs_make_reply(krb5_context context, > krb5_kdc_configuration *config, > KDC_REQ_BODY *b, >- krb5_const_principal tgt_name, >+ krb5_principal tgt_name, > const EncTicketPart *tgt, > const krb5_keyblock *replykey, > int rk_is_subkey, > const EncryptionKey *serverkey, >+ const EncryptionKey *krbtgtkey, > const krb5_keyblock *sessionkey, > krb5_kvno kvno, > AuthorizationData *auth_data, >@@ -513,8 +493,9 @@ tgs_make_reply(krb5_context context, > hdb_entry_ex *client, > krb5_principal client_principal, > hdb_entry_ex *krbtgt, >- krb5_enctype krbtgt_etype, >- const krb5_data *rspac, >+ krb5_pac mspac, >+ uint16_t rodc_id, >+ krb5_boolean add_ticket_sig, > const METHOD_DATA *enc_pa_data, > const char **e_text, > krb5_data *reply) >@@ -647,17 +628,6 @@ tgs_make_reply(krb5_context context, > if (!server->entry.flags.proxiable) > et.flags.proxiable = 0; > >- if(rspac->length) { >- /* >- * No not need to filter out the any PAC from the >- * auth_data since it's signed by the KDC. >- */ >- ret = _kdc_tkt_add_if_relevant_ad(context, &et, >- KRB5_AUTHDATA_WIN2K_PAC, rspac); >- if (ret) >- goto out; >- } >- > if (auth_data) { > unsigned int i = 0; > >@@ -724,6 +694,11 @@ tgs_make_reply(krb5_context context, > is_weak = 1; > } > >+ /* The PAC should be the last change to the ticket. */ >+ ret = _krb5_kdc_pac_sign_ticket(context, mspac, tgt_name, serverkey, >+ krbtgtkey, rodc_id, add_ticket_sig, &et); >+ if (ret) >+ goto out; > > /* It is somewhat unclear where the etype in the following > encryption should come from. What we have is a session >@@ -910,6 +885,7 @@ tgs_parse_request(krb5_context context, > int **cusec, > AuthorizationData **auth_data, > krb5_keyblock **replykey, >+ Key **header_key, > int *rk_is_subkey) > { > static char failed[] = "<unparse_name failed>"; >@@ -1047,6 +1023,8 @@ tgs_parse_request(krb5_context context, > goto out; > } > >+ *header_key = tkey; >+ > { > krb5_authenticator auth; > >@@ -1236,6 +1214,57 @@ eout: > return ENOMEM; > } > >+static krb5_error_code >+db_fetch_client(krb5_context context, >+ krb5_kdc_configuration *config, >+ int flags, >+ krb5_principal cp, >+ const char *cpn, >+ const char *krbtgt_realm, >+ HDB **clientdb, >+ hdb_entry_ex **client_out) >+{ >+ krb5_error_code ret; >+ hdb_entry_ex *client = NULL; >+ >+ *client_out = NULL; >+ >+ ret = _kdc_db_fetch(context, config, cp, HDB_F_GET_CLIENT | flags, >+ NULL, clientdb, &client); >+ if (ret == HDB_ERR_NOT_FOUND_HERE) { >+ /* >+ * This is OK, we are just trying to find out if they have >+ * been disabled or deleted in the meantime; missing secrets >+ * are OK. >+ */ >+ } else if (ret) { >+ /* >+ * If the client belongs to the same realm as our TGS, it >+ * should exist in the local database. >+ */ >+ const char *msg; >+ >+ if (strcmp(krb5_principal_get_realm(context, cp), krbtgt_realm) == 0) { >+ if (ret == HDB_ERR_NOENTRY) >+ ret = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN; >+ kdc_log(context, config, 4, "Client no longer in database: %s", cpn); >+ return ret; >+ } >+ >+ msg = krb5_get_error_message(context, ret); >+ kdc_log(context, config, 4, "Client not found in database: %s", msg); >+ krb5_free_error_message(context, msg); >+ } else if (client->entry.flags.invalid || !client->entry.flags.client) { >+ kdc_log(context, config, 4, "Client has invalid bit set"); >+ _kdc_free_ent(context, client); >+ return KRB5KDC_ERR_POLICY; >+ } >+ >+ *client_out = client; >+ >+ return 0; >+} >+ > static krb5_error_code > tgs_build_reply(krb5_context context, > krb5_kdc_configuration *config, >@@ -1243,6 +1272,7 @@ tgs_build_reply(krb5_context context, > KDC_REQ_BODY *b, > hdb_entry_ex *krbtgt, > krb5_enctype krbtgt_etype, >+ Key *tkey_check, > const krb5_keyblock *replykey, > int rk_is_subkey, > krb5_ticket *ticket, >@@ -1263,7 +1293,9 @@ tgs_build_reply(krb5_context context, > const EncryptionKey *ekey; > krb5_keyblock sessionkey; > krb5_kvno kvno; >- krb5_data rspac; >+ krb5_pac mspac = NULL; >+ uint16_t rodc_id; >+ krb5_boolean add_ticket_sig = FALSE; > > hdb_entry_ex *krbtgt_out = NULL; > >@@ -1274,15 +1306,13 @@ tgs_build_reply(krb5_context context, > int nloop = 0; > EncTicketPart adtkt; > char opt_str[128]; >- int signedpath = 0; >+ krb5_boolean kdc_issued = FALSE; > >- Key *tkey_check; > Key *tkey_sign; > int flags = HDB_F_FOR_TGS_REQ; > > memset(&sessionkey, 0, sizeof(sessionkey)); > memset(&adtkt, 0, sizeof(adtkt)); >- krb5_data_zero(&rspac); > memset(&enc_pa_data, 0, sizeof(enc_pa_data)); > > s = b->sname; >@@ -1517,18 +1547,6 @@ server_lookup: > * backward. > */ > >- /* >- * Validate authoriation data >- */ >- >- ret = hdb_enctype2key(context, &krbtgt->entry, >- krbtgt_etype, &tkey_check); >- if(ret) { >- kdc_log(context, config, 0, >- "Failed to find key for krbtgt PAC check"); >- goto out; >- } >- > /* Now refetch the primary krbtgt, and get the current kvno (the > * sign check may have been on an old kvno, and the server may > * have been an incoming trust) */ >@@ -1589,41 +1607,14 @@ server_lookup: > goto out; > } > >- ret = _kdc_db_fetch(context, config, cp, HDB_F_GET_CLIENT | flags, >- NULL, &clientdb, &client); >- if(ret == HDB_ERR_NOT_FOUND_HERE) { >- /* This is OK, we are just trying to find out if they have >- * been disabled or deleted in the meantime, missing secrets >- * is OK */ >- } else if(ret){ >- const char *krbtgt_realm, *msg; >- >- /* >- * If the client belongs to the same realm as our krbtgt, it >- * should exist in the local database. >- * >- */ >- >- krbtgt_realm = krb5_principal_get_realm(context, krbtgt_out->entry.principal); >- >- if(strcmp(krb5_principal_get_realm(context, cp), krbtgt_realm) == 0) { >- if (ret == HDB_ERR_NOENTRY) >- ret = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN; >- kdc_log(context, config, 1, "Client no longer in database: %s", >- cpn); >- goto out; >- } >- >- msg = krb5_get_error_message(context, ret); >- kdc_log(context, config, 1, "Client not found in database: %s", msg); >- krb5_free_error_message(context, msg); >- } >+ ret = db_fetch_client(context, config, flags, cp, cpn, >+ krb5_principal_get_realm(context, krbtgt_out->entry.principal), >+ &clientdb, &client); >+ if (ret) >+ goto out; > >- ret = check_PAC(context, config, cp, NULL, >- client, server, krbtgt, >- &tkey_check->key, >- ekey, &tkey_sign->key, >- tgt, &rspac, &signedpath); >+ ret = check_PAC(context, config, cp, NULL, client, server, krbtgt, krbtgt, >+ &tkey_check->key, &tkey_check->key, tgt, &kdc_issued, &mspac); > if (ret) { > const char *msg = krb5_get_error_message(context, ret); > kdc_log(context, config, 0, >@@ -1743,27 +1734,15 @@ server_lookup: > goto out; > > /* If we were about to put a PAC into the ticket, we better fix it to be the right PAC */ >- if(rspac.data) { >- krb5_pac p = NULL; >- krb5_data_free(&rspac); >- ret = _kdc_pac_generate(context, s4u2self_impersonated_client, NULL, &p); >+ if (mspac) { >+ krb5_pac_free(context, mspac); >+ mspac = NULL; >+ ret = _kdc_pac_generate(context, s4u2self_impersonated_client, NULL, &mspac); > if (ret) { > kdc_log(context, config, 0, "PAC generation failed for -- %s", > tpn); > goto out; > } >- if (p != NULL) { >- ret = _krb5_pac_sign(context, p, ticket->ticket.authtime, >- s4u2self_impersonated_client->entry.principal, >- ekey, &tkey_sign->key, >- &rspac); >- krb5_pac_free(context, p); >- if (ret) { >- kdc_log(context, config, 0, "PAC signing failed for -- %s", >- tpn); >- goto out; >- } >- } > } > > /* >@@ -1806,22 +1785,25 @@ server_lookup: > && b->additional_tickets->len != 0 > && b->kdc_options.enc_tkt_in_skey == 0) > { >- int ad_signedpath = 0; >+ hdb_entry_ex *adclient = NULL; >+ krb5_boolean ad_kdc_issued = FALSE; > Key *clientkey; > Ticket *t; > > /* >- * Require that the KDC have issued the service's krbtgt (not >- * self-issued ticket with kimpersonate(1). >+ * We require that the service's krbtgt has a PAC. > */ >- if (!signedpath) { >+ if (mspac == NULL) { > ret = KRB5KDC_ERR_BADOPTION; > kdc_log(context, config, 0, >- "Constrained delegation done on service ticket %s/%s", >+ "Constrained delegation without PAC %s/%s", > cpn, spn); > goto out; > } > >+ krb5_pac_free(context, mspac); >+ mspac = NULL; >+ > t = &b->additional_tickets->val[0]; > > ret = hdb_enctype2key(context, &client->entry, >@@ -1885,19 +1867,32 @@ server_lookup: > goto out; > } > >- krb5_data_free(&rspac); >+ /* Try lookup the delegated client in DB */ >+ ret = db_fetch_client(context, config, flags, tp, tpn, >+ krb5_principal_get_realm(context, krbtgt_out->entry.principal), >+ NULL, &adclient); >+ if (ret) >+ goto out; >+ >+ if (adclient != NULL) { >+ ret = kdc_check_flags(context, config, >+ adclient, tpn, >+ server, spn, >+ FALSE); >+ if (ret) { >+ _kdc_free_ent(context, adclient); >+ goto out; >+ } >+ } > > /* >- * generate the PAC for the user. >- * > * TODO: pass in t->sname and t->realm and build > * a S4U_DELEGATION_INFO blob to the PAC. > */ >- ret = check_PAC(context, config, tp, dp, >- client, server, krbtgt, >- &clientkey->key, >- ekey, &tkey_sign->key, >- &adtkt, &rspac, &ad_signedpath); >+ ret = check_PAC(context, config, tp, dp, adclient, server, krbtgt, client, >+ &clientkey->key, &tkey_check->key, &adtkt, &ad_kdc_issued, &mspac); >+ if (adclient) >+ _kdc_free_ent(context, adclient); > if (ret) { > const char *msg = krb5_get_error_message(context, ret); > kdc_log(context, config, 0, >@@ -1908,13 +1903,12 @@ server_lookup: > goto out; > } > >- if (!ad_signedpath) { >+ if (mspac == NULL || !ad_kdc_issued) { > ret = KRB5KDC_ERR_BADOPTION; > kdc_log(context, config, 0, >- "Ticket not signed with PAC nor SignedPath service %s failed " >- "for delegation to %s for client %s (%s)" >- "from %s", >- spn, tpn, dpn, cpn, from); >+ "Ticket not signed with PAC; service %s failed for " >+ "for delegation to %s for client %s (%s) from %s; (%s).", >+ spn, tpn, dpn, cpn, from, mspac ? "Ticket unsigned" : "No PAC"); > goto out; > } > >@@ -1983,6 +1977,25 @@ server_lookup: > } > } > >+ /* >+ * Only add ticket signature if the requested server is not krbtgt, and >+ * either the header server is krbtgt or, in the case of renewal/validation >+ * if it was signed with PAC ticket signature and we verified it. >+ * Currently Heimdal only allows renewal of krbtgt anyway but that might >+ * change one day (see issue #763) so make sure to check for it. >+ */ >+ >+ if (kdc_issued && >+ !krb5_principal_is_krbtgt(context, server->entry.principal)) >+ add_ticket_sig = TRUE; >+ >+ /* >+ * Active-Directory implementations use the high part of the kvno as the >+ * read-only-dc identifier, we need to embed it in the PAC KDC signatures. >+ */ >+ >+ rodc_id = krbtgt_out->entry.kvno >> 16; >+ > /* > * > */ >@@ -1995,6 +2008,7 @@ server_lookup: > replykey, > rk_is_subkey, > ekey, >+ &tkey_sign->key, > &sessionkey, > kvno, > *auth_data, >@@ -2004,8 +2018,9 @@ server_lookup: > client, > cp, > krbtgt_out, >- krbtgt_etype, >- &rspac, >+ mspac, >+ rodc_id, >+ add_ticket_sig, > &enc_pa_data, > e_text, > reply); >@@ -2018,7 +2033,6 @@ out: > if (dpn) > free(dpn); > >- krb5_data_free(&rspac); > krb5_free_keyblock_contents(context, &sessionkey); > if(krbtgt_out) > _kdc_free_ent(context, krbtgt_out); >@@ -2043,6 +2057,9 @@ out: > > free_EncTicketPart(&adtkt); > >+ if (mspac) >+ krb5_pac_free(context, mspac); >+ > return ret; > } > >@@ -2063,6 +2080,7 @@ _kdc_tgs_rep(krb5_context context, > krb5_error_code ret; > int i = 0; > const PA_DATA *tgs_req; >+ Key *header_key = NULL; > > hdb_entry_ex *krbtgt = NULL; > krb5_ticket *ticket = NULL; >@@ -2100,6 +2118,7 @@ _kdc_tgs_rep(krb5_context context, > &csec, &cusec, > &auth_data, > &replykey, >+ &header_key, > &rk_is_subkey); > if (ret == HDB_ERR_NOT_FOUND_HERE) { > /* kdc_log() is called in tgs_parse_request() */ >@@ -2117,6 +2136,7 @@ _kdc_tgs_rep(krb5_context context, > &req->req_body, > krbtgt, > krbtgt_etype, >+ header_key, > replykey, > rk_is_subkey, > ticket, >diff --git a/source4/heimdal/kdc/windc.c b/source4/heimdal/kdc/windc.c >index fb1c8a6a993..43dc89e2bc0 100644 >--- a/source4/heimdal/kdc/windc.c >+++ b/source4/heimdal/kdc/windc.c >@@ -77,8 +77,14 @@ _kdc_pac_generate(krb5_context context, > krb5_pac *pac) > { > *pac = NULL; >- if (windcft == NULL) >+ if (krb5_config_get_bool_default(context, NULL, FALSE, "realms", >+ client->entry.principal->realm, >+ "disable_pac", NULL)) > return 0; >+ if (windcft == NULL) { >+ return krb5_pac_init(context, pac); >+ } >+ > if (windcft->pac_pk_generate != NULL && pk_reply_key != NULL) > return (windcft->pac_pk_generate)(windcctx, context, > client, pk_reply_key, pac); >@@ -92,20 +98,17 @@ _kdc_pac_verify(krb5_context context, > hdb_entry_ex *client, > hdb_entry_ex *server, > hdb_entry_ex *krbtgt, >- krb5_pac *pac, >- int *verified) >+ krb5_pac *pac) > { > krb5_error_code ret; > > if (windcft == NULL) >- return 0; >+ return KRB5_PLUGIN_NO_HANDLE; > > ret = windcft->pac_verify(windcctx, context, > client_principal, > delegated_proxy_principal, > client, server, krbtgt, pac); >- if (ret == 0) >- *verified = 1; > return ret; > } > >diff --git a/source4/heimdal/kdc/windc_plugin.h b/source4/heimdal/kdc/windc_plugin.h >index bf90826cb06..dda258da3d1 100644 >--- a/source4/heimdal/kdc/windc_plugin.h >+++ b/source4/heimdal/kdc/windc_plugin.h >@@ -43,8 +43,9 @@ > * krb5_pac_init and fill in the PAC structure for the principal using > * krb5_pac_add_buffer. > * >- * The PAC verify function should verify all components in the PAC >- * using krb5_pac_get_types and krb5_pac_get_buffer for all types. >+ * The PAC verify function should verify the PAC KDC signatures by fetching >+ * the right KDC key and calling krb5_pac_verify() with that KDC key. >+ * Optionally, update the PAC buffers upon success. > * > * Check client access function check if the client is authorized. > */ >diff --git a/source4/heimdal/lib/krb5/authdata.c b/source4/heimdal/lib/krb5/authdata.c >new file mode 100644 >index 00000000000..ac426618f6e >--- /dev/null >+++ b/source4/heimdal/lib/krb5/authdata.c >@@ -0,0 +1,124 @@ >+/* >+ * Copyright (c) 1997-2021 Kungliga Tekniska Högskolan >+ * (Royal Institute of Technology, Stockholm, Sweden). >+ * Copyright (c) 2021 Isaac Boukris >+ * All rights reserved. >+ * >+ * Redistribution and use in source and binary forms, with or without >+ * modification, are permitted provided that the following conditions >+ * are met: >+ * >+ * 1. Redistributions of source code must retain the above copyright >+ * notice, this list of conditions and the following disclaimer. >+ * >+ * 2. Redistributions in binary form must reproduce the above copyright >+ * notice, this list of conditions and the following disclaimer in the >+ * documentation and/or other materials provided with the distribution. >+ * >+ * 3. Neither the name of the Institute nor the names of its contributors >+ * may be used to endorse or promote products derived from this software >+ * without specific prior written permission. >+ * >+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND >+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE >+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE >+ * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE >+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL >+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS >+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) >+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT >+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY >+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF >+ * SUCH DAMAGE. >+ */ >+ >+#include "krb5_locl.h" >+ >+/* >+ * Add the AuthorizationData `data´ of `type´ to the last element in >+ * the sequence of authorization_data in `tkt´ wrapped in an IF_RELEVANT >+ */ >+ >+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL >+_kdc_tkt_add_if_relevant_ad(krb5_context context, >+ EncTicketPart *tkt, >+ int type, >+ const krb5_data *data) >+{ >+ krb5_error_code ret; >+ size_t size = 0; >+ >+ if (tkt->authorization_data == NULL) { >+ tkt->authorization_data = calloc(1, sizeof(*tkt->authorization_data)); >+ if (tkt->authorization_data == NULL) { >+ return krb5_enomem(context); >+ } >+ } >+ >+ /* add the entry to the last element */ >+ { >+ AuthorizationData ad = { 0, NULL }; >+ AuthorizationDataElement ade; >+ >+ ade.ad_type = type; >+ ade.ad_data = *data; >+ >+ ret = add_AuthorizationData(&ad, &ade); >+ if (ret) { >+ krb5_set_error_message(context, ret, "add AuthorizationData failed"); >+ return ret; >+ } >+ >+ ade.ad_type = KRB5_AUTHDATA_IF_RELEVANT; >+ >+ ASN1_MALLOC_ENCODE(AuthorizationData, >+ ade.ad_data.data, ade.ad_data.length, >+ &ad, &size, ret); >+ free_AuthorizationData(&ad); >+ if (ret) { >+ krb5_set_error_message(context, ret, "ASN.1 encode of " >+ "AuthorizationData failed"); >+ return ret; >+ } >+ if (ade.ad_data.length != size) >+ krb5_abortx(context, "internal asn.1 encoder error"); >+ >+ ret = add_AuthorizationData(tkt->authorization_data, &ade); >+ der_free_octet_string(&ade.ad_data); >+ if (ret) { >+ krb5_set_error_message(context, ret, "add AuthorizationData failed"); >+ return ret; >+ } >+ } >+ >+ return 0; >+} >+ >+/* >+ * Insert a PAC wrapped in AD-IF-RELEVANT container as the first AD element, >+ * as some clients such as Windows may fail to parse it otherwise. >+ */ >+ >+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL >+_kdc_tkt_insert_pac(krb5_context context, >+ EncTicketPart *tkt, >+ const krb5_data *data) >+{ >+ AuthorizationDataElement ade; >+ unsigned int i; >+ krb5_error_code ret; >+ >+ ret = _kdc_tkt_add_if_relevant_ad(context, tkt, KRB5_AUTHDATA_WIN2K_PAC, >+ data); >+ if (ret) >+ return ret; >+ >+ heim_assert(tkt->authorization_data->len != 0, "No authorization_data!"); >+ ade = tkt->authorization_data->val[tkt->authorization_data->len - 1]; >+ for (i = 0; i < tkt->authorization_data->len - 1; i++) { >+ tkt->authorization_data->val[i + 1] = tkt->authorization_data->val[i]; >+ } >+ tkt->authorization_data->val[0] = ade; >+ >+ return 0; >+} >diff --git a/source4/heimdal/lib/krb5/pac.c b/source4/heimdal/lib/krb5/pac.c >index 26aae107b32..eec1e84c7bd 100644 >--- a/source4/heimdal/lib/krb5/pac.c >+++ b/source4/heimdal/lib/krb5/pac.c >@@ -53,6 +53,8 @@ struct krb5_pac_data { > struct PAC_INFO_BUFFER *server_checksum; > struct PAC_INFO_BUFFER *privsvr_checksum; > struct PAC_INFO_BUFFER *logon_name; >+ struct PAC_INFO_BUFFER *ticket_checksum; >+ krb5_data ticket_sign_data; > }; > > #define PAC_ALIGNMENT 8 >@@ -64,6 +66,7 @@ struct krb5_pac_data { > #define PAC_PRIVSVR_CHECKSUM 7 > #define PAC_LOGON_NAME 10 > #define PAC_CONSTRAINED_DELEGATION 11 >+#define PAC_TICKET_CHECKSUM 16 > > #define CHECK(r,f,l) \ > do { \ >@@ -142,13 +145,13 @@ krb5_pac_parse(krb5_context context, const void *ptr, size_t len, > CHECK(ret, krb5_ret_uint32(sp, &tmp2), out); > if (tmp < 1) { > ret = EINVAL; /* Too few buffers */ >- krb5_set_error_message(context, ret, N_("PAC have too few buffer", "")); >+ krb5_set_error_message(context, ret, N_("PAC has too few buffers", "")); > goto out; > } > if (tmp2 != 0) { > ret = EINVAL; /* Wrong version */ > krb5_set_error_message(context, ret, >- N_("PAC have wrong version %d", ""), >+ N_("PAC has wrong version %d", ""), > (int)tmp2); > goto out; > } >@@ -191,7 +194,7 @@ krb5_pac_parse(krb5_context context, const void *ptr, size_t len, > if (p->pac->buffers[i].offset_lo > len) { > ret = EINVAL; > krb5_set_error_message(context, ret, >- N_("PAC offset off end", "")); >+ N_("PAC offset overflow", "")); > goto out; > } > if (p->pac->buffers[i].offset_lo < header_end) { >@@ -204,7 +207,7 @@ krb5_pac_parse(krb5_context context, const void *ptr, size_t len, > } > if (p->pac->buffers[i].buffersize > len - p->pac->buffers[i].offset_lo){ > ret = EINVAL; >- krb5_set_error_message(context, ret, N_("PAC length off end", "")); >+ krb5_set_error_message(context, ret, N_("PAC length overflow", "")); > goto out; > } > >@@ -213,7 +216,7 @@ krb5_pac_parse(krb5_context context, const void *ptr, size_t len, > if (p->server_checksum) { > ret = EINVAL; > krb5_set_error_message(context, ret, >- N_("PAC have two server checksums", "")); >+ N_("PAC has multiple server checksums", "")); > goto out; > } > p->server_checksum = &p->pac->buffers[i]; >@@ -221,7 +224,7 @@ krb5_pac_parse(krb5_context context, const void *ptr, size_t len, > if (p->privsvr_checksum) { > ret = EINVAL; > krb5_set_error_message(context, ret, >- N_("PAC have two KDC checksums", "")); >+ N_("PAC has multiple KDC checksums", "")); > goto out; > } > p->privsvr_checksum = &p->pac->buffers[i]; >@@ -229,10 +232,18 @@ krb5_pac_parse(krb5_context context, const void *ptr, size_t len, > if (p->logon_name) { > ret = EINVAL; > krb5_set_error_message(context, ret, >- N_("PAC have two logon names", "")); >+ N_("PAC has multiple logon names", "")); > goto out; > } > p->logon_name = &p->pac->buffers[i]; >+ } else if (p->pac->buffers[i].type == PAC_TICKET_CHECKSUM) { >+ if (p->ticket_checksum) { >+ ret = EINVAL; >+ krb5_set_error_message(context, ret, >+ N_("PAC has multiple ticket checksums", "")); >+ goto out; >+ } >+ p->ticket_checksum = &p->pac->buffers[i]; > } > } > >@@ -425,6 +436,7 @@ KRB5_LIB_FUNCTION void KRB5_LIB_CALL > krb5_pac_free(krb5_context context, krb5_pac pac) > { > krb5_data_free(&pac->data); >+ krb5_data_free(&pac->ticket_sign_data); > free(pac->pac); > free(pac); > } >@@ -444,6 +456,7 @@ verify_checksum(krb5_context context, > uint32_t type; > krb5_error_code ret; > Checksum cksum; >+ size_t cksumsize; > > memset(&cksum, 0, sizeof(cksum)); > >@@ -456,8 +469,17 @@ verify_checksum(krb5_context context, > > CHECK(ret, krb5_ret_uint32(sp, &type), out); > cksum.cksumtype = type; >- cksum.checksum.length = >- sig->buffersize - krb5_storage_seek(sp, 0, SEEK_CUR); >+ >+ ret = krb5_checksumsize(context, type, &cksumsize); >+ if (ret) >+ goto out; >+ >+ /* Allow for RODCIdentifier trailer, see MS-PAC 2.8 */ >+ if (cksumsize > (sig->buffersize - krb5_storage_seek(sp, 0, SEEK_CUR))) { >+ ret = EINVAL; >+ goto out; >+ } >+ cksum.checksum.length = cksumsize; > cksum.checksum.data = malloc(cksum.checksum.length); > if (cksum.checksum.data == NULL) { > ret = krb5_enomem(context); >@@ -804,7 +826,6 @@ out: > return ret; > } > >- > /** > * Verify the PAC. > * >@@ -844,18 +865,22 @@ krb5_pac_verify(krb5_context context, > return EINVAL; > } > >- ret = verify_logonname(context, >- pac->logon_name, >- &pac->data, >- authtime, >- principal); >- if (ret) >- return ret; >+ if (principal != NULL) { >+ ret = verify_logonname(context, pac->logon_name, &pac->data, authtime, >+ principal); >+ if (ret) >+ return ret; >+ } >+ >+ if (pac->server_checksum->buffersize < 4 || >+ pac->privsvr_checksum->buffersize < 4) >+ return EINVAL; > > /* > * in the service case, clean out data option of the privsvr and > * server checksum before checking the checksum. > */ >+ if (server != NULL) > { > krb5_data *copy; > >@@ -897,6 +922,20 @@ krb5_pac_verify(krb5_context context, > privsvr); > if (ret) > return ret; >+ >+ if (pac->ticket_sign_data.length != 0) { >+ if (pac->ticket_checksum == NULL) { >+ krb5_set_error_message(context, EINVAL, >+ "PAC missing ticket checksum"); >+ return EINVAL; >+ } >+ >+ ret = verify_checksum(context, pac->ticket_checksum, &pac->data, >+ pac->ticket_sign_data.data, >+ pac->ticket_sign_data.length, privsvr); >+ if (ret) >+ return ret; >+ } > } > > return 0; >@@ -965,13 +1004,14 @@ _krb5_pac_sign(krb5_context context, > krb5_principal principal, > const krb5_keyblock *server_key, > const krb5_keyblock *priv_key, >+ uint16_t rodc_id, > krb5_data *data) > { > krb5_error_code ret; > krb5_storage *sp = NULL, *spdata = NULL; > uint32_t end; > size_t server_size, priv_size; >- uint32_t server_offset = 0, priv_offset = 0; >+ uint32_t server_offset = 0, priv_offset = 0, ticket_offset = 0; > uint32_t server_cksumtype = 0, priv_cksumtype = 0; > int num = 0; > size_t i; >@@ -985,9 +1025,9 @@ _krb5_pac_sign(krb5_context context, > p->server_checksum = &p->pac->buffers[i]; > } > if (p->server_checksum != &p->pac->buffers[i]) { >- ret = EINVAL; >+ ret = KRB5KDC_ERR_BADOPTION; > krb5_set_error_message(context, ret, >- N_("PAC have two server checksums", "")); >+ N_("PAC has multiple server checksums", "")); > goto out; > } > } else if (p->pac->buffers[i].type == PAC_PRIVSVR_CHECKSUM) { >@@ -995,9 +1035,9 @@ _krb5_pac_sign(krb5_context context, > p->privsvr_checksum = &p->pac->buffers[i]; > } > if (p->privsvr_checksum != &p->pac->buffers[i]) { >- ret = EINVAL; >+ ret = KRB5KDC_ERR_BADOPTION; > krb5_set_error_message(context, ret, >- N_("PAC have two KDC checksums", "")); >+ N_("PAC has multiple KDC checksums", "")); > goto out; > } > } else if (p->pac->buffers[i].type == PAC_LOGON_NAME) { >@@ -1005,9 +1045,19 @@ _krb5_pac_sign(krb5_context context, > p->logon_name = &p->pac->buffers[i]; > } > if (p->logon_name != &p->pac->buffers[i]) { >- ret = EINVAL; >+ ret = KRB5KDC_ERR_BADOPTION; >+ krb5_set_error_message(context, ret, >+ N_("PAC has multiple logon names", "")); >+ goto out; >+ } >+ } else if (p->pac->buffers[i].type == PAC_TICKET_CHECKSUM) { >+ if (p->ticket_checksum == NULL) { >+ p->ticket_checksum = &p->pac->buffers[i]; >+ } >+ if (p->ticket_checksum != &p->pac->buffers[i]) { >+ ret = KRB5KDC_ERR_BADOPTION; > krb5_set_error_message(context, ret, >- N_("PAC have two logon names", "")); >+ N_("PAC has multiple ticket checksums", "")); > goto out; > } > } >@@ -1019,6 +1069,8 @@ _krb5_pac_sign(krb5_context context, > num++; > if (p->privsvr_checksum == NULL) > num++; >+ if (p->ticket_sign_data.length != 0 && p->ticket_checksum == NULL) >+ num++; > > if (num) { > void *ptr; >@@ -1044,6 +1096,11 @@ _krb5_pac_sign(krb5_context context, > memset(p->privsvr_checksum, 0, sizeof(*p->privsvr_checksum)); > p->privsvr_checksum->type = PAC_PRIVSVR_CHECKSUM; > } >+ if (p->ticket_sign_data.length != 0 && p->ticket_checksum == NULL) { >+ p->ticket_checksum = &p->pac->buffers[p->pac->numbuffers++]; >+ memset(p->ticket_checksum, 0, sizeof(*p->privsvr_checksum)); >+ p->ticket_checksum->type = PAC_TICKET_CHECKSUM; >+ } > } > > /* Calculate LOGON NAME */ >@@ -1055,6 +1112,7 @@ _krb5_pac_sign(krb5_context context, > ret = pac_checksum(context, server_key, &server_cksumtype, &server_size); > if (ret) > goto out; >+ > ret = pac_checksum(context, priv_key, &priv_cksumtype, &priv_size); > if (ret) > goto out; >@@ -1095,10 +1153,24 @@ _krb5_pac_sign(krb5_context context, > priv_offset = end + 4; > CHECK(ret, krb5_store_uint32(spdata, priv_cksumtype), out); > CHECK(ret, fill_zeros(context, spdata, priv_size), out); >+ if (rodc_id != 0) { >+ len += sizeof(rodc_id); >+ CHECK(ret, fill_zeros(context, spdata, sizeof(rodc_id)), out); >+ } >+ } else if (p->ticket_sign_data.length != 0 && >+ p->pac->buffers[i].type == PAC_TICKET_CHECKSUM) { >+ len = priv_size + 4; >+ ticket_offset = end + 4; >+ CHECK(ret, krb5_store_uint32(spdata, priv_cksumtype), out); >+ CHECK(ret, fill_zeros(context, spdata, priv_size), out); >+ if (rodc_id != 0) { >+ len += sizeof(rodc_id); >+ CHECK(ret, krb5_store_uint16(spdata, rodc_id), out); >+ } > } else if (p->pac->buffers[i].type == PAC_LOGON_NAME) { > len = krb5_storage_write(spdata, logon.data, logon.length); > if (logon.length != len) { >- ret = EINVAL; >+ ret = KRB5KDC_ERR_BADOPTION; > goto out; > } > } else { >@@ -1156,6 +1228,16 @@ _krb5_pac_sign(krb5_context context, > } > > /* sign */ >+ if (p->ticket_sign_data.length) { >+ ret = create_checksum(context, priv_key, priv_cksumtype, >+ p->ticket_sign_data.data, >+ p->ticket_sign_data.length, >+ (char *)d.data + ticket_offset, priv_size); >+ if (ret) { >+ krb5_data_free(&d); >+ goto out; >+ } >+ } > ret = create_checksum(context, server_key, server_cksumtype, > d.data, d.length, > (char *)d.data + server_offset, server_size); >@@ -1171,6 +1253,32 @@ _krb5_pac_sign(krb5_context context, > goto out; > } > >+ if (rodc_id != 0) { >+ krb5_data rd; >+ krb5_storage *rs = krb5_storage_emem(); >+ if (rs == NULL) { >+ krb5_data_free(&d); >+ ret = krb5_enomem(context); >+ goto out; >+ } >+ krb5_storage_set_flags(rs, KRB5_STORAGE_BYTEORDER_LE); >+ ret = krb5_store_uint16(rs, rodc_id); >+ if (ret) { >+ krb5_storage_free(rs); >+ krb5_data_free(&d); >+ goto out; >+ } >+ ret = krb5_storage_to_data(rs, &rd); >+ krb5_storage_free(rs); >+ if (ret) { >+ krb5_data_free(&d); >+ goto out; >+ } >+ heim_assert(rd.length == sizeof(rodc_id), "invalid length"); >+ memcpy((char *)d.data + priv_offset + priv_size, rd.data, rd.length); >+ krb5_data_free(&rd); >+ } >+ > /* done */ > *data = d; > >@@ -1187,3 +1295,221 @@ out: > krb5_storage_free(spdata); > return ret; > } >+ >+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL >+_krb5_pac_get_kdc_checksum_info(krb5_context context, >+ krb5_pac pac, >+ krb5_cksumtype *cstype, >+ uint16_t *rodc_id) >+{ >+ krb5_error_code ret; >+ krb5_storage *sp = NULL; >+ const struct PAC_INFO_BUFFER *sig; >+ size_t cksumsize, prefix; >+ uint32_t type = 0; >+ >+ *cstype = 0; >+ *rodc_id = 0; >+ >+ sig = pac->privsvr_checksum; >+ if (sig == NULL) { >+ krb5_set_error_message(context, KRB5KDC_ERR_BADOPTION, >+ "PAC missing kdc checksum"); >+ return KRB5KDC_ERR_BADOPTION; >+ } >+ >+ sp = krb5_storage_from_mem((char *)pac->data.data + sig->offset_lo, >+ sig->buffersize); >+ if (sp == NULL) >+ return krb5_enomem(context); >+ >+ krb5_storage_set_flags(sp, KRB5_STORAGE_BYTEORDER_LE); >+ >+ ret = krb5_ret_uint32(sp, &type); >+ if (ret) >+ goto out; >+ >+ ret = krb5_checksumsize(context, type, &cksumsize); >+ if (ret) >+ goto out; >+ >+ prefix = krb5_storage_seek(sp, 0, SEEK_CUR); >+ >+ if ((sig->buffersize - prefix) >= cksumsize + 2) { >+ krb5_storage_seek(sp, cksumsize, SEEK_CUR); >+ ret = krb5_ret_uint16(sp, rodc_id); >+ if (ret) >+ goto out; >+ } >+ >+ *cstype = type; >+ >+out: >+ krb5_storage_free(sp); >+ >+ return ret; >+} >+ >+static unsigned char single_zero = '\0'; >+static krb5_data single_zero_pac = { 1, &single_zero }; >+ >+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL >+_krb5_kdc_pac_ticket_parse(krb5_context context, >+ EncTicketPart *tkt, >+ krb5_boolean *signedticket, >+ krb5_pac *ppac) >+{ >+ AuthorizationData *ad = tkt->authorization_data; >+ krb5_boolean pac_found = FALSE; >+ krb5_pac pac = NULL; >+ unsigned i, j; >+ size_t len = 0; >+ krb5_error_code ret; >+ >+ *signedticket = FALSE; >+ *ppac = NULL; >+ >+ if (ad == NULL || ad->len == 0) >+ return 0; >+ >+ for (i = 0; i < ad->len; i++) { >+ AuthorizationData child; >+ >+ if (ad->val[i].ad_type == KRB5_AUTHDATA_WIN2K_PAC) >+ return KRB5KDC_ERR_BADOPTION; >+ >+ if (ad->val[i].ad_type != KRB5_AUTHDATA_IF_RELEVANT) >+ continue; >+ >+ ret = decode_AuthorizationData(ad->val[i].ad_data.data, >+ ad->val[i].ad_data.length, >+ &child, >+ NULL); >+ if (ret) { >+ krb5_set_error_message(context, ret, "Failed to decode " >+ "AD-IF-RELEVANT with %d", ret); >+ return ret; >+ } >+ >+ for (j = 0; j < child.len; j++) { >+ if (child.val[j].ad_type == KRB5_AUTHDATA_WIN2K_PAC) { >+ krb5_data adifr_data = ad->val[i].ad_data; >+ krb5_data pac_data = child.val[j].ad_data; >+ krb5_data recoded_adifr; >+ >+ if (pac_found) { >+ free_AuthorizationData(&child); >+ return KRB5KDC_ERR_BADOPTION; >+ } >+ pac_found = TRUE; >+ >+ ret = krb5_pac_parse(context, >+ pac_data.data, >+ pac_data.length, >+ &pac); >+ if (ret) { >+ free_AuthorizationData(&child); >+ return ret; >+ } >+ >+ if (pac->ticket_checksum == NULL) { >+ free_AuthorizationData(&child); >+ *ppac = pac; >+ continue; >+ } >+ >+ /* >+ * Encode the ticket with the PAC replaced with a single zero >+ * byte, to be used as input data to the ticket signature. >+ */ >+ >+ child.val[j].ad_data = single_zero_pac; >+ >+ ASN1_MALLOC_ENCODE(AuthorizationData, recoded_adifr.data, >+ recoded_adifr.length, &child, &len, ret); >+ if (recoded_adifr.length != len) >+ krb5_abortx(context, "Internal error in ASN.1 encoder"); >+ >+ child.val[j].ad_data = pac_data; >+ free_AuthorizationData(&child); >+ >+ if (ret) { >+ krb5_pac_free(context, pac); >+ return ret; >+ } >+ >+ ad->val[i].ad_data = recoded_adifr; >+ >+ ASN1_MALLOC_ENCODE(EncTicketPart, >+ pac->ticket_sign_data.data, >+ pac->ticket_sign_data.length, tkt, &len, >+ ret); >+ if(pac->ticket_sign_data.length != len) >+ krb5_abortx(context, "Internal error in ASN.1 encoder"); >+ >+ ad->val[i].ad_data = adifr_data; >+ krb5_data_free(&recoded_adifr); >+ >+ if (ret) { >+ krb5_pac_free(context, pac); >+ return ret; >+ } >+ >+ *signedticket = TRUE; >+ *ppac = pac; >+ } >+ } >+ free_AuthorizationData(&child); >+ } >+ return 0; >+} >+ >+KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL >+_krb5_kdc_pac_sign_ticket(krb5_context context, >+ const krb5_pac pac, >+ krb5_principal client, >+ const krb5_keyblock *server_key, >+ const krb5_keyblock *kdc_key, >+ uint16_t rodc_id, >+ krb5_boolean add_ticket_sig, >+ EncTicketPart *tkt) >+{ >+ krb5_error_code ret; >+ krb5_data tkt_data; >+ krb5_data rspac; >+ >+ krb5_data_zero(&rspac); >+ krb5_data_zero(&tkt_data); >+ >+ krb5_data_free(&pac->ticket_sign_data); >+ >+ if (add_ticket_sig) { >+ size_t len = 0; >+ >+ ret = _kdc_tkt_insert_pac(context, tkt, &single_zero_pac); >+ if (ret) >+ return ret; >+ >+ ASN1_MALLOC_ENCODE(EncTicketPart, tkt_data.data, tkt_data.length, >+ tkt, &len, ret); >+ if(tkt_data.length != len) >+ krb5_abortx(context, "Internal error in ASN.1 encoder"); >+ if (ret) >+ return ret; >+ >+ ret = remove_AuthorizationData(tkt->authorization_data, 0); >+ if (ret) { >+ krb5_data_free(&tkt_data); >+ return ret; >+ } >+ >+ pac->ticket_sign_data = tkt_data; >+ } >+ >+ ret = _krb5_pac_sign(context, pac, tkt->authtime, client, server_key, >+ kdc_key, rodc_id, &rspac); >+ if (ret) >+ return ret; >+ >+ return _kdc_tkt_insert_pac(context, tkt, &rspac); >+} >diff --git a/source4/heimdal/lib/krb5/version-script.map b/source4/heimdal/lib/krb5/version-script.map >index ddae2a06764..91eb3543003 100644 >--- a/source4/heimdal/lib/krb5/version-script.map >+++ b/source4/heimdal/lib/krb5/version-script.map >@@ -751,6 +751,11 @@ HEIMDAL_KRB5_2.0 { > _krb5_get_host_realm_int; > _krb5_get_int; > _krb5_pac_sign; >+ _krb5_kdc_pac_sign_ticket; >+ _krb5_kdc_pac_ticket_parse; >+ _krb5_pac_get_kdc_checksum_info; >+ _kdc_tkt_insert_pac; >+ _kdc_tkt_add_if_relevant_ad; > _krb5_parse_moduli; > _krb5_pk_kdf; > _krb5_pk_load_id; >diff --git a/source4/heimdal_build/wscript_build b/source4/heimdal_build/wscript_build >index 9904b245218..f151788dcfd 100644 >--- a/source4/heimdal_build/wscript_build >+++ b/source4/heimdal_build/wscript_build >@@ -606,7 +606,7 @@ if not bld.CONFIG_SET("USING_SYSTEM_KRB5"): > KRB5_SOURCE = [os.path.join('lib/krb5/', x) for x in to_list( > '''acache.c add_et_list.c > addr_families.c appdefault.c >- asn1_glue.c auth_context.c >+ asn1_glue.c auth_context.c authdata.c > build_ap_req.c build_auth.c cache.c > changepw.c codec.c config_file.c > constants.c convert_creds.c >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 1f8554155bf..2d2d0af658f 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -743,7 +743,7 @@ planoldpythontestsuite("ad_dc:local", "samba.tests.gpo", extra_args=['-U"$USERNA > planoldpythontestsuite("ad_dc:local", "samba.tests.dckeytab", extra_args=['-U"$USERNAME%$PASSWORD"']) > > have_fast_support = int('SAMBA_USES_MITKDC' in config_hash) >-tkt_sig_support = 0 >+tkt_sig_support = int('SAMBA4_USES_HEIMDAL' in config_hash) > planoldpythontestsuite("none", "samba.tests.krb5.kcrypto") > planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.simple_tests", > environ={'SERVICE_USERNAME':'$SERVER', >-- >2.25.1 > > >From 74978c9ddf2e7d30f53a05d7a3cddd48c687d37c Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Sun, 19 Sep 2021 15:04:14 +0300 >Subject: [PATCH 348/380] krb5: allow NULL parameter to krb5_pac_free() > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >[jsutton@samba.org Cherry-picked from Heimdal commit >b295167208a96e68515902138f6ce93972892ec5] > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 2d09de5c41e729bccc2d7949d8a3568a95e80e76) >--- > source4/heimdal/kdc/krb5tgs.c | 3 +-- > source4/heimdal/lib/krb5/pac.c | 2 ++ > 2 files changed, 3 insertions(+), 2 deletions(-) > >diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c >index e8bbb42465f..24a4f261766 100644 >--- a/source4/heimdal/kdc/krb5tgs.c >+++ b/source4/heimdal/kdc/krb5tgs.c >@@ -2057,8 +2057,7 @@ out: > > free_EncTicketPart(&adtkt); > >- if (mspac) >- krb5_pac_free(context, mspac); >+ krb5_pac_free(context, mspac); > > return ret; > } >diff --git a/source4/heimdal/lib/krb5/pac.c b/source4/heimdal/lib/krb5/pac.c >index eec1e84c7bd..18f385fac1f 100644 >--- a/source4/heimdal/lib/krb5/pac.c >+++ b/source4/heimdal/lib/krb5/pac.c >@@ -435,6 +435,8 @@ krb5_pac_get_types(krb5_context context, > KRB5_LIB_FUNCTION void KRB5_LIB_CALL > krb5_pac_free(krb5_context context, krb5_pac pac) > { >+ if (pac == NULL) >+ return; > krb5_data_free(&pac->data); > krb5_data_free(&pac->ticket_sign_data); > free(pac->pac); >-- >2.25.1 > > >From 8f840ac4bc042d8d5d7d511ce2754477f002d781 Mon Sep 17 00:00:00 2001 >From: Isaac Boukris <iboukris@gmail.com> >Date: Sun, 19 Sep 2021 15:16:58 +0300 >Subject: [PATCH 349/380] krb5: rework PAC validation loop > >Avoid allocating the PAC on error. > >Closes: #836 > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >[jsutton@samba.org Cherry-picked from Heimdal commit >6df8be5091363a1c9a9165465ab8292f817bec81] > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 2773379603a5a625c5d1c6e62f29c442942ff570) >--- > source4/heimdal/lib/krb5/pac.c | 132 +++++++++++++++++---------------- > 1 file changed, 69 insertions(+), 63 deletions(-) > >diff --git a/source4/heimdal/lib/krb5/pac.c b/source4/heimdal/lib/krb5/pac.c >index 18f385fac1f..922a8710eda 100644 >--- a/source4/heimdal/lib/krb5/pac.c >+++ b/source4/heimdal/lib/krb5/pac.c >@@ -1362,11 +1362,10 @@ _krb5_kdc_pac_ticket_parse(krb5_context context, > krb5_pac *ppac) > { > AuthorizationData *ad = tkt->authorization_data; >- krb5_boolean pac_found = FALSE; > krb5_pac pac = NULL; > unsigned i, j; > size_t len = 0; >- krb5_error_code ret; >+ krb5_error_code ret = 0; > > *signedticket = FALSE; > *ppac = NULL; >@@ -1377,8 +1376,10 @@ _krb5_kdc_pac_ticket_parse(krb5_context context, > for (i = 0; i < ad->len; i++) { > AuthorizationData child; > >- if (ad->val[i].ad_type == KRB5_AUTHDATA_WIN2K_PAC) >- return KRB5KDC_ERR_BADOPTION; >+ if (ad->val[i].ad_type == KRB5_AUTHDATA_WIN2K_PAC) { >+ ret = KRB5KDC_ERR_BADOPTION; >+ goto out; >+ } > > if (ad->val[i].ad_type != KRB5_AUTHDATA_IF_RELEVANT) > continue; >@@ -1390,79 +1391,84 @@ _krb5_kdc_pac_ticket_parse(krb5_context context, > if (ret) { > krb5_set_error_message(context, ret, "Failed to decode " > "AD-IF-RELEVANT with %d", ret); >- return ret; >+ goto out; > } > > for (j = 0; j < child.len; j++) { >- if (child.val[j].ad_type == KRB5_AUTHDATA_WIN2K_PAC) { >- krb5_data adifr_data = ad->val[i].ad_data; >- krb5_data pac_data = child.val[j].ad_data; >- krb5_data recoded_adifr; >- >- if (pac_found) { >- free_AuthorizationData(&child); >- return KRB5KDC_ERR_BADOPTION; >- } >- pac_found = TRUE; >- >- ret = krb5_pac_parse(context, >- pac_data.data, >- pac_data.length, >- &pac); >- if (ret) { >- free_AuthorizationData(&child); >- return ret; >- } >- >- if (pac->ticket_checksum == NULL) { >- free_AuthorizationData(&child); >- *ppac = pac; >- continue; >- } >- >- /* >- * Encode the ticket with the PAC replaced with a single zero >- * byte, to be used as input data to the ticket signature. >- */ >- >- child.val[j].ad_data = single_zero_pac; >- >- ASN1_MALLOC_ENCODE(AuthorizationData, recoded_adifr.data, >- recoded_adifr.length, &child, &len, ret); >- if (recoded_adifr.length != len) >- krb5_abortx(context, "Internal error in ASN.1 encoder"); >- >- child.val[j].ad_data = pac_data; >+ krb5_data adifr_data = ad->val[i].ad_data; >+ krb5_data pac_data = child.val[j].ad_data; >+ krb5_data recoded_adifr; >+ >+ if (child.val[j].ad_type != KRB5_AUTHDATA_WIN2K_PAC) >+ continue; >+ >+ if (pac != NULL) { >+ free_AuthorizationData(&child); >+ ret = KRB5KDC_ERR_BADOPTION; >+ goto out; >+ } >+ >+ ret = krb5_pac_parse(context, >+ pac_data.data, >+ pac_data.length, >+ &pac); >+ if (ret) { > free_AuthorizationData(&child); >+ goto out; >+ } > >- if (ret) { >- krb5_pac_free(context, pac); >- return ret; >- } >+ if (pac->ticket_checksum == NULL) >+ continue; > >- ad->val[i].ad_data = recoded_adifr; >+ /* >+ * Encode the ticket with the PAC replaced with a single zero >+ * byte, to be used as input data to the ticket signature. >+ */ > >- ASN1_MALLOC_ENCODE(EncTicketPart, >- pac->ticket_sign_data.data, >- pac->ticket_sign_data.length, tkt, &len, >- ret); >- if(pac->ticket_sign_data.length != len) >- krb5_abortx(context, "Internal error in ASN.1 encoder"); >+ child.val[j].ad_data = single_zero_pac; > >- ad->val[i].ad_data = adifr_data; >- krb5_data_free(&recoded_adifr); >+ ASN1_MALLOC_ENCODE(AuthorizationData, recoded_adifr.data, >+ recoded_adifr.length, &child, &len, ret); >+ if (recoded_adifr.length != len) >+ krb5_abortx(context, "Internal error in ASN.1 encoder"); > >- if (ret) { >- krb5_pac_free(context, pac); >- return ret; >- } >+ child.val[j].ad_data = pac_data; > >- *signedticket = TRUE; >- *ppac = pac; >+ if (ret) { >+ free_AuthorizationData(&child); >+ goto out; > } >+ >+ ad->val[i].ad_data = recoded_adifr; >+ >+ ASN1_MALLOC_ENCODE(EncTicketPart, >+ pac->ticket_sign_data.data, >+ pac->ticket_sign_data.length, tkt, &len, >+ ret); >+ if (pac->ticket_sign_data.length != len) >+ krb5_abortx(context, "Internal error in ASN.1 encoder"); >+ >+ ad->val[i].ad_data = adifr_data; >+ krb5_data_free(&recoded_adifr); >+ >+ if (ret) { >+ free_AuthorizationData(&child); >+ goto out; >+ } >+ >+ *signedticket = TRUE; > } > free_AuthorizationData(&child); > } >+ >+out: >+ if (ret) { >+ krb5_pac_free(context, pac); >+ return ret; >+ } >+ >+ *ppac = pac; >+ > return 0; > } > >-- >2.25.1 > > >From 1c8674f90bcc82f604daaae73d7174170cb70814 Mon Sep 17 00:00:00 2001 >From: Luke Howard <lukeh@padl.com> >Date: Fri, 17 Sep 2021 13:57:57 +1000 >Subject: [PATCH 350/380] krb5: return KRB5KRB_AP_ERR_INAPP_CKSUM if PAC > checksum fails > >Return KRB5KRB_AP_ERR_INAPP_CKSUM instead of EINVAL when verifying a PAC, if >the checksum is absent or unkeyed. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >[jsutton@samba.org Cherry-picked from Heimdal commit >c4b99b48c4b18f30d504b427bc1961d7a71f631e] > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit d6a472e953545ec3858ca969c1a4191e4f27ba63) >--- > source4/heimdal/lib/krb5/pac.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/source4/heimdal/lib/krb5/pac.c b/source4/heimdal/lib/krb5/pac.c >index 922a8710eda..3e45125d35e 100644 >--- a/source4/heimdal/lib/krb5/pac.c >+++ b/source4/heimdal/lib/krb5/pac.c >@@ -489,13 +489,13 @@ verify_checksum(krb5_context context, > } > ret = krb5_storage_read(sp, cksum.checksum.data, cksum.checksum.length); > if (ret != (int)cksum.checksum.length) { >- ret = EINVAL; >+ ret = KRB5KRB_AP_ERR_INAPP_CKSUM; > krb5_set_error_message(context, ret, "PAC checksum missing checksum"); > goto out; > } > > if (!krb5_checksum_is_keyed(context, cksum.cksumtype)) { >- ret = EINVAL; >+ ret = KRB5KRB_AP_ERR_INAPP_CKSUM; > krb5_set_error_message(context, ret, "Checksum type %d not keyed", > cksum.cksumtype); > goto out; >-- >2.25.1 > > >From 674a7058e945a2f3f4d7fb75c59a5b12e26c3f23 Mon Sep 17 00:00:00 2001 >From: Luke Howard <lukeh@padl.com> >Date: Sun, 6 Jan 2019 17:54:58 +1100 >Subject: [PATCH 351/380] kdc: only set HDB_F_GET_KRBTGT when requesting TGS > principal > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >[jsutton@samba.org Backported from Heimdal commit > f1dd2b818aa0866960945edea02a6bc782ed697c > - Removed change to _kdc_find_etype() use_strongest_session_key > parameter since Samba's Heimdal version uses different logic >] > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit db30b71f79864a20b38a1f812a5df833f3a92de8) >--- > source4/heimdal/kdc/kerberos5.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > >diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c >index 7b17d2539ce..d1fd201113b 100644 >--- a/source4/heimdal/kdc/kerberos5.c >+++ b/source4/heimdal/kdc/kerberos5.c >@@ -983,6 +983,7 @@ _kdc_as_rep(krb5_context context, > pk_client_params *pkp = NULL; > #endif > const EncryptionKey *pk_reply_key = NULL; >+ krb5_boolean is_tgs; > > memset(&rep, 0, sizeof(rep)); > memset(&session_key, 0, sizeof(session_key)); >@@ -1033,6 +1034,8 @@ _kdc_as_rep(krb5_context context, > kdc_log(context, config, 0, "AS-REQ %s from %s for %s", > client_name, from, server_name); > >+ is_tgs = krb5_principal_is_krbtgt(context, server_princ); >+ > /* > * > */ >@@ -1101,7 +1104,7 @@ _kdc_as_rep(krb5_context context, > goto out; > } > ret = _kdc_db_fetch(context, config, server_princ, >- HDB_F_GET_SERVER|HDB_F_GET_KRBTGT | flags, >+ HDB_F_GET_SERVER | flags | (is_tgs ? HDB_F_GET_KRBTGT : 0), > NULL, NULL, &server); > if(ret == HDB_ERR_NOT_FOUND_HERE) { > kdc_log(context, config, 5, "target %s does not have secrets at this KDC, need to proxy", server_name); >-- >2.25.1 > > >From ce4200c9dd0fd33ee248b2915456c4eea4167725 Mon Sep 17 00:00:00 2001 >From: Luke Howard <lukeh@padl.com> >Date: Thu, 23 Sep 2021 14:39:35 +1000 >Subject: [PATCH 352/380] kdc: use ticket client name when signing PAC > >The principal in the PAC_LOGON_NAME buffer is expected to match the client name >in the ticket. Previously we were setting this to the canonical client name, >which would have broken PAC validation if the client did not request name >canonicalization > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >[jsutton@samba.org Backported from Heimdal commit > 3b0856cab2b25624deb1f6e0e67637ba96a647ac > - Renamed variable to avoid shadowing existing variable >] > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 75d1a7cd14b134506061ed64ddb9b99856231d2c) >--- > source4/heimdal/kdc/kerberos5.c | 12 +++++++++++- > 1 file changed, 11 insertions(+), 1 deletion(-) > >diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c >index d1fd201113b..6dc945b134a 100644 >--- a/source4/heimdal/kdc/kerberos5.c >+++ b/source4/heimdal/kdc/kerberos5.c >@@ -1716,6 +1716,7 @@ _kdc_as_rep(krb5_context context, > krb5_pac p = NULL; > krb5_data data; > uint16_t rodc_id; >+ krb5_principal client_pac; > > ret = _kdc_pac_generate(context, client, pk_reply_key, &p); > if (ret) { >@@ -1726,12 +1727,21 @@ _kdc_as_rep(krb5_context context, > if (p != NULL) { > rodc_id = server->entry.kvno >> 16; > >+ /* libkrb5 expects ticket and PAC client names to match */ >+ ret = _krb5_principalname2krb5_principal(context, &client_pac, >+ et.cname, et.crealm); >+ if (ret) { >+ krb5_pac_free(context, p); >+ goto out; >+ } >+ > ret = _krb5_pac_sign(context, p, et.authtime, >- client->entry.principal, >+ client_pac, > &skey->key, /* Server key */ > &skey->key, /* FIXME: should be krbtgt key */ > rodc_id, > &data); >+ krb5_free_principal(context, client_pac); > krb5_pac_free(context, p); > if (ret) { > kdc_log(context, config, 0, "PAC signing failed for -- %s", >-- >2.25.1 > > >From ba9bb5852e87c09dc802aa4a0a080eaa21eed486 Mon Sep 17 00:00:00 2001 >From: Luke Howard <lukeh@padl.com> >Date: Thu, 23 Sep 2021 17:51:51 +1000 >Subject: [PATCH 353/380] kdc: correctly generate PAC TGS signature > >When generating an AS-REQ, the TGS signature was incorrectly generated using >the server key, which would fail to validate if the server was not also the >TGS. Fix this. > >Patch from Isaac Bourkis <iboukris@gmail.com>. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >[jsutton@samba.org Backported from Heimdal commit > e7863e2af922809dad25a2e948e98c408944d551 > - Samba's Heimdal version does not have the generate_pac() helper > function. > - Samba's Heimdal version does not use the 'r' context variable. >] > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 91e684f5dcb48b76e6a322c15acb53cbce5c275a) >--- > source4/heimdal/kdc/kerberos5.c | 49 ++++++++++++++++++++++++++++++++- > 1 file changed, 48 insertions(+), 1 deletion(-) > >diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c >index 6dc945b134a..a131f1af08e 100644 >--- a/source4/heimdal/kdc/kerberos5.c >+++ b/source4/heimdal/kdc/kerberos5.c >@@ -948,6 +948,33 @@ _kdc_is_anonymous(krb5_context context, krb5_principal principal) > return 1; > } > >+static krb5_error_code >+get_local_tgs(krb5_context context, >+ krb5_kdc_configuration *config, >+ krb5_const_realm realm, >+ hdb_entry_ex **krbtgt) >+{ >+ krb5_error_code ret; >+ krb5_principal tgs_name; >+ >+ *krbtgt = NULL; >+ >+ ret = krb5_make_principal(context, >+ &tgs_name, >+ realm, >+ KRB5_TGS_NAME, >+ realm, >+ NULL); >+ if (ret) >+ return ret; >+ >+ ret = _kdc_db_fetch(context, config, tgs_name, >+ HDB_F_GET_KRBTGT, NULL, NULL, krbtgt); >+ krb5_free_principal(context, tgs_name); >+ >+ return ret; >+} >+ > /* > * > */ >@@ -984,6 +1011,8 @@ _kdc_as_rep(krb5_context context, > #endif > const EncryptionKey *pk_reply_key = NULL; > krb5_boolean is_tgs; >+ hdb_entry_ex *krbtgt = NULL; >+ Key *krbtgt_key = NULL; > > memset(&rep, 0, sizeof(rep)); > memset(&session_key, 0, sizeof(session_key)); >@@ -1466,6 +1495,22 @@ _kdc_as_rep(krb5_context context, > if(ret) > goto out; > >+ /* If server is not krbtgt, fetch local krbtgt key for signing authdata */ >+ if (is_tgs) { >+ krbtgt_key = skey; >+ } else { >+ ret = get_local_tgs(context, config, server_princ->realm, >+ &krbtgt); >+ if (ret) >+ goto out; >+ >+ ret = _kdc_get_preferred_key(context, config, krbtgt, >+ server_princ->realm, >+ NULL, &krbtgt_key); >+ if (ret) >+ goto out; >+ } >+ > if(f.renew || f.validate || f.proxy || f.forwarded || f.enc_tkt_in_skey > || (f.request_anonymous && !config->allow_anonymous)) { > ret = KRB5KDC_ERR_BADOPTION; >@@ -1738,7 +1783,7 @@ _kdc_as_rep(krb5_context context, > ret = _krb5_pac_sign(context, p, et.authtime, > client_pac, > &skey->key, /* Server key */ >- &skey->key, /* FIXME: should be krbtgt key */ >+ &krbtgt_key->key, /* TGS key */ > rodc_id, > &data); > krb5_free_principal(context, client_pac); >@@ -1807,6 +1852,8 @@ out: > _kdc_free_ent(context, client); > if(server) > _kdc_free_ent(context, server); >+ if (krbtgt) >+ _kdc_free_ent(context, krbtgt); > return ret; > } > >-- >2.25.1 > > >From 58024273dd7a2d508ba7154da06d1c2f5f48d3a9 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 11 Aug 2021 13:27:11 +1200 >Subject: [PATCH 354/380] s4/heimdal/lib/krb5/pac.c: Align PAC buffers to match > Windows > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 28a5a586c8e9cd155d676dcfcb81a2587ace99d1) >--- > selftest/knownfail_heimdal_kdc | 1 + > source4/heimdal/lib/krb5/pac.c | 14 +++++++++++++- > 2 files changed, 14 insertions(+), 1 deletion(-) > >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 4ec682c01d0..20eea7f2d7e 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -124,6 +124,7 @@ > # > # S4U tests > # >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_bronze_bit_constrained_delegation_old_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_bronze_bit_rbcd_old_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_service_pac > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_unkeyed_client_checksum >diff --git a/source4/heimdal/lib/krb5/pac.c b/source4/heimdal/lib/krb5/pac.c >index 3e45125d35e..6535a9bdcc4 100644 >--- a/source4/heimdal/lib/krb5/pac.c >+++ b/source4/heimdal/lib/krb5/pac.c >@@ -62,10 +62,12 @@ struct krb5_pac_data { > #define PACTYPE_SIZE 8 > #define PAC_INFO_BUFFER_SIZE 16 > >+#define PAC_LOGON_INFO 1 > #define PAC_SERVER_CHECKSUM 6 > #define PAC_PRIVSVR_CHECKSUM 7 > #define PAC_LOGON_NAME 10 > #define PAC_CONSTRAINED_DELEGATION 11 >+#define PAC_UPN_DNS_INFO 12 > #define PAC_TICKET_CHECKSUM 16 > > #define CHECK(r,f,l) \ >@@ -1184,7 +1186,17 @@ _krb5_pac_sign(krb5_context context, > ret = krb5_enomem(context); > goto out; > } >- /* XXX if not aligned, fill_zeros */ >+ >+ if (p->pac->buffers[i].type == PAC_LOGON_INFO >+ || p->pac->buffers[i].type == PAC_UPN_DNS_INFO) >+ { >+ uint32_t rounded = (len + PAC_ALIGNMENT - 1) / PAC_ALIGNMENT >+ * PAC_ALIGNMENT; >+ uint32_t remaining = rounded - len; >+ CHECK(ret, fill_zeros(context, spdata, remaining), out); >+ >+ len = rounded; >+ } > } > > /* write header */ >-- >2.25.1 > > >From 1296c695c9e69090a80d59a1450d3abf7e75779f Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 8 Oct 2021 15:43:41 +1300 >Subject: [PATCH 355/380] heimdal: Make _krb5_pac_get_kdc_checksum_info() into > a global function > >This lets us call it from Samba. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 3bdce12789af1e7a7aba56691f184625a432410d) >--- > source4/heimdal/lib/krb5/pac.c | 8 ++++---- > source4/heimdal/lib/krb5/version-script.map | 2 +- > 2 files changed, 5 insertions(+), 5 deletions(-) > >diff --git a/source4/heimdal/lib/krb5/pac.c b/source4/heimdal/lib/krb5/pac.c >index 6535a9bdcc4..f6d38178a88 100644 >--- a/source4/heimdal/lib/krb5/pac.c >+++ b/source4/heimdal/lib/krb5/pac.c >@@ -1311,10 +1311,10 @@ out: > } > > KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL >-_krb5_pac_get_kdc_checksum_info(krb5_context context, >- krb5_pac pac, >- krb5_cksumtype *cstype, >- uint16_t *rodc_id) >+krb5_pac_get_kdc_checksum_info(krb5_context context, >+ krb5_pac pac, >+ krb5_cksumtype *cstype, >+ uint16_t *rodc_id) > { > krb5_error_code ret; > krb5_storage *sp = NULL; >diff --git a/source4/heimdal/lib/krb5/version-script.map b/source4/heimdal/lib/krb5/version-script.map >index 91eb3543003..9ba00cd04f6 100644 >--- a/source4/heimdal/lib/krb5/version-script.map >+++ b/source4/heimdal/lib/krb5/version-script.map >@@ -470,6 +470,7 @@ HEIMDAL_KRB5_2.0 { > krb5_pac_add_buffer; > krb5_pac_free; > krb5_pac_get_buffer; >+ krb5_pac_get_kdc_checksum_info; > krb5_pac_get_types; > krb5_pac_init; > krb5_pac_parse; >@@ -753,7 +754,6 @@ HEIMDAL_KRB5_2.0 { > _krb5_pac_sign; > _krb5_kdc_pac_sign_ticket; > _krb5_kdc_pac_ticket_parse; >- _krb5_pac_get_kdc_checksum_info; > _kdc_tkt_insert_pac; > _kdc_tkt_add_if_relevant_ad; > _krb5_parse_moduli; >-- >2.25.1 > > >From fb5eb1829d6b63d15acce99cc7a155a9659e7a27 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 8 Oct 2021 16:08:39 +1300 >Subject: [PATCH 356/380] s4:kdc: Check ticket signature > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 02fa69c6c73c01d82807be4370e838f3e7c66f35) >--- > selftest/knownfail_heimdal_kdc | 9 -- > source4/kdc/wdc-samba4.c | 270 ++++++++++++++++++++++++++------- > 2 files changed, 215 insertions(+), 64 deletions(-) > >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 20eea7f2d7e..683dbacb979 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -124,13 +124,8 @@ > # > # S4U tests > # >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_bronze_bit_constrained_delegation_old_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_bronze_bit_rbcd_old_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_service_pac >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_unkeyed_client_checksum >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_unkeyed_service_checksum >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_zeroed_client_checksum >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_zeroed_service_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_existing_delegation_info > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_missing_client_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_client_pac_a >@@ -142,10 +137,6 @@ > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed > # >-# RODC tests >-# >-^samba.tests.krb5.rodc_tests.samba.tests.krb5.rodc_tests.RodcKerberosTests.test_rodc_ticket_signature >-# > # The lack of KRB5SignedPath means we no longer return > # KRB5KRB_ERR_RESPONSE_TOO_BIG in this specific case > # >diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c >index 037db40ce46..589df8a651d 100644 >--- a/source4/kdc/wdc-samba4.c >+++ b/source4/kdc/wdc-samba4.c >@@ -23,7 +23,10 @@ > > #include "includes.h" > #include "kdc/kdc-glue.h" >+#include "kdc/db-glue.h" > #include "kdc/pac-glue.h" >+#include "sdb.h" >+#include "sdb_hdb.h" > > /* > * Given the right private pointer from hdb_samba4, >@@ -94,15 +97,13 @@ static krb5_error_code samba_wdc_get_pac_compat(void *priv, krb5_context context > return samba_wdc_get_pac(priv, context, client, NULL, pac); > } > >-/* Resign (and reform, including possibly new groups) a PAC */ >- >-static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, >- const krb5_principal client_principal, >- const krb5_principal delegated_proxy_principal, >- struct hdb_entry_ex *client, >- struct hdb_entry_ex *server, >- struct hdb_entry_ex *krbtgt, >- krb5_pac *pac) >+static krb5_error_code samba_wdc_reget_pac2(krb5_context context, >+ const krb5_principal delegated_proxy_principal, >+ struct hdb_entry_ex *client, >+ struct hdb_entry_ex *server, >+ struct hdb_entry_ex *krbtgt, >+ krb5_pac *pac, >+ krb5_cksumtype ctype) > { > struct samba_kdc_entry *p = > talloc_get_type_abort(server->ctx, >@@ -110,15 +111,13 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > struct samba_kdc_entry *krbtgt_skdc_entry = > talloc_get_type_abort(krbtgt->ctx, > struct samba_kdc_entry); >- TALLOC_CTX *mem_ctx = talloc_named(p, 0, "samba_kdc_reget_pac context"); >+ TALLOC_CTX *mem_ctx = talloc_named(p, 0, "samba_kdc_reget_pac2 context"); > krb5_pac new_pac = NULL; > DATA_BLOB *pac_blob = NULL; > DATA_BLOB *upn_blob = NULL; > DATA_BLOB *deleg_blob = NULL; > krb5_error_code ret; > NTSTATUS nt_status; >- struct PAC_SIGNATURE_DATA *pac_srv_sig; >- struct PAC_SIGNATURE_DATA *pac_kdc_sig; > bool is_in_db, is_untrusted; > size_t num_types = 0; > uint32_t *types = NULL; >@@ -130,6 +129,7 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > ssize_t upn_dns_info_idx = -1; > ssize_t srv_checksum_idx = -1; > ssize_t kdc_checksum_idx = -1; >+ ssize_t tkt_checksum_idx = -1; > > if (!mem_ctx) { > return ENOMEM; >@@ -150,6 +150,71 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > return ret; > } > >+ if (delegated_proxy_principal != NULL) { >+ krb5_enctype etype; >+ Key *key = NULL; >+ >+ if (!is_in_db) { >+ /* >+ * The RODC-issued PAC was signed by a KDC entry that we >+ * don't have a key for. The server signature is not >+ * trustworthy, since it could have been created by the >+ * server we got the ticket from. We must not proceed as >+ * otherwise the ticket signature is unchecked. >+ */ >+ talloc_free(mem_ctx); >+ return HDB_ERR_NOT_FOUND_HERE; >+ } >+ >+ /* Fetch the correct key depending on the checksum type. */ >+ if (ctype == CKSUMTYPE_HMAC_MD5) { >+ etype = ENCTYPE_ARCFOUR_HMAC; >+ } else { >+ ret = krb5_cksumtype_to_enctype(context, >+ ctype, >+ &etype); >+ if (ret != 0) { >+ talloc_free(mem_ctx); >+ return ret; >+ } >+ } >+ ret = hdb_enctype2key(context, &krbtgt->entry, etype, &key); >+ if (ret != 0) { >+ return ret; >+ } >+ >+ /* Check the KDC and ticket signatures. */ >+ ret = krb5_pac_verify(context, >+ *pac, >+ 0, >+ NULL, >+ NULL, >+ &key->key); >+ if (ret != 0) { >+ DEBUG(1, ("PAC KDC signature failed to verify\n")); >+ talloc_free(mem_ctx); >+ return ret; >+ } >+ >+ deleg_blob = talloc_zero(mem_ctx, DATA_BLOB); >+ if (!deleg_blob) { >+ talloc_free(mem_ctx); >+ return ENOMEM; >+ } >+ >+ nt_status = samba_kdc_update_delegation_info_blob(mem_ctx, >+ context, *pac, >+ server->entry.principal, >+ delegated_proxy_principal, >+ deleg_blob); >+ if (!NT_STATUS_IS_OK(nt_status)) { >+ DEBUG(0, ("Building PAC failed: %s\n", >+ nt_errstr(nt_status))); >+ talloc_free(mem_ctx); >+ return EINVAL; >+ } >+ } >+ > if (is_untrusted) { > struct samba_kdc_entry *client_skdc_entry = NULL; > >@@ -173,52 +238,10 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > return ENOMEM; > } > >- pac_srv_sig = talloc_zero(mem_ctx, struct PAC_SIGNATURE_DATA); >- if (!pac_srv_sig) { >- talloc_free(mem_ctx); >- return ENOMEM; >- } >- >- pac_kdc_sig = talloc_zero(mem_ctx, struct PAC_SIGNATURE_DATA); >- if (!pac_kdc_sig) { >- talloc_free(mem_ctx); >- return ENOMEM; >- } >- > nt_status = samba_kdc_update_pac_blob(mem_ctx, context, > krbtgt_skdc_entry->kdc_db_ctx->samdb, > *pac, pac_blob, >- pac_srv_sig, pac_kdc_sig); >- if (!NT_STATUS_IS_OK(nt_status)) { >- DEBUG(0, ("Building PAC failed: %s\n", >- nt_errstr(nt_status))); >- talloc_free(mem_ctx); >- return EINVAL; >- } >- >- if (is_in_db) { >- /* Now check the KDC signature, fetching the correct key based on the enc type */ >- ret = kdc_check_pac(context, pac_srv_sig->signature, pac_kdc_sig, krbtgt); >- if (ret != 0) { >- DEBUG(1, ("PAC KDC signature failed to verify\n")); >- talloc_free(mem_ctx); >- return ret; >- } >- } >- } >- >- if (delegated_proxy_principal) { >- deleg_blob = talloc_zero(mem_ctx, DATA_BLOB); >- if (!deleg_blob) { >- talloc_free(mem_ctx); >- return ENOMEM; >- } >- >- nt_status = samba_kdc_update_delegation_info_blob(mem_ctx, >- context, *pac, >- server->entry.principal, >- delegated_proxy_principal, >- deleg_blob); >+ NULL, NULL); > if (!NT_STATUS_IS_OK(nt_status)) { > DEBUG(0, ("Building PAC failed: %s\n", > nt_errstr(nt_status))); >@@ -308,6 +331,18 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > } > kdc_checksum_idx = i; > break; >+ case PAC_TYPE_TICKET_CHECKSUM: >+ if (tkt_checksum_idx != -1) { >+ DEBUG(1, ("ticket checksum type[%"PRIu32"] twice [%zd] and [%zu]: \n", >+ types[i], >+ tkt_checksum_idx, >+ i)); >+ SAFE_FREE(types); >+ talloc_free(mem_ctx); >+ return EINVAL; >+ } >+ tkt_checksum_idx = i; >+ break; > default: > continue; > } >@@ -471,6 +506,131 @@ static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, > return ret; > } > >+/* Resign (and reform, including possibly new groups) a PAC */ >+ >+static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context, >+ const krb5_principal client_principal, >+ const krb5_principal delegated_proxy_principal, >+ struct hdb_entry_ex *client, >+ struct hdb_entry_ex *server, >+ struct hdb_entry_ex *krbtgt, >+ krb5_pac *pac) >+{ >+ struct samba_kdc_entry *krbtgt_skdc_entry = >+ talloc_get_type_abort(krbtgt->ctx, >+ struct samba_kdc_entry); >+ krb5_error_code ret; >+ krb5_cksumtype ctype = CKSUMTYPE_NONE; >+ struct hdb_entry_ex signing_krbtgt_hdb; >+ >+ if (delegated_proxy_principal) { >+ uint16_t rodc_id; >+ unsigned int my_krbtgt_number; >+ >+ /* >+ * We're using delegated_proxy_principal for the moment to >+ * indicate cases where the ticket was encrypted with the server >+ * key, and not a krbtgt key. This cannot be trusted, so we need >+ * to find a krbtgt key that signs the PAC in order to trust the >+ * ticket. >+ * >+ * The krbtgt passed in to this function refers to the krbtgt >+ * used to decrypt the ticket of the server requesting >+ * S4U2Proxy. >+ * >+ * When we implement service ticket renewal, we need to check >+ * the PAC, and this will need to be updated. >+ */ >+ ret = krb5_pac_get_kdc_checksum_info(context, >+ *pac, >+ &ctype, >+ &rodc_id); >+ if (ret != 0) { >+ DEBUG(1, ("Failed to get PAC checksum info\n")); >+ return ret; >+ } >+ >+ /* >+ * We need to check the KDC and ticket signatures, fetching the >+ * correct key based on the enctype. >+ */ >+ >+ my_krbtgt_number = krbtgt_skdc_entry->kdc_db_ctx->my_krbtgt_number; >+ >+ if (my_krbtgt_number != 0) { >+ /* >+ * If we are an RODC, and we are not the KDC that signed >+ * the evidence ticket, then we need to proxy the >+ * request. >+ */ >+ if (rodc_id != my_krbtgt_number) { >+ return HDB_ERR_NOT_FOUND_HERE; >+ } >+ } else { >+ /* >+ * If we are a DC, the ticket may have been signed by a >+ * different KDC than the one that issued the header >+ * ticket. >+ */ >+ if (rodc_id != krbtgt->entry.kvno >> 16) { >+ struct sdb_entry_ex signing_krbtgt_sdb; >+ >+ /* >+ * If we didn't sign the ticket, then return an >+ * error. >+ */ >+ if (rodc_id != 0) { >+ return KRB5KRB_AP_ERR_MODIFIED; >+ } >+ >+ /* >+ * Fetch our key from the database. To support >+ * key rollover, we're going to need to try >+ * multiple keys by trial and error. For now, >+ * krbtgt keys aren't assumed to change. >+ */ >+ ret = samba_kdc_fetch(context, >+ krbtgt_skdc_entry->kdc_db_ctx, >+ krbtgt->entry.principal, >+ SDB_F_GET_KRBTGT | SDB_F_CANON, >+ 0, >+ &signing_krbtgt_sdb); >+ if (ret != 0) { >+ return ret; >+ } >+ >+ ret = sdb_entry_ex_to_hdb_entry_ex(context, >+ &signing_krbtgt_sdb, >+ &signing_krbtgt_hdb); >+ sdb_free_entry(&signing_krbtgt_sdb); >+ if (ret != 0) { >+ return ret; >+ } >+ >+ /* >+ * Replace the krbtgt entry with our own entry >+ * for further processing. >+ */ >+ krbtgt = &signing_krbtgt_hdb; >+ } >+ } >+ } >+ >+ ret = samba_wdc_reget_pac2(context, >+ delegated_proxy_principal, >+ client, >+ server, >+ krbtgt, >+ pac, >+ ctype); >+ >+ if (krbtgt == &signing_krbtgt_hdb) { >+ hdb_free_entry(context, &signing_krbtgt_hdb); >+ } >+ >+ return ret; >+} >+ > static char *get_netbios_name(TALLOC_CTX *mem_ctx, HostAddresses *addrs) > { > char *nb_name = NULL; >-- >2.25.1 > > >From e9b87991ca019e8a6aedb91a9faa4f279ba9a3a6 Mon Sep 17 00:00:00 2001 >From: Nicolas Williams <nico@twosigma.com> >Date: Sun, 10 Oct 2021 21:55:59 -0500 >Subject: [PATCH 357/380] krb5: Fix PAC signature leak affecting KDC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >[jsutton@samba.org Cherry-picked from Heimdal commit > 54581d2d52443a9a07ed5980df331f660b397dcf] > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit f6adfefbbb41b9100736134d0f975f1ec0c33c42) >--- > source4/heimdal/lib/krb5/pac.c | 136 +++++++++++++++------------------ > 1 file changed, 61 insertions(+), 75 deletions(-) > >diff --git a/source4/heimdal/lib/krb5/pac.c b/source4/heimdal/lib/krb5/pac.c >index f6d38178a88..05bcc523080 100644 >--- a/source4/heimdal/lib/krb5/pac.c >+++ b/source4/heimdal/lib/krb5/pac.c >@@ -1018,9 +1018,10 @@ _krb5_pac_sign(krb5_context context, > uint32_t server_offset = 0, priv_offset = 0, ticket_offset = 0; > uint32_t server_cksumtype = 0, priv_cksumtype = 0; > int num = 0; >- size_t i; >+ size_t i, sz; > krb5_data logon, d; > >+ krb5_data_zero(&d); > krb5_data_zero(&logon); > > for (i = 0; i < p->pac->numbuffers; i++) { >@@ -1080,8 +1081,10 @@ _krb5_pac_sign(krb5_context context, > void *ptr; > > ptr = realloc(p->pac, sizeof(*p->pac) + (sizeof(p->pac->buffers[0]) * (p->pac->numbuffers + num - 1))); >- if (ptr == NULL) >- return krb5_enomem(context); >+ if (ptr == NULL) { >+ ret = krb5_enomem(context); >+ goto out; >+ } > > p->pac = ptr; > >@@ -1109,30 +1112,33 @@ _krb5_pac_sign(krb5_context context, > > /* Calculate LOGON NAME */ > ret = build_logon_name(context, authtime, principal, &logon); >- if (ret) >- goto out; > > /* Set lengths for checksum */ >- ret = pac_checksum(context, server_key, &server_cksumtype, &server_size); >- if (ret) >- goto out; >+ if (ret == 0) >+ ret = pac_checksum(context, server_key, &server_cksumtype, &server_size); > >- ret = pac_checksum(context, priv_key, &priv_cksumtype, &priv_size); >- if (ret) >- goto out; >+ if (ret == 0) >+ ret = pac_checksum(context, priv_key, &priv_cksumtype, &priv_size); > > /* Encode PAC */ >- sp = krb5_storage_emem(); >- if (sp == NULL) >- return krb5_enomem(context); >- >- krb5_storage_set_flags(sp, KRB5_STORAGE_BYTEORDER_LE); >+ if (ret == 0) { >+ sp = krb5_storage_emem(); >+ if (sp == NULL) >+ ret = krb5_enomem(context); >+ } > >- spdata = krb5_storage_emem(); >- if (spdata == NULL) { >- krb5_storage_free(sp); >- return krb5_enomem(context); >+ if (ret == 0) { >+ krb5_storage_set_flags(sp, KRB5_STORAGE_BYTEORDER_LE); >+ spdata = krb5_storage_emem(); >+ if (spdata == NULL) { >+ krb5_storage_free(sp); >+ ret = krb5_enomem(context); >+ } > } >+ >+ if (ret) >+ goto out; >+ > krb5_storage_set_flags(spdata, KRB5_STORAGE_BYTEORDER_LE); > > CHECK(ret, krb5_store_uint32(sp, p->pac->numbuffers), out); >@@ -1222,77 +1228,56 @@ _krb5_pac_sign(krb5_context context, > /* assert (server_offset != 0 && priv_offset != 0); */ > > /* export PAC */ >- ret = krb5_storage_to_data(spdata, &d); >- if (ret) { >- krb5_set_error_message(context, ret, N_("malloc: out of memory", "")); >- goto out; >- } >- ret = krb5_storage_write(sp, d.data, d.length); >- if (ret != (int)d.length) { >- krb5_data_free(&d); >- ret = krb5_enomem(context); >- goto out; >+ if (ret == 0) >+ ret = krb5_storage_to_data(spdata, &d); >+ if (ret == 0) { >+ sz = krb5_storage_write(sp, d.data, d.length); >+ if (sz != d.length) { >+ krb5_data_free(&d); >+ ret = krb5_enomem(context); >+ goto out; >+ } > } > krb5_data_free(&d); > >- ret = krb5_storage_to_data(sp, &d); >- if (ret) { >- ret = krb5_enomem(context); >- goto out; >- } >+ if (ret == 0) >+ ret = krb5_storage_to_data(sp, &d); > > /* sign */ >- if (p->ticket_sign_data.length) { >+ if (ret == 0 && p->ticket_sign_data.length) > ret = create_checksum(context, priv_key, priv_cksumtype, > p->ticket_sign_data.data, > p->ticket_sign_data.length, > (char *)d.data + ticket_offset, priv_size); >- if (ret) { >- krb5_data_free(&d); >- goto out; >- } >- } >- ret = create_checksum(context, server_key, server_cksumtype, >- d.data, d.length, >- (char *)d.data + server_offset, server_size); >- if (ret) { >- krb5_data_free(&d); >- goto out; >- } >- ret = create_checksum(context, priv_key, priv_cksumtype, >- (char *)d.data + server_offset, server_size, >- (char *)d.data + priv_offset, priv_size); >- if (ret) { >- krb5_data_free(&d); >- goto out; >- } >- >- if (rodc_id != 0) { >+ if (ret == 0) >+ ret = create_checksum(context, server_key, server_cksumtype, >+ d.data, d.length, >+ (char *)d.data + server_offset, server_size); >+ if (ret == 0) >+ ret = create_checksum(context, priv_key, priv_cksumtype, >+ (char *)d.data + server_offset, server_size, >+ (char *)d.data + priv_offset, priv_size); >+ if (ret == 0 && rodc_id != 0) { > krb5_data rd; > krb5_storage *rs = krb5_storage_emem(); >- if (rs == NULL) { >- krb5_data_free(&d); >+ if (rs == NULL) > ret = krb5_enomem(context); >- goto out; >- } > krb5_storage_set_flags(rs, KRB5_STORAGE_BYTEORDER_LE); >- ret = krb5_store_uint16(rs, rodc_id); >- if (ret) { >- krb5_storage_free(rs); >- krb5_data_free(&d); >- goto out; >- } >- ret = krb5_storage_to_data(rs, &rd); >+ if (ret == 0) >+ ret = krb5_store_uint16(rs, rodc_id); >+ if (ret == 0) >+ ret = krb5_storage_to_data(rs, &rd); > krb5_storage_free(rs); >- if (ret) { >- krb5_data_free(&d); >+ if (ret) > goto out; >- } > heim_assert(rd.length == sizeof(rodc_id), "invalid length"); > memcpy((char *)d.data + priv_offset + priv_size, rd.data, rd.length); > krb5_data_free(&rd); > } > >+ if (ret) >+ goto out; >+ > /* done */ > *data = d; > >@@ -1302,6 +1287,7 @@ _krb5_pac_sign(krb5_context context, > > return 0; > out: >+ krb5_data_free(&d); > krb5_data_free(&logon); > if (sp) > krb5_storage_free(sp); >@@ -1528,8 +1514,8 @@ _krb5_kdc_pac_sign_ticket(krb5_context context, > > ret = _krb5_pac_sign(context, pac, tkt->authtime, client, server_key, > kdc_key, rodc_id, &rspac); >- if (ret) >- return ret; >- >- return _kdc_tkt_insert_pac(context, tkt, &rspac); >+ if (ret == 0) >+ ret = _kdc_tkt_insert_pac(context, tkt, &rspac); >+ krb5_data_free(&rspac); >+ return ret; > } >-- >2.25.1 > > >From 8ef4e25e309c9e6010b5eedd709215e3d1643529 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Fri, 15 Oct 2021 13:09:20 +1300 >Subject: [PATCH 358/380] selftest/dbcheck: Fix up RODC one-way links (use > correct dbcheck rule) > >The previous commit was correct on intention, but it was not noticed >as there is a race, that the incorrect rule was appended to. > >These links are removed by remove_plausible_deleted_DN_links not >fix_all_old_dn_string_component_mismatch > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Fri Oct 15 10:00:47 UTC 2021 on sn-devel-184 > >(cherry picked from commit a7ad665e65f0701eb75cac5bc10a366ccd9689f4) >--- > testprogs/blackbox/dbcheck.sh | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/testprogs/blackbox/dbcheck.sh b/testprogs/blackbox/dbcheck.sh >index e2ba987e2de..5462441005e 100755 >--- a/testprogs/blackbox/dbcheck.sh >+++ b/testprogs/blackbox/dbcheck.sh >@@ -19,12 +19,12 @@ dbcheck() { > > # This list of attributes can be freely extended > dbcheck_fix_one_way_links() { >- $PYTHON $BINDIR/samba-tool dbcheck --quiet --fix --yes fix_all_old_dn_string_component_mismatch --attrs="lastKnownParent defaultObjectCategory fromServer rIDSetReferences msDS-RevealOnDemandGroup msDS-NeverRevealGroup" --cross-ncs $ARGS >+ $PYTHON $BINDIR/samba-tool dbcheck --quiet --fix --yes fix_all_old_dn_string_component_mismatch --attrs="lastKnownParent defaultObjectCategory fromServer rIDSetReferences" --cross-ncs $ARGS > } > > # This list of attributes can be freely extended > dbcheck_fix_stale_links() { >- $PYTHON $BINDIR/samba-tool dbcheck --quiet --fix --yes remove_plausible_deleted_DN_links --attrs="member msDS-NC-Replica-Locations msDS-NC-RO-Replica-Locations" --cross-ncs $ARGS >+ $PYTHON $BINDIR/samba-tool dbcheck --quiet --fix --yes remove_plausible_deleted_DN_links --attrs="member msDS-NC-Replica-Locations msDS-NC-RO-Replica-Locations msDS-RevealOnDemandGroup msDS-NeverRevealGroup" --cross-ncs $ARGS > } > > # This list of attributes can be freely extended >-- >2.25.1 > > >From 5707827592052ddc81ac9296c704eee896970249 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 15 Oct 2021 12:12:30 +1300 >Subject: [PATCH 359/380] heimdal:kdc: Fix ticket signing without a PAC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit d23d8e859357b0fac4d1f4a49f1dce6cf60d6216) >--- > source4/heimdal/kdc/krb5tgs.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > >diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c >index 24a4f261766..b0c873a4ffb 100644 >--- a/source4/heimdal/kdc/krb5tgs.c >+++ b/source4/heimdal/kdc/krb5tgs.c >@@ -695,10 +695,12 @@ tgs_make_reply(krb5_context context, > } > > /* The PAC should be the last change to the ticket. */ >- ret = _krb5_kdc_pac_sign_ticket(context, mspac, tgt_name, serverkey, >- krbtgtkey, rodc_id, add_ticket_sig, &et); >+ if (mspac != NULL) { >+ ret = _krb5_kdc_pac_sign_ticket(context, mspac, tgt_name, serverkey, >+ krbtgtkey, rodc_id, add_ticket_sig, &et); > if (ret) > goto out; >+ } > > /* It is somewhat unclear where the etype in the following > encryption should come from. What we have is a session >-- >2.25.1 > > >From f7f6584d0a6d981fd672e6344c8bcf05dcd454ed Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 15 Oct 2021 14:26:40 +1300 >Subject: [PATCH 360/380] tests/krb5: Allow get_tgt() to request including or > omitting a PAC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit e086c6193f6da6fcb5d0bcada2199e9bc7ad25f5) >--- > python/samba/tests/krb5/kdc_base_test.py | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 87160f675ae..1fc15315b0b 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -1306,9 +1306,9 @@ class KDCBaseTest(RawKerberosTest): > > def get_tgt(self, creds, to_rodc=False, kdc_options=None, > expected_flags=None, unexpected_flags=None, >- fresh=False): >+ pac_request=True, expect_pac=True, fresh=False): > user_name = creds.get_username() >- cache_key = (user_name, to_rodc, kdc_options) >+ cache_key = (user_name, to_rodc, kdc_options, pac_request) > > if not fresh: > tgt = self.tkt_cache.get(cache_key) >@@ -1363,7 +1363,7 @@ class KDCBaseTest(RawKerberosTest): > kdc_options=kdc_options, > preauth_key=None, > ticket_decryption_key=ticket_decryption_key, >- pac_request=True, >+ pac_request=pac_request, > pac_options=pac_options, > to_rodc=to_rodc) > self.check_pre_authentication(rep) >@@ -1405,8 +1405,9 @@ class KDCBaseTest(RawKerberosTest): > kdc_options=kdc_options, > preauth_key=preauth_key, > ticket_decryption_key=ticket_decryption_key, >- pac_request=True, >+ pac_request=pac_request, > pac_options=pac_options, >+ expect_pac=expect_pac, > to_rodc=to_rodc) > self.check_as_reply(rep) > >-- >2.25.1 > > >From 906ee9cb772d5e57559512bf60dc879fb60cf3e8 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 15 Oct 2021 14:27:15 +1300 >Subject: [PATCH 361/380] tests/krb5: Allow specifying whether to expect a PAC > with _test_as_exchange() > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 0dc69c1327f72384628a869a00482f6528b8671b) >--- > python/samba/tests/krb5/raw_testcase.py | 2 ++ > 1 file changed, 2 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index e008223eb23..29dc5f397b6 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -3530,6 +3530,7 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_decryption_key=None, > pac_request=None, > pac_options=None, >+ expect_pac=True, > to_rodc=False): > > def _generate_padata_copy(_kdc_exchange_dict, >@@ -3569,6 +3570,7 @@ class RawKerberosTest(TestCaseInTempDir): > kdc_options=str(kdc_options), > pac_request=pac_request, > pac_options=pac_options, >+ expect_pac=expect_pac, > to_rodc=to_rodc) > > rep = self._generic_kdc_exchange(kdc_exchange_dict, >-- >2.25.1 > > >From f8f92fa80dc9ab7cdcfb7b7167a418c2769620c8 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 15 Oct 2021 14:27:25 +1300 >Subject: [PATCH 362/380] tests/krb5: Add method to get the PAC from a ticket > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> >(cherry picked from commit 288355896a2b6f460c42559ec46ff980ab57782e) >--- > python/samba/tests/krb5/raw_testcase.py | 9 +++++++++ > 1 file changed, 9 insertions(+) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 29dc5f397b6..0790ac13f99 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -3447,6 +3447,15 @@ class RawKerberosTest(TestCaseInTempDir): > _, pac = self.replace_pac(auth_data, None, expect_pac) > return pac > >+ def get_ticket_pac(self, ticket, expect_pac=True): >+ auth_data = ticket.ticket_private.get('authorization-data') >+ if expect_pac: >+ self.assertIsNotNone(auth_data) >+ elif auth_data is None: >+ return None >+ >+ return self.get_pac(auth_data, expect_pac=expect_pac) >+ > def get_krbtgt_checksum_key(self): > krbtgt_creds = self.get_krbtgt_creds() > krbtgt_key = self.TicketDecryptionKey_from_creds(krbtgt_creds) >-- >2.25.1 > > >From 43bee90b942082f5553d20209ecabd8e5bff2670 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 15 Oct 2021 14:29:26 +1300 >Subject: [PATCH 363/380] tests/krb5: Add tests for requesting a service ticket > without a PAC > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Sun Oct 17 23:40:33 UTC 2021 on sn-devel-184 > >[abartlet@samba.org backported from commit 9d3a691920205f8a9dc05d0e173e25e6a335f139 > as the MIT KDC 1.16 seen on the reference Ubuntu 18.04 does not fail > test_remove_pac] >--- > python/samba/tests/krb5/kdc_tgs_tests.py | 120 +++++++++++++++++++++++ > selftest/knownfail_heimdal_kdc | 5 + > selftest/knownfail_mit_kdc | 4 + > 3 files changed, 129 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py >index 3075cc6b0a9..9d846a2c3ad 100755 >--- a/python/samba/tests/krb5/kdc_tgs_tests.py >+++ b/python/samba/tests/krb5/kdc_tgs_tests.py >@@ -23,15 +23,18 @@ import os > sys.path.insert(0, "bin/python") > os.environ["PYTHONUNBUFFERED"] = "1" > >+import samba.tests.krb5.kcrypto as kcrypto > from samba.tests.krb5.kdc_base_test import KDCBaseTest > from samba.tests.krb5.rfc4120_constants import ( > AES256_CTS_HMAC_SHA1_96, > ARCFOUR_HMAC_MD5, > KRB_ERROR, >+ KRB_TGS_REP, > KDC_ERR_BADMATCH, > NT_PRINCIPAL, > NT_SRV_INST, > ) >+import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1 > > global_asn1_print = False > global_hexdump = False >@@ -209,6 +212,123 @@ class KdcTgsTests(KDCBaseTest): > pac_data.account_sid, > "rep = {%s},%s" % (rep, pac_data)) > >+ def _make_tgs_request(self, client_creds, service_creds, tgt, >+ expect_pac=True): >+ client_account = client_creds.get_username() >+ cname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[client_account]) >+ >+ service_account = service_creds.get_username() >+ sname = self.PrincipalName_create(name_type=NT_PRINCIPAL, >+ names=[service_account]) >+ >+ realm = service_creds.get_realm() >+ >+ expected_crealm = realm >+ expected_cname = cname >+ expected_srealm = realm >+ expected_sname = sname >+ >+ expected_supported_etypes = service_creds.tgs_supported_enctypes >+ >+ etypes = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5) >+ >+ kdc_options = str(krb5_asn1.KDCOptions('canonicalize')) >+ >+ target_decryption_key = self.TicketDecryptionKey_from_creds( >+ service_creds) >+ >+ authenticator_subkey = self.RandomKey(kcrypto.Enctype.AES256) >+ >+ kdc_exchange_dict = self.tgs_exchange_dict( >+ expected_crealm=expected_crealm, >+ expected_cname=expected_cname, >+ expected_srealm=expected_srealm, >+ expected_sname=expected_sname, >+ expected_supported_etypes=expected_supported_etypes, >+ ticket_decryption_key=target_decryption_key, >+ check_rep_fn=self.generic_check_kdc_rep, >+ check_kdc_private_fn=self.generic_check_kdc_private, >+ expected_error_mode=0, >+ tgt=tgt, >+ authenticator_subkey=authenticator_subkey, >+ kdc_options=kdc_options, >+ expect_pac=expect_pac) >+ >+ rep = self._generic_kdc_exchange(kdc_exchange_dict, >+ cname=cname, >+ realm=realm, >+ sname=sname, >+ etypes=etypes) >+ self.check_reply(rep, KRB_TGS_REP) >+ >+ return kdc_exchange_dict['rep_ticket_creds'] >+ >+ def test_request_no_pac(self): >+ client_creds = self.get_client_creds() >+ service_creds = self.get_service_creds() >+ >+ tgt = self.get_tgt(client_creds, pac_request=False, >+ expect_pac=False) >+ >+ pac = self.get_ticket_pac(tgt, expect_pac=False) >+ self.assertIsNone(pac) >+ >+ ticket = self._make_tgs_request(client_creds, service_creds, tgt, >+ expect_pac=False) >+ >+ pac = self.get_ticket_pac(ticket, expect_pac=False) >+ self.assertIsNone(pac) >+ >+ def test_client_no_auth_data_required(self): >+ client_creds = self.get_cached_creds( >+ machine_account=False, >+ opts={'no_auth_data_required': True}) >+ service_creds = self.get_service_creds() >+ >+ tgt = self.get_tgt(client_creds) >+ >+ pac = self.get_ticket_pac(tgt) >+ self.assertIsNotNone(pac) >+ >+ ticket = self._make_tgs_request(client_creds, service_creds, tgt) >+ >+ pac = self.get_ticket_pac(ticket) >+ self.assertIsNotNone(pac) >+ >+ def test_service_no_auth_data_required(self): >+ client_creds = self.get_client_creds() >+ service_creds = self.get_cached_creds( >+ machine_account=True, >+ opts={'no_auth_data_required': True}) >+ >+ tgt = self.get_tgt(client_creds) >+ >+ pac = self.get_ticket_pac(tgt) >+ self.assertIsNotNone(pac) >+ >+ ticket = self._make_tgs_request(client_creds, service_creds, tgt, >+ expect_pac=False) >+ >+ pac = self.get_ticket_pac(ticket, expect_pac=False) >+ self.assertIsNone(pac) >+ >+ def test_remove_pac(self): >+ client_creds = self.get_client_creds() >+ service_creds = self.get_service_creds() >+ >+ tgt = self.modified_ticket(self.get_tgt(client_creds), >+ exclude_pac=True) >+ >+ pac = self.get_ticket_pac(tgt, expect_pac=False) >+ self.assertIsNone(pac) >+ >+ ticket = self._make_tgs_request(client_creds, service_creds, tgt, >+ expect_pac=False) >+ >+ pac = self.get_ticket_pac(ticket, expect_pac=False) >+ self.assertIsNone(pac) >+ > > if __name__ == "__main__": > global_asn1_print = False >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 683dbacb979..32cfa2afa88 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -141,3 +141,8 @@ > # KRB5KRB_ERR_RESPONSE_TOO_BIG in this specific case > # > ^samba4.krb5.kdc with machine account.as-req-pac-request.fl2000dc:local >+# >+# TGS tests >+# >+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_client_no_auth_data_required >+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_service_no_auth_data_required >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 09efbc7b590..00f652db14a 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -276,6 +276,10 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_ldap_service_ticket\(ad_dc\) > ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_get_ticket_for_host_service_of_machine_account\(ad_dc\) > # >+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_client_no_auth_data_required\(ad_dc\) >+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_request_no_pac\(ad_dc\) >+^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_service_no_auth_data_required\(ad_dc\) >+# > # MIT currently fails the following MS-KILE tests. > # > ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_1_3 >-- >2.25.1 > > >From 6bbb22d087b4ad85f16f9533aea54cae3882c5ec Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Mon, 18 Oct 2021 15:21:50 +1300 >Subject: [PATCH 364/380] kdc: Remove UF_NO_AUTH_DATA_REQUIRED from client > principals > >Tests against Windows 2019 show that UF_NO_AUTH_DATA_REQUIRED >applies to services only, not to clients. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14871 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >[abartlet@samba.org backported from commit 92e8ce18a79e88c9b961dc20e39436c4cf653013 > as there was a knownfail conflict with the test_remove_pac case > which succeeds on this branch] >--- > selftest/knownfail_heimdal_kdc | 1 - > selftest/knownfail_mit_kdc | 1 - > source4/kdc/mit_samba.c | 7 ------- > source4/kdc/pac-glue.c | 5 ----- > 4 files changed, 14 deletions(-) > >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 32cfa2afa88..4d058bad3da 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -144,5 +144,4 @@ > # > # TGS tests > # >-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_client_no_auth_data_required > ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_service_no_auth_data_required >diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc >index 00f652db14a..0f845fb9b1c 100644 >--- a/selftest/knownfail_mit_kdc >+++ b/selftest/knownfail_mit_kdc >@@ -276,7 +276,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ > ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_ldap_service_ticket\(ad_dc\) > ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_get_ticket_for_host_service_of_machine_account\(ad_dc\) > # >-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_client_no_auth_data_required\(ad_dc\) > ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_request_no_pac\(ad_dc\) > ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_service_no_auth_data_required\(ad_dc\) > # >diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c >index 2936fe2d18a..689e14e1c38 100644 >--- a/source4/kdc/mit_samba.c >+++ b/source4/kdc/mit_samba.c >@@ -495,18 +495,11 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, > ssize_t srv_checksum_idx = -1; > ssize_t kdc_checksum_idx = -1; > krb5_pac new_pac = NULL; >- bool ok; > > if (client != NULL) { > client_skdc_entry = > talloc_get_type_abort(client->e_data, > struct samba_kdc_entry); >- >- /* The user account may be set not to want the PAC */ >- ok = samba_princ_needs_pac(client_skdc_entry); >- if (!ok) { >- return EINVAL; >- } > } > > if (server == NULL) { >diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c >index 88bcb734fc5..688103d8477 100644 >--- a/source4/kdc/pac-glue.c >+++ b/source4/kdc/pac-glue.c >@@ -651,11 +651,6 @@ NTSTATUS samba_kdc_get_pac_blobs(TALLOC_CTX *mem_ctx, > } > *_upn_info_blob = NULL; > >- /* The user account may be set not to want the PAC */ >- if ( ! samba_princ_needs_pac(p)) { >- return NT_STATUS_OK; >- } >- > logon_blob = talloc_zero(mem_ctx, DATA_BLOB); > if (logon_blob == NULL) { > return NT_STATUS_NO_MEMORY; >-- >2.25.1 > > >From 5b09a65e2b90a49453dd1282d2bf26babc54a9c6 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Mon, 18 Oct 2021 16:00:45 +1300 >Subject: [PATCH 365/380] kdc: Correctly strip PAC, rather than error on > UF_NO_AUTH_DATA_REQUIRED for servers > >UF_NO_AUTH_DATA_REQUIRED on a server/service account should cause >the PAC to be stripped not to given an error if the PAC was still >present. > >Tested against Windows 2019 > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14871 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit 031a8287642e3c4b9d0b7c6b51f3b1d79b227542) >--- > selftest/knownfail_heimdal_kdc | 4 ---- > source4/kdc/wdc-samba4.c | 38 +++++++++++++++++++++++----------- > 2 files changed, 26 insertions(+), 16 deletions(-) > >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 4d058bad3da..683dbacb979 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -141,7 +141,3 @@ > # KRB5KRB_ERR_RESPONSE_TOO_BIG in this specific case > # > ^samba4.krb5.kdc with machine account.as-req-pac-request.fl2000dc:local >-# >-# TGS tests >-# >-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_service_no_auth_data_required >diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c >index 589df8a651d..ac9d7d51733 100644 >--- a/source4/kdc/wdc-samba4.c >+++ b/source4/kdc/wdc-samba4.c >@@ -105,13 +105,15 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context, > krb5_pac *pac, > krb5_cksumtype ctype) > { >- struct samba_kdc_entry *p = >+ struct samba_kdc_entry *server_skdc_entry = > talloc_get_type_abort(server->ctx, > struct samba_kdc_entry); > struct samba_kdc_entry *krbtgt_skdc_entry = > talloc_get_type_abort(krbtgt->ctx, > struct samba_kdc_entry); >- TALLOC_CTX *mem_ctx = talloc_named(p, 0, "samba_kdc_reget_pac2 context"); >+ TALLOC_CTX *mem_ctx = talloc_named(server_skdc_entry, >+ 0, >+ "samba_kdc_reget_pac2 context"); > krb5_pac new_pac = NULL; > DATA_BLOB *pac_blob = NULL; > DATA_BLOB *upn_blob = NULL; >@@ -135,12 +137,6 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context, > return ENOMEM; > } > >- /* The user account may be set not to want the PAC */ >- if (!samba_princ_needs_pac(p)) { >- talloc_free(mem_ctx); >- return EINVAL; >- } >- > /* If the krbtgt was generated by an RODC, and we are not that > * RODC, then we need to regenerate the PAC - we can't trust > * it */ >@@ -373,12 +369,28 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context, > return EINVAL; > } > >- /* Build an updated PAC */ >+ /* >+ * The server account may be set not to want the PAC. >+ * >+ * While this is wasteful if the above cacluations were done >+ * and now thrown away, this is cleaner as we do any ticket >+ * signature checking etc always. >+ * >+ * UF_NO_AUTH_DATA_REQUIRED is the rare case and most of the >+ * time (eg not accepting a ticket from the RODC) we do not >+ * need to re-generate anything anyway. >+ */ >+ if (!samba_princ_needs_pac(server_skdc_entry)) { >+ ret = 0; >+ new_pac = NULL; >+ goto out; >+ } >+ >+ /* Otherwise build an updated PAC */ > ret = krb5_pac_init(context, &new_pac); > if (ret != 0) { >- SAFE_FREE(types); >- talloc_free(mem_ctx); >- return ret; >+ new_pac = NULL; >+ goto out; > } > > for (i = 0;;) { >@@ -496,6 +508,8 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context, > } > } > >+out: >+ > SAFE_FREE(types); > > /* We now replace the pac */ >-- >2.25.1 > > >From 1130b556193593b287873ecf855efa6820cb1bd9 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 18 Oct 2021 16:05:19 +1300 >Subject: [PATCH 366/380] tests/krb5: Ensure PAC is not present if expect_pac > is false > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14871 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit cc3d27596b9e8a8a46e8ba9c3c1a445477d458cf) >--- > python/samba/tests/krb5/raw_testcase.py | 14 +++++++------- > 1 file changed, 7 insertions(+), 7 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 0790ac13f99..0b9fe8e7a04 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -2385,13 +2385,6 @@ class RawKerberosTest(TestCaseInTempDir): > self.assertElementPresent(ticket_private, 'authorization-data', > expect_empty=not expect_pac) > >- if expect_pac: >- authorization_data = self.getElementValue(ticket_private, >- 'authorization-data') >- pac_data = self.get_pac(authorization_data) >- >- self.check_pac_buffers(pac_data, kdc_exchange_dict) >- > encpart_session_key = None > if encpart_private is not None: > self.assertElementPresent(encpart_private, 'key') >@@ -2493,6 +2486,13 @@ class RawKerberosTest(TestCaseInTempDir): > ticket_private=ticket_private, > encpart_private=encpart_private) > >+ if ticket_private is not None: >+ pac_data = self.get_ticket_pac(ticket_creds, expect_pac=expect_pac) >+ if expect_pac: >+ self.check_pac_buffers(pac_data, kdc_exchange_dict) >+ else: >+ self.assertIsNone(pac_data) >+ > expect_ticket_checksum = kdc_exchange_dict['expect_ticket_checksum'] > if expect_ticket_checksum: > self.assertIsNotNone(ticket_decryption_key) >-- >2.25.1 > > >From 813e2fc60f9302dc5ee16b3bf245c155c15f6c18 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 18 Oct 2021 16:07:11 +1300 >Subject: [PATCH 367/380] tests/krb5: Add tests for constrained delegation to > NO_AUTH_DATA_REQUIRED service > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14871 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> > >Autobuild-User(master): Stefan Metzmacher <metze@samba.org> >Autobuild-Date(master): Wed Oct 20 09:22:43 UTC 2021 on sn-devel-184 > >(cherry picked from commit 83a654a4efd39a6e792a6d49e0ecf586e9bc53ef) >--- > python/samba/tests/krb5/s4u_tests.py | 107 ++++++++++++++++++++++++++- > selftest/knownfail_heimdal_kdc | 8 +- > 2 files changed, 113 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/s4u_tests.py b/python/samba/tests/krb5/s4u_tests.py >index 9a25256081a..bbb7135b55b 100755 >--- a/python/samba/tests/krb5/s4u_tests.py >+++ b/python/samba/tests/krb5/s4u_tests.py >@@ -538,6 +538,8 @@ class S4UKerberosTests(KDCBaseTest): > transited_service = f'host/{service1_name}@{service1_realm}' > expected_transited_services.append(transited_service) > >+ expect_pac = kdc_dict.pop('expect_pac', True) >+ > kdc_exchange_dict = self.tgs_exchange_dict( > expected_crealm=client_realm, > expected_cname=client_cname, >@@ -557,7 +559,8 @@ class S4UKerberosTests(KDCBaseTest): > pac_options=pac_options, > expect_edata=expect_edata, > expected_proxy_target=expected_proxy_target, >- expected_transited_services=expected_transited_services) >+ expected_transited_services=expected_transited_services, >+ expect_pac=expect_pac) > > self._generic_kdc_exchange(kdc_exchange_dict, > cname=None, >@@ -577,6 +580,18 @@ class S4UKerberosTests(KDCBaseTest): > 'allow_delegation': True > }) > >+ def test_constrained_delegation_no_auth_data_required(self): >+ # Test constrained delegation. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': 0, >+ 'allow_delegation': True, >+ 'service2_opts': { >+ 'no_auth_data_required': True >+ }, >+ 'expect_pac': False >+ }) >+ > def test_constrained_delegation_existing_delegation_info(self): > # Test constrained delegation with an existing S4U_DELEGATION_INFO > # structure in the PAC. >@@ -624,6 +639,35 @@ class S4UKerberosTests(KDCBaseTest): > 'modify_service_tgt_fn': self.remove_ticket_pac > }) > >+ def test_constrained_delegation_no_client_pac_no_auth_data_required(self): >+ # Test constrained delegation when the client service ticket does not >+ # contain a PAC. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': (KDC_ERR_BADOPTION, >+ KDC_ERR_MODIFIED), >+ 'allow_delegation': True, >+ 'modify_client_tkt_fn': self.remove_ticket_pac, >+ 'expect_edata': False, >+ 'service2_opts': { >+ 'no_auth_data_required': True >+ } >+ }) >+ >+ def test_constrained_delegation_no_service_pac_no_auth_data_required(self): >+ # Test constrained delegation when the service TGT does not contain a >+ # PAC. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': (KDC_ERR_BADOPTION, >+ KDC_ERR_MODIFIED), >+ 'allow_delegation': True, >+ 'modify_service_tgt_fn': self.remove_ticket_pac, >+ 'service2_opts': { >+ 'no_auth_data_required': True >+ } >+ }) >+ > def test_constrained_delegation_non_forwardable(self): > # Test constrained delegation with a non-forwardable ticket. > self._run_delegation_test( >@@ -645,6 +689,18 @@ class S4UKerberosTests(KDCBaseTest): > 'allow_delegation': True > }) > >+ def test_rbcd_no_auth_data_required(self): >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': 0, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'service2_opts': { >+ 'no_auth_data_required': True >+ }, >+ 'expect_pac': False >+ }) >+ > def test_rbcd_existing_delegation_info(self): > # Test constrained delegation with an existing S4U_DELEGATION_INFO > # structure in the PAC. >@@ -712,6 +768,55 @@ class S4UKerberosTests(KDCBaseTest): > 'modify_service_tgt_fn': self.remove_ticket_pac > }) > >+ def test_rbcd_no_client_pac_no_auth_data_required_a(self): >+ # Test constrained delegation when the client service ticket does not >+ # contain a PAC, and an empty msDS-AllowedToDelegateTo attribute. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_MODIFIED, >+ 'expected_status': ntstatus.NT_STATUS_NOT_SUPPORTED, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_client_tkt_fn': self.remove_ticket_pac, >+ 'service2_opts': { >+ 'no_auth_data_required': True >+ } >+ }) >+ >+ def test_rbcd_no_client_pac_no_auth_data_required_b(self): >+ # Test constrained delegation when the client service ticket does not >+ # contain a PAC, and a non-empty msDS-AllowedToDelegateTo attribute. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_MODIFIED, >+ 'expected_status': ntstatus.NT_STATUS_NO_MATCH, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_client_tkt_fn': self.remove_ticket_pac, >+ 'service1_opts': { >+ 'delegation_to_spn': ('host/test') >+ }, >+ 'service2_opts': { >+ 'no_auth_data_required': True >+ } >+ }) >+ >+ def test_rbcd_no_service_pac_no_auth_data_required(self): >+ # Test constrained delegation when the service TGT does not contain a >+ # PAC. >+ self._run_delegation_test( >+ { >+ 'expected_error_mode': KDC_ERR_BADOPTION, >+ 'expected_status': >+ ntstatus.NT_STATUS_NOT_FOUND, >+ 'allow_rbcd': True, >+ 'pac_options': '0001', # supports RBCD >+ 'modify_service_tgt_fn': self.remove_ticket_pac, >+ 'service2_opts': { >+ 'no_auth_data_required': True >+ } >+ }) >+ > def test_rbcd_non_forwardable(self): > # Test resource-based constrained delegation with a non-forwardable > # ticket. >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index 683dbacb979..b1d7a1ebe8f 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -125,7 +125,7 @@ > # S4U tests > # > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_bronze_bit_rbcd_old_checksum >-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_service_pac >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_service_pac\(.*\)$ > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_existing_delegation_info > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_missing_client_checksum > ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_client_pac_a >@@ -141,3 +141,9 @@ > # KRB5KRB_ERR_RESPONSE_TOO_BIG in this specific case > # > ^samba4.krb5.kdc with machine account.as-req-pac-request.fl2000dc:local >+# >+# >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_auth_data_required >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_auth_data_required >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_client_pac_no_auth_data_required_a >+^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_client_pac_no_auth_data_required_b >-- >2.25.1 > > >From 5c7ff468fdddfc9f4cedaffdfc64c2e8ccf5dd8a Mon Sep 17 00:00:00 2001 >From: Viktor Dukhovni <viktor@twosigma.com> >Date: Wed, 10 Aug 2016 23:31:14 +0000 >Subject: [PATCH 368/380] HEIMDAL:kdc: Fix transit path validation > CVE-2017-6594 > >Commit f469fc6 (2010-10-02) inadvertently caused the previous hop realm >to not be added to the transit path of issued tickets. This may, in >some cases, enable bypass of capath policy in Heimdal versions 1.5 >through 7.2. > >Note, this may break sites that rely on the bug. With the bug some >incomplete [capaths] worked, that should not have. These may now break >authentication in some cross-realm configurations. > >(similar to heimdal commit b1e699103f08d6a0ca46a122193c9da65f6cf837) > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=12998 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Reviewed-by: Stefan Metzmacher <metze@samba.org> >Reviewed-by: Andrew Bartlett <abartlet@samba.org> > >Autobuild-User(master): Stefan Metzmacher <metze@samba.org> >Autobuild-Date(master): Wed Oct 20 10:58:37 UTC 2021 on sn-devel-184 > >(cherry picked from commit 7e961f3f7a815960ae25377d5b7515184d439690) >--- > source4/heimdal/kdc/krb5tgs.c | 13 ++++++++++--- > 1 file changed, 10 insertions(+), 3 deletions(-) > >diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c >index b0c873a4ffb..33120a28d34 100644 >--- a/source4/heimdal/kdc/krb5tgs.c >+++ b/source4/heimdal/kdc/krb5tgs.c >@@ -409,8 +409,12 @@ fix_transited_encoding(krb5_context context, > "Decoding transited encoding"); > return ret; > } >+ >+ /* >+ * If the realm of the presented tgt is neither the client nor the server >+ * realm, it is a transit realm and must be added to transited set. >+ */ > if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)) { >- /* not us, so add the previous realm to transited set */ > if (num_realms + 1 > UINT_MAX/sizeof(*realms)) { > ret = ERANGE; > goto free_realms; >@@ -492,6 +496,7 @@ tgs_make_reply(krb5_context context, > const char *server_name, > hdb_entry_ex *client, > krb5_principal client_principal, >+ const char *tgt_realm, > hdb_entry_ex *krbtgt, > krb5_pac mspac, > uint16_t rodc_id, >@@ -553,7 +558,7 @@ tgs_make_reply(krb5_context context, > &tgt->transited, &et, > krb5_principal_get_realm(context, client_principal), > krb5_principal_get_realm(context, server->entry.principal), >- krb5_principal_get_realm(context, krbtgt->entry.principal)); >+ tgt_realm); > if(ret) > goto out; > >@@ -1292,13 +1297,14 @@ tgs_build_reply(krb5_context context, > HDB *clientdb, *s4u2self_impersonated_clientdb; > krb5_realm ref_realm = NULL; > EncTicketPart *tgt = &ticket->ticket; >+ const char *tgt_realm = /* Realm of TGT issuer */ >+ krb5_principal_get_realm(context, krbtgt->entry.principal); > const EncryptionKey *ekey; > krb5_keyblock sessionkey; > krb5_kvno kvno; > krb5_pac mspac = NULL; > uint16_t rodc_id; > krb5_boolean add_ticket_sig = FALSE; >- > hdb_entry_ex *krbtgt_out = NULL; > > METHOD_DATA enc_pa_data; >@@ -2019,6 +2025,7 @@ server_lookup: > spn, > client, > cp, >+ tgt_realm, > krbtgt_out, > mspac, > rodc_id, >-- >2.25.1 > > >From 766711d1b19934844830f113022ce19c08472d5b Mon Sep 17 00:00:00 2001 >From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >Date: Wed, 8 Sep 2021 17:01:26 +1200 >Subject: [PATCH 369/380] pytest/rodc_rwdc: try to avoid race. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14868 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit a169e013e66bab15e594ce49b805edebfcd503cf) >--- > source4/dsdb/tests/python/rodc_rwdc.py | 4 ++++ > 1 file changed, 4 insertions(+) > >diff --git a/source4/dsdb/tests/python/rodc_rwdc.py b/source4/dsdb/tests/python/rodc_rwdc.py >index 988eeaf8094..5de78605963 100644 >--- a/source4/dsdb/tests/python/rodc_rwdc.py >+++ b/source4/dsdb/tests/python/rodc_rwdc.py >@@ -251,6 +251,10 @@ class RodcRwdcCachedTests(password_lockout_base.BasePasswordTestCase): > res = ldb_system.search(userdn, attrs=['unicodePwd']) > self.assertTrue('unicodePwd' in res[0]) > >+ # force replication here to flush any pending preloads (this >+ # was a racy test). >+ self.force_replication() >+ > newpass = userpass + '!' > > # Forcing replication should blank out password (when changed) >-- >2.25.1 > > >From e2eed72e4b497505bf6cc3a5ddd11682a216074f Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Mon, 20 Sep 2021 16:27:40 +1200 >Subject: [PATCH 370/380] selftest: Increase account lockout windows to make > test more realiable > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14868 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit 6292f0597f208d7953382341380921cf0fd0a8a8) >--- > source4/dsdb/tests/python/rodc_rwdc.py | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >diff --git a/source4/dsdb/tests/python/rodc_rwdc.py b/source4/dsdb/tests/python/rodc_rwdc.py >index 5de78605963..f8b21b8af21 100644 >--- a/source4/dsdb/tests/python/rodc_rwdc.py >+++ b/source4/dsdb/tests/python/rodc_rwdc.py >@@ -289,14 +289,14 @@ class RodcRwdcCachedTests(password_lockout_base.BasePasswordTestCase): > m = ldb.Message() > m.dn = ldb.Dn(self.ldb, self.base_dn) > >- self.account_lockout_duration = 10 >+ self.account_lockout_duration = 15 > account_lockout_duration_ticks = -int(self.account_lockout_duration * (1e7)) > > m["lockoutDuration"] = ldb.MessageElement(str(account_lockout_duration_ticks), > ldb.FLAG_MOD_REPLACE, > "lockoutDuration") > >- self.lockout_observation_window = 10 >+ self.lockout_observation_window = 15 > lockout_observation_window_ticks = -int(self.lockout_observation_window * (1e7)) > > m["lockOutObservationWindow"] = ldb.MessageElement(str(lockout_observation_window_ticks), >-- >2.25.1 > > >From 6cefd02acd920ce1f6b98749b12896f1dbff531f Mon Sep 17 00:00:00 2001 >From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >Date: Fri, 6 Aug 2021 11:08:10 +1200 >Subject: [PATCH 371/380] pytest: dynamic tests optionally add __doc__ > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14869 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit aacb18f920349e13b562c7c97901a0be7b273137) >--- > python/samba/tests/__init__.py | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > >diff --git a/python/samba/tests/__init__.py b/python/samba/tests/__init__.py >index 9d5128bab0e..d7abffe4060 100644 >--- a/python/samba/tests/__init__.py >+++ b/python/samba/tests/__init__.py >@@ -71,7 +71,7 @@ class TestCase(unittest.TestCase): > """A Samba test case.""" > > @classmethod >- def generate_dynamic_test(cls, fnname, suffix, *args): >+ def generate_dynamic_test(cls, fnname, suffix, *args, doc=None): > """ > fnname is something like "test_dynamic_sum" > suffix is something like "1plus2" >@@ -84,6 +84,7 @@ class TestCase(unittest.TestCase): > """ > def fn(self): > getattr(self, "_%s_with_args" % fnname)(*args) >+ fn.__doc__ = doc > setattr(cls, "%s_%s" % (fnname, suffix), fn) > > @classmethod >-- >2.25.1 > > >From 69a728e6d4b5c8c2e04f40980dc69cc0dd31ce29 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Fri, 8 Oct 2021 15:40:09 +1300 >Subject: [PATCH 372/380] selftest: krb5 account creation: clarify account type > as an enum > >This makes the code clearer with a symbolic constant rather >than a True/False boolean. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14869 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit 49306f74eb29a2192019fab9260f9d242f9d5fd9) >--- > .../tests/krb5/as_canonicalization_tests.py | 7 ++- > python/samba/tests/krb5/kdc_base_test.py | 63 ++++++++++++------- > python/samba/tests/krb5/kdc_tgs_tests.py | 7 ++- > .../ms_kile_client_principal_lookup_tests.py | 36 +++++++---- > python/samba/tests/krb5/rodc_tests.py | 4 +- > python/samba/tests/krb5/s4u_tests.py | 35 ++++++----- > python/samba/tests/krb5/test_ccache.py | 11 ++-- > 7 files changed, 100 insertions(+), 63 deletions(-) > >diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py >index 9538d0ae3cf..674fcb37101 100755 >--- a/python/samba/tests/krb5/as_canonicalization_tests.py >+++ b/python/samba/tests/krb5/as_canonicalization_tests.py >@@ -171,9 +171,10 @@ class KerberosASCanonicalizationTests(KDCBaseTest): > def machine_account_creds(self): > if self.machine_creds is None: > samdb = self.get_samdb() >- self.machine_creds, _ = self.create_account(samdb, >- MACHINE_NAME, >- machine_account=True) >+ self.machine_creds, _ = self.create_account( >+ samdb, >+ MACHINE_NAME, >+ account_type=self.AccountType.COMPUTER) > self.machine_creds.set_secure_channel_type(SEC_CHAN_WKSTA) > self.machine_creds.set_kerberos_state(DONT_USE_KERBEROS) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 1fc15315b0b..7cd3c5255f2 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -23,6 +23,7 @@ import tempfile > import binascii > import collections > import secrets >+from enum import Enum, auto > > from collections import namedtuple > import ldb >@@ -90,6 +91,10 @@ class KDCBaseTest(RawKerberosTest): > """ Base class for KDC tests. > """ > >+ class AccountType(Enum): >+ USER = auto() >+ COMPUTER = auto() >+ > @classmethod > def setUpClass(cls): > super().setUpClass() >@@ -230,7 +235,7 @@ class KDCBaseTest(RawKerberosTest): > > return default_enctypes > >- def create_account(self, samdb, name, machine_account=False, >+ def create_account(self, samdb, name, account_type=AccountType.USER, > spn=None, upn=None, additional_details=None, > ou=None, account_control=0): > '''Create an account for testing. >@@ -238,8 +243,10 @@ class KDCBaseTest(RawKerberosTest): > which is used by tearDownClass to clean up the created accounts. > ''' > if ou is None: >- guid = (DS_GUID_COMPUTERS_CONTAINER if machine_account >- else DS_GUID_USERS_CONTAINER) >+ if account_type is account_type.COMPUTER: >+ guid = DS_GUID_COMPUTERS_CONTAINER >+ else: >+ guid = DS_GUID_USERS_CONTAINER > > ou = samdb.get_wellknown_dn(samdb.get_default_basedn(), guid) > >@@ -248,14 +255,17 @@ class KDCBaseTest(RawKerberosTest): > # remove the account if it exists, this will happen if a previous test > # run failed > delete_force(samdb, dn) >- if machine_account: >- object_class = "computer" >- account_name = "%s$" % name >- account_control |= UF_WORKSTATION_TRUST_ACCOUNT >- else: >+ if account_type is self.AccountType.USER: > object_class = "user" > account_name = name > account_control |= UF_NORMAL_ACCOUNT >+ else: >+ object_class = "computer" >+ account_name = "%s$" % name >+ if account_type is self.AccountType.COMPUTER: >+ account_control |= UF_WORKSTATION_TRUST_ACCOUNT >+ else: >+ self.fail() > > password = generate_random_password(32, 32) > utf16pw = ('"%s"' % password).encode('utf-16-le') >@@ -267,6 +277,10 @@ class KDCBaseTest(RawKerberosTest): > "userAccountControl": str(account_control), > "unicodePwd": utf16pw} > if spn is not None: >+ if isinstance(spn, str): >+ spn = spn.format(account=account_name) >+ else: >+ spn = tuple(s.format(account=account_name) for s in spn) > details["servicePrincipalName"] = spn > if upn is not None: > details["userPrincipalName"] = upn >@@ -280,10 +294,10 @@ class KDCBaseTest(RawKerberosTest): > creds.set_domain(samdb.domain_netbios_name().upper()) > creds.set_password(password) > creds.set_username(account_name) >- if machine_account: >- creds.set_workstation(name) >- else: >+ if account_type is self.AccountType.USER: > creds.set_workstation('') >+ else: >+ creds.set_workstation(name) > creds.set_dn(ldb.Dn(samdb, dn)) > creds.set_spn(spn) > # >@@ -609,13 +623,14 @@ class KDCBaseTest(RawKerberosTest): > return cleanup > > def get_cached_creds(self, *, >- machine_account, >+ account_type, > opts=None, > use_cache=True): > if opts is None: > opts = {} > > opts_default = { >+ 'spn': None, > 'allowed_replication': False, > 'allowed_replication_mock': False, > 'denied_replication': False, >@@ -632,7 +647,7 @@ class KDCBaseTest(RawKerberosTest): > } > > account_opts = { >- 'machine_account': machine_account, >+ 'account_type': account_type, > **opts_default, > **opts > } >@@ -651,7 +666,8 @@ class KDCBaseTest(RawKerberosTest): > return creds > > def create_account_opts(self, *, >- machine_account, >+ account_type, >+ spn, > allowed_replication, > allowed_replication_mock, > denied_replication, >@@ -665,12 +681,13 @@ class KDCBaseTest(RawKerberosTest): > delegation_from_dn, > trusted_to_auth_for_delegation, > fast_support): >- if machine_account: >- self.assertFalse(not_delegated) >- else: >+ if account_type is self.AccountType.USER: >+ self.assertIsNone(spn) > self.assertIsNone(delegation_to_spn) > self.assertIsNone(delegation_from_dn) > self.assertFalse(trusted_to_auth_for_delegation) >+ else: >+ self.assertFalse(not_delegated) > > samdb = self.get_samdb() > rodc_samdb = self.get_rodc_samdb() >@@ -707,13 +724,11 @@ class KDCBaseTest(RawKerberosTest): > details['msDS-AllowedToActOnBehalfOfOtherIdentity'] = ( > security_descriptor) > >- if machine_account: >+ if spn is None and account_type is not self.AccountType.USER: > spn = 'host/' + user_name >- else: >- spn = None > > creds, dn = self.create_account(samdb, user_name, >- machine_account=machine_account, >+ account_type=account_type, > spn=spn, > additional_details=details, > account_control=user_account_control) >@@ -787,7 +802,7 @@ class KDCBaseTest(RawKerberosTest): > allow_missing_password=False, > allow_missing_keys=True): > def create_client_account(): >- return self.get_cached_creds(machine_account=False) >+ return self.get_cached_creds(account_type=self.AccountType.USER) > > c = self._get_krb5_creds(prefix='CLIENT', > allow_missing_password=allow_missing_password, >@@ -799,7 +814,7 @@ class KDCBaseTest(RawKerberosTest): > allow_missing_password=False, > allow_missing_keys=True): > def create_mach_account(): >- return self.get_cached_creds(machine_account=True, >+ return self.get_cached_creds(account_type=self.AccountType.COMPUTER, > opts={'fast_support': True}) > > c = self._get_krb5_creds(prefix='MAC', >@@ -813,7 +828,7 @@ class KDCBaseTest(RawKerberosTest): > allow_missing_keys=True): > def create_service_account(): > return self.get_cached_creds( >- machine_account=True, >+ account_type=self.AccountType.COMPUTER, > opts={ > 'trusted_to_auth_for_delegation': True, > 'fast_support': True >diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py >index 9d846a2c3ad..f36704f998c 100755 >--- a/python/samba/tests/krb5/kdc_tgs_tests.py >+++ b/python/samba/tests/krb5/kdc_tgs_tests.py >@@ -148,7 +148,8 @@ class KdcTgsTests(KDCBaseTest): > samdb = self.get_samdb() > user_name = "tsttktusr" > (uc, dn) = self.create_account(samdb, user_name) >- (mc, _) = self.create_account(samdb, "tsttktmac", machine_account=True) >+ (mc, _) = self.create_account(samdb, "tsttktmac", >+ account_type=self.AccountType.COMPUTER) > realm = uc.get_realm().lower() > > # Do the initial AS-REQ, should get a pre-authentication required >@@ -282,7 +283,7 @@ class KdcTgsTests(KDCBaseTest): > > def test_client_no_auth_data_required(self): > client_creds = self.get_cached_creds( >- machine_account=False, >+ account_type=self.AccountType.USER, > opts={'no_auth_data_required': True}) > service_creds = self.get_service_creds() > >@@ -299,7 +300,7 @@ class KdcTgsTests(KDCBaseTest): > def test_service_no_auth_data_required(self): > client_creds = self.get_client_creds() > service_creds = self.get_cached_creds( >- machine_account=True, >+ account_type=self.AccountType.COMPUTER, > opts={'no_auth_data_required': True}) > > tgt = self.get_tgt(client_creds) >diff --git a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >index 2ee3d4a2a83..0aa3309b814 100755 >--- a/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >+++ b/python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py >@@ -95,7 +95,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > realm = uc.get_realm().lower() > > mach_name = "mskilemac" >- (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -151,7 +152,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > # > samdb = self.get_samdb() > mach_name = "mskilemac" >- (mc, dn) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, dn) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > realm = mc.get_realm().lower() > > # Do the initial AS-REQ, should get a pre-authentication required >@@ -215,7 +217,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > realm = uc.get_realm().lower() > > mach_name = "mskilemac" >- (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -286,7 +289,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.add_attribute(samdb, dn, "altSecurityIdentities", alt_sec) > > mach_name = "mskilemac" >- (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > > # Do the initial AS-REQ, as we've set UF_DONT_REQUIRE_PREAUTH > # we should get a valid AS-RESP >@@ -351,7 +355,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.add_attribute(samdb, dn, "altSecurityIdentities", alt_sec) > > mach_name = "mskilemac" >- (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -420,7 +425,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > self.add_attribute(samdb, dn, "altSecurityIdentities", alt_sec) > > mach_name = "mskilemac" >- (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -459,7 +465,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > realm = uc.get_realm().lower() > > mach_name = "mskilemac" >- (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -523,7 +530,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > ename = user_name + "@" + realm > > mach_name = "mskilemac" >- (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -586,7 +594,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > realm = uc.get_realm().lower() > > mach_name = "mskilemac" >- (mc, dn) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, dn) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > ename = mach_name + "@" + realm > uname = mach_name + "$@" + realm > >@@ -661,7 +670,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > ename = alt_name + "@" + realm > > mach_name = "mskilemac" >- (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > > # Do the initial AS-REQ, as we've set UF_DONT_REQUIRE_PREAUTH > # we should get a valid AS-RESP >@@ -728,7 +738,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > uname = user_name + "@" + realm > > mach_name = "mskilemac" >- (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >@@ -798,7 +809,8 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest): > ename = alt_name + "@" + realm > > mach_name = "mskilemac" >- (mc, _) = self.create_account(samdb, mach_name, machine_account=True) >+ (mc, _) = self.create_account(samdb, mach_name, >+ account_type=self.AccountType.COMPUTER) > > # Do the initial AS-REQ, should get a pre-authentication required > # response >diff --git a/python/samba/tests/krb5/rodc_tests.py b/python/samba/tests/krb5/rodc_tests.py >index 4579f9eb552..302ae865cf1 100755 >--- a/python/samba/tests/krb5/rodc_tests.py >+++ b/python/samba/tests/krb5/rodc_tests.py >@@ -39,12 +39,12 @@ class RodcKerberosTests(KDCBaseTest): > # and including the RODCIdentifier. > def test_rodc_ticket_signature(self): > user_creds = self.get_cached_creds( >- machine_account=False, >+ account_type=self.AccountType.USER, > opts={ > 'revealed_to_rodc': True > }) > target_creds = self.get_cached_creds( >- machine_account=True, >+ account_type=self.AccountType.COMPUTER, > opts={ > 'revealed_to_rodc': True > }) >diff --git a/python/samba/tests/krb5/s4u_tests.py b/python/samba/tests/krb5/s4u_tests.py >index bbb7135b55b..ea629d29706 100755 >--- a/python/samba/tests/krb5/s4u_tests.py >+++ b/python/samba/tests/krb5/s4u_tests.py >@@ -220,12 +220,14 @@ class S4UKerberosTests(KDCBaseTest): > > def _run_s4u2self_test(self, kdc_dict): > client_opts = kdc_dict.pop('client_opts', None) >- client_creds = self.get_cached_creds(machine_account=False, >- opts=client_opts) >+ client_creds = self.get_cached_creds( >+ account_type=self.AccountType.USER, >+ opts=client_opts) > > service_opts = kdc_dict.pop('service_opts', None) >- service_creds = self.get_cached_creds(machine_account=True, >- opts=service_opts) >+ service_creds = self.get_cached_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts=service_opts) > > service_tgt = self.get_tgt(service_creds) > modify_service_tgt_fn = kdc_dict.pop('modify_service_tgt_fn', None) >@@ -432,8 +434,9 @@ class S4UKerberosTests(KDCBaseTest): > > def _run_delegation_test(self, kdc_dict): > client_opts = kdc_dict.pop('client_opts', None) >- client_creds = self.get_cached_creds(machine_account=False, >- opts=client_opts) >+ client_creds = self.get_cached_creds( >+ account_type=self.AccountType.USER, >+ opts=client_opts) > > service1_opts = kdc_dict.pop('service1_opts', {}) > service2_opts = kdc_dict.pop('service2_opts', {}) >@@ -443,24 +446,28 @@ class S4UKerberosTests(KDCBaseTest): > self.assertFalse(allow_delegation and allow_rbcd) > > if allow_rbcd: >- service1_creds = self.get_cached_creds(machine_account=True, >- opts=service1_opts) >+ service1_creds = self.get_cached_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts=service1_opts) > > self.assertNotIn('delegation_from_dn', service2_opts) > service2_opts['delegation_from_dn'] = str(service1_creds.get_dn()) > >- service2_creds = self.get_cached_creds(machine_account=True, >- opts=service2_opts) >+ service2_creds = self.get_cached_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts=service2_opts) > else: >- service2_creds = self.get_cached_creds(machine_account=True, >- opts=service2_opts) >+ service2_creds = self.get_cached_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts=service2_opts) > > if allow_delegation: > self.assertNotIn('delegation_to_spn', service1_opts) > service1_opts['delegation_to_spn'] = service2_creds.get_spn() > >- service1_creds = self.get_cached_creds(machine_account=True, >- opts=service1_opts) >+ service1_creds = self.get_cached_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts=service1_opts) > > client_tkt_options = kdc_dict.pop('client_tkt_options', 'forwardable') > expected_flags = krb5_asn1.TicketFlags(client_tkt_options) >diff --git a/python/samba/tests/krb5/test_ccache.py b/python/samba/tests/krb5/test_ccache.py >index c44ea02d504..6a2b78398ac 100755 >--- a/python/samba/tests/krb5/test_ccache.py >+++ b/python/samba/tests/krb5/test_ccache.py >@@ -55,11 +55,12 @@ class CcacheTests(KDCBaseTest): > (user_credentials, _) = self.create_account(samdb, user_name) > > # Create the machine account. >- (mach_credentials, _) = self.create_account(samdb, >- mach_name, >- machine_account=True, >- spn="%s/%s" % (service, >- mach_name)) >+ (mach_credentials, _) = self.create_account( >+ samdb, >+ mach_name, >+ account_type=self.AccountType.COMPUTER, >+ spn="%s/%s" % (service, >+ mach_name)) > > # Talk to the KDC to obtain the service ticket, which gets placed into > # the cache. The machine account name has to match the name in the >-- >2.25.1 > > >From 6a137e7c38bce1cd26d7aae351b69bd11f637523 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 20 Oct 2021 12:39:05 +1300 >Subject: [PATCH 373/380] tests/krb5: Decrease length of test account prefix > >This allows us more room to test with different account names. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit a5a6296e57cab2b53617d997c37b4e92d4124cc7) >--- > python/samba/tests/krb5/kdc_base_test.py | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 7cd3c5255f2..8f453b464fd 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -108,7 +108,7 @@ class KDCBaseTest(RawKerberosTest): > # An identifier to ensure created accounts have unique names. Windows > # caches accounts based on usernames, so account names being different > # across test runs avoids previous test runs affecting the results. >- cls.account_base = f'krb5_{secrets.token_hex(5)}_' >+ cls.account_base = f'{secrets.token_hex(4)}_' > cls.account_id = 0 > > # A set containing DNs of accounts created as part of testing. >-- >2.25.1 > > >From dbb99d9f456b2a90070a0664bd9eb769724f836d Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 20 Oct 2021 12:41:39 +1300 >Subject: [PATCH 374/380] tests/krb5: Allow specifying prefix or suffix for > test account names > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit 7e39994ed341883ac4c8c257220c19dbf70c7bc5) >--- > python/samba/tests/krb5/kdc_base_test.py | 8 ++++++++ > 1 file changed, 8 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 8f453b464fd..d8f3969d228 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -630,6 +630,8 @@ class KDCBaseTest(RawKerberosTest): > opts = {} > > opts_default = { >+ 'name_prefix': None, >+ 'name_suffix': None, > 'spn': None, > 'allowed_replication': False, > 'allowed_replication_mock': False, >@@ -667,6 +669,8 @@ class KDCBaseTest(RawKerberosTest): > > def create_account_opts(self, *, > account_type, >+ name_prefix, >+ name_suffix, > spn, > allowed_replication, > allowed_replication_mock, >@@ -696,6 +700,10 @@ class KDCBaseTest(RawKerberosTest): > > user_name = self.account_base + str(self.account_id) > type(self).account_id += 1 >+ if name_prefix is not None: >+ user_name = name_prefix + user_name >+ if name_suffix is not None: >+ user_name += name_suffix > > user_account_control = 0 > if trusted_to_auth_for_delegation: >-- >2.25.1 > > >From 7d020c7a1440a9a853836461342533f99f84fab4 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 20 Oct 2021 12:44:19 +1300 >Subject: [PATCH 375/380] tests/krb5: Allow creating machine accounts without a > trailing dollar > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit f4785ccfefe7c89f84ad847ca3c12f604172b321) >--- > python/samba/tests/krb5/kdc_base_test.py | 12 ++++++++---- > 1 file changed, 8 insertions(+), 4 deletions(-) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index d8f3969d228..35f168a3c83 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -237,7 +237,7 @@ class KDCBaseTest(RawKerberosTest): > > def create_account(self, samdb, name, account_type=AccountType.USER, > spn=None, upn=None, additional_details=None, >- ou=None, account_control=0): >+ ou=None, account_control=0, add_dollar=True): > '''Create an account for testing. > The dn of the created account is added to self.accounts, > which is used by tearDownClass to clean up the created accounts. >@@ -255,13 +255,14 @@ class KDCBaseTest(RawKerberosTest): > # remove the account if it exists, this will happen if a previous test > # run failed > delete_force(samdb, dn) >+ account_name = name > if account_type is self.AccountType.USER: > object_class = "user" >- account_name = name > account_control |= UF_NORMAL_ACCOUNT > else: > object_class = "computer" >- account_name = "%s$" % name >+ if add_dollar: >+ account_name += '$' > if account_type is self.AccountType.COMPUTER: > account_control |= UF_WORKSTATION_TRUST_ACCOUNT > else: >@@ -632,6 +633,7 @@ class KDCBaseTest(RawKerberosTest): > opts_default = { > 'name_prefix': None, > 'name_suffix': None, >+ 'add_dollar': True, > 'spn': None, > 'allowed_replication': False, > 'allowed_replication_mock': False, >@@ -671,6 +673,7 @@ class KDCBaseTest(RawKerberosTest): > account_type, > name_prefix, > name_suffix, >+ add_dollar, > spn, > allowed_replication, > allowed_replication_mock, >@@ -739,7 +742,8 @@ class KDCBaseTest(RawKerberosTest): > account_type=account_type, > spn=spn, > additional_details=details, >- account_control=user_account_control) >+ account_control=user_account_control, >+ add_dollar=add_dollar) > > keys = self.get_keys(samdb, dn) > self.creds_set_keys(creds, keys) >-- >2.25.1 > > >From b52222cd85b9898ca31edacc4c6debe728e5fae6 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 20 Oct 2021 12:45:08 +1300 >Subject: [PATCH 376/380] tests/krb5: Allow specifying the UPN for test > accounts > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit 889476d1754f8ce2a41557ed3bf5242c1293584e) >--- > python/samba/tests/krb5/kdc_base_test.py | 4 ++++ > python/samba/tests/krb5/raw_testcase.py | 7 +++++++ > 2 files changed, 11 insertions(+) > >diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py >index 35f168a3c83..b24c6376ab0 100644 >--- a/python/samba/tests/krb5/kdc_base_test.py >+++ b/python/samba/tests/krb5/kdc_base_test.py >@@ -300,6 +300,7 @@ class KDCBaseTest(RawKerberosTest): > else: > creds.set_workstation(name) > creds.set_dn(ldb.Dn(samdb, dn)) >+ creds.set_upn(upn) > creds.set_spn(spn) > # > # Save the account name so it can be deleted in tearDownClass >@@ -634,6 +635,7 @@ class KDCBaseTest(RawKerberosTest): > 'name_prefix': None, > 'name_suffix': None, > 'add_dollar': True, >+ 'upn': None, > 'spn': None, > 'allowed_replication': False, > 'allowed_replication_mock': False, >@@ -674,6 +676,7 @@ class KDCBaseTest(RawKerberosTest): > name_prefix, > name_suffix, > add_dollar, >+ upn, > spn, > allowed_replication, > allowed_replication_mock, >@@ -740,6 +743,7 @@ class KDCBaseTest(RawKerberosTest): > > creds, dn = self.create_account(samdb, user_name, > account_type=account_type, >+ upn=upn, > spn=spn, > additional_details=details, > account_control=user_account_control, >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 0b9fe8e7a04..619a8d006b2 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -366,6 +366,7 @@ class KerberosCredentials(Credentials): > self.forced_salt = None > > self.dn = None >+ self.upn = None > self.spn = None > > def set_as_supported_enctypes(self, value): >@@ -475,6 +476,12 @@ class KerberosCredentials(Credentials): > def get_spn(self): > return self.spn > >+ def set_upn(self, upn): >+ self.upn = upn >+ >+ def get_upn(self): >+ return self.upn >+ > > class KerberosTicketCreds: > def __init__(self, ticket, session_key, >-- >2.25.1 > > >From 1517d30095f179d14b8295db1fd8ece22b77eebb Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 20 Oct 2021 12:45:47 +1300 >Subject: [PATCH 377/380] tests/krb5: Fix account salt calculation to match > Windows > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >(cherry picked from commit 25bdf4c994e4fdb74abbacb1e22237f3f2cc37fe) >--- > python/samba/tests/krb5/raw_testcase.py | 13 +++++++++++-- > 1 file changed, 11 insertions(+), 2 deletions(-) > >diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py >index 619a8d006b2..f352615db1f 100644 >--- a/python/samba/tests/krb5/raw_testcase.py >+++ b/python/samba/tests/krb5/raw_testcase.py >@@ -454,13 +454,22 @@ class KerberosCredentials(Credentials): > if self.forced_salt is not None: > return self.forced_salt > >+ upn = self.get_upn() >+ if upn is not None: >+ salt_name = upn.rsplit('@', 1)[0].replace('/', '') >+ else: >+ salt_name = self.get_username() >+ > if self.get_workstation(): >+ salt_name = self.get_username().lower() >+ if salt_name[-1] == '$': >+ salt_name = salt_name[:-1] > salt_string = '%shost%s.%s' % ( > self.get_realm().upper(), >- self.get_username().lower().rsplit('$', 1)[0], >+ salt_name, > self.get_realm().lower()) > else: >- salt_string = self.get_realm().upper() + self.get_username() >+ salt_string = self.get_realm().upper() + salt_name > > return salt_string.encode('utf-8') > >-- >2.25.1 > > >From 769c78bcd406ef496a7878b925f927a9c1bba526 Mon Sep 17 00:00:00 2001 >From: Joseph Sutton <josephsutton@catalyst.net.nz> >Date: Wed, 20 Oct 2021 12:46:36 +1300 >Subject: [PATCH 378/380] tests/krb5: Add tests for account salt calculation > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> >Reviewed-by: Stefan Metzmacher <metze@samba.org> >[abartlet@samba.org backported from commit 46039baa81377df10e5b134e4bb064ed246795e4 > as the no_preauth side of the testsuite shows differences in enctypes > in Samba 4.14. The change is only in salt calculation so this is > not vital] >--- > python/samba/tests/krb5/as_req_tests.py | 10 + > python/samba/tests/krb5/salt_tests.py | 327 ++++++++++++++++++++++++ > python/samba/tests/usage.py | 1 + > selftest/knownfail.d/kdc-salt | 12 + > selftest/knownfail_heimdal_kdc | 108 ++++++++ > source4/selftest/tests.py | 8 + > 6 files changed, 466 insertions(+) > create mode 100755 python/samba/tests/krb5/salt_tests.py > create mode 100644 selftest/knownfail.d/kdc-salt > >diff --git a/python/samba/tests/krb5/as_req_tests.py b/python/samba/tests/krb5/as_req_tests.py >index 7d7baaebf24..08081928363 100755 >--- a/python/samba/tests/krb5/as_req_tests.py >+++ b/python/samba/tests/krb5/as_req_tests.py >@@ -113,6 +113,13 @@ class AsReqKerberosTests(KDCBaseTest): > > def test_as_req_enc_timestamp(self): > client_creds = self.get_client_creds() >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_as_req_enc_timestamp_mac(self): >+ client_creds = self.get_mach_creds() >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def _run_as_req_enc_timestamp(self, client_creds): > client_account = client_creds.get_username() > client_as_etypes = self.get_default_enctypes() > client_kvno = client_creds.get_kvno() >@@ -197,6 +204,9 @@ class AsReqKerberosTests(KDCBaseTest): > pac_request=True) > self.assertIsNotNone(as_rep) > >+ return etype_info2 >+ >+ > if __name__ == "__main__": > global_asn1_print = False > global_hexdump = False >diff --git a/python/samba/tests/krb5/salt_tests.py b/python/samba/tests/krb5/salt_tests.py >new file mode 100755 >index 00000000000..ecbf618e40e >--- /dev/null >+++ b/python/samba/tests/krb5/salt_tests.py >@@ -0,0 +1,327 @@ >+#!/usr/bin/env python3 >+# Unix SMB/CIFS implementation. >+# Copyright (C) Stefan Metzmacher 2020 >+# >+# This program is free software; you can redistribute it and/or modify >+# it under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# This program is distributed in the hope that it will be useful, >+# but WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with this program. If not, see <http://www.gnu.org/licenses/>. >+# >+ >+import sys >+import os >+ >+import ldb >+ >+from samba.tests.krb5.as_req_tests import AsReqKerberosTests >+import samba.tests.krb5.kcrypto as kcrypto >+ >+sys.path.insert(0, "bin/python") >+os.environ["PYTHONUNBUFFERED"] = "1" >+ >+global_asn1_print = False >+global_hexdump = False >+ >+ >+class SaltTests(AsReqKerberosTests): >+ >+ def setUp(self): >+ super().setUp() >+ self.do_asn1_print = global_asn1_print >+ self.do_hexdump = global_hexdump >+ >+ def _get_creds(self, *, >+ account_type, >+ opts=None): >+ try: >+ return self.get_cached_creds( >+ account_type=account_type, >+ opts=opts) >+ except ldb.LdbError: >+ self.fail() >+ >+ def _run_salt_test(self, client_creds): >+ expected_salt = self.get_salt(client_creds) >+ self.assertIsNotNone(expected_salt) >+ >+ etype_info2 = self._run_as_req_enc_timestamp(client_creds) >+ >+ self.assertEqual(etype_info2[0]['etype'], kcrypto.Enctype.AES256) >+ self.assertEqual(etype_info2[0]['salt'], expected_salt) >+ >+ def test_salt_at_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'name_suffix': 'foo@bar'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_at_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'name_suffix': 'foo@bar'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_at_case_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'name_suffix': 'Foo@bar'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_at_case_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'name_suffix': 'Foo@bar'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_double_at_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'name_suffix': 'foo@@bar'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_double_at_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'name_suffix': 'foo@@bar'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_at_start_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'name_prefix': '@foo'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_at_start_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'name_prefix': '@foo'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_at_end_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'name_suffix': 'foo@'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_at_end_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'name_suffix': 'foo@'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_at_end_no_dollar_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'name_suffix': 'foo@', >+ 'add_dollar': False}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_no_dollar_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'add_dollar': False}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_dollar_mid_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'name_suffix': 'foo$bar', >+ 'add_dollar': False}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_dollar_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'name_suffix': 'foo$bar'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_dollar_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'name_suffix': 'foo$bar'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_dollar_end_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'name_suffix': 'foo$'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_dollar_end_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'name_suffix': 'foo$'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'foo0'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'foo1'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_host_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'host/foo2'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_host_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'host/foo3'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_realm_user(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'foo4@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_realm_mac(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'foo5@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_host_realm_user(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'host/foo6@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_host_realm_mac(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'host/foo7@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_dollar_realm_user(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'foo8$@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_dollar_realm_mac(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'foo9$@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_host_dollar_realm_user(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'host/foo10$@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_host_dollar_realm_mac(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'host/foo11$@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_other_realm_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'foo12@other.realm'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_other_realm_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'foo13@other.realm'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_host_other_realm_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'host/foo14@other.realm'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_host_other_realm_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'host/foo15@other.realm'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_case_user(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'Foo16'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_case_mac(self): >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'Foo17'}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_dollar_mid_realm_user(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'foo$18@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_dollar_mid_realm_mac(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'foo$19@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_host_dollar_mid_realm_user(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'host/foo$20@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_host_dollar_mid_realm_mac(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'host/foo$21@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_at_realm_user(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.USER, >+ opts={'upn': 'foo22@bar@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ def test_salt_upn_at_realm_mac(self): >+ realm = self.get_samdb().domain_dns_name() >+ client_creds = self._get_creds( >+ account_type=self.AccountType.COMPUTER, >+ opts={'upn': 'foo23@bar@' + realm}) >+ self._run_as_req_enc_timestamp(client_creds) >+ >+ >+if __name__ == "__main__": >+ global_asn1_print = False >+ global_hexdump = False >+ import unittest >+ unittest.main() >diff --git a/python/samba/tests/usage.py b/python/samba/tests/usage.py >index e1711b532d7..4b68a2b798c 100644 >--- a/python/samba/tests/usage.py >+++ b/python/samba/tests/usage.py >@@ -103,6 +103,7 @@ EXCLUDE_USAGE = { > 'python/samba/tests/krb5/as_req_tests.py', > 'python/samba/tests/krb5/fast_tests.py', > 'python/samba/tests/krb5/rodc_tests.py', >+ 'python/samba/tests/krb5/salt_tests.py', > } > > EXCLUDE_HELP = { >diff --git a/selftest/knownfail.d/kdc-salt b/selftest/knownfail.d/kdc-salt >new file mode 100644 >index 00000000000..1a4ecd44624 >--- /dev/null >+++ b/selftest/knownfail.d/kdc-salt >@@ -0,0 +1,12 @@ >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_case_mac >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_case_user >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_end_mac >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_end_no_dollar_mac >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_end_user >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_mac >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_start_mac >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_start_user >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_user >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_double_at_mac >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_double_at_user >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_upn_at_realm_user >diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc >index b1d7a1ebe8f..b39b11c3c53 100644 >--- a/selftest/knownfail_heimdal_kdc >+++ b/selftest/knownfail_heimdal_kdc >@@ -71,6 +71,114 @@ > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2008r2dc > ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_dummy_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_dummy_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_aes128_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_dummy_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes128_aes256_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes256_aes128_pac_True.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_False.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_None.fl2008r2dc >+^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_as_req_no_preauth_rc4_dummy_aes256_pac_True.fl2008r2dc > # > # FAST tests > # >diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py >index 2d2d0af658f..e7ec2f363d2 100755 >--- a/source4/selftest/tests.py >+++ b/source4/selftest/tests.py >@@ -1326,6 +1326,14 @@ for env in ["fl2008r2dc", "fl2003dc"]: > 'TKT_SIG_SUPPORT': tkt_sig_support > }) > >+planoldpythontestsuite('fl2008r2dc', 'samba.tests.krb5.salt_tests', >+ environ={ >+ 'ADMIN_USERNAME': '$USERNAME', >+ 'ADMIN_PASSWORD': '$PASSWORD', >+ 'STRICT_CHECKING': '0', >+ 'FAST_SUPPORT': have_fast_support, >+ 'TKT_SIG_SUPPORT': tkt_sig_support >+ }) > > for env in ["rodc", "promoted_dc", "fl2000dc", "fl2008r2dc"]: > if env == "rodc": >-- >2.25.1 > > >From c80748544918a25943c7de091ddf5b94bfcb8742 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Tue, 19 Oct 2021 16:01:36 +1300 >Subject: [PATCH 379/380] dsdb: Allow special chars like "@" in samAccountName > when generating the salt > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Stefan Metzmacher <metze@samba.org> > >Autobuild-User(master): Stefan Metzmacher <metze@samba.org> >Autobuild-Date(master): Wed Oct 20 12:54:54 UTC 2021 on sn-devel-184 > >(cherry picked from commit 5eeb441b771a1ffe1ba1c69b72e8795f525a58ed) >--- > auth/credentials/credentials_krb5.c | 12 +- > lib/krb5_wrap/krb5_samba.c | 192 +++++++++++++++--- > lib/krb5_wrap/krb5_samba.h | 13 +- > selftest/knownfail.d/kdc-salt | 11 - > source3/passdb/machine_account_secrets.c | 10 +- > .../dsdb/samdb/ldb_modules/password_hash.c | 23 ++- > 6 files changed, 195 insertions(+), 66 deletions(-) > >diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c >index 20e677e521a..61e55f7032d 100644 >--- a/auth/credentials/credentials_krb5.c >+++ b/auth/credentials/credentials_krb5.c >@@ -1199,12 +1199,12 @@ _PUBLIC_ int cli_credentials_get_keytab(struct cli_credentials *cred, > break; > } > >- ret = smb_krb5_salt_principal(realm, >- username, /* sAMAccountName */ >- upn, /* userPrincipalName */ >- uac_flags, >- mem_ctx, >- &salt_principal); >+ ret = smb_krb5_salt_principal_str(realm, >+ username, /* sAMAccountName */ >+ upn, /* userPrincipalName */ >+ uac_flags, >+ mem_ctx, >+ &salt_principal); > if (ret) { > talloc_free(mem_ctx); > return ret; >diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c >index ee7055ea7b8..7655dab8ec6 100644 >--- a/lib/krb5_wrap/krb5_samba.c >+++ b/lib/krb5_wrap/krb5_samba.c >@@ -456,19 +456,20 @@ int smb_krb5_get_pw_salt(krb5_context context, > * > * @see smb_krb5_salt_principal2data > */ >-int smb_krb5_salt_principal(const char *realm, >+int smb_krb5_salt_principal(krb5_context krb5_ctx, >+ const char *realm, > const char *sAMAccountName, > const char *userPrincipalName, > uint32_t uac_flags, >- TALLOC_CTX *mem_ctx, >- char **_salt_principal) >+ krb5_principal *salt_princ) > { > TALLOC_CTX *frame = talloc_stackframe(); > char *upper_realm = NULL; > const char *principal = NULL; > int principal_len = 0; >+ krb5_error_code krb5_ret; > >- *_salt_principal = NULL; >+ *salt_princ = NULL; > > if (sAMAccountName == NULL) { > TALLOC_FREE(frame); >@@ -512,7 +513,6 @@ int smb_krb5_salt_principal(const char *realm, > */ > if (uac_flags & UF_TRUST_ACCOUNT_MASK) { > int computer_len = 0; >- char *tmp = NULL; > > computer_len = strlen(sAMAccountName); > if (sAMAccountName[computer_len-1] == '$') { >@@ -520,60 +520,186 @@ int smb_krb5_salt_principal(const char *realm, > } > > if (uac_flags & UF_INTERDOMAIN_TRUST_ACCOUNT) { >- principal = talloc_asprintf(frame, "krbtgt/%*.*s", >- computer_len, computer_len, >- sAMAccountName); >- if (principal == NULL) { >+ const char *krbtgt = "krbtgt"; >+ krb5_ret = krb5_build_principal_ext(krb5_ctx, >+ salt_princ, >+ strlen(upper_realm), >+ upper_realm, >+ strlen(krbtgt), >+ krbtgt, >+ computer_len, >+ sAMAccountName, >+ 0); >+ if (krb5_ret != 0) { > TALLOC_FREE(frame); >- return ENOMEM; >+ return krb5_ret; > } > } else { >- >- tmp = talloc_asprintf(frame, "host/%*.*s.%s", >- computer_len, computer_len, >- sAMAccountName, realm); >+ const char *host = "host"; >+ char *tmp = NULL; >+ char *tmp_lower = NULL; >+ >+ tmp = talloc_asprintf(frame, "%*.*s.%s", >+ computer_len, >+ computer_len, >+ sAMAccountName, >+ realm); > if (tmp == NULL) { > TALLOC_FREE(frame); > return ENOMEM; > } > >- principal = strlower_talloc(frame, tmp); >- TALLOC_FREE(tmp); >- if (principal == NULL) { >+ tmp_lower = strlower_talloc(frame, tmp); >+ if (tmp_lower == NULL) { > TALLOC_FREE(frame); > return ENOMEM; > } >- } > >- principal_len = strlen(principal); >+ krb5_ret = krb5_build_principal_ext(krb5_ctx, >+ salt_princ, >+ strlen(upper_realm), >+ upper_realm, >+ strlen(host), >+ host, >+ strlen(tmp_lower), >+ tmp_lower, >+ 0); >+ if (krb5_ret != 0) { >+ TALLOC_FREE(frame); >+ return krb5_ret; >+ } >+ } > > } else if (userPrincipalName != NULL) { >- char *p; >+ /* >+ * We parse the name not only to allow an easy >+ * replacement of the realm (no matter the realm in >+ * the UPN, the salt comes from the upper-case real >+ * realm, but also to correctly provide a salt when >+ * the UPN is host/foo.bar >+ * >+ * This can fail for a UPN of the form foo@bar@REALM >+ * (which is accepted by windows) however. >+ */ >+ krb5_ret = krb5_parse_name(krb5_ctx, >+ userPrincipalName, >+ salt_princ); > >- principal = userPrincipalName; >- p = strchr(principal, '@'); >- if (p != NULL) { >- principal_len = PTR_DIFF(p, principal); >- } else { >- principal_len = strlen(principal); >+ if (krb5_ret != 0) { >+ TALLOC_FREE(frame); >+ return krb5_ret; >+ } >+ >+ /* >+ * No matter what realm (including none) in the UPN, >+ * the realm is replaced with our upper-case realm >+ */ >+ smb_krb5_principal_set_realm(krb5_ctx, >+ *salt_princ, >+ upper_realm); >+ if (krb5_ret != 0) { >+ krb5_free_principal(krb5_ctx, *salt_princ); >+ TALLOC_FREE(frame); >+ return krb5_ret; > } > } else { > principal = sAMAccountName; > principal_len = strlen(principal); >- } > >- *_salt_principal = talloc_asprintf(mem_ctx, "%*.*s@%s", >- principal_len, principal_len, >- principal, upper_realm); >- if (*_salt_principal == NULL) { >- TALLOC_FREE(frame); >- return ENOMEM; >+ krb5_ret = krb5_build_principal_ext(krb5_ctx, >+ salt_princ, >+ strlen(upper_realm), >+ upper_realm, >+ principal_len, >+ principal, >+ 0); >+ if (krb5_ret != 0) { >+ TALLOC_FREE(frame); >+ return krb5_ret; >+ } > } > > TALLOC_FREE(frame); > return 0; > } > >+/** >+ * @brief This constructs the salt principal used by active directory >+ * >+ * Most Kerberos encryption types require a salt in order to >+ * calculate the long term private key for user/computer object >+ * based on a password. >+ * >+ * The returned _salt_principal is a string in forms like this: >+ * - host/somehost.example.com@EXAMPLE.COM >+ * - SomeAccount@EXAMPLE.COM >+ * - SomePrincipal@EXAMPLE.COM >+ * >+ * This is not the form that's used as salt, it's just >+ * the human readable form. It needs to be converted by >+ * smb_krb5_salt_principal2data(). >+ * >+ * @param[in] realm The realm the user/computer is added too. >+ * >+ * @param[in] sAMAccountName The sAMAccountName attribute of the object. >+ * >+ * @param[in] userPrincipalName The userPrincipalName attribute of the object >+ * or NULL is not available. >+ * >+ * @param[in] uac_flags UF_ACCOUNT_TYPE_MASKed userAccountControl field >+ * >+ * @param[in] mem_ctx The TALLOC_CTX to allocate _salt_principal. >+ * >+ * @param[out] _salt_principal The resulting principal as string. >+ * >+ * @retval 0 Success; otherwise - Kerberos error codes >+ * >+ * @see smb_krb5_salt_principal2data >+ */ >+int smb_krb5_salt_principal_str(const char *realm, >+ const char *sAMAccountName, >+ const char *userPrincipalName, >+ uint32_t uac_flags, >+ TALLOC_CTX *mem_ctx, >+ char **_salt_principal_str) >+{ >+ krb5_principal salt_principal = NULL; >+ char *salt_principal_malloc; >+ krb5_context krb5_ctx; >+ krb5_error_code krb5_ret >+ = smb_krb5_init_context_common(&krb5_ctx); >+ if (krb5_ret != 0) { >+ DBG_ERR("kerberos init context failed (%s)\n", >+ error_message(krb5_ret)); >+ return krb5_ret; >+ } >+ >+ krb5_ret = smb_krb5_salt_principal(krb5_ctx, >+ realm, >+ sAMAccountName, >+ userPrincipalName, >+ uac_flags, >+ &salt_principal); >+ >+ krb5_ret = krb5_unparse_name(krb5_ctx, salt_principal, >+ &salt_principal_malloc); >+ if (krb5_ret != 0) { >+ krb5_free_principal(krb5_ctx, salt_principal); >+ DBG_ERR("kerberos unparse of salt principal failed (%s)\n", >+ error_message(krb5_ret)); >+ return krb5_ret; >+ } >+ krb5_free_principal(krb5_ctx, salt_principal); >+ *_salt_principal_str >+ = talloc_strdup(mem_ctx, salt_principal_malloc); >+ krb5_free_unparsed_name(krb5_ctx, salt_principal_malloc); >+ >+ if (*_salt_principal_str == NULL) { >+ return ENOMEM; >+ } >+ return 0; >+} >+ > /** > * @brief Converts the salt principal string into the salt data blob > * >diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h >index 64ae0275dbd..8269847c735 100644 >--- a/lib/krb5_wrap/krb5_samba.h >+++ b/lib/krb5_wrap/krb5_samba.h >@@ -350,12 +350,19 @@ krb5_error_code ms_suptypes_to_ietf_enctypes(TALLOC_CTX *mem_ctx, > int smb_krb5_get_pw_salt(krb5_context context, > krb5_const_principal host_princ, > krb5_data *psalt); >-int smb_krb5_salt_principal(const char *realm, >+int smb_krb5_salt_principal(krb5_context krb5_ctx, >+ const char *realm, > const char *sAMAccountName, > const char *userPrincipalName, > uint32_t uac_flags, >- TALLOC_CTX *mem_ctx, >- char **_salt_principal); >+ krb5_principal *salt_princ); >+ >+int smb_krb5_salt_principal_str(const char *realm, >+ const char *sAMAccountName, >+ const char *userPrincipalName, >+ uint32_t uac_flags, >+ TALLOC_CTX *mem_ctx, >+ char **_salt_principal); > int smb_krb5_salt_principal2data(krb5_context context, > const char *salt_principal, > TALLOC_CTX *mem_ctx, >diff --git a/selftest/knownfail.d/kdc-salt b/selftest/knownfail.d/kdc-salt >index 1a4ecd44624..a671e4d93eb 100644 >--- a/selftest/knownfail.d/kdc-salt >+++ b/selftest/knownfail.d/kdc-salt >@@ -1,12 +1 @@ >-^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_case_mac >-^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_case_user >-^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_end_mac >-^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_end_no_dollar_mac >-^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_end_user >-^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_mac >-^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_start_mac >-^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_start_user >-^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_at_user >-^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_double_at_mac >-^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_double_at_user > ^samba.tests.krb5.salt_tests.samba.tests.krb5.salt_tests.SaltTests.test_salt_upn_at_realm_user >diff --git a/source3/passdb/machine_account_secrets.c b/source3/passdb/machine_account_secrets.c >index efba80f1474..f426d9da25e 100644 >--- a/source3/passdb/machine_account_secrets.c >+++ b/source3/passdb/machine_account_secrets.c >@@ -1574,11 +1574,11 @@ NTSTATUS secrets_store_JoinCtx(const struct libnet_JoinCtx *r) > if (info->salt_principal == NULL && r->out.domain_is_ad) { > char *p = NULL; > >- ret = smb_krb5_salt_principal(info->domain_info.dns_domain.string, >- info->account_name, >- NULL /* userPrincipalName */, >- UF_WORKSTATION_TRUST_ACCOUNT, >- info, &p); >+ ret = smb_krb5_salt_principal_str(info->domain_info.dns_domain.string, >+ info->account_name, >+ NULL /* userPrincipalName */, >+ UF_WORKSTATION_TRUST_ACCOUNT, >+ info, &p); > if (ret != 0) { > status = krb5_to_nt_status(ret); > DBG_ERR("smb_krb5_salt_principal() failed " >diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c >index c321678e813..2111b5547d9 100644 >--- a/source4/dsdb/samdb/ldb_modules/password_hash.c >+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c >@@ -684,8 +684,8 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) > { > struct ldb_context *ldb; > krb5_error_code krb5_ret; >- char *salt_principal = NULL; >- char *salt_data = NULL; >+ krb5_principal salt_principal = NULL; >+ krb5_data salt_data; > krb5_data salt; > krb5_keyblock key; > krb5_data cleartext_data; >@@ -696,11 +696,11 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) > cleartext_data.length = io->n.cleartext_utf8->length; > > uac_flags = io->u.userAccountControl & UF_ACCOUNT_TYPE_MASK; >- krb5_ret = smb_krb5_salt_principal(io->ac->status->domain_data.realm, >+ krb5_ret = smb_krb5_salt_principal(io->smb_krb5_context->krb5_context, >+ io->ac->status->domain_data.realm, > io->u.sAMAccountName, > io->u.user_principal_name, > uac_flags, >- io->ac, > &salt_principal); > if (krb5_ret) { > ldb_asprintf_errstring(ldb, >@@ -714,8 +714,10 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) > /* > * create salt from salt_principal > */ >- krb5_ret = smb_krb5_salt_principal2data(io->smb_krb5_context->krb5_context, >- salt_principal, io->ac, &salt_data); >+ krb5_ret = smb_krb5_get_pw_salt(io->smb_krb5_context->krb5_context, >+ salt_principal, &salt_data); >+ >+ krb5_free_principal(io->smb_krb5_context->krb5_context, salt_principal); > if (krb5_ret) { > ldb_asprintf_errstring(ldb, > "setup_kerberos_keys: " >@@ -724,12 +726,17 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) > krb5_ret, io->ac)); > return LDB_ERR_OPERATIONS_ERROR; > } >- io->g.salt = salt_data; > > /* now use the talloced copy of the salt */ >- salt.data = discard_const(io->g.salt); >+ salt.data = talloc_strndup(io->ac, >+ (char *)salt_data.data, >+ salt_data.length); >+ io->g.salt = salt.data; > salt.length = strlen(io->g.salt); > >+ smb_krb5_free_data_contents(io->smb_krb5_context->krb5_context, >+ &salt_data); >+ > /* > * create ENCTYPE_AES256_CTS_HMAC_SHA1_96 key out of > * the salt and the cleartext password >-- >2.25.1 > > >From f24fcfc799a3e77c9c2cdf24e2c18874e9594f35 Mon Sep 17 00:00:00 2001 >From: Andrew Bartlett <abartlet@samba.org> >Date: Fri, 22 Oct 2021 10:50:36 +1300 >Subject: [PATCH 380/380] lib/krb5_wrap: Fix missing error check in new salt > code > >CID 1492905: Control flow issues (DEADCODE) > >This was a regression in 5eeb441b771a1ffe1ba1c69b72e8795f525a58ed. > >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14874 >BUG: https://bugzilla.samba.org/show_bug.cgi?id=14881 > >Signed-off-by: Andrew Bartlett <abartlet@samba.org> >Reviewed-by: Andreas Schneider <asn@samba.org> > >Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> >Autobuild-Date(master): Sat Oct 23 08:07:13 UTC 2021 on sn-devel-184 > >(cherry picked from commit 5094d986b7686f057195dcb10764295b88967019) > >Autobuild-User(v4-13-test): Stefan Metzmacher <metze@samba.org> >Autobuild-Date(v4-13-test): Wed Oct 27 23:29:34 UTC 2021 on sn-devel-184 >--- > lib/krb5_wrap/krb5_samba.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > >diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c >index 7655dab8ec6..b0ce48da669 100644 >--- a/lib/krb5_wrap/krb5_samba.c >+++ b/lib/krb5_wrap/krb5_samba.c >@@ -594,9 +594,9 @@ int smb_krb5_salt_principal(krb5_context krb5_ctx, > * No matter what realm (including none) in the UPN, > * the realm is replaced with our upper-case realm > */ >- smb_krb5_principal_set_realm(krb5_ctx, >- *salt_princ, >- upper_realm); >+ krb5_ret = smb_krb5_principal_set_realm(krb5_ctx, >+ *salt_princ, >+ upper_realm); > if (krb5_ret != 0) { > krb5_free_principal(krb5_ctx, *salt_princ); > TALLOC_FREE(frame); >-- >2.25.1 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Flags:
abartlet
:
ci-passed+
Actions:
View
Attachments on
bug 14881
:
16864
|
16865
|
16868
|
16869
|
16870
|
16871
|
16873
|
16874
|
16875
|
16876
|
16877
|
16879
|
16881
| 16882 |
16883