tests/krb5: Make edata checking less strict

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py
index ee9d932e38a32501f4f49a50f9a93f6d766bc52c..f021a1e73cd5e09a45c71b2439ae077b174cf93b 100755 (executable)
--- a/python/samba/tests/krb5/fast_tests.py
+++ b/python/samba/tests/krb5/fast_tests.py
@@ -146,7 +146,8 @@ class FAST_Tests(KDCBaseTest):
                 'fast_armor': FX_FAST_ARMOR_AP_REQUEST,
                 'gen_armor_tgt_fn': self.get_mach_tgt,
                 'sname': None,
-                'expected_sname': expected_sname
+                'expected_sname': expected_sname,
+                'strict_edata_checking': False
             }
         ])
 
@@ -161,7 +162,8 @@ class FAST_Tests(KDCBaseTest):
                 'gen_tgt_fn': self.get_user_tgt,
                 'fast_armor': None,
                 'sname': None,
-                'expected_sname': expected_sname
+                'expected_sname': expected_sname,
+                'strict_edata_checking': False
             }
         ])
 
@@ -179,7 +181,8 @@ class FAST_Tests(KDCBaseTest):
                 'inner_req': {
                     'sname': None  # should be ignored
                 },
-                'expected_sname': expected_sname
+                'expected_sname': expected_sname,
+                'strict_edata_checking': False
             }
         ])
 
@@ -197,7 +200,8 @@ class FAST_Tests(KDCBaseTest):
                 'inner_req': {
                     'sname': None  # should be ignored
                 },
-                'expected_sname': expected_sname
+                'expected_sname': expected_sname,
+                'strict_edata_checking': False
             }
         ])
 
@@ -357,7 +361,8 @@ class FAST_Tests(KDCBaseTest):
                 'use_fast': True,
                 'gen_tgt_fn': self.get_mach_tgt,
                 'fast_armor': None,
-                'etypes': ()
+                'etypes': (),
+                'strict_edata_checking': False
             }
         ])
 
@@ -379,7 +384,8 @@ class FAST_Tests(KDCBaseTest):
                 'use_fast': True,
                 'fast_armor': FX_FAST_ARMOR_AP_REQUEST,
                 'gen_armor_tgt_fn': self.get_mach_tgt,
-                'etypes': ()
+                'etypes': (),
+                'strict_edata_checking': False
             }
         ])
 
@@ -1458,6 +1464,8 @@ class FAST_Tests(KDCBaseTest):
 
             fast_ap_options = kdc_dict.pop('fast_ap_options', None)
 
+            strict_edata_checking = kdc_dict.pop('strict_edata_checking', True)
+
             if rep_type == KRB_AS_REP:
                 kdc_exchange_dict = self.as_exchange_dict(
                     expected_crealm=expected_crealm,
@@ -1493,6 +1501,7 @@ class FAST_Tests(KDCBaseTest):
                     pac_request=True,
                     pac_options=pac_options,
                     fast_ap_options=fast_ap_options,
+                    strict_edata_checking=strict_edata_checking,
                     expect_edata=expect_edata)
             else:  # KRB_TGS_REP
                 kdc_exchange_dict = self.tgs_exchange_dict(
@@ -1528,6 +1537,7 @@ class FAST_Tests(KDCBaseTest):
                     pac_request=None,
                     pac_options=pac_options,
                     fast_ap_options=fast_ap_options,
+                    strict_edata_checking=strict_edata_checking,
                     expect_edata=expect_edata)
 
             repeat = kdc_dict.pop('repeat', 1)

diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py
index 4171ead34d4dafe8d5f362f31914e79fc16a4a74..76fc995ce9519d4d24ebd2880b056bdc2aaf98a6 100644 (file)
--- a/python/samba/tests/krb5/raw_testcase.py
+++ b/python/samba/tests/krb5/raw_testcase.py
@@ -2041,6 +2041,7 @@ class RawKerberosTest(TestCaseInTempDir):
                          pac_options=None,
                          ap_options=None,
                          fast_ap_options=None,
+                         strict_edata_checking=True,
                          expect_edata=None,
                          expect_pac=True,
                          expect_claims=True,
@@ -2099,6 +2100,7 @@ class RawKerberosTest(TestCaseInTempDir):
             'pac_options': pac_options,
             'ap_options': ap_options,
             'fast_ap_options': fast_ap_options,
+            'strict_edata_checking': strict_edata_checking,
             'expect_edata': expect_edata,
             'expect_pac': expect_pac,
             'expect_claims': expect_claims,
@@ -2152,6 +2154,7 @@ class RawKerberosTest(TestCaseInTempDir):
                           pac_options=None,
                           ap_options=None,
                           fast_ap_options=None,
+                          strict_edata_checking=True,
                           expect_edata=None,
                           expect_pac=True,
                           expect_claims=True,
@@ -2211,6 +2214,7 @@ class RawKerberosTest(TestCaseInTempDir):
             'pac_options': pac_options,
             'ap_options': ap_options,
             'fast_ap_options': fast_ap_options,
+            'strict_edata_checking': strict_edata_checking,
             'expect_edata': expect_edata,
             'expect_pac': expect_pac,
             'expect_claims': expect_claims,
@@ -2821,7 +2825,8 @@ class RawKerberosTest(TestCaseInTempDir):
                             and not inner)
         if not expect_edata:
             self.assertIsNone(expected_status)
-            self.assertElementMissing(rep, 'e-data')
+            if self.strict_checking:
+                self.assertElementMissing(rep, 'e-data')
             return rep
         edata = self.getElementValue(rep, 'e-data')
         if self.strict_checking:
@@ -2947,13 +2952,19 @@ class RawKerberosTest(TestCaseInTempDir):
                 expected_patypes += (PADATA_FX_FAST,)
                 expected_patypes += (PADATA_FX_COOKIE,)
 
+        require_strict = {PADATA_FX_COOKIE,
+                          PADATA_FX_FAST,
+                          PADATA_PAC_OPTIONS,
+                          PADATA_PK_AS_REP_19,
+                          PADATA_PK_AS_REQ}
+        strict_edata_checking = kdc_exchange_dict['strict_edata_checking']
+        if not strict_edata_checking:
+            require_strict.add(PADATA_ETYPE_INFO2)
+            require_strict.add(PADATA_ENCRYPTED_CHALLENGE)
+
         got_patypes = tuple(pa['padata-type'] for pa in rep_padata)
         self.assertSequenceElementsEqual(expected_patypes, got_patypes,
-                                         require_strict={PADATA_FX_COOKIE,
-                                                         PADATA_FX_FAST,
-                                                         PADATA_PAC_OPTIONS,
-                                                         PADATA_PK_AS_REP_19,
-                                                         PADATA_PK_AS_REQ})
+                                         require_strict=require_strict)
 
         if not expected_patypes:
             return None

diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc
index d593048c8a8740c397cdfc3ca87bbc731a0ae62e..fbc1d286937d080aab4b1d3209aad87ff8996aad 100644 (file)
--- a/selftest/knownfail_mit_kdc
+++ b/selftest/knownfail_mit_kdc
@@ -345,13 +345,11 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
 ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_tgt.ad_dc
 ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_invalid_tgt_mach.ad_dc
 ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_armor.ad_dc
-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_unknown_critical_option.ad_dc
 ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_outer_no_sname.ad_dc
 ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_outer_no_sname.ad_dc
 ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_no_sname.ad_dc
 ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_armor_session_key.ad_dc
 ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_tgs_no_sname.ad_dc
-^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_fast_no_etypes.ad_dc
 ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_no_sname.ad_dc
 ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_simple_tgs_no_sname.ad_dc
 ^samba.tests.krb5.fast_tests.samba.tests.krb5.fast_tests.FAST_Tests.test_fast_inner_no_sname.ad_dc