sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

tests/krb5: Add test for S4U2Self with wrong sname

Browse Source 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Joseph Sutton 2021-11-25 10:05:17 +13:00 committed by Andrew Bartlett
parent d5d22bf84a
commit bac5f75059
2 changed files with 32 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
python/samba/tests/krb5/s4u_tests.py
View File

@ -36,6 +36,7 @@ from samba.tests.krb5.raw_testcase import (
from samba.tests.krb5.rfc4120_constants import (
AES256_CTS_HMAC_SHA1_96,
ARCFOUR_HMAC_MD5,
KDC_ERR_BADMATCH,
KDC_ERR_BADOPTION,
KDC_ERR_BAD_INTEGRITY,
KDC_ERR_GENERIC,
@ -243,7 +244,9 @@ class S4UKerberosTests(KDCBaseTest):
client_dn = client_creds.get_dn()
sid = self.get_objectSid(samdb, client_dn)
service_name = service_creds.get_username()[:-1]
service_name = kdc_dict.pop('service_name', None)
if service_name is None:
service_name = service_creds.get_username()[:-1]
service_sname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
names=['host', service_name])
@ -474,6 +477,33 @@ class S4UKerberosTests(KDCBaseTest):
'expected_flags': 'forwardable'
})
# Do an S4U2Self with the sname in the request different to that of the
# service. We expect an error.
def test_s4u2self_wrong_sname(self):
other_creds = self.get_cached_creds(
account_type=self.AccountType.COMPUTER,
opts={
'trusted_to_auth_for_delegation': True,
'id': 0
})
other_sname = other_creds.get_username()[:-1]
self._run_s4u2self_test(
{
'expected_error_mode': KDC_ERR_BADMATCH,
'expect_edata': False,
'client_opts': {
'not_delegated': False
},
'service_opts': {
'trusted_to_auth_for_delegation': True
},
'service_name': other_sname,
'kdc_options': 'forwardable',
'modify_service_tgt_fn': functools.partial(
self.set_ticket_forwardable, flag=True)
})
def _run_delegation_test(self, kdc_dict):
client_opts = kdc_dict.pop('client_opts', None)
client_creds = self.get_cached_creds(

1
selftest/knownfail_heimdal_kdc
View File

@ -81,6 +81,7 @@
^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_service_checksum
^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable
^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed
^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_wrong_sname
#
^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_auth_data_required
^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_auth_data_required