python:tests/krb5: only expect compressed claims if the compression reduces the size

I have captures showing that claims compression depends on the payload
itself and how well it compresses, instead of the pure length of the
payload.

E.g. a single string claim with a value of 68 'a'
characters has an unpressed size of 336
and compressed size is 335.
While a single string with random string s1
has an unpressed size of 504 and it's still
uncompressed on the wire.
A different random string s2 also has an unpressed
size of 504, but it is compressed into a size of 502.

So it really depends if the compression makes it actually
smaller than the uncompressed version.

This makes the tests more reliable against Windows DCs
with existing claims defined.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py
index 4ec4201ccefdf747d9c1fd61875d70ef0940a7fc..c014c18c8462b96d09eb78b105d3434880979294 100644 (file)
--- a/python/samba/tests/krb5/raw_testcase.py
+++ b/python/samba/tests/krb5/raw_testcase.py
@@ -4874,18 +4874,36 @@ class RawKerberosTest(TestCase):
 
                 if uncompressed_size < (
                         claims.CLAIM_LOWER_COMPRESSION_THRESHOLD):
-                    self.assertEqual(claims.CLAIMS_COMPRESSION_FORMAT_NONE,
-                                     compression_format,
+                    self.assertEqual(compression_format,
+                                     claims.CLAIMS_COMPRESSION_FORMAT_NONE,
                                      f'{claims_type} unexpectedly '
                                      f'compressed ({uncompressed_size} '
                                      f'bytes uncompressed)')
-                elif uncompressed_size >= (
-                        claims.CLAIM_UPPER_COMPRESSION_THRESHOLD):
-                    self.assertEqual(
-                        claims.CLAIMS_COMPRESSION_FORMAT_XPRESS_HUFF,
-                        compression_format,
-                        f'{claims_type} unexpectedly not compressed '
-                        f'({uncompressed_size} bytes uncompressed)')
+                elif uncompressed_size > claims_metadata.claims_set_size:
+                    self.assertEqual(compression_format,
+                                     claims.CLAIMS_COMPRESSION_FORMAT_XPRESS_HUFF,
+                                     f'{claims_type} unexpectedly not compressed '
+                                     f'({uncompressed_size} bytes uncompressed)')
+                elif compression_format == claims.CLAIMS_COMPRESSION_FORMAT_NONE:
+                    claims_metadata.compression_format = claims.CLAIMS_COMPRESSION_FORMAT_XPRESS_HUFF
+                    tmp_claims_huff = ndr_pack(claims_metadata)
+                    claims_metadata.compression_format = compression_format
+                    tmp_metadata = ndr_unpack(claims.CLAIMS_SET_METADATA,
+                                              tmp_claims_huff)
+                    self.assertEqual(tmp_metadata.uncompressed_claims_set_size,
+                                     uncompressed_size)
+                    if uncompressed_size > tmp_metadata.claims_set_size:
+                        possible_gain = uncompressed_size - tmp_metadata.claims_set_size
+                        self.assertEqual(compression_format,
+                                         claims.CLAIMS_COMPRESSION_FORMAT_XPRESS_HUFF,
+                                         f'{claims_type} unexpectedly not compressed '
+                                         f'({uncompressed_size} bytes uncompressed)'
+                                         f'(could gain {possible_gain} bytes)')
+                else:
+                    self.assertEqual(compression_format,
+                                     claims.CLAIMS_COMPRESSION_FORMAT_XPRESS_HUFF,
+                                     f'{claims_type} unexpectedly not compressed '
+                                     f'({uncompressed_size} bytes uncompressed)')
 
                 claims_set = claims_metadata.claims_set.claims.claims
                 self.assertIsNotNone(claims_set,