From: Andrew Bartlett <abartlet@samba.org>
Date: Sun, 19 Nov 2023 23:17:57 +0000 (+1300)
Subject: python/tests: Add test for creds.set_krb5_fast_credentials()
X-Git-Tag: talloc-2.4.2~485
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0293d233bf206fabe1e209548c0c44d511f9e73f;p=thirdparty%2Fsamba.git

python/tests: Add test for creds.set_krb5_fast_credentials()

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
---

diff --git a/python/samba/tests/gensec.py b/python/samba/tests/gensec.py
index 5c76e2495a5..fbe5995e70b 100644
--- a/python/samba/tests/gensec.py
+++ b/python/samba/tests/gensec.py
@@ -47,11 +47,14 @@ class GensecTests(samba.tests.TestCase):
     def test_info_uninitialized(self):
         self.assertRaises(RuntimeError, self.gensec.session_info)
 
-    def _test_update(self, mech, *, client_mech=None, client_only_opt=None):
+    def _test_update(self, mech, *, creds=None, client_mech=None, client_only_opt=None):
         """Test GENSEC by doing an exchange with ourselves using GSSAPI against a KDC"""
 
         # Start up a client and server GENSEC instance to test things with
 
+        if creds is None:
+            creds = self.get_credentials()
+
         if client_only_opt:
             orig_client_opt = self.lp_ctx.get(client_only_opt)
             if not orig_client_opt:
@@ -59,7 +62,7 @@ class GensecTests(samba.tests.TestCase):
             self.lp_ctx.set(client_only_opt, "yes")
 
         self.gensec_client = gensec.Security.start_client(self.settings)
-        self.gensec_client.set_credentials(self.get_credentials())
+        self.gensec_client.set_credentials(creds)
         self.gensec_client.want_feature(gensec.FEATURE_SEAL)
         if client_mech is not None:
             self.gensec_client.start_mech_by_name(client_mech)
@@ -177,6 +180,30 @@ class GensecTests(samba.tests.TestCase):
     def test_update_ntlmssp_to_spnego(self):
         self._test_update("GSS-SPNEGO", client_mech="ntlmssp")
 
+    def test_update_fast(self):
+        """Test associating a machine account with the credentials
+           to protect the password from cracking and show
+           'log in from device' pattern.
+
+           (Note we can't tell if FAST armor was actually used with this test)"""
+        creds = self.insta_creds(template=self.get_credentials())
+        machine_creds = Credentials()
+        machine_creds.guess(self.lp_ctx)
+        machine_creds.set_machine_account(self.lp_ctx)
+        creds.set_krb5_fast_armor_credentials(machine_creds, True)
+        self._test_update("GSSAPI", creds=creds)
+
+    def test_update_anon_fast(self):
+        """Test setting no FAST credentials, but requiring FAST.
+           Against a Heimdal KDC this will trigger the anonymous
+           PKINIT protection.
+
+           (Note we can't tell if FAST armor was actually used with this test)
+        """
+        creds = self.insta_creds(template=self.get_credentials())
+        creds.set_krb5_fast_armor_credentials(None, True)
+        self._test_update("GSSAPI", creds=creds)
+
     def test_max_update_size(self):
         """Test GENSEC by doing an exchange with ourselves using GSSAPI against a KDC"""