tests/krb5: Check reply FAST padata if request included FAST

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py
index 77b682e57ead4a3b73690d727e70c926209632cb..965a8f9fb00972fa1d56d33b6058042310826e95 100644 (file)
--- a/python/samba/tests/krb5/raw_testcase.py
+++ b/python/samba/tests/krb5/raw_testcase.py
@@ -2177,6 +2177,21 @@ class RawKerberosTest(TestCaseInTempDir):
             rep_padata = self.der_decode(edata,
                                          asn1Spec=krb5_asn1.METHOD_DATA())
             self.assertGreater(len(rep_padata), 0)
+
+            if sent_fast:
+                self.assertEqual(1, len(rep_padata))
+                rep_pa_dict = self.get_pa_dict(rep_padata)
+                self.assertIn(PADATA_FX_FAST, rep_pa_dict)
+
+                armor_key = kdc_exchange_dict['armor_key']
+                self.assertIsNotNone(armor_key)
+                fast_response = self.check_fx_fast_data(
+                    kdc_exchange_dict,
+                    rep_pa_dict[PADATA_FX_FAST],
+                    armor_key,
+                    expect_strengthen_key=False)
+
+                rep_padata = fast_response['padata']
         else:
             rep_padata = []