CVE-2020-25719 selftest: Always expect a PAC in TGS replies with Heimdal

This is tested in other places already, but this ensures a global
check that a TGS-REP has a PAC, regardless.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>

diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index a0de8ab661c2ac17fdf5ae7976f83451f71a1ef3..276c05acb32d65694d294e8195385bc00caf1229 100755 (executable)
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -914,7 +914,7 @@ for env in ['fileserver_smb1', 'nt4_member', 'clusteredmember', 'ktest', 'nt4_dc
 
 have_fast_support = int('SAMBA_USES_MITKDC' in config_hash)
 tkt_sig_support = int('SAMBA4_USES_HEIMDAL' in config_hash)
-expect_pac = 0
+expect_pac = int('SAMBA4_USES_HEIMDAL' in config_hash)
 planoldpythontestsuite("none", "samba.tests.krb5.kcrypto")
 planoldpythontestsuite("ad_dc_default", "samba.tests.krb5.simple_tests",
                        environ={'SERVICE_USERNAME':'$SERVER',