python/samba/tests/dcerpc/raw_protocol.py

   1 #!/usr/bin/env python3
   2 # Unix SMB/CIFS implementation.
   3 # Copyright (C) Stefan Metzmacher 2014,2015
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 import sys
  20 import os
  21 import time
  22
  23 sys.path.insert(0, "bin/python")
  24 os.environ["PYTHONUNBUFFERED"] = "1"
  25
  26 import samba.dcerpc.dcerpc as dcerpc
  27 import samba.dcerpc.base as base
  28 import samba.dcerpc.misc as misc
  29 import samba.dcerpc.epmapper
  30 import samba.dcerpc.mgmt
  31 import samba.dcerpc.netlogon
  32 import samba.dcerpc.lsa
  33 import struct
  34 from samba import gensec
  35 from samba.tests.dcerpc.raw_testcase import RawDCERPCTest
  36 from samba.compat import binary_type
  37 from samba.ntstatus import (
  38     NT_STATUS_SUCCESS
  39 )
  40
  41 global_ndr_print = False
  42 global_hexdump = False
  43
  44
  45 class TestDCERPC_BIND(RawDCERPCTest):
  46
  47     def setUp(self):
  48         super(TestDCERPC_BIND, self).setUp()
  49         self.do_ndr_print = global_ndr_print
  50         self.do_hexdump = global_hexdump
  51
  52     def _test_no_auth_request_bind_pfc_flags(self, req_pfc_flags, rep_pfc_flags):
  53         ndr32 = base.transfer_syntax_ndr()
  54
  55         tsf1_list = [ndr32]
  56         ctx1 = dcerpc.ctx_list()
  57         ctx1.context_id = 1
  58         ctx1.num_transfer_syntaxes = len(tsf1_list)
  59         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
  60         ctx1.transfer_syntaxes = tsf1_list
  61
  62         req = self.generate_bind(call_id=0, pfc_flags=req_pfc_flags, ctx_list=[ctx1])
  63         self.send_pdu(req)
  64         rep = self.recv_pdu()
  65         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
  66                         pfc_flags=rep_pfc_flags, auth_length=0)
  67         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
  68         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
  69         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
  70         self.assertEqual(rep.u.secondary_address_size, 4)
  71         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
  72         self.assertPadding(rep.u._pad1, 2)
  73         self.assertEqual(rep.u.num_results, 1)
  74         self.assertEqual(rep.u.ctx_list[0].result,
  75                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
  76         self.assertEqual(rep.u.ctx_list[0].reason,
  77                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
  78         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
  79         self.assertEqual(rep.u.auth_info, b'\0' * 0)
  80
  81         # And now try a request
  82         req = self.generate_request(call_id=1,
  83                                     context_id=ctx1.context_id,
  84                                     opnum=0,
  85                                     stub=b"")
  86         self.send_pdu(req)
  87         rep = self.recv_pdu()
  88         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
  89                         auth_length=0)
  90         self.assertNotEquals(rep.u.alloc_hint, 0)
  91         self.assertEqual(rep.u.context_id, req.u.context_id)
  92         self.assertEqual(rep.u.cancel_count, 0)
  93         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
  94
  95     def _test_no_auth_request_alter_pfc_flags(self, req_pfc_flags, rep_pfc_flags):
  96         ndr32 = base.transfer_syntax_ndr()
  97
  98         tsf1_list = [ndr32]
  99         ctx1 = dcerpc.ctx_list()
 100         ctx1.context_id = 1
 101         ctx1.num_transfer_syntaxes = len(tsf1_list)
 102         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 103         ctx1.transfer_syntaxes = tsf1_list
 104
 105         req = self.generate_bind(call_id=0, ctx_list=[ctx1])
 106         self.send_pdu(req)
 107         rep = self.recv_pdu()
 108         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
 109                         auth_length=0)
 110         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 111         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 112         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 113         self.assertEqual(rep.u.secondary_address_size, 4)
 114         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
 115         self.assertPadding(rep.u._pad1, 2)
 116         self.assertEqual(rep.u.num_results, 1)
 117         self.assertEqual(rep.u.ctx_list[0].result,
 118                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
 119         self.assertEqual(rep.u.ctx_list[0].reason,
 120                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
 121         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
 122         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 123
 124         # And now try a alter context
 125         req = self.generate_alter(call_id=0, pfc_flags=req_pfc_flags, ctx_list=[ctx1])
 126         self.send_pdu(req)
 127         rep = self.recv_pdu()
 128         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
 129                         pfc_flags=rep_pfc_flags, auth_length=0)
 130         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 131         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 132         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 133         self.assertEqual(rep.u.secondary_address_size, 0)
 134         self.assertEqual(rep.u.secondary_address, "")
 135         self.assertPadding(rep.u._pad1, 2)
 136         self.assertEqual(rep.u.num_results, 1)
 137         self.assertEqual(rep.u.ctx_list[0].result,
 138                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
 139         self.assertEqual(rep.u.ctx_list[0].reason,
 140                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
 141         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
 142         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 143
 144         # And now try a request
 145         req = self.generate_request(call_id=1,
 146                                     context_id=ctx1.context_id,
 147                                     opnum=0,
 148                                     stub=b"")
 149         self.send_pdu(req)
 150         rep = self.recv_pdu()
 151         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
 152                         auth_length=0)
 153         self.assertNotEquals(rep.u.alloc_hint, 0)
 154         self.assertEqual(rep.u.context_id, req.u.context_id)
 155         self.assertEqual(rep.u.cancel_count, 0)
 156         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
 157
 158     def test_no_auth_request(self):
 159         return self._test_no_auth_request_bind_pfc_flags(
 160                                         req_pfc_flags=0 |
 161                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 162                                         dcerpc.DCERPC_PFC_FLAG_LAST,
 163                                         rep_pfc_flags=0 |
 164                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 165                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 166
 167     def test_no_auth_request_bind_pfc_00(self):
 168         return self._test_no_auth_request_bind_pfc_flags(
 169                                         req_pfc_flags=0 |
 170                                         0,
 171                                         rep_pfc_flags=0 |
 172                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 173                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 174
 175     def test_no_auth_request_bind_pfc_FIRST(self):
 176         return self._test_no_auth_request_bind_pfc_flags(
 177                                         req_pfc_flags=0 |
 178                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 179                                         0,
 180                                         rep_pfc_flags=0 |
 181                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 182                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 183
 184     def test_no_auth_request_bind_pfc_LAST(self):
 185         return self._test_no_auth_request_bind_pfc_flags(
 186                                         req_pfc_flags=0 |
 187                                         dcerpc.DCERPC_PFC_FLAG_LAST |
 188                                         0,
 189                                         rep_pfc_flags=0 |
 190                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 191                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 192
 193     def test_no_auth_request_bind_pfc_HDR_SIGNING(self):
 194         return self._test_no_auth_request_bind_pfc_flags(
 195                                         req_pfc_flags=0 |
 196                                         dcerpc.DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
 197                                         0,
 198                                         rep_pfc_flags=0 |
 199                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 200                                         dcerpc.DCERPC_PFC_FLAG_LAST |
 201                                         dcerpc.DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN)
 202
 203     def test_no_auth_request_bind_pfc_08(self):
 204         return self._test_no_auth_request_bind_pfc_flags(
 205                                         req_pfc_flags=0 |
 206                                         8 |
 207                                         0,
 208                                         rep_pfc_flags=0 |
 209                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 210                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 211
 212     def test_no_auth_request_bind_pfc_CONC_MPX(self):
 213         return self._test_no_auth_request_bind_pfc_flags(
 214                                         req_pfc_flags=0 |
 215                                         dcerpc.DCERPC_PFC_FLAG_CONC_MPX |
 216                                         0,
 217                                         rep_pfc_flags=0 |
 218                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 219                                         dcerpc.DCERPC_PFC_FLAG_LAST |
 220                                         dcerpc.DCERPC_PFC_FLAG_CONC_MPX)
 221
 222     def test_no_auth_request_bind_pfc_DID_NOT_EXECUTE(self):
 223         return self._test_no_auth_request_bind_pfc_flags(
 224                                         req_pfc_flags=0 |
 225                                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
 226                                         0,
 227                                         rep_pfc_flags=0 |
 228                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 229                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 230
 231     def test_no_auth_request_bind_pfc_MAYBE(self):
 232         return self._test_no_auth_request_bind_pfc_flags(
 233                                         req_pfc_flags=0 |
 234                                         dcerpc.DCERPC_PFC_FLAG_MAYBE |
 235                                         0,
 236                                         rep_pfc_flags=0 |
 237                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 238                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 239
 240     def test_no_auth_request_bind_pfc_OBJECT_UUID(self):
 241         return self._test_no_auth_request_bind_pfc_flags(
 242                                         req_pfc_flags=0 |
 243                                         dcerpc.DCERPC_PFC_FLAG_OBJECT_UUID |
 244                                         0,
 245                                         rep_pfc_flags=0 |
 246                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 247                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 248
 249     # TODO: doesn't announce DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN
 250     # without authentication
 251     # TODO: doesn't announce DCERPC_PFC_FLAG_CONC_MPX
 252     # by default
 253     def _test_no_auth_request_bind_pfc_ff(self):
 254         return self._test_no_auth_request_bind_pfc_flags(
 255                                         req_pfc_flags=0 |
 256                                         0xff |
 257                                         0,
 258                                         rep_pfc_flags=0 |
 259                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 260                                         dcerpc.DCERPC_PFC_FLAG_LAST |
 261                                         dcerpc.DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
 262                                         dcerpc.DCERPC_PFC_FLAG_CONC_MPX)
 263
 264     def test_no_auth_request_alter_pfc_00(self):
 265         return self._test_no_auth_request_alter_pfc_flags(
 266                                         req_pfc_flags=0 |
 267                                         0,
 268                                         rep_pfc_flags=0 |
 269                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 270                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 271
 272     def test_no_auth_request_alter_pfc_FIRST(self):
 273         return self._test_no_auth_request_alter_pfc_flags(
 274                                         req_pfc_flags=0 |
 275                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 276                                         0,
 277                                         rep_pfc_flags=0 |
 278                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 279                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 280
 281     def test_no_auth_request_alter_pfc_LAST(self):
 282         return self._test_no_auth_request_alter_pfc_flags(
 283                                         req_pfc_flags=0 |
 284                                         dcerpc.DCERPC_PFC_FLAG_LAST |
 285                                         0,
 286                                         rep_pfc_flags=0 |
 287                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 288                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 289
 290     def test_no_auth_request_alter_pfc_HDR_SIGNING(self):
 291         return self._test_no_auth_request_alter_pfc_flags(
 292                                         req_pfc_flags=0 |
 293                                         dcerpc.DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
 294                                         0,
 295                                         rep_pfc_flags=0 |
 296                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 297                                         dcerpc.DCERPC_PFC_FLAG_LAST |
 298                                         dcerpc.DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN)
 299
 300     def test_no_auth_request_alter_pfc_08(self):
 301         return self._test_no_auth_request_alter_pfc_flags(
 302                                         req_pfc_flags=0 |
 303                                         8 |
 304                                         0,
 305                                         rep_pfc_flags=0 |
 306                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 307                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 308
 309     def test_no_auth_request_alter_pfc_CONC_MPX(self):
 310         return self._test_no_auth_request_alter_pfc_flags(
 311                                         req_pfc_flags=0 |
 312                                         dcerpc.DCERPC_PFC_FLAG_CONC_MPX |
 313                                         0,
 314                                         rep_pfc_flags=0 |
 315                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 316                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 317
 318     def test_no_auth_request_alter_pfc_DID_NOT_EXECUTE(self):
 319         return self._test_no_auth_request_alter_pfc_flags(
 320                                         req_pfc_flags=0 |
 321                                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
 322                                         0,
 323                                         rep_pfc_flags=0 |
 324                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 325                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 326
 327     def test_no_auth_request_alter_pfc_MAYBE(self):
 328         return self._test_no_auth_request_alter_pfc_flags(
 329                                         req_pfc_flags=0 |
 330                                         dcerpc.DCERPC_PFC_FLAG_MAYBE |
 331                                         0,
 332                                         rep_pfc_flags=0 |
 333                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 334                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 335
 336     def test_no_auth_request_alter_pfc_OBJECT_UUID(self):
 337         return self._test_no_auth_request_alter_pfc_flags(
 338                                         req_pfc_flags=0 |
 339                                         dcerpc.DCERPC_PFC_FLAG_OBJECT_UUID |
 340                                         0,
 341                                         rep_pfc_flags=0 |
 342                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 343                                         dcerpc.DCERPC_PFC_FLAG_LAST)
 344
 345     def test_no_auth_request_alter_pfc_ff(self):
 346         return self._test_no_auth_request_alter_pfc_flags(
 347                                         req_pfc_flags=0 |
 348                                         0xff |
 349                                         0,
 350                                         rep_pfc_flags=0 |
 351                                         dcerpc.DCERPC_PFC_FLAG_FIRST |
 352                                         dcerpc.DCERPC_PFC_FLAG_LAST |
 353                                         dcerpc.DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN)
 354
 355     def test_no_auth_no_ctx(self):
 356         # send an useless bind
 357         req = self.generate_bind(call_id=0)
 358         self.send_pdu(req)
 359         rep = self.recv_pdu()
 360         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_NAK, req.call_id,
 361                         auth_length=0)
 362         self.assertEqual(rep.u.reject_reason,
 363                           dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
 364         self.assertEqual(rep.u.num_versions, 1)
 365         self.assertEqual(rep.u.versions[0].rpc_vers, req.rpc_vers)
 366         self.assertEqual(rep.u.versions[0].rpc_vers_minor, req.rpc_vers_minor)
 367         self.assertPadding(rep.u._pad, 3)
 368
 369     def test_invalid_auth_noctx(self):
 370         req = self.generate_bind(call_id=0)
 371         req.auth_length = dcerpc.DCERPC_AUTH_TRAILER_LENGTH
 372         self.send_pdu(req)
 373         rep = self.recv_pdu()
 374         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_NAK, req.call_id,
 375                         auth_length=0)
 376         self.assertEqual(rep.u.reject_reason,
 377                           dcerpc.DCERPC_BIND_NAK_REASON_PROTOCOL_VERSION_NOT_SUPPORTED)
 378         self.assertEqual(rep.u.num_versions, 1)
 379         self.assertEqual(rep.u.versions[0].rpc_vers, req.rpc_vers)
 380         self.assertEqual(rep.u.versions[0].rpc_vers_minor, req.rpc_vers_minor)
 381         self.assertPadding(rep.u._pad, 3)
 382
 383     def test_no_auth_valid_valid_request(self):
 384         ndr32 = base.transfer_syntax_ndr()
 385
 386         tsf1_list = [ndr32]
 387         ctx1 = dcerpc.ctx_list()
 388         ctx1.context_id = 1
 389         ctx1.num_transfer_syntaxes = len(tsf1_list)
 390         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 391         ctx1.transfer_syntaxes = tsf1_list
 392
 393         req = self.generate_bind(call_id=0, ctx_list=[ctx1])
 394         self.send_pdu(req)
 395         rep = self.recv_pdu()
 396         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
 397                         auth_length=0)
 398         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 399         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 400         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 401         self.assertEqual(rep.u.secondary_address_size, 4)
 402         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
 403         self.assertPadding(rep.u._pad1, 2)
 404         self.assertEqual(rep.u.num_results, 1)
 405         self.assertEqual(rep.u.ctx_list[0].result,
 406                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
 407         self.assertEqual(rep.u.ctx_list[0].reason,
 408                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
 409         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
 410         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 411
 412         # Send a bind again
 413         tsf2_list = [ndr32]
 414         ctx2 = dcerpc.ctx_list()
 415         ctx2.context_id = 2
 416         ctx2.num_transfer_syntaxes = len(tsf2_list)
 417         ctx2.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 418         ctx2.transfer_syntaxes = tsf2_list
 419
 420         req = self.generate_bind(call_id=1, ctx_list=[ctx2])
 421         self.send_pdu(req)
 422         rep = self.recv_pdu()
 423         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_NAK, req.call_id,
 424                         auth_length=0)
 425         self.assertEqual(rep.u.reject_reason,
 426                           dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
 427         self.assertEqual(rep.u.num_versions, 1)
 428         self.assertEqual(rep.u.versions[0].rpc_vers, req.rpc_vers)
 429         self.assertEqual(rep.u.versions[0].rpc_vers_minor, req.rpc_vers_minor)
 430         self.assertPadding(rep.u._pad, 3)
 431
 432         # wait for a disconnect
 433         rep = self.recv_pdu()
 434         self.assertIsNone(rep)
 435         self.assertNotConnected()
 436
 437     def test_no_auth_invalid_valid_request(self):
 438         # send an useless bind
 439         req = self.generate_bind(call_id=0)
 440         self.send_pdu(req)
 441         rep = self.recv_pdu()
 442         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_NAK, req.call_id,
 443                         auth_length=0)
 444         self.assertEqual(rep.u.reject_reason,
 445                           dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
 446         self.assertEqual(rep.u.num_versions, 1)
 447         self.assertEqual(rep.u.versions[0].rpc_vers, req.rpc_vers)
 448         self.assertEqual(rep.u.versions[0].rpc_vers_minor, req.rpc_vers_minor)
 449         self.assertPadding(rep.u._pad, 3)
 450
 451         # wait for a disconnect
 452         rep = self.recv_pdu()
 453         self.assertIsNone(rep)
 454         self.assertNotConnected()
 455
 456     def test_alter_no_auth_no_ctx(self):
 457         ndr32 = base.transfer_syntax_ndr()
 458
 459         tsf1_list = [ndr32]
 460         ctx1 = dcerpc.ctx_list()
 461         ctx1.context_id = 1
 462         ctx1.num_transfer_syntaxes = len(tsf1_list)
 463         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 464         ctx1.transfer_syntaxes = tsf1_list
 465
 466         req = self.generate_bind(call_id=0, ctx_list=[ctx1])
 467         self.send_pdu(req)
 468         rep = self.recv_pdu()
 469         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
 470                         auth_length=0)
 471         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 472         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 473         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 474         self.assertEqual(rep.u.secondary_address_size, 4)
 475         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
 476         self.assertPadding(rep.u._pad1, 2)
 477         self.assertEqual(rep.u.num_results, 1)
 478         self.assertEqual(rep.u.ctx_list[0].result,
 479                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
 480         self.assertEqual(rep.u.ctx_list[0].reason,
 481                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
 482         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
 483         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 484
 485         # Send a alter
 486         req = self.generate_alter(call_id=1, ctx_list=[])
 487         self.send_pdu(req)
 488         rep = self.recv_pdu()
 489         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
 490                         pfc_flags=req.pfc_flags |
 491                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 492                         auth_length=0)
 493         self.assertNotEquals(rep.u.alloc_hint, 0)
 494         self.assertEqual(rep.u.context_id, 0)
 495         self.assertEqual(rep.u.cancel_count, 0)
 496         self.assertEqual(rep.u.flags, 0)
 497         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
 498         self.assertEqual(rep.u.reserved, 0)
 499         self.assertEqual(len(rep.u.error_and_verifier), 0)
 500
 501         # wait for a disconnect
 502         rep = self.recv_pdu()
 503         self.assertIsNone(rep)
 504         self.assertNotConnected()
 505
 506     def test_no_auth_presentation_ctx_valid1(self):
 507         ndr32 = base.transfer_syntax_ndr()
 508
 509         zero_syntax = misc.ndr_syntax_id()
 510
 511         tsf1_list = [zero_syntax, ndr32]
 512         ctx1 = dcerpc.ctx_list()
 513         ctx1.context_id = 1
 514         ctx1.num_transfer_syntaxes = len(tsf1_list)
 515         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 516         ctx1.transfer_syntaxes = tsf1_list
 517
 518         req = self.generate_bind(call_id=0, ctx_list=[ctx1])
 519         self.send_pdu(req)
 520         rep = self.recv_pdu()
 521         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
 522                         auth_length=0)
 523         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 524         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 525         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 526         self.assertEqual(rep.u.secondary_address_size, 4)
 527         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
 528         self.assertPadding(rep.u._pad1, 2)
 529         self.assertEqual(rep.u.num_results, 1)
 530         self.assertEqual(rep.u.ctx_list[0].result,
 531                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
 532         self.assertEqual(rep.u.ctx_list[0].reason,
 533                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
 534         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
 535         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 536
 537         # Send a alter
 538         req = self.generate_alter(call_id=1, ctx_list=[ctx1])
 539         self.send_pdu(req)
 540         rep = self.recv_pdu()
 541         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
 542                         auth_length=0)
 543         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 544         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 545         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 546         self.assertEqual(rep.u.secondary_address_size, 0)
 547         self.assertPadding(rep.u._pad1, 2)
 548         self.assertEqual(rep.u.num_results, 1)
 549         self.assertEqual(rep.u.ctx_list[0].result,
 550                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
 551         self.assertEqual(rep.u.ctx_list[0].reason,
 552                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
 553         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
 554         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 555
 556         req = self.generate_request(call_id=2,
 557                                     context_id=ctx1.context_id,
 558                                     opnum=0xffff,
 559                                     stub=b"")
 560         self.send_pdu(req)
 561         rep = self.recv_pdu()
 562         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
 563                         pfc_flags=req.pfc_flags |
 564                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 565                         auth_length=0)
 566         self.assertNotEquals(rep.u.alloc_hint, 0)
 567         self.assertEqual(rep.u.context_id, ctx1.context_id)
 568         self.assertEqual(rep.u.cancel_count, 0)
 569         self.assertEqual(rep.u.flags, 0)
 570         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_OP_RNG_ERROR)
 571         self.assertEqual(rep.u.reserved, 0)
 572         self.assertEqual(len(rep.u.error_and_verifier), 0)
 573
 574     def test_no_auth_presentation_ctx_invalid1(self):
 575         ndr32 = base.transfer_syntax_ndr()
 576
 577         zero_syntax = misc.ndr_syntax_id()
 578
 579         tsf1_list = [ndr32]
 580         ctx1 = dcerpc.ctx_list()
 581         ctx1.context_id = 1
 582         ctx1.num_transfer_syntaxes = len(tsf1_list)
 583         ctx1.abstract_syntax = ndr32
 584         ctx1.transfer_syntaxes = tsf1_list
 585
 586         req = self.generate_bind(call_id=0, ctx_list=[ctx1])
 587         self.send_pdu(req)
 588         rep = self.recv_pdu()
 589         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
 590                         auth_length=0)
 591         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 592         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 593         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 594         self.assertEqual(rep.u.secondary_address_size, 4)
 595         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
 596         self.assertPadding(rep.u._pad1, 2)
 597         self.assertEqual(rep.u.num_results, 1)
 598         self.assertEqual(rep.u.ctx_list[0].result,
 599                           dcerpc.DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION)
 600         self.assertEqual(rep.u.ctx_list[0].reason,
 601                           dcerpc.DCERPC_BIND_ACK_REASON_ABSTRACT_SYNTAX_NOT_SUPPORTED)
 602         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, zero_syntax)
 603         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 604
 605         # Send a alter
 606         req = self.generate_alter(call_id=1, ctx_list=[ctx1])
 607         self.send_pdu(req)
 608         rep = self.recv_pdu()
 609         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
 610                         auth_length=0)
 611         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 612         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 613         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 614         self.assertEqual(rep.u.secondary_address_size, 0)
 615         self.assertPadding(rep.u._pad1, 2)
 616         self.assertEqual(rep.u.num_results, 1)
 617         self.assertEqual(rep.u.ctx_list[0].result,
 618                           dcerpc.DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION)
 619         self.assertEqual(rep.u.ctx_list[0].reason,
 620                           dcerpc.DCERPC_BIND_ACK_REASON_ABSTRACT_SYNTAX_NOT_SUPPORTED)
 621         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, zero_syntax)
 622         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 623
 624         req = self.generate_request(call_id=2,
 625                                     context_id=12345,
 626                                     opnum=0,
 627                                     stub=b"")
 628         self.send_pdu(req)
 629         rep = self.recv_pdu()
 630         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
 631                         pfc_flags=req.pfc_flags |
 632                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 633                         auth_length=0)
 634         self.assertNotEquals(rep.u.alloc_hint, 0)
 635         self.assertEqual(rep.u.context_id, 0)
 636         self.assertEqual(rep.u.cancel_count, 0)
 637         self.assertEqual(rep.u.flags, 0)
 638         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_UNKNOWN_IF)
 639         self.assertEqual(rep.u.reserved, 0)
 640         self.assertEqual(len(rep.u.error_and_verifier), 0)
 641
 642         # Send a alter again to prove the connection is still alive
 643         req = self.generate_alter(call_id=3, ctx_list=[ctx1])
 644         self.send_pdu(req)
 645         rep = self.recv_pdu()
 646         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
 647                         auth_length=0)
 648         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 649         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 650         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 651         self.assertEqual(rep.u.secondary_address_size, 0)
 652         self.assertPadding(rep.u._pad1, 2)
 653         self.assertEqual(rep.u.num_results, 1)
 654         self.assertEqual(rep.u.ctx_list[0].result,
 655                           dcerpc.DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION)
 656         self.assertEqual(rep.u.ctx_list[0].reason,
 657                           dcerpc.DCERPC_BIND_ACK_REASON_ABSTRACT_SYNTAX_NOT_SUPPORTED)
 658         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, zero_syntax)
 659         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 660
 661     def test_no_auth_presentation_ctx_invalid2(self):
 662         ndr32 = base.transfer_syntax_ndr()
 663
 664         zero_syntax = misc.ndr_syntax_id()
 665
 666         tsf1a_list = []
 667         ctx1a = dcerpc.ctx_list()
 668         ctx1a.context_id = 1
 669         ctx1a.num_transfer_syntaxes = len(tsf1a_list)
 670         ctx1a.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 671         ctx1a.transfer_syntaxes = tsf1a_list
 672
 673         req = self.generate_bind(call_id=0, ctx_list=[ctx1a])
 674         self.send_pdu(req)
 675         rep = self.recv_pdu()
 676         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_NAK, req.call_id,
 677                         auth_length=0)
 678         self.assertEqual(rep.u.reject_reason,
 679                           dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
 680         self.assertEqual(rep.u.num_versions, 1)
 681         self.assertEqual(rep.u.versions[0].rpc_vers, req.rpc_vers)
 682         self.assertEqual(rep.u.versions[0].rpc_vers_minor, req.rpc_vers_minor)
 683         self.assertPadding(rep.u._pad, 3)
 684
 685         # wait for a disconnect
 686         rep = self.recv_pdu()
 687         self.assertIsNone(rep)
 688         self.assertNotConnected()
 689
 690     def test_no_auth_presentation_ctx_invalid3(self):
 691         ndr32 = base.transfer_syntax_ndr()
 692
 693         zero_syntax = misc.ndr_syntax_id()
 694
 695         tsf1a_list = [zero_syntax, ndr32, ndr32, ndr32]
 696         ctx1a = dcerpc.ctx_list()
 697         ctx1a.context_id = 1
 698         ctx1a.num_transfer_syntaxes = len(tsf1a_list)
 699         ctx1a.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 700         ctx1a.transfer_syntaxes = tsf1a_list
 701
 702         req = self.generate_bind(call_id=0, ctx_list=[ctx1a])
 703         self.send_pdu(req)
 704         rep = self.recv_pdu()
 705         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
 706                         auth_length=0)
 707         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 708         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 709         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 710         self.assertEqual(rep.u.secondary_address_size, 4)
 711         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
 712         self.assertPadding(rep.u._pad1, 2)
 713         self.assertEqual(rep.u.num_results, 1)
 714         self.assertEqual(rep.u.ctx_list[0].result,
 715                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
 716         self.assertEqual(rep.u.ctx_list[0].reason,
 717                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
 718         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
 719         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 720
 721         tsf1b_list = []
 722         ctx1b = dcerpc.ctx_list()
 723         ctx1b.context_id = 1
 724         ctx1b.num_transfer_syntaxes = len(tsf1b_list)
 725         ctx1b.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 726         ctx1b.transfer_syntaxes = tsf1b_list
 727
 728         # Send a alter
 729         req = self.generate_alter(call_id=1, ctx_list=[ctx1b])
 730         self.send_pdu(req)
 731         rep = self.recv_pdu()
 732         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
 733                         pfc_flags=req.pfc_flags |
 734                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 735                         auth_length=0)
 736         self.assertNotEquals(rep.u.alloc_hint, 0)
 737         self.assertEqual(rep.u.context_id, 0)
 738         self.assertEqual(rep.u.cancel_count, 0)
 739         self.assertEqual(rep.u.flags, 0)
 740         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
 741         self.assertEqual(rep.u.reserved, 0)
 742         self.assertEqual(len(rep.u.error_and_verifier), 0)
 743
 744         # wait for a disconnect
 745         rep = self.recv_pdu()
 746         self.assertIsNone(rep)
 747         self.assertNotConnected()
 748
 749     def test_no_auth_presentation_ctx_invalid4(self):
 750         ndr32 = base.transfer_syntax_ndr()
 751         ndr64 = base.transfer_syntax_ndr64()
 752
 753         zero_syntax = misc.ndr_syntax_id()
 754
 755         tsf1a_list = [zero_syntax, ndr32, ndr32, ndr32]
 756         ctx1a = dcerpc.ctx_list()
 757         ctx1a.context_id = 1
 758         ctx1a.num_transfer_syntaxes = len(tsf1a_list)
 759         ctx1a.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 760         ctx1a.transfer_syntaxes = tsf1a_list
 761
 762         req = self.generate_bind(call_id=0, ctx_list=[ctx1a])
 763         self.send_pdu(req)
 764         rep = self.recv_pdu()
 765         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
 766                         auth_length=0)
 767         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 768         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 769         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 770         self.assertEqual(rep.u.secondary_address_size, 4)
 771         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
 772         self.assertPadding(rep.u._pad1, 2)
 773         self.assertEqual(rep.u.num_results, 1)
 774         self.assertEqual(rep.u.ctx_list[0].result,
 775                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
 776         self.assertEqual(rep.u.ctx_list[0].reason,
 777                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
 778         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
 779         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 780
 781         # With a known but wrong syntax we get a protocol error
 782         # see test_no_auth_presentation_ctx_valid2
 783         tsf1b_list = [zero_syntax, samba.dcerpc.epmapper.abstract_syntax(), ndr64]
 784         ctx1b = dcerpc.ctx_list()
 785         ctx1b.context_id = 1
 786         ctx1b.num_transfer_syntaxes = len(tsf1b_list)
 787         ctx1b.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 788         ctx1b.transfer_syntaxes = tsf1b_list
 789
 790         # Send a alter
 791         req = self.generate_alter(call_id=1, ctx_list=[ctx1b])
 792         self.send_pdu(req)
 793         rep = self.recv_pdu()
 794         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
 795                         pfc_flags=req.pfc_flags |
 796                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 797                         auth_length=0)
 798         self.assertNotEquals(rep.u.alloc_hint, 0)
 799         self.assertEqual(rep.u.context_id, 0)
 800         self.assertEqual(rep.u.cancel_count, 0)
 801         self.assertEqual(rep.u.flags, 0)
 802         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
 803         self.assertEqual(rep.u.reserved, 0)
 804         self.assertEqual(len(rep.u.error_and_verifier), 0)
 805
 806         # wait for a disconnect
 807         rep = self.recv_pdu()
 808         self.assertIsNone(rep)
 809         self.assertNotConnected()
 810
 811     def test_no_auth_presentation_ctx_valid2(self):
 812         ndr32 = base.transfer_syntax_ndr()
 813
 814         zero_syntax = misc.ndr_syntax_id()
 815
 816         tsf1a_list = [zero_syntax, ndr32, ndr32, ndr32]
 817         ctx1a = dcerpc.ctx_list()
 818         ctx1a.context_id = 1
 819         ctx1a.num_transfer_syntaxes = len(tsf1a_list)
 820         ctx1a.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 821         ctx1a.transfer_syntaxes = tsf1a_list
 822
 823         req = self.generate_bind(call_id=0, ctx_list=[ctx1a])
 824         self.send_pdu(req)
 825         rep = self.recv_pdu()
 826         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
 827                         auth_length=0)
 828         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 829         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 830         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 831         self.assertEqual(rep.u.secondary_address_size, 4)
 832         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
 833         self.assertPadding(rep.u._pad1, 2)
 834         self.assertEqual(rep.u.num_results, 1)
 835         self.assertEqual(rep.u.ctx_list[0].result,
 836                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
 837         self.assertEqual(rep.u.ctx_list[0].reason,
 838                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
 839         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
 840         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 841
 842         # With a unknown but wrong syntaxes we get NO protocol error
 843         # see test_no_auth_presentation_ctx_invalid4
 844         tsf1b_list = [zero_syntax, samba.dcerpc.epmapper.abstract_syntax()]
 845         ctx1b = dcerpc.ctx_list()
 846         ctx1b.context_id = 1
 847         ctx1b.num_transfer_syntaxes = len(tsf1b_list)
 848         ctx1b.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 849         ctx1b.transfer_syntaxes = tsf1b_list
 850
 851         # Send a alter
 852         req = self.generate_alter(call_id=1, ctx_list=[ctx1b])
 853         self.send_pdu(req)
 854         rep = self.recv_pdu()
 855         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
 856                         auth_length=0)
 857         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 858         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 859         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 860         self.assertEqual(rep.u.secondary_address_size, 0)
 861         self.assertPadding(rep.u._pad1, 2)
 862         self.assertEqual(rep.u.num_results, 1)
 863         self.assertEqual(rep.u.ctx_list[0].result,
 864                           dcerpc.DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION)
 865         self.assertEqual(rep.u.ctx_list[0].reason,
 866                           dcerpc.DCERPC_BIND_ACK_REASON_TRANSFER_SYNTAXES_NOT_SUPPORTED)
 867         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, zero_syntax)
 868         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 869
 870         req = self.generate_request(call_id=2,
 871                                     context_id=ctx1a.context_id,
 872                                     opnum=0xffff,
 873                                     stub=b"")
 874         self.send_pdu(req)
 875         rep = self.recv_pdu()
 876         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
 877                         pfc_flags=req.pfc_flags |
 878                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 879                         auth_length=0)
 880         self.assertNotEquals(rep.u.alloc_hint, 0)
 881         self.assertEqual(rep.u.context_id, ctx1a.context_id)
 882         self.assertEqual(rep.u.cancel_count, 0)
 883         self.assertEqual(rep.u.flags, 0)
 884         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_OP_RNG_ERROR)
 885         self.assertEqual(rep.u.reserved, 0)
 886         self.assertEqual(len(rep.u.error_and_verifier), 0)
 887
 888     def test_no_auth_presentation_ctx_no_ndr64(self):
 889         ndr32 = base.transfer_syntax_ndr()
 890         zero_syntax = misc.ndr_syntax_id()
 891
 892         tsfZ_list = [zero_syntax]
 893         ctxZ = dcerpc.ctx_list()
 894         ctxZ.context_id = 54321
 895         ctxZ.num_transfer_syntaxes = len(tsfZ_list)
 896         ctxZ.abstract_syntax = zero_syntax
 897         ctxZ.transfer_syntaxes = tsfZ_list
 898
 899         req = self.generate_bind(call_id=0, ctx_list=[ctxZ])
 900         self.send_pdu(req)
 901         rep = self.recv_pdu()
 902         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
 903                         auth_length=0)
 904         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 905         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 906         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 907         self.assertEqual(rep.u.secondary_address_size, 4)
 908         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
 909         self.assertPadding(rep.u._pad1, 2)
 910         self.assertEqual(rep.u.num_results, 1)
 911         self.assertEqual(rep.u.ctx_list[0].result,
 912                           dcerpc.DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION)
 913         self.assertEqual(rep.u.ctx_list[0].reason,
 914                           dcerpc.DCERPC_BIND_ACK_REASON_ABSTRACT_SYNTAX_NOT_SUPPORTED)
 915         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, zero_syntax)
 916         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 917
 918         tsf0_list = [ndr32]
 919         ctx0 = dcerpc.ctx_list()
 920         ctx0.context_id = 0
 921         ctx0.num_transfer_syntaxes = len(tsf0_list)
 922         ctx0.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 923         ctx0.transfer_syntaxes = tsf0_list
 924
 925         req = self.generate_alter(call_id=0, ctx_list=[ctx0])
 926         self.send_pdu(req)
 927         rep = self.recv_pdu()
 928         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
 929                         auth_length=0)
 930         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 931         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 932         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 933         self.assertEqual(rep.u.secondary_address_size, 0)
 934         self.assertPadding(rep.u._pad1, 2)
 935         self.assertEqual(rep.u.num_results, 1)
 936         self.assertEqual(rep.u.ctx_list[0].result,
 937                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
 938         self.assertEqual(rep.u.ctx_list[0].reason,
 939                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
 940         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
 941         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 942
 943         req = self.generate_request(call_id=1,
 944                                     context_id=ctx0.context_id,
 945                                     opnum=0,
 946                                     stub=b"")
 947         self.send_pdu(req)
 948         rep = self.recv_pdu()
 949         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
 950                         auth_length=0)
 951         self.assertNotEquals(rep.u.alloc_hint, 0)
 952         self.assertEqual(rep.u.context_id, req.u.context_id)
 953         self.assertEqual(rep.u.cancel_count, 0)
 954         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
 955
 956         tsf1_list = [zero_syntax, ndr32]
 957         ctx1 = dcerpc.ctx_list()
 958         ctx1.context_id = 1
 959         ctx1.num_transfer_syntaxes = len(tsf1_list)
 960         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 961         ctx1.transfer_syntaxes = tsf1_list
 962
 963         req = self.generate_alter(call_id=1, ctx_list=[ctx1])
 964         self.send_pdu(req)
 965         rep = self.recv_pdu()
 966         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
 967                         auth_length=0)
 968         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
 969         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
 970         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
 971         self.assertEqual(rep.u.secondary_address_size, 0)
 972         self.assertPadding(rep.u._pad1, 2)
 973         self.assertEqual(rep.u.num_results, 1)
 974         self.assertEqual(rep.u.ctx_list[0].result,
 975                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
 976         self.assertEqual(rep.u.ctx_list[0].reason,
 977                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
 978         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
 979         self.assertEqual(rep.u.auth_info, b'\0' * 0)
 980
 981         req = self.generate_request(call_id=1,
 982                                     context_id=ctx1.context_id,
 983                                     opnum=0,
 984                                     stub=b"")
 985         self.send_pdu(req)
 986         rep = self.recv_pdu()
 987         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
 988                         auth_length=0)
 989         self.assertNotEquals(rep.u.alloc_hint, 0)
 990         self.assertEqual(rep.u.context_id, req.u.context_id)
 991         self.assertEqual(rep.u.cancel_count, 0)
 992         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
 993
 994         tsf2_list = [ndr32, ndr32]
 995         ctx2 = dcerpc.ctx_list()
 996         ctx2.context_id = 2
 997         ctx2.num_transfer_syntaxes = len(tsf2_list)
 998         ctx2.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
 999         ctx2.transfer_syntaxes = tsf2_list
1000
1001         req = self.generate_alter(call_id=2, ctx_list=[ctx2])
1002         self.send_pdu(req)
1003         rep = self.recv_pdu()
1004         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
1005                         auth_length=0)
1006         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1007         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1008         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1009         self.assertEqual(rep.u.secondary_address_size, 0)
1010         self.assertPadding(rep.u._pad1, 2)
1011         self.assertEqual(rep.u.num_results, 1)
1012         self.assertEqual(rep.u.ctx_list[0].result,
1013                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
1014         self.assertEqual(rep.u.ctx_list[0].reason,
1015                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
1016         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
1017         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1018
1019         req = self.generate_request(call_id=1,
1020                                     context_id=ctx2.context_id,
1021                                     opnum=0,
1022                                     stub=b"")
1023         self.send_pdu(req)
1024         rep = self.recv_pdu()
1025         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1026                         auth_length=0)
1027         self.assertNotEquals(rep.u.alloc_hint, 0)
1028         self.assertEqual(rep.u.context_id, req.u.context_id)
1029         self.assertEqual(rep.u.cancel_count, 0)
1030         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1031
1032         tsf3_list = [ndr32]
1033         ctx3 = dcerpc.ctx_list()
1034         ctx3.context_id = 3
1035         ctx3.num_transfer_syntaxes = len(tsf3_list)
1036         ctx3.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
1037         ctx3.transfer_syntaxes = tsf3_list
1038
1039         tsf4_list = [ndr32]
1040         ctx4 = dcerpc.ctx_list()
1041         ctx4.context_id = 4
1042         ctx4.num_transfer_syntaxes = len(tsf4_list)
1043         ctx4.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
1044         ctx4.transfer_syntaxes = tsf4_list
1045
1046         req = self.generate_alter(call_id=34, ctx_list=[ctx3, ctx4])
1047         self.send_pdu(req)
1048         rep = self.recv_pdu()
1049         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
1050                         auth_length=0)
1051         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1052         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1053         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1054         self.assertEqual(rep.u.secondary_address_size, 0)
1055         self.assertPadding(rep.u._pad1, 2)
1056         self.assertEqual(rep.u.num_results, 2)
1057         self.assertEqual(rep.u.ctx_list[0].result,
1058                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
1059         self.assertEqual(rep.u.ctx_list[0].reason,
1060                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
1061         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
1062         self.assertEqual(rep.u.ctx_list[1].result,
1063                           dcerpc.DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION)
1064         self.assertEqual(rep.u.ctx_list[1].reason,
1065                           dcerpc.DCERPC_BIND_ACK_REASON_TRANSFER_SYNTAXES_NOT_SUPPORTED)
1066         self.assertNDRSyntaxEquals(rep.u.ctx_list[1].syntax, zero_syntax)
1067         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1068
1069         req = self.generate_request(call_id=1,
1070                                     context_id=ctx3.context_id,
1071                                     opnum=0,
1072                                     stub=b"")
1073         self.send_pdu(req)
1074         rep = self.recv_pdu()
1075         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1076                         auth_length=0)
1077         self.assertNotEquals(rep.u.alloc_hint, 0)
1078         self.assertEqual(rep.u.context_id, req.u.context_id)
1079         self.assertEqual(rep.u.cancel_count, 0)
1080         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1081
1082         req = self.generate_alter(call_id=43, ctx_list=[ctx4, ctx3])
1083         self.send_pdu(req)
1084         rep = self.recv_pdu()
1085         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
1086                         auth_length=0)
1087         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1088         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1089         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1090         self.assertEqual(rep.u.secondary_address_size, 0)
1091         self.assertPadding(rep.u._pad1, 2)
1092         self.assertEqual(rep.u.num_results, 2)
1093         self.assertEqual(rep.u.ctx_list[0].result,
1094                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
1095         self.assertEqual(rep.u.ctx_list[0].reason,
1096                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
1097         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
1098         self.assertEqual(rep.u.ctx_list[1].result,
1099                           dcerpc.DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION)
1100         self.assertEqual(rep.u.ctx_list[1].reason,
1101                           dcerpc.DCERPC_BIND_ACK_REASON_TRANSFER_SYNTAXES_NOT_SUPPORTED)
1102         self.assertNDRSyntaxEquals(rep.u.ctx_list[1].syntax, zero_syntax)
1103         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1104
1105         req = self.generate_request(call_id=1,
1106                                     context_id=ctx4.context_id,
1107                                     opnum=0,
1108                                     stub=b"")
1109         self.send_pdu(req)
1110         rep = self.recv_pdu()
1111         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1112                         auth_length=0)
1113         self.assertNotEquals(rep.u.alloc_hint, 0)
1114         self.assertEqual(rep.u.context_id, req.u.context_id)
1115         self.assertEqual(rep.u.cancel_count, 0)
1116         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1117
1118         req = self.generate_request(call_id=1,
1119                                     context_id=ctx3.context_id,
1120                                     opnum=0,
1121                                     stub=b"")
1122         self.send_pdu(req)
1123         rep = self.recv_pdu()
1124         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1125                         auth_length=0)
1126         self.assertNotEquals(rep.u.alloc_hint, 0)
1127         self.assertEqual(rep.u.context_id, req.u.context_id)
1128         self.assertEqual(rep.u.cancel_count, 0)
1129         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1130
1131         req = self.generate_alter(call_id=44, ctx_list=[ctx4, ctx4])
1132         self.send_pdu(req)
1133         rep = self.recv_pdu()
1134         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
1135                         auth_length=0)
1136         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1137         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1138         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1139         self.assertEqual(rep.u.secondary_address_size, 0)
1140         self.assertPadding(rep.u._pad1, 2)
1141         self.assertEqual(rep.u.num_results, 2)
1142         self.assertEqual(rep.u.ctx_list[0].result,
1143                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
1144         self.assertEqual(rep.u.ctx_list[0].reason,
1145                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
1146         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
1147         self.assertEqual(rep.u.ctx_list[1].result,
1148                           dcerpc.DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION)
1149         self.assertEqual(rep.u.ctx_list[1].reason,
1150                           dcerpc.DCERPC_BIND_ACK_REASON_TRANSFER_SYNTAXES_NOT_SUPPORTED)
1151         self.assertNDRSyntaxEquals(rep.u.ctx_list[1].syntax, zero_syntax)
1152         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1153
1154         req = self.generate_request(call_id=1,
1155                                     context_id=ctx4.context_id,
1156                                     opnum=0,
1157                                     stub=b"")
1158         self.send_pdu(req)
1159         rep = self.recv_pdu()
1160         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1161                         auth_length=0)
1162         self.assertNotEquals(rep.u.alloc_hint, 0)
1163         self.assertEqual(rep.u.context_id, req.u.context_id)
1164         self.assertEqual(rep.u.cancel_count, 0)
1165         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1166
1167         req = self.generate_request(call_id=1,
1168                                     context_id=ctx3.context_id,
1169                                     opnum=0,
1170                                     stub=b"")
1171         self.send_pdu(req)
1172         rep = self.recv_pdu()
1173         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1174                         auth_length=0)
1175         self.assertNotEquals(rep.u.alloc_hint, 0)
1176         self.assertEqual(rep.u.context_id, req.u.context_id)
1177         self.assertEqual(rep.u.cancel_count, 0)
1178         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1179
1180         tsf5mgmt_list = [ndr32]
1181         ctx5mgmt = dcerpc.ctx_list()
1182         ctx5mgmt.context_id = 5
1183         ctx5mgmt.num_transfer_syntaxes = len(tsf5mgmt_list)
1184         ctx5mgmt.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
1185         ctx5mgmt.transfer_syntaxes = tsf5mgmt_list
1186
1187         tsf5epm_list = [ndr32]
1188         ctx5epm = dcerpc.ctx_list()
1189         ctx5epm.context_id = 5
1190         ctx5epm.num_transfer_syntaxes = len(tsf5epm_list)
1191         ctx5epm.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
1192         ctx5epm.transfer_syntaxes = tsf5epm_list
1193
1194         req = self.generate_alter(call_id=55, ctx_list=[ctx5mgmt, ctx5epm])
1195         self.send_pdu(req)
1196         rep = self.recv_pdu()
1197         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
1198                         auth_length=0)
1199         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1200         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1201         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1202         self.assertEqual(rep.u.secondary_address_size, 0)
1203         self.assertPadding(rep.u._pad1, 2)
1204         self.assertEqual(rep.u.num_results, 2)
1205         self.assertEqual(rep.u.ctx_list[0].result,
1206                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
1207         self.assertEqual(rep.u.ctx_list[0].reason,
1208                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
1209         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
1210         self.assertEqual(rep.u.ctx_list[1].result,
1211                           dcerpc.DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION)
1212         self.assertEqual(rep.u.ctx_list[1].reason,
1213                           dcerpc.DCERPC_BIND_ACK_REASON_TRANSFER_SYNTAXES_NOT_SUPPORTED)
1214         self.assertNDRSyntaxEquals(rep.u.ctx_list[1].syntax, zero_syntax)
1215         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1216
1217         req = self.generate_request(call_id=1,
1218                                     context_id=ctx5mgmt.context_id,
1219                                     opnum=0,
1220                                     stub=b"")
1221         self.send_pdu(req)
1222         rep = self.recv_pdu()
1223         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1224                         auth_length=0)
1225         self.assertNotEquals(rep.u.alloc_hint, 0)
1226         self.assertEqual(rep.u.context_id, req.u.context_id)
1227         self.assertEqual(rep.u.cancel_count, 0)
1228         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1229
1230         req = self.generate_alter(call_id=55, ctx_list=[ctx5mgmt, ctx5epm])
1231         self.send_pdu(req)
1232         rep = self.recv_pdu()
1233         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
1234                         auth_length=0)
1235         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1236         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1237         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1238         self.assertEqual(rep.u.secondary_address_size, 0)
1239         self.assertPadding(rep.u._pad1, 2)
1240         self.assertEqual(rep.u.num_results, 2)
1241         self.assertEqual(rep.u.ctx_list[0].result,
1242                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
1243         self.assertEqual(rep.u.ctx_list[0].reason,
1244                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
1245         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
1246         self.assertEqual(rep.u.ctx_list[1].result,
1247                           dcerpc.DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION)
1248         self.assertEqual(rep.u.ctx_list[1].reason,
1249                           dcerpc.DCERPC_BIND_ACK_REASON_TRANSFER_SYNTAXES_NOT_SUPPORTED)
1250         self.assertNDRSyntaxEquals(rep.u.ctx_list[1].syntax, zero_syntax)
1251         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1252
1253         req = self.generate_request(call_id=1,
1254                                     context_id=ctx5mgmt.context_id,
1255                                     opnum=0,
1256                                     stub=b"")
1257         self.send_pdu(req)
1258         rep = self.recv_pdu()
1259         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1260                         auth_length=0)
1261         self.assertNotEquals(rep.u.alloc_hint, 0)
1262         self.assertEqual(rep.u.context_id, req.u.context_id)
1263         self.assertEqual(rep.u.cancel_count, 0)
1264         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1265
1266     def test_no_auth_bind_time_none_simple(self):
1267         features = 0
1268         btf = base.bind_time_features_syntax(features)
1269
1270         zero_syntax = misc.ndr_syntax_id()
1271
1272         tsf1_list = [btf]
1273         ctx1 = dcerpc.ctx_list()
1274         ctx1.context_id = 1
1275         ctx1.num_transfer_syntaxes = len(tsf1_list)
1276         ctx1.abstract_syntax = zero_syntax
1277         ctx1.transfer_syntaxes = tsf1_list
1278
1279         req = self.generate_bind(call_id=0, ctx_list=[ctx1])
1280         self.send_pdu(req)
1281         rep = self.recv_pdu()
1282         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
1283                         auth_length=0)
1284         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1285         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1286         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1287         self.assertEqual(rep.u.secondary_address_size, 4)
1288         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
1289         self.assertPadding(rep.u._pad1, 2)
1290         self.assertEqual(rep.u.num_results, 1)
1291         self.assertEqual(rep.u.ctx_list[0].result,
1292                           dcerpc.DCERPC_BIND_ACK_RESULT_NEGOTIATE_ACK)
1293         self.assertEqual(rep.u.ctx_list[0].reason, features)
1294         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, zero_syntax)
1295         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1296
1297     def test_no_auth_bind_time_none_ignore_additional(self):
1298         features1 = 0
1299         btf1 = base.bind_time_features_syntax(features1)
1300
1301         features2 = dcerpc.DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN
1302         features2 |= dcerpc.DCERPC_BIND_TIME_SECURITY_CONTEXT_MULTIPLEXING
1303         btf2 = base.bind_time_features_syntax(features2)
1304
1305         zero_syntax = misc.ndr_syntax_id()
1306         ndr64 = base.transfer_syntax_ndr64()
1307
1308         tsf1_list = [btf1, btf2, zero_syntax]
1309         ctx1 = dcerpc.ctx_list()
1310         ctx1.context_id = 1
1311         ctx1.num_transfer_syntaxes = len(tsf1_list)
1312         ctx1.abstract_syntax = ndr64
1313         ctx1.transfer_syntaxes = tsf1_list
1314
1315         req = self.generate_bind(call_id=0, ctx_list=[ctx1])
1316         self.send_pdu(req)
1317         rep = self.recv_pdu()
1318         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
1319                         auth_length=0)
1320         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1321         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1322         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1323         self.assertEqual(rep.u.secondary_address_size, 4)
1324         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
1325         self.assertPadding(rep.u._pad1, 2)
1326         self.assertEqual(rep.u.num_results, 1)
1327         self.assertEqual(rep.u.ctx_list[0].result,
1328                           dcerpc.DCERPC_BIND_ACK_RESULT_NEGOTIATE_ACK)
1329         self.assertEqual(rep.u.ctx_list[0].reason, features1)
1330         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, zero_syntax)
1331         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1332
1333     def test_no_auth_bind_time_only_first(self):
1334         features1 = dcerpc.DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN
1335         btf1 = base.bind_time_features_syntax(features1)
1336
1337         features2 = dcerpc.DCERPC_BIND_TIME_SECURITY_CONTEXT_MULTIPLEXING
1338         btf2 = base.bind_time_features_syntax(features2)
1339
1340         zero_syntax = misc.ndr_syntax_id()
1341
1342         tsf1_list = [zero_syntax, btf1, btf2, zero_syntax]
1343         ctx1 = dcerpc.ctx_list()
1344         ctx1.context_id = 1
1345         ctx1.num_transfer_syntaxes = len(tsf1_list)
1346         ctx1.abstract_syntax = zero_syntax
1347         ctx1.transfer_syntaxes = tsf1_list
1348
1349         req = self.generate_bind(call_id=0, ctx_list=[ctx1])
1350         self.send_pdu(req)
1351         rep = self.recv_pdu()
1352         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
1353                         auth_length=0)
1354         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1355         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1356         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1357         self.assertEqual(rep.u.secondary_address_size, 4)
1358         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
1359         self.assertPadding(rep.u._pad1, 2)
1360         self.assertEqual(rep.u.num_results, 1)
1361         self.assertEqual(rep.u.ctx_list[0].result,
1362                           dcerpc.DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION)
1363         self.assertEqual(rep.u.ctx_list[0].reason,
1364                           dcerpc.DCERPC_BIND_ACK_REASON_ABSTRACT_SYNTAX_NOT_SUPPORTED)
1365         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, zero_syntax)
1366         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1367
1368     def test_no_auth_bind_time_twice(self):
1369         features1 = dcerpc.DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN
1370         btf1 = base.bind_time_features_syntax(features1)
1371
1372         features2 = dcerpc.DCERPC_BIND_TIME_SECURITY_CONTEXT_MULTIPLEXING
1373         btf2 = base.bind_time_features_syntax(features2)
1374
1375         zero_syntax = misc.ndr_syntax_id()
1376
1377         tsf1_list = [btf1]
1378         ctx1 = dcerpc.ctx_list()
1379         ctx1.context_id = 1
1380         ctx1.num_transfer_syntaxes = len(tsf1_list)
1381         ctx1.abstract_syntax = zero_syntax
1382         ctx1.transfer_syntaxes = tsf1_list
1383
1384         tsf2_list = [btf2]
1385         ctx2 = dcerpc.ctx_list()
1386         ctx2.context_id = 2
1387         ctx2.num_transfer_syntaxes = len(tsf2_list)
1388         ctx2.abstract_syntax = zero_syntax
1389         ctx2.transfer_syntaxes = tsf2_list
1390
1391         req = self.generate_bind(call_id=0, ctx_list=[ctx1, ctx2])
1392         self.send_pdu(req)
1393         rep = self.recv_pdu()
1394         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_NAK, req.call_id,
1395                         auth_length=0)
1396         self.assertEqual(rep.u.reject_reason,
1397                           dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
1398         self.assertEqual(rep.u.num_versions, 1)
1399         self.assertEqual(rep.u.versions[0].rpc_vers, req.rpc_vers)
1400         self.assertEqual(rep.u.versions[0].rpc_vers_minor, req.rpc_vers_minor)
1401         self.assertPadding(rep.u._pad, 3)
1402
1403         # wait for a disconnect
1404         rep = self.recv_pdu()
1405         self.assertIsNone(rep)
1406         self.assertNotConnected()
1407
1408     def test_no_auth_bind_time_keep_on_orphan_simple(self):
1409         features = dcerpc.DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN
1410         btf = base.bind_time_features_syntax(features)
1411
1412         zero_syntax = misc.ndr_syntax_id()
1413
1414         tsf1_list = [btf]
1415         ctx1 = dcerpc.ctx_list()
1416         ctx1.context_id = 1
1417         ctx1.num_transfer_syntaxes = len(tsf1_list)
1418         ctx1.abstract_syntax = zero_syntax
1419         ctx1.transfer_syntaxes = tsf1_list
1420
1421         req = self.generate_bind(call_id=0, ctx_list=[ctx1])
1422         self.send_pdu(req)
1423         rep = self.recv_pdu()
1424         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
1425                         auth_length=0)
1426         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1427         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1428         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1429         self.assertEqual(rep.u.secondary_address_size, 4)
1430         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
1431         self.assertPadding(rep.u._pad1, 2)
1432         self.assertEqual(rep.u.num_results, 1)
1433         self.assertEqual(rep.u.ctx_list[0].result,
1434                           dcerpc.DCERPC_BIND_ACK_RESULT_NEGOTIATE_ACK)
1435         self.assertEqual(rep.u.ctx_list[0].reason, features)
1436         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, zero_syntax)
1437         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1438
1439     def test_no_auth_bind_time_keep_on_orphan_ignore_additional(self):
1440         features1 = dcerpc.DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN
1441         btf1 = base.bind_time_features_syntax(features1)
1442
1443         features2 = dcerpc.DCERPC_BIND_TIME_SECURITY_CONTEXT_MULTIPLEXING
1444         btf2 = base.bind_time_features_syntax(features2)
1445
1446         zero_syntax = misc.ndr_syntax_id()
1447         ndr64 = base.transfer_syntax_ndr64()
1448
1449         tsf1_list = [btf1, btf2, zero_syntax]
1450         ctx1 = dcerpc.ctx_list()
1451         ctx1.context_id = 1
1452         ctx1.num_transfer_syntaxes = len(tsf1_list)
1453         ctx1.abstract_syntax = ndr64
1454         ctx1.transfer_syntaxes = tsf1_list
1455
1456         req = self.generate_bind(call_id=0, ctx_list=[ctx1])
1457         self.send_pdu(req)
1458         rep = self.recv_pdu()
1459         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
1460                         auth_length=0)
1461         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1462         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1463         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1464         self.assertEqual(rep.u.secondary_address_size, 4)
1465         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
1466         self.assertPadding(rep.u._pad1, 2)
1467         self.assertEqual(rep.u.num_results, 1)
1468         self.assertEqual(rep.u.ctx_list[0].result,
1469                           dcerpc.DCERPC_BIND_ACK_RESULT_NEGOTIATE_ACK)
1470         self.assertEqual(rep.u.ctx_list[0].reason, features1)
1471         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, zero_syntax)
1472         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1473
1474     def test_no_auth_bind_time_sec_ctx_ignore_additional(self):
1475         features1 = dcerpc.DCERPC_BIND_TIME_SECURITY_CONTEXT_MULTIPLEXING
1476         btf1 = base.bind_time_features_syntax(features1)
1477
1478         features2 = dcerpc.DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN
1479         btf2 = base.bind_time_features_syntax(features2)
1480
1481         zero_syntax = misc.ndr_syntax_id()
1482         ndr64 = base.transfer_syntax_ndr64()
1483
1484         tsf1_list = [btf1, btf2, zero_syntax]
1485         ctx1 = dcerpc.ctx_list()
1486         ctx1.context_id = 1
1487         ctx1.num_transfer_syntaxes = len(tsf1_list)
1488         ctx1.abstract_syntax = ndr64
1489         ctx1.transfer_syntaxes = tsf1_list
1490
1491         req = self.generate_bind(call_id=0, ctx_list=[ctx1])
1492         self.send_pdu(req)
1493         rep = self.recv_pdu()
1494         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
1495                         auth_length=0)
1496         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1497         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1498         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1499         self.assertEqual(rep.u.secondary_address_size, 4)
1500         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
1501         self.assertPadding(rep.u._pad1, 2)
1502         self.assertEqual(rep.u.num_results, 1)
1503         self.assertEqual(rep.u.ctx_list[0].result,
1504                           dcerpc.DCERPC_BIND_ACK_RESULT_NEGOTIATE_ACK)
1505         self.assertEqual(rep.u.ctx_list[0].reason, features1)
1506         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, zero_syntax)
1507         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1508
1509     def _test_auth_type_level_bind_nak(self, auth_type, auth_level, creds=None,
1510                                        reason=dcerpc.DCERPC_BIND_NAK_REASON_INVALID_AUTH_TYPE):
1511         ndr32 = base.transfer_syntax_ndr()
1512
1513         tsf1_list = [ndr32]
1514         ctx1 = dcerpc.ctx_list()
1515         ctx1.context_id = 1
1516         ctx1.num_transfer_syntaxes = len(tsf1_list)
1517         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
1518         ctx1.transfer_syntaxes = tsf1_list
1519         ctx_list = [ctx1]
1520
1521         auth_context_id = 0
1522
1523         if creds is not None:
1524             # We always start with DCERPC_AUTH_LEVEL_INTEGRITY
1525             auth_context = self.get_auth_context_creds(creds,
1526                                                        auth_type=auth_type,
1527                                                        auth_level=auth_level,
1528                                                        auth_context_id=auth_context_id,
1529                                                        g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY)
1530             from_server = b""
1531             (finished, to_server) = auth_context["gensec"].update(from_server)
1532             self.assertFalse(finished)
1533
1534             auth_info = self.generate_auth(auth_type=auth_context["auth_type"],
1535                                            auth_level=auth_context["auth_level"],
1536                                            auth_context_id=auth_context["auth_context_id"],
1537                                            auth_blob=to_server)
1538         else:
1539             to_server = b"none"
1540             auth_info = self.generate_auth(auth_type=auth_type,
1541                                            auth_level=auth_level,
1542                                            auth_context_id=auth_context_id,
1543                                            auth_blob=to_server)
1544
1545         req = self.generate_bind(call_id=0,
1546                                  ctx_list=ctx_list,
1547                                  auth_info=auth_info)
1548         self.send_pdu(req)
1549         rep = self.recv_pdu()
1550         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_NAK, req.call_id,
1551                         auth_length=0)
1552         self.assertEqual(rep.u.reject_reason, reason)
1553         self.assertEqual(rep.u.num_versions, 1)
1554         self.assertEqual(rep.u.versions[0].rpc_vers, req.rpc_vers)
1555         self.assertEqual(rep.u.versions[0].rpc_vers_minor, req.rpc_vers_minor)
1556         self.assertPadding(rep.u._pad, 3)
1557
1558         # wait for a disconnect
1559         rep = self.recv_pdu()
1560         self.assertIsNone(rep)
1561         self.assertNotConnected()
1562
1563     def _test_auth_none_level_bind(self, auth_level,
1564                                    reason=dcerpc.DCERPC_BIND_NAK_REASON_INVALID_AUTH_TYPE):
1565         return self._test_auth_type_level_bind_nak(auth_type=dcerpc.DCERPC_AUTH_LEVEL_NONE,
1566                                                    auth_level=auth_level, reason=reason)
1567
1568     def test_auth_none_none_bind(self):
1569         return self._test_auth_none_level_bind(dcerpc.DCERPC_AUTH_LEVEL_NONE,
1570                                                reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
1571
1572     def test_auth_none_connect_bind(self):
1573         return self._test_auth_none_level_bind(dcerpc.DCERPC_AUTH_LEVEL_CONNECT)
1574
1575     def test_auth_none_call_bind(self):
1576         return self._test_auth_none_level_bind(dcerpc.DCERPC_AUTH_LEVEL_CALL)
1577
1578     def test_auth_none_packet_bind(self):
1579         return self._test_auth_none_level_bind(dcerpc.DCERPC_AUTH_LEVEL_PACKET)
1580
1581     def test_auth_none_integrity_bind(self):
1582         return self._test_auth_none_level_bind(dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY)
1583
1584     def test_auth_none_privacy_bind(self):
1585         return self._test_auth_none_level_bind(dcerpc.DCERPC_AUTH_LEVEL_PRIVACY)
1586
1587     def test_auth_none_0_bind(self):
1588         return self._test_auth_none_level_bind(0,
1589                                                reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
1590
1591     def test_auth_none_7_bind(self):
1592         return self._test_auth_none_level_bind(7,
1593                                                reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
1594
1595     def test_auth_none_255_bind(self):
1596         return self._test_auth_none_level_bind(255,
1597                                                reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
1598
1599     def _test_auth_none_level_request(self, auth_level):
1600         ndr32 = base.transfer_syntax_ndr()
1601
1602         tsf1_list = [ndr32]
1603         ctx1 = dcerpc.ctx_list()
1604         ctx1.context_id = 1
1605         ctx1.num_transfer_syntaxes = len(tsf1_list)
1606         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
1607         ctx1.transfer_syntaxes = tsf1_list
1608         ctx_list = [ctx1]
1609
1610         auth_type = dcerpc.DCERPC_AUTH_TYPE_NONE
1611         auth_context_id = 0
1612
1613         req = self.generate_bind(call_id=0,
1614                                  ctx_list=ctx_list)
1615
1616         self.send_pdu(req)
1617         rep = self.recv_pdu()
1618         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
1619         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1620         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1621         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1622         self.assertEqual(rep.u.secondary_address_size, 4)
1623         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
1624         self.assertPadding(rep.u._pad1, 2)
1625         self.assertEqual(rep.u.num_results, 1)
1626         self.assertEqual(rep.u.ctx_list[0].result,
1627                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
1628         self.assertEqual(rep.u.ctx_list[0].reason,
1629                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
1630         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
1631         self.assertEqual(len(rep.u.auth_info), 0)
1632
1633         # And now try a request without auth_info
1634         req = self.generate_request(call_id=2,
1635                                     context_id=ctx1.context_id,
1636                                     opnum=0,
1637                                     stub=b"")
1638         self.send_pdu(req)
1639         rep = self.recv_pdu()
1640         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1641                         auth_length=0)
1642         self.assertNotEquals(rep.u.alloc_hint, 0)
1643         self.assertEqual(rep.u.context_id, req.u.context_id)
1644         self.assertEqual(rep.u.cancel_count, 0)
1645         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1646
1647         auth_info = self.generate_auth(auth_type=auth_type,
1648                                        auth_level=auth_level,
1649                                        auth_context_id=auth_context_id,
1650                                        auth_blob=b"none")
1651
1652         req = self.generate_request(call_id=3,
1653                                     context_id=ctx1.context_id,
1654                                     opnum=0,
1655                                     stub=b"",
1656                                     auth_info=auth_info)
1657         self.send_pdu(req)
1658         rep = self.recv_pdu()
1659         # We get a fault back
1660         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
1661                         auth_length=0)
1662         self.assertNotEquals(rep.u.alloc_hint, 0)
1663         self.assertEqual(rep.u.context_id, req.u.context_id)
1664         self.assertEqual(rep.u.cancel_count, 0)
1665         self.assertEqual(rep.u.flags, 0)
1666         self.assertEqual(rep.u.status, dcerpc.DCERPC_FAULT_ACCESS_DENIED)
1667         self.assertEqual(rep.u.reserved, 0)
1668         self.assertEqual(len(rep.u.error_and_verifier), 0)
1669
1670         # wait for a disconnect
1671         rep = self.recv_pdu()
1672         self.assertIsNone(rep)
1673         self.assertNotConnected()
1674
1675     def test_auth_none_none_request(self):
1676         return self._test_auth_none_level_request(dcerpc.DCERPC_AUTH_LEVEL_NONE)
1677
1678     def test_auth_none_connect_request(self):
1679         return self._test_auth_none_level_request(dcerpc.DCERPC_AUTH_LEVEL_CONNECT)
1680
1681     def test_auth_none_call_request(self):
1682         return self._test_auth_none_level_request(dcerpc.DCERPC_AUTH_LEVEL_CALL)
1683
1684     def test_auth_none_packet_request(self):
1685         return self._test_auth_none_level_request(dcerpc.DCERPC_AUTH_LEVEL_PACKET)
1686
1687     def _test_neg_xmit_check_values(self,
1688                                     req_xmit=None,
1689                                     req_recv=None,
1690                                     rep_both=None,
1691                                     alter_xmit=None,
1692                                     alter_recv=None):
1693         ndr32 = base.transfer_syntax_ndr()
1694
1695         tsf1_list = [ndr32]
1696         ctx1 = dcerpc.ctx_list()
1697         ctx1.context_id = 1
1698         ctx1.num_transfer_syntaxes = len(tsf1_list)
1699         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
1700         ctx1.transfer_syntaxes = tsf1_list
1701
1702         req = self.generate_bind(call_id=0,
1703                                  max_xmit_frag=req_xmit,
1704                                  max_recv_frag=req_recv,
1705                                  ctx_list=[ctx1])
1706         self.send_pdu(req)
1707         rep = self.recv_pdu()
1708         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
1709                         auth_length=0)
1710         self.assertEqual(rep.u.max_xmit_frag, rep_both)
1711         self.assertEqual(rep.u.max_recv_frag, rep_both)
1712         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1713         self.assertEqual(rep.u.secondary_address_size, 4)
1714         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
1715         self.assertPadding(rep.u._pad1, 2)
1716         self.assertEqual(rep.u.num_results, 1)
1717         self.assertEqual(rep.u.ctx_list[0].result,
1718                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
1719         self.assertEqual(rep.u.ctx_list[0].reason,
1720                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
1721         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
1722         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1723
1724         assoc_group_id = rep.u.assoc_group_id
1725         if alter_xmit is None:
1726             alter_xmit = rep_both - 8
1727         if alter_recv is None:
1728             alter_recv = rep_both - 8
1729
1730         # max_{xmit,recv}_frag and assoc_group_id are completely
1731         # ignored in alter_context requests
1732         req = self.generate_alter(call_id=1,
1733                                   max_xmit_frag=alter_xmit,
1734                                   max_recv_frag=alter_recv,
1735                                   assoc_group_id=0xffffffff - rep.u.assoc_group_id,
1736                                   ctx_list=[ctx1])
1737         self.send_pdu(req)
1738         rep = self.recv_pdu()
1739         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id,
1740                         auth_length=0)
1741         self.assertEqual(rep.u.max_xmit_frag, rep_both)
1742         self.assertEqual(rep.u.max_recv_frag, rep_both)
1743         self.assertEqual(rep.u.assoc_group_id, rep.u.assoc_group_id)
1744         self.assertEqual(rep.u.secondary_address_size, 0)
1745         self.assertPadding(rep.u._pad1, 2)
1746         self.assertEqual(rep.u.num_results, 1)
1747         self.assertEqual(rep.u.ctx_list[0].result,
1748                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
1749         self.assertEqual(rep.u.ctx_list[0].reason,
1750                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
1751         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
1752         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1753
1754         chunk_size = rep_both - dcerpc.DCERPC_REQUEST_LENGTH
1755         req = self.generate_request(call_id=2,
1756                                     context_id=ctx1.context_id,
1757                                     opnum=0,
1758                                     alloc_hint=0xffffffff,
1759                                     stub=b"\00" * chunk_size)
1760         self.send_pdu(req, ndr_print=True, hexdump=True)
1761         rep = self.recv_pdu(ndr_print=True, hexdump=True)
1762         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1763                         auth_length=0)
1764         self.assertNotEquals(rep.u.alloc_hint, 0)
1765         self.assertEqual(rep.u.context_id, req.u.context_id)
1766         self.assertEqual(rep.u.cancel_count, 0)
1767         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1768
1769         chunk_size = 5840 - dcerpc.DCERPC_REQUEST_LENGTH
1770         req = self.generate_request(call_id=2,
1771                                     context_id=ctx1.context_id,
1772                                     opnum=0,
1773                                     alloc_hint=0xffffffff,
1774                                     stub=b"\00" * chunk_size)
1775         self.send_pdu(req)
1776         rep = self.recv_pdu()
1777         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1778                         auth_length=0)
1779         self.assertNotEquals(rep.u.alloc_hint, 0)
1780         self.assertEqual(rep.u.context_id, req.u.context_id)
1781         self.assertEqual(rep.u.cancel_count, 0)
1782         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1783
1784         chunk_size += 1
1785         req = self.generate_request(call_id=3,
1786                                     context_id=ctx1.context_id,
1787                                     opnum=0,
1788                                     alloc_hint=0xffffffff,
1789                                     stub=b"\00" * chunk_size)
1790         self.send_pdu(req)
1791         rep = self.recv_pdu()
1792         # We get a fault
1793         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
1794                         auth_length=0)
1795         self.assertNotEquals(rep.u.alloc_hint, 0)
1796         self.assertEqual(rep.u.context_id, 0)
1797         self.assertEqual(rep.u.cancel_count, 0)
1798         self.assertEqual(rep.u.flags, 0)
1799         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
1800         self.assertEqual(rep.u.reserved, 0)
1801         self.assertEqual(len(rep.u.error_and_verifier), 0)
1802
1803         # wait for a disconnect
1804         rep = self.recv_pdu()
1805         self.assertIsNone(rep)
1806         self.assertNotConnected()
1807
1808     def test_neg_xmit_ffff_ffff(self):
1809         return self._test_neg_xmit_check_values(req_xmit=0xffff,
1810                                                 req_recv=0xffff,
1811                                                 rep_both=5840)
1812
1813     def test_neg_xmit_0_ffff(self):
1814         return self._test_neg_xmit_check_values(req_xmit=0,
1815                                                 req_recv=0xffff,
1816                                                 rep_both=2048,
1817                                                 alter_xmit=0xffff,
1818                                                 alter_recv=0xffff)
1819
1820     def test_neg_xmit_ffff_0(self):
1821         return self._test_neg_xmit_check_values(req_xmit=0xffff,
1822                                                 req_recv=0,
1823                                                 rep_both=2048)
1824
1825     def test_neg_xmit_0_0(self):
1826         return self._test_neg_xmit_check_values(req_xmit=0,
1827                                                 req_recv=0,
1828                                                 rep_both=2048,
1829                                                 alter_xmit=0xffff,
1830                                                 alter_recv=0xffff)
1831
1832     def test_neg_xmit_3199_0(self):
1833         return self._test_neg_xmit_check_values(req_xmit=3199,
1834                                                 req_recv=0,
1835                                                 rep_both=2048)
1836
1837     def test_neg_xmit_0_3199(self):
1838         return self._test_neg_xmit_check_values(req_xmit=0,
1839                                                 req_recv=3199,
1840                                                 rep_both=2048)
1841
1842     def test_neg_xmit_3199_ffff(self):
1843         return self._test_neg_xmit_check_values(req_xmit=3199,
1844                                                 req_recv=0xffff,
1845                                                 rep_both=3192)
1846
1847     def test_neg_xmit_ffff_3199(self):
1848         return self._test_neg_xmit_check_values(req_xmit=0xffff,
1849                                                 req_recv=3199,
1850                                                 rep_both=3192)
1851
1852     def test_alloc_hint(self):
1853         ndr32 = base.transfer_syntax_ndr()
1854
1855         tsf1_list = [ndr32]
1856         ctx = dcerpc.ctx_list()
1857         ctx.context_id = 0
1858         ctx.num_transfer_syntaxes = len(tsf1_list)
1859         ctx.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
1860         ctx.transfer_syntaxes = tsf1_list
1861
1862         req = self.generate_bind(call_id=0,
1863                                  ctx_list=[ctx])
1864         self.send_pdu(req)
1865         rep = self.recv_pdu()
1866         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id,
1867                         auth_length=0)
1868         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
1869         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
1870         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
1871         self.assertEqual(rep.u.secondary_address_size, 4)
1872         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
1873         self.assertPadding(rep.u._pad1, 2)
1874         self.assertEqual(rep.u.num_results, 1)
1875         self.assertEqual(rep.u.ctx_list[0].result,
1876                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
1877         self.assertEqual(rep.u.ctx_list[0].reason,
1878                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
1879         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
1880         self.assertEqual(rep.u.auth_info, b'\0' * 0)
1881
1882         # And now try a request without auth_info
1883         req = self.generate_request(call_id=2,
1884                                     context_id=ctx.context_id,
1885                                     opnum=0,
1886                                     alloc_hint=0xffffffff,
1887                                     stub=b"")
1888         self.send_pdu(req)
1889         rep = self.recv_pdu()
1890         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1891                         auth_length=0)
1892         self.assertNotEquals(rep.u.alloc_hint, 0)
1893         self.assertEqual(rep.u.context_id, req.u.context_id)
1894         self.assertEqual(rep.u.cancel_count, 0)
1895         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1896
1897         req = self.generate_request(call_id=3,
1898                                     context_id=ctx.context_id,
1899                                     opnum=1,
1900                                     alloc_hint=0xffffffff,
1901                                     stub=b"\04\00\00\00\00\00\00\00")
1902         self.send_pdu(req)
1903         rep = self.recv_pdu()
1904         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1905                         auth_length=0)
1906         self.assertNotEquals(rep.u.alloc_hint, 0)
1907         self.assertEqual(rep.u.context_id, req.u.context_id)
1908         self.assertEqual(rep.u.cancel_count, 0)
1909         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1910
1911         req = self.generate_request(call_id=4,
1912                                     context_id=ctx.context_id,
1913                                     opnum=1,
1914                                     alloc_hint=1,
1915                                     stub=b"\04\00\00\00\00\00\00\00")
1916         self.send_pdu(req)
1917         rep = self.recv_pdu()
1918         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
1919                         auth_length=0)
1920         self.assertNotEquals(rep.u.alloc_hint, 0)
1921         self.assertEqual(rep.u.context_id, req.u.context_id)
1922         self.assertEqual(rep.u.cancel_count, 0)
1923         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
1924
1925     def _get_netlogon_ctx(self):
1926         abstract = samba.dcerpc.netlogon.abstract_syntax()
1927         ndr32 = base.transfer_syntax_ndr()
1928
1929         (ctx, ack) = self.prepare_presentation(abstract, ndr32, context_id=0,
1930                                                epmap=True, return_ack=True)
1931
1932         server = '\\\\' + self.target_hostname
1933         if isinstance(server, binary_type):
1934             server_utf16 = server.decode('utf-8').encode('utf-16-le')
1935         else:
1936             server_utf16 = server.encode('utf-16-le')
1937         computer = 'UNKNOWNCOMPUTER'
1938         if isinstance(server, binary_type):
1939             computer_utf16 = computer.decode('utf-8').encode('utf-16-le')
1940         else:
1941             computer_utf16 = computer.encode('utf-16-le')
1942
1943         real_stub = struct.pack('<IIII', 0x00200000,
1944                                 len(server) + 1, 0, len(server) + 1)
1945         real_stub += server_utf16 + b'\x00\x00'
1946         mod_len = len(real_stub) % 4
1947         if mod_len != 0:
1948             real_stub += b'\x00' * (4 - mod_len)
1949         real_stub += struct.pack('<III',
1950                                  len(computer) + 1, 0, len(computer) + 1)
1951         real_stub += computer_utf16 + b'\x00\x00'
1952         real_stub += b'\x11\x22\x33\x44\x55\x66\x77\x88'
1953
1954         return (ctx, ack, real_stub)
1955
1956     def _test_fragmented_requests(self, remaining=None, alloc_hint=None,
1957                                   fault_first=None, fault_last=None):
1958         (ctx, rep, real_stub) = self._get_netlogon_ctx()
1959
1960         chunk = rep.u.max_recv_frag - dcerpc.DCERPC_REQUEST_LENGTH
1961
1962         total = 0
1963         first = True
1964         while remaining > 0:
1965             thistime = min(remaining, chunk)
1966             remaining -= thistime
1967             total += thistime
1968
1969             pfc_flags = 0
1970             if first:
1971                 pfc_flags |= dcerpc.DCERPC_PFC_FLAG_FIRST
1972                 first = False
1973                 stub = real_stub + b'\x00' * (thistime - len(real_stub))
1974             else:
1975                 stub = b"\x00" * thistime
1976
1977             if remaining == 0:
1978                 pfc_flags |= dcerpc.DCERPC_PFC_FLAG_LAST
1979
1980             # And now try a request without auth_info
1981             # netr_ServerReqChallenge()
1982             req = self.generate_request(call_id=0x21234,
1983                                         pfc_flags=pfc_flags,
1984                                         context_id=ctx.context_id,
1985                                         opnum=4,
1986                                         alloc_hint=alloc_hint,
1987                                         stub=stub)
1988             if alloc_hint >= thistime:
1989                 alloc_hint -= thistime
1990             else:
1991                 alloc_hint = 0
1992             self.send_pdu(req, hexdump=False)
1993             if fault_first is not None:
1994                 rep = self.recv_pdu()
1995                 # We get a fault back
1996                 self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
1997                                 auth_length=0)
1998                 self.assertNotEquals(rep.u.alloc_hint, 0)
1999                 self.assertEqual(rep.u.context_id, req.u.context_id)
2000                 self.assertEqual(rep.u.cancel_count, 0)
2001                 self.assertEqual(rep.u.flags, 0)
2002                 self.assertEqual(rep.u.status, fault_first)
2003                 self.assertEqual(rep.u.reserved, 0)
2004                 self.assertEqual(len(rep.u.error_and_verifier), 0)
2005
2006                 # wait for a disconnect
2007                 rep = self.recv_pdu()
2008                 self.assertIsNone(rep)
2009                 self.assertNotConnected()
2010                 return
2011             if remaining == 0:
2012                 break
2013             if total >= 0x400000 and fault_last is not None:
2014                 rep = self.recv_pdu()
2015                 # We get a fault back
2016                 self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
2017                                 auth_length=0)
2018                 self.assertNotEquals(rep.u.alloc_hint, 0)
2019                 self.assertEqual(rep.u.context_id, req.u.context_id)
2020                 self.assertEqual(rep.u.cancel_count, 0)
2021                 self.assertEqual(rep.u.flags, 0)
2022                 self.assertEqual(rep.u.status, fault_last)
2023                 self.assertEqual(rep.u.reserved, 0)
2024                 self.assertEqual(len(rep.u.error_and_verifier), 0)
2025
2026                 # wait for a disconnect
2027                 rep = self.recv_pdu()
2028                 self.assertIsNone(rep)
2029                 self.assertNotConnected()
2030                 return
2031             rep = self.recv_pdu(timeout=0.01)
2032             self.assertIsNone(rep)
2033             self.assertIsConnected()
2034
2035         if total >= 0x400000 and fault_last is not None:
2036             rep = self.recv_pdu()
2037             # We get a fault back
2038             self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
2039                             auth_length=0)
2040             self.assertNotEquals(rep.u.alloc_hint, 0)
2041             self.assertEqual(rep.u.context_id, req.u.context_id)
2042             self.assertEqual(rep.u.cancel_count, 0)
2043             self.assertEqual(rep.u.flags, 0)
2044             self.assertEqual(rep.u.status, fault_last)
2045             self.assertEqual(rep.u.reserved, 0)
2046             self.assertEqual(len(rep.u.error_and_verifier), 0)
2047
2048             # wait for a disconnect
2049             rep = self.recv_pdu()
2050             self.assertIsNone(rep)
2051             self.assertNotConnected()
2052             return
2053         rep = self.recv_pdu()
2054         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2055                         auth_length=0)
2056         self.assertNotEquals(rep.u.alloc_hint, 0)
2057         self.assertEqual(rep.u.context_id, req.u.context_id)
2058         self.assertEqual(rep.u.cancel_count, 0)
2059         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2060
2061         self.assertEqual(len(rep.u.stub_and_verifier), 12)
2062         status = struct.unpack_from("<I", rep.u.stub_and_verifier, len(rep.u.stub_and_verifier) - 4)
2063         self.assertEqual(status[0], 0)
2064
2065     def test_fragmented_requests01(self):
2066         return self._test_fragmented_requests(remaining=0x400000,
2067                                               alloc_hint=0x400000)
2068
2069     def test_fragmented_requests02(self):
2070         return self._test_fragmented_requests(remaining=0x400000,
2071                                               alloc_hint=0x100000)
2072
2073     def test_fragmented_requests03(self):
2074         return self._test_fragmented_requests(remaining=0x400000,
2075                                               alloc_hint=0)
2076
2077     def test_fragmented_requests04(self):
2078         return self._test_fragmented_requests(remaining=0x400000,
2079                                               alloc_hint=0x400001,
2080                                               fault_first=dcerpc.DCERPC_FAULT_ACCESS_DENIED)
2081
2082     def test_fragmented_requests05(self):
2083         return self._test_fragmented_requests(remaining=0x500001,
2084                                               alloc_hint=0,
2085                                               fault_last=dcerpc.DCERPC_FAULT_ACCESS_DENIED)
2086
2087     def _test_same_requests(self, pfc_flags, fault_1st=False, fault_2nd=False):
2088         (ctx, rep, real_stub) = self._get_netlogon_ctx()
2089
2090         # netr_ServerReqChallenge with given flags
2091         req = self.generate_request(call_id=2,
2092                                     pfc_flags=pfc_flags,
2093                                     context_id=ctx.context_id,
2094                                     opnum=4,
2095                                     stub=real_stub)
2096         self.send_pdu(req)
2097         if fault_1st:
2098             rep = self.recv_pdu()
2099             # We get a fault back
2100             self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
2101                             auth_length=0)
2102             self.assertNotEquals(rep.u.alloc_hint, 0)
2103             self.assertEqual(rep.u.context_id, 0)
2104             self.assertEqual(rep.u.cancel_count, 0)
2105             self.assertEqual(rep.u.flags, 0)
2106             self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
2107             self.assertEqual(rep.u.reserved, 0)
2108             self.assertEqual(len(rep.u.error_and_verifier), 0)
2109
2110             # wait for a disconnect
2111             rep = self.recv_pdu()
2112             self.assertIsNone(rep)
2113             self.assertNotConnected()
2114             return
2115         rep = self.recv_pdu(timeout=0.1)
2116         self.assertIsNone(rep)
2117         self.assertIsConnected()
2118
2119         # netr_ServerReqChallenge without DCERPC_PFC_FLAG_LAST
2120         # with the same call_id
2121         req = self.generate_request(call_id=2,
2122                                     pfc_flags=pfc_flags,
2123                                     context_id=ctx.context_id,
2124                                     opnum=4,
2125                                     stub=real_stub)
2126         self.send_pdu(req)
2127         if fault_2nd:
2128             rep = self.recv_pdu()
2129             # We get a fault back
2130             self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
2131                             auth_length=0)
2132             self.assertNotEquals(rep.u.alloc_hint, 0)
2133             self.assertEqual(rep.u.context_id, req.u.context_id)
2134             self.assertEqual(rep.u.cancel_count, 0)
2135             self.assertEqual(rep.u.flags, 0)
2136             self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
2137             self.assertEqual(rep.u.reserved, 0)
2138             self.assertEqual(len(rep.u.error_and_verifier), 0)
2139
2140             # wait for a disconnect
2141             rep = self.recv_pdu()
2142             self.assertIsNone(rep)
2143             self.assertNotConnected()
2144             return
2145
2146         rep = self.recv_pdu(timeout=0.1)
2147         self.assertIsNone(rep)
2148         self.assertIsConnected()
2149
2150     def test_first_only_requests(self):
2151         return self._test_same_requests(pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST,
2152                                         fault_2nd=True)
2153
2154     def test_none_only_requests(self):
2155         return self._test_same_requests(pfc_flags=0, fault_1st=True)
2156
2157     def test_last_only_requests(self):
2158         return self._test_same_requests(pfc_flags=dcerpc.DCERPC_PFC_FLAG_LAST,
2159                                         fault_1st=True)
2160
2161     def test_first_maybe_requests(self):
2162         return self._test_same_requests(pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST |
2163                                         dcerpc.DCERPC_PFC_FLAG_MAYBE,
2164                                         fault_2nd=True)
2165
2166     def test_first_didnot_requests(self):
2167         return self._test_same_requests(pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST |
2168                                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
2169                                         fault_2nd=True)
2170
2171     def test_first_cmpx_requests(self):
2172         return self._test_same_requests(pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST |
2173                                         dcerpc.DCERPC_PFC_FLAG_CONC_MPX,
2174                                         fault_2nd=True)
2175
2176     def test_first_08_requests(self):
2177         return self._test_same_requests(pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST |
2178                                         0x08,
2179                                         fault_2nd=True)
2180
2181     def test_first_cancel_requests(self):
2182         (ctx, rep, real_stub) = self._get_netlogon_ctx()
2183
2184         # netr_ServerReqChallenge with given flags
2185         req = self.generate_request(call_id=2,
2186                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST |
2187                                     dcerpc.DCERPC_PFC_FLAG_PENDING_CANCEL,
2188                                     context_id=ctx.context_id,
2189                                     opnum=4,
2190                                     stub=real_stub)
2191         self.send_pdu(req)
2192         rep = self.recv_pdu()
2193         # We get a fault back
2194         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
2195                         pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST |
2196                         dcerpc.DCERPC_PFC_FLAG_LAST |
2197                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
2198                         auth_length=0)
2199         self.assertNotEquals(rep.u.alloc_hint, 0)
2200         self.assertEqual(rep.u.context_id, 0)
2201         self.assertEqual(rep.u.cancel_count, 0)
2202         self.assertEqual(rep.u.flags, 0)
2203         self.assertEqual(rep.u.status, dcerpc.DCERPC_FAULT_NO_CALL_ACTIVE)
2204         self.assertEqual(rep.u.reserved, 0)
2205         self.assertEqual(len(rep.u.error_and_verifier), 0)
2206
2207         # wait for a disconnect
2208         rep = self.recv_pdu()
2209         self.assertIsNone(rep)
2210         self.assertNotConnected()
2211
2212     def test_2nd_cancel_requests(self):
2213         (ctx, rep, real_stub) = self._get_netlogon_ctx()
2214
2215         # netr_ServerReqChallenge with given flags
2216         req = self.generate_request(call_id=2,
2217                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST,
2218                                     context_id=ctx.context_id,
2219                                     opnum=4,
2220                                     stub=real_stub)
2221         self.send_pdu(req)
2222         rep = self.recv_pdu(timeout=0.1)
2223         self.assertIsNone(rep)
2224         self.assertIsConnected()
2225
2226         # netr_ServerReqChallenge with given flags
2227         req = self.generate_request(call_id=2,
2228                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_PENDING_CANCEL,
2229                                     context_id=ctx.context_id,
2230                                     opnum=4,
2231                                     stub=real_stub)
2232         self.send_pdu(req)
2233         rep = self.recv_pdu(timeout=0.1)
2234         self.assertIsNone(rep)
2235         self.assertIsConnected()
2236
2237         # netr_ServerReqChallenge with given flags
2238         req = self.generate_request(call_id=2,
2239                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_LAST,
2240                                     context_id=ctx.context_id,
2241                                     opnum=4,
2242                                     stub=real_stub)
2243         self.send_pdu(req)
2244         rep = self.recv_pdu()
2245         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2246                         auth_length=0)
2247         self.assertNotEquals(rep.u.alloc_hint, 0)
2248         self.assertEqual(rep.u.context_id, req.u.context_id)
2249         self.assertEqual(rep.u.cancel_count, 0)
2250         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2251
2252         self.assertEqual(len(rep.u.stub_and_verifier), 12)
2253         status = struct.unpack_from("<I", rep.u.stub_and_verifier, len(rep.u.stub_and_verifier) - 4)
2254         self.assertEqual(status[0], 0)
2255
2256     def test_last_cancel_requests(self):
2257         (ctx, rep, real_stub) = self._get_netlogon_ctx()
2258
2259         # netr_ServerReqChallenge with given flags
2260         req = self.generate_request(call_id=2,
2261                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST,
2262                                     context_id=ctx.context_id,
2263                                     opnum=4,
2264                                     stub=real_stub[:4])
2265         self.send_pdu(req)
2266         rep = self.recv_pdu(timeout=0.1)
2267         self.assertIsNone(rep)
2268         self.assertIsConnected()
2269
2270         # netr_ServerReqChallenge with given flags
2271         req = self.generate_request(call_id=2,
2272                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_LAST |
2273                                     dcerpc.DCERPC_PFC_FLAG_PENDING_CANCEL,
2274                                     context_id=ctx.context_id,
2275                                     opnum=4,
2276                                     stub=real_stub[4:])
2277         self.send_pdu(req)
2278         rep = self.recv_pdu()
2279         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2280                         auth_length=0)
2281         self.assertNotEquals(rep.u.alloc_hint, 0)
2282         self.assertEqual(rep.u.context_id, req.u.context_id)
2283         self.assertEqual(rep.u.cancel_count, 0)
2284         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2285
2286         self.assertEqual(len(rep.u.stub_and_verifier), 12)
2287         status = struct.unpack_from("<I", rep.u.stub_and_verifier, len(rep.u.stub_and_verifier) - 4)
2288         self.assertEqual(status[0], 0)
2289
2290     def test_mix_requests(self):
2291         (ctx, rep, real_stub) = self._get_netlogon_ctx()
2292
2293         # netr_ServerReqChallenge with given flags
2294         req = self.generate_request(call_id=50,
2295                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST,
2296                                     context_id=ctx.context_id,
2297                                     opnum=4,
2298                                     stub=real_stub)
2299         self.send_pdu(req)
2300         rep = self.recv_pdu(timeout=0.1)
2301         self.assertIsNone(rep)
2302         self.assertIsConnected()
2303
2304         # netr_ServerReqChallenge with given flags
2305         req = self.generate_request(call_id=51,
2306                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST,
2307                                     context_id=ctx.context_id,
2308                                     opnum=4,
2309                                     stub=real_stub)
2310         self.send_pdu(req)
2311         rep = self.recv_pdu()
2312         # We get a fault back
2313         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, 50,
2314                         pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST |
2315                         dcerpc.DCERPC_PFC_FLAG_LAST,
2316                         auth_length=0)
2317         self.assertNotEquals(rep.u.alloc_hint, 0)
2318         self.assertEqual(rep.u.context_id, req.u.context_id)
2319         self.assertEqual(rep.u.cancel_count, 0)
2320         self.assertEqual(rep.u.flags, 0)
2321         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
2322         self.assertEqual(rep.u.reserved, 0)
2323         self.assertEqual(len(rep.u.error_and_verifier), 0)
2324
2325     def test_co_cancel_no_request(self):
2326         ndr32 = base.transfer_syntax_ndr()
2327         abstract = samba.dcerpc.mgmt.abstract_syntax()
2328         ctx = self.prepare_presentation(abstract, ndr32, context_id=0xff)
2329
2330         req = self.generate_co_cancel(call_id=3)
2331         self.send_pdu(req)
2332         rep = self.recv_pdu(timeout=0.01)
2333         self.assertIsNone(rep)
2334         self.assertIsConnected()
2335
2336         # And now try a request
2337         req = self.generate_request(call_id=1,
2338                                     context_id=ctx.context_id,
2339                                     opnum=0,
2340                                     stub=b"")
2341         self.send_pdu(req)
2342         rep = self.recv_pdu()
2343         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2344                         auth_length=0)
2345         self.assertNotEquals(rep.u.alloc_hint, 0)
2346         self.assertEqual(rep.u.context_id, req.u.context_id)
2347         self.assertEqual(rep.u.cancel_count, 0)
2348         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2349
2350     def test_co_cancel_request_after_first(self):
2351         ndr32 = base.transfer_syntax_ndr()
2352         abstract = samba.dcerpc.mgmt.abstract_syntax()
2353         ctx = self.prepare_presentation(abstract, ndr32, context_id=0xff)
2354
2355         req = self.generate_request(call_id=1,
2356                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST,
2357                                     context_id=ctx.context_id,
2358                                     opnum=0,
2359                                     stub=b"")
2360         self.send_pdu(req)
2361         rep = self.recv_pdu(timeout=0.01)
2362         self.assertIsNone(rep)
2363         self.assertIsConnected()
2364
2365         req = self.generate_co_cancel(call_id=1)
2366         self.send_pdu(req)
2367         rep = self.recv_pdu(timeout=0.01)
2368         self.assertIsNone(rep)
2369         self.assertIsConnected()
2370
2371         req = self.generate_request(call_id=1,
2372                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_LAST,
2373                                     context_id=ctx.context_id,
2374                                     opnum=0,
2375                                     stub=b"")
2376         self.send_pdu(req)
2377         rep = self.recv_pdu()
2378         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2379                         auth_length=0)
2380         self.assertNotEquals(rep.u.alloc_hint, 0)
2381         self.assertEqual(rep.u.context_id, req.u.context_id)
2382         self.assertEqual(rep.u.cancel_count, 0)
2383         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2384
2385         # And now try a request
2386         req = self.generate_request(call_id=2,
2387                                     context_id=ctx.context_id,
2388                                     opnum=0,
2389                                     stub=b"")
2390         self.send_pdu(req)
2391         rep = self.recv_pdu()
2392         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2393                         auth_length=0)
2394         self.assertNotEquals(rep.u.alloc_hint, 0)
2395         self.assertEqual(rep.u.context_id, req.u.context_id)
2396         self.assertEqual(rep.u.cancel_count, 0)
2397         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2398
2399     def test_orphaned_no_request(self):
2400         ndr32 = base.transfer_syntax_ndr()
2401         abstract = samba.dcerpc.mgmt.abstract_syntax()
2402         ctx = self.prepare_presentation(abstract, ndr32)
2403
2404         req = self.generate_orphaned(call_id=3)
2405         self.send_pdu(req)
2406         rep = self.recv_pdu(timeout=0.01)
2407         self.assertIsNone(rep)
2408         self.assertIsConnected()
2409
2410         # And now try a request
2411         req = self.generate_request(call_id=1,
2412                                     context_id=ctx.context_id,
2413                                     opnum=0,
2414                                     stub=b"")
2415         self.send_pdu(req)
2416         rep = self.recv_pdu()
2417         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2418                         auth_length=0)
2419         self.assertNotEquals(rep.u.alloc_hint, 0)
2420         self.assertEqual(rep.u.context_id, req.u.context_id & 0xff)
2421         self.assertEqual(rep.u.cancel_count, 0)
2422         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2423
2424     def test_orphaned_request_after_first_last(self):
2425         ndr32 = base.transfer_syntax_ndr()
2426         abstract = samba.dcerpc.mgmt.abstract_syntax()
2427         ctx = self.prepare_presentation(abstract, ndr32)
2428
2429         req = self.generate_request(call_id=1,
2430                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST,
2431                                     context_id=ctx.context_id,
2432                                     opnum=0,
2433                                     stub=b"")
2434         self.send_pdu(req)
2435         rep = self.recv_pdu(timeout=0.1)
2436         self.assertIsNone(rep)
2437         self.assertIsConnected()
2438
2439         req = self.generate_orphaned(call_id=1)
2440         self.send_pdu(req)
2441         rep = self.recv_pdu(timeout=0.1)
2442         self.assertIsNone(rep)
2443         self.assertIsConnected()
2444
2445         req = self.generate_request(call_id=1,
2446                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_LAST,
2447                                     context_id=ctx.context_id,
2448                                     opnum=0,
2449                                     stub=b"")
2450         self.send_pdu(req)
2451         rep = self.recv_pdu()
2452         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2453                         auth_length=0)
2454         self.assertNotEquals(rep.u.alloc_hint, 0)
2455         self.assertEqual(rep.u.context_id, req.u.context_id & 0xff)
2456         self.assertEqual(rep.u.cancel_count, 0)
2457         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2458
2459         # And now try a request
2460         req = self.generate_request(call_id=2,
2461                                     context_id=ctx.context_id,
2462                                     opnum=0,
2463                                     stub=b"")
2464         self.send_pdu(req)
2465         rep = self.recv_pdu()
2466         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2467                         auth_length=0)
2468         self.assertNotEquals(rep.u.alloc_hint, 0)
2469         self.assertEqual(rep.u.context_id, req.u.context_id & 0xff)
2470         self.assertEqual(rep.u.cancel_count, 0)
2471         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2472
2473     def test_orphaned_request_after_first_mpx_last(self):
2474         ndr32 = base.transfer_syntax_ndr()
2475         abstract = samba.dcerpc.mgmt.abstract_syntax()
2476
2477         pfc_flags = samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_FIRST
2478         pfc_flags |= samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_LAST
2479         pfc_flags |= samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_CONC_MPX
2480         ctx = self.prepare_presentation(abstract, ndr32, pfc_flags=pfc_flags)
2481
2482         req = self.generate_request(call_id=1,
2483                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST,
2484                                     context_id=ctx.context_id,
2485                                     opnum=0,
2486                                     stub=b"")
2487         self.send_pdu(req)
2488         rep = self.recv_pdu(timeout=0.1)
2489         self.assertIsNone(rep)
2490         self.assertIsConnected()
2491
2492         req = self.generate_orphaned(call_id=1)
2493         self.send_pdu(req)
2494         rep = self.recv_pdu(timeout=0.1)
2495         self.assertIsNone(rep)
2496         self.assertIsConnected()
2497
2498         req = self.generate_request(call_id=1,
2499                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_LAST,
2500                                     context_id=ctx.context_id,
2501                                     opnum=0,
2502                                     stub=b"")
2503         self.send_pdu(req)
2504         rep = self.recv_pdu()
2505         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2506                         auth_length=0)
2507         self.assertNotEquals(rep.u.alloc_hint, 0)
2508         self.assertEqual(rep.u.context_id, req.u.context_id & 0xff)
2509         self.assertEqual(rep.u.cancel_count, 0)
2510         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2511
2512         # And now try a request
2513         req = self.generate_request(call_id=2,
2514                                     context_id=ctx.context_id,
2515                                     opnum=0,
2516                                     stub=b"")
2517         self.send_pdu(req)
2518         rep = self.recv_pdu()
2519         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2520                         auth_length=0)
2521         self.assertNotEquals(rep.u.alloc_hint, 0)
2522         self.assertEqual(rep.u.context_id, req.u.context_id & 0xff)
2523         self.assertEqual(rep.u.cancel_count, 0)
2524         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2525
2526     def test_orphaned_request_after_first_no_last(self):
2527         ndr32 = base.transfer_syntax_ndr()
2528         abstract = samba.dcerpc.mgmt.abstract_syntax()
2529         ctx = self.prepare_presentation(abstract, ndr32)
2530
2531         req1 = self.generate_request(call_id=1,
2532                                      pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST,
2533                                      context_id=ctx.context_id,
2534                                      opnum=0,
2535                                      stub=b"")
2536         self.send_pdu(req1)
2537         rep = self.recv_pdu(timeout=0.1)
2538         self.assertIsNone(rep)
2539         self.assertIsConnected()
2540
2541         req = self.generate_orphaned(call_id=1)
2542         self.send_pdu(req)
2543         rep = self.recv_pdu(timeout=0.1)
2544         self.assertIsNone(rep)
2545         self.assertIsConnected()
2546
2547         # And now try a new request
2548         req2 = self.generate_request(call_id=2,
2549                                      context_id=ctx.context_id,
2550                                      opnum=0,
2551                                      stub=b"")
2552         self.send_pdu(req2)
2553         rep = self.recv_pdu()
2554         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req1.call_id,
2555                         auth_length=0)
2556         self.assertNotEquals(rep.u.alloc_hint, 0)
2557         self.assertEqual(rep.u.context_id, req1.u.context_id)
2558         self.assertEqual(rep.u.cancel_count, 0)
2559         self.assertEqual(rep.u.flags, 0)
2560         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
2561         self.assertEqual(rep.u.reserved, 0)
2562         self.assertEqual(len(rep.u.error_and_verifier), 0)
2563
2564         # wait for a disconnect
2565         rep = self.recv_pdu()
2566         self.assertIsNone(rep)
2567         self.assertNotConnected()
2568
2569     def test_orphaned_request_after_first_mpx_no_last(self):
2570         ndr32 = base.transfer_syntax_ndr()
2571         abstract = samba.dcerpc.mgmt.abstract_syntax()
2572
2573         pfc_flags = samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_FIRST
2574         pfc_flags |= samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_LAST
2575         pfc_flags |= samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_CONC_MPX
2576         ctx = self.prepare_presentation(abstract, ndr32,
2577                                         pfc_flags=pfc_flags)
2578
2579         req1 = self.generate_request(call_id=1,
2580                                      pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST,
2581                                      context_id=ctx.context_id,
2582                                      opnum=0,
2583                                      stub=b"")
2584         self.send_pdu(req1)
2585         rep = self.recv_pdu(timeout=0.1)
2586         self.assertIsNone(rep)
2587         self.assertIsConnected()
2588
2589         req = self.generate_orphaned(call_id=1)
2590         self.send_pdu(req)
2591         rep = self.recv_pdu(timeout=0.1)
2592         self.assertIsNone(rep)
2593         self.assertIsConnected()
2594
2595         # And now try a new request
2596         req2 = self.generate_request(call_id=2,
2597                                      context_id=ctx.context_id - 1,
2598                                      opnum=0,
2599                                      stub=b"")
2600         self.send_pdu(req2)
2601         rep = self.recv_pdu()
2602         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req2.call_id,
2603                         auth_length=0)
2604         self.assertNotEquals(rep.u.alloc_hint, 0)
2605         self.assertEqual(rep.u.context_id, 0)
2606         self.assertEqual(rep.u.cancel_count, 0)
2607         self.assertEqual(rep.u.flags, 0)
2608         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
2609         self.assertEqual(rep.u.reserved, 0)
2610         self.assertEqual(len(rep.u.error_and_verifier), 0)
2611
2612         # wait for a disconnect
2613         rep = self.recv_pdu()
2614         self.assertIsNone(rep)
2615         self.assertNotConnected()
2616
2617     def _test_spnego_connect_upgrade_request(self, upgrade_auth_level):
2618         ndr32 = base.transfer_syntax_ndr()
2619
2620         tsf1_list = [ndr32]
2621         ctx1 = dcerpc.ctx_list()
2622         ctx1.context_id = 1
2623         ctx1.num_transfer_syntaxes = len(tsf1_list)
2624         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
2625         ctx1.transfer_syntaxes = tsf1_list
2626         ctx_list = [ctx1]
2627
2628         c = self.get_anon_creds()
2629         g = gensec.Security.start_client(self.settings)
2630         g.set_credentials(c)
2631         g.want_feature(gensec.FEATURE_DCE_STYLE)
2632         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
2633         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
2634         auth_context_id = 2
2635         g.start_mech_by_authtype(auth_type, auth_level)
2636         from_server = b""
2637         (finished, to_server) = g.update(from_server)
2638         self.assertFalse(finished)
2639
2640         auth_info = self.generate_auth(auth_type=auth_type,
2641                                        auth_level=auth_level,
2642                                        auth_context_id=auth_context_id,
2643                                        auth_blob=to_server)
2644
2645         req = self.generate_bind(call_id=0,
2646                                  ctx_list=ctx_list,
2647                                  auth_info=auth_info)
2648
2649         self.send_pdu(req)
2650         rep = self.recv_pdu()
2651         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
2652         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
2653         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
2654         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
2655         self.assertEqual(rep.u.secondary_address_size, 4)
2656         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
2657         self.assertPadding(rep.u._pad1, 2)
2658         self.assertEqual(rep.u.num_results, 1)
2659         self.assertEqual(rep.u.ctx_list[0].result,
2660                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
2661         self.assertEqual(rep.u.ctx_list[0].reason,
2662                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
2663         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
2664         self.assertNotEquals(len(rep.u.auth_info), 0)
2665         a = self.parse_auth(rep.u.auth_info)
2666
2667         from_server = a.credentials
2668         (finished, to_server) = g.update(from_server)
2669         self.assertFalse(finished)
2670
2671         auth_info = self.generate_auth(auth_type=auth_type,
2672                                        auth_level=auth_level,
2673                                        auth_context_id=auth_context_id,
2674                                        auth_blob=to_server)
2675
2676         req = self.generate_alter(call_id=0,
2677                                   ctx_list=ctx_list,
2678                                   assoc_group_id=rep.u.assoc_group_id,
2679                                   auth_info=auth_info)
2680
2681         self.send_pdu(req)
2682         rep = self.recv_pdu()
2683         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id)
2684         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
2685         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
2686         self.assertEqual(rep.u.assoc_group_id, req.u.assoc_group_id)
2687         self.assertEqual(rep.u.secondary_address_size, 0)
2688         self.assertPadding(rep.u._pad1, 2)
2689         self.assertEqual(rep.u.num_results, 1)
2690         self.assertEqual(rep.u.ctx_list[0].result,
2691                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
2692         self.assertEqual(rep.u.ctx_list[0].reason,
2693                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
2694         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
2695         self.assertNotEquals(len(rep.u.auth_info), 0)
2696         a = self.parse_auth(rep.u.auth_info)
2697
2698         from_server = a.credentials
2699         (finished, to_server) = g.update(from_server)
2700         self.assertTrue(finished)
2701
2702         # And now try a request without auth_info
2703         req = self.generate_request(call_id=2,
2704                                     context_id=ctx1.context_id,
2705                                     opnum=0,
2706                                     stub=b"")
2707         self.send_pdu(req)
2708         rep = self.recv_pdu()
2709         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2710                         auth_length=0)
2711         self.assertNotEquals(rep.u.alloc_hint, 0)
2712         self.assertEqual(rep.u.context_id, req.u.context_id & 0xff)
2713         self.assertEqual(rep.u.cancel_count, 0)
2714         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2715
2716         # Now a request with auth_info DCERPC_AUTH_LEVEL_CONNECT
2717         auth_info = self.generate_auth(auth_type=auth_type,
2718                                        auth_level=auth_level,
2719                                        auth_context_id=auth_context_id,
2720                                        auth_blob=b"\x01" +b"\x00" *15)
2721         req = self.generate_request(call_id=3,
2722                                     context_id=ctx1.context_id,
2723                                     opnum=0,
2724                                     stub=b"",
2725                                     auth_info=auth_info)
2726         self.send_pdu(req)
2727         rep = self.recv_pdu()
2728         # We don't get an auth_info back
2729         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
2730                         auth_length=0)
2731         self.assertNotEquals(rep.u.alloc_hint, 0)
2732         self.assertEqual(rep.u.context_id, req.u.context_id & 0xff)
2733         self.assertEqual(rep.u.cancel_count, 0)
2734         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
2735
2736         # Now a request with auth_info upgrade_auth_level
2737         auth_info = self.generate_auth(auth_type=auth_type,
2738                                        auth_level=upgrade_auth_level,
2739                                        auth_context_id=auth_context_id,
2740                                        auth_blob=b"\x01" + b"\x00" * 15)
2741         req = self.generate_request(call_id=4,
2742                                     context_id=ctx1.context_id,
2743                                     opnum=0,
2744                                     stub=b"",
2745                                     auth_info=auth_info)
2746         self.send_pdu(req)
2747         rep = self.recv_pdu()
2748         # We get a fault back
2749         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
2750                         auth_length=0)
2751         self.assertNotEquals(rep.u.alloc_hint, 0)
2752         self.assertEqual(rep.u.context_id, req.u.context_id)
2753         self.assertEqual(rep.u.cancel_count, 0)
2754         self.assertEqual(rep.u.flags, 0)
2755         self.assertEqual(rep.u.status, dcerpc.DCERPC_FAULT_ACCESS_DENIED)
2756         self.assertEqual(rep.u.reserved, 0)
2757         self.assertEqual(len(rep.u.error_and_verifier), 0)
2758
2759         # wait for a disconnect
2760         rep = self.recv_pdu()
2761         self.assertIsNone(rep)
2762         self.assertNotConnected()
2763
2764     def test_spnego_connect_packet_upgrade(self):
2765         return self._test_spnego_connect_upgrade_request(
2766                                         dcerpc.DCERPC_AUTH_LEVEL_PACKET)
2767
2768     def test_spnego_connect_integrity_upgrade(self):
2769         return self._test_spnego_connect_upgrade_request(
2770                                         dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY)
2771
2772     def _test_spnego_connect_downgrade_request(self, initial_auth_level):
2773         ndr32 = base.transfer_syntax_ndr()
2774
2775         tsf1_list = [ndr32]
2776         ctx1 = dcerpc.ctx_list()
2777         ctx1.context_id = 1
2778         ctx1.num_transfer_syntaxes = len(tsf1_list)
2779         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
2780         ctx1.transfer_syntaxes = tsf1_list
2781         ctx_list = [ctx1]
2782
2783         c = self.get_anon_creds()
2784         g = gensec.Security.start_client(self.settings)
2785         g.set_credentials(c)
2786         g.want_feature(gensec.FEATURE_DCE_STYLE)
2787         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
2788         auth_level = initial_auth_level
2789         auth_context_id = 2
2790         g.start_mech_by_authtype(auth_type, auth_level)
2791         from_server = b""
2792         (finished, to_server) = g.update(from_server)
2793         self.assertFalse(finished)
2794
2795         auth_info = self.generate_auth(auth_type=auth_type,
2796                                        auth_level=auth_level,
2797                                        auth_context_id=auth_context_id,
2798                                        auth_blob=to_server)
2799
2800         req = self.generate_bind(call_id=0,
2801                                  ctx_list=ctx_list,
2802                                  auth_info=auth_info)
2803
2804         self.send_pdu(req)
2805         rep = self.recv_pdu()
2806         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
2807         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
2808         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
2809         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
2810         self.assertEqual(rep.u.secondary_address_size, 4)
2811         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
2812         self.assertPadding(rep.u._pad1, 2)
2813         self.assertEqual(rep.u.num_results, 1)
2814         self.assertEqual(rep.u.ctx_list[0].result,
2815                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
2816         self.assertEqual(rep.u.ctx_list[0].reason,
2817                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
2818         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
2819         self.assertNotEquals(len(rep.u.auth_info), 0)
2820         a = self.parse_auth(rep.u.auth_info)
2821
2822         from_server = a.credentials
2823         (finished, to_server) = g.update(from_server)
2824         self.assertFalse(finished)
2825
2826         auth_info = self.generate_auth(auth_type=auth_type,
2827                                        auth_level=auth_level,
2828                                        auth_context_id=auth_context_id,
2829                                        auth_blob=to_server)
2830
2831         req = self.generate_alter(call_id=0,
2832                                   ctx_list=ctx_list,
2833                                   assoc_group_id=rep.u.assoc_group_id,
2834                                   auth_info=auth_info)
2835
2836         self.send_pdu(req)
2837         rep = self.recv_pdu()
2838         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id)
2839         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
2840         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
2841         self.assertEqual(rep.u.assoc_group_id, req.u.assoc_group_id)
2842         self.assertEqual(rep.u.secondary_address_size, 0)
2843         self.assertPadding(rep.u._pad1, 2)
2844         self.assertEqual(rep.u.num_results, 1)
2845         self.assertEqual(rep.u.ctx_list[0].result,
2846                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
2847         self.assertEqual(rep.u.ctx_list[0].reason,
2848                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
2849         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
2850         self.assertNotEquals(len(rep.u.auth_info), 0)
2851         a = self.parse_auth(rep.u.auth_info)
2852
2853         from_server = a.credentials
2854         (finished, to_server) = g.update(from_server)
2855         self.assertTrue(finished)
2856
2857         # Now a request with auth_info DCERPC_AUTH_LEVEL_CONNECT
2858         auth_info = self.generate_auth(auth_type=auth_type,
2859                                        auth_level=dcerpc.DCERPC_AUTH_LEVEL_CONNECT,
2860                                        auth_context_id=auth_context_id,
2861                                        auth_blob=b"\x01" + b"\x00" * 15)
2862         req = self.generate_request(call_id=3,
2863                                     context_id=ctx1.context_id,
2864                                     opnum=0,
2865                                     stub=b"",
2866                                     auth_info=auth_info)
2867         self.send_pdu(req)
2868         rep = self.recv_pdu()
2869         # We get a fault back
2870         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
2871                         auth_length=0)
2872         self.assertNotEquals(rep.u.alloc_hint, 0)
2873         self.assertEqual(rep.u.context_id, req.u.context_id)
2874         self.assertEqual(rep.u.cancel_count, 0)
2875         self.assertEqual(rep.u.flags, 0)
2876         self.assertEqual(rep.u.status, dcerpc.DCERPC_FAULT_ACCESS_DENIED)
2877         self.assertEqual(rep.u.reserved, 0)
2878         self.assertEqual(len(rep.u.error_and_verifier), 0)
2879
2880         # wait for a disconnect
2881         rep = self.recv_pdu()
2882         self.assertIsNone(rep)
2883         self.assertNotConnected()
2884
2885     def test_spnego_packet_downgrade_connect(self):
2886         return self._test_spnego_connect_downgrade_request(
2887                                         dcerpc.DCERPC_AUTH_LEVEL_PACKET)
2888
2889     def test_spnego_integrity_downgrade_connect(self):
2890         return self._test_spnego_connect_upgrade_request(
2891                                         dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY)
2892
2893     def test_spnego_unfinished_request(self):
2894         ndr32 = base.transfer_syntax_ndr()
2895
2896         tsf1_list = [ndr32]
2897         ctx1 = dcerpc.ctx_list()
2898         ctx1.context_id = 1
2899         ctx1.num_transfer_syntaxes = len(tsf1_list)
2900         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
2901         ctx1.transfer_syntaxes = tsf1_list
2902         ctx_list = [ctx1]
2903
2904         c = self.get_anon_creds()
2905         g = gensec.Security.start_client(self.settings)
2906         g.set_credentials(c)
2907         g.want_feature(gensec.FEATURE_DCE_STYLE)
2908         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
2909         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
2910         auth_context_id = 2
2911         g.start_mech_by_authtype(auth_type, auth_level)
2912         from_server = b""
2913         (finished, to_server) = g.update(from_server)
2914         self.assertFalse(finished)
2915
2916         auth_info = self.generate_auth(auth_type=auth_type,
2917                                        auth_level=auth_level,
2918                                        auth_context_id=auth_context_id,
2919                                        auth_blob=to_server)
2920
2921         req = self.generate_bind(call_id=0,
2922                                  ctx_list=ctx_list,
2923                                  auth_info=auth_info)
2924
2925         self.send_pdu(req)
2926         rep = self.recv_pdu()
2927         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
2928         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
2929         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
2930         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
2931         assoc_group_id = rep.u.assoc_group_id
2932         self.assertEqual(rep.u.secondary_address_size, 4)
2933         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
2934         self.assertPadding(rep.u._pad1, 2)
2935         self.assertEqual(rep.u.num_results, 1)
2936         self.assertEqual(rep.u.ctx_list[0].result,
2937                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
2938         self.assertEqual(rep.u.ctx_list[0].reason,
2939                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
2940         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
2941         self.assertNotEquals(len(rep.u.auth_info), 0)
2942         a = self.parse_auth(rep.u.auth_info)
2943
2944         from_server = a.credentials
2945         (finished, to_server) = g.update(from_server)
2946         self.assertFalse(finished)
2947
2948         # Now a request with auth_info DCERPC_AUTH_LEVEL_CONNECT
2949         auth_info = self.generate_auth(auth_type=auth_type,
2950                                        auth_level=auth_level,
2951                                        auth_context_id=auth_context_id,
2952                                        auth_blob=b"\x01" + b"\x00" * 15)
2953         req = self.generate_request(call_id=1,
2954                                     context_id=ctx1.context_id,
2955                                     opnum=0,
2956                                     stub=b"",
2957                                     auth_info=auth_info)
2958         self.send_pdu(req)
2959         rep = self.recv_pdu()
2960         # We get a fault
2961         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
2962                         pfc_flags=req.pfc_flags |
2963                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
2964                         auth_length=0)
2965         self.assertNotEquals(rep.u.alloc_hint, 0)
2966         self.assertEqual(rep.u.context_id, 0)
2967         self.assertEqual(rep.u.cancel_count, 0)
2968         self.assertEqual(rep.u.flags, 0)
2969         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
2970         self.assertEqual(rep.u.reserved, 0)
2971         self.assertEqual(len(rep.u.error_and_verifier), 0)
2972
2973         # wait for a disconnect
2974         rep = self.recv_pdu()
2975         self.assertIsNone(rep)
2976         self.assertNotConnected()
2977
2978     def test_spnego_auth3(self):
2979         ndr32 = base.transfer_syntax_ndr()
2980
2981         tsf1_list = [ndr32]
2982         ctx1 = dcerpc.ctx_list()
2983         ctx1.context_id = 1
2984         ctx1.num_transfer_syntaxes = len(tsf1_list)
2985         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
2986         ctx1.transfer_syntaxes = tsf1_list
2987         ctx_list = [ctx1]
2988
2989         c = self.get_anon_creds()
2990         g = gensec.Security.start_client(self.settings)
2991         g.set_credentials(c)
2992         g.want_feature(gensec.FEATURE_DCE_STYLE)
2993         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
2994         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
2995         auth_context_id = 2
2996         g.start_mech_by_authtype(auth_type, auth_level)
2997         from_server = b""
2998         (finished, to_server) = g.update(from_server)
2999         self.assertFalse(finished)
3000
3001         auth_info = self.generate_auth(auth_type=auth_type,
3002                                        auth_level=auth_level,
3003                                        auth_context_id=auth_context_id,
3004                                        auth_blob=to_server)
3005         req = self.generate_bind(call_id=0,
3006                                  ctx_list=ctx_list,
3007                                  auth_info=auth_info)
3008         self.send_pdu(req)
3009         rep = self.recv_pdu()
3010         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
3011         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3012         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3013         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
3014         self.assertEqual(rep.u.secondary_address_size, 4)
3015         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
3016         self.assertPadding(rep.u._pad1, 2)
3017         self.assertEqual(rep.u.num_results, 1)
3018         self.assertEqual(rep.u.ctx_list[0].result,
3019                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3020         self.assertEqual(rep.u.ctx_list[0].reason,
3021                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3022         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3023         self.assertNotEquals(len(rep.u.auth_info), 0)
3024         a = self.parse_auth(rep.u.auth_info)
3025
3026         from_server = a.credentials
3027         (finished, to_server) = g.update(from_server)
3028         self.assertFalse(finished)
3029
3030         auth_info = self.generate_auth(auth_type=auth_type,
3031                                        auth_level=auth_level,
3032                                        auth_context_id=auth_context_id,
3033                                        auth_blob=to_server)
3034         req = self.generate_auth3(call_id=0,
3035                                   auth_info=auth_info)
3036         self.send_pdu(req)
3037         rep = self.recv_pdu(timeout=0.01)
3038         self.assertIsNone(rep)
3039         self.assertIsConnected()
3040
3041         # And now try a request without auth_info
3042         req = self.generate_request(call_id=2,
3043                                     context_id=ctx1.context_id,
3044                                     opnum=0,
3045                                     stub=b"")
3046         self.send_pdu(req)
3047         rep = self.recv_pdu()
3048         # We get a fault back
3049         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
3050                         auth_length=0)
3051         self.assertNotEquals(rep.u.alloc_hint, 0)
3052         self.assertEqual(rep.u.context_id, req.u.context_id)
3053         self.assertEqual(rep.u.cancel_count, 0)
3054         self.assertEqual(rep.u.flags, 0)
3055         self.assertEqual(rep.u.status, dcerpc.DCERPC_FAULT_ACCESS_DENIED)
3056         self.assertEqual(rep.u.reserved, 0)
3057         self.assertEqual(len(rep.u.error_and_verifier), 0)
3058
3059         # wait for a disconnect
3060         rep = self.recv_pdu()
3061         self.assertIsNone(rep)
3062         self.assertNotConnected()
3063
3064     def test_spnego_connect_reauth_alter(self):
3065         ndr32 = base.transfer_syntax_ndr()
3066         ndr64 = base.transfer_syntax_ndr64()
3067
3068         tsf1_list = [ndr32]
3069         ctx1 = dcerpc.ctx_list()
3070         ctx1.context_id = 1
3071         ctx1.num_transfer_syntaxes = len(tsf1_list)
3072         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3073         ctx1.transfer_syntaxes = tsf1_list
3074         ctx_list = [ctx1]
3075
3076         c = self.get_anon_creds()
3077         g = gensec.Security.start_client(self.settings)
3078         g.set_credentials(c)
3079         g.want_feature(gensec.FEATURE_DCE_STYLE)
3080         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
3081         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
3082         auth_context_id = 2
3083         g.start_mech_by_authtype(auth_type, auth_level)
3084         from_server = b""
3085         (finished, to_server) = g.update(from_server)
3086         self.assertFalse(finished)
3087
3088         auth_info = self.generate_auth(auth_type=auth_type,
3089                                        auth_level=auth_level,
3090                                        auth_context_id=auth_context_id,
3091                                        auth_blob=to_server)
3092
3093         req = self.generate_bind(call_id=0,
3094                                  ctx_list=ctx_list,
3095                                  auth_info=auth_info)
3096
3097         self.send_pdu(req)
3098         rep = self.recv_pdu()
3099         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
3100         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3101         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3102         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
3103         self.assertEqual(rep.u.secondary_address_size, 4)
3104         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
3105         self.assertPadding(rep.u._pad1, 2)
3106         self.assertEqual(rep.u.num_results, 1)
3107         self.assertEqual(rep.u.ctx_list[0].result,
3108                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3109         self.assertEqual(rep.u.ctx_list[0].reason,
3110                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3111         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3112         self.assertNotEquals(len(rep.u.auth_info), 0)
3113         a = self.parse_auth(rep.u.auth_info)
3114
3115         from_server = a.credentials
3116         (finished, to_server) = g.update(from_server)
3117         self.assertFalse(finished)
3118
3119         auth_info = self.generate_auth(auth_type=auth_type,
3120                                        auth_level=auth_level,
3121                                        auth_context_id=auth_context_id,
3122                                        auth_blob=to_server)
3123         req = self.generate_alter(call_id=0,
3124                                   ctx_list=[ctx1],
3125                                   assoc_group_id=rep.u.assoc_group_id,
3126                                   auth_info=auth_info)
3127         self.send_pdu(req)
3128         rep = self.recv_pdu()
3129         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id)
3130         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3131         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3132         self.assertEqual(rep.u.assoc_group_id, req.u.assoc_group_id)
3133         self.assertEqual(rep.u.secondary_address_size, 0)
3134         self.assertPadding(rep.u._pad1, 2)
3135         self.assertEqual(rep.u.num_results, 1)
3136         self.assertEqual(rep.u.ctx_list[0].result,
3137                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3138         self.assertEqual(rep.u.ctx_list[0].reason,
3139                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3140         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3141         self.assertNotEquals(len(rep.u.auth_info), 0)
3142         a = self.parse_auth(rep.u.auth_info)
3143
3144         from_server = a.credentials
3145         (finished, to_server) = g.update(from_server)
3146         self.assertTrue(finished)
3147
3148         # And now try a request without auth_info
3149         req = self.generate_request(call_id=2,
3150                                     context_id=ctx1.context_id,
3151                                     opnum=0,
3152                                     stub=b"")
3153         self.send_pdu(req)
3154         rep = self.recv_pdu()
3155         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
3156                         auth_length=0)
3157         self.assertNotEquals(rep.u.alloc_hint, 0)
3158         self.assertEqual(rep.u.context_id, req.u.context_id & 0xff)
3159         self.assertEqual(rep.u.cancel_count, 0)
3160         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
3161
3162         # Now a request with auth_info DCERPC_AUTH_LEVEL_CONNECT
3163         auth_info = self.generate_auth(auth_type=auth_type,
3164                                        auth_level=auth_level,
3165                                        auth_context_id=auth_context_id,
3166                                        auth_blob=b"\x01" + b"\x00" * 15)
3167         req = self.generate_request(call_id=3,
3168                                     context_id=ctx1.context_id,
3169                                     opnum=0,
3170                                     stub=b"",
3171                                     auth_info=auth_info)
3172         self.send_pdu(req)
3173         rep = self.recv_pdu()
3174         # We don't get an auth_info back
3175         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
3176                         auth_length=0)
3177         self.assertNotEquals(rep.u.alloc_hint, 0)
3178         self.assertEqual(rep.u.context_id, req.u.context_id)
3179         self.assertEqual(rep.u.cancel_count, 0)
3180         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
3181
3182         # Now a reauth
3183
3184         g = gensec.Security.start_client(self.settings)
3185         g.set_credentials(c)
3186         g.want_feature(gensec.FEATURE_DCE_STYLE)
3187         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
3188         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
3189         auth_context_id = 2
3190         g.start_mech_by_authtype(auth_type, auth_level)
3191         from_server = b""
3192         (finished, to_server) = g.update(from_server)
3193         self.assertFalse(finished)
3194
3195         auth_info = self.generate_auth(auth_type=auth_type,
3196                                        auth_level=auth_level,
3197                                        auth_context_id=auth_context_id,
3198                                        auth_blob=to_server)
3199         req = self.generate_alter(call_id=0,
3200                                   ctx_list=ctx_list,
3201                                   auth_info=auth_info)
3202         self.send_pdu(req)
3203         rep = self.recv_pdu()
3204         # We get a fault
3205         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
3206                         pfc_flags=req.pfc_flags |
3207                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
3208                         auth_length=0)
3209         self.assertNotEquals(rep.u.alloc_hint, 0)
3210         self.assertEqual(rep.u.context_id, 0)
3211         self.assertEqual(rep.u.cancel_count, 0)
3212         self.assertEqual(rep.u.flags, 0)
3213         self.assertEqual(rep.u.status, dcerpc.DCERPC_FAULT_ACCESS_DENIED)
3214         self.assertEqual(rep.u.reserved, 0)
3215         self.assertEqual(len(rep.u.error_and_verifier), 0)
3216
3217         # wait for a disconnect
3218         rep = self.recv_pdu()
3219         self.assertIsNone(rep)
3220         self.assertNotConnected()
3221
3222     def test_spnego_connect_reauth_auth3(self):
3223         ndr32 = base.transfer_syntax_ndr()
3224         ndr64 = base.transfer_syntax_ndr64()
3225
3226         tsf1_list = [ndr32]
3227         ctx1 = dcerpc.ctx_list()
3228         ctx1.context_id = 1
3229         ctx1.num_transfer_syntaxes = len(tsf1_list)
3230         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3231         ctx1.transfer_syntaxes = tsf1_list
3232         ctx_list = [ctx1]
3233
3234         c = self.get_anon_creds()
3235         g = gensec.Security.start_client(self.settings)
3236         g.set_credentials(c)
3237         g.want_feature(gensec.FEATURE_DCE_STYLE)
3238         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
3239         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
3240         auth_context_id = 2
3241         g.start_mech_by_authtype(auth_type, auth_level)
3242         from_server = b""
3243         (finished, to_server) = g.update(from_server)
3244         self.assertFalse(finished)
3245
3246         auth_info = self.generate_auth(auth_type=auth_type,
3247                                        auth_level=auth_level,
3248                                        auth_context_id=auth_context_id,
3249                                        auth_blob=to_server)
3250
3251         req = self.generate_bind(call_id=0,
3252                                  ctx_list=ctx_list,
3253                                  auth_info=auth_info)
3254
3255         self.send_pdu(req)
3256         rep = self.recv_pdu()
3257         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
3258         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3259         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3260         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
3261         self.assertEqual(rep.u.secondary_address_size, 4)
3262         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
3263         self.assertPadding(rep.u._pad1, 2)
3264         self.assertEqual(rep.u.num_results, 1)
3265         self.assertEqual(rep.u.ctx_list[0].result,
3266                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3267         self.assertEqual(rep.u.ctx_list[0].reason,
3268                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3269         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3270         self.assertNotEquals(len(rep.u.auth_info), 0)
3271         a = self.parse_auth(rep.u.auth_info)
3272
3273         from_server = a.credentials
3274         (finished, to_server) = g.update(from_server)
3275         self.assertFalse(finished)
3276
3277         auth_info = self.generate_auth(auth_type=auth_type,
3278                                        auth_level=auth_level,
3279                                        auth_context_id=auth_context_id,
3280                                        auth_blob=to_server)
3281         req = self.generate_alter(call_id=0,
3282                                   ctx_list=[ctx1],
3283                                   assoc_group_id=rep.u.assoc_group_id,
3284                                   auth_info=auth_info)
3285         self.send_pdu(req)
3286         rep = self.recv_pdu()
3287         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id)
3288         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3289         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3290         self.assertEqual(rep.u.assoc_group_id, req.u.assoc_group_id)
3291         self.assertEqual(rep.u.secondary_address_size, 0)
3292         self.assertPadding(rep.u._pad1, 2)
3293         self.assertEqual(rep.u.num_results, 1)
3294         self.assertEqual(rep.u.ctx_list[0].result,
3295                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3296         self.assertEqual(rep.u.ctx_list[0].reason,
3297                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3298         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3299         self.assertNotEquals(len(rep.u.auth_info), 0)
3300         a = self.parse_auth(rep.u.auth_info)
3301
3302         from_server = a.credentials
3303         (finished, to_server) = g.update(from_server)
3304         self.assertTrue(finished)
3305
3306         # And now try a request without auth_info
3307         req = self.generate_request(call_id=2,
3308                                     context_id=ctx1.context_id,
3309                                     opnum=0,
3310                                     stub=b"")
3311         self.send_pdu(req)
3312         rep = self.recv_pdu()
3313         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
3314                         auth_length=0)
3315         self.assertNotEquals(rep.u.alloc_hint, 0)
3316         self.assertEqual(rep.u.context_id, req.u.context_id)
3317         self.assertEqual(rep.u.cancel_count, 0)
3318         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
3319
3320         # Now a request with auth_info DCERPC_AUTH_LEVEL_CONNECT
3321         auth_info = self.generate_auth(auth_type=auth_type,
3322                                        auth_level=auth_level,
3323                                        auth_context_id=auth_context_id,
3324                                        auth_blob=b"\x01" + b"\x00" * 15)
3325         req = self.generate_request(call_id=3,
3326                                     context_id=ctx1.context_id,
3327                                     opnum=0,
3328                                     stub=b"",
3329                                     auth_info=auth_info)
3330         self.send_pdu(req)
3331         rep = self.recv_pdu()
3332         # We don't get an auth_info back
3333         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
3334                         auth_length=0)
3335         self.assertNotEquals(rep.u.alloc_hint, 0)
3336         self.assertEqual(rep.u.context_id, req.u.context_id)
3337         self.assertEqual(rep.u.cancel_count, 0)
3338         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
3339
3340         # Now a reauth
3341
3342         g = gensec.Security.start_client(self.settings)
3343         g.set_credentials(c)
3344         g.want_feature(gensec.FEATURE_DCE_STYLE)
3345         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
3346         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
3347         auth_context_id = 2
3348         g.start_mech_by_authtype(auth_type, auth_level)
3349         from_server = b""
3350         (finished, to_server) = g.update(from_server)
3351         self.assertFalse(finished)
3352
3353         auth_info = self.generate_auth(auth_type=auth_type,
3354                                        auth_level=auth_level,
3355                                        auth_context_id=auth_context_id,
3356                                        auth_blob=to_server)
3357         req = self.generate_auth3(call_id=0,
3358                                   auth_info=auth_info)
3359         self.send_pdu(req)
3360         rep = self.recv_pdu()
3361         # We get a fault
3362         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
3363                         pfc_flags=req.pfc_flags |
3364                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
3365                         auth_length=0)
3366         self.assertNotEquals(rep.u.alloc_hint, 0)
3367         self.assertEqual(rep.u.context_id, 0)
3368         self.assertEqual(rep.u.cancel_count, 0)
3369         self.assertEqual(rep.u.flags, 0)
3370         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
3371         self.assertEqual(rep.u.reserved, 0)
3372         self.assertEqual(len(rep.u.error_and_verifier), 0)
3373
3374         # wait for a disconnect
3375         rep = self.recv_pdu()
3376         self.assertIsNone(rep)
3377         self.assertNotConnected()
3378
3379     def test_spnego_change_auth_level(self):
3380         ndr32 = base.transfer_syntax_ndr()
3381
3382         tsf1_list = [ndr32]
3383         ctx1 = dcerpc.ctx_list()
3384         ctx1.context_id = 1
3385         ctx1.num_transfer_syntaxes = len(tsf1_list)
3386         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3387         ctx1.transfer_syntaxes = tsf1_list
3388
3389         c = self.get_anon_creds()
3390         g = gensec.Security.start_client(self.settings)
3391         g.set_credentials(c)
3392         g.want_feature(gensec.FEATURE_DCE_STYLE)
3393         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
3394         auth_level = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
3395         auth_context_id = 2
3396         g.start_mech_by_authtype(auth_type, auth_level)
3397         from_server = b""
3398         (finished, to_server) = g.update(from_server)
3399         self.assertFalse(finished)
3400
3401         auth_info = self.generate_auth(auth_type=auth_type,
3402                                        auth_level=auth_level,
3403                                        auth_context_id=auth_context_id,
3404                                        auth_blob=to_server)
3405         req = self.generate_bind(call_id=0,
3406                                  ctx_list=[ctx1],
3407                                  auth_info=auth_info)
3408         self.send_pdu(req)
3409         rep = self.recv_pdu()
3410         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
3411         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3412         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3413         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
3414         self.assertEqual(rep.u.secondary_address_size, 4)
3415         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
3416         self.assertPadding(rep.u._pad1, 2)
3417         self.assertEqual(rep.u.num_results, 1)
3418         self.assertEqual(rep.u.ctx_list[0].result,
3419                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3420         self.assertEqual(rep.u.ctx_list[0].reason,
3421                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3422         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3423         self.assertNotEquals(len(rep.u.auth_info), 0)
3424         a = self.parse_auth(rep.u.auth_info)
3425
3426         from_server = a.credentials
3427         (finished, to_server) = g.update(from_server)
3428         self.assertFalse(finished)
3429
3430         auth_info = self.generate_auth(auth_type=auth_type,
3431                                        auth_level=dcerpc.DCERPC_AUTH_LEVEL_PRIVACY,
3432                                        auth_context_id=auth_context_id,
3433                                        auth_blob=to_server)
3434         req = self.generate_alter(call_id=0,
3435                                   ctx_list=[ctx1],
3436                                   assoc_group_id=rep.u.assoc_group_id,
3437                                   auth_info=auth_info)
3438         self.send_pdu(req)
3439         rep = self.recv_pdu()
3440         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
3441                         pfc_flags=req.pfc_flags |
3442                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
3443                         auth_length=0)
3444         self.assertNotEquals(rep.u.alloc_hint, 0)
3445         self.assertEqual(rep.u.context_id, 0)
3446         self.assertEqual(rep.u.cancel_count, 0)
3447         self.assertEqual(rep.u.flags, 0)
3448         self.assertEqual(rep.u.status, dcerpc.DCERPC_FAULT_ACCESS_DENIED)
3449         self.assertEqual(rep.u.reserved, 0)
3450         self.assertEqual(len(rep.u.error_and_verifier), 0)
3451
3452         # wait for a disconnect
3453         rep = self.recv_pdu()
3454         self.assertIsNone(rep)
3455         self.assertNotConnected()
3456
3457     def test_spnego_change_abstract(self):
3458         ndr32 = base.transfer_syntax_ndr()
3459
3460         tsf1_list = [ndr32]
3461         ctx1 = dcerpc.ctx_list()
3462         ctx1.context_id = 1
3463         ctx1.num_transfer_syntaxes = len(tsf1_list)
3464         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3465         ctx1.transfer_syntaxes = tsf1_list
3466
3467         ctx1b = dcerpc.ctx_list()
3468         ctx1b.context_id = 1
3469         ctx1b.num_transfer_syntaxes = len(tsf1_list)
3470         ctx1b.abstract_syntax = samba.dcerpc.epmapper.abstract_syntax()
3471         ctx1b.transfer_syntaxes = tsf1_list
3472
3473         c = self.get_anon_creds()
3474         g = gensec.Security.start_client(self.settings)
3475         g.set_credentials(c)
3476         g.want_feature(gensec.FEATURE_DCE_STYLE)
3477         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
3478         auth_level = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
3479         auth_context_id = 2
3480         g.start_mech_by_authtype(auth_type, auth_level)
3481         from_server = b""
3482         (finished, to_server) = g.update(from_server)
3483         self.assertFalse(finished)
3484
3485         auth_info = self.generate_auth(auth_type=auth_type,
3486                                        auth_level=auth_level,
3487                                        auth_context_id=auth_context_id,
3488                                        auth_blob=to_server)
3489         req = self.generate_bind(call_id=0,
3490                                  ctx_list=[ctx1],
3491                                  auth_info=auth_info)
3492         self.send_pdu(req)
3493         rep = self.recv_pdu()
3494         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
3495         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3496         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3497         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
3498         self.assertEqual(rep.u.secondary_address_size, 4)
3499         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
3500         self.assertPadding(rep.u._pad1, 2)
3501         self.assertEqual(rep.u.num_results, 1)
3502         self.assertEqual(rep.u.ctx_list[0].result,
3503                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3504         self.assertEqual(rep.u.ctx_list[0].reason,
3505                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3506         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3507         self.assertNotEquals(len(rep.u.auth_info), 0)
3508         a = self.parse_auth(rep.u.auth_info)
3509
3510         from_server = a.credentials
3511         (finished, to_server) = g.update(from_server)
3512         self.assertFalse(finished)
3513
3514         auth_info = self.generate_auth(auth_type=auth_type,
3515                                        auth_level=dcerpc.DCERPC_AUTH_LEVEL_PRIVACY,
3516                                        auth_context_id=auth_context_id,
3517                                        auth_blob=to_server)
3518         req = self.generate_alter(call_id=0,
3519                                   ctx_list=[ctx1b],
3520                                   assoc_group_id=rep.u.assoc_group_id,
3521                                   auth_info=auth_info)
3522         self.send_pdu(req)
3523         rep = self.recv_pdu()
3524         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
3525                         pfc_flags=req.pfc_flags |
3526                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
3527                         auth_length=0)
3528         self.assertNotEquals(rep.u.alloc_hint, 0)
3529         self.assertEqual(rep.u.context_id, 0)
3530         self.assertEqual(rep.u.cancel_count, 0)
3531         self.assertEqual(rep.u.flags, 0)
3532         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
3533         self.assertEqual(rep.u.reserved, 0)
3534         self.assertEqual(len(rep.u.error_and_verifier), 0)
3535
3536         # wait for a disconnect
3537         rep = self.recv_pdu()
3538         self.assertIsNone(rep)
3539         self.assertNotConnected()
3540
3541     def test_spnego_change_transfer(self):
3542         ndr32 = base.transfer_syntax_ndr()
3543         ndr64 = base.transfer_syntax_ndr64()
3544
3545         tsf1_list = [ndr32]
3546         ctx1 = dcerpc.ctx_list()
3547         ctx1.context_id = 1
3548         ctx1.num_transfer_syntaxes = len(tsf1_list)
3549         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3550         ctx1.transfer_syntaxes = tsf1_list
3551
3552         tsf1b_list = [ndr32, ndr64]
3553         ctx1b = dcerpc.ctx_list()
3554         ctx1b.context_id = 1
3555         ctx1b.num_transfer_syntaxes = len(tsf1b_list)
3556         ctx1b.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3557         ctx1b.transfer_syntaxes = tsf1b_list
3558
3559         c = self.get_anon_creds()
3560         g = gensec.Security.start_client(self.settings)
3561         g.set_credentials(c)
3562         g.want_feature(gensec.FEATURE_DCE_STYLE)
3563         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
3564         auth_level = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
3565         auth_context_id = 2
3566         g.start_mech_by_authtype(auth_type, auth_level)
3567         from_server = b""
3568         (finished, to_server) = g.update(from_server)
3569         self.assertFalse(finished)
3570
3571         auth_info = self.generate_auth(auth_type=auth_type,
3572                                        auth_level=auth_level,
3573                                        auth_context_id=auth_context_id,
3574                                        auth_blob=to_server)
3575         req = self.generate_bind(call_id=0,
3576                                  ctx_list=[ctx1],
3577                                  auth_info=auth_info)
3578         self.send_pdu(req)
3579         rep = self.recv_pdu()
3580         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
3581         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3582         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3583         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
3584         self.assertEqual(rep.u.secondary_address_size, 4)
3585         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
3586         self.assertPadding(rep.u._pad1, 2)
3587         self.assertEqual(rep.u.num_results, 1)
3588         self.assertEqual(rep.u.ctx_list[0].result,
3589                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3590         self.assertEqual(rep.u.ctx_list[0].reason,
3591                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3592         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3593         self.assertNotEquals(len(rep.u.auth_info), 0)
3594         a = self.parse_auth(rep.u.auth_info)
3595
3596         from_server = a.credentials
3597         (finished, to_server) = g.update(from_server)
3598         self.assertFalse(finished)
3599
3600         # We change ctx_list and auth_level
3601         auth_info = self.generate_auth(auth_type=auth_type,
3602                                        auth_level=dcerpc.DCERPC_AUTH_LEVEL_PRIVACY,
3603                                        auth_context_id=auth_context_id,
3604                                        auth_blob=to_server)
3605         req = self.generate_alter(call_id=0,
3606                                   ctx_list=[ctx1b],
3607                                   assoc_group_id=rep.u.assoc_group_id,
3608                                   auth_info=auth_info)
3609         self.send_pdu(req)
3610         rep = self.recv_pdu()
3611         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
3612                         pfc_flags=req.pfc_flags |
3613                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
3614                         auth_length=0)
3615         self.assertNotEquals(rep.u.alloc_hint, 0)
3616         self.assertEqual(rep.u.context_id, 0)
3617         self.assertEqual(rep.u.cancel_count, 0)
3618         self.assertEqual(rep.u.flags, 0)
3619         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
3620         self.assertEqual(rep.u.reserved, 0)
3621         self.assertEqual(len(rep.u.error_and_verifier), 0)
3622
3623         # wait for a disconnect
3624         rep = self.recv_pdu()
3625         self.assertIsNone(rep)
3626         self.assertNotConnected()
3627
3628     def test_spnego_change_auth_type1(self):
3629         ndr32 = base.transfer_syntax_ndr()
3630         ndr64 = base.transfer_syntax_ndr64()
3631
3632         tsf1_list = [ndr32]
3633         ctx1 = dcerpc.ctx_list()
3634         ctx1.context_id = 1
3635         ctx1.num_transfer_syntaxes = len(tsf1_list)
3636         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3637         ctx1.transfer_syntaxes = tsf1_list
3638
3639         c = self.get_anon_creds()
3640         g = gensec.Security.start_client(self.settings)
3641         g.set_credentials(c)
3642         g.want_feature(gensec.FEATURE_DCE_STYLE)
3643         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
3644         auth_level = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
3645         auth_context_id = 2
3646         g.start_mech_by_authtype(auth_type, auth_level)
3647         from_server = b""
3648         (finished, to_server) = g.update(from_server)
3649         self.assertFalse(finished)
3650
3651         auth_info = self.generate_auth(auth_type=auth_type,
3652                                        auth_level=auth_level,
3653                                        auth_context_id=auth_context_id,
3654                                        auth_blob=to_server)
3655         req = self.generate_bind(call_id=0,
3656                                  ctx_list=[ctx1],
3657                                  auth_info=auth_info)
3658         self.send_pdu(req)
3659         rep = self.recv_pdu()
3660         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
3661         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3662         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3663         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
3664         self.assertEqual(rep.u.secondary_address_size, 4)
3665         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
3666         self.assertPadding(rep.u._pad1, 2)
3667         self.assertEqual(rep.u.num_results, 1)
3668         self.assertEqual(rep.u.ctx_list[0].result,
3669                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3670         self.assertEqual(rep.u.ctx_list[0].reason,
3671                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3672         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3673         self.assertNotEquals(len(rep.u.auth_info), 0)
3674         a = self.parse_auth(rep.u.auth_info)
3675
3676         from_server = a.credentials
3677         (finished, to_server) = g.update(from_server)
3678         self.assertFalse(finished)
3679
3680         # We change ctx_list and auth_level
3681         auth_info = self.generate_auth(auth_type=dcerpc.DCERPC_AUTH_TYPE_KRB5,
3682                                        auth_level=auth_level,
3683                                        auth_context_id=auth_context_id,
3684                                        auth_blob=to_server)
3685         req = self.generate_alter(call_id=0,
3686                                   ctx_list=[ctx1],
3687                                   assoc_group_id=rep.u.assoc_group_id,
3688                                   auth_info=auth_info)
3689         self.send_pdu(req)
3690         rep = self.recv_pdu()
3691         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
3692                         pfc_flags=req.pfc_flags |
3693                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
3694                         auth_length=0)
3695         self.assertNotEquals(rep.u.alloc_hint, 0)
3696         self.assertEqual(rep.u.context_id, 0)
3697         self.assertEqual(rep.u.cancel_count, 0)
3698         self.assertEqual(rep.u.flags, 0)
3699         self.assertEqual(rep.u.status, dcerpc.DCERPC_FAULT_SEC_PKG_ERROR)
3700         self.assertEqual(rep.u.reserved, 0)
3701         self.assertEqual(len(rep.u.error_and_verifier), 0)
3702
3703         # wait for a disconnect
3704         rep = self.recv_pdu()
3705         self.assertIsNone(rep)
3706         self.assertNotConnected()
3707
3708     def test_spnego_change_auth_type2(self):
3709         ndr32 = base.transfer_syntax_ndr()
3710         ndr64 = base.transfer_syntax_ndr64()
3711
3712         tsf1_list = [ndr32]
3713         ctx1 = dcerpc.ctx_list()
3714         ctx1.context_id = 1
3715         ctx1.num_transfer_syntaxes = len(tsf1_list)
3716         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3717         ctx1.transfer_syntaxes = tsf1_list
3718
3719         tsf1b_list = [ndr32, ndr64]
3720         ctx1b = dcerpc.ctx_list()
3721         ctx1b.context_id = 1
3722         ctx1b.num_transfer_syntaxes = len(tsf1b_list)
3723         ctx1b.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3724         ctx1b.transfer_syntaxes = tsf1b_list
3725
3726         c = self.get_anon_creds()
3727         g = gensec.Security.start_client(self.settings)
3728         g.set_credentials(c)
3729         g.want_feature(gensec.FEATURE_DCE_STYLE)
3730         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
3731         auth_level = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
3732         auth_context_id = 2
3733         g.start_mech_by_authtype(auth_type, auth_level)
3734         from_server = b""
3735         (finished, to_server) = g.update(from_server)
3736         self.assertFalse(finished)
3737
3738         auth_info = self.generate_auth(auth_type=auth_type,
3739                                        auth_level=auth_level,
3740                                        auth_context_id=auth_context_id,
3741                                        auth_blob=to_server)
3742         req = self.generate_bind(call_id=0,
3743                                  ctx_list=[ctx1],
3744                                  auth_info=auth_info)
3745         self.send_pdu(req)
3746         rep = self.recv_pdu()
3747         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
3748         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3749         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3750         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
3751         self.assertEqual(rep.u.secondary_address_size, 4)
3752         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
3753         self.assertPadding(rep.u._pad1, 2)
3754         self.assertEqual(rep.u.num_results, 1)
3755         self.assertEqual(rep.u.ctx_list[0].result,
3756                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3757         self.assertEqual(rep.u.ctx_list[0].reason,
3758                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3759         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3760         self.assertNotEquals(len(rep.u.auth_info), 0)
3761         a = self.parse_auth(rep.u.auth_info)
3762
3763         from_server = a.credentials
3764         (finished, to_server) = g.update(from_server)
3765         self.assertFalse(finished)
3766
3767         # We change ctx_list and auth_level
3768         auth_info = self.generate_auth(auth_type=dcerpc.DCERPC_AUTH_TYPE_KRB5,
3769                                        auth_level=auth_level,
3770                                        auth_context_id=auth_context_id,
3771                                        auth_blob=to_server)
3772         req = self.generate_alter(call_id=0,
3773                                   ctx_list=[ctx1b],
3774                                   assoc_group_id=rep.u.assoc_group_id,
3775                                   auth_info=auth_info)
3776         self.send_pdu(req)
3777         rep = self.recv_pdu()
3778         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
3779                         pfc_flags=req.pfc_flags |
3780                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
3781                         auth_length=0)
3782         self.assertNotEquals(rep.u.alloc_hint, 0)
3783         self.assertEqual(rep.u.context_id, 0)
3784         self.assertEqual(rep.u.cancel_count, 0)
3785         self.assertEqual(rep.u.flags, 0)
3786         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
3787         self.assertEqual(rep.u.reserved, 0)
3788         self.assertEqual(len(rep.u.error_and_verifier), 0)
3789
3790         # wait for a disconnect
3791         rep = self.recv_pdu()
3792         self.assertIsNone(rep)
3793         self.assertNotConnected()
3794
3795     def test_spnego_change_auth_type3(self):
3796         ndr32 = base.transfer_syntax_ndr()
3797         ndr64 = base.transfer_syntax_ndr64()
3798
3799         tsf1_list = [ndr32]
3800         ctx1 = dcerpc.ctx_list()
3801         ctx1.context_id = 1
3802         ctx1.num_transfer_syntaxes = len(tsf1_list)
3803         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3804         ctx1.transfer_syntaxes = tsf1_list
3805
3806         tsf1b_list = [ndr32, ndr64]
3807         ctx1b = dcerpc.ctx_list()
3808         ctx1b.context_id = 1
3809         ctx1b.num_transfer_syntaxes = len(tsf1b_list)
3810         ctx1b.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3811         ctx1b.transfer_syntaxes = tsf1b_list
3812
3813         c = self.get_anon_creds()
3814         g = gensec.Security.start_client(self.settings)
3815         g.set_credentials(c)
3816         g.want_feature(gensec.FEATURE_DCE_STYLE)
3817         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
3818         auth_level = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
3819         auth_context_id = 2
3820         g.start_mech_by_authtype(auth_type, auth_level)
3821         from_server = b""
3822         (finished, to_server) = g.update(from_server)
3823         self.assertFalse(finished)
3824
3825         auth_info = self.generate_auth(auth_type=auth_type,
3826                                        auth_level=auth_level,
3827                                        auth_context_id=auth_context_id,
3828                                        auth_blob=to_server)
3829         req = self.generate_bind(call_id=0,
3830                                  ctx_list=[ctx1],
3831                                  auth_info=auth_info)
3832         self.send_pdu(req)
3833         rep = self.recv_pdu()
3834         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
3835         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3836         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3837         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
3838         self.assertEqual(rep.u.secondary_address_size, 4)
3839         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
3840         self.assertPadding(rep.u._pad1, 2)
3841         self.assertEqual(rep.u.num_results, 1)
3842         self.assertEqual(rep.u.ctx_list[0].result,
3843                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3844         self.assertEqual(rep.u.ctx_list[0].reason,
3845                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3846         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3847         self.assertNotEquals(len(rep.u.auth_info), 0)
3848         a = self.parse_auth(rep.u.auth_info)
3849
3850         from_server = a.credentials
3851         (finished, to_server) = g.update(from_server)
3852         self.assertFalse(finished)
3853
3854         # We change ctx_list and auth_level
3855         auth_info = self.generate_auth(auth_type=dcerpc.DCERPC_AUTH_TYPE_NONE,
3856                                        auth_level=auth_level,
3857                                        auth_context_id=auth_context_id,
3858                                        auth_blob=to_server)
3859         req = self.generate_alter(call_id=0,
3860                                   ctx_list=[ctx1b],
3861                                   assoc_group_id=rep.u.assoc_group_id,
3862                                   auth_info=auth_info)
3863         self.send_pdu(req)
3864         rep = self.recv_pdu()
3865         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
3866                         pfc_flags=req.pfc_flags |
3867                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
3868                         auth_length=0)
3869         self.assertNotEquals(rep.u.alloc_hint, 0)
3870         self.assertEqual(rep.u.context_id, 0)
3871         self.assertEqual(rep.u.cancel_count, 0)
3872         self.assertEqual(rep.u.flags, 0)
3873         self.assertEqual(rep.u.status, dcerpc.DCERPC_FAULT_ACCESS_DENIED)
3874         self.assertEqual(rep.u.reserved, 0)
3875         self.assertEqual(len(rep.u.error_and_verifier), 0)
3876
3877         # wait for a disconnect
3878         rep = self.recv_pdu()
3879         self.assertIsNone(rep)
3880         self.assertNotConnected()
3881
3882     def test_spnego_auth_pad_ok(self):
3883         ndr32 = base.transfer_syntax_ndr()
3884
3885         tsf1_list = [ndr32]
3886         ctx1 = dcerpc.ctx_list()
3887         ctx1.context_id = 1
3888         ctx1.num_transfer_syntaxes = len(tsf1_list)
3889         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
3890         ctx1.transfer_syntaxes = tsf1_list
3891         ctx_list = [ctx1]
3892
3893         c = self.get_anon_creds()
3894         g = gensec.Security.start_client(self.settings)
3895         g.set_credentials(c)
3896         g.want_feature(gensec.FEATURE_DCE_STYLE)
3897         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
3898         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
3899         auth_context_id = 2
3900         g.start_mech_by_authtype(auth_type, auth_level)
3901         from_server = b""
3902         (finished, to_server) = g.update(from_server)
3903         self.assertFalse(finished)
3904
3905         auth_info = self.generate_auth(auth_type=auth_type,
3906                                        auth_level=auth_level,
3907                                        auth_context_id=auth_context_id,
3908                                        auth_blob=to_server)
3909
3910         req = self.generate_bind(call_id=0,
3911                                  ctx_list=ctx_list,
3912                                  auth_info=auth_info)
3913         req_pdu = samba.ndr.ndr_pack(req)
3914
3915         auth_pad_ok = len(req_pdu)
3916         auth_pad_ok -= dcerpc.DCERPC_REQUEST_LENGTH
3917         auth_pad_ok -= dcerpc.DCERPC_AUTH_TRAILER_LENGTH
3918         auth_pad_ok -= len(to_server)
3919
3920         auth_info = self.generate_auth(auth_type=auth_type,
3921                                        auth_level=auth_level,
3922                                        auth_context_id=auth_context_id,
3923                                        auth_pad_length=auth_pad_ok,
3924                                        auth_blob=to_server)
3925
3926         req = self.generate_bind(call_id=0,
3927                                  ctx_list=ctx_list,
3928                                  auth_info=auth_info)
3929         self.send_pdu(req)
3930         rep = self.recv_pdu()
3931         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
3932         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3933         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3934         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
3935         self.assertEqual(rep.u.secondary_address_size, 4)
3936         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
3937         self.assertPadding(rep.u._pad1, 2)
3938         self.assertEqual(rep.u.num_results, 1)
3939         self.assertEqual(rep.u.ctx_list[0].result,
3940                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3941         self.assertEqual(rep.u.ctx_list[0].reason,
3942                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3943         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3944         self.assertNotEquals(len(rep.u.auth_info), 0)
3945         a = self.parse_auth(rep.u.auth_info)
3946
3947         from_server = a.credentials
3948         (finished, to_server) = g.update(from_server)
3949         self.assertFalse(finished)
3950
3951         auth_info = self.generate_auth(auth_type=auth_type,
3952                                        auth_level=auth_level,
3953                                        auth_context_id=auth_context_id,
3954                                        auth_blob=to_server)
3955         req = self.generate_alter(call_id=0,
3956                                   ctx_list=ctx_list,
3957                                   assoc_group_id=rep.u.assoc_group_id,
3958                                   auth_info=auth_info)
3959         req_pdu = samba.ndr.ndr_pack(req)
3960
3961         auth_pad_ok = len(req_pdu)
3962         auth_pad_ok -= dcerpc.DCERPC_REQUEST_LENGTH
3963         auth_pad_ok -= dcerpc.DCERPC_AUTH_TRAILER_LENGTH
3964         auth_pad_ok -= len(to_server)
3965         auth_info = self.generate_auth(auth_type=auth_type,
3966                                        auth_level=auth_level,
3967                                        auth_context_id=auth_context_id,
3968                                        auth_pad_length=auth_pad_ok,
3969                                        auth_blob=to_server)
3970         req = self.generate_alter(call_id=0,
3971                                   ctx_list=ctx_list,
3972                                   assoc_group_id=rep.u.assoc_group_id,
3973                                   auth_info=auth_info)
3974         self.send_pdu(req)
3975         rep = self.recv_pdu()
3976         self.verify_pdu(rep, dcerpc.DCERPC_PKT_ALTER_RESP, req.call_id)
3977         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
3978         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
3979         self.assertEqual(rep.u.assoc_group_id, req.u.assoc_group_id)
3980         self.assertEqual(rep.u.secondary_address_size, 0)
3981         self.assertPadding(rep.u._pad1, 2)
3982         self.assertEqual(rep.u.num_results, 1)
3983         self.assertEqual(rep.u.ctx_list[0].result,
3984                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
3985         self.assertEqual(rep.u.ctx_list[0].reason,
3986                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
3987         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
3988         self.assertNotEquals(len(rep.u.auth_info), 0)
3989         a = self.parse_auth(rep.u.auth_info)
3990
3991         from_server = a.credentials
3992         (finished, to_server) = g.update(from_server)
3993         self.assertTrue(finished)
3994
3995         # And now try a request without auth_info
3996         req = self.generate_request(call_id=2,
3997                                     context_id=ctx1.context_id,
3998                                     opnum=0,
3999                                     stub=b"")
4000         self.send_pdu(req)
4001         rep = self.recv_pdu()
4002         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
4003                         auth_length=0)
4004         self.assertNotEquals(rep.u.alloc_hint, 0)
4005         self.assertEqual(rep.u.context_id, req.u.context_id)
4006         self.assertEqual(rep.u.cancel_count, 0)
4007         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
4008
4009         # Now a request with auth_info DCERPC_AUTH_LEVEL_CONNECT
4010         auth_info = self.generate_auth(auth_type=auth_type,
4011                                        auth_level=auth_level,
4012                                        auth_context_id=auth_context_id,
4013                                        auth_blob=b"\x01" + b"\x00" * 15)
4014         req = self.generate_request(call_id=3,
4015                                     context_id=ctx1.context_id,
4016                                     opnum=0,
4017                                     stub=b"",
4018                                     auth_info=auth_info)
4019         self.send_pdu(req)
4020         rep = self.recv_pdu()
4021         # We don't get an auth_info back
4022         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
4023                         auth_length=0)
4024         self.assertNotEquals(rep.u.alloc_hint, 0)
4025         self.assertEqual(rep.u.context_id, req.u.context_id)
4026         self.assertEqual(rep.u.cancel_count, 0)
4027         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
4028
4029         self._disconnect("disconnect")
4030         self.assertNotConnected()
4031
4032     def test_spnego_auth_pad_fail_bind(self):
4033         ndr32 = base.transfer_syntax_ndr()
4034
4035         tsf1_list = [ndr32]
4036         ctx1 = dcerpc.ctx_list()
4037         ctx1.context_id = 1
4038         ctx1.num_transfer_syntaxes = len(tsf1_list)
4039         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
4040         ctx1.transfer_syntaxes = tsf1_list
4041         ctx_list = [ctx1]
4042
4043         c = self.get_anon_creds()
4044         g = gensec.Security.start_client(self.settings)
4045         g.set_credentials(c)
4046         g.want_feature(gensec.FEATURE_DCE_STYLE)
4047         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
4048         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
4049         auth_context_id = 2
4050         g.start_mech_by_authtype(auth_type, auth_level)
4051         from_server = b""
4052         (finished, to_server) = g.update(from_server)
4053         self.assertFalse(finished)
4054
4055         auth_info = self.generate_auth(auth_type=auth_type,
4056                                        auth_level=auth_level,
4057                                        auth_context_id=auth_context_id,
4058                                        auth_blob=to_server)
4059
4060         req = self.generate_bind(call_id=0,
4061                                  ctx_list=ctx_list,
4062                                  auth_info=auth_info)
4063         req_pdu = samba.ndr.ndr_pack(req)
4064
4065         auth_pad_ok = len(req_pdu)
4066         auth_pad_ok -= dcerpc.DCERPC_REQUEST_LENGTH
4067         auth_pad_ok -= dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4068         auth_pad_ok -= len(to_server)
4069         auth_pad_bad = auth_pad_ok + 1
4070         auth_info = self.generate_auth(auth_type=auth_type,
4071                                        auth_level=auth_level,
4072                                        auth_context_id=auth_context_id,
4073                                        auth_pad_length=auth_pad_bad,
4074                                        auth_blob=to_server)
4075
4076         req = self.generate_bind(call_id=0,
4077                                  ctx_list=ctx_list,
4078                                  auth_info=auth_info)
4079         self.send_pdu(req)
4080         rep = self.recv_pdu()
4081         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_NAK, req.call_id,
4082                         auth_length=0)
4083         self.assertEqual(rep.u.reject_reason,
4084                           dcerpc.DCERPC_BIND_NAK_REASON_PROTOCOL_VERSION_NOT_SUPPORTED)
4085         self.assertEqual(rep.u.num_versions, 1)
4086         self.assertEqual(rep.u.versions[0].rpc_vers, req.rpc_vers)
4087         self.assertEqual(rep.u.versions[0].rpc_vers_minor, req.rpc_vers_minor)
4088         self.assertEqual(len(rep.u._pad), 3)
4089         self.assertEqual(rep.u._pad, b'\0' * 3)
4090
4091         # wait for a disconnect
4092         rep = self.recv_pdu()
4093         self.assertIsNone(rep)
4094         self.assertNotConnected()
4095
4096     def test_spnego_auth_pad_fail_alter(self):
4097         ndr32 = base.transfer_syntax_ndr()
4098
4099         tsf1_list = [ndr32]
4100         ctx1 = dcerpc.ctx_list()
4101         ctx1.context_id = 1
4102         ctx1.num_transfer_syntaxes = len(tsf1_list)
4103         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
4104         ctx1.transfer_syntaxes = tsf1_list
4105         ctx_list = [ctx1]
4106
4107         c = self.get_anon_creds()
4108         g = gensec.Security.start_client(self.settings)
4109         g.set_credentials(c)
4110         g.want_feature(gensec.FEATURE_DCE_STYLE)
4111         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
4112         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
4113         auth_context_id = 2
4114         g.start_mech_by_authtype(auth_type, auth_level)
4115         from_server = b""
4116         (finished, to_server) = g.update(from_server)
4117         self.assertFalse(finished)
4118
4119         auth_info = self.generate_auth(auth_type=auth_type,
4120                                        auth_level=auth_level,
4121                                        auth_context_id=auth_context_id,
4122                                        auth_blob=to_server)
4123
4124         req = self.generate_bind(call_id=0,
4125                                  ctx_list=ctx_list,
4126                                  auth_info=auth_info)
4127         req_pdu = samba.ndr.ndr_pack(req)
4128
4129         auth_pad_ok = len(req_pdu)
4130         auth_pad_ok -= dcerpc.DCERPC_REQUEST_LENGTH
4131         auth_pad_ok -= dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4132         auth_pad_ok -= len(to_server)
4133
4134         auth_info = self.generate_auth(auth_type=auth_type,
4135                                        auth_level=auth_level,
4136                                        auth_context_id=auth_context_id,
4137                                        auth_pad_length=auth_pad_ok,
4138                                        auth_blob=to_server)
4139
4140         req = self.generate_bind(call_id=0,
4141                                  ctx_list=ctx_list,
4142                                  auth_info=auth_info)
4143         self.send_pdu(req)
4144         rep = self.recv_pdu()
4145         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
4146         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
4147         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
4148         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
4149         self.assertEqual(rep.u.secondary_address_size, 4)
4150         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
4151         self.assertPadding(rep.u._pad1, 2)
4152         self.assertEqual(rep.u.num_results, 1)
4153         self.assertEqual(rep.u.ctx_list[0].result,
4154                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
4155         self.assertEqual(rep.u.ctx_list[0].reason,
4156                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
4157         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
4158         self.assertNotEquals(len(rep.u.auth_info), 0)
4159         a = self.parse_auth(rep.u.auth_info)
4160
4161         from_server = a.credentials
4162         (finished, to_server) = g.update(from_server)
4163         self.assertFalse(finished)
4164
4165         auth_info = self.generate_auth(auth_type=auth_type,
4166                                        auth_level=auth_level,
4167                                        auth_context_id=auth_context_id,
4168                                        auth_blob=to_server)
4169         req = self.generate_alter(call_id=0,
4170                                   ctx_list=ctx_list,
4171                                   assoc_group_id=rep.u.assoc_group_id,
4172                                   auth_info=auth_info)
4173         req_pdu = samba.ndr.ndr_pack(req)
4174
4175         auth_pad_ok = len(req_pdu)
4176         auth_pad_ok -= dcerpc.DCERPC_REQUEST_LENGTH
4177         auth_pad_ok -= dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4178         auth_pad_ok -= len(to_server)
4179         auth_pad_bad = auth_pad_ok + 1
4180         auth_info = self.generate_auth(auth_type=auth_type,
4181                                        auth_level=auth_level,
4182                                        auth_context_id=auth_context_id,
4183                                        auth_pad_length=auth_pad_bad,
4184                                        auth_blob=to_server)
4185         req = self.generate_alter(call_id=0,
4186                                   ctx_list=ctx_list,
4187                                   assoc_group_id=rep.u.assoc_group_id,
4188                                   auth_info=auth_info)
4189         self.send_pdu(req)
4190         rep = self.recv_pdu()
4191         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
4192                         pfc_flags=req.pfc_flags |
4193                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
4194                         auth_length=0)
4195         self.assertNotEquals(rep.u.alloc_hint, 0)
4196         self.assertEqual(rep.u.context_id, 0)
4197         self.assertEqual(rep.u.cancel_count, 0)
4198         self.assertEqual(rep.u.flags, 0)
4199         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_PROTO_ERROR)
4200         self.assertEqual(rep.u.reserved, 0)
4201         self.assertEqual(len(rep.u.error_and_verifier), 0)
4202
4203         # wait for a disconnect
4204         rep = self.recv_pdu()
4205         self.assertIsNone(rep)
4206         self.assertNotConnected()
4207
4208     def test_ntlmssp_auth_pad_ok(self):
4209         ndr32 = base.transfer_syntax_ndr()
4210
4211         tsf1_list = [ndr32]
4212         ctx1 = dcerpc.ctx_list()
4213         ctx1.context_id = 1
4214         ctx1.num_transfer_syntaxes = len(tsf1_list)
4215         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
4216         ctx1.transfer_syntaxes = tsf1_list
4217         ctx_list = [ctx1]
4218
4219         c = self.get_anon_creds()
4220         g = gensec.Security.start_client(self.settings)
4221         g.set_credentials(c)
4222         g.want_feature(gensec.FEATURE_DCE_STYLE)
4223         auth_type = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
4224         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
4225         auth_context_id = 2
4226         g.start_mech_by_authtype(auth_type, auth_level)
4227         from_server = b""
4228         (finished, to_server) = g.update(from_server)
4229         self.assertFalse(finished)
4230
4231         auth_info = self.generate_auth(auth_type=auth_type,
4232                                        auth_level=auth_level,
4233                                        auth_context_id=auth_context_id,
4234                                        auth_blob=to_server)
4235
4236         req = self.generate_bind(call_id=0,
4237                                  ctx_list=ctx_list,
4238                                  auth_info=auth_info)
4239         req_pdu = samba.ndr.ndr_pack(req)
4240
4241         auth_pad_ok = len(req_pdu)
4242         auth_pad_ok -= dcerpc.DCERPC_REQUEST_LENGTH
4243         auth_pad_ok -= dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4244         auth_pad_ok -= len(to_server)
4245
4246         auth_info = self.generate_auth(auth_type=auth_type,
4247                                        auth_level=auth_level,
4248                                        auth_context_id=auth_context_id,
4249                                        auth_pad_length=auth_pad_ok,
4250                                        auth_blob=to_server)
4251
4252         req = self.generate_bind(call_id=0,
4253                                  ctx_list=ctx_list,
4254                                  auth_info=auth_info)
4255         self.send_pdu(req)
4256         rep = self.recv_pdu()
4257         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
4258         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
4259         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
4260         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
4261         self.assertEqual(rep.u.secondary_address_size, 4)
4262         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
4263         self.assertPadding(rep.u._pad1, 2)
4264         self.assertEqual(rep.u.num_results, 1)
4265         self.assertEqual(rep.u.ctx_list[0].result,
4266                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
4267         self.assertEqual(rep.u.ctx_list[0].reason,
4268                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
4269         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
4270         self.assertNotEquals(len(rep.u.auth_info), 0)
4271         a = self.parse_auth(rep.u.auth_info)
4272
4273         from_server = a.credentials
4274         (finished, to_server) = g.update(from_server)
4275         self.assertTrue(finished)
4276
4277         auth_pad_ok = 0
4278         auth_info = self.generate_auth(auth_type=auth_type,
4279                                        auth_level=auth_level,
4280                                        auth_context_id=auth_context_id,
4281                                        auth_pad_length=auth_pad_ok,
4282                                        auth_blob=to_server)
4283         req = self.generate_auth3(call_id=0,
4284                                   auth_info=auth_info)
4285         self.send_pdu(req)
4286         rep = self.recv_pdu(timeout=0.01)
4287         self.assertIsNone(rep)
4288         self.assertIsConnected()
4289
4290         # And now try a request without auth_info
4291         req = self.generate_request(call_id=2,
4292                                     context_id=ctx1.context_id,
4293                                     opnum=0,
4294                                     stub=b"")
4295         self.send_pdu(req)
4296         rep = self.recv_pdu()
4297         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
4298                         auth_length=0)
4299         self.assertNotEquals(rep.u.alloc_hint, 0)
4300         self.assertEqual(rep.u.context_id, req.u.context_id)
4301         self.assertEqual(rep.u.cancel_count, 0)
4302         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
4303
4304         # Now a request with auth_info DCERPC_AUTH_LEVEL_CONNECT
4305         auth_info = self.generate_auth(auth_type=auth_type,
4306                                        auth_level=auth_level,
4307                                        auth_context_id=auth_context_id,
4308                                        auth_blob=b"\x01" + b"\x00" * 15)
4309         req = self.generate_request(call_id=3,
4310                                     context_id=ctx1.context_id,
4311                                     opnum=0,
4312                                     stub=b"",
4313                                     auth_info=auth_info)
4314         self.send_pdu(req)
4315         rep = self.recv_pdu()
4316         # We don't get an auth_info back
4317         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
4318                         auth_length=0)
4319         self.assertNotEquals(rep.u.alloc_hint, 0)
4320         self.assertEqual(rep.u.context_id, req.u.context_id)
4321         self.assertEqual(rep.u.cancel_count, 0)
4322         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
4323
4324         self._disconnect("disconnect")
4325         self.assertNotConnected()
4326
4327     def test_ntlmssp_auth_pad_fail_auth3(self):
4328         ndr32 = base.transfer_syntax_ndr()
4329
4330         tsf1_list = [ndr32]
4331         ctx1 = dcerpc.ctx_list()
4332         ctx1.context_id = 1
4333         ctx1.num_transfer_syntaxes = len(tsf1_list)
4334         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
4335         ctx1.transfer_syntaxes = tsf1_list
4336         ctx_list = [ctx1]
4337
4338         c = self.get_anon_creds()
4339         g = gensec.Security.start_client(self.settings)
4340         g.set_credentials(c)
4341         g.want_feature(gensec.FEATURE_DCE_STYLE)
4342         auth_type = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
4343         auth_level = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
4344         auth_context_id = 2
4345         g.start_mech_by_authtype(auth_type, auth_level)
4346         from_server = b""
4347         (finished, to_server) = g.update(from_server)
4348         self.assertFalse(finished)
4349
4350         auth_info = self.generate_auth(auth_type=auth_type,
4351                                        auth_level=auth_level,
4352                                        auth_context_id=auth_context_id,
4353                                        auth_blob=to_server)
4354
4355         req = self.generate_bind(call_id=0,
4356                                  ctx_list=ctx_list,
4357                                  auth_info=auth_info)
4358         req_pdu = samba.ndr.ndr_pack(req)
4359
4360         auth_pad_ok = len(req_pdu)
4361         auth_pad_ok -= dcerpc.DCERPC_REQUEST_LENGTH
4362         auth_pad_ok -= dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4363         auth_pad_ok -= len(to_server)
4364
4365         auth_info = self.generate_auth(auth_type=auth_type,
4366                                        auth_level=auth_level,
4367                                        auth_context_id=auth_context_id,
4368                                        auth_pad_length=auth_pad_ok,
4369                                        auth_blob=to_server)
4370
4371         req = self.generate_bind(call_id=0,
4372                                  ctx_list=ctx_list,
4373                                  auth_info=auth_info)
4374         self.send_pdu(req)
4375         rep = self.recv_pdu()
4376         self.verify_pdu(rep, dcerpc.DCERPC_PKT_BIND_ACK, req.call_id)
4377         self.assertEqual(rep.u.max_xmit_frag, req.u.max_xmit_frag)
4378         self.assertEqual(rep.u.max_recv_frag, req.u.max_recv_frag)
4379         self.assertNotEquals(rep.u.assoc_group_id, req.u.assoc_group_id)
4380         self.assertEqual(rep.u.secondary_address_size, 4)
4381         self.assertEqual(rep.u.secondary_address, "%d" % self.tcp_port)
4382         self.assertPadding(rep.u._pad1, 2)
4383         self.assertEqual(rep.u.num_results, 1)
4384         self.assertEqual(rep.u.ctx_list[0].result,
4385                           dcerpc.DCERPC_BIND_ACK_RESULT_ACCEPTANCE)
4386         self.assertEqual(rep.u.ctx_list[0].reason,
4387                           dcerpc.DCERPC_BIND_ACK_REASON_NOT_SPECIFIED)
4388         self.assertNDRSyntaxEquals(rep.u.ctx_list[0].syntax, ndr32)
4389         self.assertNotEquals(len(rep.u.auth_info), 0)
4390         a = self.parse_auth(rep.u.auth_info)
4391
4392         from_server = a.credentials
4393         (finished, to_server) = g.update(from_server)
4394         self.assertTrue(finished)
4395
4396         auth_pad_bad = 1
4397         auth_info = self.generate_auth(auth_type=auth_type,
4398                                        auth_level=auth_level,
4399                                        auth_context_id=auth_context_id,
4400                                        auth_pad_length=auth_pad_bad,
4401                                        auth_blob=to_server)
4402         req = self.generate_auth3(call_id=0,
4403                                   auth_info=auth_info)
4404         self.send_pdu(req)
4405         rep = self.recv_pdu()
4406         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
4407                         pfc_flags=req.pfc_flags |
4408                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
4409                         auth_length=0)
4410         self.assertNotEquals(rep.u.alloc_hint, 0)
4411         self.assertEqual(rep.u.context_id, 0)
4412         self.assertEqual(rep.u.cancel_count, 0)
4413         self.assertEqual(rep.u.flags, 0)
4414         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_FAULT_REMOTE_NO_MEMORY)
4415         self.assertEqual(rep.u.reserved, 0)
4416         self.assertEqual(len(rep.u.error_and_verifier), 0)
4417
4418         # wait for a disconnect
4419         rep = self.recv_pdu()
4420         self.assertIsNone(rep)
4421         self.assertNotConnected()
4422
4423     def _test_auth_bind_auth_level(self, auth_type, auth_level, auth_context_id, ctx,
4424                                    g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY,
4425                                    hdr_signing=False,
4426                                    alter_fault=None):
4427         creds = self.get_user_creds()
4428         auth_context = self.get_auth_context_creds(creds=creds,
4429                                                    auth_type=auth_type,
4430                                                    auth_level=auth_level,
4431                                                    auth_context_id=auth_context_id,
4432                                                    g_auth_level=g_auth_level,
4433                                                    hdr_signing=hdr_signing)
4434         if auth_context is None:
4435             return None
4436         ack = self.do_generic_bind(ctx=ctx,
4437                                    auth_context=auth_context,
4438                                    alter_fault=alter_fault)
4439         if ack is None:
4440             return None
4441         return auth_context
4442
4443     def _test_spnego_level_bind_nak(self, auth_level,
4444                                     reason=dcerpc.DCERPC_BIND_NAK_REASON_INVALID_CHECKSUM):
4445         c = self.get_user_creds()
4446         return self._test_auth_type_level_bind_nak(auth_type=dcerpc.DCERPC_AUTH_TYPE_SPNEGO,
4447                                                    auth_level=auth_level, creds=c, reason=reason)
4448
4449     def _test_spnego_level_bind(self, auth_level,
4450                                 g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY,
4451                                 alter_fault=None,
4452                                 request_fault=None,
4453                                 response_fault_flags=0):
4454         ndr32 = base.transfer_syntax_ndr()
4455
4456         tsf1_list = [ndr32]
4457         ctx1 = dcerpc.ctx_list()
4458         ctx1.context_id = 0x1001
4459         ctx1.num_transfer_syntaxes = len(tsf1_list)
4460         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
4461         ctx1.transfer_syntaxes = tsf1_list
4462
4463         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
4464         auth_context_id = 2
4465
4466         auth_context = self._test_auth_bind_auth_level(auth_type=auth_type,
4467                                               auth_level=auth_level,
4468                                               auth_context_id=auth_context_id,
4469                                               ctx=ctx1,
4470                                               g_auth_level=g_auth_level,
4471                                               alter_fault=alter_fault)
4472         if request_fault is None:
4473             return
4474
4475         self.assertIsNotNone(auth_context)
4476         g = auth_context["gensec"]
4477         self.assertIsNotNone(g)
4478
4479         stub_bin = b'\x00' * 17
4480         mod_len = len(stub_bin) % dcerpc.DCERPC_AUTH_PAD_ALIGNMENT
4481         auth_pad_length = 0
4482         if mod_len > 0:
4483             auth_pad_length = dcerpc.DCERPC_AUTH_PAD_ALIGNMENT - mod_len
4484         stub_bin += b'\x00' * auth_pad_length
4485
4486         if g_auth_level >= dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY:
4487             sig_size = g.sig_size(len(stub_bin))
4488         else:
4489             sig_size = 16
4490         zero_sig = b"\x00" * sig_size
4491
4492         auth_info = self.generate_auth(auth_type=auth_type,
4493                                        auth_level=auth_level,
4494                                        auth_pad_length=auth_pad_length,
4495                                        auth_context_id=auth_context_id,
4496                                        auth_blob=zero_sig)
4497         req = self.generate_request(call_id=4,
4498                                     context_id=ctx1.context_id,
4499                                     opnum=0xffff,
4500                                     stub=stub_bin,
4501                                     auth_info=auth_info)
4502         if g_auth_level >= dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY:
4503             req_blob = samba.ndr.ndr_pack(req)
4504             ofs_stub = dcerpc.DCERPC_REQUEST_LENGTH
4505             ofs_sig = len(req_blob) - req.auth_length
4506             ofs_trailer = ofs_sig - dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4507             req_data = req_blob[ofs_stub:ofs_trailer]
4508             req_whole = req_blob[0:ofs_sig]
4509             sig = g.sign_packet(req_data, req_whole)
4510             auth_info = self.generate_auth(auth_type=auth_type,
4511                                            auth_level=auth_level,
4512                                            auth_pad_length=auth_pad_length,
4513                                            auth_context_id=auth_context_id,
4514                                            auth_blob=sig)
4515             req = self.generate_request(call_id=4,
4516                                         context_id=ctx1.context_id,
4517                                         opnum=0xffff,
4518                                         stub=stub_bin,
4519                                         auth_info=auth_info)
4520         self.send_pdu(req)
4521         rep = self.recv_pdu()
4522         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
4523                         pfc_flags=req.pfc_flags | response_fault_flags,
4524                         auth_length=0)
4525         self.assertNotEquals(rep.u.alloc_hint, 0)
4526         self.assertEqual(rep.u.context_id, ctx1.context_id)
4527         self.assertEqual(rep.u.cancel_count, 0)
4528         self.assertEqual(rep.u.flags, 0)
4529         self.assertEqual(rep.u.status, request_fault)
4530         self.assertEqual(rep.u.reserved, 0)
4531         self.assertEqual(len(rep.u.error_and_verifier), 0)
4532
4533         if response_fault_flags & dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE:
4534             return
4535
4536         # wait for a disconnect
4537         rep = self.recv_pdu()
4538         self.assertIsNone(rep)
4539         self.assertNotConnected()
4540
4541     def test_spnego_none_bind(self):
4542         return self._test_spnego_level_bind_nak(dcerpc.DCERPC_AUTH_LEVEL_NONE,
4543                                                 reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
4544
4545     def test_spnego_call_bind(self):
4546         return self._test_spnego_level_bind_nak(dcerpc.DCERPC_AUTH_LEVEL_CALL,
4547                                                 reason=dcerpc.DCERPC_BIND_NAK_REASON_INVALID_CHECKSUM)
4548
4549     def test_spnego_0_bind(self):
4550         return self._test_spnego_level_bind_nak(0,
4551                                                 reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
4552
4553     def test_spnego_7_bind(self):
4554         return self._test_spnego_level_bind_nak(7,
4555                                                 reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
4556
4557     def test_spnego_255_bind(self):
4558         return self._test_spnego_level_bind_nak(255,
4559                                                 reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
4560
4561     def test_spnego_connect_bind_none(self):
4562         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_CONNECT,
4563                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_CONNECT)
4564
4565     def test_spnego_connect_bind_sign(self):
4566         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_CONNECT,
4567                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY)
4568
4569     def test_spnego_connect_bind_seal(self):
4570         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_CONNECT,
4571                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_PRIVACY)
4572
4573     def test_spnego_packet_bind_none(self):
4574         # DCERPC_AUTH_LEVEL_PACKET is handled as alias of
4575         # DCERPC_AUTH_LEVEL_INTEGRITY
4576         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_PACKET,
4577                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_CONNECT,
4578                                             request_fault=dcerpc.DCERPC_FAULT_SEC_PKG_ERROR)
4579
4580     def test_spnego_packet_bind_sign(self):
4581         # DCERPC_AUTH_LEVEL_PACKET is handled as alias of
4582         # DCERPC_AUTH_LEVEL_INTEGRITY
4583         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_PACKET,
4584                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY,
4585                                             request_fault=dcerpc.DCERPC_NCA_S_OP_RNG_ERROR,
4586                                             response_fault_flags=dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE)
4587
4588     def test_spnego_packet_bind_seal(self):
4589         # DCERPC_AUTH_LEVEL_PACKET is handled as alias of
4590         # DCERPC_AUTH_LEVEL_INTEGRITY
4591         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_PACKET,
4592                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_PRIVACY,
4593                                             request_fault=dcerpc.DCERPC_NCA_S_OP_RNG_ERROR,
4594                                             response_fault_flags=dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE)
4595
4596     def test_spnego_integrity_bind_none(self):
4597         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY,
4598                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_CONNECT,
4599                                             request_fault=dcerpc.DCERPC_FAULT_SEC_PKG_ERROR)
4600
4601     def test_spnego_integrity_bind_sign(self):
4602         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY,
4603                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY,
4604                                             request_fault=dcerpc.DCERPC_NCA_S_OP_RNG_ERROR,
4605                                             response_fault_flags=dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE)
4606
4607     def test_spnego_integrity_bind_seal(self):
4608         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY,
4609                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_PRIVACY,
4610                                             request_fault=dcerpc.DCERPC_NCA_S_OP_RNG_ERROR,
4611                                             response_fault_flags=dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE)
4612
4613     def test_spnego_privacy_bind_none(self):
4614         # This fails...
4615         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_PRIVACY,
4616                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_CONNECT,
4617                                             alter_fault=dcerpc.DCERPC_FAULT_SEC_PKG_ERROR)
4618
4619     def test_spnego_privacy_bind_sign(self):
4620         # This fails...
4621         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_PRIVACY,
4622                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY,
4623                                             alter_fault=dcerpc.DCERPC_FAULT_SEC_PKG_ERROR)
4624
4625     def test_spnego_privacy_bind_seal(self):
4626         return self._test_spnego_level_bind(auth_level=dcerpc.DCERPC_AUTH_LEVEL_PRIVACY,
4627                                             g_auth_level=dcerpc.DCERPC_AUTH_LEVEL_PRIVACY)
4628
4629     def _test_auth_signing_auth_level_request(self, auth_type, auth_level, hdr_sign=False):
4630         ndr32 = base.transfer_syntax_ndr()
4631
4632         tsf1_list = [ndr32]
4633         ctx1 = dcerpc.ctx_list()
4634         ctx1.context_id = 0x1001
4635         ctx1.num_transfer_syntaxes = len(tsf1_list)
4636         ctx1.abstract_syntax = samba.dcerpc.mgmt.abstract_syntax()
4637         ctx1.transfer_syntaxes = tsf1_list
4638         ctx_list = [ctx1]
4639
4640         auth_context_id = 2
4641
4642         auth_context = self._test_auth_bind_auth_level(auth_type=auth_type,
4643                                               auth_level=auth_level,
4644                                               auth_context_id=auth_context_id,
4645                                               hdr_signing=hdr_sign,
4646                                               ctx=ctx1)
4647         self.assertIsNotNone(auth_context)
4648         g = auth_context["gensec"]
4649         self.assertIsNotNone(g)
4650
4651         stub_bin = b'\x00' * 0
4652         mod_len = len(stub_bin) % dcerpc.DCERPC_AUTH_PAD_ALIGNMENT
4653         auth_pad_length = 0
4654         if mod_len > 0:
4655             auth_pad_length = dcerpc.DCERPC_AUTH_PAD_ALIGNMENT - mod_len
4656         stub_bin += b'\x00' * auth_pad_length
4657
4658         sig_size = g.sig_size(len(stub_bin))
4659         zero_sig = b"\x00" * sig_size
4660
4661         auth_info = self.generate_auth(auth_type=auth_type,
4662                                        auth_level=auth_level,
4663                                        auth_pad_length=auth_pad_length,
4664                                        auth_context_id=auth_context_id,
4665                                        auth_blob=zero_sig)
4666         req = self.generate_request(call_id=3,
4667                                     context_id=ctx1.context_id,
4668                                     opnum=0,
4669                                     stub=stub_bin,
4670                                     auth_info=auth_info)
4671         req_blob = samba.ndr.ndr_pack(req)
4672         ofs_stub = dcerpc.DCERPC_REQUEST_LENGTH
4673         ofs_sig = len(req_blob) - req.auth_length
4674         ofs_trailer = ofs_sig - dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4675         req_data = req_blob[ofs_stub:ofs_trailer]
4676         req_whole = req_blob[0:ofs_sig]
4677         sig = g.sign_packet(req_data, req_whole)
4678         auth_info = self.generate_auth(auth_type=auth_type,
4679                                        auth_level=auth_level,
4680                                        auth_pad_length=auth_pad_length,
4681                                        auth_context_id=auth_context_id,
4682                                        auth_blob=sig)
4683         req = self.generate_request(call_id=3,
4684                                     context_id=ctx1.context_id,
4685                                     opnum=0,
4686                                     stub=stub_bin,
4687                                     auth_info=auth_info)
4688         self.send_pdu(req)
4689         (rep, rep_blob) = self.recv_pdu_raw()
4690         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
4691                         auth_length=sig_size)
4692         self.assertNotEquals(rep.u.alloc_hint, 0)
4693         self.assertEqual(rep.u.context_id, req.u.context_id & 0xff)
4694         self.assertEqual(rep.u.cancel_count, 0)
4695         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
4696         self.assertEqual(rep.auth_length, sig_size)
4697
4698         ofs_stub = dcerpc.DCERPC_REQUEST_LENGTH
4699         ofs_sig = rep.frag_length - rep.auth_length
4700         ofs_trailer = ofs_sig - dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4701         rep_data = rep_blob[ofs_stub:ofs_trailer]
4702         rep_whole = rep_blob[0:ofs_sig]
4703         rep_sig = rep_blob[ofs_sig:]
4704         rep_auth_info_blob = rep_blob[ofs_trailer:]
4705
4706         rep_auth_info = self.parse_auth(rep_auth_info_blob)
4707         self.assertEqual(rep_auth_info.auth_type, auth_type)
4708         self.assertEqual(rep_auth_info.auth_level, auth_level)
4709         # mgmt_inq_if_ids() returns no fixed size results
4710         #self.assertEqual(rep_auth_info.auth_pad_length, 0)
4711         self.assertEqual(rep_auth_info.auth_reserved, 0)
4712         self.assertEqual(rep_auth_info.auth_context_id, auth_context_id)
4713         self.assertEqual(rep_auth_info.credentials, rep_sig)
4714
4715         g.check_packet(rep_data, rep_whole, rep_sig)
4716
4717         stub_bin = b'\x00' * 17
4718         mod_len = len(stub_bin) % dcerpc.DCERPC_AUTH_PAD_ALIGNMENT
4719         auth_pad_length = 0
4720         if mod_len > 0:
4721             auth_pad_length = dcerpc.DCERPC_AUTH_PAD_ALIGNMENT - mod_len
4722         stub_bin += b'\x00' * auth_pad_length
4723
4724         sig_size = g.sig_size(len(stub_bin))
4725         zero_sig = b"\x00" * sig_size
4726
4727         auth_info = self.generate_auth(auth_type=auth_type,
4728                                        auth_level=auth_level,
4729                                        auth_pad_length=auth_pad_length,
4730                                        auth_context_id=auth_context_id,
4731                                        auth_blob=zero_sig)
4732         req = self.generate_request(call_id=4,
4733                                     context_id=ctx1.context_id,
4734                                     opnum=0xffff,
4735                                     stub=stub_bin,
4736                                     auth_info=auth_info)
4737         req_blob = samba.ndr.ndr_pack(req)
4738         ofs_stub = dcerpc.DCERPC_REQUEST_LENGTH
4739         ofs_sig = len(req_blob) - req.auth_length
4740         ofs_trailer = ofs_sig - dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4741         req_data = req_blob[ofs_stub:ofs_trailer]
4742         req_whole = req_blob[0:ofs_sig]
4743         sig = g.sign_packet(req_data, req_whole)
4744         auth_info = self.generate_auth(auth_type=auth_type,
4745                                        auth_level=auth_level,
4746                                        auth_pad_length=auth_pad_length,
4747                                        auth_context_id=auth_context_id,
4748                                        auth_blob=sig)
4749         req = self.generate_request(call_id=4,
4750                                     context_id=ctx1.context_id,
4751                                     opnum=0xffff,
4752                                     stub=stub_bin,
4753                                     auth_info=auth_info)
4754         self.send_pdu(req)
4755         rep = self.recv_pdu()
4756         self.verify_pdu(rep, dcerpc.DCERPC_PKT_FAULT, req.call_id,
4757                         pfc_flags=req.pfc_flags |
4758                         dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
4759                         auth_length=0)
4760         self.assertNotEquals(rep.u.alloc_hint, 0)
4761         self.assertEqual(rep.u.context_id, ctx1.context_id)
4762         self.assertEqual(rep.u.cancel_count, 0)
4763         self.assertEqual(rep.u.flags, 0)
4764         self.assertEqual(rep.u.status, dcerpc.DCERPC_NCA_S_OP_RNG_ERROR)
4765         self.assertEqual(rep.u.reserved, 0)
4766         self.assertEqual(len(rep.u.error_and_verifier), 0)
4767
4768         stub_bin = b'\x00' * 8
4769         mod_len = len(stub_bin) % dcerpc.DCERPC_AUTH_PAD_ALIGNMENT
4770         auth_pad_length = 0
4771         if mod_len > 0:
4772             auth_pad_length = dcerpc.DCERPC_AUTH_PAD_ALIGNMENT - mod_len
4773         stub_bin += b'\x00' * auth_pad_length
4774
4775         sig_size = g.sig_size(len(stub_bin))
4776         zero_sig = b"\x00" * sig_size
4777
4778         auth_info = self.generate_auth(auth_type=auth_type,
4779                                        auth_level=auth_level,
4780                                        auth_pad_length=auth_pad_length,
4781                                        auth_context_id=auth_context_id,
4782                                        auth_blob=zero_sig)
4783         req = self.generate_request(call_id=5,
4784                                     context_id=ctx1.context_id,
4785                                     opnum=1,
4786                                     stub=stub_bin,
4787                                     auth_info=auth_info)
4788         req_blob = samba.ndr.ndr_pack(req)
4789         ofs_stub = dcerpc.DCERPC_REQUEST_LENGTH
4790         ofs_sig = len(req_blob) - req.auth_length
4791         ofs_trailer = ofs_sig - dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4792         req_data = req_blob[ofs_stub:ofs_trailer]
4793         req_whole = req_blob[0:ofs_sig]
4794         sig = g.sign_packet(req_data, req_whole)
4795         auth_info = self.generate_auth(auth_type=auth_type,
4796                                        auth_level=auth_level,
4797                                        auth_pad_length=auth_pad_length,
4798                                        auth_context_id=auth_context_id,
4799                                        auth_blob=sig)
4800         req = self.generate_request(call_id=5,
4801                                     context_id=ctx1.context_id,
4802                                     opnum=1,
4803                                     stub=stub_bin,
4804                                     auth_info=auth_info)
4805         self.send_pdu(req)
4806         (rep, rep_blob) = self.recv_pdu_raw()
4807         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
4808                         auth_length=sig_size)
4809         self.assertNotEquals(rep.u.alloc_hint, 0)
4810         self.assertEqual(rep.u.context_id, req.u.context_id & 0xff)
4811         self.assertEqual(rep.u.cancel_count, 0)
4812         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
4813         self.assertEqual(rep.auth_length, sig_size)
4814
4815         ofs_stub = dcerpc.DCERPC_REQUEST_LENGTH
4816         ofs_sig = rep.frag_length - rep.auth_length
4817         ofs_trailer = ofs_sig - dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4818         rep_data = rep_blob[ofs_stub:ofs_trailer]
4819         rep_whole = rep_blob[0:ofs_sig]
4820         rep_sig = rep_blob[ofs_sig:]
4821         rep_auth_info_blob = rep_blob[ofs_trailer:]
4822
4823         rep_auth_info = self.parse_auth(rep_auth_info_blob)
4824         self.assertEqual(rep_auth_info.auth_type, auth_type)
4825         self.assertEqual(rep_auth_info.auth_level, auth_level)
4826         self.assertEqual(rep_auth_info.auth_pad_length, 4)
4827         self.assertEqual(rep_auth_info.auth_reserved, 0)
4828         self.assertEqual(rep_auth_info.auth_context_id, auth_context_id)
4829         self.assertEqual(rep_auth_info.credentials, rep_sig)
4830
4831         g.check_packet(rep_data, rep_whole, rep_sig)
4832
4833         stub_bin = b'\x00' * 8
4834         mod_len = len(stub_bin) % dcerpc.DCERPC_AUTH_PAD_ALIGNMENT
4835         auth_pad_length = 0
4836         if mod_len > 0:
4837             auth_pad_length = dcerpc.DCERPC_AUTH_PAD_ALIGNMENT - mod_len
4838         stub_bin += b'\x00' * auth_pad_length
4839
4840         sig_size = g.sig_size(len(stub_bin))
4841         zero_sig = b"\x00" * sig_size
4842
4843         auth_info = self.generate_auth(auth_type=auth_type,
4844                                        auth_level=auth_level,
4845                                        auth_pad_length=auth_pad_length,
4846                                        auth_context_id=auth_context_id,
4847                                        auth_blob=zero_sig)
4848         req = self.generate_request(call_id=6,
4849                                     context_id=ctx1.context_id,
4850                                     opnum=3,
4851                                     stub=stub_bin,
4852                                     auth_info=auth_info)
4853         req_blob = samba.ndr.ndr_pack(req)
4854         ofs_stub = dcerpc.DCERPC_REQUEST_LENGTH
4855         ofs_sig = len(req_blob) - req.auth_length
4856         ofs_trailer = ofs_sig - dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4857         req_data = req_blob[ofs_stub:ofs_trailer]
4858         req_whole = req_blob[0:ofs_sig]
4859         sig = g.sign_packet(req_data, req_whole)
4860         auth_info = self.generate_auth(auth_type=auth_type,
4861                                        auth_level=auth_level,
4862                                        auth_pad_length=auth_pad_length,
4863                                        auth_context_id=auth_context_id,
4864                                        auth_blob=sig)
4865         req = self.generate_request(call_id=6,
4866                                     context_id=ctx1.context_id,
4867                                     opnum=3,
4868                                     stub=stub_bin,
4869                                     auth_info=auth_info)
4870         self.send_pdu(req)
4871         (rep, rep_blob) = self.recv_pdu_raw()
4872         self.verify_pdu(rep, dcerpc.DCERPC_PKT_RESPONSE, req.call_id,
4873                         auth_length=sig_size)
4874         self.assertNotEquals(rep.u.alloc_hint, 0)
4875         self.assertEqual(rep.u.context_id, req.u.context_id & 0xff)
4876         self.assertEqual(rep.u.cancel_count, 0)
4877         self.assertGreaterEqual(len(rep.u.stub_and_verifier), rep.u.alloc_hint)
4878         self.assertEqual(rep.auth_length, sig_size)
4879
4880         ofs_stub = dcerpc.DCERPC_REQUEST_LENGTH
4881         ofs_sig = rep.frag_length - rep.auth_length
4882         ofs_trailer = ofs_sig - dcerpc.DCERPC_AUTH_TRAILER_LENGTH
4883         rep_data = rep_blob[ofs_stub:ofs_trailer]
4884         rep_whole = rep_blob[0:ofs_sig]
4885         rep_sig = rep_blob[ofs_sig:]
4886         rep_auth_info_blob = rep_blob[ofs_trailer:]
4887
4888         rep_auth_info = self.parse_auth(rep_auth_info_blob)
4889         self.assertEqual(rep_auth_info.auth_type, auth_type)
4890         self.assertEqual(rep_auth_info.auth_level, auth_level)
4891         self.assertEqual(rep_auth_info.auth_pad_length, 12)
4892         self.assertEqual(rep_auth_info.auth_reserved, 0)
4893         self.assertEqual(rep_auth_info.auth_context_id, auth_context_id)
4894         self.assertEqual(rep_auth_info.credentials, rep_sig)
4895
4896         g.check_packet(rep_data, rep_whole, rep_sig)
4897
4898     def test_spnego_signing_packet(self):
4899         # DCERPC_AUTH_LEVEL_PACKET is handled as alias of
4900         # DCERPC_AUTH_LEVEL_INTEGRITY
4901         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_SPNEGO,
4902                                                           dcerpc.DCERPC_AUTH_LEVEL_PACKET)
4903
4904     def test_spnego_hdr_signing_packet(self):
4905         # DCERPC_AUTH_LEVEL_PACKET is handled as alias of
4906         # DCERPC_AUTH_LEVEL_INTEGRITY
4907         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_SPNEGO,
4908                                                           dcerpc.DCERPC_AUTH_LEVEL_PACKET,
4909                                                           hdr_sign=True)
4910
4911     def test_spnego_signing_integrity(self):
4912         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_SPNEGO,
4913                                                           dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY)
4914
4915     def test_spnego_hdr_signing_integrity(self):
4916         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_SPNEGO,
4917                                                           dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY,
4918                                                           hdr_sign=True)
4919
4920     def test_ntlm_signing_packet(self):
4921         # DCERPC_AUTH_LEVEL_PACKET is handled as alias of
4922         # DCERPC_AUTH_LEVEL_INTEGRITY
4923         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_NTLMSSP,
4924                                                           dcerpc.DCERPC_AUTH_LEVEL_PACKET)
4925
4926     def test_ntlm_hdr_signing_packet(self):
4927         # DCERPC_AUTH_LEVEL_PACKET is handled as alias of
4928         # DCERPC_AUTH_LEVEL_INTEGRITY
4929         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_NTLMSSP,
4930                                                           dcerpc.DCERPC_AUTH_LEVEL_PACKET,
4931                                                           hdr_sign=True)
4932
4933     def test_ntlm_signing_integrity(self):
4934         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_NTLMSSP,
4935                                                           dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY)
4936
4937     def test_ntlm_hdr_signing_integrity(self):
4938         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_NTLMSSP,
4939                                                           dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY,
4940                                                           hdr_sign=True)
4941
4942     def test_krb5_signing_packet(self):
4943         # DCERPC_AUTH_LEVEL_PACKET is handled as alias of
4944         # DCERPC_AUTH_LEVEL_INTEGRITY
4945         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_KRB5,
4946                                                           dcerpc.DCERPC_AUTH_LEVEL_PACKET)
4947
4948     def test_krb5_hdr_signing_packet(self):
4949         # DCERPC_AUTH_LEVEL_PACKET is handled as alias of
4950         # DCERPC_AUTH_LEVEL_INTEGRITY
4951         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_KRB5,
4952                                                           dcerpc.DCERPC_AUTH_LEVEL_PACKET,
4953                                                           hdr_sign=True)
4954
4955     def test_krb5_signing_integrity(self):
4956         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_KRB5,
4957                                                           dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY)
4958
4959     def test_krb5_hdr_signing_integrity(self):
4960         return self._test_auth_signing_auth_level_request(dcerpc.DCERPC_AUTH_TYPE_KRB5,
4961                                                           dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY,
4962                                                           hdr_sign=True)
4963
4964     def test_assoc_group_fail1(self):
4965         abstract = samba.dcerpc.mgmt.abstract_syntax()
4966         transfer = base.transfer_syntax_ndr()
4967
4968         tsf1_list = [transfer]
4969         ctx = samba.dcerpc.dcerpc.ctx_list()
4970         ctx.context_id = 1
4971         ctx.num_transfer_syntaxes = len(tsf1_list)
4972         ctx.abstract_syntax = abstract
4973         ctx.transfer_syntaxes = tsf1_list
4974
4975         ack = self.do_generic_bind(ctx=ctx, assoc_group_id=1,
4976                                    nak_reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
4977         return
4978
4979     def test_assoc_group_fail2(self):
4980         abstract = samba.dcerpc.mgmt.abstract_syntax()
4981         transfer = base.transfer_syntax_ndr()
4982
4983         tsf1_list = [transfer]
4984         ctx = samba.dcerpc.dcerpc.ctx_list()
4985         ctx.context_id = 1
4986         ctx.num_transfer_syntaxes = len(tsf1_list)
4987         ctx.abstract_syntax = abstract
4988         ctx.transfer_syntaxes = tsf1_list
4989
4990         ack = self.do_generic_bind(ctx=ctx)
4991
4992         self._disconnect("test_assoc_group_fail2")
4993         self.assertNotConnected()
4994         time.sleep(0.5)
4995         self.connect()
4996
4997         ack2 = self.do_generic_bind(ctx=ctx, assoc_group_id=ack.u.assoc_group_id,
4998                                     nak_reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
4999         return
5000
5001     def test_assoc_group_diff1(self):
5002         abstract = samba.dcerpc.mgmt.abstract_syntax()
5003         transfer = base.transfer_syntax_ndr()
5004
5005         (ctx1, ack1) = self.prepare_presentation(abstract, transfer,
5006                                                  context_id=1, return_ack=True)
5007
5008         conn2 = self.second_connection()
5009         (ctx2, ack2) = conn2.prepare_presentation(abstract, transfer,
5010                                                   context_id=2, return_ack=True)
5011         self.assertNotEqual(ack2.u.assoc_group_id, ack1.u.assoc_group_id)
5012
5013         conn2._disconnect("End of Test")
5014         return
5015
5016     def test_assoc_group_ok1(self):
5017         abstract = samba.dcerpc.mgmt.abstract_syntax()
5018         transfer = base.transfer_syntax_ndr()
5019
5020         (ctx1, ack1) = self.prepare_presentation(abstract, transfer,
5021                                                  context_id=1, return_ack=True)
5022
5023         conn2 = self.second_connection()
5024         (ctx2, ack2) = conn2.prepare_presentation(abstract, transfer,
5025                                                   assoc_group_id=ack1.u.assoc_group_id,
5026                                                   context_id=2, return_ack=True)
5027
5028         inq_if_ids = samba.dcerpc.mgmt.inq_if_ids()
5029         self.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids)
5030         conn2.do_single_request(call_id=1, ctx=ctx2, io=inq_if_ids)
5031
5032         conn2.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids,
5033                                 fault_pfc_flags=(
5034                                     samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_FIRST |
5035                                     samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_LAST |
5036                                     samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE),
5037                                 fault_status=dcerpc.DCERPC_NCA_S_UNKNOWN_IF,
5038                                 fault_context_id=0)
5039
5040         self.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids)
5041         conn2.do_single_request(call_id=1, ctx=ctx2, io=inq_if_ids)
5042         conn2._disconnect("End of Test")
5043         return
5044
5045     def test_assoc_group_ok2(self):
5046         abstract = samba.dcerpc.mgmt.abstract_syntax()
5047         transfer = base.transfer_syntax_ndr()
5048
5049         self.reconnect_smb_pipe(primary_address='\\pipe\\lsarpc',
5050                                 secondary_address='\\pipe\\lsass',
5051                                 transport_creds=self.get_user_creds())
5052         (ctx1, ack1) = self.prepare_presentation(abstract, transfer,
5053                                                  context_id=1, return_ack=True)
5054
5055         conn2 = self.second_connection()
5056         (ctx2, ack2) = conn2.prepare_presentation(abstract, transfer,
5057                                                   assoc_group_id=ack1.u.assoc_group_id,
5058                                                   context_id=2, return_ack=True)
5059
5060         inq_if_ids = samba.dcerpc.mgmt.inq_if_ids()
5061         self.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids)
5062         conn2.do_single_request(call_id=1, ctx=ctx2, io=inq_if_ids)
5063
5064         conn2.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids,
5065                                 fault_pfc_flags=(
5066                                     samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_FIRST |
5067                                     samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_LAST |
5068                                     samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE),
5069                                 fault_status=dcerpc.DCERPC_NCA_S_UNKNOWN_IF,
5070                                 fault_context_id=0)
5071
5072         self.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids)
5073         conn2.do_single_request(call_id=1, ctx=ctx2, io=inq_if_ids)
5074         conn2._disconnect("End of Test")
5075         return
5076
5077     def test_assoc_group_fail3(self):
5078         abstract = samba.dcerpc.mgmt.abstract_syntax()
5079         transfer = base.transfer_syntax_ndr()
5080
5081         (ctx1, ack1) = self.prepare_presentation(abstract, transfer,
5082                                                  context_id=1, return_ack=True)
5083
5084         # assoc groups are per transport
5085         connF = self.second_connection(primary_address="\\pipe\\lsarpc",
5086                                        secondary_address="\\pipe\\lsass",
5087                                        transport_creds=self.get_user_creds())
5088         tsfF_list = [transfer]
5089         ctxF = samba.dcerpc.dcerpc.ctx_list()
5090         ctxF.context_id = 0xF
5091         ctxF.num_transfer_syntaxes = len(tsfF_list)
5092         ctxF.abstract_syntax = abstract
5093         ctxF.transfer_syntaxes = tsfF_list
5094         ack = connF.do_generic_bind(ctx=ctxF, assoc_group_id=ack1.u.assoc_group_id,
5095                                     nak_reason=dcerpc.DCERPC_BIND_NAK_REASON_NOT_SPECIFIED)
5096         # wait for a disconnect
5097         rep = connF.recv_pdu()
5098         self.assertIsNone(rep)
5099         connF.assertNotConnected()
5100
5101         conn2 = self.second_connection()
5102         (ctx2, ack2) = conn2.prepare_presentation(abstract, transfer,
5103                                                   assoc_group_id=ack1.u.assoc_group_id,
5104                                                   context_id=2, return_ack=True)
5105
5106         inq_if_ids = samba.dcerpc.mgmt.inq_if_ids()
5107         self.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids)
5108         conn2.do_single_request(call_id=1, ctx=ctx2, io=inq_if_ids)
5109
5110         conn2.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids,
5111                                 fault_pfc_flags=(
5112                                     samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_FIRST |
5113                                     samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_LAST |
5114                                     samba.dcerpc.dcerpc.DCERPC_PFC_FLAG_DID_NOT_EXECUTE),
5115                                 fault_status=dcerpc.DCERPC_NCA_S_UNKNOWN_IF,
5116                                 fault_context_id=0)
5117
5118         self.do_single_request(call_id=1, ctx=ctx1, io=inq_if_ids)
5119         conn2.do_single_request(call_id=1, ctx=ctx2, io=inq_if_ids)
5120         conn2._disconnect("End of Test")
5121         return
5122
5123     def _test_krb5_hdr_sign_delayed1(self, do_upgrade):
5124         auth_type = dcerpc.DCERPC_AUTH_TYPE_KRB5
5125         auth_level = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
5126         auth_context_id = 1
5127
5128         creds = self.get_user_creds()
5129
5130         abstract = samba.dcerpc.mgmt.abstract_syntax()
5131         transfer = base.transfer_syntax_ndr()
5132
5133         tsf1_list = [transfer]
5134         ctx = samba.dcerpc.dcerpc.ctx_list()
5135         ctx.context_id = 1
5136         ctx.num_transfer_syntaxes = len(tsf1_list)
5137         ctx.abstract_syntax = abstract
5138         ctx.transfer_syntaxes = tsf1_list
5139
5140         auth_context = self.get_auth_context_creds(creds=creds,
5141                                                    auth_type=auth_type,
5142                                                    auth_level=auth_level,
5143                                                    auth_context_id=auth_context_id,
5144                                                    hdr_signing=False)
5145
5146         ack = self.do_generic_bind(call_id=1,
5147                                    ctx=ctx,
5148                                    auth_context=auth_context)
5149
5150         inq_if_ids = samba.dcerpc.mgmt.inq_if_ids()
5151         self.do_single_request(call_id=2, ctx=ctx, io=inq_if_ids,
5152                                auth_context=auth_context)
5153
5154         #
5155         # This is just an alter context without authentication
5156         # But it can turn on header signing for the whole connection
5157         #
5158         ack2 = self.do_generic_bind(call_id=3, ctx=ctx,
5159                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST |
5160                                     dcerpc.DCERPC_PFC_FLAG_LAST |
5161                                     dcerpc.DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN,
5162                                     assoc_group_id = ack.u.assoc_group_id,
5163                                     start_with_alter=True)
5164
5165         self.assertFalse(auth_context['hdr_signing'])
5166         if do_upgrade:
5167             auth_context['hdr_signing'] = True
5168             auth_context["gensec"].want_feature(gensec.FEATURE_SIGN_PKT_HEADER)
5169             fault_status=None
5170         else:
5171             fault_status=dcerpc.DCERPC_FAULT_SEC_PKG_ERROR
5172
5173         self.do_single_request(call_id=4, ctx=ctx, io=inq_if_ids,
5174                                auth_context=auth_context,
5175                                fault_status=fault_status)
5176
5177         if fault_status is not None:
5178             # wait for a disconnect
5179             rep = self.recv_pdu()
5180             self.assertIsNone(rep)
5181             self.assertNotConnected()
5182             return
5183
5184         self.do_single_request(call_id=5, ctx=ctx, io=inq_if_ids,
5185                                auth_context=auth_context)
5186         return
5187
5188     def test_krb5_hdr_sign_delayed1_ok1(self):
5189         return self._test_krb5_hdr_sign_delayed1(do_upgrade=True)
5190
5191     def test_krb5_hdr_sign_delayed1_fail1(self):
5192         return self._test_krb5_hdr_sign_delayed1(do_upgrade=False)
5193
5194     def _test_krb5_hdr_sign_delayed2(self, do_upgrade):
5195         auth_type = dcerpc.DCERPC_AUTH_TYPE_KRB5
5196         auth_level = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
5197         auth_context_id = 1
5198
5199         creds = self.get_user_creds()
5200
5201         abstract = samba.dcerpc.mgmt.abstract_syntax()
5202         transfer = base.transfer_syntax_ndr()
5203
5204         tsf1_list = [transfer]
5205         ctx = samba.dcerpc.dcerpc.ctx_list()
5206         ctx.context_id = 1
5207         ctx.num_transfer_syntaxes = len(tsf1_list)
5208         ctx.abstract_syntax = abstract
5209         ctx.transfer_syntaxes = tsf1_list
5210
5211         auth_context = self.get_auth_context_creds(creds=creds,
5212                                                    auth_type=auth_type,
5213                                                    auth_level=auth_level,
5214                                                    auth_context_id=auth_context_id,
5215                                                    hdr_signing=False)
5216
5217         #
5218         # SUPPORT_HEADER_SIGN on alter context activates header signing
5219         #
5220         ack = self.do_generic_bind(call_id=1,
5221                                    ctx=ctx,
5222                                    auth_context=auth_context,
5223                                    pfc_flags_2nd=dcerpc.DCERPC_PFC_FLAG_FIRST |
5224                                       dcerpc.DCERPC_PFC_FLAG_LAST |
5225                                       dcerpc.DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN)
5226
5227         self.assertFalse(auth_context['hdr_signing'])
5228         if do_upgrade:
5229             auth_context['hdr_signing'] = True
5230             auth_context["gensec"].want_feature(gensec.FEATURE_SIGN_PKT_HEADER)
5231             fault_status=None
5232         else:
5233             fault_status=dcerpc.DCERPC_FAULT_SEC_PKG_ERROR
5234
5235         inq_if_ids = samba.dcerpc.mgmt.inq_if_ids()
5236         self.do_single_request(call_id=4, ctx=ctx, io=inq_if_ids,
5237                                auth_context=auth_context,
5238                                fault_status=fault_status)
5239
5240         if fault_status is not None:
5241             # wait for a disconnect
5242             rep = self.recv_pdu()
5243             self.assertIsNone(rep)
5244             self.assertNotConnected()
5245             return
5246
5247         self.do_single_request(call_id=5, ctx=ctx, io=inq_if_ids,
5248                                auth_context=auth_context)
5249         return
5250
5251     def test_krb5_hdr_sign_delayed2_ok1(self):
5252         return self._test_krb5_hdr_sign_delayed2(do_upgrade=True)
5253
5254     def test_krb5_hdr_sign_delayed2_fail1(self):
5255         return self._test_krb5_hdr_sign_delayed2(do_upgrade=False)
5256
5257     def test_krb5_hdr_sign_delayed3_fail1(self):
5258         auth_type = dcerpc.DCERPC_AUTH_TYPE_KRB5
5259         auth_level = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
5260         auth_context_id = 1
5261
5262         creds = self.get_user_creds()
5263
5264         abstract = samba.dcerpc.mgmt.abstract_syntax()
5265         transfer = base.transfer_syntax_ndr()
5266
5267         tsf1_list = [transfer]
5268         ctx = samba.dcerpc.dcerpc.ctx_list()
5269         ctx.context_id = 1
5270         ctx.num_transfer_syntaxes = len(tsf1_list)
5271         ctx.abstract_syntax = abstract
5272         ctx.transfer_syntaxes = tsf1_list
5273
5274         auth_context = self.get_auth_context_creds(creds=creds,
5275                                                    auth_type=auth_type,
5276                                                    auth_level=auth_level,
5277                                                    auth_context_id=auth_context_id,
5278                                                    hdr_signing=False)
5279
5280         #
5281         # SUPPORT_HEADER_SIGN on auth3 doesn't activate header signing
5282         #
5283         ack = self.do_generic_bind(call_id=1,
5284                                    ctx=ctx,
5285                                    auth_context=auth_context,
5286                                    pfc_flags_2nd=dcerpc.DCERPC_PFC_FLAG_FIRST |
5287                                       dcerpc.DCERPC_PFC_FLAG_LAST |
5288                                       dcerpc.DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN,
5289                                    use_auth3=True)
5290
5291         inq_if_ids = samba.dcerpc.mgmt.inq_if_ids()
5292         self.do_single_request(call_id=2, ctx=ctx, io=inq_if_ids,
5293                                auth_context=auth_context)
5294
5295         self.assertFalse(auth_context['hdr_signing'])
5296         auth_context['hdr_signing'] = True
5297         auth_context["gensec"].want_feature(gensec.FEATURE_SIGN_PKT_HEADER)
5298         fault_status=dcerpc.DCERPC_FAULT_SEC_PKG_ERROR
5299
5300         self.do_single_request(call_id=4, ctx=ctx, io=inq_if_ids,
5301                                auth_context=auth_context,
5302                                fault_status=fault_status)
5303
5304         # wait for a disconnect
5305         rep = self.recv_pdu()
5306         self.assertIsNone(rep)
5307         self.assertNotConnected()
5308         return
5309
5310     def _test_lsa_multi_auth_connect1(self, smb_creds,
5311                                       account_name0, authority_name0):
5312         creds1 = self.get_anon_creds()
5313         account_name1 = "ANONYMOUS LOGON"
5314         authority_name1 = "NT AUTHORITY"
5315         auth_type1 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5316         auth_level1 = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
5317         auth_context_id1 = 1
5318
5319         creds2 = self.get_user_creds()
5320         account_name2 = creds2.get_username()
5321         authority_name2 = creds2.get_domain()
5322         auth_type2 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5323         auth_level2 = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
5324         auth_context_id2 = 2
5325
5326         abstract = samba.dcerpc.lsa.abstract_syntax()
5327         transfer = base.transfer_syntax_ndr()
5328
5329         self.reconnect_smb_pipe(primary_address='\\pipe\\lsarpc',
5330                                 secondary_address='\\pipe\\lsass',
5331                                 transport_creds=smb_creds)
5332         self.assertIsConnected()
5333
5334         tsf1_list = [transfer]
5335         ctx1 = samba.dcerpc.dcerpc.ctx_list()
5336         ctx1.context_id = 1
5337         ctx1.num_transfer_syntaxes = len(tsf1_list)
5338         ctx1.abstract_syntax = abstract
5339         ctx1.transfer_syntaxes = tsf1_list
5340
5341         auth_context1 = self.get_auth_context_creds(creds=creds1,
5342                                                     auth_type=auth_type1,
5343                                                     auth_level=auth_level1,
5344                                                     auth_context_id=auth_context_id1,
5345                                                     hdr_signing=False)
5346         auth_context2 = self.get_auth_context_creds(creds=creds2,
5347                                                     auth_type=auth_type2,
5348                                                     auth_level=auth_level2,
5349                                                     auth_context_id=auth_context_id2,
5350                                                     hdr_signing=False)
5351
5352         get_user_name = samba.dcerpc.lsa.GetUserName()
5353         get_user_name.in_system_name = self.target_hostname
5354         get_user_name.in_account_name = None
5355         get_user_name.in_authority_name = base.ndr_pointer(None)
5356
5357         ack1 = self.do_generic_bind(call_id=0,
5358                                     ctx=ctx1,
5359                                     auth_context=auth_context1)
5360
5361         #
5362         # With just one explicit auth context and that
5363         # uses AUTH_LEVEL_CONNECT context.
5364         #
5365         # We always get that by default instead of the one default one
5366         # inherited from the transport
5367         #
5368         self.do_single_request(call_id=1, ctx=ctx1, io=get_user_name)
5369         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5370         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5371         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5372
5373         self.do_single_request(call_id=2, ctx=ctx1, io=get_user_name,
5374                                auth_context=auth_context1)
5375         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5376         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5377         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5378
5379         ack2 = self.do_generic_bind(call_id=3,
5380                                     ctx=ctx1,
5381                                     auth_context=auth_context2,
5382                                     assoc_group_id = ack1.u.assoc_group_id,
5383                                     start_with_alter=True)
5384
5385         #
5386         # Now we have two explicit auth contexts
5387         #
5388         # If we don't specify one of them we get the default one
5389         # inherited from the transport
5390         #
5391         self.do_single_request(call_id=4, ctx=ctx1, io=get_user_name)
5392         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5393         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5394         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5395
5396         self.do_single_request(call_id=5, ctx=ctx1, io=get_user_name,
5397                                auth_context=auth_context1)
5398         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5399         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5400         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5401
5402         self.do_single_request(call_id=6, ctx=ctx1, io=get_user_name,
5403                                auth_context=auth_context2)
5404         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5405         self.assertEqualsStrLower(get_user_name.out_account_name, account_name2)
5406         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name2)
5407
5408         self.do_single_request(call_id=7, ctx=ctx1, io=get_user_name)
5409         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5410         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5411         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5412
5413         return
5414
5415     def test_lsa_multi_auth_connect1u(self):
5416         smb_auth_creds = self.get_user_creds()
5417         account_name0 = smb_auth_creds.get_username()
5418         authority_name0 = smb_auth_creds.get_domain()
5419         return self._test_lsa_multi_auth_connect1(smb_auth_creds,
5420                                                   account_name0,
5421                                                   authority_name0)
5422
5423     def test_lsa_multi_auth_connect1a(self):
5424         smb_auth_creds = self.get_anon_creds()
5425         account_name0 = "ANONYMOUS LOGON"
5426         authority_name0 = "NT AUTHORITY"
5427         return self._test_lsa_multi_auth_connect1(smb_auth_creds,
5428                                                   account_name0,
5429                                                   authority_name0)
5430
5431     def _test_lsa_multi_auth_connect2(self, smb_creds,
5432                                       account_name0, authority_name0):
5433         creds1 = self.get_anon_creds()
5434         account_name1 = "ANONYMOUS LOGON"
5435         authority_name1 = "NT AUTHORITY"
5436         auth_type1 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5437         auth_level1 = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
5438         auth_context_id1 = 1
5439
5440         creds2 = self.get_user_creds()
5441         account_name2 = creds2.get_username()
5442         authority_name2 = creds2.get_domain()
5443         auth_type2 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5444         auth_level2 = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
5445         auth_context_id2 = 2
5446
5447         abstract = samba.dcerpc.lsa.abstract_syntax()
5448         transfer = base.transfer_syntax_ndr()
5449
5450         self.reconnect_smb_pipe(primary_address='\\pipe\\lsarpc',
5451                                 secondary_address='\\pipe\\lsass',
5452                                 transport_creds=smb_creds)
5453         self.assertIsConnected()
5454
5455         tsf1_list = [transfer]
5456         ctx1 = samba.dcerpc.dcerpc.ctx_list()
5457         ctx1.context_id = 1
5458         ctx1.num_transfer_syntaxes = len(tsf1_list)
5459         ctx1.abstract_syntax = abstract
5460         ctx1.transfer_syntaxes = tsf1_list
5461
5462         auth_context1 = self.get_auth_context_creds(creds=creds1,
5463                                                     auth_type=auth_type1,
5464                                                     auth_level=auth_level1,
5465                                                     auth_context_id=auth_context_id1,
5466                                                     hdr_signing=False)
5467         auth_context2 = self.get_auth_context_creds(creds=creds2,
5468                                                     auth_type=auth_type2,
5469                                                     auth_level=auth_level2,
5470                                                     auth_context_id=auth_context_id2,
5471                                                     hdr_signing=False)
5472
5473         get_user_name = samba.dcerpc.lsa.GetUserName()
5474         get_user_name.in_system_name = self.target_hostname
5475         get_user_name.in_account_name = None
5476         get_user_name.in_authority_name = base.ndr_pointer(None)
5477
5478         ack0 = self.do_generic_bind(call_id=0, ctx=ctx1)
5479
5480         #
5481         # We use the default auth context
5482         # inherited from the transport
5483         #
5484         self.do_single_request(call_id=1, ctx=ctx1, io=get_user_name)
5485         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5486         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5487         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5488
5489         ack1 = self.do_generic_bind(call_id=2,
5490                                     ctx=ctx1,
5491                                     auth_context=auth_context1,
5492                                     assoc_group_id = ack0.u.assoc_group_id,
5493                                     start_with_alter=True)
5494
5495         #
5496         # With just one explicit auth context and that
5497         # uses AUTH_LEVEL_CONNECT context.
5498         #
5499         # We always get that by default instead of the one default one
5500         # inherited from the transport
5501         #
5502         self.do_single_request(call_id=3, ctx=ctx1, io=get_user_name)
5503         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5504         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5505         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5506
5507         self.do_single_request(call_id=4, ctx=ctx1, io=get_user_name,
5508                                auth_context=auth_context1)
5509         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5510         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5511         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5512
5513         ack2 = self.do_generic_bind(call_id=5,
5514                                     ctx=ctx1,
5515                                     auth_context=auth_context2,
5516                                     assoc_group_id = ack0.u.assoc_group_id,
5517                                     start_with_alter=True)
5518
5519         #
5520         # Now we have two explicit auth contexts
5521         #
5522         # If we don't specify one of them we get the default one
5523         # inherited from the transport (again)
5524         #
5525         self.do_single_request(call_id=6, ctx=ctx1, io=get_user_name)
5526         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5527         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5528         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5529
5530         self.do_single_request(call_id=7, ctx=ctx1, io=get_user_name,
5531                                auth_context=auth_context1)
5532         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5533         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5534         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5535
5536         self.do_single_request(call_id=8, ctx=ctx1, io=get_user_name,
5537                                auth_context=auth_context2)
5538         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5539         self.assertEqualsStrLower(get_user_name.out_account_name, account_name2)
5540         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name2)
5541
5542         self.do_single_request(call_id=9, ctx=ctx1, io=get_user_name)
5543         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5544         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5545         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5546
5547         return
5548
5549     def test_lsa_multi_auth_connect2u(self):
5550         smb_auth_creds = self.get_user_creds()
5551         account_name0 = smb_auth_creds.get_username()
5552         authority_name0 = smb_auth_creds.get_domain()
5553         return self._test_lsa_multi_auth_connect2(smb_auth_creds,
5554                                                   account_name0,
5555                                                   authority_name0)
5556
5557     def test_lsa_multi_auth_connect2a(self):
5558         smb_auth_creds = self.get_anon_creds()
5559         account_name0 = "ANONYMOUS LOGON"
5560         authority_name0 = "NT AUTHORITY"
5561         return self._test_lsa_multi_auth_connect2(smb_auth_creds,
5562                                                   account_name0,
5563                                                   authority_name0)
5564
5565     def _test_lsa_multi_auth_connect3(self, smb_creds,
5566                                       account_name0, authority_name0):
5567         creds1 = self.get_anon_creds()
5568         account_name1 = "ANONYMOUS LOGON"
5569         authority_name1 = "NT AUTHORITY"
5570         auth_type1 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5571         auth_level1 = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
5572         auth_context_id1 = 1
5573
5574         creds2 = self.get_user_creds()
5575         account_name2 = creds2.get_username()
5576         authority_name2 = creds2.get_domain()
5577         auth_type2 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5578         auth_level2 = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
5579         auth_context_id2 = 2
5580
5581         abstract = samba.dcerpc.lsa.abstract_syntax()
5582         transfer = base.transfer_syntax_ndr()
5583
5584         self.reconnect_smb_pipe(primary_address='\\pipe\\lsarpc',
5585                                 secondary_address='\\pipe\\lsass',
5586                                 transport_creds=smb_creds)
5587         self.assertIsConnected()
5588
5589         tsf1_list = [transfer]
5590         ctx1 = samba.dcerpc.dcerpc.ctx_list()
5591         ctx1.context_id = 1
5592         ctx1.num_transfer_syntaxes = len(tsf1_list)
5593         ctx1.abstract_syntax = abstract
5594         ctx1.transfer_syntaxes = tsf1_list
5595
5596         auth_context1 = self.get_auth_context_creds(creds=creds1,
5597                                                     auth_type=auth_type1,
5598                                                     auth_level=auth_level1,
5599                                                     auth_context_id=auth_context_id1,
5600                                                     hdr_signing=False)
5601         auth_context2 = self.get_auth_context_creds(creds=creds2,
5602                                                     auth_type=auth_type2,
5603                                                     auth_level=auth_level2,
5604                                                     auth_context_id=auth_context_id2,
5605                                                     hdr_signing=False)
5606
5607         get_user_name = samba.dcerpc.lsa.GetUserName()
5608         get_user_name.in_system_name = self.target_hostname
5609         get_user_name.in_account_name = None
5610         get_user_name.in_authority_name = base.ndr_pointer(None)
5611
5612         ack0 = self.do_generic_bind(call_id=0, ctx=ctx1)
5613
5614         #
5615         # We use the default auth context
5616         # inherited from the transport
5617         #
5618         self.do_single_request(call_id=1, ctx=ctx1, io=get_user_name)
5619         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5620         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5621         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5622
5623         ack1 = self.do_generic_bind(call_id=2,
5624                                     ctx=ctx1,
5625                                     auth_context=auth_context1,
5626                                     assoc_group_id = ack0.u.assoc_group_id,
5627                                     start_with_alter=True)
5628
5629         #
5630         # With just one explicit auth context and that
5631         # uses AUTH_LEVEL_CONNECT context.
5632         #
5633         # We always get that by default instead of the one default one
5634         # inherited from the transport
5635         #
5636         # Until an explicit usage resets that mode
5637         #
5638         self.do_single_request(call_id=3, ctx=ctx1, io=get_user_name)
5639         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5640         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5641         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5642
5643         self.do_single_request(call_id=4, ctx=ctx1, io=get_user_name)
5644         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5645         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5646         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5647
5648         self.do_single_request(call_id=5, ctx=ctx1, io=get_user_name,
5649                                auth_context=auth_context1)
5650         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5651         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5652         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5653
5654         self.do_single_request(call_id=6, ctx=ctx1, io=get_user_name)
5655         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5656         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5657         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5658
5659         ack2 = self.do_generic_bind(call_id=7,
5660                                     ctx=ctx1,
5661                                     auth_context=auth_context2,
5662                                     assoc_group_id = ack0.u.assoc_group_id,
5663                                     start_with_alter=True)
5664         #
5665         # A new auth context won't change that mode again.
5666         #
5667         self.do_single_request(call_id=8, ctx=ctx1, io=get_user_name)
5668         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5669         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5670         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5671
5672         self.do_single_request(call_id=9, ctx=ctx1, io=get_user_name,
5673                                auth_context=auth_context1)
5674         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5675         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5676         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5677
5678         self.do_single_request(call_id=10, ctx=ctx1, io=get_user_name,
5679                                auth_context=auth_context2)
5680         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5681         self.assertEqualsStrLower(get_user_name.out_account_name, account_name2)
5682         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name2)
5683
5684         self.do_single_request(call_id=11, ctx=ctx1, io=get_user_name)
5685         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5686         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5687         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5688
5689         return
5690
5691     def test_lsa_multi_auth_connect3u(self):
5692         smb_auth_creds = self.get_user_creds()
5693         account_name0 = smb_auth_creds.get_username()
5694         authority_name0 = smb_auth_creds.get_domain()
5695         return self._test_lsa_multi_auth_connect3(smb_auth_creds,
5696                                                   account_name0,
5697                                                   authority_name0)
5698
5699     def test_lsa_multi_auth_connect3a(self):
5700         smb_auth_creds = self.get_anon_creds()
5701         account_name0 = "ANONYMOUS LOGON"
5702         authority_name0 = "NT AUTHORITY"
5703         return self._test_lsa_multi_auth_connect3(smb_auth_creds,
5704                                                   account_name0,
5705                                                   authority_name0)
5706
5707     def _test_lsa_multi_auth_connect4(self, smb_creds,
5708                                       account_name0, authority_name0):
5709         creds1 = self.get_anon_creds()
5710         account_name1 = "ANONYMOUS LOGON"
5711         authority_name1 = "NT AUTHORITY"
5712         auth_type1 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5713         auth_level1 = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
5714         auth_context_id1 = 1
5715
5716         creds2 = self.get_user_creds()
5717         account_name2 = creds2.get_username()
5718         authority_name2 = creds2.get_domain()
5719         auth_type2 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5720         auth_level2 = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
5721         auth_context_id2 = 2
5722
5723         creds3 = self.get_anon_creds()
5724         account_name3 = "ANONYMOUS LOGON"
5725         authority_name3 = "NT AUTHORITY"
5726         auth_type3 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5727         auth_level3 = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
5728         auth_context_id3 = 3
5729
5730         creds4 = self.get_user_creds()
5731         account_name4 = creds4.get_username()
5732         authority_name4 = creds4.get_domain()
5733         auth_type4 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5734         auth_level4 = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
5735         auth_context_id4 = 4
5736
5737         abstract = samba.dcerpc.lsa.abstract_syntax()
5738         transfer = base.transfer_syntax_ndr()
5739
5740         self.reconnect_smb_pipe(primary_address='\\pipe\\lsarpc',
5741                                 secondary_address='\\pipe\\lsass',
5742                                 transport_creds=smb_creds)
5743         self.assertIsConnected()
5744
5745         tsf1_list = [transfer]
5746         ctx1 = samba.dcerpc.dcerpc.ctx_list()
5747         ctx1.context_id = 1
5748         ctx1.num_transfer_syntaxes = len(tsf1_list)
5749         ctx1.abstract_syntax = abstract
5750         ctx1.transfer_syntaxes = tsf1_list
5751
5752         auth_context1 = self.get_auth_context_creds(creds=creds1,
5753                                                     auth_type=auth_type1,
5754                                                     auth_level=auth_level1,
5755                                                     auth_context_id=auth_context_id1,
5756                                                     hdr_signing=False)
5757         auth_context2 = self.get_auth_context_creds(creds=creds2,
5758                                                     auth_type=auth_type2,
5759                                                     auth_level=auth_level2,
5760                                                     auth_context_id=auth_context_id2,
5761                                                     hdr_signing=False)
5762         auth_context3 = self.get_auth_context_creds(creds=creds3,
5763                                                     auth_type=auth_type3,
5764                                                     auth_level=auth_level3,
5765                                                     auth_context_id=auth_context_id3,
5766                                                     hdr_signing=False)
5767         auth_context4 = self.get_auth_context_creds(creds=creds4,
5768                                                     auth_type=auth_type4,
5769                                                     auth_level=auth_level4,
5770                                                     auth_context_id=auth_context_id4,
5771                                                     hdr_signing=False)
5772
5773         get_user_name = samba.dcerpc.lsa.GetUserName()
5774         get_user_name.in_system_name = self.target_hostname
5775         get_user_name.in_account_name = None
5776         get_user_name.in_authority_name = base.ndr_pointer(None)
5777
5778         ack0 = self.do_generic_bind(call_id=0, ctx=ctx1)
5779
5780         #
5781         # We use the default auth context
5782         # inherited from the transport
5783         #
5784         self.do_single_request(call_id=1, ctx=ctx1, io=get_user_name)
5785         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5786         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5787         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5788
5789         ack1 = self.do_generic_bind(call_id=2,
5790                                     ctx=ctx1,
5791                                     auth_context=auth_context1,
5792                                     assoc_group_id = ack0.u.assoc_group_id,
5793                                     start_with_alter=True)
5794
5795         #
5796         # With just one explicit auth context and that
5797         # uses AUTH_LEVEL_CONNECT context.
5798         #
5799         # We always get that by default instead of the one default one
5800         # inherited from the transport
5801         #
5802         # Until a new explicit context resets the mode
5803         #
5804         self.do_single_request(call_id=3, ctx=ctx1, io=get_user_name)
5805         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5806         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5807         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5808
5809         self.do_single_request(call_id=4, ctx=ctx1, io=get_user_name)
5810         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5811         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5812         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5813
5814         ack2 = self.do_generic_bind(call_id=5,
5815                                     ctx=ctx1,
5816                                     auth_context=auth_context2,
5817                                     assoc_group_id = ack0.u.assoc_group_id,
5818                                     start_with_alter=True)
5819
5820         #
5821         # A new auth context with LEVEL_CONNECT resets the default.
5822         #
5823         self.do_single_request(call_id=6, ctx=ctx1, io=get_user_name)
5824         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5825         self.assertEqualsStrLower(get_user_name.out_account_name, account_name2)
5826         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name2)
5827
5828         self.do_single_request(call_id=7, ctx=ctx1, io=get_user_name)
5829         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5830         self.assertEqualsStrLower(get_user_name.out_account_name, account_name2)
5831         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name2)
5832
5833         ack3 = self.do_generic_bind(call_id=8,
5834                                     ctx=ctx1,
5835                                     auth_context=auth_context3,
5836                                     assoc_group_id = ack0.u.assoc_group_id,
5837                                     start_with_alter=True)
5838
5839         #
5840         # A new auth context with LEVEL_CONNECT resets the default.
5841         #
5842         self.do_single_request(call_id=9, ctx=ctx1, io=get_user_name)
5843         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5844         self.assertEqualsStrLower(get_user_name.out_account_name, account_name3)
5845         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name3)
5846
5847         self.do_single_request(call_id=10, ctx=ctx1, io=get_user_name)
5848         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5849         self.assertEqualsStrLower(get_user_name.out_account_name, account_name3)
5850         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name3)
5851
5852         ack4 = self.do_generic_bind(call_id=11,
5853                                     ctx=ctx1,
5854                                     auth_context=auth_context4,
5855                                     assoc_group_id = ack0.u.assoc_group_id,
5856                                     start_with_alter=True)
5857
5858         #
5859         # A new auth context with LEVEL_CONNECT resets the default.
5860         #
5861         self.do_single_request(call_id=12, ctx=ctx1, io=get_user_name)
5862         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5863         self.assertEqualsStrLower(get_user_name.out_account_name, account_name4)
5864         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name4)
5865
5866         self.do_single_request(call_id=13, ctx=ctx1, io=get_user_name)
5867         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5868         self.assertEqualsStrLower(get_user_name.out_account_name, account_name4)
5869         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name4)
5870
5871         #
5872         # Only the explicit usage of any context reset that mode
5873         #
5874         self.do_single_request(call_id=14, ctx=ctx1, io=get_user_name,
5875                                auth_context=auth_context1)
5876         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5877         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5878         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5879
5880         self.do_single_request(call_id=15, ctx=ctx1, io=get_user_name)
5881         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5882         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5883         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5884
5885         self.do_single_request(call_id=16, ctx=ctx1, io=get_user_name,
5886                                auth_context=auth_context1)
5887         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5888         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
5889         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
5890
5891         self.do_single_request(call_id=17, ctx=ctx1, io=get_user_name,
5892                                auth_context=auth_context2)
5893         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5894         self.assertEqualsStrLower(get_user_name.out_account_name, account_name2)
5895         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name2)
5896
5897         self.do_single_request(call_id=18, ctx=ctx1, io=get_user_name,
5898                                auth_context=auth_context3)
5899         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5900         self.assertEqualsStrLower(get_user_name.out_account_name, account_name3)
5901         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name3)
5902
5903         self.do_single_request(call_id=19, ctx=ctx1, io=get_user_name,
5904                                auth_context=auth_context4)
5905         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5906         self.assertEqualsStrLower(get_user_name.out_account_name, account_name4)
5907         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name4)
5908
5909         self.do_single_request(call_id=20, ctx=ctx1, io=get_user_name)
5910         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
5911         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
5912         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
5913
5914         return
5915
5916     def test_lsa_multi_auth_connect4u(self):
5917         smb_auth_creds = self.get_user_creds()
5918         account_name0 = smb_auth_creds.get_username()
5919         authority_name0 = smb_auth_creds.get_domain()
5920         return self._test_lsa_multi_auth_connect4(smb_auth_creds,
5921                                                   account_name0,
5922                                                   authority_name0)
5923
5924     def test_lsa_multi_auth_connect4a(self):
5925         smb_auth_creds = self.get_anon_creds()
5926         account_name0 = "ANONYMOUS LOGON"
5927         authority_name0 = "NT AUTHORITY"
5928         return self._test_lsa_multi_auth_connect4(smb_auth_creds,
5929                                                   account_name0,
5930                                                   authority_name0)
5931
5932     def _test_lsa_multi_auth_sign_connect1(self, smb_creds,
5933                                            account_name0, authority_name0):
5934
5935         creds1 = self.get_user_creds()
5936         account_name1 = creds1.get_username()
5937         authority_name1 = creds1.get_domain()
5938         auth_type1 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5939         auth_level1 = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
5940         auth_context_id1 = 1
5941
5942         creds2 = self.get_user_creds()
5943         account_name2 = creds2.get_username()
5944         authority_name2 = creds2.get_domain()
5945         auth_type2 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5946         auth_level2 = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
5947         auth_context_id2 = 2
5948
5949         creds3 = self.get_anon_creds()
5950         account_name3 = "ANONYMOUS LOGON"
5951         authority_name3 = "NT AUTHORITY"
5952         auth_type3 = dcerpc.DCERPC_AUTH_TYPE_NTLMSSP
5953         auth_level3 = dcerpc.DCERPC_AUTH_LEVEL_CONNECT
5954         auth_context_id3 = 3
5955
5956         abstract = samba.dcerpc.lsa.abstract_syntax()
5957         transfer = base.transfer_syntax_ndr()
5958
5959         self.reconnect_smb_pipe(primary_address='\\pipe\\lsarpc',
5960                                 secondary_address='\\pipe\\lsass',
5961                                 transport_creds=smb_creds)
5962         self.assertIsConnected()
5963
5964         tsf1_list = [transfer]
5965         ctx1 = samba.dcerpc.dcerpc.ctx_list()
5966         ctx1.context_id = 1
5967         ctx1.num_transfer_syntaxes = len(tsf1_list)
5968         ctx1.abstract_syntax = abstract
5969         ctx1.transfer_syntaxes = tsf1_list
5970
5971         auth_context1 = self.get_auth_context_creds(creds=creds1,
5972                                                     auth_type=auth_type1,
5973                                                     auth_level=auth_level1,
5974                                                     auth_context_id=auth_context_id1,
5975                                                     hdr_signing=False)
5976         auth_context2 = self.get_auth_context_creds(creds=creds2,
5977                                                     auth_type=auth_type2,
5978                                                     auth_level=auth_level2,
5979                                                     auth_context_id=auth_context_id2,
5980                                                     hdr_signing=False)
5981         auth_context3 = self.get_auth_context_creds(creds=creds3,
5982                                                     auth_type=auth_type3,
5983                                                     auth_level=auth_level3,
5984                                                     auth_context_id=auth_context_id3,
5985                                                     hdr_signing=False)
5986
5987         get_user_name = samba.dcerpc.lsa.GetUserName()
5988         get_user_name.in_system_name = self.target_hostname
5989         get_user_name.in_account_name = None
5990         get_user_name.in_authority_name = base.ndr_pointer(None)
5991
5992         ack1 = self.do_generic_bind(call_id=0,
5993                                     ctx=ctx1,
5994                                     auth_context=auth_context1)
5995
5996         #
5997         # With just one explicit auth context and that
5998         # *not* uses AUTH_LEVEL_CONNECT context.
5999         #
6000         # We don't get the by default (auth_context1)
6001         #
6002         self.do_single_request(call_id=1, ctx=ctx1, io=get_user_name)
6003         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
6004         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
6005         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
6006
6007         self.do_single_request(call_id=2, ctx=ctx1, io=get_user_name,
6008                                auth_context=auth_context1)
6009         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
6010         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
6011         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
6012
6013         self.do_single_request(call_id=3, ctx=ctx1, io=get_user_name)
6014         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
6015         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
6016         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
6017
6018         ack2 = self.do_generic_bind(call_id=4,
6019                                     ctx=ctx1,
6020                                     auth_context=auth_context2,
6021                                     assoc_group_id = ack1.u.assoc_group_id,
6022                                     start_with_alter=True)
6023
6024         #
6025         # With just two explicit auth context and
6026         # *none* uses AUTH_LEVEL_CONNECT context.
6027         #
6028         # We don't get auth_context1 or auth_context2 by default
6029         #
6030         self.do_single_request(call_id=5, ctx=ctx1, io=get_user_name)
6031         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
6032         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
6033         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
6034
6035         self.do_single_request(call_id=6, ctx=ctx1, io=get_user_name,
6036                                auth_context=auth_context1)
6037         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
6038         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
6039         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
6040
6041         self.do_single_request(call_id=7, ctx=ctx1, io=get_user_name,
6042                                auth_context=auth_context2)
6043         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
6044         self.assertEqualsStrLower(get_user_name.out_account_name, account_name2)
6045         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name2)
6046
6047         self.do_single_request(call_id=8, ctx=ctx1, io=get_user_name)
6048         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
6049         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
6050         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
6051
6052         ack3 = self.do_generic_bind(call_id=9,
6053                                     ctx=ctx1,
6054                                     auth_context=auth_context3,
6055                                     assoc_group_id = ack1.u.assoc_group_id,
6056                                     start_with_alter=True)
6057
6058         #
6059         # Now we have tree explicit auth contexts,
6060         # but just one with AUTH_LEVEL_CONNECT
6061         #
6062         # If we don't specify one of them we get
6063         # that one auth_level_connect context.
6064         #
6065         # Until an explicit usage of any auth context reset that mode.
6066         #
6067         self.do_single_request(call_id=10, ctx=ctx1, io=get_user_name)
6068         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
6069         self.assertEqualsStrLower(get_user_name.out_account_name, account_name3)
6070         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name3)
6071
6072         self.do_single_request(call_id=11, ctx=ctx1, io=get_user_name)
6073         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
6074         self.assertEqualsStrLower(get_user_name.out_account_name, account_name3)
6075         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name3)
6076
6077         self.do_single_request(call_id=12, ctx=ctx1, io=get_user_name,
6078                                auth_context=auth_context1)
6079         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
6080         self.assertEqualsStrLower(get_user_name.out_account_name, account_name1)
6081         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name1)
6082
6083         self.do_single_request(call_id=13, ctx=ctx1, io=get_user_name)
6084         self.assertEqual(get_user_name.result[0], NT_STATUS_SUCCESS)
6085         self.assertEqualsStrLower(get_user_name.out_account_name, account_name0)
6086         self.assertEqualsStrLower(get_user_name.out_authority_name.value, authority_name0)
6087
6088         return
6089
6090     def test_lsa_multi_auth_sign_connect1u(self):
6091         smb_auth_creds = self.get_user_creds()
6092         account_name0 = smb_auth_creds.get_username()
6093         authority_name0 = smb_auth_creds.get_domain()
6094         return self._test_lsa_multi_auth_sign_connect1(smb_auth_creds,
6095                                                   account_name0,
6096                                                   authority_name0)
6097     def test_lsa_multi_auth_sign_connect1a(self):
6098         smb_auth_creds = self.get_anon_creds()
6099         account_name0 = "ANONYMOUS LOGON"
6100         authority_name0 = "NT AUTHORITY"
6101         return self._test_lsa_multi_auth_sign_connect1(smb_auth_creds,
6102                                                   account_name0,
6103                                                   authority_name0)
6104
6105     def test_spnego_multiple_auth_hdr_signing(self):
6106         auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
6107         auth_level1 = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
6108         auth_context_id1=1
6109         auth_level2 = dcerpc.DCERPC_AUTH_LEVEL_PACKET
6110         auth_context_id2=2
6111
6112         creds = self.get_user_creds()
6113
6114         abstract = samba.dcerpc.mgmt.abstract_syntax()
6115         transfer = base.transfer_syntax_ndr()
6116
6117         tsf1_list = [transfer]
6118         ctx = samba.dcerpc.dcerpc.ctx_list()
6119         ctx.context_id = 1
6120         ctx.num_transfer_syntaxes = len(tsf1_list)
6121         ctx.abstract_syntax = abstract
6122         ctx.transfer_syntaxes = tsf1_list
6123
6124         auth_context1 = self.get_auth_context_creds(creds=creds,
6125                                                     auth_type=auth_type,
6126                                                     auth_level=auth_level1,
6127                                                     auth_context_id=auth_context_id1,
6128                                                     hdr_signing=False)
6129         auth_context2 = self.get_auth_context_creds(creds=creds,
6130                                                     auth_type=auth_type,
6131                                                     auth_level=auth_level2,
6132                                                     auth_context_id=auth_context_id2,
6133                                                     hdr_signing=False)
6134
6135         ack0 = self.do_generic_bind(call_id=1, ctx=ctx)
6136
6137         ack1 = self.do_generic_bind(call_id=2,
6138                                     ctx=ctx,
6139                                     auth_context=auth_context1,
6140                                     assoc_group_id = ack0.u.assoc_group_id,
6141                                     start_with_alter=True)
6142         ack2 = self.do_generic_bind(call_id=3,
6143                                     ctx=ctx,
6144                                     auth_context=auth_context2,
6145                                     assoc_group_id = ack0.u.assoc_group_id,
6146                                     start_with_alter=True)
6147
6148         inq_if_ids = samba.dcerpc.mgmt.inq_if_ids()
6149         self.do_single_request(call_id=4, ctx=ctx, io=inq_if_ids)
6150         self.do_single_request(call_id=5, ctx=ctx, io=inq_if_ids,
6151                                auth_context=auth_context1)
6152         self.do_single_request(call_id=6, ctx=ctx, io=inq_if_ids,
6153                                auth_context=auth_context2)
6154
6155         ack3 = self.do_generic_bind(call_id=7, ctx=ctx,
6156                                     pfc_flags=dcerpc.DCERPC_PFC_FLAG_FIRST |
6157                                     dcerpc.DCERPC_PFC_FLAG_LAST |
6158                                     dcerpc.DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN,
6159                                     assoc_group_id = ack0.u.assoc_group_id,
6160                                     start_with_alter=True)
6161
6162         self.assertFalse(auth_context1['hdr_signing'])
6163         auth_context1['hdr_signing'] = True
6164         auth_context1["gensec"].want_feature(gensec.FEATURE_SIGN_PKT_HEADER)
6165
6166         self.do_single_request(call_id=8, ctx=ctx, io=inq_if_ids)
6167         self.do_single_request(call_id=9, ctx=ctx, io=inq_if_ids,
6168                                auth_context=auth_context1)
6169         self.do_single_request(call_id=10, ctx=ctx, io=inq_if_ids,
6170                                auth_context=auth_context2,
6171                                fault_status=dcerpc.DCERPC_FAULT_SEC_PKG_ERROR)
6172
6173         # wait for a disconnect
6174         rep = self.recv_pdu()
6175         self.assertIsNone(rep)
6176         self.assertNotConnected()
6177
6178     def test_multiple_auth_limit(self):
6179         creds = self.get_user_creds()
6180
6181         abstract = samba.dcerpc.mgmt.abstract_syntax()
6182         transfer = base.transfer_syntax_ndr()
6183
6184         tsf1_list = [transfer]
6185         ctx = samba.dcerpc.dcerpc.ctx_list()
6186         ctx.context_id = 1
6187         ctx.num_transfer_syntaxes = len(tsf1_list)
6188         ctx.abstract_syntax = abstract
6189         ctx.transfer_syntaxes = tsf1_list
6190
6191         ack0 = self.do_generic_bind(call_id=0, ctx=ctx)
6192
6193         is_server_listening = samba.dcerpc.mgmt.is_server_listening()
6194
6195         max_num_auth_str = samba.tests.env_get_var_value('MAX_NUM_AUTH', allow_missing=True)
6196         if max_num_auth_str is not None:
6197             max_num_auth = int(max_num_auth_str)
6198         else:
6199             max_num_auth = 2049
6200
6201         for i in range(1, max_num_auth+2):
6202             auth_type = dcerpc.DCERPC_AUTH_TYPE_SPNEGO
6203             auth_level = dcerpc.DCERPC_AUTH_LEVEL_INTEGRITY
6204             auth_context_id = i
6205
6206             auth_context = self.get_auth_context_creds(creds=creds,
6207                                                        auth_type=auth_type,
6208                                                        auth_level=auth_level,
6209                                                        auth_context_id=auth_context_id,
6210                                                        hdr_signing=False)
6211
6212             alter_fault = None
6213             if i > max_num_auth:
6214                 alter_fault = dcerpc.DCERPC_NCA_S_PROTO_ERROR
6215
6216             ack = self.do_generic_bind(call_id=auth_context_id,
6217                                        ctx=ctx,
6218                                        auth_context=auth_context,
6219                                        assoc_group_id = ack0.u.assoc_group_id,
6220                                        alter_fault=alter_fault,
6221                                        start_with_alter=True,
6222                                        )
6223             if alter_fault is not None:
6224                 break
6225
6226
6227             self.do_single_request(call_id=auth_context_id,
6228                                    ctx=ctx, io=is_server_listening,
6229                                    auth_context=auth_context)
6230
6231         # wait for a disconnect
6232         rep = self.recv_pdu()
6233         self.assertIsNone(rep)
6234         self.assertNotConnected()
6235         return
6236
6237
6238 if __name__ == "__main__":
6239     global_ndr_print = True
6240     global_hexdump = True
6241     import unittest
6242     unittest.main()