from k5test import *
import re

# KDC option test coverage notes:
#
# FORWARDABLE              here
# FORWARDED                no test
# PROXIABLE                here
# PROXY                    no test
# ALLOW_POSTDATE           no test
# POSTDATED                no test
# RENEWABLE                t_renew.py
# CNAME_IN_ADDL_TKT        gssapi/t_s4u.py
# CANONICALIZE             t_kdb.py and various other tests
# REQUEST_ANONYMOUS        t_pkinit.py
# DISABLE_TRANSITED_CHECK  no test
# RENEWABLE_OK             t_renew.py
# ENC_TKT_IN_SKEY          t_u2u.py
# RENEW                    t_renew.py
# VALIDATE                 no test

# Run klist -f and return the flags on the ticket for svcprinc.
def get_flags(realm, svcprinc):
    grab_flags = False
    for line in realm.run([klist, '-f']).splitlines():
        if grab_flags:
            return re.findall(r'Flags: ([a-zA-Z]*)', line)[0]
        grab_flags = line.endswith(svcprinc)


# Get the flags on the ticket for svcprinc, and check for an expected
# element and an expected-absent element, either of which can be None.
def check_flags(realm, svcprinc, expected_flag, expected_noflag):
    flags = get_flags(realm, svcprinc)
    if expected_flag is not None and not expected_flag in flags:
        fail('expected flag ' + expected_flag)
    if expected_noflag is not None and expected_noflag in flags:
        fail('did not expect flag ' + expected_noflag)


# Run kinit with the given flags, and check the flags on the resulting
# TGT.
def kinit_check_flags(realm, flags, expected_flag, expected_noflag):
    realm.kinit(realm.user_princ, password('user'), flags)
    check_flags(realm, realm.krbtgt_princ, expected_flag, expected_noflag)


# Run kinit with kflags.  Then get credentials for the host principal
# with gflags, and check the flags on the resulting ticket.
def gcred_check_flags(realm, kflags, gflags, expected_flag, expected_noflag):
    realm.kinit(realm.user_princ, password('user'), kflags)
    realm.run(['./gcred'] + gflags + ['unknown', realm.host_princ])
    check_flags(realm, realm.host_princ, expected_flag, expected_noflag)


realm = K5Realm()

mark('proxiable (AS)')
kinit_check_flags(realm, [], None, 'P')
kinit_check_flags(realm, ['-p'], 'P', None)
realm.run([kadminl, 'modprinc', '-allow_proxiable', realm.user_princ])
kinit_check_flags(realm, ['-p'], None, 'P')
realm.run([kadminl, 'modprinc', '+allow_proxiable', realm.user_princ])
realm.run([kadminl, 'modprinc', '-allow_proxiable', realm.krbtgt_princ])
kinit_check_flags(realm, ['-p'], None, 'P')
realm.run([kadminl, 'modprinc', '+allow_proxiable', realm.krbtgt_princ])

mark('proxiable (TGS)')
gcred_check_flags(realm, [], [], None, 'P')
gcred_check_flags(realm, ['-p'], [], 'P', None)

# Not tested: PROXIABLE option set with a non-proxiable TGT (because
# there is no krb5_get_credentials() flag to request this; would
# expect a non-proxiable ticket).

# Not tested: proxiable TGT but PROXIABLE flag not set (because we
# internally set the PROXIABLE option when using a proxiable TGT;
# would expect a non-proxiable ticket).

mark('forwardable (AS)')
kinit_check_flags(realm, [], None, 'F')
kinit_check_flags(realm, ['-f'], 'F', None)
realm.run([kadminl, 'modprinc', '-allow_forwardable', realm.user_princ])
kinit_check_flags(realm, ['-f'], None, 'F')
realm.run([kadminl, 'modprinc', '+allow_forwardable', realm.user_princ])
realm.run([kadminl, 'modprinc', '-allow_forwardable', realm.krbtgt_princ])
kinit_check_flags(realm, ['-f'], None, 'F')
realm.run([kadminl, 'modprinc', '+allow_forwardable', realm.krbtgt_princ])

mark('forwardable (TGS)')
realm.kinit(realm.user_princ, password('user'))
gcred_check_flags(realm, [], [], None, 'F')
gcred_check_flags(realm, [], ['-f'], None, 'F')
gcred_check_flags(realm, ['-f'], [], 'F', None)

# Not tested: forwardable TGT but FORWARDABLE flag not set (because we
# internally set the FORWARDABLE option when using a forwardable TGT;
# would expect a non-proxiable ticket).

success('KDC option tests')