tests python krb5: use key usage constants

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

7 files changed, 42 insertions, 34 deletions

diff --git a/python/samba/tests/krb5/as_canonicalization_tests.py b/python/samba/tests/krb5/as_canonicalization_tests.py
index 6ea3ff0491e..e89b40eab8f 100755
--- a/python/samba/tests/krb5/as_canonicalization_tests.py
+++ b/python/samba/tests/krb5/as_canonicalization_tests.py
@@ -367,8 +367,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest):
         pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC())
 
-        enc_pa_ts_usage = 1
-        pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts)
+        pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData())
 
         pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts)
@@ -413,7 +412,7 @@ class KerberosASCanonicalizationTests(RawKerberosTest):
         self.assertEqual(msg_type, KRB_AS_REP, "Data {0}".format(str(data)))
 
         # Decrypt and decode the EncKdcRepPart
-        enc = key.decrypt(3, rep['enc-part']['cipher'])
+        enc = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher'])
         if enc[0] == 0x7A:
             # MIT Kerberos Tags the EncASRepPart as a EncKDCRepPart
             # i.e. tag number 26 instead of tag number 25
diff --git a/python/samba/tests/krb5/compatability_tests.py b/python/samba/tests/krb5/compatability_tests.py
index e4b1453e712..0b3701cd60d 100755
--- a/python/samba/tests/krb5/compatability_tests.py
+++ b/python/samba/tests/krb5/compatability_tests.py
@@ -178,8 +178,7 @@ class SimpleKerberosTests(RawKerberosTest):
         pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC())
 
-        enc_pa_ts_usage = 1
-        pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts)
+        pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData())
 
         pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts)
@@ -207,9 +206,9 @@ class SimpleKerberosTests(RawKerberosTest):
         msg_type = rep['msg-type']
         self.assertEqual(msg_type, KRB_AS_REP)
 
-        usage = 3
         enc_part = rep['enc-part']
-        enc_as_rep_part = key.decrypt(usage, rep['enc-part']['cipher'])
+        enc_as_rep_part = key.decrypt(
+            KU_AS_REP_ENC_PART, rep['enc-part']['cipher'])
         return (enc_as_rep_part, enc_part)
 
 
diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py
index 1a823d173e3..e835d389f1c 100644
--- a/python/samba/tests/krb5/kdc_base_test.py
+++ b/python/samba/tests/krb5/kdc_base_test.py
@@ -41,6 +41,10 @@ from samba.tests.krb5.rfc4120_constants import (
     KRB_AS_REP,
     KRB_TGS_REP,
     KRB_ERROR,
+    KU_AS_REP_ENC_PART,
+    KU_PA_ENC_TIMESTAMP,
+    KU_TGS_REP_ENC_PART_SUB_KEY,
+    KU_TICKET,
     PADATA_ENC_TIMESTAMP,
     PADATA_ETYPE_INFO2,
 )
@@ -196,8 +200,7 @@ class KDCBaseTest(RawKerberosTest):
         padata = self.PA_ENC_TS_ENC_create(patime, pausec)
         padata = self.der_encode(padata, asn1Spec=krb5_asn1.PA_ENC_TS_ENC())
 
-        usage = 1
-        padata = self.EncryptedData_create(key, usage, padata)
+        padata = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, padata)
         padata = self.der_encode(padata, asn1Spec=krb5_asn1.EncryptedData())
 
         padata = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, padata)
@@ -207,8 +210,7 @@ class KDCBaseTest(RawKerberosTest):
     def get_as_rep_enc_data(self, key, rep):
         ''' Decrypt and Decode the encrypted data in an AS-REP
         '''
-        usage = 3
-        enc_part = key.decrypt(usage, rep['enc-part']['cipher'])
+        enc_part = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher'])
         # MIT KDC encodes both EncASRepPart and EncTGSRepPart with
         # application tag 26
         try:
@@ -303,7 +305,6 @@ class KDCBaseTest(RawKerberosTest):
         padata = []
 
         subkey = self.RandomKey(key.etype)
-        subkey_usage = 9
 
         (ctime, cusec) = self.get_KerberosTimeWithUsec()
 
@@ -332,7 +333,8 @@ class KDCBaseTest(RawKerberosTest):
         msg_type = rep['msg-type']
         enc_part = None
         if msg_type == KRB_TGS_REP:
-            enc_part = subkey.decrypt(subkey_usage, rep['enc-part']['cipher'])
+            enc_part = subkey.decrypt(
+                KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher'])
             enc_part = self.der_decode(
                 enc_part, asn1Spec=krb5_asn1.EncTGSRepPart())
         return (rep, enc_part)
@@ -403,7 +405,7 @@ class KDCBaseTest(RawKerberosTest):
             salt,
             ticket['enc-part']['kvno'])
 
-        enc_part = key.decrypt(2, ticket['enc-part']['cipher'])
+        enc_part = key.decrypt(KU_TICKET, ticket['enc-part']['cipher'])
         enc_ticket_part = self.der_decode(
             enc_part, asn1Spec=krb5_asn1.EncTicketPart())
         return enc_ticket_part
diff --git a/python/samba/tests/krb5/kdc_tests.py b/python/samba/tests/krb5/kdc_tests.py
index 57a25448965..17b9d154bd9 100755
--- a/python/samba/tests/krb5/kdc_tests.py
+++ b/python/samba/tests/krb5/kdc_tests.py
@@ -91,8 +91,7 @@ class KdcTests(RawKerberosTest):
         pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC())
 
-        enc_pa_ts_usage = 1
-        pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts)
+        pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData())
 
         pa_ts = self.PA_DATA_create(PADATA_ENC_TIMESTAMP, pa_ts)
diff --git a/python/samba/tests/krb5/s4u_tests.py b/python/samba/tests/krb5/s4u_tests.py
index ae38635c53b..2e1bd3fbe1f 100755
--- a/python/samba/tests/krb5/s4u_tests.py
+++ b/python/samba/tests/krb5/s4u_tests.py
@@ -25,6 +25,11 @@ os.environ["PYTHONUNBUFFERED"] = "1"
 from samba.tests import env_get_var_value
 from samba.tests.krb5.kcrypto import Cksumtype
 from samba.tests.krb5.raw_testcase import RawKerberosTest
+from samba.tests.krb5.rfc4120_constants import (
+    KU_PA_ENC_TIMESTAMP,
+    KU_AS_REP_ENC_PART,
+    KU_TGS_REP_ENC_PART_SUB_KEY,
+)
 import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1
 
 global_asn1_print = False
@@ -86,8 +91,7 @@ class S4UKerberosTests(RawKerberosTest):
         pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC())
 
-        enc_pa_ts_usage = 1
-        pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts)
+        pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData())
 
         pa_ts = self.PA_DATA_create(2, pa_ts)
@@ -115,8 +119,7 @@ class S4UKerberosTests(RawKerberosTest):
         msg_type = rep['msg-type']
         self.assertEqual(msg_type, 11)
 
-        usage = 3
-        enc_part2 = key.decrypt(usage, rep['enc-part']['cipher'])
+        enc_part2 = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher'])
         enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncASRepPart())
 
         # S4U2Self Request
@@ -135,7 +138,6 @@ class S4UKerberosTests(RawKerberosTest):
         padata = [pa_s4u]
 
         subkey = self.RandomKey(ticket_session_key.etype)
-        subkey_usage = 9
 
         (ctime, cusec) = self.get_KerberosTimeWithUsec()
 
@@ -163,7 +165,8 @@ class S4UKerberosTests(RawKerberosTest):
 
         msg_type = rep['msg-type']
         if msg_type == 13:
-            enc_part2 = subkey.decrypt(subkey_usage, rep['enc-part']['cipher'])
+            enc_part2 = subkey.decrypt(
+                KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher'])
             enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart())
 
         return msg_type
diff --git a/python/samba/tests/krb5/simple_tests.py b/python/samba/tests/krb5/simple_tests.py
index 236fbda1cd5..6c090af3d46 100755
--- a/python/samba/tests/krb5/simple_tests.py
+++ b/python/samba/tests/krb5/simple_tests.py
@@ -23,6 +23,11 @@ sys.path.insert(0, "bin/python")
 os.environ["PYTHONUNBUFFERED"] = "1"
 
 from samba.tests.krb5.raw_testcase import RawKerberosTest
+from samba.tests.krb5.rfc4120_constants import (
+    KU_AS_REP_ENC_PART,
+    KU_PA_ENC_TIMESTAMP,
+    KU_TGS_REP_ENC_PART_SUB_KEY,
+)
 import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1
 
 global_asn1_print = False
@@ -84,8 +89,7 @@ class SimpleKerberosTests(RawKerberosTest):
         pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC())
 
-        enc_pa_ts_usage = 1
-        pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts)
+        pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData())
 
         pa_ts = self.PA_DATA_create(2, pa_ts)
@@ -113,8 +117,7 @@ class SimpleKerberosTests(RawKerberosTest):
         msg_type = rep['msg-type']
         self.assertEqual(msg_type, 11)
 
-        usage = 3
-        enc_part2 = key.decrypt(usage, rep['enc-part']['cipher'])
+        enc_part2 = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher'])
 
         # MIT KDC encodes both EncASRepPart and EncTGSRepPart with application tag 26
         try:
@@ -134,7 +137,6 @@ class SimpleKerberosTests(RawKerberosTest):
         padata = []
 
         subkey = self.RandomKey(ticket_session_key.etype)
-        subkey_usage = 9
 
         (ctime, cusec) = self.get_KerberosTimeWithUsec()
 
@@ -163,7 +165,8 @@ class SimpleKerberosTests(RawKerberosTest):
         msg_type = rep['msg-type']
         self.assertEqual(msg_type, 13)
 
-        enc_part2 = subkey.decrypt(subkey_usage, rep['enc-part']['cipher'])
+        enc_part2 = subkey.decrypt(
+            KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher'])
         enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart())
 
         return
diff --git a/python/samba/tests/krb5/xrealm_tests.py b/python/samba/tests/krb5/xrealm_tests.py
index 64064b8a670..b4a02bff33a 100755
--- a/python/samba/tests/krb5/xrealm_tests.py
+++ b/python/samba/tests/krb5/xrealm_tests.py
@@ -23,6 +23,11 @@ sys.path.insert(0, "bin/python")
 os.environ["PYTHONUNBUFFERED"] = "1"
 
 from samba.tests.krb5.raw_testcase import RawKerberosTest
+from samba.tests.krb5.rfc4120_constants import (
+    KU_PA_ENC_TIMESTAMP,
+    KU_AS_REP_ENC_PART,
+    KU_TGS_REP_ENC_PART_SUB_KEY,
+)
 import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1
 import samba.tests
 
@@ -85,8 +90,7 @@ class XrealmKerberosTests(RawKerberosTest):
         pa_ts = self.PA_ENC_TS_ENC_create(patime, pausec)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.PA_ENC_TS_ENC())
 
-        enc_pa_ts_usage = 1
-        pa_ts = self.EncryptedData_create(key, enc_pa_ts_usage, pa_ts)
+        pa_ts = self.EncryptedData_create(key, KU_PA_ENC_TIMESTAMP, pa_ts)
         pa_ts = self.der_encode(pa_ts, asn1Spec=krb5_asn1.EncryptedData())
 
         pa_ts = self.PA_DATA_create(2, pa_ts)
@@ -114,8 +118,7 @@ class XrealmKerberosTests(RawKerberosTest):
         msg_type = rep['msg-type']
         self.assertEqual(msg_type, 11)
 
-        usage = 3
-        enc_part2 = key.decrypt(usage, rep['enc-part']['cipher'])
+        enc_part2 = key.decrypt(KU_AS_REP_ENC_PART, rep['enc-part']['cipher'])
 
         # MIT KDC encodes both EncASRepPart and EncTGSRepPart with application tag 26
         try:
@@ -134,7 +137,6 @@ class XrealmKerberosTests(RawKerberosTest):
         padata = []
 
         subkey = self.RandomKey(ticket_session_key.etype)
-        subkey_usage = 9
 
         (ctime, cusec) = self.get_KerberosTimeWithUsec()
 
@@ -163,7 +165,8 @@ class XrealmKerberosTests(RawKerberosTest):
         msg_type = rep['msg-type']
         self.assertEqual(msg_type, 13)
 
-        enc_part2 = subkey.decrypt(subkey_usage, rep['enc-part']['cipher'])
+        enc_part2 = subkey.decrypt(
+            KU_TGS_REP_ENC_PART_SUB_KEY, rep['enc-part']['cipher'])
         enc_part2 = self.der_decode(enc_part2, asn1Spec=krb5_asn1.EncTGSRepPart())
 
         # Check the forwardable flag