|
 |
d738b9 |
From d65bcba04f0051ac3ad74be7415da85b1c80a0ad Mon Sep 17 00:00:00 2001
|
|
|
d738b9 |
From: Greg Hudson <ghudson@mit.edu>
|
|
|
d738b9 |
Date: Wed, 11 Jan 2017 10:49:30 -0500
|
|
|
d738b9 |
Subject: [PATCH] Add test case for PKINIT DH renegotiation
|
|
|
d738b9 |
|
|
|
d738b9 |
In t_pkinit.py, add a PKINIT test case where the KDC sends
|
|
|
d738b9 |
KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED and the client retries with the
|
|
|
d738b9 |
KDC's TD_DH_PARAMETERS value, using the clpreauth tryagain method.
|
|
|
d738b9 |
Use the trace log to verify that the renegotiation actually takes
|
|
|
d738b9 |
place.
|
|
|
d738b9 |
|
|
|
d738b9 |
(cherry picked from commit 7ad7eb7fd591e6c789ea24b94eccbf74ee4d79f8)
|
|
|
d738b9 |
---
|
|
|
d738b9 |
src/tests/t_pkinit.py | 18 ++++++++++++++++++
|
|
|
d738b9 |
1 file changed, 18 insertions(+)
|
|
|
d738b9 |
|
|
|
d738b9 |
diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
|
|
|
d738b9 |
index ac4d326b6..183977750 100755
|
|
|
d738b9 |
--- a/src/tests/t_pkinit.py
|
|
|
d738b9 |
+++ b/src/tests/t_pkinit.py
|
|
|
d738b9 |
@@ -174,6 +174,24 @@ realm.kinit(realm.user_princ,
|
|
|
d738b9 |
'-X', 'flag_RSA_PROTOCOL=yes'])
|
|
|
d738b9 |
realm.klist(realm.user_princ)
|
|
|
d738b9 |
|
|
|
d738b9 |
+# Test a DH parameter renegotiation by temporarily setting a 4096-bit
|
|
|
d738b9 |
+# minimum on the KDC.
|
|
|
d738b9 |
+tracefile = os.path.join(realm.testdir, 'trace')
|
|
|
d738b9 |
+minbits_kdc_conf = {'realms': {'$realm': {'pkinit_dh_min_bits': '4096'}}}
|
|
|
d738b9 |
+minbits_env = realm.special_env('restrict', True, kdc_conf=minbits_kdc_conf)
|
|
|
d738b9 |
+realm.stop_kdc()
|
|
|
d738b9 |
+realm.start_kdc(env=minbits_env)
|
|
|
d738b9 |
+realm.run(['env', 'KRB5_TRACE=' + tracefile, kinit, '-X',
|
|
|
d738b9 |
+ 'X509_user_identity=' + file_identity, realm.user_princ])
|
|
|
d738b9 |
+with open(tracefile, 'r') as f:
|
|
|
d738b9 |
+ trace = f.read()
|
|
|
d738b9 |
+if ('Key parameters not accepted' not in trace or
|
|
|
d738b9 |
+ 'Preauth tryagain input types' not in trace or
|
|
|
d738b9 |
+ 'trying again with KDC-provided parameters' not in trace):
|
|
|
d738b9 |
+ fail('DH renegotiation steps not found in kinit trace log')
|
|
|
d738b9 |
+realm.stop_kdc()
|
|
|
d738b9 |
+realm.start_kdc()
|
|
|
d738b9 |
+
|
|
|
d738b9 |
# Run the basic test - PKINIT with FILE: identity, with a password on the key,
|
|
|
d738b9 |
# supplied by the prompter.
|
|
|
d738b9 |
# Expect failure if the responder does nothing, and we have no prompter.
|