Blame SOURCES/Echo-KDC-cookies-in-preauth-tryagain.patch

665228
From 7deb721e6eeb51be30c147240426c19a0c7beede Mon Sep 17 00:00:00 2001
665228
From: Greg Hudson <ghudson@mit.edu>
665228
Date: Sat, 21 Jan 2017 13:20:38 -0500
665228
Subject: [PATCH] Echo KDC cookies in preauth tryagain
665228
665228
When trying again after a mechanism-specific error, we should send the
665228
KDC cookie for conformance with RFC 6113.
665228
665228
ticket: 8539
665228
(cherry picked from commit 25f12e90d98b677d0a72893b3c6eb859377aee68)
665228
[rharwood@redhat.com: backport around expected_trace]
665228
---
665228
 src/lib/krb5/krb/preauth2.c |  8 +++++++-
665228
 src/tests/t_pkinit.py       | 19 +++++++++----------
665228
 2 files changed, 16 insertions(+), 11 deletions(-)
665228
665228
diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c
665228
index 9c5d6eaa9..cfe3dd5b0 100644
665228
--- a/src/lib/krb5/krb/preauth2.c
665228
+++ b/src/lib/krb5/krb/preauth2.c
665228
@@ -923,7 +923,7 @@ k5_preauth_tryagain(krb5_context context, krb5_init_creds_context ctx,
665228
     krb5_pa_data **mod_pa;
665228
     krb5_clpreauth_modreq modreq;
665228
     clpreauth_handle h;
665228
-    int i;
665228
+    int i, count;
665228
 
665228
     *padata_out = NULL;
665228
 
665228
@@ -942,6 +942,12 @@ k5_preauth_tryagain(krb5_context context, krb5_init_creds_context ctx,
665228
                                  ctx->err_reply, ctx->err_padata,
665228
                                  ctx->prompter, ctx->prompter_data, &mod_pa);
665228
         if (ret == 0 && mod_pa != NULL) {
665228
+            for (count = 0; mod_pa[count] != NULL; count++);
665228
+            ret = copy_cookie(context, ctx->err_padata, &mod_pa, &count);
665228
+            if (ret) {
665228
+                krb5_free_pa_data(context, mod_pa);
665228
+                return ret;
665228
+            }
665228
             TRACE_PREAUTH_TRYAGAIN_OUTPUT(context, mod_pa);
665228
             *padata_out = mod_pa;
665228
             return 0;
665228
diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
665228
index 183977750..38424932b 100755
665228
--- a/src/tests/t_pkinit.py
665228
+++ b/src/tests/t_pkinit.py
665228
@@ -175,20 +175,19 @@ realm.kinit(realm.user_princ,
665228
 realm.klist(realm.user_princ)
665228
 
665228
 # Test a DH parameter renegotiation by temporarily setting a 4096-bit
665228
-# minimum on the KDC.
665228
-tracefile = os.path.join(realm.testdir, 'trace')
665228
+# minimum on the KDC.  (Preauth type 16 is PKINIT PA_PK_AS_REQ;
665228
+# 133 is FAST PA-FX-COOKIE.)
665228
 minbits_kdc_conf = {'realms': {'$realm': {'pkinit_dh_min_bits': '4096'}}}
665228
 minbits_env = realm.special_env('restrict', True, kdc_conf=minbits_kdc_conf)
665228
 realm.stop_kdc()
665228
 realm.start_kdc(env=minbits_env)
665228
-realm.run(['env', 'KRB5_TRACE=' + tracefile, kinit, '-X',
665228
-           'X509_user_identity=' + file_identity, realm.user_princ])
665228
-with open(tracefile, 'r') as f:
665228
-    trace = f.read()
665228
-if ('Key parameters not accepted' not in trace or
665228
-    'Preauth tryagain input types' not in trace or
665228
-    'trying again with KDC-provided parameters' not in trace):
665228
-    fail('DH renegotiation steps not found in kinit trace log')
665228
+expected_trace = ('Key parameters not accepted',
665228
+                  'Preauth tryagain input types',
665228
+                  'trying again with KDC-provided parameters',
665228
+                  'Followup preauth for next request: 16, 133')
665228
+realm.kinit(realm.user_princ,
665228
+            flags=['-X', 'X509_user_identity=%s' % file_identity],
665228
+            expected_trace=expected_trace)
665228
 realm.stop_kdc()
665228
 realm.start_kdc()
665228