|
 |
d738b9 |
From 7439bb967c7c7d860bc69b6b4eaa290a7fe7f530 Mon Sep 17 00:00:00 2001
|
|
|
d738b9 |
From: Greg Hudson <ghudson@mit.edu>
|
|
|
d738b9 |
Date: Sat, 21 Jan 2017 13:20:38 -0500
|
|
|
d738b9 |
Subject: [PATCH] Echo KDC cookies in preauth tryagain
|
|
|
d738b9 |
|
|
|
d738b9 |
When trying again after a mechanism-specific error, we should send the
|
|
|
d738b9 |
KDC cookie for conformance with RFC 6113.
|
|
|
d738b9 |
|
|
|
d738b9 |
ticket: 8539
|
|
|
d738b9 |
(cherry picked from commit 25f12e90d98b677d0a72893b3c6eb859377aee68)
|
|
|
d738b9 |
[rharwood@redhat.com: backport around expected_trace]
|
|
|
d738b9 |
---
|
|
|
d738b9 |
src/lib/krb5/krb/preauth2.c | 8 +++++++-
|
|
|
d738b9 |
src/tests/t_pkinit.py | 19 +++++++++----------
|
|
|
d738b9 |
2 files changed, 16 insertions(+), 11 deletions(-)
|
|
|
d738b9 |
|
|
|
d738b9 |
diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c
|
|
|
d738b9 |
index 9c5d6eaa9..cfe3dd5b0 100644
|
|
|
d738b9 |
--- a/src/lib/krb5/krb/preauth2.c
|
|
|
d738b9 |
+++ b/src/lib/krb5/krb/preauth2.c
|
|
|
d738b9 |
@@ -923,7 +923,7 @@ k5_preauth_tryagain(krb5_context context, krb5_init_creds_context ctx,
|
|
|
d738b9 |
krb5_pa_data **mod_pa;
|
|
|
d738b9 |
krb5_clpreauth_modreq modreq;
|
|
|
d738b9 |
clpreauth_handle h;
|
|
|
d738b9 |
- int i;
|
|
|
d738b9 |
+ int i, count;
|
|
|
d738b9 |
|
|
|
d738b9 |
*padata_out = NULL;
|
|
|
d738b9 |
|
|
|
d738b9 |
@@ -942,6 +942,12 @@ k5_preauth_tryagain(krb5_context context, krb5_init_creds_context ctx,
|
|
|
d738b9 |
ctx->err_reply, ctx->err_padata,
|
|
|
d738b9 |
ctx->prompter, ctx->prompter_data, &mod_pa);
|
|
|
d738b9 |
if (ret == 0 && mod_pa != NULL) {
|
|
|
d738b9 |
+ for (count = 0; mod_pa[count] != NULL; count++);
|
|
|
d738b9 |
+ ret = copy_cookie(context, ctx->err_padata, &mod_pa, &count);
|
|
|
d738b9 |
+ if (ret) {
|
|
|
d738b9 |
+ krb5_free_pa_data(context, mod_pa);
|
|
|
d738b9 |
+ return ret;
|
|
|
d738b9 |
+ }
|
|
|
d738b9 |
TRACE_PREAUTH_TRYAGAIN_OUTPUT(context, mod_pa);
|
|
|
d738b9 |
*padata_out = mod_pa;
|
|
|
d738b9 |
return 0;
|
|
|
d738b9 |
diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
|
|
|
d738b9 |
index 183977750..38424932b 100755
|
|
|
d738b9 |
--- a/src/tests/t_pkinit.py
|
|
|
d738b9 |
+++ b/src/tests/t_pkinit.py
|
|
|
d738b9 |
@@ -175,20 +175,19 @@ realm.kinit(realm.user_princ,
|
|
|
d738b9 |
realm.klist(realm.user_princ)
|
|
|
d738b9 |
|
|
|
d738b9 |
# Test a DH parameter renegotiation by temporarily setting a 4096-bit
|
|
|
d738b9 |
-# minimum on the KDC.
|
|
|
d738b9 |
-tracefile = os.path.join(realm.testdir, 'trace')
|
|
|
d738b9 |
+# minimum on the KDC. (Preauth type 16 is PKINIT PA_PK_AS_REQ;
|
|
|
d738b9 |
+# 133 is FAST PA-FX-COOKIE.)
|
|
|
d738b9 |
minbits_kdc_conf = {'realms': {'$realm': {'pkinit_dh_min_bits': '4096'}}}
|
|
|
d738b9 |
minbits_env = realm.special_env('restrict', True, kdc_conf=minbits_kdc_conf)
|
|
|
d738b9 |
realm.stop_kdc()
|
|
|
d738b9 |
realm.start_kdc(env=minbits_env)
|
|
|
d738b9 |
-realm.run(['env', 'KRB5_TRACE=' + tracefile, kinit, '-X',
|
|
|
d738b9 |
- 'X509_user_identity=' + file_identity, realm.user_princ])
|
|
|
d738b9 |
-with open(tracefile, 'r') as f:
|
|
|
d738b9 |
- trace = f.read()
|
|
|
d738b9 |
-if ('Key parameters not accepted' not in trace or
|
|
|
d738b9 |
- 'Preauth tryagain input types' not in trace or
|
|
|
d738b9 |
- 'trying again with KDC-provided parameters' not in trace):
|
|
|
d738b9 |
- fail('DH renegotiation steps not found in kinit trace log')
|
|
|
d738b9 |
+expected_trace = ('Key parameters not accepted',
|
|
|
d738b9 |
+ 'Preauth tryagain input types',
|
|
|
d738b9 |
+ 'trying again with KDC-provided parameters',
|
|
|
d738b9 |
+ 'Followup preauth for next request: 16, 133')
|
|
|
d738b9 |
+realm.kinit(realm.user_princ,
|
|
|
d738b9 |
+ flags=['-X', 'X509_user_identity=%s' % file_identity],
|
|
|
d738b9 |
+ expected_trace=expected_trace)
|
|
|
d738b9 |
realm.stop_kdc()
|
|
|
d738b9 |
realm.start_kdc()
|
|
|
d738b9 |
|