[29829] in CVS-changelog-for-Kerberos-V5
krb5 commit: Add test case for PKINIT DH renegotiation
daemon@ATHENA.MIT.EDU (Greg Hudson)
Thu Jan 12 12:08:31 2017
Date: Thu, 12 Jan 2017 12:08:27 -0500
From: Greg Hudson <ghudson@mit.edu>
Message-Id: <201701121708.v0CH8RiE004827@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/7ad7eb7fd591e6c789ea24b94eccbf74ee4d79f8
commit 7ad7eb7fd591e6c789ea24b94eccbf74ee4d79f8
Author: Greg Hudson <ghudson@mit.edu>
Date: Wed Jan 11 10:49:30 2017 -0500
Add test case for PKINIT DH renegotiation
In t_pkinit.py, add a PKINIT test case where the KDC sends
KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED and the client retries with the
KDC's TD_DH_PARAMETERS value, using the clpreauth tryagain method.
Use the trace log to verify that the renegotiation actually takes
place.
src/tests/t_pkinit.py | 18 ++++++++++++++++++
1 files changed, 18 insertions(+), 0 deletions(-)
diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
index ac4d326..1839777 100755
--- a/src/tests/t_pkinit.py
+++ b/src/tests/t_pkinit.py
@@ -174,6 +174,24 @@ realm.kinit(realm.user_princ,
'-X', 'flag_RSA_PROTOCOL=yes'])
realm.klist(realm.user_princ)
+# Test a DH parameter renegotiation by temporarily setting a 4096-bit
+# minimum on the KDC.
+tracefile = os.path.join(realm.testdir, 'trace')
+minbits_kdc_conf = {'realms': {'$realm': {'pkinit_dh_min_bits': '4096'}}}
+minbits_env = realm.special_env('restrict', True, kdc_conf=minbits_kdc_conf)
+realm.stop_kdc()
+realm.start_kdc(env=minbits_env)
+realm.run(['env', 'KRB5_TRACE=' + tracefile, kinit, '-X',
+ 'X509_user_identity=' + file_identity, realm.user_princ])
+with open(tracefile, 'r') as f:
+ trace = f.read()
+if ('Key parameters not accepted' not in trace or
+ 'Preauth tryagain input types' not in trace or
+ 'trying again with KDC-provided parameters' not in trace):
+ fail('DH renegotiation steps not found in kinit trace log')
+realm.stop_kdc()
+realm.start_kdc()
+
# Run the basic test - PKINIT with FILE: identity, with a password on the key,
# supplied by the prompter.
# Expect failure if the responder does nothing, and we have no prompter.
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
