From: Greg Hudson <ghudson@mit.edu>
Date: Wed, 11 Jan 2017 15:49:30 +0000 (-0500)
Subject: Add test case for PKINIT DH renegotiation
X-Git-Tag: krb5-1.16-beta1~165
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7ad7eb7fd591e6c789ea24b94eccbf74ee4d79f8;p=thirdparty%2Fkrb5.git

Add test case for PKINIT DH renegotiation

In t_pkinit.py, add a PKINIT test case where the KDC sends
KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED and the client retries with the
KDC's TD_DH_PARAMETERS value, using the clpreauth tryagain method.
Use the trace log to verify that the renegotiation actually takes
place.
---

diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
index ac4d326b61..1839777504 100755
--- a/src/tests/t_pkinit.py
+++ b/src/tests/t_pkinit.py
@@ -174,6 +174,24 @@ realm.kinit(realm.user_princ,
                    '-X', 'flag_RSA_PROTOCOL=yes'])
 realm.klist(realm.user_princ)
 
+# Test a DH parameter renegotiation by temporarily setting a 4096-bit
+# minimum on the KDC.
+tracefile = os.path.join(realm.testdir, 'trace')
+minbits_kdc_conf = {'realms': {'$realm': {'pkinit_dh_min_bits': '4096'}}}
+minbits_env = realm.special_env('restrict', True, kdc_conf=minbits_kdc_conf)
+realm.stop_kdc()
+realm.start_kdc(env=minbits_env)
+realm.run(['env', 'KRB5_TRACE=' + tracefile, kinit, '-X',
+           'X509_user_identity=' + file_identity, realm.user_princ])
+with open(tracefile, 'r') as f:
+    trace = f.read()
+if ('Key parameters not accepted' not in trace or
+    'Preauth tryagain input types' not in trace or
+    'trying again with KDC-provided parameters' not in trace):
+    fail('DH renegotiation steps not found in kinit trace log')
+realm.stop_kdc()
+realm.start_kdc()
+
 # Run the basic test - PKINIT with FILE: identity, with a password on the key,
 # supplied by the prompter.
 # Expect failure if the responder does nothing, and we have no prompter.