svn rev #24566: trunk/src/ lib/krb5/krb/ tests/

[ghudson@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24566
Commit By: ghudson
Log Message:
ticket: 6838
tags: pullups
target_version: 1.9

Fix a regression in the client-side ticket renewal code where KDC
options were not folded into the renewal request (most notably, the
KDC_OPT_RENEWABLE flag), so we didn't request renewable renewed
tickets.  Add a simple test case for ticket renewal.



Changed Files:
U   trunk/src/lib/krb5/krb/val_renew.c
U   trunk/src/tests/Makefile.in
A   trunk/src/tests/t_renew.py
Modified: trunk/src/lib/krb5/krb/val_renew.c
===================================================================
--- trunk/src/lib/krb5/krb/val_renew.c	2010-12-14 17:24:21 UTC (rev 24565)
+++ trunk/src/lib/krb5/krb/val_renew.c	2010-12-14 17:28:38 UTC (rev 24566)
@@ -59,7 +59,10 @@
     if (code != 0)
 	return code;
 
-    /* Use it to get a new credential from the KDC. */
+    /* Use KDC options from old credential as well as requested options. */
+    kdcopt |= (old_creds.ticket_flags & KDC_TKT_COMMON_MASK);
+
+    /* Use the old credential to get a new credential from the KDC. */
     code = krb5_get_cred_via_tkt(context, &old_creds, kdcopt,
 				 old_creds.addresses, in_creds, &new_creds);
     krb5_free_cred_contents(context, &old_creds);

Modified: trunk/src/tests/Makefile.in
===================================================================
--- trunk/src/tests/Makefile.in	2010-12-14 17:24:21 UTC (rev 24565)
+++ trunk/src/tests/Makefile.in	2010-12-14 17:28:38 UTC (rev 24566)
@@ -66,6 +66,7 @@
 	$(RUNPYTEST) $(srcdir)/t_lockout.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_kadm5_hook.py $(PYTESTFLAGS)
 	$(RUNPYTEST) $(srcdir)/t_keyrollover.py $(PYTESTFLAGS)
+	$(RUNPYTEST) $(srcdir)/t_renew.py $(PYTESTFLAGS)
 
 clean::
 	$(RM) kdc.conf

Added: trunk/src/tests/t_renew.py
===================================================================
--- trunk/src/tests/t_renew.py	                        (rev 0)
+++ trunk/src/tests/t_renew.py	2010-12-14 17:28:38 UTC (rev 24566)
@@ -0,0 +1,16 @@
+#!/usr/bin/python
+from k5test import *
+
+realm = K5Realm(create_host=False, start_kadmind=False, get_creds=False)
+
+# Configure the realm to allow renewable tickets and acquire some.
+realm.run_kadminl('modprinc -maxrenewlife "2 days" user')
+realm.run_kadminl('modprinc -maxrenewlife "2 days" %s' % realm.krbtgt_princ)
+realm.kinit(realm.user_princ, password('user'), flags=['-r', '2d'])
+
+# Renew twice, to test that renewed tickets are renewable.
+realm.kinit(realm.user_princ, flags=['-R'])
+realm.kinit(realm.user_princ, flags=['-R'])
+realm.klist(realm.user_princ)
+
+success('Renewing credentials.')