krb5 commit: Add test case for PKINIT DH renegotiation

[Greg Hudson]

https://github.com/krb5/krb5/commit/7ad7eb7fd591e6c789ea24b94eccbf74ee4d79f8
commit 7ad7eb7fd591e6c789ea24b94eccbf74ee4d79f8
Author: Greg Hudson <ghudson at mit.edu>
Date:   Wed Jan 11 10:49:30 2017 -0500

    Add test case for PKINIT DH renegotiation
    
    In t_pkinit.py, add a PKINIT test case where the KDC sends
    KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED and the client retries with the
    KDC's TD_DH_PARAMETERS value, using the clpreauth tryagain method.
    Use the trace log to verify that the renegotiation actually takes
    place.

 src/tests/t_pkinit.py |   18 ++++++++++++++++++
 1 files changed, 18 insertions(+), 0 deletions(-)

diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
index ac4d326..1839777 100755
--- a/src/tests/t_pkinit.py
+++ b/src/tests/t_pkinit.py
@@ -174,6 +174,24 @@ realm.kinit(realm.user_princ,
                    '-X', 'flag_RSA_PROTOCOL=yes'])
 realm.klist(realm.user_princ)
 
+# Test a DH parameter renegotiation by temporarily setting a 4096-bit
+# minimum on the KDC.
+tracefile = os.path.join(realm.testdir, 'trace')
+minbits_kdc_conf = {'realms': {'$realm': {'pkinit_dh_min_bits': '4096'}}}
+minbits_env = realm.special_env('restrict', True, kdc_conf=minbits_kdc_conf)
+realm.stop_kdc()
+realm.start_kdc(env=minbits_env)
+realm.run(['env', 'KRB5_TRACE=' + tracefile, kinit, '-X',
+           'X509_user_identity=' + file_identity, realm.user_princ])
+with open(tracefile, 'r') as f:
+    trace = f.read()
+if ('Key parameters not accepted' not in trace or
+    'Preauth tryagain input types' not in trace or
+    'trying again with KDC-provided parameters' not in trace):
+    fail('DH renegotiation steps not found in kinit trace log')
+realm.stop_kdc()
+realm.start_kdc()
+
 # Run the basic test - PKINIT with FILE: identity, with a password on the key,
 # supplied by the prompter.
 # Expect failure if the responder does nothing, and we have no prompter.