krb5 commit: Add paChecksum2 to PKINIT ASN.1 tests

ghudson at mit.edu ghudson at mit.edu
Mon Oct 6 12:42:43 EDT 2025


https://github.com/krb5/krb5/commit/34d661676b1db04d870be3d7ad26616aa69d1f3d
commit 34d661676b1db04d870be3d7ad26616aa69d1f3d
Author: Greg Hudson <ghudson at mit.edu>
Date:   Sun Sep 28 15:39:10 2025 -0400

    Add paChecksum2 to PKINIT ASN.1 tests
    
    Commit 310793ba63782af5ffa3a95d20e41f8f03ca7e00 added the paChecksum2
    field to krb5_pk_authenticator.  ktest_make_sample_pk_authenticator()
    does not initialize this field, leading to undefined behavior in the
    tests.  Initialize the field with a sample paChecksum2 value, and
    amend the expected output to include its encoding.
    
    Reported by Michael Osipov.

 src/tests/asn.1/krb5_decode_test.c |  2 +-
 src/tests/asn.1/ktest.c            | 42 ++++++++++++++++++++++++++++----------
 src/tests/asn.1/ktest_equal.c      | 15 +++++++++++++-
 src/tests/asn.1/pkinit_encode.out  |  2 +-
 src/tests/asn.1/pkinit_trval.out   |  6 ++++++
 5 files changed, 53 insertions(+), 14 deletions(-)

diff --git a/src/tests/asn.1/krb5_decode_test.c b/src/tests/asn.1/krb5_decode_test.c
index 25ed30e42..daeab87c3 100644
--- a/src/tests/asn.1/krb5_decode_test.c
+++ b/src/tests/asn.1/krb5_decode_test.c
@@ -1178,7 +1178,7 @@ main(int argc, char **argv)
     /* decode_krb5_auth_pack */
     {
         setup(krb5_auth_pack,ktest_make_sample_auth_pack);
-        decode_run("krb5_auth_pack","","30 81 89 A0 39 30 37 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61",
+        decode_run("krb5_auth_pack","","30 81 B0 A0 60 30 5E A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A5 25 30 23 A0 0A 04 08 6B 72 62 35 64 61 74 61 A1 15 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61",
                    acc.decode_krb5_auth_pack,
                    ktest_equal_auth_pack,ktest_free_auth_pack);
         ktest_empty_auth_pack(&ref);
diff --git a/src/tests/asn.1/ktest.c b/src/tests/asn.1/ktest.c
index 20360c8ff..d607891d3 100644
--- a/src/tests/asn.1/ktest.c
+++ b/src/tests/asn.1/ktest.c
@@ -694,17 +694,6 @@ ktest_make_maximal_pa_otp_req(krb5_pa_otp_req *p)
 
 #ifndef DISABLE_PKINIT
 
-static void
-ktest_make_sample_pk_authenticator(krb5_pk_authenticator *p)
-{
-    p->cusec = SAMPLE_USEC;
-    p->ctime = SAMPLE_TIME;
-    p->nonce = SAMPLE_NONCE;
-    ktest_make_sample_data(&p->paChecksum);
-    p->freshnessToken = ealloc(sizeof(krb5_data));
-    ktest_make_sample_data(p->freshnessToken);
-}
-
 static void
 ktest_make_sample_oid(krb5_data *p)
 {
@@ -726,6 +715,26 @@ ktest_make_sample_algorithm_identifier_no_params(krb5_algorithm_identifier *p)
     p->parameters = empty_data();
 }
 
+static void
+ktest_make_sample_pa_checksum2(krb5_pachecksum2 *p)
+{
+    ktest_make_sample_data(&p->checksum);
+    ktest_make_sample_algorithm_identifier(&p->algorithmIdentifier);
+}
+
+static void
+ktest_make_sample_pk_authenticator(krb5_pk_authenticator *p)
+{
+    p->cusec = SAMPLE_USEC;
+    p->ctime = SAMPLE_TIME;
+    p->nonce = SAMPLE_NONCE;
+    ktest_make_sample_data(&p->paChecksum);
+    p->freshnessToken = ealloc(sizeof(krb5_data));
+    ktest_make_sample_data(p->freshnessToken);
+    p->paChecksum2 = ealloc(sizeof(krb5_pachecksum2));
+    ktest_make_sample_pa_checksum2(p->paChecksum2);
+}
+
 static void
 ktest_make_sample_external_principal_identifier(
     krb5_external_principal_identifier *p)
@@ -1599,12 +1608,23 @@ ktest_empty_pa_otp_req(krb5_pa_otp_req *p)
 
 #ifndef DISABLE_PKINIT
 
+static void
+ktest_empty_pa_checksum2(krb5_pachecksum2 *p)
+{
+    ktest_empty_data(&p->checksum);
+    ktest_empty_algorithm_identifier(&p->algorithmIdentifier);
+}
+
 static void
 ktest_empty_pk_authenticator(krb5_pk_authenticator *p)
 {
     ktest_empty_data(&p->paChecksum);
     krb5_free_data(NULL, p->freshnessToken);
     p->freshnessToken = NULL;
+    if (p->paChecksum2 != NULL)
+        ktest_empty_pa_checksum2(p->paChecksum2);
+    free(p->paChecksum2);
+    p->paChecksum2 = NULL;
 }
 
 static void
diff --git a/src/tests/asn.1/ktest_equal.c b/src/tests/asn.1/ktest_equal.c
index 13786dd1e..72aa1ff6c 100644
--- a/src/tests/asn.1/ktest_equal.c
+++ b/src/tests/asn.1/ktest_equal.c
@@ -834,6 +834,18 @@ ktest_equal_sequence_of_spake_factor(krb5_spake_factor **ref,
 
 #ifndef DISABLE_PKINIT
 
+static int
+ktest_equal_pachecksum2(krb5_pachecksum2 *ref, krb5_pachecksum2 *var)
+{
+    int p = TRUE;
+    if (ref == var) return TRUE;
+    else if (ref == NULL || var == NULL) return FALSE;
+    p = p && equal_str(checksum);
+    p = p && struct_equal(algorithmIdentifier,
+                          ktest_equal_algorithm_identifier);
+    return p;
+}
+
 static int
 ktest_equal_pk_authenticator(krb5_pk_authenticator *ref,
                              krb5_pk_authenticator *var)
@@ -844,7 +856,8 @@ ktest_equal_pk_authenticator(krb5_pk_authenticator *ref,
     p = p && scalar_equal(cusec);
     p = p && scalar_equal(ctime);
     p = p && scalar_equal(nonce);
-    p = p && data_eq(ref->paChecksum, var->paChecksum);
+    p = p && equal_str(paChecksum);
+    p = p && ptr_equal(paChecksum2, ktest_equal_pachecksum2);
     return p;
 }
 
diff --git a/src/tests/asn.1/pkinit_encode.out b/src/tests/asn.1/pkinit_encode.out
index a764182e1..9ab0aee77 100644
--- a/src/tests/asn.1/pkinit_encode.out
+++ b/src/tests/asn.1/pkinit_encode.out
@@ -1,7 +1,7 @@
 encode_krb5_pa_pk_as_req: 30 38 80 08 6B 72 62 35 64 61 74 61 A1 22 30 20 30 1E 80 08 6B 72 62 35 64 61 74 61 81 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61
 encode_krb5_pa_pk_as_rep(dhInfo): A0 28 30 26 80 08 6B 72 62 35 64 61 74 61 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
 encode_krb5_pa_pk_as_rep(encKeyPack): 81 08 6B 72 62 35 64 61 74 61
-encode_krb5_auth_pack: 30 81 89 A0 39 30 37 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
+encode_krb5_auth_pack: 30 81 B0 A0 60 30 5E A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A5 25 30 23 A0 0A 04 08 6B 72 62 35 64 61 74 61 A1 15 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
 encode_krb5_kdc_dh_key_info: 30 25 A0 0B 03 09 00 6B 72 62 35 64 61 74 61 A1 03 02 01 2A A2 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A
 encode_krb5_reply_key_pack: 30 26 A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
 encode_krb5_sp80056a_other_info: 30 81 81 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A0 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A2 0A 04 08 6B 72 62 35 64 61 74 61
diff --git a/src/tests/asn.1/pkinit_trval.out b/src/tests/asn.1/pkinit_trval.out
index c47bd71f6..418be6354 100644
--- a/src/tests/asn.1/pkinit_trval.out
+++ b/src/tests/asn.1/pkinit_trval.out
@@ -40,6 +40,12 @@ encode_krb5_auth_pack:
 .  .  [2] [Integer] 42
 .  .  [3] [Octet String] "krb5data"
 .  .  [4] [Octet String] "krb5data"
+.  .  [5] [Sequence/Sequence Of]
+.  .  .  [0] [Octet String] "krb5data"
+.  .  .  [1] [Sequence/Sequence Of]
+.  .  .  .  [Object Identifier] <9>
+               2a 86 48 86 f7 12 01 02 02                    *.H......
+.  .  .  .  [Octet String] "params"
 .  [1] [Octet String] "pvalue"
 .  [2] [Sequence/Sequence Of]
 .  .  [Sequence/Sequence Of]


More information about the cvs-krb5 mailing list