From c22d77ba160927e8d5e1a54333c1e9ff2c1ce963 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Wed, 3 Mar 2021 16:23:34 -0500
Subject: [PATCH 01/22] Fix the mess the mass rebuild made of Release

---
 krb5.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krb5.spec b/krb5.spec
index 81f9a94..e21080b 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}3%{?dist}.1
+Release: %{?zdpd}4%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz

From 3892b7fc8e2e1d943e54d9017769a24f648df886 Mon Sep 17 00:00:00 2001
From: Miroslav Vadkerti <mvadkert@redhat.com>
Date: Mon, 29 Mar 2021 10:30:49 +0200
Subject: [PATCH 02/22] Onboard krb5 to downstream gating

Because krb5 is auto-synced via DistroBaker, we need to add
downstream gating configuration in Fedora.

Signed-off-by: Miroslav Vadkerti <mvadkert@redhat.com>
---
 gating.yaml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 gating.yaml

diff --git a/gating.yaml b/gating.yaml
new file mode 100644
index 0000000..5588d06
--- /dev/null
+++ b/gating.yaml
@@ -0,0 +1,6 @@
+ --- !Policy
+ product_versions:
+   - rhel-9
+ decision_context: osci_compose_gate
+ rules:
+   - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}

From 2f63f28a7618e3513c3940555198b44a240c456c Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Mon, 3 May 2021 17:50:44 -0400
Subject: [PATCH 03/22] Add rpminspect configuration

(cherry picked from commit 1c2362203efef27ede12cd70d9e746eb4fe5ef19)
---
 rpminspect.yaml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 rpminspect.yaml

diff --git a/rpminspect.yaml b/rpminspect.yaml
new file mode 100644
index 0000000..a31a5e3
--- /dev/null
+++ b/rpminspect.yaml
@@ -0,0 +1,17 @@
+---
+inspections:
+  # https://bugzilla.redhat.com/show_bug.cgi?id=1956479
+  badfuncs: off
+
+  # Not a Java package
+  javabytecode: off
+
+  # I need to be able to *add* functions, and also we export internal
+  # functions that are not considered part of our ABI.
+  abidiff: off
+  
+  # These just flag when things change "too much"
+  changedfiles: off
+  filesize: off
+  patches: off
+  upstream: off

From be7528aa8e47e45f4b9de90769643e74e2d40470 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Tue, 4 May 2021 15:02:53 -0400
Subject: [PATCH 04/22] Suppress static analyzer warning in FIPS override

(cherry picked from commit e9fb111a119250ea761f3f3a3059cca72bd71d76)
---
 Add-APIs-for-marshalling-credentials.patch             |  2 +-
 ...hostname-canonicalization-helper-to-k5test.py.patch |  2 +-
 Support-host-based-GSS-initiator-names.patch           |  2 +-
 downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch     | 10 ++++++----
 krb5.spec                                              |  5 ++++-
 5 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/Add-APIs-for-marshalling-credentials.patch b/Add-APIs-for-marshalling-credentials.patch
index 105f358..da613e9 100644
--- a/Add-APIs-for-marshalling-credentials.patch
+++ b/Add-APIs-for-marshalling-credentials.patch
@@ -1,4 +1,4 @@
-From 4505316756e42db02b6dabe0a6b075fe52852371 Mon Sep 17 00:00:00 2001
+From c1fe1c8fa3df7f50c7e28d52263d0d24afb4b3a1 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Thu, 14 Jan 2021 18:13:09 -0500
 Subject: [PATCH] Add APIs for marshalling credentials
diff --git a/Add-hostname-canonicalization-helper-to-k5test.py.patch b/Add-hostname-canonicalization-helper-to-k5test.py.patch
index 501984f..75c3e87 100644
--- a/Add-hostname-canonicalization-helper-to-k5test.py.patch
+++ b/Add-hostname-canonicalization-helper-to-k5test.py.patch
@@ -1,4 +1,4 @@
-From d898d94cef8e1a8772a91cd3a62255c33f109636 Mon Sep 17 00:00:00 2001
+From 3e78bc5d48513fe38f3bc4228b12abcdc0733ee2 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Fri, 15 Jan 2021 14:43:34 -0500
 Subject: [PATCH] Add hostname canonicalization helper to k5test.py
diff --git a/Support-host-based-GSS-initiator-names.patch b/Support-host-based-GSS-initiator-names.patch
index ebcae16..25b074f 100644
--- a/Support-host-based-GSS-initiator-names.patch
+++ b/Support-host-based-GSS-initiator-names.patch
@@ -1,4 +1,4 @@
-From 8c57937f3ca793fe3f8fdd636be0bc11c24069bc Mon Sep 17 00:00:00 2001
+From 3133e5e24e94bf060e23a4d97cbdf74e934d010f Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Fri, 15 Jan 2021 13:51:34 -0500
 Subject: [PATCH] Support host-based GSS initiator names
diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
index 047a59e..d48b1cd 100644
--- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
+++ b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
@@ -1,4 +1,4 @@
-From 4a62aeae7b747cd289548949f940525365fe0947 Mon Sep 17 00:00:00 2001
+From 852e9efad17e3ef6ea54f91044a279bb34020ecf Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Fri, 9 Nov 2018 15:12:21 -0500
 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4
@@ -19,6 +19,8 @@ post6 restores MD4 (and therefore keygen-only RC4).
 
 post7 restores MD5 and adds radius_md5_fips_override.
 
+post8 silences a static analyzer warning.
+
 Last-updated: krb5-1.17
 ---
  doc/admin/conf_files/krb5_conf.rst            |  6 +++
@@ -349,7 +351,7 @@ index 03c613716..d89982a13 100644
              return retval;
  
 diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h
-index 0143d155a..223ffd730 100644
+index 0143d155a..57672982f 100644
 --- a/src/lib/krad/internal.h
 +++ b/src/lib/krad/internal.h
 @@ -39,6 +39,8 @@
@@ -407,8 +409,8 @@ index 0143d155a..223ffd730 100644
 +    if (!FIPS_mode())
 +        return 0;
 +
-+    profile_get_boolean(ctx->profile, "libdefaults",
-+                        "radius_md5_fips_override", NULL, 0, &val);
++    (void)profile_get_boolean(ctx->profile, "libdefaults",
++                              "radius_md5_fips_override", NULL, 0, &val);
 +    return !val;
 +}
 +
diff --git a/krb5.spec b/krb5.spec
index e21080b..c4a407e 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}4%{?dist}
+Release: %{?zdpd}5%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -635,6 +635,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Tue May 04 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-5
+- Suppress static analyzer warning in FIPS override
+
 * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.19.1-3.1
 - Rebuilt for updated systemd-rpm-macros
   See https://pagure.io/fesco/issue/2583.

From b407176c1f69882e2ea9bd5b14bed7f36d26ddb2 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Tue, 4 May 2021 15:21:05 -0400
Subject: [PATCH 05/22] Remove broken gating file

Currently the gating file prevents building:

    rharwood@eesha:~/krb5.fedora/rawhide$ fedpkg build
    Could not execute build: Found a gating.yaml file in your repo with additional Greenwave policies, but it is not valid.
    Please fix the file or skip this check using the option --skip-remote-rules-validation.
    Error response from Greenwave: YAML Parser Error: mapping values are not allowed here
      in "<unicode string>", line 2, column 18:
           product_versions:
                                ^
    rharwood@eesha:~/krb5.fedora/rawhide$

Patches to add it back will be considered if and only if they don't
break the build.

(cherry picked from commit 69e05d5e39b3a10e453a6cf72c646cd6c2876ea8)
---
 gating.yaml | 6 ------
 1 file changed, 6 deletions(-)
 delete mode 100644 gating.yaml

diff --git a/gating.yaml b/gating.yaml
deleted file mode 100644
index 5588d06..0000000
--- a/gating.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
- --- !Policy
- product_versions:
-   - rhel-9
- decision_context: osci_compose_gate
- rules:
-   - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}

From a987c5f3a2f811d72af827bece6b521a54f21e5a Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Thu, 20 May 2021 13:48:19 -0400
Subject: [PATCH 06/22] Add KCM_OP_GET_CRED_LIST and KCM_OP_RETRIEVE support

(cherry picked from commit 904d264a4145af06e7524b1b6a6e75a8e01d3b38)
---
 ...P_GET_CRED_LIST-for-faster-iteration.patch | 358 ++++++++++++++++++
 Use-KCM_OP_RETRIEVE-in-KCM-client.patch       | 235 ++++++++++++
 krb5.spec                                     |   7 +-
 3 files changed, 599 insertions(+), 1 deletion(-)
 create mode 100644 Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
 create mode 100644 Use-KCM_OP_RETRIEVE-in-KCM-client.patch

diff --git a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
new file mode 100644
index 0000000..237de35
--- /dev/null
+++ b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
@@ -0,0 +1,358 @@
+From dc92022ad26cec8085a852dec6aeba310fa7a751 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
+Date: Thu, 11 Feb 2021 15:33:10 +0100
+Subject: [PATCH] Add KCM_OP_GET_CRED_LIST for faster iteration
+
+For large caches, one IPC operation per credential dominates the cost
+of iteration.  Instead transfer the whole list of credentials to the
+client in one IPC operation.
+
+Add optional support for the new opcode to the test KCM server to
+allow testing of the main and fallback code paths.
+
+[ghudson@mit.edu: fixed memory leaks and potential memory errors;
+adjusted code style and comments; rewrote commit message; added
+kcmserver.py support and tests]
+
+ticket: 8990 (new)
+(cherry picked from commit 81bdb47d8ded390263d8ee48f71d5c312b4f1736)
+---
+ src/include/kcm.h            |  12 ++-
+ src/lib/krb5/ccache/cc_kcm.c | 144 ++++++++++++++++++++++++++++++++---
+ src/tests/kcmserver.py       |  28 ++++++-
+ src/tests/t_ccache.py        |  10 ++-
+ 4 files changed, 175 insertions(+), 19 deletions(-)
+
+diff --git a/src/include/kcm.h b/src/include/kcm.h
+index 5ea1447cd..e4140c3a0 100644
+--- a/src/include/kcm.h
++++ b/src/include/kcm.h
+@@ -51,9 +51,9 @@
+  *
+  * All replies begin with a 32-bit big-endian reply code.
+  *
+- * Parameters are appended to the request or reply with no delimiters.  Flags
+- * and time offsets are stored as 32-bit big-endian integers.  Names are
+- * marshalled as zero-terminated strings.  Principals and credentials are
++ * Parameters are appended to the request or reply with no delimiters.  Flags,
++ * time offsets, and lengths are stored as 32-bit big-endian integers.  Names
++ * are marshalled as zero-terminated strings.  Principals and credentials are
+  * marshalled in the v4 FILE ccache format.  UUIDs are 16 bytes.  UUID lists
+  * are not delimited, so nothing can come after them.
+  */
+@@ -89,7 +89,11 @@ typedef enum kcm_opcode {
+     KCM_OP_HAVE_NTLM_CRED,
+     KCM_OP_DEL_NTLM_CRED,
+     KCM_OP_DO_NTLM_AUTH,
+-    KCM_OP_GET_NTLM_USER_LIST
++    KCM_OP_GET_NTLM_USER_LIST,
++
++    /* MIT extensions */
++    KCM_OP_MIT_EXTENSION_BASE = 13000,
++    KCM_OP_GET_CRED_LIST,       /* (name) -> (count, count*{len, cred}) */
+ } kcm_opcode;
+ 
+ #endif /* KCM_H */
+diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
+index 9093f894d..772928e4d 100644
+--- a/src/lib/krb5/ccache/cc_kcm.c
++++ b/src/lib/krb5/ccache/cc_kcm.c
+@@ -61,6 +61,17 @@ struct uuid_list {
+     size_t pos;
+ };
+ 
++struct cred_list {
++    krb5_creds *creds;
++    size_t count;
++    size_t pos;
++};
++
++struct kcm_cursor {
++    struct uuid_list *uuids;
++    struct cred_list *creds;
++};
++
+ struct kcmio {
+     SOCKET fd;
+ #ifdef __APPLE__
+@@ -489,6 +500,69 @@ free_uuid_list(struct uuid_list *uuids)
+     free(uuids);
+ }
+ 
++static void
++free_cred_list(struct cred_list *list)
++{
++    size_t i;
++
++    if (list == NULL)
++        return;
++
++    /* Creds are transferred to the caller as list->pos is incremented, so we
++     * can start freeing there. */
++    for (i = list->pos; i < list->count; i++)
++        krb5_free_cred_contents(NULL, &list->creds[i]);
++    free(list->creds);
++    free(list);
++}
++
++/* Fetch a cred list from req->reply. */
++static krb5_error_code
++kcmreq_get_cred_list(struct kcmreq *req, struct cred_list **creds_out)
++{
++    struct cred_list *list;
++    const unsigned char *data;
++    krb5_error_code ret = 0;
++    size_t count, len, i;
++
++    *creds_out = NULL;
++
++    /* Check a rough bound on the count to prevent very large allocations. */
++    count = k5_input_get_uint32_be(&req->reply);
++    if (count > req->reply.len / 4)
++        return KRB5_KCM_MALFORMED_REPLY;
++
++    list = malloc(sizeof(*list));
++    if (list == NULL)
++        return ENOMEM;
++
++    list->creds = NULL;
++    list->count = count;
++    list->pos = 0;
++    list->creds = k5calloc(count, sizeof(*list->creds), &ret);
++    if (list->creds == NULL) {
++        free(list);
++        return ret;
++    }
++
++    for (i = 0; i < count; i++) {
++        len = k5_input_get_uint32_be(&req->reply);
++        data = k5_input_get_bytes(&req->reply, len);
++        if (data == NULL)
++            break;
++        ret = k5_unmarshal_cred(data, len, 4, &list->creds[i]);
++        if (ret)
++            break;
++    }
++    if (i < count) {
++        free_cred_list(list);
++        return (ret == ENOMEM) ? ENOMEM : KRB5_KCM_MALFORMED_REPLY;
++    }
++
++    *creds_out = list;
++    return 0;
++}
++
+ static void
+ kcmreq_free(struct kcmreq *req)
+ {
+@@ -753,33 +827,53 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache,
+ {
+     krb5_error_code ret;
+     struct kcmreq req = EMPTY_KCMREQ;
+-    struct uuid_list *uuids;
++    struct uuid_list *uuids = NULL;
++    struct cred_list *creds = NULL;
++    struct kcm_cursor *cursor;
+ 
+     *cursor_out = NULL;
+ 
+     get_kdc_offset(context, cache);
+ 
+-    kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache);
++    kcmreq_init(&req, KCM_OP_GET_CRED_LIST, cache);
+     ret = cache_call(context, cache, &req);
+-    if (ret)
++    if (ret == 0) {
++        /* GET_CRED_LIST is available. */
++        ret = kcmreq_get_cred_list(&req, &creds);
++        if (ret)
++            goto cleanup;
++    } else if (ret == KRB5_FCC_INTERNAL) {
++        /* Fall back to GET_CRED_UUID_LIST. */
++        kcmreq_free(&req);
++        kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache);
++        ret = cache_call(context, cache, &req);
++        if (ret)
++            goto cleanup;
++        ret = kcmreq_get_uuid_list(&req, &uuids);
++        if (ret)
++            goto cleanup;
++    } else {
+         goto cleanup;
+-    ret = kcmreq_get_uuid_list(&req, &uuids);
+-    if (ret)
++    }
++
++    cursor = k5alloc(sizeof(*cursor), &ret);
++    if (cursor == NULL)
+         goto cleanup;
+-    *cursor_out = (krb5_cc_cursor)uuids;
++    cursor->uuids = uuids;
++    cursor->creds = creds;
++    *cursor_out = (krb5_cc_cursor)cursor;
+ 
+ cleanup:
+     kcmreq_free(&req);
+     return ret;
+ }
+ 
+-static krb5_error_code KRB5_CALLCONV
+-kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor,
+-              krb5_creds *cred_out)
++static krb5_error_code
++next_cred_by_uuid(krb5_context context, krb5_ccache cache,
++                  struct uuid_list *uuids, krb5_creds *cred_out)
+ {
+     krb5_error_code ret;
+     struct kcmreq req;
+-    struct uuid_list *uuids = (struct uuid_list *)*cursor;
+ 
+     memset(cred_out, 0, sizeof(*cred_out));
+ 
+@@ -797,11 +891,39 @@ kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor,
+     return map_invalid(ret);
+ }
+ 
++static krb5_error_code KRB5_CALLCONV
++kcm_next_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor,
++              krb5_creds *cred_out)
++{
++    struct kcm_cursor *c = (struct kcm_cursor *)*cursor;
++    struct cred_list *list;
++
++    if (c->uuids != NULL)
++        return next_cred_by_uuid(context, cache, c->uuids, cred_out);
++
++    list = c->creds;
++    if (list->pos >= list->count)
++        return KRB5_CC_END;
++
++    /* Transfer memory ownership of one cred to the caller. */
++    *cred_out = list->creds[list->pos];
++    memset(&list->creds[list->pos], 0, sizeof(*list->creds));
++    list->pos++;
++
++    return 0;
++}
++
+ static krb5_error_code KRB5_CALLCONV
+ kcm_end_seq_get(krb5_context context, krb5_ccache cache,
+                 krb5_cc_cursor *cursor)
+ {
+-    free_uuid_list((struct uuid_list *)*cursor);
++    struct kcm_cursor *c = *cursor;
++
++    if (c == NULL)
++        return 0;
++    free_uuid_list(c->uuids);
++    free_cred_list(c->creds);
++    free(c);
+     *cursor = NULL;
+     return 0;
+ }
+diff --git a/src/tests/kcmserver.py b/src/tests/kcmserver.py
+index 57432e5a7..8c5e66ff1 100644
+--- a/src/tests/kcmserver.py
++++ b/src/tests/kcmserver.py
+@@ -23,6 +23,7 @@
+ #         traceback.print_exception(etype, value, tb, file=f)
+ # sys.excepthook = ehook
+ 
++import optparse
+ import select
+ import socket
+ import struct
+@@ -49,12 +50,14 @@ class KCMOpcodes(object):
+     SET_DEFAULT_CACHE = 21
+     GET_KDC_OFFSET = 22
+     SET_KDC_OFFSET = 23
++    GET_CRED_LIST = 13001
+ 
+ 
+ class KRB5Errors(object):
+     KRB5_CC_END = -1765328242
+     KRB5_CC_NOSUPP = -1765328137
+     KRB5_FCC_NOFILE = -1765328189
++    KRB5_FCC_INTERNAL = -1765328188
+ 
+ 
+ def make_uuid():
+@@ -183,6 +186,14 @@ def op_set_kdc_offset(argbytes):
+     return 0, b''
+ 
+ 
++def op_get_cred_list(argbytes):
++    name, rest = unmarshal_name(argbytes)
++    cache = get_cache(name)
++    creds = [cache.creds[u] for u in cache.cred_uuids]
++    return 0, (struct.pack('>L', len(creds)) +
++               b''.join(struct.pack('>L', len(c)) + c for c in creds))
++
++
+ ophandlers = {
+     KCMOpcodes.GEN_NEW : op_gen_new,
+     KCMOpcodes.INITIALIZE : op_initialize,
+@@ -197,7 +208,8 @@ ophandlers = {
+     KCMOpcodes.GET_DEFAULT_CACHE : op_get_default_cache,
+     KCMOpcodes.SET_DEFAULT_CACHE : op_set_default_cache,
+     KCMOpcodes.GET_KDC_OFFSET : op_get_kdc_offset,
+-    KCMOpcodes.SET_KDC_OFFSET : op_set_kdc_offset
++    KCMOpcodes.SET_KDC_OFFSET : op_set_kdc_offset,
++    KCMOpcodes.GET_CRED_LIST : op_get_cred_list
+ }
+ 
+ # Read and respond to a request from the socket s.
+@@ -215,7 +227,11 @@ def service_request(s):
+ 
+     majver, minver, op = struct.unpack('>BBH', req[:4])
+     argbytes = req[4:]
+-    code, payload = ophandlers[op](argbytes)
++
++    if op in ophandlers:
++        code, payload = ophandlers[op](argbytes)
++    else:
++        code, payload = KRB5Errors.KRB5_FCC_INTERNAL, b''
+ 
+     # The KCM response is the code (4 bytes) and the response payload.
+     # The Heimdal IPC response is the length of the KCM response (4
+@@ -226,9 +242,15 @@ def service_request(s):
+     s.sendall(hipc_response)
+     return True
+ 
++parser = optparse.OptionParser()
++parser.add_option('-c', '--credlist', action='store_true', dest='credlist',
++                  default=False, help='Support KCM_OP_GET_CRED_LIST')
++(options, args) = parser.parse_args()
++if not options.credlist:
++    del ophandlers[KCMOpcodes.GET_CRED_LIST]
+ 
+ server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+-server.bind(sys.argv[1])
++server.bind(args[0])
+ server.listen(5)
+ select_input = [server,]
+ sys.stderr.write('starting...\n')
+diff --git a/src/tests/t_ccache.py b/src/tests/t_ccache.py
+index 66804afa5..90040fb7b 100755
+--- a/src/tests/t_ccache.py
++++ b/src/tests/t_ccache.py
+@@ -125,10 +125,18 @@ def collection_test(realm, ccname):
+ 
+ 
+ collection_test(realm, 'DIR:' + os.path.join(realm.testdir, 'cc'))
++
++# Test KCM without and with GET_CRED_LIST support.
+ kcmserver_path = os.path.join(srctop, 'tests', 'kcmserver.py')
+-realm.start_server([sys.executable, kcmserver_path, kcm_socket_path],
++kcmd = realm.start_server([sys.executable, kcmserver_path, kcm_socket_path],
++                          'starting...')
++collection_test(realm, 'KCM:')
++stop_daemon(kcmd)
++os.remove(kcm_socket_path)
++realm.start_server([sys.executable, kcmserver_path, '-c', kcm_socket_path],
+                    'starting...')
+ collection_test(realm, 'KCM:')
++
+ if test_keyring:
+     def cleanup_keyring(anchor, name):
+         out = realm.run(['keyctl', 'list', anchor])
diff --git a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch
new file mode 100644
index 0000000..22c6593
--- /dev/null
+++ b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch
@@ -0,0 +1,235 @@
+From 04a810c642245947d5f32a498ed7b1a6f9a11006 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 26 Mar 2021 23:38:54 -0400
+Subject: [PATCH] Use KCM_OP_RETRIEVE in KCM client
+
+In kcm_retrieve(), try KCM_OP_RETRIEVE.  Fall back to iteration if the
+server doesn't implement it, or if we can an answer incompatible with
+KRB5_TC_SUPPORTED_KTYPES.
+
+In kcmserver.py, implement partial decoding for creds and cred tags so
+that we can do a basic principal name match.
+
+ticket: 8997 (new)
+(cherry picked from commit 795ebba8c039be172ab93cd41105c73ffdba0fdb)
+---
+ src/include/kcm.h            |  2 +-
+ src/lib/krb5/ccache/cc_kcm.c | 52 +++++++++++++++++++++++++++++++++---
+ src/tests/kcmserver.py       | 44 +++++++++++++++++++++++++++---
+ src/tests/t_ccache.py        | 11 +++++---
+ 4 files changed, 99 insertions(+), 10 deletions(-)
+
+diff --git a/src/include/kcm.h b/src/include/kcm.h
+index e4140c3a0..5a3e55ce6 100644
+--- a/src/include/kcm.h
++++ b/src/include/kcm.h
+@@ -68,7 +68,7 @@ typedef enum kcm_opcode {
+     KCM_OP_INITIALIZE,          /*          (name, princ) -> ()          */
+     KCM_OP_DESTROY,             /*                 (name) -> ()          */
+     KCM_OP_STORE,               /*           (name, cred) -> ()          */
+-    KCM_OP_RETRIEVE,
++    KCM_OP_RETRIEVE,            /* (name, flags, credtag) -> (cred)      */
+     KCM_OP_GET_PRINCIPAL,       /*                 (name) -> (princ)     */
+     KCM_OP_GET_CRED_UUID_LIST,  /*                 (name) -> (uuid, ...) */
+     KCM_OP_GET_CRED_BY_UUID,    /*           (name, uuid) -> (cred)      */
+diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
+index 772928e4d..80f8bf631 100644
+--- a/src/lib/krb5/ccache/cc_kcm.c
++++ b/src/lib/krb5/ccache/cc_kcm.c
+@@ -792,9 +792,55 @@ static krb5_error_code KRB5_CALLCONV
+ kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags,
+              krb5_creds *mcred, krb5_creds *cred_out)
+ {
+-    /* There is a KCM opcode for retrieving creds, but Heimdal's client doesn't
+-     * use it.  It causes the KCM daemon to actually make a TGS request. */
+-    return k5_cc_retrieve_cred_default(context, cache, flags, mcred, cred_out);
++    krb5_error_code ret;
++    struct kcmreq req = EMPTY_KCMREQ;
++    krb5_creds cred;
++    krb5_enctype *enctypes = NULL;
++
++    memset(&cred, 0, sizeof(cred));
++
++    /* Include KCM_GC_CACHED in flags to prevent Heimdal's sssd from making a
++     * TGS request itself. */
++    kcmreq_init(&req, KCM_OP_RETRIEVE, cache);
++    k5_buf_add_uint32_be(&req.reqbuf, map_tcflags(flags) | KCM_GC_CACHED);
++    k5_marshal_mcred(&req.reqbuf, mcred);
++    ret = cache_call(context, cache, &req);
++
++    /* Fall back to iteration if the server does not support retrieval. */
++    if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) {
++        ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred,
++                                          cred_out);
++        goto cleanup;
++    }
++    if (ret)
++        goto cleanup;
++
++    ret = k5_unmarshal_cred(req.reply.ptr, req.reply.len, 4, &cred);
++    if (ret)
++        goto cleanup;
++
++    /* In rare cases we might retrieve a credential with a session key this
++     * context can't support, in which case we must retry using iteration. */
++    if (flags & KRB5_TC_SUPPORTED_KTYPES) {
++        ret = krb5_get_tgs_ktypes(context, cred.server, &enctypes);
++        if (ret)
++            goto cleanup;
++        if (!k5_etypes_contains(enctypes, cred.keyblock.enctype)) {
++            ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred,
++                                              cred_out);
++            goto cleanup;
++        }
++    }
++
++    *cred_out = cred;
++    memset(&cred, 0, sizeof(cred));
++
++cleanup:
++    kcmreq_free(&req);
++    krb5_free_cred_contents(context, &cred);
++    free(enctypes);
++    /* Heimdal's KCM returns KRB5_CC_END if no cred is found. */
++    return (ret == KRB5_CC_END) ? KRB5_CC_NOTFOUND : map_invalid(ret);
+ }
+ 
+ static krb5_error_code KRB5_CALLCONV
+diff --git a/src/tests/kcmserver.py b/src/tests/kcmserver.py
+index 8c5e66ff1..25e6f2bbe 100644
+--- a/src/tests/kcmserver.py
++++ b/src/tests/kcmserver.py
+@@ -40,6 +40,7 @@ class KCMOpcodes(object):
+     INITIALIZE = 4
+     DESTROY = 5
+     STORE = 6
++    RETRIEVE = 7
+     GET_PRINCIPAL = 8
+     GET_CRED_UUID_LIST = 9
+     GET_CRED_BY_UUID = 10
+@@ -54,6 +55,7 @@ class KCMOpcodes(object):
+ 
+ 
+ class KRB5Errors(object):
++    KRB5_CC_NOTFOUND = -1765328243
+     KRB5_CC_END = -1765328242
+     KRB5_CC_NOSUPP = -1765328137
+     KRB5_FCC_NOFILE = -1765328189
+@@ -86,11 +88,29 @@ def get_cache(name):
+     return cache
+ 
+ 
++def unpack_data(argbytes):
++    dlen, = struct.unpack('>L', argbytes[:4])
++    return argbytes[4:dlen+4], argbytes[dlen+4:]
++
++
+ def unmarshal_name(argbytes):
+     offset = argbytes.find(b'\0')
+     return argbytes[0:offset], argbytes[offset+1:]
+ 
+ 
++def unmarshal_princ(argbytes):
++    # Ignore the type at argbytes[0:4].
++    ncomps, = struct.unpack('>L', argbytes[4:8])
++    realm, rest = unpack_data(argbytes[8:])
++    comps = []
++    for i in range(ncomps):
++        comp, rest = unpack_data(rest)
++        comps.append(comp)
++    # Asssume no quoting is needed.
++    princ = b'/'.join(comps) + b'@' + realm
++    return princ, rest
++
++
+ def op_gen_new(argbytes):
+     # Does not actually check for uniqueness.
+     global next_unique
+@@ -126,6 +146,22 @@ def op_store(argbytes):
+     return 0, b''
+ 
+ 
++def op_retrieve(argbytes):
++    name, rest = unmarshal_name(argbytes)
++    # Ignore the flags at rest[0:4] and the header at rest[4:8].
++    # Assume there are client and server creds in the tag and match
++    # only against them.
++    cprinc, rest = unmarshal_princ(rest[8:])
++    sprinc, rest = unmarshal_princ(rest)
++    cache = get_cache(name)
++    for cred in (cache.creds[u] for u in cache.cred_uuids):
++        cred_cprinc, rest = unmarshal_princ(cred)
++        cred_sprinc, rest = unmarshal_princ(rest)
++        if cred_cprinc == cprinc and cred_sprinc == sprinc:
++            return 0, cred
++    return KRB5Errors.KRB5_CC_NOTFOUND, b''
++
++
+ def op_get_principal(argbytes):
+     name, rest = unmarshal_name(argbytes)
+     cache = get_cache(name)
+@@ -199,6 +235,7 @@ ophandlers = {
+     KCMOpcodes.INITIALIZE : op_initialize,
+     KCMOpcodes.DESTROY : op_destroy,
+     KCMOpcodes.STORE : op_store,
++    KCMOpcodes.RETRIEVE : op_retrieve,
+     KCMOpcodes.GET_PRINCIPAL : op_get_principal,
+     KCMOpcodes.GET_CRED_UUID_LIST : op_get_cred_uuid_list,
+     KCMOpcodes.GET_CRED_BY_UUID : op_get_cred_by_uuid,
+@@ -243,10 +280,11 @@ def service_request(s):
+     return True
+ 
+ parser = optparse.OptionParser()
+-parser.add_option('-c', '--credlist', action='store_true', dest='credlist',
+-                  default=False, help='Support KCM_OP_GET_CRED_LIST')
++parser.add_option('-f', '--fallback', action='store_true', dest='fallback',
++                  default=False, help='Do not support RETRIEVE/GET_CRED_LIST')
+ (options, args) = parser.parse_args()
+-if not options.credlist:
++if options.fallback:
++    del ophandlers[KCMOpcodes.RETRIEVE]
+     del ophandlers[KCMOpcodes.GET_CRED_LIST]
+ 
+ server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+diff --git a/src/tests/t_ccache.py b/src/tests/t_ccache.py
+index 90040fb7b..6ea9fb969 100755
+--- a/src/tests/t_ccache.py
++++ b/src/tests/t_ccache.py
+@@ -25,7 +25,7 @@ from k5test import *
+ kcm_socket_path = os.path.join(os.getcwd(), 'testdir', 'kcm')
+ conf = {'libdefaults': {'kcm_socket': kcm_socket_path,
+                         'kcm_mach_service': '-'}}
+-realm = K5Realm(create_host=False, krb5_conf=conf)
++realm = K5Realm(krb5_conf=conf)
+ 
+ keyctl = which('keyctl')
+ out = realm.run([klist, '-c', 'KEYRING:process:abcd'], expected_code=1)
+@@ -71,6 +71,11 @@ def collection_test(realm, ccname):
+     realm.kinit('alice', password('alice'))
+     realm.run([klist], expected_msg='Default principal: alice@')
+     realm.run([klist, '-A', '-s'])
++    realm.run([kvno, realm.host_princ], expected_msg = 'kvno = 1')
++    realm.run([kvno, realm.host_princ], expected_msg = 'kvno = 1')
++    out = realm.run([klist])
++    if out.count(realm.host_princ) != 1:
++        fail('Wrong number of service tickets in cache')
+     realm.run([kdestroy])
+     output = realm.run([klist], expected_code=1)
+     if 'No credentials cache' not in output and 'not found' not in output:
+@@ -126,14 +131,14 @@ def collection_test(realm, ccname):
+ 
+ collection_test(realm, 'DIR:' + os.path.join(realm.testdir, 'cc'))
+ 
+-# Test KCM without and with GET_CRED_LIST support.
++# Test KCM with and without RETRIEVE and GET_CRED_LIST support.
+ kcmserver_path = os.path.join(srctop, 'tests', 'kcmserver.py')
+ kcmd = realm.start_server([sys.executable, kcmserver_path, kcm_socket_path],
+                           'starting...')
+ collection_test(realm, 'KCM:')
+ stop_daemon(kcmd)
+ os.remove(kcm_socket_path)
+-realm.start_server([sys.executable, kcmserver_path, '-c', kcm_socket_path],
++realm.start_server([sys.executable, kcmserver_path, '-f', kcm_socket_path],
+                    'starting...')
+ collection_test(realm, 'KCM:')
+ 
diff --git a/krb5.spec b/krb5.spec
index c4a407e..ac83dce 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}5%{?dist}
+Release: %{?zdpd}6%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -73,6 +73,8 @@ Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
 Patch8: Add-APIs-for-marshalling-credentials.patch
 Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch
 Patch10: Support-host-based-GSS-initiator-names.patch
+Patch11: Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
+Patch12: Use-KCM_OP_RETRIEVE-in-KCM-client.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -635,6 +637,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Thu May 20 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-6
+- Add KCM_OP_GET_CRED_LIST and KCM_OP_RETRIEVE support
+
 * Tue May 04 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-5
 - Suppress static analyzer warning in FIPS override
 

From e76f184909f203bbce0e21dfaba50aa75bddc671 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Thu, 20 May 2021 13:59:15 -0400
Subject: [PATCH 07/22] Fix context for previous backport

(cherry picked from commit c4150c67d14ea9272ae0bca9eca2bcbf5b349dc4)
---
 ...CM-flag-transmission-for-remove_cred.patch | 103 ++++++++++++++++++
 Use-KCM_OP_RETRIEVE-in-KCM-client.patch       |  10 +-
 krb5.spec                                     |   8 +-
 3 files changed, 114 insertions(+), 7 deletions(-)
 create mode 100644 Fix-KCM-flag-transmission-for-remove_cred.patch

diff --git a/Fix-KCM-flag-transmission-for-remove_cred.patch b/Fix-KCM-flag-transmission-for-remove_cred.patch
new file mode 100644
index 0000000..0542bfa
--- /dev/null
+++ b/Fix-KCM-flag-transmission-for-remove_cred.patch
@@ -0,0 +1,103 @@
+From 1f160bee7ee2c6242fa2625b9f3e8fc211cec6c4 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Mon, 29 Mar 2021 14:32:56 -0400
+Subject: [PATCH] Fix KCM flag transmission for remove_cred
+
+MIT krb5 uses low bits for KRB5_TC flags, while Heimdal uses high bits
+so that the same flag word can also hold KRB5_GC flags.  Add a mapping
+function and send the Heimdal flag values when performing a
+remove_cred operation.
+
+ticket: 8995
+(cherry picked from commit 11a82cf424f9c905bb73680c64524f087090d4ef)
+---
+ src/include/kcm.h            | 19 +++++++++++++++++++
+ src/lib/krb5/ccache/cc_kcm.c | 36 +++++++++++++++++++++++++++++++++++-
+ 2 files changed, 54 insertions(+), 1 deletion(-)
+
+diff --git a/src/include/kcm.h b/src/include/kcm.h
+index e4140c3a0..9b66f1cbd 100644
+--- a/src/include/kcm.h
++++ b/src/include/kcm.h
+@@ -56,8 +56,27 @@
+  * are marshalled as zero-terminated strings.  Principals and credentials are
+  * marshalled in the v4 FILE ccache format.  UUIDs are 16 bytes.  UUID lists
+  * are not delimited, so nothing can come after them.
++ *
++ * Flag words must use Heimdal flag values, which are not the same as MIT krb5
++ * values for KRB5_GC and KRB5_TC constants.  The same flag word may contain
++ * both kinds of flags in Heimdal, but not in MIT krb5.  Defines for the
++ * applicable Heimdal flag values are given below using KCM_GC and KCM_TC
++ * prefixes.
+  */
+ 
++#define KCM_GC_CACHED                   (1U << 0)
++
++#define KCM_TC_DONT_MATCH_REALM         (1U << 31)
++#define KCM_TC_MATCH_KEYTYPE            (1U << 30)
++#define KCM_TC_MATCH_SRV_NAMEONLY       (1U << 29)
++#define KCM_TC_MATCH_FLAGS_EXACT        (1U << 28)
++#define KCM_TC_MATCH_FLAGS              (1U << 27)
++#define KCM_TC_MATCH_TIMES_EXACT        (1U << 26)
++#define KCM_TC_MATCH_TIMES              (1U << 25)
++#define KCM_TC_MATCH_AUTHDATA           (1U << 24)
++#define KCM_TC_MATCH_2ND_TKT            (1U << 23)
++#define KCM_TC_MATCH_IS_SKEY            (1U << 22)
++
+ /* Opcodes without comments are currently unused in the MIT client
+  * implementation. */
+ typedef enum kcm_opcode {
+diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
+index 772928e4d..1f81a2190 100644
+--- a/src/lib/krb5/ccache/cc_kcm.c
++++ b/src/lib/krb5/ccache/cc_kcm.c
+@@ -110,6 +110,40 @@ map_invalid(krb5_error_code code)
+         KRB5_KCM_MALFORMED_REPLY : code;
+ }
+ 
++/*
++ * Map an MIT krb5 KRB5_TC flag word to the equivalent Heimdal flag word.  Note
++ * that there is no MIT krb5 equivalent for Heimdal's KRB5_TC_DONT_MATCH_REALM
++ * (which is like KRB5_TC_MATCH_SRV_NAMEONLY but also applies to the client
++ * principal) and no Heimdal equivalent for MIT krb5's KRB5_TC_SUPPORTED_KTYPES
++ * (which matches against enctypes from the krb5_context rather than the
++ * matching cred).
++ */
++static inline krb5_flags
++map_tcflags(krb5_flags mitflags)
++{
++    krb5_flags heimflags = 0;
++
++    if (mitflags & KRB5_TC_MATCH_TIMES)
++        heimflags |= KCM_TC_MATCH_TIMES;
++    if (mitflags & KRB5_TC_MATCH_IS_SKEY)
++        heimflags |= KCM_TC_MATCH_IS_SKEY;
++    if (mitflags & KRB5_TC_MATCH_FLAGS)
++        heimflags |= KCM_TC_MATCH_FLAGS;
++    if (mitflags & KRB5_TC_MATCH_TIMES_EXACT)
++        heimflags |= KCM_TC_MATCH_TIMES_EXACT;
++    if (mitflags & KRB5_TC_MATCH_FLAGS_EXACT)
++        heimflags |= KCM_TC_MATCH_FLAGS_EXACT;
++    if (mitflags & KRB5_TC_MATCH_AUTHDATA)
++        heimflags |= KCM_TC_MATCH_AUTHDATA;
++    if (mitflags & KRB5_TC_MATCH_SRV_NAMEONLY)
++        heimflags |= KCM_TC_MATCH_SRV_NAMEONLY;
++    if (mitflags & KRB5_TC_MATCH_2ND_TKT)
++        heimflags |= KCM_TC_MATCH_2ND_TKT;
++    if (mitflags & KRB5_TC_MATCH_KTYPE)
++        heimflags |= KCM_TC_MATCH_KEYTYPE;
++    return heimflags;
++}
++
+ /* Begin a request for the given opcode.  If cache is non-null, supply the
+  * cache name as a request parameter. */
+ static void
+@@ -936,7 +970,7 @@ kcm_remove_cred(krb5_context context, krb5_ccache cache, krb5_flags flags,
+     struct kcmreq req;
+ 
+     kcmreq_init(&req, KCM_OP_REMOVE_CRED, cache);
+-    k5_buf_add_uint32_be(&req.reqbuf, flags);
++    k5_buf_add_uint32_be(&req.reqbuf, map_tcflags(flags));
+     k5_marshal_mcred(&req.reqbuf, mcred);
+     ret = cache_call(context, cache, &req);
+     kcmreq_free(&req);
diff --git a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch
index 22c6593..c0abcf3 100644
--- a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch
+++ b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch
@@ -1,4 +1,4 @@
-From 04a810c642245947d5f32a498ed7b1a6f9a11006 Mon Sep 17 00:00:00 2001
+From 8f073717c0373bcd4d13e338273449f00325b00c Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Fri, 26 Mar 2021 23:38:54 -0400
 Subject: [PATCH] Use KCM_OP_RETRIEVE in KCM client
@@ -20,10 +20,10 @@ ticket: 8997 (new)
  4 files changed, 99 insertions(+), 10 deletions(-)
 
 diff --git a/src/include/kcm.h b/src/include/kcm.h
-index e4140c3a0..5a3e55ce6 100644
+index 9b66f1cbd..85c20d345 100644
 --- a/src/include/kcm.h
 +++ b/src/include/kcm.h
-@@ -68,7 +68,7 @@ typedef enum kcm_opcode {
+@@ -87,7 +87,7 @@ typedef enum kcm_opcode {
      KCM_OP_INITIALIZE,          /*          (name, princ) -> ()          */
      KCM_OP_DESTROY,             /*                 (name) -> ()          */
      KCM_OP_STORE,               /*           (name, cred) -> ()          */
@@ -33,10 +33,10 @@ index e4140c3a0..5a3e55ce6 100644
      KCM_OP_GET_CRED_UUID_LIST,  /*                 (name) -> (uuid, ...) */
      KCM_OP_GET_CRED_BY_UUID,    /*           (name, uuid) -> (cred)      */
 diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
-index 772928e4d..80f8bf631 100644
+index 1f81a2190..ef77ac216 100644
 --- a/src/lib/krb5/ccache/cc_kcm.c
 +++ b/src/lib/krb5/ccache/cc_kcm.c
-@@ -792,9 +792,55 @@ static krb5_error_code KRB5_CALLCONV
+@@ -826,9 +826,55 @@ static krb5_error_code KRB5_CALLCONV
  kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags,
               krb5_creds *mcred, krb5_creds *cred_out)
  {
diff --git a/krb5.spec b/krb5.spec
index ac83dce..d571916 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}6%{?dist}
+Release: %{?zdpd}7%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -74,7 +74,8 @@ Patch8: Add-APIs-for-marshalling-credentials.patch
 Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch
 Patch10: Support-host-based-GSS-initiator-names.patch
 Patch11: Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
-Patch12: Use-KCM_OP_RETRIEVE-in-KCM-client.patch
+Patch12: Fix-KCM-flag-transmission-for-remove_cred.patch
+Patch13: Use-KCM_OP_RETRIEVE-in-KCM-client.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -637,6 +638,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Thu May 20 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-7
+- Fix context for previous backport
+
 * Thu May 20 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-6
 - Add KCM_OP_GET_CRED_LIST and KCM_OP_RETRIEVE support
 

From ee6f543041e48dad29f9ac0ed536a8f003bf8894 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Thu, 20 May 2021 17:26:12 -0400
Subject: [PATCH 08/22] Add all the sssd-kcm workarounds

(cherry picked from commit 72e80d67ef87e136c3d5dd7b1e0323f968769096)
---
 ...P_GET_CRED_LIST-for-faster-iteration.patch |  2 +-
 ...CM-flag-transmission-for-remove_cred.patch |  2 +-
 Fix-KCM-retrieval-support-for-sssd.patch      | 62 +++++++++++++++++++
 ...teration-fallback-work-with-sssd-kcm.patch | 26 ++++++++
 Use-KCM_OP_RETRIEVE-in-KCM-client.patch       |  4 +-
 krb5.spec                                     |  9 ++-
 6 files changed, 99 insertions(+), 6 deletions(-)
 create mode 100644 Fix-KCM-retrieval-support-for-sssd.patch
 create mode 100644 Make-KCM-iteration-fallback-work-with-sssd-kcm.patch

diff --git a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
index 237de35..060b039 100644
--- a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
+++ b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
@@ -1,4 +1,4 @@
-From dc92022ad26cec8085a852dec6aeba310fa7a751 Mon Sep 17 00:00:00 2001
+From a0ee8b02e56c65e5dcd569caed0e151cef004ef4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
 Date: Thu, 11 Feb 2021 15:33:10 +0100
 Subject: [PATCH] Add KCM_OP_GET_CRED_LIST for faster iteration
diff --git a/Fix-KCM-flag-transmission-for-remove_cred.patch b/Fix-KCM-flag-transmission-for-remove_cred.patch
index 0542bfa..951be10 100644
--- a/Fix-KCM-flag-transmission-for-remove_cred.patch
+++ b/Fix-KCM-flag-transmission-for-remove_cred.patch
@@ -1,4 +1,4 @@
-From 1f160bee7ee2c6242fa2625b9f3e8fc211cec6c4 Mon Sep 17 00:00:00 2001
+From 04f0de4420508161ce439f262f2761ff51a07ab0 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Mon, 29 Mar 2021 14:32:56 -0400
 Subject: [PATCH] Fix KCM flag transmission for remove_cred
diff --git a/Fix-KCM-retrieval-support-for-sssd.patch b/Fix-KCM-retrieval-support-for-sssd.patch
new file mode 100644
index 0000000..5fb7c2b
--- /dev/null
+++ b/Fix-KCM-retrieval-support-for-sssd.patch
@@ -0,0 +1,62 @@
+From a5b2cff51808cd86fe8195e7ac074ecd25c3344d Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 11 May 2021 14:04:07 -0400
+Subject: [PATCH] Fix KCM retrieval support for sssd
+
+Commit 795ebba8c039be172ab93cd41105c73ffdba0fdb added a retrieval
+handler using KCM_OP_RETRIEVE, falling back on the same error codes as
+the previous KCM_OP_GET_CRED_LIST support.  But sssd (as of 2.4)
+returns KRB5_CC_NOSUPP instead of KRB5_CC_IO if it recognizes an
+opcode but does not implement it.  Add a helper function to recognize
+all known unsupported-opcode error codes, and use it in kcm_retrieve()
+and kcm_start_seq_get().
+
+ticket: 8997
+(cherry picked from commit da103e36e13f3c846bcddbe38dd518a21e5260a0)
+---
+ src/lib/krb5/ccache/cc_kcm.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
+index 23fcf13ea..18505cd3d 100644
+--- a/src/lib/krb5/ccache/cc_kcm.c
++++ b/src/lib/krb5/ccache/cc_kcm.c
+@@ -144,6 +144,20 @@ map_tcflags(krb5_flags mitflags)
+     return heimflags;
+ }
+ 
++/*
++ * Return true if code could indicate an unsupported operation.  Heimdal's KCM
++ * returns KRB5_FCC_INTERNAL.  sssd's KCM daemon (as of sssd 2.4) returns
++ * KRB5_CC_NO_SUPP if it recognizes the operation but does not implement it,
++ * and KRB5_CC_IO if it doesn't recognize the operation (which is unfortunate
++ * since it could also indicate a communication failure).
++ */
++static krb5_boolean
++unsupported_op_error(krb5_error_code code)
++{
++    return code == KRB5_FCC_INTERNAL || code == KRB5_CC_IO ||
++        code == KRB5_CC_NOSUPP;
++}
++
+ /* Begin a request for the given opcode.  If cache is non-null, supply the
+  * cache name as a request parameter. */
+ static void
+@@ -841,7 +855,7 @@ kcm_retrieve(krb5_context context, krb5_ccache cache, krb5_flags flags,
+     ret = cache_call(context, cache, &req);
+ 
+     /* Fall back to iteration if the server does not support retrieval. */
+-    if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) {
++    if (unsupported_op_error(ret)) {
+         ret = k5_cc_retrieve_cred_default(context, cache, flags, mcred,
+                                           cred_out);
+         goto cleanup;
+@@ -922,7 +936,7 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache,
+         ret = kcmreq_get_cred_list(&req, &creds);
+         if (ret)
+             goto cleanup;
+-    } else if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) {
++    } else if (unsupported_op_error(ret)) {
+         /* Fall back to GET_CRED_UUID_LIST. */
+         kcmreq_free(&req);
+         kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache);
diff --git a/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch b/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch
new file mode 100644
index 0000000..5fa3106
--- /dev/null
+++ b/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch
@@ -0,0 +1,26 @@
+From 2dbca7e14c945d6394e0e05f285a068dcd541295 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
+Date: Tue, 30 Mar 2021 14:35:28 +0200
+Subject: [PATCH] Make KCM iteration fallback work with sssd-kcm
+
+sssd-kcm returns KRB5_CC_IO if the operation code is not known.
+
+ticket: 8990
+(cherry picked from commit 06afae820a44c1dc96ad88a0b16c3e50bc938b2a)
+---
+ src/lib/krb5/ccache/cc_kcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
+index 1f81a2190..46705f1da 100644
+--- a/src/lib/krb5/ccache/cc_kcm.c
++++ b/src/lib/krb5/ccache/cc_kcm.c
+@@ -876,7 +876,7 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache,
+         ret = kcmreq_get_cred_list(&req, &creds);
+         if (ret)
+             goto cleanup;
+-    } else if (ret == KRB5_FCC_INTERNAL) {
++    } else if (ret == KRB5_FCC_INTERNAL || ret == KRB5_CC_IO) {
+         /* Fall back to GET_CRED_UUID_LIST. */
+         kcmreq_free(&req);
+         kcmreq_init(&req, KCM_OP_GET_CRED_UUID_LIST, cache);
diff --git a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch
index c0abcf3..401b363 100644
--- a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch
+++ b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch
@@ -1,4 +1,4 @@
-From 8f073717c0373bcd4d13e338273449f00325b00c Mon Sep 17 00:00:00 2001
+From c56d4b87de0f30a38dc61d374ad225d02d581eb3 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Fri, 26 Mar 2021 23:38:54 -0400
 Subject: [PATCH] Use KCM_OP_RETRIEVE in KCM client
@@ -33,7 +33,7 @@ index 9b66f1cbd..85c20d345 100644
      KCM_OP_GET_CRED_UUID_LIST,  /*                 (name) -> (uuid, ...) */
      KCM_OP_GET_CRED_BY_UUID,    /*           (name, uuid) -> (cred)      */
 diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
-index 1f81a2190..ef77ac216 100644
+index 46705f1da..23fcf13ea 100644
 --- a/src/lib/krb5/ccache/cc_kcm.c
 +++ b/src/lib/krb5/ccache/cc_kcm.c
 @@ -826,9 +826,55 @@ static krb5_error_code KRB5_CALLCONV
diff --git a/krb5.spec b/krb5.spec
index d571916..cbe0580 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}7%{?dist}
+Release: %{?zdpd}8%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -75,7 +75,9 @@ Patch9: Add-hostname-canonicalization-helper-to-k5test.py.patch
 Patch10: Support-host-based-GSS-initiator-names.patch
 Patch11: Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
 Patch12: Fix-KCM-flag-transmission-for-remove_cred.patch
-Patch13: Use-KCM_OP_RETRIEVE-in-KCM-client.patch
+Patch13: Make-KCM-iteration-fallback-work-with-sssd-kcm.patch
+Patch14: Use-KCM_OP_RETRIEVE-in-KCM-client.patch
+Patch15: Fix-KCM-retrieval-support-for-sssd.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -638,6 +640,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Thu May 20 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-8
+- Add all the sssd-kcm workarounds
+
 * Thu May 20 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-7
 - Fix context for previous backport
 

From 5bbe654d6166b8519f33c0dedba9f6b57ae925a8 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Wed, 2 Jun 2021 12:09:09 -0400
Subject: [PATCH 09/22] Fix doc build for Sphinx 4.0

---
 Fix-doc-build-for-Sphinx-4.0.patch | 152 +++++++++++++++++++++++++++++
 krb5.spec                          |   6 +-
 2 files changed, 157 insertions(+), 1 deletion(-)
 create mode 100644 Fix-doc-build-for-Sphinx-4.0.patch

diff --git a/Fix-doc-build-for-Sphinx-4.0.patch b/Fix-doc-build-for-Sphinx-4.0.patch
new file mode 100644
index 0000000..ae3972c
--- /dev/null
+++ b/Fix-doc-build-for-Sphinx-4.0.patch
@@ -0,0 +1,152 @@
+From 0bf023bdbb8335f48a6a4dcf8bd5dac9c2cd7fb6 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Wed, 26 May 2021 15:08:28 -0400
+Subject: [PATCH] Fix doc build for Sphinx 4.0
+
+Use app.add_css_file() to register krb5.css if possible (it was added
+in Sphinx 1.8), since the old name app.add_stylesheet() was removed in
+Sphinx 4.0.
+
+Use the highlight directive instead of the highlightlang directive,
+which was removed in Sphinx 4.0.
+
+Remove two duplicate table of contents entries to fix warnings.
+
+In the Github Actions configuration, add a second doc build using the
+newest version of Sphinx.
+
+ticket: 9006
+tags: pullup
+target_version: 1.19-next
+
+(cherry picked from commit 3fa40a32e22cb9de91fa1d18deddcba446515855)
+---
+ .github/workflows/doc.yml            | 16 +++++++++++++++-
+ doc/appdev/refs/macros/index.rst     |  1 -
+ doc/appdev/refs/types/index.rst      |  1 -
+ doc/appdev/refs/types/krb5_int32.rst |  2 +-
+ doc/appdev/refs/types/krb5_ui_4.rst  |  2 +-
+ doc/conf.py                          |  9 ++++++++-
+ doc/tools/define_document.tmpl       |  2 +-
+ doc/tools/type_document.tmpl         |  2 +-
+ 8 files changed, 27 insertions(+), 8 deletions(-)
+
+diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
+index 292df4cfe..75f467cde 100644
+--- a/.github/workflows/doc.yml
++++ b/.github/workflows/doc.yml
+@@ -5,7 +5,7 @@ on:
+     pull_request: {paths: [doc/**, src/doc/*, src/include/krb5/krb5.hin, .github/workflows/doc.yml]}
+ 
+ jobs:
+-    doc:
++    doc-older-sphinx:
+         runs-on: ubuntu-18.04
+         steps:
+             - name: Checkout repository
+@@ -19,6 +19,20 @@ jobs:
+               run: |
+                 cd src/doc
+                 make -f Makefile.in SPHINX_ARGS=-W htmlsrc
++    doc-newest-sphinx:
++        runs-on: ubuntu-18.04
++        steps:
++            - name: Checkout repository
++              uses: actions/checkout@v1
++            - name: Linux setup
++              run: |
++                sudo apt-get update -qq
++                sudo apt-get install -y doxygen python3-lxml python3-pip
++                pip3 install Cheetah3 sphinx
++            - name: Build documentation
++              run: |
++                cd src/doc
++                make -f Makefile.in SPHINX_ARGS=-W htmlsrc
+             - name: Upload HTML
+               uses: actions/upload-artifact@v2
+               with:
+diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst
+index 4d51e795c..0cb2e81bd 100644
+--- a/doc/appdev/refs/macros/index.rst
++++ b/doc/appdev/refs/macros/index.rst
+@@ -54,7 +54,6 @@ Public
+    ENCTYPE_DES3_CBC_RAW.rst
+    ENCTYPE_DES3_CBC_SHA.rst
+    ENCTYPE_DES3_CBC_SHA1.rst
+-   ENCTYPE_DES3_CBC_SHA1.rst
+    ENCTYPE_DES_CBC_CRC.rst
+    ENCTYPE_DES_CBC_MD4.rst
+    ENCTYPE_DES_CBC_MD5.rst
+diff --git a/doc/appdev/refs/types/index.rst b/doc/appdev/refs/types/index.rst
+index dc414cfde..d8d2a8f3c 100644
+--- a/doc/appdev/refs/types/index.rst
++++ b/doc/appdev/refs/types/index.rst
+@@ -62,7 +62,6 @@ Public
+    krb5_preauthtype.rst
+    krb5_principal.rst
+    krb5_principal_data.rst
+-   krb5_const_principal.rst
+    krb5_prompt.rst
+    krb5_prompt_type.rst
+    krb5_prompter_fct.rst
+diff --git a/doc/appdev/refs/types/krb5_int32.rst b/doc/appdev/refs/types/krb5_int32.rst
+index 2bc914b3c..28baafa38 100644
+--- a/doc/appdev/refs/types/krb5_int32.rst
++++ b/doc/appdev/refs/types/krb5_int32.rst
+@@ -1,4 +1,4 @@
+-.. highlightlang:: c
++.. highlight:: c
+ 
+ .. _krb5-int32-struct:
+ 
+diff --git a/doc/appdev/refs/types/krb5_ui_4.rst b/doc/appdev/refs/types/krb5_ui_4.rst
+index de79bafe1..73eb38cf4 100644
+--- a/doc/appdev/refs/types/krb5_ui_4.rst
++++ b/doc/appdev/refs/types/krb5_ui_4.rst
+@@ -1,4 +1,4 @@
+-.. highlightlang:: c
++.. highlight:: c
+ 
+ .. _krb5-ui4-struct:
+ 
+diff --git a/doc/conf.py b/doc/conf.py
+index 4fb6aae14..a876fd633 100644
+--- a/doc/conf.py
++++ b/doc/conf.py
+@@ -98,8 +98,15 @@ pygments_style = 'sphinx'
+ 
+ # -- Options for HTML output ---------------------------------------------------
+ 
++# When we can rely on Sphinx 1.8 (released Sep 2018) we can just set:
++#   html_css_files = ['kerb.css']
++# But in the meantime, we add this file using either a way that works
++# after 1.8 or a way that works before 4.0.
+ def setup(app):
+-    app.add_stylesheet('kerb.css')
++    if callable(getattr(app, 'add_css_file', None)):
++        app.add_css_file('kerb.css')
++    else:
++        app.add_stylesheet('kerb.css')
+ 
+ # The theme to use for HTML and HTML Help pages.  See the documentation for
+ # a list of builtin themes.
+diff --git a/doc/tools/define_document.tmpl b/doc/tools/define_document.tmpl
+index ca56d866c..8e74dc302 100644
+--- a/doc/tools/define_document.tmpl
++++ b/doc/tools/define_document.tmpl
+@@ -1,4 +1,4 @@
+-.. highlightlang:: c
++.. highlight:: c
+ 
+ .. $composite.macro_reference($composite.name):
+ 
+diff --git a/doc/tools/type_document.tmpl b/doc/tools/type_document.tmpl
+index 5987fa762..11aafb818 100644
+--- a/doc/tools/type_document.tmpl
++++ b/doc/tools/type_document.tmpl
+@@ -1,4 +1,4 @@
+-.. highlightlang:: c
++.. highlight:: c
+ 
+ .. $composite.struct_reference($composite.name):
+ 
diff --git a/krb5.spec b/krb5.spec
index cbe0580..b59f39c 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}8%{?dist}
+Release: %{?zdpd}9%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -78,6 +78,7 @@ Patch12: Fix-KCM-flag-transmission-for-remove_cred.patch
 Patch13: Make-KCM-iteration-fallback-work-with-sssd-kcm.patch
 Patch14: Use-KCM_OP_RETRIEVE-in-KCM-client.patch
 Patch15: Fix-KCM-retrieval-support-for-sssd.patch
+Patch16: Fix-doc-build-for-Sphinx-4.0.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -640,6 +641,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Wed Jun 02 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-9
+- Fix doc build for Sphinx 4.0
+
 * Thu May 20 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-8
 - Add all the sssd-kcm workarounds
 

From 09eff6f6dfb6656d931bc4fd9e202c93db37cac4 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Wed, 9 Jun 2021 10:55:13 -0400
Subject: [PATCH 10/22] Fix three canonicalization cases for fallback

---
 ...ith-keytab-to-defer-canonicalization.patch |   60 +
 ...in-k-with-fallback-or-referral-realm.patch |   64 +
 ...incipal-realm-canonicalization-cases.patch |   96 +
 ...dejagnu-kadmin-tests-to-Python-tests.patch | 1750 +++++++++++++++++
 krb5.spec                                     |    9 +-
 5 files changed, 1978 insertions(+), 1 deletion(-)
 create mode 100644 Allow-kinit-with-keytab-to-defer-canonicalization.patch
 create mode 100644 Fix-kadmin-k-with-fallback-or-referral-realm.patch
 create mode 100644 Fix-some-principal-realm-canonicalization-cases.patch
 create mode 100644 Move-some-dejagnu-kadmin-tests-to-Python-tests.patch

diff --git a/Allow-kinit-with-keytab-to-defer-canonicalization.patch b/Allow-kinit-with-keytab-to-defer-canonicalization.patch
new file mode 100644
index 0000000..9315f66
--- /dev/null
+++ b/Allow-kinit-with-keytab-to-defer-canonicalization.patch
@@ -0,0 +1,60 @@
+From 090c7319652466339e3e6482bdd1b5a294638dff Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Thu, 3 Jun 2021 16:03:07 -0400
+Subject: [PATCH] Allow kinit with keytab to defer canonicalization
+
+[ghudson@mit.edu: added tests]
+
+ticket: 9012 (new)
+(cherry picked from commit 5e6a6efc5df689d9fb8730d0227167ffbb6ece0e)
+---
+ src/clients/kinit/kinit.c | 11 -----------
+ src/tests/t_keytab.py     | 13 +++++++++++++
+ 2 files changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/src/clients/kinit/kinit.c b/src/clients/kinit/kinit.c
+index d1f5d74c3..5a6d7237c 100644
+--- a/src/clients/kinit/kinit.c
++++ b/src/clients/kinit/kinit.c
+@@ -510,17 +510,6 @@ k5_begin(struct k_opts *opts, struct k5_data *k5)
+                     _("when creating default server principal name"));
+             goto cleanup;
+         }
+-        if (k5->me->realm.data[0] == 0) {
+-            ret = krb5_unparse_name(k5->ctx, k5->me, &k5->name);
+-            if (ret == 0) {
+-                com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN,
+-                        _("(principal %s)"), k5->name);
+-            } else {
+-                com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN,
+-                        _("for local services"));
+-            }
+-            goto cleanup;
+-        }
+     } else if (k5->out_cc != NULL) {
+         /* If the output ccache is initialized, use its principal. */
+         if (krb5_cc_get_principal(k5->ctx, k5->out_cc, &princ) == 0)
+diff --git a/src/tests/t_keytab.py b/src/tests/t_keytab.py
+index 850375c92..a9adebb26 100755
+--- a/src/tests/t_keytab.py
++++ b/src/tests/t_keytab.py
+@@ -41,6 +41,19 @@ realm.kinit(realm.user_princ, flags=['-i'],
+             expected_msg='keytab specified, forcing -k')
+ realm.klist(realm.user_princ)
+ 
++# Test default principal for -k.  This operation requires
++# canonicalization against the keytab in krb5_get_init_creds_keytab()
++# as the krb5_sname_to_principal() result won't have a realm.  Try
++# with and without without fallback processing since the code paths
++# are different.
++mark('default principal for -k')
++realm.run([kinit, '-k'])
++realm.klist(realm.host_princ)
++no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}}
++no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf)
++realm.run([kinit, '-k'], env=no_canon)
++realm.klist(realm.host_princ)
++
+ # Test extracting keys with multiple key versions present.
+ mark('multi-kvno extract')
+ os.remove(realm.keytab)
diff --git a/Fix-kadmin-k-with-fallback-or-referral-realm.patch b/Fix-kadmin-k-with-fallback-or-referral-realm.patch
new file mode 100644
index 0000000..3e03da1
--- /dev/null
+++ b/Fix-kadmin-k-with-fallback-or-referral-realm.patch
@@ -0,0 +1,64 @@
+From cd8ff035f5b4720a8fc457355726f7bd0eab5eaa Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Mon, 7 Jun 2021 15:00:41 -0400
+Subject: [PATCH] Fix kadmin -k with fallback or referral realm
+
+kadmin -k produces a client principal name with
+krb5_sname_to_principal(), but it gets converted to a string and back
+due to the signature of kadm5_init_with_skey(), which loses track of
+the name type, so no canonicalization is performed.
+
+In libkadm5clnt initialization, recognize the important subset of this
+case--an empty realm indicates either fallback processing or the
+referral realm--and restore the host-based name type so that the
+client principal can be canonicalized against the keytab.
+
+ticket: 9013 (new)
+(cherry picked from commit dcb79089276624d7ddf44e08d35bd6d7d7e557d2)
+---
+ src/lib/kadm5/clnt/client_init.c |  7 +++++++
+ src/tests/t_kadmin.py            | 12 ++++++++++++
+ 2 files changed, 19 insertions(+)
+
+diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c
+index aa1223bb3..0aaca701f 100644
+--- a/src/lib/kadm5/clnt/client_init.c
++++ b/src/lib/kadm5/clnt/client_init.c
+@@ -221,9 +221,16 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+         return KADM5_MISSING_KRB5_CONF_PARAMS;
+     }
+ 
++    /*
++     * Parse the client name.  If it has an empty realm, it is almost certainly
++     * a host-based principal using DNS fallback processing or the referral
++     * realm, so give it the appropriate name type for canonicalization.
++     */
+     code = krb5_parse_name(handle->context, client_name, &client);
+     if (code)
+         goto error;
++    if (init_type == INIT_SKEY && client->realm.length == 0)
++        client->type = KRB5_NT_SRV_HST;
+ 
+     /*
+      * Get credentials.  Also does some fallbacks in case kadmin/fqdn
+diff --git a/src/tests/t_kadmin.py b/src/tests/t_kadmin.py
+index fe6a3cc2e..98453d92e 100644
+--- a/src/tests/t_kadmin.py
++++ b/src/tests/t_kadmin.py
+@@ -51,4 +51,16 @@ for i in range(200):
+     realm.run_kadmin(['addprinc', '-randkey', 'foo%d' % i])
+ realm.run_kadmin(['listprincs'], expected_msg='foo199')
+ 
++# Test kadmin -k with the default principal, with and without
++# fallback.  This operation requires canonicalization against the
++# keytab in krb5_get_init_creds_keytab() as the
++# krb5_sname_to_principal() result won't have a realm.  Try with and
++# without without fallback processing since the code paths are
++# different.
++mark('kadmin -k')
++realm.run([kadmin, '-k', 'getprinc', realm.host_princ])
++no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}}
++no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf)
++realm.run([kadmin, '-k', 'getprinc', realm.host_princ], env=no_canon)
++
+ success('kadmin and kpasswd tests')
diff --git a/Fix-some-principal-realm-canonicalization-cases.patch b/Fix-some-principal-realm-canonicalization-cases.patch
new file mode 100644
index 0000000..2c6c915
--- /dev/null
+++ b/Fix-some-principal-realm-canonicalization-cases.patch
@@ -0,0 +1,96 @@
+From 5ae9bc98f23aeaa2ce17debe5a9b0cf1130e54ed Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Mon, 7 Jun 2021 13:27:29 -0400
+Subject: [PATCH] Fix some principal realm canonicalization cases
+
+The no_hostrealm and subst_defrealm flags in struct canonprinc were
+only applied when dns_canonicalize_hostname=fallback; in the other
+cases, the initial krb5_sname_to_principal() result is treated as
+canonical.  For no_hostrealm this limitation doesn't currently matter,
+because all uses pass a principal with no realm as input.  However,
+subst_defrealm is used to convert the referral realm to the default
+realm in krb5_get_init_creds_keytab(), krb5_cc_cache_match(), and
+gss_acquire_cred() when it needs to check the desired name against a
+specified ccache.
+
+In k5_canonprinc(), if the input principal is a
+krb5_sname_to_principal() result and fallback isn't in effect, apply
+subst_defrealm.  Document in os-proto.h that no_hostrealm doesn't
+remove an existing realm and that krb5_sname_to_principal() may
+already have looked one up.
+
+ticket: 9011 (new)
+(cherry picked from commit c077d0c6430c4ac163443aacc03d14d206a4cbb8)
+---
+ src/lib/krb5/os/os-proto.h | 13 +++++++++----
+ src/lib/krb5/os/sn2princ.c | 24 +++++++++++++++++++++---
+ 2 files changed, 30 insertions(+), 7 deletions(-)
+
+diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h
+index 7d5e7978f..a985f2aec 100644
+--- a/src/lib/krb5/os/os-proto.h
++++ b/src/lib/krb5/os/os-proto.h
+@@ -85,10 +85,15 @@ struct sendto_callback_info {
+ 
+ /*
+  * Initialize with all zeros except for princ.  Set no_hostrealm to disable
+- * host-to-realm lookup, which ordinarily happens after canonicalizing the host
+- * part.  Set subst_defrealm to substitute the default realm for the referral
+- * realm after realm lookup (this has no effect if no_hostrealm is set).  Free
+- * with free_canonprinc() when done.
++ * host-to-realm lookup, which ordinarily happens during fallback processing
++ * after canonicalizing the host part.  Set subst_defrealm to substitute the
++ * default realm for the referral realm after realm lookup.  Do not set both
++ * flags.  Free with free_canonprinc() when done.
++ *
++ * no_hostrealm only applies if fallback processing is in use
++ * (dns_canonicalize_hostname = fallback).  It will not remove the realm if
++ * krb5_sname_to_principal() already canonicalized the hostname and looked up a
++ * realm.  subst_defrealm applies whether or not fallback processing is in use.
+  */
+ struct canonprinc {
+     krb5_const_principal princ;
+diff --git a/src/lib/krb5/os/sn2princ.c b/src/lib/krb5/os/sn2princ.c
+index c99b7da17..93c155932 100644
+--- a/src/lib/krb5/os/sn2princ.c
++++ b/src/lib/krb5/os/sn2princ.c
+@@ -271,18 +271,36 @@ krb5_error_code
+ k5_canonprinc(krb5_context context, struct canonprinc *iter,
+               krb5_const_principal *princ_out)
+ {
++    krb5_error_code ret;
+     int step = ++iter->step;
+ 
+     *princ_out = NULL;
+ 
+-    /* If we're not doing fallback, the input principal is canonical. */
+-    if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK ||
+-        iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 ||
++    /* If the hostname isn't from krb5_sname_to_principal(), the input
++     * principal is canonical. */
++    if (iter->princ->type != KRB5_NT_SRV_HST || iter->princ->length != 2 ||
+         iter->princ->data[1].length == 0) {
+         *princ_out = (step == 1) ? iter->princ : NULL;
+         return 0;
+     }
+ 
++    /* If we're not doing fallback, the hostname is canonical, but we may need
++     * to substitute the default realm. */
++    if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK) {
++        if (step > 1)
++            return 0;
++        iter->copy = *iter->princ;
++        if (iter->subst_defrealm && iter->copy.realm.length == 0) {
++            ret = krb5_get_default_realm(context, &iter->realm);
++            if (ret)
++                return ret;
++            iter->copy = *iter->princ;
++            iter->copy.realm = string2data(iter->realm);
++        }
++        *princ_out = &iter->copy;
++        return 0;
++    }
++
+     /* Canonicalize without DNS at step 1, with DNS at step 2. */
+     if (step > 2)
+         return 0;
diff --git a/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch b/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch
new file mode 100644
index 0000000..9334c19
--- /dev/null
+++ b/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch
@@ -0,0 +1,1750 @@
+From 9b3d8b9c395bf1a889ea6d6439dc3543c680480d Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Thu, 22 Apr 2021 15:51:36 -0400
+Subject: [PATCH] Move some dejagnu kadmin tests to Python tests
+
+Remove the dejagnu scripts kadmin.exp, pwchange.exp, and pwhist.exp.
+
+Add a new Python test script t_kadmin.py for the miscellaneous kadmin
+tests from kadmin.exp.
+
+In t_changepw.py, use modprinc +needchange for one of the kinit
+password change tests to gain the same coverage as pwchange.exp had,
+and add the "password changes are usable by kinit" tests from
+kadmin.exp.
+
+In t_policy.py, add the ticket 929 regression tests from kadmin.exp
+and the ticket 2841 regression tests from pwhist.exp.
+
+(cherry picked from commit 8027531caf6911bb07bf13de087da0e6bef5a348)
+---
+ src/tests/Makefile.in                         |    1 +
+ src/tests/dejagnu/krb-standalone/kadmin.exp   | 1133 -----------------
+ src/tests/dejagnu/krb-standalone/pwchange.exp |  145 ---
+ src/tests/dejagnu/krb-standalone/pwhist.exp   |  217 ----
+ src/tests/t_changepw.py                       |   34 +-
+ src/tests/t_kadmin.py                         |   54 +
+ src/tests/t_policy.py                         |   62 +
+ 7 files changed, 143 insertions(+), 1503 deletions(-)
+ delete mode 100644 src/tests/dejagnu/krb-standalone/kadmin.exp
+ delete mode 100644 src/tests/dejagnu/krb-standalone/pwchange.exp
+ delete mode 100644 src/tests/dejagnu/krb-standalone/pwhist.exp
+ create mode 100644 src/tests/t_kadmin.py
+
+diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in
+index 6b7749129..ab416cc5f 100644
+--- a/src/tests/Makefile.in
++++ b/src/tests/Makefile.in
+@@ -147,6 +147,7 @@ check-pytests: unlockiter s4u2self
+ 	$(RUNPYTEST) $(srcdir)/t_referral.py $(PYTESTFLAGS)
+ 	$(RUNPYTEST) $(srcdir)/t_skew.py $(PYTESTFLAGS)
+ 	$(RUNPYTEST) $(srcdir)/t_keytab.py $(PYTESTFLAGS)
++	$(RUNPYTEST) $(srcdir)/t_kadmin.py $(PYTESTFLAGS)
+ 	$(RUNPYTEST) $(srcdir)/t_kadmin_acl.py $(PYTESTFLAGS)
+ 	$(RUNPYTEST) $(srcdir)/t_kadmin_parsing.py $(PYTESTFLAGS)
+ 	$(RUNPYTEST) $(srcdir)/t_kdb.py $(PYTESTFLAGS)
+diff --git a/src/tests/dejagnu/krb-standalone/kadmin.exp b/src/tests/dejagnu/krb-standalone/kadmin.exp
+deleted file mode 100644
+index fa50a61fb..000000000
+--- a/src/tests/dejagnu/krb-standalone/kadmin.exp
++++ /dev/null
+@@ -1,1133 +0,0 @@
+-# Kerberos kadmin test.
+-# This is a DejaGnu test script.
+-# This script tests Kerberos kadmin5 using kadmin.local as verification.
+-
+-#++
+-# kadmin_add	- Test add new v5 principal function of kadmin.
+-#
+-# Adds principal $pname with password $password.  Returns 1 on success.
+-#--
+-proc kadmin_add { pname password } {
+-    global REALMNAME
+-    global KADMIN
+-    global KADMIN_LOCAL
+-    global KEY
+-    global spawn_id
+-    global tmppwd
+-
+-    set good 0
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin add $pname lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin add $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin add $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*:" {
+-	send "adminpass$KEY\r"
+-    }
+-    expect "Enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" }
+-    expect "Re-enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" }
+-    expect "Principal \"$pname@$REALMNAME\" created." { set good 1 }
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin add)"
+-    catch "close -i $spawn_id"
+-    if { $good == 1 } {
+-	#
+-	# use kadmin.local to verify that a principal was created and that its
+-	# salt types are 0 (normal).
+-	#
+-	envstack_push
+-	setup_kerberos_env kdc
+-	spawn $KADMIN_LOCAL -r $REALMNAME
+-	envstack_pop
+-	expect_after {
+-	    -i $spawn_id
+-	    timeout {
+-		fail "kadmin add $pname"
+-		catch "expect_after"
+-		return 0
+-	    }
+-	    eof {
+-		fail "kadmin add $pname"
+-		catch "expect_after"
+-		return 0
+-	    }
+-	}
+-	set good 0
+-	expect "kadmin.local: " { send "getprinc $pname\r" }
+-	expect "Principal: $pname@$REALMNAME" { set good 1 }
+-	expect "Expiration date:" { verbose "got expiration date" }
+-	expect "Last password change:" { verbose "got last pwchange" }
+-	expect "Password expiration date:" { verbose "got pwexpire date" }
+-	expect "Maximum ticket life:" { verbose "got max life" }
+-	expect "Maximum renewable life:" { verbose "got max rlife" }
+-	expect "Last modified:" { verbose "got last modified" }
+-	expect "Last successful authentication:" { verbose "last succ auth" }
+-	expect "Last failed authentication:" { verbose "last pw failed" }
+-	expect "Failed password attempts:" { verbose "num failed attempts" }
+-	expect "Number of keys:" { verbose "num keys"} 
+-	expect {
+-		"Key: " { verbose "Key listed" 
+-			exp_continue
+-		}
+-		"Attributes:" { verbose "attributes" }
+-	}
+-	expect "kadmin.local: " { send "q\r" }
+-
+-	expect_after
+-	expect eof
+-	set k_stat [wait -i $spawn_id]
+-	verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)"
+-	catch "close -i $spawn_id"
+-	if { $good == 1 } {
+-	    pass "kadmin add $pname"
+-	    return 1
+-	}
+-	else {
+-	    fail "kadmin add $pname"
+-	    return 0
+-	}
+-    }
+-    else {
+-	fail "kadmin add $pname"
+-	return 0
+-    }
+-}
+-
+-#++
+-# kadmin_add_rnd	- Test add new v5 principal with random key function.
+-#
+-# Adds principal $pname with random key.  Returns 1 on success.
+-#--
+-proc kadmin_add_rnd { pname { flags "" } } {
+-    global REALMNAME
+-    global KADMIN
+-    global KADMIN_LOCAL
+-    global KEY
+-    global spawn_id
+-    global tmppwd
+-
+-    set good 0
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "ank -randkey $flags $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin add rnd $pname lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin add_rnd $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin add_rnd $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *" {
+-	send "adminpass$KEY\r"
+-    }
+-    expect "Principal \"$pname@$REALMNAME\" created." { set good 1 }
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin add_rnd)"
+-    catch "close -i $spawn_id"
+-    if { $good == 1 } {
+-	#
+-	# use kadmin.local to verify that a principal was created and that its
+-	# salt types are 0 (normal).
+-	#
+-	envstack_push
+-	setup_kerberos_env kdc
+-	spawn $KADMIN_LOCAL -r $REALMNAME
+-	envstack_pop
+-	expect_after {
+-	     -i $spawn_id
+-	    timeout {
+-		fail "kadmin add_rnd $pname"
+-		catch "expect_after"
+-		return 0
+-	    }
+-	    eof {
+-		fail "kadmin add_rnd $pname"
+-		catch "expect_after"
+-		return 0
+-	    }
+-	}
+-	set good 0
+-	expect "kadmin.local:" { send "getprinc $pname\r" }
+-	expect "Principal: $pname@$REALMNAME" { set good 1 }
+-	expect "kadmin.local:" { send "q\r" }
+-	expect_after
+-	expect eof
+-	set k_stat [wait -i $spawn_id]
+-	verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)"
+-	catch "close -i $spawn_id"
+-	if { $good == 1 } {
+-	    pass "kadmin add_rnd $pname"
+-	    return 1
+-	}
+-	else {
+-	    fail "kadmin add_rnd $pname"
+-	    return 0
+-	}
+-    }
+-    else {
+-	fail "kadmin add_rnd $pname"
+-	return 0
+-    }
+-}
+-
+-#++
+-# kadmin_show	- Test show principal function of kadmin.
+-# 
+-# Retrieves entry for $pname.  Returns 1 on success.
+-#--
+-proc kadmin_show { pname } {
+-    global REALMNAME
+-    global KADMIN
+-    global KEY
+-    global spawn_id
+-
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_principal $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin show $pname lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin show $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin show $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *"
+-    send "adminpass$KEY\r"
+-    expect -re "\r.*Principal: $pname@$REALMNAME.*Key: .*Attributes:.*Policy: .*\r"
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin show)"
+-    catch "close -i $spawn_id"
+-    pass "kadmin show $pname"
+-    return 1
+-}
+-
+-#++
+-# kadmin_cpw	- Test change password function of kadmin
+-#
+-# Change password of $pname to $password.  Returns 1 on success.
+-#--
+-proc kadmin_cpw { pname password } {
+-    global REALMNAME
+-    global KADMIN
+-    global KEY
+-    global spawn_id
+-
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "cpw $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin cpw $pname lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin cpw $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin cpw $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *" {
+-	send "adminpass$KEY\r"
+-    }
+-
+-    expect "Enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" }
+-    expect "Re-enter password for principal \"$pname@$REALMNAME\":" { send "$password\r" }
+-    # When in doubt, jam one of these in there.
+-    expect "\r"
+-    expect "Password for \"$pname@$REALMNAME\" changed."
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin cpw)"
+-    catch "close -i $spawn_id"
+-    pass "kadmin cpw $pname"
+-    return 1
+-}
+-
+-#++
+-# kadmin_cpw_rnd	- Test change random key function of kadmin.
+-#
+-# Changes principal $pname's key to a new random key.  Returns 1 on success.
+-#--
+-proc kadmin_cpw_rnd { pname } {
+-    global REALMNAME
+-    global KADMIN
+-    global KEY
+-    global spawn_id
+-
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "cpw -randkey $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin cpw_rnd $pname lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin cpw_rnd $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin cpw_rnd $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *" {
+-	send "adminpass$KEY\r"
+-    }
+-    # When in doubt, jam one of these in there.
+-    expect "\r"
+-    expect "Key for \"$pname@$REALMNAME\" randomized."
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin cpw_rnd)"
+-    catch "close -i $spawn_id"
+-    pass "kadmin cpw_rnd $pname"
+-    return 1
+-}
+-
+-#++
+-# kadmin_modify	- Test modify principal function of kadmin.
+-#
+-# Modifies principal $pname with flags $flags.  Returns 1 on success.
+-#--
+-proc kadmin_modify { pname flags } {
+-    global REALMNAME
+-    global KADMIN
+-    global KEY
+-    global spawn_id
+-
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "modprinc $flags $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin modify $pname ($flags) lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin modify $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin modify $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *"
+-    send "adminpass$KEY\r"
+-    # When in doubt, jam one of these in there.
+-    expect "\r"
+-    expect "Principal \"$pname@$REALMNAME\" modified."
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin modify)"
+-    catch "close -i $spawn_id"
+-    pass "kadmin modify $pname"
+-    return 1
+-}
+-
+-
+-#++
+-# kadmin_list	- Test list database function of kadmin.
+-#
+-# Lists the database and verifies that output matches regular expression
+-# "(.*@$REALMNAME)*".  Returns 1 on success.
+-#--
+-proc kadmin_list {  } {
+-    global REALMNAME
+-    global KADMIN
+-    global KEY
+-    global spawn_id
+-
+-    # "*" would match everything
+-    # "*n" should match a few like kadmin/admin but see ticket 5667
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_principals *n"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin ldb lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	"Communication failure" {
+-	    fail "kadmin ldb got RPC error"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin ldb"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin ldb"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *" {
+-	send "adminpass$KEY\r"
+-    }
+-    expect -re "\(.*@$REALMNAME\r\n\)+"
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin list)"
+-    catch "close -i $spawn_id"
+-    pass "kadmin ldb"
+-    return 1
+-}
+-
+-#++
+-# kadmin_extract	- Test extract service key function of kadmin.
+-#
+-# Extracts service key for service name $name instance $instance.  Returns
+-# 1 on success.
+-#--
+-proc kadmin_extract { instance name } {
+-    global REALMNAME
+-    global KADMIN
+-    global KEY
+-    global spawn_id
+-    global tmppwd
+-
+-    catch "exec rm -f $tmppwd/keytab"
+-
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "xst -k $tmppwd/keytab $name/$instance"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin xst $instance $name lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin xst $instance $name"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin xst $instance $name"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *" {
+-	send "adminpass$KEY\r"
+-    }
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin xst)"
+-    catch "close -i $spawn_id"
+-    catch "exec rm -f $instance-new-keytab"
+-    pass "kadmin xst $instance $name"
+-    return 1
+-}
+-
+-#++
+-# kadmin_delete	- Test delete principal function of kadmin.
+-#
+-# Deletes principal $pname.  Returns 1 on success.
+-#--
+-proc kadmin_delete { pname } {
+-    global REALMNAME
+-    global KADMIN
+-    global KADMIN_LOCAL
+-    global KEY
+-    global spawn_id
+-    global tmppwd
+-
+-    set good 0
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delprinc -force $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin_delete $pname lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin delprinc $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin delprinc $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *" {
+-	send "adminpass$KEY\r"
+-    }
+-    expect "Principal \"$pname@$REALMNAME\" deleted." { set good 1 }
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin delprinc)"
+-    catch "close -i $spawn_id"
+-    if { $good == 1 } {
+-	#
+-	# use kadmin.local to verify that the old principal is not present.
+-	#
+-	envstack_push
+-	setup_kerberos_env kdc
+-	spawn $KADMIN_LOCAL -r $REALMNAME
+-	envstack_pop
+-	expect_after {
+-	    -i $spawn_id
+-	    timeout {
+-		fail "kadmin delprinc $pname"
+-		catch "expect_after"
+-		return 0
+-	    }
+-	    eof {
+-		fail "kadmin delprinc $pname"
+-		catch "expect_after"
+-		return 0
+-	    }
+-	}
+-	set good 0
+-	expect "kadmin.local: " { send "getprinc $pname\r" }
+-	expect "Principal does not exist while retrieving \"$pname@$REALMNAME\"." { set good 1 }
+-	expect "kadmin.local: " { send "quit\r" }
+-	expect_after
+-	expect eof
+-	set k_stat [wait -i $spawn_id]
+-	verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)"
+-	catch "close -i $spawn_id"
+-	if { $good == 1 } {
+-	    pass "kadmin delprinc $pname"
+-	    return 1
+-	}
+-	else {
+-	    fail "kadmin delprinc $pname"
+-	    return 0
+-	}
+-    }
+-    else {
+-	fail "kadmin delprinc $pname"
+-	return 0
+-    }
+-}
+-
+-#++
+-# kadmin_delete	- Test delete principal function of kadmin.
+-#
+-# Deletes principal $pname.  Returns 1 on success.
+-#--
+-proc kadmin_delete_locked_down { pname } {
+-    global REALMNAME
+-    global KADMIN
+-    global KADMIN_LOCAL
+-    global KEY
+-    global spawn_id
+-    global tmppwd
+-
+-    #
+-    # First test that we fail, then unlock and retry
+-    #
+-
+-    set good 0
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delprinc -force $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin_delete $pname lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin delprinc $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin delprinc $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *" {
+-	send "adminpass$KEY\r"
+-    }
+-    expect "delete_principal: Operation requires ``delete'' privilege while deleting principal \"$pname@$REALMNAME\"" { set good 1 }
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin delprinc)"
+-    catch "close -i $spawn_id"
+-    if { $good == 1 } {
+-	#
+-	# use kadmin.local to remove lockdown.
+-	#
+-	envstack_push
+-	setup_kerberos_env kdc
+-	spawn $KADMIN_LOCAL -r $REALMNAME
+-	envstack_pop
+-	expect_after {
+-	    -i $spawn_id
+-	    timeout {
+-		fail "kadmin delprinc $pname"
+-		catch "expect_after"
+-		return 0
+-	    }
+-	    eof {
+-		fail "kadmin delprinc $pname"
+-		catch "expect_after"
+-		return 0
+-	    }
+-	}
+-	set good 0
+-	expect "kadmin.local: " { send "modprinc -lockdown_keys $pname\r" }
+-	expect "Principal \"$pname@$REALMNAME\" modified." { set good 1 }
+-	expect "kadmin.local: " { send "quit\r" }
+-	expect_after
+-	expect eof
+-	set k_stat [wait -i $spawn_id]
+-	verbose "wait -i $spawn_id returned $k_stat (kadmin.local show)"
+-	catch "close -i $spawn_id"
+-	if { $good == 1 } {
+-            set good 0
+-            if {[kadmin_delete $pname]} { set good 1 }
+-        }
+-	if { $good == 1 } {
+-	    pass "kadmin delprinc $pname"
+-	    return 1
+-	}
+-	else {
+-	    fail "kadmin delprinc $pname"
+-	    return 0
+-	}
+-    }
+-    else {
+-	fail "kadmin delprinc $pname"
+-	return 0
+-    }
+-}
+-
+-#++
+-# kpasswd_cpw	- Test password changing using kpasswd.
+-#
+-# Change $princ's password from $opw to $npw.  Returns 1 on success.
+-#--
+-proc kpasswd_cpw { princ opw npw } {
+-    global KPASSWD
+-    global REALMNAME
+-
+-    spawn $KPASSWD $princ
+-    expect_after {
+-	timeout {
+-	    fail "kpasswd $princ $npw"
+-#	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kpasswd $princ $npw"
+-#	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-
+-#    expect "Changing password for $princ."
+-#    expect "Old password:" { send "$opw\r" }
+-#    expect "New password:" { send "$npw\r" }
+-#    expect "New password (again):" { send "$npw\r" }
+-    expect "Password for $princ@$REALMNAME:" { send "$opw\r" }
+-    expect "Enter new password:"  { send "$npw\r" }
+-    expect "Enter it again:"      { send "$npw\r" }
+-#    expect "Kerberos password changed."
+-    expect "Password changed."
+-    expect_after
+-    expect eof
+-
+-    if ![check_exit_status "kpasswd"] {
+-	fail "kpasswd $princ $npw"
+-	return 0
+-    }
+-    pass "kpasswd $princ $npw"
+-    return 1
+-}
+-
+-#++
+-# kadmin_addpol	- Test add new policy function of kadmin.
+-#
+-# Adds policy $pname.  Returns 1 on success.
+-#--
+-proc kadmin_addpol { pname } {
+-    global REALMNAME
+-    global KADMIN
+-    global KADMIN_LOCAL
+-    global KEY
+-    global spawn_id
+-    global tmppwd
+-
+-    set good 0
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "addpol $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin addpol $pname lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin addpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin addpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *" {
+-	send "adminpass$KEY\r"
+-    }
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin addpol)"
+-    catch "close -i $spawn_id"
+-    #
+-    # use kadmin.local to verify that a policy was created
+-    #
+-    envstack_push
+-    setup_kerberos_env kdc
+-    spawn $KADMIN_LOCAL -r $REALMNAME
+-    envstack_pop
+-    expect_after {
+-        -i $spawn_id
+-        timeout {
+-	    fail "kadmin addpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-        }
+-        eof {
+-	    fail "kadmin addpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-        }
+-    }
+-    set good 0
+-    expect "kadmin.local: " { send "getpol $pname\r" }
+-    expect "Policy: $pname" { set good 1 }
+-    expect "Maximum password life:" { verbose "got max pw life" }
+-    expect "Minimum password life:" { verbose "got min pw life" }
+-    expect "Minimum password length:" { verbose "got min pw length" }
+-    expect "Minimum number of password character classes:" {
+-        verbose "got min pw character classes" }
+-    expect "Number of old keys kept:" { verbose "got num old keys kept" }
+-    expect "kadmin.local: " { send "q\r" }
+-
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin.local showpol)"
+-    catch "close -i $spawn_id"
+-    if { $good == 1 } {
+-        pass "kadmin addpol $pname"
+-        return 1
+-    }
+-    else {
+-        fail "kadmin addpol $pname"
+-        return 0
+-    }
+-}
+-
+-#++
+-# kadmin_delpol	- Test delete policy function of kadmin.
+-#
+-# Deletes policy $pname.  Returns 1 on success.
+-#--
+-proc kadmin_delpol { pname } {
+-    global REALMNAME
+-    global KADMIN
+-    global KADMIN_LOCAL
+-    global KEY
+-    global spawn_id
+-    global tmppwd
+-
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "delpol -force $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin_delpol $pname lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin delpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin delpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *" {
+-	send "adminpass$KEY\r"
+-    }
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin delpol)"
+-    catch "close -i $spawn_id"
+-    #
+-    # use kadmin.local to verify that the old policy is not present.
+-    #
+-    envstack_push
+-    setup_kerberos_env kdc
+-    spawn $KADMIN_LOCAL -r $REALMNAME
+-    envstack_pop
+-    expect_after {
+-        -i $spawn_id
+-        timeout {
+-	    fail "kadmin delpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-        }
+-        eof {
+-	    fail "kadmin delpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-        }
+-    }
+-    set good 0
+-    expect "kadmin.local: " { send "getpol $pname\r" }
+-    expect "Policy does not exist while retrieving policy \"$pname\"." {
+-	set good 1
+-    }
+-    expect "kadmin.local: " { send "quit\r" }
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin.local showpol)"
+-    catch "close -i $spawn_id"
+-    if { $good == 1 } {
+-        pass "kadmin delpol $pname"
+-        return 1
+-    }
+-    else {
+-        fail "kadmin delpol $pname"
+-        return 0
+-    }
+-}
+-
+-#++
+-# kadmin_listpols	- Test list policy database function of kadmin.
+-#
+-# Lists the policies.  Returns 1 on success.
+-#--
+-proc kadmin_listpols {  } {
+-    global REALMNAME
+-    global KADMIN
+-    global KEY
+-    global spawn_id
+-
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_policies *"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin lpols lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin lpols"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin lpols"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *" {
+-	send "adminpass$KEY\r"
+-    }
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin listpols)"
+-    catch "close -i $spawn_id"
+-    pass "kadmin lpols"
+-    return 1
+-}
+-
+-#++
+-# kadmin_modpol	- Test modify policy function of kadmin.
+-#
+-# Modifies policy $pname with flags $flags.  Returns 1 on success.
+-#--
+-proc kadmin_modpol { pname flags } {
+-    global REALMNAME
+-    global KADMIN
+-    global KEY
+-    global spawn_id
+-
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "modpol $flags $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin modpol $pname ($flags) lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin modpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin modpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *"
+-    send "adminpass$KEY\r"
+-    # When in doubt, jam one of these in there.
+-    expect "\r"
+-    # Sadly, kadmin doesn't print a confirmation message for policy operations.
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin modpol)"
+-    catch "close -i $spawn_id"
+-    pass "kadmin modpol $pname"
+-    return 1
+-}
+-
+-#++
+-# kadmin_showpol	- Test show policy function of kadmin.
+-# 
+-# Retrieves entry for $pname.  Returns 1 on success.
+-#--
+-proc kadmin_showpol { pname } {
+-    global REALMNAME
+-    global KADMIN
+-    global KEY
+-    global spawn_id
+-
+-    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "get_policy $pname"
+-    expect_after {
+-	"Cannot contact any KDC" {
+-	    fail "kadmin showpol $pname lost KDC"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	timeout {
+-	    fail "kadmin showpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kadmin showpol $pname"
+-	    catch "expect_after"
+-	    return 0
+-	}
+-    }
+-    expect -re "assword\[^\r\n\]*: *"
+-    send "adminpass$KEY\r"
+-    expect -re "\r.*Policy: $pname.*Number of old keys kept: .*\r"
+-    expect_after
+-    expect eof
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin showpol)"
+-    catch "close -i $spawn_id"
+-    pass "kadmin showpol $pname"
+-    return 1
+-}
+-
+-#++
+-# kdestroy
+-#--
+-proc kdestroy { } {
+-    global KDESTROY
+-
+-    spawn $KDESTROY -5
+-    if ![check_exit_status "kdestroy"] {
+-	return 0
+-    }
+-    return 1
+-}
+-
+-# Wrap the tests in a procedure, so that we can kill the daemons if
+-# we get some sort of error.
+-
+-proc kadmin_test { } {
+-    global hostname
+-
+-    # Start up the kerberos and kadmind daemons
+-    if {![start_kerberos_daemons 0] } {
+-	return
+-    }
+-
+-    # Test basic kadmin functions.
+-    if {![kadmin_add v5principal/instance1 v5principal] \
+-	|| ![kadmin_addpol standardpol] \
+-	|| ![kadmin_showpol standardpol] \
+-	|| ![kadmin_listpols] \
+-	|| ![kadmin_modpol standardpol "-minlength 5"] \
+-	|| ![kadmin_add v4principal/instance2 v4principal] \
+-	|| ![kadmin_add_rnd v5random] \
+-	|| ![kadmin_show v5principal/instance1] \
+-	|| ![kadmin_show v4principal/instance2] \
+-	|| ![kadmin_show v5random] \
+-	|| ![kadmin_cpw v5principal/instance1 faroutman] \
+-	|| ![kadmin_cpw v4principal/instance2 honkydory] \
+-	|| ![kadmin_cpw_rnd v5random] \
+-	|| ![kadmin_modify v5random -allow_tix] \
+-	|| ![kadmin_modify v5random +allow_tix] \
+-	|| ![kadmin_modify v5random "-policy standardpol"] \
+-	|| ![kadmin_list] \
+-	|| ![kadmin_extract instance1 v5principal] \
+-	|| ![kadmin_delete v5random] \
+-	|| ![kadmin_delete v4principal/instance2] \
+-	|| ![kadmin_delete v5principal/instance1] \
+-	|| ![kadmin_delpol standardpol]} {
+-	return
+-    }
+-
+-# You cannot extract a v4 key...
+-#	|| ![kadmin_extractv4 instance2 v4principal] \
+-
+-    # now test kpasswd
+-    if {![kadmin_add testprinc/instance thisisatest] \
+-	    || ![kpasswd_cpw testprinc/instance thisisatest anothertest] \
+-	    || ![kpasswd_cpw testprinc/instance anothertest goredsox] \
+-	    || ![kadmin_delete testprinc/instance]} {
+-	return
+-    }
+-
+-    # now test that we can kinit with principals/passwords.
+-    # We defer kdestroying until after kpasswd at least once to test FAST automatic use in kpasswd
+-    if {![kadmin_add testprinc1/instance thisisatest] \
+-	    || ![kinit testprinc1/instance thisisatest 0] \
+-	    || ![kpasswd_cpw testprinc1/instance thisisatest anothertest] \
+-	    || ![kdestroy] \
+-	    || ![kinit testprinc1/instance anothertest 0] \
+-	    || ![kdestroy] \
+-	    || ![kpasswd_cpw testprinc1/instance anothertest goredsox] \
+-	    || ![kinit testprinc1/instance goredsox 0] \
+-	    || ![kdestroy] \
+-	    || ![kadmin_cpw testprinc1/instance betterwork] \
+-	    || ![kinit testprinc1/instance betterwork 0] \
+-	    || ![kdestroy] \
+-	    || ![kadmin_delete testprinc1/instance]} {
+-	return
+-    }
+-
+-    # now test modify changes.
+-    if {![kadmin_add testuser longtestpw] \
+-	    || ![kinit testuser longtestpw 0] \
+-	    || ![kdestroy] \
+-	    || ![kadmin_modify testuser "-maxlife \"2500 seconds\""] \
+-	    || ![kinit testuser longtestpw 0] \
+-	    || ![kdestroy] \
+-	    || ![kadmin_delete testuser]} {
+-	return
+-    }
+-
+-    # now test that reducing the history number doesn't make kadmind vulnerable.
+-    if {![kadmin_addpol crashpol] \
+-	    || ![kadmin_modpol crashpol "-history 5"] \
+-	    || ![kadmin_add crash first] \
+-	    || ![kadmin_modify crash "-policy crashpol"] \
+-	    || ![kadmin_cpw crash second] \
+-	    || ![kadmin_cpw crash third] \
+-	    || ![kadmin_cpw crash fourth] \
+-	    || ![kadmin_modpol crashpol "-history 3"] \
+-	    || ![kadmin_cpw crash fifth] \
+-	    || ![kadmin_delete crash] \
+-	    || ![kadmin_delpol crashpol]} {
+-	return
+-    }
+-
+-    # test retrieval of large number of principals
+-    # bug [2877]
+-    for { set i 0 } { $i < 200 } { incr i } {
+-	if { ![kadmin_add "foo$i" foopass] } {
+-	    return
+-	}
+-    }
+-
+-    if { ![kadmin_list] } {
+-	return
+-    }
+-
+-    # test fallback to kadmin/hostname
+-    if {![kadmin_add_rnd kadmin/$hostname] \
+-	    || ![kadmin_delete_locked_down kadmin/admin] \
+-	    || ![kadmin_list] \
+-	    || ![kadmin_add_rnd kadmin/admin -allow_tgs_req] \
+-	    || ![kadmin_list]} {
+-	return
+-    }
+-
+-    verbose "kadmin_test succeeded"
+-}
+-
+-run_once kadmin {
+-    # Set up the kerberos database.
+-    if {![get_hostname] \
+-	    || ![setup_kerberos_files] \
+-	    || ![setup_kerberos_env] \
+-	    || ![setup_kerberos_db 0]} {
+-	return
+-    }
+-
+-    # Run the test.
+-    set status [catch kadmin_test msg]
+-
+-    # Shut down the kerberos daemons and the rsh daemon.
+-    stop_kerberos_daemons
+-
+-    if { $status != 0 } {
+-	send_error "ERROR: error in kadmin.exp\n"
+-	send_error "$msg\n"
+-	exit 1
+-    }
+-}
+diff --git a/src/tests/dejagnu/krb-standalone/pwchange.exp b/src/tests/dejagnu/krb-standalone/pwchange.exp
+deleted file mode 100644
+index 010e8344a..000000000
+--- a/src/tests/dejagnu/krb-standalone/pwchange.exp
++++ /dev/null
+@@ -1,145 +0,0 @@
+-# Password-changing Kerberos test.
+-# This is a DejaGnu test script.
+-
+-# We are about to start up a couple of daemon processes.  We do all
+-# the rest of the tests inside a proc, so that we can easily kill the
+-# processes when the procedure ends.
+-
+-proc kinit_expecting_pwchange { name pass newpass } {
+-    global REALMNAME
+-    global KINIT
+-    global spawn_id
+-
+-    # Use kinit to get a ticket.
+-	#
+-	# For now always get forwardable tickets. Later when we need to make
+-	# tests that distinguish between forwardable tickets and otherwise
+-	# we should but another option to this proc. --proven
+-	#
+-    spawn $KINIT -5 -f $name@$REALMNAME
+-    expect {
+-	"Password for $name@$REALMNAME:" {
+-	    verbose "kinit started"
+-	}
+-	timeout {
+-	    fail "kinit"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kinit"
+-	    return 0
+-	}
+-    }
+-    send "$pass\r"
+-    expect {
+-	"Enter new password: " { }
+-	timeout {
+-	    fail "kinit (new password prompt)"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kinit (new password prompt)"
+-	    return 0
+-	}
+-    }
+-    send "$newpass\r"
+-    expect {
+-	" again: " { }
+-	timeout {
+-	    fail "kinit (new password prompt2)"
+-	    return 0
+-	}
+-	eof {
+-	    fail "kinit (new password prompt2)"
+-	    return 0
+-	}
+-    }
+-    send "$newpass\r"
+-    expect eof
+-    if ![check_exit_status kinit] {
+-	return 0
+-    }
+-
+-    return 1
+-}
+-
+-proc doit { } {
+-    global REALMNAME
+-    global KLIST
+-    global KDESTROY
+-    global KEY
+-    global KADMIN_LOCAL
+-    global KTUTIL
+-    global hostname
+-    global tmppwd
+-    global spawn_id
+-    global supported_enctypes
+-    global KRBIV
+-    global portbase
+-    global mode
+-
+-    # Start up the kerberos and kadmind daemons.
+-    if ![start_kerberos_daemons 0] {
+-	return
+-    }
+-
+-    # Use kadmin to add a key.
+-    if ![add_kerberos_key pwchanger 0] {
+-	return
+-    }
+-
+-    setup_kerberos_env kdc
+-    spawn $KADMIN_LOCAL -q "modprinc +needchange pwchanger"
+-    catch expect_after
+-    expect {
+-	timeout {
+-	    fail "kadmin.local modprinc +needchange"
+-	}
+-	eof {
+-	    pass "kadmin.local modprinc +needchange"
+-	}
+-    }
+-    set k_stat [wait -i $spawn_id]
+-    verbose "wait -i $spawn_id returned $k_stat (kadmin modprinc +needchange)"
+-    catch "close -i $spawn_id"
+-
+-    setup_kerberos_env client
+-    if ![kinit_expecting_pwchange pwchanger pwchanger$KEY floople] {
+-	return
+-    }
+-    pass "kinit (password change)"
+-    if ![kinit pwchanger floople 0] {
+-	return
+-    }
+-    pass "kinit (new password)"
+-
+-    # Destroy the ticket.
+-    spawn $KDESTROY -5
+-    if ![check_exit_status "kdestroy"] {
+-	return
+-    }
+-    pass "kdestroy"
+-}
+-
+-run_once pwchange {
+-    # Set up the Kerberos files and environment.
+-    if {![get_hostname] || ![setup_kerberos_files] || ![setup_kerberos_env]} {
+-	return
+-    }
+-
+-    # Initialize the Kerberos database.  The argument tells
+-    # setup_kerberos_db that it is being called from here.
+-    if ![setup_kerberos_db 0] {
+-	return
+-    }
+-
+-    set status [catch doit msg]
+-
+-    stop_kerberos_daemons
+-
+-    if { $status != 0 } {
+-	send_error "ERROR: error in pwchange.exp\n"
+-	send_error "$msg\n"
+-	exit 1
+-    }
+-}
+diff --git a/src/tests/dejagnu/krb-standalone/pwhist.exp b/src/tests/dejagnu/krb-standalone/pwhist.exp
+deleted file mode 100644
+index ed7a3771a..000000000
+--- a/src/tests/dejagnu/krb-standalone/pwhist.exp
++++ /dev/null
+@@ -1,217 +0,0 @@
+-# password history tests
+-
+-# one *non-interactive* kadmin.local request
+-proc onerq { rq pname str {flags ""} } {
+-    global REALMNAME
+-    global KADMIN_LOCAL
+-
+-    spawn $KADMIN_LOCAL -r $REALMNAME -q "$rq $flags $pname"
+-    expect_after {
+-	timeout {
+-	    verbose "kadmin.local $rq $flags $pname timed out"
+-	    catch expect_after
+-	    kill [exp_pid]
+-	    close
+-	    expect eof
+-	    wait
+-	    return 0
+-	} eof {
+-	    verbose "kadmin.local $rq $flags $pname got EOF"
+-	    catch expect_after
+-	    wait
+-	    return 0
+-	}
+-    }
+-    expect $str
+-    expect_after
+-    expect eof
+-    wait
+-    return 1
+-}
+-
+-proc addprinc { pname pw } {
+-    global REALMNAME
+-
+-    return [onerq addprinc $pname \
+-		"Principal \"$pname@$REALMNAME\" created." "-pw $pw"]
+-}
+-
+-proc delprinc { pname } {
+-    global REALMNAME
+-    return [onerq delprinc $pname \
+-		"Principal \"$pname@$REALMNAME\" deleted." "-force"]
+-}
+-
+-proc cpw { pname pw } {
+-    global REALMNAME
+-
+-    return [onerq cpw $pname \
+-		"Password for \"$pname@$REALMNAME\" changed." "-pw $pw"]
+-}
+-
+-proc modprinc { pname flags } {
+-    global REALMNAME
+-
+-    return [onerq modprinc $pname \
+-		"Principal \"$pname@$REALMNAME\" modified." $flags]
+-}
+-
+-proc addpol { pname } {
+-    if ![onerq addpol $pname ""] {
+-	return 0
+-    }
+-    return [onerq getpol $pname "Policy: $pname"]
+-}
+-
+-proc delpol { pname } {
+-    onerq delpol $pname "" -force
+-    return [onerq getpol $pname \
+-		"Policy does not exist while retrieving policy \"$pname\"."]
+-}
+-
+-proc modpol { pname flags } {
+-    return [onerq modpol $pname "" $flags]
+-}
+-
+-# Mandatory command must return true.
+-# Issues a break in its parent on failure.
+-proc mustrun { cmd } {
+-    if ![eval $cmd] {
+-	perror "mandatory command failed: $cmd"
+-	uplevel break
+-    }
+-}
+-
+-# Fail test if command fails.
+-# Issues a break in its parent on failure.
+-proc chkpass { cmd } {
+-    upvar test test
+-    if ![eval $cmd] {
+-	verbose "unexpected failure: $cmd"
+-	fail $test
+-	uplevel break
+-    }
+-}
+-
+-# Fail test if command succeeds.
+-# Issues a break in its parent on failure.
+-proc chkfail { cmd } {
+-    upvar test test
+-    if [eval $cmd] {
+-	verbose "unexpected success: $cmd"
+-	fail $test
+-	uplevel break
+-    }
+-}
+-
+-# wrapper to run command (actually usually sequence of commands)
+-#
+-# If any part of CMD throws an exception, set failall, otherwise pass.
+-# If failall is already true, report unresolved.
+-proc wraptest { test cmd } {
+-    upvar failall failall
+-    if $failall {
+-	unresolved $test
+-	return
+-    }
+-    if [catch $cmd] {
+-	set failall 1
+-    } else {
+-	pass $test
+-    }
+-}
+-
+-run_once pwhist {
+-    # Set up the kerberos database.
+-    if {![get_hostname] \
+-	    || ![setup_kerberos_files] \
+-	    || ![setup_kerberos_env kdc] \
+-	    || ![setup_kerberos_db 0]} {
+-	return
+-    }
+-
+-    set failall 0
+-    wraptest "nkeys=1, nhist=3" {
+-	mustrun { addpol crashpol }
+-	mustrun { modpol crashpol "-history 3"}
+-	mustrun { addprinc crash 1111 }
+-	mustrun { modprinc crash "-policy crashpol" }
+-	chkpass { cpw crash 2222 }
+-	chkfail { cpw crash 2222 }
+-	chkfail { cpw crash 1111 }
+-    }
+-    verbose {old_keys [ 1111 ->[] ]}
+-
+-    # The following will result in reading/writing past array bounds if
+-    # add_to_history() is not patched.
+-    #
+-    # NOTE: A pass from this test does not mean the bug isn't present;
+-    # check with Purify, valgrind, etc.
+-    wraptest "array bounds ok on nkeys=1, nhist 3->2" {
+-	mustrun { modpol crashpol "-history 2" }
+-	chkpass { cpw crash 3333 }
+-    }
+-    verbose {old_keys [ ->2222 ]}
+-
+-    wraptest "verify nhist=2" {
+-	mustrun { delprinc crash }
+-	mustrun { addprinc crash 1111 }
+-	mustrun { modprinc crash "-policy crashpol" }
+-	chkpass { cpw crash 2222 }
+-	chkfail { cpw crash 2222 }
+-	chkfail { cpw crash 1111 }
+-    }
+-    verbose {old_keys [ ->1111 ]}
+-
+-    # The following will fail if growing the history array causes an extra
+-    # key to be lost due to failure to shift entries.
+-    wraptest "grow nhist 2->3" {
+-	mustrun { modpol crashpol "-history 3" }
+-	chkpass { cpw crash 3333 }
+-	chkfail { cpw crash 3333 }
+-	chkfail { cpw crash 2222 }
+-	chkfail { cpw crash 1111 }
+-    }
+-    verbose {old_keys [ 2222 ->1111 ]}
+-
+-    wraptest "grow nhist 3->4" {
+-	mustrun { modpol crashpol "-history 4" }
+-	chkfail { cpw crash 3333 }
+-	chkfail { cpw crash 2222 }
+-	chkfail { cpw crash 1111 }
+-	chkpass { cpw crash 4444 }
+-	chkfail { cpw crash 3333 }
+-	chkfail { cpw crash 2222 }
+-	chkfail { cpw crash 1111 }
+-    }
+-    verbose {old_keys [ 2222 3333 ->1111 ]}
+-    wraptest "shrink nhist 4->3" {
+-	mustrun { modpol crashpol "-history 3" }
+-	chkfail { cpw crash 4444 }
+-	chkfail { cpw crash 3333 }
+-	chkfail { cpw crash 2222 }
+-	chkfail { cpw crash 1111 }
+-	chkpass { cpw crash 5555 }
+-    }
+-    verbose {old_keys [ 4444 ->3333 ]}
+-    wraptest "verify nhist=3" {
+-	chkfail { cpw crash 5555 }
+-	chkfail { cpw crash 4444 }
+-	chkfail { cpw crash 3333 }
+-	chkpass { cpw crash 2222 }
+-    }
+-    verbose {old_keys [ ->4444 5555 ]}
+-    wraptest "shrink nhist 3->2" {
+-	mustrun { modpol crashpol "-history 2" }
+-	chkfail { cpw crash 2222 }
+-	chkfail { cpw crash 5555 }
+-	chkfail { cpw crash 4444 }
+-	chkpass { cpw crash 3333 }
+-    }
+-    verbose {old_keys [ ->2222 ]}
+-
+-    delprinc crash
+-    delpol crashpol
+-
+-    stop_kerberos_daemons
+-}
+diff --git a/src/tests/t_changepw.py b/src/tests/t_changepw.py
+index 573bdbd49..bf8e3a9eb 100755
+--- a/src/tests/t_changepw.py
++++ b/src/tests/t_changepw.py
+@@ -1,23 +1,24 @@
+ from k5test import *
+ 
+-# This file is intended to cover any password-changing mechanism.  For
+-# now it only contains a regression test for #7868.
+-
+ realm = K5Realm(create_host=False, get_creds=False, start_kadmind=True)
++realm.prep_kadmin()
+ 
+ # Mark a principal as expired and change its password through kinit.
++mark('password change via kinit')
+ realm.run([kadminl, 'modprinc', '-pwexpire', '1 day ago', 'user'])
+ pwinput = password('user') + '\nabcd\nabcd\n'
+ realm.run([kinit, realm.user_princ], input=pwinput)
+ 
+-# Do the same thing with FAST, with tracing turned on.
+-realm.run([kadminl, 'modprinc', '-pwexpire', '1 day ago', 'user'])
++# Regression test for #7868 (preauth options ignored when
++# krb5_get_init_creds_password() initiates a password change).  This
++# time use the REQUIRES_PWCHANGE bit instead of the password
++# expiration time.
++mark('password change via kinit with FAST')
++realm.run([kadminl, 'modprinc', '+needchange', 'user'])
+ pwinput = 'abcd\nefgh\nefgh\n'
+ out, trace = realm.run([kinit, '-T', realm.ccache, realm.user_princ],
+                        input=pwinput, return_trace=True)
+-
+-# Read the trace and check that FAST was used when getting the
+-# kadmin/changepw ticket.
++# Check that FAST was used when getting the kadmin/changepw ticket.
+ getting_changepw = fast_used_for_changepw = False
+ for line in trace.splitlines():
+     if 'Getting initial credentials for user@' in line:
+@@ -29,4 +30,21 @@ for line in trace.splitlines():
+ if not fast_used_for_changepw:
+     fail('FAST was not used to get kadmin/changepw ticket')
+ 
++# Test that passwords specified via kadmin and kpasswd are usable with
++# kinit.
++mark('password change usability by kinit')
++realm.run([kadminl, 'addprinc', '-pw', 'pw1', 'testprinc'])
++# Run kpasswd with an active cache to exercise automatic FAST use.
++realm.kinit('testprinc', 'pw1')
++realm.run([kpasswd, 'testprinc'], input='pw1\npw2\npw2\n')
++realm.kinit('testprinc', 'pw2')
++realm.run([kdestroy])
++realm.run([kpasswd, 'testprinc'], input='pw2\npw3\npw3\n')
++realm.kinit('testprinc', 'pw3')
++realm.run([kdestroy])
++realm.run_kadmin(['cpw', '-pw', 'pw4', 'testprinc'])
++realm.kinit('testprinc', 'pw4')
++realm.run([kdestroy])
++realm.run([kadminl, 'delprinc', 'testprinc'])
++
+ success('Password change tests')
+diff --git a/src/tests/t_kadmin.py b/src/tests/t_kadmin.py
+new file mode 100644
+index 000000000..fe6a3cc2e
+--- /dev/null
++++ b/src/tests/t_kadmin.py
+@@ -0,0 +1,54 @@
++from k5test import *
++
++realm = K5Realm(start_kadmind=True)
++
++# Create a principal.  Test -q option and keyboard entry of the admin
++# password and principal password.  Verify creation with kadmin.local.
++realm.run([kadmin, '-q', 'addprinc princ/pw'],
++          input=password('admin') + '\npw1\npw1\n')
++realm.run([kadminl, 'getprinc', 'princ/pw'],
++          expected_msg='Principal: princ/pw@KRBTEST.COM')
++
++# Run the remaining tests with a cache for efficiency.
++realm.prep_kadmin()
++
++realm.run_kadmin(['addpol', 'standardpol'])
++realm.run_kadmin(['listpols'], expected_msg='standardpol')
++realm.run_kadmin(['modpol', '-minlength', '5', 'standardpol'])
++realm.run_kadmin(['getpol', 'standardpol'],
++                 expected_msg='Minimum password length: 5')
++
++realm.run_kadmin(['addprinc', '-randkey', 'princ/random'])
++realm.run([kadminl, 'getprinc', 'princ/random'],
++          expected_msg='Principal: princ/random@KRBTEST.COM')
++
++realm.run_kadmin(['cpw', 'princ/pw'], input='newpw\nnewpw\n')
++realm.run_kadmin(['cpw', '-randkey', 'princ/random'])
++
++realm.run_kadmin(['modprinc', '-allow_tix', 'princ/random'])
++realm.run_kadmin(['modprinc', '+allow_tix', 'princ/random'])
++realm.run_kadmin(['modprinc', '-policy', 'standardpol', 'princ/random'])
++
++realm.run_kadmin(['listprincs'], expected_msg='princ/random@KRBTEST.COM')
++
++realm.run_kadmin(['ktadd', 'princ/pw'])
++
++realm.run_kadmin(['delprinc', 'princ/random'])
++realm.run([kadminl, 'getprinc', 'princ/random'], expected_code=1,
++          expected_msg='Principal does not exist')
++realm.run_kadmin(['delprinc', 'princ/pw'])
++realm.run([kadminl, 'getprinc', 'princ/pw'], expected_code=1,
++          expected_msg='Principal does not exist')
++
++realm.run_kadmin(['delpol', 'standardpol'])
++realm.run([kadminl, 'getpol', 'standardpol'], expected_code=1,
++          expected_msg='Policy does not exist')
++
++# Regression test for #2877 (fixed-sized GSSRPC buffers can't
++# accomodate large listprinc results).
++mark('large listprincs result')
++for i in range(200):
++    realm.run_kadmin(['addprinc', '-randkey', 'foo%d' % i])
++realm.run_kadmin(['listprincs'], expected_msg='foo199')
++
++success('kadmin and kpasswd tests')
+diff --git a/src/tests/t_policy.py b/src/tests/t_policy.py
+index 5a0c06b86..2bb4f5f18 100755
+--- a/src/tests/t_policy.py
++++ b/src/tests/t_policy.py
+@@ -25,6 +25,68 @@ realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser'], expected_code=1,
+ realm.run([kadminl, 'cpw', '-pw', '3rdpassword', 'pwuser'])
+ realm.run([kadminl, 'cpw', '-pw', 'l0ngenough', 'pwuser'])
+ 
++# Regression test for #929 (kadmind crash with more historical
++# passwords in a principal entry than current policy history setting).
++mark('password history (policy value reduced below current array size)')
++realm.run([kadminl, 'addpol', '-history', '5', 'histpol'])
++realm.addprinc('histprinc', 'first')
++realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc'])
++realm.run([kadminl, 'cpw', '-pw', 'second', 'histprinc'])
++realm.run([kadminl, 'cpw', '-pw', 'third', 'histprinc'])
++realm.run([kadminl, 'cpw', '-pw', 'fourth', 'histprinc'])
++realm.run([kadminl, 'modpol', '-history', '3', 'histpol'])
++realm.run([kadminl, 'cpw', '-pw', 'fifth', 'histprinc'])
++realm.run([kadminl, 'delprinc', 'histprinc'])
++
++# Regression test for #2841 (heap buffer overflow when policy history
++# value is reduced to match the number of historical passwords for a
++# principal).
++mark('password history (policy value reduced to current array size)')
++def histfail(*pwlist):
++    for pw in pwlist:
++        realm.run([kadminl, 'cpw', '-pw', pw, 'histprinc'], expected_code=1,
++                  expected_msg='Cannot reuse password')
++realm.run([kadminl, 'modpol', '-history', '3', 'histpol'])
++realm.addprinc('histprinc', '1111')
++realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc'])
++realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc'])
++histfail('2222', '1111')
++realm.run([kadminl, 'modpol', '-history', '2', 'histpol'])
++realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc'])
++
++# Test that the history array is properly resized if the policy
++# history value is increased after the array is filled.
++mark('password history (policy value increase)')
++realm.run([kadminl, 'delprinc', 'histprinc'])
++realm.addprinc('histprinc', '1111')
++realm.run([kadminl, 'modprinc', '-policy', 'histpol', 'histprinc'])
++realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc'])
++histfail('2222', '1111')
++realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc'], expected_code=1,
++          expected_msg='Cannot reuse password')
++realm.run([kadminl, 'cpw', '-pw', '1111', 'histprinc'], expected_code=1,
++          expected_msg='Cannot reuse password')
++realm.run([kadminl, 'modpol', '-history', '3', 'histpol'])
++realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc'])
++histfail('3333', '2222', '1111')
++realm.run([kadminl, 'modpol', '-history', '4', 'histpol'])
++histfail('3333', '2222', '1111')
++realm.run([kadminl, 'cpw', '-pw', '4444', 'histprinc'])
++histfail('4444', '3333', '2222', '1111')
++
++# Test that when the policy history value is reduced, all currently
++# known old passwords still fail until the next password change, after
++# which the new number of old passwords fails (but no more).
++mark('password history (policy value reduction)')
++realm.run([kadminl, 'modpol', '-history', '3', 'histpol'])
++histfail('4444', '3333', '2222', '1111')
++realm.run([kadminl, 'cpw', '-pw', '5555', 'histprinc'])
++histfail('5555', '3333', '3333')
++realm.run([kadminl, 'cpw', '-pw', '2222', 'histprinc'])
++realm.run([kadminl, 'modpol', '-history', '2', 'histpol'])
++histfail('2222', '5555', '4444')
++realm.run([kadminl, 'cpw', '-pw', '3333', 'histprinc'])
++
+ # Test references to nonexistent policies.
+ mark('nonexistent policy references')
+ realm.run([kadminl, 'addprinc', '-randkey', '-policy', 'newpol', 'newuser'])
diff --git a/krb5.spec b/krb5.spec
index b59f39c..25d282e 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}9%{?dist}
+Release: %{?zdpd}10%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -79,6 +79,10 @@ Patch13: Make-KCM-iteration-fallback-work-with-sssd-kcm.patch
 Patch14: Use-KCM_OP_RETRIEVE-in-KCM-client.patch
 Patch15: Fix-KCM-retrieval-support-for-sssd.patch
 Patch16: Fix-doc-build-for-Sphinx-4.0.patch
+Patch17: Move-some-dejagnu-kadmin-tests-to-Python-tests.patch
+Patch18: Fix-some-principal-realm-canonicalization-cases.patch
+Patch19: Allow-kinit-with-keytab-to-defer-canonicalization.patch
+Patch20: Fix-kadmin-k-with-fallback-or-referral-realm.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -641,6 +645,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Wed Jun 09 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-10
+- Fix three canonicalization cases for fallback
+
 * Wed Jun 02 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-9
 - Fix doc build for Sphinx 4.0
 

From 1806554414f0e2c21d64eb6aa31a7f06e952361f Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Mon, 21 Jun 2021 13:16:44 -0400
Subject: [PATCH 11/22] Add the backward-compatible parts of openssl3 support

---
 Fix-k5tls-module-for-OpenSSL-3.patch          |  57 ++
 ...pkcs11-build-issues-with-openssl-3.0.patch | 551 ++++++++++++++++++
 ...ecated-OpenSSL-calls-from-softpkcs11.patch | 149 +++++
 krb5.spec                                     |   8 +-
 4 files changed, 764 insertions(+), 1 deletion(-)
 create mode 100644 Fix-k5tls-module-for-OpenSSL-3.patch
 create mode 100644 Fix-softpkcs11-build-issues-with-openssl-3.0.patch
 create mode 100644 Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch

diff --git a/Fix-k5tls-module-for-OpenSSL-3.patch b/Fix-k5tls-module-for-OpenSSL-3.patch
new file mode 100644
index 0000000..fd425b8
--- /dev/null
+++ b/Fix-k5tls-module-for-OpenSSL-3.patch
@@ -0,0 +1,57 @@
+From 201e38845e9f70234bcaa9ba7c25b28e38169b0a Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Sat, 29 May 2021 12:05:49 -0400
+Subject: [PATCH] Fix k5tls module for OpenSSL 3
+
+Starting in OpenSSL 3, connection termination without a close_notify
+alert causes SSL_read() to return SSL_ERROR_SSL instead of
+SSL_ERROR_SYSCALL.  OpenSSL 3 also provides a new option
+SSL_OP_IGNORE_UNEXPECTED_EOF which allows an application to explicitly
+ignore possible truncation attacks and receive SSL_ERROR_ZERO_RETURN
+instead.
+
+Remove the call to SSL_CTX_get_options() since SSL_CTX_set_options()
+doesn't clear existing options.
+
+[ghudson@mit.edu: edited commit message and comment]
+
+(cherry picked from commit aa9b4a2a64046afd2fab7cb49c346295874a5fb6)
+---
+ src/plugins/tls/k5tls/openssl.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/src/plugins/tls/k5tls/openssl.c b/src/plugins/tls/k5tls/openssl.c
+index 76a43b3cd..99fda7ffc 100644
+--- a/src/plugins/tls/k5tls/openssl.c
++++ b/src/plugins/tls/k5tls/openssl.c
+@@ -433,7 +433,7 @@ setup(krb5_context context, SOCKET fd, const char *servername,
+       char **anchors, k5_tls_handle *handle_out)
+ {
+     int e;
+-    long options;
++    long options = SSL_OP_NO_SSLv2;
+     SSL_CTX *ctx = NULL;
+     SSL *ssl = NULL;
+     k5_tls_handle handle = NULL;
+@@ -448,8 +448,19 @@ setup(krb5_context context, SOCKET fd, const char *servername,
+     ctx = SSL_CTX_new(SSLv23_client_method());
+     if (ctx == NULL)
+         goto error;
+-    options = SSL_CTX_get_options(ctx);
+-    SSL_CTX_set_options(ctx, options | SSL_OP_NO_SSLv2);
++
++#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
++    /*
++     * For OpenSSL 3 and later, mark close_notify alerts as optional.  We don't
++     * need to worry about truncation attacks because the protocols this module
++     * is used with (Kerberos and change-password) receive a single
++     * length-delimited message from the server.  For prior versions of OpenSSL
++     * we check for SSL_ERROR_SYSCALL when reading instead (this error changes
++     * to SSL_ERROR_SSL in OpenSSL 3).
++     */
++    options |= SSL_OP_IGNORE_UNEXPECTED_EOF;
++#endif
++    SSL_CTX_set_options(ctx, options);
+ 
+     SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_callback);
+     X509_STORE_set_flags(SSL_CTX_get_cert_store(ctx), 0);
diff --git a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch
new file mode 100644
index 0000000..d7a0a5c
--- /dev/null
+++ b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch
@@ -0,0 +1,551 @@
+From a86b780ef275b35e8dc1e6d1886ec8e8d941f7c4 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Sat, 15 May 2021 17:35:25 -0400
+Subject: [PATCH] Fix softpkcs11 build issues with openssl 3.0
+
+EVP_PKEY_get0_RSA() has been modified to have const return type.  Remove
+its usages in favor of the EVP_PKEY interface.  Also remove calls to
+RSA_blinding_off(), which we don't need and would require a non-const
+object.  Similarly, remove RSA_set_method() calls that set a pre-existing
+default.
+
+Since softpkcs11 doesn't link against krb5 and can't use zap(), allocate
+buffers with OPENSSL_malloc() so can use OPENSSL_clear_free().
+
+Move several argument validation checks to the top of their functions.
+
+Fix some incorrect/inconsistent log messages.
+
+(cherry picked from commit 00de1aad7b3647b91017c7009b0bc65cd0c8b2e0)
+---
+ src/tests/softpkcs11/main.c | 360 ++++++++++++++----------------------
+ 1 file changed, 141 insertions(+), 219 deletions(-)
+
+diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c
+index 1cccdfb43..caa537b68 100644
+--- a/src/tests/softpkcs11/main.c
++++ b/src/tests/softpkcs11/main.c
+@@ -375,10 +375,9 @@ add_st_object(void)
+         return NULL;
+     soft_token.object.objs = objs;
+ 
+-    o = malloc(sizeof(*o));
++    o = calloc(1, sizeof(*o));
+     if (o == NULL)
+         return NULL;
+-    memset(o, 0, sizeof(*o));
+     o->attrs = NULL;
+     o->num_attributes = 0;
+     o->object_handle = soft_token.object.num_objs;
+@@ -424,7 +423,7 @@ add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key)
+         CK_ULONG modulus_bits = 0;
+         CK_BYTE *exponent = NULL;
+         size_t exponent_len = 0;
+-        RSA *rsa;
++        const RSA *rsa;
+         const BIGNUM *n, *e;
+ 
+         rsa = EVP_PKEY_get0_RSA(key);
+@@ -445,8 +444,6 @@ add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key)
+         add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT,
+                              exponent, exponent_len);
+ 
+-        RSA_set_method(rsa, RSA_PKCS1_OpenSSL());
+-
+         free(modulus);
+         free(exponent);
+     }
+@@ -679,10 +676,6 @@ add_certificate(char *label,
+         } else {
+             /* XXX verify keytype */
+ 
+-            if (key_type == CKK_RSA)
+-                RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key),
+-                               RSA_PKCS1_OpenSSL());
+-
+             if (X509_check_private_key(cert, o->u.private_key.key) != 1) {
+                 EVP_PKEY_free(o->u.private_key.key);
+                 o->u.private_key.key = NULL;
+@@ -695,7 +688,7 @@ add_certificate(char *label,
+     }
+ 
+     ret = CKR_OK;
+- out:
++out:
+     if (ret != CKR_OK) {
+         st_logf("something went wrong when adding cert!\n");
+ 
+@@ -1224,8 +1217,6 @@ C_Login(CK_SESSION_HANDLE hSession,
+         }
+ 
+         /* XXX check keytype */
+-        RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key),
+-                       RSA_PKCS1_OpenSSL());
+ 
+         if (X509_check_private_key(o->u.private_key.cert, o->u.private_key.key) != 1) {
+             EVP_PKEY_free(o->u.private_key.key);
+@@ -1495,8 +1486,9 @@ C_Encrypt(CK_SESSION_HANDLE hSession,
+     struct st_object *o;
+     void *buffer = NULL;
+     CK_RV ret;
+-    RSA *rsa;
+-    int padding, len, buffer_len, padding_len;
++    size_t buffer_len = 0;
++    int padding;
++    EVP_PKEY_CTX *ctx = NULL;
+ 
+     st_logf("Encrypt\n");
+ 
+@@ -1512,70 +1504,58 @@ C_Encrypt(CK_SESSION_HANDLE hSession,
+         return CKR_ARGUMENTS_BAD;
+     }
+ 
+-    rsa = EVP_PKEY_get0_RSA(o->u.public_key);
+-
+-    if (rsa == NULL)
+-        return CKR_ARGUMENTS_BAD;
+-
+-    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
+-
+-    buffer_len = RSA_size(rsa);
+-
+-    buffer = malloc(buffer_len);
+-    if (buffer == NULL) {
+-        ret = CKR_DEVICE_MEMORY;
+-        goto out;
+-    }
+-
+-    ret = CKR_OK;
+-    switch(state->encrypt_mechanism->mechanism) {
+-    case CKM_RSA_PKCS:
+-        padding = RSA_PKCS1_PADDING;
+-        padding_len = RSA_PKCS1_PADDING_SIZE;
+-        break;
+-    case CKM_RSA_X_509:
+-        padding = RSA_NO_PADDING;
+-        padding_len = 0;
+-        break;
+-    default:
+-        ret = CKR_FUNCTION_NOT_SUPPORTED;
+-        goto out;
+-    }
+-
+-    if ((CK_ULONG)buffer_len + padding_len < ulDataLen) {
+-        ret = CKR_ARGUMENTS_BAD;
+-        goto out;
+-    }
+-
+     if (pulEncryptedDataLen == NULL) {
+         st_logf("pulEncryptedDataLen NULL\n");
+         ret = CKR_ARGUMENTS_BAD;
+         goto out;
+     }
+ 
+-    if (pData == NULL_PTR) {
++    if (pData == NULL) {
+         st_logf("data NULL\n");
+         ret = CKR_ARGUMENTS_BAD;
+         goto out;
+     }
+ 
+-    len = RSA_public_encrypt(ulDataLen, pData, buffer, rsa, padding);
+-    if (len <= 0) {
++    switch(state->encrypt_mechanism->mechanism) {
++    case CKM_RSA_PKCS:
++        padding = RSA_PKCS1_PADDING;
++        break;
++    case CKM_RSA_X_509:
++        padding = RSA_NO_PADDING;
++        break;
++    default:
++        ret = CKR_FUNCTION_NOT_SUPPORTED;
++        goto out;
++    }
++
++    ctx = EVP_PKEY_CTX_new(o->u.public_key, NULL);
++    if (ctx == NULL || EVP_PKEY_encrypt_init(ctx) <= 0 ||
++        EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 ||
++        EVP_PKEY_encrypt(ctx, NULL, &buffer_len, pData, ulDataLen) <= 0) {
+         ret = CKR_DEVICE_ERROR;
+         goto out;
+     }
+-    if (len > buffer_len)
+-        abort();
+ 
+-    if (pEncryptedData != NULL_PTR)
+-        memcpy(pEncryptedData, buffer, len);
+-    *pulEncryptedDataLen = len;
+-
+- out:
+-    if (buffer) {
+-        memset(buffer, 0, buffer_len);
+-        free(buffer);
++    buffer = OPENSSL_malloc(buffer_len);
++    if (buffer == NULL) {
++        ret = CKR_DEVICE_MEMORY;
++        goto out;
+     }
++
++    if (EVP_PKEY_encrypt(ctx, buffer, &buffer_len, pData, ulDataLen) <= 0) {
++        ret = CKR_DEVICE_ERROR;
++        goto out;
++    }
++    st_logf("Encrypt done\n");
++
++    if (pEncryptedData != NULL)
++        memcpy(pEncryptedData, buffer, buffer_len);
++    *pulEncryptedDataLen = buffer_len;
++
++    ret = CKR_OK;
++out:
++    OPENSSL_clear_free(buffer, buffer_len);
++    EVP_PKEY_CTX_free(ctx);
+     return ret;
+ }
+ 
+@@ -1646,8 +1626,9 @@ C_Decrypt(CK_SESSION_HANDLE hSession,
+     struct st_object *o;
+     void *buffer = NULL;
+     CK_RV ret;
+-    RSA *rsa;
+-    int padding, len, buffer_len, padding_len;
++    size_t buffer_len = 0;
++    int padding;
++    EVP_PKEY_CTX *ctx = NULL;
+ 
+     st_logf("Decrypt\n");
+ 
+@@ -1663,41 +1644,6 @@ C_Decrypt(CK_SESSION_HANDLE hSession,
+         return CKR_ARGUMENTS_BAD;
+     }
+ 
+-    rsa = EVP_PKEY_get0_RSA(o->u.private_key.key);
+-
+-    if (rsa == NULL)
+-        return CKR_ARGUMENTS_BAD;
+-
+-    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
+-
+-    buffer_len = RSA_size(rsa);
+-
+-    buffer = malloc(buffer_len);
+-    if (buffer == NULL) {
+-        ret = CKR_DEVICE_MEMORY;
+-        goto out;
+-    }
+-
+-    ret = CKR_OK;
+-    switch(state->decrypt_mechanism->mechanism) {
+-    case CKM_RSA_PKCS:
+-        padding = RSA_PKCS1_PADDING;
+-        padding_len = RSA_PKCS1_PADDING_SIZE;
+-        break;
+-    case CKM_RSA_X_509:
+-        padding = RSA_NO_PADDING;
+-        padding_len = 0;
+-        break;
+-    default:
+-        ret = CKR_FUNCTION_NOT_SUPPORTED;
+-        goto out;
+-    }
+-
+-    if ((CK_ULONG)buffer_len + padding_len < ulEncryptedDataLen) {
+-        ret = CKR_ARGUMENTS_BAD;
+-        goto out;
+-    }
+-
+     if (pulDataLen == NULL) {
+         st_logf("pulDataLen NULL\n");
+         ret = CKR_ARGUMENTS_BAD;
+@@ -1710,24 +1656,48 @@ C_Decrypt(CK_SESSION_HANDLE hSession,
+         goto out;
+     }
+ 
+-    len = RSA_private_decrypt(ulEncryptedDataLen, pEncryptedData, buffer,
+-                              rsa, padding);
+-    if (len <= 0) {
++    switch(state->decrypt_mechanism->mechanism) {
++    case CKM_RSA_PKCS:
++        padding = RSA_PKCS1_PADDING;
++        break;
++    case CKM_RSA_X_509:
++        padding = RSA_NO_PADDING;
++        break;
++    default:
++        ret = CKR_FUNCTION_NOT_SUPPORTED;
++        goto out;
++    }
++
++    ctx = EVP_PKEY_CTX_new(o->u.private_key.key, NULL);
++    if (ctx == NULL || EVP_PKEY_decrypt_init(ctx) <= 0 ||
++        EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 ||
++        EVP_PKEY_decrypt(ctx, NULL, &buffer_len, pEncryptedData,
++                         ulEncryptedDataLen) <= 0) {
+         ret = CKR_DEVICE_ERROR;
+         goto out;
+     }
+-    if (len > buffer_len)
+-        abort();
++
++    buffer = OPENSSL_malloc(buffer_len);
++    if (buffer == NULL) {
++        ret = CKR_DEVICE_MEMORY;
++        goto out;
++    }
++
++    if (EVP_PKEY_decrypt(ctx, buffer, &buffer_len, pEncryptedData,
++                         ulEncryptedDataLen) <= 0) {
++        ret = CKR_DEVICE_ERROR;
++        goto out;
++    }
++    st_logf("Decrypt done\n");
+ 
+     if (pData != NULL_PTR)
+-        memcpy(pData, buffer, len);
+-    *pulDataLen = len;
++        memcpy(pData, buffer, buffer_len);
++    *pulDataLen = buffer_len;
+ 
+- out:
+-    if (buffer) {
+-        memset(buffer, 0, buffer_len);
+-        free(buffer);
+-    }
++    ret = CKR_OK;
++out:
++    OPENSSL_clear_free(buffer, buffer_len);
++    EVP_PKEY_CTX_free(ctx);
+     return ret;
+ }
+ 
+@@ -1806,8 +1776,9 @@ C_Sign(CK_SESSION_HANDLE hSession,
+     struct st_object *o;
+     void *buffer = NULL;
+     CK_RV ret;
+-    RSA *rsa;
+-    int padding, len, buffer_len, padding_len;
++    int padding;
++    size_t buffer_len = 0;
++    EVP_PKEY_CTX *ctx = NULL;
+ 
+     st_logf("Sign\n");
+     VERIFY_SESSION_HANDLE(hSession, &state);
+@@ -1822,40 +1793,6 @@ C_Sign(CK_SESSION_HANDLE hSession,
+         return CKR_ARGUMENTS_BAD;
+     }
+ 
+-    rsa = EVP_PKEY_get0_RSA(o->u.private_key.key);
+-
+-    if (rsa == NULL)
+-        return CKR_ARGUMENTS_BAD;
+-
+-    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
+-
+-    buffer_len = RSA_size(rsa);
+-
+-    buffer = malloc(buffer_len);
+-    if (buffer == NULL) {
+-        ret = CKR_DEVICE_MEMORY;
+-        goto out;
+-    }
+-
+-    switch(state->sign_mechanism->mechanism) {
+-    case CKM_RSA_PKCS:
+-        padding = RSA_PKCS1_PADDING;
+-        padding_len = RSA_PKCS1_PADDING_SIZE;
+-        break;
+-    case CKM_RSA_X_509:
+-        padding = RSA_NO_PADDING;
+-        padding_len = 0;
+-        break;
+-    default:
+-        ret = CKR_FUNCTION_NOT_SUPPORTED;
+-        goto out;
+-    }
+-
+-    if ((CK_ULONG)buffer_len < ulDataLen + padding_len) {
+-        ret = CKR_ARGUMENTS_BAD;
+-        goto out;
+-    }
+-
+     if (pulSignatureLen == NULL) {
+         st_logf("signature len NULL\n");
+         ret = CKR_ARGUMENTS_BAD;
+@@ -1868,26 +1805,46 @@ C_Sign(CK_SESSION_HANDLE hSession,
+         goto out;
+     }
+ 
+-    len = RSA_private_encrypt(ulDataLen, pData, buffer, rsa, padding);
+-    st_logf("private encrypt done\n");
+-    if (len <= 0) {
++    switch(state->sign_mechanism->mechanism) {
++    case CKM_RSA_PKCS:
++        padding = RSA_PKCS1_PADDING;
++        break;
++    case CKM_RSA_X_509:
++        padding = RSA_NO_PADDING;
++        break;
++    default:
++        ret = CKR_FUNCTION_NOT_SUPPORTED;
++        goto out;
++    }
++
++    ctx = EVP_PKEY_CTX_new(o->u.private_key.key, NULL);
++    if (ctx == NULL || EVP_PKEY_sign_init(ctx) <= 0 ||
++        EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 ||
++        EVP_PKEY_sign(ctx, NULL, &buffer_len, pData, ulDataLen) <= 0) {
+         ret = CKR_DEVICE_ERROR;
+         goto out;
+     }
+-    if (len > buffer_len)
+-        abort();
+ 
+-    if (pSignature != NULL_PTR)
+-        memcpy(pSignature, buffer, len);
+-    *pulSignatureLen = len;
++    buffer = OPENSSL_malloc(buffer_len);
++    if (buffer == NULL) {
++        ret = CKR_DEVICE_MEMORY;
++        goto out;
++    }
++
++    if (EVP_PKEY_sign(ctx, buffer, &buffer_len, pData, ulDataLen) <= 0) {
++        ret = CKR_DEVICE_ERROR;
++        goto out;
++    }
++    st_logf("Sign done\n");
++
++    if (pSignature != NULL)
++        memcpy(pSignature, buffer, buffer_len);
++    *pulSignatureLen = buffer_len;
+ 
+     ret = CKR_OK;
+-
+- out:
+-    if (buffer) {
+-        memset(buffer, 0, buffer_len);
+-        free(buffer);
+-    }
++out:
++    OPENSSL_clear_free(buffer, buffer_len);
++    EVP_PKEY_CTX_free(ctx);
+     return ret;
+ }
+ 
+@@ -1951,10 +1908,9 @@ C_Verify(CK_SESSION_HANDLE hSession,
+ {
+     struct session_state *state;
+     struct st_object *o;
+-    void *buffer = NULL;
+     CK_RV ret;
+-    RSA *rsa;
+-    int padding, len, buffer_len;
++    int padding;
++    EVP_PKEY_CTX *ctx = NULL;
+ 
+     st_logf("Verify\n");
+     VERIFY_SESSION_HANDLE(hSession, &state);
+@@ -1969,39 +1925,6 @@ C_Verify(CK_SESSION_HANDLE hSession,
+         return CKR_ARGUMENTS_BAD;
+     }
+ 
+-    rsa = EVP_PKEY_get0_RSA(o->u.public_key);
+-
+-    if (rsa == NULL)
+-        return CKR_ARGUMENTS_BAD;
+-
+-    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
+-
+-    buffer_len = RSA_size(rsa);
+-
+-    buffer = malloc(buffer_len);
+-    if (buffer == NULL) {
+-        ret = CKR_DEVICE_MEMORY;
+-        goto out;
+-    }
+-
+-    ret = CKR_OK;
+-    switch(state->verify_mechanism->mechanism) {
+-    case CKM_RSA_PKCS:
+-        padding = RSA_PKCS1_PADDING;
+-        break;
+-    case CKM_RSA_X_509:
+-        padding = RSA_NO_PADDING;
+-        break;
+-    default:
+-        ret = CKR_FUNCTION_NOT_SUPPORTED;
+-        goto out;
+-    }
+-
+-    if ((CK_ULONG)buffer_len < ulDataLen) {
+-        ret = CKR_ARGUMENTS_BAD;
+-        goto out;
+-    }
+-
+     if (pSignature == NULL) {
+         st_logf("signature NULL\n");
+         ret = CKR_ARGUMENTS_BAD;
+@@ -2014,34 +1937,34 @@ C_Verify(CK_SESSION_HANDLE hSession,
+         goto out;
+     }
+ 
+-    len = RSA_public_decrypt(ulDataLen, pData, buffer, rsa, padding);
+-    st_logf("private encrypt done\n");
+-    if (len <= 0) {
++    switch(state->verify_mechanism->mechanism) {
++    case CKM_RSA_PKCS:
++        padding = RSA_PKCS1_PADDING;
++        break;
++    case CKM_RSA_X_509:
++        padding = RSA_NO_PADDING;
++        break;
++    default:
++        ret = CKR_FUNCTION_NOT_SUPPORTED;
++        goto out;
++    }
++
++    ctx = EVP_PKEY_CTX_new(o->u.public_key, NULL);
++    if (ctx == NULL || EVP_PKEY_verify_init(ctx) <= 0 ||
++        EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 ||
++        EVP_PKEY_verify(ctx, pSignature, ulSignatureLen, pData,
++                        ulDataLen) <= 0) {
+         ret = CKR_DEVICE_ERROR;
+         goto out;
+     }
+-    if (len > buffer_len)
+-        abort();
++    st_logf("Verify done\n");
+ 
+-    if ((CK_ULONG)len != ulSignatureLen) {
+-        ret = CKR_GENERAL_ERROR;
+-        goto out;
+-    }
+-
+-    if (memcmp(pSignature, buffer, len) != 0) {
+-        ret = CKR_GENERAL_ERROR;
+-        goto out;
+-    }
+-
+- out:
+-    if (buffer) {
+-        memset(buffer, 0, buffer_len);
+-        free(buffer);
+-    }
++    ret = CKR_OK;
++out:
++    EVP_PKEY_CTX_free(ctx);
+     return ret;
+ }
+ 
+-
+ CK_RV
+ C_VerifyUpdate(CK_SESSION_HANDLE hSession,
+                CK_BYTE_PTR pPart,
+@@ -2072,7 +1995,6 @@ C_GenerateRandom(CK_SESSION_HANDLE hSession,
+     return CKR_FUNCTION_NOT_SUPPORTED;
+ }
+ 
+-
+ CK_FUNCTION_LIST funcs = {
+     { 2, 11 },
+     C_Initialize,
diff --git a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch
new file mode 100644
index 0000000..23f21a5
--- /dev/null
+++ b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch
@@ -0,0 +1,149 @@
+From 5072bfdfaddae762680d0f9d97afa6dbf8274760 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Sat, 15 May 2021 18:04:58 -0400
+Subject: [PATCH] Remove deprecated OpenSSL calls from softpkcs11
+
+Rewrite add_pubkey_info() in terms of the EVP_PKEY interface.  In this
+process, fix its unchecked allocations and fail fast for non-RSA keys.
+
+(cherry picked from commit d6bf42279675100e3e4fe7c6e08eef74d49624cb)
+---
+ src/configure.ac            |   1 +
+ src/tests/softpkcs11/main.c | 106 ++++++++++++++++++++++++------------
+ 2 files changed, 72 insertions(+), 35 deletions(-)
+
+diff --git a/src/configure.ac b/src/configure.ac
+index ea708491b..477819091 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -1118,6 +1118,7 @@ int i = 1;
+ ])], k5_cv_openssl_version_okay=yes, k5_cv_openssl_version_okay=no)])
+   old_LIBS="$LIBS"
+   AC_CHECK_LIB(crypto, PKCS7_get_signer_info)
++  AC_CHECK_FUNCS(EVP_PKEY_get_bn_param)
+   LIBS="$old_LIBS"
+ fi
+ if test "$k5_cv_openssl_version_okay" = yes && (test "$enable_pkinit" = yes || test "$enable_pkinit" = try); then
+diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c
+index caa537b68..86b4ef711 100644
+--- a/src/tests/softpkcs11/main.c
++++ b/src/tests/softpkcs11/main.c
+@@ -413,47 +413,83 @@ add_object_attribute(struct st_object *o,
+     return CKR_OK;
+ }
+ 
++#ifdef HAVE_EVP_PKEY_GET_BN_PARAM
++
++/* Declare owner pointers since EVP_PKEY_get_bn_param() gives us copies. */
++#define DECLARE_BIGNUM(name) BIGNUM *name = NULL
++#define RELEASE_BIGNUM(bn) BN_clear_free(bn)
+ static CK_RV
+-add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key)
++get_bignums(EVP_PKEY *key, BIGNUM **n, BIGNUM **e)
+ {
+-    switch (key_type) {
+-    case CKK_RSA: {
+-        CK_BYTE *modulus = NULL;
+-        size_t modulus_len = 0;
+-        CK_ULONG modulus_bits = 0;
+-        CK_BYTE *exponent = NULL;
+-        size_t exponent_len = 0;
+-        const RSA *rsa;
+-        const BIGNUM *n, *e;
++    if (EVP_PKEY_get_bn_param(key, "n", n) == 0 ||
++        EVP_PKEY_get_bn_param(key, "e", e) == 0)
++        return CKR_DEVICE_ERROR;
+ 
+-        rsa = EVP_PKEY_get0_RSA(key);
+-        RSA_get0_key(rsa, &n, &e, NULL);
+-        modulus_bits = BN_num_bits(n);
+-
+-        modulus_len = BN_num_bytes(n);
+-        modulus = malloc(modulus_len);
+-        BN_bn2bin(n, modulus);
+-
+-        exponent_len = BN_num_bytes(e);
+-        exponent = malloc(exponent_len);
+-        BN_bn2bin(e, exponent);
+-
+-        add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len);
+-        add_object_attribute(o, 0, CKA_MODULUS_BITS,
+-                             &modulus_bits, sizeof(modulus_bits));
+-        add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT,
+-                             exponent, exponent_len);
+-
+-        free(modulus);
+-        free(exponent);
+-    }
+-    default:
+-        /* XXX */
+-        break;
+-    }
+     return CKR_OK;
+ }
+ 
++#else
++
++/* Declare const pointers since the old API gives us aliases. */
++#define DECLARE_BIGNUM(name) const BIGNUM *name
++#define RELEASE_BIGNUM(bn)
++static CK_RV
++get_bignums(EVP_PKEY *key, const BIGNUM **n, const BIGNUM **e)
++{
++    const RSA *rsa;
++
++    rsa = EVP_PKEY_get0_RSA(key);
++    RSA_get0_key(rsa, n, e, NULL);
++
++    return CKR_OK;
++}
++
++#endif
++
++static CK_RV
++add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key)
++{
++    CK_BYTE *modulus = NULL, *exponent = 0;
++    size_t modulus_len = 0, exponent_len = 0;
++    CK_ULONG modulus_bits = 0;
++    CK_RV ret;
++    DECLARE_BIGNUM(n);
++    DECLARE_BIGNUM(e);
++
++    if (key_type != CKK_RSA)
++        abort();
++
++    ret = get_bignums(key, &n, &e);
++    if (ret != CKR_OK)
++        goto done;
++
++    modulus_bits = BN_num_bits(n);
++    modulus_len = BN_num_bytes(n);
++    exponent_len = BN_num_bytes(e);
++
++    modulus = malloc(modulus_len);
++    exponent = malloc(exponent_len);
++    if (modulus == NULL || exponent == NULL) {
++        ret = CKR_DEVICE_MEMORY;
++        goto done;
++    }
++
++    BN_bn2bin(n, modulus);
++    BN_bn2bin(e, exponent);
++
++    add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len);
++    add_object_attribute(o, 0, CKA_MODULUS_BITS, &modulus_bits,
++                         sizeof(modulus_bits));
++    add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT, exponent, exponent_len);
++
++    ret = CKR_OK;
++done:
++    free(modulus);
++    free(exponent);
++    RELEASE_BIGNUM(n);
++    RELEASE_BIGNUM(e);
++    return ret;
++}
+ 
+ static int
+ pem_callback(char *buf, int num, int w, void *key)
diff --git a/krb5.spec b/krb5.spec
index 25d282e..6d2a5cb 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}10%{?dist}
+Release: %{?zdpd}11%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -83,6 +83,9 @@ Patch17: Move-some-dejagnu-kadmin-tests-to-Python-tests.patch
 Patch18: Fix-some-principal-realm-canonicalization-cases.patch
 Patch19: Allow-kinit-with-keytab-to-defer-canonicalization.patch
 Patch20: Fix-kadmin-k-with-fallback-or-referral-realm.patch
+Patch21: Fix-softpkcs11-build-issues-with-openssl-3.0.patch
+Patch22: Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch
+Patch23: Fix-k5tls-module-for-OpenSSL-3.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -645,6 +648,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Mon Jun 21 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-11
+- Add the backward-compatible parts of openssl3 support
+
 * Wed Jun 09 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-10
 - Fix three canonicalization cases for fallback
 

From 9450abbfbce5ef124d006864648cdb4ccebc08de Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Mon, 28 Jun 2021 17:50:46 -0400
Subject: [PATCH 12/22] MEMORY locking fix and static analysis pullup

---
 ...context-after-failed-open-in-libkdb5.patch |  35 +
 ...aks-on-error-in-kadm5-init-functions.patch | 664 ++++++++++++++++++
 Use-asan-in-one-of-the-CI-builds.patch        |  22 +
 ...king-in-MEMORY-krb5_cc_get_principal.patch |  47 ++
 krb5.spec                                     |   9 +-
 5 files changed, 776 insertions(+), 1 deletion(-)
 create mode 100644 Clean-up-context-after-failed-open-in-libkdb5.patch
 create mode 100644 Fix-leaks-on-error-in-kadm5-init-functions.patch
 create mode 100644 Use-asan-in-one-of-the-CI-builds.patch
 create mode 100644 Using-locking-in-MEMORY-krb5_cc_get_principal.patch

diff --git a/Clean-up-context-after-failed-open-in-libkdb5.patch b/Clean-up-context-after-failed-open-in-libkdb5.patch
new file mode 100644
index 0000000..a892a14
--- /dev/null
+++ b/Clean-up-context-after-failed-open-in-libkdb5.patch
@@ -0,0 +1,35 @@
+From 78c03a9b5ef3e3f894bea11c89e575b9bb4d1b0f Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Wed, 23 Jun 2021 16:57:39 -0400
+Subject: [PATCH] Clean up context after failed open in libkdb5
+
+If krb5_db_open() or krb5_db_create() fails, release the dal_handle,
+as the caller is unlikely to call krb5_db_close() after a failure.
+
+(cherry picked from commit 849b7056e703bd3724d909263769ce190db59acc)
+---
+ src/lib/kdb/kdb5.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c
+index 47e9b31a7..11e2430c4 100644
+--- a/src/lib/kdb/kdb5.c
++++ b/src/lib/kdb/kdb5.c
+@@ -675,6 +675,8 @@ krb5_db_open(krb5_context kcontext, char **db_args, int mode)
+         return status;
+     status = v->init_module(kcontext, section, db_args, mode);
+     free(section);
++    if (status)
++        (void)krb5_db_fini(kcontext);
+     return status;
+ }
+ 
+@@ -702,6 +704,8 @@ krb5_db_create(krb5_context kcontext, char **db_args)
+         return status;
+     status = v->create(kcontext, section, db_args);
+     free(section);
++    if (status)
++        (void)krb5_db_fini(kcontext);
+     return status;
+ }
+ 
diff --git a/Fix-leaks-on-error-in-kadm5-init-functions.patch b/Fix-leaks-on-error-in-kadm5-init-functions.patch
new file mode 100644
index 0000000..ef12052
--- /dev/null
+++ b/Fix-leaks-on-error-in-kadm5-init-functions.patch
@@ -0,0 +1,664 @@
+From 6b2f7995ab23cffcababe537d57540236f99f0e3 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Wed, 23 Jun 2021 16:53:16 -0400
+Subject: [PATCH] Fix leaks on error in kadm5 init functions
+
+In the GENERIC_CHECK_HANDLE function, separate out the
+version-checking logic so we can call it in the init functions before
+allocating resources.
+
+In the client and server library initialization functions, use a
+single exit path after argument validation, and share the destruction
+code with kadm5_destroy() via a helper.
+
+(cherry picked from commit 552d7b7626450f963b8e37345c472420c842402c)
+---
+ src/lib/kadm5/admin_internal.h   |  39 ++++---
+ src/lib/kadm5/clnt/client_init.c | 174 +++++++++++-----------------
+ src/lib/kadm5/srv/server_init.c  | 191 ++++++++++---------------------
+ 3 files changed, 145 insertions(+), 259 deletions(-)
+
+diff --git a/src/lib/kadm5/admin_internal.h b/src/lib/kadm5/admin_internal.h
+index faf8e9c36..9be53883a 100644
+--- a/src/lib/kadm5/admin_internal.h
++++ b/src/lib/kadm5/admin_internal.h
+@@ -11,29 +11,32 @@
+ 
+ #define KADM5_SERVER_HANDLE_MAGIC       0x12345800
+ 
+-#define GENERIC_CHECK_HANDLE(handle, old_api_version, new_api_version)  \
++#define CHECK_VERSIONS(struct_version, api_version, old_api_err, new_api_err) \
+     {                                                                   \
+-        kadm5_server_handle_t srvr =                                    \
+-            (kadm5_server_handle_t) handle;                             \
+-                                                                        \
+-        if (! srvr)                                                     \
+-            return KADM5_BAD_SERVER_HANDLE;                             \
+-        if (srvr->magic_number != KADM5_SERVER_HANDLE_MAGIC)            \
+-            return KADM5_BAD_SERVER_HANDLE;                             \
+-        if ((srvr->struct_version & KADM5_MASK_BITS) !=                 \
+-            KADM5_STRUCT_VERSION_MASK)                                  \
++        if ((struct_version & KADM5_MASK_BITS) != KADM5_STRUCT_VERSION_MASK) \
+             return KADM5_BAD_STRUCT_VERSION;                            \
+-        if (srvr->struct_version < KADM5_STRUCT_VERSION_1)              \
++        if (struct_version < KADM5_STRUCT_VERSION_1)                    \
+             return KADM5_OLD_STRUCT_VERSION;                            \
+-        if (srvr->struct_version > KADM5_STRUCT_VERSION_1)              \
++        if (struct_version > KADM5_STRUCT_VERSION_1)                    \
+             return KADM5_NEW_STRUCT_VERSION;                            \
+-        if ((srvr->api_version & KADM5_MASK_BITS) !=                    \
+-            KADM5_API_VERSION_MASK)                                     \
++        if ((api_version & KADM5_MASK_BITS) != KADM5_API_VERSION_MASK)  \
+             return KADM5_BAD_API_VERSION;                               \
+-        if (srvr->api_version < KADM5_API_VERSION_2)                    \
+-            return old_api_version;                                     \
+-        if (srvr->api_version > KADM5_API_VERSION_4)                    \
+-            return new_api_version;                                     \
++        if (api_version < KADM5_API_VERSION_2)                          \
++            return old_api_err;                                         \
++        if (api_version > KADM5_API_VERSION_4)                          \
++            return new_api_err;                                         \
++    }
++
++#define GENERIC_CHECK_HANDLE(handle, old_api_err, new_api_err)  \
++    {                                                           \
++        kadm5_server_handle_t srvr = handle;                    \
++                                                                \
++        if (srvr == NULL)                                       \
++            return KADM5_BAD_SERVER_HANDLE;                     \
++        if (srvr->magic_number != KADM5_SERVER_HANDLE_MAGIC)    \
++            return KADM5_BAD_SERVER_HANDLE;                     \
++        CHECK_VERSIONS(srvr->struct_version, srvr->api_version, \
++                       old_api_err, new_api_err);               \
+     }
+ 
+ /*
+diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c
+index 0aaca701f..75614bb19 100644
+--- a/src/lib/kadm5/clnt/client_init.c
++++ b/src/lib/kadm5/clnt/client_init.c
+@@ -138,6 +138,36 @@ kadm5_init_with_skey(krb5_context context, char *client_name,
+                     server_handle);
+ }
+ 
++static kadm5_ret_t
++free_handle(kadm5_server_handle_t handle)
++{
++    kadm5_ret_t ret = 0;
++    OM_uint32 minor_stat;
++    krb5_ccache ccache;
++
++    if (handle == NULL)
++        return 0;
++
++    if (handle->destroy_cache && handle->cache_name != NULL) {
++        ret = krb5_cc_resolve(handle->context, handle->cache_name, &ccache);
++        if (!ret)
++            ret = krb5_cc_destroy(handle->context, ccache);
++    }
++    free(handle->cache_name);
++    (void)gss_release_cred(&minor_stat, &handle->cred);
++    if (handle->clnt != NULL && handle->clnt->cl_auth != NULL)
++        AUTH_DESTROY(handle->clnt->cl_auth);
++    if (handle->clnt != NULL)
++        clnt_destroy(handle->clnt);
++    if (handle->client_socket != -1)
++        close(handle->client_socket);
++    free(handle->lhandle);
++    kadm5_free_config_params(handle->context, &handle->params);
++    free(handle);
++
++    return ret;
++}
++
+ static kadm5_ret_t
+ init_any(krb5_context context, char *client_name, enum init_type init_type,
+          char *pass, krb5_ccache ccache_in, char *service_name,
+@@ -145,36 +175,34 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+          krb5_ui_4 api_version, char **db_args, void **server_handle)
+ {
+     int fd = -1;
+-    OM_uint32 minor_stat;
+     krb5_boolean iprop_enable;
+     int port;
+     rpcprog_t rpc_prog;
+     rpcvers_t rpc_vers;
+-    krb5_ccache ccache;
+     krb5_principal client = NULL, server = NULL;
+     struct timeval timeout;
+ 
+-    kadm5_server_handle_t handle;
++    kadm5_server_handle_t handle = NULL;
+     kadm5_config_params params_local;
+ 
+-    int code = 0;
++    krb5_error_code code;
+     generic_ret r = { 0, 0 };
+ 
+     initialize_ovk_error_table();
+     initialize_ovku_error_table();
+ 
+-    if (! server_handle) {
++    if (server_handle == NULL || client_name == NULL)
+         return EINVAL;
+-    }
+ 
+-    if (! (handle = malloc(sizeof(*handle)))) {
+-        return ENOMEM;
+-    }
+-    memset(handle, 0, sizeof(*handle));
+-    if (! (handle->lhandle = malloc(sizeof(*handle)))) {
+-        free(handle);
+-        return ENOMEM;
+-    }
++    CHECK_VERSIONS(struct_version, api_version, KADM5_OLD_LIB_API_VERSION,
++                   KADM5_NEW_LIB_API_VERSION);
++
++    handle = k5alloc(sizeof(*handle), &code);
++    if (handle == NULL)
++        goto cleanup;
++    handle->lhandle = k5alloc(sizeof(*handle), &code);
++    if (handle->lhandle == NULL)
++        goto cleanup;
+ 
+     handle->magic_number = KADM5_SERVER_HANDLE_MAGIC;
+     handle->struct_version = struct_version;
+@@ -192,33 +220,20 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+ 
+     handle->context = context;
+ 
+-    if(client_name == NULL) {
+-        free(handle);
+-        return EINVAL;
+-    }
+-
+-    /*
+-     * Verify the version numbers before proceeding; we can't use
+-     * CHECK_HANDLE because not all fields are set yet.
+-     */
+-    GENERIC_CHECK_HANDLE(handle, KADM5_OLD_LIB_API_VERSION,
+-                         KADM5_NEW_LIB_API_VERSION);
+-
+     memset(&params_local, 0, sizeof(params_local));
+ 
+-    if ((code = kadm5_get_config_params(handle->context, 0,
+-                                        params_in, &handle->params))) {
+-        free(handle);
+-        return(code);
+-    }
++    code = kadm5_get_config_params(handle->context, 0, params_in,
++                                   &handle->params);
++    if (code)
++        goto cleanup;
+ 
+ #define REQUIRED_PARAMS (KADM5_CONFIG_REALM |           \
+                          KADM5_CONFIG_ADMIN_SERVER |    \
+                          KADM5_CONFIG_KADMIND_PORT)
+ 
+     if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) {
+-        free(handle);
+-        return KADM5_MISSING_KRB5_CONF_PARAMS;
++        code = KADM5_MISSING_KRB5_CONF_PARAMS;
++        goto cleanup;
+     }
+ 
+     /*
+@@ -228,7 +243,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+      */
+     code = krb5_parse_name(handle->context, client_name, &client);
+     if (code)
+-        goto error;
++        goto cleanup;
+     if (init_type == INIT_SKEY && client->realm.length == 0)
+         client->type = KRB5_NT_SRV_HST;
+ 
+@@ -239,7 +254,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+     code = get_init_creds(handle, client, init_type, pass, ccache_in,
+                           service_name, handle->params.realm, &server);
+     if (code)
+-        goto error;
++        goto cleanup;
+ 
+     /* If the service_name and client_name are iprop-centric, use the iprop
+      * port and RPC identifiers. */
+@@ -258,7 +273,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+ 
+     code = connect_to_server(handle->params.admin_server, port, &fd);
+     if (code)
+-        goto error;
++        goto cleanup;
+ 
+     handle->clnt = clnttcp_create(NULL, rpc_prog, rpc_vers, &fd, 0, 0);
+     if (handle->clnt == NULL) {
+@@ -266,7 +281,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+ #ifdef DEBUG
+         clnt_pcreateerror("clnttcp_create");
+ #endif
+-        goto error;
++        goto cleanup;
+     }
+ 
+     /* Set a one-hour timeout. */
+@@ -278,10 +293,6 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+     handle->lhandle->clnt = handle->clnt;
+     handle->lhandle->client_socket = fd;
+ 
+-    /* now that handle->clnt is set, we can check the handle */
+-    if ((code = _kadm5_check_handle((void *) handle)))
+-        goto error;
+-
+     /*
+      * The RPC connection is open; establish the GSS-API
+      * authentication context.
+@@ -289,7 +300,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+     code = setup_gss(handle, params_in,
+                      (init_type == INIT_CREDS) ? client : NULL, server);
+     if (code)
+-        goto error;
++        goto cleanup;
+ 
+     /*
+      * Bypass the remainder of the code and return straight away
+@@ -297,7 +308,8 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+      */
+     if (iprop_enable) {
+         code = 0;
+-        *server_handle = (void *) handle;
++        *server_handle = handle;
++        handle = NULL;
+         goto cleanup;
+     }
+ 
+@@ -306,7 +318,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+ #ifdef DEBUG
+         clnt_perror(handle->clnt, "init_2 null resp");
+ #endif
+-        goto error;
++        goto cleanup;
+     }
+     /* Drop down to v3 wire protocol if server does not support v4 */
+     if (r.code == KADM5_NEW_SERVER_API_VERSION &&
+@@ -315,7 +327,7 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+         memset(&r, 0, sizeof(generic_ret));
+         if (init_2(&handle->api_version, &r, handle->clnt)) {
+             code = KADM5_RPC_ERROR;
+-            goto error;
++            goto cleanup;
+         }
+     }
+     /* Drop down to v2 wire protocol if server does not support v3 */
+@@ -325,47 +337,21 @@ init_any(krb5_context context, char *client_name, enum init_type init_type,
+         memset(&r, 0, sizeof(generic_ret));
+         if (init_2(&handle->api_version, &r, handle->clnt)) {
+             code = KADM5_RPC_ERROR;
+-            goto error;
++            goto cleanup;
+         }
+     }
+     if (r.code) {
+         code = r.code;
+-        goto error;
++        goto cleanup;
+     }
+ 
+-    *server_handle = (void *) handle;
+-
+-    goto cleanup;
+-
+-error:
+-    /*
+-     * Note that it is illegal for this code to execute if "handle"
+-     * has not been allocated and initialized.  I.e., don't use "goto
+-     * error" before the block of code at the top of the function
+-     * that allocates and initializes "handle".
+-     */
+-    if (handle->destroy_cache && handle->cache_name) {
+-        if (krb5_cc_resolve(handle->context,
+-                            handle->cache_name, &ccache) == 0)
+-            (void) krb5_cc_destroy (handle->context, ccache);
+-    }
+-    if (handle->cache_name)
+-        free(handle->cache_name);
+-    (void)gss_release_cred(&minor_stat, &handle->cred);
+-    if(handle->clnt && handle->clnt->cl_auth)
+-        AUTH_DESTROY(handle->clnt->cl_auth);
+-    if(handle->clnt)
+-        clnt_destroy(handle->clnt);
+-    if (fd != -1)
+-        close(fd);
+-    free(handle->lhandle);
+-    kadm5_free_config_params(handle->context, &handle->params);
++    *server_handle = handle;
++    handle = NULL;
+ 
+ cleanup:
+-    krb5_free_principal(handle->context, client);
+-    krb5_free_principal(handle->context, server);
+-    if (code)
+-        free(handle);
++    krb5_free_principal(context, client);
++    krb5_free_principal(context, server);
++    (void)free_handle(handle);
+ 
+     return code;
+ }
+@@ -695,38 +681,8 @@ rpc_auth(kadm5_server_handle_t handle, kadm5_config_params *params_in,
+ kadm5_ret_t
+ kadm5_destroy(void *server_handle)
+ {
+-    OM_uint32 minor_stat;
+-    krb5_ccache            ccache = NULL;
+-    int                    code = KADM5_OK;
+-    kadm5_server_handle_t      handle =
+-        (kadm5_server_handle_t) server_handle;
+-
+     CHECK_HANDLE(server_handle);
+-
+-    if (handle->destroy_cache && handle->cache_name) {
+-        if ((code = krb5_cc_resolve(handle->context,
+-                                    handle->cache_name, &ccache)) == 0)
+-            code = krb5_cc_destroy (handle->context, ccache);
+-    }
+-    if (handle->cache_name)
+-        free(handle->cache_name);
+-    if (handle->cred)
+-        (void)gss_release_cred(&minor_stat, &handle->cred);
+-    if (handle->clnt && handle->clnt->cl_auth)
+-        AUTH_DESTROY(handle->clnt->cl_auth);
+-    if (handle->clnt)
+-        clnt_destroy(handle->clnt);
+-    if (handle->client_socket != -1)
+-        close(handle->client_socket);
+-    if (handle->lhandle)
+-        free (handle->lhandle);
+-
+-    kadm5_free_config_params(handle->context, &handle->params);
+-
+-    handle->magic_number = 0;
+-    free(handle);
+-
+-    return code;
++    return free_handle(server_handle);
+ }
+ /* not supported on client */
+ kadm5_ret_t kadm5_lock(void *server_handle)
+diff --git a/src/lib/kadm5/srv/server_init.c b/src/lib/kadm5/srv/server_init.c
+index 3adc4b57d..2c0d51efd 100644
+--- a/src/lib/kadm5/srv/server_init.c
++++ b/src/lib/kadm5/srv/server_init.c
+@@ -19,23 +19,6 @@
+ #include "osconf.h"
+ #include "iprop_hdr.h"
+ 
+-/*
+- * Function check_handle
+- *
+- * Purpose: Check a server handle and return a com_err code if it is
+- * invalid or 0 if it is valid.
+- *
+- * Arguments:
+- *
+- *      handle          The server handle.
+- */
+-
+-static int check_handle(void *handle)
+-{
+-    CHECK_HANDLE(handle);
+-    return 0;
+-}
+-
+ static int dup_db_args(kadm5_server_handle_t handle, char **db_args)
+ {
+     int count  = 0;
+@@ -84,6 +67,23 @@ static void free_db_args(kadm5_server_handle_t handle)
+     }
+ }
+ 
++static void
++free_handle(kadm5_server_handle_t handle)
++{
++    if (handle == NULL)
++        return;
++
++    destroy_pwqual(handle);
++    k5_kadm5_hook_free_handles(handle->context, handle->hook_handles);
++    ulog_fini(handle->context);
++    krb5_db_fini(handle->context);
++    krb5_free_principal(handle->context, handle->current_caller);
++    kadm5_free_config_params(handle->context, &handle->params);
++    free(handle->lhandle);
++    free_db_args(handle);
++    free(handle);
++}
++
+ kadm5_ret_t kadm5_init_with_password(krb5_context context, char *client_name,
+                                      char *pass, char *service_name,
+                                      kadm5_config_params *params,
+@@ -163,8 +163,8 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass,
+                        char **db_args,
+                        void **server_handle)
+ {
+-    int ret;
+-    kadm5_server_handle_t handle;
++    krb5_error_code ret;
++    kadm5_server_handle_t handle = NULL;
+     kadm5_config_params params_local; /* for v1 compat */
+ 
+     if (! server_handle)
+@@ -173,17 +173,17 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass,
+     if (! client_name)
+         return EINVAL;
+ 
+-    if (! (handle = (kadm5_server_handle_t) malloc(sizeof *handle)))
+-        return ENOMEM;
+-    memset(handle, 0, sizeof(*handle));
++    CHECK_VERSIONS(struct_version, api_version, KADM5_OLD_SERVER_API_VERSION,
++                   KADM5_NEW_SERVER_API_VERSION);
++
++    handle = k5alloc(sizeof(*handle), &ret);
++    if (handle == NULL)
++        goto cleanup;
++    handle->context = context;
+ 
+     ret = dup_db_args(handle, db_args);
+-    if (ret) {
+-        free(handle);
+-        return ret;
+-    }
+-
+-    handle->context = context;
++    if (ret)
++        goto cleanup;
+ 
+     initialize_ovk_error_table();
+     initialize_ovku_error_table();
+@@ -192,13 +192,6 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass,
+     handle->struct_version = struct_version;
+     handle->api_version = api_version;
+ 
+-    /*
+-     * Verify the version numbers before proceeding; we can't use
+-     * CHECK_HANDLE because not all fields are set yet.
+-     */
+-    GENERIC_CHECK_HANDLE(handle, KADM5_OLD_SERVER_API_VERSION,
+-                         KADM5_NEW_SERVER_API_VERSION);
+-
+     /*
+      * Acquire relevant profile entries.  Merge values
+      * in params_in with values from profile, based on
+@@ -208,11 +201,8 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass,
+ 
+     ret = kadm5_get_config_params(handle->context, 1, params_in,
+                                   &handle->params);
+-    if (ret) {
+-        free_db_args(handle);
+-        free(handle);
+-        return(ret);
+-    }
++    if (ret)
++        goto cleanup;
+ 
+ #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | KADM5_CONFIG_DBNAME |     \
+                          KADM5_CONFIG_ENCTYPE |                         \
+@@ -226,132 +216,69 @@ kadm5_ret_t kadm5_init(krb5_context context, char *client_name, char *pass,
+      KADM5_CONFIG_IPROP_PORT)
+ 
+     if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) {
+-        kadm5_free_config_params(handle->context, &handle->params);
+-        free_db_args(handle);
+-        free(handle);
+-        return KADM5_MISSING_CONF_PARAMS;
++        ret = KADM5_MISSING_CONF_PARAMS;
++        goto cleanup;
+     }
+     if ((handle->params.mask & KADM5_CONFIG_IPROP_ENABLED) == KADM5_CONFIG_IPROP_ENABLED
+         && handle->params.iprop_enabled) {
+         if ((handle->params.mask & IPROP_REQUIRED_PARAMS) != IPROP_REQUIRED_PARAMS) {
+-            kadm5_free_config_params(handle->context, &handle->params);
+-            free_db_args(handle);
+-            free(handle);
+-            return KADM5_MISSING_CONF_PARAMS;
++            ret = KADM5_MISSING_CONF_PARAMS;
++            goto cleanup;
+         }
+     }
+ 
+     ret = krb5_set_default_realm(handle->context, handle->params.realm);
+-    if (ret) {
+-        kadm5_free_config_params(handle->context, &handle->params);
+-        free_db_args(handle);
+-        free(handle);
+-        return ret;
+-    }
++    if (ret)
++        goto cleanup;
+ 
+     ret = krb5_db_open(handle->context, db_args,
+                        KRB5_KDB_OPEN_RW | KRB5_KDB_SRV_TYPE_ADMIN);
+-    if (ret) {
+-        kadm5_free_config_params(handle->context, &handle->params);
+-        free_db_args(handle);
+-        free(handle);
+-        return(ret);
+-    }
++    if (ret)
++        goto cleanup;
+ 
+-    if ((ret = krb5_parse_name(handle->context, client_name,
+-                               &handle->current_caller))) {
+-        kadm5_free_config_params(handle->context, &handle->params);
+-        krb5_db_fini(handle->context);
+-        free_db_args(handle);
+-        free(handle);
+-        return ret;
+-    }
++    ret = krb5_parse_name(handle->context, client_name,
++                          &handle->current_caller);
++    if (ret)
++        goto cleanup;
+ 
+-    if (! (handle->lhandle = malloc(sizeof(*handle)))) {
+-        kadm5_free_config_params(handle->context, &handle->params);
+-        krb5_db_fini(handle->context);
+-        free_db_args(handle);
+-        free(handle);
+-        return ENOMEM;
+-    }
++    handle->lhandle = k5alloc(sizeof(*handle), &ret);
++    if (handle->lhandle == NULL)
++        goto cleanup;
+     *handle->lhandle = *handle;
+     handle->lhandle->api_version = KADM5_API_VERSION_4;
+     handle->lhandle->struct_version = KADM5_STRUCT_VERSION;
+     handle->lhandle->lhandle = handle->lhandle;
+ 
+-    /* can't check the handle until current_caller is set */
+-    ret = check_handle((void *) handle);
+-    if (ret) {
+-        kadm5_free_config_params(handle->context, &handle->params);
+-        free_db_args(handle);
+-        free(handle);
+-        return ret;
+-    }
+-
+     ret = kdb_init_master(handle, handle->params.realm,
+                           (handle->params.mask & KADM5_CONFIG_MKEY_FROM_KBD)
+                           && handle->params.mkey_from_kbd);
+-    if (ret) {
+-        kadm5_free_config_params(handle->context, &handle->params);
+-        krb5_db_fini(handle->context);
+-        free_db_args(handle);
+-        free(handle);
+-        return ret;
+-    }
++    if (ret)
++        goto cleanup;
+ 
+     ret = kdb_init_hist(handle, handle->params.realm);
+-    if (ret) {
+-        kadm5_free_config_params(handle->context, &handle->params);
+-        krb5_db_fini(handle->context);
+-        free_db_args(handle);
+-        free(handle);
+-        return ret;
+-    }
++    if (ret)
++        goto cleanup;
+ 
+     ret = k5_kadm5_hook_load(context,&handle->hook_handles);
+-    if (ret) {
+-        kadm5_free_config_params(handle->context, &handle->params);
+-        krb5_db_fini(handle->context);
+-        krb5_free_principal(handle->context, handle->current_caller);
+-        free_db_args(handle);
+-        free(handle);
+-        return ret;
+-    }
++    if (ret)
++        goto cleanup;
+ 
+     ret = init_pwqual(handle);
+-    if (ret) {
+-        kadm5_free_config_params(handle->context, &handle->params);
+-        k5_kadm5_hook_free_handles(context, handle->hook_handles);
+-        krb5_db_fini(handle->context);
+-        krb5_free_principal(handle->context, handle->current_caller);
+-        free_db_args(handle);
+-        free(handle);
+-        return ret;
+-    }
++    if (ret)
++        goto cleanup;
+ 
+-    *server_handle = (void *) handle;
++    *server_handle = handle;
++    handle = NULL;
+ 
+-    return KADM5_OK;
++cleanup:
++    free_handle(handle);
++    return ret;
+ }
+ 
+ kadm5_ret_t kadm5_destroy(void *server_handle)
+ {
+-    kadm5_server_handle_t handle = server_handle;
+-
+     CHECK_HANDLE(server_handle);
+-
+-    destroy_pwqual(handle);
+-
+-    k5_kadm5_hook_free_handles(handle->context, handle->hook_handles);
+-    ulog_fini(handle->context);
+-    krb5_db_fini(handle->context);
+-    krb5_free_principal(handle->context, handle->current_caller);
+-    kadm5_free_config_params(handle->context, &handle->params);
+-    handle->magic_number = 0;
+-    free(handle->lhandle);
+-    free_db_args(handle);
+-    free(handle);
+-
++    free_handle(server_handle);
+     return KADM5_OK;
+ }
+ 
diff --git a/Use-asan-in-one-of-the-CI-builds.patch b/Use-asan-in-one-of-the-CI-builds.patch
new file mode 100644
index 0000000..e6b1e86
--- /dev/null
+++ b/Use-asan-in-one-of-the-CI-builds.patch
@@ -0,0 +1,22 @@
+From 5457242ca6742ace42f1f7dbe37208752c6f26f4 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Mon, 21 Jun 2021 19:15:26 -0400
+Subject: [PATCH] Use asan in one of the CI builds
+
+(cherry picked from commit 7368354bcd0b58480a88b1fb81e63bd6aae7edf2)
+---
+ .github/workflows/build.yml | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
+index 8d1042b7b..06a35b7b9 100644
+--- a/.github/workflows/build.yml
++++ b/.github/workflows/build.yml
+@@ -17,6 +17,7 @@ jobs:
+                       os: ubuntu-18.04
+                       compiler: clang
+                       makevars: CPPFLAGS=-Werror
++                      configureopts: --enable-asan
+                     - name: linux-clang-openssl
+                       os: ubuntu-18.04
+                       compiler: clang
diff --git a/Using-locking-in-MEMORY-krb5_cc_get_principal.patch b/Using-locking-in-MEMORY-krb5_cc_get_principal.patch
new file mode 100644
index 0000000..2ae1967
--- /dev/null
+++ b/Using-locking-in-MEMORY-krb5_cc_get_principal.patch
@@ -0,0 +1,47 @@
+From d9a6607d47ff6449d1cad2a9a5b4d3b9b2768ddd Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Sun, 20 Jun 2021 19:24:07 -0400
+Subject: [PATCH] Using locking in MEMORY krb5_cc_get_principal()
+
+Without locking, the principal pointer could be freed out from under
+krb5_copy_principal() by another thread calling krb5_cc_initialize()
+or krb5_cc_destroy().
+
+ticket: 9014 (new)
+tags: pullup
+target_version: 1.19-next
+target_version: 1.18-next
+
+(cherry picked from commit 1848447291c68e21311f441b0458ae53471d00d3)
+---
+ src/lib/krb5/ccache/cc_memory.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/src/lib/krb5/ccache/cc_memory.c b/src/lib/krb5/ccache/cc_memory.c
+index 610091a25..e4c795d25 100644
+--- a/src/lib/krb5/ccache/cc_memory.c
++++ b/src/lib/krb5/ccache/cc_memory.c
+@@ -575,12 +575,17 @@ krb5_mcc_get_name (krb5_context context, krb5_ccache id)
+ krb5_error_code KRB5_CALLCONV
+ krb5_mcc_get_principal(krb5_context context, krb5_ccache id, krb5_principal *princ)
+ {
+-    krb5_mcc_data *ptr = (krb5_mcc_data *)id->data;
+-    if (!ptr->prin) {
+-        *princ = 0L;
+-        return KRB5_FCC_NOFILE;
+-    }
+-    return krb5_copy_principal(context, ptr->prin, princ);
++    krb5_error_code ret;
++    krb5_mcc_data *d = id->data;
++
++    *princ = NULL;
++    k5_cc_mutex_lock(context, &d->lock);
++    if (d->prin == NULL)
++        ret = KRB5_FCC_NOFILE;
++    else
++        ret = krb5_copy_principal(context, d->prin, princ);
++    k5_cc_mutex_unlock(context, &d->lock);
++    return ret;
+ }
+ 
+ krb5_error_code KRB5_CALLCONV
diff --git a/krb5.spec b/krb5.spec
index 6d2a5cb..6f8a7c8 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}11%{?dist}
+Release: %{?zdpd}12%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -86,6 +86,10 @@ Patch20: Fix-kadmin-k-with-fallback-or-referral-realm.patch
 Patch21: Fix-softpkcs11-build-issues-with-openssl-3.0.patch
 Patch22: Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch
 Patch23: Fix-k5tls-module-for-OpenSSL-3.patch
+Patch24: Fix-leaks-on-error-in-kadm5-init-functions.patch
+Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch
+Patch26: Use-asan-in-one-of-the-CI-builds.patch
+Patch27: Using-locking-in-MEMORY-krb5_cc_get_principal.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -648,6 +652,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Mon Jun 28 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-12
+- MEMORY locking fix and static analysis pullup
+
 * Mon Jun 21 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-11
 - Add the backward-compatible parts of openssl3 support
 

From e2cba14cf15a409c01b2affe5787e7b4d5077cd5 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Thu, 1 Jul 2021 13:17:47 -0400
Subject: [PATCH 13/22] Fix use-after-free during krad remote_shutdown()

---
 ...up-gssapi_krb5-ccache-name-functions.patch | 193 ++++++++++++++++++
 ...ter-free-during-krad-remote_shutdown.patch |  38 ++++
 krb5.spec                                     |   7 +-
 3 files changed, 237 insertions(+), 1 deletion(-)
 create mode 100644 Clean-up-gssapi_krb5-ccache-name-functions.patch
 create mode 100644 Fix-use-after-free-during-krad-remote_shutdown.patch

diff --git a/Clean-up-gssapi_krb5-ccache-name-functions.patch b/Clean-up-gssapi_krb5-ccache-name-functions.patch
new file mode 100644
index 0000000..32f3fc4
--- /dev/null
+++ b/Clean-up-gssapi_krb5-ccache-name-functions.patch
@@ -0,0 +1,193 @@
+From 8285f21d40e30477436128ae2c28403cd5575074 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Wed, 26 May 2021 18:22:10 -0400
+Subject: [PATCH] Clean up gssapi_krb5 ccache name functions
+
+Modernize kg_get_ccache_name() and kg_get_ccache_name().  Drop
+unnecessary use of const in kg_get_ccache_name() so that its return
+value can be properly freed.  Fixes some static analyzer false
+positives.
+
+(cherry picked from commit f573f7f8ee5269103a0492d6521a3242c5ffb63b)
+---
+ src/lib/gssapi/krb5/gssapiP_krb5.h |  3 +-
+ src/lib/gssapi/krb5/gssapi_krb5.c  | 47 ++++++++--------------
+ src/lib/gssapi/krb5/set_ccache.c   | 64 ++++++++++++------------------
+ 3 files changed, 42 insertions(+), 72 deletions(-)
+
+diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h
+index fd7abbd77..88d41130a 100644
+--- a/src/lib/gssapi/krb5/gssapiP_krb5.h
++++ b/src/lib/gssapi/krb5/gssapiP_krb5.h
+@@ -380,8 +380,7 @@ OM_uint32 kg_sync_ccache_name (krb5_context context, OM_uint32 *minor_status);
+ OM_uint32 kg_caller_provided_ccache_name (OM_uint32 *minor_status,
+                                           int *out_caller_provided_name);
+ 
+-OM_uint32 kg_get_ccache_name (OM_uint32 *minor_status,
+-                              const char **out_name);
++OM_uint32 kg_get_ccache_name (OM_uint32 *minor_status, char **out_name);
+ 
+ OM_uint32 kg_set_ccache_name (OM_uint32 *minor_status,
+                               const char *name);
+diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c
+index 46aa9b7a5..9915a8bb5 100644
+--- a/src/lib/gssapi/krb5/gssapi_krb5.c
++++ b/src/lib/gssapi/krb5/gssapi_krb5.c
+@@ -253,46 +253,31 @@ kg_caller_provided_ccache_name (OM_uint32 *minor_status,
+ }
+ 
+ OM_uint32
+-kg_get_ccache_name (OM_uint32 *minor_status, const char **out_name)
++kg_get_ccache_name(OM_uint32 *minor_status, char **out_name)
+ {
+-    const char *name = NULL;
+-    OM_uint32 err = 0;
+     char *kg_ccache_name;
++    const char *def_name;
++    OM_uint32 err;
++    krb5_context context;
++
++    *out_name = NULL;
+ 
+     kg_ccache_name = k5_getspecific(K5_KEY_GSS_KRB5_CCACHE_NAME);
+-
+     if (kg_ccache_name != NULL) {
+-        name = strdup(kg_ccache_name);
+-        if (name == NULL)
+-            err = ENOMEM;
++        *out_name = strdup(kg_ccache_name);
++        err = (*out_name == NULL) ? ENOMEM : 0;
+     } else {
+-        krb5_context context = NULL;
+-
+-        /* Reset the context default ccache (see text above), and then
+-           retrieve it.  */
++        /* Use the default ccache name. */
+         err = krb5_gss_init_context(&context);
+-        if (!err)
+-            err = krb5_cc_set_default_name (context, NULL);
+-        if (!err) {
+-            name = krb5_cc_default_name(context);
+-            if (name) {
+-                name = strdup(name);
+-                if (name == NULL)
+-                    err = ENOMEM;
+-            }
+-        }
+-        if (err && context)
+-            save_error_info(err, context);
+-        if (context)
+-            krb5_free_context(context);
+-    }
+-
+-    if (!err) {
+-        if (out_name) {
+-            *out_name = name;
+-        }
++        if (err)
++            goto cleanup;
++        def_name = krb5_cc_default_name(context);
++        *out_name = (def_name != NULL) ? strdup(def_name) : NULL;
++        err = (*out_name == NULL) ? ENOMEM : 0;
++        krb5_free_context(context);
+     }
+ 
++cleanup:
+     *minor_status = err;
+     return (*minor_status == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE;
+ }
+diff --git a/src/lib/gssapi/krb5/set_ccache.c b/src/lib/gssapi/krb5/set_ccache.c
+index 8acf3ec90..91c3462be 100644
+--- a/src/lib/gssapi/krb5/set_ccache.c
++++ b/src/lib/gssapi/krb5/set_ccache.c
+@@ -26,7 +26,7 @@
+ 
+ /*
+  * Set ccache name used by gssapi, and optionally obtain old ccache
+- * name.  Caller should not free returned name.
++ * name.  Caller must not free returned name.
+  */
+ 
+ #include <string.h>
+@@ -38,11 +38,9 @@ gss_krb5int_ccache_name(OM_uint32 *minor_status,
+                         const gss_OID desired_object,
+                         const gss_buffer_t value)
+ {
+-    char *old_name = NULL;
+     OM_uint32 err = 0;
+-    OM_uint32 minor = 0;
+-    char *gss_out_name;
+     struct krb5_gss_ccache_name_req *req;
++    char *old_name, *cur_name = NULL;
+ 
+     err = gss_krb5int_initialize_library();
+     if (err) {
+@@ -57,45 +55,33 @@ gss_krb5int_ccache_name(OM_uint32 *minor_status,
+ 
+     req = (struct krb5_gss_ccache_name_req *)value->value;
+ 
+-    gss_out_name = k5_getspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME);
++    /* Our job is simple if the caller doesn't want the current name. */
++    if (req->out_name == NULL)
++        return kg_set_ccache_name(minor_status, req->name);
+ 
+-    if (req->out_name) {
+-        const char *tmp_name = NULL;
++    /* Fetch the current name and change it. */
++    kg_get_ccache_name(&err, &cur_name);
++    if (err)
++        goto cleanup;
++    kg_set_ccache_name(&err, req->name);
++    if (err)
++        goto cleanup;
+ 
+-        if (!err) {
+-            kg_get_ccache_name (&err, &tmp_name);
+-        }
+-        if (!err) {
+-            old_name = gss_out_name;
+-            gss_out_name = (char *)tmp_name;
+-        }
+-    }
+-    /* If out_name was NULL, we keep the same gss_out_name value, and
+-       don't free up any storage (leave old_name NULL).  */
++    /* Store the current name in a thread-specific variable.  Free that
++     * variable's previous contents. */
++    old_name = k5_getspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME);
++    err = k5_setspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME, cur_name);
++    if (err)
++        goto cleanup;
++    free(old_name);
+ 
+-    if (!err)
+-        kg_set_ccache_name (&err, req->name);
+-
+-    minor = k5_setspecific(K5_KEY_GSS_KRB5_SET_CCACHE_OLD_NAME, gss_out_name);
+-    if (minor) {
+-        /* Um.  Now what?  */
+-        if (err == 0) {
+-            err = minor;
+-        }
+-        free(gss_out_name);
+-        gss_out_name = NULL;
+-    }
+-
+-    if (!err) {
+-        if (req->out_name) {
+-            *(req->out_name) = gss_out_name;
+-        }
+-    }
+-
+-    if (old_name != NULL) {
+-        free (old_name);
+-    }
++    /* Give the caller an alias to the stored value. */
++    *req->out_name = cur_name;
++    cur_name = NULL;
++    err = 0;
+ 
++cleanup:
++    free(cur_name);
+     *minor_status = err;
+     return (*minor_status == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE;
+ }
diff --git a/Fix-use-after-free-during-krad-remote_shutdown.patch b/Fix-use-after-free-during-krad-remote_shutdown.patch
new file mode 100644
index 0000000..fb9c56d
--- /dev/null
+++ b/Fix-use-after-free-during-krad-remote_shutdown.patch
@@ -0,0 +1,38 @@
+From bcd7b5e8aa0d325e9b178d9be3459759d39b631e Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Sat, 29 May 2021 13:25:59 -0400
+Subject: [PATCH] Fix use-after-free during krad remote_shutdown()
+
+Since elements of the queue can be removed on out-of-memory errors,
+the correct call is K5_TAILQ_FOREACH_SAFE, not K5_TAILQ_FOREACH.
+Reported by Coverity.
+
+ticket: 9015 (new)
+tags: pullup
+target_version: 1.19-next
+target_version: 1.18-next
+
+(cherry picked from commit 8c88defb16b34937d5b72b4832c854ce2dbe32d1)
+---
+ src/lib/krad/remote.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
+index eca432424..7b5804b1d 100644
+--- a/src/lib/krad/remote.c
++++ b/src/lib/krad/remote.c
+@@ -220,12 +220,12 @@ static void
+ remote_shutdown(krad_remote *rr)
+ {
+     krb5_error_code retval;
+-    request *r;
++    request *r, *next;
+ 
+     remote_disconnect(rr);
+ 
+     /* Start timers for all unsent packets. */
+-    K5_TAILQ_FOREACH(r, &rr->list, list) {
++    K5_TAILQ_FOREACH_SAFE(r, &rr->list, list, next) {
+         if (r->timer == NULL) {
+             retval = request_start_timer(r, rr->vctx);
+             if (retval != 0)
diff --git a/krb5.spec b/krb5.spec
index 6f8a7c8..f1f9360 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}12%{?dist}
+Release: %{?zdpd}13%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -90,6 +90,8 @@ Patch24: Fix-leaks-on-error-in-kadm5-init-functions.patch
 Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch
 Patch26: Use-asan-in-one-of-the-CI-builds.patch
 Patch27: Using-locking-in-MEMORY-krb5_cc_get_principal.patch
+Patch28: Fix-use-after-free-during-krad-remote_shutdown.patch
+Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -652,6 +654,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Thu Jul 01 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-13
+- Fix use-after-free during krad remote_shutdown()
+
 * Mon Jun 28 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-12
 - MEMORY locking fix and static analysis pullup
 

From d4c49281cc424475d33c6c2c2e7e61cf0982bfc6 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Mon, 12 Jul 2021 13:11:12 -0400
Subject: [PATCH 14/22] Fix KDC null deref on bad encrypted challenge
 (CVE-2021-36222)

---
 ...ull-deref-on-bad-encrypted-challenge.patch | 113 ++++++++++++++++++
 krb5.spec                                     |   6 +-
 2 files changed, 118 insertions(+), 1 deletion(-)
 create mode 100644 Fix-KDC-null-deref-on-bad-encrypted-challenge.patch

diff --git a/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch b/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
new file mode 100644
index 0000000..4a7c7ae
--- /dev/null
+++ b/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
@@ -0,0 +1,113 @@
+From 791211b00a53b394376d096c881b725ee739a936 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 7 Jul 2021 11:47:44 +1200
+Subject: [PATCH] Fix KDC null deref on bad encrypted challenge
+
+The function ec_verify() in src/kdc/kdc_preauth_ec.c contains a check
+to avoid further processing if the armor key is NULL.  However, this
+check is bypassed by a call to k5memdup0() which overwrites retval
+with 0 if the allocation succeeds.  If the armor key is NULL, a call
+to krb5_c_fx_cf2_simple() will then dereference it, resulting in a
+crash.  Add a check before the k5memdup0() call to avoid overwriting
+retval.
+
+CVE-2021-36222:
+
+In MIT krb5 releases 1.16 and later, an unauthenticated attacker can
+cause a null dereference in the KDC by sending a request containing a
+PA-ENCRYPTED-CHALLENGE padata element without using FAST.
+
+[ghudson@mit.edu: trimmed patch; added test case; edited commit
+message]
+
+ticket: 9007 (new)
+tags: pullup
+target_version: 1.19-next
+target_version: 1.18-next
+
+(cherry picked from commit fc98f520caefff2e5ee9a0026fdf5109944b3562)
+---
+ src/kdc/kdc_preauth_ec.c      |  3 ++-
+ src/tests/Makefile.in         |  1 +
+ src/tests/t_cve-2021-36222.py | 46 +++++++++++++++++++++++++++++++++++
+ 3 files changed, 49 insertions(+), 1 deletion(-)
+ create mode 100644 src/tests/t_cve-2021-36222.py
+
+diff --git a/src/kdc/kdc_preauth_ec.c b/src/kdc/kdc_preauth_ec.c
+index 7e636b3f9..43a9902cc 100644
+--- a/src/kdc/kdc_preauth_ec.c
++++ b/src/kdc/kdc_preauth_ec.c
+@@ -87,7 +87,8 @@ ec_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request,
+     }
+ 
+     /* Check for a configured FAST ec auth indicator. */
+-    realmstr = k5memdup0(realm.data, realm.length, &retval);
++    if (retval == 0)
++        realmstr = k5memdup0(realm.data, realm.length, &retval);
+     if (realmstr != NULL)
+         retval = profile_get_string(context->profile, KRB5_CONF_REALMS,
+                                     realmstr,
+diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in
+index ab416cc5f..20f27d748 100644
+--- a/src/tests/Makefile.in
++++ b/src/tests/Makefile.in
+@@ -159,6 +159,7 @@ check-pytests: unlockiter s4u2self
+ 	$(RUNPYTEST) $(srcdir)/t_cve-2012-1015.py $(PYTESTFLAGS)
+ 	$(RUNPYTEST) $(srcdir)/t_cve-2013-1416.py $(PYTESTFLAGS)
+ 	$(RUNPYTEST) $(srcdir)/t_cve-2013-1417.py $(PYTESTFLAGS)
++	$(RUNPYTEST) $(srcdir)/t_cve-2021-36222.py $(PYTESTFLAGS)
+ 	$(RM) au.log
+ 	$(RUNPYTEST) $(srcdir)/t_audit.py $(PYTESTFLAGS)
+ 	$(RUNPYTEST) $(srcdir)/jsonwalker.py -d $(srcdir)/au_dict.json \
+diff --git a/src/tests/t_cve-2021-36222.py b/src/tests/t_cve-2021-36222.py
+new file mode 100644
+index 000000000..57e04993b
+--- /dev/null
++++ b/src/tests/t_cve-2021-36222.py
+@@ -0,0 +1,46 @@
++import socket
++from k5test import *
++
++realm = K5Realm()
++
++# CVE-2021-36222 KDC null dereference on encrypted challenge preauth
++# without FAST
++
++s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
++a = (hostname, realm.portbase)
++
++m = ('6A81A0' '30819D'          # [APPLICATION 10] SEQUENCE
++     'A103' '0201' '05'         #  [1] pvno = 5
++     'A203' '0201' '0A'         #  [2] msg-type = 10
++     'A30E' '300C'              #  [3] padata = SEQUENCE OF
++     '300A'                     #   SEQUENCE
++     'A104' '0202' '008A'       #    [1] padata-type = PA-ENCRYPTED-CHALLENGE
++     'A202' '0400'              #    [2] padata-value = ""
++     'A48180' '307E'            #  [4] req-body = SEQUENCE
++     'A007' '0305' '0000000000' #   [0] kdc-options = 0
++     'A120' '301E'              #   [1] cname = SEQUENCE
++     'A003' '0201' '01'         #    [0] name-type = NT-PRINCIPAL
++     'A117' '3015'              #    [1] name-string = SEQUENCE-OF
++     '1B06' '6B7262746774'      #     krbtgt
++     '1B0B' '4B5242544553542E434F4D'
++                                #     KRBTEST.COM
++     'A20D' '1B0B' '4B5242544553542E434F4D'
++                                #   [2] realm = KRBTEST.COM
++     'A320' '301E'              #   [3] sname = SEQUENCE
++     'A003' '0201' '01'         #    [0] name-type = NT-PRINCIPAL
++     'A117' '3015'              #    [1] name-string = SEQUENCE-OF
++     '1B06' '6B7262746774'      #     krbtgt
++     '1B0B' '4B5242544553542E434F4D'
++                                #     KRBTEST.COM
++     'A511' '180F' '31393934303631303036303331375A'
++                                #   [5] till = 19940610060317Z
++     'A703' '0201' '00'         #   [7] nonce = 0
++     'A808' '3006'              #   [8] etype = SEQUENCE OF
++     '020112' '020111')         #    aes256-cts aes128-cts
++
++s.sendto(bytes.fromhex(m), a)
++
++# Make sure kinit still works.
++realm.kinit(realm.user_princ, password('user'))
++
++success('CVE-2021-36222 regression test')
diff --git a/krb5.spec b/krb5.spec
index f1f9360..48ff4fb 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}13%{?dist}
+Release: %{?zdpd}14%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -92,6 +92,7 @@ Patch26: Use-asan-in-one-of-the-CI-builds.patch
 Patch27: Using-locking-in-MEMORY-krb5_cc_get_principal.patch
 Patch28: Fix-use-after-free-during-krad-remote_shutdown.patch
 Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch
+Patch30: Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -654,6 +655,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Mon Jul 12 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-14
+- Fix KDC null deref on bad encrypted challenge (CVE-2021-36222)
+
 * Thu Jul 01 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-13
 - Fix use-after-free during krad remote_shutdown()
 

From 75a24fdad13fdc2e74cbdcc454a60d620ec55108 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Wed, 21 Jul 2021 12:44:26 -0400
Subject: [PATCH 15/22] Fix defcred leak in krb5 gss_inquire_cred()

---
 ...efcred-leak-in-krb5-gss_inquire_cred.patch | 85 +++++++++++++++++++
 krb5.spec                                     |  6 +-
 2 files changed, 90 insertions(+), 1 deletion(-)
 create mode 100644 Fix-defcred-leak-in-krb5-gss_inquire_cred.patch

diff --git a/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch b/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch
new file mode 100644
index 0000000..9b11bc7
--- /dev/null
+++ b/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch
@@ -0,0 +1,85 @@
+From 7e6cdffd47559be61a8c26c4ed3c500c536d5368 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 16 Jul 2021 13:39:39 -0400
+Subject: [PATCH] Fix defcred leak in krb5 gss_inquire_cred()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit 1cd2821c19b2b95e39d5fc2f451a035585a40fa5 altered the memory
+management of krb5_gss_inquire_cred(), introducing defcred to act as
+an owner pointer when the function must acquire a default credential.
+The commit neglected to update the code to release the default cred
+along the successful path.  The old code does not trigger because
+cred_handle is now reassigned, so the default credential is leaked.
+
+Unify the success and failure cleanup for this function so that
+defcred is properly released on success.
+
+Reported by Pavel Březina.
+
+ticket: 9016
+tags: pullup
+target_version: 1.19-next
+target_version: 1.18-next
+
+(cherry picked from commit 593e16448e1af23eef74689afe06a7bcc86e79c7)
+---
+ src/lib/gssapi/krb5/inq_cred.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/src/lib/gssapi/krb5/inq_cred.c b/src/lib/gssapi/krb5/inq_cred.c
+index a8f254110..bb63b726c 100644
+--- a/src/lib/gssapi/krb5/inq_cred.c
++++ b/src/lib/gssapi/krb5/inq_cred.c
+@@ -127,7 +127,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
+     if ((code = krb5_timeofday(context, &now))) {
+         *minor_status = code;
+         ret = GSS_S_FAILURE;
+-        goto fail;
++        goto cleanup;
+     }
+ 
+     if (cred->expire != 0) {
+@@ -158,7 +158,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
+             *minor_status = code;
+             save_error_info(*minor_status, context);
+             ret = GSS_S_FAILURE;
+-            goto fail;
++            goto cleanup;
+         }
+     }
+ 
+@@ -174,7 +174,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
+             if (ret_name)
+                 kg_release_name(context, &ret_name);
+             /* *minor_status set above */
+-            goto fail;
++            goto cleanup;
+         }
+     }
+ 
+@@ -190,20 +190,16 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
+ 
+     if (cred_usage)
+         *cred_usage = cred->usage;
+-    k5_mutex_unlock(&cred->lock);
+ 
+     if (mechanisms) {
+         *mechanisms = mechs;
+         mechs = GSS_C_NO_OID_SET;
+     }
+ 
+-    if (cred_handle == GSS_C_NO_CREDENTIAL)
+-        krb5_gss_release_cred(minor_status, (gss_cred_id_t *)&cred);
+-
+-    krb5_free_context(context);
+     *minor_status = 0;
+-    return((lifetime == 0)?GSS_S_CREDENTIALS_EXPIRED:GSS_S_COMPLETE);
+-fail:
++    ret = (lifetime == 0) ? GSS_S_CREDENTIALS_EXPIRED : GSS_S_COMPLETE;
++
++cleanup:
+     k5_mutex_unlock(&cred->lock);
+     krb5_gss_release_cred(&tmpmin, &defcred);
+     krb5_free_context(context);
diff --git a/krb5.spec b/krb5.spec
index 48ff4fb..d27bf68 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.1
-Release: %{?zdpd}14%{?dist}
+Release: %{?zdpd}15%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -93,6 +93,7 @@ Patch27: Using-locking-in-MEMORY-krb5_cc_get_principal.patch
 Patch28: Fix-use-after-free-during-krad-remote_shutdown.patch
 Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch
 Patch30: Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
+Patch31: Fix-defcred-leak-in-krb5-gss_inquire_cred.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -655,6 +656,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Wed Jul 21 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-15
+- Fix defcred leak in krb5 gss_inquire_cred()
+
 * Mon Jul 12 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-14
 - Fix KDC null deref on bad encrypted challenge (CVE-2021-36222)
 

From f4fc3f0f4637bcd9d31eddb16a36a99ac90c70a4 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Mon, 26 Jul 2021 14:49:39 -0400
Subject: [PATCH 16/22] New upstream version (1.19.2)

---
 Add-APIs-for-marshalling-credentials.patch    |   2 +-
 ...P_GET_CRED_LIST-for-faster-iteration.patch |   2 +-
 ...canonicalization-helper-to-k5test.py.patch |   2 +-
 ...ith-keytab-to-defer-canonicalization.patch |   2 +-
 ...context-after-failed-open-in-libkdb5.patch |   2 +-
 ...up-gssapi_krb5-ccache-name-functions.patch |   2 +-
 ...CM-flag-transmission-for-remove_cred.patch |   2 +-
 Fix-KCM-retrieval-support-for-sssd.patch      |   2 +-
 ...ull-deref-on-bad-encrypted-challenge.patch | 113 -------------
 ...efcred-leak-in-krb5-gss_inquire_cred.patch |  85 ----------
 Fix-doc-build-for-Sphinx-4.0.patch            | 152 ------------------
 Fix-k5tls-module-for-OpenSSL-3.patch          |   2 +-
 ...in-k-with-fallback-or-referral-realm.patch |   2 +-
 ...aks-on-error-in-kadm5-init-functions.patch |   2 +-
 ...pkcs11-build-issues-with-openssl-3.0.patch |   2 +-
 ...incipal-realm-canonicalization-cases.patch |   2 +-
 ...ter-free-during-krad-remote_shutdown.patch |  38 -----
 ...teration-fallback-work-with-sssd-kcm.patch |   2 +-
 ...dejagnu-kadmin-tests-to-Python-tests.patch |   4 +-
 ...ecated-OpenSSL-calls-from-softpkcs11.patch |   2 +-
 Support-host-based-GSS-initiator-names.patch  |   2 +-
 Use-KCM_OP_RETRIEVE-in-KCM-client.patch       |   2 +-
 Use-asan-in-one-of-the-CI-builds.patch        |   2 +-
 ...king-in-MEMORY-krb5_cc_get_principal.patch |  47 ------
 ...am-FIPS-with-PRNG-and-RADIUS-and-MD4.patch |   4 +-
 downstream-Remove-3des-support.patch          |  10 +-
 downstream-SELinux-integration.patch          |   2 +-
 ...ackported-version-of-OpenSSL-3-KDF-i.patch |   2 +-
 downstream-fix-debuginfo-with-y.tab.c.patch   |   2 +-
 downstream-ksu-pam-integration.patch          |   2 +-
 downstream-netlib-and-dns.patch               |   2 +-
 krb5.spec                                     |  12 +-
 32 files changed, 37 insertions(+), 474 deletions(-)
 delete mode 100644 Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
 delete mode 100644 Fix-defcred-leak-in-krb5-gss_inquire_cred.patch
 delete mode 100644 Fix-doc-build-for-Sphinx-4.0.patch
 delete mode 100644 Fix-use-after-free-during-krad-remote_shutdown.patch
 delete mode 100644 Using-locking-in-MEMORY-krb5_cc_get_principal.patch

diff --git a/Add-APIs-for-marshalling-credentials.patch b/Add-APIs-for-marshalling-credentials.patch
index da613e9..8578721 100644
--- a/Add-APIs-for-marshalling-credentials.patch
+++ b/Add-APIs-for-marshalling-credentials.patch
@@ -1,4 +1,4 @@
-From c1fe1c8fa3df7f50c7e28d52263d0d24afb4b3a1 Mon Sep 17 00:00:00 2001
+From 3a99832252755cf7e5fef2bd824459cea3eb823e Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Thu, 14 Jan 2021 18:13:09 -0500
 Subject: [PATCH] Add APIs for marshalling credentials
diff --git a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
index 060b039..455e3e0 100644
--- a/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
+++ b/Add-KCM_OP_GET_CRED_LIST-for-faster-iteration.patch
@@ -1,4 +1,4 @@
-From a0ee8b02e56c65e5dcd569caed0e151cef004ef4 Mon Sep 17 00:00:00 2001
+From 8772d8f47b7460a0eef48366881483fd9b3acfd3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
 Date: Thu, 11 Feb 2021 15:33:10 +0100
 Subject: [PATCH] Add KCM_OP_GET_CRED_LIST for faster iteration
diff --git a/Add-hostname-canonicalization-helper-to-k5test.py.patch b/Add-hostname-canonicalization-helper-to-k5test.py.patch
index 75c3e87..58179a2 100644
--- a/Add-hostname-canonicalization-helper-to-k5test.py.patch
+++ b/Add-hostname-canonicalization-helper-to-k5test.py.patch
@@ -1,4 +1,4 @@
-From 3e78bc5d48513fe38f3bc4228b12abcdc0733ee2 Mon Sep 17 00:00:00 2001
+From e88f0319427cee7245fb05c97a25473297c9d2d6 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Fri, 15 Jan 2021 14:43:34 -0500
 Subject: [PATCH] Add hostname canonicalization helper to k5test.py
diff --git a/Allow-kinit-with-keytab-to-defer-canonicalization.patch b/Allow-kinit-with-keytab-to-defer-canonicalization.patch
index 9315f66..eee7d1d 100644
--- a/Allow-kinit-with-keytab-to-defer-canonicalization.patch
+++ b/Allow-kinit-with-keytab-to-defer-canonicalization.patch
@@ -1,4 +1,4 @@
-From 090c7319652466339e3e6482bdd1b5a294638dff Mon Sep 17 00:00:00 2001
+From fb4d9fa851b1d0d3375556d1cdc1fce72176df1e Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Thu, 3 Jun 2021 16:03:07 -0400
 Subject: [PATCH] Allow kinit with keytab to defer canonicalization
diff --git a/Clean-up-context-after-failed-open-in-libkdb5.patch b/Clean-up-context-after-failed-open-in-libkdb5.patch
index a892a14..fca6a71 100644
--- a/Clean-up-context-after-failed-open-in-libkdb5.patch
+++ b/Clean-up-context-after-failed-open-in-libkdb5.patch
@@ -1,4 +1,4 @@
-From 78c03a9b5ef3e3f894bea11c89e575b9bb4d1b0f Mon Sep 17 00:00:00 2001
+From 95547c12b39e62df55cef05cae890302834b7f98 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Wed, 23 Jun 2021 16:57:39 -0400
 Subject: [PATCH] Clean up context after failed open in libkdb5
diff --git a/Clean-up-gssapi_krb5-ccache-name-functions.patch b/Clean-up-gssapi_krb5-ccache-name-functions.patch
index 32f3fc4..207f186 100644
--- a/Clean-up-gssapi_krb5-ccache-name-functions.patch
+++ b/Clean-up-gssapi_krb5-ccache-name-functions.patch
@@ -1,4 +1,4 @@
-From 8285f21d40e30477436128ae2c28403cd5575074 Mon Sep 17 00:00:00 2001
+From 5e5ea8e8345c8b2f3254b0d346b8e0de0df3a696 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Wed, 26 May 2021 18:22:10 -0400
 Subject: [PATCH] Clean up gssapi_krb5 ccache name functions
diff --git a/Fix-KCM-flag-transmission-for-remove_cred.patch b/Fix-KCM-flag-transmission-for-remove_cred.patch
index 951be10..77c383e 100644
--- a/Fix-KCM-flag-transmission-for-remove_cred.patch
+++ b/Fix-KCM-flag-transmission-for-remove_cred.patch
@@ -1,4 +1,4 @@
-From 04f0de4420508161ce439f262f2761ff51a07ab0 Mon Sep 17 00:00:00 2001
+From 1528c264d0e1eebff34132c01f4f770f01f1d1c2 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Mon, 29 Mar 2021 14:32:56 -0400
 Subject: [PATCH] Fix KCM flag transmission for remove_cred
diff --git a/Fix-KCM-retrieval-support-for-sssd.patch b/Fix-KCM-retrieval-support-for-sssd.patch
index 5fb7c2b..9c09507 100644
--- a/Fix-KCM-retrieval-support-for-sssd.patch
+++ b/Fix-KCM-retrieval-support-for-sssd.patch
@@ -1,4 +1,4 @@
-From a5b2cff51808cd86fe8195e7ac074ecd25c3344d Mon Sep 17 00:00:00 2001
+From 43be8fba5301d08fc4d5ddef14f8ae3d9655b0ba Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Tue, 11 May 2021 14:04:07 -0400
 Subject: [PATCH] Fix KCM retrieval support for sssd
diff --git a/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch b/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
deleted file mode 100644
index 4a7c7ae..0000000
--- a/Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From 791211b00a53b394376d096c881b725ee739a936 Mon Sep 17 00:00:00 2001
-From: Joseph Sutton <josephsutton@catalyst.net.nz>
-Date: Wed, 7 Jul 2021 11:47:44 +1200
-Subject: [PATCH] Fix KDC null deref on bad encrypted challenge
-
-The function ec_verify() in src/kdc/kdc_preauth_ec.c contains a check
-to avoid further processing if the armor key is NULL.  However, this
-check is bypassed by a call to k5memdup0() which overwrites retval
-with 0 if the allocation succeeds.  If the armor key is NULL, a call
-to krb5_c_fx_cf2_simple() will then dereference it, resulting in a
-crash.  Add a check before the k5memdup0() call to avoid overwriting
-retval.
-
-CVE-2021-36222:
-
-In MIT krb5 releases 1.16 and later, an unauthenticated attacker can
-cause a null dereference in the KDC by sending a request containing a
-PA-ENCRYPTED-CHALLENGE padata element without using FAST.
-
-[ghudson@mit.edu: trimmed patch; added test case; edited commit
-message]
-
-ticket: 9007 (new)
-tags: pullup
-target_version: 1.19-next
-target_version: 1.18-next
-
-(cherry picked from commit fc98f520caefff2e5ee9a0026fdf5109944b3562)
----
- src/kdc/kdc_preauth_ec.c      |  3 ++-
- src/tests/Makefile.in         |  1 +
- src/tests/t_cve-2021-36222.py | 46 +++++++++++++++++++++++++++++++++++
- 3 files changed, 49 insertions(+), 1 deletion(-)
- create mode 100644 src/tests/t_cve-2021-36222.py
-
-diff --git a/src/kdc/kdc_preauth_ec.c b/src/kdc/kdc_preauth_ec.c
-index 7e636b3f9..43a9902cc 100644
---- a/src/kdc/kdc_preauth_ec.c
-+++ b/src/kdc/kdc_preauth_ec.c
-@@ -87,7 +87,8 @@ ec_verify(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request,
-     }
- 
-     /* Check for a configured FAST ec auth indicator. */
--    realmstr = k5memdup0(realm.data, realm.length, &retval);
-+    if (retval == 0)
-+        realmstr = k5memdup0(realm.data, realm.length, &retval);
-     if (realmstr != NULL)
-         retval = profile_get_string(context->profile, KRB5_CONF_REALMS,
-                                     realmstr,
-diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in
-index ab416cc5f..20f27d748 100644
---- a/src/tests/Makefile.in
-+++ b/src/tests/Makefile.in
-@@ -159,6 +159,7 @@ check-pytests: unlockiter s4u2self
- 	$(RUNPYTEST) $(srcdir)/t_cve-2012-1015.py $(PYTESTFLAGS)
- 	$(RUNPYTEST) $(srcdir)/t_cve-2013-1416.py $(PYTESTFLAGS)
- 	$(RUNPYTEST) $(srcdir)/t_cve-2013-1417.py $(PYTESTFLAGS)
-+	$(RUNPYTEST) $(srcdir)/t_cve-2021-36222.py $(PYTESTFLAGS)
- 	$(RM) au.log
- 	$(RUNPYTEST) $(srcdir)/t_audit.py $(PYTESTFLAGS)
- 	$(RUNPYTEST) $(srcdir)/jsonwalker.py -d $(srcdir)/au_dict.json \
-diff --git a/src/tests/t_cve-2021-36222.py b/src/tests/t_cve-2021-36222.py
-new file mode 100644
-index 000000000..57e04993b
---- /dev/null
-+++ b/src/tests/t_cve-2021-36222.py
-@@ -0,0 +1,46 @@
-+import socket
-+from k5test import *
-+
-+realm = K5Realm()
-+
-+# CVE-2021-36222 KDC null dereference on encrypted challenge preauth
-+# without FAST
-+
-+s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-+a = (hostname, realm.portbase)
-+
-+m = ('6A81A0' '30819D'          # [APPLICATION 10] SEQUENCE
-+     'A103' '0201' '05'         #  [1] pvno = 5
-+     'A203' '0201' '0A'         #  [2] msg-type = 10
-+     'A30E' '300C'              #  [3] padata = SEQUENCE OF
-+     '300A'                     #   SEQUENCE
-+     'A104' '0202' '008A'       #    [1] padata-type = PA-ENCRYPTED-CHALLENGE
-+     'A202' '0400'              #    [2] padata-value = ""
-+     'A48180' '307E'            #  [4] req-body = SEQUENCE
-+     'A007' '0305' '0000000000' #   [0] kdc-options = 0
-+     'A120' '301E'              #   [1] cname = SEQUENCE
-+     'A003' '0201' '01'         #    [0] name-type = NT-PRINCIPAL
-+     'A117' '3015'              #    [1] name-string = SEQUENCE-OF
-+     '1B06' '6B7262746774'      #     krbtgt
-+     '1B0B' '4B5242544553542E434F4D'
-+                                #     KRBTEST.COM
-+     'A20D' '1B0B' '4B5242544553542E434F4D'
-+                                #   [2] realm = KRBTEST.COM
-+     'A320' '301E'              #   [3] sname = SEQUENCE
-+     'A003' '0201' '01'         #    [0] name-type = NT-PRINCIPAL
-+     'A117' '3015'              #    [1] name-string = SEQUENCE-OF
-+     '1B06' '6B7262746774'      #     krbtgt
-+     '1B0B' '4B5242544553542E434F4D'
-+                                #     KRBTEST.COM
-+     'A511' '180F' '31393934303631303036303331375A'
-+                                #   [5] till = 19940610060317Z
-+     'A703' '0201' '00'         #   [7] nonce = 0
-+     'A808' '3006'              #   [8] etype = SEQUENCE OF
-+     '020112' '020111')         #    aes256-cts aes128-cts
-+
-+s.sendto(bytes.fromhex(m), a)
-+
-+# Make sure kinit still works.
-+realm.kinit(realm.user_princ, password('user'))
-+
-+success('CVE-2021-36222 regression test')
diff --git a/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch b/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch
deleted file mode 100644
index 9b11bc7..0000000
--- a/Fix-defcred-leak-in-krb5-gss_inquire_cred.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 7e6cdffd47559be61a8c26c4ed3c500c536d5368 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Fri, 16 Jul 2021 13:39:39 -0400
-Subject: [PATCH] Fix defcred leak in krb5 gss_inquire_cred()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Commit 1cd2821c19b2b95e39d5fc2f451a035585a40fa5 altered the memory
-management of krb5_gss_inquire_cred(), introducing defcred to act as
-an owner pointer when the function must acquire a default credential.
-The commit neglected to update the code to release the default cred
-along the successful path.  The old code does not trigger because
-cred_handle is now reassigned, so the default credential is leaked.
-
-Unify the success and failure cleanup for this function so that
-defcred is properly released on success.
-
-Reported by Pavel Březina.
-
-ticket: 9016
-tags: pullup
-target_version: 1.19-next
-target_version: 1.18-next
-
-(cherry picked from commit 593e16448e1af23eef74689afe06a7bcc86e79c7)
----
- src/lib/gssapi/krb5/inq_cred.c | 16 ++++++----------
- 1 file changed, 6 insertions(+), 10 deletions(-)
-
-diff --git a/src/lib/gssapi/krb5/inq_cred.c b/src/lib/gssapi/krb5/inq_cred.c
-index a8f254110..bb63b726c 100644
---- a/src/lib/gssapi/krb5/inq_cred.c
-+++ b/src/lib/gssapi/krb5/inq_cred.c
-@@ -127,7 +127,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
-     if ((code = krb5_timeofday(context, &now))) {
-         *minor_status = code;
-         ret = GSS_S_FAILURE;
--        goto fail;
-+        goto cleanup;
-     }
- 
-     if (cred->expire != 0) {
-@@ -158,7 +158,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
-             *minor_status = code;
-             save_error_info(*minor_status, context);
-             ret = GSS_S_FAILURE;
--            goto fail;
-+            goto cleanup;
-         }
-     }
- 
-@@ -174,7 +174,7 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
-             if (ret_name)
-                 kg_release_name(context, &ret_name);
-             /* *minor_status set above */
--            goto fail;
-+            goto cleanup;
-         }
-     }
- 
-@@ -190,20 +190,16 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
- 
-     if (cred_usage)
-         *cred_usage = cred->usage;
--    k5_mutex_unlock(&cred->lock);
- 
-     if (mechanisms) {
-         *mechanisms = mechs;
-         mechs = GSS_C_NO_OID_SET;
-     }
- 
--    if (cred_handle == GSS_C_NO_CREDENTIAL)
--        krb5_gss_release_cred(minor_status, (gss_cred_id_t *)&cred);
--
--    krb5_free_context(context);
-     *minor_status = 0;
--    return((lifetime == 0)?GSS_S_CREDENTIALS_EXPIRED:GSS_S_COMPLETE);
--fail:
-+    ret = (lifetime == 0) ? GSS_S_CREDENTIALS_EXPIRED : GSS_S_COMPLETE;
-+
-+cleanup:
-     k5_mutex_unlock(&cred->lock);
-     krb5_gss_release_cred(&tmpmin, &defcred);
-     krb5_free_context(context);
diff --git a/Fix-doc-build-for-Sphinx-4.0.patch b/Fix-doc-build-for-Sphinx-4.0.patch
deleted file mode 100644
index ae3972c..0000000
--- a/Fix-doc-build-for-Sphinx-4.0.patch
+++ /dev/null
@@ -1,152 +0,0 @@
-From 0bf023bdbb8335f48a6a4dcf8bd5dac9c2cd7fb6 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Wed, 26 May 2021 15:08:28 -0400
-Subject: [PATCH] Fix doc build for Sphinx 4.0
-
-Use app.add_css_file() to register krb5.css if possible (it was added
-in Sphinx 1.8), since the old name app.add_stylesheet() was removed in
-Sphinx 4.0.
-
-Use the highlight directive instead of the highlightlang directive,
-which was removed in Sphinx 4.0.
-
-Remove two duplicate table of contents entries to fix warnings.
-
-In the Github Actions configuration, add a second doc build using the
-newest version of Sphinx.
-
-ticket: 9006
-tags: pullup
-target_version: 1.19-next
-
-(cherry picked from commit 3fa40a32e22cb9de91fa1d18deddcba446515855)
----
- .github/workflows/doc.yml            | 16 +++++++++++++++-
- doc/appdev/refs/macros/index.rst     |  1 -
- doc/appdev/refs/types/index.rst      |  1 -
- doc/appdev/refs/types/krb5_int32.rst |  2 +-
- doc/appdev/refs/types/krb5_ui_4.rst  |  2 +-
- doc/conf.py                          |  9 ++++++++-
- doc/tools/define_document.tmpl       |  2 +-
- doc/tools/type_document.tmpl         |  2 +-
- 8 files changed, 27 insertions(+), 8 deletions(-)
-
-diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
-index 292df4cfe..75f467cde 100644
---- a/.github/workflows/doc.yml
-+++ b/.github/workflows/doc.yml
-@@ -5,7 +5,7 @@ on:
-     pull_request: {paths: [doc/**, src/doc/*, src/include/krb5/krb5.hin, .github/workflows/doc.yml]}
- 
- jobs:
--    doc:
-+    doc-older-sphinx:
-         runs-on: ubuntu-18.04
-         steps:
-             - name: Checkout repository
-@@ -19,6 +19,20 @@ jobs:
-               run: |
-                 cd src/doc
-                 make -f Makefile.in SPHINX_ARGS=-W htmlsrc
-+    doc-newest-sphinx:
-+        runs-on: ubuntu-18.04
-+        steps:
-+            - name: Checkout repository
-+              uses: actions/checkout@v1
-+            - name: Linux setup
-+              run: |
-+                sudo apt-get update -qq
-+                sudo apt-get install -y doxygen python3-lxml python3-pip
-+                pip3 install Cheetah3 sphinx
-+            - name: Build documentation
-+              run: |
-+                cd src/doc
-+                make -f Makefile.in SPHINX_ARGS=-W htmlsrc
-             - name: Upload HTML
-               uses: actions/upload-artifact@v2
-               with:
-diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst
-index 4d51e795c..0cb2e81bd 100644
---- a/doc/appdev/refs/macros/index.rst
-+++ b/doc/appdev/refs/macros/index.rst
-@@ -54,7 +54,6 @@ Public
-    ENCTYPE_DES3_CBC_RAW.rst
-    ENCTYPE_DES3_CBC_SHA.rst
-    ENCTYPE_DES3_CBC_SHA1.rst
--   ENCTYPE_DES3_CBC_SHA1.rst
-    ENCTYPE_DES_CBC_CRC.rst
-    ENCTYPE_DES_CBC_MD4.rst
-    ENCTYPE_DES_CBC_MD5.rst
-diff --git a/doc/appdev/refs/types/index.rst b/doc/appdev/refs/types/index.rst
-index dc414cfde..d8d2a8f3c 100644
---- a/doc/appdev/refs/types/index.rst
-+++ b/doc/appdev/refs/types/index.rst
-@@ -62,7 +62,6 @@ Public
-    krb5_preauthtype.rst
-    krb5_principal.rst
-    krb5_principal_data.rst
--   krb5_const_principal.rst
-    krb5_prompt.rst
-    krb5_prompt_type.rst
-    krb5_prompter_fct.rst
-diff --git a/doc/appdev/refs/types/krb5_int32.rst b/doc/appdev/refs/types/krb5_int32.rst
-index 2bc914b3c..28baafa38 100644
---- a/doc/appdev/refs/types/krb5_int32.rst
-+++ b/doc/appdev/refs/types/krb5_int32.rst
-@@ -1,4 +1,4 @@
--.. highlightlang:: c
-+.. highlight:: c
- 
- .. _krb5-int32-struct:
- 
-diff --git a/doc/appdev/refs/types/krb5_ui_4.rst b/doc/appdev/refs/types/krb5_ui_4.rst
-index de79bafe1..73eb38cf4 100644
---- a/doc/appdev/refs/types/krb5_ui_4.rst
-+++ b/doc/appdev/refs/types/krb5_ui_4.rst
-@@ -1,4 +1,4 @@
--.. highlightlang:: c
-+.. highlight:: c
- 
- .. _krb5-ui4-struct:
- 
-diff --git a/doc/conf.py b/doc/conf.py
-index 4fb6aae14..a876fd633 100644
---- a/doc/conf.py
-+++ b/doc/conf.py
-@@ -98,8 +98,15 @@ pygments_style = 'sphinx'
- 
- # -- Options for HTML output ---------------------------------------------------
- 
-+# When we can rely on Sphinx 1.8 (released Sep 2018) we can just set:
-+#   html_css_files = ['kerb.css']
-+# But in the meantime, we add this file using either a way that works
-+# after 1.8 or a way that works before 4.0.
- def setup(app):
--    app.add_stylesheet('kerb.css')
-+    if callable(getattr(app, 'add_css_file', None)):
-+        app.add_css_file('kerb.css')
-+    else:
-+        app.add_stylesheet('kerb.css')
- 
- # The theme to use for HTML and HTML Help pages.  See the documentation for
- # a list of builtin themes.
-diff --git a/doc/tools/define_document.tmpl b/doc/tools/define_document.tmpl
-index ca56d866c..8e74dc302 100644
---- a/doc/tools/define_document.tmpl
-+++ b/doc/tools/define_document.tmpl
-@@ -1,4 +1,4 @@
--.. highlightlang:: c
-+.. highlight:: c
- 
- .. $composite.macro_reference($composite.name):
- 
-diff --git a/doc/tools/type_document.tmpl b/doc/tools/type_document.tmpl
-index 5987fa762..11aafb818 100644
---- a/doc/tools/type_document.tmpl
-+++ b/doc/tools/type_document.tmpl
-@@ -1,4 +1,4 @@
--.. highlightlang:: c
-+.. highlight:: c
- 
- .. $composite.struct_reference($composite.name):
- 
diff --git a/Fix-k5tls-module-for-OpenSSL-3.patch b/Fix-k5tls-module-for-OpenSSL-3.patch
index fd425b8..f53a23c 100644
--- a/Fix-k5tls-module-for-OpenSSL-3.patch
+++ b/Fix-k5tls-module-for-OpenSSL-3.patch
@@ -1,4 +1,4 @@
-From 201e38845e9f70234bcaa9ba7c25b28e38169b0a Mon Sep 17 00:00:00 2001
+From 7e4429640f69acdd5d4f9caa655c011d8bd736f0 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Sat, 29 May 2021 12:05:49 -0400
 Subject: [PATCH] Fix k5tls module for OpenSSL 3
diff --git a/Fix-kadmin-k-with-fallback-or-referral-realm.patch b/Fix-kadmin-k-with-fallback-or-referral-realm.patch
index 3e03da1..a5162e7 100644
--- a/Fix-kadmin-k-with-fallback-or-referral-realm.patch
+++ b/Fix-kadmin-k-with-fallback-or-referral-realm.patch
@@ -1,4 +1,4 @@
-From cd8ff035f5b4720a8fc457355726f7bd0eab5eaa Mon Sep 17 00:00:00 2001
+From 2d2bb9a14613b3283dabdd40c3ee28e5b680cf93 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Mon, 7 Jun 2021 15:00:41 -0400
 Subject: [PATCH] Fix kadmin -k with fallback or referral realm
diff --git a/Fix-leaks-on-error-in-kadm5-init-functions.patch b/Fix-leaks-on-error-in-kadm5-init-functions.patch
index ef12052..bdacecb 100644
--- a/Fix-leaks-on-error-in-kadm5-init-functions.patch
+++ b/Fix-leaks-on-error-in-kadm5-init-functions.patch
@@ -1,4 +1,4 @@
-From 6b2f7995ab23cffcababe537d57540236f99f0e3 Mon Sep 17 00:00:00 2001
+From a14e0fd3c1d00ba625e6d9eb72829f31527c6ad8 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Wed, 23 Jun 2021 16:53:16 -0400
 Subject: [PATCH] Fix leaks on error in kadm5 init functions
diff --git a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch
index d7a0a5c..184c1bf 100644
--- a/Fix-softpkcs11-build-issues-with-openssl-3.0.patch
+++ b/Fix-softpkcs11-build-issues-with-openssl-3.0.patch
@@ -1,4 +1,4 @@
-From a86b780ef275b35e8dc1e6d1886ec8e8d941f7c4 Mon Sep 17 00:00:00 2001
+From 391379bff864751262dbcedb897f2c2dd394345f Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Sat, 15 May 2021 17:35:25 -0400
 Subject: [PATCH] Fix softpkcs11 build issues with openssl 3.0
diff --git a/Fix-some-principal-realm-canonicalization-cases.patch b/Fix-some-principal-realm-canonicalization-cases.patch
index 2c6c915..81fde7f 100644
--- a/Fix-some-principal-realm-canonicalization-cases.patch
+++ b/Fix-some-principal-realm-canonicalization-cases.patch
@@ -1,4 +1,4 @@
-From 5ae9bc98f23aeaa2ce17debe5a9b0cf1130e54ed Mon Sep 17 00:00:00 2001
+From 0779309f52f4c05bb1f01f638261ef1b8ca82488 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Mon, 7 Jun 2021 13:27:29 -0400
 Subject: [PATCH] Fix some principal realm canonicalization cases
diff --git a/Fix-use-after-free-during-krad-remote_shutdown.patch b/Fix-use-after-free-during-krad-remote_shutdown.patch
deleted file mode 100644
index fb9c56d..0000000
--- a/Fix-use-after-free-during-krad-remote_shutdown.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From bcd7b5e8aa0d325e9b178d9be3459759d39b631e Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Sat, 29 May 2021 13:25:59 -0400
-Subject: [PATCH] Fix use-after-free during krad remote_shutdown()
-
-Since elements of the queue can be removed on out-of-memory errors,
-the correct call is K5_TAILQ_FOREACH_SAFE, not K5_TAILQ_FOREACH.
-Reported by Coverity.
-
-ticket: 9015 (new)
-tags: pullup
-target_version: 1.19-next
-target_version: 1.18-next
-
-(cherry picked from commit 8c88defb16b34937d5b72b4832c854ce2dbe32d1)
----
- src/lib/krad/remote.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
-index eca432424..7b5804b1d 100644
---- a/src/lib/krad/remote.c
-+++ b/src/lib/krad/remote.c
-@@ -220,12 +220,12 @@ static void
- remote_shutdown(krad_remote *rr)
- {
-     krb5_error_code retval;
--    request *r;
-+    request *r, *next;
- 
-     remote_disconnect(rr);
- 
-     /* Start timers for all unsent packets. */
--    K5_TAILQ_FOREACH(r, &rr->list, list) {
-+    K5_TAILQ_FOREACH_SAFE(r, &rr->list, list, next) {
-         if (r->timer == NULL) {
-             retval = request_start_timer(r, rr->vctx);
-             if (retval != 0)
diff --git a/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch b/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch
index 5fa3106..a0e28a9 100644
--- a/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch
+++ b/Make-KCM-iteration-fallback-work-with-sssd-kcm.patch
@@ -1,4 +1,4 @@
-From 2dbca7e14c945d6394e0e05f285a068dcd541295 Mon Sep 17 00:00:00 2001
+From 32ee800fa31d3bbda660bb9270f9aa20718ab202 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
 Date: Tue, 30 Mar 2021 14:35:28 +0200
 Subject: [PATCH] Make KCM iteration fallback work with sssd-kcm
diff --git a/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch b/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch
index 9334c19..1c97190 100644
--- a/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch
+++ b/Move-some-dejagnu-kadmin-tests-to-Python-tests.patch
@@ -1,4 +1,4 @@
-From 9b3d8b9c395bf1a889ea6d6439dc3543c680480d Mon Sep 17 00:00:00 2001
+From 2fd38805a159020722395e79213540d9bcfa6c71 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Thu, 22 Apr 2021 15:51:36 -0400
 Subject: [PATCH] Move some dejagnu kadmin tests to Python tests
@@ -32,7 +32,7 @@ and the ticket 2841 regression tests from pwhist.exp.
  create mode 100644 src/tests/t_kadmin.py
 
 diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in
-index 6b7749129..ab416cc5f 100644
+index fd714eedb..20f27d748 100644
 --- a/src/tests/Makefile.in
 +++ b/src/tests/Makefile.in
 @@ -147,6 +147,7 @@ check-pytests: unlockiter s4u2self
diff --git a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch
index 23f21a5..429cf4d 100644
--- a/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch
+++ b/Remove-deprecated-OpenSSL-calls-from-softpkcs11.patch
@@ -1,4 +1,4 @@
-From 5072bfdfaddae762680d0f9d97afa6dbf8274760 Mon Sep 17 00:00:00 2001
+From 0a2778833d2f04a29fe9d7122913abe42299044a Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Sat, 15 May 2021 18:04:58 -0400
 Subject: [PATCH] Remove deprecated OpenSSL calls from softpkcs11
diff --git a/Support-host-based-GSS-initiator-names.patch b/Support-host-based-GSS-initiator-names.patch
index 25b074f..cd7450c 100644
--- a/Support-host-based-GSS-initiator-names.patch
+++ b/Support-host-based-GSS-initiator-names.patch
@@ -1,4 +1,4 @@
-From 3133e5e24e94bf060e23a4d97cbdf74e934d010f Mon Sep 17 00:00:00 2001
+From 818a777822658d44ce647fe975011a5ea25e8250 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Fri, 15 Jan 2021 13:51:34 -0500
 Subject: [PATCH] Support host-based GSS initiator names
diff --git a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch
index 401b363..2af5676 100644
--- a/Use-KCM_OP_RETRIEVE-in-KCM-client.patch
+++ b/Use-KCM_OP_RETRIEVE-in-KCM-client.patch
@@ -1,4 +1,4 @@
-From c56d4b87de0f30a38dc61d374ad225d02d581eb3 Mon Sep 17 00:00:00 2001
+From 336f744403baa5dfaffcc5bd226fdd8f14a0200b Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Fri, 26 Mar 2021 23:38:54 -0400
 Subject: [PATCH] Use KCM_OP_RETRIEVE in KCM client
diff --git a/Use-asan-in-one-of-the-CI-builds.patch b/Use-asan-in-one-of-the-CI-builds.patch
index e6b1e86..4964d2f 100644
--- a/Use-asan-in-one-of-the-CI-builds.patch
+++ b/Use-asan-in-one-of-the-CI-builds.patch
@@ -1,4 +1,4 @@
-From 5457242ca6742ace42f1f7dbe37208752c6f26f4 Mon Sep 17 00:00:00 2001
+From 37e1fe755c6e976253a7f40ec7a9e740e4329789 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Mon, 21 Jun 2021 19:15:26 -0400
 Subject: [PATCH] Use asan in one of the CI builds
diff --git a/Using-locking-in-MEMORY-krb5_cc_get_principal.patch b/Using-locking-in-MEMORY-krb5_cc_get_principal.patch
deleted file mode 100644
index 2ae1967..0000000
--- a/Using-locking-in-MEMORY-krb5_cc_get_principal.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From d9a6607d47ff6449d1cad2a9a5b4d3b9b2768ddd Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Sun, 20 Jun 2021 19:24:07 -0400
-Subject: [PATCH] Using locking in MEMORY krb5_cc_get_principal()
-
-Without locking, the principal pointer could be freed out from under
-krb5_copy_principal() by another thread calling krb5_cc_initialize()
-or krb5_cc_destroy().
-
-ticket: 9014 (new)
-tags: pullup
-target_version: 1.19-next
-target_version: 1.18-next
-
-(cherry picked from commit 1848447291c68e21311f441b0458ae53471d00d3)
----
- src/lib/krb5/ccache/cc_memory.c | 17 +++++++++++------
- 1 file changed, 11 insertions(+), 6 deletions(-)
-
-diff --git a/src/lib/krb5/ccache/cc_memory.c b/src/lib/krb5/ccache/cc_memory.c
-index 610091a25..e4c795d25 100644
---- a/src/lib/krb5/ccache/cc_memory.c
-+++ b/src/lib/krb5/ccache/cc_memory.c
-@@ -575,12 +575,17 @@ krb5_mcc_get_name (krb5_context context, krb5_ccache id)
- krb5_error_code KRB5_CALLCONV
- krb5_mcc_get_principal(krb5_context context, krb5_ccache id, krb5_principal *princ)
- {
--    krb5_mcc_data *ptr = (krb5_mcc_data *)id->data;
--    if (!ptr->prin) {
--        *princ = 0L;
--        return KRB5_FCC_NOFILE;
--    }
--    return krb5_copy_principal(context, ptr->prin, princ);
-+    krb5_error_code ret;
-+    krb5_mcc_data *d = id->data;
-+
-+    *princ = NULL;
-+    k5_cc_mutex_lock(context, &d->lock);
-+    if (d->prin == NULL)
-+        ret = KRB5_FCC_NOFILE;
-+    else
-+        ret = krb5_copy_principal(context, d->prin, princ);
-+    k5_cc_mutex_unlock(context, &d->lock);
-+    return ret;
- }
- 
- krb5_error_code KRB5_CALLCONV
diff --git a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
index d48b1cd..553dec9 100644
--- a/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
+++ b/downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
@@ -1,4 +1,4 @@
-From 852e9efad17e3ef6ea54f91044a279bb34020ecf Mon Sep 17 00:00:00 2001
+From 91e1d43858d90f59f5d9f45987cfca02c3175feb Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Fri, 9 Nov 2018 15:12:21 -0500
 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4
@@ -477,7 +477,7 @@ index c597174b6..fc2d24800 100644
  }
  
 diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
-index c96a9b4ee..eca432424 100644
+index a938665f6..7b5804b1d 100644
 --- a/src/lib/krad/remote.c
 +++ b/src/lib/krad/remote.c
 @@ -263,7 +263,7 @@ on_io_write(krad_remote *rr)
diff --git a/downstream-Remove-3des-support.patch b/downstream-Remove-3des-support.patch
index 2bc2479..9c29cdd 100644
--- a/downstream-Remove-3des-support.patch
+++ b/downstream-Remove-3des-support.patch
@@ -1,4 +1,4 @@
-From fef4e551d3d2dcb55e58cc182304254c36aa8949 Mon Sep 17 00:00:00 2001
+From defa8816e26ab9f5a8f0b61e7bebad67175c433e Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 26 Mar 2019 18:51:10 -0400
 Subject: [PATCH] [downstream] Remove 3des support
@@ -195,7 +195,7 @@ index 1dc958d62..3a72aabef 100644
  
  While **aes128-cts** and **aes256-cts** are supported for all Kerberos
 diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
-index 047185afb..b08d954d9 100644
+index 694922c0d..c4d5499d3 100644
 --- a/doc/admin/enctypes.rst
 +++ b/doc/admin/enctypes.rst
 @@ -129,7 +129,7 @@ enctype                    weak?      krb5     Windows
@@ -243,7 +243,7 @@ index ade5e1f87..e4dc54f7e 100644
  
  .. _err_cert_chain_cert_expired:
 diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst
-index cebb6644c..4d51e795c 100644
+index 5542d9850..0cb2e81bd 100644
 --- a/doc/appdev/refs/macros/index.rst
 +++ b/doc/appdev/refs/macros/index.rst
 @@ -36,7 +36,6 @@ Public
@@ -255,10 +255,10 @@ index cebb6644c..4d51e795c 100644
     CKSUMTYPE_NIST_SHA.rst
     CKSUMTYPE_RSA_MD4.rst
 diff --git a/doc/conf.py b/doc/conf.py
-index 543202bf4..4fb6aae14 100644
+index 14158ae81..a876fd633 100644
 --- a/doc/conf.py
 +++ b/doc/conf.py
-@@ -271,7 +271,7 @@ else:
+@@ -278,7 +278,7 @@ else:
      rst_epilog += '''
  .. |krb5conf| replace:: ``/etc/krb5.conf``
  .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal``
diff --git a/downstream-SELinux-integration.patch b/downstream-SELinux-integration.patch
index 0ba8b6c..48b058b 100644
--- a/downstream-SELinux-integration.patch
+++ b/downstream-SELinux-integration.patch
@@ -1,4 +1,4 @@
-From e787771b618a344d45ac515927e914602f48946f Mon Sep 17 00:00:00 2001
+From 97966ffaac6bf9f2e09ac33a16b15794b31d51de Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:30:53 -0400
 Subject: [PATCH] [downstream] SELinux integration
diff --git a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch
index 84551d1..4a9f664 100644
--- a/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch
+++ b/downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch
@@ -1,4 +1,4 @@
-From 687bb26cb0877fa5497e90f7d325de42b456da2a Mon Sep 17 00:00:00 2001
+From 86d606e33439fd0511c5154be7f32b0df2c72e54 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Fri, 15 Nov 2019 20:05:16 +0000
 Subject: [PATCH] [downstream] Use backported version of OpenSSL-3 KDF
diff --git a/downstream-fix-debuginfo-with-y.tab.c.patch b/downstream-fix-debuginfo-with-y.tab.c.patch
index 172a093..494152c 100644
--- a/downstream-fix-debuginfo-with-y.tab.c.patch
+++ b/downstream-fix-debuginfo-with-y.tab.c.patch
@@ -1,4 +1,4 @@
-From d5ea86ef491feb38f12e6aa53b7579ac02675df6 Mon Sep 17 00:00:00 2001
+From 98b50683165089bf7bd9d91f953abbd79a8b1b08 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:49:25 -0400
 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c
diff --git a/downstream-ksu-pam-integration.patch b/downstream-ksu-pam-integration.patch
index 7490bf2..bebe946 100644
--- a/downstream-ksu-pam-integration.patch
+++ b/downstream-ksu-pam-integration.patch
@@ -1,4 +1,4 @@
-From 90ba715be48c2e1b6c7ca53cb1d75f3af2c388d6 Mon Sep 17 00:00:00 2001
+From 659b3b4a654b879ce84ad8fb4621dde5ae693385 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:29:58 -0400
 Subject: [PATCH] [downstream] ksu pam integration
diff --git a/downstream-netlib-and-dns.patch b/downstream-netlib-and-dns.patch
index de4f9bf..d3ae129 100644
--- a/downstream-netlib-and-dns.patch
+++ b/downstream-netlib-and-dns.patch
@@ -1,4 +1,4 @@
-From ad123366e5fb2694cf6d9f4f292a001a761b78fa Mon Sep 17 00:00:00 2001
+From 2d7e197fa88dccd3ca051f9f7cb97937c35c55a8 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:46:21 -0400
 Subject: [PATCH] [downstream] netlib and dns
diff --git a/krb5.spec b/krb5.spec
index d27bf68..930a581 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -41,8 +41,8 @@
 
 Summary: The Kerberos network authentication system
 Name: krb5
-Version: 1.19.1
-Release: %{?zdpd}15%{?dist}
+Version: 1.19.2
+Release: %{?zdpd}1%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -78,7 +78,6 @@ Patch12: Fix-KCM-flag-transmission-for-remove_cred.patch
 Patch13: Make-KCM-iteration-fallback-work-with-sssd-kcm.patch
 Patch14: Use-KCM_OP_RETRIEVE-in-KCM-client.patch
 Patch15: Fix-KCM-retrieval-support-for-sssd.patch
-Patch16: Fix-doc-build-for-Sphinx-4.0.patch
 Patch17: Move-some-dejagnu-kadmin-tests-to-Python-tests.patch
 Patch18: Fix-some-principal-realm-canonicalization-cases.patch
 Patch19: Allow-kinit-with-keytab-to-defer-canonicalization.patch
@@ -89,11 +88,7 @@ Patch23: Fix-k5tls-module-for-OpenSSL-3.patch
 Patch24: Fix-leaks-on-error-in-kadm5-init-functions.patch
 Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch
 Patch26: Use-asan-in-one-of-the-CI-builds.patch
-Patch27: Using-locking-in-MEMORY-krb5_cc_get_principal.patch
-Patch28: Fix-use-after-free-during-krad-remote_shutdown.patch
 Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch
-Patch30: Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
-Patch31: Fix-defcred-leak-in-krb5-gss_inquire_cred.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -656,6 +651,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Mon Jul 26 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.2-1
+- New upstream version (1.19.2)
+
 * Wed Jul 21 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-15
 - Fix defcred leak in krb5 gss_inquire_cred()
 

From 3cd2cfc1c6a4e703f85109f38583769469113e1e Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Mon, 26 Jul 2021 14:50:12 -0400
Subject: [PATCH 17/22] Add sources

---
 .gitignore | 2 ++
 sources    | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 01d1000..c3c3cb9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -197,3 +197,5 @@ krb5-1.8.3-pdf.tar.gz
 /krb5-1.19.tar.gz.asc
 /krb5-1.19.1.tar.gz
 /krb5-1.19.1.tar.gz.asc
+/krb5-1.19.2.tar.gz
+/krb5-1.19.2.tar.gz.asc
diff --git a/sources b/sources
index e74f7db..16c7a8d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (krb5-1.19.1.tar.gz) = 36bf33802119ada4650a8f69f1daca95aaf882dc96bfa7061f0340a5decd588c31fc10108ddadf1042934e0e2c3bbd975deec565b0a7f0fc2baf8b8cc6d97491
-SHA512 (krb5-1.19.1.tar.gz.asc) = 078924730ce441630b4ac553a76ba0ebacb09b67dd057a53e3cf42185dd80bf423e875bddd306e4e91873797a9c013a7b0cae66134976abdea2c9752028e66c7
+SHA512 (krb5-1.19.2.tar.gz) = b90d6ed0e1e8a87eb5cb2c36d88b823a6a6caabf85e5d419adb8a930f7eea09a5f8491464e7e454cca7ba88be09d19415962fe0036ad2e31fc584f9fc0bbd470
+SHA512 (krb5-1.19.2.tar.gz.asc) = 87c4d096dbb6821401125b8f8a315ce1aac029744ba9670a4f8a2a680e6dd5798e1c6d5d2b68b17fd9a4b3b9c6ff111cd1dcac42f934d48fb20381b3765e0f64

From d693d443474a16e0eed4e384bd0754e6157217cf Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Thu, 19 Aug 2021 12:29:56 -0400
Subject: [PATCH 18/22] Fix KDC null deref on TGS inner body null server
 (CVE-2021-37750)

---
 ...-deref-on-TGS-inner-body-null-server.patch | 45 +++++++++++++++++++
 krb5.spec                                     |  6 ++-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch

diff --git a/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch b/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch
new file mode 100644
index 0000000..24b9d95
--- /dev/null
+++ b/Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch
@@ -0,0 +1,45 @@
+From bb8fa495d00ccd931eec87a01b8920636cf7903e Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 3 Aug 2021 01:15:27 -0400
+Subject: [PATCH] Fix KDC null deref on TGS inner body null server
+
+After the KDC decodes a FAST inner body, it does not check for a null
+server.  Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
+would typically result in an error from krb5_unparse_name(), but with
+the addition of get_local_tgt() it results in a null dereference.  Add
+a null check.
+
+Reported by Joseph Sutton of Catalyst.
+
+CVE-2021-37750:
+
+In MIT krb5 releases 1.14 and later, an authenticated attacker can
+cause a null dereference in the KDC by sending a FAST TGS request with
+no server field.
+
+ticket: 9008 (new)
+tags: pullup
+target_version: 1.19-next
+target_version: 1.18-next
+
+(cherry picked from commit d775c95af7606a51bf79547a94fa52ddd1cb7f49)
+---
+ src/kdc/do_tgs_req.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
+index 6d244ffd4..39a504ca1 100644
+--- a/src/kdc/do_tgs_req.c
++++ b/src/kdc/do_tgs_req.c
+@@ -207,6 +207,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
+         status = "FIND_FAST";
+         goto cleanup;
+     }
++    if (sprinc == NULL) {
++        status = "NULL_SERVER";
++        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
++        goto cleanup;
++    }
+ 
+     errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
+                             &local_tgt, &local_tgt_storage, &local_tgt_key);
diff --git a/krb5.spec b/krb5.spec
index 930a581..37c3b90 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.2
-Release: %{?zdpd}1%{?dist}
+Release: %{?zdpd}2%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -89,6 +89,7 @@ Patch24: Fix-leaks-on-error-in-kadm5-init-functions.patch
 Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch
 Patch26: Use-asan-in-one-of-the-CI-builds.patch
 Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch
+Patch30: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -651,6 +652,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Thu Aug 19 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.2-2
+- Fix KDC null deref on TGS inner body null server (CVE-2021-37750)
+
 * Mon Jul 26 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.2-1
 - New upstream version (1.19.2)
 

From 2deca4e8cd8e0a0c8c0143eb952547603c79df85 Mon Sep 17 00:00:00 2001
From: Julien Rische <jrische@redhat.com>
Date: Wed, 23 Mar 2022 13:16:13 +0100
Subject: [PATCH 19/22] Use SHA-256 instead of SHA-1 for PKINIT CMS digest

CMS digest and signature algorithm for the anonymous PKINIT is changed
from SHA-1 to SHA-256. SHA-1 hasn't been considered secure anymore for
this kind of purposes for some years already.

Resolves: rhbz#2067121

Signed-off-by: Julien Rische <jrische@redhat.com>
---
 ...nstead-of-SHA1-for-PKINIT-CMS-digest.patch | 113 ++++++++++++++++++
 krb5.spec                                     |   6 +-
 2 files changed, 118 insertions(+), 1 deletion(-)
 create mode 100644 Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch

diff --git a/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch b/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch
new file mode 100644
index 0000000..9a16277
--- /dev/null
+++ b/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch
@@ -0,0 +1,113 @@
+From 9a34c4a2464f5c2df139967c9427d1dabb375d57 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Fri, 11 Mar 2022 11:33:56 +0100
+Subject: [PATCH] Use SHA-256 instead of SHA-1 for PKINIT CMS digest
+
+Various organizations including NIST have been strongly recommending to
+stop using SHA-1 for digital signatures for some years already. CMS
+digest is used to generate such signatures, hence it should be upgraded
+to use SHA-256.
+---
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 27 ++++++++++---------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 911e74fd9..3ceba8b0d 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -1234,7 +1234,7 @@ cms_signeddata_create(krb5_context context,
+         /* will not fill-out EVP_PKEY because it's on the smartcard */
+ 
+         /* Set digest algs */
+-        p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha1);
++        p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha256);
+ 
+         if (p7si->digest_alg->parameter != NULL)
+             ASN1_TYPE_free(p7si->digest_alg->parameter);
+@@ -1245,17 +1245,17 @@ cms_signeddata_create(krb5_context context,
+         /* Set sig algs */
+         if (p7si->digest_enc_alg->parameter != NULL)
+             ASN1_TYPE_free(p7si->digest_enc_alg->parameter);
+-        p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha1WithRSAEncryption);
++        p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha256WithRSAEncryption);
+         if (!(p7si->digest_enc_alg->parameter = ASN1_TYPE_new()))
+             goto cleanup;
+         p7si->digest_enc_alg->parameter->type = V_ASN1_NULL;
+ 
+         /* add signed attributes */
+-        /* compute sha1 digest over the EncapsulatedContentInfo */
++        /* compute sha256 digest over the EncapsulatedContentInfo */
+         ctx = EVP_MD_CTX_new();
+         if (ctx == NULL)
+             goto cleanup;
+-        EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
++        EVP_DigestInit_ex(ctx, EVP_sha256(), NULL);
+         EVP_DigestUpdate(ctx, data, data_len);
+         md_tmp = EVP_MD_CTX_md(ctx);
+         EVP_DigestFinal_ex(ctx, md_data, &md_len);
+@@ -1283,9 +1283,10 @@ cms_signeddata_create(krb5_context context,
+             goto cleanup2;
+ 
+ #ifndef WITHOUT_PKCS11
+-        /* Some tokens can only do RSAEncryption without sha1 hash */
+-        /* to compute sha1WithRSAEncryption, encode the algorithm ID for the hash
+-         * function and the hash value into an ASN.1 value of type DigestInfo
++        /* Some tokens can only do RSAEncryption without sha256 hash */
++        /* to compute sha256WithRSAEncryption, encode the algorithm ID for the
++         * hash function and the hash value into an ASN.1 value of type
++         * DigestInfo
+          * DigestInfo::=SEQUENCE {
+          *  digestAlgorithm  AlgorithmIdentifier,
+          *  digest OCTET STRING }
+@@ -1304,7 +1305,7 @@ cms_signeddata_create(krb5_context context,
+             alg = X509_ALGOR_new();
+             if (alg == NULL)
+                 goto cleanup2;
+-            X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha1), V_ASN1_NULL, NULL);
++            X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha256), V_ASN1_NULL, NULL);
+             alg_len = i2d_X509_ALGOR(alg, NULL);
+ 
+             digest = ASN1_OCTET_STRING_new();
+@@ -1333,7 +1334,7 @@ cms_signeddata_create(krb5_context context,
+ #endif
+         {
+             pkiDebug("mech = %s\n",
+-                     id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA1_RSA_PKCS" : "FS");
++                     id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA256_RSA_PKCS" : "FS");
+             retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen,
+                                       &sig, &sig_len);
+         }
+@@ -4147,7 +4148,7 @@ create_signature(unsigned char **sig, unsigned int *sig_len,
+     ctx = EVP_MD_CTX_new();
+     if (ctx == NULL)
+         return ENOMEM;
+-    EVP_SignInit(ctx, EVP_sha1());
++    EVP_SignInit(ctx, EVP_sha256());
+     EVP_SignUpdate(ctx, data, data_len);
+     *sig_len = EVP_PKEY_size(pkey);
+     if ((*sig = malloc(*sig_len)) == NULL)
+@@ -4621,10 +4622,10 @@ pkinit_get_certs_pkcs11(krb5_context context,
+ 
+ #ifndef PKINIT_USE_MECH_LIST
+     /*
+-     * We'd like to use CKM_SHA1_RSA_PKCS for signing if it's available, but
++     * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but
+      * many cards seems to be confused about whether they are capable of
+      * this or not. The safe thing seems to be to ignore the mechanism list,
+-     * always use CKM_RSA_PKCS and calculate the sha1 digest ourselves.
++     * always use CKM_RSA_PKCS and calculate the sha256 digest ourselves.
+      */
+ 
+     id_cryptoctx->mech = CKM_RSA_PKCS;
+@@ -4652,7 +4653,7 @@ pkinit_get_certs_pkcs11(krb5_context context,
+         if (mechp[i] == CKM_RSA_PKCS) {
+             /* This seems backwards... */
+             id_cryptoctx->mech =
+-                (info.flags & CKF_SIGN) ? CKM_SHA1_RSA_PKCS : CKM_RSA_PKCS;
++                (info.flags & CKF_SIGN) ? CKM_SHA256_RSA_PKCS : CKM_RSA_PKCS;
+         }
+     }
+     free(mechp);
+-- 
+2.35.1
+
diff --git a/krb5.spec b/krb5.spec
index 37c3b90..d00606f 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.2
-Release: %{?zdpd}2%{?dist}
+Release: %{?zdpd}3%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -90,6 +90,7 @@ Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch
 Patch26: Use-asan-in-one-of-the-CI-builds.patch
 Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch
 Patch30: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch
+Patch31: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -652,6 +653,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Wed Mar 23 2022 Julien Rische <jrische@redhat.com> - 1.19.2-3
+- Use SHA-256 instead of SHA-1 for PKINIT CMS digest
+
 * Thu Aug 19 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.2-2
 - Fix KDC null deref on TGS inner body null server (CVE-2021-37750)
 

From e66c7a3a8103d28eda7651540791d9d8c47183f4 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Tue, 5 Apr 2022 09:23:01 +0300
Subject: [PATCH 20/22] Allow use of larger RADIUS attributes in krad library

    In kr_attrset_decode(), explicitly treat the length byte as unsigned.
    Otherwise attributes longer than 125 characters will be rejected with
    EBADMSG.

    Add a 253-character-long NAS-Identifier attribute to the tests to make
    sure that attributes with the maximal number of characters are working
    as expected.

    [ghudson@mit.edu: used uint8_t cast per current practices; edited
    commit message]

    ticket: 9036 (new)

From upstream, needed in preparation for OAuth2 support for FreeIPA and
SSSD.

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
---
 krb5-krad-larger-attrs.patch | 69 ++++++++++++++++++++++++++++++++++++
 krb5.spec                    |  6 +++-
 2 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 krb5-krad-larger-attrs.patch

diff --git a/krb5-krad-larger-attrs.patch b/krb5-krad-larger-attrs.patch
new file mode 100644
index 0000000..32111ec
--- /dev/null
+++ b/krb5-krad-larger-attrs.patch
@@ -0,0 +1,69 @@
+From f35077bfc570205092eca2a9d44e50ce265622f4 Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Mon, 8 Nov 2021 17:48:50 +0100
+Subject: [PATCH] Support larger RADIUS attributes in libkrad
+
+In kr_attrset_decode(), explicitly treat the length byte as unsigned.
+Otherwise attributes longer than 125 characters will be rejected with
+EBADMSG.
+
+Add a 253-character-long NAS-Identifier attribute to the tests to make
+sure that attributes with the maximal number of characters are working
+as expected.
+
+[ghudson@mit.edu: used uint8_t cast per current practices; edited
+commit message]
+
+ticket: 9036 (new)
+---
+ src/lib/krad/attrset.c  |  2 +-
+ src/lib/krad/t_packet.c | 13 +++++++++++++
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c
+index 03c613716..f309f1581 100644
+--- a/src/lib/krad/attrset.c
++++ b/src/lib/krad/attrset.c
+@@ -217,7 +217,7 @@ kr_attrset_decode(krb5_context ctx, const krb5_data *in, const char *secret,
+ 
+     for (i = 0; i + 2 < in->length; ) {
+         type = in->data[i++];
+-        tmp = make_data(&in->data[i + 1], in->data[i] - 2);
++        tmp = make_data(&in->data[i + 1], (uint8_t)in->data[i] - 2);
+         i += tmp.length + 1;
+ 
+         retval = (in->length < i) ? EBADMSG : 0;
+diff --git a/src/lib/krad/t_packet.c b/src/lib/krad/t_packet.c
+index 0a92e9cc2..c22489144 100644
+--- a/src/lib/krad/t_packet.c
++++ b/src/lib/krad/t_packet.c
+@@ -57,6 +57,14 @@ make_packet(krb5_context ctx, const krb5_data *username,
+     krb5_error_code retval;
+     const krb5_data *data;
+     int i = 0;
++    krb5_data nas_id;
++
++    nas_id = string2data("12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "123");
+ 
+     retval = krad_attrset_new(ctx, &set);
+     if (retval != 0)
+@@ -71,6 +79,11 @@ make_packet(krb5_context ctx, const krb5_data *username,
+     if (retval != 0)
+         goto out;
+ 
++    retval = krad_attrset_add(set, krad_attr_name2num("NAS-Identifier"),
++                              &nas_id);
++    if (retval != 0)
++        goto out;
++
+     retval = krad_packet_new_request(ctx, "foo",
+                                      krad_code_name2num("Access-Request"),
+                                      set, iterator, &i, &tmp);
+-- 
+2.35.1
+
diff --git a/krb5.spec b/krb5.spec
index d00606f..43efc62 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.2
-Release: %{?zdpd}3%{?dist}
+Release: %{?zdpd}4%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -91,6 +91,7 @@ Patch26: Use-asan-in-one-of-the-CI-builds.patch
 Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch
 Patch30: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch
 Patch31: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch
+Patch32: krb5-krad-larger-attrs.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -653,6 +654,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Tue Apr 05 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-4
+- Allow use of larger RADIUS attributes in krad library
+
 * Wed Mar 23 2022 Julien Rische <jrische@redhat.com> - 1.19.2-3
 - Use SHA-256 instead of SHA-1 for PKINIT CMS digest
 

From 114b35c4361f28b0fe967f13a769ee77030d90b0 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Tue, 5 Apr 2022 22:14:44 +0300
Subject: [PATCH 21/22] Fix libkrad client cleanup code

Resolves: rhbz#2072059

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
---
 krb5-krad-remote.patch | 209 +++++++++++++++++++++++++++++++++++++++++
 krb5.spec              |   9 +-
 2 files changed, 216 insertions(+), 2 deletions(-)
 create mode 100644 krb5-krad-remote.patch

diff --git a/krb5-krad-remote.patch b/krb5-krad-remote.patch
new file mode 100644
index 0000000..42452ff
--- /dev/null
+++ b/krb5-krad-remote.patch
@@ -0,0 +1,209 @@
+From ce160f8826bae223876a6527a731c36b6912db15 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 9 Nov 2021 13:00:43 -0500
+Subject: [PATCH 1/2] Avoid use after free during libkrad cleanup
+
+libkrad client requests contain a list of references to remotes, with
+no back-references or reference counts.  To prevent accesses to
+dangling references during cleanup, cancel all requests on all remotes
+before freeing any remotes.
+
+Remove the code for aging out unused servers.  This code was fairly
+safe as all requests referencing a remote should have completed or
+timed out during an hour of disuse, but in the current design we have
+no way to guarantee or check that.  The set of addresses we send
+RADIUS requests to will generally be small, so aging out servers is
+unnecessary.
+
+ticket: 9035 (new)
+---
+ src/lib/krad/client.c   | 42 ++++++++++++++---------------------------
+ src/lib/krad/internal.h |  4 ++++
+ src/lib/krad/remote.c   | 11 ++++++++---
+ 3 files changed, 26 insertions(+), 31 deletions(-)
+
+diff --git a/src/lib/krad/client.c b/src/lib/krad/client.c
+index 6365dd1c6..810940afc 100644
+--- a/src/lib/krad/client.c
++++ b/src/lib/krad/client.c
+@@ -64,7 +64,6 @@ struct request_st {
+ 
+ struct server_st {
+     krad_remote *serv;
+-    time_t last;
+     K5_LIST_ENTRY(server_st) list;
+ };
+ 
+@@ -81,15 +80,10 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret,
+            krad_remote **out)
+ {
+     krb5_error_code retval;
+-    time_t currtime;
+     server *srv;
+ 
+-    if (time(&currtime) == (time_t)-1)
+-        return errno;
+-
+     K5_LIST_FOREACH(srv, &rc->servers, list) {
+         if (kr_remote_equals(srv->serv, ai, secret)) {
+-            srv->last = currtime;
+             *out = srv->serv;
+             return 0;
+         }
+@@ -98,7 +92,6 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret,
+     srv = calloc(1, sizeof(server));
+     if (srv == NULL)
+         return ENOMEM;
+-    srv->last = currtime;
+ 
+     retval = kr_remote_new(rc->kctx, rc->vctx, ai, secret, &srv->serv);
+     if (retval != 0) {
+@@ -173,28 +166,12 @@ request_new(krad_client *rc, krad_code code, const krad_attrset *attrs,
+     return 0;
+ }
+ 
+-/* Close remotes that haven't been used in a while. */
+-static void
+-age(struct server_head *head, time_t currtime)
+-{
+-    server *srv, *tmp;
+-
+-    K5_LIST_FOREACH_SAFE(srv, head, list, tmp) {
+-        if (currtime == (time_t)-1 || currtime - srv->last > 60 * 60) {
+-            K5_LIST_REMOVE(srv, list);
+-            kr_remote_free(srv->serv);
+-            free(srv);
+-        }
+-    }
+-}
+-
+ /* Handle a response from a server (or related errors). */
+ static void
+ on_response(krb5_error_code retval, const krad_packet *reqp,
+             const krad_packet *rspp, void *data)
+ {
+     request *req = data;
+-    time_t currtime;
+     size_t i;
+ 
+     /* Do nothing if we are already completed. */
+@@ -221,10 +198,6 @@ on_response(krb5_error_code retval, const krad_packet *reqp,
+     for (i = 0; req->remotes[i].remote != NULL; i++)
+         kr_remote_cancel(req->remotes[i].remote, req->remotes[i].packet);
+ 
+-    /* Age out servers that haven't been used in a while. */
+-    if (time(&currtime) != (time_t)-1)
+-        age(&req->rc->servers, currtime);
+-
+     request_free(req);
+ }
+ 
+@@ -247,10 +220,23 @@ krad_client_new(krb5_context kctx, verto_ctx *vctx, krad_client **out)
+ void
+ krad_client_free(krad_client *rc)
+ {
++    server *srv;
++
+     if (rc == NULL)
+         return;
+ 
+-    age(&rc->servers, -1);
++    /* Cancel all requests before freeing any remotes, since each request's
++     * callback data may contain references to multiple remotes. */
++    K5_LIST_FOREACH(srv, &rc->servers, list)
++        kr_remote_cancel_all(srv->serv);
++
++    while (!K5_LIST_EMPTY(&rc->servers)) {
++        srv = K5_LIST_FIRST(&rc->servers);
++        K5_LIST_REMOVE(srv, list);
++        kr_remote_free(srv->serv);
++        free(srv);
++    }
++
+     free(rc);
+ }
+ 
+diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h
+index 0143d155a..7619563fc 100644
+--- a/src/lib/krad/internal.h
++++ b/src/lib/krad/internal.h
+@@ -109,6 +109,10 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs,
+ void
+ kr_remote_cancel(krad_remote *rr, const krad_packet *pkt);
+ 
++/* Cancel all requests awaiting responses. */
++void
++kr_remote_cancel_all(krad_remote *rr);
++
+ /* Determine if this remote object refers to the remote resource identified
+  * by the addrinfo struct and the secret. */
+ krb5_boolean
+diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
+index 7e491e994..06ae751bc 100644
+--- a/src/lib/krad/remote.c
++++ b/src/lib/krad/remote.c
+@@ -421,15 +421,20 @@ error:
+     return retval;
+ }
+ 
++void
++kr_remote_cancel_all(krad_remote *rr)
++{
++    while (!K5_TAILQ_EMPTY(&rr->list))
++        request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL);
++}
++
+ void
+ kr_remote_free(krad_remote *rr)
+ {
+     if (rr == NULL)
+         return;
+ 
+-    while (!K5_TAILQ_EMPTY(&rr->list))
+-        request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL);
+-
++    kr_remote_cancel_all(rr);
+     free(rr->secret);
+     if (rr->info != NULL)
+         free(rr->info->ai_addr);
+-- 
+2.35.1
+
+
+From e0084425df784952e76b3bcc8ae9d08300234733 Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Mon, 8 Nov 2021 17:47:17 +0100
+Subject: [PATCH 2/2] More python3 fixes for t_daemon.py
+
+[ghudson@mit.edu: use a list comprehension instead of map()]
+---
+ src/lib/krad/t_daemon.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/lib/krad/t_daemon.py b/src/lib/krad/t_daemon.py
+index 7668cd7f8..4a3de079c 100755
+--- a/src/lib/krad/t_daemon.py
++++ b/src/lib/krad/t_daemon.py
+@@ -50,7 +50,7 @@ class TestServer(server.Server):
+ 
+         for key in pkt.keys():
+             if key == "User-Password":
+-                passwd = map(pkt.PwDecrypt, pkt[key])
++                passwd = [pkt.PwDecrypt(x) for x in pkt[key]]
+ 
+         reply = self.CreateReplyPacket(pkt)
+         if passwd == ['accept']:
+@@ -61,8 +61,8 @@ class TestServer(server.Server):
+ 
+ srv = TestServer(addresses=["localhost"],
+                  hosts={"127.0.0.1":
+-                        server.RemoteHost("127.0.0.1", "foo", "localhost")},
+-                 dict=dictionary.Dictionary(StringIO.StringIO(DICTIONARY)))
++                        server.RemoteHost("127.0.0.1", b"foo", "localhost")},
++                 dict=dictionary.Dictionary(StringIO(DICTIONARY)))
+ 
+ # Write a sentinel character to let the parent process know we're listening.
+ sys.stdout.write("~")
+-- 
+2.35.1
+
diff --git a/krb5.spec b/krb5.spec
index 43efc62..5d637fa 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.2
-Release: %{?zdpd}4%{?dist}
+Release: %{?zdpd}5%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -91,7 +91,8 @@ Patch26: Use-asan-in-one-of-the-CI-builds.patch
 Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch
 Patch30: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch
 Patch31: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch
-Patch32: krb5-krad-larger-attrs.patch
+Patch32: krb5-krad-remote.patch
+Patch33: krb5-krad-larger-attrs.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -654,6 +655,10 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Tue Apr 05 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-5
+- Fix libkrad client cleanup
+- Fixes rhbz#2072059
+
 * Tue Apr 05 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-4
 - Allow use of larger RADIUS attributes in krad library
 

From ee9e3fc1e187256a7a88fc63972e1179ab6dc4ce Mon Sep 17 00:00:00 2001
From: Julien Rische <jrische@redhat.com>
Date: Wed, 20 Apr 2022 17:17:09 +0200
Subject: [PATCH 22/22] Try harder to avoid password change replay errors

change_set_password() was changed to prefer TCP.  However, because
UDP_LAST falls back to UDP after one second, we can still get a replay
error due to a dropped packet, before the TCP layer has a chance to
retry.

Instead, try k5_sendto() with NO_UDP, and only fall back to UDP after
TCP fails completely without reaching a server.  In sendto_kdc.c,
implement an ONLY_UDP transport strategy to allow the UDP fallback.

Resolves: rhbz#2076965

Signed-off-by: Julien Rische <jrische@redhat.com>
---
 ...-avoid-password-change-replay-errors.patch | 91 +++++++++++++++++++
 krb5.spec                                     |  7 +-
 2 files changed, 97 insertions(+), 1 deletion(-)
 create mode 100644 Try-harder-to-avoid-password-change-replay-errors.patch

diff --git a/Try-harder-to-avoid-password-change-replay-errors.patch b/Try-harder-to-avoid-password-change-replay-errors.patch
new file mode 100644
index 0000000..aa84aca
--- /dev/null
+++ b/Try-harder-to-avoid-password-change-replay-errors.patch
@@ -0,0 +1,91 @@
+From 8c055cea87da5d27dd4b039819e79508f68e14c6 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 4 Mar 2022 00:45:00 -0500
+Subject: [PATCH] Try harder to avoid password change replay errors
+
+Commit d7b3018d338fc9c989c3fa17505870f23c3759a8 (ticket 7905) changed
+change_set_password() to prefer TCP.  However, because UDP_LAST falls
+back to UDP after one second, we can still get a replay error due to a
+dropped packet, before the TCP layer has a chance to retry.
+
+Instead, try k5_sendto() with NO_UDP, and only fall back to UDP after
+TCP fails completely without reaching a server.  In sendto_kdc.c,
+implement an ONLY_UDP transport strategy to allow the UDP fallback.
+
+ticket: 9037
+---
+ src/lib/krb5/os/changepw.c   |  9 ++++++++-
+ src/lib/krb5/os/os-proto.h   |  1 +
+ src/lib/krb5/os/sendto_kdc.c | 12 ++++++++----
+ 3 files changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c
+index 9f968da7f..c59232586 100644
+--- a/src/lib/krb5/os/changepw.c
++++ b/src/lib/krb5/os/changepw.c
+@@ -255,9 +255,16 @@ change_set_password(krb5_context context,
+     callback_info.pfn_cleanup = kpasswd_sendto_msg_cleanup;
+     krb5_free_data_contents(callback_ctx.context, &chpw_rep);
+ 
++    /* UDP retransmits may be seen as replays.  Only try UDP after other
++     * transports fail completely. */
+     code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm,
+-                     &sl, UDP_LAST, &callback_info, &chpw_rep,
++                     &sl, NO_UDP, &callback_info, &chpw_rep,
+                      ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL);
++    if (code == KRB5_KDC_UNREACH) {
++        code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm,
++                         &sl, ONLY_UDP, &callback_info, &chpw_rep,
++                         ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL);
++    }
+     if (code)
+         goto cleanup;
+ 
+diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h
+index a985f2aec..91d2791ce 100644
+--- a/src/lib/krb5/os/os-proto.h
++++ b/src/lib/krb5/os/os-proto.h
+@@ -49,6 +49,7 @@ typedef enum {
+     UDP_FIRST = 0,
+     UDP_LAST,
+     NO_UDP,
++    ONLY_UDP
+ } k5_transport_strategy;
+ 
+ /* A single server hostname or address. */
+diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
+index 0eedec175..c7f5d861a 100644
+--- a/src/lib/krb5/os/sendto_kdc.c
++++ b/src/lib/krb5/os/sendto_kdc.c
+@@ -802,11 +802,14 @@ resolve_server(krb5_context context, const krb5_data *realm,
+     int err, result;
+     char portbuf[PORT_LENGTH];
+ 
+-    /* Skip UDP entries if we don't want UDP. */
++    /* Skip entries excluded by the strategy. */
+     if (strategy == NO_UDP && entry->transport == UDP)
+         return 0;
++    if (strategy == ONLY_UDP && entry->transport != UDP &&
++        entry->transport != TCP_OR_UDP)
++        return 0;
+ 
+-    transport = (strategy == UDP_FIRST) ? UDP : TCP;
++    transport = (strategy == UDP_FIRST || strategy == ONLY_UDP) ? UDP : TCP;
+     if (entry->hostname == NULL) {
+         /* Added by a module, so transport is either TCP or UDP. */
+         ai.ai_socktype = socktype_for_transport(entry->transport);
+@@ -850,8 +853,9 @@ resolve_server(krb5_context context, const krb5_data *realm,
+     }
+ 
+     /* For TCP_OR_UDP entries, add each address again with the non-preferred
+-     * transport, unless we are avoiding UDP.  Flag these as deferred. */
+-    if (retval == 0 && entry->transport == TCP_OR_UDP && strategy != NO_UDP) {
++     * transport, if there is one.  Flag these as deferred. */
++    if (retval == 0 && entry->transport == TCP_OR_UDP &&
++        (strategy == UDP_FIRST || strategy == UDP_LAST)) {
+         transport = (strategy == UDP_FIRST) ? TCP : UDP;
+         for (a = addrs; a != 0 && retval == 0; a = a->ai_next) {
+             a->ai_socktype = socktype_for_transport(transport);
+-- 
+2.35.1
+
diff --git a/krb5.spec b/krb5.spec
index 5d637fa..550cc74 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.2
-Release: %{?zdpd}5%{?dist}
+Release: %{?zdpd}6%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -93,6 +93,7 @@ Patch30: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch
 Patch31: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch
 Patch32: krb5-krad-remote.patch
 Patch33: krb5-krad-larger-attrs.patch
+Patch34: Try-harder-to-avoid-password-change-replay-errors.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -655,6 +656,10 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Wed Apr 20 2022 Julien Rische <jrische@redhat.com> - 1.19.2-6
+- Try harder to avoid password change replay errors
+- Resolves: rhbz#2076965
+
 * Tue Apr 05 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-5
 - Fix libkrad client cleanup
 - Fixes rhbz#2072059