diff --git a/Fix-integer-overflows-in-PAC-parsing.patch b/Fix-integer-overflows-in-PAC-parsing.patch new file mode 100644 index 0000000..b5191aa --- /dev/null +++ b/Fix-integer-overflows-in-PAC-parsing.patch @@ -0,0 +1,106 @@ +From ecb5e0d78edb35a5570b581e144f6de68d44ddc8 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Mon, 17 Oct 2022 20:25:11 -0400 +Subject: [PATCH] Fix integer overflows in PAC parsing + +In krb5_parse_pac(), check for buffer counts large enough to threaten +integer overflow in the header length and memory length calculations. +Avoid potential integer overflows when checking the length of each +buffer. + +CVE-2022-42898: + +In MIT krb5 releases 1.8 and later, an authenticated attacker may be +able to cause a KDC or kadmind process to crash by reading beyond the +bounds of allocated memory, creating a denial of service. A +privileged attacker may similarly be able to cause a Kerberos or GSS +application service to crash. On 32-bit platforms, an attacker can +also cause insufficient memory to be allocated for the result, +potentially leading to remote code execution in a KDC, kadmind, or GSS +or Kerberos application server process. An attacker with the +privileges of a cross-realm KDC may be able to extract secrets from +the KDC process's memory by having them copied into the PAC of a new +ticket. + +ticket: 9074 (new) +tags: pullup +target_version: 1.20-next +target_version: 1.19-next +--- + src/lib/krb5/krb/pac.c | 9 +++++++-- + src/lib/krb5/krb/t_pac.c | 18 ++++++++++++++++++ + 2 files changed, 25 insertions(+), 2 deletions(-) + +diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c +index 950beda657..1b9ef12276 100644 +--- a/src/lib/krb5/krb/pac.c ++++ b/src/lib/krb5/krb/pac.c +@@ -27,6 +27,8 @@ + #include "k5-int.h" + #include "authdata.h" + ++#define MAX_BUFFERS 4096 ++ + /* draft-brezak-win2k-krb-authz-00 */ + + /* +@@ -316,6 +318,9 @@ krb5_pac_parse(krb5_context context, + if (version != 0) + return EINVAL; + ++ if (cbuffers < 1 || cbuffers > MAX_BUFFERS) ++ return ERANGE; ++ + header_len = PACTYPE_LENGTH + (cbuffers * PAC_INFO_BUFFER_LENGTH); + if (len < header_len) + return ERANGE; +@@ -348,8 +353,8 @@ krb5_pac_parse(krb5_context context, + krb5_pac_free(context, pac); + return EINVAL; + } +- if (buffer->Offset < header_len || +- buffer->Offset + buffer->cbBufferSize > len) { ++ if (buffer->Offset < header_len || buffer->Offset > len || ++ buffer->cbBufferSize > len - buffer->Offset) { + krb5_pac_free(context, pac); + return ERANGE; + } +diff --git a/src/lib/krb5/krb/t_pac.c b/src/lib/krb5/krb/t_pac.c +index ee47152ee4..ccd165380d 100644 +--- a/src/lib/krb5/krb/t_pac.c ++++ b/src/lib/krb5/krb/t_pac.c +@@ -431,6 +431,16 @@ static const unsigned char s4u_pac_ent_xrealm[] = { + 0x8a, 0x81, 0x9c, 0x9c, 0x00, 0x00, 0x00, 0x00 + }; + ++static const unsigned char fuzz1[] = { ++ 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, ++ 0x06, 0xff, 0xff, 0xff, 0x00, 0x00, 0xf5 ++}; ++ ++static const unsigned char fuzz2[] = { ++ 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, ++ 0x20, 0x20 ++}; ++ + static const char *s4u_principal = "w2k8u@ACME.COM"; + static const char *s4u_enterprise = "w2k8u@abc@ACME.COM"; + +@@ -646,6 +656,14 @@ main(int argc, char **argv) + krb5_free_principal(context, sep); + } + ++ /* Check problematic PACs found by fuzzing. */ ++ ret = krb5_pac_parse(context, fuzz1, sizeof(fuzz1), &pac); ++ if (!ret) ++ err(context, ret, "krb5_pac_parse should have failed"); ++ ret = krb5_pac_parse(context, fuzz2, sizeof(fuzz2), &pac); ++ if (!ret) ++ err(context, ret, "krb5_pac_parse should have failed"); ++ + /* + * Test empty free + */ +-- +2.37.3 + diff --git a/Read-GSS-configuration-files-with-mtime-0.patch b/Read-GSS-configuration-files-with-mtime-0.patch new file mode 100644 index 0000000..752345d --- /dev/null +++ b/Read-GSS-configuration-files-with-mtime-0.patch @@ -0,0 +1,71 @@ +From e90c4449c4f2252de21631915f76a6644bafe320 Mon Sep 17 00:00:00 2001 +From: Simo Sorce +Date: Thu, 19 May 2022 12:27:40 -0400 +Subject: [PATCH] Read GSS configuration files with mtime 0 + +There is at least one case (with flatpaks) where configuration files +in the special read-only /etc all have an mtime of 0. Using an +initial last modified time of 0 in g_initialize.c causes these files +to never be read. + +Change the initial high value to the be the "invalid" value +(time_t)-1. Since the C and POSIX standards do not require time_t to +be signed, special-case the checks in load_if_changed() and +updateMechList() to treat all mod times as newer than -1. + +[ghudson@mit.edu: edited commit message; slightly modified approach] + +ticket: 9060 (new) +target_version: 1.20 +tags: pullup +--- + src/lib/gssapi/mechglue/g_initialize.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c +index 6d49700a5..857d4a4f2 100644 +--- a/src/lib/gssapi/mechglue/g_initialize.c ++++ b/src/lib/gssapi/mechglue/g_initialize.c +@@ -93,7 +93,7 @@ static void free_mechSet(void); + static gss_mech_info g_mechList = NULL; + static gss_mech_info g_mechListTail = NULL; + static k5_mutex_t g_mechListLock = K5_MUTEX_PARTIAL_INITIALIZER; +-static time_t g_confFileModTime = (time_t)0; ++static time_t g_confFileModTime = (time_t)-1; + static time_t g_confLastCall = (time_t)0; + + static gss_OID_set_desc g_mechSet = { 0, NULL }; +@@ -469,9 +469,9 @@ load_if_changed(const char *pathname, time_t last, time_t *highest) + mtime = check_link_mtime(pathname, &mtime); + if (mtime == (time_t)-1) + return; +- if (mtime > *highest) ++ if (mtime > *highest || *highest == (time_t)-1) + *highest = mtime; +- if (mtime > last) ++ if (mtime > last || last == (time_t)-1) + loadConfigFile(pathname); + } + +@@ -482,7 +482,7 @@ static void + loadConfigFiles() + { + glob_t globbuf; +- time_t highest = 0, now; ++ time_t highest = (time_t)-1, now; + char **path; + const char *val; + +@@ -522,7 +522,8 @@ updateMechList(void) + + #if defined(_WIN32) + time_t lastConfModTime = getRegConfigModTime(MECH_KEY); +- if (g_confFileModTime >= lastConfModTime) ++ if (g_confFileModTime >= lastConfModTime && ++ g_confFileModTime != (time_t)-1) + return; + g_confFileModTime = lastConfModTime; + loadConfigFromRegistry(HKEY_CURRENT_USER, MECH_KEY); +-- +2.35.3 + diff --git a/Try-harder-to-avoid-password-change-replay-errors.patch b/Try-harder-to-avoid-password-change-replay-errors.patch new file mode 100644 index 0000000..298de34 --- /dev/null +++ b/Try-harder-to-avoid-password-change-replay-errors.patch @@ -0,0 +1,91 @@ +From 4c2efa452d484d3acf5a0c7d0895510dac41a739 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 4 Mar 2022 00:45:00 -0500 +Subject: [PATCH] Try harder to avoid password change replay errors + +Commit d7b3018d338fc9c989c3fa17505870f23c3759a8 (ticket 7905) changed +change_set_password() to prefer TCP. However, because UDP_LAST falls +back to UDP after one second, we can still get a replay error due to a +dropped packet, before the TCP layer has a chance to retry. + +Instead, try k5_sendto() with NO_UDP, and only fall back to UDP after +TCP fails completely without reaching a server. In sendto_kdc.c, +implement an ONLY_UDP transport strategy to allow the UDP fallback. + +ticket: 9037 +--- + src/lib/krb5/os/changepw.c | 9 ++++++++- + src/lib/krb5/os/os-proto.h | 1 + + src/lib/krb5/os/sendto_kdc.c | 12 ++++++++---- + 3 files changed, 17 insertions(+), 5 deletions(-) + +diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c +index 9f968da7f..c59232586 100644 +--- a/src/lib/krb5/os/changepw.c ++++ b/src/lib/krb5/os/changepw.c +@@ -255,9 +255,16 @@ change_set_password(krb5_context context, + callback_info.pfn_cleanup = kpasswd_sendto_msg_cleanup; + krb5_free_data_contents(callback_ctx.context, &chpw_rep); + ++ /* UDP retransmits may be seen as replays. Only try UDP after other ++ * transports fail completely. */ + code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, +- &sl, UDP_LAST, &callback_info, &chpw_rep, ++ &sl, NO_UDP, &callback_info, &chpw_rep, + ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); ++ if (code == KRB5_KDC_UNREACH) { ++ code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, ++ &sl, ONLY_UDP, &callback_info, &chpw_rep, ++ ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); ++ } + if (code) + goto cleanup; + +diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h +index a985f2aec..91d2791ce 100644 +--- a/src/lib/krb5/os/os-proto.h ++++ b/src/lib/krb5/os/os-proto.h +@@ -49,6 +49,7 @@ typedef enum { + UDP_FIRST = 0, + UDP_LAST, + NO_UDP, ++ ONLY_UDP + } k5_transport_strategy; + + /* A single server hostname or address. */ +diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c +index 0eedec175..c7f5d861a 100644 +--- a/src/lib/krb5/os/sendto_kdc.c ++++ b/src/lib/krb5/os/sendto_kdc.c +@@ -802,11 +802,14 @@ resolve_server(krb5_context context, const krb5_data *realm, + int err, result; + char portbuf[PORT_LENGTH]; + +- /* Skip UDP entries if we don't want UDP. */ ++ /* Skip entries excluded by the strategy. */ + if (strategy == NO_UDP && entry->transport == UDP) + return 0; ++ if (strategy == ONLY_UDP && entry->transport != UDP && ++ entry->transport != TCP_OR_UDP) ++ return 0; + +- transport = (strategy == UDP_FIRST) ? UDP : TCP; ++ transport = (strategy == UDP_FIRST || strategy == ONLY_UDP) ? UDP : TCP; + if (entry->hostname == NULL) { + /* Added by a module, so transport is either TCP or UDP. */ + ai.ai_socktype = socktype_for_transport(entry->transport); +@@ -850,8 +853,9 @@ resolve_server(krb5_context context, const krb5_data *realm, + } + + /* For TCP_OR_UDP entries, add each address again with the non-preferred +- * transport, unless we are avoiding UDP. Flag these as deferred. */ +- if (retval == 0 && entry->transport == TCP_OR_UDP && strategy != NO_UDP) { ++ * transport, if there is one. Flag these as deferred. */ ++ if (retval == 0 && entry->transport == TCP_OR_UDP && ++ (strategy == UDP_FIRST || strategy == UDP_LAST)) { + transport = (strategy == UDP_FIRST) ? TCP : UDP; + for (a = addrs; a != 0 && retval == 0; a = a->ai_next) { + a->ai_socktype = socktype_for_transport(transport); +-- +2.35.1 + diff --git a/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch b/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch new file mode 100644 index 0000000..f798819 --- /dev/null +++ b/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch @@ -0,0 +1,113 @@ +From d2fafab4eaf031a662b35cd53200d4d8178bfd6c Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Fri, 11 Mar 2022 11:33:56 +0100 +Subject: [PATCH] Use SHA-256 instead of SHA-1 for PKINIT CMS digest + +Various organizations including NIST have been strongly recommending to +stop using SHA-1 for digital signatures for some years already. CMS +digest is used to generate such signatures, hence it should be upgraded +to use SHA-256. +--- + .../preauth/pkinit/pkinit_crypto_openssl.c | 27 ++++++++++--------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 911e74fd9..3ceba8b0d 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -1234,7 +1234,7 @@ cms_signeddata_create(krb5_context context, + /* will not fill-out EVP_PKEY because it's on the smartcard */ + + /* Set digest algs */ +- p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha1); ++ p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha256); + + if (p7si->digest_alg->parameter != NULL) + ASN1_TYPE_free(p7si->digest_alg->parameter); +@@ -1245,17 +1245,17 @@ cms_signeddata_create(krb5_context context, + /* Set sig algs */ + if (p7si->digest_enc_alg->parameter != NULL) + ASN1_TYPE_free(p7si->digest_enc_alg->parameter); +- p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha1WithRSAEncryption); ++ p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha256WithRSAEncryption); + if (!(p7si->digest_enc_alg->parameter = ASN1_TYPE_new())) + goto cleanup; + p7si->digest_enc_alg->parameter->type = V_ASN1_NULL; + + /* add signed attributes */ +- /* compute sha1 digest over the EncapsulatedContentInfo */ ++ /* compute sha256 digest over the EncapsulatedContentInfo */ + ctx = EVP_MD_CTX_new(); + if (ctx == NULL) + goto cleanup; +- EVP_DigestInit_ex(ctx, EVP_sha1(), NULL); ++ EVP_DigestInit_ex(ctx, EVP_sha256(), NULL); + EVP_DigestUpdate(ctx, data, data_len); + md_tmp = EVP_MD_CTX_md(ctx); + EVP_DigestFinal_ex(ctx, md_data, &md_len); +@@ -1283,9 +1283,10 @@ cms_signeddata_create(krb5_context context, + goto cleanup2; + + #ifndef WITHOUT_PKCS11 +- /* Some tokens can only do RSAEncryption without sha1 hash */ +- /* to compute sha1WithRSAEncryption, encode the algorithm ID for the hash +- * function and the hash value into an ASN.1 value of type DigestInfo ++ /* Some tokens can only do RSAEncryption without sha256 hash */ ++ /* to compute sha256WithRSAEncryption, encode the algorithm ID for the ++ * hash function and the hash value into an ASN.1 value of type ++ * DigestInfo + * DigestInfo::=SEQUENCE { + * digestAlgorithm AlgorithmIdentifier, + * digest OCTET STRING } +@@ -1304,7 +1305,7 @@ cms_signeddata_create(krb5_context context, + alg = X509_ALGOR_new(); + if (alg == NULL) + goto cleanup2; +- X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha1), V_ASN1_NULL, NULL); ++ X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha256), V_ASN1_NULL, NULL); + alg_len = i2d_X509_ALGOR(alg, NULL); + + digest = ASN1_OCTET_STRING_new(); +@@ -1333,7 +1334,7 @@ cms_signeddata_create(krb5_context context, + #endif + { + pkiDebug("mech = %s\n", +- id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA1_RSA_PKCS" : "FS"); ++ id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA256_RSA_PKCS" : "FS"); + retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen, + &sig, &sig_len); + } +@@ -4147,7 +4148,7 @@ create_signature(unsigned char **sig, unsigned int *sig_len, + ctx = EVP_MD_CTX_new(); + if (ctx == NULL) + return ENOMEM; +- EVP_SignInit(ctx, EVP_sha1()); ++ EVP_SignInit(ctx, EVP_sha256()); + EVP_SignUpdate(ctx, data, data_len); + *sig_len = EVP_PKEY_size(pkey); + if ((*sig = malloc(*sig_len)) == NULL) +@@ -4621,10 +4622,10 @@ pkinit_get_certs_pkcs11(krb5_context context, + + #ifndef PKINIT_USE_MECH_LIST + /* +- * We'd like to use CKM_SHA1_RSA_PKCS for signing if it's available, but ++ * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but + * many cards seems to be confused about whether they are capable of + * this or not. The safe thing seems to be to ignore the mechanism list, +- * always use CKM_RSA_PKCS and calculate the sha1 digest ourselves. ++ * always use CKM_RSA_PKCS and calculate the sha256 digest ourselves. + */ + + id_cryptoctx->mech = CKM_RSA_PKCS; +@@ -4652,7 +4653,7 @@ pkinit_get_certs_pkcs11(krb5_context context, + if (mechp[i] == CKM_RSA_PKCS) { + /* This seems backwards... */ + id_cryptoctx->mech = +- (info.flags & CKF_SIGN) ? CKM_SHA1_RSA_PKCS : CKM_RSA_PKCS; ++ (info.flags & CKF_SIGN) ? CKM_SHA256_RSA_PKCS : CKM_RSA_PKCS; + } + } + free(mechp); +-- +2.35.1 + diff --git a/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch b/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch new file mode 100644 index 0000000..4317a3b --- /dev/null +++ b/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch @@ -0,0 +1,81 @@ +From 086c6b5008d53b748bec1ea03e55c73c5326ceb2 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 5 May 2022 17:15:12 +0200 +Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection with FIPS + +libkrad allows to establish connections only to UNIX socket in FIPS +mode, because MD5 digest is not considered safe enough to be used for +network communication. However, FreeRadius requires connection on TCP or +UDP ports. + +This commit allows TCP or UDP connections in FIPS mode if destination is +localhost. + +Resolves: rhbz#2082189 +--- + src/lib/krad/remote.c | 35 +++++++++++++++++++++++++++++++++-- + 1 file changed, 33 insertions(+), 2 deletions(-) + +diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c +index 6f9354e54..c7f3c8f5f 100644 +--- a/src/lib/krad/remote.c ++++ b/src/lib/krad/remote.c +@@ -33,6 +33,7 @@ + + #include + #include ++#include + + #include + +@@ -74,6 +75,35 @@ on_io(verto_ctx *ctx, verto_ev *ev); + static void + on_timeout(verto_ctx *ctx, verto_ev *ev); + ++static in_addr_t get_in_addr(struct addrinfo *info) ++{ return ((struct sockaddr_in *)(info->ai_addr))->sin_addr.s_addr; } ++ ++static struct in6_addr *get_in6_addr(struct addrinfo *info) ++{ return &(((struct sockaddr_in6 *)(info->ai_addr))->sin6_addr); } ++ ++static bool is_inet_localhost(struct addrinfo *info) ++{ ++ struct addrinfo *p; ++ ++ for (p = info; p; p = p->ai_next) { ++ switch (p->ai_family) { ++ case AF_INET: ++ if (IN_LOOPBACKNET != (get_in_addr(p) & IN_CLASSA_NET ++ >> IN_CLASSA_NSHIFT)) ++ return false; ++ break; ++ case AF_INET6: ++ if (!IN6_IS_ADDR_LOOPBACK(get_in6_addr(p))) ++ return false; ++ break; ++ default: ++ return false; ++ } ++ } ++ ++ return true; ++} ++ + /* Iterate over the set of outstanding packets. */ + static const krad_packet * + iterator(request **out) +@@ -460,8 +490,9 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, + (krad_packet_iter_cb)iterator, &r, &tmp); + if (retval != 0) + goto error; +- else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL && +- rr->info->ai_family != AF_UNIX) { ++ else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL ++ && rr->info->ai_family != AF_UNIX ++ && !is_inet_localhost(rr->info)) { + /* This would expose cleartext passwords, so abort. */ + retval = ESOCKTNOSUPPORT; + goto error; +-- +2.35.3 + diff --git a/downstream-Use-newly-enforced-dejagnu-path-naming-convention.patch b/downstream-Use-newly-enforced-dejagnu-path-naming-convention.patch new file mode 100644 index 0000000..a415ab8 --- /dev/null +++ b/downstream-Use-newly-enforced-dejagnu-path-naming-convention.patch @@ -0,0 +1,803 @@ +From c3b21383d08ad244ecb5369eb08356d6eebff725 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 31 Mar 2022 18:24:39 +0200 +Subject: [PATCH] Use newly enforced dejagnu path naming convention + +Since version 1.6.3, dejagnu started to enforce a naming convention that +was already in place, but not mandatory: dejagnu test directories have +to be named "testsuite". If they don't implicit relative sub-paths +resolution (e.g. "lib", "config") is not forking. + +This commit renames unit tests and global tests directories to match +this requirement. +--- + src/configure.ac | 6 ++-- + src/lib/kadm5/Makefile.in | 2 +- + .../{unit-test => testsuite}/Makefile.in | 28 +++++++++--------- + .../api.2/crte-policy.exp | 0 + .../api.2/get-policy.exp | 0 + .../api.2/mod-policy.exp | 0 + .../api.current/chpass-principal-v2.exp | 0 + .../api.current/chpass-principal.exp | 0 + .../api.current/crte-policy.exp | 0 + .../api.current/crte-principal.exp | 0 + .../api.current/destroy.exp | 0 + .../api.current/dlte-policy.exp | 0 + .../api.current/dlte-principal.exp | 0 + .../api.current/get-policy.exp | 0 + .../api.current/get-principal-v2.exp | 0 + .../api.current/get-principal.exp | 0 + .../api.current/init-v2.exp | 0 + .../api.current/init.exp | 0 + .../api.current/mod-policy.exp | 0 + .../api.current/mod-principal-v2.exp | 0 + .../api.current/mod-principal.exp | 0 + .../api.current/randkey-principal-v2.exp | 0 + .../api.current/randkey-principal.exp | 0 + .../{unit-test => testsuite}/config/unix.exp | 0 + src/lib/kadm5/{unit-test => testsuite}/deps | 0 + .../{unit-test => testsuite}/destroy-test.c | 0 + .../diff-files/destroy-1 | 0 + .../diff-files/no-diffs | 0 + .../{unit-test => testsuite}/handle-test.c | 0 + .../{unit-test => testsuite}/init-test.c | 0 + .../{unit-test => testsuite}/iter-test.c | 0 + .../kadm5/{unit-test => testsuite}/lib/lib.t | 2 +- + .../{unit-test => testsuite}/lock-test.c | 0 + .../{unit-test => testsuite}/randkey-test.c | 0 + .../{unit-test => testsuite}/setkey-test.c | 0 + .../kadm5/{unit-test => testsuite}/site.exp | 0 + src/lib/rpc/Makefile.in | 2 +- + .../rpc/{unit-test => testsuite}/Makefile.in | 2 +- + src/lib/rpc/{unit-test => testsuite}/client.c | 0 + src/lib/rpc/{unit-test => testsuite}/deps | 0 + .../rpc/{unit-test => testsuite}/rpc_test.h | 0 + .../rpc/{unit-test => testsuite}/rpc_test.x | 0 + .../{unit-test => testsuite}/rpc_test_clnt.c | 0 + .../{unit-test => testsuite}/rpc_test_svc.c | 0 + src/lib/rpc/{unit-test => testsuite}/server.c | 0 + src/lib/rpc/{unit-test => testsuite}/t_rpc.py | 0 + src/tests/Makefile.in | 2 +- + src/tests/t_authdata.py | 2 +- + src/tests/t_certauth.py | 2 +- + src/tests/t_pkinit.py | 2 +- + src/tests/t_proxy.py | 12 ++++---- + src/tests/{dejagnu => testsuite}/Makefile.in | 4 +-- + .../{dejagnu => testsuite}/config/default.exp | 2 +- + src/tests/{dejagnu => testsuite}/deps | 0 + .../krb-standalone/gssapi.exp | 2 +- + .../krb-standalone/kprop.exp | 0 + .../krb-standalone/princexpire.exp | 0 + .../krb-standalone/sample.exp | 2 +- + .../krb-standalone/simple.exp | 2 +- + .../krb-standalone/standalone.exp | 0 + .../krb-standalone/tcp.exp | 0 + .../pkinit-certs/ca.pem | 0 + .../pkinit-certs/generic.p12 | Bin + .../pkinit-certs/generic.pem | 0 + .../pkinit-certs/kdc.pem | 0 + .../pkinit-certs/make-certs.sh | 0 + .../pkinit-certs/privkey-enc.pem | 0 + .../pkinit-certs/privkey.pem | 0 + .../pkinit-certs/user-enc.p12 | Bin + .../pkinit-certs/user-upn.p12 | Bin + .../pkinit-certs/user-upn.pem | 0 + .../pkinit-certs/user-upn2.p12 | Bin + .../pkinit-certs/user-upn2.pem | 0 + .../pkinit-certs/user-upn3.p12 | Bin + .../pkinit-certs/user-upn3.pem | 0 + .../pkinit-certs/user.p12 | Bin + .../pkinit-certs/user.pem | 0 + .../{dejagnu => testsuite}/proxy-certs/ca.pem | 0 + .../proxy-certs/make-certs.sh | 0 + .../proxy-certs/proxy-badsig.pem | 0 + .../proxy-certs/proxy-ideal.pem | 0 + .../proxy-certs/proxy-no-match.pem | 0 + .../proxy-certs/proxy-san.pem | 0 + .../proxy-certs/proxy-subject.pem | 0 + src/tests/{dejagnu => testsuite}/t_inetd.c | 2 +- + src/util/k5test.py | 2 +- + 86 files changed, 39 insertions(+), 39 deletions(-) + rename src/lib/kadm5/{unit-test => testsuite}/Makefile.in (86%) + rename src/lib/kadm5/{unit-test => testsuite}/api.2/crte-policy.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.2/get-policy.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.2/mod-policy.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/chpass-principal-v2.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/chpass-principal.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/crte-policy.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/crte-principal.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/destroy.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/dlte-policy.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/dlte-principal.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/get-policy.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/get-principal-v2.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/get-principal.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/init-v2.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/init.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/mod-policy.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/mod-principal-v2.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/mod-principal.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/randkey-principal-v2.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/api.current/randkey-principal.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/config/unix.exp (100%) + rename src/lib/kadm5/{unit-test => testsuite}/deps (100%) + rename src/lib/kadm5/{unit-test => testsuite}/destroy-test.c (100%) + rename src/lib/kadm5/{unit-test => testsuite}/diff-files/destroy-1 (100%) + rename src/lib/kadm5/{unit-test => testsuite}/diff-files/no-diffs (100%) + rename src/lib/kadm5/{unit-test => testsuite}/handle-test.c (100%) + rename src/lib/kadm5/{unit-test => testsuite}/init-test.c (100%) + rename src/lib/kadm5/{unit-test => testsuite}/iter-test.c (100%) + rename src/lib/kadm5/{unit-test => testsuite}/lib/lib.t (99%) + rename src/lib/kadm5/{unit-test => testsuite}/lock-test.c (100%) + rename src/lib/kadm5/{unit-test => testsuite}/randkey-test.c (100%) + rename src/lib/kadm5/{unit-test => testsuite}/setkey-test.c (100%) + rename src/lib/kadm5/{unit-test => testsuite}/site.exp (100%) + rename src/lib/rpc/{unit-test => testsuite}/Makefile.in (97%) + rename src/lib/rpc/{unit-test => testsuite}/client.c (100%) + rename src/lib/rpc/{unit-test => testsuite}/deps (100%) + rename src/lib/rpc/{unit-test => testsuite}/rpc_test.h (100%) + rename src/lib/rpc/{unit-test => testsuite}/rpc_test.x (100%) + rename src/lib/rpc/{unit-test => testsuite}/rpc_test_clnt.c (100%) + rename src/lib/rpc/{unit-test => testsuite}/rpc_test_svc.c (100%) + rename src/lib/rpc/{unit-test => testsuite}/server.c (100%) + rename src/lib/rpc/{unit-test => testsuite}/t_rpc.py (100%) + rename src/tests/{dejagnu => testsuite}/Makefile.in (92%) + rename src/tests/{dejagnu => testsuite}/config/default.exp (99%) + rename src/tests/{dejagnu => testsuite}/deps (100%) + rename src/tests/{dejagnu => testsuite}/krb-standalone/gssapi.exp (98%) + rename src/tests/{dejagnu => testsuite}/krb-standalone/kprop.exp (100%) + rename src/tests/{dejagnu => testsuite}/krb-standalone/princexpire.exp (100%) + rename src/tests/{dejagnu => testsuite}/krb-standalone/sample.exp (98%) + rename src/tests/{dejagnu => testsuite}/krb-standalone/simple.exp (98%) + rename src/tests/{dejagnu => testsuite}/krb-standalone/standalone.exp (100%) + rename src/tests/{dejagnu => testsuite}/krb-standalone/tcp.exp (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/ca.pem (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/generic.p12 (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/generic.pem (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/kdc.pem (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/make-certs.sh (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/privkey-enc.pem (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/privkey.pem (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-enc.p12 (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn.p12 (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn.pem (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn2.p12 (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn2.pem (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn3.p12 (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn3.pem (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/user.p12 (100%) + rename src/tests/{dejagnu => testsuite}/pkinit-certs/user.pem (100%) + rename src/tests/{dejagnu => testsuite}/proxy-certs/ca.pem (100%) + rename src/tests/{dejagnu => testsuite}/proxy-certs/make-certs.sh (100%) + rename src/tests/{dejagnu => testsuite}/proxy-certs/proxy-badsig.pem (100%) + rename src/tests/{dejagnu => testsuite}/proxy-certs/proxy-ideal.pem (100%) + rename src/tests/{dejagnu => testsuite}/proxy-certs/proxy-no-match.pem (100%) + rename src/tests/{dejagnu => testsuite}/proxy-certs/proxy-san.pem (100%) + rename src/tests/{dejagnu => testsuite}/proxy-certs/proxy-subject.pem (100%) + rename src/tests/{dejagnu => testsuite}/t_inetd.c (99%) + +diff --git a/src/configure.ac b/src/configure.ac +index 477819091..7143e9160 100644 +--- a/src/configure.ac ++++ b/src/configure.ac +@@ -1497,9 +1497,9 @@ V5_AC_OUTPUT_MAKEFILE(. + lib/gssapi lib/gssapi/generic lib/gssapi/krb5 lib/gssapi/spnego + lib/gssapi/mechglue + +- lib/rpc lib/rpc/unit-test ++ lib/rpc lib/rpc/testsuite + +- lib/kadm5 lib/kadm5/clnt lib/kadm5/srv lib/kadm5/unit-test ++ lib/kadm5 lib/kadm5/clnt lib/kadm5/srv lib/kadm5/testsuite + lib/krad + lib/apputils + +@@ -1543,5 +1543,5 @@ V5_AC_OUTPUT_MAKEFILE(. + appl/gss-sample appl/user_user + + tests tests/asn.1 tests/create tests/hammer tests/verify tests/gssapi +- tests/dejagnu tests/threads tests/shlib tests/gss-threads tests/misc ++ tests/testsuite tests/threads tests/shlib tests/gss-threads tests/misc + ) +diff --git a/src/lib/kadm5/Makefile.in b/src/lib/kadm5/Makefile.in +index c4eaad38d..76fc4b548 100644 +--- a/src/lib/kadm5/Makefile.in ++++ b/src/lib/kadm5/Makefile.in +@@ -1,6 +1,6 @@ + mydir=lib$(S)kadm5 + BUILDTOP=$(REL)..$(S).. +-SUBDIRS = clnt srv unit-test ++SUBDIRS = clnt srv testsuite + + ##DOSBUILDTOP = ..\.. + +diff --git a/src/lib/kadm5/unit-test/Makefile.in b/src/lib/kadm5/testsuite/Makefile.in +similarity index 86% +rename from src/lib/kadm5/unit-test/Makefile.in +rename to src/lib/kadm5/testsuite/Makefile.in +index 68fa097ff..5a55b786b 100644 +--- a/src/lib/kadm5/unit-test/Makefile.in ++++ b/src/lib/kadm5/testsuite/Makefile.in +@@ -1,4 +1,4 @@ +-mydir=lib$(S)kadm5$(S)unit-test ++mydir=lib$(S)kadm5$(S)testsuite + BUILDTOP=$(REL)..$(S)..$(S).. + KDB_DEP_LIB=$(DL_LIB) $(THREAD_LINKOPTS) + +@@ -61,7 +61,7 @@ runenv.exp: Makefile + eval echo "set env\($$i\) \$$$$i"; done > runenv.exp + + # +-# The unit-test targets ++# The testsuite targets + # + + check: check-@DO_TEST@ +@@ -72,13 +72,13 @@ check-: + @echo "+++ Either tcl, runtest, or Perl is unavailable." + @echo "+++" + +-check-ok unit-test: unit-test-client unit-test-server ++check-ok testsuite: testsuite-client testsuite-server + +-unit-test-client: unit-test-client-setup unit-test-client-body \ +- unit-test-client-cleanup ++testsuite-client: testsuite-client-setup testsuite-client-body \ ++ testsuite-client-cleanup + +-unit-test-server: unit-test-server-setup unit-test-server-body \ +- unit-test-server-cleanup ++testsuite-server: testsuite-server-setup testsuite-server-body \ ++ testsuite-server-cleanup + + test-randkey: randkey-test + $(ENV_SETUP) $(VALGRIND) ./randkey-test +@@ -98,19 +98,19 @@ test-destroy: destroy-test + test-setkey-client: client-setkey-test + $(ENV_SETUP) $(VALGRIND) ./client-setkey-test testkeys admin admin + +-unit-test-client-setup: runenv.sh ++testsuite-client-setup: runenv.sh + $(ENV_SETUP) $(VALGRIND) $(START_SERVERS) + +-unit-test-client-cleanup: ++testsuite-client-cleanup: + $(ENV_SETUP) $(STOP_SERVERS) + +-unit-test-server-setup: runenv.sh ++testsuite-server-setup: runenv.sh + $(ENV_SETUP) $(VALGRIND) $(START_SERVERS_LOCAL) + +-unit-test-server-cleanup: ++testsuite-server-cleanup: + $(ENV_SETUP) $(STOP_SERVERS_LOCAL) + +-unit-test-client-body: site.exp test-noauth test-destroy test-handle-client \ ++testsuite-client-body: site.exp test-noauth test-destroy test-handle-client \ + test-setkey-client runenv.exp + $(ENV_SETUP) $(RUNTEST) --tool api RPC=1 API=$(CLNTTCL) \ + KINIT=$(BUILDTOP)/clients/kinit/kinit \ +@@ -121,7 +121,7 @@ unit-test-client-body: site.exp test-noauth test-destroy test-handle-client \ + -mv api.log capi.log + -mv api.sum capi.sum + +-unit-test-server-body: site.exp test-handle-server lock-test ++testsuite-server-body: site.exp test-handle-server lock-test + $(ENV_SETUP) $(RUNTEST) --tool api RPC=0 API=$(SRVTCL) \ + LOCKTEST=./lock-test \ + KADMIN_LOCAL=$(BUILDTOP)/kadmin/cli/kadmin.local \ +@@ -140,4 +140,4 @@ clean: + $(RM) lock-test lock-test.o + $(RM) server-iter-test iter-test.o + $(RM) server-setkey-test client-setkey-test setkey-test.o +- $(RM) *.log *.plog *.sum *.psum unit-test-log.* runenv.exp ++ $(RM) *.log *.plog *.sum *.psum testsuite-log.* runenv.exp +diff --git a/src/lib/kadm5/unit-test/api.2/crte-policy.exp b/src/lib/kadm5/testsuite/api.2/crte-policy.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.2/crte-policy.exp +rename to src/lib/kadm5/testsuite/api.2/crte-policy.exp +diff --git a/src/lib/kadm5/unit-test/api.2/get-policy.exp b/src/lib/kadm5/testsuite/api.2/get-policy.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.2/get-policy.exp +rename to src/lib/kadm5/testsuite/api.2/get-policy.exp +diff --git a/src/lib/kadm5/unit-test/api.2/mod-policy.exp b/src/lib/kadm5/testsuite/api.2/mod-policy.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.2/mod-policy.exp +rename to src/lib/kadm5/testsuite/api.2/mod-policy.exp +diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp b/src/lib/kadm5/testsuite/api.current/chpass-principal-v2.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp +rename to src/lib/kadm5/testsuite/api.current/chpass-principal-v2.exp +diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal.exp b/src/lib/kadm5/testsuite/api.current/chpass-principal.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/chpass-principal.exp +rename to src/lib/kadm5/testsuite/api.current/chpass-principal.exp +diff --git a/src/lib/kadm5/unit-test/api.current/crte-policy.exp b/src/lib/kadm5/testsuite/api.current/crte-policy.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/crte-policy.exp +rename to src/lib/kadm5/testsuite/api.current/crte-policy.exp +diff --git a/src/lib/kadm5/unit-test/api.current/crte-principal.exp b/src/lib/kadm5/testsuite/api.current/crte-principal.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/crte-principal.exp +rename to src/lib/kadm5/testsuite/api.current/crte-principal.exp +diff --git a/src/lib/kadm5/unit-test/api.current/destroy.exp b/src/lib/kadm5/testsuite/api.current/destroy.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/destroy.exp +rename to src/lib/kadm5/testsuite/api.current/destroy.exp +diff --git a/src/lib/kadm5/unit-test/api.current/dlte-policy.exp b/src/lib/kadm5/testsuite/api.current/dlte-policy.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/dlte-policy.exp +rename to src/lib/kadm5/testsuite/api.current/dlte-policy.exp +diff --git a/src/lib/kadm5/unit-test/api.current/dlte-principal.exp b/src/lib/kadm5/testsuite/api.current/dlte-principal.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/dlte-principal.exp +rename to src/lib/kadm5/testsuite/api.current/dlte-principal.exp +diff --git a/src/lib/kadm5/unit-test/api.current/get-policy.exp b/src/lib/kadm5/testsuite/api.current/get-policy.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/get-policy.exp +rename to src/lib/kadm5/testsuite/api.current/get-policy.exp +diff --git a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp b/src/lib/kadm5/testsuite/api.current/get-principal-v2.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/get-principal-v2.exp +rename to src/lib/kadm5/testsuite/api.current/get-principal-v2.exp +diff --git a/src/lib/kadm5/unit-test/api.current/get-principal.exp b/src/lib/kadm5/testsuite/api.current/get-principal.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/get-principal.exp +rename to src/lib/kadm5/testsuite/api.current/get-principal.exp +diff --git a/src/lib/kadm5/unit-test/api.current/init-v2.exp b/src/lib/kadm5/testsuite/api.current/init-v2.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/init-v2.exp +rename to src/lib/kadm5/testsuite/api.current/init-v2.exp +diff --git a/src/lib/kadm5/unit-test/api.current/init.exp b/src/lib/kadm5/testsuite/api.current/init.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/init.exp +rename to src/lib/kadm5/testsuite/api.current/init.exp +diff --git a/src/lib/kadm5/unit-test/api.current/mod-policy.exp b/src/lib/kadm5/testsuite/api.current/mod-policy.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/mod-policy.exp +rename to src/lib/kadm5/testsuite/api.current/mod-policy.exp +diff --git a/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp b/src/lib/kadm5/testsuite/api.current/mod-principal-v2.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp +rename to src/lib/kadm5/testsuite/api.current/mod-principal-v2.exp +diff --git a/src/lib/kadm5/unit-test/api.current/mod-principal.exp b/src/lib/kadm5/testsuite/api.current/mod-principal.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/mod-principal.exp +rename to src/lib/kadm5/testsuite/api.current/mod-principal.exp +diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp b/src/lib/kadm5/testsuite/api.current/randkey-principal-v2.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp +rename to src/lib/kadm5/testsuite/api.current/randkey-principal-v2.exp +diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal.exp b/src/lib/kadm5/testsuite/api.current/randkey-principal.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/api.current/randkey-principal.exp +rename to src/lib/kadm5/testsuite/api.current/randkey-principal.exp +diff --git a/src/lib/kadm5/unit-test/config/unix.exp b/src/lib/kadm5/testsuite/config/unix.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/config/unix.exp +rename to src/lib/kadm5/testsuite/config/unix.exp +diff --git a/src/lib/kadm5/unit-test/deps b/src/lib/kadm5/testsuite/deps +similarity index 100% +rename from src/lib/kadm5/unit-test/deps +rename to src/lib/kadm5/testsuite/deps +diff --git a/src/lib/kadm5/unit-test/destroy-test.c b/src/lib/kadm5/testsuite/destroy-test.c +similarity index 100% +rename from src/lib/kadm5/unit-test/destroy-test.c +rename to src/lib/kadm5/testsuite/destroy-test.c +diff --git a/src/lib/kadm5/unit-test/diff-files/destroy-1 b/src/lib/kadm5/testsuite/diff-files/destroy-1 +similarity index 100% +rename from src/lib/kadm5/unit-test/diff-files/destroy-1 +rename to src/lib/kadm5/testsuite/diff-files/destroy-1 +diff --git a/src/lib/kadm5/unit-test/diff-files/no-diffs b/src/lib/kadm5/testsuite/diff-files/no-diffs +similarity index 100% +rename from src/lib/kadm5/unit-test/diff-files/no-diffs +rename to src/lib/kadm5/testsuite/diff-files/no-diffs +diff --git a/src/lib/kadm5/unit-test/handle-test.c b/src/lib/kadm5/testsuite/handle-test.c +similarity index 100% +rename from src/lib/kadm5/unit-test/handle-test.c +rename to src/lib/kadm5/testsuite/handle-test.c +diff --git a/src/lib/kadm5/unit-test/init-test.c b/src/lib/kadm5/testsuite/init-test.c +similarity index 100% +rename from src/lib/kadm5/unit-test/init-test.c +rename to src/lib/kadm5/testsuite/init-test.c +diff --git a/src/lib/kadm5/unit-test/iter-test.c b/src/lib/kadm5/testsuite/iter-test.c +similarity index 100% +rename from src/lib/kadm5/unit-test/iter-test.c +rename to src/lib/kadm5/testsuite/iter-test.c +diff --git a/src/lib/kadm5/unit-test/lib/lib.t b/src/lib/kadm5/testsuite/lib/lib.t +similarity index 99% +rename from src/lib/kadm5/unit-test/lib/lib.t +rename to src/lib/kadm5/testsuite/lib/lib.t +index 3444775cf..327946849 100644 +--- a/src/lib/kadm5/unit-test/lib/lib.t ++++ b/src/lib/kadm5/testsuite/lib/lib.t +@@ -226,7 +226,7 @@ proc end_dump_compare {name} { + global RPC + + if { ! $RPC } { +-# set file $TOP/admin/lib/unit-test/diff-files/$name ++# set file $TOP/admin/lib/testsuite/diff-files/$name + # exec $env(SIMPLE_DUMP) > /tmp/dump.after + # exec $env(COMPARE_DUMP) /tmp/dump.before /tmp/dump.after $file + } +diff --git a/src/lib/kadm5/unit-test/lock-test.c b/src/lib/kadm5/testsuite/lock-test.c +similarity index 100% +rename from src/lib/kadm5/unit-test/lock-test.c +rename to src/lib/kadm5/testsuite/lock-test.c +diff --git a/src/lib/kadm5/unit-test/randkey-test.c b/src/lib/kadm5/testsuite/randkey-test.c +similarity index 100% +rename from src/lib/kadm5/unit-test/randkey-test.c +rename to src/lib/kadm5/testsuite/randkey-test.c +diff --git a/src/lib/kadm5/unit-test/setkey-test.c b/src/lib/kadm5/testsuite/setkey-test.c +similarity index 100% +rename from src/lib/kadm5/unit-test/setkey-test.c +rename to src/lib/kadm5/testsuite/setkey-test.c +diff --git a/src/lib/kadm5/unit-test/site.exp b/src/lib/kadm5/testsuite/site.exp +similarity index 100% +rename from src/lib/kadm5/unit-test/site.exp +rename to src/lib/kadm5/testsuite/site.exp +diff --git a/src/lib/rpc/Makefile.in b/src/lib/rpc/Makefile.in +index 39db2d3ce..58ebafeba 100644 +--- a/src/lib/rpc/Makefile.in ++++ b/src/lib/rpc/Makefile.in +@@ -2,7 +2,7 @@ mydir=lib$(S)rpc + BUILDTOP=$(REL)..$(S).. + DEFINES = -DGSSAPI_KRB5 -DDEBUG_GSSAPI=0 -DGSSRPC__IMPL + +-SUBDIRS=unit-test ++SUBDIRS=testsuite + + ##DOSBUILDTOP = ..\.. + ##DOSLIBNAME=libgssrpc.lib +diff --git a/src/lib/rpc/unit-test/Makefile.in b/src/lib/rpc/testsuite/Makefile.in +similarity index 97% +rename from src/lib/rpc/unit-test/Makefile.in +rename to src/lib/rpc/testsuite/Makefile.in +index 309ae2b21..530a45bc6 100644 +--- a/src/lib/rpc/unit-test/Makefile.in ++++ b/src/lib/rpc/testsuite/Makefile.in +@@ -1,4 +1,4 @@ +-mydir=lib$(S)rpc$(S)unit-test ++mydir=lib$(S)rpc$(S)testsuite + BUILDTOP=$(REL)..$(S)..$(S).. + + OBJS= client.o rpc_test_clnt.o rpc_test_svc.o server.o +diff --git a/src/lib/rpc/unit-test/client.c b/src/lib/rpc/testsuite/client.c +similarity index 100% +rename from src/lib/rpc/unit-test/client.c +rename to src/lib/rpc/testsuite/client.c +diff --git a/src/lib/rpc/unit-test/deps b/src/lib/rpc/testsuite/deps +similarity index 100% +rename from src/lib/rpc/unit-test/deps +rename to src/lib/rpc/testsuite/deps +diff --git a/src/lib/rpc/unit-test/rpc_test.h b/src/lib/rpc/testsuite/rpc_test.h +similarity index 100% +rename from src/lib/rpc/unit-test/rpc_test.h +rename to src/lib/rpc/testsuite/rpc_test.h +diff --git a/src/lib/rpc/unit-test/rpc_test.x b/src/lib/rpc/testsuite/rpc_test.x +similarity index 100% +rename from src/lib/rpc/unit-test/rpc_test.x +rename to src/lib/rpc/testsuite/rpc_test.x +diff --git a/src/lib/rpc/unit-test/rpc_test_clnt.c b/src/lib/rpc/testsuite/rpc_test_clnt.c +similarity index 100% +rename from src/lib/rpc/unit-test/rpc_test_clnt.c +rename to src/lib/rpc/testsuite/rpc_test_clnt.c +diff --git a/src/lib/rpc/unit-test/rpc_test_svc.c b/src/lib/rpc/testsuite/rpc_test_svc.c +similarity index 100% +rename from src/lib/rpc/unit-test/rpc_test_svc.c +rename to src/lib/rpc/testsuite/rpc_test_svc.c +diff --git a/src/lib/rpc/unit-test/server.c b/src/lib/rpc/testsuite/server.c +similarity index 100% +rename from src/lib/rpc/unit-test/server.c +rename to src/lib/rpc/testsuite/server.c +diff --git a/src/lib/rpc/unit-test/t_rpc.py b/src/lib/rpc/testsuite/t_rpc.py +similarity index 100% +rename from src/lib/rpc/unit-test/t_rpc.py +rename to src/lib/rpc/testsuite/t_rpc.py +diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in +index 20f27d748..1198dca0c 100644 +--- a/src/tests/Makefile.in ++++ b/src/tests/Makefile.in +@@ -1,6 +1,6 @@ + mydir=tests + BUILDTOP=$(REL).. +-SUBDIRS = asn.1 create hammer verify gssapi dejagnu shlib gss-threads misc \ ++SUBDIRS = asn.1 create hammer verify gssapi testsuite shlib gss-threads misc \ + threads softpkcs11 + + RUN_DB_TEST = $(RUN_SETUP) KRB5_KDC_PROFILE=kdc.conf KRB5_CONFIG=krb5.conf \ +diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py +index 2e01f46bc..e5135f435 100644 +--- a/src/tests/t_authdata.py ++++ b/src/tests/t_authdata.py +@@ -57,7 +57,7 @@ if not os.path.exists(os.path.join(plugins, 'preauth', 'pkinit.so')): + skipped('anonymous ticket authdata tests', 'PKINIT not built') + else: + # Set up a realm with PKINIT support and get anonymous tickets. +- certs = os.path.join(srctop, 'tests', 'dejagnu', 'pkinit-certs') ++ certs = os.path.join(srctop, 'tests', 'testsuite', 'pkinit-certs') + ca_pem = os.path.join(certs, 'ca.pem') + kdc_pem = os.path.join(certs, 'kdc.pem') + privkey_pem = os.path.join(certs, 'privkey.pem') +diff --git a/src/tests/t_certauth.py b/src/tests/t_certauth.py +index 0fe0fdb4a..bfa5bfc96 100644 +--- a/src/tests/t_certauth.py ++++ b/src/tests/t_certauth.py +@@ -4,7 +4,7 @@ from k5test import * + if not os.path.exists(os.path.join(plugins, 'preauth', 'pkinit.so')): + skip_rest('certauth tests', 'PKINIT module not built') + +-certs = os.path.join(srctop, 'tests', 'dejagnu', 'pkinit-certs') ++certs = os.path.join(srctop, 'tests', 'testsuite', 'pkinit-certs') + ca_pem = os.path.join(certs, 'ca.pem') + kdc_pem = os.path.join(certs, 'kdc.pem') + privkey_pem = os.path.join(certs, 'privkey.pem') +diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py +index aee4da2b1..8763ce484 100755 +--- a/src/tests/t_pkinit.py ++++ b/src/tests/t_pkinit.py +@@ -7,7 +7,7 @@ if not os.path.exists(os.path.join(plugins, 'preauth', 'pkinit.so')): + soft_pkcs11 = os.path.join(buildtop, 'tests', 'softpkcs11', 'softpkcs11.so') + + # Construct a krb5.conf fragment configuring pkinit. +-certs = os.path.join(srctop, 'tests', 'dejagnu', 'pkinit-certs') ++certs = os.path.join(srctop, 'tests', 'testsuite', 'pkinit-certs') + ca_pem = os.path.join(certs, 'ca.pem') + kdc_pem = os.path.join(certs, 'kdc.pem') + user_pem = os.path.join(certs, 'user.pem') +diff --git a/src/tests/t_proxy.py b/src/tests/t_proxy.py +index 3069eaa8f..6ae5c8c8e 100755 +--- a/src/tests/t_proxy.py ++++ b/src/tests/t_proxy.py +@@ -10,17 +10,17 @@ except: + + # Construct a krb5.conf fragment configuring the client to use a local proxy + # server. +-proxysubjectpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs', ++proxysubjectpem = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs', + 'proxy-subject.pem') +-proxysanpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs', ++proxysanpem = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs', + 'proxy-san.pem') +-proxyidealpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs', ++proxyidealpem = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs', + 'proxy-ideal.pem') +-proxywrongpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs', ++proxywrongpem = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs', + 'proxy-no-match.pem') +-proxybadpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs', ++proxybadpem = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs', + 'proxy-badsig.pem') +-proxyca = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs', 'ca.pem') ++proxyca = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs', 'ca.pem') + proxyurl = 'https://localhost:$port5/KdcProxy' + proxyurlupcase = 'https://LocalHost:$port5/KdcProxy' + proxyurl4 = 'https://127.0.0.1:$port5/KdcProxy' +diff --git a/src/tests/dejagnu/Makefile.in b/src/tests/testsuite/Makefile.in +similarity index 92% +rename from src/tests/dejagnu/Makefile.in +rename to src/tests/testsuite/Makefile.in +index e78e270ed..d3efe3606 100644 +--- a/src/tests/dejagnu/Makefile.in ++++ b/src/tests/testsuite/Makefile.in +@@ -1,4 +1,4 @@ +-mydir=tests$(S)dejagnu ++mydir=tests$(S)testsuite + BUILDTOP=$(REL)..$(S).. + RUNTEST = @RUNTEST@ $(DEJAFLAGS) + RUNTESTFLAGS = +@@ -13,7 +13,7 @@ check: check-runtest-@HAVE_RUNTEST@ + + check-runtest-no: + @echo "+++" +- @echo "+++ WARNING: tests/dejagnu tests not run." ++ @echo "+++ WARNING: tests/testsuite tests not run." + @echo "+++ runtest is unavailable." + @echo "+++" + @echo 'Skipped dejagnu tests: runtest not found' >> $(SKIPTESTS) +diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/testsuite/config/default.exp +similarity index 99% +rename from src/tests/dejagnu/config/default.exp +rename to src/tests/testsuite/config/default.exp +index 302dee74c..1492fac32 100644 +--- a/src/tests/dejagnu/config/default.exp ++++ b/src/tests/testsuite/config/default.exp +@@ -256,7 +256,7 @@ verbose "Test realm is $REALMNAME" + + # Find some programs we need. We use the binaries from the build tree + # if they exist. If they do not, then they must be in PATH. We +-# expect $objdir to be ...tests/dejagnu. ++# expect $objdir to be ...tests/testsuite. + + foreach i { + {KDB5_UTIL $objdir/../../kadmin/dbutil/kdb5_util} +diff --git a/src/tests/dejagnu/deps b/src/tests/testsuite/deps +similarity index 100% +rename from src/tests/dejagnu/deps +rename to src/tests/testsuite/deps +diff --git a/src/tests/dejagnu/krb-standalone/gssapi.exp b/src/tests/testsuite/krb-standalone/gssapi.exp +similarity index 98% +rename from src/tests/dejagnu/krb-standalone/gssapi.exp +rename to src/tests/testsuite/krb-standalone/gssapi.exp +index e3357e769..d176e210c 100644 +--- a/src/tests/dejagnu/krb-standalone/gssapi.exp ++++ b/src/tests/testsuite/krb-standalone/gssapi.exp +@@ -2,7 +2,7 @@ + # This is a DejaGnu test script. + # This script tests that the GSS-API tester functions correctly. + +-# This mostly just calls procedures in test/dejagnu/config/default.exp. ++# This mostly just calls procedures in test/testsuite/config/default.exp. + + if ![info exists KDESTROY] { + set KDESTROY [findfile $objdir/../../clients/kdestroy/kdestroy] +diff --git a/src/tests/dejagnu/krb-standalone/kprop.exp b/src/tests/testsuite/krb-standalone/kprop.exp +similarity index 100% +rename from src/tests/dejagnu/krb-standalone/kprop.exp +rename to src/tests/testsuite/krb-standalone/kprop.exp +diff --git a/src/tests/dejagnu/krb-standalone/princexpire.exp b/src/tests/testsuite/krb-standalone/princexpire.exp +similarity index 100% +rename from src/tests/dejagnu/krb-standalone/princexpire.exp +rename to src/tests/testsuite/krb-standalone/princexpire.exp +diff --git a/src/tests/dejagnu/krb-standalone/sample.exp b/src/tests/testsuite/krb-standalone/sample.exp +similarity index 98% +rename from src/tests/dejagnu/krb-standalone/sample.exp +rename to src/tests/testsuite/krb-standalone/sample.exp +index 93a75f1d0..009de5ddb 100644 +--- a/src/tests/dejagnu/krb-standalone/sample.exp ++++ b/src/tests/testsuite/krb-standalone/sample.exp +@@ -2,7 +2,7 @@ + # This is a DejaGnu test script. + # This script tests that sample user-user communication works. + +-# This mostly just calls procedures in test/dejagnu/config/default.exp. ++# This mostly just calls procedures in test/testsuite/config/default.exp. + + if ![info exists KLIST] { + set KLIST [findfile $objdir/../../clients/klist/klist] +diff --git a/src/tests/dejagnu/krb-standalone/simple.exp b/src/tests/testsuite/krb-standalone/simple.exp +similarity index 98% +rename from src/tests/dejagnu/krb-standalone/simple.exp +rename to src/tests/testsuite/krb-standalone/simple.exp +index d8b218248..92b33066e 100644 +--- a/src/tests/dejagnu/krb-standalone/simple.exp ++++ b/src/tests/testsuite/krb-standalone/simple.exp +@@ -2,7 +2,7 @@ + # This is a DejaGnu test script. + # This script tests that krb-safe and krb-priv messages work. + +-# This mostly just calls procedures in test/dejagnu/config/default.exp. ++# This mostly just calls procedures in test/testsuite/config/default.exp. + + if ![info exists KLIST] { + set KLIST [findfile $objdir/../../clients/klist/klist] +diff --git a/src/tests/dejagnu/krb-standalone/standalone.exp b/src/tests/testsuite/krb-standalone/standalone.exp +similarity index 100% +rename from src/tests/dejagnu/krb-standalone/standalone.exp +rename to src/tests/testsuite/krb-standalone/standalone.exp +diff --git a/src/tests/dejagnu/krb-standalone/tcp.exp b/src/tests/testsuite/krb-standalone/tcp.exp +similarity index 100% +rename from src/tests/dejagnu/krb-standalone/tcp.exp +rename to src/tests/testsuite/krb-standalone/tcp.exp +diff --git a/src/tests/dejagnu/pkinit-certs/ca.pem b/src/tests/testsuite/pkinit-certs/ca.pem +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/ca.pem +rename to src/tests/testsuite/pkinit-certs/ca.pem +diff --git a/src/tests/dejagnu/pkinit-certs/generic.p12 b/src/tests/testsuite/pkinit-certs/generic.p12 +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/generic.p12 +rename to src/tests/testsuite/pkinit-certs/generic.p12 +diff --git a/src/tests/dejagnu/pkinit-certs/generic.pem b/src/tests/testsuite/pkinit-certs/generic.pem +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/generic.pem +rename to src/tests/testsuite/pkinit-certs/generic.pem +diff --git a/src/tests/dejagnu/pkinit-certs/kdc.pem b/src/tests/testsuite/pkinit-certs/kdc.pem +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/kdc.pem +rename to src/tests/testsuite/pkinit-certs/kdc.pem +diff --git a/src/tests/dejagnu/pkinit-certs/make-certs.sh b/src/tests/testsuite/pkinit-certs/make-certs.sh +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/make-certs.sh +rename to src/tests/testsuite/pkinit-certs/make-certs.sh +diff --git a/src/tests/dejagnu/pkinit-certs/privkey-enc.pem b/src/tests/testsuite/pkinit-certs/privkey-enc.pem +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/privkey-enc.pem +rename to src/tests/testsuite/pkinit-certs/privkey-enc.pem +diff --git a/src/tests/dejagnu/pkinit-certs/privkey.pem b/src/tests/testsuite/pkinit-certs/privkey.pem +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/privkey.pem +rename to src/tests/testsuite/pkinit-certs/privkey.pem +diff --git a/src/tests/dejagnu/pkinit-certs/user-enc.p12 b/src/tests/testsuite/pkinit-certs/user-enc.p12 +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/user-enc.p12 +rename to src/tests/testsuite/pkinit-certs/user-enc.p12 +diff --git a/src/tests/dejagnu/pkinit-certs/user-upn.p12 b/src/tests/testsuite/pkinit-certs/user-upn.p12 +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/user-upn.p12 +rename to src/tests/testsuite/pkinit-certs/user-upn.p12 +diff --git a/src/tests/dejagnu/pkinit-certs/user-upn.pem b/src/tests/testsuite/pkinit-certs/user-upn.pem +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/user-upn.pem +rename to src/tests/testsuite/pkinit-certs/user-upn.pem +diff --git a/src/tests/dejagnu/pkinit-certs/user-upn2.p12 b/src/tests/testsuite/pkinit-certs/user-upn2.p12 +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/user-upn2.p12 +rename to src/tests/testsuite/pkinit-certs/user-upn2.p12 +diff --git a/src/tests/dejagnu/pkinit-certs/user-upn2.pem b/src/tests/testsuite/pkinit-certs/user-upn2.pem +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/user-upn2.pem +rename to src/tests/testsuite/pkinit-certs/user-upn2.pem +diff --git a/src/tests/dejagnu/pkinit-certs/user-upn3.p12 b/src/tests/testsuite/pkinit-certs/user-upn3.p12 +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/user-upn3.p12 +rename to src/tests/testsuite/pkinit-certs/user-upn3.p12 +diff --git a/src/tests/dejagnu/pkinit-certs/user-upn3.pem b/src/tests/testsuite/pkinit-certs/user-upn3.pem +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/user-upn3.pem +rename to src/tests/testsuite/pkinit-certs/user-upn3.pem +diff --git a/src/tests/dejagnu/pkinit-certs/user.p12 b/src/tests/testsuite/pkinit-certs/user.p12 +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/user.p12 +rename to src/tests/testsuite/pkinit-certs/user.p12 +diff --git a/src/tests/dejagnu/pkinit-certs/user.pem b/src/tests/testsuite/pkinit-certs/user.pem +similarity index 100% +rename from src/tests/dejagnu/pkinit-certs/user.pem +rename to src/tests/testsuite/pkinit-certs/user.pem +diff --git a/src/tests/dejagnu/proxy-certs/ca.pem b/src/tests/testsuite/proxy-certs/ca.pem +similarity index 100% +rename from src/tests/dejagnu/proxy-certs/ca.pem +rename to src/tests/testsuite/proxy-certs/ca.pem +diff --git a/src/tests/dejagnu/proxy-certs/make-certs.sh b/src/tests/testsuite/proxy-certs/make-certs.sh +similarity index 100% +rename from src/tests/dejagnu/proxy-certs/make-certs.sh +rename to src/tests/testsuite/proxy-certs/make-certs.sh +diff --git a/src/tests/dejagnu/proxy-certs/proxy-badsig.pem b/src/tests/testsuite/proxy-certs/proxy-badsig.pem +similarity index 100% +rename from src/tests/dejagnu/proxy-certs/proxy-badsig.pem +rename to src/tests/testsuite/proxy-certs/proxy-badsig.pem +diff --git a/src/tests/dejagnu/proxy-certs/proxy-ideal.pem b/src/tests/testsuite/proxy-certs/proxy-ideal.pem +similarity index 100% +rename from src/tests/dejagnu/proxy-certs/proxy-ideal.pem +rename to src/tests/testsuite/proxy-certs/proxy-ideal.pem +diff --git a/src/tests/dejagnu/proxy-certs/proxy-no-match.pem b/src/tests/testsuite/proxy-certs/proxy-no-match.pem +similarity index 100% +rename from src/tests/dejagnu/proxy-certs/proxy-no-match.pem +rename to src/tests/testsuite/proxy-certs/proxy-no-match.pem +diff --git a/src/tests/dejagnu/proxy-certs/proxy-san.pem b/src/tests/testsuite/proxy-certs/proxy-san.pem +similarity index 100% +rename from src/tests/dejagnu/proxy-certs/proxy-san.pem +rename to src/tests/testsuite/proxy-certs/proxy-san.pem +diff --git a/src/tests/dejagnu/proxy-certs/proxy-subject.pem b/src/tests/testsuite/proxy-certs/proxy-subject.pem +similarity index 100% +rename from src/tests/dejagnu/proxy-certs/proxy-subject.pem +rename to src/tests/testsuite/proxy-certs/proxy-subject.pem +diff --git a/src/tests/dejagnu/t_inetd.c b/src/tests/testsuite/t_inetd.c +similarity index 99% +rename from src/tests/dejagnu/t_inetd.c +rename to src/tests/testsuite/t_inetd.c +index abcde50fa..2bad2cf65 100644 +--- a/src/tests/dejagnu/t_inetd.c ++++ b/src/tests/testsuite/t_inetd.c +@@ -1,5 +1,5 @@ + /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +-/* tests/dejagnu/t_inetd.c */ ++/* tests/testsuite/t_inetd.c */ + /* + * Copyright 1991 by the Massachusetts Institute of Technology. + * All Rights Reserved. +diff --git a/src/util/k5test.py b/src/util/k5test.py +index 251d11a9d..908a1495c 100644 +--- a/src/util/k5test.py ++++ b/src/util/k5test.py +@@ -1383,7 +1383,7 @@ kswitch = os.path.join(buildtop, 'clients', 'kswitch', 'kswitch') + kvno = os.path.join(buildtop, 'clients', 'kvno', 'kvno') + kdestroy = os.path.join(buildtop, 'clients', 'kdestroy', 'kdestroy') + kpasswd = os.path.join(buildtop, 'clients', 'kpasswd', 'kpasswd') +-t_inetd = os.path.join(buildtop, 'tests', 'dejagnu', 't_inetd') ++t_inetd = os.path.join(buildtop, 'tests', 'testsuite', 't_inetd') + kproplog = os.path.join(buildtop, 'kprop', 'kproplog') + kpropd = os.path.join(buildtop, 'kprop', 'kpropd') + kprop = os.path.join(buildtop, 'kprop', 'kprop') +-- +2.35.1 + diff --git a/krb5-krad-larger-attrs.patch b/krb5-krad-larger-attrs.patch new file mode 100644 index 0000000..32111ec --- /dev/null +++ b/krb5-krad-larger-attrs.patch @@ -0,0 +1,69 @@ +From f35077bfc570205092eca2a9d44e50ce265622f4 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Mon, 8 Nov 2021 17:48:50 +0100 +Subject: [PATCH] Support larger RADIUS attributes in libkrad + +In kr_attrset_decode(), explicitly treat the length byte as unsigned. +Otherwise attributes longer than 125 characters will be rejected with +EBADMSG. + +Add a 253-character-long NAS-Identifier attribute to the tests to make +sure that attributes with the maximal number of characters are working +as expected. + +[ghudson@mit.edu: used uint8_t cast per current practices; edited +commit message] + +ticket: 9036 (new) +--- + src/lib/krad/attrset.c | 2 +- + src/lib/krad/t_packet.c | 13 +++++++++++++ + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c +index 03c613716..f309f1581 100644 +--- a/src/lib/krad/attrset.c ++++ b/src/lib/krad/attrset.c +@@ -217,7 +217,7 @@ kr_attrset_decode(krb5_context ctx, const krb5_data *in, const char *secret, + + for (i = 0; i + 2 < in->length; ) { + type = in->data[i++]; +- tmp = make_data(&in->data[i + 1], in->data[i] - 2); ++ tmp = make_data(&in->data[i + 1], (uint8_t)in->data[i] - 2); + i += tmp.length + 1; + + retval = (in->length < i) ? EBADMSG : 0; +diff --git a/src/lib/krad/t_packet.c b/src/lib/krad/t_packet.c +index 0a92e9cc2..c22489144 100644 +--- a/src/lib/krad/t_packet.c ++++ b/src/lib/krad/t_packet.c +@@ -57,6 +57,14 @@ make_packet(krb5_context ctx, const krb5_data *username, + krb5_error_code retval; + const krb5_data *data; + int i = 0; ++ krb5_data nas_id; ++ ++ nas_id = string2data("12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "123"); + + retval = krad_attrset_new(ctx, &set); + if (retval != 0) +@@ -71,6 +79,11 @@ make_packet(krb5_context ctx, const krb5_data *username, + if (retval != 0) + goto out; + ++ retval = krad_attrset_add(set, krad_attr_name2num("NAS-Identifier"), ++ &nas_id); ++ if (retval != 0) ++ goto out; ++ + retval = krad_packet_new_request(ctx, "foo", + krad_code_name2num("Access-Request"), + set, iterator, &i, &tmp); +-- +2.35.1 + diff --git a/krb5-krad-remote.patch b/krb5-krad-remote.patch new file mode 100644 index 0000000..42452ff --- /dev/null +++ b/krb5-krad-remote.patch @@ -0,0 +1,209 @@ +From ce160f8826bae223876a6527a731c36b6912db15 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 9 Nov 2021 13:00:43 -0500 +Subject: [PATCH 1/2] Avoid use after free during libkrad cleanup + +libkrad client requests contain a list of references to remotes, with +no back-references or reference counts. To prevent accesses to +dangling references during cleanup, cancel all requests on all remotes +before freeing any remotes. + +Remove the code for aging out unused servers. This code was fairly +safe as all requests referencing a remote should have completed or +timed out during an hour of disuse, but in the current design we have +no way to guarantee or check that. The set of addresses we send +RADIUS requests to will generally be small, so aging out servers is +unnecessary. + +ticket: 9035 (new) +--- + src/lib/krad/client.c | 42 ++++++++++++++--------------------------- + src/lib/krad/internal.h | 4 ++++ + src/lib/krad/remote.c | 11 ++++++++--- + 3 files changed, 26 insertions(+), 31 deletions(-) + +diff --git a/src/lib/krad/client.c b/src/lib/krad/client.c +index 6365dd1c6..810940afc 100644 +--- a/src/lib/krad/client.c ++++ b/src/lib/krad/client.c +@@ -64,7 +64,6 @@ struct request_st { + + struct server_st { + krad_remote *serv; +- time_t last; + K5_LIST_ENTRY(server_st) list; + }; + +@@ -81,15 +80,10 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret, + krad_remote **out) + { + krb5_error_code retval; +- time_t currtime; + server *srv; + +- if (time(&currtime) == (time_t)-1) +- return errno; +- + K5_LIST_FOREACH(srv, &rc->servers, list) { + if (kr_remote_equals(srv->serv, ai, secret)) { +- srv->last = currtime; + *out = srv->serv; + return 0; + } +@@ -98,7 +92,6 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret, + srv = calloc(1, sizeof(server)); + if (srv == NULL) + return ENOMEM; +- srv->last = currtime; + + retval = kr_remote_new(rc->kctx, rc->vctx, ai, secret, &srv->serv); + if (retval != 0) { +@@ -173,28 +166,12 @@ request_new(krad_client *rc, krad_code code, const krad_attrset *attrs, + return 0; + } + +-/* Close remotes that haven't been used in a while. */ +-static void +-age(struct server_head *head, time_t currtime) +-{ +- server *srv, *tmp; +- +- K5_LIST_FOREACH_SAFE(srv, head, list, tmp) { +- if (currtime == (time_t)-1 || currtime - srv->last > 60 * 60) { +- K5_LIST_REMOVE(srv, list); +- kr_remote_free(srv->serv); +- free(srv); +- } +- } +-} +- + /* Handle a response from a server (or related errors). */ + static void + on_response(krb5_error_code retval, const krad_packet *reqp, + const krad_packet *rspp, void *data) + { + request *req = data; +- time_t currtime; + size_t i; + + /* Do nothing if we are already completed. */ +@@ -221,10 +198,6 @@ on_response(krb5_error_code retval, const krad_packet *reqp, + for (i = 0; req->remotes[i].remote != NULL; i++) + kr_remote_cancel(req->remotes[i].remote, req->remotes[i].packet); + +- /* Age out servers that haven't been used in a while. */ +- if (time(&currtime) != (time_t)-1) +- age(&req->rc->servers, currtime); +- + request_free(req); + } + +@@ -247,10 +220,23 @@ krad_client_new(krb5_context kctx, verto_ctx *vctx, krad_client **out) + void + krad_client_free(krad_client *rc) + { ++ server *srv; ++ + if (rc == NULL) + return; + +- age(&rc->servers, -1); ++ /* Cancel all requests before freeing any remotes, since each request's ++ * callback data may contain references to multiple remotes. */ ++ K5_LIST_FOREACH(srv, &rc->servers, list) ++ kr_remote_cancel_all(srv->serv); ++ ++ while (!K5_LIST_EMPTY(&rc->servers)) { ++ srv = K5_LIST_FIRST(&rc->servers); ++ K5_LIST_REMOVE(srv, list); ++ kr_remote_free(srv->serv); ++ free(srv); ++ } ++ + free(rc); + } + +diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h +index 0143d155a..7619563fc 100644 +--- a/src/lib/krad/internal.h ++++ b/src/lib/krad/internal.h +@@ -109,6 +109,10 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, + void + kr_remote_cancel(krad_remote *rr, const krad_packet *pkt); + ++/* Cancel all requests awaiting responses. */ ++void ++kr_remote_cancel_all(krad_remote *rr); ++ + /* Determine if this remote object refers to the remote resource identified + * by the addrinfo struct and the secret. */ + krb5_boolean +diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c +index 7e491e994..06ae751bc 100644 +--- a/src/lib/krad/remote.c ++++ b/src/lib/krad/remote.c +@@ -421,15 +421,20 @@ error: + return retval; + } + ++void ++kr_remote_cancel_all(krad_remote *rr) ++{ ++ while (!K5_TAILQ_EMPTY(&rr->list)) ++ request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL); ++} ++ + void + kr_remote_free(krad_remote *rr) + { + if (rr == NULL) + return; + +- while (!K5_TAILQ_EMPTY(&rr->list)) +- request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL); +- ++ kr_remote_cancel_all(rr); + free(rr->secret); + if (rr->info != NULL) + free(rr->info->ai_addr); +-- +2.35.1 + + +From e0084425df784952e76b3bcc8ae9d08300234733 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Mon, 8 Nov 2021 17:47:17 +0100 +Subject: [PATCH 2/2] More python3 fixes for t_daemon.py + +[ghudson@mit.edu: use a list comprehension instead of map()] +--- + src/lib/krad/t_daemon.py | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/lib/krad/t_daemon.py b/src/lib/krad/t_daemon.py +index 7668cd7f8..4a3de079c 100755 +--- a/src/lib/krad/t_daemon.py ++++ b/src/lib/krad/t_daemon.py +@@ -50,7 +50,7 @@ class TestServer(server.Server): + + for key in pkt.keys(): + if key == "User-Password": +- passwd = map(pkt.PwDecrypt, pkt[key]) ++ passwd = [pkt.PwDecrypt(x) for x in pkt[key]] + + reply = self.CreateReplyPacket(pkt) + if passwd == ['accept']: +@@ -61,8 +61,8 @@ class TestServer(server.Server): + + srv = TestServer(addresses=["localhost"], + hosts={"127.0.0.1": +- server.RemoteHost("127.0.0.1", "foo", "localhost")}, +- dict=dictionary.Dictionary(StringIO.StringIO(DICTIONARY))) ++ server.RemoteHost("127.0.0.1", b"foo", "localhost")}, ++ dict=dictionary.Dictionary(StringIO(DICTIONARY))) + + # Write a sentinel character to let the parent process know we're listening. + sys.stdout.write("~") +-- +2.35.1 + diff --git a/krb5.spec b/krb5.spec index 37c3b90..c381d04 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}2%{?dist} +Release: %{?zdpd}9%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -90,6 +90,14 @@ Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch Patch26: Use-asan-in-one-of-the-CI-builds.patch Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch Patch30: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch +Patch31: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch +Patch32: krb5-krad-remote.patch +Patch33: krb5-krad-larger-attrs.patch +Patch34: Try-harder-to-avoid-password-change-replay-errors.patch +Patch35: downstream-Use-newly-enforced-dejagnu-path-naming-convention.patch +Patch36: downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch +Patch37: Read-GSS-configuration-files-with-mtime-0.patch +Patch38: Fix-integer-overflows-in-PAC-parsing.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -250,7 +258,7 @@ popd # builds going on the same host don't step on each other. cfg="src/kadmin/testing/proto/kdc.conf.proto \ src/kadmin/testing/proto/krb5.conf.proto \ - src/lib/kadm5/unit-test/api.current/init-v2.exp \ + src/lib/kadm5/testsuite/api.current/init-v2.exp \ src/util/k5test.py" LONG_BIT=`getconf LONG_BIT` PORT=`expr 61000 + $LONG_BIT - 48` @@ -652,6 +660,34 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Nov 09 2022 Julien Rische - 1.19.2-9 +- Fix integer overflows in PAC parsing (CVE-2022-42898) +- Resolves: rhbz#2143009 + +* Thu Jun 16 2022 Julien Rische - 1.19.2-8 +- Allow libkrad UDP/TCP connection to localhost in FIPS mode +- Resolves: rhbz#2082189 +- Read GSS configuration files with mtime 0 + +* Wed Apr 20 2022 Julien Rische - 1.19.2-7 +- Try harder to avoid password change replay errors +- Resolves: rhbz#2076965 +- Restore and fix dejagnu tests + +* Tue Apr 05 2022 Alexander Bokovoy - 1.19.2-6 +- Fix libkrad client cleanup +- Fixes rhbz#2072059 + +* Tue Apr 05 2022 Alexander Bokovoy - 1.19.2-5 +- Allow use of larger RADIUS attributes in krad library + +* Thu Mar 31 2022 Julien Rische - 1.19.2-4 +- Disable TCL-based libkadm5 API tests +- Resolves: rhbz#2069077 + +* Wed Mar 23 2022 Julien Rische - 1.19.2-3 +- Use SHA-256 instead of SHA-1 for PKINIT CMS digest + * Thu Aug 19 2021 Robbie Harwood - 1.19.2-2 - Fix KDC null deref on TGS inner body null server (CVE-2021-37750)