krb5 1.21.3-11

- Fix strchr() conformance to C23

.gitignore

@@ -204,3 +204,7 @@
 /krb5-1.20.1.tar.gz.asc
 /krb5-1.21.tar.gz
 /krb5-1.21.tar.gz.asc
+/krb5-1.21.2.tar.gz
+/krb5-1.21.2.tar.gz.asc
+/krb5-1.21.3.tar.gz
+/krb5-1.21.3.tar.gz.asc

0001-downstream-Revert-Don-t-issue-session-keys-with-depr.patch

@@ -0,0 +1,310 @@
+From 6f7fd964539dfe4a885068f43a91db9738661870 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Tue, 9 Jul 2024 11:15:33 +0200
+Subject: [PATCH] [downstream] Revert "Don't issue session keys with
+ deprecated enctypes"
+
+This reverts commit 1b57a4d134bbd0e7c52d5885a92eccc815726463.
+---
+ doc/admin/conf_files/krb5_conf.rst | 12 ------------
+ doc/admin/enctypes.rst             | 23 +++-------------------
+ src/include/k5-int.h               |  4 ----
+ src/kdc/kdc_util.c                 | 10 ----------
+ src/lib/krb5/krb/get_in_tkt.c      | 31 +++++++++++-------------------
+ src/lib/krb5/krb/init_ctx.c        | 10 ----------
+ src/tests/gssapi/t_enctypes.py     |  3 +--
+ src/tests/t_etype_info.py          |  2 +-
+ src/tests/t_sesskeynego.py         | 28 ++-------------------------
+ src/util/k5test.py                 |  4 ++--
+ 10 files changed, 20 insertions(+), 107 deletions(-)
+
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index ecdf917501..f22d5db11b 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -95,18 +95,6 @@ Additionally, krb5.conf may include any of the relations described in
+ 
+ The libdefaults section may contain any of the following relations:
+ 
+-**allow_des3**
+-    Permit the KDC to issue tickets with des3-cbc-sha1 session keys.
+-    In future releases, this flag will allow des3-cbc-sha1 to be used
+-    at all.  The default value for this tag is false.  (Added in
+-    release 1.21.)
+-
+-**allow_rc4**
+-    Permit the KDC to issue tickets with arcfour-hmac session keys.
+-    In future releases, this flag will allow arcfour-hmac to be used
+-    at all.  The default value for this tag is false.  (Added in
+-    release 1.21.)
+-
+ **allow_weak_crypto**
+     If this flag is set to false, then weak encryption types (as noted
+     in :ref:`Encryption_types` in :ref:`kdc.conf(5)`) will be filtered
+diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
+index dce19ad43e..694922c0d9 100644
+--- a/doc/admin/enctypes.rst
++++ b/doc/admin/enctypes.rst
+@@ -48,15 +48,12 @@ Session key selection
+ The KDC chooses the session key enctype by taking the intersection of
+ its **permitted_enctypes** list, the list of long-term keys for the
+ most recent kvno of the service, and the client's requested list of
+-enctypes.  Starting in krb5-1.21, all services are assumed to support
+-aes256-cts-hmac-sha1-96; also, des3-cbc-sha1 and arcfour-hmac session
+-keys will not be issued by default.
++enctypes.
+ 
+ Starting in krb5-1.11, it is possible to set a string attribute on a
+ service principal to control what session key enctypes the KDC may
+-issue for service tickets for that principal, overriding the service's
+-long-term keys and the assumption of aes256-cts-hmac-sha1-96 support.
+-See :ref:`set_string` in :ref:`kadmin(1)` for details.
++issue for service tickets for that principal.  See :ref:`set_string`
++in :ref:`kadmin(1)` for details.
+ 
+ 
+ Choosing enctypes for a service
+@@ -90,20 +87,6 @@ affect how enctypes are chosen.
+     acceptable risk for your environment and the weak enctypes are
+     required for backward compatibility.
+ 
+-**allow_des3**
+-    was added in release 1.21 and defaults to *false*.  Unless this
+-    flag is set to *true*, the KDC will not issue tickets with
+-    des3-cbc-sha1 session keys.  In a future release, this flag will
+-    control whether des3-cbc-sha1 is permitted in similar fashion to
+-    weak enctypes.
+-
+-**allow_rc4**
+-    was added in release 1.21 and defaults to *false*.  Unless this
+-    flag is set to *true*, the KDC will not issue tickets with
+-    arcfour-hmac session keys.  In a future release, this flag will
+-    control whether arcfour-hmac is permitted in similar fashion to
+-    weak enctypes.
+-
+ **permitted_enctypes**
+     controls the set of enctypes that a service will permit for
+     session keys and for ticket and authenticator encryption.  The KDC
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index 2f7791b775..1d1c8293f4 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -180,8 +180,6 @@ typedef unsigned char   u_char;
+  * matches the variable name.  Keep these alphabetized. */
+ #define KRB5_CONF_ACL_FILE                     "acl_file"
+ #define KRB5_CONF_ADMIN_SERVER                 "admin_server"
+-#define KRB5_CONF_ALLOW_DES3                   "allow_des3"
+-#define KRB5_CONF_ALLOW_RC4                    "allow_rc4"
+ #define KRB5_CONF_ALLOW_WEAK_CRYPTO            "allow_weak_crypto"
+ #define KRB5_CONF_AUTH_TO_LOCAL                "auth_to_local"
+ #define KRB5_CONF_AUTH_TO_LOCAL_NAMES          "auth_to_local_names"
+@@ -1240,8 +1238,6 @@ struct _krb5_context {
+     struct _kdb_log_context *kdblog_context;
+ 
+     krb5_boolean allow_weak_crypto;
+-    krb5_boolean allow_des3;
+-    krb5_boolean allow_rc4;
+     krb5_boolean ignore_acceptor_hostname;
+     krb5_boolean enforce_ok_as_delegate;
+     enum dns_canonhost dns_canonicalize_hostname;
+diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
+index e54cc751f9..75e04b73db 100644
+--- a/src/kdc/kdc_util.c
++++ b/src/kdc/kdc_util.c
+@@ -1088,16 +1088,6 @@ select_session_keytype(krb5_context context, krb5_db_entry *server,
+         if (!krb5_is_permitted_enctype(context, ktype[i]))
+             continue;
+ 
+-        /*
+-         * Prevent these deprecated enctypes from being used as session keys
+-         * unless they are explicitly allowed.  In the future they will be more
+-         * comprehensively disabled and eventually removed.
+-         */
+-        if (ktype[i] == ENCTYPE_DES3_CBC_SHA1 && !context->allow_des3)
+-            continue;
+-        if (ktype[i] == ENCTYPE_ARCFOUR_HMAC && !context->allow_rc4)
+-            continue;
+-
+         if (dbentry_supports_enctype(context, server, ktype[i]))
+             return ktype[i];
+     }
+diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
+index ea089f0fcc..1b420a3ac2 100644
+--- a/src/lib/krb5/krb/get_in_tkt.c
++++ b/src/lib/krb5/krb/get_in_tkt.c
+@@ -1582,31 +1582,22 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options,
+     (*prompter)(context, data, 0, banner, 0, 0);
+ }
+ 
+-/* Display a warning via the prompter if a deprecated enctype was used for
+- * either the reply key or the session key. */
++/* Display a warning via the prompter if des3-cbc-sha1 was used for either the
++ * reply key or the session key. */
+ static void
+-warn_deprecated(krb5_context context, krb5_init_creds_context ctx,
+-                krb5_enctype as_key_enctype)
++warn_des3(krb5_context context, krb5_init_creds_context ctx,
++          krb5_enctype as_key_enctype)
+ {
+-    krb5_enctype etype;
+-    char encbuf[128], banner[256];
++    const char *banner;
+ 
+-    if (ctx->prompter == NULL)
+-        return;
+-
+-    if (krb5int_c_deprecated_enctype(as_key_enctype))
+-        etype = as_key_enctype;
+-    else if (krb5int_c_deprecated_enctype(ctx->cred.keyblock.enctype))
+-        etype = ctx->cred.keyblock.enctype;
+-    else
++    if (as_key_enctype != ENCTYPE_DES3_CBC_SHA1 &&
++        ctx->cred.keyblock.enctype != ENCTYPE_DES3_CBC_SHA1)
+         return;
+-
+-    if (krb5_enctype_to_name(etype, FALSE, encbuf, sizeof(encbuf)) != 0)
++    if (ctx->prompter == NULL)
+         return;
+-    snprintf(banner, sizeof(banner),
+-             _("Warning: encryption type %s used for authentication is "
+-               "deprecated and will be disabled"), encbuf);
+ 
++    banner = _("Warning: encryption type des3-cbc-sha1 used for "
++               "authentication is weak and will be disabled");
+     /* PROMPTER_INVOCATION */
+     (*ctx->prompter)(context, ctx->prompter_data, NULL, banner, 0, NULL);
+ }
+@@ -1857,7 +1848,7 @@ init_creds_step_reply(krb5_context context,
+     ctx->complete = TRUE;
+     warn_pw_expiry(context, ctx->opt, ctx->prompter, ctx->prompter_data,
+                    ctx->in_tkt_service, ctx->reply);
+-    warn_deprecated(context, ctx, encrypting_key.enctype);
++    warn_des3(context, ctx, encrypting_key.enctype);
+ 
+ cleanup:
+     krb5_free_pa_data(context, kdc_padata);
+diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
+index a6c2bbeb54..87b486c53f 100644
+--- a/src/lib/krb5/krb/init_ctx.c
++++ b/src/lib/krb5/krb/init_ctx.c
+@@ -221,16 +221,6 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+         goto cleanup;
+     ctx->allow_weak_crypto = tmp;
+ 
+-    retval = get_boolean(ctx, KRB5_CONF_ALLOW_DES3, 0, &tmp);
+-    if (retval)
+-        goto cleanup;
+-    ctx->allow_des3 = tmp;
+-
+-    retval = get_boolean(ctx, KRB5_CONF_ALLOW_RC4, 0, &tmp);
+-    if (retval)
+-        goto cleanup;
+-    ctx->allow_rc4 = tmp;
+-
+     retval = get_boolean(ctx, KRB5_CONF_IGNORE_ACCEPTOR_HOSTNAME, 0, &tmp);
+     if (retval)
+         goto cleanup;
+diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
+index f5f11842e2..7494d7fcdb 100755
+--- a/src/tests/gssapi/t_enctypes.py
++++ b/src/tests/gssapi/t_enctypes.py
+@@ -18,8 +18,7 @@ d_rc4 = 'DEPRECATED:arcfour-hmac'
+ # These tests make assumptions about the default enctype lists, so set
+ # them explicitly rather than relying on the library defaults.
+ supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal'
+-conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4',
+-                        'allow_des3': 'true', 'allow_rc4': 'true'},
++conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4'},
+         'realms': {'$realm': {'supported_enctypes': supp}}}
+ realm = K5Realm(krb5_conf=conf)
+ shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save'))
+diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
+index 38cf96ca8f..c982508d8b 100644
+--- a/src/tests/t_etype_info.py
++++ b/src/tests/t_etype_info.py
+@@ -1,7 +1,7 @@
+ from k5test import *
+ 
+ supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac'
+-conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'},
++conf = {'libdefaults': {'allow_weak_crypto': 'true'},
+         'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
+ realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf)
+ 
+diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py
+index 5a213617b5..9024aee838 100755
+--- a/src/tests/t_sesskeynego.py
++++ b/src/tests/t_sesskeynego.py
+@@ -25,8 +25,6 @@ conf3 = {'libdefaults': {
+         'default_tkt_enctypes': 'aes128-cts',
+         'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}}
+ conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}}
+-conf5 = {'libdefaults': {'allow_rc4': 'true'}}
+-conf6 = {'libdefaults': {'allow_des3': 'true'}}
+ # Test with client request and session_enctypes preferring aes128, but
+ # aes256 long-term key.
+ realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False)
+@@ -56,12 +54,10 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes',
+            'aes128-cts,aes256-cts'])
+ test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96')
+ 
+-# 3b: Skip RC4 (as the KDC does not allow it for session keys by
+-# default) and negotiate aes128-cts session key, with only an aes256
+-# long-term service key.
++# 3b: Negotiate rc4-hmac session key when principal only has aes256 long-term.
+ realm.run([kadminl, 'setstr', 'server', 'session_enctypes',
+            'rc4-hmac,aes128-cts,aes256-cts'])
+-test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96')
++test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
+ realm.stop()
+ 
+ # 4: Check that permitted_enctypes is a default for session key enctypes.
+@@ -71,24 +67,4 @@ realm.run([kvno, 'user'],
+           expected_trace=('etypes requested in TGS request: aes256-cts',))
+ realm.stop()
+ 
+-# 5: allow_rc4 permits negotiation of rc4-hmac session key.
+-realm = K5Realm(krb5_conf=conf5, create_host=False, get_creds=False)
+-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
+-realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac'])
+-test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
+-realm.stop()
+-
+-# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key.
+-realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False)
+-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
+-realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1'])
+-test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96')
+-realm.stop()
+-
+-# 7: default config negotiates aes256-sha1 session key for RC4-only service.
+-realm = K5Realm(create_host=False, get_creds=False)
+-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server'])
+-test_kvno(realm, 'aes256-cts-hmac-sha1-96', 'DEPRECATED:arcfour-hmac')
+-realm.stop()
+-
+ success('sesskeynego')
+diff --git a/src/util/k5test.py b/src/util/k5test.py
+index 8e5f5ba8e9..2a86c5cdfc 100644
+--- a/src/util/k5test.py
++++ b/src/util/k5test.py
+@@ -1340,14 +1340,14 @@ _passes = [
+ 
+     # Exercise the DES3 enctype.
+     ('des3', None,
+-     {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}},
++     {'libdefaults': {'permitted_enctypes': 'des3'}},
+      {'realms': {'$realm': {
+                     'supported_enctypes': 'des3-cbc-sha1:normal',
+                     'master_key_type': 'des3-cbc-sha1'}}}),
+ 
+     # Exercise the arcfour enctype.
+     ('arcfour', None,
+-     {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}},
++     {'libdefaults': {'permitted_enctypes': 'rc4'}},
+      {'realms': {'$realm': {
+                     'supported_enctypes': 'arcfour-hmac:normal',
+                     'master_key_type': 'arcfour-hmac'}}}),
+-- 
+2.45.1
+

0002-downstream-ksu-pam-integration.patch

@@ -1,4 +1,4 @@
-From 67c82a09c6c53713c281045cd55de2720cd06907 Mon Sep 17 00:00:00 2001
+From de4205c45e310ceaaa7cd7958af7293322fa43a6 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:29:58 -0400
 Subject: [PATCH] [downstream] ksu pam integration
@@ -773,5 +773,5 @@ index 77be7a2025..587221936e 100644
  if test "${localedir+set}" != set; then
      localedir='$(datadir)/locale'
 -- 
-2.40.1
+2.45.1
 

0003-downstream-SELinux-integration.patch

@@ -1,4 +1,4 @@
-From dfbac76ab7bb7e6e2c3171eefcaa93573e6b630e Mon Sep 17 00:00:00 2001
+From 30ff501e4b519396f5aea25e24919be817863e7c Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:30:53 -0400
 Subject: [PATCH] [downstream] SELinux integration
@@ -188,7 +188,7 @@ index 587221936e..69be9030f8 100644
  if test "${localedir+set}" != set; then
      localedir='$(datadir)/locale'
 diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index 2f7791b775..9c534faa8a 100644
+index 1d1c8293f4..768110e5ef 100644
 --- a/src/include/k5-int.h
 +++ b/src/include/k5-int.h
 @@ -128,6 +128,7 @@ typedef unsigned char   u_char;
@@ -238,10 +238,10 @@ index 0000000000..dfaaa847cb
 +#endif
 +#endif
 diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
-index 9c76780181..dd6430ece8 100644
+index 4e09ed345d..09f800be52 100644
 --- a/src/include/krb5/krb5.hin
 +++ b/src/include/krb5/krb5.hin
-@@ -87,6 +87,12 @@
+@@ -83,6 +83,12 @@
  #define THREEPARAMOPEN(x,y,z) open(x,y,z)
  #endif
  
@@ -1034,5 +1034,5 @@ index 0000000000..807d039da3
 +
 +#endif /* USE_SELINUX */
 -- 
-2.40.1
+2.45.1
 

0004-downstream-fix-debuginfo-with-y.tab.c.patch

@@ -1,4 +1,4 @@
-From a9c463ed5988c860ebb18de212d6c56da1cb1169 Mon Sep 17 00:00:00 2001
+From 393830d96000ed692aa9a99ef87187d6f2863931 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:49:25 -0400
 Subject: [PATCH] [downstream] fix debuginfo with y.tab.c
@@ -40,5 +40,5 @@ index 8669c2436c..a22f23c02c 100644
  install:
  	$(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG)
 -- 
-2.40.1
+2.45.1
 

0005-downstream-Remove-3des-support.patch

@@ -1,4 +1,4 @@
-From 0691db92e13e0d224c2c9dd72c1421d8f7c3c078 Mon Sep 17 00:00:00 2001
+From 7d697742abb370cfc7241c1faa78ba08d7650f6a Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 26 Mar 2019 18:51:10 -0400
 Subject: [PATCH] [downstream] Remove 3des support
@@ -8,7 +8,7 @@ des3-hmac-sha1, des3-cbc-sha1-kd).  Update all tests and documentation
 to user other enctypes.  Mark the 3DES enctypes UNSUPPORTED and retain
 their constants.
 
-Last-updated: 1.20-final
+Last-updated: 1.21.1-final
 [antorres@redhat.com: remove diffs for:
      - src/kdamin/testing/proto/kdc.conf.proto
      - src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
@@ -98,19 +98,18 @@ Last-updated: 1.20-final
  src/plugins/preauth/pkinit/pkinit_crypto.h    |  10 +-
  src/plugins/preauth/pkinit/pkinit_kdf_test.c  |  30 --
  src/plugins/preauth/spake/t_vectors.c         |  25 --
- src/tests/gssapi/t_enctypes.py                |  34 +-
+ src/tests/gssapi/t_enctypes.py                |  33 +-
  src/tests/gssapi/t_invalid.c                  |  12 -
  src/tests/gssapi/t_pcontok.c                  |  16 +-
  src/tests/gssapi/t_prf.c                      |   7 -
  src/tests/t_authdata.py                       |   2 +-
- src/tests/t_etype_info.py                     |  20 +-
+ src/tests/t_etype_info.py                     |  21 +-
  src/tests/t_keyrollover.py                    |   8 +-
  src/tests/t_mkey.py                           |  35 --
  src/tests/t_salt.py                           |   5 +-
- src/tests/t_sesskeynego.py                    |   8 -
  src/util/k5test.py                            |   7 -
  .../leash/htmlhelp/html/Encryption_Types.htm  |  13 -
- 90 files changed, 149 insertions(+), 4720 deletions(-)
+ 89 files changed, 149 insertions(+), 4712 deletions(-)
  delete mode 100644 src/lib/crypto/builtin/des/ISSUES
  delete mode 100644 src/lib/crypto/builtin/des/Makefile.in
  delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c
@@ -200,10 +199,10 @@ index 74a0a2acef..846c58ed82 100644
  
  While **aes128-cts** and **aes256-cts** are supported for all Kerberos
 diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
-index dce19ad43e..2b4ed7da0b 100644
+index 694922c0d9..c4d5499d3b 100644
 --- a/doc/admin/enctypes.rst
 +++ b/doc/admin/enctypes.rst
-@@ -146,7 +146,7 @@ enctype                    weak?      krb5     Windows
+@@ -129,7 +129,7 @@ enctype                    weak?      krb5     Windows
  des-cbc-crc                weak       <1.18    >=2000
  des-cbc-md4                weak       <1.18    ?
  des-cbc-md5                weak       <1.18    >=2000
@@ -212,7 +211,7 @@ index dce19ad43e..2b4ed7da0b 100644
  arcfour-hmac               deprecated >=1.3    >=2000
  arcfour-hmac-exp           weak       >=1.3    >=2000
  aes128-cts-hmac-sha1-96               >=1.3    >=Vista
-@@ -165,9 +165,11 @@ default.
+@@ -148,9 +148,11 @@ default.
  krb5 releases 1.17 and later flag deprecated encryption types
  (including ``des3-cbc-sha1`` and ``arcfour-hmac``) in KDC logs and
  kadmin output.  krb5 release 1.19 issues a warning during initial
@@ -260,7 +259,7 @@ index 45fe160d7f..b4b1f3bd93 100644
     CKSUMTYPE_NIST_SHA.rst
     CKSUMTYPE_RSA_MD4.rst
 diff --git a/doc/conf.py b/doc/conf.py
-index cd76f5999f..1e1cfce80c 100644
+index ecf9020a72..db7fa377ef 100644
 --- a/doc/conf.py
 +++ b/doc/conf.py
 @@ -281,7 +281,7 @@ else:
@@ -327,10 +326,10 @@ index 69be9030f8..2561e917a2 100644
  
  	lib/krb5 lib/krb5/error_tables lib/krb5/asn.1 lib/krb5/ccache
 diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
-index dd6430ece8..350bcf86f2 100644
+index 09f800be52..c5a625db8f 100644
 --- a/src/include/krb5/krb5.hin
 +++ b/src/include/krb5/krb5.hin
-@@ -426,8 +426,8 @@ typedef struct _krb5_crypto_iov {
+@@ -422,8 +422,8 @@ typedef struct _krb5_crypto_iov {
  #define ENCTYPE_DES_CBC_MD4     0x0002  /**< @deprecated no longer supported */
  #define ENCTYPE_DES_CBC_MD5     0x0003  /**< @deprecated no longer supported */
  #define ENCTYPE_DES_CBC_RAW     0x0004  /**< @deprecated no longer supported */
@@ -341,7 +340,7 @@ index dd6430ece8..350bcf86f2 100644
  #define ENCTYPE_DES_HMAC_SHA1   0x0008  /**< @deprecated no longer supported */
  /* PKINIT */
  #define ENCTYPE_DSA_SHA1_CMS    0x0009  /**< DSA with SHA1, CMS signature */
-@@ -436,9 +436,9 @@ typedef struct _krb5_crypto_iov {
+@@ -432,9 +432,9 @@ typedef struct _krb5_crypto_iov {
  #define ENCTYPE_RC2_CBC_ENV     0x000c  /**< RC2 cbc mode, CMS enveloped data */
  #define ENCTYPE_RSA_ENV         0x000d  /**< RSA encryption, CMS enveloped data */
  #define ENCTYPE_RSA_ES_OAEP_ENV 0x000e  /**< RSA w/OEAP encryption, CMS enveloped data */
@@ -353,7 +352,7 @@ index dd6430ece8..350bcf86f2 100644
  #define ENCTYPE_AES128_CTS_HMAC_SHA1_96     0x0011 /**< RFC 3962 */
  #define ENCTYPE_AES256_CTS_HMAC_SHA1_96     0x0012 /**< RFC 3962 */
  #define ENCTYPE_AES128_CTS_HMAC_SHA256_128  0x0013 /**< RFC 8009 */
-@@ -463,7 +463,7 @@ typedef struct _krb5_crypto_iov {
+@@ -459,7 +459,7 @@ typedef struct _krb5_crypto_iov {
  #define CKSUMTYPE_RSA_MD5       0x0007
  #define CKSUMTYPE_RSA_MD5_DES   0x0008
  #define CKSUMTYPE_NIST_SHA      0x0009
@@ -363,10 +362,10 @@ index dd6430ece8..350bcf86f2 100644
  #define CKSUMTYPE_HMAC_SHA1_96_AES128 0x000f /**< RFC 3962. Used with
                                                  ENCTYPE_AES128_CTS_HMAC_SHA1_96 */
 diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
-index e54cc751f9..ea10e23a95 100644
+index 75e04b73db..fe4e48209a 100644
 --- a/src/kdc/kdc_util.c
 +++ b/src/kdc/kdc_util.c
-@@ -1164,8 +1164,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen)
+@@ -1154,8 +1154,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen)
          name = "rsaEncryption-EnvOID";
      else if (ktype == ENCTYPE_RSA_ES_OAEP_ENV)
          name = "id-RSAES-OAEP-EnvOID";
@@ -375,7 +374,7 @@ index e54cc751f9..ea10e23a95 100644
      else
          return krb5_enctype_to_name(ktype, FALSE, buf, buflen);
  
-@@ -1657,8 +1655,6 @@ krb5_boolean
+@@ -1647,8 +1645,6 @@ krb5_boolean
  enctype_requires_etype_info_2(krb5_enctype enctype)
  {
      switch(enctype) {
@@ -5492,10 +5491,10 @@ index 9b183bc337..f0cc4a6809 100644
      if (sealalg != 0xffff)
          xfree(plain);
 diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c
-index 85a9574f36..3ce2a90ce9 100644
+index 21b501731e..6a6585d9af 100644
 --- a/src/lib/gssapi/krb5/k5unsealiov.c
 +++ b/src/lib/gssapi/krb5/k5unsealiov.c
-@@ -102,28 +102,21 @@ kg_unseal_v1_iov(krb5_context context,
+@@ -103,28 +103,21 @@ kg_unseal_v1_iov(krb5_context context,
      }
  
      if ((ctx->sealalg == SEAL_ALG_NONE && signalg > 1) ||
@@ -5529,7 +5528,7 @@ index 85a9574f36..3ce2a90ce9 100644
      /* get the token parameters */
      code = kg_get_seq_num(context, ctx->seq, ptr + 14, ptr + 6, &direction,
                            &seqnum);
-@@ -181,16 +174,10 @@ kg_unseal_v1_iov(krb5_context context,
+@@ -182,16 +175,10 @@ kg_unseal_v1_iov(krb5_context context,
  
      /* initialize the checksum */
  
@@ -5549,7 +5548,7 @@ index 85a9574f36..3ce2a90ce9 100644
  
      code = krb5_c_checksum_length(context, md5cksum.checksum_type, &sumlen);
      if (code != 0) {
-@@ -209,18 +196,13 @@ kg_unseal_v1_iov(krb5_context context,
+@@ -210,18 +197,13 @@ kg_unseal_v1_iov(krb5_context context,
          goto cleanup;
      }
  
@@ -5593,7 +5592,7 @@ index 84f1949887..32150f5e34 100644
      case ENCTYPE_ARCFOUR_HMAC_EXP:
          /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" enctype,
 diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
-index a6c2bbeb54..18290b764b 100644
+index 87b486c53f..2b5abcd817 100644
 --- a/src/lib/krb5/krb/init_ctx.c
 +++ b/src/lib/krb5/krb/init_ctx.c
 @@ -59,7 +59,6 @@
@@ -5604,7 +5603,7 @@ index a6c2bbeb54..18290b764b 100644
      ENCTYPE_ARCFOUR_HMAC,
      ENCTYPE_CAMELLIA128_CTS_CMAC, ENCTYPE_CAMELLIA256_CTS_CMAC,
      0
-@@ -460,8 +459,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey,
+@@ -450,8 +449,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey,
              /* Set all enctypes in the default list. */
              for (i = 0; default_list[i]; i++)
                  mod_list(default_list[i], sel, weak, &list);
@@ -5849,10 +5848,10 @@ index 2279202d3a..96b0307d78 100644
        /* initial key, w, x, y, T, S, K */
        "8846F7EAEE8FB117AD06BDD830B7586C",
 diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
-index f5f11842e2..1bb8c40b6b 100755
+index 7494d7fcdb..2f95d89967 100755
 --- a/src/tests/gssapi/t_enctypes.py
 +++ b/src/tests/gssapi/t_enctypes.py
-@@ -1,25 +1,17 @@
+@@ -1,24 +1,17 @@
  from k5test import *
  
 -# Define some convenience abbreviations for enctypes we will see in
@@ -5876,14 +5875,13 @@ index f5f11842e2..1bb8c40b6b 100755
  # These tests make assumptions about the default enctype lists, so set
  # them explicitly rather than relying on the library defaults.
 -supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal'
--conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4',
--                        'allow_des3': 'true', 'allow_rc4': 'true'},
+-conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4'},
 +supp='aes256-cts:normal aes128-cts:normal rc4-hmac:normal'
-+conf = {'libdefaults': {'permitted_enctypes': 'aes rc4', 'allow_rc4': 'true'},
++conf = {'libdefaults': {'permitted_enctypes': 'aes rc4'},
          'realms': {'$realm': {'supported_enctypes': supp}}}
  realm = K5Realm(krb5_conf=conf)
  shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save'))
-@@ -88,19 +80,12 @@ test('both aes128', 'aes128-cts', 'aes128-cts',
+@@ -87,19 +80,12 @@ test('both aes128', 'aes128-cts', 'aes128-cts',
  test_err('acc aes128', None, 'aes128-cts',
           'Encryption type aes256-cts-hmac-sha1-96 not permitted')
  
@@ -5904,7 +5902,7 @@ index f5f11842e2..1bb8c40b6b 100755
  # subkey.
  test('upgrade noargs', None, None,
       tktenc=aes256, tktsession=d_rc4,
-@@ -116,13 +101,6 @@ test('upgrade init aes128+rc4', 'aes128-cts rc4', None,
+@@ -115,13 +101,6 @@ test('upgrade init aes128+rc4', 'aes128-cts rc4', None,
       tktenc=aes256, tktsession=d_rc4,
       proto='cfx', isubkey=rc4, asubkey=aes128)
  
@@ -5919,10 +5917,10 @@ index f5f11842e2..1bb8c40b6b 100755
  # because the ticket session key and initiator subkey are
  # non-permitted.  (This is unfortunate if the acceptor's restriction
 diff --git a/src/tests/gssapi/t_invalid.c b/src/tests/gssapi/t_invalid.c
-index 9876a11e67..fb8fe55111 100644
+index 882e163634..8192935099 100644
 --- a/src/tests/gssapi/t_invalid.c
 +++ b/src/tests/gssapi/t_invalid.c
-@@ -84,18 +84,6 @@ struct test {
+@@ -94,18 +94,6 @@ struct test {
      size_t toklen;
      const char *token;
  } tests[] = {
@@ -6008,20 +6006,21 @@ index bde1c36844..8fcd30db51 100644
  realm.run(['./forward'])
  realm.run([kvno, realm.host_princ])
 diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
-index 38cf96ca8f..e82ff7ff07 100644
+index c982508d8b..a6f538b66d 100644
 --- a/src/tests/t_etype_info.py
 +++ b/src/tests/t_etype_info.py
-@@ -1,7 +1,7 @@
+@@ -1,8 +1,7 @@
  from k5test import *
  
 -supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac'
--conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'},
+-conf = {'libdefaults': {'allow_weak_crypto': 'true'},
+-        'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
 +supported_enctypes = 'aes128-cts rc4-hmac'
-+conf = {'libdefaults': {'allow_rc4': 'true'},
-         'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
++conf = {'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
  realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf)
  
-@@ -26,9 +26,9 @@ def test_etinfo(princ, enctypes, expected_lines):
+ realm.run([kadminl, 'addprinc', '-pw', 'pw', '+requires_preauth',
+@@ -26,9 +25,9 @@ def test_etinfo(princ, enctypes, expected_lines):
  # With no newer enctypes in the request, PA-ETYPE-INFO2,
  # PA-ETYPE-INFO, and PA-PW-SALT appear in the AS-REP, each listing one
  # key for the most preferred matching enctype.
@@ -6034,7 +6033,7 @@ index 38cf96ca8f..e82ff7ff07 100644
               'asrep pw_salt KRBTEST.COMuser'])
  
  # With a newer enctype in the request (even if it is not the most
-@@ -39,9 +39,9 @@ test_etinfo('user', 'rc4 aes256-cts',
+@@ -39,9 +38,9 @@ test_etinfo('user', 'rc4 aes256-cts',
  
  # In preauth-required errors, PA-PW-SALT does not appear, but the same
  # etype-info2 values are expected.
@@ -6047,7 +6046,7 @@ index 38cf96ca8f..e82ff7ff07 100644
  test_etinfo('preauthuser', 'rc4 aes256-cts',
              ['error etype_info2 rc4-hmac KRBTEST.COMpreauthuser'])
  
-@@ -50,8 +50,8 @@ test_etinfo('preauthuser', 'rc4 aes256-cts',
+@@ -50,8 +49,8 @@ test_etinfo('preauthuser', 'rc4 aes256-cts',
  # (to allow for preauth mechs which don't depend on long-term keys).
  # An AS-REP cannot be generated without preauth as there is no reply
  # key.
@@ -6159,34 +6158,8 @@ index 65084bbf35..55ca897459 100755
  
  # Test using different salt types in a principal's key list.
  # Parameters from one key in the list must not leak over to later ones.
-diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py
-index 5a213617b5..c7dba0ff5b 100755
---- a/src/tests/t_sesskeynego.py
-+++ b/src/tests/t_sesskeynego.py
-@@ -26,7 +26,6 @@ conf3 = {'libdefaults': {
-         'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}}
- conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}}
- conf5 = {'libdefaults': {'allow_rc4': 'true'}}
--conf6 = {'libdefaults': {'allow_des3': 'true'}}
- # Test with client request and session_enctypes preferring aes128, but
- # aes256 long-term key.
- realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False)
-@@ -78,13 +77,6 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac'])
- test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
- realm.stop()
- 
--# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key.
--realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False)
--realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
--realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1'])
--test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96')
--realm.stop()
--
- # 7: default config negotiates aes256-sha1 session key for RC4-only service.
- realm = K5Realm(create_host=False, get_creds=False)
- realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server'])
 diff --git a/src/util/k5test.py b/src/util/k5test.py
-index 8e5f5ba8e9..b953827018 100644
+index 2a86c5cdfc..d823653aa0 100644
 --- a/src/util/k5test.py
 +++ b/src/util/k5test.py
 @@ -1338,13 +1338,6 @@ _passes = [
@@ -6195,14 +6168,14 @@ index 8e5f5ba8e9..b953827018 100644
  
 -    # Exercise the DES3 enctype.
 -    ('des3', None,
--     {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}},
+-     {'libdefaults': {'permitted_enctypes': 'des3'}},
 -     {'realms': {'$realm': {
 -                    'supported_enctypes': 'des3-cbc-sha1:normal',
 -                    'master_key_type': 'des3-cbc-sha1'}}}),
 -
      # Exercise the arcfour enctype.
      ('arcfour', None,
-      {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}},
+      {'libdefaults': {'permitted_enctypes': 'rc4'}},
 diff --git a/src/windows/leash/htmlhelp/html/Encryption_Types.htm b/src/windows/leash/htmlhelp/html/Encryption_Types.htm
 index 1aebdd0b4a..c38eefd2bd 100644
 --- a/src/windows/leash/htmlhelp/html/Encryption_Types.htm
@@ -6228,5 +6201,5 @@ index 1aebdd0b4a..c38eefd2bd 100644
       <td>The AES Advanced Encryption Standard
  family, like 3DES, is a symmetric block cipher and was designed
 -- 
-2.40.1
+2.45.1
 

0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch

@@ -1,4 +1,4 @@
-From 53191fd3a1acfeefa8e5c26e7e9d130688daf745 Mon Sep 17 00:00:00 2001
+From 7b6453903c248a761d3ceb538dfacebbf3d3a9ff Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Fri, 9 Nov 2018 15:12:21 -0500
 Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4
@@ -41,10 +41,10 @@ Last-updated: krb5-1.20
  15 files changed, 155 insertions(+), 33 deletions(-)
 
 diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
-index ecdf917501..b78a3faf0a 100644
+index f22d5db11b..a33711d918 100644
 --- a/doc/admin/conf_files/krb5_conf.rst
 +++ b/doc/admin/conf_files/krb5_conf.rst
-@@ -342,6 +342,12 @@ The libdefaults section may contain any of the following relations:
+@@ -330,6 +330,12 @@ The libdefaults section may contain any of the following relations:
      qualification of shortnames, set this relation to the empty string
      with ``qualify_shortname = ""``.  (New in release 1.18.)
  
@@ -608,5 +608,5 @@ index 1a772d450f..232e78bc05 100644
      vt->name = "spake";
      vt->pa_type_list = pa_types;
 -- 
-2.40.1
+2.45.1
 

0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch

@@ -1,7 +1,8 @@
-From c19d0bd35cde40172118c67c38a44f164bce1e16 Mon Sep 17 00:00:00 2001
+From 707fa7bd2be6327343dc8fc5c20dc77645524518 Mon Sep 17 00:00:00 2001
 From: Julien Rische <jrische@redhat.com>
 Date: Thu, 5 May 2022 17:15:12 +0200
-Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection with FIPS
+Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection
+ with FIPS
 
 libkrad allows to establish connections only to UNIX socket in FIPS
 mode, because MD5 digest is not considered safe enough to be used for
@@ -77,5 +78,5 @@ index 929f1cef67..063f17a613 100644
          retval = ESOCKTNOSUPPORT;
          goto error;
 -- 
-2.40.1
+2.45.1
 

0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch

@@ -1,4 +1,4 @@
-From 0366e8b5b2f960cb8305fd95839376b6c18aae42 Mon Sep 17 00:00:00 2001
+From 1da88bea558348be2974470774aa688f8be634c0 Mon Sep 17 00:00:00 2001
 From: Julien Rische <jrische@redhat.com>
 Date: Wed, 7 Dec 2022 13:22:42 +0100
 Subject: [PATCH] [downstream] Make tests compatible with
@@ -37,5 +37,5 @@ index 87bac17929..26bc95a8dc 100644
          fail('URI answers do not match')
      j += 1
 -- 
-2.40.1
+2.45.1
 

0009-downstream-Include-missing-OpenSSL-FIPS-header.patch

@@ -1,4 +1,4 @@
-From a567b9de563cd8ad262f77cf97a8bc528a884745 Mon Sep 17 00:00:00 2001
+From 775ed8588cc21385fb16a4cec4a861f0d578ce04 Mon Sep 17 00:00:00 2001
 From: Julien Rische <jrische@redhat.com>
 Date: Thu, 5 Jan 2023 20:06:47 +0100
 Subject: [PATCH] [downstream] Include missing OpenSSL FIPS header
@@ -116,5 +116,5 @@ index 232e78bc05..3394f8a58e 100644
   * The SPAKE kdcpreauth module uses a secure cookie containing the following
   * concatenated fields (all integer fields are big-endian):
 -- 
-2.40.1
+2.45.1
 

0010-downstream-Do-not-set-root-as-ksu-file-owner.patch

@@ -1,4 +1,4 @@
-From 6adfd97a3558aae4ace346685266bac9dae8bba9 Mon Sep 17 00:00:00 2001
+From 4fd20741afcf76085ea62eb015cd589bb9392a7b Mon Sep 17 00:00:00 2001
 From: Julien Rische <jrische@redhat.com>
 Date: Mon, 9 Jan 2023 22:39:52 +0100
 Subject: [PATCH] [downstream] Do not set root as ksu file owner
@@ -27,5 +27,5 @@ index 7eaa2f351c..e9ae71471e 100644
  ## ${prefix}.
  prefix=@prefix@
 -- 
-2.40.1
+2.45.1
 

0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch

@@ -1,4 +1,4 @@
-From 73640dc4899494d010b83b080b3a65bd3e69177c Mon Sep 17 00:00:00 2001
+From 16f90c007036789d8d9343e8a0cbabfd21853b5a Mon Sep 17 00:00:00 2001
 From: Julien Rische <jrische@redhat.com>
 Date: Thu, 19 Jan 2023 19:22:27 +0100
 Subject: [PATCH] [downstream] Allow KRB5KDF, MD5, and MD4 in FIPS mode
@@ -161,5 +161,5 @@ index 5a43c3d9eb..8528ddc4a9 100644
          ret = KRB5_CRYPTO_INTERNAL;
          goto done;
 -- 
-2.40.1
+2.45.1
 

0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch

@@ -1,7 +1,8 @@
-From f47c9eb8618006012600a906367295ed53c558d0 Mon Sep 17 00:00:00 2001
+From 23b58199db429603802e338db530677b61561335 Mon Sep 17 00:00:00 2001
 From: Julien Rische <jrische@redhat.com>
 Date: Wed, 15 Mar 2023 15:56:34 +0100
-Subject: [PATCH] [downstream] Allow to set PAC ticket signature as optional
+Subject: [PATCH] [downstream] Allow to set PAC ticket signature as
+ optional
 
 MS-PAC states that "The ticket signature SHOULD be included in tickets
 that are not encrypted to the krbtgt account". However, the
@@ -73,10 +74,10 @@ index 745b24f351..6075349e5e 100644
  #if !defined(_WIN32)
  
 diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
-index 350bcf86f2..17e1b52266 100644
+index c5a625db8f..2d9b64dc85 100644
 --- a/src/include/krb5/krb5.hin
 +++ b/src/include/krb5/krb5.hin
-@@ -8356,6 +8356,46 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+@@ -8329,6 +8329,46 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
                         const krb5_keyblock *server,
                         const krb5_keyblock *privsvr, krb5_pac *pac_out);
  
@@ -124,7 +125,7 @@ index 350bcf86f2..17e1b52266 100644
  krb5_error_code KRB5_CALLCONV
  krb5_pac_sign(krb5_context context, krb5_pac pac, krb5_timestamp authtime,
 diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
-index ea10e23a95..c7b6e4090d 100644
+index fe4e48209a..93415ba862 100644
 --- a/src/kdc/kdc_util.c
 +++ b/src/kdc/kdc_util.c
 @@ -560,16 +560,36 @@ cleanup:
@@ -258,7 +259,7 @@ index 4c50e935a2..d4b0455c8c 100644
  krb5_kt_client_default
  krb5_kt_close
 diff --git a/src/man/kadmin.man b/src/man/kadmin.man
-index d028dc2975..2c8d10067f 100644
+index 8413e70ccd..f68eb0569d 100644
 --- a/src/man/kadmin.man
 +++ b/src/man/kadmin.man
 @@ -724,6 +724,12 @@ encryption type.  It may be necessary to set this value to
@@ -275,5 +276,5 @@ index d028dc2975..2c8d10067f 100644
  .sp
  This command requires the \fBmodify\fP privilege.
 -- 
-2.40.1
+2.45.1
 

0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch

@@ -1,8 +1,8 @@
-From d1322546dca51100759eac318ce554bd301c50c3 Mon Sep 17 00:00:00 2001
+From 31b9debcf2cbd558f8f315fefb69fc8206b115b4 Mon Sep 17 00:00:00 2001
 From: Julien Rische <jrische@redhat.com>
 Date: Tue, 23 May 2023 12:19:54 +0200
-Subject: [PATCH] [downstream] Make PKINIT CMS SHA-1 signature verification
- available in FIPS mode
+Subject: [PATCH] [downstream] Make PKINIT CMS SHA-1 signature
+ verification available in FIPS mode
 
 We recommend using the SHA1 crypto-module in order to allow the
 verification of SHA-1 signature for CMS messages. However, this module
@@ -20,7 +20,7 @@ curve cryptography is implemented for PKINIT in MIT krb5.
  1 file changed, 10 insertions(+), 1 deletion(-)
 
 diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-index f41328763e..263ef7845e 100644
+index cb9c79626c..17dd18e37d 100644
 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
 +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
 @@ -1844,8 +1844,17 @@ cms_signeddata_verify(krb5_context context,
@@ -43,5 +43,5 @@ index f41328763e..263ef7845e 100644
          goto cleanup;
      }
 -- 
-2.40.1
+2.45.1
 

0014-Enable-PKINIT-if-at-least-one-group-is-available.patch

@@ -1,4 +1,4 @@
-From a378b1970d92692baeddf6a8681f47efb13e343d Mon Sep 17 00:00:00 2001
+From c24c9faf859ddc04910a6bc591d8ddb2ada93e80 Mon Sep 17 00:00:00 2001
 From: Greg Hudson <ghudson@mit.edu>
 Date: Tue, 30 May 2023 01:21:48 -0400
 Subject: [PATCH] Enable PKINIT if at least one group is available
@@ -52,7 +52,7 @@ index 9fa315d7a0..8bdbea8e95 100644
  
  krb5_error_code pkinit_init_req_crypto(pkinit_req_crypto_context *);
 diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-index 263ef7845e..d646073d55 100644
+index 17dd18e37d..8cdc40bfb4 100644
 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
 +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
 @@ -47,7 +47,8 @@
@@ -139,7 +139,7 @@ index 263ef7845e..d646073d55 100644
  }
  
  static void
-@@ -2910,11 +2918,11 @@ client_create_dh(krb5_context context,
+@@ -2912,11 +2920,11 @@ client_create_dh(krb5_context context,
  
      if (cryptoctx->received_params != NULL)
          params = cryptoctx->received_params;
@@ -154,7 +154,7 @@ index 263ef7845e..d646073d55 100644
          params = plg_cryptoctx->dh_4096;
      else
          goto cleanup;
-@@ -3210,19 +3218,23 @@ pkinit_create_td_dh_parameters(krb5_context context,
+@@ -3212,19 +3220,23 @@ pkinit_create_td_dh_parameters(krb5_context context,
      krb5_algorithm_identifier alg_4096 = { dh_oid, oakley_4096 };
      krb5_algorithm_identifier *alglist[4];
  
@@ -214,5 +214,5 @@ index 259e95c6c2..5ee39c085c 100644
      TRACE(c, "PKINIT OpenSSL error: {str}", msg)
  
 -- 
-2.40.1
+2.45.1
 

0015-Replace-ssl.wrap_socket-for-tests.patch

@@ -0,0 +1,64 @@
+From e92365b510a2407eaceaec90836f5c713403d75f Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Wed, 19 Jul 2023 13:43:17 +0200
+Subject: [PATCH] Replace ssl.wrap_socket() for tests
+
+The ssl.wrap_socket() function was deprecated in Python 3.7 and is
+removed in Python 3.12.  The ssl.SSLContext.wrap_socket() method
+replaces it.
+
+Bump the required Python version for tests to 3.4 for
+ssl.create_default_context().
+
+[ghudson@mit.edu: changed minimum Python version]
+
+(cherry picked from commit 0ceab6c363e65fb21d3312a663f2b9b569ecc415)
+---
+ src/configure.ac             | 9 ++++-----
+ src/util/wsgiref-kdcproxy.py | 4 +++-
+ 2 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/src/configure.ac b/src/configure.ac
+index 2561e917a2..487f393146 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -1157,10 +1157,9 @@ AC_SUBST(PKINIT)
+ # for lib/apputils
+ AC_REPLACE_FUNCS(daemon)
+ 
+-# For Python tests.  Python version 3.2.4 is required as prior
+-# versions do not accept string input to subprocess.Popen.communicate
+-# when universal_newlines is set.
+-PYTHON_MINVERSION=3.2.4
++# For Python tests.  Python version 3.4 is required for
++# ssl.create_default_context().
++PYTHON_MINVERSION=3.4
+ AC_SUBST(PYTHON_MINVERSION)
+ AC_CHECK_PROG(PYTHON,python3,python3)
+ if test x"$PYTHON" = x; then
+@@ -1168,7 +1167,7 @@ if test x"$PYTHON" = x; then
+ fi
+ HAVE_PYTHON=no
+ if test x"$PYTHON" != x; then
+-	wantver="(sys.hexversion >= 0x30204F0)"
++	wantver="(sys.hexversion >= 0x30400F0)"
+ 	if "$PYTHON" -c "import sys; sys.exit(not $wantver and 1 or 0)"; then
+ 		HAVE_PYTHON=yes
+ 	fi
+diff --git a/src/util/wsgiref-kdcproxy.py b/src/util/wsgiref-kdcproxy.py
+index 58759696b6..d1d10d733c 100755
+--- a/src/util/wsgiref-kdcproxy.py
++++ b/src/util/wsgiref-kdcproxy.py
+@@ -14,6 +14,8 @@ else:
+     pem = '*'
+ 
+ server = make_server('localhost', port, kdcproxy.Application())
+-server.socket = ssl.wrap_socket(server.socket, certfile=pem, server_side=True)
++sslctx = ssl.create_default_context(purpose=ssl.Purpose.CLIENT_AUTH)
++sslctx.load_cert_chain(certfile=pem)
++server.socket = sslctx.wrap_socket(server.socket, server_side=True)
+ os.write(sys.stdout.fileno(), b'proxy server ready\n')
+ server.serve_forever()
+-- 
+2.45.1
+

0017-Fix-two-unlikely-memory-leaks.patch

@@ -0,0 +1,206 @@
+From ee66c1feedb57ce06ce51aaa823f9a61f564c58e Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 5 Mar 2024 19:53:07 -0500
+Subject: [PATCH] Fix two unlikely memory leaks
+
+In gss_krb5int_make_seal_token_v3(), one of the bounds checks (which
+could probably never be triggered) leaks plain.data.  Fix this leak
+and use current practices for cleanup throughout the function.
+
+In xmt_rmtcallres() (unused within the tree and likely elsewhere),
+store port_ptr into crp->port_ptr as soon as it is allocated;
+otherwise it could leak if the subsequent xdr_u_int32() operation
+fails.
+
+(cherry picked from commit c5f9c816107f70139de11b38aa02db2f1774ee0d)
+---
+ src/lib/gssapi/krb5/k5sealv3.c | 56 +++++++++++++++-------------------
+ src/lib/rpc/pmap_rmt.c         | 10 +++---
+ 2 files changed, 29 insertions(+), 37 deletions(-)
+
+diff --git a/src/lib/gssapi/krb5/k5sealv3.c b/src/lib/gssapi/krb5/k5sealv3.c
+index 1fcbdfbb87..d3210c1107 100644
+--- a/src/lib/gssapi/krb5/k5sealv3.c
++++ b/src/lib/gssapi/krb5/k5sealv3.c
+@@ -65,7 +65,7 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+                                 int conf_req_flag, int toktype)
+ {
+     size_t bufsize = 16;
+-    unsigned char *outbuf = 0;
++    unsigned char *outbuf = NULL;
+     krb5_error_code err;
+     int key_usage;
+     unsigned char acceptor_flag;
+@@ -75,9 +75,13 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+ #endif
+     size_t ec;
+     unsigned short tok_id;
+-    krb5_checksum sum;
++    krb5_checksum sum = { 0 };
+     krb5_key key;
+     krb5_cksumtype cksumtype;
++    krb5_data plain = empty_data();
++
++    token->value = NULL;
++    token->length = 0;
+ 
+     acceptor_flag = ctx->initiate ? 0 : FLAG_SENDER_IS_ACCEPTOR;
+     key_usage = (toktype == KG_TOK_WRAP_MSG
+@@ -107,14 +111,15 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+ #endif
+ 
+     if (toktype == KG_TOK_WRAP_MSG && conf_req_flag) {
+-        krb5_data plain;
+         krb5_enc_data cipher;
+         size_t ec_max;
+         size_t encrypt_size;
+ 
+         /* 300: Adds some slop.  */
+-        if (SIZE_MAX - 300 < message->length)
+-            return ENOMEM;
++        if (SIZE_MAX - 300 < message->length) {
++            err = ENOMEM;
++            goto cleanup;
++        }
+         ec_max = SIZE_MAX - message->length - 300;
+         if (ec_max > 0xffff)
+             ec_max = 0xffff;
+@@ -126,20 +131,20 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+ #endif
+         err = alloc_data(&plain, message->length + 16 + ec);
+         if (err)
+-            return err;
++            goto cleanup;
+ 
+         /* Get size of ciphertext.  */
+         encrypt_size = krb5_encrypt_size(plain.length, key->keyblock.enctype);
+         if (encrypt_size > SIZE_MAX / 2) {
+             err = ENOMEM;
+-            goto error;
++            goto cleanup;
+         }
+         bufsize = 16 + encrypt_size;
+         /* Allocate space for header plus encrypted data.  */
+         outbuf = gssalloc_malloc(bufsize);
+         if (outbuf == NULL) {
+-            free(plain.data);
+-            return ENOMEM;
++            err = ENOMEM;
++            goto cleanup;
+         }
+ 
+         /* TOK_ID */
+@@ -164,11 +169,8 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+         cipher.ciphertext.length = bufsize - 16;
+         cipher.enctype = key->keyblock.enctype;
+         err = krb5_k_encrypt(context, key, key_usage, 0, &plain, &cipher);
+-        zap(plain.data, plain.length);
+-        free(plain.data);
+-        plain.data = 0;
+         if (err)
+-            goto error;
++            goto cleanup;
+ 
+         /* Now that we know we're returning a valid token....  */
+         ctx->seq_send++;
+@@ -181,7 +183,6 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+         /* If the rotate fails, don't worry about it.  */
+ #endif
+     } else if (toktype == KG_TOK_WRAP_MSG && !conf_req_flag) {
+-        krb5_data plain;
+         size_t cksumsize;
+ 
+         /* Here, message is the application-supplied data; message2 is
+@@ -193,21 +194,19 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+     wrap_with_checksum:
+         err = alloc_data(&plain, message->length + 16);
+         if (err)
+-            return err;
++            goto cleanup;
+ 
+         err = krb5_c_checksum_length(context, cksumtype, &cksumsize);
+         if (err)
+-            goto error;
++            goto cleanup;
+ 
+         assert(cksumsize <= 0xffff);
+ 
+         bufsize = 16 + message2->length + cksumsize;
+         outbuf = gssalloc_malloc(bufsize);
+         if (outbuf == NULL) {
+-            free(plain.data);
+-            plain.data = 0;
+             err = ENOMEM;
+-            goto error;
++            goto cleanup;
+         }
+ 
+         /* TOK_ID */
+@@ -239,23 +238,15 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+         if (message2->length)
+             memcpy(outbuf + 16, message2->value, message2->length);
+ 
+-        sum.contents = outbuf + 16 + message2->length;
+-        sum.length = cksumsize;
+-
+         err = krb5_k_make_checksum(context, cksumtype, key,
+                                    key_usage, &plain, &sum);
+-        zap(plain.data, plain.length);
+-        free(plain.data);
+-        plain.data = 0;
+         if (err) {
+             zap(outbuf,bufsize);
+-            goto error;
++            goto cleanup;
+         }
+         if (sum.length != cksumsize)
+             abort();
+         memcpy(outbuf + 16 + message2->length, sum.contents, cksumsize);
+-        krb5_free_checksum_contents(context, &sum);
+-        sum.contents = 0;
+         /* Now that we know we're actually generating the token...  */
+         ctx->seq_send++;
+ 
+@@ -285,12 +276,13 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+ 
+     token->value = outbuf;
+     token->length = bufsize;
+-    return 0;
++    outbuf = NULL;
++    err = 0;
+ 
+-error:
++cleanup:
++    krb5_free_checksum_contents(context, &sum);
++    zapfree(plain.data, plain.length);
+     gssalloc_free(outbuf);
+-    token->value = NULL;
+-    token->length = 0;
+     return err;
+ }
+ 
+diff --git a/src/lib/rpc/pmap_rmt.c b/src/lib/rpc/pmap_rmt.c
+index 434e4eea65..f55ca46c60 100644
+--- a/src/lib/rpc/pmap_rmt.c
++++ b/src/lib/rpc/pmap_rmt.c
+@@ -161,12 +161,12 @@ xdr_rmtcallres(
+ 	caddr_t port_ptr;
+ 
+ 	port_ptr = (caddr_t)(void *)crp->port_ptr;
+-	if (xdr_reference(xdrs, &port_ptr, sizeof (uint32_t),
+-			  (xdrproc_t)xdr_u_int32) &&
+-	    xdr_u_int32(xdrs, &crp->resultslen)) {
+-		crp->port_ptr = (uint32_t *)(void *)port_ptr;
++	if (!xdr_reference(xdrs, &port_ptr, sizeof (uint32_t),
++			   (xdrproc_t)xdr_u_int32))
++		return (FALSE);
++	crp->port_ptr = (uint32_t *)(void *)port_ptr;
++	if (xdr_u_int32(xdrs, &crp->resultslen))
+ 		return ((*(crp->xdr_results))(xdrs, crp->results_ptr));
+-	}
+ 	return (FALSE);
+ }
+ 
+-- 
+2.45.1
+

0019-Remove-klist-s-defname-global-variable.patch

@@ -0,0 +1,71 @@
+From 05bb6d9c729a3c6a4ba35270368bc0f6e1875ad0 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Mon, 8 Jan 2024 16:52:27 +0100
+Subject: [PATCH] Remove klist's defname global variable
+
+Addition of a "cleanup" section in kinit's show_ccache() function as
+part of commit 6c5471176f5266564fbc8a7e02f03b4b042202f8 introduced a
+double-free bug, because defname is a global variable.  After the
+first call, successive calls may take place with a dangling pointer in
+defname, which will be freed if krb5_cc_get_principal() fails.
+
+Convert "defname" to a local variable initialized at the beginning of
+show_ccache().
+
+[ghudson@mit.edu: edited commit message]
+
+(cherry picked from commit 5b00197227231943bd2305328c8260dd0b0dbcf0)
+---
+ src/clients/klist/klist.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c
+index b5ae96a843..b5808e5c93 100644
+--- a/src/clients/klist/klist.c
++++ b/src/clients/klist/klist.c
+@@ -53,7 +53,6 @@ int show_flags = 0, show_time = 0, status_only = 0, show_keys = 0;
+ int show_etype = 0, show_addresses = 0, no_resolve = 0, print_version = 0;
+ int show_adtype = 0, show_all = 0, list_all = 0, use_client_keytab = 0;
+ int show_config = 0;
+-char *defname;
+ char *progname;
+ krb5_timestamp now;
+ unsigned int timestamp_width;
+@@ -62,7 +61,7 @@ krb5_context context;
+ 
+ static krb5_boolean is_local_tgt(krb5_principal princ, krb5_data *realm);
+ static char *etype_string(krb5_enctype );
+-static void show_credential(krb5_creds *);
++static void show_credential(krb5_creds *, const char *);
+ 
+ static void list_all_ccaches(void);
+ static int list_ccache(krb5_ccache);
+@@ -473,6 +472,7 @@ show_ccache(krb5_ccache cache)
+     krb5_creds creds;
+     krb5_principal princ = NULL;
+     krb5_error_code ret;
++    char *defname = NULL;
+     int status = 1;
+ 
+     ret = krb5_cc_get_principal(context, cache, &princ);
+@@ -503,7 +503,7 @@ show_ccache(krb5_ccache cache)
+     }
+     while ((ret = krb5_cc_next_cred(context, cache, &cur, &creds)) == 0) {
+         if (show_config || !krb5_is_config_principal(context, creds.server))
+-            show_credential(&creds);
++            show_credential(&creds, defname);
+         krb5_free_cred_contents(context, &creds);
+     }
+     if (ret == KRB5_CC_END) {
+@@ -676,7 +676,7 @@ print_config_data(int col, krb5_data *data)
+ }
+ 
+ static void
+-show_credential(krb5_creds *cred)
++show_credential(krb5_creds *cred, const char *defname)
+ {
+     krb5_error_code ret;
+     krb5_ticket *tkt = NULL;
+-- 
+2.45.1
+

0020-End-connection-on-KDC_ERR_SVC_UNAVAILABLE.patch

@@ -0,0 +1,34 @@
+From d7bcca2a215de880f4419afc450a96a747d48560 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 27 Oct 2023 00:44:53 -0400
+Subject: [PATCH] End connection on KDC_ERR_SVC_UNAVAILABLE
+
+In sendto_kdc.c:service_fds(), if a message handler indicates that a
+message should be discarded, kill the connection so we don't continue
+waiting on it for more data.
+
+ticket: 7899
+(cherry picked from commit ca80f64c786341d5871ae1de18142e62af64f7b9)
+---
+ src/lib/krb5/os/sendto_kdc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
+index 0f4bf23a95..262edf09b4 100644
+--- a/src/lib/krb5/os/sendto_kdc.c
++++ b/src/lib/krb5/os/sendto_kdc.c
+@@ -1440,7 +1440,10 @@ service_fds(krb5_context context, struct select_state *selstate,
+                 if (msg_handler != NULL) {
+                     krb5_data reply = make_data(state->in.buf, state->in.pos);
+ 
+-                    stop = (msg_handler(context, &reply, msg_handler_data) != 0);
++                    if (!msg_handler(context, &reply, msg_handler_data)) {
++                        kill_conn(context, state, selstate);
++                        stop = 0;
++                    }
+                 }
+ 
+                 if (stop) {
+-- 
+2.46.0
+

0021-Add-request_timeout-configuration-parameter.patch

@@ -0,0 +1,226 @@
+From a07b3ae29fd972c40e30b95f6bcc8fb3ed4d9991 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Thu, 26 Oct 2023 14:20:34 -0400
+Subject: [PATCH] Add request_timeout configuration parameter
+
+Add a parameter to limit the total amount of time taken for a KDC or
+password change request.
+
+ticket: 9106 (new)
+(cherry picked from commit 802318cda963456b3ed7856c836e89da891483be)
+---
+ doc/admin/conf_files/krb5_conf.rst |  9 ++++++
+ src/include/k5-int.h               |  2 ++
+ src/lib/krb5/krb/init_ctx.c        | 14 +++++++-
+ src/lib/krb5/os/sendto_kdc.c       | 51 ++++++++++++++++++++----------
+ 4 files changed, 58 insertions(+), 18 deletions(-)
+
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index a33711d918..65fb592d98 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -356,6 +356,15 @@ The libdefaults section may contain any of the following relations:
+     (:ref:`duration` string.)  Sets the default renewable lifetime
+     for initial ticket requests.  The default value is 0.
+ 
++**request_timeout**
++    (:ref:`duration` string.)  Sets the maximum total time for KDC or
++    password change requests.  This timeout does not affect the
++    intervals between requests, so setting a low timeout may result in
++    fewer requests being attempted and/or some servers not being
++    contacted.  A value of 0 indicates no specific maximum, in which
++    case requests will time out if no server responds after several
++    tries.  The default value is 0.  (New in release 1.22.)
++
+ **spake_preauth_groups**
+     A whitespace or comma-separated list of words which specifies the
+     groups allowed for SPAKE preauthentication.  The possible values
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index b3e07945c1..69d6a6f569 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -296,6 +296,7 @@ typedef unsigned char   u_char;
+ #define KRB5_CONF_SPAKE_PREAUTH_INDICATOR      "spake_preauth_indicator"
+ #define KRB5_CONF_SPAKE_PREAUTH_KDC_CHALLENGE  "spake_preauth_kdc_challenge"
+ #define KRB5_CONF_SPAKE_PREAUTH_GROUPS         "spake_preauth_groups"
++#define KRB5_CONF_REQUEST_TIMEOUT              "request_timeout"
+ #define KRB5_CONF_TICKET_LIFETIME              "ticket_lifetime"
+ #define KRB5_CONF_UDP_PREFERENCE_LIMIT         "udp_preference_limit"
+ #define KRB5_CONF_UNLOCKITER                   "unlockiter"
+@@ -1200,6 +1201,7 @@ struct _krb5_context {
+     kdb5_dal_handle *dal_handle;
+     /* allowable clock skew */
+     krb5_deltat     clockskew;
++    krb5_deltat     req_timeout;
+     krb5_flags      kdc_default_options;
+     krb5_flags      library_options;
+     krb5_boolean    profile_secure;
+diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
+index 2b5abcd817..582a2945ff 100644
+--- a/src/lib/krb5/krb/init_ctx.c
++++ b/src/lib/krb5/krb/init_ctx.c
+@@ -157,7 +157,7 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+     krb5_context ctx = 0;
+     krb5_error_code retval;
+     int tmp;
+-    char *plugin_dir = NULL;
++    char *plugin_dir = NULL, *timeout_str = NULL;
+ 
+     /* Verify some assumptions.  If the assumptions hold and the
+        compiler is optimizing, this should result in no code being
+@@ -240,6 +240,17 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+     get_integer(ctx, KRB5_CONF_CLOCKSKEW, DEFAULT_CLOCKSKEW, &tmp);
+     ctx->clockskew = tmp;
+ 
++    retval = profile_get_string(ctx->profile, KRB5_CONF_LIBDEFAULTS,
++                                KRB5_CONF_REQUEST_TIMEOUT, NULL, NULL,
++                                &timeout_str);
++    if (retval)
++        goto cleanup;
++    if (timeout_str != NULL) {
++        retval = krb5_string_to_deltat(timeout_str, &ctx->req_timeout);
++        if (retval)
++            goto cleanup;
++    }
++
+     get_integer(ctx, KRB5_CONF_KDC_DEFAULT_OPTIONS, KDC_OPT_RENEWABLE_OK,
+                 &tmp);
+     ctx->kdc_default_options = tmp;
+@@ -281,6 +292,7 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+ 
+ cleanup:
+     profile_release_string(plugin_dir);
++    profile_release_string(timeout_str);
+     krb5_free_context(ctx);
+     return retval;
+ }
+diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
+index 262edf09b4..98247a1089 100644
+--- a/src/lib/krb5/os/sendto_kdc.c
++++ b/src/lib/krb5/os/sendto_kdc.c
+@@ -1395,34 +1395,41 @@ get_endtime(time_ms endtime, struct conn_state *conns)
+ 
+ static krb5_boolean
+ service_fds(krb5_context context, struct select_state *selstate,
+-            time_ms interval, struct conn_state *conns,
++            time_ms interval, time_ms timeout, struct conn_state *conns,
+             struct select_state *seltemp, const krb5_data *realm,
+             int (*msg_handler)(krb5_context, const krb5_data *, void *),
+             void *msg_handler_data, struct conn_state **winner_out)
+ {
+     int e, selret = 0;
+-    time_ms endtime;
++    time_ms curtime, interval_end, endtime;
+     struct conn_state *state;
+ 
+     *winner_out = NULL;
+ 
+-    e = get_curtime_ms(&endtime);
++    e = get_curtime_ms(&curtime);
+     if (e)
+         return TRUE;
+-    endtime += interval;
++    interval_end = curtime + interval;
+ 
+     e = 0;
+     while (selstate->nfds > 0) {
+-        e = cm_select_or_poll(selstate, get_endtime(endtime, conns),
+-                              seltemp, &selret);
++        endtime = get_endtime(interval_end, conns);
++        /* Don't wait longer than the whole request should last. */
++        if (timeout && endtime > timeout)
++            endtime = timeout;
++        e = cm_select_or_poll(selstate, endtime, seltemp, &selret);
+         if (e == EINTR)
+             continue;
+         if (e != 0)
+             break;
+ 
+-        if (selret == 0)
+-            /* Timeout, return to caller.  */
++        if (selret == 0) {
++            /* We timed out.  Stop if we hit the overall request timeout. */
++            if (timeout && (get_curtime_ms(&curtime) || curtime >= timeout))
++                return TRUE;
++            /* Otherwise return to the caller to send the next request. */
+             return FALSE;
++        }
+ 
+         /* Got something on a socket, process it.  */
+         for (state = conns; state != NULL; state = state->next) {
+@@ -1495,7 +1502,7 @@ k5_sendto(krb5_context context, const krb5_data *message,
+           void *msg_handler_data)
+ {
+     int pass;
+-    time_ms delay;
++    time_ms delay, timeout = 0;
+     krb5_error_code retval;
+     struct conn_state *conns = NULL, *state, **tailptr, *next, *winner;
+     size_t s;
+@@ -1505,6 +1512,13 @@ k5_sendto(krb5_context context, const krb5_data *message,
+ 
+     *reply = empty_data();
+ 
++    if (context->req_timeout) {
++        retval = get_curtime_ms(&timeout);
++        if (retval)
++            return retval;
++        timeout += 1000 * context->req_timeout;
++    }
++
+     /* One for use here, listing all our fds in use, and one for
+      * temporary use in service_fds, for the fds of interest.  */
+     sel_state = malloc(2 * sizeof(*sel_state));
+@@ -1532,8 +1546,9 @@ k5_sendto(krb5_context context, const krb5_data *message,
+             if (maybe_send(context, state, message, sel_state, realm,
+                            callback_info))
+                 continue;
+-            done = service_fds(context, sel_state, 1000, conns, seltemp,
+-                               realm, msg_handler, msg_handler_data, &winner);
++            done = service_fds(context, sel_state, 1000, timeout, conns,
++                               seltemp, realm, msg_handler, msg_handler_data,
++                               &winner);
+         }
+     }
+ 
+@@ -1545,13 +1560,13 @@ k5_sendto(krb5_context context, const krb5_data *message,
+         if (maybe_send(context, state, message, sel_state, realm,
+                        callback_info))
+             continue;
+-        done = service_fds(context, sel_state, 1000, conns, seltemp,
++        done = service_fds(context, sel_state, 1000, timeout, conns, seltemp,
+                            realm, msg_handler, msg_handler_data, &winner);
+     }
+ 
+     /* Wait for two seconds at the end of the first pass. */
+     if (!done) {
+-        done = service_fds(context, sel_state, 2000, conns, seltemp,
++        done = service_fds(context, sel_state, 2000, timeout, conns, seltemp,
+                            realm, msg_handler, msg_handler_data, &winner);
+     }
+ 
+@@ -1562,15 +1577,17 @@ k5_sendto(krb5_context context, const krb5_data *message,
+             if (maybe_send(context, state, message, sel_state, realm,
+                            callback_info))
+                 continue;
+-            done = service_fds(context, sel_state, 1000, conns, seltemp,
+-                               realm, msg_handler, msg_handler_data, &winner);
++            done = service_fds(context, sel_state, 1000, timeout, conns,
++                               seltemp, realm, msg_handler, msg_handler_data,
++                               &winner);
+             if (sel_state->nfds == 0)
+                 break;
+         }
+         /* Wait for the delay backoff at the end of this pass. */
+         if (!done) {
+-            done = service_fds(context, sel_state, delay, conns, seltemp,
+-                               realm, msg_handler, msg_handler_data, &winner);
++            done = service_fds(context, sel_state, delay, timeout, conns,
++                               seltemp, realm, msg_handler, msg_handler_data,
++                               &winner);
+         }
+         if (sel_state->nfds == 0)
+             break;
+-- 
+2.46.0
+

0022-Wait-indefinitely-on-KDC-TCP-connections.patch

@@ -0,0 +1,138 @@
+From 1da153d97d7fb30a44fca35f9b71b8f4ed5385b9 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Thu, 26 Oct 2023 16:26:42 -0400
+Subject: [PATCH] Wait indefinitely on KDC TCP connections
+
+When making a KDC or password change request, wait indefinitely
+(limited only by request_timeout if set) once a KDC has accepted a TCP
+connection.
+
+ticket: 9105 (new)
+(cherry picked from commit 6436a3808061da787a43c6810f5f0370cdfb6e36)
+---
+ doc/admin/conf_files/krb5_conf.rst |  2 +-
+ src/lib/krb5/os/sendto_kdc.c       | 50 ++++++++++++++++--------------
+ 2 files changed, 27 insertions(+), 25 deletions(-)
+
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index 65fb592d98..b7284c47df 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -357,7 +357,7 @@ The libdefaults section may contain any of the following relations:
+     for initial ticket requests.  The default value is 0.
+ 
+ **request_timeout**
+-    (:ref:`duration` string.)  Sets the maximum total time for KDC or
++    (:ref:`duration` string.)  Sets the maximum total time for KDC and
+     password change requests.  This timeout does not affect the
+     intervals between requests, so setting a low timeout may result in
+     fewer requests being attempted and/or some servers not being
+diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
+index 98247a1089..924f5b2d26 100644
+--- a/src/lib/krb5/os/sendto_kdc.c
++++ b/src/lib/krb5/os/sendto_kdc.c
+@@ -134,7 +134,6 @@ struct conn_state {
+     krb5_data callback_buffer;
+     size_t server_index;
+     struct conn_state *next;
+-    time_ms endtime;
+     krb5_boolean defer;
+     struct {
+         const char *uri_path;
+@@ -344,15 +343,19 @@ cm_select_or_poll(const struct select_state *in, time_ms endtime,
+                   struct select_state *out, int *sret)
+ {
+ #ifndef USE_POLL
+-    struct timeval tv;
++    struct timeval tv, *tvp;
+ #endif
+     krb5_error_code retval;
+     time_ms curtime, interval;
+ 
+-    retval = get_curtime_ms(&curtime);
+-    if (retval != 0)
+-        return retval;
+-    interval = (curtime < endtime) ? endtime - curtime : 0;
++    if (endtime != 0) {
++        retval = get_curtime_ms(&curtime);
++        if (retval != 0)
++            return retval;
++        interval = (curtime < endtime) ? endtime - curtime : 0;
++    } else {
++        interval = -1;
++    }
+ 
+     /* We don't need a separate copy of the selstate for poll, but use one for
+      * consistency with how we use select. */
+@@ -361,9 +364,14 @@ cm_select_or_poll(const struct select_state *in, time_ms endtime,
+ #ifdef USE_POLL
+     *sret = poll(out->fds, out->nfds, interval);
+ #else
+-    tv.tv_sec = interval / 1000;
+-    tv.tv_usec = interval % 1000 * 1000;
+-    *sret = select(out->max, &out->rfds, &out->wfds, &out->xfds, &tv);
++    if (interval != -1) {
++        tv.tv_sec = interval / 1000;
++        tv.tv_usec = interval % 1000 * 1000;
++        tvp = &tv;
++    } else {
++        tvp = NULL;
++    }
++    *sret = select(out->max, &out->rfds, &out->wfds, &out->xfds, tvp);
+ #endif
+ 
+     return (*sret < 0) ? SOCKET_ERRNO : 0;
+@@ -1099,11 +1107,6 @@ service_tcp_connect(krb5_context context, const krb5_data *realm,
+     }
+ 
+     conn->state = WRITING;
+-
+-    /* Record this connection's timeout for service_fds. */
+-    if (get_curtime_ms(&conn->endtime) == 0)
+-        conn->endtime += 10000;
+-
+     return conn->service_write(context, realm, conn, selstate);
+ }
+ 
+@@ -1378,19 +1381,18 @@ kill_conn:
+     return FALSE;
+ }
+ 
+-/* Return the maximum of endtime and the endtime fields of all currently active
+- * TCP connections. */
+-static time_ms
+-get_endtime(time_ms endtime, struct conn_state *conns)
++/* Return true if conns contains any states with connected TCP sockets. */
++static krb5_boolean
++any_tcp_connections(struct conn_state *conns)
+ {
+     struct conn_state *state;
+ 
+     for (state = conns; state != NULL; state = state->next) {
+-        if ((state->state == READING || state->state == WRITING) &&
+-            state->endtime > endtime)
+-            endtime = state->endtime;
++        if (state->addr.transport != UDP &&
++            (state->state == READING || state->state == WRITING))
++            return TRUE;
+     }
+-    return endtime;
++    return FALSE;
+ }
+ 
+ static krb5_boolean
+@@ -1413,9 +1415,9 @@ service_fds(krb5_context context, struct select_state *selstate,
+ 
+     e = 0;
+     while (selstate->nfds > 0) {
+-        endtime = get_endtime(interval_end, conns);
++        endtime = any_tcp_connections(conns) ? 0 : interval_end;
+         /* Don't wait longer than the whole request should last. */
+-        if (timeout && endtime > timeout)
++        if (timeout && (!endtime || endtime > timeout))
+             endtime = timeout;
+         e = cm_select_or_poll(selstate, endtime, seltemp, &selret);
+         if (e == EINTR)
+-- 
+2.46.0
+

0024-Fix-various-issues-detected-by-static-analysis.patch

@@ -0,0 +1,265 @@
+From 3999883b9745bfd7065d41ff05b19e56bcb2e791 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Fri, 6 Sep 2024 17:18:11 +0200
+Subject: [PATCH] Fix various issues detected by static analysis
+
+In klists's show_credential(), ensure that the column counter doesn't
+decrease if printf() fails.
+
+In process_k5beta7_princ(), bounds-check the e_length field.
+
+In ndr_enc_delegation_info(), initialize b so it is always valid for
+the cleanup handler.
+
+In krb5_dbe_def_decrypt_key_data(), change the flow control so ret is
+always set by the end of the function.  Return KRB5_KDB_INVALIDKEYSIZE
+if there isn't enough data in the first key_data_contents field or if
+the serialized key length is invalid.
+
+In svcauth_gss_validate(), expand rpchdr to accomodate the header plus
+MAX_AUTH_BYTES.
+
+In svcudp_reply(), change slen to unsigned to match the return type of
+XDR_GETPOS() and eliminate an unnecessary check for slen >= 0.
+
+In krb5int_pthread_loaded()(), remove pthread_equal() from the weak
+symbol checks.  It is implemented as an inline function in some glibc
+versions, which makes the comparison "&pthread_equal == 0" always
+false.
+
+[ghudson@mit.edu: further modified krb5_dbe_def_decrypt_key_data() for
+clarity; added detail to commit message]
+
+(cherry picked from commit a96541981ee34c8642ddeb6101b98e883e41c6e5)
+---
+ src/clients/klist/klist.c  | 12 ++++-----
+ src/kadmin/dbutil/dump.c   |  5 ++++
+ src/kdc/ndr.c              |  2 +-
+ src/lib/kdb/decrypt_key.c  | 54 ++++++++++++++++++++------------------
+ src/lib/rpc/svc_auth_gss.c |  5 +++-
+ src/lib/rpc/svc_udp.c      | 13 ++++-----
+ src/util/support/threads.c |  2 --
+ 7 files changed, 51 insertions(+), 42 deletions(-)
+
+diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c
+index b5808e5c93..ba9539fd23 100644
+--- a/src/clients/klist/klist.c
++++ b/src/clients/klist/klist.c
+@@ -681,7 +681,7 @@ show_credential(krb5_creds *cred, const char *defname)
+     krb5_error_code ret;
+     krb5_ticket *tkt = NULL;
+     char *name = NULL, *sname = NULL, *tktsname, *flags;
+-    int extra_field = 0, ccol = 0, i;
++    int extra_field = 0, ccol = 0, i, r;
+     krb5_boolean is_config = krb5_is_config_principal(context, cred->server);
+ 
+     ret = krb5_unparse_name(context, cred->client, &name);
+@@ -711,11 +711,11 @@ show_credential(krb5_creds *cred, const char *defname)
+         fputs("config: ", stdout);
+         ccol = 8;
+         for (i = 1; i < cred->server->length; i++) {
+-            ccol += printf("%s%.*s%s",
+-                           i > 1 ? "(" : "",
+-                           (int)cred->server->data[i].length,
+-                           cred->server->data[i].data,
+-                           i > 1 ? ")" : "");
++            r = printf("%s%.*s%s", i > 1 ? "(" : "",
++                       (int)cred->server->data[i].length,
++                       cred->server->data[i].data, i > 1 ? ")" : "");
++            if (r >= 0)
++                ccol += r;
+         }
+         fputs(" = ", stdout);
+         ccol += 3;
+diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c
+index 4d6cc0bdf9..feb053d834 100644
+--- a/src/kadmin/dbutil/dump.c
++++ b/src/kadmin/dbutil/dump.c
+@@ -704,6 +704,11 @@ process_k5beta7_princ(krb5_context context, const char *fname, FILE *filep,
+ 
+     dbentry->len = u1;
+     dbentry->n_key_data = u4;
++
++    if (u5 > UINT16_MAX) {
++        load_err(fname, *linenop, _("invalid principal extra data size"));
++        goto fail;
++    }
+     dbentry->e_length = u5;
+ 
+     if (kp != NULL) {
+diff --git a/src/kdc/ndr.c b/src/kdc/ndr.c
+index d438408ee2..38be9fe42a 100644
+--- a/src/kdc/ndr.c
++++ b/src/kdc/ndr.c
+@@ -242,7 +242,7 @@ ndr_enc_delegation_info(struct pac_s4u_delegation_info *in, krb5_data *out)
+ {
+     krb5_error_code ret;
+     size_t i;
+-    struct k5buf b;
++    struct k5buf b = EMPTY_K5BUF;
+     struct encoded_wchars pt_encoded = { 0 }, *tss_encoded = NULL;
+     uint32_t pointer = 0;
+ 
+diff --git a/src/lib/kdb/decrypt_key.c b/src/lib/kdb/decrypt_key.c
+index 82bbed6312..21aa3742b1 100644
+--- a/src/lib/kdb/decrypt_key.c
++++ b/src/lib/kdb/decrypt_key.c
+@@ -60,7 +60,7 @@ krb5_dbe_def_decrypt_key_data(krb5_context context, const krb5_keyblock *mkey,
+                               krb5_keyblock *dbkey_out,
+                               krb5_keysalt *keysalt_out)
+ {
+-    krb5_error_code ret;
++    krb5_error_code ret = KRB5_CRYPTO_INTERNAL;
+     int16_t keylen;
+     krb5_enc_data cipher;
+     krb5_data plain = empty_data();
+@@ -74,36 +74,38 @@ krb5_dbe_def_decrypt_key_data(krb5_context context, const krb5_keyblock *mkey,
+     if (mkey == NULL)
+         return KRB5_KDB_BADSTORED_MKEY;
+ 
+-    if (kd->key_data_contents[0] != NULL && kd->key_data_length[0] >= 2) {
+-        keylen = load_16_le(kd->key_data_contents[0]);
+-        if (keylen < 0)
+-            return EINVAL;
+-        cipher.enctype = ENCTYPE_UNKNOWN;
+-        cipher.ciphertext = make_data(kd->key_data_contents[0] + 2,
+-                                      kd->key_data_length[0] - 2);
+-        ret = alloc_data(&plain, kd->key_data_length[0] - 2);
+-        if (ret)
+-            goto cleanup;
++    if (kd->key_data_contents[0] == NULL || kd->key_data_length[0] < 2)
++        return KRB5_KDB_INVALIDKEYSIZE;
+ 
+-        ret = krb5_c_decrypt(context, mkey, 0, 0, &cipher, &plain);
+-        if (ret)
+-            goto cleanup;
++    keylen = load_16_le(kd->key_data_contents[0]);
++    if (keylen < 0)
++        return KRB5_KDB_INVALIDKEYSIZE;
+ 
+-        /* Make sure the plaintext has at least as many bytes as the true ke
+-         * length (it may have more due to padding). */
+-        if ((unsigned int)keylen > plain.length) {
+-            ret = KRB5_CRYPTO_INTERNAL;
+-            if (ret)
+-                goto cleanup;
+-        }
++    cipher.enctype = ENCTYPE_UNKNOWN;
++    cipher.ciphertext = make_data(kd->key_data_contents[0] + 2,
++                                  kd->key_data_length[0] - 2);
++    ret = alloc_data(&plain, kd->key_data_length[0] - 2);
++    if (ret)
++        goto cleanup;
+ 
+-        kb.magic = KV5M_KEYBLOCK;
+-        kb.enctype = kd->key_data_type[0];
+-        kb.length = keylen;
+-        kb.contents = (uint8_t *)plain.data;
+-        plain = empty_data();
++    ret = krb5_c_decrypt(context, mkey, 0, 0, &cipher, &plain);
++    if (ret)
++        goto cleanup;
++
++    /* Make sure the plaintext has at least as many bytes as the true key
++     * length (it may have more due to padding). */
++    if ((unsigned int)keylen > plain.length) {
++        ret = KRB5_CRYPTO_INTERNAL;
++        if (ret)
++            goto cleanup;
+     }
+ 
++    kb.magic = KV5M_KEYBLOCK;
++    kb.enctype = kd->key_data_type[0];
++    kb.length = keylen;
++    kb.contents = (uint8_t *)plain.data;
++    plain = empty_data();
++
+     /* Decode salt data. */
+     if (keysalt_out != NULL) {
+         if (kd->key_data_ver == 2) {
+diff --git a/src/lib/rpc/svc_auth_gss.c b/src/lib/rpc/svc_auth_gss.c
+index 98d601c8ab..4f1d2911b0 100644
+--- a/src/lib/rpc/svc_auth_gss.c
++++ b/src/lib/rpc/svc_auth_gss.c
+@@ -297,7 +297,7 @@ svcauth_gss_validate(struct svc_req *rqst, struct svc_rpc_gss_data *gd, struct r
+ 	struct opaque_auth	*oa;
+ 	gss_buffer_desc		 rpcbuf, checksum;
+ 	OM_uint32		 maj_stat, min_stat, qop_state;
+-	u_char			 rpchdr[128];
++	u_char			 rpchdr[32 + MAX_AUTH_BYTES];
+ 	int32_t			*buf;
+ 
+ 	log_debug("in svcauth_gss_validate()");
+@@ -315,6 +315,8 @@ svcauth_gss_validate(struct svc_req *rqst, struct svc_rpc_gss_data *gd, struct r
+ 		return (FALSE);
+ 
+ 	buf = (int32_t *)(void *)rpchdr;
++
++	/* Write the 32 first bytes of the header. */
+ 	IXDR_PUT_LONG(buf, msg->rm_xid);
+ 	IXDR_PUT_ENUM(buf, msg->rm_direction);
+ 	IXDR_PUT_LONG(buf, msg->rm_call.cb_rpcvers);
+@@ -323,6 +325,7 @@ svcauth_gss_validate(struct svc_req *rqst, struct svc_rpc_gss_data *gd, struct r
+ 	IXDR_PUT_LONG(buf, msg->rm_call.cb_proc);
+ 	IXDR_PUT_ENUM(buf, oa->oa_flavor);
+ 	IXDR_PUT_LONG(buf, oa->oa_length);
++
+ 	if (oa->oa_length) {
+ 		memcpy((caddr_t)buf, oa->oa_base, oa->oa_length);
+ 		buf += RNDUP(oa->oa_length) / sizeof(int32_t);
+diff --git a/src/lib/rpc/svc_udp.c b/src/lib/rpc/svc_udp.c
+index 8ecbdf2b33..3aff277eb7 100644
+--- a/src/lib/rpc/svc_udp.c
++++ b/src/lib/rpc/svc_udp.c
+@@ -248,8 +248,9 @@ static bool_t svcudp_reply(
+ {
+      struct svcudp_data *su = su_data(xprt);
+      XDR *xdrs = &su->su_xdrs;
+-     int slen;
++     u_int slen;
+      bool_t stat = FALSE;
++     ssize_t r;
+ 
+      xdrproc_t xdr_results = NULL;
+      caddr_t xdr_location = 0;
+@@ -272,12 +273,12 @@ static bool_t svcudp_reply(
+      if (xdr_replymsg(xdrs, msg) &&
+ 	 (!has_args ||
+ 	  (SVCAUTH_WRAP(xprt->xp_auth, xdrs, xdr_results, xdr_location)))) {
+-	  slen = (int)XDR_GETPOS(xdrs);
+-	  if (sendto(xprt->xp_sock, rpc_buffer(xprt), slen, 0,
+-		     (struct sockaddr *)&(xprt->xp_raddr), xprt->xp_addrlen)
+-	      == slen) {
++	  slen = XDR_GETPOS(xdrs);
++	  r = sendto(xprt->xp_sock, rpc_buffer(xprt), slen, 0,
++		     (struct sockaddr *)&(xprt->xp_raddr), xprt->xp_addrlen);
++	  if (r >= 0 && (u_int)r == slen) {
+ 	       stat = TRUE;
+-	       if (su->su_cache && slen >= 0) {
++	       if (su->su_cache) {
+ 		    cache_set(xprt, (uint32_t) slen);
+ 	       }
+ 	  }
+diff --git a/src/util/support/threads.c b/src/util/support/threads.c
+index be7e4c2e3f..4ded805b79 100644
+--- a/src/util/support/threads.c
++++ b/src/util/support/threads.c
+@@ -118,7 +118,6 @@ struct tsd_block {
+ # pragma weak pthread_mutex_destroy
+ # pragma weak pthread_mutex_init
+ # pragma weak pthread_self
+-# pragma weak pthread_equal
+ # pragma weak pthread_getspecific
+ # pragma weak pthread_setspecific
+ # pragma weak pthread_key_create
+@@ -151,7 +150,6 @@ int krb5int_pthread_loaded (void)
+         || &pthread_mutex_destroy == 0
+         || &pthread_mutex_init == 0
+         || &pthread_self == 0
+-        || &pthread_equal == 0
+         /* Any program that's really multithreaded will have to be
+            able to create threads.  */
+         || &pthread_create == 0
+-- 
+2.46.0
+

0025-Generate-and-verify-message-MACs-in-libkrad.patch

@@ -0,0 +1,629 @@
+From ea02fd7bb79861b8e36517c7c95af821a16657c4 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 22 Aug 2024 17:15:50 +0200
+Subject: [PATCH] Generate and verify message MACs in libkrad
+
+Implement some of the measures specified in
+draft-ietf-radext-deprecating-radius-03 for mitigating the BlastRADIUS
+attack (CVE-2024-3596):
+
+* Include a Message-Authenticator MAC as the first attribute when
+  generating a packet of type Access-Request, Access-Reject,
+  Access-Accept, or Access-Challenge (sections 5.2.1 and 5.2.4), if
+  the secret is non-empty.  (An empty secret indicates the use of Unix
+  domain socket transport.)
+
+* Validate the Message-Authenticator MAC in received packets, if
+  present.
+
+FreeRADIUS enforces Message-Authenticator as of versions 3.2.5 and
+3.0.27.  libkrad must generate Message-Authenticator attributes in
+order to remain compatible with these implementations.
+
+[ghudson@mit.edu: adjusted style and naming; simplified some
+functions; edited commit message]
+
+ticket: 9142 (new)
+tags: pullup
+target_version: 1.21-next
+
+(cherry picked from commit 871125fea8ce0370a972bf65f7d1de63f619b06c)
+---
+ src/include/k5-int.h                   |   5 +
+ src/lib/crypto/krb/checksum_hmac_md5.c |  28 ++++
+ src/lib/crypto/libk5crypto.exports     |   1 +
+ src/lib/krad/attr.c                    |  17 ++
+ src/lib/krad/attrset.c                 |  59 +++++--
+ src/lib/krad/internal.h                |   7 +-
+ src/lib/krad/packet.c                  | 206 +++++++++++++++++++++++--
+ src/lib/krad/t_attrset.c               |   2 +-
+ src/lib/krad/t_daemon.py               |   3 +-
+ src/lib/krad/t_packet.c                |  11 ++
+ src/tests/t_otp.py                     |   3 +
+ 11 files changed, 311 insertions(+), 31 deletions(-)
+
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index 69d6a6f569..b7789a2dd8 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -2403,4 +2403,9 @@ krb5_boolean
+ k5_sname_compare(krb5_context context, krb5_const_principal sname,
+                  krb5_const_principal princ);
+ 
++/* Generate an HMAC-MD5 keyed checksum as specified by RFC 2104. */
++krb5_error_code
++k5_hmac_md5(const krb5_data *key, const krb5_crypto_iov *data, size_t num_data,
++            krb5_data *output);
++
+ #endif /* _KRB5_INT_H */
+diff --git a/src/lib/crypto/krb/checksum_hmac_md5.c b/src/lib/crypto/krb/checksum_hmac_md5.c
+index ec024f3966..a809388549 100644
+--- a/src/lib/crypto/krb/checksum_hmac_md5.c
++++ b/src/lib/crypto/krb/checksum_hmac_md5.c
+@@ -92,3 +92,31 @@ cleanup:
+     free(hash_iov);
+     return ret;
+ }
++
++krb5_error_code
++k5_hmac_md5(const krb5_data *key, const krb5_crypto_iov *data, size_t num_data,
++            krb5_data *output)
++{
++    krb5_error_code ret;
++    const struct krb5_hash_provider *hash = &krb5int_hash_md5;
++    krb5_keyblock keyblock = { 0 };
++    krb5_data hashed_key;
++    uint8_t hkeybuf[16];
++    krb5_crypto_iov iov;
++
++    /* Hash the key if it is longer than the block size. */
++    if (key->length > hash->blocksize) {
++        hashed_key = make_data(hkeybuf, sizeof(hkeybuf));
++        iov.flags = KRB5_CRYPTO_TYPE_DATA;
++        iov.data = *key;
++        ret = hash->hash(&iov, 1, &hashed_key);
++        if (ret)
++            return ret;
++        key = &hashed_key;
++    }
++
++    keyblock.magic = KV5M_KEYBLOCK;
++    keyblock.length = key->length;
++    keyblock.contents = (uint8_t *)key->data;
++    return krb5int_hmac_keyblock(hash, &keyblock, data, num_data, output);
++}
+diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports
+index d8ffa63304..00e0ce1812 100644
+--- a/src/lib/crypto/libk5crypto.exports
++++ b/src/lib/crypto/libk5crypto.exports
+@@ -102,3 +102,4 @@ krb5_c_prfplus
+ krb5_c_derive_prfplus
+ k5_enctype_to_ssf
+ krb5int_c_deprecated_enctype
++k5_hmac_md5
+diff --git a/src/lib/krad/attr.c b/src/lib/krad/attr.c
+index 42d354a3b5..65ed1d35e7 100644
+--- a/src/lib/krad/attr.c
++++ b/src/lib/krad/attr.c
+@@ -125,6 +125,23 @@ static const attribute_record attributes[UCHAR_MAX] = {
+     {"NAS-Port-Type", 4, 4, NULL, NULL},
+     {"Port-Limit", 4, 4, NULL, NULL},
+     {"Login-LAT-Port", 1, MAX_ATTRSIZE, NULL, NULL},
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */
++    {NULL, 0, 0, NULL, NULL}, /* Password-Retry */
++    {NULL, 0, 0, NULL, NULL}, /* Prompt */
++    {NULL, 0, 0, NULL, NULL}, /* Connect-Info */
++    {NULL, 0, 0, NULL, NULL}, /* Configuration-Token */
++    {NULL, 0, 0, NULL, NULL}, /* EAP-Message */
++    {"Message-Authenticator", MD5_DIGEST_SIZE, MD5_DIGEST_SIZE, NULL, NULL},
+ };
+ 
+ /* Encode User-Password attribute. */
+diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c
+index 6ec031e320..e5457ebfd7 100644
+--- a/src/lib/krad/attrset.c
++++ b/src/lib/krad/attrset.c
+@@ -164,15 +164,44 @@ krad_attrset_copy(const krad_attrset *set, krad_attrset **copy)
+     return 0;
+ }
+ 
++/* Place an encoded attributes into outbuf at position *i.  Increment *i by the
++ * length of the encoding. */
++static krb5_error_code
++append_attr(krb5_context ctx, const char *secret,
++            const uint8_t *auth, krad_attr type, const krb5_data *data,
++            uint8_t outbuf[MAX_ATTRSETSIZE], size_t *i, krb5_boolean *is_fips)
++{
++    uint8_t buffer[MAX_ATTRSIZE];
++    size_t attrlen;
++    krb5_error_code retval;
++
++    retval = kr_attr_encode(ctx, secret, auth, type, data, buffer, &attrlen,
++                            is_fips);
++    if (retval)
++        return retval;
++
++    if (attrlen > MAX_ATTRSETSIZE - *i - 2)
++        return EMSGSIZE;
++
++    outbuf[(*i)++] = type;
++    outbuf[(*i)++] = attrlen + 2;
++    memcpy(outbuf + *i, buffer, attrlen);
++    *i += attrlen;
++
++    return 0;
++}
++
+ krb5_error_code
+ kr_attrset_encode(const krad_attrset *set, const char *secret,
+-                  const unsigned char *auth,
++                  const uint8_t *auth, krb5_boolean add_msgauth,
+                   unsigned char outbuf[MAX_ATTRSETSIZE], size_t *outlen,
+                   krb5_boolean *is_fips)
+ {
+-    unsigned char buffer[MAX_ATTRSIZE];
+     krb5_error_code retval;
+-    size_t i = 0, attrlen;
++    krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator");
++    const uint8_t zeroes[MD5_DIGEST_SIZE] = { 0 };
++    krb5_data zerodata;
++    size_t i = 0;
+     attr *a;
+ 
+     if (set == NULL) {
+@@ -180,19 +209,21 @@ kr_attrset_encode(const krad_attrset *set, const char *secret,
+         return 0;
+     }
+ 
+-    K5_TAILQ_FOREACH(a, &set->list, list) {
+-        retval = kr_attr_encode(set->ctx, secret, auth, a->type, &a->attr,
+-                                buffer, &attrlen, is_fips);
+-        if (retval != 0)
++    if (add_msgauth) {
++        /* Encode Message-Authenticator as the first attribute, per
++         * draft-ietf-radext-deprecating-radius-03 section 5.2. */
++        zerodata = make_data((uint8_t *)zeroes, MD5_DIGEST_SIZE);
++        retval = append_attr(set->ctx, secret, auth, msgauth_type, &zerodata,
++                             outbuf, &i, is_fips);
++        if (retval)
+             return retval;
++    }
+ 
+-        if (i + attrlen + 2 > MAX_ATTRSETSIZE)
+-            return EMSGSIZE;
+-
+-        outbuf[i++] = a->type;
+-        outbuf[i++] = attrlen + 2;
+-        memcpy(&outbuf[i], buffer, attrlen);
+-        i += attrlen;
++    K5_TAILQ_FOREACH(a, &set->list, list) {
++        retval = append_attr(set->ctx, secret, auth, a->type, &a->attr,
++                             outbuf, &i, is_fips);
++        if (retval)
++            return retval;
+     }
+ 
+     *outlen = i;
+diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h
+index a17b6f39b1..ca66f3ec68 100644
+--- a/src/lib/krad/internal.h
++++ b/src/lib/krad/internal.h
+@@ -49,6 +49,8 @@
+ #define UCHAR_MAX 255
+ #endif
+ 
++#define MD5_DIGEST_SIZE 16
++
+ /* RFC 2865 */
+ #define MAX_ATTRSIZE (UCHAR_MAX - 2)
+ #define MAX_ATTRSETSIZE (KRAD_PACKET_SIZE_MAX - 20)
+@@ -79,10 +81,11 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
+                krad_attr type, const krb5_data *in,
+                unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen);
+ 
+-/* Encode the attributes into the buffer. */
++/* Encode set into outbuf.  If add_msgauth is true, include a zeroed
++ * Message-Authenticator as the first attribute. */
+ krb5_error_code
+ kr_attrset_encode(const krad_attrset *set, const char *secret,
+-                  const unsigned char *auth,
++                  const uint8_t *auth, krb5_boolean add_msgauth,
+                   unsigned char outbuf[MAX_ATTRSETSIZE], size_t *outlen,
+                   krb5_boolean *is_fips);
+ 
+diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c
+index c5446b890c..3c1a4d507e 100644
+--- a/src/lib/krad/packet.c
++++ b/src/lib/krad/packet.c
+@@ -36,6 +36,7 @@
+ typedef unsigned char uchar;
+ 
+ /* RFC 2865 */
++#define MSGAUTH_SIZE (2 + MD5_DIGEST_SIZE)
+ #define OFFSET_CODE 0
+ #define OFFSET_ID 1
+ #define OFFSET_LENGTH 2
+@@ -222,6 +223,106 @@ packet_set_attrset(krb5_context ctx, const char *secret, krad_packet *pkt)
+     return kr_attrset_decode(ctx, &tmp, secret, pkt_auth(pkt), &pkt->attrset);
+ }
+ 
++/* Determine if a packet requires a Message-Authenticator attribute. */
++static inline krb5_boolean
++requires_msgauth(const char *secret, krad_code code)
++{
++    /* If no secret is provided, assume that the transport is a UNIX socket.
++     * Message-Authenticator is required only on UDP and TCP connections. */
++    if (*secret == '\0')
++        return FALSE;
++
++    /*
++     * Per draft-ietf-radext-deprecating-radius-03 sections 5.2.1 and 5.2.4,
++     * Message-Authenticator is required in Access-Request packets and all
++     * potential responses when UDP or TCP transport is used.
++     */
++    return code == krad_code_name2num("Access-Request") ||
++        code == krad_code_name2num("Access-Reject") ||
++        code == krad_code_name2num("Access-Accept") ||
++        code == krad_code_name2num("Access-Challenge");
++}
++
++/* Check if the packet has a Message-Authenticator attribute. */
++static inline krb5_boolean
++has_pkt_msgauth(const krad_packet *pkt)
++{
++    krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator");
++
++    return krad_attrset_get(pkt->attrset, msgauth_type, 0) != NULL;
++}
++
++/* Return the beginning of the Message-Authenticator attribute in pkt, or NULL
++ * if no such attribute is present. */
++static const uint8_t *
++lookup_msgauth_addr(const krad_packet *pkt)
++{
++    krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator");
++    size_t i;
++    uint8_t *p;
++
++    i = OFFSET_ATTR;
++    while (i + 2 < pkt->pkt.length) {
++        p = (uint8_t *)offset(&pkt->pkt, i);
++        if (msgauth_type == *p)
++            return p;
++        i += p[1];
++    }
++
++    return NULL;
++}
++
++/*
++ * Calculate the message authenticator MAC for pkt as specified in RFC 2869
++ * section 5.14, placing the result in mac_out.  Use the provided authenticator
++ * auth, which may be from pkt or from a corresponding request.
++ */
++static krb5_error_code
++calculate_mac(const char *secret, const krad_packet *pkt,
++              const uint8_t auth[AUTH_FIELD_SIZE],
++              uint8_t mac_out[MD5_DIGEST_SIZE])
++{
++    uint8_t zeroed_msgauth[MSGAUTH_SIZE];
++    krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator");
++    const uint8_t *msgauth_attr, *msgauth_end, *pkt_end;
++    krb5_crypto_iov input[5];
++    krb5_data ksecr, mac;
++
++    msgauth_attr = lookup_msgauth_addr(pkt);
++    if (msgauth_attr == NULL)
++        return EINVAL;
++    msgauth_end = msgauth_attr + MSGAUTH_SIZE;
++    pkt_end = (const uint8_t *)pkt->pkt.data + pkt->pkt.length;
++
++    /* Read code, id, and length from the packet. */
++    input[0].flags = KRB5_CRYPTO_TYPE_DATA;
++    input[0].data = make_data(pkt->pkt.data, OFFSET_AUTH);
++
++    /* Read the provided authenticator. */
++    input[1].flags = KRB5_CRYPTO_TYPE_DATA;
++    input[1].data = make_data((uint8_t *)auth, AUTH_FIELD_SIZE);
++
++    /* Read any attributes before Message-Authenticator. */
++    input[2].flags = KRB5_CRYPTO_TYPE_DATA;
++    input[2].data = make_data(pkt_attr(pkt), msgauth_attr - pkt_attr(pkt));
++
++    /* Read Message-Authenticator with the data bytes all set to zero, per RFC
++     * 2869 section 5.14. */
++    zeroed_msgauth[0] = msgauth_type;
++    zeroed_msgauth[1] = MSGAUTH_SIZE;
++    memset(zeroed_msgauth + 2, 0, MD5_DIGEST_SIZE);
++    input[3].flags = KRB5_CRYPTO_TYPE_DATA;
++    input[3].data = make_data(zeroed_msgauth, MSGAUTH_SIZE);
++
++    /* Read any attributes after Message-Authenticator. */
++    input[4].flags = KRB5_CRYPTO_TYPE_DATA;
++    input[4].data = make_data((uint8_t *)msgauth_end, pkt_end - msgauth_end);
++
++    mac = make_data(mac_out, MD5_DIGEST_SIZE);
++    ksecr = string2data((char *)secret);
++    return k5_hmac_md5(&ksecr, input, 5, &mac);
++}
++
+ ssize_t
+ krad_packet_bytes_needed(const krb5_data *buffer)
+ {
+@@ -255,6 +356,7 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code,
+     krad_packet *pkt;
+     uchar id;
+     size_t attrset_len;
++    krb5_boolean msgauth_required;
+ 
+     pkt = packet_new();
+     if (pkt == NULL) {
+@@ -274,9 +376,13 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code,
+     if (retval != 0)
+         goto error;
+ 
++    /* Determine if Message-Authenticator is required. */
++    msgauth_required = (*secret != '\0' &&
++                        code == krad_code_name2num("Access-Request"));
++
+     /* Encode the attributes. */
+-    retval = kr_attrset_encode(set, secret, pkt_auth(pkt), pkt_attr(pkt),
+-                               &attrset_len, &pkt->is_fips);
++    retval = kr_attrset_encode(set, secret, pkt_auth(pkt), msgauth_required,
++                               pkt_attr(pkt), &attrset_len, &pkt->is_fips);
+     if (retval != 0)
+         goto error;
+ 
+@@ -285,6 +391,13 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code,
+     pkt_code_set(pkt, code);
+     pkt_len_set(pkt, pkt->pkt.length);
+ 
++    if (msgauth_required) {
++        /* Calculate and set the Message-Authenticator MAC. */
++        retval = calculate_mac(secret, pkt, pkt_auth(pkt), pkt_attr(pkt) + 2);
++        if (retval != 0)
++            goto error;
++    }
++
+     /* Copy the attrset for future use. */
+     retval = packet_set_attrset(ctx, secret, pkt);
+     if (retval != 0)
+@@ -307,14 +420,19 @@ krad_packet_new_response(krb5_context ctx, const char *secret, krad_code code,
+     krb5_error_code retval;
+     krad_packet *pkt;
+     size_t attrset_len;
++    krb5_boolean msgauth_required;
+ 
+     pkt = packet_new();
+     if (pkt == NULL)
+         return ENOMEM;
+ 
++    /* Determine if Message-Authenticator is required. */
++    msgauth_required = requires_msgauth(secret, code);
++
+     /* Encode the attributes. */
+-    retval = kr_attrset_encode(set, secret, pkt_auth(request), pkt_attr(pkt),
+-                               &attrset_len, &pkt->is_fips);
++    retval = kr_attrset_encode(set, secret, pkt_auth(request),
++                               msgauth_required, pkt_attr(pkt), &attrset_len,
++                               &pkt->is_fips);
+     if (retval != 0)
+         goto error;
+ 
+@@ -330,6 +448,18 @@ krad_packet_new_response(krb5_context ctx, const char *secret, krad_code code,
+     if (retval != 0)
+         goto error;
+ 
++    if (msgauth_required) {
++        /*
++         * Calculate and replace the Message-Authenticator MAC.  Per RFC 2869
++         * section 5.14, use the authenticator from the request, not from the
++         * response.
++         */
++        retval = calculate_mac(secret, pkt, pkt_auth(request),
++                               pkt_attr(pkt) + 2);
++        if (retval != 0)
++            goto error;
++    }
++
+     /* Copy the attrset for future use. */
+     retval = packet_set_attrset(ctx, secret, pkt);
+     if (retval != 0)
+@@ -343,6 +473,34 @@ error:
+     return retval;
+ }
+ 
++/* Verify the Message-Authenticator value in pkt, using the provided
++ * authenticator (which may be from pkt or from a corresponding request). */
++static krb5_error_code
++verify_msgauth(const char *secret, const krad_packet *pkt,
++               const uint8_t auth[AUTH_FIELD_SIZE])
++{
++    uint8_t mac[MD5_DIGEST_SIZE];
++    krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator");
++    const krb5_data *msgauth;
++    krb5_error_code retval;
++
++    msgauth = krad_packet_get_attr(pkt, msgauth_type, 0);
++    if (msgauth == NULL)
++        return ENODATA;
++
++    retval = calculate_mac(secret, pkt, auth, mac);
++    if (retval)
++        return retval;
++
++    if (msgauth->length != MD5_DIGEST_SIZE)
++        return EMSGSIZE;
++
++    if (k5_bcmp(mac, msgauth->data, MD5_DIGEST_SIZE) != 0)
++        return EBADMSG;
++
++    return 0;
++}
++
+ /* Decode a packet. */
+ static krb5_error_code
+ decode_packet(krb5_context ctx, const char *secret, const krb5_data *buffer,
+@@ -394,21 +552,35 @@ krad_packet_decode_request(krb5_context ctx, const char *secret,
+                            krad_packet **reqpkt)
+ {
+     const krad_packet *tmp = NULL;
++    krad_packet *req;
+     krb5_error_code retval;
+ 
+-    retval = decode_packet(ctx, secret, buffer, reqpkt);
+-    if (cb != NULL && retval == 0) {
++    retval = decode_packet(ctx, secret, buffer, &req);
++    if (retval)
++        return retval;
++
++    /* Verify Message-Authenticator if present. */
++    if (has_pkt_msgauth(req)) {
++        retval = verify_msgauth(secret, req, pkt_auth(req));
++        if (retval) {
++            krad_packet_free(req);
++            return retval;
++        }
++    }
++
++    if (cb != NULL) {
+         for (tmp = (*cb)(data, FALSE); tmp != NULL; tmp = (*cb)(data, FALSE)) {
+             if (pkt_id_get(*reqpkt) == pkt_id_get(tmp))
+                 break;
+         }
+-    }
+ 
+-    if (cb != NULL && (retval != 0 || tmp != NULL))
+-        (*cb)(data, TRUE);
++        if (tmp != NULL)
++            (*cb)(data, TRUE);
++    }
+ 
++    *reqpkt = req;
+     *duppkt = tmp;
+-    return retval;
++    return 0;
+ }
+ 
+ krb5_error_code
+@@ -435,9 +607,17 @@ krad_packet_decode_response(krb5_context ctx, const char *secret,
+                 break;
+             }
+ 
+-            /* If the authenticator matches, then the response is valid. */
+-            if (memcmp(pkt_auth(*rsppkt), auth, sizeof(auth)) == 0)
+-                break;
++            /* Verify the response authenticator. */
++            if (k5_bcmp(pkt_auth(*rsppkt), auth, sizeof(auth)) != 0)
++                continue;
++
++            /* Verify Message-Authenticator if present. */
++            if (has_pkt_msgauth(*rsppkt)) {
++                if (verify_msgauth(secret, *rsppkt, pkt_auth(tmp)) != 0)
++                    continue;
++            }
++
++            break;
+         }
+     }
+ 
+diff --git a/src/lib/krad/t_attrset.c b/src/lib/krad/t_attrset.c
+index 4cdb8b7d8e..f9c66509bd 100644
+--- a/src/lib/krad/t_attrset.c
++++ b/src/lib/krad/t_attrset.c
+@@ -63,7 +63,7 @@ main(void)
+     noerror(krad_attrset_add(set, krad_attr_name2num("User-Password"), &tmp));
+ 
+     /* Encode attrset. */
+-    noerror(kr_attrset_encode(set, "foo", auth, buffer, &encode_len,
++    noerror(kr_attrset_encode(set, "foo", auth, FALSE, buffer, &encode_len,
+                               &is_fips));
+     krad_attrset_free(set);
+ 
+diff --git a/src/lib/krad/t_daemon.py b/src/lib/krad/t_daemon.py
+index 4a3de079c7..647d4894eb 100755
+--- a/src/lib/krad/t_daemon.py
++++ b/src/lib/krad/t_daemon.py
+@@ -40,6 +40,7 @@ DICTIONARY = """
+ ATTRIBUTE\tUser-Name\t1\tstring
+ ATTRIBUTE\tUser-Password\t2\toctets
+ ATTRIBUTE\tNAS-Identifier\t32\tstring
++ATTRIBUTE\tMessage-Authenticator\t80\toctets
+ """
+ 
+ class TestServer(server.Server):
+@@ -52,7 +53,7 @@ class TestServer(server.Server):
+             if key == "User-Password":
+                 passwd = [pkt.PwDecrypt(x) for x in pkt[key]]
+ 
+-        reply = self.CreateReplyPacket(pkt)
++        reply = self.CreateReplyPacket(pkt, message_authenticator=True)
+         if passwd == ['accept']:
+             reply.code = packet.AccessAccept
+         else:
+diff --git a/src/lib/krad/t_packet.c b/src/lib/krad/t_packet.c
+index c22489144f..104b6507a2 100644
+--- a/src/lib/krad/t_packet.c
++++ b/src/lib/krad/t_packet.c
+@@ -172,6 +172,9 @@ main(int argc, const char **argv)
+     krb5_data username, password;
+     krb5_boolean auth = FALSE;
+     krb5_context ctx;
++    const krad_packet *dupreq;
++    const krb5_data *encpkt;
++    krad_packet *decreq;
+ 
+     username = string2data("testUser");
+ 
+@@ -184,9 +187,17 @@ main(int argc, const char **argv)
+ 
+     password = string2data("accept");
+     noerror(make_packet(ctx, &username, &password, &packets[ACCEPT_PACKET]));
++    encpkt = krad_packet_encode(packets[ACCEPT_PACKET]);
++    noerror(krad_packet_decode_request(ctx, "foo", encpkt, NULL, NULL,
++                                       &dupreq, &decreq));
++    krad_packet_free(decreq);
+ 
+     password = string2data("reject");
+     noerror(make_packet(ctx, &username, &password, &packets[REJECT_PACKET]));
++    encpkt = krad_packet_encode(packets[REJECT_PACKET]);
++    noerror(krad_packet_decode_request(ctx, "foo", encpkt, NULL, NULL,
++                                       &dupreq, &decreq));
++    krad_packet_free(decreq);
+ 
+     memset(&hints, 0, sizeof(hints));
+     hints.ai_family = AF_INET;
+diff --git a/src/tests/t_otp.py b/src/tests/t_otp.py
+index c3b820a411..dd5cdc5c26 100755
+--- a/src/tests/t_otp.py
++++ b/src/tests/t_otp.py
+@@ -49,6 +49,7 @@ ATTRIBUTE    User-Name    1    string
+ ATTRIBUTE    User-Password   2    octets
+ ATTRIBUTE    Service-Type    6    integer
+ ATTRIBUTE    NAS-Identifier  32    string
++ATTRIBUTE    Message-Authenticator 80 octets
+ '''
+ 
+ class RadiusDaemon(Process):
+@@ -97,6 +98,8 @@ class RadiusDaemon(Process):
+             reply.code = packet.AccessReject
+             replyq['reply'] = False
+ 
++        reply.add_message_authenticator()
++
+         outq.put(replyq)
+         if addr is None:
+             sock.send(reply.ReplyPacket())
+-- 
+2.46.0
+

0027-Add-ecdsa-with-sha512-256-to-supportedCMSTypes.patch

@@ -0,0 +1,78 @@
+From 43d10f1580c033fe706470e7588c720ac7854918 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Wed, 21 Jun 2023 18:27:11 +0200
+Subject: [PATCH] Add ecdsa-with-sha512/256 to supportedCMSTypes
+
+Elliptic curve certificates are already supported for PKINIT
+pre-authentication, but their associated signature types aren't
+advertized.  Add ecdsa-with-sha512 and ecdsa-with-sha256 OIDs to the
+supportedCMSTypes list sent by the client.
+
+[ghudson@mit.edu: edited commit message]
+
+ticket: 9100 (new)
+(cherry picked from commit 9913e5c92c4e5cb76d6ae58386f744766d2e6454)
+---
+ src/plugins/preauth/pkinit/pkinit_constants.c | 38 +++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_constants.c b/src/plugins/preauth/pkinit/pkinit_constants.c
+index 10f8688ec2..905e90d29c 100644
+--- a/src/plugins/preauth/pkinit/pkinit_constants.c
++++ b/src/plugins/preauth/pkinit/pkinit_constants.c
+@@ -64,14 +64,52 @@ static char sha512WithRSAEncr_oid[9] = {
+     0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0d
+ };
+ 
++/* RFC 3279 ecdsa-with-SHA1: iso(1) member-body(2) us(840) ansi-X9-62(10045)
++ * signatures(4) 1 */
++static char ecdsaWithSha1_oid[] = {
++    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x01
++};
++
++/* RFC 5758 ecdsa-with-SHA256: iso(1) member-body(2) us(840) ansi-X9-62(10045)
++ * signatures(4) ecdsa-with-SHA2(3) 2 */
++static char ecdsaWithSha256_oid[] = {
++    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02
++};
++
++/* RFC 5758 ecdsa-with-SHA384: iso(1) member-body(2) us(840) ansi-X9-62(10045)
++ * signatures(4) ecdsa-with-SHA2(3) 3 */
++static char ecdsaWithSha384_oid[] = {
++    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x03
++};
++
++/* RFC 5758 ecdsa-with-SHA512: iso(1) member-body(2) us(840) ansi-X9-62(10045)
++ * signatures(4) ecdsa-with-SHA2(3) 4 */
++static char ecdsaWithSha512_oid[] = {
++    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x04
++};
++
+ const krb5_data sha256WithRSAEncr_id = {
+     KV5M_DATA, sizeof(sha256WithRSAEncr_oid), sha256WithRSAEncr_oid
+ };
+ const krb5_data sha512WithRSAEncr_id = {
+     KV5M_DATA, sizeof(sha512WithRSAEncr_oid), sha512WithRSAEncr_oid
+ };
++const krb5_data ecdsaWithSha1_id = {
++    KV5M_DATA, sizeof(ecdsaWithSha1_oid), ecdsaWithSha1_oid
++};
++const krb5_data ecdsaWithSha256_id = {
++    KV5M_DATA, sizeof(ecdsaWithSha256_oid), ecdsaWithSha256_oid
++};
++const krb5_data ecdsaWithSha384_id = {
++    KV5M_DATA, sizeof(ecdsaWithSha384_oid), ecdsaWithSha384_oid
++};
++const krb5_data ecdsaWithSha512_id = {
++    KV5M_DATA, sizeof(ecdsaWithSha512_oid), ecdsaWithSha512_oid
++};
+ 
+ krb5_data const * const supported_cms_algs[] = {
++    &ecdsaWithSha512_id,
++    &ecdsaWithSha256_id,
+     &sha512WithRSAEncr_id,
+     &sha256WithRSAEncr_id,
+     NULL
+-- 
+2.47.1
+

0028-Get-rid-of-pkinit_crypto_openssl.h.patch

@@ -0,0 +1,264 @@
+From fba4cbf0bc50569b8ea6d1e1c3303eaab84935e1 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Sun, 30 Jul 2023 01:07:38 -0400
+Subject: [PATCH] Get rid of pkinit_crypto_openssl.h
+
+Fold pkinit_crypto_openssl.h into the one source file where it was
+used.  Also clean up the include of <arpa/inet.h>, as htonl() is no
+longer used after commit 1c87ce6c44a9de0824580a2d72a8a202237e01f4.
+
+(cherry picked from commit b3352945fb8836f8b4095e0b8aad04b54aca3152)
+---
+ src/plugins/preauth/pkinit/deps               |   2 +-
+ .../preauth/pkinit/pkinit_crypto_openssl.c    |  85 +++++++++++-
+ .../preauth/pkinit/pkinit_crypto_openssl.h    | 121 ------------------
+ 3 files changed, 83 insertions(+), 125 deletions(-)
+ delete mode 100644 src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
+
+diff --git a/src/plugins/preauth/pkinit/deps b/src/plugins/preauth/pkinit/deps
+index 58320aa801..b6f4476fe8 100644
+--- a/src/plugins/preauth/pkinit/deps
++++ b/src/plugins/preauth/pkinit/deps
+@@ -112,4 +112,4 @@ pkinit_crypto_openssl.so pkinit_crypto_openssl.po $(OUTPRE)pkinit_crypto_openssl
+   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \
+   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+   pkcs11.h pkinit.h pkinit_accessor.h pkinit_crypto.h \
+-  pkinit_crypto_openssl.c pkinit_crypto_openssl.h pkinit_trace.h
++  pkinit_crypto_openssl.c pkinit_trace.h
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index f6d494bd11..ae8599d5a2 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -30,20 +30,99 @@
+  */
+ 
+ #include "k5-int.h"
+-#include "pkinit_crypto_openssl.h"
+ #include "k5-buf.h"
+ #include "k5-err.h"
+ #include "k5-hex.h"
+-#include <unistd.h>
++#include "pkinit.h"
+ #include <dirent.h>
+-#include <arpa/inet.h>
+ 
++#include <openssl/bn.h>
++#include <openssl/dh.h>
++#include <openssl/x509.h>
++#include <openssl/pkcs7.h>
++#include <openssl/pkcs12.h>
++#include <openssl/obj_mac.h>
++#include <openssl/x509v3.h>
++#include <openssl/err.h>
++#include <openssl/evp.h>
++#include <openssl/sha.h>
++#include <openssl/asn1.h>
++#include <openssl/pem.h>
++#include <openssl/asn1t.h>
++#include <openssl/cms.h>
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ #include <openssl/core_names.h>
+ #include <openssl/kdf.h>
++#include <openssl/decoder.h>
+ #include <openssl/params.h>
+ #endif
+ 
++#define DN_BUF_LEN  256
++#define MAX_CREDS_ALLOWED 20
++
++struct _pkinit_cred_info {
++    char *name;
++    X509 *cert;
++    EVP_PKEY *key;
++#ifndef WITHOUT_PKCS11
++    CK_BYTE_PTR cert_id;
++    int cert_id_len;
++#endif
++};
++typedef struct _pkinit_cred_info *pkinit_cred_info;
++
++struct _pkinit_identity_crypto_context {
++    pkinit_cred_info creds[MAX_CREDS_ALLOWED+1];
++    STACK_OF(X509) *my_certs;   /* available user certs */
++    char *identity;             /* identity name for user cert */
++    int cert_index;             /* cert to use out of available certs*/
++    EVP_PKEY *my_key;           /* available user keys if in filesystem */
++    STACK_OF(X509) *trustedCAs; /* available trusted ca certs */
++    STACK_OF(X509) *intermediateCAs;   /* available intermediate ca certs */
++    STACK_OF(X509_CRL) *revoked;    /* available crls */
++    int pkcs11_method;
++    krb5_prompter_fct prompter;
++    void *prompter_data;
++#ifndef WITHOUT_PKCS11
++    char *p11_module_name;
++    CK_SLOT_ID slotid;
++    char *token_label;
++    char *cert_label;
++    /* These are crypto-specific. */
++    struct plugin_file_handle *p11_module;
++    CK_SESSION_HANDLE session;
++    CK_FUNCTION_LIST_PTR p11;
++    uint8_t *cert_id;
++    size_t cert_id_len;
++    CK_MECHANISM_TYPE mech;
++#endif
++    krb5_boolean defer_id_prompt;
++    pkinit_deferred_id *deferred_ids;
++};
++
++struct _pkinit_plg_crypto_context {
++    EVP_PKEY *dh_1024;
++    EVP_PKEY *dh_2048;
++    EVP_PKEY *dh_4096;
++    EVP_PKEY *ec_p256;
++    EVP_PKEY *ec_p384;
++    EVP_PKEY *ec_p521;
++    ASN1_OBJECT *id_pkinit_authData;
++    ASN1_OBJECT *id_pkinit_DHKeyData;
++    ASN1_OBJECT *id_pkinit_rkeyData;
++    ASN1_OBJECT *id_pkinit_san;
++    ASN1_OBJECT *id_ms_san_upn;
++    ASN1_OBJECT *id_pkinit_KPClientAuth;
++    ASN1_OBJECT *id_pkinit_KPKdc;
++    ASN1_OBJECT *id_ms_kp_sc_logon;
++    ASN1_OBJECT *id_kp_serverAuth;
++};
++
++struct _pkinit_req_crypto_context {
++    X509 *received_cert;
++    EVP_PKEY *client_pkey;
++};
++
+ static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context );
+ static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context );
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
+deleted file mode 100644
+index b7a3358800..0000000000
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
++++ /dev/null
+@@ -1,121 +0,0 @@
+-/*
+- * COPYRIGHT (C) 2006,2007
+- * THE REGENTS OF THE UNIVERSITY OF MICHIGAN
+- * ALL RIGHTS RESERVED
+- *
+- * Permission is granted to use, copy, create derivative works
+- * and redistribute this software and such derivative works
+- * for any purpose, so long as the name of The University of
+- * Michigan is not used in any advertising or publicity
+- * pertaining to the use of distribution of this software
+- * without specific, written prior authorization.  If the
+- * above copyright notice or any other identification of the
+- * University of Michigan is included in any copy of any
+- * portion of this software, then the disclaimer below must
+- * also be included.
+- *
+- * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION
+- * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY
+- * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF
+- * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING
+- * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF
+- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
+- * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE
+- * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR
+- * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING
+- * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN
+- * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF
+- * SUCH DAMAGES.
+- */
+-
+-#ifndef _PKINIT_CRYPTO_OPENSSL_H
+-#define _PKINIT_CRYPTO_OPENSSL_H
+-
+-#include "pkinit.h"
+-
+-#include <openssl/bn.h>
+-#include <openssl/dh.h>
+-#include <openssl/x509.h>
+-#include <openssl/pkcs7.h>
+-#include <openssl/pkcs12.h>
+-#include <openssl/obj_mac.h>
+-#include <openssl/x509v3.h>
+-#include <openssl/err.h>
+-#include <openssl/evp.h>
+-#include <openssl/sha.h>
+-#include <openssl/asn1.h>
+-#include <openssl/pem.h>
+-#include <openssl/asn1t.h>
+-#include <openssl/cms.h>
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+-#include <openssl/core_names.h>
+-#include <openssl/decoder.h>
+-#endif
+-
+-#define DN_BUF_LEN  256
+-#define MAX_CREDS_ALLOWED 20
+-
+-struct _pkinit_cred_info {
+-    char *name;
+-    X509 *cert;
+-    EVP_PKEY *key;
+-#ifndef WITHOUT_PKCS11
+-    CK_BYTE_PTR cert_id;
+-    int cert_id_len;
+-#endif
+-};
+-typedef struct _pkinit_cred_info * pkinit_cred_info;
+-
+-struct _pkinit_identity_crypto_context {
+-    pkinit_cred_info creds[MAX_CREDS_ALLOWED+1];
+-    STACK_OF(X509) *my_certs;   /* available user certs */
+-    char *identity;             /* identity name for user cert */
+-    int cert_index;             /* cert to use out of available certs*/
+-    EVP_PKEY *my_key;           /* available user keys if in filesystem */
+-    STACK_OF(X509) *trustedCAs; /* available trusted ca certs */
+-    STACK_OF(X509) *intermediateCAs;   /* available intermediate ca certs */
+-    STACK_OF(X509_CRL) *revoked;    /* available crls */
+-    int pkcs11_method;
+-    krb5_prompter_fct prompter;
+-    void *prompter_data;
+-#ifndef WITHOUT_PKCS11
+-    char *p11_module_name;
+-    CK_SLOT_ID slotid;
+-    char *token_label;
+-    char *cert_label;
+-    /* These are crypto-specific */
+-    struct plugin_file_handle *p11_module;
+-    CK_SESSION_HANDLE session;
+-    CK_FUNCTION_LIST_PTR p11;
+-    uint8_t *cert_id;
+-    size_t cert_id_len;
+-    CK_MECHANISM_TYPE mech;
+-#endif
+-    krb5_boolean defer_id_prompt;
+-    pkinit_deferred_id *deferred_ids;
+-};
+-
+-struct _pkinit_plg_crypto_context {
+-    EVP_PKEY *dh_1024;
+-    EVP_PKEY *dh_2048;
+-    EVP_PKEY *dh_4096;
+-    EVP_PKEY *ec_p256;
+-    EVP_PKEY *ec_p384;
+-    EVP_PKEY *ec_p521;
+-    ASN1_OBJECT *id_pkinit_authData;
+-    ASN1_OBJECT *id_pkinit_DHKeyData;
+-    ASN1_OBJECT *id_pkinit_rkeyData;
+-    ASN1_OBJECT *id_pkinit_san;
+-    ASN1_OBJECT *id_ms_san_upn;
+-    ASN1_OBJECT *id_pkinit_KPClientAuth;
+-    ASN1_OBJECT *id_pkinit_KPKdc;
+-    ASN1_OBJECT *id_ms_kp_sc_logon;
+-    ASN1_OBJECT *id_kp_serverAuth;
+-};
+-
+-struct _pkinit_req_crypto_context {
+-    X509 *received_cert;
+-    EVP_PKEY *client_pkey;
+-};
+-
+-#endif	/* _PKINIT_CRYPTO_OPENSSL_H */
+-- 
+2.47.1
+

0029-Use-SoftHSMv2-for-PKCS11-PKINIT-tests.patch

@@ -0,0 +1,157 @@
+From 1b01057df4c2223fbf92be44f1e764207208ef03 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Mon, 26 Feb 2024 19:03:38 -0500
+Subject: [PATCH] Use SoftHSMv2 for PKCS11 PKINIT tests
+
+Instead of softpkcs11, use SoftHSMv2 to mock the PKCS11 token for
+PKINIT tests.  Use pkcs11-tool from OpenSC to initialize the token and
+import a certificate and key.  SoftHSM does not support PIN-less
+tokens (see https://github.com/opendnssec/SoftHSMv2/issues/480) so
+remove that test for now.
+
+(cherry picked from commit 8ab61608236883fdc5c2d43f4bd1ff2094401d19)
+---
+ .github/workflows/build.yml |  2 +-
+ src/tests/t_pkinit.py       | 82 ++++++++++++++++++++-----------------
+ 2 files changed, 45 insertions(+), 39 deletions(-)
+
+diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
+index 68a4788adb..d7ae86b150 100644
+--- a/.github/workflows/build.yml
++++ b/.github/workflows/build.yml
+@@ -33,7 +33,7 @@ jobs:
+               if: startsWith(matrix.os, 'ubuntu')
+               run: |
+                 sudo apt-get update -qq
+-                sudo apt-get install -y bison gettext keyutils ldap-utils libcmocka-dev libldap2-dev libkeyutils-dev libsasl2-dev libssl-dev python3-kdcproxy python3-pip slapd tcsh
++                sudo apt-get install -y bison gettext keyutils ldap-utils libcmocka-dev libldap2-dev libkeyutils-dev libsasl2-dev libssl-dev python3-kdcproxy python3-pip slapd tcsh softhsm2 opensc
+                 pip3 install pyrad
+             - name: Build
+               env:
+diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
+index f8f2debc1b..4435746429 100755
+--- a/src/tests/t_pkinit.py
++++ b/src/tests/t_pkinit.py
+@@ -1,11 +1,10 @@
+ from k5test import *
++import re
+ 
+ # Skip this test if pkinit wasn't built.
+ if not pkinit_enabled:
+     skip_rest('PKINIT tests', 'PKINIT module not built')
+ 
+-soft_pkcs11 = os.path.join(buildtop, 'tests', 'softpkcs11', 'softpkcs11.so')
+-
+ # Construct a krb5.conf fragment configuring pkinit.
+ user_pem = os.path.join(pkinit_certs, 'user.pem')
+ privkey_pem = os.path.join(pkinit_certs, 'privkey.pem')
+@@ -55,9 +54,6 @@ p12_upn2_identity = 'PKCS12:%s' % user_upn2_p12
+ p12_upn3_identity = 'PKCS12:%s' % user_upn3_p12
+ p12_generic_identity = 'PKCS12:%s' % generic_p12
+ p12_enc_identity = 'PKCS12:%s' % user_enc_p12
+-p11_identity = 'PKCS11:' + soft_pkcs11
+-p11_token_identity = ('PKCS11:module_name=' + soft_pkcs11 +
+-                      ':slotid=1:token=SoftToken (token)')
+ 
+ # Start a realm with the test kdb module for the following UPN SAN tests.
+ realm = K5Realm(kdc_conf=alias_kdc_conf, create_kdb=False, pkinit=True)
+@@ -389,53 +385,63 @@ realm.klist(realm.user_princ)
+ realm.kinit(realm.user_princ, flags=['-X', 'X509_user_identity=,'],
+             expected_code=1, expected_msg='Preauthentication failed while')
+ 
+-softpkcs11rc = os.path.join(os.getcwd(), 'testdir', 'soft-pkcs11.rc')
+-realm.env['SOFTPKCS11RC'] = softpkcs11rc
++softhsm2 = '/usr/lib/softhsm/libsofthsm2.so'
++if not os.path.exists(softhsm2):
++    skip_rest('PKCS11 tests', 'SoftHSMv2 required')
++pkcs11_tool = which('pkcs11-tool')
++if not pkcs11_tool:
++    skip_rest('PKCS11 tests', 'pkcs11-tool from OpenSC required')
++tool_cmd = [pkcs11_tool, '--module', softhsm2]
++
++# Prepare a SoftHSM token.
++softhsm2_conf = os.path.join(realm.testdir, 'softhsm2.conf')
++softhsm2_tokens = os.path.join(realm.testdir, 'tokens')
++os.mkdir(softhsm2_tokens)
++realm.env['SOFTHSM2_CONF'] = softhsm2_conf
++with open(softhsm2_conf, 'w') as f:
++    f.write('directories.tokendir = %s\n' % softhsm2_tokens)
++realm.run(tool_cmd + ['--init-token', '--label', 'user',
++                      '--so-pin', 'sopin', '--init-pin', '--pin', 'userpin'])
++realm.run(tool_cmd + ['-w', user_pem, '-y', 'cert'])
++realm.run(tool_cmd + ['-w', privkey_pem, '-y', 'privkey',
++                      '-l', '--pin', 'userpin'])
++
++# Extract the slot ID generated by SoftHSM.
++out = realm.run(tool_cmd + ['-L'])
++m = re.search(r'slot ID 0x([0-9a-f]+)\n', out)
++if not m:
++    fail('could not extract slot ID from SoftHSM token')
++slot_id = int(m.group(1), 16)
++
++p11_attr = 'X509_user_identity=PKCS11:' + softhsm2
++p11_token_identity = ('PKCS11:module_name=%s:slotid=%d:token=user' %
++                      (softhsm2, slot_id))
+ 
+-# PKINIT with PKCS11: identity, with no need for a PIN.
+-mark('PKCS11 identity, no PIN')
+-conf = open(softpkcs11rc, 'w')
+-conf.write("%s\t%s\t%s\t%s\n" % ('user', 'user token', user_pem, privkey_pem))
+-conf.close()
+-# Expect to succeed without having to supply any more information.
+-realm.kinit(realm.user_princ,
+-            flags=['-X', 'X509_user_identity=%s' % p11_identity])
++mark('PKCS11 identity, with PIN (prompter)')
++realm.kinit(realm.user_princ, flags=['-X', p11_attr], password='userpin')
+ realm.klist(realm.user_princ)
+ realm.run([kvno, realm.host_princ])
+ 
+-# PKINIT with PKCS11: identity, with a PIN supplied by the prompter.
+-mark('PKCS11 identity, with PIN (prompter)')
+-os.remove(softpkcs11rc)
+-conf = open(softpkcs11rc, 'w')
+-conf.write("%s\t%s\t%s\t%s\n" % ('user', 'user token', user_pem,
+-                                 privkey_enc_pem))
+-conf.close()
+-# Expect failure if the responder does nothing, and there's no prompter
++mark('PKCS11 identity, unavailable PIN')
+ realm.run(['./responder', '-x', 'pkinit={"%s": 0}' % p11_token_identity,
+-           '-X', 'X509_user_identity=%s' % p11_identity, realm.user_princ],
+-          expected_code=2)
+-realm.kinit(realm.user_princ,
+-            flags=['-X', 'X509_user_identity=%s' % p11_identity],
+-            password='encrypted')
+-realm.klist(realm.user_princ)
+-realm.run([kvno, realm.host_princ])
++           '-X', p11_attr, realm.user_princ], expected_code=2)
+ 
+-# Supply the wrong PIN.
+ mark('PKCS11 identity, wrong PIN')
+ expected_trace = ('PKINIT client has no configured identity; giving up',)
+ realm.kinit(realm.user_princ,
+-            flags=['-X', 'X509_user_identity=%s' % p11_identity],
++            flags=['-X', p11_attr],
+             password='wrong', expected_code=1, expected_trace=expected_trace)
+ 
+ # PKINIT with PKCS11: identity, with a PIN supplied by the responder.
+-# Supply the response in raw form.
++# Supply the response in raw form.  Expect the PIN_COUNT_LOW flag (1)
++# to be set due to the previous test.
+ mark('PKCS11 identity, with PIN (responder)')
+-realm.run(['./responder', '-x', 'pkinit={"%s": 0}' % p11_token_identity,
+-           '-r', 'pkinit={"%s": "encrypted"}' % p11_token_identity,
+-           '-X', 'X509_user_identity=%s' % p11_identity, realm.user_princ])
++realm.run(['./responder', '-x', 'pkinit={"%s": 1}' % p11_token_identity,
++           '-r', 'pkinit={"%s": "userpin"}' % p11_token_identity,
++           '-X', p11_attr, realm.user_princ])
+ # Supply the response through the convenience API.
+-realm.run(['./responder', '-X', 'X509_user_identity=%s' % p11_identity,
+-           '-p', '%s=%s' % (p11_token_identity, 'encrypted'),
++realm.run(['./responder', '-X', p11_attr,
++           '-p', '%s=%s' % (p11_token_identity, 'userpin'),
+            realm.user_princ])
+ realm.klist(realm.user_princ)
+ realm.run([kvno, realm.host_princ])
+-- 
+2.47.1
+

0030-Simplify-PKINIT-cert-representation.patch

@@ -0,0 +1,202 @@
+From b0315d30f066c4241fcecc33dd9e4d1c7c28b9d8 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 9 Feb 2024 17:32:40 -0500
+Subject: [PATCH] Simplify PKINIT cert representation
+
+In the _pkinit_identity_crypto_context structure, the my_certs field
+is a stack which only ever contains one cert and is only ever used to
+retrieve that one cert.  The cert_index field is always 0.  Replace
+these fields with a my_cert field pointing directly to the X509
+certificate.
+
+Simplify crypto_cert_select_default() by making it call
+crypto_cert_select() with index 0 after verifying the certificate
+count.
+
+(cherry picked from commit f95dfb7908456f9563cee66706216a21df8d791f)
+---
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 74 +++++--------------
+ 1 file changed, 20 insertions(+), 54 deletions(-)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index ae8599d5a2..da59cb1e02 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -73,10 +73,9 @@ typedef struct _pkinit_cred_info *pkinit_cred_info;
+ 
+ struct _pkinit_identity_crypto_context {
+     pkinit_cred_info creds[MAX_CREDS_ALLOWED+1];
+-    STACK_OF(X509) *my_certs;   /* available user certs */
++    X509 *my_cert;              /* selected user or KDC cert */
+     char *identity;             /* identity name for user cert */
+-    int cert_index;             /* cert to use out of available certs*/
+-    EVP_PKEY *my_key;           /* available user keys if in filesystem */
++    EVP_PKEY *my_key;           /* selected cert key if in filesystem */
+     STACK_OF(X509) *trustedCAs; /* available trusted ca certs */
+     STACK_OF(X509) *intermediateCAs;   /* available intermediate ca certs */
+     STACK_OF(X509_CRL) *revoked;    /* available crls */
+@@ -1489,8 +1488,7 @@ pkinit_init_certs(pkinit_identity_crypto_context ctx)
+ 
+     for (i = 0; i < MAX_CREDS_ALLOWED; i++)
+         ctx->creds[i] = NULL;
+-    ctx->my_certs = NULL;
+-    ctx->cert_index = 0;
++    ctx->my_cert = NULL;
+     ctx->my_key = NULL;
+     ctx->trustedCAs = NULL;
+     ctx->intermediateCAs = NULL;
+@@ -1506,8 +1504,8 @@ pkinit_fini_certs(pkinit_identity_crypto_context ctx)
+     if (ctx == NULL)
+         return;
+ 
+-    if (ctx->my_certs != NULL)
+-        sk_X509_pop_free(ctx->my_certs, X509_free);
++    if (ctx->my_cert != NULL)
++        X509_free(ctx->my_cert);
+ 
+     if (ctx->my_key != NULL)
+         EVP_PKEY_free(ctx->my_key);
+@@ -1696,7 +1694,6 @@ cms_signeddata_create(krb5_context context,
+     ASN1_OCTET_STRING *digest = NULL;
+     unsigned int alg_len = 0, digest_len = 0;
+     unsigned char *y = NULL;
+-    X509 *cert = NULL;
+     ASN1_OBJECT *oid = NULL, *oid_copy;
+ 
+     /* Start creating PKCS7 data. */
+@@ -1715,7 +1712,7 @@ cms_signeddata_create(krb5_context context,
+     if (oid == NULL)
+         goto cleanup;
+ 
+-    if (id_cryptoctx->my_certs != NULL) {
++    if (id_cryptoctx->my_cert != NULL) {
+         X509_STORE *certstore = NULL;
+         X509_STORE_CTX *certctx;
+         STACK_OF(X509) *certstack = NULL;
+@@ -1726,8 +1723,6 @@ cms_signeddata_create(krb5_context context,
+         if ((cert_stack = sk_X509_new_null()) == NULL)
+             goto cleanup;
+ 
+-        cert = sk_X509_value(id_cryptoctx->my_certs, id_cryptoctx->cert_index);
+-
+         certstore = X509_STORE_new();
+         if (certstore == NULL)
+             goto cleanup;
+@@ -1736,7 +1731,7 @@ cms_signeddata_create(krb5_context context,
+         certctx = X509_STORE_CTX_new();
+         if (certctx == NULL)
+             goto cleanup;
+-        X509_STORE_CTX_init(certctx, certstore, cert,
++        X509_STORE_CTX_init(certctx, certstore, id_cryptoctx->my_cert,
+                             id_cryptoctx->intermediateCAs);
+         X509_STORE_CTX_trusted_stack(certctx, id_cryptoctx->trustedCAs);
+         if (!X509_verify_cert(certctx)) {
+@@ -1764,13 +1759,13 @@ cms_signeddata_create(krb5_context context,
+         if (!ASN1_INTEGER_set(p7si->version, 1))
+             goto cleanup;
+         if (!X509_NAME_set(&p7si->issuer_and_serial->issuer,
+-                           X509_get_issuer_name(cert)))
++                           X509_get_issuer_name(id_cryptoctx->my_cert)))
+             goto cleanup;
+         /* because ASN1_INTEGER_set is used to set a 'long' we will do
+          * things the ugly way. */
+         ASN1_INTEGER_free(p7si->issuer_and_serial->serial);
+         if (!(p7si->issuer_and_serial->serial =
+-              ASN1_INTEGER_dup(X509_get_serialNumber(cert))))
++              ASN1_INTEGER_dup(X509_get_serialNumber(id_cryptoctx->my_cert))))
+             goto cleanup;
+ 
+         /* will not fill-out EVP_PKEY because it's on the smartcard */
+@@ -3311,7 +3306,7 @@ pkinit_check_kdc_pkid(krb5_context context,
+     PKCS7_ISSUER_AND_SERIAL *is = NULL;
+     const unsigned char *p = pdid_buf;
+     int status = 1;
+-    X509 *kdc_cert = sk_X509_value(id_cryptoctx->my_certs, id_cryptoctx->cert_index);
++    X509 *kdc_cert = id_cryptoctx->my_cert;
+ 
+     *valid_kdcPkId = 0;
+     pkiDebug("found kdcPkId in AS REQ\n");
+@@ -4783,7 +4778,8 @@ cleanup:
+ }
+ 
+ /*
+- * Set the certificate in idctx->creds[cred_index] as the selected certificate.
++ * Set the certificate in idctx->creds[cred_index] as the selected certificate,
++ * stealing pointers from it.
+  */
+ krb5_error_code
+ crypto_cert_select(krb5_context context, pkinit_identity_crypto_context idctx,
+@@ -4795,20 +4791,17 @@ crypto_cert_select(krb5_context context, pkinit_identity_crypto_context idctx,
+         return ENOENT;
+ 
+     ci = idctx->creds[cred_index];
+-    /* copy the selected cert into our id_cryptoctx */
+-    if (idctx->my_certs != NULL)
+-        sk_X509_pop_free(idctx->my_certs, X509_free);
+-    idctx->my_certs = sk_X509_new_null();
+-    sk_X509_push(idctx->my_certs, ci->cert);
+-    free(idctx->identity);
++
++    idctx->my_cert = ci->cert;
++    ci->cert = NULL;
++
+     /* hang on to the selected credential name */
++    free(idctx->identity);
+     if (ci->name != NULL)
+         idctx->identity = strdup(ci->name);
+     else
+         idctx->identity = NULL;
+ 
+-    ci->cert = NULL;       /* Don't free it twice */
+-    idctx->cert_index = 0;
+     if (idctx->pkcs11_method != 1) {
+         idctx->my_key = ci->key;
+         ci->key = NULL;    /* Don't free it twice */
+@@ -4837,41 +4830,14 @@ crypto_cert_select_default(krb5_context context,
+ 
+     retval = crypto_cert_get_count(id_cryptoctx, &cert_count);
+     if (retval)
+-        goto errout;
++        return retval;
+ 
+     if (cert_count != 1) {
+         TRACE_PKINIT_NO_DEFAULT_CERT(context, cert_count);
+-        retval = EINVAL;
+-        goto errout;
+-    }
+-    /* copy the selected cert into our id_cryptoctx */
+-    if (id_cryptoctx->my_certs != NULL) {
+-        sk_X509_pop_free(id_cryptoctx->my_certs, X509_free);
++        return EINVAL;
+     }
+-    id_cryptoctx->my_certs = sk_X509_new_null();
+-    sk_X509_push(id_cryptoctx->my_certs, id_cryptoctx->creds[0]->cert);
+-    id_cryptoctx->creds[0]->cert = NULL;        /* Don't free it twice */
+-    id_cryptoctx->cert_index = 0;
+-    /* hang on to the selected credential name */
+-    if (id_cryptoctx->creds[0]->name != NULL)
+-        id_cryptoctx->identity = strdup(id_cryptoctx->creds[0]->name);
+-    else
+-        id_cryptoctx->identity = NULL;
+ 
+-    if (id_cryptoctx->pkcs11_method != 1) {
+-        id_cryptoctx->my_key = id_cryptoctx->creds[0]->key;
+-        id_cryptoctx->creds[0]->key = NULL;     /* Don't free it twice */
+-    }
+-#ifndef WITHOUT_PKCS11
+-    else {
+-        id_cryptoctx->cert_id = id_cryptoctx->creds[0]->cert_id;
+-        id_cryptoctx->creds[0]->cert_id = NULL; /* Don't free it twice */
+-        id_cryptoctx->cert_id_len = id_cryptoctx->creds[0]->cert_id_len;
+-    }
+-#endif
+-    retval = 0;
+-errout:
+-    return retval;
++    return crypto_cert_select(context, id_cryptoctx, 0);
+ }
+ 
+ 
+-- 
+2.47.1
+

0032-Improve-PKCS11-error-reporting-in-PKINIT.patch

@@ -0,0 +1,599 @@
+From e43c05e7b0b93401dd68fc3ec3186c3a455b04ea Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 23 Feb 2024 13:51:26 -0500
+Subject: [PATCH] Improve PKCS11 error reporting in PKINIT
+
+Create a helper p11err() to set extended error message for failed
+PKCS11 operations, and use it instead of pkiDebug() and pkcs11error().
+
+ticket: 9113 (new)
+(cherry picked from commit 98afb314d13939cbee19c69885dcb655db8460da)
+---
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 262 ++++++++++--------
+ src/plugins/preauth/pkinit/pkinit_trace.h     |   9 -
+ 2 files changed, 142 insertions(+), 129 deletions(-)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 4accfc2664..402bf1b9b3 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -161,9 +161,11 @@ static krb5_error_code pkinit_create_sequence_of_principal_identifiers
+  int type, krb5_pa_data ***e_data_out);
+ 
+ #ifndef WITHOUT_PKCS11
+-static krb5_error_code pkinit_find_private_key
+-(pkinit_identity_crypto_context, CK_ATTRIBUTE_TYPE usage,
+- CK_OBJECT_HANDLE *objp);
++static krb5_error_code
++pkinit_find_private_key(krb5_context context,
++                        pkinit_identity_crypto_context id_cryptoctx,
++                        CK_ATTRIBUTE_TYPE usage,
++                        CK_OBJECT_HANDLE *objp);
+ static krb5_error_code pkinit_login
+ (krb5_context context, pkinit_identity_crypto_context id_cryptoctx,
+  CK_TOKEN_INFO *tip, const char *password);
+@@ -180,6 +182,8 @@ static krb5_error_code pkinit_sign_data_pkcs11
+ (krb5_context context, pkinit_identity_crypto_context id_cryptoctx,
+  unsigned char *data, unsigned int data_len,
+  unsigned char **sig, unsigned int *sig_len);
++
++static krb5_error_code p11err(krb5_context context, CK_RV rv, const char *op);
+ #endif  /* WITHOUT_PKCS11 */
+ 
+ static krb5_error_code pkinit_sign_data_fs
+@@ -197,9 +201,6 @@ create_krb5_invalidCertificates(krb5_context context,
+ static krb5_error_code
+ create_identifiers_from_stack(STACK_OF(X509) *sk,
+                               krb5_external_principal_identifier *** ids);
+-static const char *
+-pkcs11err(int err);
+-
+ 
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 
+@@ -944,8 +945,9 @@ cleanup:
+ 
+ #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 
++#ifndef WITHOUT_PKC11
+ static struct pkcs11_errstrings {
+-    short code;
++    CK_RV code;
+     char *text;
+ } pkcs11_errstrings[] = {
+     { 0x0,      "ok" },
+@@ -1035,6 +1037,7 @@ static struct pkcs11_errstrings {
+     { 0x200,    "function rejected" },
+     { -1,       NULL }
+ };
++#endif
+ 
+ MAKE_INIT_FUNCTION(pkinit_openssl_init);
+ 
+@@ -1563,6 +1566,8 @@ pkinit_fini_pkcs11(pkinit_identity_crypto_context ctx)
+     free(ctx->token_label);
+     free(ctx->cert_id);
+     free(ctx->cert_label);
++    ctx->p11_module_name = ctx->token_label = ctx->cert_label = NULL;
++    ctx->cert_id = NULL;
+ #endif
+ }
+ 
+@@ -3344,48 +3349,53 @@ pkinit_pkcs7type2oid(pkinit_plg_crypto_context cryptoctx, int pkcs7_type)
+ }
+ 
+ #ifndef WITHOUT_PKCS11
+-static struct plugin_file_handle *
++static krb5_error_code
+ load_pkcs11_module(krb5_context context, const char *modname,
+-                   CK_FUNCTION_LIST_PTR_PTR p11p)
++                   struct plugin_file_handle **handle_out,
++                   CK_FUNCTION_LIST_PTR_PTR p11_out)
+ {
+     struct plugin_file_handle *handle = NULL;
+-    CK_RV (*getflist)(CK_FUNCTION_LIST_PTR_PTR);
++    CK_RV rv, (*getflist)(CK_FUNCTION_LIST_PTR_PTR);
+     struct errinfo einfo = EMPTY_ERRINFO;
+-    const char *errmsg = NULL;
++    const char *errmsg = NULL, *failure;
+     void (*sym)(void);
+     long err;
+-    CK_RV rv;
+ 
+     TRACE_PKINIT_PKCS11_OPEN(context, modname);
+     err = krb5int_open_plugin(modname, &handle, &einfo);
+     if (err) {
+-        errmsg = k5_get_error(&einfo, err);
+-        TRACE_PKINIT_PKCS11_OPEN_FAILED(context, errmsg);
++        failure = _("Cannot load PKCS11 module");
+         goto error;
+     }
+ 
+     err = krb5int_get_plugin_func(handle, "C_GetFunctionList", &sym, &einfo);
+     if (err) {
+-        errmsg = k5_get_error(&einfo, err);
+-        TRACE_PKINIT_PKCS11_GETSYM_FAILED(context, errmsg);
++        failure = _("Cannot find C_GetFunctionList in PKCS11 module");
+         goto error;
+     }
+ 
+     getflist = (CK_RV (*)(CK_FUNCTION_LIST_PTR_PTR))sym;
+-    rv = (*getflist)(p11p);
++    rv = (*getflist)(p11_out);
+     if (rv != CKR_OK) {
+-        TRACE_PKINIT_PKCS11_GETFLIST_FAILED(context, pkcs11err(rv));
++        failure = _("Cannot retrieve function list in PKCS11 module");
+         goto error;
+     }
+ 
+-    return handle;
++    *handle_out = handle;
++    return 0;
+ 
+ error:
+-    k5_free_error(&einfo, errmsg);
++    if (err) {
++        errmsg = k5_get_error(&einfo, err);
++        k5_setmsg(context, err, _("%s: %s"), failure, errmsg);
++    } else {
++        err = KRB5KDC_ERR_PREAUTH_FAILED;
++        k5_setmsg(context, err, "%s", failure);
++    }
+     k5_clear_error(&einfo);
+     if (handle != NULL)
+         krb5int_close_plugin(handle);
+-    return NULL;
++    return err;
+ }
+ 
+ static krb5_error_code
+@@ -3393,12 +3403,13 @@ pkinit_login(krb5_context context,
+              pkinit_identity_crypto_context id_cryptoctx,
+              CK_TOKEN_INFO *tip, const char *password)
+ {
++    krb5_error_code ret = 0;
++    CK_RV rv;
+     krb5_data rdat;
+     char *prompt;
+     const char *warning;
+     krb5_prompt kprompt;
+     krb5_prompt_type prompt_type;
+-    int r = 0;
+ 
+     if (tip->flags & CKF_PROTECTED_AUTHENTICATION_PATH) {
+         rdat.data = NULL;
+@@ -3407,7 +3418,7 @@ pkinit_login(krb5_context context,
+         rdat.data = strdup(password);
+         rdat.length = strlen(password);
+     } else if (id_cryptoctx->prompter == NULL) {
+-        r = KRB5_LIBOS_CANTREADPWD;
++        ret = KRB5_LIBOS_CANTREADPWD;
+         rdat.data = NULL;
+     } else {
+         if (tip->flags & CKF_USER_PIN_LOCKED)
+@@ -3431,31 +3442,28 @@ pkinit_login(krb5_context context,
+ 
+         /* PROMPTER_INVOCATION */
+         k5int_set_prompt_types(context, &prompt_type);
+-        r = (*id_cryptoctx->prompter)(context, id_cryptoctx->prompter_data,
+-                                      NULL, NULL, 1, &kprompt);
++        ret = (*id_cryptoctx->prompter)(context, id_cryptoctx->prompter_data,
++                                        NULL, NULL, 1, &kprompt);
+         k5int_set_prompt_types(context, 0);
+         free(prompt);
+     }
+ 
+-    if (r == 0) {
+-        r = id_cryptoctx->p11->C_Login(id_cryptoctx->session, CKU_USER,
+-                                       (u_char *) rdat.data, rdat.length);
+-
+-        if (r != CKR_OK) {
+-            TRACE_PKINIT_PKCS11_LOGIN_FAILED(context, pkcs11err(r));
+-            r = KRB5KDC_ERR_PREAUTH_FAILED;
+-        }
++    if (!ret) {
++        rv = id_cryptoctx->p11->C_Login(id_cryptoctx->session, CKU_USER,
++                                        (uint8_t *)rdat.data, rdat.length);
++        if (rv != CKR_OK)
++            ret = p11err(context, rv, "C_Login");
+     }
+     free(rdat.data);
+ 
+-    return r;
++    return ret;
+ }
+ 
+ static krb5_error_code
+ pkinit_open_session(krb5_context context,
+                     pkinit_identity_crypto_context cctx)
+ {
+-    CK_ULONG i, pret;
++    CK_ULONG i, rv;
+     unsigned char *cp;
+     size_t label_len;
+     CK_ULONG count = 0;
+@@ -3469,30 +3477,35 @@ pkinit_open_session(krb5_context context,
+         return 0; /* session already open */
+ 
+     /* Load module */
+-    cctx->p11_module = load_pkcs11_module(context, cctx->p11_module_name,
+-                                          &cctx->p11);
+-    if (cctx->p11_module == NULL)
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
++    ret = load_pkcs11_module(context, cctx->p11_module_name, &cctx->p11_module,
++                             &cctx->p11);
++    if (ret)
++        goto cleanup;
+ 
+     /* Init */
+-    pret = cctx->p11->C_Initialize(NULL);
+-    if (pret != CKR_OK) {
+-        pkiDebug("C_Initialize: %s\n", pkcs11err(pret));
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = cctx->p11->C_Initialize(NULL);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_Initialize");
++        goto cleanup;
+     }
+ 
+     /* Get the list of available slots */
+-    if (cctx->p11->C_GetSlotList(TRUE, NULL, &count) != CKR_OK)
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = cctx->p11->C_GetSlotList(TRUE, NULL, &count);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_GetSlotList");
++        goto cleanup;
++    }
+     if (count == 0) {
+         TRACE_PKINIT_PKCS11_NO_TOKEN(context);
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
++        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        goto cleanup;
+     }
+-    slotlist = calloc(count, sizeof(CK_SLOT_ID));
++    slotlist = k5calloc(count, sizeof(CK_SLOT_ID), &ret);
+     if (slotlist == NULL)
+-        return ENOMEM;
+-    if (cctx->p11->C_GetSlotList(TRUE, slotlist, &count) != CKR_OK) {
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        goto cleanup;
++    rv = cctx->p11->C_GetSlotList(TRUE, slotlist, &count);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_GetSlotList");
+         goto cleanup;
+     }
+ 
+@@ -3503,19 +3516,17 @@ pkinit_open_session(krb5_context context,
+             continue;
+ 
+         /* Open session */
+-        pret = cctx->p11->C_OpenSession(slotlist[i], CKF_SERIAL_SESSION,
+-                                        NULL, NULL, &cctx->session);
+-        if (pret != CKR_OK) {
+-            pkiDebug("C_OpenSession: %s\n", pkcs11err(pret));
+-            ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        rv = cctx->p11->C_OpenSession(slotlist[i], CKF_SERIAL_SESSION,
++                                      NULL, NULL, &cctx->session);
++        if (rv != CKR_OK) {
++            ret = p11err(context, rv, "C_OpenSession");
+             goto cleanup;
+         }
+ 
+         /* Get token info */
+-        pret = cctx->p11->C_GetTokenInfo(slotlist[i], &tinfo);
+-        if (pret != CKR_OK) {
+-            pkiDebug("C_GetTokenInfo: %s\n", pkcs11err(pret));
+-            ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        rv = cctx->p11->C_GetTokenInfo(slotlist[i], &tinfo);
++        if (rv != CKR_OK) {
++            ret = p11err(context, rv, "C_GetTokenInfo");
+             goto cleanup;
+         }
+ 
+@@ -3577,6 +3588,10 @@ pkinit_open_session(krb5_context context,
+ 
+     ret = 0;
+ cleanup:
++    /* On error, finalize the PKCS11 fields to ensure that we don't mistakenly
++     * short-circuit with success on the next call. */
++    if (ret)
++        pkinit_fini_pkcs11(cctx);
+     free(slotlist);
+     free(p11name);
+     return ret;
+@@ -3598,16 +3613,17 @@ cleanup:
+  * If there are more than one, we just take the first one.
+  */
+ 
+-krb5_error_code
+-pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx,
++static krb5_error_code
++pkinit_find_private_key(krb5_context context,
++                        pkinit_identity_crypto_context id_cryptoctx,
+                         CK_ATTRIBUTE_TYPE usage,
+                         CK_OBJECT_HANDLE *objp)
+ {
+     CK_OBJECT_CLASS cls;
+     CK_ATTRIBUTE attrs[4];
+     CK_ULONG count;
++    CK_RV rv;
+     unsigned int nattrs = 0;
+-    int r;
+ #ifdef PKINIT_USE_KEY_USAGE
+     CK_BBOOL true_false;
+ #endif
+@@ -3637,18 +3653,21 @@ pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx,
+     attrs[nattrs].ulValueLen = id_cryptoctx->cert_id_len;
+     nattrs++;
+ 
+-    r = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs, nattrs);
+-    if (r != CKR_OK) {
+-        pkiDebug("krb5_pkinit_sign_data: C_FindObjectsInit: %s\n",
+-                 pkcs11err(r));
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
+-    }
++    rv = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs,
++                                              nattrs);
++    if (rv != CKR_OK)
++        return p11err(context, rv, _("C_FindObjectsInit"));
+ 
+-    r = id_cryptoctx->p11->C_FindObjects(id_cryptoctx->session, objp, 1, &count);
++    rv = id_cryptoctx->p11->C_FindObjects(id_cryptoctx->session, objp, 1,
++                                          &count);
+     id_cryptoctx->p11->C_FindObjectsFinal(id_cryptoctx->session);
+-    pkiDebug("found %d private keys (%s)\n", (int)count, pkcs11err(r));
+-    if (r != CKR_OK || count < 1)
++    if (rv != CKR_OK)
++        return p11err(context, rv, _("C_FindObjects"));
++    if (count < 1) {
++        k5_setmsg(context, KRB5KDC_ERR_PREAUTH_FAILED,
++                  _("Found no private keys in PKCS11 token"));
+         return KRB5KDC_ERR_PREAUTH_FAILED;
++    }
+     return 0;
+ }
+ #endif
+@@ -3796,34 +3815,32 @@ pkinit_sign_data_pkcs11(krb5_context context,
+     CK_FUNCTION_LIST_PTR p11;
+     CK_ATTRIBUTE attr;
+     CK_KEY_TYPE keytype;
++    CK_RV rv;
+     EVP_MD_CTX *ctx;
+     const EVP_MD *md = EVP_sha256();
+     unsigned int mdlen;
+     uint8_t mdbuf[EVP_MAX_MD_SIZE], *dinfo = NULL, *sigbuf = NULL, *input;
+     size_t dinfo_len, input_len;
+-    int r;
+ 
+     *sig = NULL;
+     *sig_len = 0;
+ 
+-    if (pkinit_open_session(context, id_cryptoctx)) {
+-        pkiDebug("can't open pkcs11 session\n");
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
+-    }
++    ret = pkinit_open_session(context, id_cryptoctx);
++    if (ret)
++        return ret;
+     p11 = id_cryptoctx->p11;
+     session = id_cryptoctx->session;
+ 
+-    ret = pkinit_find_private_key(id_cryptoctx, CKA_SIGN, &obj);
++    ret = pkinit_find_private_key(context, id_cryptoctx, CKA_SIGN, &obj);
+     if (ret)
+         return ret;
+ 
+     attr.type = CKA_KEY_TYPE;
+     attr.pValue = &keytype;
+     attr.ulValueLen = sizeof(keytype);
+-    r = p11->C_GetAttributeValue(session, obj, &attr, 1);
+-    if (r) {
+-        pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(r));
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = p11->C_GetAttributeValue(session, obj, &attr, 1);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_GetAttributeValue");
+         goto cleanup;
+     }
+ 
+@@ -3865,10 +3882,9 @@ pkinit_sign_data_pkcs11(krb5_context context,
+     mech.pParameter = NULL;
+     mech.ulParameterLen = 0;
+ 
+-    r = p11->C_SignInit(session, &mech, obj);
+-    if (r != CKR_OK) {
+-        pkiDebug("C_SignInit: %s\n", pkcs11err(r));
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = p11->C_SignInit(session, &mech, obj);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_SignInit");
+         goto cleanup;
+     }
+ 
+@@ -3881,18 +3897,17 @@ pkinit_sign_data_pkcs11(krb5_context context,
+     if (sigbuf == NULL)
+         goto cleanup;
+ 
+-    r = p11->C_Sign(session, input, input_len, sigbuf, &len);
+-    if (r == CKR_BUFFER_TOO_SMALL || (r == CKR_OK && len >= PK_SIGLEN_GUESS)) {
++    rv = p11->C_Sign(session, input, input_len, sigbuf, &len);
++    if (rv == CKR_BUFFER_TOO_SMALL ||
++        (rv == CKR_OK && len >= PK_SIGLEN_GUESS)) {
+         free(sigbuf);
+-        pkiDebug("C_Sign realloc %d\n", (int) len);
+         sigbuf = k5alloc(len, &ret);
+         if (sigbuf == NULL)
+             goto cleanup;
+-        r = p11->C_Sign(session, input, input_len, sigbuf, &len);
++        rv = p11->C_Sign(session, input, input_len, sigbuf, &len);
+     }
+-    if (r != CKR_OK) {
+-        pkiDebug("C_Sign: %s\n", pkcs11err(r));
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_Sign");
+         goto cleanup;
+     }
+ 
+@@ -4348,13 +4363,14 @@ reassemble_pkcs11_name(pkinit_identity_opts *idopts)
+ }
+ 
+ static krb5_error_code
+-load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session,
+-              pkinit_identity_opts *idopts, pkinit_cred_info *cred_out)
++load_one_cert(krb5_context context, CK_FUNCTION_LIST_PTR p11,
++              CK_SESSION_HANDLE session, pkinit_identity_opts *idopts,
++              pkinit_cred_info *cred_out)
+ {
+     krb5_error_code ret;
+     CK_ATTRIBUTE attrs[2];
+     CK_BYTE_PTR cert = NULL, cert_id = NULL;
+-    CK_RV pret;
++    CK_RV rv;
+     const unsigned char *cp;
+     CK_OBJECT_HANDLE obj;
+     CK_ULONG count;
+@@ -4364,8 +4380,8 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session,
+     *cred_out = NULL;
+ 
+     /* Look for X.509 cert. */
+-    pret = p11->C_FindObjects(session, &obj, 1, &count);
+-    if (pret != CKR_OK || count <= 0)
++    rv = p11->C_FindObjects(session, &obj, 1, &count);
++    if (rv != CKR_OK || count <= 0)
+         return 0;
+ 
+     /* Get cert and id len. */
+@@ -4375,10 +4391,9 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session,
+     attrs[1].type = CKA_ID;
+     attrs[1].pValue = NULL;
+     attrs[1].ulValueLen = 0;
+-    pret = p11->C_GetAttributeValue(session, obj, attrs, 2);
+-    if (pret != CKR_OK && pret != CKR_BUFFER_TOO_SMALL) {
+-        pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(pret));
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = p11->C_GetAttributeValue(session, obj, attrs, 2);
++    if (rv != CKR_OK && rv != CKR_BUFFER_TOO_SMALL) {
++        ret = p11err(context, rv, "C_GetAttributeValue");
+         goto cleanup;
+     }
+ 
+@@ -4393,10 +4408,9 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session,
+     attrs[0].pValue = cert;
+     attrs[1].type = CKA_ID;
+     attrs[1].pValue = cert_id;
+-    pret = p11->C_GetAttributeValue(session, obj, attrs, 2);
+-    if (pret != CKR_OK) {
+-        pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(pret));
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = p11->C_GetAttributeValue(session, obj, attrs, 2);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_GetAttributeValue");
+         goto cleanup;
+     }
+ 
+@@ -4406,7 +4420,8 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session,
+     cp = (unsigned char *)cert;
+     x = d2i_X509(NULL, &cp, (int)attrs[0].ulValueLen);
+     if (x == NULL) {
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        ret = oerr(context, 0,
++                   _("Failed to decode X509 certificate from PKCS11 token"));
+         goto cleanup;
+     }
+ 
+@@ -4444,7 +4459,7 @@ pkinit_get_certs_pkcs11(krb5_context context,
+     int i;
+     unsigned int nattrs;
+     krb5_error_code ret;
+-    CK_RV pret;
++    CK_RV rv;
+ 
+     /* Copy stuff from idopts -> id_cryptoctx */
+     if (idopts->p11_module_name != NULL) {
+@@ -4516,16 +4531,16 @@ pkinit_get_certs_pkcs11(krb5_context context,
+         nattrs++;
+     }
+ 
+-    pret = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs,
+-                                                nattrs);
+-    if (pret != CKR_OK) {
+-        pkiDebug("C_FindObjectsInit: %s\n", pkcs11err(pret));
++    rv = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs,
++                                              nattrs);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_FindObjectsInit");
+         return KRB5KDC_ERR_PREAUTH_FAILED;
+     }
+ 
+     for (i = 0; i < MAX_CREDS_ALLOWED; i++) {
+-        ret = load_one_cert(id_cryptoctx->p11, id_cryptoctx->session, idopts,
+-                            &id_cryptoctx->creds[i]);
++        ret = load_one_cert(context, id_cryptoctx->p11, id_cryptoctx->session,
++                            idopts, &id_cryptoctx->creds[i]);
+         if (ret)
+             return ret;
+         if (id_cryptoctx->creds[i] == NULL)
+@@ -5510,19 +5525,26 @@ print_pubkey(BIGNUM * key, char *msg)
+ }
+ #endif
+ 
+-static const char *
+-pkcs11err(int err)
++#ifndef WITHOUT_PKCS11
++static krb5_error_code
++p11err(krb5_context context, CK_RV rv, const char *op)
+ {
++    krb5_error_code code = KRB5KDC_ERR_PREAUTH_FAILED;
+     int i;
++    const char *msg;
+ 
+-    for (i = 0; pkcs11_errstrings[i].text != NULL; i++)
+-        if (pkcs11_errstrings[i].code == err)
++    for (i = 0; pkcs11_errstrings[i].text != NULL; i++) {
++        if (pkcs11_errstrings[i].code == rv)
+             break;
+-    if (pkcs11_errstrings[i].text != NULL)
+-        return (pkcs11_errstrings[i].text);
++    }
++    msg = pkcs11_errstrings[i].text;
++    if (msg == NULL)
++        msg = "unknown PKCS11 error";
+ 
+-    return "unknown PKCS11 error";
++    krb5_set_error_message(context, code, _("PKCS11 error (%s): %s"), op, msg);
++    return code;
+ }
++#endif
+ 
+ /*
+  * Add an item to the pkinit_identity_crypto_context's list of deferred
+diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h
+index 1c1ceb5a41..1faa6816d7 100644
+--- a/src/plugins/preauth/pkinit/pkinit_trace.h
++++ b/src/plugins/preauth/pkinit/pkinit_trace.h
+@@ -98,21 +98,12 @@
+ #define TRACE_PKINIT_OPENSSL_ERROR(c, msg)              \
+     TRACE(c, "PKINIT OpenSSL error: {str}", msg)
+ 
+-#define TRACE_PKINIT_PKCS11_GETFLIST_FAILED(c, errstr)                  \
+-    TRACE(c, "PKINIT PKCS11 C_GetFunctionList failed: {str}", errstr)
+-#define TRACE_PKINIT_PKCS11_GETSYM_FAILED(c, errstr)                    \
+-    TRACE(c, "PKINIT unable to find PKCS11 plugin symbol "              \
+-          "C_GetFunctionList: {str}", errstr)
+-#define TRACE_PKINIT_PKCS11_LOGIN_FAILED(c, errstr)             \
+-    TRACE(c, "PKINIT PKCS11 C_Login failed: {str}", errstr)
+ #define TRACE_PKINIT_PKCS11_NO_MATCH_TOKEN(c)                   \
+     TRACE(c, "PKINIT PKCS#11 module has no matching tokens")
+ #define TRACE_PKINIT_PKCS11_NO_TOKEN(c)                                 \
+     TRACE(c, "PKINIT PKCS#11 module shows no slots with tokens")
+ #define TRACE_PKINIT_PKCS11_OPEN(c, name)                       \
+     TRACE(c, "PKINIT opening PKCS#11 module \"{str}\"", name)
+-#define TRACE_PKINIT_PKCS11_OPEN_FAILED(c, errstr)                      \
+-    TRACE(c, "PKINIT PKCS#11 module open failed: {str}", errstr)
+ #define TRACE_PKINIT_PKCS11_SLOT(c, slot, len, label)            \
+     TRACE(c, "PKINIT PKCS#11 slotid {int} token {lenstr}",       \
+           slot, len, label)
+-- 
+2.47.1
+

0033-Set-missing-mask-flags-for-kdb5_util-operations.patch

@@ -0,0 +1,61 @@
+From 946f7dba8cea3d2ed0e68c5e7594cbd7e1364609 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 1 Aug 2024 10:56:07 +0200
+Subject: [PATCH] Set missing mask flags for kdb5_util operations
+
+Set KADM5_TL_DATA for the use_mkey and update_princ_encryption
+commands.  (Commit c877f13c8985d820583b0d7ac1bb4c5dc36e677e did this
+for the add_new_mkey and purge_mkeys commands.)  Set appropriate flags
+for the add_random_key command.
+
+[ghudson@mit.edu: combined two commits; pruned out proposed mask flag
+additions for values represented within key data or tl-data (like
+KADM5_MKVNO), as those flags are currently only used in the kadm5
+protocol, not to communicate with the KDB module]
+
+ticket: 9158 (new)
+(cherry picked from commit 4ed7da378940198cf4415f86d4eb013de6ac6455)
+---
+ src/kadmin/dbutil/kdb5_mkey.c | 4 +++-
+ src/kadmin/dbutil/kdb5_util.c | 3 +++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/kadmin/dbutil/kdb5_mkey.c b/src/kadmin/dbutil/kdb5_mkey.c
+index aceb0a9b80..ac5c51d05e 100644
+--- a/src/kadmin/dbutil/kdb5_mkey.c
++++ b/src/kadmin/dbutil/kdb5_mkey.c
+@@ -525,6 +525,8 @@ kdb5_use_mkey(int argc, char *argv[])
+         goto cleanup_return;
+     }
+ 
++    master_entry->mask |= KADM5_TL_DATA;
++
+     if ((retval = krb5_db_put_principal(util_context, master_entry))) {
+         com_err(progname, retval,
+                 _("while adding master key entry to the database"));
+@@ -814,7 +816,7 @@ update_princ_encryption_1(void *cb, krb5_db_entry *ent)
+         goto fail;
+     }
+ 
+-    ent->mask |= KADM5_KEY_DATA;
++    ent->mask |= KADM5_KEY_DATA | KADM5_TL_DATA;
+ 
+     if ((retval = krb5_db_put_principal(util_context, ent))) {
+         com_err(progname, retval, _("while updating principal '%s' key data "
+diff --git a/src/kadmin/dbutil/kdb5_util.c b/src/kadmin/dbutil/kdb5_util.c
+index 55d529fa4c..afc817891b 100644
+--- a/src/kadmin/dbutil/kdb5_util.c
++++ b/src/kadmin/dbutil/kdb5_util.c
+@@ -600,6 +600,9 @@ add_random_key(int argc, char **argv)
+         exit_status++;
+         return;
+     }
++
++    dbent->mask |= KADM5_ATTRIBUTES | KADM5_KEY_DATA | KADM5_TL_DATA;
++
+     ret = krb5_db_put_principal(util_context, dbent);
+     krb5_db_free_principal(util_context, dbent);
+     if (ret) {
+-- 
+2.47.1
+

0034-Prevent-overflow-when-calculating-ulog-block-size.patch

@@ -0,0 +1,64 @@
+From 9b669dd42b28e7900f5ccac2816204e7d04ea23c Mon Sep 17 00:00:00 2001
+From: Zoltan Borbely <Zoltan.Borbely@morganstanley.com>
+Date: Tue, 28 Jan 2025 16:39:25 -0500
+Subject: [PATCH] Prevent overflow when calculating ulog block size
+
+In kdb_log.c:resize(), log an error and fail if the update size is
+larger than the largest possible block size (2^16-1).
+
+CVE-2025-24528:
+
+In MIT krb5 release 1.7 and later with incremental propagation
+enabled, an authenticated attacker can cause kadmind to write beyond
+the end of the mapped region for the iprop log file, likely causing a
+process crash.
+
+[ghudson@mit.edu: edited commit message and added CVE description]
+
+ticket: 9159 (new)
+tags: pullup
+target_version: 1.21-next
+
+(cherry picked from commit 78ceba024b64d49612375be4a12d1c066b0bfbd0)
+---
+ src/lib/kdb/kdb_log.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/kdb/kdb_log.c b/src/lib/kdb/kdb_log.c
+index e9b95fce59..c805ebd988 100644
+--- a/src/lib/kdb/kdb_log.c
++++ b/src/lib/kdb/kdb_log.c
+@@ -183,7 +183,7 @@ extend_file_to(int fd, unsigned int new_size)
+  */
+ static krb5_error_code
+ resize(kdb_hlog_t *ulog, uint32_t ulogentries, int ulogfd,
+-       unsigned int recsize)
++       unsigned int recsize, const kdb_incr_update_t *upd)
+ {
+     unsigned int new_block, new_size;
+ 
+@@ -195,6 +195,12 @@ resize(kdb_hlog_t *ulog, uint32_t ulogentries, int ulogfd,
+     new_block *= ULOG_BLOCK;
+     new_size += ulogentries * new_block;
+ 
++    if (new_block > UINT16_MAX) {
++        syslog(LOG_ERR, _("ulog overflow caused by principal %.*s"),
++               upd->kdb_princ_name.utf8str_t_len,
++               upd->kdb_princ_name.utf8str_t_val);
++        return KRB5_LOG_ERROR;
++    }
+     if (new_size > MAXLOGLEN)
+         return KRB5_LOG_ERROR;
+ 
+@@ -291,7 +297,7 @@ store_update(kdb_log_context *log_ctx, kdb_incr_update_t *upd)
+     recsize = sizeof(kdb_ent_header_t) + upd_size;
+ 
+     if (recsize > ulog->kdb_block) {
+-        retval = resize(ulog, ulogentries, log_ctx->ulogfd, recsize);
++        retval = resize(ulog, ulogentries, log_ctx->ulogfd, recsize, upd);
+         if (retval)
+             return retval;
+     }
+-- 
+2.48.1
+

0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch

@@ -0,0 +1,327 @@
+From c617915958a5cb05463713adcf03b6a0e0512ac3 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 16 Dec 2022 18:31:07 -0500
+Subject: [PATCH] Don't issue session keys with deprecated enctypes
+
+A paper by Tom Tervoort noted that rc4-hmac pre-hashes the input for
+its checksum and GSS operations before applying HMAC, and is therefore
+potentially vulnerable to hash collision attacks if a protocol
+contains a restricted signing oracle.
+
+In light of these potential attacks, begin the functional deprecation
+of DES3 and RC4 by disallowing their use as session key enctypes by
+default.  Add the variables allow_des3 and allow_rc4 in case
+negotiability of these enctypes for session keys needs to be turned
+back on, with the expectation that in future releases the enctypes
+will be more comprehensively deprecated.
+
+ticket: 9081
+(cherry picked from commit 1b57a4d134bbd0e7c52d5885a92eccc815726463)
+---
+ doc/admin/conf_files/krb5_conf.rst | 12 ++++++++++++
+ doc/admin/enctypes.rst             | 23 +++++++++++++++++++---
+ src/include/k5-int.h               |  4 ++++
+ src/kdc/kdc_util.c                 | 10 ++++++++++
+ src/lib/krb5/krb/get_in_tkt.c      | 31 +++++++++++++++++++-----------
+ src/lib/krb5/krb/init_ctx.c        | 10 ++++++++++
+ src/tests/gssapi/t_enctypes.py     |  5 +++--
+ src/tests/t_etype_info.py          |  5 +++--
+ src/tests/t_sesskeynego.py         | 28 +++++++++++++++++++++++++--
+ src/util/k5test.py                 |  9 ++++++++-
+ 10 files changed, 116 insertions(+), 21 deletions(-)
+
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index dca52e1426..d51fd3ce7e 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -95,6 +95,18 @@ Additionally, krb5.conf may include any of the relations described in
+ 
+ The libdefaults section may contain any of the following relations:
+ 
++**allow_des3**
++    Permit the KDC to issue tickets with des3-cbc-sha1 session keys.
++    In future releases, this flag will allow des3-cbc-sha1 to be used
++    at all.  The default value for this tag is false.  (Added in
++    release 1.21.)
++
++**allow_rc4**
++    Permit the KDC to issue tickets with arcfour-hmac session keys.
++    In future releases, this flag will allow arcfour-hmac to be used
++    at all.  The default value for this tag is false.  (Added in
++    release 1.21.)
++
+ **allow_weak_crypto**
+     If this flag is set to false, then weak encryption types (as noted
+     in :ref:`Encryption_types` in :ref:`kdc.conf(5)`) will be filtered
+diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
+index c4d5499d3b..2b4ed7da0b 100644
+--- a/doc/admin/enctypes.rst
++++ b/doc/admin/enctypes.rst
+@@ -48,12 +48,15 @@ Session key selection
+ The KDC chooses the session key enctype by taking the intersection of
+ its **permitted_enctypes** list, the list of long-term keys for the
+ most recent kvno of the service, and the client's requested list of
+-enctypes.
++enctypes.  Starting in krb5-1.21, all services are assumed to support
++aes256-cts-hmac-sha1-96; also, des3-cbc-sha1 and arcfour-hmac session
++keys will not be issued by default.
+ 
+ Starting in krb5-1.11, it is possible to set a string attribute on a
+ service principal to control what session key enctypes the KDC may
+-issue for service tickets for that principal.  See :ref:`set_string`
+-in :ref:`kadmin(1)` for details.
++issue for service tickets for that principal, overriding the service's
++long-term keys and the assumption of aes256-cts-hmac-sha1-96 support.
++See :ref:`set_string` in :ref:`kadmin(1)` for details.
+ 
+ 
+ Choosing enctypes for a service
+@@ -87,6 +90,20 @@ affect how enctypes are chosen.
+     acceptable risk for your environment and the weak enctypes are
+     required for backward compatibility.
+ 
++**allow_des3**
++    was added in release 1.21 and defaults to *false*.  Unless this
++    flag is set to *true*, the KDC will not issue tickets with
++    des3-cbc-sha1 session keys.  In a future release, this flag will
++    control whether des3-cbc-sha1 is permitted in similar fashion to
++    weak enctypes.
++
++**allow_rc4**
++    was added in release 1.21 and defaults to *false*.  Unless this
++    flag is set to *true*, the KDC will not issue tickets with
++    arcfour-hmac session keys.  In a future release, this flag will
++    control whether arcfour-hmac is permitted in similar fashion to
++    weak enctypes.
++
+ **permitted_enctypes**
+     controls the set of enctypes that a service will permit for
+     session keys and for ticket and authenticator encryption.  The KDC
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index b7789a2dd8..d0a263aa7d 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -181,6 +181,8 @@ typedef unsigned char   u_char;
+  * matches the variable name.  Keep these alphabetized. */
+ #define KRB5_CONF_ACL_FILE                     "acl_file"
+ #define KRB5_CONF_ADMIN_SERVER                 "admin_server"
++#define KRB5_CONF_ALLOW_DES3                   "allow_des3"
++#define KRB5_CONF_ALLOW_RC4                    "allow_rc4"
+ #define KRB5_CONF_ALLOW_WEAK_CRYPTO            "allow_weak_crypto"
+ #define KRB5_CONF_AUTH_TO_LOCAL                "auth_to_local"
+ #define KRB5_CONF_AUTH_TO_LOCAL_NAMES          "auth_to_local_names"
+@@ -1241,6 +1243,8 @@ struct _krb5_context {
+     struct _kdb_log_context *kdblog_context;
+ 
+     krb5_boolean allow_weak_crypto;
++    krb5_boolean allow_des3;
++    krb5_boolean allow_rc4;
+     krb5_boolean ignore_acceptor_hostname;
+     krb5_boolean enforce_ok_as_delegate;
+     enum dns_canonhost dns_canonicalize_hostname;
+diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
+index 93415ba862..c7b6e4090d 100644
+--- a/src/kdc/kdc_util.c
++++ b/src/kdc/kdc_util.c
+@@ -1108,6 +1108,16 @@ select_session_keytype(krb5_context context, krb5_db_entry *server,
+         if (!krb5_is_permitted_enctype(context, ktype[i]))
+             continue;
+ 
++        /*
++         * Prevent these deprecated enctypes from being used as session keys
++         * unless they are explicitly allowed.  In the future they will be more
++         * comprehensively disabled and eventually removed.
++         */
++        if (ktype[i] == ENCTYPE_DES3_CBC_SHA1 && !context->allow_des3)
++            continue;
++        if (ktype[i] == ENCTYPE_ARCFOUR_HMAC && !context->allow_rc4)
++            continue;
++
+         if (dbentry_supports_enctype(context, server, ktype[i]))
+             return ktype[i];
+     }
+diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
+index 1b420a3ac2..ea089f0fcc 100644
+--- a/src/lib/krb5/krb/get_in_tkt.c
++++ b/src/lib/krb5/krb/get_in_tkt.c
+@@ -1582,22 +1582,31 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options,
+     (*prompter)(context, data, 0, banner, 0, 0);
+ }
+ 
+-/* Display a warning via the prompter if des3-cbc-sha1 was used for either the
+- * reply key or the session key. */
++/* Display a warning via the prompter if a deprecated enctype was used for
++ * either the reply key or the session key. */
+ static void
+-warn_des3(krb5_context context, krb5_init_creds_context ctx,
+-          krb5_enctype as_key_enctype)
++warn_deprecated(krb5_context context, krb5_init_creds_context ctx,
++                krb5_enctype as_key_enctype)
+ {
+-    const char *banner;
++    krb5_enctype etype;
++    char encbuf[128], banner[256];
+ 
+-    if (as_key_enctype != ENCTYPE_DES3_CBC_SHA1 &&
+-        ctx->cred.keyblock.enctype != ENCTYPE_DES3_CBC_SHA1)
+-        return;
+     if (ctx->prompter == NULL)
+         return;
+ 
+-    banner = _("Warning: encryption type des3-cbc-sha1 used for "
+-               "authentication is weak and will be disabled");
++    if (krb5int_c_deprecated_enctype(as_key_enctype))
++        etype = as_key_enctype;
++    else if (krb5int_c_deprecated_enctype(ctx->cred.keyblock.enctype))
++        etype = ctx->cred.keyblock.enctype;
++    else
++        return;
++
++    if (krb5_enctype_to_name(etype, FALSE, encbuf, sizeof(encbuf)) != 0)
++        return;
++    snprintf(banner, sizeof(banner),
++             _("Warning: encryption type %s used for authentication is "
++               "deprecated and will be disabled"), encbuf);
++
+     /* PROMPTER_INVOCATION */
+     (*ctx->prompter)(context, ctx->prompter_data, NULL, banner, 0, NULL);
+ }
+@@ -1848,7 +1857,7 @@ init_creds_step_reply(krb5_context context,
+     ctx->complete = TRUE;
+     warn_pw_expiry(context, ctx->opt, ctx->prompter, ctx->prompter_data,
+                    ctx->in_tkt_service, ctx->reply);
+-    warn_des3(context, ctx, encrypting_key.enctype);
++    warn_deprecated(context, ctx, encrypting_key.enctype);
+ 
+ cleanup:
+     krb5_free_pa_data(context, kdc_padata);
+diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
+index 582a2945ff..a32f8dbf03 100644
+--- a/src/lib/krb5/krb/init_ctx.c
++++ b/src/lib/krb5/krb/init_ctx.c
+@@ -220,6 +220,16 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+         goto cleanup;
+     ctx->allow_weak_crypto = tmp;
+ 
++    retval = get_boolean(ctx, KRB5_CONF_ALLOW_DES3, 0, &tmp);
++    if (retval)
++        goto cleanup;
++    ctx->allow_des3 = tmp;
++
++    retval = get_boolean(ctx, KRB5_CONF_ALLOW_RC4, 0, &tmp);
++    if (retval)
++        goto cleanup;
++    ctx->allow_rc4 = tmp;
++
+     retval = get_boolean(ctx, KRB5_CONF_IGNORE_ACCEPTOR_HOSTNAME, 0, &tmp);
+     if (retval)
+         goto cleanup;
+diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
+index 2f95d89967..e6bde47afc 100755
+--- a/src/tests/gssapi/t_enctypes.py
++++ b/src/tests/gssapi/t_enctypes.py
+@@ -10,8 +10,9 @@ d_rc4 = 'DEPRECATED:arcfour-hmac'
+ 
+ # These tests make assumptions about the default enctype lists, so set
+ # them explicitly rather than relying on the library defaults.
+-supp='aes256-cts:normal aes128-cts:normal rc4-hmac:normal'
+-conf = {'libdefaults': {'permitted_enctypes': 'aes rc4'},
++supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal'
++conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4',
++                        'allow_des3': 'true', 'allow_rc4': 'true'},
+         'realms': {'$realm': {'supported_enctypes': supp}}}
+ realm = K5Realm(krb5_conf=conf)
+ shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save'))
+diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
+index a6f538b66d..75d9621dd6 100644
+--- a/src/tests/t_etype_info.py
++++ b/src/tests/t_etype_info.py
+@@ -1,7 +1,8 @@
+ from k5test import *
+ 
+-supported_enctypes = 'aes128-cts rc4-hmac'
+-conf = {'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
++supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac'
++conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'},
++        'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
+ realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf)
+ 
+ realm.run([kadminl, 'addprinc', '-pw', 'pw', '+requires_preauth',
+diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py
+index 9024aee838..5a213617b5 100755
+--- a/src/tests/t_sesskeynego.py
++++ b/src/tests/t_sesskeynego.py
+@@ -25,6 +25,8 @@ conf3 = {'libdefaults': {
+         'default_tkt_enctypes': 'aes128-cts',
+         'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}}
+ conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}}
++conf5 = {'libdefaults': {'allow_rc4': 'true'}}
++conf6 = {'libdefaults': {'allow_des3': 'true'}}
+ # Test with client request and session_enctypes preferring aes128, but
+ # aes256 long-term key.
+ realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False)
+@@ -54,10 +56,12 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes',
+            'aes128-cts,aes256-cts'])
+ test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96')
+ 
+-# 3b: Negotiate rc4-hmac session key when principal only has aes256 long-term.
++# 3b: Skip RC4 (as the KDC does not allow it for session keys by
++# default) and negotiate aes128-cts session key, with only an aes256
++# long-term service key.
+ realm.run([kadminl, 'setstr', 'server', 'session_enctypes',
+            'rc4-hmac,aes128-cts,aes256-cts'])
+-test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
++test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96')
+ realm.stop()
+ 
+ # 4: Check that permitted_enctypes is a default for session key enctypes.
+@@ -67,4 +71,24 @@ realm.run([kvno, 'user'],
+           expected_trace=('etypes requested in TGS request: aes256-cts',))
+ realm.stop()
+ 
++# 5: allow_rc4 permits negotiation of rc4-hmac session key.
++realm = K5Realm(krb5_conf=conf5, create_host=False, get_creds=False)
++realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
++realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac'])
++test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
++realm.stop()
++
++# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key.
++realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False)
++realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
++realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1'])
++test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96')
++realm.stop()
++
++# 7: default config negotiates aes256-sha1 session key for RC4-only service.
++realm = K5Realm(create_host=False, get_creds=False)
++realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server'])
++test_kvno(realm, 'aes256-cts-hmac-sha1-96', 'DEPRECATED:arcfour-hmac')
++realm.stop()
++
+ success('sesskeynego')
+diff --git a/src/util/k5test.py b/src/util/k5test.py
+index d823653aa0..8e5f5ba8e9 100644
+--- a/src/util/k5test.py
++++ b/src/util/k5test.py
+@@ -1338,9 +1338,16 @@ _passes = [
+     # No special settings; exercises AES256.
+     ('default', None, None, None),
+ 
++    # Exercise the DES3 enctype.
++    ('des3', None,
++     {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}},
++     {'realms': {'$realm': {
++                    'supported_enctypes': 'des3-cbc-sha1:normal',
++                    'master_key_type': 'des3-cbc-sha1'}}}),
++
+     # Exercise the arcfour enctype.
+     ('arcfour', None,
+-     {'libdefaults': {'permitted_enctypes': 'rc4'}},
++     {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}},
+      {'realms': {'$realm': {
+                     'supported_enctypes': 'arcfour-hmac:normal',
+                     'master_key_type': 'arcfour-hmac'}}}),
+-- 
+2.49.0
+

0036-downstream-Remove-3des-support-cumulative-1.patch

@@ -0,0 +1,260 @@
+From b0993b57dbe584f9308cc7773b930efe76e19ba3 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Fri, 4 Apr 2025 15:08:36 +0200
+Subject: [PATCH] [downstream] Remove 3des support (cumulative 1)
+
+Remove mentions for the triple-DES encryption type which were added
+since the previous downstream patch.
+---
+ README                             | 15 +++++++--------
+ doc/admin/conf_files/krb5_conf.rst |  6 ------
+ doc/admin/enctypes.rst             | 11 ++---------
+ doc/mitK5features.rst              |  5 ++---
+ src/include/k5-int.h               |  2 --
+ src/kdc/kdc_util.c                 |  2 --
+ src/lib/krb5/krb/init_ctx.c        |  5 -----
+ src/man/krb5.conf.man              |  6 ------
+ src/tests/gssapi/t_enctypes.py     |  5 ++---
+ src/tests/t_etype_info.py          |  4 ++--
+ src/tests/t_sesskeynego.py         |  8 --------
+ src/util/k5test.py                 |  7 -------
+ 12 files changed, 15 insertions(+), 61 deletions(-)
+
+diff --git a/README b/README
+index 6d6f7f16e3..9341bd3dd8 100644
+--- a/README
++++ b/README
+@@ -81,11 +81,11 @@ Triple-DES and RC4 transitions
+ ------------------------------
+ 
+ Beginning with the krb5-1.21 release, the KDC will not issue tickets
+-with triple-DES or RC4 session keys unless explicitly configured using
+-the new allow_des3 and allow_rc4 variables in [libdefaults].  To
+-facilitate the negotiation of session keys, the KDC will assume that
+-all services can handle aes256-sha1 session keys unless the service
+-principal has a session_enctypes string attribute.
++with RC4 session keys unless explicitly configured using the new
++allow_rc4 variable in [libdefaults].  To facilitate the negotiation of
++session keys, the KDC will assume that all services can handle
++aes256-sha1 session keys unless the service principal has a
++session_enctypes string attribute.
+ 
+ Beginning with the krb5-1.19 release, a warning will be issued if
+ initial credentials are acquired using the des3-cbc-sha1 encryption
+@@ -164,9 +164,8 @@ Developer experience:
+ 
+ Protocol evolution:
+ 
+-* The KDC will no longer issue tickets with RC4 or triple-DES session
+-  keys unless explicitly configured with the new allow_rc4 or
+-  allow_des3 variables respectively.
++* The KDC will no longer issue tickets with RC4 session keys unless
++  explicitly configured with the new allow_rc4 variable.
+ 
+ * The KDC will assume that all services can handle aes256-sha1 session
+   keys unless the service principal has a session_enctypes string
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index d51fd3ce7e..d20dcf18e3 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -95,12 +95,6 @@ Additionally, krb5.conf may include any of the relations described in
+ 
+ The libdefaults section may contain any of the following relations:
+ 
+-**allow_des3**
+-    Permit the KDC to issue tickets with des3-cbc-sha1 session keys.
+-    In future releases, this flag will allow des3-cbc-sha1 to be used
+-    at all.  The default value for this tag is false.  (Added in
+-    release 1.21.)
+-
+ **allow_rc4**
+     Permit the KDC to issue tickets with arcfour-hmac session keys.
+     In future releases, this flag will allow arcfour-hmac to be used
+diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
+index 2b4ed7da0b..6ce4638d5e 100644
+--- a/doc/admin/enctypes.rst
++++ b/doc/admin/enctypes.rst
+@@ -49,8 +49,8 @@ The KDC chooses the session key enctype by taking the intersection of
+ its **permitted_enctypes** list, the list of long-term keys for the
+ most recent kvno of the service, and the client's requested list of
+ enctypes.  Starting in krb5-1.21, all services are assumed to support
+-aes256-cts-hmac-sha1-96; also, des3-cbc-sha1 and arcfour-hmac session
+-keys will not be issued by default.
++aes256-cts-hmac-sha1-96; also, arcfour-hmac session keys will not be
++issued by default.
+ 
+ Starting in krb5-1.11, it is possible to set a string attribute on a
+ service principal to control what session key enctypes the KDC may
+@@ -90,13 +90,6 @@ affect how enctypes are chosen.
+     acceptable risk for your environment and the weak enctypes are
+     required for backward compatibility.
+ 
+-**allow_des3**
+-    was added in release 1.21 and defaults to *false*.  Unless this
+-    flag is set to *true*, the KDC will not issue tickets with
+-    des3-cbc-sha1 session keys.  In a future release, this flag will
+-    control whether des3-cbc-sha1 is permitted in similar fashion to
+-    weak enctypes.
+-
+ **allow_rc4**
+     was added in release 1.21 and defaults to *false*.  Unless this
+     flag is set to *true*, the KDC will not issue tickets with
+diff --git a/doc/mitK5features.rst b/doc/mitK5features.rst
+index cad0855724..64d746b0af 100644
+--- a/doc/mitK5features.rst
++++ b/doc/mitK5features.rst
+@@ -659,9 +659,8 @@ Release 1.21
+ 
+ * Protocol evolution:
+ 
+-  - The KDC will no longer issue tickets with RC4 or triple-DES
+-    session keys unless explicitly configured with the new allow_rc4
+-    or allow_des3 variables respectively.
++  - The KDC will no longer issue tickets with RC4 session keys unless
++    explicitly configured with the new allow_rc4 variable.
+ 
+   - The KDC will assume that all services can handle aes256-sha1
+     session keys unless the service principal has a session_enctypes
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index d0a263aa7d..82a763298d 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -181,7 +181,6 @@ typedef unsigned char   u_char;
+  * matches the variable name.  Keep these alphabetized. */
+ #define KRB5_CONF_ACL_FILE                     "acl_file"
+ #define KRB5_CONF_ADMIN_SERVER                 "admin_server"
+-#define KRB5_CONF_ALLOW_DES3                   "allow_des3"
+ #define KRB5_CONF_ALLOW_RC4                    "allow_rc4"
+ #define KRB5_CONF_ALLOW_WEAK_CRYPTO            "allow_weak_crypto"
+ #define KRB5_CONF_AUTH_TO_LOCAL                "auth_to_local"
+@@ -1243,7 +1242,6 @@ struct _krb5_context {
+     struct _kdb_log_context *kdblog_context;
+ 
+     krb5_boolean allow_weak_crypto;
+-    krb5_boolean allow_des3;
+     krb5_boolean allow_rc4;
+     krb5_boolean ignore_acceptor_hostname;
+     krb5_boolean enforce_ok_as_delegate;
+diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
+index c7b6e4090d..bafcf5f728 100644
+--- a/src/kdc/kdc_util.c
++++ b/src/kdc/kdc_util.c
+@@ -1113,8 +1113,6 @@ select_session_keytype(krb5_context context, krb5_db_entry *server,
+          * unless they are explicitly allowed.  In the future they will be more
+          * comprehensively disabled and eventually removed.
+          */
+-        if (ktype[i] == ENCTYPE_DES3_CBC_SHA1 && !context->allow_des3)
+-            continue;
+         if (ktype[i] == ENCTYPE_ARCFOUR_HMAC && !context->allow_rc4)
+             continue;
+ 
+diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
+index a32f8dbf03..82aba64c5e 100644
+--- a/src/lib/krb5/krb/init_ctx.c
++++ b/src/lib/krb5/krb/init_ctx.c
+@@ -220,11 +220,6 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+         goto cleanup;
+     ctx->allow_weak_crypto = tmp;
+ 
+-    retval = get_boolean(ctx, KRB5_CONF_ALLOW_DES3, 0, &tmp);
+-    if (retval)
+-        goto cleanup;
+-    ctx->allow_des3 = tmp;
+-
+     retval = get_boolean(ctx, KRB5_CONF_ALLOW_RC4, 0, &tmp);
+     if (retval)
+         goto cleanup;
+diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
+index 6c0e9aff8c..4b53988712 100644
+--- a/src/man/krb5.conf.man
++++ b/src/man/krb5.conf.man
+@@ -178,12 +178,6 @@ kdc.conf(5), but it is not a recommended practice.
+ The libdefaults section may contain any of the following relations:
+ .INDENT 0.0
+ .TP
+-\fBallow_des3\fP
+-Permit the KDC to issue tickets with des3\-cbc\-sha1 session keys.
+-In future releases, this flag will allow des3\-cbc\-sha1 to be used
+-at all.  The default value for this tag is false.  (Added in
+-release 1.21.)
+-.TP
+ \fBallow_rc4\fP
+ Permit the KDC to issue tickets with arcfour\-hmac session keys.
+ In future releases, this flag will allow arcfour\-hmac to be used
+diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
+index e6bde47afc..1bb8c40b6b 100755
+--- a/src/tests/gssapi/t_enctypes.py
++++ b/src/tests/gssapi/t_enctypes.py
+@@ -10,9 +10,8 @@ d_rc4 = 'DEPRECATED:arcfour-hmac'
+ 
+ # These tests make assumptions about the default enctype lists, so set
+ # them explicitly rather than relying on the library defaults.
+-supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal'
+-conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4',
+-                        'allow_des3': 'true', 'allow_rc4': 'true'},
++supp='aes256-cts:normal aes128-cts:normal rc4-hmac:normal'
++conf = {'libdefaults': {'permitted_enctypes': 'aes rc4', 'allow_rc4': 'true'},
+         'realms': {'$realm': {'supported_enctypes': supp}}}
+ realm = K5Realm(krb5_conf=conf)
+ shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save'))
+diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
+index 75d9621dd6..e82ff7ff07 100644
+--- a/src/tests/t_etype_info.py
++++ b/src/tests/t_etype_info.py
+@@ -1,7 +1,7 @@
+ from k5test import *
+ 
+-supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac'
+-conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'},
++supported_enctypes = 'aes128-cts rc4-hmac'
++conf = {'libdefaults': {'allow_rc4': 'true'},
+         'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
+ realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf)
+ 
+diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py
+index 5a213617b5..c7dba0ff5b 100755
+--- a/src/tests/t_sesskeynego.py
++++ b/src/tests/t_sesskeynego.py
+@@ -26,7 +26,6 @@ conf3 = {'libdefaults': {
+         'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}}
+ conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}}
+ conf5 = {'libdefaults': {'allow_rc4': 'true'}}
+-conf6 = {'libdefaults': {'allow_des3': 'true'}}
+ # Test with client request and session_enctypes preferring aes128, but
+ # aes256 long-term key.
+ realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False)
+@@ -78,13 +77,6 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac'])
+ test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
+ realm.stop()
+ 
+-# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key.
+-realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False)
+-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
+-realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1'])
+-test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96')
+-realm.stop()
+-
+ # 7: default config negotiates aes256-sha1 session key for RC4-only service.
+ realm = K5Realm(create_host=False, get_creds=False)
+ realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server'])
+diff --git a/src/util/k5test.py b/src/util/k5test.py
+index 8e5f5ba8e9..b953827018 100644
+--- a/src/util/k5test.py
++++ b/src/util/k5test.py
+@@ -1338,13 +1338,6 @@ _passes = [
+     # No special settings; exercises AES256.
+     ('default', None, None, None),
+ 
+-    # Exercise the DES3 enctype.
+-    ('des3', None,
+-     {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}},
+-     {'realms': {'$realm': {
+-                    'supported_enctypes': 'des3-cbc-sha1:normal',
+-                    'master_key_type': 'des3-cbc-sha1'}}}),
+-
+     # Exercise the arcfour enctype.
+     ('arcfour', None,
+      {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}},
+-- 
+2.49.0
+

0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch

@@ -0,0 +1,692 @@
+From 9d03713af124c2096d071ba36893018da8d71655 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Tue, 14 Jan 2025 13:31:11 +0100
+Subject: [PATCH] Add PKINIT paChecksum2 from MS-PKCA v20230920
+
+In 2023, Microsoft updated MS-PKCA to add the optional paChecksum2
+element in the PKAuthenticator sequence.  This checksum accepts SHA-1,
+SHA-256, SHA-384, and SHA-512 digests.
+
+In Windows Server 2025, this checksum becomes mandatory when using
+PKINIT with FFDH (but strangely not with ECDH if SHA-1 is configured as
+allowed).
+
+[ghudson@mit.edu: refactored crypto interfaces to reduce complexity of
+calling code]
+
+ticket: 9166 (new)
+(cherry picked from commit 310793ba63782af5ffa3a95d20e41f8f03ca7e00)
+---
+ src/include/k5-int-pkinit.h                   |  25 ++--
+ src/lib/krb5/asn.1/asn1_k_encode.c            |  18 ++-
+ src/plugins/preauth/pkinit/pkinit.h           |   1 +
+ src/plugins/preauth/pkinit/pkinit_clnt.c      |  41 +++----
+ src/plugins/preauth/pkinit/pkinit_constants.c |  42 +++++--
+ src/plugins/preauth/pkinit/pkinit_crypto.h    |  24 +++-
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 116 +++++++++++++++++-
+ src/plugins/preauth/pkinit/pkinit_kdf_test.c  |   4 +-
+ src/plugins/preauth/pkinit/pkinit_lib.c       |  16 ++-
+ src/plugins/preauth/pkinit/pkinit_srv.c       |  38 ++----
+ src/plugins/preauth/pkinit/pkinit_trace.h     |   5 +-
+ src/tests/asn.1/krb5_decode_test.c            |   2 +-
+ src/tests/asn.1/ktest.c                       |   7 +-
+ src/tests/asn.1/ktest_equal.c                 |   2 +-
+ src/tests/asn.1/pkinit_encode.out             |   2 +-
+ src/tests/asn.1/pkinit_trval.out              |   2 +-
+ 16 files changed, 250 insertions(+), 95 deletions(-)
+
+diff --git a/src/include/k5-int-pkinit.h b/src/include/k5-int-pkinit.h
+index 915904e518..cf6b1f99c5 100644
+--- a/src/include/k5-int-pkinit.h
++++ b/src/include/k5-int-pkinit.h
+@@ -36,21 +36,28 @@
+  * pkinit structures
+  */
+ 
+-/* PKAuthenticator */
+-typedef struct _krb5_pk_authenticator {
+-    krb5_int32      cusec;  /* (0..999999) */
+-    krb5_timestamp  ctime;
+-    krb5_int32      nonce;  /* (0..4294967295) */
+-    krb5_checksum   paChecksum;
+-    krb5_data      *freshnessToken;
+-} krb5_pk_authenticator;
+-
+ /* AlgorithmIdentifier */
+ typedef struct _krb5_algorithm_identifier {
+     krb5_data algorithm;      /* OID */
+     krb5_data parameters; /* Optional */
+ } krb5_algorithm_identifier;
+ 
++/* PAChecksum2 */
++typedef struct _krb5_pachecksum2 {
++    krb5_data checksum;
++    krb5_algorithm_identifier algorithmIdentifier;
++} krb5_pachecksum2;
++
++/* PKAuthenticator */
++typedef struct _krb5_pk_authenticator {
++    krb5_int32        cusec;  /* (0..999999) */
++    krb5_timestamp    ctime;
++    krb5_int32        nonce;  /* (0..4294967295) */
++    krb5_data         paChecksum;
++    krb5_data        *freshnessToken; /* Optional */
++    krb5_pachecksum2 *paChecksum2; /* Optional */
++} krb5_pk_authenticator;
++
+ /** AuthPack from RFC 4556*/
+ typedef struct _krb5_auth_pack {
+     krb5_pk_authenticator       pkAuthenticator;
+diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c
+index 5378b5c23b..cf7b500837 100644
+--- a/src/lib/krb5/asn.1/asn1_k_encode.c
++++ b/src/lib/krb5/asn.1/asn1_k_encode.c
+@@ -1394,20 +1394,30 @@ DEFSEQTYPE(pkinit_supp_pub_info, krb5_pkinit_supp_pub_info,
+ MAKE_ENCODER(encode_krb5_pkinit_supp_pub_info, pkinit_supp_pub_info);
+ MAKE_ENCODER(encode_krb5_sp80056a_other_info, sp80056a_other_info);
+ 
+-/* A krb5_checksum encoded as an OCTET STRING, for PKAuthenticator. */
+-DEFCOUNTEDTYPE(ostring_checksum, krb5_checksum, contents, length, octetstring);
++DEFFIELD(pachecksum2_0, krb5_pachecksum2, checksum, 0, ostring_data);
++DEFFIELD(pachecksum2_1, krb5_pachecksum2, algorithmIdentifier, 1,
++         algorithm_identifier);
++static const struct atype_info *pachecksum2_fields[] = {
++    &k5_atype_pachecksum2_0, &k5_atype_pachecksum2_1
++};
++DEFSEQTYPE(pachecksum2, krb5_pachecksum2, pachecksum2_fields);
++
++DEFPTRTYPE(pachecksum2_ptr, pachecksum2);
++DEFOPTIONALZEROTYPE(opt_pachecksum2_ptr, pachecksum2_ptr);
+ 
+ DEFFIELD(pk_authenticator_0, krb5_pk_authenticator, cusec, 0, int32);
+ DEFFIELD(pk_authenticator_1, krb5_pk_authenticator, ctime, 1, kerberos_time);
+ DEFFIELD(pk_authenticator_2, krb5_pk_authenticator, nonce, 2, int32);
+ DEFFIELD(pk_authenticator_3, krb5_pk_authenticator, paChecksum, 3,
+-         ostring_checksum);
++         ostring_data);
+ DEFFIELD(pk_authenticator_4, krb5_pk_authenticator, freshnessToken, 4,
+          opt_ostring_data_ptr);
++DEFFIELD(pk_authenticator_5, krb5_pk_authenticator, paChecksum2, 5,
++         opt_pachecksum2_ptr);
+ static const struct atype_info *pk_authenticator_fields[] = {
+     &k5_atype_pk_authenticator_0, &k5_atype_pk_authenticator_1,
+     &k5_atype_pk_authenticator_2, &k5_atype_pk_authenticator_3,
+-    &k5_atype_pk_authenticator_4
++    &k5_atype_pk_authenticator_4, &k5_atype_pk_authenticator_5
+ };
+ DEFSEQTYPE(pk_authenticator, krb5_pk_authenticator, pk_authenticator_fields);
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
+index 7ba7155bb4..a1564b6df2 100644
+--- a/src/plugins/preauth/pkinit/pkinit.h
++++ b/src/plugins/preauth/pkinit/pkinit.h
+@@ -338,6 +338,7 @@ void free_krb5_external_principal_identifier(krb5_external_principal_identifier
+ void free_krb5_algorithm_identifiers(krb5_algorithm_identifier ***in);
+ void free_krb5_algorithm_identifier(krb5_algorithm_identifier *in);
+ void free_krb5_kdc_dh_key_info(krb5_kdc_dh_key_info **in);
++void free_pachecksum2(krb5_context context, krb5_pachecksum2 **in);
+ krb5_error_code pkinit_copy_krb5_data(krb5_data *dst, const krb5_data *src);
+ 
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
+index b08022a214..433f477538 100644
+--- a/src/plugins/preauth/pkinit/pkinit_clnt.c
++++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
+@@ -56,10 +56,9 @@ use_content_info(krb5_context context, pkinit_req_context req,
+ static krb5_error_code
+ pkinit_as_req_create(krb5_context context, pkinit_context plgctx,
+                      pkinit_req_context reqctx, krb5_timestamp ctsec,
+-                     krb5_int32 cusec, krb5_ui_4 nonce,
+-                     const krb5_checksum *cksum,
+-                     krb5_principal client, krb5_principal server,
+-                     krb5_data **as_req);
++                     krb5_int32 cusec, krb5_ui_4 nonce, const krb5_data *cksum,
++                     const krb5_pachecksum2 *cksum2, krb5_principal client,
++                     krb5_principal server, krb5_data **as_req);
+ 
+ static krb5_error_code
+ pkinit_as_rep_parse(krb5_context context, pkinit_context plgctx,
+@@ -89,7 +88,8 @@ pa_pkinit_gen_req(krb5_context context,
+     krb5_timestamp ctsec = 0;
+     krb5_int32 cusec = 0;
+     krb5_ui_4 nonce = 0;
+-    krb5_checksum cksum;
++    krb5_data cksum = empty_data();
++    krb5_pachecksum2 *cksum2 = NULL;
+     krb5_data *der_req = NULL;
+     krb5_pa_data **return_pa_data = NULL;
+ 
+@@ -118,15 +118,10 @@ pa_pkinit_gen_req(krb5_context context,
+         goto cleanup;
+     }
+ 
+-    retval = krb5_c_make_checksum(context, CKSUMTYPE_SHA1, NULL, 0, der_req,
+-                                  &cksum);
++    retval = crypto_generate_checksums(context, der_req, &cksum, &cksum2);
+     if (retval)
+         goto cleanup;
+-    TRACE_PKINIT_CLIENT_REQ_CHECKSUM(context, &cksum);
+-#ifdef DEBUG_CKSUM
+-    pkiDebug("calculating checksum on buf size (%d)\n", der_req->length);
+-    print_buffer(der_req->data, der_req->length);
+-#endif
++    TRACE_PKINIT_CLIENT_REQ_CHECKSUMS(context, &cksum, cksum2);
+ 
+     retval = cb->get_preauth_time(context, rock, TRUE, &ctsec, &cusec);
+     if (retval)
+@@ -140,7 +135,8 @@ pa_pkinit_gen_req(krb5_context context,
+     nonce = request->nonce;
+ 
+     retval = pkinit_as_req_create(context, plgctx, reqctx, ctsec, cusec,
+-                                  nonce, &cksum, request->client, request->server, &out_data);
++                                  nonce, &cksum, cksum2, request->client,
++                                  request->server, &out_data);
+     if (retval) {
+         pkiDebug("error %d on pkinit_as_req_create; aborting PKINIT\n",
+                  (int) retval);
+@@ -168,23 +164,19 @@ pa_pkinit_gen_req(krb5_context context,
+ 
+ cleanup:
+     krb5_free_data(context, der_req);
+-    krb5_free_checksum_contents(context, &cksum);
++    krb5_free_data_contents(context, &cksum);
++    free_pachecksum2(context, &cksum2);
+     krb5_free_data(context, out_data);
+     krb5_free_pa_data(context, return_pa_data);
+     return retval;
+ }
+ 
+ static krb5_error_code
+-pkinit_as_req_create(krb5_context context,
+-                     pkinit_context plgctx,
+-                     pkinit_req_context reqctx,
+-                     krb5_timestamp ctsec,
+-                     krb5_int32 cusec,
+-                     krb5_ui_4 nonce,
+-                     const krb5_checksum * cksum,
+-                     krb5_principal client,
+-                     krb5_principal server,
+-                     krb5_data ** as_req)
++pkinit_as_req_create(krb5_context context, pkinit_context plgctx,
++                     pkinit_req_context reqctx, krb5_timestamp ctsec,
++                     krb5_int32 cusec, krb5_ui_4 nonce, const krb5_data *cksum,
++                     const krb5_pachecksum2 *cksum2, krb5_principal client,
++                     krb5_principal server, krb5_data **as_req)
+ {
+     krb5_error_code retval = ENOMEM;
+     krb5_data spki = empty_data(), *coded_auth_pack = NULL;
+@@ -202,6 +194,7 @@ pkinit_as_req_create(krb5_context context,
+     auth_pack.pkAuthenticator.paChecksum = *cksum;
+     if (!reqctx->opts->disable_freshness)
+         auth_pack.pkAuthenticator.freshnessToken = reqctx->freshness_token;
++    auth_pack.pkAuthenticator.paChecksum2 = (krb5_pachecksum2 *)cksum2;
+     auth_pack.clientDHNonce.length = 0;
+     auth_pack.supportedKDFs = (krb5_data **)supported_kdf_alg_ids;
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_constants.c b/src/plugins/preauth/pkinit/pkinit_constants.c
+index 905e90d29c..a32b373c32 100644
+--- a/src/plugins/preauth/pkinit/pkinit_constants.c
++++ b/src/plugins/preauth/pkinit/pkinit_constants.c
+@@ -34,25 +34,49 @@
+ 
+ /* RFC 8636 id-pkinit-kdf-ah-sha1: iso(1) identified-organization(3) dod(6)
+  * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha1(1) */
+-static char sha1_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01 };
++static char kdf_sha1[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01 };
+ /* RFC 8636 id-pkinit-kdf-ah-sha256: iso(1) identified-organization(3) dod(6)
+  * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha256(2) */
+-static char sha256_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x02 };
++static char kdf_sha256[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x02 };
+ /* RFC 8636 id-pkinit-kdf-ah-sha512: iso(1) identified-organization(3) dod(6)
+  * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha512(3) */
+-static char sha512_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x03 };
++static char kdf_sha512[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x03 };
+ 
+-const krb5_data sha1_id = { KV5M_DATA, sizeof(sha1_oid), sha1_oid };
+-const krb5_data sha256_id = { KV5M_DATA, sizeof(sha256_oid), sha256_oid };
+-const krb5_data sha512_id = { KV5M_DATA, sizeof(sha512_oid), sha512_oid };
++const krb5_data kdf_sha1_id = { KV5M_DATA, sizeof(kdf_sha1), kdf_sha1 };
++const krb5_data kdf_sha256_id = { KV5M_DATA, sizeof(kdf_sha256), kdf_sha256 };
++const krb5_data kdf_sha512_id = { KV5M_DATA, sizeof(kdf_sha512), kdf_sha512 };
+ 
+ krb5_data const * const supported_kdf_alg_ids[] = {
+-    &sha256_id,
+-    &sha1_id,
+-    &sha512_id,
++    &kdf_sha256_id,
++    &kdf_sha1_id,
++    &kdf_sha512_id,
+     NULL
+ };
+ 
++/* RFC 3370 sha-1: iso(1) identified-organization(3) oiw(14) secsig(3)
++ * algorithm(2) 26 */
++static char cms_sha1[] = { 0x2b, 0x0e, 0x03, 0x02, 0x1a };
++/* RFC 5754 id-sha256: joint-iso-itu-t(2) country(16) us(840) organization(1)
++ * gov(101) csor(3) nistalgorithm(4) hashalgs(2) 1 */
++static char cms_sha256[] = {
++    0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
++};
++/* RFC 5754 id-sha384: joint-iso-itu-t(2) country(16) us(840) organization(1)
++ * gov(101) csor(3) nistalgorithm(4) hashalgs(2) 2 */
++static char cms_sha384[] = {
++    0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02
++};
++/* RFC 5754 id-sha512: joint-iso-itu-t(2) country(16) us(840) organization(1)
++ * gov(101) csor(3) nistalgorithm(4) hashalgs(2) 3 */
++static char cms_sha512[] = {
++    0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03
++};
++
++const krb5_data cms_sha1_id = { KV5M_DATA, sizeof(cms_sha1), cms_sha1 };
++const krb5_data cms_sha256_id = { KV5M_DATA, sizeof(cms_sha256), cms_sha256 };
++const krb5_data cms_sha384_id = { KV5M_DATA, sizeof(cms_sha384), cms_sha384 };
++const krb5_data cms_sha512_id = { KV5M_DATA, sizeof(cms_sha512), cms_sha512 };
++
+ /* RFC 4055 sha256WithRSAEncryption: iso(1) member-body(2) us(840)
+  * rsadsi(113549) pkcs(1) 1 11 */
+ static char sha256WithRSAEncr_oid[9] = {
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
+index fd876e4850..3b12e904b1 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto.h
++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
+@@ -562,9 +562,13 @@ pkinit_alg_agility_kdf(krb5_context context,
+                        krb5_data *pk_as_rep,
+                        krb5_keyblock *key_block);
+ 
+-extern const krb5_data sha1_id;
+-extern const krb5_data sha256_id;
+-extern const krb5_data sha512_id;
++extern const krb5_data kdf_sha1_id;
++extern const krb5_data kdf_sha256_id;
++extern const krb5_data kdf_sha512_id;
++extern const krb5_data cms_sha1_id;
++extern const krb5_data cms_sha256_id;
++extern const krb5_data cms_sha384_id;
++extern const krb5_data cms_sha512_id;
+ extern const krb5_data oakley_1024;
+ extern const krb5_data oakley_2048;
+ extern const krb5_data oakley_4096;
+@@ -597,4 +601,18 @@ crypto_req_cert_matching_data(krb5_context context,
+ 
+ int parse_dh_min_bits(krb5_context context, const char *str);
+ 
++/* Generate a SHA-1 checksum over body in *cksum1_out and a SHA-256 checksum
++ * over body in *cksum2_out with appropriate metadata. */
++krb5_error_code
++crypto_generate_checksums(krb5_context context, const krb5_data *body,
++			  krb5_data *cksum1_out,
++			  krb5_pachecksum2 **cksum2_out);
++
++/* Verify the SHA-1 checksum in cksum1 and the tagged checksum in cksum2.
++ * cksum2 may be NULL, in which case only cksum1 is verified. */
++krb5_error_code
++crypto_verify_checksums(krb5_context context, krb5_data *body,
++			const krb5_data *cksum1,
++			const krb5_pachecksum2 *cksum2);
++
+ #endif	/* _PKINIT_CRYPTO_H */
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 402bf1b9b3..429b7d202c 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -2616,11 +2616,11 @@ cleanup:
+ static const EVP_MD *
+ algid_to_md(const krb5_data *alg_id)
+ {
+-    if (data_eq(*alg_id, sha1_id))
++    if (data_eq(*alg_id, kdf_sha1_id))
+         return EVP_sha1();
+-    if (data_eq(*alg_id, sha256_id))
++    if (data_eq(*alg_id, kdf_sha256_id))
+         return EVP_sha256();
+-    if (data_eq(*alg_id, sha512_id))
++    if (data_eq(*alg_id, kdf_sha512_id))
+         return EVP_sha512();
+     return NULL;
+ }
+@@ -5663,3 +5663,113 @@ parse_dh_min_bits(krb5_context context, const char *str)
+     TRACE_PKINIT_DH_INVALID_MIN_BITS(context, str);
+     return PKINIT_DEFAULT_DH_MIN_BITS;
+ }
++
++/* Return the OpenSSL message digest type matching the given CMS OID, or NULL
++ * if it doesn't match any of the CMS OIDs we know about. */
++static const EVP_MD *
++md_from_cms_oid(const krb5_data *alg_id)
++{
++    if (data_eq(*alg_id, cms_sha1_id))
++        return EVP_sha1();
++    if (data_eq(*alg_id, cms_sha256_id))
++        return EVP_sha256();
++    if (data_eq(*alg_id, cms_sha384_id))
++        return EVP_sha384();
++    if (data_eq(*alg_id, cms_sha512_id))
++        return EVP_sha512();
++    return NULL;
++}
++
++/* Compute a message digest of the given type over body, placing the result in
++ * *digest_out in allocated storage.  Return true on success. */
++static krb5_boolean
++make_digest(const krb5_data *body, const EVP_MD *md, krb5_data *digest_out)
++{
++    krb5_error_code ret;
++    krb5_data d;
++
++    if (md == NULL)
++        return FALSE;
++    ret = alloc_data(&d, EVP_MD_size(md));
++    if (ret)
++        return FALSE;
++    if (!EVP_Digest(body->data, body->length, (uint8_t *)d.data, &d.length, md,
++                    NULL)) {
++        free(d.data);
++        return FALSE;
++    }
++    *digest_out = d;
++    return TRUE;
++}
++
++/* Return true if digest verifies for the given body and message digest
++ * type. */
++static krb5_boolean
++check_digest(const krb5_data *body, const EVP_MD *md, const krb5_data *digest)
++{
++    unsigned int digest_len;
++    uint8_t buf[EVP_MAX_MD_SIZE];
++
++    if (md == NULL)
++        return FALSE;
++    if (!EVP_Digest(body->data, body->length, buf, &digest_len, md, NULL))
++        return FALSE;
++    return (digest->length == digest_len &&
++            CRYPTO_memcmp(digest->data, buf, digest_len) == 0);
++}
++
++krb5_error_code
++crypto_generate_checksums(krb5_context context, const krb5_data *body,
++                          krb5_data *cksum1_out, krb5_pachecksum2 **cksum2_out)
++{
++    krb5_data cksum1 = empty_data();
++    krb5_pachecksum2 *cksum2 = NULL;
++    krb5_error_code ret;
++
++    if (!make_digest(body, EVP_sha1(), &cksum1))
++        goto fail;
++
++    cksum2 = k5alloc(sizeof(*cksum2), &ret);
++    if (cksum2 == NULL)
++        goto fail;
++
++    if (!make_digest(body, EVP_sha256(), &cksum2->checksum))
++        goto fail;
++
++    if (krb5int_copy_data_contents(context, &cms_sha256_id,
++                                   &cksum2->algorithmIdentifier.algorithm))
++        goto fail;
++
++    cksum2->algorithmIdentifier.parameters = empty_data();
++
++    *cksum1_out = cksum1;
++    *cksum2_out = cksum2;
++    return 0;
++
++fail:
++    krb5_free_data_contents(context, &cksum1);
++    free_pachecksum2(context, &cksum2);
++    return KRB5_CRYPTO_INTERNAL;
++}
++
++krb5_error_code
++crypto_verify_checksums(krb5_context context, krb5_data *body,
++                        const krb5_data *cksum1,
++                        const krb5_pachecksum2 *cksum2)
++{
++    const EVP_MD *md;
++
++    /* RFC 4556 doesn't say what error to return if the checksum doesn't match.
++     * Windows returns this one. */
++    if (!check_digest(body, EVP_sha1(), cksum1))
++        return KRB5KRB_AP_ERR_MODIFIED;
++
++    if (cksum2 == NULL)
++        return 0;
++
++    md = md_from_cms_oid(&cksum2->algorithmIdentifier.algorithm);
++    if (!check_digest(body, md, &cksum2->checksum))
++        return KRB5KRB_AP_ERR_MODIFIED;
++
++    return 0;
++}
+diff --git a/src/plugins/preauth/pkinit/pkinit_kdf_test.c b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
+index 99c93ac128..dd6e8d7503 100644
+--- a/src/plugins/preauth/pkinit/pkinit_kdf_test.c
++++ b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
+@@ -126,7 +126,7 @@ main(int argc, char **argv)
+ 
+     /* TEST 1:  SHA-1/AES */
+     /* set up algorithm id */
+-    alg_id.algorithm = sha1_id;
++    alg_id.algorithm = kdf_sha1_id;
+ 
+     enctype = enctype_aes;
+ 
+@@ -157,7 +157,7 @@ main(int argc, char **argv)
+ 
+     /* TEST 2: SHA-256/AES */
+     /* set up algorithm id */
+-    alg_id.algorithm = sha256_id;
++    alg_id.algorithm = kdf_sha256_id;
+ 
+     enctype = enctype_aes;
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_lib.c b/src/plugins/preauth/pkinit/pkinit_lib.c
+index 25965eb5d2..891f47fd26 100644
+--- a/src/plugins/preauth/pkinit/pkinit_lib.c
++++ b/src/plugins/preauth/pkinit/pkinit_lib.c
+@@ -29,6 +29,7 @@
+  * SUCH DAMAGES.
+  */
+ 
++#include "k5-int.h"
+ #include "pkinit.h"
+ 
+ #define FAKECERT
+@@ -119,8 +120,9 @@ free_krb5_auth_pack(krb5_auth_pack **in)
+ {
+     if ((*in) == NULL) return;
+     krb5_free_data_contents(NULL, &(*in)->clientPublicValue);
+-    free((*in)->pkAuthenticator.paChecksum.contents);
++    free((*in)->pkAuthenticator.paChecksum.data);
+     krb5_free_data(NULL, (*in)->pkAuthenticator.freshnessToken);
++    free_pachecksum2(NULL, &(*in)->pkAuthenticator.paChecksum2);
+     if ((*in)->supportedCMSTypes != NULL)
+         free_krb5_algorithm_identifiers(&((*in)->supportedCMSTypes));
+     if ((*in)->supportedKDFs) {
+@@ -196,6 +198,18 @@ free_krb5_kdc_dh_key_info(krb5_kdc_dh_key_info **in)
+     free(*in);
+ }
+ 
++void
++free_pachecksum2(krb5_context context, krb5_pachecksum2 **in)
++{
++    if (*in == NULL)
++        return;
++    krb5_free_data_contents(context, &(*in)->checksum);
++    krb5_free_data_contents(context, &(*in)->algorithmIdentifier.algorithm);
++    krb5_free_data_contents(context, &(*in)->algorithmIdentifier.parameters);
++    free(*in);
++    *in = NULL;
++}
++
+ void
+ init_krb5_pa_pk_as_req(krb5_pa_pk_as_req **in)
+ {
+diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
+index e22bcb195b..f558308483 100644
+--- a/src/plugins/preauth/pkinit/pkinit_srv.c
++++ b/src/plugins/preauth/pkinit/pkinit_srv.c
+@@ -428,11 +428,12 @@ pkinit_server_verify_padata(krb5_context context,
+     krb5_data authp_data = {0, 0, NULL}, krb5_authz = {0, 0, NULL};
+     krb5_pa_pk_as_req *reqp = NULL;
+     krb5_auth_pack *auth_pack = NULL;
++    krb5_pk_authenticator *pka;
+     pkinit_kdc_context plgctx = NULL;
+     pkinit_kdc_req_context reqctx = NULL;
+     krb5_checksum cksum = {0, 0, 0, NULL};
+     krb5_data *der_req = NULL;
+-    krb5_data k5data, *ftoken;
++    krb5_data k5data;
+     int is_signed = 1;
+     krb5_pa_data **e_data = NULL;
+     krb5_kdcpreauth_modreq modreq = NULL;
+@@ -524,8 +525,9 @@ pkinit_server_verify_padata(krb5_context context,
+         pkiDebug("failed to decode krb5_auth_pack\n");
+         goto cleanup;
+     }
++    pka = &auth_pack->pkAuthenticator;
+ 
+-    retval = krb5_check_clockskew(context, auth_pack->pkAuthenticator.ctime);
++    retval = krb5_check_clockskew(context, pka->ctime);
+     if (retval)
+         goto cleanup;
+ 
+@@ -548,36 +550,14 @@ pkinit_server_verify_padata(krb5_context context,
+         goto cleanup;
+     }
+     der_req = cb->request_body(context, rock);
+-    retval = krb5_c_make_checksum(context, CKSUMTYPE_SHA1, NULL, 0, der_req,
+-                                  &cksum);
+-    if (retval) {
+-        pkiDebug("unable to calculate AS REQ checksum\n");
+-        goto cleanup;
+-    }
+-    if (cksum.length != auth_pack->pkAuthenticator.paChecksum.length ||
+-        k5_bcmp(cksum.contents, auth_pack->pkAuthenticator.paChecksum.contents,
+-                cksum.length) != 0) {
+-        pkiDebug("failed to match the checksum\n");
+-#ifdef DEBUG_CKSUM
+-        pkiDebug("calculating checksum on buf size (%d)\n", req_pkt->length);
+-        print_buffer(req_pkt->data, req_pkt->length);
+-        pkiDebug("received checksum type=%d size=%d ",
+-                 auth_pack->pkAuthenticator.paChecksum.checksum_type,
+-                 auth_pack->pkAuthenticator.paChecksum.length);
+-        print_buffer(auth_pack->pkAuthenticator.paChecksum.contents,
+-                     auth_pack->pkAuthenticator.paChecksum.length);
+-        pkiDebug("expected checksum type=%d size=%d ",
+-                 cksum.checksum_type, cksum.length);
+-        print_buffer(cksum.contents, cksum.length);
+-#endif
+ 
+-        retval = KRB5KDC_ERR_PA_CHECKSUM_MUST_BE_INCLUDED;
++    retval = crypto_verify_checksums(context, der_req, &pka->paChecksum,
++                                     pka->paChecksum2);
++    if (retval)
+         goto cleanup;
+-    }
+ 
+-    ftoken = auth_pack->pkAuthenticator.freshnessToken;
+-    if (ftoken != NULL) {
+-        retval = cb->check_freshness_token(context, rock, ftoken);
++    if (pka->freshnessToken != NULL) {
++        retval = cb->check_freshness_token(context, rock, pka->freshnessToken);
+         if (retval)
+             goto cleanup;
+         valid_freshness_token = TRUE;
+diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h
+index 1faa6816d7..7b68d4b3b1 100644
+--- a/src/plugins/preauth/pkinit/pkinit_trace.h
++++ b/src/plugins/preauth/pkinit/pkinit_trace.h
+@@ -58,8 +58,9 @@
+     TRACE(c, "PKINIT client verified DH reply")
+ #define TRACE_PKINIT_CLIENT_REP_DH_FAIL(c)              \
+     TRACE(c, "PKINIT client could not verify DH reply")
+-#define TRACE_PKINIT_CLIENT_REQ_CHECKSUM(c, cksum)                      \
+-    TRACE(c, "PKINIT client computed kdc-req-body checksum {cksum}", cksum)
++#define TRACE_PKINIT_CLIENT_REQ_CHECKSUMS(c, ck1, ck2)                  \
++    TRACE(c, "PKINIT client computed checksums: {hexdata} {hexdata}",   \
++          ck1, &(ck2)->checksum)
+ #define TRACE_PKINIT_CLIENT_REQ_DH(c)                           \
+     TRACE(c, "PKINIT client making DH request")
+ #define TRACE_PKINIT_CLIENT_SAN_CONFIG_DNSNAME(c, host)                 \
+diff --git a/src/tests/asn.1/krb5_decode_test.c b/src/tests/asn.1/krb5_decode_test.c
+index 2fa6dce8eb..f47849abad 100644
+--- a/src/tests/asn.1/krb5_decode_test.c
++++ b/src/tests/asn.1/krb5_decode_test.c
+@@ -1174,7 +1174,7 @@ main(int argc, char **argv)
+     /* decode_krb5_auth_pack */
+     {
+         setup(krb5_auth_pack,ktest_make_sample_auth_pack);
+-        decode_run("krb5_auth_pack","","30 81 85 A0 35 30 33 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 06 04 04 31 32 33 34 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61",
++        decode_run("krb5_auth_pack","","30 81 89 A0 39 30 37 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61",
+                    acc.decode_krb5_auth_pack,
+                    ktest_equal_auth_pack,ktest_free_auth_pack);
+         ktest_empty_auth_pack(&ref);
+diff --git a/src/tests/asn.1/ktest.c b/src/tests/asn.1/ktest.c
+index d37e4fa7e6..7f54aa3184 100644
+--- a/src/tests/asn.1/ktest.c
++++ b/src/tests/asn.1/ktest.c
+@@ -700,9 +700,7 @@ ktest_make_sample_pk_authenticator(krb5_pk_authenticator *p)
+     p->cusec = SAMPLE_USEC;
+     p->ctime = SAMPLE_TIME;
+     p->nonce = SAMPLE_NONCE;
+-    ktest_make_sample_checksum(&p->paChecksum);
+-    /* We don't encode the checksum type, only the contents. */
+-    p->paChecksum.checksum_type = 0;
++    ktest_make_sample_data(&p->paChecksum);
+     p->freshnessToken = ealloc(sizeof(krb5_data));
+     ktest_make_sample_data(p->freshnessToken);
+ }
+@@ -1604,8 +1602,7 @@ ktest_empty_pa_otp_req(krb5_pa_otp_req *p)
+ static void
+ ktest_empty_pk_authenticator(krb5_pk_authenticator *p)
+ {
+-    ktest_empty_checksum(&p->paChecksum);
+-    p->paChecksum.contents = NULL;
++    ktest_empty_data(&p->paChecksum);
+     krb5_free_data(NULL, p->freshnessToken);
+     p->freshnessToken = NULL;
+ }
+diff --git a/src/tests/asn.1/ktest_equal.c b/src/tests/asn.1/ktest_equal.c
+index b48a0285d2..13786dd1e5 100644
+--- a/src/tests/asn.1/ktest_equal.c
++++ b/src/tests/asn.1/ktest_equal.c
+@@ -844,7 +844,7 @@ ktest_equal_pk_authenticator(krb5_pk_authenticator *ref,
+     p = p && scalar_equal(cusec);
+     p = p && scalar_equal(ctime);
+     p = p && scalar_equal(nonce);
+-    p = p && struct_equal(paChecksum, ktest_equal_checksum);
++    p = p && data_eq(ref->paChecksum, var->paChecksum);
+     return p;
+ }
+ 
+diff --git a/src/tests/asn.1/pkinit_encode.out b/src/tests/asn.1/pkinit_encode.out
+index 6ec7aaa36a..a764182e15 100644
+--- a/src/tests/asn.1/pkinit_encode.out
++++ b/src/tests/asn.1/pkinit_encode.out
+@@ -1,7 +1,7 @@
+ encode_krb5_pa_pk_as_req: 30 38 80 08 6B 72 62 35 64 61 74 61 A1 22 30 20 30 1E 80 08 6B 72 62 35 64 61 74 61 81 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61
+ encode_krb5_pa_pk_as_rep(dhInfo): A0 28 30 26 80 08 6B 72 62 35 64 61 74 61 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
+ encode_krb5_pa_pk_as_rep(encKeyPack): 81 08 6B 72 62 35 64 61 74 61
+-encode_krb5_auth_pack: 30 81 85 A0 35 30 33 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 06 04 04 31 32 33 34 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
++encode_krb5_auth_pack: 30 81 89 A0 39 30 37 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
+ encode_krb5_kdc_dh_key_info: 30 25 A0 0B 03 09 00 6B 72 62 35 64 61 74 61 A1 03 02 01 2A A2 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A
+ encode_krb5_reply_key_pack: 30 26 A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
+ encode_krb5_sp80056a_other_info: 30 81 81 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A0 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A2 0A 04 08 6B 72 62 35 64 61 74 61
+diff --git a/src/tests/asn.1/pkinit_trval.out b/src/tests/asn.1/pkinit_trval.out
+index 46f4a34108..c47bd71f67 100644
+--- a/src/tests/asn.1/pkinit_trval.out
++++ b/src/tests/asn.1/pkinit_trval.out
+@@ -38,7 +38,7 @@ encode_krb5_auth_pack:
+ .  .  [0] [Integer] 123456
+ .  .  [1] [Generalized Time] "19940610060317Z"
+ .  .  [2] [Integer] 42
+-.  .  [3] [Octet String] "1234"
++.  .  [3] [Octet String] "krb5data"
+ .  .  [4] [Octet String] "krb5data"
+ .  [1] [Octet String] "pvalue"
+ .  [2] [Sequence/Sequence Of]
+-- 
+2.49.0
+

0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch

@@ -0,0 +1,381 @@
+From 33afd2a6cfdf87d153170b41fbabfb92be49c422 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 10 Apr 2025 10:04:22 +0200
+Subject: [PATCH] [downstream] Do not block HMAC-MD4/5 in FIPS mode
+
+To ensure RC4 HMAC-MD5 was not used in FIPS mode, access to HMAC-MD4/5
+was not allowed in this mode. However, since we provide the
+"radius_md5_fips_override" configuration parameter to allow using RADIUS
+regardless to the FIPS restrictions, we should allow HMAC-MD5 to be used
+too in this case, because it is required for the newly supported
+Message-Authenticator attribute.
+
+A FIPS mode check is added in calculate_mac() which will fail if
+"radius_md5_fips_override" is not true. It will not affect interactions
+between krb5kdc and ipa-otpd, because the Message-Authenticator
+attribute is not generated in this case.
+---
+ src/lib/crypto/krb/crypto_int.h               |  9 +++
+ src/lib/crypto/openssl/Makefile.in            |  9 ++-
+ src/lib/crypto/openssl/common.c               | 80 +++++++++++++++++++
+ .../crypto/openssl/hash_provider/hash_evp.c   | 62 ++------------
+ src/lib/crypto/openssl/hmac.c                 | 15 ++--
+ src/lib/krad/packet.c                         | 19 +++--
+ 6 files changed, 120 insertions(+), 74 deletions(-)
+ create mode 100644 src/lib/crypto/openssl/common.c
+
+diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h
+index 1ee4b30e02..ff67b6bd35 100644
+--- a/src/lib/crypto/krb/crypto_int.h
++++ b/src/lib/crypto/krb/crypto_int.h
+@@ -36,6 +36,9 @@
+ 
+ #include <openssl/opensslv.h>
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
++
++#include <openssl/provider.h>
++
+ /*
+  * OpenSSL 3.0 relegates MD4 and RC4 to the legacy provider, which must be
+  * explicitly loaded into a library context.  Performing this loading within a
+@@ -660,4 +663,10 @@ iov_cursor_advance(struct iov_cursor *c, size_t nblocks)
+     c->out_pos += nblocks * c->block_size;
+ }
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++
++krb5_error_code k5_get_ossl_legacy_libctx(OSSL_LIB_CTX **libctx);
++
++#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
++
+ #endif /* CRYPTO_INT_H */
+diff --git a/src/lib/crypto/openssl/Makefile.in b/src/lib/crypto/openssl/Makefile.in
+index 8e4cdb8bbf..cc131000bd 100644
+--- a/src/lib/crypto/openssl/Makefile.in
++++ b/src/lib/crypto/openssl/Makefile.in
+@@ -8,21 +8,24 @@ STLIBOBJS=\
+ 	hmac.o	\
+ 	kdf.o	\
+ 	pbkdf2.o \
+-	sha256.o
++	sha256.o \
++	common.o
+ 
+ OBJS=\
+ 	$(OUTPRE)cmac.$(OBJEXT)	\
+ 	$(OUTPRE)hmac.$(OBJEXT)	\
+ 	$(OUTPRE)kdf.$(OBJEXT)	\
+ 	$(OUTPRE)pbkdf2.$(OBJEXT) \
+-	$(OUTPRE)sha256.$(OBJEXT)
++	$(OUTPRE)sha256.$(OBJEXT) \
++	$(OUTPRE)common.$(OBJEXT)
+ 
+ SRCS=\
+ 	$(srcdir)/cmac.c	\
+ 	$(srcdir)/hmac.c	\
+ 	$(srcdir)/kdf.c		\
+ 	$(srcdir)/pbkdf2.c	\
+-	$(srcdir)/sha256.c
++	$(srcdir)/sha256.c	\
++	$(srcdir)/common.c
+ 
+ SUBDIROBJLISTS= md4/OBJS.ST 		\
+ 		md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST 	\
+diff --git a/src/lib/crypto/openssl/common.c b/src/lib/crypto/openssl/common.c
+new file mode 100644
+index 0000000000..ced43fd54c
+--- /dev/null
++++ b/src/lib/crypto/openssl/common.c
+@@ -0,0 +1,80 @@
++#include "crypto_int.h"
++
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++
++#include <openssl/provider.h>
++#include <openssl/fips.h>
++#include <threads.h>
++#include <stdbool.h>
++
++typedef struct ossl_legacy_context {
++    bool initialized;
++    OSSL_LIB_CTX *libctx;
++    OSSL_PROVIDER *default_provider;
++    OSSL_PROVIDER *legacy_provider;
++} ossl_legacy_context_t;
++
++static thread_local ossl_legacy_context_t g_ossl_legacy_ctx;
++
++static krb5_error_code
++init_ossl_legacy_ctx(ossl_legacy_context_t *ctx)
++{
++    ctx->libctx = OSSL_LIB_CTX_new();
++    if (!ctx->libctx)
++        return KRB5_CRYPTO_INTERNAL;
++
++    /* Load both legacy and default provider as both may be needed. */
++    ctx->default_provider = OSSL_PROVIDER_load(ctx->libctx, "default");
++    ctx->legacy_provider = OSSL_PROVIDER_load(ctx->libctx, "legacy");
++
++    if (!(ctx->default_provider && ctx->legacy_provider))
++        return KRB5_CRYPTO_INTERNAL;
++
++    ctx->initialized = true;
++    return 0;
++}
++
++static void
++deinit_ossl_legacy_ctx(ossl_legacy_context_t *ctx)
++{
++    if (ctx->legacy_provider)
++        OSSL_PROVIDER_unload(ctx->legacy_provider);
++
++    if (ctx->default_provider)
++        OSSL_PROVIDER_unload(ctx->default_provider);
++
++    if (ctx->libctx)
++        OSSL_LIB_CTX_free(ctx->libctx);
++
++    ctx->initialized = false;
++}
++
++krb5_error_code
++k5_get_ossl_legacy_libctx(OSSL_LIB_CTX **libctx)
++{
++    krb5_error_code err;
++
++    if (!FIPS_mode()) {
++        if (libctx)
++            *libctx = NULL;
++        err = 0;
++        goto end;
++    }
++
++    if (!g_ossl_legacy_ctx.initialized) {
++        err = init_ossl_legacy_ctx(&g_ossl_legacy_ctx);
++        if (err) {
++            deinit_ossl_legacy_ctx(&g_ossl_legacy_ctx);
++            goto end;
++        }
++    }
++
++    if (libctx)
++        *libctx = g_ossl_legacy_ctx.libctx;
++    err = 0;
++
++end:
++    return err;
++}
++
++#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
+diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c
+index eb2e693e9f..2fd5d383d6 100644
+--- a/src/lib/crypto/openssl/hash_provider/hash_evp.c
++++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c
+@@ -44,48 +44,7 @@
+ #define EVP_MD_CTX_free EVP_MD_CTX_destroy
+ #endif
+ 
+-#include <openssl/provider.h>
+ #include <openssl/fips.h>
+-#include <threads.h>
+-
+-typedef struct ossl_lib_md_context {
+-    OSSL_LIB_CTX *libctx;
+-    OSSL_PROVIDER *default_provider;
+-    OSSL_PROVIDER *legacy_provider;
+-} ossl_md_context_t;
+-
+-static thread_local ossl_md_context_t *ossl_md_ctx = NULL;
+-
+-static krb5_error_code
+-init_ossl_md_ctx(ossl_md_context_t *ctx, const char *algo)
+-{
+-    ctx->libctx = OSSL_LIB_CTX_new();
+-    if (!ctx->libctx)
+-        return KRB5_CRYPTO_INTERNAL;
+-
+-    /* Load both legacy and default provider as both may be needed. */
+-    ctx->default_provider = OSSL_PROVIDER_load(ctx->libctx, "default");
+-    ctx->legacy_provider = OSSL_PROVIDER_load(ctx->libctx, "legacy");
+-
+-    if (!(ctx->default_provider && ctx->legacy_provider))
+-        return KRB5_CRYPTO_INTERNAL;
+-
+-    return 0;
+-}
+-
+-static void
+-deinit_ossl_ctx(ossl_md_context_t *ctx)
+-{
+-    if (ctx->legacy_provider)
+-        OSSL_PROVIDER_unload(ctx->legacy_provider);
+-
+-    if (ctx->default_provider)
+-        OSSL_PROVIDER_unload(ctx->default_provider);
+-
+-    if (ctx->libctx)
+-        OSSL_LIB_CTX_free(ctx->libctx);
+-}
+-
+ 
+ static krb5_error_code
+ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
+@@ -120,25 +79,14 @@ hash_legacy_evp(const char *algo, const krb5_crypto_iov *data, size_t num_data,
+                 krb5_data *output)
+ {
+     krb5_error_code err;
++    OSSL_LIB_CTX *ossl_libctx;
+     EVP_MD *md = NULL;
+ 
+-    if (!ossl_md_ctx) {
+-        ossl_md_ctx = malloc(sizeof(ossl_md_context_t));
+-        if (!ossl_md_ctx) {
+-            err = ENOMEM;
+-            goto end;
+-        }
+-
+-        err = init_ossl_md_ctx(ossl_md_ctx, algo);
+-        if (err) {
+-            deinit_ossl_ctx(ossl_md_ctx);
+-            free(ossl_md_ctx);
+-            ossl_md_ctx = NULL;
+-            goto end;
+-        }
+-    }
++    err = k5_get_ossl_legacy_libctx(&ossl_libctx);
++    if (err)
++        goto end;
+ 
+-    md = EVP_MD_fetch(ossl_md_ctx->libctx, algo, NULL);
++    md = EVP_MD_fetch(ossl_libctx, algo, NULL);
+     if (!md) {
+         err = KRB5_CRYPTO_INTERNAL;
+         goto end;
+diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c
+index 25a419d73a..8f9e88fec9 100644
+--- a/src/lib/crypto/openssl/hmac.c
++++ b/src/lib/crypto/openssl/hmac.c
+@@ -59,7 +59,6 @@
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ #include <openssl/params.h>
+ #include <openssl/core_names.h>
+-#include <openssl/fips.h>
+ #else
+ #include <openssl/hmac.h>
+ #endif
+@@ -112,11 +111,7 @@ map_digest(const struct krb5_hash_provider *hash)
+         return EVP_sha256();
+     else if (hash == &krb5int_hash_sha384)
+         return EVP_sha384();
+-
+-    if (FIPS_mode())
+-        return NULL;
+-
+-    if (hash == &krb5int_hash_md5)
++    else if (hash == &krb5int_hash_md5)
+         return EVP_md5();
+     else if (hash == &krb5int_hash_md4)
+         return EVP_md4();
+@@ -138,13 +133,19 @@ krb5int_hmac_keyblock(const struct krb5_hash_provider *hash,
+     EVP_MAC_CTX *ctx = NULL;
+     OSSL_PARAM params[2], *p = params;
+     size_t i = 0, md_len;
++    OSSL_LIB_CTX *ossl_libctx;
++    krb5_error_code err;
+ 
+     if (md == NULL || keyblock->length > hash->blocksize)
+         return KRB5_CRYPTO_INTERNAL;
+     if (output->length < hash->hashsize)
+         return KRB5_BAD_MSIZE;
+ 
+-    mac = EVP_MAC_fetch(NULL, "HMAC", NULL);
++    err = k5_get_ossl_legacy_libctx(&ossl_libctx);
++    if (err)
++        return err;
++
++    mac = EVP_MAC_fetch(ossl_libctx, "HMAC", NULL);
+     if (mac == NULL)
+         return KRB5_CRYPTO_INTERNAL;
+ 
+diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c
+index 3c1a4d507e..b95c99df65 100644
+--- a/src/lib/krad/packet.c
++++ b/src/lib/krad/packet.c
+@@ -278,7 +278,7 @@ lookup_msgauth_addr(const krad_packet *pkt)
+  * auth, which may be from pkt or from a corresponding request.
+  */
+ static krb5_error_code
+-calculate_mac(const char *secret, const krad_packet *pkt,
++calculate_mac(krb5_context ctx, const char *secret, const krad_packet *pkt,
+               const uint8_t auth[AUTH_FIELD_SIZE],
+               uint8_t mac_out[MD5_DIGEST_SIZE])
+ {
+@@ -288,6 +288,10 @@ calculate_mac(const char *secret, const krad_packet *pkt,
+     krb5_crypto_iov input[5];
+     krb5_data ksecr, mac;
+ 
++    /* Do not use HMAC-MD5 if not explicitly allowed */
++    if (kr_use_fips(ctx))
++        return KRB5_CRYPTO_INTERNAL;
++
+     msgauth_attr = lookup_msgauth_addr(pkt);
+     if (msgauth_attr == NULL)
+         return EINVAL;
+@@ -393,7 +397,8 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code,
+ 
+     if (msgauth_required) {
+         /* Calculate and set the Message-Authenticator MAC. */
+-        retval = calculate_mac(secret, pkt, pkt_auth(pkt), pkt_attr(pkt) + 2);
++        retval = calculate_mac(ctx, secret, pkt, pkt_auth(pkt),
++                               pkt_attr(pkt) + 2);
+         if (retval != 0)
+             goto error;
+     }
+@@ -454,7 +459,7 @@ krad_packet_new_response(krb5_context ctx, const char *secret, krad_code code,
+          * section 5.14, use the authenticator from the request, not from the
+          * response.
+          */
+-        retval = calculate_mac(secret, pkt, pkt_auth(request),
++        retval = calculate_mac(ctx, secret, pkt, pkt_auth(request),
+                                pkt_attr(pkt) + 2);
+         if (retval != 0)
+             goto error;
+@@ -476,7 +481,7 @@ error:
+ /* Verify the Message-Authenticator value in pkt, using the provided
+  * authenticator (which may be from pkt or from a corresponding request). */
+ static krb5_error_code
+-verify_msgauth(const char *secret, const krad_packet *pkt,
++verify_msgauth(krb5_context ctx, const char *secret, const krad_packet *pkt,
+                const uint8_t auth[AUTH_FIELD_SIZE])
+ {
+     uint8_t mac[MD5_DIGEST_SIZE];
+@@ -488,7 +493,7 @@ verify_msgauth(const char *secret, const krad_packet *pkt,
+     if (msgauth == NULL)
+         return ENODATA;
+ 
+-    retval = calculate_mac(secret, pkt, auth, mac);
++    retval = calculate_mac(ctx, secret, pkt, auth, mac);
+     if (retval)
+         return retval;
+ 
+@@ -561,7 +566,7 @@ krad_packet_decode_request(krb5_context ctx, const char *secret,
+ 
+     /* Verify Message-Authenticator if present. */
+     if (has_pkt_msgauth(req)) {
+-        retval = verify_msgauth(secret, req, pkt_auth(req));
++        retval = verify_msgauth(ctx, secret, req, pkt_auth(req));
+         if (retval) {
+             krad_packet_free(req);
+             return retval;
+@@ -613,7 +618,7 @@ krad_packet_decode_response(krb5_context ctx, const char *secret,
+ 
+             /* Verify Message-Authenticator if present. */
+             if (has_pkt_msgauth(*rsppkt)) {
+-                if (verify_msgauth(secret, *rsppkt, pkt_auth(tmp)) != 0)
++                if (verify_msgauth(ctx, secret, *rsppkt, pkt_auth(tmp)) != 0)
+                     continue;
+             }
+ 
+-- 
+2.49.0
+

0039-Fix-strchr-conformance-to-C23.patch

@@ -0,0 +1,189 @@
+From 1761e06398e4f043e4f540f57131c37fcc53a1b9 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Wed, 10 Dec 2025 10:42:02 +0200
+Subject: [PATCH] Fix strchr() conformance to C23
+
+C23 7.28.5.1 specifies search functions such as strchr() as generic,
+returning const char * if the first argument is of type const char *.
+Fix uses of strchr() to conform to this change.
+
+[jrische@redhat.com: altered changes to avoid casts; fixed an
+additional case]
+[ghudson@mit.edu: condensed some declarations; rewrote commit message]
+
+ticket: 9191 (new)
+(cherry picked from commit 6cd8580d823585d50ee4f30efd9f7e855823a369)
+---
+ src/lib/krb5/ccache/ccbase.c                      |  4 ++--
+ src/lib/krb5/os/expand_path.c                     |  3 ++-
+ src/lib/krb5/os/locate_kdc.c                      | 15 +++++++--------
+ src/plugins/preauth/pkinit/pkinit_crypto.h        |  2 +-
+ .../preauth/pkinit/pkinit_crypto_openssl.c        |  6 +++---
+ src/plugins/preauth/pkinit/pkinit_identity.c      |  2 +-
+ src/plugins/preauth/pkinit/pkinit_matching.c      |  2 +-
+ src/tests/responder.c                             |  3 +--
+ 8 files changed, 18 insertions(+), 19 deletions(-)
+
+diff --git a/src/lib/krb5/ccache/ccbase.c b/src/lib/krb5/ccache/ccbase.c
+index 5a01320832..1aada91b5e 100644
+--- a/src/lib/krb5/ccache/ccbase.c
++++ b/src/lib/krb5/ccache/ccbase.c
+@@ -201,8 +201,8 @@ krb5_cc_register(krb5_context context, const krb5_cc_ops *ops,
+ krb5_error_code KRB5_CALLCONV
+ krb5_cc_resolve (krb5_context context, const char *name, krb5_ccache *cache)
+ {
+-    char *pfx, *cp;
+-    const char *resid;
++    char *pfx;
++    const char *cp, *resid;
+     unsigned int pfxlen;
+     krb5_error_code err;
+     const krb5_cc_ops *ops;
+diff --git a/src/lib/krb5/os/expand_path.c b/src/lib/krb5/os/expand_path.c
+index 5cbccf08c8..6569b8820b 100644
+--- a/src/lib/krb5/os/expand_path.c
++++ b/src/lib/krb5/os/expand_path.c
+@@ -454,7 +454,8 @@ k5_expand_path_tokens_extra(krb5_context context, const char *path_in,
+ {
+     krb5_error_code ret;
+     struct k5buf buf;
+-    char *tok_begin, *tok_end, *tok_val, **extra_tokens = NULL, *path;
++    const char *tok_begin, *tok_end;
++    char *tok_val, **extra_tokens = NULL, *path;
+     const char *path_left;
+     size_t nargs = 0, i;
+     va_list ap;
+diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c
+index edca5ac7eb..47e15c849f 100644
+--- a/src/lib/krb5/os/locate_kdc.c
++++ b/src/lib/krb5/os/locate_kdc.c
+@@ -188,8 +188,8 @@ oom:
+ }
+ 
+ static void
+-parse_uri_if_https(const char *host_or_uri, k5_transport *transport,
+-                   const char **host, const char **uri_path)
++parse_uri_if_https(char *host_or_uri, k5_transport *transport,
++                   char **host, const char **uri_path)
+ {
+     char *cp;
+ 
+@@ -229,8 +229,7 @@ locate_srv_conf_1(krb5_context context, const krb5_data *realm,
+                   k5_transport transport, int udpport)
+ {
+     const char *realm_srv_names[4];
+-    char **hostlist = NULL, *realmstr = NULL, *host = NULL;
+-    const char *hostspec;
++    char **hostlist = NULL, *realmstr = NULL, *host = NULL, *hostspec;
+     krb5_error_code code;
+     int i, default_port;
+ 
+@@ -535,8 +534,8 @@ prof_locate_server(krb5_context context, const krb5_data *realm,
+  * Return a NULL *host_out if there are any problems parsing the URI.
+  */
+ static void
+-parse_uri_fields(const char *uri, k5_transport *transport_out,
+-                 const char **host_out, int *primary_out)
++parse_uri_fields(char *uri, k5_transport *transport_out,
++                 char **host_out, int *primary_out)
+ 
+ {
+     k5_transport transport;
+@@ -604,8 +603,8 @@ locate_uri(krb5_context context, const krb5_data *realm,
+     krb5_error_code ret;
+     k5_transport transport, host_trans;
+     struct srv_dns_entry *answers, *entry;
+-    char *host;
+-    const char *host_field, *path;
++    char *host, *host_field;
++    const char *path;
+     int port, def_port, primary;
+ 
+     ret = k5_make_uri_query(context, realm, req_service, &answers);
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
+index 3b12e904b1..99e2394040 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto.h
++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
+@@ -456,7 +456,7 @@ krb5_error_code crypto_load_cas_and_crls
+ 		    defines the storage type (file, directory, etc) */
+ 	int catype,					/* IN
+ 		    defines the ca type (anchor, intermediate, crls) */
+-	char *id);					/* IN
++	const char *id);				/* IN
+ 		    defines the location (filename, directory name, etc) */
+ 
+ /*
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 429b7d202c..6013080afc 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -4956,7 +4956,7 @@ load_cas_and_crls(krb5_context context,
+                   pkinit_req_crypto_context req_cryptoctx,
+                   pkinit_identity_crypto_context id_cryptoctx,
+                   int catype,
+-                  char *filename)
++                  const char *filename)
+ {
+     STACK_OF(X509_INFO) *sk = NULL;
+     STACK_OF(X509) *ca_certs = NULL;
+@@ -5114,7 +5114,7 @@ load_cas_and_crls_dir(krb5_context context,
+                       pkinit_req_crypto_context req_cryptoctx,
+                       pkinit_identity_crypto_context id_cryptoctx,
+                       int catype,
+-                      char *dirname)
++                      const char *dirname)
+ {
+     krb5_error_code retval = EINVAL;
+     DIR *d = NULL;
+@@ -5166,7 +5166,7 @@ crypto_load_cas_and_crls(krb5_context context,
+                          pkinit_identity_crypto_context id_cryptoctx,
+                          int idtype,
+                          int catype,
+-                         char *id)
++                         const char *id)
+ {
+     switch (idtype) {
+     case IDTYPE_FILE:
+diff --git a/src/plugins/preauth/pkinit/pkinit_identity.c b/src/plugins/preauth/pkinit/pkinit_identity.c
+index a5a979f279..b06d519c66 100644
+--- a/src/plugins/preauth/pkinit/pkinit_identity.c
++++ b/src/plugins/preauth/pkinit/pkinit_identity.c
+@@ -474,7 +474,7 @@ process_option_ca_crl(krb5_context context,
+                       const char *value,
+                       int catype)
+ {
+-    char *residual;
++    const char *residual;
+     unsigned int typelen;
+     int idtype;
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_matching.c b/src/plugins/preauth/pkinit/pkinit_matching.c
+index b42485a50a..5a7f2ba3fa 100644
+--- a/src/plugins/preauth/pkinit/pkinit_matching.c
++++ b/src/plugins/preauth/pkinit/pkinit_matching.c
+@@ -263,7 +263,7 @@ parse_rule_component(krb5_context context,
+     char err_buf[128];
+     int ret;
+     struct keyword_desc *kw, *nextkw;
+-    char *nk;
++    const char *nk;
+     int found_next_kw = 0;
+     char *value = NULL;
+     size_t len;
+diff --git a/src/tests/responder.c b/src/tests/responder.c
+index 82f870ea5d..4221a20283 100644
+--- a/src/tests/responder.c
++++ b/src/tests/responder.c
+@@ -282,8 +282,7 @@ responder(krb5_context ctx, void *rawdata, krb5_responder_context rctx)
+     /* Provide a particular response for an OTP challenge. */
+     if (data->otp_answer != NULL) {
+         if (krb5_responder_otp_get_challenge(ctx, rctx, &ochl) == 0) {
+-            key = strchr(data->otp_answer, '=');
+-            if (key != NULL) {
++            if (strchr(data->otp_answer, '=') != NULL) {
+                 /* Make a copy of the answer that we can chop up. */
+                 key = strdup(data->otp_answer);
+                 if (key == NULL)
+-- 
+2.51.1
+

0040-automated-fast.patch

@@ -0,0 +1,226 @@
+From 3baf9b93dc1dfe38585722c71d7268304cb4a01a Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Sun, 21 Sep 2025 11:14:51 +0300
+Subject: libkrb5: in case PKINIT is configured, attempt Anonymous
+ PKINIT for FAST
+
+If auto_fast_armor is configured for the realm or globally, optimistically
+assume that Anonymous PKINIT is supported as well and try to obtain it for
+FAST use in case no pre-made FAST channel was established by the caller.
+
+This behavior will automatically enable use of passwordless pre-authentication
+methods which rely on FAST channel presence in deployments such as FreeIPA.
+
+Notably, Microsoft Active Directory KDCs do not support Anonymous PKINIT. For
+these deployments only a machine account (host keytab) can be used to build a
+FAST channel. However, libkrb5 does not have access to /etc/krb5.keytab in a
+general case.
+
+Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
+---
+ src/lib/krb5/krb/fast.c | 118 ++++++++++++++++++++++++++++++++++++++++
+ src/lib/krb5/krb/fast.h |   2 +
+ src/man/krb5.conf.man   |  13 +++++
+ 3 files changed, 133 insertions(+)
+
+diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c
+index 62c9f0841..ee2e08189 100644
+--- a/src/lib/krb5/krb/fast.c
++++ b/src/lib/krb5/krb/fast.c
+@@ -168,6 +168,109 @@ krb5int_fast_prep_req_body(krb5_context context,
+     return retval;
+ }
+ 
++static krb5_boolean
++fast_is_pkinit_allowed(krb5_context context, krb5_data *realm)
++{
++    int value;
++    krb5_error_code retval = EINVAL;
++    char realmstr[1024];
++    const char *option = "auto_fast_armor";
++    const int def_value = FALSE;
++
++    if (realm != NULL && realm->length > sizeof(realmstr)-1)
++        return FALSE;
++
++    if (realm != NULL) {
++        strncpy(realmstr, realm->data, realm->length);
++        realmstr[realm->length] = '\0';
++
++        retval = profile_get_boolean(context->profile,
++                                     KRB5_CONF_REALMS, realmstr,
++                                     option, def_value, &value);
++    }
++
++    return retval ? FALSE : value;
++
++}
++
++static krb5_error_code
++fast_acquire_pkinit_armor(krb5_context context,
++                           struct krb5int_fast_request_state *state,
++                           krb5_get_init_creds_opt *opt, krb5_kdc_req *request)
++{
++    krb5_context ctx;
++    krb5_get_init_creds_opt *options = NULL;
++    krb5_error_code retval = 0;
++    krb5_data *target_realm = &request->server->realm;
++    krb5_creds creds;
++    krb5_principal anon_princ = NULL;
++    krb5_ccache out_cc;
++
++    /* short circuit, we are asked to perform Anonymous PKINIT already */
++    if (opt->flags & KRB5_GET_INIT_CREDS_OPT_ANONYMOUS) {
++        return EINVAL;
++    }
++
++    /* skip realms which do not allow use of automated FAST armor */
++    if (!fast_is_pkinit_allowed(context, target_realm)) {
++        return EINVAL;
++    }
++
++    retval = krb5_init_context(&ctx);
++    if (retval != 0) {
++        return retval;
++    }
++    retval = krb5_get_init_creds_opt_alloc(ctx, &options);
++    if (retval != 0) {
++        goto cleanup;
++    }
++    krb5_get_init_creds_opt_set_anonymous(options, 1);
++    retval = krb5_cc_new_unique(ctx, "MEMORY", NULL, &out_cc);
++    if (retval != 0) {
++        goto cleanup;
++    }
++
++    retval = krb5_get_init_creds_opt_set_out_ccache(ctx, options, out_cc);
++    if (retval != 0) {
++        goto cleanup;
++    }
++
++    retval = krb5_build_principal_ext(ctx, &anon_princ,
++                                      target_realm->length, target_realm->data,
++                                      strlen(KRB5_WELLKNOWN_NAMESTR),
++                                      KRB5_WELLKNOWN_NAMESTR,
++                                      strlen(KRB5_ANONYMOUS_PRINCSTR),
++                                      KRB5_ANONYMOUS_PRINCSTR, 0);
++    if (retval != 0) {
++        goto cleanup;
++    }
++
++    retval = krb5_get_init_creds_password(ctx, &creds, anon_princ, 0,
++                                          NULL /* no prompter */, NULL,
++                                          0, NULL /* service name */,
++                                          options);
++    if (retval == 0) {
++        state->fast_state_flags |= KRB5INT_FAST_OWN_ARMOR;
++        state->armor_ccache = out_cc;
++    }
++cleanup:
++    if (retval != 0 && out_cc != NULL) {
++        (void) krb5_cc_destroy(ctx, out_cc);
++    }
++    if (retval == 0) {
++        krb5_free_cred_contents(ctx, &creds);
++    }
++    if (options != NULL) {
++        krb5_get_init_creds_opt_free(ctx, options);
++    }
++    if (anon_princ != NULL) {
++        krb5_free_principal(ctx, anon_princ);
++    }
++    krb5_free_context(ctx);
++
++    return retval;
++}
++
+ krb5_error_code
+ krb5int_fast_as_armor(krb5_context context,
+                       struct krb5int_fast_request_state *state,
+@@ -178,10 +281,20 @@ krb5int_fast_as_armor(krb5_context context,
+     krb5_principal target_principal = NULL;
+     krb5_data *target_realm;
+     const char *ccname = k5_gic_opt_get_fast_ccache_name(opt);
++    char *fast_ccname = NULL;
+     krb5_flags fast_flags;
+ 
+     krb5_clear_error_message(context);
+     target_realm = &request->server->realm;
++    if (ccname == NULL) {
++        retval = fast_acquire_pkinit_armor(context, state, opt, request);
++        if (retval == 0) {
++            retval = krb5_cc_get_full_name(context, state->armor_ccache, &fast_ccname);
++            if (retval == 0 && fast_ccname != NULL)
++                ccname = fast_ccname;
++        }
++        retval = 0;
++    }
+     if (ccname != NULL) {
+         TRACE_FAST_ARMOR_CCACHE(context, ccname);
+         state->fast_state_flags |= KRB5INT_FAST_ARMOR_AVAIL;
+@@ -220,6 +333,8 @@ krb5int_fast_as_armor(krb5_context context,
+         krb5_cc_close(context, ccache);
+     if (target_principal)
+         krb5_free_principal(context, target_principal);
++    if (fast_ccname)
++        free(fast_ccname);
+     return retval;
+ }
+ 
+@@ -615,6 +730,9 @@ krb5int_fast_free_state(krb5_context context,
+     /*We are responsible for none of the store in the fast_outer_req*/
+     krb5_free_keyblock(context, state->armor_key);
+     krb5_free_fast_armor(context, state->armor);
++    if (state->fast_state_flags & KRB5INT_FAST_OWN_ARMOR) {
++        krb5_cc_destroy(context, state->armor_ccache);
++    }
+     free(state);
+ }
+ 
+diff --git a/src/lib/krb5/krb/fast.h b/src/lib/krb5/krb/fast.h
+index 7156ea203..e5fe8bd54 100644
+--- a/src/lib/krb5/krb/fast.h
++++ b/src/lib/krb5/krb/fast.h
+@@ -34,6 +34,7 @@ struct krb5int_fast_request_state {
+     krb5_kdc_req fast_outer_request;
+     krb5_keyblock *armor_key; /*non-null means fast is in use*/
+     krb5_fast_armor *armor;
++    krb5_ccache armor_ccache;
+     krb5_ui_4 fast_state_flags;
+     krb5_ui_4 fast_options;
+     krb5_int32 nonce;
+@@ -41,6 +42,7 @@ struct krb5int_fast_request_state {
+ 
+ #define KRB5INT_FAST_DO_FAST     (1l<<0)  /* Perform FAST */
+ #define KRB5INT_FAST_ARMOR_AVAIL (1l<<1)
++#define KRB5INT_FAST_OWN_ARMOR   (1l<<2)
+ 
+ krb5_error_code
+ krb5int_fast_prep_req_body(krb5_context context,
+diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
+index d4caa2bd3..ac7649647 100644
+--- a/src/man/krb5.conf.man
++++ b/src/man/krb5.conf.man
+@@ -650,6 +650,19 @@ primary KDC, in case the user\(aqs password has just been changed, and
+ the updated database has not been propagated to the replica
+ servers yet.  New in release 1.19.
+ .TP
++\fBauto_fast_armor\fP
++If this flag is true, then initial ticket request will use Anonymous
++PKINIT to protect the communication as a FAST channel in case an application
++did not provide its own FAST channel. This is useful for deployments where
++pre-authentication methods require use of the FAST channel, such as
++passwordless methods provided by FreeIPA. Microsoft Active Directory
++implementation of PKINIT does not support Anonymous PKINIT feature.
++As a result, \fIauto_fast_armor\fP defaults to false.
++.sp
++Use of \fIauto_fast_armor = true\fP requires properly configured PKINIT and
++WELLKNOWN/ANONYMOUS principal defined on the KDC side. Consult KDC documentation
++for details.
++.TP
+ \fBv4_instance_convert\fP
+ This subsection allows the administrator to configure exceptions
+ to the \fBdefault_domain\fP mapping rule.  It contains V4 instances
+-- 
+2.51.0
+

0041-bail-if-prompter-is-not-specified-but-required.patch

@@ -0,0 +1,40 @@
+From ff580d9cf86202d45454a6b6f53accc22cb40b62 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Sun, 19 Oct 2025 18:14:29 +0300
+Subject: [PATCH] bail if prompter is not specified but required
+
+GSSAPI gss_init_sec_context() may trigger credential re-initialization
+if the cred in ccache is expired. If automatic FAST armor is in use,
+we'd request Anonymous PKINIT and use it as an armor and this will
+enable seeing pre-authentication methods which require armor presence.
+
+OTP is one of such methods and its use requires prompter to be set,
+but GSSAPI cannot specify a prompter and thus we should fail any
+pre-auth where a prompter wasn't passed.
+
+PKINIT PKCS11 and SAM-2 preauth methods use KRB5_LIBOS_CANTREADPWD while PKINIT
+and gic_pwd.c use EIO. Use EIO here because we technically attempt to read a
+PIN rather than a password.
+
+Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
+---
+ src/lib/krb5/krb/preauth_otp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/lib/krb5/krb/preauth_otp.c b/src/lib/krb5/krb/preauth_otp.c
+index 07ffc15c2..48003da62 100644
+--- a/src/lib/krb5/krb/preauth_otp.c
++++ b/src/lib/krb5/krb/preauth_otp.c
+@@ -479,6 +479,9 @@ doprompt(krb5_context context, krb5_prompter_fct prompter, void *prompter_data,
+     krb5_error_code retval;
+     krb5_prompt_type prompt_type = KRB5_PROMPT_TYPE_PREAUTH;
+ 
++    if (prompter == NULL)
++        return EIO;
++
+     if (prompttxt == NULL || out == NULL)
+         return EINVAL;
+ 
+-- 
+2.51.0
+

kdc.conf

@@ -1,3 +1,7 @@
+[libdefaults]
+# Allow RC4 HMAC-MD5 for session keys (see CVE-2022-37966)
+#allow_rc4 = true
+
 [kdcdefaults]
     kdc_ports = 88
     kdc_tcp_ports = 88

krb5-tests

@@ -12,6 +12,7 @@ trap "rm -rf ${testdir}" EXIT
 
 build_flags="$(eval "echo $(rpm --eval '%{_smp_mflags}')")"
 
-cp -rp /usr/share/{{ name }}-tests "${testdir}/"
-make -C "${testdir}/{{ name }}-tests" $build_flags
-keyctl session - make -C "${testdir}/{{ name }}-tests" check
+mkdir "${testdir}/{{ name }}-tests"
+cp -rp /usr/share/{{ name }}-tests/{{ arch }} "${testdir}/{{ name }}-tests/"
+make -C "${testdir}/{{ name }}-tests/{{ arch }}/" $build_flags
+keyctl session - make -C "${testdir}/{{ name }}-tests/{{ arch }}/" check

sources

@@ -1,2 +1,2 @@
-SHA512 (krb5-1.21.tar.gz) = 8ee2366888f6d553a44fc642a89c69a57dbc1ec4c89a36b9ba8b00584a9a32c73a2b0566ba5f21852ad9617046666c276dac402393bf8eb19fbe0c07a838071a
-SHA512 (krb5-1.21.tar.gz.asc) = 7147a44a13f4f26c5c1d9aba738b32892b50e351ad149dcaf0b6f2c010e3c51d7d51540d0a51b085450ffa31d5027b5f2e5841109d7af8bdaddbdd3a569582d5
+SHA512 (krb5-1.21.3.tar.gz) = 87bc06607f4d95ff604169cea22180703a42d667af05f66f1569b8bd592670c42820b335e5c279e8b4f066d1e7da20f1948a1e4def7c5d295c170cbfc7f49c71
+SHA512 (krb5-1.21.3.tar.gz.asc) = 8992a5f5247315b9846aa73be4ee1ea223c0231a52d5c6c28718b1f3e3b45d62e2dad4aa5543a83163d1369bb79886b6c1c22766f22d8aa2f6b2575c54d0075c

tests/got-audit/got-audit.gdb

@@ -0,0 +1,2 @@
+gef config gef.disable_color True
+got-audit --all

tests/got-audit/kdc.conf

@@ -0,0 +1,12 @@
+[kdcdefaults]
+    kdc_ports = 88
+    kdc_tcp_ports = 88
+
+[realms]
+    ${krb5REALM1} = {
+        #master_key_type = aes256-cts
+        acl_file = /var/kerberos/krb5kdc/kadm5.acl
+        dict_file = /usr/share/dict/words
+        admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
+        supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
+    }

tests/got-audit/krb5.conf

@@ -0,0 +1,29 @@
+# To opt out of the system crypto-policies configuration of krb5, remove the
+# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
+includedir /etc/krb5.conf.d/
+
+[logging]
+    default = FILE:/var/log/krb5libs.log
+    kdc = FILE:/var/log/krb5kdc.log
+    admin_server = FILE:/var/log/kadmind.log
+
+[libdefaults]
+    default_realm = ${krb5REALM1}
+    dns_lookup_realm = false
+    ticket_lifetime = 24h
+    renew_lifetime = 7d
+    forwardable = true
+    rdns = false
+    default_ccache_name = KEYRING:persistent:%{uid}
+
+[realms]
+    ${krb5REALM1} = {
+        kdc = localhost.localdomain
+        admin_server = localhost.localdomain
+    }
+
+[domain_realm]
+    ${krb5HostName} = ${krb5REALM1}
+
+[capaths]
+    ${krb5REALM1} = .

tests/got-audit/main.fmf

@@ -0,0 +1,12 @@
+summary: Audit the GOT for signs of tampering
+description: |
+  Pointers in the server process GOT will be checked to ensure that
+  each function pointer's value is within a shared object file
+  that exports a symbol of that name, and that no shared object
+  files export conflicting symbols.
+contact: Gordon Messmer <gordon.messmer@gmail.com>
+require+:
+  - gdb-gef           # needed to test got-audit
+  - krb5-server
+test: ./runtest.sh
+framework: beakerlib

tests/got-audit/runtest.sh

@@ -0,0 +1,121 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/openssh/Sanity/got-audit
+#   Description: Check pointers in the server process GOT for signs of tampering
+#   Author: Gordon Messmer <gordon.messmer@gmail.com>
+#
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+krb5REALM1='TEST1.REDHAT.COM'
+krb5HostName=`hostname`
+krb5DomainName=`hostname -d`
+krb5User='alice'
+krb5UserPass='alice'
+krb5UserKrbPass='aaa'
+krb5User2='bob'
+krb5User3='carl'
+krb5KDCPass='qwe'
+krb5RootPass='rrr'
+
+krb5conf="/etc/krb5.conf"
+krb5confdir="/etc/krb5.conf.d"
+krb5kdcconf="/var/kerberos/krb5kdc/kdc.conf"
+krb5kadmacl="/var/kerberos/krb5kdc/kadm5.acl"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlServiceStart sshd
+        rlRun "TestDir=\$(pwd)"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})"
+    rlPhaseEnd
+
+    rlPhaseStartSetup "KDC and kadmind setup"
+        # Stop and backup
+        rlRun "rlServiceStop kadmin krb5kdc"
+        rlRun "rm -f /var/kerberos/krb5kdc/principal* /var/kerberos/krb5kdc/.k5*"
+        rlFileBackup $krb5conf /var/kerberos/krb5kdc /etc/sysconfig/{kadmin,krb5kdc} /etc/hosts
+        rlFileBackup --clean /root/.k5login
+        [ -e /etc/krb5.keytab ] && rlFileBackup /etc/krb5.keytab
+        [ -e $krb5confdir ] && rlFileBackup $krb5confdir
+        # Basic setup of KDC and krb5.conf
+        rlRun "sed -i \"s/\[libdefaults\]/[libdefaults]\n default_realm = $krb5REALM1/\" $krb5conf"
+        rlRun "sed -i \"s/\[realms\]/[realms]\n $krb5REALM1 = {\n  kdc = $krb5HostName\n  admin_server = $krb5HostName\n }/\" $krb5conf"
+        if [ "$krb5DomainName" ]; then
+            rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n .$krb5DomainName = $krb5REALM1\n $krb5DomainName = $krb5REALM1/\" $krb5conf"
+        else
+            rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n $krb5HostName = $krb5REALM1/\" $krb5conf"
+        fi
+        rlRun "sed -i s/EXAMPLE.COM/$krb5REALM1/ $krb5kdcconf"
+        # Configure the kadmin ACL
+        rlRun "echo \"*/master@$krb5REALM1  *\" > $krb5kadmacl"
+        if rlIsFedora '>=31';then
+            rlLog "Modify supported_enctypes for Fedora >=31. Remove *DES ciphers."
+            rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
+        elif rlIsRHEL '8' && [ `rpm -q --qf '%{VERSION}' krb5-server | cut -d"." -f2` -lt 18 ];then
+            rlLog "Modify supported_enctypes for RHEL-8."
+            rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
+        else
+            #RHEL-8 Bug 1802334 - [Rebase] krb5: rebase to 1.18:
+            #- Removal of *DES encryption types
+            #https://bugzilla.redhat.com/show_bug.cgi?id=1802334
+            rlLog "Modify supported_enctypes for RHEL-8 with krb-1.18. Remove *DES ciphers."
+            rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
+        fi
+        # Create the realm databases
+        rlRun "rngd -r /dev/urandom"
+        rlRun "kdb5_util create -s -r $krb5REALM1 -P $krb5KDCPass"
+        rlRun "rlServiceStart kadmin krb5kdc"
+        rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -pw $krb5RootPass root/master\""
+        rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -pw $krb5UserKrbPass $krb5User\""
+        rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -randkey host/$krb5HostName\""
+        rlRun "kadmin.local -r $krb5REALM1 -q \"ktadd host/$krb5HostName\""
+        # Create test system user 
+        [ $krb5User != "root" ] && rlRun "useradd $krb5User"
+        rlRun "echo $krb5UserPass | passwd --stdin $krb5User"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Run GEF got-audit"
+        rlRun "systemctl restart krb5kdc.service"
+        rlRun "systemctl restart kadmin.service"
+        rlRun "systemctl --no-pager status krb5kdc.service"
+        rlRun "systemctl --no-pager status kadmin.service"
+
+        rlRun "SERVICE_PID=\$( systemctl show --property=MainPID krb5kdc.service | cut -f2 -d= )"
+        rlRun "echo SERVICE_PID is '$SERVICE_PID'"
+        [ -n "$SERVICE_PID" ] || rlFail "No service pid was found"
+        rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'"
+        # Basic test: ensure that at least one symbol is found in libc.so,
+        #  to verify that the report looks plausible.
+        rlAssertGrep " : /.*/libc.so" "$auditfile"
+        # Ensure the got-audit did not report any errors
+        rlAssertNotGrep " :: ERROR" "$auditfile"
+        rlRun "cp '$auditfile' '$TMT_TEST_DATA'/krb5kdc-got-audit.txt"
+
+        rlRun "SERVICE_PID=\$( systemctl show --property=MainPID kadmin.service | cut -f2 -d= )"
+        rlRun "echo SERVICE_PID is '$SERVICE_PID'"
+        [ -n "$SERVICE_PID" ] || rlFail "No service pid was found"
+        rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'"
+        # Basic test: ensure that at least one symbol is found in libc.so,
+        #  to verify that the report looks plausible.
+        rlAssertGrep " : /.*/libc.so" "$auditfile"
+        # Ensure the got-audit did not report any errors
+        rlAssertNotGrep " :: ERROR" "$auditfile"
+        rlRun "cp '$auditfile' '$TMT_TEST_DATA'/kadmin-got-audit.txt"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -rf /var/kerberos/krb5kdc/* /var/kerberos/krb5kdc/.k5* /etc/krb5* /etc/sysconfig/{kadmin,krb5kdc}"
+        rlFileRestore
+        rlServiceRestore krb5kdc kadmin
+        [ $krb5User != "root" ] && rlRun "userdel -r -f $krb5User"
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

tests/upstream/test.sh

@@ -1,2 +1,7 @@
 #!/bin/sh -eux
-/usr/libexec/krb5-tests
+rc=0
+for test_exec in /usr/libexec/krb5-tests-*
+do
+    "$test_exec" || rc=1
+done
+exit $rc