krb5 1.21.3-11

- Fix strchr() conformance to C23

0039-Fix-strchr-conformance-to-C23.patch

@@ -0,0 +1,189 @@
+From 1761e06398e4f043e4f540f57131c37fcc53a1b9 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Wed, 10 Dec 2025 10:42:02 +0200
+Subject: [PATCH] Fix strchr() conformance to C23
+
+C23 7.28.5.1 specifies search functions such as strchr() as generic,
+returning const char * if the first argument is of type const char *.
+Fix uses of strchr() to conform to this change.
+
+[jrische@redhat.com: altered changes to avoid casts; fixed an
+additional case]
+[ghudson@mit.edu: condensed some declarations; rewrote commit message]
+
+ticket: 9191 (new)
+(cherry picked from commit 6cd8580d823585d50ee4f30efd9f7e855823a369)
+---
+ src/lib/krb5/ccache/ccbase.c                      |  4 ++--
+ src/lib/krb5/os/expand_path.c                     |  3 ++-
+ src/lib/krb5/os/locate_kdc.c                      | 15 +++++++--------
+ src/plugins/preauth/pkinit/pkinit_crypto.h        |  2 +-
+ .../preauth/pkinit/pkinit_crypto_openssl.c        |  6 +++---
+ src/plugins/preauth/pkinit/pkinit_identity.c      |  2 +-
+ src/plugins/preauth/pkinit/pkinit_matching.c      |  2 +-
+ src/tests/responder.c                             |  3 +--
+ 8 files changed, 18 insertions(+), 19 deletions(-)
+
+diff --git a/src/lib/krb5/ccache/ccbase.c b/src/lib/krb5/ccache/ccbase.c
+index 5a01320832..1aada91b5e 100644
+--- a/src/lib/krb5/ccache/ccbase.c
++++ b/src/lib/krb5/ccache/ccbase.c
+@@ -201,8 +201,8 @@ krb5_cc_register(krb5_context context, const krb5_cc_ops *ops,
+ krb5_error_code KRB5_CALLCONV
+ krb5_cc_resolve (krb5_context context, const char *name, krb5_ccache *cache)
+ {
+-    char *pfx, *cp;
+-    const char *resid;
++    char *pfx;
++    const char *cp, *resid;
+     unsigned int pfxlen;
+     krb5_error_code err;
+     const krb5_cc_ops *ops;
+diff --git a/src/lib/krb5/os/expand_path.c b/src/lib/krb5/os/expand_path.c
+index 5cbccf08c8..6569b8820b 100644
+--- a/src/lib/krb5/os/expand_path.c
++++ b/src/lib/krb5/os/expand_path.c
+@@ -454,7 +454,8 @@ k5_expand_path_tokens_extra(krb5_context context, const char *path_in,
+ {
+     krb5_error_code ret;
+     struct k5buf buf;
+-    char *tok_begin, *tok_end, *tok_val, **extra_tokens = NULL, *path;
++    const char *tok_begin, *tok_end;
++    char *tok_val, **extra_tokens = NULL, *path;
+     const char *path_left;
+     size_t nargs = 0, i;
+     va_list ap;
+diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c
+index edca5ac7eb..47e15c849f 100644
+--- a/src/lib/krb5/os/locate_kdc.c
++++ b/src/lib/krb5/os/locate_kdc.c
+@@ -188,8 +188,8 @@ oom:
+ }
+ 
+ static void
+-parse_uri_if_https(const char *host_or_uri, k5_transport *transport,
+-                   const char **host, const char **uri_path)
++parse_uri_if_https(char *host_or_uri, k5_transport *transport,
++                   char **host, const char **uri_path)
+ {
+     char *cp;
+ 
+@@ -229,8 +229,7 @@ locate_srv_conf_1(krb5_context context, const krb5_data *realm,
+                   k5_transport transport, int udpport)
+ {
+     const char *realm_srv_names[4];
+-    char **hostlist = NULL, *realmstr = NULL, *host = NULL;
+-    const char *hostspec;
++    char **hostlist = NULL, *realmstr = NULL, *host = NULL, *hostspec;
+     krb5_error_code code;
+     int i, default_port;
+ 
+@@ -535,8 +534,8 @@ prof_locate_server(krb5_context context, const krb5_data *realm,
+  * Return a NULL *host_out if there are any problems parsing the URI.
+  */
+ static void
+-parse_uri_fields(const char *uri, k5_transport *transport_out,
+-                 const char **host_out, int *primary_out)
++parse_uri_fields(char *uri, k5_transport *transport_out,
++                 char **host_out, int *primary_out)
+ 
+ {
+     k5_transport transport;
+@@ -604,8 +603,8 @@ locate_uri(krb5_context context, const krb5_data *realm,
+     krb5_error_code ret;
+     k5_transport transport, host_trans;
+     struct srv_dns_entry *answers, *entry;
+-    char *host;
+-    const char *host_field, *path;
++    char *host, *host_field;
++    const char *path;
+     int port, def_port, primary;
+ 
+     ret = k5_make_uri_query(context, realm, req_service, &answers);
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
+index 3b12e904b1..99e2394040 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto.h
++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
+@@ -456,7 +456,7 @@ krb5_error_code crypto_load_cas_and_crls
+ 		    defines the storage type (file, directory, etc) */
+ 	int catype,					/* IN
+ 		    defines the ca type (anchor, intermediate, crls) */
+-	char *id);					/* IN
++	const char *id);				/* IN
+ 		    defines the location (filename, directory name, etc) */
+ 
+ /*
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 429b7d202c..6013080afc 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -4956,7 +4956,7 @@ load_cas_and_crls(krb5_context context,
+                   pkinit_req_crypto_context req_cryptoctx,
+                   pkinit_identity_crypto_context id_cryptoctx,
+                   int catype,
+-                  char *filename)
++                  const char *filename)
+ {
+     STACK_OF(X509_INFO) *sk = NULL;
+     STACK_OF(X509) *ca_certs = NULL;
+@@ -5114,7 +5114,7 @@ load_cas_and_crls_dir(krb5_context context,
+                       pkinit_req_crypto_context req_cryptoctx,
+                       pkinit_identity_crypto_context id_cryptoctx,
+                       int catype,
+-                      char *dirname)
++                      const char *dirname)
+ {
+     krb5_error_code retval = EINVAL;
+     DIR *d = NULL;
+@@ -5166,7 +5166,7 @@ crypto_load_cas_and_crls(krb5_context context,
+                          pkinit_identity_crypto_context id_cryptoctx,
+                          int idtype,
+                          int catype,
+-                         char *id)
++                         const char *id)
+ {
+     switch (idtype) {
+     case IDTYPE_FILE:
+diff --git a/src/plugins/preauth/pkinit/pkinit_identity.c b/src/plugins/preauth/pkinit/pkinit_identity.c
+index a5a979f279..b06d519c66 100644
+--- a/src/plugins/preauth/pkinit/pkinit_identity.c
++++ b/src/plugins/preauth/pkinit/pkinit_identity.c
+@@ -474,7 +474,7 @@ process_option_ca_crl(krb5_context context,
+                       const char *value,
+                       int catype)
+ {
+-    char *residual;
++    const char *residual;
+     unsigned int typelen;
+     int idtype;
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_matching.c b/src/plugins/preauth/pkinit/pkinit_matching.c
+index b42485a50a..5a7f2ba3fa 100644
+--- a/src/plugins/preauth/pkinit/pkinit_matching.c
++++ b/src/plugins/preauth/pkinit/pkinit_matching.c
+@@ -263,7 +263,7 @@ parse_rule_component(krb5_context context,
+     char err_buf[128];
+     int ret;
+     struct keyword_desc *kw, *nextkw;
+-    char *nk;
++    const char *nk;
+     int found_next_kw = 0;
+     char *value = NULL;
+     size_t len;
+diff --git a/src/tests/responder.c b/src/tests/responder.c
+index 82f870ea5d..4221a20283 100644
+--- a/src/tests/responder.c
++++ b/src/tests/responder.c
+@@ -282,8 +282,7 @@ responder(krb5_context ctx, void *rawdata, krb5_responder_context rctx)
+     /* Provide a particular response for an OTP challenge. */
+     if (data->otp_answer != NULL) {
+         if (krb5_responder_otp_get_challenge(ctx, rctx, &ochl) == 0) {
+-            key = strchr(data->otp_answer, '=');
+-            if (key != NULL) {
++            if (strchr(data->otp_answer, '=') != NULL) {
+                 /* Make a copy of the answer that we can chop up. */
+                 key = strdup(data->otp_answer);
+                 if (key == NULL)
+-- 
+2.51.1
+

0040-automated-fast.patch

@@ -0,0 +1,226 @@
+From 3baf9b93dc1dfe38585722c71d7268304cb4a01a Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Sun, 21 Sep 2025 11:14:51 +0300
+Subject: libkrb5: in case PKINIT is configured, attempt Anonymous
+ PKINIT for FAST
+
+If auto_fast_armor is configured for the realm or globally, optimistically
+assume that Anonymous PKINIT is supported as well and try to obtain it for
+FAST use in case no pre-made FAST channel was established by the caller.
+
+This behavior will automatically enable use of passwordless pre-authentication
+methods which rely on FAST channel presence in deployments such as FreeIPA.
+
+Notably, Microsoft Active Directory KDCs do not support Anonymous PKINIT. For
+these deployments only a machine account (host keytab) can be used to build a
+FAST channel. However, libkrb5 does not have access to /etc/krb5.keytab in a
+general case.
+
+Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
+---
+ src/lib/krb5/krb/fast.c | 118 ++++++++++++++++++++++++++++++++++++++++
+ src/lib/krb5/krb/fast.h |   2 +
+ src/man/krb5.conf.man   |  13 +++++
+ 3 files changed, 133 insertions(+)
+
+diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c
+index 62c9f0841..ee2e08189 100644
+--- a/src/lib/krb5/krb/fast.c
++++ b/src/lib/krb5/krb/fast.c
+@@ -168,6 +168,109 @@ krb5int_fast_prep_req_body(krb5_context context,
+     return retval;
+ }
+ 
++static krb5_boolean
++fast_is_pkinit_allowed(krb5_context context, krb5_data *realm)
++{
++    int value;
++    krb5_error_code retval = EINVAL;
++    char realmstr[1024];
++    const char *option = "auto_fast_armor";
++    const int def_value = FALSE;
++
++    if (realm != NULL && realm->length > sizeof(realmstr)-1)
++        return FALSE;
++
++    if (realm != NULL) {
++        strncpy(realmstr, realm->data, realm->length);
++        realmstr[realm->length] = '\0';
++
++        retval = profile_get_boolean(context->profile,
++                                     KRB5_CONF_REALMS, realmstr,
++                                     option, def_value, &value);
++    }
++
++    return retval ? FALSE : value;
++
++}
++
++static krb5_error_code
++fast_acquire_pkinit_armor(krb5_context context,
++                           struct krb5int_fast_request_state *state,
++                           krb5_get_init_creds_opt *opt, krb5_kdc_req *request)
++{
++    krb5_context ctx;
++    krb5_get_init_creds_opt *options = NULL;
++    krb5_error_code retval = 0;
++    krb5_data *target_realm = &request->server->realm;
++    krb5_creds creds;
++    krb5_principal anon_princ = NULL;
++    krb5_ccache out_cc;
++
++    /* short circuit, we are asked to perform Anonymous PKINIT already */
++    if (opt->flags & KRB5_GET_INIT_CREDS_OPT_ANONYMOUS) {
++        return EINVAL;
++    }
++
++    /* skip realms which do not allow use of automated FAST armor */
++    if (!fast_is_pkinit_allowed(context, target_realm)) {
++        return EINVAL;
++    }
++
++    retval = krb5_init_context(&ctx);
++    if (retval != 0) {
++        return retval;
++    }
++    retval = krb5_get_init_creds_opt_alloc(ctx, &options);
++    if (retval != 0) {
++        goto cleanup;
++    }
++    krb5_get_init_creds_opt_set_anonymous(options, 1);
++    retval = krb5_cc_new_unique(ctx, "MEMORY", NULL, &out_cc);
++    if (retval != 0) {
++        goto cleanup;
++    }
++
++    retval = krb5_get_init_creds_opt_set_out_ccache(ctx, options, out_cc);
++    if (retval != 0) {
++        goto cleanup;
++    }
++
++    retval = krb5_build_principal_ext(ctx, &anon_princ,
++                                      target_realm->length, target_realm->data,
++                                      strlen(KRB5_WELLKNOWN_NAMESTR),
++                                      KRB5_WELLKNOWN_NAMESTR,
++                                      strlen(KRB5_ANONYMOUS_PRINCSTR),
++                                      KRB5_ANONYMOUS_PRINCSTR, 0);
++    if (retval != 0) {
++        goto cleanup;
++    }
++
++    retval = krb5_get_init_creds_password(ctx, &creds, anon_princ, 0,
++                                          NULL /* no prompter */, NULL,
++                                          0, NULL /* service name */,
++                                          options);
++    if (retval == 0) {
++        state->fast_state_flags |= KRB5INT_FAST_OWN_ARMOR;
++        state->armor_ccache = out_cc;
++    }
++cleanup:
++    if (retval != 0 && out_cc != NULL) {
++        (void) krb5_cc_destroy(ctx, out_cc);
++    }
++    if (retval == 0) {
++        krb5_free_cred_contents(ctx, &creds);
++    }
++    if (options != NULL) {
++        krb5_get_init_creds_opt_free(ctx, options);
++    }
++    if (anon_princ != NULL) {
++        krb5_free_principal(ctx, anon_princ);
++    }
++    krb5_free_context(ctx);
++
++    return retval;
++}
++
+ krb5_error_code
+ krb5int_fast_as_armor(krb5_context context,
+                       struct krb5int_fast_request_state *state,
+@@ -178,10 +281,20 @@ krb5int_fast_as_armor(krb5_context context,
+     krb5_principal target_principal = NULL;
+     krb5_data *target_realm;
+     const char *ccname = k5_gic_opt_get_fast_ccache_name(opt);
++    char *fast_ccname = NULL;
+     krb5_flags fast_flags;
+ 
+     krb5_clear_error_message(context);
+     target_realm = &request->server->realm;
++    if (ccname == NULL) {
++        retval = fast_acquire_pkinit_armor(context, state, opt, request);
++        if (retval == 0) {
++            retval = krb5_cc_get_full_name(context, state->armor_ccache, &fast_ccname);
++            if (retval == 0 && fast_ccname != NULL)
++                ccname = fast_ccname;
++        }
++        retval = 0;
++    }
+     if (ccname != NULL) {
+         TRACE_FAST_ARMOR_CCACHE(context, ccname);
+         state->fast_state_flags |= KRB5INT_FAST_ARMOR_AVAIL;
+@@ -220,6 +333,8 @@ krb5int_fast_as_armor(krb5_context context,
+         krb5_cc_close(context, ccache);
+     if (target_principal)
+         krb5_free_principal(context, target_principal);
++    if (fast_ccname)
++        free(fast_ccname);
+     return retval;
+ }
+ 
+@@ -615,6 +730,9 @@ krb5int_fast_free_state(krb5_context context,
+     /*We are responsible for none of the store in the fast_outer_req*/
+     krb5_free_keyblock(context, state->armor_key);
+     krb5_free_fast_armor(context, state->armor);
++    if (state->fast_state_flags & KRB5INT_FAST_OWN_ARMOR) {
++        krb5_cc_destroy(context, state->armor_ccache);
++    }
+     free(state);
+ }
+ 
+diff --git a/src/lib/krb5/krb/fast.h b/src/lib/krb5/krb/fast.h
+index 7156ea203..e5fe8bd54 100644
+--- a/src/lib/krb5/krb/fast.h
++++ b/src/lib/krb5/krb/fast.h
+@@ -34,6 +34,7 @@ struct krb5int_fast_request_state {
+     krb5_kdc_req fast_outer_request;
+     krb5_keyblock *armor_key; /*non-null means fast is in use*/
+     krb5_fast_armor *armor;
++    krb5_ccache armor_ccache;
+     krb5_ui_4 fast_state_flags;
+     krb5_ui_4 fast_options;
+     krb5_int32 nonce;
+@@ -41,6 +42,7 @@ struct krb5int_fast_request_state {
+ 
+ #define KRB5INT_FAST_DO_FAST     (1l<<0)  /* Perform FAST */
+ #define KRB5INT_FAST_ARMOR_AVAIL (1l<<1)
++#define KRB5INT_FAST_OWN_ARMOR   (1l<<2)
+ 
+ krb5_error_code
+ krb5int_fast_prep_req_body(krb5_context context,
+diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
+index d4caa2bd3..ac7649647 100644
+--- a/src/man/krb5.conf.man
++++ b/src/man/krb5.conf.man
+@@ -650,6 +650,19 @@ primary KDC, in case the user\(aqs password has just been changed, and
+ the updated database has not been propagated to the replica
+ servers yet.  New in release 1.19.
+ .TP
++\fBauto_fast_armor\fP
++If this flag is true, then initial ticket request will use Anonymous
++PKINIT to protect the communication as a FAST channel in case an application
++did not provide its own FAST channel. This is useful for deployments where
++pre-authentication methods require use of the FAST channel, such as
++passwordless methods provided by FreeIPA. Microsoft Active Directory
++implementation of PKINIT does not support Anonymous PKINIT feature.
++As a result, \fIauto_fast_armor\fP defaults to false.
++.sp
++Use of \fIauto_fast_armor = true\fP requires properly configured PKINIT and
++WELLKNOWN/ANONYMOUS principal defined on the KDC side. Consult KDC documentation
++for details.
++.TP
+ \fBv4_instance_convert\fP
+ This subsection allows the administrator to configure exceptions
+ to the \fBdefault_domain\fP mapping rule.  It contains V4 instances
+-- 
+2.51.0
+

0041-bail-if-prompter-is-not-specified-but-required.patch

@@ -0,0 +1,40 @@
+From ff580d9cf86202d45454a6b6f53accc22cb40b62 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Sun, 19 Oct 2025 18:14:29 +0300
+Subject: [PATCH] bail if prompter is not specified but required
+
+GSSAPI gss_init_sec_context() may trigger credential re-initialization
+if the cred in ccache is expired. If automatic FAST armor is in use,
+we'd request Anonymous PKINIT and use it as an armor and this will
+enable seeing pre-authentication methods which require armor presence.
+
+OTP is one of such methods and its use requires prompter to be set,
+but GSSAPI cannot specify a prompter and thus we should fail any
+pre-auth where a prompter wasn't passed.
+
+PKINIT PKCS11 and SAM-2 preauth methods use KRB5_LIBOS_CANTREADPWD while PKINIT
+and gic_pwd.c use EIO. Use EIO here because we technically attempt to read a
+PIN rather than a password.
+
+Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
+---
+ src/lib/krb5/krb/preauth_otp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/lib/krb5/krb/preauth_otp.c b/src/lib/krb5/krb/preauth_otp.c
+index 07ffc15c2..48003da62 100644
+--- a/src/lib/krb5/krb/preauth_otp.c
++++ b/src/lib/krb5/krb/preauth_otp.c
+@@ -479,6 +479,9 @@ doprompt(krb5_context context, krb5_prompter_fct prompter, void *prompter_data,
+     krb5_error_code retval;
+     krb5_prompt_type prompt_type = KRB5_PROMPT_TYPE_PREAUTH;
+ 
++    if (prompter == NULL)
++        return EIO;
++
+     if (prompttxt == NULL || out == NULL)
+         return EINVAL;
+ 
+-- 
+2.51.0
+

krb5.spec

@@ -10,7 +10,7 @@
 #
 # baserelease is what we have standardized across Fedora and what
 # rpmdev-bumpspec knows how to handle.
-%global baserelease 7
+%global baserelease 11
 
 # This should be e.g. beta1 or %%nil
 %global pre_release %nil
@@ -97,6 +97,9 @@ Patch0035: 0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch
 Patch0036: 0036-downstream-Remove-3des-support-cumulative-1.patch
 Patch0037: 0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch
 Patch0038: 0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch
+Patch0039: 0039-Fix-strchr-conformance-to-C23.patch
+Patch0040: 0040-automated-fast.patch
+Patch0041: 0041-bail-if-prompter-is-not-specified-but-required.patch
 
 License: Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision
 URL: https://web.mit.edu/kerberos/www/
@@ -742,6 +745,21 @@ exit 0
 %{_datarootdir}/%{name}-tests/%{_arch}
 
 %changelog
+* Mon Jan 05 2026 Julien Rische <jrische@redhat.com> - 1.21.3-11
+- Fix strchr() conformance to C23
+
+* Mon Oct 20 2025 Alexander Bokovoy <abokovoy@redhat.com> - 1.21.3-10
+- Update the prompter patch to upstream version
+  Resolves: rhbz#2403513
+
+* Wed Oct 15 2025 Alexander Bokovoy <abokovoy@redhat.com> - 1.21.3-9
+- do not crash when prompter is not available in GSSAPI
+  Resolves: rhbz#2403513
+
+* Fri Sep 26 2025 Alexander Bokovoy <abokovoy@redhat.com> - 1.21.3-8
+- Add automated FAST channel for kinit
+- https://github.com/krb5/krb5/pull/1447 - work in progress
+
 * Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.21.3-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild