Fix integer overflows in PAC parsing (CVE-2022-42898)

Resolves: rhbz#2143009
Signed-off-by: Julien Rische <jrische@redhat.com>

Fix-integer-overflows-in-PAC-parsing.patch

@@ -0,0 +1,106 @@
+From ecb5e0d78edb35a5570b581e144f6de68d44ddc8 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Mon, 17 Oct 2022 20:25:11 -0400
+Subject: [PATCH] Fix integer overflows in PAC parsing
+
+In krb5_parse_pac(), check for buffer counts large enough to threaten
+integer overflow in the header length and memory length calculations.
+Avoid potential integer overflows when checking the length of each
+buffer.
+
+CVE-2022-42898:
+
+In MIT krb5 releases 1.8 and later, an authenticated attacker may be
+able to cause a KDC or kadmind process to crash by reading beyond the
+bounds of allocated memory, creating a denial of service.  A
+privileged attacker may similarly be able to cause a Kerberos or GSS
+application service to crash.  On 32-bit platforms, an attacker can
+also cause insufficient memory to be allocated for the result,
+potentially leading to remote code execution in a KDC, kadmind, or GSS
+or Kerberos application server process.  An attacker with the
+privileges of a cross-realm KDC may be able to extract secrets from
+the KDC process's memory by having them copied into the PAC of a new
+ticket.
+
+ticket: 9074 (new)
+tags: pullup
+target_version: 1.20-next
+target_version: 1.19-next
+---
+ src/lib/krb5/krb/pac.c   |  9 +++++++--
+ src/lib/krb5/krb/t_pac.c | 18 ++++++++++++++++++
+ 2 files changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c
+index 950beda657..1b9ef12276 100644
+--- a/src/lib/krb5/krb/pac.c
++++ b/src/lib/krb5/krb/pac.c
+@@ -27,6 +27,8 @@
+ #include "k5-int.h"
+ #include "authdata.h"
+ 
++#define MAX_BUFFERS 4096
++
+ /* draft-brezak-win2k-krb-authz-00 */
+ 
+ /*
+@@ -316,6 +318,9 @@ krb5_pac_parse(krb5_context context,
+     if (version != 0)
+         return EINVAL;
+ 
++    if (cbuffers < 1 || cbuffers > MAX_BUFFERS)
++        return ERANGE;
++
+     header_len = PACTYPE_LENGTH + (cbuffers * PAC_INFO_BUFFER_LENGTH);
+     if (len < header_len)
+         return ERANGE;
+@@ -348,8 +353,8 @@ krb5_pac_parse(krb5_context context,
+             krb5_pac_free(context, pac);
+             return EINVAL;
+         }
+-        if (buffer->Offset < header_len ||
+-            buffer->Offset + buffer->cbBufferSize > len) {
++        if (buffer->Offset < header_len || buffer->Offset > len ||
++            buffer->cbBufferSize > len - buffer->Offset) {
+             krb5_pac_free(context, pac);
+             return ERANGE;
+         }
+diff --git a/src/lib/krb5/krb/t_pac.c b/src/lib/krb5/krb/t_pac.c
+index ee47152ee4..ccd165380d 100644
+--- a/src/lib/krb5/krb/t_pac.c
++++ b/src/lib/krb5/krb/t_pac.c
+@@ -431,6 +431,16 @@ static const unsigned char s4u_pac_ent_xrealm[] = {
+     0x8a, 0x81, 0x9c, 0x9c, 0x00, 0x00, 0x00, 0x00
+ };
+ 
++static const unsigned char fuzz1[] = {
++    0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00,
++    0x06, 0xff, 0xff, 0xff, 0x00, 0x00, 0xf5
++};
++
++static const unsigned char fuzz2[] = {
++    0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00,
++    0x20, 0x20
++};
++
+ static const char *s4u_principal = "w2k8u@ACME.COM";
+ static const char *s4u_enterprise = "w2k8u@abc@ACME.COM";
+ 
+@@ -646,6 +656,14 @@ main(int argc, char **argv)
+         krb5_free_principal(context, sep);
+     }
+ 
++    /* Check problematic PACs found by fuzzing. */
++    ret = krb5_pac_parse(context, fuzz1, sizeof(fuzz1), &pac);
++    if (!ret)
++        err(context, ret, "krb5_pac_parse should have failed");
++    ret = krb5_pac_parse(context, fuzz2, sizeof(fuzz2), &pac);
++    if (!ret)
++        err(context, ret, "krb5_pac_parse should have failed");
++
+     /*
+      * Test empty free
+      */
+-- 
+2.37.3
+

Read-GSS-configuration-files-with-mtime-0.patch

@@ -0,0 +1,71 @@
+From e90c4449c4f2252de21631915f76a6644bafe320 Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Thu, 19 May 2022 12:27:40 -0400
+Subject: [PATCH] Read GSS configuration files with mtime 0
+
+There is at least one case (with flatpaks) where configuration files
+in the special read-only /etc all have an mtime of 0.  Using an
+initial last modified time of 0 in g_initialize.c causes these files
+to never be read.
+
+Change the initial high value to the be the "invalid" value
+(time_t)-1.  Since the C and POSIX standards do not require time_t to
+be signed, special-case the checks in load_if_changed() and
+updateMechList() to treat all mod times as newer than -1.
+
+[ghudson@mit.edu: edited commit message; slightly modified approach]
+
+ticket: 9060 (new)
+target_version: 1.20
+tags: pullup
+---
+ src/lib/gssapi/mechglue/g_initialize.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c
+index 6d49700a5..857d4a4f2 100644
+--- a/src/lib/gssapi/mechglue/g_initialize.c
++++ b/src/lib/gssapi/mechglue/g_initialize.c
+@@ -93,7 +93,7 @@ static void free_mechSet(void);
+ static gss_mech_info g_mechList = NULL;
+ static gss_mech_info g_mechListTail = NULL;
+ static k5_mutex_t g_mechListLock = K5_MUTEX_PARTIAL_INITIALIZER;
+-static time_t g_confFileModTime = (time_t)0;
++static time_t g_confFileModTime = (time_t)-1;
+ static time_t g_confLastCall = (time_t)0;
+ 
+ static gss_OID_set_desc g_mechSet = { 0, NULL };
+@@ -469,9 +469,9 @@ load_if_changed(const char *pathname, time_t last, time_t *highest)
+ 	mtime = check_link_mtime(pathname, &mtime);
+ 	if (mtime == (time_t)-1)
+ 		return;
+-	if (mtime > *highest)
++	if (mtime > *highest || *highest == (time_t)-1)
+ 		*highest = mtime;
+-	if (mtime > last)
++	if (mtime > last || last == (time_t)-1)
+ 		loadConfigFile(pathname);
+ }
+ 
+@@ -482,7 +482,7 @@ static void
+ loadConfigFiles()
+ {
+ 	glob_t globbuf;
+-	time_t highest = 0, now;
++	time_t highest = (time_t)-1, now;
+ 	char **path;
+ 	const char *val;
+ 
+@@ -522,7 +522,8 @@ updateMechList(void)
+ 
+ #if defined(_WIN32)
+ 	time_t lastConfModTime = getRegConfigModTime(MECH_KEY);
+-	if (g_confFileModTime >= lastConfModTime)
++	if (g_confFileModTime >= lastConfModTime &&
++	    g_confFileModTime != (time_t)-1)
+ 		return;
+ 	g_confFileModTime = lastConfModTime;
+ 	loadConfigFromRegistry(HKEY_CURRENT_USER, MECH_KEY);
+-- 
+2.35.3
+

Try-harder-to-avoid-password-change-replay-errors.patch

@@ -0,0 +1,91 @@
+From 4c2efa452d484d3acf5a0c7d0895510dac41a739 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 4 Mar 2022 00:45:00 -0500
+Subject: [PATCH] Try harder to avoid password change replay errors
+
+Commit d7b3018d338fc9c989c3fa17505870f23c3759a8 (ticket 7905) changed
+change_set_password() to prefer TCP.  However, because UDP_LAST falls
+back to UDP after one second, we can still get a replay error due to a
+dropped packet, before the TCP layer has a chance to retry.
+
+Instead, try k5_sendto() with NO_UDP, and only fall back to UDP after
+TCP fails completely without reaching a server.  In sendto_kdc.c,
+implement an ONLY_UDP transport strategy to allow the UDP fallback.
+
+ticket: 9037
+---
+ src/lib/krb5/os/changepw.c   |  9 ++++++++-
+ src/lib/krb5/os/os-proto.h   |  1 +
+ src/lib/krb5/os/sendto_kdc.c | 12 ++++++++----
+ 3 files changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c
+index 9f968da7f..c59232586 100644
+--- a/src/lib/krb5/os/changepw.c
++++ b/src/lib/krb5/os/changepw.c
+@@ -255,9 +255,16 @@ change_set_password(krb5_context context,
+     callback_info.pfn_cleanup = kpasswd_sendto_msg_cleanup;
+     krb5_free_data_contents(callback_ctx.context, &chpw_rep);
+ 
++    /* UDP retransmits may be seen as replays.  Only try UDP after other
++     * transports fail completely. */
+     code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm,
+-                     &sl, UDP_LAST, &callback_info, &chpw_rep,
++                     &sl, NO_UDP, &callback_info, &chpw_rep,
+                      ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL);
++    if (code == KRB5_KDC_UNREACH) {
++        code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm,
++                         &sl, ONLY_UDP, &callback_info, &chpw_rep,
++                         ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL);
++    }
+     if (code)
+         goto cleanup;
+ 
+diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h
+index a985f2aec..91d2791ce 100644
+--- a/src/lib/krb5/os/os-proto.h
++++ b/src/lib/krb5/os/os-proto.h
+@@ -49,6 +49,7 @@ typedef enum {
+     UDP_FIRST = 0,
+     UDP_LAST,
+     NO_UDP,
++    ONLY_UDP
+ } k5_transport_strategy;
+ 
+ /* A single server hostname or address. */
+diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
+index 0eedec175..c7f5d861a 100644
+--- a/src/lib/krb5/os/sendto_kdc.c
++++ b/src/lib/krb5/os/sendto_kdc.c
+@@ -802,11 +802,14 @@ resolve_server(krb5_context context, const krb5_data *realm,
+     int err, result;
+     char portbuf[PORT_LENGTH];
+ 
+-    /* Skip UDP entries if we don't want UDP. */
++    /* Skip entries excluded by the strategy. */
+     if (strategy == NO_UDP && entry->transport == UDP)
+         return 0;
++    if (strategy == ONLY_UDP && entry->transport != UDP &&
++        entry->transport != TCP_OR_UDP)
++        return 0;
+ 
+-    transport = (strategy == UDP_FIRST) ? UDP : TCP;
++    transport = (strategy == UDP_FIRST || strategy == ONLY_UDP) ? UDP : TCP;
+     if (entry->hostname == NULL) {
+         /* Added by a module, so transport is either TCP or UDP. */
+         ai.ai_socktype = socktype_for_transport(entry->transport);
+@@ -850,8 +853,9 @@ resolve_server(krb5_context context, const krb5_data *realm,
+     }
+ 
+     /* For TCP_OR_UDP entries, add each address again with the non-preferred
+-     * transport, unless we are avoiding UDP.  Flag these as deferred. */
+-    if (retval == 0 && entry->transport == TCP_OR_UDP && strategy != NO_UDP) {
++     * transport, if there is one.  Flag these as deferred. */
++    if (retval == 0 && entry->transport == TCP_OR_UDP &&
++        (strategy == UDP_FIRST || strategy == UDP_LAST)) {
+         transport = (strategy == UDP_FIRST) ? TCP : UDP;
+         for (a = addrs; a != 0 && retval == 0; a = a->ai_next) {
+             a->ai_socktype = socktype_for_transport(transport);
+-- 
+2.35.1
+

Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch

@@ -0,0 +1,113 @@
+From d2fafab4eaf031a662b35cd53200d4d8178bfd6c Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Fri, 11 Mar 2022 11:33:56 +0100
+Subject: [PATCH] Use SHA-256 instead of SHA-1 for PKINIT CMS digest
+
+Various organizations including NIST have been strongly recommending to
+stop using SHA-1 for digital signatures for some years already. CMS
+digest is used to generate such signatures, hence it should be upgraded
+to use SHA-256.
+---
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 27 ++++++++++---------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 911e74fd9..3ceba8b0d 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -1234,7 +1234,7 @@ cms_signeddata_create(krb5_context context,
+         /* will not fill-out EVP_PKEY because it's on the smartcard */
+ 
+         /* Set digest algs */
+-        p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha1);
++        p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha256);
+ 
+         if (p7si->digest_alg->parameter != NULL)
+             ASN1_TYPE_free(p7si->digest_alg->parameter);
+@@ -1245,17 +1245,17 @@ cms_signeddata_create(krb5_context context,
+         /* Set sig algs */
+         if (p7si->digest_enc_alg->parameter != NULL)
+             ASN1_TYPE_free(p7si->digest_enc_alg->parameter);
+-        p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha1WithRSAEncryption);
++        p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha256WithRSAEncryption);
+         if (!(p7si->digest_enc_alg->parameter = ASN1_TYPE_new()))
+             goto cleanup;
+         p7si->digest_enc_alg->parameter->type = V_ASN1_NULL;
+ 
+         /* add signed attributes */
+-        /* compute sha1 digest over the EncapsulatedContentInfo */
++        /* compute sha256 digest over the EncapsulatedContentInfo */
+         ctx = EVP_MD_CTX_new();
+         if (ctx == NULL)
+             goto cleanup;
+-        EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
++        EVP_DigestInit_ex(ctx, EVP_sha256(), NULL);
+         EVP_DigestUpdate(ctx, data, data_len);
+         md_tmp = EVP_MD_CTX_md(ctx);
+         EVP_DigestFinal_ex(ctx, md_data, &md_len);
+@@ -1283,9 +1283,10 @@ cms_signeddata_create(krb5_context context,
+             goto cleanup2;
+ 
+ #ifndef WITHOUT_PKCS11
+-        /* Some tokens can only do RSAEncryption without sha1 hash */
+-        /* to compute sha1WithRSAEncryption, encode the algorithm ID for the hash
+-         * function and the hash value into an ASN.1 value of type DigestInfo
++        /* Some tokens can only do RSAEncryption without sha256 hash */
++        /* to compute sha256WithRSAEncryption, encode the algorithm ID for the
++         * hash function and the hash value into an ASN.1 value of type
++         * DigestInfo
+          * DigestInfo::=SEQUENCE {
+          *  digestAlgorithm  AlgorithmIdentifier,
+          *  digest OCTET STRING }
+@@ -1304,7 +1305,7 @@ cms_signeddata_create(krb5_context context,
+             alg = X509_ALGOR_new();
+             if (alg == NULL)
+                 goto cleanup2;
+-            X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha1), V_ASN1_NULL, NULL);
++            X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha256), V_ASN1_NULL, NULL);
+             alg_len = i2d_X509_ALGOR(alg, NULL);
+ 
+             digest = ASN1_OCTET_STRING_new();
+@@ -1333,7 +1334,7 @@ cms_signeddata_create(krb5_context context,
+ #endif
+         {
+             pkiDebug("mech = %s\n",
+-                     id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA1_RSA_PKCS" : "FS");
++                     id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA256_RSA_PKCS" : "FS");
+             retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen,
+                                       &sig, &sig_len);
+         }
+@@ -4147,7 +4148,7 @@ create_signature(unsigned char **sig, unsigned int *sig_len,
+     ctx = EVP_MD_CTX_new();
+     if (ctx == NULL)
+         return ENOMEM;
+-    EVP_SignInit(ctx, EVP_sha1());
++    EVP_SignInit(ctx, EVP_sha256());
+     EVP_SignUpdate(ctx, data, data_len);
+     *sig_len = EVP_PKEY_size(pkey);
+     if ((*sig = malloc(*sig_len)) == NULL)
+@@ -4621,10 +4622,10 @@ pkinit_get_certs_pkcs11(krb5_context context,
+ 
+ #ifndef PKINIT_USE_MECH_LIST
+     /*
+-     * We'd like to use CKM_SHA1_RSA_PKCS for signing if it's available, but
++     * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but
+      * many cards seems to be confused about whether they are capable of
+      * this or not. The safe thing seems to be to ignore the mechanism list,
+-     * always use CKM_RSA_PKCS and calculate the sha1 digest ourselves.
++     * always use CKM_RSA_PKCS and calculate the sha256 digest ourselves.
+      */
+ 
+     id_cryptoctx->mech = CKM_RSA_PKCS;
+@@ -4652,7 +4653,7 @@ pkinit_get_certs_pkcs11(krb5_context context,
+         if (mechp[i] == CKM_RSA_PKCS) {
+             /* This seems backwards... */
+             id_cryptoctx->mech =
+-                (info.flags & CKF_SIGN) ? CKM_SHA1_RSA_PKCS : CKM_RSA_PKCS;
++                (info.flags & CKF_SIGN) ? CKM_SHA256_RSA_PKCS : CKM_RSA_PKCS;
+         }
+     }
+     free(mechp);
+-- 
+2.35.1
+

downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch

@@ -0,0 +1,81 @@
+From 086c6b5008d53b748bec1ea03e55c73c5326ceb2 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 5 May 2022 17:15:12 +0200
+Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection with FIPS
+
+libkrad allows to establish connections only to UNIX socket in FIPS
+mode, because MD5 digest is not considered safe enough to be used for
+network communication. However, FreeRadius requires connection on TCP or
+UDP ports.
+
+This commit allows TCP or UDP connections in FIPS mode if destination is
+localhost.
+
+Resolves: rhbz#2082189
+---
+ src/lib/krad/remote.c | 35 +++++++++++++++++++++++++++++++++--
+ 1 file changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
+index 6f9354e54..c7f3c8f5f 100644
+--- a/src/lib/krad/remote.c
++++ b/src/lib/krad/remote.c
+@@ -33,6 +33,7 @@
+ 
+ #include <string.h>
+ #include <unistd.h>
++#include <stdbool.h>
+ 
+ #include <sys/un.h>
+ 
+@@ -74,6 +75,35 @@ on_io(verto_ctx *ctx, verto_ev *ev);
+ static void
+ on_timeout(verto_ctx *ctx, verto_ev *ev);
+ 
++static in_addr_t get_in_addr(struct addrinfo *info)
++{ return ((struct sockaddr_in *)(info->ai_addr))->sin_addr.s_addr; }
++
++static struct in6_addr *get_in6_addr(struct addrinfo *info)
++{ return &(((struct sockaddr_in6 *)(info->ai_addr))->sin6_addr); }
++
++static bool is_inet_localhost(struct addrinfo *info)
++{
++    struct addrinfo *p;
++
++    for (p = info; p; p = p->ai_next) {
++        switch (p->ai_family) {
++            case AF_INET:
++                if (IN_LOOPBACKNET != (get_in_addr(p) & IN_CLASSA_NET
++                                                      >> IN_CLASSA_NSHIFT))
++                    return false;
++                break;
++            case AF_INET6:
++                if (!IN6_IS_ADDR_LOOPBACK(get_in6_addr(p)))
++                    return false;
++                break;
++            default:
++                return false;
++        }
++    }
++
++    return true;
++}
++
+ /* Iterate over the set of outstanding packets. */
+ static const krad_packet *
+ iterator(request **out)
+@@ -460,8 +490,9 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs,
+                                      (krad_packet_iter_cb)iterator, &r, &tmp);
+     if (retval != 0)
+         goto error;
+-    else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL &&
+-        rr->info->ai_family != AF_UNIX) {
++    else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL
++                          && rr->info->ai_family != AF_UNIX
++                          && !is_inet_localhost(rr->info)) {
+         /* This would expose cleartext passwords, so abort. */
+         retval = ESOCKTNOSUPPORT;
+         goto error;
+-- 
+2.35.3
+

downstream-Use-newly-enforced-dejagnu-path-naming-convention.patch

@@ -0,0 +1,803 @@
+From c3b21383d08ad244ecb5369eb08356d6eebff725 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 31 Mar 2022 18:24:39 +0200
+Subject: [PATCH] Use newly enforced dejagnu path naming convention
+
+Since version 1.6.3, dejagnu started to enforce a naming convention that
+was already in place, but not mandatory: dejagnu test directories have
+to be named "testsuite". If they don't implicit relative sub-paths
+resolution (e.g. "lib", "config") is not forking.
+
+This commit renames unit tests and global tests directories to match
+this requirement.
+---
+ src/configure.ac                              |   6 ++--
+ src/lib/kadm5/Makefile.in                     |   2 +-
+ .../{unit-test => testsuite}/Makefile.in      |  28 +++++++++---------
+ .../api.2/crte-policy.exp                     |   0
+ .../api.2/get-policy.exp                      |   0
+ .../api.2/mod-policy.exp                      |   0
+ .../api.current/chpass-principal-v2.exp       |   0
+ .../api.current/chpass-principal.exp          |   0
+ .../api.current/crte-policy.exp               |   0
+ .../api.current/crte-principal.exp            |   0
+ .../api.current/destroy.exp                   |   0
+ .../api.current/dlte-policy.exp               |   0
+ .../api.current/dlte-principal.exp            |   0
+ .../api.current/get-policy.exp                |   0
+ .../api.current/get-principal-v2.exp          |   0
+ .../api.current/get-principal.exp             |   0
+ .../api.current/init-v2.exp                   |   0
+ .../api.current/init.exp                      |   0
+ .../api.current/mod-policy.exp                |   0
+ .../api.current/mod-principal-v2.exp          |   0
+ .../api.current/mod-principal.exp             |   0
+ .../api.current/randkey-principal-v2.exp      |   0
+ .../api.current/randkey-principal.exp         |   0
+ .../{unit-test => testsuite}/config/unix.exp  |   0
+ src/lib/kadm5/{unit-test => testsuite}/deps   |   0
+ .../{unit-test => testsuite}/destroy-test.c   |   0
+ .../diff-files/destroy-1                      |   0
+ .../diff-files/no-diffs                       |   0
+ .../{unit-test => testsuite}/handle-test.c    |   0
+ .../{unit-test => testsuite}/init-test.c      |   0
+ .../{unit-test => testsuite}/iter-test.c      |   0
+ .../kadm5/{unit-test => testsuite}/lib/lib.t  |   2 +-
+ .../{unit-test => testsuite}/lock-test.c      |   0
+ .../{unit-test => testsuite}/randkey-test.c   |   0
+ .../{unit-test => testsuite}/setkey-test.c    |   0
+ .../kadm5/{unit-test => testsuite}/site.exp   |   0
+ src/lib/rpc/Makefile.in                       |   2 +-
+ .../rpc/{unit-test => testsuite}/Makefile.in  |   2 +-
+ src/lib/rpc/{unit-test => testsuite}/client.c |   0
+ src/lib/rpc/{unit-test => testsuite}/deps     |   0
+ .../rpc/{unit-test => testsuite}/rpc_test.h   |   0
+ .../rpc/{unit-test => testsuite}/rpc_test.x   |   0
+ .../{unit-test => testsuite}/rpc_test_clnt.c  |   0
+ .../{unit-test => testsuite}/rpc_test_svc.c   |   0
+ src/lib/rpc/{unit-test => testsuite}/server.c |   0
+ src/lib/rpc/{unit-test => testsuite}/t_rpc.py |   0
+ src/tests/Makefile.in                         |   2 +-
+ src/tests/t_authdata.py                       |   2 +-
+ src/tests/t_certauth.py                       |   2 +-
+ src/tests/t_pkinit.py                         |   2 +-
+ src/tests/t_proxy.py                          |  12 ++++----
+ src/tests/{dejagnu => testsuite}/Makefile.in  |   4 +--
+ .../{dejagnu => testsuite}/config/default.exp |   2 +-
+ src/tests/{dejagnu => testsuite}/deps         |   0
+ .../krb-standalone/gssapi.exp                 |   2 +-
+ .../krb-standalone/kprop.exp                  |   0
+ .../krb-standalone/princexpire.exp            |   0
+ .../krb-standalone/sample.exp                 |   2 +-
+ .../krb-standalone/simple.exp                 |   2 +-
+ .../krb-standalone/standalone.exp             |   0
+ .../krb-standalone/tcp.exp                    |   0
+ .../pkinit-certs/ca.pem                       |   0
+ .../pkinit-certs/generic.p12                  | Bin
+ .../pkinit-certs/generic.pem                  |   0
+ .../pkinit-certs/kdc.pem                      |   0
+ .../pkinit-certs/make-certs.sh                |   0
+ .../pkinit-certs/privkey-enc.pem              |   0
+ .../pkinit-certs/privkey.pem                  |   0
+ .../pkinit-certs/user-enc.p12                 | Bin
+ .../pkinit-certs/user-upn.p12                 | Bin
+ .../pkinit-certs/user-upn.pem                 |   0
+ .../pkinit-certs/user-upn2.p12                | Bin
+ .../pkinit-certs/user-upn2.pem                |   0
+ .../pkinit-certs/user-upn3.p12                | Bin
+ .../pkinit-certs/user-upn3.pem                |   0
+ .../pkinit-certs/user.p12                     | Bin
+ .../pkinit-certs/user.pem                     |   0
+ .../{dejagnu => testsuite}/proxy-certs/ca.pem |   0
+ .../proxy-certs/make-certs.sh                 |   0
+ .../proxy-certs/proxy-badsig.pem              |   0
+ .../proxy-certs/proxy-ideal.pem               |   0
+ .../proxy-certs/proxy-no-match.pem            |   0
+ .../proxy-certs/proxy-san.pem                 |   0
+ .../proxy-certs/proxy-subject.pem             |   0
+ src/tests/{dejagnu => testsuite}/t_inetd.c    |   2 +-
+ src/util/k5test.py                            |   2 +-
+ 86 files changed, 39 insertions(+), 39 deletions(-)
+ rename src/lib/kadm5/{unit-test => testsuite}/Makefile.in (86%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.2/crte-policy.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.2/get-policy.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.2/mod-policy.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/chpass-principal-v2.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/chpass-principal.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/crte-policy.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/crte-principal.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/destroy.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/dlte-policy.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/dlte-principal.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/get-policy.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/get-principal-v2.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/get-principal.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/init-v2.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/init.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/mod-policy.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/mod-principal-v2.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/mod-principal.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/randkey-principal-v2.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/api.current/randkey-principal.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/config/unix.exp (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/deps (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/destroy-test.c (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/diff-files/destroy-1 (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/diff-files/no-diffs (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/handle-test.c (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/init-test.c (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/iter-test.c (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/lib/lib.t (99%)
+ rename src/lib/kadm5/{unit-test => testsuite}/lock-test.c (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/randkey-test.c (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/setkey-test.c (100%)
+ rename src/lib/kadm5/{unit-test => testsuite}/site.exp (100%)
+ rename src/lib/rpc/{unit-test => testsuite}/Makefile.in (97%)
+ rename src/lib/rpc/{unit-test => testsuite}/client.c (100%)
+ rename src/lib/rpc/{unit-test => testsuite}/deps (100%)
+ rename src/lib/rpc/{unit-test => testsuite}/rpc_test.h (100%)
+ rename src/lib/rpc/{unit-test => testsuite}/rpc_test.x (100%)
+ rename src/lib/rpc/{unit-test => testsuite}/rpc_test_clnt.c (100%)
+ rename src/lib/rpc/{unit-test => testsuite}/rpc_test_svc.c (100%)
+ rename src/lib/rpc/{unit-test => testsuite}/server.c (100%)
+ rename src/lib/rpc/{unit-test => testsuite}/t_rpc.py (100%)
+ rename src/tests/{dejagnu => testsuite}/Makefile.in (92%)
+ rename src/tests/{dejagnu => testsuite}/config/default.exp (99%)
+ rename src/tests/{dejagnu => testsuite}/deps (100%)
+ rename src/tests/{dejagnu => testsuite}/krb-standalone/gssapi.exp (98%)
+ rename src/tests/{dejagnu => testsuite}/krb-standalone/kprop.exp (100%)
+ rename src/tests/{dejagnu => testsuite}/krb-standalone/princexpire.exp (100%)
+ rename src/tests/{dejagnu => testsuite}/krb-standalone/sample.exp (98%)
+ rename src/tests/{dejagnu => testsuite}/krb-standalone/simple.exp (98%)
+ rename src/tests/{dejagnu => testsuite}/krb-standalone/standalone.exp (100%)
+ rename src/tests/{dejagnu => testsuite}/krb-standalone/tcp.exp (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/ca.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/generic.p12 (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/generic.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/kdc.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/make-certs.sh (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/privkey-enc.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/privkey.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-enc.p12 (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn.p12 (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn2.p12 (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn2.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn3.p12 (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/user-upn3.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/user.p12 (100%)
+ rename src/tests/{dejagnu => testsuite}/pkinit-certs/user.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/proxy-certs/ca.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/proxy-certs/make-certs.sh (100%)
+ rename src/tests/{dejagnu => testsuite}/proxy-certs/proxy-badsig.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/proxy-certs/proxy-ideal.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/proxy-certs/proxy-no-match.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/proxy-certs/proxy-san.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/proxy-certs/proxy-subject.pem (100%)
+ rename src/tests/{dejagnu => testsuite}/t_inetd.c (99%)
+
+diff --git a/src/configure.ac b/src/configure.ac
+index 477819091..7143e9160 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -1497,9 +1497,9 @@ V5_AC_OUTPUT_MAKEFILE(.
+ 	lib/gssapi lib/gssapi/generic lib/gssapi/krb5 lib/gssapi/spnego
+ 	lib/gssapi/mechglue
+ 
+-	lib/rpc lib/rpc/unit-test
++	lib/rpc lib/rpc/testsuite
+ 
+-	lib/kadm5 lib/kadm5/clnt lib/kadm5/srv lib/kadm5/unit-test
++	lib/kadm5 lib/kadm5/clnt lib/kadm5/srv lib/kadm5/testsuite
+ 	lib/krad
+ 	lib/apputils
+ 
+@@ -1543,5 +1543,5 @@ V5_AC_OUTPUT_MAKEFILE(.
+ 	appl/gss-sample appl/user_user
+ 
+ 	tests tests/asn.1 tests/create tests/hammer tests/verify tests/gssapi
+-	tests/dejagnu tests/threads tests/shlib tests/gss-threads tests/misc
++	tests/testsuite tests/threads tests/shlib tests/gss-threads tests/misc
+ )
+diff --git a/src/lib/kadm5/Makefile.in b/src/lib/kadm5/Makefile.in
+index c4eaad38d..76fc4b548 100644
+--- a/src/lib/kadm5/Makefile.in
++++ b/src/lib/kadm5/Makefile.in
+@@ -1,6 +1,6 @@
+ mydir=lib$(S)kadm5
+ BUILDTOP=$(REL)..$(S)..
+-SUBDIRS = clnt srv unit-test
++SUBDIRS = clnt srv testsuite
+ 
+ ##DOSBUILDTOP = ..\..
+ 
+diff --git a/src/lib/kadm5/unit-test/Makefile.in b/src/lib/kadm5/testsuite/Makefile.in
+similarity index 86%
+rename from src/lib/kadm5/unit-test/Makefile.in
+rename to src/lib/kadm5/testsuite/Makefile.in
+index 68fa097ff..5a55b786b 100644
+--- a/src/lib/kadm5/unit-test/Makefile.in
++++ b/src/lib/kadm5/testsuite/Makefile.in
+@@ -1,4 +1,4 @@
+-mydir=lib$(S)kadm5$(S)unit-test
++mydir=lib$(S)kadm5$(S)testsuite
+ BUILDTOP=$(REL)..$(S)..$(S)..
+ KDB_DEP_LIB=$(DL_LIB) $(THREAD_LINKOPTS)
+ 
+@@ -61,7 +61,7 @@ runenv.exp: Makefile
+ 		eval echo "set env\($$i\) \$$$$i"; done > runenv.exp
+ 
+ #
+-# The unit-test targets
++# The testsuite targets
+ #
+ 
+ check: check-@DO_TEST@
+@@ -72,13 +72,13 @@ check-:
+ 	@echo "+++ Either tcl, runtest, or Perl is unavailable."
+ 	@echo "+++"
+ 
+-check-ok unit-test: unit-test-client unit-test-server
++check-ok testsuite: testsuite-client testsuite-server
+ 
+-unit-test-client: unit-test-client-setup unit-test-client-body \
+-	unit-test-client-cleanup
++testsuite-client: testsuite-client-setup testsuite-client-body \
++	testsuite-client-cleanup
+ 
+-unit-test-server: unit-test-server-setup unit-test-server-body \
+-	unit-test-server-cleanup
++testsuite-server: testsuite-server-setup testsuite-server-body \
++	testsuite-server-cleanup
+ 
+ test-randkey: randkey-test
+ 	$(ENV_SETUP) $(VALGRIND) ./randkey-test
+@@ -98,19 +98,19 @@ test-destroy: destroy-test
+ test-setkey-client: client-setkey-test
+ 	$(ENV_SETUP) $(VALGRIND) ./client-setkey-test testkeys admin admin
+ 
+-unit-test-client-setup: runenv.sh
++testsuite-client-setup: runenv.sh
+ 	$(ENV_SETUP) $(VALGRIND) $(START_SERVERS)
+ 
+-unit-test-client-cleanup:
++testsuite-client-cleanup:
+ 	$(ENV_SETUP) $(STOP_SERVERS)
+ 
+-unit-test-server-setup: runenv.sh
++testsuite-server-setup: runenv.sh
+ 	$(ENV_SETUP) $(VALGRIND) $(START_SERVERS_LOCAL)
+ 
+-unit-test-server-cleanup:
++testsuite-server-cleanup:
+ 	$(ENV_SETUP) $(STOP_SERVERS_LOCAL)
+ 
+-unit-test-client-body: site.exp test-noauth test-destroy test-handle-client \
++testsuite-client-body: site.exp test-noauth test-destroy test-handle-client \
+ 	test-setkey-client runenv.exp
+ 	$(ENV_SETUP) $(RUNTEST) --tool api RPC=1 API=$(CLNTTCL) \
+ 		KINIT=$(BUILDTOP)/clients/kinit/kinit \
+@@ -121,7 +121,7 @@ unit-test-client-body: site.exp test-noauth test-destroy test-handle-client \
+ 	-mv api.log capi.log
+ 	-mv api.sum capi.sum
+ 
+-unit-test-server-body: site.exp test-handle-server lock-test 
++testsuite-server-body: site.exp test-handle-server lock-test 
+ 	$(ENV_SETUP) $(RUNTEST) --tool api RPC=0 API=$(SRVTCL) \
+ 		LOCKTEST=./lock-test \
+ 		KADMIN_LOCAL=$(BUILDTOP)/kadmin/cli/kadmin.local \
+@@ -140,4 +140,4 @@ clean:
+ 	$(RM) lock-test lock-test.o
+ 	$(RM) server-iter-test iter-test.o
+ 	$(RM) server-setkey-test client-setkey-test setkey-test.o
+-	$(RM) *.log *.plog *.sum *.psum unit-test-log.* runenv.exp
++	$(RM) *.log *.plog *.sum *.psum testsuite-log.* runenv.exp
+diff --git a/src/lib/kadm5/unit-test/api.2/crte-policy.exp b/src/lib/kadm5/testsuite/api.2/crte-policy.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.2/crte-policy.exp
+rename to src/lib/kadm5/testsuite/api.2/crte-policy.exp
+diff --git a/src/lib/kadm5/unit-test/api.2/get-policy.exp b/src/lib/kadm5/testsuite/api.2/get-policy.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.2/get-policy.exp
+rename to src/lib/kadm5/testsuite/api.2/get-policy.exp
+diff --git a/src/lib/kadm5/unit-test/api.2/mod-policy.exp b/src/lib/kadm5/testsuite/api.2/mod-policy.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.2/mod-policy.exp
+rename to src/lib/kadm5/testsuite/api.2/mod-policy.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp b/src/lib/kadm5/testsuite/api.current/chpass-principal-v2.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
+rename to src/lib/kadm5/testsuite/api.current/chpass-principal-v2.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal.exp b/src/lib/kadm5/testsuite/api.current/chpass-principal.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/chpass-principal.exp
+rename to src/lib/kadm5/testsuite/api.current/chpass-principal.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/crte-policy.exp b/src/lib/kadm5/testsuite/api.current/crte-policy.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/crte-policy.exp
+rename to src/lib/kadm5/testsuite/api.current/crte-policy.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/crte-principal.exp b/src/lib/kadm5/testsuite/api.current/crte-principal.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/crte-principal.exp
+rename to src/lib/kadm5/testsuite/api.current/crte-principal.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/destroy.exp b/src/lib/kadm5/testsuite/api.current/destroy.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/destroy.exp
+rename to src/lib/kadm5/testsuite/api.current/destroy.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/dlte-policy.exp b/src/lib/kadm5/testsuite/api.current/dlte-policy.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/dlte-policy.exp
+rename to src/lib/kadm5/testsuite/api.current/dlte-policy.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/dlte-principal.exp b/src/lib/kadm5/testsuite/api.current/dlte-principal.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/dlte-principal.exp
+rename to src/lib/kadm5/testsuite/api.current/dlte-principal.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/get-policy.exp b/src/lib/kadm5/testsuite/api.current/get-policy.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/get-policy.exp
+rename to src/lib/kadm5/testsuite/api.current/get-policy.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp b/src/lib/kadm5/testsuite/api.current/get-principal-v2.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
+rename to src/lib/kadm5/testsuite/api.current/get-principal-v2.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/get-principal.exp b/src/lib/kadm5/testsuite/api.current/get-principal.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/get-principal.exp
+rename to src/lib/kadm5/testsuite/api.current/get-principal.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/init-v2.exp b/src/lib/kadm5/testsuite/api.current/init-v2.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/init-v2.exp
+rename to src/lib/kadm5/testsuite/api.current/init-v2.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/init.exp b/src/lib/kadm5/testsuite/api.current/init.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/init.exp
+rename to src/lib/kadm5/testsuite/api.current/init.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/mod-policy.exp b/src/lib/kadm5/testsuite/api.current/mod-policy.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/mod-policy.exp
+rename to src/lib/kadm5/testsuite/api.current/mod-policy.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp b/src/lib/kadm5/testsuite/api.current/mod-principal-v2.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/mod-principal-v2.exp
+rename to src/lib/kadm5/testsuite/api.current/mod-principal-v2.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/mod-principal.exp b/src/lib/kadm5/testsuite/api.current/mod-principal.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/mod-principal.exp
+rename to src/lib/kadm5/testsuite/api.current/mod-principal.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp b/src/lib/kadm5/testsuite/api.current/randkey-principal-v2.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
+rename to src/lib/kadm5/testsuite/api.current/randkey-principal-v2.exp
+diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal.exp b/src/lib/kadm5/testsuite/api.current/randkey-principal.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/api.current/randkey-principal.exp
+rename to src/lib/kadm5/testsuite/api.current/randkey-principal.exp
+diff --git a/src/lib/kadm5/unit-test/config/unix.exp b/src/lib/kadm5/testsuite/config/unix.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/config/unix.exp
+rename to src/lib/kadm5/testsuite/config/unix.exp
+diff --git a/src/lib/kadm5/unit-test/deps b/src/lib/kadm5/testsuite/deps
+similarity index 100%
+rename from src/lib/kadm5/unit-test/deps
+rename to src/lib/kadm5/testsuite/deps
+diff --git a/src/lib/kadm5/unit-test/destroy-test.c b/src/lib/kadm5/testsuite/destroy-test.c
+similarity index 100%
+rename from src/lib/kadm5/unit-test/destroy-test.c
+rename to src/lib/kadm5/testsuite/destroy-test.c
+diff --git a/src/lib/kadm5/unit-test/diff-files/destroy-1 b/src/lib/kadm5/testsuite/diff-files/destroy-1
+similarity index 100%
+rename from src/lib/kadm5/unit-test/diff-files/destroy-1
+rename to src/lib/kadm5/testsuite/diff-files/destroy-1
+diff --git a/src/lib/kadm5/unit-test/diff-files/no-diffs b/src/lib/kadm5/testsuite/diff-files/no-diffs
+similarity index 100%
+rename from src/lib/kadm5/unit-test/diff-files/no-diffs
+rename to src/lib/kadm5/testsuite/diff-files/no-diffs
+diff --git a/src/lib/kadm5/unit-test/handle-test.c b/src/lib/kadm5/testsuite/handle-test.c
+similarity index 100%
+rename from src/lib/kadm5/unit-test/handle-test.c
+rename to src/lib/kadm5/testsuite/handle-test.c
+diff --git a/src/lib/kadm5/unit-test/init-test.c b/src/lib/kadm5/testsuite/init-test.c
+similarity index 100%
+rename from src/lib/kadm5/unit-test/init-test.c
+rename to src/lib/kadm5/testsuite/init-test.c
+diff --git a/src/lib/kadm5/unit-test/iter-test.c b/src/lib/kadm5/testsuite/iter-test.c
+similarity index 100%
+rename from src/lib/kadm5/unit-test/iter-test.c
+rename to src/lib/kadm5/testsuite/iter-test.c
+diff --git a/src/lib/kadm5/unit-test/lib/lib.t b/src/lib/kadm5/testsuite/lib/lib.t
+similarity index 99%
+rename from src/lib/kadm5/unit-test/lib/lib.t
+rename to src/lib/kadm5/testsuite/lib/lib.t
+index 3444775cf..327946849 100644
+--- a/src/lib/kadm5/unit-test/lib/lib.t
++++ b/src/lib/kadm5/testsuite/lib/lib.t
+@@ -226,7 +226,7 @@ proc end_dump_compare {name} {
+     global  RPC
+ 
+     if { ! $RPC } { 
+-#	set file $TOP/admin/lib/unit-test/diff-files/$name
++#	set file $TOP/admin/lib/testsuite/diff-files/$name
+ #	exec $env(SIMPLE_DUMP) > /tmp/dump.after
+ #	exec $env(COMPARE_DUMP) /tmp/dump.before /tmp/dump.after $file
+     }
+diff --git a/src/lib/kadm5/unit-test/lock-test.c b/src/lib/kadm5/testsuite/lock-test.c
+similarity index 100%
+rename from src/lib/kadm5/unit-test/lock-test.c
+rename to src/lib/kadm5/testsuite/lock-test.c
+diff --git a/src/lib/kadm5/unit-test/randkey-test.c b/src/lib/kadm5/testsuite/randkey-test.c
+similarity index 100%
+rename from src/lib/kadm5/unit-test/randkey-test.c
+rename to src/lib/kadm5/testsuite/randkey-test.c
+diff --git a/src/lib/kadm5/unit-test/setkey-test.c b/src/lib/kadm5/testsuite/setkey-test.c
+similarity index 100%
+rename from src/lib/kadm5/unit-test/setkey-test.c
+rename to src/lib/kadm5/testsuite/setkey-test.c
+diff --git a/src/lib/kadm5/unit-test/site.exp b/src/lib/kadm5/testsuite/site.exp
+similarity index 100%
+rename from src/lib/kadm5/unit-test/site.exp
+rename to src/lib/kadm5/testsuite/site.exp
+diff --git a/src/lib/rpc/Makefile.in b/src/lib/rpc/Makefile.in
+index 39db2d3ce..58ebafeba 100644
+--- a/src/lib/rpc/Makefile.in
++++ b/src/lib/rpc/Makefile.in
+@@ -2,7 +2,7 @@ mydir=lib$(S)rpc
+ BUILDTOP=$(REL)..$(S)..
+ DEFINES = -DGSSAPI_KRB5 -DDEBUG_GSSAPI=0 -DGSSRPC__IMPL
+ 
+-SUBDIRS=unit-test
++SUBDIRS=testsuite
+ 
+ ##DOSBUILDTOP = ..\..
+ ##DOSLIBNAME=libgssrpc.lib
+diff --git a/src/lib/rpc/unit-test/Makefile.in b/src/lib/rpc/testsuite/Makefile.in
+similarity index 97%
+rename from src/lib/rpc/unit-test/Makefile.in
+rename to src/lib/rpc/testsuite/Makefile.in
+index 309ae2b21..530a45bc6 100644
+--- a/src/lib/rpc/unit-test/Makefile.in
++++ b/src/lib/rpc/testsuite/Makefile.in
+@@ -1,4 +1,4 @@
+-mydir=lib$(S)rpc$(S)unit-test
++mydir=lib$(S)rpc$(S)testsuite
+ BUILDTOP=$(REL)..$(S)..$(S)..
+ 
+ OBJS= client.o rpc_test_clnt.o rpc_test_svc.o server.o
+diff --git a/src/lib/rpc/unit-test/client.c b/src/lib/rpc/testsuite/client.c
+similarity index 100%
+rename from src/lib/rpc/unit-test/client.c
+rename to src/lib/rpc/testsuite/client.c
+diff --git a/src/lib/rpc/unit-test/deps b/src/lib/rpc/testsuite/deps
+similarity index 100%
+rename from src/lib/rpc/unit-test/deps
+rename to src/lib/rpc/testsuite/deps
+diff --git a/src/lib/rpc/unit-test/rpc_test.h b/src/lib/rpc/testsuite/rpc_test.h
+similarity index 100%
+rename from src/lib/rpc/unit-test/rpc_test.h
+rename to src/lib/rpc/testsuite/rpc_test.h
+diff --git a/src/lib/rpc/unit-test/rpc_test.x b/src/lib/rpc/testsuite/rpc_test.x
+similarity index 100%
+rename from src/lib/rpc/unit-test/rpc_test.x
+rename to src/lib/rpc/testsuite/rpc_test.x
+diff --git a/src/lib/rpc/unit-test/rpc_test_clnt.c b/src/lib/rpc/testsuite/rpc_test_clnt.c
+similarity index 100%
+rename from src/lib/rpc/unit-test/rpc_test_clnt.c
+rename to src/lib/rpc/testsuite/rpc_test_clnt.c
+diff --git a/src/lib/rpc/unit-test/rpc_test_svc.c b/src/lib/rpc/testsuite/rpc_test_svc.c
+similarity index 100%
+rename from src/lib/rpc/unit-test/rpc_test_svc.c
+rename to src/lib/rpc/testsuite/rpc_test_svc.c
+diff --git a/src/lib/rpc/unit-test/server.c b/src/lib/rpc/testsuite/server.c
+similarity index 100%
+rename from src/lib/rpc/unit-test/server.c
+rename to src/lib/rpc/testsuite/server.c
+diff --git a/src/lib/rpc/unit-test/t_rpc.py b/src/lib/rpc/testsuite/t_rpc.py
+similarity index 100%
+rename from src/lib/rpc/unit-test/t_rpc.py
+rename to src/lib/rpc/testsuite/t_rpc.py
+diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in
+index 20f27d748..1198dca0c 100644
+--- a/src/tests/Makefile.in
++++ b/src/tests/Makefile.in
+@@ -1,6 +1,6 @@
+ mydir=tests
+ BUILDTOP=$(REL)..
+-SUBDIRS = asn.1 create hammer verify gssapi dejagnu shlib gss-threads misc \
++SUBDIRS = asn.1 create hammer verify gssapi testsuite shlib gss-threads misc \
+ 	threads softpkcs11
+ 
+ RUN_DB_TEST = $(RUN_SETUP) KRB5_KDC_PROFILE=kdc.conf KRB5_CONFIG=krb5.conf \
+diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py
+index 2e01f46bc..e5135f435 100644
+--- a/src/tests/t_authdata.py
++++ b/src/tests/t_authdata.py
+@@ -57,7 +57,7 @@ if not os.path.exists(os.path.join(plugins, 'preauth', 'pkinit.so')):
+     skipped('anonymous ticket authdata tests', 'PKINIT not built')
+ else:
+     # Set up a realm with PKINIT support and get anonymous tickets.
+-    certs = os.path.join(srctop, 'tests', 'dejagnu', 'pkinit-certs')
++    certs = os.path.join(srctop, 'tests', 'testsuite', 'pkinit-certs')
+     ca_pem = os.path.join(certs, 'ca.pem')
+     kdc_pem = os.path.join(certs, 'kdc.pem')
+     privkey_pem = os.path.join(certs, 'privkey.pem')
+diff --git a/src/tests/t_certauth.py b/src/tests/t_certauth.py
+index 0fe0fdb4a..bfa5bfc96 100644
+--- a/src/tests/t_certauth.py
++++ b/src/tests/t_certauth.py
+@@ -4,7 +4,7 @@ from k5test import *
+ if not os.path.exists(os.path.join(plugins, 'preauth', 'pkinit.so')):
+     skip_rest('certauth tests', 'PKINIT module not built')
+ 
+-certs = os.path.join(srctop, 'tests', 'dejagnu', 'pkinit-certs')
++certs = os.path.join(srctop, 'tests', 'testsuite', 'pkinit-certs')
+ ca_pem = os.path.join(certs, 'ca.pem')
+ kdc_pem = os.path.join(certs, 'kdc.pem')
+ privkey_pem = os.path.join(certs, 'privkey.pem')
+diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
+index aee4da2b1..8763ce484 100755
+--- a/src/tests/t_pkinit.py
++++ b/src/tests/t_pkinit.py
+@@ -7,7 +7,7 @@ if not os.path.exists(os.path.join(plugins, 'preauth', 'pkinit.so')):
+ soft_pkcs11 = os.path.join(buildtop, 'tests', 'softpkcs11', 'softpkcs11.so')
+ 
+ # Construct a krb5.conf fragment configuring pkinit.
+-certs = os.path.join(srctop, 'tests', 'dejagnu', 'pkinit-certs')
++certs = os.path.join(srctop, 'tests', 'testsuite', 'pkinit-certs')
+ ca_pem = os.path.join(certs, 'ca.pem')
+ kdc_pem = os.path.join(certs, 'kdc.pem')
+ user_pem = os.path.join(certs, 'user.pem')
+diff --git a/src/tests/t_proxy.py b/src/tests/t_proxy.py
+index 3069eaa8f..6ae5c8c8e 100755
+--- a/src/tests/t_proxy.py
++++ b/src/tests/t_proxy.py
+@@ -10,17 +10,17 @@ except:
+ 
+ # Construct a krb5.conf fragment configuring the client to use a local proxy
+ # server.
+-proxysubjectpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs',
++proxysubjectpem = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs',
+                                'proxy-subject.pem')
+-proxysanpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs',
++proxysanpem = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs',
+                            'proxy-san.pem')
+-proxyidealpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs',
++proxyidealpem = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs',
+                              'proxy-ideal.pem')
+-proxywrongpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs',
++proxywrongpem = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs',
+                              'proxy-no-match.pem')
+-proxybadpem = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs',
++proxybadpem = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs',
+                            'proxy-badsig.pem')
+-proxyca = os.path.join(srctop, 'tests', 'dejagnu', 'proxy-certs', 'ca.pem')
++proxyca = os.path.join(srctop, 'tests', 'testsuite', 'proxy-certs', 'ca.pem')
+ proxyurl = 'https://localhost:$port5/KdcProxy'
+ proxyurlupcase = 'https://LocalHost:$port5/KdcProxy'
+ proxyurl4 = 'https://127.0.0.1:$port5/KdcProxy'
+diff --git a/src/tests/dejagnu/Makefile.in b/src/tests/testsuite/Makefile.in
+similarity index 92%
+rename from src/tests/dejagnu/Makefile.in
+rename to src/tests/testsuite/Makefile.in
+index e78e270ed..d3efe3606 100644
+--- a/src/tests/dejagnu/Makefile.in
++++ b/src/tests/testsuite/Makefile.in
+@@ -1,4 +1,4 @@
+-mydir=tests$(S)dejagnu
++mydir=tests$(S)testsuite
+ BUILDTOP=$(REL)..$(S)..
+ RUNTEST = @RUNTEST@ $(DEJAFLAGS)
+ RUNTESTFLAGS =
+@@ -13,7 +13,7 @@ check: check-runtest-@HAVE_RUNTEST@
+ 
+ check-runtest-no:
+ 	@echo "+++"
+-	@echo "+++ WARNING: tests/dejagnu tests not run."
++	@echo "+++ WARNING: tests/testsuite tests not run."
+ 	@echo "+++ runtest is unavailable."
+ 	@echo "+++"
+ 	@echo 'Skipped dejagnu tests: runtest not found' >> $(SKIPTESTS)
+diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/testsuite/config/default.exp
+similarity index 99%
+rename from src/tests/dejagnu/config/default.exp
+rename to src/tests/testsuite/config/default.exp
+index 302dee74c..1492fac32 100644
+--- a/src/tests/dejagnu/config/default.exp
++++ b/src/tests/testsuite/config/default.exp
+@@ -256,7 +256,7 @@ verbose "Test realm is $REALMNAME"
+ 
+ # Find some programs we need.  We use the binaries from the build tree
+ # if they exist.  If they do not, then they must be in PATH.  We
+-# expect $objdir to be ...tests/dejagnu.
++# expect $objdir to be ...tests/testsuite.
+ 
+ foreach i {
+     {KDB5_UTIL $objdir/../../kadmin/dbutil/kdb5_util}
+diff --git a/src/tests/dejagnu/deps b/src/tests/testsuite/deps
+similarity index 100%
+rename from src/tests/dejagnu/deps
+rename to src/tests/testsuite/deps
+diff --git a/src/tests/dejagnu/krb-standalone/gssapi.exp b/src/tests/testsuite/krb-standalone/gssapi.exp
+similarity index 98%
+rename from src/tests/dejagnu/krb-standalone/gssapi.exp
+rename to src/tests/testsuite/krb-standalone/gssapi.exp
+index e3357e769..d176e210c 100644
+--- a/src/tests/dejagnu/krb-standalone/gssapi.exp
++++ b/src/tests/testsuite/krb-standalone/gssapi.exp
+@@ -2,7 +2,7 @@
+ # This is a DejaGnu test script.
+ # This script tests that the GSS-API tester functions correctly.
+ 
+-# This mostly just calls procedures in test/dejagnu/config/default.exp.
++# This mostly just calls procedures in test/testsuite/config/default.exp.
+ 
+ if ![info exists KDESTROY] {
+     set KDESTROY [findfile $objdir/../../clients/kdestroy/kdestroy]
+diff --git a/src/tests/dejagnu/krb-standalone/kprop.exp b/src/tests/testsuite/krb-standalone/kprop.exp
+similarity index 100%
+rename from src/tests/dejagnu/krb-standalone/kprop.exp
+rename to src/tests/testsuite/krb-standalone/kprop.exp
+diff --git a/src/tests/dejagnu/krb-standalone/princexpire.exp b/src/tests/testsuite/krb-standalone/princexpire.exp
+similarity index 100%
+rename from src/tests/dejagnu/krb-standalone/princexpire.exp
+rename to src/tests/testsuite/krb-standalone/princexpire.exp
+diff --git a/src/tests/dejagnu/krb-standalone/sample.exp b/src/tests/testsuite/krb-standalone/sample.exp
+similarity index 98%
+rename from src/tests/dejagnu/krb-standalone/sample.exp
+rename to src/tests/testsuite/krb-standalone/sample.exp
+index 93a75f1d0..009de5ddb 100644
+--- a/src/tests/dejagnu/krb-standalone/sample.exp
++++ b/src/tests/testsuite/krb-standalone/sample.exp
+@@ -2,7 +2,7 @@
+ # This is a DejaGnu test script.
+ # This script tests that sample user-user communication works.
+ 
+-# This mostly just calls procedures in test/dejagnu/config/default.exp.
++# This mostly just calls procedures in test/testsuite/config/default.exp.
+ 
+ if ![info exists KLIST] {
+     set KLIST [findfile $objdir/../../clients/klist/klist]
+diff --git a/src/tests/dejagnu/krb-standalone/simple.exp b/src/tests/testsuite/krb-standalone/simple.exp
+similarity index 98%
+rename from src/tests/dejagnu/krb-standalone/simple.exp
+rename to src/tests/testsuite/krb-standalone/simple.exp
+index d8b218248..92b33066e 100644
+--- a/src/tests/dejagnu/krb-standalone/simple.exp
++++ b/src/tests/testsuite/krb-standalone/simple.exp
+@@ -2,7 +2,7 @@
+ # This is a DejaGnu test script.
+ # This script tests that krb-safe and krb-priv messages work.
+ 
+-# This mostly just calls procedures in test/dejagnu/config/default.exp.
++# This mostly just calls procedures in test/testsuite/config/default.exp.
+ 
+ if ![info exists KLIST] {
+     set KLIST [findfile $objdir/../../clients/klist/klist]
+diff --git a/src/tests/dejagnu/krb-standalone/standalone.exp b/src/tests/testsuite/krb-standalone/standalone.exp
+similarity index 100%
+rename from src/tests/dejagnu/krb-standalone/standalone.exp
+rename to src/tests/testsuite/krb-standalone/standalone.exp
+diff --git a/src/tests/dejagnu/krb-standalone/tcp.exp b/src/tests/testsuite/krb-standalone/tcp.exp
+similarity index 100%
+rename from src/tests/dejagnu/krb-standalone/tcp.exp
+rename to src/tests/testsuite/krb-standalone/tcp.exp
+diff --git a/src/tests/dejagnu/pkinit-certs/ca.pem b/src/tests/testsuite/pkinit-certs/ca.pem
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/ca.pem
+rename to src/tests/testsuite/pkinit-certs/ca.pem
+diff --git a/src/tests/dejagnu/pkinit-certs/generic.p12 b/src/tests/testsuite/pkinit-certs/generic.p12
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/generic.p12
+rename to src/tests/testsuite/pkinit-certs/generic.p12
+diff --git a/src/tests/dejagnu/pkinit-certs/generic.pem b/src/tests/testsuite/pkinit-certs/generic.pem
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/generic.pem
+rename to src/tests/testsuite/pkinit-certs/generic.pem
+diff --git a/src/tests/dejagnu/pkinit-certs/kdc.pem b/src/tests/testsuite/pkinit-certs/kdc.pem
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/kdc.pem
+rename to src/tests/testsuite/pkinit-certs/kdc.pem
+diff --git a/src/tests/dejagnu/pkinit-certs/make-certs.sh b/src/tests/testsuite/pkinit-certs/make-certs.sh
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/make-certs.sh
+rename to src/tests/testsuite/pkinit-certs/make-certs.sh
+diff --git a/src/tests/dejagnu/pkinit-certs/privkey-enc.pem b/src/tests/testsuite/pkinit-certs/privkey-enc.pem
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/privkey-enc.pem
+rename to src/tests/testsuite/pkinit-certs/privkey-enc.pem
+diff --git a/src/tests/dejagnu/pkinit-certs/privkey.pem b/src/tests/testsuite/pkinit-certs/privkey.pem
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/privkey.pem
+rename to src/tests/testsuite/pkinit-certs/privkey.pem
+diff --git a/src/tests/dejagnu/pkinit-certs/user-enc.p12 b/src/tests/testsuite/pkinit-certs/user-enc.p12
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/user-enc.p12
+rename to src/tests/testsuite/pkinit-certs/user-enc.p12
+diff --git a/src/tests/dejagnu/pkinit-certs/user-upn.p12 b/src/tests/testsuite/pkinit-certs/user-upn.p12
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/user-upn.p12
+rename to src/tests/testsuite/pkinit-certs/user-upn.p12
+diff --git a/src/tests/dejagnu/pkinit-certs/user-upn.pem b/src/tests/testsuite/pkinit-certs/user-upn.pem
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/user-upn.pem
+rename to src/tests/testsuite/pkinit-certs/user-upn.pem
+diff --git a/src/tests/dejagnu/pkinit-certs/user-upn2.p12 b/src/tests/testsuite/pkinit-certs/user-upn2.p12
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/user-upn2.p12
+rename to src/tests/testsuite/pkinit-certs/user-upn2.p12
+diff --git a/src/tests/dejagnu/pkinit-certs/user-upn2.pem b/src/tests/testsuite/pkinit-certs/user-upn2.pem
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/user-upn2.pem
+rename to src/tests/testsuite/pkinit-certs/user-upn2.pem
+diff --git a/src/tests/dejagnu/pkinit-certs/user-upn3.p12 b/src/tests/testsuite/pkinit-certs/user-upn3.p12
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/user-upn3.p12
+rename to src/tests/testsuite/pkinit-certs/user-upn3.p12
+diff --git a/src/tests/dejagnu/pkinit-certs/user-upn3.pem b/src/tests/testsuite/pkinit-certs/user-upn3.pem
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/user-upn3.pem
+rename to src/tests/testsuite/pkinit-certs/user-upn3.pem
+diff --git a/src/tests/dejagnu/pkinit-certs/user.p12 b/src/tests/testsuite/pkinit-certs/user.p12
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/user.p12
+rename to src/tests/testsuite/pkinit-certs/user.p12
+diff --git a/src/tests/dejagnu/pkinit-certs/user.pem b/src/tests/testsuite/pkinit-certs/user.pem
+similarity index 100%
+rename from src/tests/dejagnu/pkinit-certs/user.pem
+rename to src/tests/testsuite/pkinit-certs/user.pem
+diff --git a/src/tests/dejagnu/proxy-certs/ca.pem b/src/tests/testsuite/proxy-certs/ca.pem
+similarity index 100%
+rename from src/tests/dejagnu/proxy-certs/ca.pem
+rename to src/tests/testsuite/proxy-certs/ca.pem
+diff --git a/src/tests/dejagnu/proxy-certs/make-certs.sh b/src/tests/testsuite/proxy-certs/make-certs.sh
+similarity index 100%
+rename from src/tests/dejagnu/proxy-certs/make-certs.sh
+rename to src/tests/testsuite/proxy-certs/make-certs.sh
+diff --git a/src/tests/dejagnu/proxy-certs/proxy-badsig.pem b/src/tests/testsuite/proxy-certs/proxy-badsig.pem
+similarity index 100%
+rename from src/tests/dejagnu/proxy-certs/proxy-badsig.pem
+rename to src/tests/testsuite/proxy-certs/proxy-badsig.pem
+diff --git a/src/tests/dejagnu/proxy-certs/proxy-ideal.pem b/src/tests/testsuite/proxy-certs/proxy-ideal.pem
+similarity index 100%
+rename from src/tests/dejagnu/proxy-certs/proxy-ideal.pem
+rename to src/tests/testsuite/proxy-certs/proxy-ideal.pem
+diff --git a/src/tests/dejagnu/proxy-certs/proxy-no-match.pem b/src/tests/testsuite/proxy-certs/proxy-no-match.pem
+similarity index 100%
+rename from src/tests/dejagnu/proxy-certs/proxy-no-match.pem
+rename to src/tests/testsuite/proxy-certs/proxy-no-match.pem
+diff --git a/src/tests/dejagnu/proxy-certs/proxy-san.pem b/src/tests/testsuite/proxy-certs/proxy-san.pem
+similarity index 100%
+rename from src/tests/dejagnu/proxy-certs/proxy-san.pem
+rename to src/tests/testsuite/proxy-certs/proxy-san.pem
+diff --git a/src/tests/dejagnu/proxy-certs/proxy-subject.pem b/src/tests/testsuite/proxy-certs/proxy-subject.pem
+similarity index 100%
+rename from src/tests/dejagnu/proxy-certs/proxy-subject.pem
+rename to src/tests/testsuite/proxy-certs/proxy-subject.pem
+diff --git a/src/tests/dejagnu/t_inetd.c b/src/tests/testsuite/t_inetd.c
+similarity index 99%
+rename from src/tests/dejagnu/t_inetd.c
+rename to src/tests/testsuite/t_inetd.c
+index abcde50fa..2bad2cf65 100644
+--- a/src/tests/dejagnu/t_inetd.c
++++ b/src/tests/testsuite/t_inetd.c
+@@ -1,5 +1,5 @@
+ /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+-/* tests/dejagnu/t_inetd.c */
++/* tests/testsuite/t_inetd.c */
+ /*
+  * Copyright 1991 by the Massachusetts Institute of Technology.
+  * All Rights Reserved.
+diff --git a/src/util/k5test.py b/src/util/k5test.py
+index 251d11a9d..908a1495c 100644
+--- a/src/util/k5test.py
++++ b/src/util/k5test.py
+@@ -1383,7 +1383,7 @@ kswitch = os.path.join(buildtop, 'clients', 'kswitch', 'kswitch')
+ kvno = os.path.join(buildtop, 'clients', 'kvno', 'kvno')
+ kdestroy = os.path.join(buildtop, 'clients', 'kdestroy', 'kdestroy')
+ kpasswd = os.path.join(buildtop, 'clients', 'kpasswd', 'kpasswd')
+-t_inetd = os.path.join(buildtop, 'tests', 'dejagnu', 't_inetd')
++t_inetd = os.path.join(buildtop, 'tests', 'testsuite', 't_inetd')
+ kproplog = os.path.join(buildtop, 'kprop', 'kproplog')
+ kpropd = os.path.join(buildtop, 'kprop', 'kpropd')
+ kprop = os.path.join(buildtop, 'kprop', 'kprop')
+-- 
+2.35.1
+

krb5-krad-larger-attrs.patch

@@ -0,0 +1,69 @@
+From f35077bfc570205092eca2a9d44e50ce265622f4 Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Mon, 8 Nov 2021 17:48:50 +0100
+Subject: [PATCH] Support larger RADIUS attributes in libkrad
+
+In kr_attrset_decode(), explicitly treat the length byte as unsigned.
+Otherwise attributes longer than 125 characters will be rejected with
+EBADMSG.
+
+Add a 253-character-long NAS-Identifier attribute to the tests to make
+sure that attributes with the maximal number of characters are working
+as expected.
+
+[ghudson@mit.edu: used uint8_t cast per current practices; edited
+commit message]
+
+ticket: 9036 (new)
+---
+ src/lib/krad/attrset.c  |  2 +-
+ src/lib/krad/t_packet.c | 13 +++++++++++++
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c
+index 03c613716..f309f1581 100644
+--- a/src/lib/krad/attrset.c
++++ b/src/lib/krad/attrset.c
+@@ -217,7 +217,7 @@ kr_attrset_decode(krb5_context ctx, const krb5_data *in, const char *secret,
+ 
+     for (i = 0; i + 2 < in->length; ) {
+         type = in->data[i++];
+-        tmp = make_data(&in->data[i + 1], in->data[i] - 2);
++        tmp = make_data(&in->data[i + 1], (uint8_t)in->data[i] - 2);
+         i += tmp.length + 1;
+ 
+         retval = (in->length < i) ? EBADMSG : 0;
+diff --git a/src/lib/krad/t_packet.c b/src/lib/krad/t_packet.c
+index 0a92e9cc2..c22489144 100644
+--- a/src/lib/krad/t_packet.c
++++ b/src/lib/krad/t_packet.c
+@@ -57,6 +57,14 @@ make_packet(krb5_context ctx, const krb5_data *username,
+     krb5_error_code retval;
+     const krb5_data *data;
+     int i = 0;
++    krb5_data nas_id;
++
++    nas_id = string2data("12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "123");
+ 
+     retval = krad_attrset_new(ctx, &set);
+     if (retval != 0)
+@@ -71,6 +79,11 @@ make_packet(krb5_context ctx, const krb5_data *username,
+     if (retval != 0)
+         goto out;
+ 
++    retval = krad_attrset_add(set, krad_attr_name2num("NAS-Identifier"),
++                              &nas_id);
++    if (retval != 0)
++        goto out;
++
+     retval = krad_packet_new_request(ctx, "foo",
+                                      krad_code_name2num("Access-Request"),
+                                      set, iterator, &i, &tmp);
+-- 
+2.35.1
+

krb5-krad-remote.patch

@@ -0,0 +1,209 @@
+From ce160f8826bae223876a6527a731c36b6912db15 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 9 Nov 2021 13:00:43 -0500
+Subject: [PATCH 1/2] Avoid use after free during libkrad cleanup
+
+libkrad client requests contain a list of references to remotes, with
+no back-references or reference counts.  To prevent accesses to
+dangling references during cleanup, cancel all requests on all remotes
+before freeing any remotes.
+
+Remove the code for aging out unused servers.  This code was fairly
+safe as all requests referencing a remote should have completed or
+timed out during an hour of disuse, but in the current design we have
+no way to guarantee or check that.  The set of addresses we send
+RADIUS requests to will generally be small, so aging out servers is
+unnecessary.
+
+ticket: 9035 (new)
+---
+ src/lib/krad/client.c   | 42 ++++++++++++++---------------------------
+ src/lib/krad/internal.h |  4 ++++
+ src/lib/krad/remote.c   | 11 ++++++++---
+ 3 files changed, 26 insertions(+), 31 deletions(-)
+
+diff --git a/src/lib/krad/client.c b/src/lib/krad/client.c
+index 6365dd1c6..810940afc 100644
+--- a/src/lib/krad/client.c
++++ b/src/lib/krad/client.c
+@@ -64,7 +64,6 @@ struct request_st {
+ 
+ struct server_st {
+     krad_remote *serv;
+-    time_t last;
+     K5_LIST_ENTRY(server_st) list;
+ };
+ 
+@@ -81,15 +80,10 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret,
+            krad_remote **out)
+ {
+     krb5_error_code retval;
+-    time_t currtime;
+     server *srv;
+ 
+-    if (time(&currtime) == (time_t)-1)
+-        return errno;
+-
+     K5_LIST_FOREACH(srv, &rc->servers, list) {
+         if (kr_remote_equals(srv->serv, ai, secret)) {
+-            srv->last = currtime;
+             *out = srv->serv;
+             return 0;
+         }
+@@ -98,7 +92,6 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret,
+     srv = calloc(1, sizeof(server));
+     if (srv == NULL)
+         return ENOMEM;
+-    srv->last = currtime;
+ 
+     retval = kr_remote_new(rc->kctx, rc->vctx, ai, secret, &srv->serv);
+     if (retval != 0) {
+@@ -173,28 +166,12 @@ request_new(krad_client *rc, krad_code code, const krad_attrset *attrs,
+     return 0;
+ }
+ 
+-/* Close remotes that haven't been used in a while. */
+-static void
+-age(struct server_head *head, time_t currtime)
+-{
+-    server *srv, *tmp;
+-
+-    K5_LIST_FOREACH_SAFE(srv, head, list, tmp) {
+-        if (currtime == (time_t)-1 || currtime - srv->last > 60 * 60) {
+-            K5_LIST_REMOVE(srv, list);
+-            kr_remote_free(srv->serv);
+-            free(srv);
+-        }
+-    }
+-}
+-
+ /* Handle a response from a server (or related errors). */
+ static void
+ on_response(krb5_error_code retval, const krad_packet *reqp,
+             const krad_packet *rspp, void *data)
+ {
+     request *req = data;
+-    time_t currtime;
+     size_t i;
+ 
+     /* Do nothing if we are already completed. */
+@@ -221,10 +198,6 @@ on_response(krb5_error_code retval, const krad_packet *reqp,
+     for (i = 0; req->remotes[i].remote != NULL; i++)
+         kr_remote_cancel(req->remotes[i].remote, req->remotes[i].packet);
+ 
+-    /* Age out servers that haven't been used in a while. */
+-    if (time(&currtime) != (time_t)-1)
+-        age(&req->rc->servers, currtime);
+-
+     request_free(req);
+ }
+ 
+@@ -247,10 +220,23 @@ krad_client_new(krb5_context kctx, verto_ctx *vctx, krad_client **out)
+ void
+ krad_client_free(krad_client *rc)
+ {
++    server *srv;
++
+     if (rc == NULL)
+         return;
+ 
+-    age(&rc->servers, -1);
++    /* Cancel all requests before freeing any remotes, since each request's
++     * callback data may contain references to multiple remotes. */
++    K5_LIST_FOREACH(srv, &rc->servers, list)
++        kr_remote_cancel_all(srv->serv);
++
++    while (!K5_LIST_EMPTY(&rc->servers)) {
++        srv = K5_LIST_FIRST(&rc->servers);
++        K5_LIST_REMOVE(srv, list);
++        kr_remote_free(srv->serv);
++        free(srv);
++    }
++
+     free(rc);
+ }
+ 
+diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h
+index 0143d155a..7619563fc 100644
+--- a/src/lib/krad/internal.h
++++ b/src/lib/krad/internal.h
+@@ -109,6 +109,10 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs,
+ void
+ kr_remote_cancel(krad_remote *rr, const krad_packet *pkt);
+ 
++/* Cancel all requests awaiting responses. */
++void
++kr_remote_cancel_all(krad_remote *rr);
++
+ /* Determine if this remote object refers to the remote resource identified
+  * by the addrinfo struct and the secret. */
+ krb5_boolean
+diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
+index 7e491e994..06ae751bc 100644
+--- a/src/lib/krad/remote.c
++++ b/src/lib/krad/remote.c
+@@ -421,15 +421,20 @@ error:
+     return retval;
+ }
+ 
++void
++kr_remote_cancel_all(krad_remote *rr)
++{
++    while (!K5_TAILQ_EMPTY(&rr->list))
++        request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL);
++}
++
+ void
+ kr_remote_free(krad_remote *rr)
+ {
+     if (rr == NULL)
+         return;
+ 
+-    while (!K5_TAILQ_EMPTY(&rr->list))
+-        request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL);
+-
++    kr_remote_cancel_all(rr);
+     free(rr->secret);
+     if (rr->info != NULL)
+         free(rr->info->ai_addr);
+-- 
+2.35.1
+
+
+From e0084425df784952e76b3bcc8ae9d08300234733 Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Mon, 8 Nov 2021 17:47:17 +0100
+Subject: [PATCH 2/2] More python3 fixes for t_daemon.py
+
+[ghudson@mit.edu: use a list comprehension instead of map()]
+---
+ src/lib/krad/t_daemon.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/lib/krad/t_daemon.py b/src/lib/krad/t_daemon.py
+index 7668cd7f8..4a3de079c 100755
+--- a/src/lib/krad/t_daemon.py
++++ b/src/lib/krad/t_daemon.py
+@@ -50,7 +50,7 @@ class TestServer(server.Server):
+ 
+         for key in pkt.keys():
+             if key == "User-Password":
+-                passwd = map(pkt.PwDecrypt, pkt[key])
++                passwd = [pkt.PwDecrypt(x) for x in pkt[key]]
+ 
+         reply = self.CreateReplyPacket(pkt)
+         if passwd == ['accept']:
+@@ -61,8 +61,8 @@ class TestServer(server.Server):
+ 
+ srv = TestServer(addresses=["localhost"],
+                  hosts={"127.0.0.1":
+-                        server.RemoteHost("127.0.0.1", "foo", "localhost")},
+-                 dict=dictionary.Dictionary(StringIO.StringIO(DICTIONARY)))
++                        server.RemoteHost("127.0.0.1", b"foo", "localhost")},
++                 dict=dictionary.Dictionary(StringIO(DICTIONARY)))
+ 
+ # Write a sentinel character to let the parent process know we're listening.
+ sys.stdout.write("~")
+-- 
+2.35.1
+

krb5.spec

@@ -42,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.2
-Release: %{?zdpd}2%{?dist}
+Release: %{?zdpd}9%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -90,6 +90,14 @@ Patch25: Clean-up-context-after-failed-open-in-libkdb5.patch
 Patch26: Use-asan-in-one-of-the-CI-builds.patch
 Patch29: Clean-up-gssapi_krb5-ccache-name-functions.patch
 Patch30: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch
+Patch31: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch
+Patch32: krb5-krad-remote.patch
+Patch33: krb5-krad-larger-attrs.patch
+Patch34: Try-harder-to-avoid-password-change-replay-errors.patch
+Patch35: downstream-Use-newly-enforced-dejagnu-path-naming-convention.patch
+Patch36: downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch
+Patch37: Read-GSS-configuration-files-with-mtime-0.patch
+Patch38: Fix-integer-overflows-in-PAC-parsing.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -250,7 +258,7 @@ popd
 # builds going on the same host don't step on each other.
 cfg="src/kadmin/testing/proto/kdc.conf.proto \
      src/kadmin/testing/proto/krb5.conf.proto \
-     src/lib/kadm5/unit-test/api.current/init-v2.exp \
+     src/lib/kadm5/testsuite/api.current/init-v2.exp \
      src/util/k5test.py"
 LONG_BIT=`getconf LONG_BIT`
 PORT=`expr 61000 + $LONG_BIT - 48`
@@ -652,6 +660,34 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Wed Nov 09 2022 Julien Rische <jrische@redhat.com> - 1.19.2-9
+- Fix integer overflows in PAC parsing (CVE-2022-42898)
+- Resolves: rhbz#2143009
+
+* Thu Jun 16 2022 Julien Rische <jrische@redhat.com> - 1.19.2-8
+- Allow libkrad UDP/TCP connection to localhost in FIPS mode
+- Resolves: rhbz#2082189
+- Read GSS configuration files with mtime 0
+
+* Wed Apr 20 2022 Julien Rische <jrische@redhat.com> - 1.19.2-7
+- Try harder to avoid password change replay errors
+- Resolves: rhbz#2076965
+- Restore and fix dejagnu tests
+
+* Tue Apr 05 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-6
+- Fix libkrad client cleanup
+- Fixes rhbz#2072059
+
+* Tue Apr 05 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-5
+- Allow use of larger RADIUS attributes in krad library
+
+* Thu Mar 31 2022 Julien Rische <jrische@redhat.com> - 1.19.2-4
+- Disable TCL-based libkadm5 API tests
+- Resolves: rhbz#2069077
+
+* Wed Mar 23 2022 Julien Rische <jrische@redhat.com> - 1.19.2-3
+- Use SHA-256 instead of SHA-1 for PKINIT CMS digest
+
 * Thu Aug 19 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.2-2
 - Fix KDC null deref on TGS inner body null server (CVE-2021-37750)