upgrade to 1.18

Adjust-build-configuration.patch

@@ -0,0 +1,72 @@
+From cbfe13d5f0de6e2a3deab2ba0dacda8c952476ab Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Tue, 23 Aug 2016 16:45:26 -0400
+Subject: [PATCH] [downstream] Adjust build configuration
+
+Build binaries in this package as RELRO PIEs, libraries as partial RELRO,
+and install shared libraries with the execute bit set on them.  Prune out
+the -L/usr/lib* and PIE flags where they might leak out and affect
+apps which just want to link with the libraries. FIXME: needs to check and
+not just assume that the compiler supports using these flags.
+
+Last-updated: krb5-1.15-beta1
+---
+ src/build-tools/krb5-config.in | 7 +++++++
+ src/config/pre.in              | 2 +-
+ src/config/shlib.conf          | 5 +++--
+ 3 files changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
+index c17cb5eb5..1891dea99 100755
+--- a/src/build-tools/krb5-config.in
++++ b/src/build-tools/krb5-config.in
+@@ -226,6 +226,13 @@ if test -n "$do_libs"; then
+ 	    -e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \
+ 	    -e 's#\$(CFLAGS)##'`
+ 
++    if test `dirname $libdir` = /usr ; then
++        lib_flags=`echo $lib_flags | sed -e "s#-L$libdir##" -e "s#$RPATH_FLAG$libdir##"`
++    fi
++    lib_flags=`echo $lib_flags | sed -e "s#-fPIE##g" -e "s#-pie##g"`
++    lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,relro##g"`
++    lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,now##g"`
++
+     if test $library = 'kdb'; then
+ 	lib_flags="$lib_flags -lkdb5 $KDB5_DB_LIB"
+ 	library=krb5
+diff --git a/src/config/pre.in b/src/config/pre.in
+index 917357df9..a8540ae2a 100644
+--- a/src/config/pre.in
++++ b/src/config/pre.in
+@@ -185,7 +185,7 @@ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP)
+ INSTALL_SCRIPT=@INSTALL_PROGRAM@
+ INSTALL_DATA=@INSTALL_DATA@
+ INSTALL_SHLIB=@INSTALL_SHLIB@
+-INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
++INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755
+ ## This is needed because autoconf will sometimes define @exec_prefix@ to be
+ ## ${prefix}.
+ prefix=@prefix@
+diff --git a/src/config/shlib.conf b/src/config/shlib.conf
+index 3e4af6c02..2b20c3fda 100644
+--- a/src/config/shlib.conf
++++ b/src/config/shlib.conf
+@@ -423,7 +423,7 @@ mips-*-netbsd*)
+ 	# Linux ld doesn't default to stuffing the SONAME field...
+ 	# Use objdump -x to examine the fields of the library
+ 	# UNDEF_CHECK is suppressed by --enable-asan
+-	LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK)'
++	LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK)  -Wl,-z,relro -Wl,--warn-shared-textrel'
+ 	UNDEF_CHECK='-Wl,--no-undefined'
+ 	# $(EXPORT_CHECK) runs export-check.pl when in maintainer mode.
+ 	LDCOMBINE_TAIL='-Wl,--version-script binutils.versions $(EXPORT_CHECK)'
+@@ -435,7 +435,8 @@ mips-*-netbsd*)
+ 	SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
+ 	PROFFLAGS=-pg
+ 	PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)'
+-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)'
++	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) -pie -Wl,-z,relro -Wl,-z,now $(LDFLAGS)'
++	INSTALL_SHLIB='${INSTALL} -m755'
+ 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)'
+ 	CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)'
+ 	CXX_LINK_STATIC='$(CXX) $(PROG_LIBPATH) $(CXXFLAGS) $(LDFLAGS)'

FIPS-with-PRNG-and-RADIUS-and-MD4.patch

@@ -0,0 +1,568 @@
+From 5978878bcee5ec39e4357f408470d39e9540d2bf Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Fri, 9 Nov 2018 15:12:21 -0500
+Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4
+
+NB: Use openssl's PRNG in FIPS mode and taint within krad.
+
+A lot of the FIPS error conditions from OpenSSL are incredibly
+mysterious (at best, things return NULL unexpectedly; at worst,
+internal assertions are tripped; most of the time, you just get
+ENOMEM).  In order to cope with this, we need to have some level of
+awareness of what we can and can't safely call.
+
+This will slow down some calls slightly (FIPS_mode() takes multiple
+locks), but not for any ciphers we care about - which is to say that
+AES is fine.  Shame about SPAKE though.
+
+post6 restores MD4 (and therefore keygen-only RC4).
+
+Last-updated: krb5-1.17
+---
+ src/lib/crypto/krb/prng.c                     | 11 ++++-
+ .../crypto/openssl/enc_provider/camellia.c    |  6 +++
+ src/lib/crypto/openssl/enc_provider/rc4.c     | 13 +++++-
+ .../crypto/openssl/hash_provider/hash_evp.c   | 12 +++++
+ src/lib/crypto/openssl/hmac.c                 |  6 ++-
+ src/lib/krad/attr.c                           | 45 ++++++++++++++-----
+ src/lib/krad/attrset.c                        |  5 ++-
+ src/lib/krad/internal.h                       | 13 +++++-
+ src/lib/krad/packet.c                         | 22 ++++-----
+ src/lib/krad/remote.c                         | 10 ++++-
+ src/lib/krad/t_attr.c                         |  3 +-
+ src/lib/krad/t_attrset.c                      |  4 +-
+ src/plugins/preauth/spake/spake_client.c      |  6 +++
+ src/plugins/preauth/spake/spake_kdc.c         |  6 +++
+ 14 files changed, 129 insertions(+), 33 deletions(-)
+
+diff --git a/src/lib/crypto/krb/prng.c b/src/lib/crypto/krb/prng.c
+index cb9ca9b98..f0e9984ca 100644
+--- a/src/lib/crypto/krb/prng.c
++++ b/src/lib/crypto/krb/prng.c
+@@ -26,6 +26,8 @@
+ 
+ #include "crypto_int.h"
+ 
++#include <openssl/rand.h>
++
+ krb5_error_code KRB5_CALLCONV
+ krb5_c_random_seed(krb5_context context, krb5_data *data)
+ {
+@@ -99,9 +101,16 @@ krb5_boolean
+ k5_get_os_entropy(unsigned char *buf, size_t len, int strong)
+ {
+     const char *device;
+-#if defined(__linux__) && defined(SYS_getrandom)
+     int r;
+ 
++    /* A wild FIPS mode appeared! */
++    if (FIPS_mode()) {
++        /* The return codes on this API are not good */
++        r = RAND_bytes(buf, len);
++        return r == 1;
++    }
++
++#if defined(__linux__) && defined(SYS_getrandom)
+     while (len > 0) {
+         /*
+          * Pull from the /dev/urandom pool, but require it to have been seeded.
+diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c
+index 2da691329..f79679a0b 100644
+--- a/src/lib/crypto/openssl/enc_provider/camellia.c
++++ b/src/lib/crypto/openssl/enc_provider/camellia.c
+@@ -304,6 +304,9 @@ krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data,
+     unsigned char blockY[CAMELLIA_BLOCK_SIZE], blockB[CAMELLIA_BLOCK_SIZE];
+     struct iov_cursor cursor;
+ 
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
++
+     if (output->length < CAMELLIA_BLOCK_SIZE)
+         return KRB5_BAD_MSIZE;
+ 
+@@ -331,6 +334,9 @@ static krb5_error_code
+ krb5int_camellia_init_state (const krb5_keyblock *key, krb5_keyusage usage,
+                              krb5_data *state)
+ {
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
++
+     state->length = 16;
+     state->data = (void *) malloc(16);
+     if (state->data == NULL)
+diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c
+index a65d57b7a..6ccaca94a 100644
+--- a/src/lib/crypto/openssl/enc_provider/rc4.c
++++ b/src/lib/crypto/openssl/enc_provider/rc4.c
+@@ -66,6 +66,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
+     EVP_CIPHER_CTX *ctx = NULL;
+     struct arcfour_state *arcstate;
+ 
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
++
+     arcstate = (state != NULL) ? (void *)state->data : NULL;
+     if (arcstate != NULL) {
+         ctx = arcstate->ctx;
+@@ -113,7 +116,12 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
+ static void
+ k5_arcfour_free_state(krb5_data *state)
+ {
+-    struct arcfour_state *arcstate = (void *)state->data;
++    struct arcfour_state *arcstate;
++
++    if (FIPS_mode())
++        return;
++
++    arcstate = (void *) state->data;
+ 
+     EVP_CIPHER_CTX_free(arcstate->ctx);
+     free(arcstate);
+@@ -125,6 +133,9 @@ k5_arcfour_init_state(const krb5_keyblock *key,
+ {
+     struct arcfour_state *arcstate;
+ 
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
++
+     /*
+      * The cipher state here is a saved pointer to a struct arcfour_state
+      * object, rather than a flat byte array as in most enc providers.  The
+diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c
+index 1e0fb8fc3..feb5eda99 100644
+--- a/src/lib/crypto/openssl/hash_provider/hash_evp.c
++++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c
+@@ -49,6 +49,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
+     if (ctx == NULL)
+         return ENOMEM;
+ 
++    if (type == EVP_md4()) {
++        /* See comment below in hash_md4(). */
++        EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
++    }
++
+     ok = EVP_DigestInit_ex(ctx, type, NULL);
+     for (i = 0; i < num_data; i++) {
+         if (!SIGN_IOV(&data[i]))
+@@ -64,12 +69,19 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
+ static krb5_error_code
+ hash_md4(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
+ {
++    /*
++     * MD4 is needed in FIPS mode to perform key generation for RC4 keys used
++     * by IPA.  These keys are only used along a (separately) secured channel
++     * for legacy reasons when performing trusts to Active Directory.
++     */
+     return hash_evp(EVP_md4(), data, num_data, output);
+ }
+ 
+ static krb5_error_code
+ hash_md5(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
+ {
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
+     return hash_evp(EVP_md5(), data, num_data, output);
+ }
+ 
+diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c
+index 7dc59dcc0..769a50c00 100644
+--- a/src/lib/crypto/openssl/hmac.c
++++ b/src/lib/crypto/openssl/hmac.c
+@@ -103,7 +103,11 @@ map_digest(const struct krb5_hash_provider *hash)
+         return EVP_sha256();
+     else if (!strncmp(hash->hash_name, "SHA-384",7))
+         return EVP_sha384();
+-    else if (!strncmp(hash->hash_name, "MD5", 3))
++
++    if (FIPS_mode())
++        return NULL;
++
++    if (!strncmp(hash->hash_name, "MD5", 3))
+         return EVP_md5();
+     else if (!strncmp(hash->hash_name, "MD4", 3))
+         return EVP_md4();
+diff --git a/src/lib/krad/attr.c b/src/lib/krad/attr.c
+index 9c13d9d75..275327e67 100644
+--- a/src/lib/krad/attr.c
++++ b/src/lib/krad/attr.c
+@@ -30,6 +30,7 @@
+ #include <k5-int.h>
+ #include "internal.h"
+ 
++#include <openssl/crypto.h>
+ #include <string.h>
+ 
+ /* RFC 2865 */
+@@ -38,7 +39,8 @@
+ typedef krb5_error_code
+ (*attribute_transform_fn)(krb5_context ctx, const char *secret,
+                           const unsigned char *auth, const krb5_data *in,
+-                          unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen);
++                          unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen,
++                          krb5_boolean *is_fips);
+ 
+ typedef struct {
+     const char *name;
+@@ -51,12 +53,14 @@ typedef struct {
+ static krb5_error_code
+ user_password_encode(krb5_context ctx, const char *secret,
+                      const unsigned char *auth, const krb5_data *in,
+-                     unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen);
++                     unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen,
++                     krb5_boolean *is_fips);
+ 
+ static krb5_error_code
+ user_password_decode(krb5_context ctx, const char *secret,
+                      const unsigned char *auth, const krb5_data *in,
+-                     unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen);
++                     unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen,
++                     krb5_boolean *ignored);
+ 
+ static const attribute_record attributes[UCHAR_MAX] = {
+     {"User-Name", 1, MAX_ATTRSIZE, NULL, NULL},
+@@ -128,7 +132,8 @@ static const attribute_record attributes[UCHAR_MAX] = {
+ static krb5_error_code
+ user_password_encode(krb5_context ctx, const char *secret,
+                      const unsigned char *auth, const krb5_data *in,
+-                     unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen)
++                     unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen,
++                     krb5_boolean *is_fips)
+ {
+     const unsigned char *indx;
+     krb5_error_code retval;
+@@ -154,8 +159,14 @@ user_password_encode(krb5_context ctx, const char *secret,
+     for (blck = 0, indx = auth; blck * BLOCKSIZE < len; blck++) {
+         memcpy(tmp.data + seclen, indx, BLOCKSIZE);
+ 
+-        retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &tmp,
+-                                      &sum);
++        if (FIPS_mode()) {
++            /* Skip encryption here.  Taint so that we won't pass it out of
++             * the machine by accident. */
++            *is_fips = TRUE;
++            sum.contents = calloc(1, BLOCKSIZE);
++        } else
++            retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &tmp,
++                                          &sum);
+         if (retval != 0) {
+             zap(tmp.data, tmp.length);
+             zap(outbuf, len);
+@@ -180,7 +191,8 @@ user_password_encode(krb5_context ctx, const char *secret,
+ static krb5_error_code
+ user_password_decode(krb5_context ctx, const char *secret,
+                      const unsigned char *auth, const krb5_data *in,
+-                     unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen)
++                     unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen,
++                     krb5_boolean *is_fips)
+ {
+     const unsigned char *indx;
+     krb5_error_code retval;
+@@ -204,8 +216,14 @@ user_password_decode(krb5_context ctx, const char *secret,
+     for (blck = 0, indx = auth; blck * BLOCKSIZE < in->length; blck++) {
+         memcpy(tmp.data + seclen, indx, BLOCKSIZE);
+ 
+-        retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0,
+-                                      &tmp, &sum);
++        if (FIPS_mode()) {
++            /* Skip encryption here.  Taint so that we won't pass it out of
++             * the machine by accident. */
++            *is_fips = TRUE;
++            sum.contents = calloc(1, BLOCKSIZE);
++        } else
++            retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0,
++                                          &tmp, &sum);
+         if (retval != 0) {
+             zap(tmp.data, tmp.length);
+             zap(outbuf, in->length);
+@@ -248,7 +266,7 @@ krb5_error_code
+ kr_attr_encode(krb5_context ctx, const char *secret,
+                const unsigned char *auth, krad_attr type,
+                const krb5_data *in, unsigned char outbuf[MAX_ATTRSIZE],
+-               size_t *outlen)
++               size_t *outlen, krb5_boolean *is_fips)
+ {
+     krb5_error_code retval;
+ 
+@@ -265,7 +283,8 @@ kr_attr_encode(krb5_context ctx, const char *secret,
+         return 0;
+     }
+ 
+-    return attributes[type - 1].encode(ctx, secret, auth, in, outbuf, outlen);
++    return attributes[type - 1].encode(ctx, secret, auth, in, outbuf, outlen,
++                                       is_fips);
+ }
+ 
+ krb5_error_code
+@@ -274,6 +293,7 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
+                unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen)
+ {
+     krb5_error_code retval;
++    krb5_boolean ignored;
+ 
+     retval = kr_attr_valid(type, in);
+     if (retval != 0)
+@@ -288,7 +308,8 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
+         return 0;
+     }
+ 
+-    return attributes[type - 1].decode(ctx, secret, auth, in, outbuf, outlen);
++    return attributes[type - 1].decode(ctx, secret, auth, in, outbuf, outlen,
++                                       &ignored);
+ }
+ 
+ krad_attr
+diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c
+index 03c613716..d89982a13 100644
+--- a/src/lib/krad/attrset.c
++++ b/src/lib/krad/attrset.c
+@@ -167,7 +167,8 @@ krad_attrset_copy(const krad_attrset *set, krad_attrset **copy)
+ krb5_error_code
+ kr_attrset_encode(const krad_attrset *set, const char *secret,
+                   const unsigned char *auth,
+-                  unsigned char outbuf[MAX_ATTRSETSIZE], size_t *outlen)
++                  unsigned char outbuf[MAX_ATTRSETSIZE], size_t *outlen,
++                  krb5_boolean *is_fips)
+ {
+     unsigned char buffer[MAX_ATTRSIZE];
+     krb5_error_code retval;
+@@ -181,7 +182,7 @@ kr_attrset_encode(const krad_attrset *set, const char *secret,
+ 
+     K5_TAILQ_FOREACH(a, &set->list, list) {
+         retval = kr_attr_encode(set->ctx, secret, auth, a->type, &a->attr,
+-                                buffer, &attrlen);
++                                buffer, &attrlen, is_fips);
+         if (retval != 0)
+             return retval;
+ 
+diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h
+index 996a89372..a53ce31ce 100644
+--- a/src/lib/krad/internal.h
++++ b/src/lib/krad/internal.h
+@@ -49,6 +49,13 @@
+ 
+ typedef struct krad_remote_st krad_remote;
+ 
++struct krad_packet_st {
++    char buffer[KRAD_PACKET_SIZE_MAX];
++    krad_attrset *attrset;
++    krb5_data pkt;
++    krb5_boolean is_fips;
++};
++
+ /* Validate constraints of an attribute. */
+ krb5_error_code
+ kr_attr_valid(krad_attr type, const krb5_data *data);
+@@ -57,7 +64,8 @@ kr_attr_valid(krad_attr type, const krb5_data *data);
+ krb5_error_code
+ kr_attr_encode(krb5_context ctx, const char *secret, const unsigned char *auth,
+                krad_attr type, const krb5_data *in,
+-               unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen);
++               unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen,
++               krb5_boolean *is_fips);
+ 
+ /* Decode an attribute. */
+ krb5_error_code
+@@ -69,7 +77,8 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
+ krb5_error_code
+ kr_attrset_encode(const krad_attrset *set, const char *secret,
+                   const unsigned char *auth,
+-                  unsigned char outbuf[MAX_ATTRSETSIZE], size_t *outlen);
++                  unsigned char outbuf[MAX_ATTRSETSIZE], size_t *outlen,
++                  krb5_boolean *is_fips);
+ 
+ /* Decode attributes from a buffer. */
+ krb5_error_code
+diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c
+index c597174b6..794ac84c4 100644
+--- a/src/lib/krad/packet.c
++++ b/src/lib/krad/packet.c
+@@ -32,6 +32,7 @@
+ #include <string.h>
+ 
+ #include <arpa/inet.h>
++#include <openssl/crypto.h>
+ 
+ typedef unsigned char uchar;
+ 
+@@ -53,12 +54,6 @@ typedef unsigned char uchar;
+ #define pkt_auth(p) ((uchar *)offset(&(p)->pkt, OFFSET_AUTH))
+ #define pkt_attr(p) ((unsigned char *)offset(&(p)->pkt, OFFSET_ATTR))
+ 
+-struct krad_packet_st {
+-    char buffer[KRAD_PACKET_SIZE_MAX];
+-    krad_attrset *attrset;
+-    krb5_data pkt;
+-};
+-
+ typedef struct {
+     uchar x[(UCHAR_MAX + 1) / 8];
+ } idmap;
+@@ -187,8 +182,13 @@ auth_generate_response(krb5_context ctx, const char *secret,
+     memcpy(data.data + response->pkt.length, secret, strlen(secret));
+ 
+     /* Hash it. */
+-    retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &data,
+-                                  &hash);
++    if (FIPS_mode()) {
++        /* This checksum does very little security-wise anyway, so don't
++         * taint. */
++        hash.contents = calloc(1, AUTH_FIELD_SIZE);
++    } else
++        retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &data,
++                                      &hash);
+     free(data.data);
+     if (retval != 0)
+         return retval;
+@@ -276,7 +276,7 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code,
+ 
+     /* Encode the attributes. */
+     retval = kr_attrset_encode(set, secret, pkt_auth(pkt), pkt_attr(pkt),
+-                               &attrset_len);
++                               &attrset_len, &pkt->is_fips);
+     if (retval != 0)
+         goto error;
+ 
+@@ -314,7 +314,7 @@ krad_packet_new_response(krb5_context ctx, const char *secret, krad_code code,
+ 
+     /* Encode the attributes. */
+     retval = kr_attrset_encode(set, secret, pkt_auth(request), pkt_attr(pkt),
+-                               &attrset_len);
++                               &attrset_len, &pkt->is_fips);
+     if (retval != 0)
+         goto error;
+ 
+@@ -451,6 +451,8 @@ krad_packet_decode_response(krb5_context ctx, const char *secret,
+ const krb5_data *
+ krad_packet_encode(const krad_packet *pkt)
+ {
++    if (pkt->is_fips)
++        return NULL;
+     return &pkt->pkt;
+ }
+ 
+diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
+index 437f7e91a..0f90443ce 100644
+--- a/src/lib/krad/remote.c
++++ b/src/lib/krad/remote.c
+@@ -263,7 +263,7 @@ on_io_write(krad_remote *rr)
+     request *r;
+ 
+     K5_TAILQ_FOREACH(r, &rr->list, list) {
+-        tmp = krad_packet_encode(r->request);
++        tmp = &r->request->pkt;
+ 
+         /* If the packet has already been sent, do nothing. */
+         if (r->sent == tmp->length)
+@@ -359,7 +359,7 @@ on_io_read(krad_remote *rr)
+     if (req != NULL) {
+         K5_TAILQ_FOREACH(r, &rr->list, list) {
+             if (r->request == req &&
+-                r->sent == krad_packet_encode(req)->length) {
++                r->sent == req->pkt.length) {
+                 request_finish(r, 0, rsp);
+                 break;
+             }
+@@ -455,6 +455,12 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs,
+                                      (krad_packet_iter_cb)iterator, &r, &tmp);
+     if (retval != 0)
+         goto error;
++    else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL &&
++        rr->info->ai_family != AF_UNIX) {
++        /* This would expose cleartext passwords, so abort. */
++        retval = ESOCKTNOSUPPORT;
++        goto error;
++    }
+ 
+     K5_TAILQ_FOREACH(r, &rr->list, list) {
+         if (r->request == tmp) {
+diff --git a/src/lib/krad/t_attr.c b/src/lib/krad/t_attr.c
+index eb2a780c8..4d285ad9d 100644
+--- a/src/lib/krad/t_attr.c
++++ b/src/lib/krad/t_attr.c
+@@ -50,6 +50,7 @@ main()
+     const char *tmp;
+     krb5_data in;
+     size_t len;
++    krb5_boolean is_fips = FALSE;
+ 
+     noerror(krb5_init_context(&ctx));
+ 
+@@ -73,7 +74,7 @@ main()
+     in = string2data((char *)decoded);
+     retval = kr_attr_encode(ctx, secret, auth,
+                             krad_attr_name2num("User-Password"),
+-                            &in, outbuf, &len);
++                            &in, outbuf, &len, &is_fips);
+     insist(retval == 0);
+     insist(len == sizeof(encoded));
+     insist(memcmp(outbuf, encoded, len) == 0);
+diff --git a/src/lib/krad/t_attrset.c b/src/lib/krad/t_attrset.c
+index 7928335ca..0f9576253 100644
+--- a/src/lib/krad/t_attrset.c
++++ b/src/lib/krad/t_attrset.c
+@@ -49,6 +49,7 @@ main()
+     krb5_context ctx;
+     size_t len = 0, encode_len;
+     krb5_data tmp;
++    krb5_boolean is_fips = FALSE;
+ 
+     noerror(krb5_init_context(&ctx));
+     noerror(krad_attrset_new(ctx, &set));
+@@ -62,7 +63,8 @@ main()
+     noerror(krad_attrset_add(set, krad_attr_name2num("User-Password"), &tmp));
+ 
+     /* Encode attrset. */
+-    noerror(kr_attrset_encode(set, "foo", auth, buffer, &encode_len));
++    noerror(kr_attrset_encode(set, "foo", auth, buffer, &encode_len,
++                              &is_fips));
+     krad_attrset_free(set);
+ 
+     /* Manually encode User-Name. */
+diff --git a/src/plugins/preauth/spake/spake_client.c b/src/plugins/preauth/spake/spake_client.c
+index 00734a13b..a3ce22b70 100644
+--- a/src/plugins/preauth/spake/spake_client.c
++++ b/src/plugins/preauth/spake/spake_client.c
+@@ -38,6 +38,8 @@
+ #include "groups.h"
+ #include <krb5/clpreauth_plugin.h>
+ 
++#include <openssl/crypto.h>
++
+ typedef struct reqstate_st {
+     krb5_pa_spake *msg;         /* set in prep_questions, used in process */
+     krb5_keyblock *initial_key;
+@@ -375,6 +377,10 @@ clpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver,
+ 
+     if (maj_ver != 1)
+         return KRB5_PLUGIN_VER_NOTSUPP;
++
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
++
+     vt = (krb5_clpreauth_vtable)vtable;
+     vt->name = "spake";
+     vt->pa_type_list = pa_types;
+diff --git a/src/plugins/preauth/spake/spake_kdc.c b/src/plugins/preauth/spake/spake_kdc.c
+index 88c964ce1..c7df0392f 100644
+--- a/src/plugins/preauth/spake/spake_kdc.c
++++ b/src/plugins/preauth/spake/spake_kdc.c
+@@ -41,6 +41,8 @@
+ 
+ #include <krb5/kdcpreauth_plugin.h>
+ 
++#include <openssl/crypto.h>
++
+ /*
+  * The SPAKE kdcpreauth module uses a secure cookie containing the following
+  * concatenated fields (all integer fields are big-endian):
+@@ -571,6 +573,10 @@ kdcpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver,
+ 
+     if (maj_ver != 1)
+         return KRB5_PLUGIN_VER_NOTSUPP;
++
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
++
+     vt = (krb5_kdcpreauth_vtable)vtable;
+     vt->name = "spake";
+     vt->pa_type_list = pa_types;

SELinux-integration.patch

@@ -1,7 +1,7 @@
-From c79d3881fefb6108306eb56cff62de03897d4bbc Mon Sep 17 00:00:00 2001
+From 4a215a206d1d5af69ea9fbf1e78001971ab18be2 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:30:53 -0400
-Subject: [PATCH] krb5-1.15.1-selinux-label.patch
+Subject: [PATCH] [downstream] SELinux integration
 
 SELinux bases access to files on the domain of the requesting process,
 the operation being performed, and the context applied to the file.
@@ -35,11 +35,13 @@ stomp all over us.
 The selabel APIs for looking up the context should be thread-safe (per
 Red Hat #273081), so switching to using them instead of matchpathcon(),
 which we used earlier, is some improvement.
+
+Last-updated: krb5-1.18-beta1
 ---
- src/aclocal.m4                                |  49 +++
+ src/aclocal.m4                                |  48 +++
  src/build-tools/krb5-config.in                |   3 +-
  src/config/pre.in                             |   3 +-
- src/configure.in                              |   2 +
+ src/configure.ac                              |   2 +
  src/include/k5-int.h                          |   1 +
  src/include/k5-label.h                        |  32 ++
  src/include/krb5/krb5.hin                     |   6 +
@@ -51,7 +53,6 @@ which we used earlier, is some improvement.
  src/lib/krb5/ccache/cc_dir.c                  |  26 +-
  src/lib/krb5/keytab/kt_file.c                 |   4 +-
  src/lib/krb5/os/trace.c                       |   2 +-
- src/lib/krb5/rcache/rc_dfl.c                  |  13 +
  src/plugins/kdb/db2/adb_openclose.c           |   2 +-
  src/plugins/kdb/db2/kdb_db2.c                 |   4 +-
  src/plugins/kdb/db2/libdb2/btree/bt_open.c    |   3 +-
@@ -61,12 +62,12 @@ which we used earlier, is some improvement.
  src/util/profile/prof_file.c                  |   3 +-
  src/util/support/Makefile.in                  |   3 +-
  src/util/support/selinux.c                    | 406 ++++++++++++++++++
- 25 files changed, 587 insertions(+), 21 deletions(-)
+ 24 files changed, 573 insertions(+), 21 deletions(-)
  create mode 100644 src/include/k5-label.h
  create mode 100644 src/util/support/selinux.c
 
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index 340546d..4440ec5 100644
+index 830203683..6796fec53 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
 @@ -89,6 +89,7 @@ AC_SUBST_FILE(libnodeps_frag)
@@ -77,13 +78,13 @@ index 340546d..4440ec5 100644
  KRB5_LIB_PARAMS
  KRB5_AC_INITFINI
  KRB5_AC_ENABLE_THREADS
-@@ -1764,3 +1765,51 @@ AC_SUBST(PAM_LIBS)
+@@ -1743,4 +1744,51 @@ AC_SUBST(PAM_LIBS)
  AC_SUBST(PAM_MAN)
  AC_SUBST(NON_PAM_MAN)
  ])dnl
 +dnl
 +dnl Use libselinux to set file contexts on newly-created files.
-+dnl 
++dnl
 +AC_DEFUN(KRB5_WITH_SELINUX,[
 +AC_ARG_WITH(selinux,[AC_HELP_STRING(--with-selinux,[compile with SELinux labeling support])],
 +           withselinux="$withval",withselinux=auto)
@@ -100,7 +101,7 @@ index 340546d..4440ec5 100644
 +                       AC_MSG_ERROR([Unable to locate selinux/selinux.h.])
 +               fi
 +       fi
-+
+ 
 +       LIBS=
 +       unset ac_cv_func_setfscreatecon
 +       AC_CHECK_FUNCS(setfscreatecon selabel_open)
@@ -130,7 +131,7 @@ index 340546d..4440ec5 100644
 +AC_SUBST(SELINUX_LIBS)
 +])dnl
 diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
-index f6184da..c17cb5e 100755
+index f6184da3f..c17cb5eb5 100755
 --- a/src/build-tools/krb5-config.in
 +++ b/src/build-tools/krb5-config.in
 @@ -41,6 +41,7 @@ DL_LIB='@DL_LIB@'
@@ -151,7 +152,7 @@ index f6184da..c17cb5e 100755
  
      echo $lib_flags
 diff --git a/src/config/pre.in b/src/config/pre.in
-index ce87e21..917357d 100644
+index ce87e21ca..917357df9 100644
 --- a/src/config/pre.in
 +++ b/src/config/pre.in
 @@ -177,6 +177,7 @@ LD = $(PURE) @LD@
@@ -171,11 +172,11 @@ index ce87e21..917357d 100644
  KDB5_LIBS	= $(KDB5_LIB) $(GSSRPC_LIBS)
  GSS_LIBS	= $(GSS_KRB5_LIB)
  # needs fixing if ever used on macOS!
-diff --git a/src/configure.in b/src/configure.in
+diff --git a/src/configure.ac b/src/configure.ac
-index e9a12ac..93aec68 100644
+index d1f576124..440a22bd9 100644
---- a/src/configure.in
+--- a/src/configure.ac
-+++ b/src/configure.in
++++ b/src/configure.ac
-@@ -1354,6 +1354,8 @@ AC_PATH_PROG(GROFF, groff)
+@@ -1392,6 +1392,8 @@ AC_PATH_PROG(GROFF, groff)
  
  KRB5_WITH_PAM
  
@@ -185,20 +186,20 @@ index e9a12ac..93aec68 100644
  if test "${localedir+set}" != set; then
      localedir='$(datadir)/locale'
 diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index 6522422..7190a8f 100644
+index 9616b24bf..0d9af3d95 100644
 --- a/src/include/k5-int.h
 +++ b/src/include/k5-int.h
-@@ -126,6 +126,7 @@ typedef unsigned char   u_char;
+@@ -128,6 +128,7 @@ typedef unsigned char   u_char;
- #endif /* HAVE_SYS_TYPES_H */
- #endif /* KRB5_SYSTYPES__ */
  
-+#include "k5-label.h"
  
  #include "k5-platform.h"
++#include "k5-label.h"
  
+ #define KRB5_KDB_MAX_LIFE       (60*60*24) /* one day */
+ #define KRB5_KDB_MAX_RLIFE      (60*60*24*7) /* one week */
 diff --git a/src/include/k5-label.h b/src/include/k5-label.h
 new file mode 100644
-index 0000000..6baf71c
+index 000000000..dfaaa847c
 --- /dev/null
 +++ b/src/include/k5-label.h
 @@ -0,0 +1,32 @@
@@ -234,9 +235,8 @@ index 0000000..6baf71c
 +#define THREEPARAMOPEN(x,y,z) open(x,y,z)
 +#endif
 +#endif
-\ No newline at end of file
 diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
-index c40a6cc..3ff86d7 100644
+index d48685357..d1f5661bf 100644
 --- a/src/include/krb5/krb5.hin
 +++ b/src/include/krb5/krb5.hin
 @@ -87,6 +87,12 @@
@@ -253,7 +253,7 @@ index c40a6cc..3ff86d7 100644
  
  #include <stdlib.h>
 diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c
-index c9574c6..8301a33 100644
+index 301e3476d..19f2cc230 100644
 --- a/src/kadmin/dbutil/dump.c
 +++ b/src/kadmin/dbutil/dump.c
 @@ -148,12 +148,21 @@ create_ofile(char *ofile, char **tmpname)
@@ -288,10 +288,10 @@ index c9574c6..8301a33 100644
          com_err(progname, errno, _("while creating 'ok' file, '%s'"), file_ok);
          goto cleanup;
 diff --git a/src/kdc/main.c b/src/kdc/main.c
-index 408c723..663fd63 100644
+index fdcd694d7..1ede4bf2f 100644
 --- a/src/kdc/main.c
 +++ b/src/kdc/main.c
-@@ -858,7 +858,7 @@ write_pid_file(const char *path)
+@@ -872,7 +872,7 @@ write_pid_file(const char *path)
      FILE *file;
      unsigned long pid;
  
@@ -301,20 +301,20 @@ index 408c723..663fd63 100644
          return errno;
      pid = (unsigned long) getpid();
 diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c
-index 68323dd..2e3cfae 100644
+index 5622d56e1..356e3e0e6 100644
 --- a/src/kprop/kpropd.c
 +++ b/src/kprop/kpropd.c
-@@ -489,6 +489,9 @@ doit(int fd)
+@@ -487,6 +487,9 @@ doit(int fd)
+     krb5_enctype etype;
      int database_fd;
      char host[INET6_ADDRSTRLEN + 1];
- 
 +#ifdef USE_SELINUX
 +    void *selabel;
 +#endif
+ 
      signal_wrapper(SIGALRM, alarm_handler);
      alarm(params.iprop_resync_timeout);
-     fromlen = sizeof(from);
+@@ -542,9 +545,15 @@ doit(int fd)
-@@ -543,9 +546,15 @@ doit(int fd)
          free(name);
          exit(1);
      }
@@ -331,7 +331,7 @@ index 68323dd..2e3cfae 100644
                              KRB5_LOCKMODE_EXCLUSIVE | KRB5_LOCKMODE_DONTBLOCK);
      if (retval) {
 diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c
-index c6885ed..9aec3c0 100644
+index c6885edf2..9aec3c05e 100644
 --- a/src/lib/kadm5/logger.c
 +++ b/src/lib/kadm5/logger.c
 @@ -309,7 +309,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do
@@ -353,20 +353,20 @@ index c6885ed..9aec3c0 100644
                  set_cloexec_file(f);
                  log_control.log_entries[lindex].lfu_filep = f;
 diff --git a/src/lib/kdb/kdb_log.c b/src/lib/kdb/kdb_log.c
-index 2659a25..a1cd38f 100644
+index 2659a2501..e9b95fce5 100644
 --- a/src/lib/kdb/kdb_log.c
 +++ b/src/lib/kdb/kdb_log.c
-@@ -491,7 +491,7 @@ ulog_map(krb5_context context, const char *logname, uint32_t ulogentries)
+@@ -480,7 +480,7 @@ ulog_map(krb5_context context, const char *logname, uint32_t ulogentries)
-         if (retval)
+         return ENOMEM;
-             goto cleanup;
+ 
-     } else {
+     if (stat(logname, &st) == -1) {
--        log_ctx->ulogfd = open(logname, O_RDWR, 0600);
+-        log_ctx->ulogfd = open(logname, O_RDWR | O_CREAT, 0600);
 +        log_ctx->ulogfd = THREEPARAMOPEN(logname, O_RDWR | O_CREAT, 0600);
          if (log_ctx->ulogfd == -1) {
              retval = errno;
              goto cleanup;
 diff --git a/src/lib/krb5/ccache/cc_dir.c b/src/lib/krb5/ccache/cc_dir.c
-index bba64e5..73f0fe6 100644
+index 7b100a0ec..5683a0433 100644
 --- a/src/lib/krb5/ccache/cc_dir.c
 +++ b/src/lib/krb5/ccache/cc_dir.c
 @@ -183,10 +183,19 @@ write_primary_file(const char *primary_path, const char *contents)
@@ -416,10 +416,10 @@ index bba64e5..73f0fe6 100644
                    _("Credential cache directory %s does not exist"),
                    dirname);
 diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c
-index 89cb686..21c80d4 100644
+index 021c94398..aaf573439 100644
 --- a/src/lib/krb5/keytab/kt_file.c
 +++ b/src/lib/krb5/keytab/kt_file.c
-@@ -1024,14 +1024,14 @@ krb5_ktfileint_open(krb5_context context, krb5_keytab id, int mode)
+@@ -735,14 +735,14 @@ krb5_ktfileint_open(krb5_context context, krb5_keytab id, int mode)
  
      KTCHECKLOCK(id);
      errno = 0;
@@ -437,7 +437,7 @@ index 89cb686..21c80d4 100644
                  goto report_errno;
              writevno = 1;
 diff --git a/src/lib/krb5/os/trace.c b/src/lib/krb5/os/trace.c
-index 4fff8f3..40a9e7b 100644
+index 2a03ae980..85dbfeb47 100644
 --- a/src/lib/krb5/os/trace.c
 +++ b/src/lib/krb5/os/trace.c
 @@ -458,7 +458,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename)
@@ -449,40 +449,8 @@ index 4fff8f3..40a9e7b 100644
      if (*fd == -1) {
          free(fd);
          return errno;
-diff --git a/src/lib/krb5/rcache/rc_dfl.c b/src/lib/krb5/rcache/rc_dfl.c
-index 1e0cb22..f5e93b1 100644
---- a/src/lib/krb5/rcache/rc_dfl.c
-+++ b/src/lib/krb5/rcache/rc_dfl.c
-@@ -793,6 +793,9 @@ krb5_rc_dfl_expunge_locked(krb5_context context, krb5_rcache id)
-     krb5_error_code retval = 0;
-     krb5_rcache tmp;
-     krb5_deltat lifespan = t->lifespan;  /* save original lifespan */
-+#ifdef USE_SELINUX
-+    void *selabel;
-+#endif
- 
-     if (! t->recovering) {
-         name = t->name;
-@@ -814,7 +817,17 @@ krb5_rc_dfl_expunge_locked(krb5_context context, krb5_rcache id)
-     retval = krb5_rc_resolve(context, tmp, 0);
-     if (retval)
-         goto cleanup;
-+#ifdef USE_SELINUX
-+    if (t->d.fn != NULL)
-+        selabel = krb5int_push_fscreatecon_for(t->d.fn);
-+    else
-+        selabel = NULL;
-+#endif
-     retval = krb5_rc_initialize(context, tmp, lifespan);
-+#ifdef USE_SELINUX
-+    if (selabel != NULL)
-+        krb5int_pop_fscreatecon(selabel);
-+#endif
-     if (retval)
-         goto cleanup;
-     for (q = t->a; q; q = q->na) {
 diff --git a/src/plugins/kdb/db2/adb_openclose.c b/src/plugins/kdb/db2/adb_openclose.c
-index 7db30a3..2b9d019 100644
+index 7db30a33b..2b9d01921 100644
 --- a/src/plugins/kdb/db2/adb_openclose.c
 +++ b/src/plugins/kdb/db2/adb_openclose.c
 @@ -152,7 +152,7 @@ osa_adb_init_db(osa_adb_db_t *dbp, char *filename, char *lockfilename,
@@ -495,7 +463,7 @@ index 7db30a3..2b9d019 100644
               * maybe someone took away write permission so we could only
               * get shared locks?
 diff --git a/src/plugins/kdb/db2/kdb_db2.c b/src/plugins/kdb/db2/kdb_db2.c
-index 5106a5c..e481e81 100644
+index 5106a5c99..e481e8121 100644
 --- a/src/plugins/kdb/db2/kdb_db2.c
 +++ b/src/plugins/kdb/db2/kdb_db2.c
 @@ -694,8 +694,8 @@ ctx_create_db(krb5_context context, krb5_db2_context *dbc)
@@ -510,7 +478,7 @@ index 5106a5c..e481e81 100644
          retval = errno;
          goto cleanup;
 diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_open.c b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
-index 2977b17..d5809a5 100644
+index 2977b17f3..d5809a5a9 100644
 --- a/src/plugins/kdb/db2/libdb2/btree/bt_open.c
 +++ b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
 @@ -60,6 +60,7 @@ static char sccsid[] = "@(#)bt_open.c	8.11 (Berkeley) 11/2/95";
@@ -531,17 +499,17 @@ index 2977b17..d5809a5 100644
  
  	} else {
 diff --git a/src/plugins/kdb/db2/libdb2/hash/hash.c b/src/plugins/kdb/db2/libdb2/hash/hash.c
-index 862dbb1..09a5d3a 100644
+index 862dbb164..686a960c9 100644
 --- a/src/plugins/kdb/db2/libdb2/hash/hash.c
 +++ b/src/plugins/kdb/db2/libdb2/hash/hash.c
-@@ -55,6 +55,7 @@ static char sccsid[] = "@(#)hash.c	8.12 (Berkeley) 11/7/95";
+@@ -51,6 +51,7 @@ static char sccsid[] = "@(#)hash.c	8.12 (Berkeley) 11/7/95";
+ #include <assert.h>
+ #endif
+ 
++#include "k5-int.h"
+ #include "db-int.h"
  #include "hash.h"
  #include "page.h"
- #include "extern.h"
-+#include "k5-int.h"
- 
- static int32_t flush_meta __P((HTAB *));
- static int32_t hash_access __P((HTAB *, ACTION, const DBT *, DBT *));
 @@ -129,7 +130,7 @@ __kdb2_hash_open(file, flags, mode, info, dflags)
  		new_table = 1;
  	}
@@ -552,17 +520,17 @@ index 862dbb1..09a5d3a 100644
  		(void)fcntl(hashp->fp, F_SETFD, 1);
  	}
 diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_open.c b/src/plugins/kdb/db2/libdb2/recno/rec_open.c
-index d8b26e7..97c6848 100644
+index d8b26e701..b0daa7c02 100644
 --- a/src/plugins/kdb/db2/libdb2/recno/rec_open.c
 +++ b/src/plugins/kdb/db2/libdb2/recno/rec_open.c
-@@ -53,6 +53,7 @@ static char sccsid[] = "@(#)rec_open.c	8.12 (Berkeley) 11/18/94";
+@@ -51,6 +51,7 @@ static char sccsid[] = "@(#)rec_open.c	8.12 (Berkeley) 11/18/94";
+ #include <stdio.h>
+ #include <unistd.h>
  
++#include "k5-int.h"
  #include "db-int.h"
  #include "recno.h"
-+#include "k5-int.h"
  
- DB *
- __rec_open(fname, flags, mode, openinfo, dflags)
 @@ -68,7 +69,8 @@ __rec_open(fname, flags, mode, openinfo, dflags)
  	int rfd = -1, sverrno;
  
@@ -574,10 +542,10 @@ index d8b26e7..97c6848 100644
  
  	if (fname != NULL && fcntl(rfd, F_SETFD, 1) == -1) {
 diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
-index 1ed72af..ce038fc 100644
+index b92cb58c7..0a95101ad 100644
 --- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
 +++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
-@@ -194,7 +194,7 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
+@@ -190,7 +190,7 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
  
      /* set password in the file */
      old_mode = umask(0177);
@@ -586,7 +554,7 @@ index 1ed72af..ce038fc 100644
      if (pfile == NULL) {
          com_err(me, errno, _("Failed to open file %s: %s"), file_name,
                  strerror (errno));
-@@ -235,6 +235,9 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
+@@ -231,6 +231,9 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
           * Delete the existing entry and add the new entry
           */
          FILE *newfile;
@@ -596,7 +564,7 @@ index 1ed72af..ce038fc 100644
  
          mode_t omask;
  
-@@ -246,7 +249,13 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
+@@ -242,7 +245,13 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
          }
  
          omask = umask(077);
@@ -611,7 +579,7 @@ index 1ed72af..ce038fc 100644
          if (newfile == NULL) {
              com_err(me, errno, _("Error creating file %s"), tmp_file);
 diff --git a/src/util/profile/prof_file.c b/src/util/profile/prof_file.c
-index 24e41fb..0dcb6b5 100644
+index aa951df05..79f9500f6 100644
 --- a/src/util/profile/prof_file.c
 +++ b/src/util/profile/prof_file.c
 @@ -33,6 +33,7 @@
@@ -632,10 +600,10 @@ index 24e41fb..0dcb6b5 100644
          retval = errno;
          if (retval == 0)
 diff --git a/src/util/support/Makefile.in b/src/util/support/Makefile.in
-index db7b030..321672b 100644
+index 86d5a950a..1052d53a1 100644
 --- a/src/util/support/Makefile.in
 +++ b/src/util/support/Makefile.in
-@@ -69,6 +69,7 @@ IPC_SYMS= \
+@@ -74,6 +74,7 @@ IPC_SYMS= \
  
  STLIBOBJS= \
  	threads.o \
@@ -643,7 +611,7 @@ index db7b030..321672b 100644
  	init-addrinfo.o \
  	plugins.o \
  	errors.o \
-@@ -160,7 +161,7 @@ SRCS=\
+@@ -168,7 +169,7 @@ SRCS=\
  
  SHLIB_EXPDEPS =
  # Add -lm if dumping thread stats, for sqrt.
@@ -654,7 +622,7 @@ index db7b030..321672b 100644
  
 diff --git a/src/util/support/selinux.c b/src/util/support/selinux.c
 new file mode 100644
-index 0000000..6d41f32
+index 000000000..6d41f3244
 --- /dev/null
 +++ b/src/util/support/selinux.c
 @@ -0,0 +1,406 @@
@@ -1064,6 +1032,3 @@ index 0000000..6d41f32
 +}
 +
 +#endif /* USE_SELINUX */
--- 
-2.19.1
-

fix-debuginfo-with-y.tab.c.patch

@@ -0,0 +1,41 @@
+From ed161c3f3cb642d025f0fee6d4af6f56bba711e9 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Tue, 23 Aug 2016 16:49:25 -0400
+Subject: [PATCH] [downstream] fix debuginfo with y.tab.c
+
+We want to keep these y.tab.c files around because the debuginfo points to
+them.  It would be more elegant at the end to use symbolic links, but that
+could mess up people working in the tree on other things.
+
+Last-updated: krb5-1.9
+---
+ src/kadmin/cli/Makefile.in                 | 5 +++++
+ src/plugins/kdb/ldap/ldap_util/Makefile.in | 2 +-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/kadmin/cli/Makefile.in b/src/kadmin/cli/Makefile.in
+index adfea6e2b..d1327e400 100644
+--- a/src/kadmin/cli/Makefile.in
++++ b/src/kadmin/cli/Makefile.in
+@@ -37,3 +37,8 @@ clean-unix::
+ # CC_LINK is not meant for compilation and this use may break in the future.
+ datetest: getdate.c
+ 	$(CC_LINK) $(ALL_CFLAGS) -DTEST -o datetest getdate.c
++
++%.c: %.y
++	$(RM) y.tab.c $@
++	$(YACC.y) $< 
++	$(CP) y.tab.c $@
+diff --git a/src/plugins/kdb/ldap/ldap_util/Makefile.in b/src/plugins/kdb/ldap/ldap_util/Makefile.in
+index 8669c2436..a22f23c02 100644
+--- a/src/plugins/kdb/ldap/ldap_util/Makefile.in
++++ b/src/plugins/kdb/ldap/ldap_util/Makefile.in
+@@ -20,7 +20,7 @@ $(PROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIB) $(GETDATE)
+ getdate.c: $(GETDATE)
+ 	$(RM) getdate.c y.tab.c
+ 	$(YACC) $(GETDATE)
+-	$(MV) y.tab.c getdate.c
++	$(CP) y.tab.c getdate.c
+ 
+ install:
+ 	$(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG)

kdc.conf

@@ -8,5 +8,5 @@
   acl_file = /var/kerberos/krb5kdc/kadm5.acl
   dict_file = /usr/share/dict/words
   admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
-  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
+  permitted_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
  }

krb5-1.12-api.patch

@@ -1,37 +0,0 @@
-From abb19d2d2eac5f9f6e4a1bf26f59f3a62143dab9 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:47:00 -0400
-Subject: [PATCH] krb5-1.12-api.patch
-
-Reference docs don't define what happens if you call krb5_realm_compare() with
-malformed krb5_principal structures.  Define a behavior which keeps it from
-crashing if applications don't check ahead of time.
----
- src/lib/krb5/krb/princ_comp.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/src/lib/krb5/krb/princ_comp.c b/src/lib/krb5/krb/princ_comp.c
-index a6936107d..0ed78833b 100644
---- a/src/lib/krb5/krb/princ_comp.c
-+++ b/src/lib/krb5/krb/princ_comp.c
-@@ -36,6 +36,10 @@ realm_compare_flags(krb5_context context,
-     const krb5_data *realm1 = &princ1->realm;
-     const krb5_data *realm2 = &princ2->realm;
- 
-+    if (princ1 == NULL || princ2 == NULL)
-+        return FALSE;
-+    if (realm1 == NULL || realm2 == NULL)
-+        return FALSE;
-     if (realm1->length != realm2->length)
-         return FALSE;
-     if (realm1->length == 0)
-@@ -88,6 +92,9 @@ krb5_principal_compare_flags(krb5_context context,
-     krb5_principal upn2 = NULL;
-     krb5_boolean ret = FALSE;
- 
-+    if (princ1 == NULL || princ2 == NULL)
-+        return FALSE;
-+
-     if (flags & KRB5_PRINCIPAL_COMPARE_ENTERPRISE) {
-         /* Treat UPNs as if they were real principals */
-         if (princ1->type == KRB5_NT_ENTERPRISE_PRINCIPAL) {

krb5-1.12-ksu-path.patch

@@ -1,22 +0,0 @@
-From 7f076496c7441cd108929aa05dbe009f34054bf5 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:32:09 -0400
-Subject: [PATCH] krb5-1.12-ksu-path.patch
-
-Set the default PATH to the one set by login.
----
- src/clients/ksu/Makefile.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in
-index 5755bb58a..9d58f29b5 100644
---- a/src/clients/ksu/Makefile.in
-+++ b/src/clients/ksu/Makefile.in
-@@ -1,6 +1,6 @@
- mydir=clients$(S)ksu
- BUILDTOP=$(REL)..$(S)..
--DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/bin /local/bin"'
-+DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/usr/local/sbin /usr/local/bin /sbin /bin /usr/sbin /usr/bin"'
- 
- KSU_LIBS=@KSU_LIBS@
- PAM_LIBS=@PAM_LIBS@

krb5-1.12-ktany.patch

@@ -1,366 +0,0 @@
-From 01acbf3cbd60bd460e6ec6702589451d19c89933 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:33:53 -0400
-Subject: [PATCH] krb5-1.12-ktany.patch
-
-Adds an "ANY" keytab type which is a list of other keytab locations to search
-when searching for a specific entry.  When iterated through, it only presents
-the contents of the first keytab.
----
- src/lib/krb5/keytab/Makefile.in |   3 +
- src/lib/krb5/keytab/kt_any.c    | 292 ++++++++++++++++++++++++++++++++
- src/lib/krb5/keytab/ktbase.c    |   7 +-
- 3 files changed, 301 insertions(+), 1 deletion(-)
- create mode 100644 src/lib/krb5/keytab/kt_any.c
-
-diff --git a/src/lib/krb5/keytab/Makefile.in b/src/lib/krb5/keytab/Makefile.in
-index 2a8fceb00..ffd179fb2 100644
---- a/src/lib/krb5/keytab/Makefile.in
-+++ b/src/lib/krb5/keytab/Makefile.in
-@@ -12,6 +12,7 @@ STLIBOBJS= \
- 	ktfr_entry.o	\
- 	ktremove.o	\
- 	ktfns.o		\
-+	kt_any.o	\
- 	kt_file.o	\
- 	kt_memory.o	\
- 	kt_srvtab.o	\
-@@ -24,6 +25,7 @@ OBJS=	\
- 	$(OUTPRE)ktfr_entry.$(OBJEXT)	\
- 	$(OUTPRE)ktremove.$(OBJEXT)	\
- 	$(OUTPRE)ktfns.$(OBJEXT)	\
-+	$(OUTPRE)kt_any.$(OBJEXT)	\
- 	$(OUTPRE)kt_file.$(OBJEXT)	\
- 	$(OUTPRE)kt_memory.$(OBJEXT)	\
- 	$(OUTPRE)kt_srvtab.$(OBJEXT)	\
-@@ -36,6 +38,7 @@ SRCS=	\
- 	$(srcdir)/ktfr_entry.c	\
- 	$(srcdir)/ktremove.c	\
- 	$(srcdir)/ktfns.c	\
-+	$(srcdir)/kt_any.c	\
- 	$(srcdir)/kt_file.c	\
- 	$(srcdir)/kt_memory.c	\
- 	$(srcdir)/kt_srvtab.c	\
-diff --git a/src/lib/krb5/keytab/kt_any.c b/src/lib/krb5/keytab/kt_any.c
-new file mode 100644
-index 000000000..1b9b7765b
---- /dev/null
-+++ b/src/lib/krb5/keytab/kt_any.c
-@@ -0,0 +1,292 @@
-+/*
-+ * lib/krb5/keytab/kt_any.c
-+ *
-+ * Copyright 1998, 1999 by the Massachusetts Institute of Technology.
-+ * All Rights Reserved.
-+ *
-+ * Export of this software from the United States of America may
-+ *   require a specific license from the United States Government.
-+ *   It is the responsibility of any person or organization contemplating
-+ *   export to obtain such a license before exporting.
-+ * 
-+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-+ * distribute this software and its documentation for any purpose and
-+ * without fee is hereby granted, provided that the above copyright
-+ * notice appear in all copies and that both that copyright notice and
-+ * this permission notice appear in supporting documentation, and that
-+ * the name of M.I.T. not be used in advertising or publicity pertaining
-+ * to distribution of the software without specific, written prior
-+ * permission.  M.I.T. makes no representations about the suitability of
-+ * this software for any purpose.  It is provided "as is" without express
-+ * or implied warranty.
-+ * 
-+ *
-+ * krb5_kta_ops
-+ */
-+
-+#include "k5-int.h"
-+
-+typedef struct _krb5_ktany_data {
-+    char *name;
-+    krb5_keytab *choices;
-+    int nchoices;
-+} krb5_ktany_data;
-+
-+typedef struct _krb5_ktany_cursor_data {
-+    int which;
-+    krb5_kt_cursor cursor;
-+} krb5_ktany_cursor_data;
-+
-+static krb5_error_code krb5_ktany_resolve
-+	          (krb5_context,
-+		   const char *,
-+		   krb5_keytab *);
-+static krb5_error_code krb5_ktany_get_name
-+	          (krb5_context context,
-+		   krb5_keytab id,
-+		   char *name,
-+		   unsigned int len);
-+static krb5_error_code krb5_ktany_close
-+	          (krb5_context context,
-+		   krb5_keytab id);
-+static krb5_error_code krb5_ktany_get_entry
-+	          (krb5_context context,
-+		   krb5_keytab id,
-+		   krb5_const_principal principal,
-+		   krb5_kvno kvno,
-+		   krb5_enctype enctype,
-+		   krb5_keytab_entry *entry);
-+static krb5_error_code krb5_ktany_start_seq_get
-+	          (krb5_context context,
-+		   krb5_keytab id,
-+		   krb5_kt_cursor *cursorp);
-+static krb5_error_code krb5_ktany_next_entry
-+	          (krb5_context context,
-+		   krb5_keytab id,
-+		   krb5_keytab_entry *entry,
-+		   krb5_kt_cursor *cursor);
-+static krb5_error_code krb5_ktany_end_seq_get
-+	          (krb5_context context,
-+		   krb5_keytab id,
-+		   krb5_kt_cursor *cursor);
-+static void cleanup
-+	          (krb5_context context,
-+		   krb5_ktany_data *data,
-+		   int nchoices);
-+
-+struct _krb5_kt_ops krb5_kta_ops = {
-+    0,
-+    "ANY", 	/* Prefix -- this string should not appear anywhere else! */
-+    krb5_ktany_resolve,
-+    krb5_ktany_get_name,
-+    krb5_ktany_close,
-+    krb5_ktany_get_entry,
-+    krb5_ktany_start_seq_get,
-+    krb5_ktany_next_entry,
-+    krb5_ktany_end_seq_get,
-+    NULL,
-+    NULL,
-+    NULL,
-+};
-+
-+static krb5_error_code
-+krb5_ktany_resolve(context, name, id)
-+    krb5_context context;
-+    const char *name;
-+    krb5_keytab *id;
-+{
-+    const char *p, *q;
-+    char *copy;
-+    krb5_error_code kerror;
-+    krb5_ktany_data *data;
-+    int i;
-+
-+    /* Allocate space for our data and remember a copy of the name. */
-+    if ((data = (krb5_ktany_data *)malloc(sizeof(krb5_ktany_data))) == NULL)
-+	return(ENOMEM);
-+    if ((data->name = (char *)malloc(strlen(name) + 1)) == NULL) {
-+	free(data);
-+	return(ENOMEM);
-+    }
-+    strcpy(data->name, name);
-+
-+    /* Count the number of choices and allocate memory for them. */
-+    data->nchoices = 1;
-+    for (p = name; (q = strchr(p, ',')) != NULL; p = q + 1)
-+	data->nchoices++;
-+    if ((data->choices = (krb5_keytab *)
-+	 malloc(data->nchoices * sizeof(krb5_keytab))) == NULL) {
-+	free(data->name);
-+	free(data);
-+	return(ENOMEM);
-+    }
-+
-+    /* Resolve each of the choices. */
-+    i = 0;
-+    for (p = name; (q = strchr(p, ',')) != NULL; p = q + 1) {
-+	/* Make a copy of the choice name so we can terminate it. */
-+	if ((copy = (char *)malloc(q - p + 1)) == NULL) {
-+	    cleanup(context, data, i);
-+	    return(ENOMEM);
-+	}
-+	memcpy(copy, p, q - p);
-+	copy[q - p] = 0;
-+
-+	/* Try resolving the choice name. */
-+	kerror = krb5_kt_resolve(context, copy, &data->choices[i]);
-+	free(copy);
-+	if (kerror) {
-+	    cleanup(context, data, i);
-+	    return(kerror);
-+	}
-+	i++;
-+    }
-+    if ((kerror = krb5_kt_resolve(context, p, &data->choices[i]))) {
-+	cleanup(context, data, i);
-+	return(kerror);
-+    }
-+
-+    /* Allocate and fill in an ID for the caller. */
-+    if ((*id = (krb5_keytab)malloc(sizeof(**id))) == NULL) {
-+	cleanup(context, data, i);
-+	return(ENOMEM);
-+    }
-+    (*id)->ops = &krb5_kta_ops;
-+    (*id)->data = (krb5_pointer)data;
-+    (*id)->magic = KV5M_KEYTAB;
-+
-+    return(0);
-+}
-+
-+static krb5_error_code
-+krb5_ktany_get_name(context, id, name, len)
-+    krb5_context context;
-+    krb5_keytab id;
-+    char *name;
-+    unsigned int len;
-+{
-+    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
-+
-+    if (len < strlen(data->name) + 1)
-+	return(KRB5_KT_NAME_TOOLONG);
-+    strcpy(name, data->name);
-+    return(0);
-+}
-+
-+static krb5_error_code
-+krb5_ktany_close(context, id)
-+    krb5_context context;
-+    krb5_keytab id;
-+{
-+    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
-+
-+    cleanup(context, data, data->nchoices);
-+    id->ops = 0;
-+    free(id);
-+    return(0);
-+}
-+
-+static krb5_error_code
-+krb5_ktany_get_entry(context, id, principal, kvno, enctype, entry)
-+    krb5_context context;
-+    krb5_keytab id;
-+    krb5_const_principal principal;
-+    krb5_kvno kvno;
-+    krb5_enctype enctype;
-+    krb5_keytab_entry *entry;
-+{
-+    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
-+    krb5_error_code kerror = KRB5_KT_NOTFOUND;
-+    int i;
-+
-+    for (i = 0; i < data->nchoices; i++) {
-+	if ((kerror = krb5_kt_get_entry(context, data->choices[i], principal,
-+					kvno, enctype, entry)) != ENOENT)
-+	    return kerror;
-+    }
-+    return kerror;
-+}
-+
-+static krb5_error_code
-+krb5_ktany_start_seq_get(context, id, cursorp)
-+    krb5_context context;
-+    krb5_keytab id;
-+    krb5_kt_cursor *cursorp;
-+{
-+    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
-+    krb5_ktany_cursor_data *cdata;
-+    krb5_error_code kerror = ENOENT;
-+    int i;
-+
-+    if ((cdata = (krb5_ktany_cursor_data *)
-+	 malloc(sizeof(krb5_ktany_cursor_data))) == NULL)
-+	return(ENOMEM);
-+
-+    /* Find a choice which can handle the serialization request. */
-+    for (i = 0; i < data->nchoices; i++) {
-+	if ((kerror = krb5_kt_start_seq_get(context, data->choices[i],
-+					    &cdata->cursor)) == 0)
-+	    break;
-+	else if (kerror != ENOENT) {
-+	    free(cdata);
-+	    return(kerror);
-+	}
-+    }
-+
-+    if (i == data->nchoices) {
-+	/* Everyone returned ENOENT, so no go. */
-+	free(cdata);
-+	return(kerror);
-+    }
-+
-+    cdata->which = i;
-+    *cursorp = (krb5_kt_cursor)cdata;
-+    return(0);
-+}
-+
-+static krb5_error_code
-+krb5_ktany_next_entry(context, id, entry, cursor)
-+    krb5_context context;
-+    krb5_keytab id;
-+    krb5_keytab_entry *entry;
-+    krb5_kt_cursor *cursor;
-+{
-+    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
-+    krb5_ktany_cursor_data *cdata = (krb5_ktany_cursor_data *)*cursor;
-+    krb5_keytab choice_id;
-+
-+    choice_id = data->choices[cdata->which];
-+    return(krb5_kt_next_entry(context, choice_id, entry, &cdata->cursor));
-+}
-+
-+static krb5_error_code
-+krb5_ktany_end_seq_get(context, id, cursor)
-+    krb5_context context;
-+    krb5_keytab id;
-+    krb5_kt_cursor *cursor;
-+{
-+    krb5_ktany_data *data = (krb5_ktany_data *)id->data;
-+    krb5_ktany_cursor_data *cdata = (krb5_ktany_cursor_data *)*cursor;
-+    krb5_keytab choice_id;
-+    krb5_error_code kerror;
-+
-+    choice_id = data->choices[cdata->which];
-+    kerror = krb5_kt_end_seq_get(context, choice_id, &cdata->cursor);
-+    free(cdata);
-+    return(kerror);
-+}
-+
-+static void
-+cleanup(context, data, nchoices)
-+    krb5_context context;
-+    krb5_ktany_data *data;
-+    int nchoices;
-+{
-+    int i;
-+
-+    free(data->name);
-+    for (i = 0; i < nchoices; i++)
-+	krb5_kt_close(context, data->choices[i]);
-+    free(data->choices);
-+    free(data);
-+}
-diff --git a/src/lib/krb5/keytab/ktbase.c b/src/lib/krb5/keytab/ktbase.c
-index 0d39b2940..6534d7c52 100644
---- a/src/lib/krb5/keytab/ktbase.c
-+++ b/src/lib/krb5/keytab/ktbase.c
-@@ -57,14 +57,19 @@ extern const krb5_kt_ops krb5_ktf_ops;
- extern const krb5_kt_ops krb5_ktf_writable_ops;
- extern const krb5_kt_ops krb5_kts_ops;
- extern const krb5_kt_ops krb5_mkt_ops;
-+extern const krb5_kt_ops krb5_kta_ops;
- 
- struct krb5_kt_typelist {
-     const krb5_kt_ops *ops;
-     const struct krb5_kt_typelist *next;
- };
-+static struct krb5_kt_typelist krb5_kt_typelist_any = {
-+    &krb5_kta_ops,
-+    NULL
-+};
- const static struct krb5_kt_typelist krb5_kt_typelist_srvtab = {
-     &krb5_kts_ops,
--    NULL
-+    &krb5_kt_typelist_any
- };
- const static struct krb5_kt_typelist krb5_kt_typelist_memory = {
-     &krb5_mkt_ops,

krb5-1.17.tar.gz.asc

@@ -1,17 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1
-
-iQIcBAABAgAGBQJcNMxOAAoJEAy6CFdfg3LfjAwP/2/oQe+4Bs/XwZTwNfakTbBl
-YHSY8MNAHIKsLh6Bn+SJBQQXSE0fEsm0hYH+JWz85+mzlZk7TbNZUI+zeikhLxi6
-+d8MMQBpk2mQN0dkIeWjTdfkcThGCDSL7l0fh3MuEfN5C7QPAPD1JL1ZeqXPH5AV
-PSQRC9s2wiOTwwuHM2i27rZ7gdhL/xfJ3ZPUFJH4klRgszwp9j10I/nh4/XyS/wB
-82umjfusFPa9VNSPzm1jm94oRmALkR3CHGvmku2XD3YOv/f5yO8C1cHWNNLxg+5h
-EqVv05ddb6iLku4fRhkEjfN3VgCtEvXuMkuAXppkDJJ7wWxMBWgCIr1DS/x7LfbL
-CI0ZTejn8HCUBNmRWsKkUuebgHJ7ccch8p/Fp0cV4eT1FL35N2oV51u7+/zK6R8y
-1dygUF2VWFOqwm8cyczdFue7dFQVDGCw7R2eK5lXY3NpZVmJblQ/gNLMcbOxGBis
-H2dOzSn+CnxlD/2LqOZnhQ1WnGBhOMxoINwX/MQsIvkwAFaM1EsdhPIP/6mSVA/g
-p04+YQ2u2ag7Pq3zHsMIonC18w4ZqDPcvXvOXqCHtlQBDAMtb927XvjoTNj5W8Ei
-jywxqdWuuqalmrKGPEsKVOJZN6xg7UTgaKzcvQTvW7D3gLbrTT2iM++VKB3vh9V9
-SkULnR3c7fKMzFeLb/Q2
-=4hZX
------END PGP SIGNATURE-----

krb5-1.18.tar.gz.asc

@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQIcBAABAgAGBQJeREfJAAoJEAy6CFdfg3Lf0sQP/3CCIesW9hqBxbcy9E7RYpfD
+P/MPZ7WpCfOlvgzo3BuDvQGp1WTV+53RP0RPvttSeFnI0clEd6Er4oYE9MmcLjc7
+URyNttUT/vIDbUDHR7ac6zdHM313Z3h30vKL8aEtClg3BhIOI4GJUilEaBeRgEY8
+KYxGvH5M4mmBYDSkELayp/a1El8QEia1sivSerBs/zZQjqUoogmQ0f1pqZUx0nTC
+A+GowpYniz6FEkIRpGVRFuOFbFEuHWMLU33OSxpvHAf/0x1D5wkRJ4EHFFcYhrLu
+T1FvOQGSbUVUXi81bzOhwQOVzZdPk0rc5Q8SLqTefcjNjTIJ+MAxCV1qxv8xpM/X
+VtuyrtJLrDTcqa2hqhHfMVQUcRwSnmotic81GJ1BFowMZCNRgyaCWP+K7KI7OCLF
+ajPmG+Yr/eDao3JavCME6OdLLS/ARTK/JtR1YOS+kPeaBKjkVtXM9y6kGsUuzXIR
+8cyAvlBAIKiFrLWhV44emOEDhzxS9bbgTGQEEQNP6blDjMcNe5PpbZ1opDv9F3kc
+Ga4h0/XZmYrijn0NvzG1szBD8j+vatHlQVaQtw7t7Rt+jMF9TtOTgQy8MD+h3hSx
+1J8GDFlXHGbYdnRnBZWGHeJ1fZaqTpY4D4erDfOHXjH4kCm3Y7Zlaj6eDb0NMzkr
+umorBypPT9mnce2aS43h
+=jxUB
+-----END PGP SIGNATURE-----

krb5.spec

@@ -1,13 +1,14 @@
 %global _hardening_ldflags %{nil}
+%global WITH_DIRSRV 1
 
 Name:     krb5
-Version:  1.17
+Version:  1.18
-Release:  9
+Release:  2
 Summary:  The Kerberos network authentication protocol
 License:  MIT
 URL:      http://web.mit.edu/kerberos/www/
-Source0:  https://web.mit.edu/kerberos/dist/krb5/1.17/%{name}-%{version}.tar.gz
+Source0:  https://web.mit.edu/kerberos/dist/krb5/1.18/%{name}-%{version}.tar.gz
-Source1:  https://web.mit.edu/kerberos/dist/krb5/1.17/%{name}-%{version}.tar.gz.asc
+Source1:  https://web.mit.edu/kerberos/dist/krb5/1.18/%{name}-%{version}.tar.gz.asc
 Source2:  kprop.service
 Source3:  kadmin.service
 Source4:  krb5kdc.service
@@ -17,12 +18,14 @@ Source7:  kadm5.acl
 Source11: ksu.pamd
 Source12: krb5kdc.logrotate
 Source13: kadmind.logrotate
-Patch0: krb5-1.12.1-pam.patch
+Source100: noport.c 
-Patch1: krb5-1.15.1-selinux-label.patch
+Patch0: ksu-pam-integration.patch
-Patch2: krb5-1.12-ksu-path.patch
+Patch1: SELinux-integration.patch
-Patch3: krb5-1.12-ktany.patch
+Patch2: Adjust-build-configuration.patch
-Patch4: krb5-1.3.1-dns.patch
+Patch3: netlib-and-dns.patch
-Patch5: krb5-1.12-api.patch
+Patch4: fix-debuginfo-with-y.tab.c.patch
+Patch5: Remove-3des-support.patch
+Patch6: FIPS-with-PRNG-and-RADIUS-and-MD4.patch
 
 BuildRequires:  gcc make automake autoconf pkgconfig pam-devel libselinux-devel byacc
 BuildRequires:  libcom_err-devel openssl-devel openldap-devel libss-devel libverto-module-base
@@ -31,6 +34,7 @@ BuildRequires:  libcom_err-devel openssl-devel openldap-devel libss-devel libver
 BuildRequires: perl-interpreter dejagnu python3 tcl-devel
 BuildRequires: net-tools rpcbind hostname iproute libverto-devel
 BuildRequires: nss_wrapper socket_wrapper keyutils, keyutils-libs-devel
+BuildRequires: lmdb-devel
 
 Obsoletes:     libkadm5 < %{version}-%{release}
 Provides:      libkadm5 = %{version}-%{release}
@@ -97,28 +101,48 @@ autoreconf -fiv
 popd
 
 %build
+source %{_libdir}/tclConfig.sh
 pushd src
+
+# Set this so that configure will have a value even if the current version of
+# autoconf doesn't set one.
+export runstatedir=%{_localstatedir}/run
+# Work out the CFLAGS and CPPFLAGS which we intend to use.
+INCLUDES=-I%{_includedir}/et
+CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC -fno-strict-aliasing -fstack-protector-all`"
+CPPFLAGS="`echo $DEFINES $INCLUDES`"
 %configure \
+    CC="%{__cc}" \
+    CFLAGS="$CFLAGS" \
+    CPPFLAGS="$CPPFLAGS" \
+    SS_LIB="-lss" \
     --enable-shared \
     --localstatedir=%{_var}/kerberos \
     --disable-rpath \
+    --without-krb5-config \
+    --with-system-et \
+    --with-system-ss \
     --with-netlib=-lresolv \
     --with-tcl \
     --enable-dns-for-realm \
     --with-ldap \
+%if %{WITH_DIRSRV}
+    --with-dirsrv-account-locking \
+%endif
     --enable-pkinit \
     --with-crypto-impl=openssl \
     --with-tls-impl=openssl \
     --with-system-verto \
-    --with-prng-alg=os \
-    --with-system-et \
-    --with-system-ss \
     --with-pam \
     --with-selinux \
-    --without-krb5-config
+    --with-prng-alg=os \
+    --with-lmdb \
+    || (cat config.log; exit 1)
 
 %make_build
 popd
+# We need to cut off any access to locally-running nameservers, too.
+%{__cc} -fPIC -shared -o noport.so -Wall -Wextra %{SOURCE100}
 
 %install
 pushd src
@@ -238,6 +262,7 @@ make -C src check || :
 %{_libdir}/krb5/plugins/preauth/pkinit.so
 %{_libdir}/krb5/plugins/kdb/db2.so
 %{_libdir}/krb5/plugins/kdb/kldap.so
+%{_libdir}/krb5/plugins/kdb/klmdb.so
 %{_libdir}/libkdb_ldap.so
 %{_libdir}/libkdb_ldap.so.*
 %{_sbindir}/kdb5_ldap_util
@@ -291,6 +316,12 @@ make -C src check || :
 %{_mandir}/man8/*
 
 %changelog
+* Wed Apr 29 2020 steven<steven_ygui@163.com> - 1.18-2
+- Fix parameters in kdc.conf of version 1.18
+
+* Fri Apr 24 2020 steven<steven_ygui@163.com> - 1.18-1
+- Upgrade upstream to 1.18
+
 * Mon Feb 17 2020 openEuler Buildteam <buildteam@openeuler.org> - 1.17-9
 - add krb5-libs containing some commands and dynamic library
 

ksu-pam-integration.patch

@@ -1,13 +1,11 @@
-From 4cbb4325a86d1d71fa45d254221ec460c41b434d Mon Sep 17 00:00:00 2001
+From 9a082e1e02ae4efd2404d0672d38b3d4eb2d6660 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:29:58 -0400
-Subject: [PATCH] krb5-1.12.1-pam.patch
+Subject: [PATCH] [downstream] ksu pam integration
 
-Modify ksu so that it performs account and session management on behalf
+Modify ksu so that it performs account and session management on behalf of
-of
+the target user account, mimicking the action of regular su.  The default
-the target user account, mimicking the action of regular su.  The
+service name is "ksu", because on  at least the configuration used
-default
-service name is "ksu", because on Fedora at least the configuration used
 is determined by whether or not a login shell is being opened, and so
 this may need to vary, too.  At run-time, ksu's behavior can be reset to
 the earlier, non-PAM behavior by setting "use_pam" to false in the [ksu]
@@ -15,30 +13,31 @@ section of /etc/krb5.conf.
 
 When enabled, ksu gains a dependency on libpam.
 
-Originally RT#5939, though it's changed since then to perform the
+Originally RT#5939, though it's changed since then to perform the account
-account
+and session management before dropping privileges, and to apply on top of
-and session management before dropping privileges, and to apply on top
-of
 changes we're proposing for how it handles cache collections.
+
+Last-updated: krb5-1.18-beta1
 ---
- src/aclocal.m4              |  67 +++++++
+ src/aclocal.m4              |  69 +++++++
  src/clients/ksu/Makefile.in |   8 +-
- src/clients/ksu/main.c      |  87 +++++++-
+ src/clients/ksu/main.c      |  88 +++++++-
  src/clients/ksu/pam.c       | 389 ++++++++++++++++++++++++++++++++++++
  src/clients/ksu/pam.h       |  57 ++++++
- src/configure.in            |   2 +
+ src/configure.ac            |   2 +
- 6 files changed, 607 insertions(+), 3 deletions(-)
+ 6 files changed, 610 insertions(+), 3 deletions(-)
  create mode 100644 src/clients/ksu/pam.c
  create mode 100644 src/clients/ksu/pam.h
 
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index 3752d9b..340546d 100644
+index 2394f7e33..830203683 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
-@@ -1697,3 +1697,70 @@ AC_DEFUN(KRB5_AC_PERSISTENT_KEYRING,[
+@@ -1675,3 +1675,72 @@ if test "$with_ldap" = yes; then
-       ]))
+   OPENLDAP_PLUGIN=yes
+ fi
  ])dnl
- dnl
++dnl
 +dnl
 +dnl Use PAM instead of local crypt() compare for checking local passwords,
 +dnl and perform PAM account, session management, and password-changing where
@@ -106,12 +105,13 @@ index 3752d9b..340546d 100644
 +AC_SUBST(PAM_MAN)
 +AC_SUBST(NON_PAM_MAN)
 +])dnl
++
 diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in
-index b2fcbf2..5755bb5 100644
+index 8b4edce4d..9d58f29b5 100644
 --- a/src/clients/ksu/Makefile.in
 +++ b/src/clients/ksu/Makefile.in
 @@ -3,12 +3,14 @@ BUILDTOP=$(REL)..$(S)..
- DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/bin /local/bin"'
+ DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/usr/local/sbin /usr/local/bin /sbin /bin /usr/sbin /usr/bin"'
  
  KSU_LIBS=@KSU_LIBS@
 +PAM_LIBS=@PAM_LIBS@
@@ -145,7 +145,7 @@ index b2fcbf2..5755bb5 100644
  clean:
  	$(RM) ksu
 diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
-index d9596d9..016ec24 100644
+index 4f03dd8ed..21a4d02bb 100644
 --- a/src/clients/ksu/main.c
 +++ b/src/clients/ksu/main.c
 @@ -26,6 +26,7 @@
@@ -175,7 +175,7 @@ index d9596d9..016ec24 100644
  /***********/
  
  #define KS_TEMPORARY_CACHE "MEMORY:_ksu"
-@@ -528,6 +534,23 @@ main (argc, argv)
+@@ -535,6 +541,23 @@ main (argc, argv)
                 prog_name,target_user,client_name,
                 source_user,ontty());
  
@@ -199,7 +199,7 @@ index d9596d9..016ec24 100644
          /* Run authorization as target.*/
          if (krb5_seteuid(target_uid)) {
              com_err(prog_name, errno, _("while switching to target for "
-@@ -588,6 +611,24 @@ main (argc, argv)
+@@ -595,6 +618,24 @@ main (argc, argv)
  
              exit(1);
          }
@@ -224,10 +224,10 @@ index d9596d9..016ec24 100644
      }
  
      if( some_rest_copy){
-@@ -644,6 +685,29 @@ main (argc, argv)
+@@ -652,6 +693,30 @@ main (argc, argv)
-         fprintf(stderr, _("ksu: couldn't set environment variable SHELL\n"));
          exit(1);
      }
+ 
 +#ifdef USE_PAM
 +    if (appl_pam_enabled(ksu_context, "ksu")) {
 +        if (appl_pam_session_open() != 0) {
@@ -251,10 +251,11 @@ index d9596d9..016ec24 100644
 +#endif
 +    }
 +#endif
- 
++
      /* set permissions */
      if (setgid(target_pwd->pw_gid) < 0) {
-@@ -742,7 +806,7 @@ main (argc, argv)
+         perror("ksu: setgid");
+@@ -749,7 +814,7 @@ main (argc, argv)
          fprintf(stderr, "program to be execed %s\n",params[0]);
      }
  
@@ -263,7 +264,7 @@ index d9596d9..016ec24 100644
          execv(params[0], params);
          com_err(prog_name, errno, _("while trying to execv %s"), params[0]);
          sweep_up(ksu_context, cc_target);
-@@ -772,16 +836,35 @@ main (argc, argv)
+@@ -779,16 +844,35 @@ main (argc, argv)
              if (ret_pid == -1) {
                  com_err(prog_name, errno, _("while calling waitpid"));
              }
@@ -302,7 +303,7 @@ index d9596d9..016ec24 100644
      }
 diff --git a/src/clients/ksu/pam.c b/src/clients/ksu/pam.c
 new file mode 100644
-index 0000000..cbfe487
+index 000000000..cbfe48704
 --- /dev/null
 +++ b/src/clients/ksu/pam.c
 @@ -0,0 +1,389 @@
@@ -697,7 +698,7 @@ index 0000000..cbfe487
 +#endif
 diff --git a/src/clients/ksu/pam.h b/src/clients/ksu/pam.h
 new file mode 100644
-index 0000000..0ab7656
+index 000000000..0ab76569c
 --- /dev/null
 +++ b/src/clients/ksu/pam.h
 @@ -0,0 +1,57 @@
@@ -758,11 +759,11 @@ index 0000000..0ab7656
 +int appl_pam_cred_init(void);
 +void appl_pam_cleanup(void);
 +#endif
-diff --git a/src/configure.in b/src/configure.in
+diff --git a/src/configure.ac b/src/configure.ac
-index 61ef738..e9a12ac 100644
+index 234f4281c..d1f576124 100644
---- a/src/configure.in
+--- a/src/configure.ac
-+++ b/src/configure.in
++++ b/src/configure.ac
-@@ -1352,6 +1352,8 @@ AC_SUBST([VERTO_VERSION])
+@@ -1390,6 +1390,8 @@ AC_SUBST([VERTO_VERSION])
  
  AC_PATH_PROG(GROFF, groff)
  
@@ -771,6 +772,3 @@ index 61ef738..e9a12ac 100644
  # Make localedir work in autoconf 2.5x.
  if test "${localedir+set}" != set; then
      localedir='$(datadir)/locale'
--- 
-2.19.1
-

netlib-and-dns.patch

@@ -1,18 +1,20 @@
-From 2338e73d8dced4f85d6b4f5a0f7df21033ac78c1 Mon Sep 17 00:00:00 2001
+From 40553473b674dfbb6328389b6b39ebe3218ed597 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:46:21 -0400
-Subject: [PATCH] krb5-1.3.1-dns.patch
+Subject: [PATCH] [downstream] netlib and dns
 
 We want to be able to use --with-netlib and --enable-dns at the same time.
+
+Last-updated: krb5-1.3.1
 ---
  src/aclocal.m4 | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index 6257dba40..5eeaa2d8a 100644
+index 6796fec53..c4358988a 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
-@@ -726,6 +726,7 @@ AC_HELP_STRING([--with-netlib=LIBS], use user defined resolver library),
+@@ -724,6 +724,7 @@ AC_HELP_STRING([--with-netlib=LIBS], use user defined resolver library),
  	LIBS="$LIBS $withval"
  	AC_MSG_RESULT("netlib will use \'$withval\'")
    fi

noport.c

@@ -0,0 +1,111 @@
+#define _GNU_SOURCE
+#include <sys/socket.h>
+#include <dlfcn.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#include <netinet/in.h>
+
+static int
+port_is_okay(unsigned short port)
+{
+	char *p, *q;
+	long l;
+
+	p = getenv("NOPORT");
+	while ((p != NULL) && (*p != '\0')) {
+		l = strtol(p, &q, 10);
+		if ((q == NULL) || (q == p)) {
+			break;
+		}
+		if ((*q == '\0') || (*q == ',')) {
+			if (port == l) {
+				errno = ECONNREFUSED;
+				return -1;
+			}
+		}
+		p = q;
+		p += strspn(p, ",");
+	}
+	return 0;
+}
+
+int
+connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
+{
+	unsigned short port;
+	static int (*next_connect)(int, const struct sockaddr *, socklen_t);
+
+	if (next_connect == NULL) {
+		next_connect = dlsym(RTLD_NEXT, "connect");
+		if (next_connect == NULL) {
+			errno = ENOSYS;
+			return -1;
+		}
+	}
+
+	if (getenv("NOPORT") == NULL) {
+		return next_connect(sockfd, addr, addrlen);
+	}
+
+	switch (addr->sa_family) {
+	case AF_INET:
+		port = ntohs(((struct sockaddr_in *)addr)->sin_port);
+		if (port_is_okay(port) != 0) {
+			return -1;
+		}
+		break;
+	case AF_INET6:
+		port = ntohs(((struct sockaddr_in6 *)addr)->sin6_port);
+		if (port_is_okay(port) != 0) {
+			return -1;
+		}
+		break;
+	default:
+		break;
+	}
+	return next_connect(sockfd, addr, addrlen);
+}
+
+ssize_t
+sendto(int sockfd, const void *buf, size_t len, int flags,
+       const struct sockaddr *dest_addr, socklen_t addrlen)
+{
+	unsigned short port;
+	static int (*next_sendto)(int, const void *, size_t, int,
+				  const struct sockaddr *, socklen_t);
+
+	if (next_sendto == NULL) {
+		next_sendto = dlsym(RTLD_NEXT, "sendto");
+		if (next_sendto == NULL) {
+			errno = ENOSYS;
+			return -1;
+		}
+	}
+
+	if (getenv("NOPORT") == NULL) {
+		return next_sendto(sockfd, buf, len, flags, dest_addr, addrlen);
+	}
+
+	if (dest_addr != NULL) {
+		switch (dest_addr->sa_family) {
+		case AF_INET:
+			port = ((struct sockaddr_in *)dest_addr)->sin_port;
+			port = ntohs(port);
+			if (port_is_okay(port) != 0) {
+				return -1;
+			}
+			break;
+		case AF_INET6:
+			port = ((struct sockaddr_in6 *)dest_addr)->sin6_port;
+			port = ntohs(port);
+			if (port_is_okay(port) != 0) {
+				return -1;
+			}
+			break;
+		default:
+			break;
+		}
+	}
+	return next_sendto(sockfd, buf, len, flags, dest_addr, addrlen);
+}