net/samba413: Backport security fix from 4.14.14

* Add upstream patch to fix configure error with Python 3.11.
* Fix plist error when AD_DC option is off and PYTHON3 option is on.
* Replace BIND911 option with BIND918 as dns/bind911 is removed from
  ports tree and dns/bind918 is added instead.

PR:		266641
Approved by:	maintainer timeout
MFH:		2022Q4
Security:	f9140ad4-4920-11ed-a07e-080027f5fec9

9 files changed, 17376 insertions, 6 deletions

diff --git a/net/samba413/Makefile b/net/samba413/Makefile
index f1dea1c15f3d..ccbb438ecb6a 100644
--- a/net/samba413/Makefile
+++ b/net/samba413/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=			${SAMBA4_BASENAME}413
 PORTVERSION=			${SAMBA4_VERSION}
-PORTREVISION=			1
+PORTREVISION=			2
 CATEGORIES?=			net
 MASTER_SITES=			SAMBA/samba/stable SAMBA/samba/rc
 DISTNAME=			${SAMBA4_DISTNAME}
@@ -96,7 +96,7 @@ OPTIONS_SINGLE_GSSAPI=		GSSAPI_BUILTIN GSSAPI_MIT
 OPTIONS_SINGLE_ZEROCONF=	ZEROCONF_NONE AVAHI MDNSRESPONDER
 
 OPTIONS_RADIO=			DNS
-OPTIONS_RADIO_DNS=		NSUPDATE BIND911 BIND916
+OPTIONS_RADIO_DNS=		NSUPDATE BIND916 BIND918
 # Make those default options
 OPTIONS_DEFAULT=		AD_DC ADS DOCS FAM LDAP \
 				PROFILE PYTHON3 QUOTAS SYSLOG UTMP \
@@ -129,8 +129,8 @@ ZEROCONF_DESC=			Zero configuration networking
 ZEROCONF_NONE_DESC=		Zeroconf support is absent
 
 DNS_DESC=			DNS frontend
-BIND911_DESC=			Use Bind 9.11 as AD DC DNS server frontend
 BIND916_DESC=			Use Bind 9.16 as AD DC DNS server frontend
+BIND918_DESC=			Use Bind 9.18 as AD DC DNS server frontend
 NSUPDATE_DESC=			Use samba NSUPDATE utility for AD DC
 ##############################################################################
 # XXX: Unconditional dependencies which can't be switched off(if present in
@@ -299,8 +299,8 @@ MDNSRESPONDER_CONFIGURE_ENABLE=	dnssd
 MDNSRESPONDER_LIB_DEPENDS=	libdns_sd.so:net/mDNSResponder
 MDNSRESPONDER_VARS=		SAMBA4_SERVICES+=mdnsd
 ##############################################################################
-BIND911_RUN_DEPENDS=		bind911>=9.11.0.0:dns/bind911
 BIND916_RUN_DEPENDS=		bind916>=9.16.0.0:dns/bind916
+BIND918_RUN_DEPENDS=		bind918>=9.18.0.0:dns/bind918
 NSUPDATE_RUN_DEPENDS=		samba-nsupdate:dns/samba-nsupdate
 ##############################################################################
 MEMORY_DEBUG_IMPLIES=		DEBUG
diff --git a/net/samba413/files/patch-samba-4.14.14 b/net/samba413/files/patch-samba-4.14.14
new file mode 100644
index 000000000000..4127ab67308e
--- /dev/null
+++ b/net/samba413/files/patch-samba-4.14.14
@@ -0,0 +1,13366 @@
+From 5d958156c7e5d6c1da61d18fe4fd105b22639b56 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 14 Jun 2022 21:09:53 +1200
+Subject: [PATCH 01/99] CVE-2022-32746 s4/dsdb/objectclass_attrs: Fix typo
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ source4/dsdb/samdb/ldb_modules/objectclass_attrs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git source4/dsdb/samdb/ldb_modules/objectclass_attrs.c source4/dsdb/samdb/ldb_modules/objectclass_attrs.c
+index 6ab46a729a2..2a77353cdfc 100644
+--- source4/dsdb/samdb/ldb_modules/objectclass_attrs.c
++++ source4/dsdb/samdb/ldb_modules/objectclass_attrs.c
+@@ -263,7 +263,7 @@ static int attr_handler(struct oc_context *ac)
+ 												LDB_CONTROL_AS_SYSTEM_OID);
+ 					if (!dsdb_module_am_system(ac->module) && !as_system) {
+ 						ldb_asprintf_errstring(ldb,
+-								       "objectclass_attrs: attribute '%s' on entry '%s' must can only be modified as system",
++								       "objectclass_attrs: attribute '%s' on entry '%s' can only be modified as system",
+ 								       msg->elements[i].name,
+ 								       ldb_dn_get_linearized(msg->dn));
+ 						return LDB_ERR_CONSTRAINT_VIOLATION;
+-- 
+2.25.1
+
+
+From 51cbeff886fe01db463448f8655a43d10040dc8b Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 21 Jun 2022 15:37:15 +1200
+Subject: [PATCH 02/99] CVE-2022-32746 s4:dsdb:tests: Add test for deleting a
+ disallowed SPN
+
+If an account has an SPN that requires Write Property to set, we should
+still be able to delete it with just Validated Write.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ selftest/knownfail.d/acl-spn-delete |  1 +
+ source4/dsdb/tests/python/acl.py    | 26 ++++++++++++++++++++++++++
+ 2 files changed, 27 insertions(+)
+ create mode 100644 selftest/knownfail.d/acl-spn-delete
+
+diff --git selftest/knownfail.d/acl-spn-delete selftest/knownfail.d/acl-spn-delete
+new file mode 100644
+index 00000000000..32018413c49
+--- /dev/null
++++ selftest/knownfail.d/acl-spn-delete
+@@ -0,0 +1 @@
++^samba4.ldap.acl.python.*__main__.AclSPNTests.test_delete_disallowed_spn\(
+diff --git source4/dsdb/tests/python/acl.py source4/dsdb/tests/python/acl.py
+index df0fe12bf29..d90d3b3923f 100755
+--- source4/dsdb/tests/python/acl.py
++++ source4/dsdb/tests/python/acl.py
+@@ -2286,6 +2286,32 @@ class AclSPNTests(AclTests):
+         else:
+             self.fail(f'able to add disallowed SPN {not_allowed_spn}')
+ 
++    def test_delete_disallowed_spn(self):
++        # Grant Validated-SPN property.
++        mod = f'(OA;;SW;{security.GUID_DRS_VALIDATE_SPN};;{self.user_sid1})'
++        self.sd_utils.dacl_add_ace(self.computerdn, mod)
++
++        spn_base = f'HOST/{self.computername}'
++
++        not_allowed_spn = f'{spn_base}/{self.dcctx.get_domain_name()}'
++
++        # Add a disallowed SPN as admin.
++        msg = Message(Dn(self.ldb_admin, self.computerdn))
++        msg['servicePrincipalName'] = MessageElement(not_allowed_spn,
++                                                     FLAG_MOD_ADD,
++                                                     'servicePrincipalName')
++        self.ldb_admin.modify(msg)
++
++        # Ensure we are able to delete a disallowed SPN.
++        msg = Message(Dn(self.ldb_user1, self.computerdn))
++        msg['servicePrincipalName'] = MessageElement(not_allowed_spn,
++                                                     FLAG_MOD_DELETE,
++                                                     'servicePrincipalName')
++        try:
++            self.ldb_user1.modify(msg)
++        except LdbError:
++            self.fail(f'unable to delete disallowed SPN {not_allowed_spn}')
++
+ 
+ # tests SEC_ADS_LIST vs. SEC_ADS_LIST_OBJECT
+ @DynamicTestCase
+-- 
+2.25.1
+
+
+From a68553792a8512a2d266bbb86f064f78b5482a65 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 21 Jun 2022 14:41:02 +1200
+Subject: [PATCH 03/99] CVE-2022-32746 s4/dsdb/partition: Fix LDB flags
+ comparison
+
+LDB_FLAG_MOD_* values are not actually flags, and the previous
+comparison was equivalent to
+
+(req_msg->elements[el_idx].flags & LDB_FLAG_MOD_MASK) != 0
+
+which is true whenever any of the LDB_FLAG_MOD_* values are set. Correct
+the expression to what it was probably intended to be.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ source4/dsdb/samdb/ldb_modules/partition.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git source4/dsdb/samdb/ldb_modules/partition.c source4/dsdb/samdb/ldb_modules/partition.c
+index 2544a106d13..2d90ca5d1b3 100644
+--- source4/dsdb/samdb/ldb_modules/partition.c
++++ source4/dsdb/samdb/ldb_modules/partition.c
+@@ -493,8 +493,8 @@ static int partition_copy_all_callback_action(
+ 			 * them here too
+ 			 */
+ 			for (el_idx=0; el_idx < req_msg->num_elements; el_idx++) {
+-				if (req_msg->elements[el_idx].flags & LDB_FLAG_MOD_DELETE
+-				    || ((req_msg->elements[el_idx].flags & LDB_FLAG_MOD_REPLACE) &&
++				if (LDB_FLAG_MOD_TYPE(req_msg->elements[el_idx].flags) == LDB_FLAG_MOD_DELETE
++				    || ((LDB_FLAG_MOD_TYPE(req_msg->elements[el_idx].flags) == LDB_FLAG_MOD_REPLACE) &&
+ 					req_msg->elements[el_idx].num_values == 0)) {
+ 					if (ldb_msg_find_element(modify_msg,
+ 								 req_msg->elements[el_idx].name) != NULL) {
+-- 
+2.25.1
+
+
+From 582ac171364f0c28f54eaf4f21b5bfa7569b5233 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 21 Jun 2022 14:49:51 +1200
+Subject: [PATCH 04/99] CVE-2022-32746 s4:torture: Fix LDB flags comparison
+
+LDB_FLAG_MOD_* values are not actually flags, and the previous
+comparison was equivalent to
+
+(el->flags & LDB_FLAG_MOD_MASK) == 0
+
+which is only true if none of the LDB_FLAG_MOD_* values are set. Correct
+the expression to what it was probably intended to be.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ source4/torture/drs/rpc/dssync.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git source4/torture/drs/rpc/dssync.c source4/torture/drs/rpc/dssync.c
+index cde9f78692b..ff7ce2d9074 100644
+--- source4/torture/drs/rpc/dssync.c
++++ source4/torture/drs/rpc/dssync.c
+@@ -527,7 +527,9 @@ static bool test_analyse_objects(struct torture_context *tctx,
+ 				el = &new_msg->elements[idx];
+ 				a = dsdb_attribute_by_lDAPDisplayName(ldap_schema,
+ 				                                      el->name);
+-				if (!(el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE))) {
++				if (LDB_FLAG_MOD_TYPE(el->flags) != LDB_FLAG_MOD_ADD &&
++				    LDB_FLAG_MOD_TYPE(el->flags) != LDB_FLAG_MOD_REPLACE)
++				{
+ 					/* DRS only value */
+ 					is_warning = false;
+ 				} else if (a->linkID & 1) {
+-- 
+2.25.1
+
+
+From 0526d27e9eddd9c2a54434cf0dcdb136a6c659e4 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 21 Jun 2022 15:22:47 +1200
+Subject: [PATCH 05/99] CVE-2022-32746 s4/dsdb/acl: Fix LDB flags comparison
+
+LDB_FLAG_MOD_* values are not actually flags, and the previous
+comparison was equivalent to
+
+(el->flags & LDB_FLAG_MOD_MASK) == 0
+
+which is only true if none of the LDB_FLAG_MOD_* values are set, so we
+would not successfully return if the element was a DELETE. Correct the
+expression to what it was intended to be.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ selftest/knownfail.d/acl-spn-delete  | 1 -
+ source4/dsdb/samdb/ldb_modules/acl.c | 5 +++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+ delete mode 100644 selftest/knownfail.d/acl-spn-delete
+
+diff --git selftest/knownfail.d/acl-spn-delete selftest/knownfail.d/acl-spn-delete
+deleted file mode 100644
+index 32018413c49..00000000000
+--- selftest/knownfail.d/acl-spn-delete
++++ /dev/null
+@@ -1 +0,0 @@
+-^samba4.ldap.acl.python.*__main__.AclSPNTests.test_delete_disallowed_spn\(
+diff --git source4/dsdb/samdb/ldb_modules/acl.c source4/dsdb/samdb/ldb_modules/acl.c
+index 21e83276bfd..8016a2d4bd0 100644
+--- source4/dsdb/samdb/ldb_modules/acl.c
++++ source4/dsdb/samdb/ldb_modules/acl.c
+@@ -734,8 +734,9 @@ static int acl_check_spn(TALLOC_CTX *mem_ctx,
+ 		 * If not add or replace (eg delete),
+ 		 * return success
+ 		 */
+-		if ((el->flags
+-		     & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE)) == 0) {
++		if (LDB_FLAG_MOD_TYPE(el->flags) != LDB_FLAG_MOD_ADD &&
++		    LDB_FLAG_MOD_TYPE(el->flags) != LDB_FLAG_MOD_REPLACE)
++		{
+ 			talloc_free(tmp_ctx);
+ 			return LDB_SUCCESS;
+ 		}
+-- 
+2.25.1
+
+
+From 2869b5aa3148869edf0d079266542aef6e64608e Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 16 Feb 2022 12:43:52 +1300
+Subject: [PATCH 06/99] CVE-2022-32746 ldb:rdn_name: Use LDB_FLAG_MOD_TYPE()
+ for flags equality check
+
+Now unrelated flags will no longer affect the result.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ lib/ldb/modules/rdn_name.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git lib/ldb/modules/rdn_name.c lib/ldb/modules/rdn_name.c
+index e69ad9315ae..25cffe07591 100644
+--- lib/ldb/modules/rdn_name.c
++++ lib/ldb/modules/rdn_name.c
+@@ -545,7 +545,7 @@ static int rdn_name_modify(struct ldb_module *module, struct ldb_request *req)
+ 	if (e != NULL) {
+ 		ldb_asprintf_errstring(ldb, "Modify of 'distinguishedName' on %s not permitted, must use 'rename' operation instead",
+ 				       ldb_dn_get_linearized(req->op.mod.message->dn));
+-		if (e->flags == LDB_FLAG_MOD_REPLACE) {
++		if (LDB_FLAG_MOD_TYPE(e->flags) == LDB_FLAG_MOD_REPLACE) {
+ 			return LDB_ERR_CONSTRAINT_VIOLATION;
+ 		} else {
+ 			return LDB_ERR_UNWILLING_TO_PERFORM;
+-- 
+2.25.1
+
+
+From 535b5a366a2ad054f729e57e282e402cf13b2efc Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 14 Jun 2022 19:49:19 +1200
+Subject: [PATCH 07/99] CVE-2022-32746 s4/dsdb/repl_meta_data: Use
+ LDB_FLAG_MOD_TYPE() for flags equality check
+
+Now unrelated flags will no longer affect the result.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ source4/dsdb/samdb/ldb_modules/repl_meta_data.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git source4/dsdb/samdb/ldb_modules/repl_meta_data.c source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+index ab506cec488..29ffda75c87 100644
+--- source4/dsdb/samdb/ldb_modules/repl_meta_data.c
++++ source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+@@ -3525,7 +3525,7 @@ static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
+ 			return ldb_module_operr(module);
+ 		}
+ 
+-		if (req->op.mod.message->elements[0].flags != LDB_FLAG_MOD_REPLACE) {
++		if (LDB_FLAG_MOD_TYPE(req->op.mod.message->elements[0].flags) != LDB_FLAG_MOD_REPLACE) {
+ 			return ldb_module_operr(module);
+ 		}
+ 
+@@ -3558,11 +3558,11 @@ static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
+ 			return ldb_module_operr(module);
+ 		}
+ 
+-		if (req->op.mod.message->elements[0].flags != LDB_FLAG_MOD_DELETE) {
++		if (LDB_FLAG_MOD_TYPE(req->op.mod.message->elements[0].flags) != LDB_FLAG_MOD_DELETE) {
+ 			return ldb_module_operr(module);
+ 		}
+ 
+-		if (req->op.mod.message->elements[1].flags != LDB_FLAG_MOD_ADD) {
++		if (LDB_FLAG_MOD_TYPE(req->op.mod.message->elements[1].flags) != LDB_FLAG_MOD_ADD) {
+ 			return ldb_module_operr(module);
+ 		}
+ 
+@@ -3645,7 +3645,7 @@ static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
+ 			return ldb_module_operr(module);
+ 		}
+ 
+-		if (msg->elements[0].flags != LDB_FLAG_MOD_ADD) {
++		if (LDB_FLAG_MOD_TYPE(msg->elements[0].flags) != LDB_FLAG_MOD_ADD) {
+ 			talloc_free(ac);
+ 			return ldb_module_operr(module);
+ 		}
+-- 
+2.25.1
+
+
+From bedd0b768c3f92645af033399aefd7ee971d9150 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 14 Jun 2022 21:11:33 +1200
+Subject: [PATCH 08/99] CVE-2022-32746 s4/dsdb/tombstone_reanimate: Use
+ LDB_FLAG_MOD_TYPE() for flags equality check
+
+Now unrelated flags will no longer affect the result.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ source4/dsdb/samdb/ldb_modules/tombstone_reanimate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git source4/dsdb/samdb/ldb_modules/tombstone_reanimate.c source4/dsdb/samdb/ldb_modules/tombstone_reanimate.c
+index 64e05195798..5f8911c66be 100644
+--- source4/dsdb/samdb/ldb_modules/tombstone_reanimate.c
++++ source4/dsdb/samdb/ldb_modules/tombstone_reanimate.c
+@@ -104,7 +104,7 @@ static bool is_tombstone_reanimate_request(struct ldb_request *req,
+ 	if (el_dn == NULL) {
+ 		return false;
+ 	}
+-	if (el_dn->flags != LDB_FLAG_MOD_REPLACE) {
++	if (LDB_FLAG_MOD_TYPE(el_dn->flags) != LDB_FLAG_MOD_REPLACE) {
+ 		return false;
+ 	}
+ 	if (el_dn->num_values != 1) {
+@@ -117,7 +117,7 @@ static bool is_tombstone_reanimate_request(struct ldb_request *req,
+ 		return false;
+ 	}
+ 
+-	if (el_deleted->flags != LDB_FLAG_MOD_DELETE) {
++	if (LDB_FLAG_MOD_TYPE(el_deleted->flags) != LDB_FLAG_MOD_DELETE) {
+ 		return false;
+ 	}
+ 
+-- 
+2.25.1
+
+
+From 49dd9042f4ee380fa1dafcebcb54d0e1f0852463 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 14 Jun 2022 21:12:39 +1200
+Subject: [PATCH 09/99] CVE-2022-32746 s4/registry: Use LDB_FLAG_MOD_TYPE() for
+ flags equality check
+
+Now unrelated flags will no longer affect the result.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ source4/lib/registry/ldb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git source4/lib/registry/ldb.c source4/lib/registry/ldb.c
+index e089355975b..db383a560da 100644
+--- source4/lib/registry/ldb.c
++++ source4/lib/registry/ldb.c
+@@ -859,7 +859,7 @@ static WERROR ldb_set_value(struct hive_key *parent,
+ 
+ 	/* Try first a "modify" and if this doesn't work do try an "add" */
+ 	for (i = 0; i < msg->num_elements; i++) {
+-		if (msg->elements[i].flags != LDB_FLAG_MOD_DELETE) {
++		if (LDB_FLAG_MOD_TYPE(msg->elements[i].flags) != LDB_FLAG_MOD_DELETE) {
+ 			msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
+ 		}
+ 	}
+-- 
+2.25.1
+
+
+From faa61ab3053d077ac9d0aa67e955217e85b660f4 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Mon, 21 Feb 2022 16:10:32 +1300
+Subject: [PATCH 10/99] CVE-2022-32746 ldb: Add flag to mark message element
+ values as shared
+
+When making a shallow copy of an ldb message, mark the message elements
+of the copy as sharing their values with the message elements in the
+original message.
+
+This flag value will be heeded in the next commit.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ lib/ldb/common/ldb_msg.c     | 43 +++++++++++++++++++++++++++++++-----
+ lib/ldb/include/ldb_module.h |  6 +++++
+ 2 files changed, 43 insertions(+), 6 deletions(-)
+
+diff --git lib/ldb/common/ldb_msg.c lib/ldb/common/ldb_msg.c
+index 57dfc5a04c2..2a9ce384bb9 100644
+--- lib/ldb/common/ldb_msg.c
++++ lib/ldb/common/ldb_msg.c
+@@ -833,11 +833,7 @@ void ldb_msg_sort_elements(struct ldb_message *msg)
+ 		       ldb_msg_element_compare_name);
+ }
+ 
+-/*
+-  shallow copy a message - copying only the elements array so that the caller
+-  can safely add new elements without changing the message
+-*/
+-struct ldb_message *ldb_msg_copy_shallow(TALLOC_CTX *mem_ctx,
++static struct ldb_message *ldb_msg_copy_shallow_impl(TALLOC_CTX *mem_ctx,
+ 					 const struct ldb_message *msg)
+ {
+ 	struct ldb_message *msg2;
+@@ -863,6 +859,35 @@ failed:
+ 	return NULL;
+ }
+ 
++/*
++  shallow copy a message - copying only the elements array so that the caller
++  can safely add new elements without changing the message
++*/
++struct ldb_message *ldb_msg_copy_shallow(TALLOC_CTX *mem_ctx,
++					 const struct ldb_message *msg)
++{
++	struct ldb_message *msg2;
++	unsigned int i;
++
++	msg2 = ldb_msg_copy_shallow_impl(mem_ctx, msg);
++	if (msg2 == NULL) {
++		return NULL;
++	}
++
++	for (i = 0; i < msg2->num_elements; ++i) {
++		/*
++		 * Mark this message's elements as sharing their values with the
++		 * original message, so that we don't inadvertently modify or
++		 * free them. We don't mark the original message element as
++		 * shared, so the original message element should not be
++		 * modified or freed while the shallow copy lives.
++		 */
++		struct ldb_message_element *el = &msg2->elements[i];
++		el->flags |= LDB_FLAG_INTERNAL_SHARED_VALUES;
++	}
++
++        return msg2;
++}
+ 
+ /*
+   copy a message, allocating new memory for all parts
+@@ -873,7 +898,7 @@ struct ldb_message *ldb_msg_copy(TALLOC_CTX *mem_ctx,
+ 	struct ldb_message *msg2;
+ 	unsigned int i, j;
+ 
+-	msg2 = ldb_msg_copy_shallow(mem_ctx, msg);
++	msg2 = ldb_msg_copy_shallow_impl(mem_ctx, msg);
+ 	if (msg2 == NULL) return NULL;
+ 
+ 	if (msg2->dn != NULL) {
+@@ -894,6 +919,12 @@ struct ldb_message *ldb_msg_copy(TALLOC_CTX *mem_ctx,
+ 				goto failed;
+ 			}
+ 		}
++
++                /*
++                 * Since we copied this element's values, we can mark them as
++                 * not shared.
++		 */
++		el->flags &= ~LDB_FLAG_INTERNAL_SHARED_VALUES;
+ 	}
+ 
+ 	return msg2;
+diff --git lib/ldb/include/ldb_module.h lib/ldb/include/ldb_module.h
+index 8c1e5ee7936..4c7c85a17f0 100644
+--- lib/ldb/include/ldb_module.h
++++ lib/ldb/include/ldb_module.h
+@@ -96,6 +96,12 @@ struct ldb_module;
+  */
+ #define LDB_FLAG_INTERNAL_FORCE_UNIQUE_INDEX 0x100
+ 
++/*
++ * indicates that this element's values are shared with another element (for
++ * example, in a shallow copy of an ldb_message) and should not be freed
++ */
++#define LDB_FLAG_INTERNAL_SHARED_VALUES 0x200
++
+ /* an extended match rule that always fails to match */
+ #define SAMBA_LDAP_MATCH_ALWAYS_FALSE "1.3.6.1.4.1.7165.4.5.1"
+ 
+-- 
+2.25.1
+
+
+From 4e5fb78c3dcff60aa8fd4b07dad4660bbb30532b Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 16 Feb 2022 12:35:13 +1300
+Subject: [PATCH 11/99] CVE-2022-32746 ldb: Ensure shallow copy modifications
+ do not affect original message
+
+Using the newly added ldb flag, we can now detect when a message has
+been shallow-copied so that its elements share their values with the
+original message elements. Then when adding values to the copied
+message, we now make a copy of the shared values array first.
+
+This should prevent a use-after-free that occurred in LDB modules when
+new values were added to a shallow copy of a message by calling
+talloc_realloc() on the original values array, invalidating the 'values'
+pointer in the original message element. The original values pointer can
+later be used in the database audit logging module which logs database
+requests, and potentially cause a crash.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ lib/ldb/common/ldb_msg.c   | 52 ++++++++++++++++++++++++++++++++------
+ lib/ldb/include/ldb.h      |  6 +++++
+ source4/dsdb/common/util.c | 20 +++++----------
+ 3 files changed, 56 insertions(+), 22 deletions(-)
+
+diff --git lib/ldb/common/ldb_msg.c lib/ldb/common/ldb_msg.c
+index 2a9ce384bb9..44d3b29e9a7 100644
+--- lib/ldb/common/ldb_msg.c
++++ lib/ldb/common/ldb_msg.c
+@@ -417,6 +417,47 @@ int ldb_msg_add(struct ldb_message *msg,
+ 	return LDB_SUCCESS;
+ }
+ 
++/*
++ * add a value to a message element
++ */
++int ldb_msg_element_add_value(TALLOC_CTX *mem_ctx,
++			      struct ldb_message_element *el,
++			      const struct ldb_val *val)
++{
++	struct ldb_val *vals;
++
++	if (el->flags & LDB_FLAG_INTERNAL_SHARED_VALUES) {
++		/*
++		 * Another message is using this message element's values array,
++		 * so we don't want to make any modifications to the original
++		 * message, or potentially invalidate its own values by calling
++		 * talloc_realloc(). Make a copy instead.
++		 */
++		el->flags &= ~LDB_FLAG_INTERNAL_SHARED_VALUES;
++
++		vals = talloc_array(mem_ctx, struct ldb_val,
++				    el->num_values + 1);
++		if (vals == NULL) {
++			return LDB_ERR_OPERATIONS_ERROR;
++		}
++
++		if (el->values != NULL) {
++			memcpy(vals, el->values, el->num_values * sizeof(struct ldb_val));
++		}
++	} else {
++		vals = talloc_realloc(mem_ctx, el->values, struct ldb_val,
++				      el->num_values + 1);
++		if (vals == NULL) {
++			return LDB_ERR_OPERATIONS_ERROR;
++		}
++	}
++	el->values = vals;
++	el->values[el->num_values] = *val;
++	el->num_values++;
++
++	return LDB_SUCCESS;
++}
++
+ /*
+   add a value to a message
+ */
+@@ -426,7 +467,6 @@ int ldb_msg_add_value(struct ldb_message *msg,
+ 		      struct ldb_message_element **return_el)
+ {
+ 	struct ldb_message_element *el;
+-	struct ldb_val *vals;
+ 	int ret;
+ 
+ 	el = ldb_msg_find_element(msg, attr_name);
+@@ -437,14 +477,10 @@ int ldb_msg_add_value(struct ldb_message *msg,
+ 		}
+ 	}
+ 
+-	vals = talloc_realloc(msg->elements, el->values, struct ldb_val,
+-			      el->num_values+1);
+-	if (!vals) {
+-		return LDB_ERR_OPERATIONS_ERROR;
++	ret = ldb_msg_element_add_value(msg->elements, el, val);
++	if (ret != LDB_SUCCESS) {
++		return ret;
+ 	}
+-	el->values = vals;
+-	el->values[el->num_values] = *val;
+-	el->num_values++;
+ 
+ 	if (return_el) {
+ 		*return_el = el;
+diff --git lib/ldb/include/ldb.h lib/ldb/include/ldb.h
+index bc44157eaf4..129beefeaf5 100644
+--- lib/ldb/include/ldb.h
++++ lib/ldb/include/ldb.h
+@@ -1981,6 +1981,12 @@ int ldb_msg_add_empty(struct ldb_message *msg,
+ 		int flags,
+ 		struct ldb_message_element **return_el);
+ 
++/**
++   add a value to a message element
++*/
++int ldb_msg_element_add_value(TALLOC_CTX *mem_ctx,
++			      struct ldb_message_element *el,
++			      const struct ldb_val *val);
+ /**
+    add a element to a ldb_message
+ */
+diff --git source4/dsdb/common/util.c source4/dsdb/common/util.c
+index 5ce4c0a5e33..577b2a33873 100644
+--- source4/dsdb/common/util.c
++++ source4/dsdb/common/util.c
+@@ -816,7 +816,7 @@ int samdb_msg_add_addval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx,
+ 			 const char *value)
+ {
+ 	struct ldb_message_element *el;
+-	struct ldb_val val, *vals;
++	struct ldb_val val;
+ 	char *v;
+ 	unsigned int i;
+ 	bool found = false;
+@@ -851,14 +851,10 @@ int samdb_msg_add_addval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx,
+ 		}
+ 	}
+ 
+-	vals = talloc_realloc(msg->elements, el->values, struct ldb_val,
+-			      el->num_values + 1);
+-	if (vals == NULL) {
++	ret = ldb_msg_element_add_value(msg->elements, el, &val);
++	if (ret != LDB_SUCCESS) {
+ 		return ldb_oom(sam_ldb);
+ 	}
+-	el->values = vals;
+-	el->values[el->num_values] = val;
+-	++(el->num_values);
+ 
+ 	return LDB_SUCCESS;
+ }
+@@ -872,7 +868,7 @@ int samdb_msg_add_delval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx,
+ 			 const char *value)
+ {
+ 	struct ldb_message_element *el;
+-	struct ldb_val val, *vals;
++	struct ldb_val val;
+ 	char *v;
+ 	unsigned int i;
+ 	bool found = false;
+@@ -907,14 +903,10 @@ int samdb_msg_add_delval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx,
+ 		}
+ 	}
+ 
+-	vals = talloc_realloc(msg->elements, el->values, struct ldb_val,
+-			      el->num_values + 1);
+-	if (vals == NULL) {
++	ret = ldb_msg_element_add_value(msg->elements, el, &val);
++	if (ret != LDB_SUCCESS) {
+ 		return ldb_oom(sam_ldb);
+ 	}
+-	el->values = vals;
+-	el->values[el->num_values] = val;
+-	++(el->num_values);
+ 
+ 	return LDB_SUCCESS;
+ }
+-- 
+2.25.1
+
+
+From 512a2617b1593bdc16caeeeda4312a581cbb34e9 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 16 Feb 2022 16:30:03 +1300
+Subject: [PATCH 12/99] CVE-2022-32746 ldb: Add functions for appending to an
+ ldb_message
+
+Currently, there are many places where we use ldb_msg_add_empty() to add
+an empty element to a message, and then call ldb_msg_add_value() or
+similar to add values to that element. However, this performs an
+unnecessary search of the message's elements to locate the new element.
+Moreover, if an element with the same attribute name already exists
+earlier in the message, the values will be added to that element,
+instead of to the intended newly added element.
+
+A similar pattern exists where we add values to a message, and then call
+ldb_msg_find_element() to locate that message element and sets its flags
+to (e.g.) LDB_FLAG_MOD_REPLACE. This also performs an unnecessary
+search, and may locate the wrong message element for setting the flags.
+
+To avoid these problems, add functions for appending a value to a
+message, so that a particular value can be added to the end of a message
+in a single operation.
+
+For ADD requests, it is important that no two message elements share the
+same attribute name, otherwise things will break. (Normally,
+ldb_msg_normalize() is called before processing the request to help
+ensure this.) Thus, we must be careful not to append an attribute to an
+ADD message, unless we are sure (e.g. through ldb_msg_find_element())
+that an existing element for that attribute is not present.
+
+These functions will be used in the next commit.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ lib/ldb/common/ldb_msg.c | 165 ++++++++++++++++++++++++++++++++++++++-
+ lib/ldb/include/ldb.h    |  24 ++++++
+ 2 files changed, 185 insertions(+), 4 deletions(-)
+
+diff --git lib/ldb/common/ldb_msg.c lib/ldb/common/ldb_msg.c
+index 44d3b29e9a7..9cd7998e21c 100644
+--- lib/ldb/common/ldb_msg.c
++++ lib/ldb/common/ldb_msg.c
+@@ -509,12 +509,15 @@ int ldb_msg_add_steal_value(struct ldb_message *msg,
+ 
+ 
+ /*
+-  add a string element to a message
++  add a string element to a message, specifying flags
+ */
+-int ldb_msg_add_string(struct ldb_message *msg,
+-		       const char *attr_name, const char *str)
++int ldb_msg_add_string_flags(struct ldb_message *msg,
++			     const char *attr_name, const char *str,
++			     int flags)
+ {
+ 	struct ldb_val val;
++	int ret;
++	struct ldb_message_element *el = NULL;
+ 
+ 	val.data = discard_const_p(uint8_t, str);
+ 	val.length = strlen(str);
+@@ -524,7 +527,25 @@ int ldb_msg_add_string(struct ldb_message *msg,
+ 		return LDB_SUCCESS;
+ 	}
+ 
+-	return ldb_msg_add_value(msg, attr_name, &val, NULL);
++	ret = ldb_msg_add_value(msg, attr_name, &val, &el);
++	if (ret != LDB_SUCCESS) {
++		return ret;
++	}
++
++	if (flags != 0) {
++		el->flags = flags;
++	}
++
++	return LDB_SUCCESS;
++}
++
++/*
++  add a string element to a message
++*/
++int ldb_msg_add_string(struct ldb_message *msg,
++		       const char *attr_name, const char *str)
++{
++	return ldb_msg_add_string_flags(msg, attr_name, str, 0);
+ }
+ 
+ /*
+@@ -586,6 +607,142 @@ int ldb_msg_add_fmt(struct ldb_message *msg,
+ 	return ldb_msg_add_steal_value(msg, attr_name, &val);
+ }
+ 
++static int ldb_msg_append_value_impl(struct ldb_message *msg,
++				     const char *attr_name,
++				     const struct ldb_val *val,
++				     int flags,
++				     struct ldb_message_element **return_el)
++{
++	struct ldb_message_element *el = NULL;
++	int ret;
++
++	ret = ldb_msg_add_empty(msg, attr_name, flags, &el);
++	if (ret != LDB_SUCCESS) {
++		return ret;
++	}
++
++	ret = ldb_msg_element_add_value(msg->elements, el, val);
++	if (ret != LDB_SUCCESS) {
++		return ret;
++	}
++
++	if (return_el != NULL) {
++		*return_el = el;
++	}
++
++	return LDB_SUCCESS;
++}
++
++/*
++  append a value to a message
++*/
++int ldb_msg_append_value(struct ldb_message *msg,
++			 const char *attr_name,
++			 const struct ldb_val *val,
++			 int flags)
++{
++	return ldb_msg_append_value_impl(msg, attr_name, val, flags, NULL);
++}
++
++/*
++  append a value to a message, stealing it into the 'right' place
++*/
++int ldb_msg_append_steal_value(struct ldb_message *msg,
++			       const char *attr_name,
++			       struct ldb_val *val,
++			       int flags)
++{
++	int ret;
++	struct ldb_message_element *el = NULL;
++
++	ret = ldb_msg_append_value_impl(msg, attr_name, val, flags, &el);
++	if (ret == LDB_SUCCESS) {
++		talloc_steal(el->values, val->data);
++	}
++	return ret;
++}
++
++/*
++  append a string element to a message, stealing it into the 'right' place
++*/
++int ldb_msg_append_steal_string(struct ldb_message *msg,
++				const char *attr_name, char *str,
++				int flags)
++{
++	struct ldb_val val;
++
++	val.data = (uint8_t *)str;
++	val.length = strlen(str);
++
++	if (val.length == 0) {
++		/* allow empty strings as non-existent attributes */
++		return LDB_SUCCESS;
++	}
++
++	return ldb_msg_append_steal_value(msg, attr_name, &val, flags);
++}
++
++/*
++  append a string element to a message
++*/
++int ldb_msg_append_string(struct ldb_message *msg,
++			  const char *attr_name, const char *str, int flags)
++{
++	struct ldb_val val;
++
++	val.data = discard_const_p(uint8_t, str);
++	val.length = strlen(str);
++
++	if (val.length == 0) {
++		/* allow empty strings as non-existent attributes */
++		return LDB_SUCCESS;
++	}
++
++	return ldb_msg_append_value(msg, attr_name, &val, flags);
++}
++
++/*
++  append a DN element to a message
++  WARNING: this uses the linearized string from the dn, and does not
++  copy the string.
++*/
++int ldb_msg_append_linearized_dn(struct ldb_message *msg, const char *attr_name,
++				 struct ldb_dn *dn, int flags)
++{
++	char *str = ldb_dn_alloc_linearized(msg, dn);
++
++	if (str == NULL) {
++		/* we don't want to have unknown DNs added */
++		return LDB_ERR_OPERATIONS_ERROR;
++	}
++
++	return ldb_msg_append_steal_string(msg, attr_name, str, flags);
++}
++
++/*
++  append a printf formatted element to a message
++*/
++int ldb_msg_append_fmt(struct ldb_message *msg, int flags,
++		       const char *attr_name, const char *fmt, ...)
++{
++	struct ldb_val val;
++	va_list ap;
++	char *str = NULL;
++
++	va_start(ap, fmt);
++	str = talloc_vasprintf(msg, fmt, ap);
++	va_end(ap);
++
++	if (str == NULL) {
++		return LDB_ERR_OPERATIONS_ERROR;
++	}
++
++	val.data   = (uint8_t *)str;
++	val.length = strlen(str);
++
++	return ldb_msg_append_steal_value(msg, attr_name, &val, flags);
++}
++
+ /*
+   compare two ldb_message_element structures
+   assumes case sensitive comparison
+diff --git lib/ldb/include/ldb.h lib/ldb/include/ldb.h
+index 129beefeaf5..63d8aedd672 100644
+--- lib/ldb/include/ldb.h
++++ lib/ldb/include/ldb.h
+@@ -2002,12 +2002,36 @@ int ldb_msg_add_steal_value(struct ldb_message *msg,
+ 		      struct ldb_val *val);
+ int ldb_msg_add_steal_string(struct ldb_message *msg,
+ 			     const char *attr_name, char *str);
++int ldb_msg_add_string_flags(struct ldb_message *msg,
++			     const char *attr_name, const char *str,
++			     int flags);
+ int ldb_msg_add_string(struct ldb_message *msg,
+ 		       const char *attr_name, const char *str);
+ int ldb_msg_add_linearized_dn(struct ldb_message *msg, const char *attr_name,
+ 			      struct ldb_dn *dn);
+ int ldb_msg_add_fmt(struct ldb_message *msg,
+ 		    const char *attr_name, const char *fmt, ...) PRINTF_ATTRIBUTE(3,4);
++/**
++   append a element to a ldb_message
++*/
++int ldb_msg_append_value(struct ldb_message *msg,
++			 const char *attr_name,
++			 const struct ldb_val *val,
++			 int flags);
++int ldb_msg_append_steal_value(struct ldb_message *msg,
++			       const char *attr_name,
++			       struct ldb_val *val,
++			       int flags);
++int ldb_msg_append_steal_string(struct ldb_message *msg,
++				const char *attr_name, char *str,
++				int flags);
++int ldb_msg_append_string(struct ldb_message *msg,
++			  const char *attr_name, const char *str,
++			  int flags);
++int ldb_msg_append_linearized_dn(struct ldb_message *msg, const char *attr_name,
++				 struct ldb_dn *dn, int flags);
++int ldb_msg_append_fmt(struct ldb_message *msg, int flags,
++		       const char *attr_name, const char *fmt, ...) PRINTF_ATTRIBUTE(4,5);
+ 
+ /**
+    compare two message elements - return 0 on match
+-- 
+2.25.1
+
+
+From f419753d1c7a373fb32ffe20930a6e084e44b44d Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Mon, 21 Feb 2022 16:27:37 +1300
+Subject: [PATCH 13/99] CVE-2022-32746 ldb: Make use of functions for appending
+ to an ldb_message
+
+This aims to minimise usage of the error-prone pattern of searching for
+a just-added message element in order to make modifications to it (and
+potentially finding the wrong element).
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ lib/ldb/ldb_map/ldb_map.c                     |   5 +-
+ lib/ldb/ldb_map/ldb_map_inbound.c             |   9 +-
+ lib/ldb/modules/rdn_name.c                    |  22 +---
+ source3/passdb/pdb_samba_dsdb.c               |  14 +--
+ source4/dns_server/dnsserver_common.c         |  12 +-
+ source4/dsdb/common/util.c                    | 114 ++++++++++++++----
+ source4/dsdb/samdb/ldb_modules/descriptor.c   |  10 +-
+ source4/dsdb/samdb/ldb_modules/objectguid.c   |  20 +--
+ .../dsdb/samdb/ldb_modules/partition_init.c   |  14 +--
+ .../dsdb/samdb/ldb_modules/repl_meta_data.c   |  24 +---
+ source4/dsdb/samdb/ldb_modules/samldb.c       |  78 +++++-------
+ .../samdb/ldb_modules/tombstone_reanimate.c   |  12 +-
+ source4/nbt_server/wins/winsdb.c              |  13 +-
+ source4/rpc_server/lsa/dcesrv_lsa.c           |  55 +++------
+ source4/winbind/idmap.c                       |  10 +-
+ 15 files changed, 183 insertions(+), 229 deletions(-)
+
+diff --git lib/ldb/ldb_map/ldb_map.c lib/ldb/ldb_map/ldb_map.c
+index b453dff80d2..c7b0c228631 100644
+--- lib/ldb/ldb_map/ldb_map.c
++++ lib/ldb/ldb_map/ldb_map.c
+@@ -946,10 +946,7 @@ struct ldb_request *map_build_fixup_req(struct map_context *ac,
+ 	if ( ! dn || ! ldb_dn_validate(msg->dn)) {
+ 		goto failed;
+ 	}
+-	if (ldb_msg_add_empty(msg, IS_MAPPED, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
+-		goto failed;
+-	}
+-	if (ldb_msg_add_string(msg, IS_MAPPED, dn) != 0) {
++	if (ldb_msg_append_string(msg, IS_MAPPED, dn, LDB_FLAG_MOD_REPLACE) != 0) {
+ 		goto failed;
+ 	}
+ 
+diff --git lib/ldb/ldb_map/ldb_map_inbound.c lib/ldb/ldb_map/ldb_map_inbound.c
+index 324295737da..50b9427c26c 100644
+--- lib/ldb/ldb_map/ldb_map_inbound.c
++++ lib/ldb/ldb_map/ldb_map_inbound.c
+@@ -569,12 +569,9 @@ static int map_modify_do_local(struct map_context *ac)
+ 		/* No local record present, add it instead */
+ 		/* Add local 'IS_MAPPED' */
+ 		/* TODO: use GUIDs here instead */
+-		if (ldb_msg_add_empty(ac->local_msg, IS_MAPPED,
+-					LDB_FLAG_MOD_ADD, NULL) != 0) {
+-			return LDB_ERR_OPERATIONS_ERROR;
+-		}
+-		ret = ldb_msg_add_linearized_dn(ac->local_msg, IS_MAPPED,
+-						ac->remote_req->op.mod.message->dn);
++		ret = ldb_msg_append_linearized_dn(ac->local_msg, IS_MAPPED,
++						   ac->remote_req->op.mod.message->dn,
++						   LDB_FLAG_MOD_ADD);
+ 		if (ret != 0) {
+ 			return LDB_ERR_OPERATIONS_ERROR;
+ 		}
+diff --git lib/ldb/modules/rdn_name.c lib/ldb/modules/rdn_name.c
+index 25cffe07591..3cb62bf567b 100644
+--- lib/ldb/modules/rdn_name.c
++++ lib/ldb/modules/rdn_name.c
+@@ -308,16 +308,10 @@ static int rdn_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
+ 	}
+ 	rdn_val = ldb_val_dup(msg, rdn_val_p);
+ 
+-	if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
++	if (ldb_msg_append_value(msg, rdn_name, &rdn_val, LDB_FLAG_MOD_REPLACE) != 0) {
+ 		goto error;
+ 	}
+-	if (ldb_msg_add_value(msg, rdn_name, &rdn_val, NULL) != 0) {
+-		goto error;
+-	}
+-	if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
+-		goto error;
+-	}
+-	if (ldb_msg_add_value(msg, "name", &rdn_val, NULL) != 0) {
++	if (ldb_msg_append_value(msg, "name", &rdn_val, LDB_FLAG_MOD_REPLACE) != 0) {
+ 		goto error;
+ 	}
+ 
+@@ -466,11 +460,7 @@ static int rdn_name_modify(struct ldb_module *module, struct ldb_request *req)
+ 		if (ret != 0) {
+ 			return ldb_module_oom(module);
+ 		}
+-		ret = ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_ADD, NULL);
+-		if (ret != 0) {
+-			return ldb_module_oom(module);
+-		}
+-		ret = ldb_msg_add_value(msg, rdn_name, &rdn_val, NULL);
++		ret = ldb_msg_append_value(msg, rdn_name, &rdn_val, LDB_FLAG_MOD_ADD);
+ 		if (ret != 0) {
+ 			return ldb_module_oom(module);
+ 		}
+@@ -479,11 +469,7 @@ static int rdn_name_modify(struct ldb_module *module, struct ldb_request *req)
+ 		if (ret != 0) {
+ 			return ldb_module_oom(module);
+ 		}
+-		ret = ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_ADD, NULL);
+-		if (ret != 0) {
+-			return ldb_module_oom(module);
+-		}
+-		ret = ldb_msg_add_value(msg, "name", &rdn_val, NULL);
++		ret = ldb_msg_append_value(msg, "name", &rdn_val, LDB_FLAG_MOD_ADD);
+ 		if (ret != 0) {
+ 			return ldb_module_oom(module);
+ 		}
+diff --git source3/passdb/pdb_samba_dsdb.c source3/passdb/pdb_samba_dsdb.c
+index 93e8f5bebe6..b2063825c04 100644
+--- source3/passdb/pdb_samba_dsdb.c
++++ source3/passdb/pdb_samba_dsdb.c
+@@ -2855,18 +2855,10 @@ static bool pdb_samba_dsdb_set_trusteddom_pw(struct pdb_methods *m,
+ 	}
+ 
+ 	msg->num_elements = 0;
+-	ret = ldb_msg_add_empty(msg, "trustAuthOutgoing",
+-				LDB_FLAG_MOD_REPLACE, NULL);
++	ret = ldb_msg_append_value(msg, "trustAuthOutgoing",
++				   &new_val, LDB_FLAG_MOD_REPLACE);
+ 	if (ret != LDB_SUCCESS) {
+-		DEBUG(0, ("ldb_msg_add_empty() failed\n"));
+-		TALLOC_FREE(tmp_ctx);
+-		ldb_transaction_cancel(state->ldb);
+-		return false;
+-	}
+-	ret = ldb_msg_add_value(msg, "trustAuthOutgoing",
+-				&new_val, NULL);
+-	if (ret != LDB_SUCCESS) {
+-		DEBUG(0, ("ldb_msg_add_value() failed\n"));
++		DEBUG(0, ("ldb_msg_append_value() failed\n"));
+ 		TALLOC_FREE(tmp_ctx);
+ 		ldb_transaction_cancel(state->ldb);
+ 		return false;
+diff --git source4/dns_server/dnsserver_common.c source4/dns_server/dnsserver_common.c
+index bcb0d087faf..cb9a082ebf6 100644
+--- source4/dns_server/dnsserver_common.c
++++ source4/dns_server/dnsserver_common.c
+@@ -1092,15 +1092,9 @@ WERROR dns_common_replace(struct ldb_context *samdb,
+ 	}
+ 
+ 	if (was_tombstoned || become_tombstoned) {
+-		ret = ldb_msg_add_empty(msg, "dNSTombstoned",
+-					LDB_FLAG_MOD_REPLACE, NULL);
+-		if (ret != LDB_SUCCESS) {
+-			werr = DNS_ERR(SERVER_FAILURE);
+-			goto exit;
+-		}
+-
+-		ret = ldb_msg_add_fmt(msg, "dNSTombstoned", "%s",
+-				      become_tombstoned ? "TRUE" : "FALSE");
++		ret = ldb_msg_append_fmt(msg, LDB_FLAG_MOD_REPLACE,
++					 "dNSTombstoned", "%s",
++					 become_tombstoned ? "TRUE" : "FALSE");
+ 		if (ret != LDB_SUCCESS) {
+ 			werr = DNS_ERR(SERVER_FAILURE);
+ 			goto exit;
+diff --git source4/dsdb/common/util.c source4/dsdb/common/util.c
+index 577b2a33873..10d6ea8883b 100644
+--- source4/dsdb/common/util.c
++++ source4/dsdb/common/util.c
+@@ -924,6 +924,16 @@ int samdb_msg_add_int(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct l
+ 	return ldb_msg_add_string(msg, attr_name, s);
+ }
+ 
++int samdb_msg_add_int_flags(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
++			    const char *attr_name, int v, int flags)
++{
++	const char *s = talloc_asprintf(mem_ctx, "%d", v);
++	if (s == NULL) {
++		return ldb_oom(sam_ldb);
++	}
++	return ldb_msg_add_string_flags(msg, attr_name, s, flags);
++}
++
+ /*
+  * Add an unsigned int element to a message
+  *
+@@ -942,6 +952,12 @@ int samdb_msg_add_uint(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct
+ 	return samdb_msg_add_int(sam_ldb, mem_ctx, msg, attr_name, (int)v);
+ }
+ 
++int samdb_msg_add_uint_flags(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
++			     const char *attr_name, unsigned int v, int flags)
++{
++	return samdb_msg_add_int_flags(sam_ldb, mem_ctx, msg, attr_name, (int)v, flags);
++}
++
+ /*
+   add a (signed) int64_t element to a message
+ */
+@@ -973,6 +989,68 @@ int samdb_msg_add_uint64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struc
+ 	return samdb_msg_add_int64(sam_ldb, mem_ctx, msg, attr_name, (int64_t)v);
+ }
+ 
++/*
++  append a int element to a message
++*/
++int samdb_msg_append_int(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
++		      const char *attr_name, int v, int flags)
++{
++	const char *s = talloc_asprintf(mem_ctx, "%d", v);
++	if (s == NULL) {
++		return ldb_oom(sam_ldb);
++	}
++	return ldb_msg_append_string(msg, attr_name, s, flags);
++}
++
++/*
++ * Append an unsigned int element to a message
++ *
++ * The issue here is that we have not yet first cast to int32_t explicitly,
++ * before we cast to an signed int to printf() into the %d or cast to a
++ * int64_t before we then cast to a long long to printf into a %lld.
++ *
++ * There are *no* unsigned integers in Active Directory LDAP, even the RID
++ * allocations and ms-DS-Secondary-KrbTgt-Number are *signed* quantities.
++ * (See the schema, and the syntax definitions in schema_syntax.c).
++ *
++ */
++int samdb_msg_append_uint(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
++			  const char *attr_name, unsigned int v, int flags)
++{
++	return samdb_msg_append_int(sam_ldb, mem_ctx, msg, attr_name, (int)v, flags);
++}
++
++/*
++  append a (signed) int64_t element to a message
++*/
++int samdb_msg_append_int64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
++			   const char *attr_name, int64_t v, int flags)
++{
++	const char *s = talloc_asprintf(mem_ctx, "%lld", (long long)v);
++	if (s == NULL) {
++		return ldb_oom(sam_ldb);
++	}
++	return ldb_msg_append_string(msg, attr_name, s, flags);
++}
++
++/*
++ * Append an unsigned int64_t (uint64_t) element to a message
++ *
++ * The issue here is that we have not yet first cast to int32_t explicitly,
++ * before we cast to an signed int to printf() into the %d or cast to a
++ * int64_t before we then cast to a long long to printf into a %lld.
++ *
++ * There are *no* unsigned integers in Active Directory LDAP, even the RID
++ * allocations and ms-DS-Secondary-KrbTgt-Number are *signed* quantities.
++ * (See the schema, and the syntax definitions in schema_syntax.c).
++ *
++ */
++int samdb_msg_append_uint64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
++			    const char *attr_name, uint64_t v, int flags)
++{
++	return samdb_msg_append_int64(sam_ldb, mem_ctx, msg, attr_name, (int64_t)v, flags);
++}
++
+ /*
+   add a samr_Password element to a message
+ */
+@@ -2814,15 +2892,8 @@ NTSTATUS samdb_set_password_sid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
+ 		tdo_msg->num_elements = 0;
+ 		TALLOC_FREE(tdo_msg->elements);
+ 
+-		ret = ldb_msg_add_empty(tdo_msg, "trustAuthIncoming",
+-					LDB_FLAG_MOD_REPLACE, NULL);
+-		if (ret != LDB_SUCCESS) {
+-			ldb_transaction_cancel(ldb);
+-			TALLOC_FREE(frame);
+-			return NT_STATUS_NO_MEMORY;
+-		}
+-		ret = ldb_msg_add_value(tdo_msg, "trustAuthIncoming",
+-					&new_val, NULL);
++		ret = ldb_msg_append_value(tdo_msg, "trustAuthIncoming",
++					   &new_val, LDB_FLAG_MOD_REPLACE);
+ 		if (ret != LDB_SUCCESS) {
+ 			ldb_transaction_cancel(ldb);
+ 			TALLOC_FREE(frame);
+@@ -3187,6 +3258,7 @@ int dsdb_find_guid_by_dn(struct ldb_context *ldb,
+ /*
+  adds the given GUID to the given ldb_message. This value is added
+  for the given attr_name (may be either "objectGUID" or "parentGUID").
++ This function is used in processing 'add' requests.
+  */
+ int dsdb_msg_add_guid(struct ldb_message *msg,
+ 		struct GUID *guid,
+@@ -5656,7 +5728,8 @@ int dsdb_user_obj_set_defaults(struct ldb_context *ldb,
+ }
+ 
+ /**
+- * Sets 'sAMAccountType on user object based on userAccountControl
++ * Sets 'sAMAccountType on user object based on userAccountControl.
++ * This function is used in processing both 'add' and 'modify' requests.
+  * @param ldb Current ldb_context
+  * @param usr_obj ldb_message representing User object
+  * @param user_account_control Value for userAccountControl flags
+@@ -5668,21 +5741,19 @@ int dsdb_user_obj_set_account_type(struct ldb_context *ldb, struct ldb_message *
+ {
+ 	int ret;
+ 	uint32_t account_type;
+-	struct ldb_message_element *el;
+ 
+ 	account_type = ds_uf2atype(user_account_control);
+ 	if (account_type == 0) {
+ 		ldb_set_errstring(ldb, "dsdb: Unrecognized account type!");
+ 		return LDB_ERR_UNWILLING_TO_PERFORM;
+ 	}
+-	ret = samdb_msg_add_uint(ldb, usr_obj, usr_obj,
+-				 "sAMAccountType",
+-				 account_type);
++	ret = samdb_msg_add_uint_flags(ldb, usr_obj, usr_obj,
++				       "sAMAccountType",
++				       account_type,
++				       LDB_FLAG_MOD_REPLACE);
+ 	if (ret != LDB_SUCCESS) {
+ 		return ret;
+ 	}
+-	el = ldb_msg_find_element(usr_obj, "sAMAccountType");
+-	el->flags = LDB_FLAG_MOD_REPLACE;
+ 
+ 	if (account_type_p) {
+ 		*account_type_p = account_type;
+@@ -5692,7 +5763,8 @@ int dsdb_user_obj_set_account_type(struct ldb_context *ldb, struct ldb_message *
+ }
+ 
+ /**
+- * Determine and set primaryGroupID based on userAccountControl value
++ * Determine and set primaryGroupID based on userAccountControl value.
++ * This function is used in processing both 'add' and 'modify' requests.
+  * @param ldb Current ldb_context
+  * @param usr_obj ldb_message representing User object
+  * @param user_account_control Value for userAccountControl flags
+@@ -5704,17 +5776,15 @@ int dsdb_user_obj_set_primary_group_id(struct ldb_context *ldb, struct ldb_messa
+ {
+ 	int ret;
+ 	uint32_t rid;
+-	struct ldb_message_element *el;
+ 
+ 	rid = ds_uf2prim_group_rid(user_account_control);
+ 
+-	ret = samdb_msg_add_uint(ldb, usr_obj, usr_obj,
+-				 "primaryGroupID", rid);
++	ret = samdb_msg_add_uint_flags(ldb, usr_obj, usr_obj,
++				       "primaryGroupID", rid,
++				       LDB_FLAG_MOD_REPLACE);
+ 	if (ret != LDB_SUCCESS) {
+ 		return ret;
+ 	}
+-	el = ldb_msg_find_element(usr_obj, "primaryGroupID");
+-	el->flags = LDB_FLAG_MOD_REPLACE;
+ 
+ 	if (group_rid_p) {
+ 		*group_rid_p = rid;
+diff --git source4/dsdb/samdb/ldb_modules/descriptor.c source4/dsdb/samdb/ldb_modules/descriptor.c
+index daa08c2ebc7..4b01961dcb0 100644
+--- source4/dsdb/samdb/ldb_modules/descriptor.c
++++ source4/dsdb/samdb/ldb_modules/descriptor.c
+@@ -857,14 +857,8 @@ static int descriptor_modify(struct ldb_module *module, struct ldb_request *req)
+ 			return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
+ 		}
+ 
+-		ret = ldb_msg_add_empty(msg, "nTSecurityDescriptor",
+-					LDB_FLAG_MOD_REPLACE,
+-					&sd_element);
+-		if (ret != LDB_SUCCESS) {
+-			return ldb_oom(ldb);
+-		}
+-		ret = ldb_msg_add_value(msg, "nTSecurityDescriptor",
+-					sd, NULL);
++		ret = ldb_msg_append_value(msg, "nTSecurityDescriptor",
++					   sd, LDB_FLAG_MOD_REPLACE);
+ 		if (ret != LDB_SUCCESS) {
+ 			return ldb_oom(ldb);
+ 		}
+diff --git source4/dsdb/samdb/ldb_modules/objectguid.c source4/dsdb/samdb/ldb_modules/objectguid.c
+index bc3260cf0d8..0fe995a5763 100644
+--- source4/dsdb/samdb/ldb_modules/objectguid.c
++++ source4/dsdb/samdb/ldb_modules/objectguid.c
+@@ -41,7 +41,6 @@
+ */
+ static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
+ {
+-	struct ldb_message_element *el;
+ 	char *s;
+ 	int ret;
+ 
+@@ -54,16 +53,13 @@ static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
+ 		return LDB_ERR_OPERATIONS_ERROR;
+ 	}
+ 
+-	ret = ldb_msg_add_string(msg, attr, s);
++	/* always set as replace. This works because on add ops, the flag
++	   is ignored */
++	ret = ldb_msg_append_string(msg, attr, s, LDB_FLAG_MOD_REPLACE);
+ 	if (ret != LDB_SUCCESS) {
+ 		return ret;
+ 	}
+ 
+-	el = ldb_msg_find_element(msg, attr);
+-	/* always set as replace. This works because on add ops, the flag
+-	   is ignored */
+-	el->flags = LDB_FLAG_MOD_REPLACE;
+-
+ 	return LDB_SUCCESS;
+ }
+ 
+@@ -73,23 +69,19 @@ static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
+ static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
+ 			      const char *attr, uint64_t v)
+ {
+-	struct ldb_message_element *el;
+ 	int ret;
+ 
+ 	if (ldb_msg_find_element(msg, attr) != NULL) {
+ 		return LDB_SUCCESS;
+ 	}
+ 
+-	ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
++	/* always set as replace. This works because on add ops, the flag
++	   is ignored */
++	ret = samdb_msg_append_uint64(ldb, msg, msg, attr, v, LDB_FLAG_MOD_REPLACE);
+ 	if (ret != LDB_SUCCESS) {
+ 		return ret;
+ 	}
+ 
+-	el = ldb_msg_find_element(msg, attr);
+-	/* always set as replace. This works because on add ops, the flag
+-	   is ignored */
+-	el->flags = LDB_FLAG_MOD_REPLACE;
+-
+ 	return LDB_SUCCESS;
+ }
+ 
+diff --git source4/dsdb/samdb/ldb_modules/partition_init.c source4/dsdb/samdb/ldb_modules/partition_init.c
+index 58c65ccedd0..484b5bffb27 100644
+--- source4/dsdb/samdb/ldb_modules/partition_init.c
++++ source4/dsdb/samdb/ldb_modules/partition_init.c
+@@ -742,10 +742,6 @@ int partition_create(struct ldb_module *module, struct ldb_request *req)
+ 		}
+ 		
+ 		mod_msg->dn = ldb_dn_new(mod_msg, ldb, DSDB_PARTITION_DN);
+-		ret = ldb_msg_add_empty(mod_msg, DSDB_PARTITION_ATTR, LDB_FLAG_MOD_ADD, NULL);
+-		if (ret != LDB_SUCCESS) {
+-			return ret;
+-		}
+ 		
+ 		casefold_dn = ldb_dn_get_casefold(dn);
+ 		
+@@ -785,18 +781,16 @@ int partition_create(struct ldb_module *module, struct ldb_request *req)
+ 		}
+ 		partition_record = talloc_asprintf(mod_msg, "%s:%s", casefold_dn, filename);
+ 
+-		ret = ldb_msg_add_steal_string(mod_msg, DSDB_PARTITION_ATTR, partition_record);
++		ret = ldb_msg_append_steal_string(mod_msg, DSDB_PARTITION_ATTR, partition_record,
++						  LDB_FLAG_MOD_ADD);
+ 		if (ret != LDB_SUCCESS) {
+ 			return ret;
+ 		}
+ 
+ 		if (ldb_request_get_control(req, DSDB_CONTROL_PARTIAL_REPLICA)) {
+ 			/* this new partition is a partial replica */
+-			ret = ldb_msg_add_empty(mod_msg, "partialReplica", LDB_FLAG_MOD_ADD, NULL);
+-			if (ret != LDB_SUCCESS) {
+-				return ret;
+-			}
+-			ret = ldb_msg_add_fmt(mod_msg, "partialReplica", "%s", ldb_dn_get_linearized(dn));
++			ret = ldb_msg_append_fmt(mod_msg, LDB_FLAG_MOD_ADD,
++						 "partialReplica", "%s", ldb_dn_get_linearized(dn));
+ 			if (ret != LDB_SUCCESS) {
+ 				return ret;
+ 			}
+diff --git source4/dsdb/samdb/ldb_modules/repl_meta_data.c source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+index 29ffda75c87..eec1e639856 100644
+--- source4/dsdb/samdb/ldb_modules/repl_meta_data.c
++++ source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+@@ -3888,22 +3888,12 @@ static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *are
+ 				       ldb_operr(ldb));
+ 	}
+ 
+-	if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
++	if (ldb_msg_append_value(msg, rdn_name, rdn_val, LDB_FLAG_MOD_REPLACE) != 0) {
+ 		talloc_free(ares);
+ 		return ldb_module_done(ac->req, NULL, NULL,
+ 				       ldb_oom(ldb));
+ 	}
+-	if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
+-		talloc_free(ares);
+-		return ldb_module_done(ac->req, NULL, NULL,
+-				       ldb_oom(ldb));
+-	}
+-	if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
+-		talloc_free(ares);
+-		return ldb_module_done(ac->req, NULL, NULL,
+-				       ldb_oom(ldb));
+-	}
+-	if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
++	if (ldb_msg_append_value(msg, "name", rdn_val, LDB_FLAG_MOD_REPLACE) != 0) {
+ 		talloc_free(ares);
+ 		return ldb_module_done(ac->req, NULL, NULL,
+ 				       ldb_oom(ldb));
+@@ -5161,16 +5151,10 @@ static int replmd_name_modify(struct replmd_replicated_request *ar,
+ 		goto failed;
+ 	}
+ 
+-	if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
+-		goto failed;
+-	}
+-	if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
+-		goto failed;
+-	}
+-	if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
++	if (ldb_msg_append_value(msg, rdn_name, rdn_val, LDB_FLAG_MOD_REPLACE) != 0) {
+ 		goto failed;
+ 	}
+-	if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
++	if (ldb_msg_append_value(msg, "name", rdn_val, LDB_FLAG_MOD_REPLACE) != 0) {
+ 		goto failed;
+ 	}
+ 
+diff --git source4/dsdb/samdb/ldb_modules/samldb.c source4/dsdb/samdb/ldb_modules/samldb.c
+index 5fb9c195c9a..107e643e492 100644
+--- source4/dsdb/samdb/ldb_modules/samldb.c
++++ source4/dsdb/samdb/ldb_modules/samldb.c
+@@ -1103,14 +1103,11 @@ static int samldb_rodc_add(struct samldb_ctx *ac)
+ 	return LDB_ERR_OTHER;
+ 
+ found:
+-	ret = ldb_msg_add_empty(ac->msg, "msDS-SecondaryKrbTgtNumber",
+-				LDB_FLAG_INTERNAL_DISABLE_VALIDATION, NULL);
+-	if (ret != LDB_SUCCESS) {
+-		return ldb_operr(ldb);
+-	}
+ 
+-	ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
+-				 "msDS-SecondaryKrbTgtNumber", krbtgt_number);
++	ldb_msg_remove_attr(ac->msg, "msDS-SecondaryKrbTgtNumber");
++	ret = samdb_msg_append_uint(ldb, ac->msg, ac->msg,
++				    "msDS-SecondaryKrbTgtNumber", krbtgt_number,
++				    LDB_FLAG_INTERNAL_DISABLE_VALIDATION);
+ 	if (ret != LDB_SUCCESS) {
+ 		return ldb_operr(ldb);
+ 	}
+@@ -1792,7 +1789,7 @@ static int samldb_objectclass_trigger(struct samldb_ctx *ac)
+ 	struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+ 	void *skip_allocate_sids = ldb_get_opaque(ldb,
+ 						  "skip_allocate_sids");
+-	struct ldb_message_element *el, *el2;
++	struct ldb_message_element *el;
+ 	struct dom_sid *sid;
+ 	int ret;
+ 
+@@ -1926,23 +1923,17 @@ static int samldb_objectclass_trigger(struct samldb_ctx *ac)
+ 		/* "isCriticalSystemObject" might be set */
+ 		if (user_account_control &
+ 		    (UF_SERVER_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)) {
+-			ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
+-						 "TRUE");
++			ret = ldb_msg_add_string_flags(ac->msg, "isCriticalSystemObject",
++						       "TRUE", LDB_FLAG_MOD_REPLACE);
+ 			if (ret != LDB_SUCCESS) {
+ 				return ret;
+ 			}
+-			el2 = ldb_msg_find_element(ac->msg,
+-						   "isCriticalSystemObject");
+-			el2->flags = LDB_FLAG_MOD_REPLACE;
+ 		} else if (user_account_control & UF_WORKSTATION_TRUST_ACCOUNT) {
+-			ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
+-						 "FALSE");
++			ret = ldb_msg_add_string_flags(ac->msg, "isCriticalSystemObject",
++						       "FALSE", LDB_FLAG_MOD_REPLACE);
+ 			if (ret != LDB_SUCCESS) {
+ 				return ret;
+ 			}
+-			el2 = ldb_msg_find_element(ac->msg,
+-						   "isCriticalSystemObject");
+-			el2->flags = LDB_FLAG_MOD_REPLACE;
+ 		}
+ 
+ 		/* Step 1.4: "userAccountControl" -> "primaryGroupID" mapping */
+@@ -2018,14 +2009,13 @@ static int samldb_objectclass_trigger(struct samldb_ctx *ac)
+ 				ldb_set_errstring(ldb, "samldb: Unrecognized account type!");
+ 				return LDB_ERR_UNWILLING_TO_PERFORM;
+ 			}
+-			ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
+-						 "sAMAccountType",
+-						 account_type);
++			ret = samdb_msg_add_uint_flags(ldb, ac->msg, ac->msg,
++						       "sAMAccountType",
++						       account_type,
++						       LDB_FLAG_MOD_REPLACE);
+ 			if (ret != LDB_SUCCESS) {
+ 				return ret;
+ 			}
+-			el2 = ldb_msg_find_element(ac->msg, "sAMAccountType");
+-			el2->flags = LDB_FLAG_MOD_REPLACE;
+ 		}
+ 		break;
+ 	}
+@@ -2945,26 +2935,23 @@ static int samldb_user_account_control_change(struct samldb_ctx *ac)
+ 	}
+ 
+ 	if (old_atype != new_atype) {
+-		ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
+-					 "sAMAccountType", new_atype);
++		ret = samdb_msg_append_uint(ldb, ac->msg, ac->msg,
++					    "sAMAccountType", new_atype,
++					    LDB_FLAG_MOD_REPLACE);
+ 		if (ret != LDB_SUCCESS) {
+ 			return ret;
+ 		}
+-		el = ldb_msg_find_element(ac->msg, "sAMAccountType");
+-		el->flags = LDB_FLAG_MOD_REPLACE;
+ 	}
+ 
+ 	/* As per MS-SAMR 3.1.1.8.10 these flags have not to be set */
+ 	if ((clear_uac & UF_LOCKOUT) && (old_lockoutTime != 0)) {
+ 		/* "lockoutTime" reset as per MS-SAMR 3.1.1.8.10 */
+ 		ldb_msg_remove_attr(ac->msg, "lockoutTime");
+-		ret = samdb_msg_add_uint64(ldb, ac->msg, ac->msg, "lockoutTime",
+-					   (NTTIME)0);
++		ret = samdb_msg_append_uint64(ldb, ac->msg, ac->msg, "lockoutTime",
++					      (NTTIME)0, LDB_FLAG_MOD_REPLACE);
+ 		if (ret != LDB_SUCCESS) {
+ 			return ret;
+ 		}
+-		el = ldb_msg_find_element(ac->msg, "lockoutTime");
+-		el->flags = LDB_FLAG_MOD_REPLACE;
+ 	}
+ 
+ 	/*
+@@ -2975,14 +2962,12 @@ static int samldb_user_account_control_change(struct samldb_ctx *ac)
+ 	 * creating the attribute.
+ 	 */
+ 	if (old_is_critical != new_is_critical || old_atype != new_atype) {
+-		ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
+-					 new_is_critical ? "TRUE": "FALSE");
++		ret = ldb_msg_append_string(ac->msg, "isCriticalSystemObject",
++					    new_is_critical ? "TRUE": "FALSE",
++					    LDB_FLAG_MOD_REPLACE);
+ 		if (ret != LDB_SUCCESS) {
+ 			return ret;
+ 		}
+-		el = ldb_msg_find_element(ac->msg,
+-					   "isCriticalSystemObject");
+-		el->flags = LDB_FLAG_MOD_REPLACE;
+ 	}
+ 
+ 	if (!ldb_msg_find_element(ac->msg, "primaryGroupID") &&
+@@ -2995,14 +2980,12 @@ static int samldb_user_account_control_change(struct samldb_ctx *ac)
+ 			}
+ 		}
+ 
+-		ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
+-					 "primaryGroupID", new_pgrid);
++		ret = samdb_msg_append_uint(ldb, ac->msg, ac->msg,
++					    "primaryGroupID", new_pgrid,
++					    LDB_FLAG_MOD_REPLACE);
+ 		if (ret != LDB_SUCCESS) {
+ 			return ret;
+ 		}
+-		el = ldb_msg_find_element(ac->msg,
+-					   "primaryGroupID");
+-		el->flags = LDB_FLAG_MOD_REPLACE;
+ 	}
+ 
+ 	/* Propagate eventual "userAccountControl" attribute changes */
+@@ -3205,13 +3188,12 @@ static int samldb_lockout_time(struct samldb_ctx *ac)
+ 
+ 	/* lockoutTime == 0 resets badPwdCount */
+ 	ldb_msg_remove_attr(ac->msg, "badPwdCount");
+-	ret = samdb_msg_add_int(ldb, ac->msg, ac->msg,
+-				"badPwdCount", 0);
++	ret = samdb_msg_append_int(ldb, ac->msg, ac->msg,
++				   "badPwdCount", 0,
++				   LDB_FLAG_MOD_REPLACE);
+ 	if (ret != LDB_SUCCESS) {
+ 		return ret;
+ 	}
+-	el = ldb_msg_find_element(ac->msg, "badPwdCount");
+-	el->flags = LDB_FLAG_MOD_REPLACE;
+ 
+ 	return LDB_SUCCESS;
+ }
+@@ -3309,13 +3291,11 @@ static int samldb_group_type_change(struct samldb_ctx *ac)
+ 		ldb_set_errstring(ldb, "samldb: Unrecognized account type!");
+ 		return LDB_ERR_UNWILLING_TO_PERFORM;
+ 	}
+-	ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg, "sAMAccountType",
+-				 account_type);
++	ret = samdb_msg_append_uint(ldb, ac->msg, ac->msg, "sAMAccountType",
++				    account_type, LDB_FLAG_MOD_REPLACE);
+ 	if (ret != LDB_SUCCESS) {
+ 		return ret;
+ 	}
+-	el = ldb_msg_find_element(ac->msg, "sAMAccountType");
+-	el->flags = LDB_FLAG_MOD_REPLACE;
+ 
+ 	return LDB_SUCCESS;
+ }
+diff --git source4/dsdb/samdb/ldb_modules/tombstone_reanimate.c source4/dsdb/samdb/ldb_modules/tombstone_reanimate.c
+index 5f8911c66be..99c5955e9e7 100644
+--- source4/dsdb/samdb/ldb_modules/tombstone_reanimate.c
++++ source4/dsdb/samdb/ldb_modules/tombstone_reanimate.c
+@@ -294,14 +294,13 @@ static int tr_prepare_attributes(struct tr_context *ac)
+ 			return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM,
+ 					 "reanimate: Unrecognized account type!");
+ 		}
+-		ret = samdb_msg_add_uint(ldb, ac->mod_msg, ac->mod_msg,
+-					 "sAMAccountType", account_type);
++		ret = samdb_msg_append_uint(ldb, ac->mod_msg, ac->mod_msg,
++					    "sAMAccountType", account_type,
++					    LDB_FLAG_MOD_REPLACE);
+ 		if (ret != LDB_SUCCESS) {
+ 			return ldb_error(ldb, LDB_ERR_OPERATIONS_ERROR,
+ 					 "reanimate: Failed to add sAMAccountType to restored object.");
+ 		}
+-		el = ldb_msg_find_element(ac->mod_msg, "sAMAccountType");
+-		el->flags = LDB_FLAG_MOD_REPLACE;
+ 
+ 		/* Default values set by Windows */
+ 		ret = samdb_find_or_add_attribute(ldb, ac->mod_msg,
+@@ -324,12 +323,11 @@ static int tr_prepare_attributes(struct tr_context *ac)
+ 			return ret;
+ 		}
+ 
+-		ret = ldb_msg_add_string(ac->mod_msg, "objectCategory", value);
++		ret = ldb_msg_append_string(ac->mod_msg, "objectCategory", value,
++					    LDB_FLAG_MOD_ADD);
+ 		if (ret != LDB_SUCCESS) {
+ 			return ret;
+ 		}
+-		el = ldb_msg_find_element(ac->mod_msg, "objectCategory");
+-		el->flags = LDB_FLAG_MOD_ADD;
+ 	}
+ 
+ 	return LDB_SUCCESS;
+diff --git source4/nbt_server/wins/winsdb.c source4/nbt_server/wins/winsdb.c
+index e4a7c2042ed..2a05e96bca4 100644
+--- source4/nbt_server/wins/winsdb.c
++++ source4/nbt_server/wins/winsdb.c
+@@ -102,13 +102,11 @@ uint64_t winsdb_set_maxVersion(struct winsdb_handle *h, uint64_t newMaxVersion)
+ 	msg->dn = dn;
+ 
+ 
+-	ret = ldb_msg_add_empty(msg, "objectClass", LDB_FLAG_MOD_REPLACE, NULL);
++	ret = ldb_msg_append_string(msg, "objectClass", "winsMaxVersion",
++				    LDB_FLAG_MOD_REPLACE);
+ 	if (ret != LDB_SUCCESS) goto failed;
+-	ret = ldb_msg_add_string(msg, "objectClass", "winsMaxVersion");
+-	if (ret != LDB_SUCCESS) goto failed;
+-	ret = ldb_msg_add_empty(msg, "maxVersion", LDB_FLAG_MOD_REPLACE, NULL);
+-	if (ret != LDB_SUCCESS) goto failed;
+-	ret = ldb_msg_add_fmt(msg, "maxVersion", "%llu", (long long)newMaxVersion);
++	ret = ldb_msg_append_fmt(msg, LDB_FLAG_MOD_REPLACE,
++				 "maxVersion", "%llu", (long long)newMaxVersion);
+ 	if (ret != LDB_SUCCESS) goto failed;
+ 
+ 	ret = ldb_modify(wins_db, msg);
+@@ -779,8 +777,7 @@ static struct ldb_message *winsdb_message(struct ldb_context *ldb,
+ 		ret |= ldb_msg_add_winsdb_addr(msg, rec, "address", rec->addresses[i]);
+ 	}
+ 	if (rec->registered_by) {
+-		ret |= ldb_msg_add_empty(msg, "registeredBy", 0, NULL);
+-		ret |= ldb_msg_add_string(msg, "registeredBy", rec->registered_by);
++		ret |= ldb_msg_append_string(msg, "registeredBy", rec->registered_by, 0);
+ 	}
+ 	if (ret != LDB_SUCCESS) goto failed;
+ 	return msg;
+diff --git source4/rpc_server/lsa/dcesrv_lsa.c source4/rpc_server/lsa/dcesrv_lsa.c
+index 15b068aec62..a165ab2b9d6 100644
+--- source4/rpc_server/lsa/dcesrv_lsa.c
++++ source4/rpc_server/lsa/dcesrv_lsa.c
+@@ -1778,12 +1778,7 @@ static NTSTATUS update_uint32_t_value(TALLOC_CTX *mem_ctx,
+ 		goto done;
+ 	}
+ 
+-	ret = ldb_msg_add_empty(dest, attribute, flags, NULL);
+-	if (ret != LDB_SUCCESS) {
+-		return NT_STATUS_NO_MEMORY;
+-	}
+-
+-	ret = samdb_msg_add_uint(sam_ldb, dest, dest, attribute, value);
++	ret = samdb_msg_append_uint(sam_ldb, dest, dest, attribute, value, flags);
+ 	if (ret != LDB_SUCCESS) {
+ 		return NT_STATUS_NO_MEMORY;
+ 	}
+@@ -1874,13 +1869,7 @@ static NTSTATUS update_trust_user(TALLOC_CTX *mem_ctx,
+ 			continue;
+ 		}
+ 
+-		ret = ldb_msg_add_empty(msg, attribute,
+-					LDB_FLAG_MOD_REPLACE, NULL);
+-		if (ret != LDB_SUCCESS) {
+-			return NT_STATUS_NO_MEMORY;
+-		}
+-
+-		ret = ldb_msg_add_value(msg, attribute, &v, NULL);
++		ret = ldb_msg_append_value(msg, attribute, &v, LDB_FLAG_MOD_REPLACE);
+ 		if (ret != LDB_SUCCESS) {
+ 			return NT_STATUS_NO_MEMORY;
+ 		}
+@@ -2166,28 +2155,30 @@ static NTSTATUS setInfoTrustedDomain_base(struct dcesrv_call_state *dce_call,
+ 	}
+ 
+ 	if (add_incoming || del_incoming) {
+-		ret = ldb_msg_add_empty(msg, "trustAuthIncoming",
+-					LDB_FLAG_MOD_REPLACE, NULL);
+-		if (ret != LDB_SUCCESS) {
+-			return NT_STATUS_NO_MEMORY;
+-		}
+ 		if (add_incoming) {
+-			ret = ldb_msg_add_value(msg, "trustAuthIncoming",
+-						&trustAuthIncoming, NULL);
++			ret = ldb_msg_append_value(msg, "trustAuthIncoming",
++						   &trustAuthIncoming, LDB_FLAG_MOD_REPLACE);
++			if (ret != LDB_SUCCESS) {
++				return NT_STATUS_NO_MEMORY;
++			}
++		} else {
++			ret = ldb_msg_add_empty(msg, "trustAuthIncoming",
++						LDB_FLAG_MOD_REPLACE, NULL);
+ 			if (ret != LDB_SUCCESS) {
+ 				return NT_STATUS_NO_MEMORY;
+ 			}
+ 		}
+ 	}
+ 	if (add_outgoing || del_outgoing) {
+-		ret = ldb_msg_add_empty(msg, "trustAuthOutgoing",
+-					LDB_FLAG_MOD_REPLACE, NULL);
+-		if (ret != LDB_SUCCESS) {
+-			return NT_STATUS_NO_MEMORY;
+-		}
+ 		if (add_outgoing) {
+-			ret = ldb_msg_add_value(msg, "trustAuthOutgoing",
+-						&trustAuthOutgoing, NULL);
++			ret = ldb_msg_append_value(msg, "trustAuthOutgoing",
++						   &trustAuthOutgoing, LDB_FLAG_MOD_REPLACE);
++			if (ret != LDB_SUCCESS) {
++				return NT_STATUS_NO_MEMORY;
++			}
++		} else {
++			ret = ldb_msg_add_empty(msg, "trustAuthOutgoing",
++						LDB_FLAG_MOD_REPLACE, NULL);
+ 			if (ret != LDB_SUCCESS) {
+ 				return NT_STATUS_NO_MEMORY;
+ 			}
+@@ -4635,14 +4626,8 @@ static NTSTATUS dcesrv_lsa_lsaRSetForestTrustInformation(struct dcesrv_call_stat
+ 		goto done;
+ 	}
+ 
+-	ret = ldb_msg_add_empty(msg, "msDS-TrustForestTrustInfo",
+-				LDB_FLAG_MOD_REPLACE, NULL);
+-	if (ret != LDB_SUCCESS) {
+-		status = NT_STATUS_NO_MEMORY;
+-		goto done;
+-	}
+-	ret = ldb_msg_add_value(msg, "msDS-TrustForestTrustInfo",
+-				&ft_blob, NULL);
++	ret = ldb_msg_append_value(msg, "msDS-TrustForestTrustInfo",
++				   &ft_blob, LDB_FLAG_MOD_REPLACE);
+ 	if (ret != LDB_SUCCESS) {
+ 		status = NT_STATUS_NO_MEMORY;
+ 		goto done;
+diff --git source4/winbind/idmap.c source4/winbind/idmap.c
+index c4039be473a..c6375f8357a 100644
+--- source4/winbind/idmap.c
++++ source4/winbind/idmap.c
+@@ -672,14 +672,8 @@ static NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx,
+ 		vals[1].data = (uint8_t *)hwm_string;
+ 		vals[1].length = strlen(hwm_string);
+ 	} else {
+-		ret = ldb_msg_add_empty(hwm_msg, "xidNumber", LDB_FLAG_MOD_ADD,
+-					NULL);
+-		if (ret != LDB_SUCCESS) {
+-			status = NT_STATUS_NONE_MAPPED;
+-			goto failed;
+-		}
+-
+-		ret = ldb_msg_add_string(hwm_msg, "xidNumber", hwm_string);
++		ret = ldb_msg_append_string(hwm_msg, "xidNumber", hwm_string,
++					    LDB_FLAG_MOD_ADD);
+ 		if (ret != LDB_SUCCESS)
+ 		{
+ 			status = NT_STATUS_NONE_MAPPED;
+-- 
+2.25.1
+
+
+From 7270b68386692829f97d5c51c50108db395b263e Mon Sep 17 00:00:00 2001
+From: Andrew Bartlett <abartlet@samba.org>
+Date: Tue, 14 Jun 2022 15:43:26 +1200
+Subject: [PATCH 14/99] CVE-2022-32746 ldb: Release LDB 2.3.4
+
+* CVE-2022-32746 Use-after-free occurring in database audit logging module (bug 15009)
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
+
+Signed-off-by: Andrew Bartlett <abartlet@samba.org>
+---
+ lib/ldb/ABI/ldb-2.3.4.sigs        | 291 ++++++++++++++++++++++++++++++
+ lib/ldb/ABI/pyldb-util-2.3.4.sigs |   3 +
+ lib/ldb/wscript                   |   2 +-
+ 3 files changed, 295 insertions(+), 1 deletion(-)
+ create mode 100644 lib/ldb/ABI/ldb-2.3.4.sigs
+ create mode 100644 lib/ldb/ABI/pyldb-util-2.3.4.sigs
+
+diff --git lib/ldb/ABI/ldb-2.3.4.sigs lib/ldb/ABI/ldb-2.3.4.sigs
+new file mode 100644
+index 00000000000..40388d9e330
+--- /dev/null
++++ lib/ldb/ABI/ldb-2.3.4.sigs
+@@ -0,0 +1,291 @@
++ldb_add: int (struct ldb_context *, const struct ldb_message *)
++ldb_any_comparison: int (struct ldb_context *, void *, ldb_attr_handler_t, const struct ldb_val *, const struct ldb_val *)
++ldb_asprintf_errstring: void (struct ldb_context *, const char *, ...)
++ldb_attr_casefold: char *(TALLOC_CTX *, const char *)
++ldb_attr_dn: int (const char *)
++ldb_attr_in_list: int (const char * const *, const char *)
++ldb_attr_list_copy: const char **(TALLOC_CTX *, const char * const *)
++ldb_attr_list_copy_add: const char **(TALLOC_CTX *, const char * const *, const char *)
++ldb_base64_decode: int (char *)
++ldb_base64_encode: char *(TALLOC_CTX *, const char *, int)
++ldb_binary_decode: struct ldb_val (TALLOC_CTX *, const char *)
++ldb_binary_encode: char *(TALLOC_CTX *, struct ldb_val)
++ldb_binary_encode_string: char *(TALLOC_CTX *, const char *)
++ldb_build_add_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
++ldb_build_del_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
++ldb_build_extended_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, const char *, void *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
++ldb_build_mod_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
++ldb_build_rename_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, struct ldb_dn *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
++ldb_build_search_req: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, enum ldb_scope, const char *, const char * const *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
++ldb_build_search_req_ex: int (struct ldb_request **, struct ldb_context *, TALLOC_CTX *, struct ldb_dn *, enum ldb_scope, struct ldb_parse_tree *, const char * const *, struct ldb_control **, void *, ldb_request_callback_t, struct ldb_request *)
++ldb_casefold: char *(struct ldb_context *, TALLOC_CTX *, const char *, size_t)
++ldb_casefold_default: char *(void *, TALLOC_CTX *, const char *, size_t)
++ldb_check_critical_controls: int (struct ldb_control **)
++ldb_comparison_binary: int (struct ldb_context *, void *, const struct ldb_val *, const struct ldb_val *)
++ldb_comparison_fold: int (struct ldb_context *, void *, const struct ldb_val *, const struct ldb_val *)
++ldb_connect: int (struct ldb_context *, const char *, unsigned int, const char **)
++ldb_control_to_string: char *(TALLOC_CTX *, const struct ldb_control *)
++ldb_controls_except_specified: struct ldb_control **(struct ldb_control **, TALLOC_CTX *, struct ldb_control *)
++ldb_debug: void (struct ldb_context *, enum ldb_debug_level, const char *, ...)
++ldb_debug_add: void (struct ldb_context *, const char *, ...)
++ldb_debug_end: void (struct ldb_context *, enum ldb_debug_level)
++ldb_debug_set: void (struct ldb_context *, enum ldb_debug_level, const char *, ...)
++ldb_delete: int (struct ldb_context *, struct ldb_dn *)
++ldb_dn_add_base: bool (struct ldb_dn *, struct ldb_dn *)
++ldb_dn_add_base_fmt: bool (struct ldb_dn *, const char *, ...)
++ldb_dn_add_child: bool (struct ldb_dn *, struct ldb_dn *)
++ldb_dn_add_child_fmt: bool (struct ldb_dn *, const char *, ...)
++ldb_dn_add_child_val: bool (struct ldb_dn *, const char *, struct ldb_val)
++ldb_dn_alloc_casefold: char *(TALLOC_CTX *, struct ldb_dn *)
++ldb_dn_alloc_linearized: char *(TALLOC_CTX *, struct ldb_dn *)
++ldb_dn_canonical_ex_string: char *(TALLOC_CTX *, struct ldb_dn *)
++ldb_dn_canonical_string: char *(TALLOC_CTX *, struct ldb_dn *)
++ldb_dn_check_local: bool (struct ldb_module *, struct ldb_dn *)
++ldb_dn_check_special: bool (struct ldb_dn *, const char *)
++ldb_dn_compare: int (struct ldb_dn *, struct ldb_dn *)
++ldb_dn_compare_base: int (struct ldb_dn *, struct ldb_dn *)
++ldb_dn_copy: struct ldb_dn *(TALLOC_CTX *, struct ldb_dn *)
++ldb_dn_escape_value: char *(TALLOC_CTX *, struct ldb_val)
++ldb_dn_extended_add_syntax: int (struct ldb_context *, unsigned int, const struct ldb_dn_extended_syntax *)
++ldb_dn_extended_filter: void (struct ldb_dn *, const char * const *)
++ldb_dn_extended_syntax_by_name: const struct ldb_dn_extended_syntax *(struct ldb_context *, const char *)
++ldb_dn_from_ldb_val: struct ldb_dn *(TALLOC_CTX *, struct ldb_context *, const struct ldb_val *)
++ldb_dn_get_casefold: const char *(struct ldb_dn *)
++ldb_dn_get_comp_num: int (struct ldb_dn *)
++ldb_dn_get_component_name: const char *(struct ldb_dn *, unsigned int)
++ldb_dn_get_component_val: const struct ldb_val *(struct ldb_dn *, unsigned int)
++ldb_dn_get_extended_comp_num: int (struct ldb_dn *)
++ldb_dn_get_extended_component: const struct ldb_val *(struct ldb_dn *, const char *)
++ldb_dn_get_extended_linearized: char *(TALLOC_CTX *, struct ldb_dn *, int)
++ldb_dn_get_ldb_context: struct ldb_context *(struct ldb_dn *)
++ldb_dn_get_linearized: const char *(struct ldb_dn *)
++ldb_dn_get_parent: struct ldb_dn *(TALLOC_CTX *, struct ldb_dn *)
++ldb_dn_get_rdn_name: const char *(struct ldb_dn *)
++ldb_dn_get_rdn_val: const struct ldb_val *(struct ldb_dn *)
++ldb_dn_has_extended: bool (struct ldb_dn *)
++ldb_dn_is_null: bool (struct ldb_dn *)
++ldb_dn_is_special: bool (struct ldb_dn *)
++ldb_dn_is_valid: bool (struct ldb_dn *)
++ldb_dn_map_local: struct ldb_dn *(struct ldb_module *, void *, struct ldb_dn *)
++ldb_dn_map_rebase_remote: struct ldb_dn *(struct ldb_module *, void *, struct ldb_dn *)
++ldb_dn_map_remote: struct ldb_dn *(struct ldb_module *, void *, struct ldb_dn *)
++ldb_dn_minimise: bool (struct ldb_dn *)
++ldb_dn_new: struct ldb_dn *(TALLOC_CTX *, struct ldb_context *, const char *)
++ldb_dn_new_fmt: struct ldb_dn *(TALLOC_CTX *, struct ldb_context *, const char *, ...)
++ldb_dn_remove_base_components: bool (struct ldb_dn *, unsigned int)
++ldb_dn_remove_child_components: bool (struct ldb_dn *, unsigned int)
++ldb_dn_remove_extended_components: void (struct ldb_dn *)
++ldb_dn_replace_components: bool (struct ldb_dn *, struct ldb_dn *)
++ldb_dn_set_component: int (struct ldb_dn *, int, const char *, const struct ldb_val)
++ldb_dn_set_extended_component: int (struct ldb_dn *, const char *, const struct ldb_val *)
++ldb_dn_update_components: int (struct ldb_dn *, const struct ldb_dn *)
++ldb_dn_validate: bool (struct ldb_dn *)
++ldb_dump_results: void (struct ldb_context *, struct ldb_result *, FILE *)
++ldb_error_at: int (struct ldb_context *, int, const char *, const char *, int)
++ldb_errstring: const char *(struct ldb_context *)
++ldb_extended: int (struct ldb_context *, const char *, void *, struct ldb_result **)
++ldb_extended_default_callback: int (struct ldb_request *, struct ldb_reply *)
++ldb_filter_attrs: int (struct ldb_context *, const struct ldb_message *, const char * const *, struct ldb_message *)
++ldb_filter_from_tree: char *(TALLOC_CTX *, const struct ldb_parse_tree *)
++ldb_get_config_basedn: struct ldb_dn *(struct ldb_context *)
++ldb_get_create_perms: unsigned int (struct ldb_context *)
++ldb_get_default_basedn: struct ldb_dn *(struct ldb_context *)
++ldb_get_event_context: struct tevent_context *(struct ldb_context *)
++ldb_get_flags: unsigned int (struct ldb_context *)
++ldb_get_opaque: void *(struct ldb_context *, const char *)
++ldb_get_root_basedn: struct ldb_dn *(struct ldb_context *)
++ldb_get_schema_basedn: struct ldb_dn *(struct ldb_context *)
++ldb_global_init: int (void)
++ldb_handle_get_event_context: struct tevent_context *(struct ldb_handle *)
++ldb_handle_new: struct ldb_handle *(TALLOC_CTX *, struct ldb_context *)
++ldb_handle_use_global_event_context: void (struct ldb_handle *)
++ldb_handler_copy: int (struct ldb_context *, void *, const struct ldb_val *, struct ldb_val *)
++ldb_handler_fold: int (struct ldb_context *, void *, const struct ldb_val *, struct ldb_val *)
++ldb_init: struct ldb_context *(TALLOC_CTX *, struct tevent_context *)
++ldb_ldif_message_redacted_string: char *(struct ldb_context *, TALLOC_CTX *, enum ldb_changetype, const struct ldb_message *)
++ldb_ldif_message_string: char *(struct ldb_context *, TALLOC_CTX *, enum ldb_changetype, const struct ldb_message *)
++ldb_ldif_parse_modrdn: int (struct ldb_context *, const struct ldb_ldif *, TALLOC_CTX *, struct ldb_dn **, struct ldb_dn **, bool *, struct ldb_dn **, struct ldb_dn **)
++ldb_ldif_read: struct ldb_ldif *(struct ldb_context *, int (*)(void *), void *)
++ldb_ldif_read_file: struct ldb_ldif *(struct ldb_context *, FILE *)
++ldb_ldif_read_file_state: struct ldb_ldif *(struct ldb_context *, struct ldif_read_file_state *)
++ldb_ldif_read_free: void (struct ldb_context *, struct ldb_ldif *)
++ldb_ldif_read_string: struct ldb_ldif *(struct ldb_context *, const char **)
++ldb_ldif_write: int (struct ldb_context *, int (*)(void *, const char *, ...), void *, const struct ldb_ldif *)
++ldb_ldif_write_file: int (struct ldb_context *, FILE *, const struct ldb_ldif *)
++ldb_ldif_write_redacted_trace_string: char *(struct ldb_context *, TALLOC_CTX *, const struct ldb_ldif *)
++ldb_ldif_write_string: char *(struct ldb_context *, TALLOC_CTX *, const struct ldb_ldif *)
++ldb_load_modules: int (struct ldb_context *, const char **)
++ldb_map_add: int (struct ldb_module *, struct ldb_request *)
++ldb_map_delete: int (struct ldb_module *, struct ldb_request *)
++ldb_map_init: int (struct ldb_module *, const struct ldb_map_attribute *, const struct ldb_map_objectclass *, const char * const *, const char *, const char *)
++ldb_map_modify: int (struct ldb_module *, struct ldb_request *)
++ldb_map_rename: int (struct ldb_module *, struct ldb_request *)
++ldb_map_search: int (struct ldb_module *, struct ldb_request *)
++ldb_match_message: int (struct ldb_context *, const struct ldb_message *, const struct ldb_parse_tree *, enum ldb_scope, bool *)
++ldb_match_msg: int (struct ldb_context *, const struct ldb_message *, const struct ldb_parse_tree *, struct ldb_dn *, enum ldb_scope)
++ldb_match_msg_error: int (struct ldb_context *, const struct ldb_message *, const struct ldb_parse_tree *, struct ldb_dn *, enum ldb_scope, bool *)
++ldb_match_msg_objectclass: int (const struct ldb_message *, const char *)
++ldb_mod_register_control: int (struct ldb_module *, const char *)
++ldb_modify: int (struct ldb_context *, const struct ldb_message *)
++ldb_modify_default_callback: int (struct ldb_request *, struct ldb_reply *)
++ldb_module_call_chain: char *(struct ldb_request *, TALLOC_CTX *)
++ldb_module_connect_backend: int (struct ldb_context *, const char *, const char **, struct ldb_module **)
++ldb_module_done: int (struct ldb_request *, struct ldb_control **, struct ldb_extended *, int)
++ldb_module_flags: uint32_t (struct ldb_context *)
++ldb_module_get_ctx: struct ldb_context *(struct ldb_module *)
++ldb_module_get_name: const char *(struct ldb_module *)
++ldb_module_get_ops: const struct ldb_module_ops *(struct ldb_module *)
++ldb_module_get_private: void *(struct ldb_module *)
++ldb_module_init_chain: int (struct ldb_context *, struct ldb_module *)
++ldb_module_load_list: int (struct ldb_context *, const char **, struct ldb_module *, struct ldb_module **)
++ldb_module_new: struct ldb_module *(TALLOC_CTX *, struct ldb_context *, const char *, const struct ldb_module_ops *)
++ldb_module_next: struct ldb_module *(struct ldb_module *)
++ldb_module_popt_options: struct poptOption **(struct ldb_context *)
++ldb_module_send_entry: int (struct ldb_request *, struct ldb_message *, struct ldb_control **)
++ldb_module_send_referral: int (struct ldb_request *, char *)
++ldb_module_set_next: void (struct ldb_module *, struct ldb_module *)
++ldb_module_set_private: void (struct ldb_module *, void *)
++ldb_modules_hook: int (struct ldb_context *, enum ldb_module_hook_type)
++ldb_modules_list_from_string: const char **(struct ldb_context *, TALLOC_CTX *, const char *)
++ldb_modules_load: int (const char *, const char *)
++ldb_msg_add: int (struct ldb_message *, const struct ldb_message_element *, int)
++ldb_msg_add_empty: int (struct ldb_message *, const char *, int, struct ldb_message_element **)
++ldb_msg_add_fmt: int (struct ldb_message *, const char *, const char *, ...)
++ldb_msg_add_linearized_dn: int (struct ldb_message *, const char *, struct ldb_dn *)
++ldb_msg_add_steal_string: int (struct ldb_message *, const char *, char *)
++ldb_msg_add_steal_value: int (struct ldb_message *, const char *, struct ldb_val *)
++ldb_msg_add_string: int (struct ldb_message *, const char *, const char *)
++ldb_msg_add_string_flags: int (struct ldb_message *, const char *, const char *, int)
++ldb_msg_add_value: int (struct ldb_message *, const char *, const struct ldb_val *, struct ldb_message_element **)
++ldb_msg_append_fmt: int (struct ldb_message *, int, const char *, const char *, ...)
++ldb_msg_append_linearized_dn: int (struct ldb_message *, const char *, struct ldb_dn *, int)
++ldb_msg_append_steal_string: int (struct ldb_message *, const char *, char *, int)
++ldb_msg_append_steal_value: int (struct ldb_message *, const char *, struct ldb_val *, int)
++ldb_msg_append_string: int (struct ldb_message *, const char *, const char *, int)
++ldb_msg_append_value: int (struct ldb_message *, const char *, const struct ldb_val *, int)
++ldb_msg_canonicalize: struct ldb_message *(struct ldb_context *, const struct ldb_message *)
++ldb_msg_check_string_attribute: int (const struct ldb_message *, const char *, const char *)
++ldb_msg_copy: struct ldb_message *(TALLOC_CTX *, const struct ldb_message *)
++ldb_msg_copy_attr: int (struct ldb_message *, const char *, const char *)
++ldb_msg_copy_shallow: struct ldb_message *(TALLOC_CTX *, const struct ldb_message *)
++ldb_msg_diff: struct ldb_message *(struct ldb_context *, struct ldb_message *, struct ldb_message *)
++ldb_msg_difference: int (struct ldb_context *, TALLOC_CTX *, struct ldb_message *, struct ldb_message *, struct ldb_message **)
++ldb_msg_element_add_value: int (TALLOC_CTX *, struct ldb_message_element *, const struct ldb_val *)
++ldb_msg_element_compare: int (struct ldb_message_element *, struct ldb_message_element *)
++ldb_msg_element_compare_name: int (struct ldb_message_element *, struct ldb_message_element *)
++ldb_msg_element_equal_ordered: bool (const struct ldb_message_element *, const struct ldb_message_element *)
++ldb_msg_find_attr_as_bool: int (const struct ldb_message *, const char *, int)
++ldb_msg_find_attr_as_dn: struct ldb_dn *(struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, const char *)
++ldb_msg_find_attr_as_double: double (const struct ldb_message *, const char *, double)
++ldb_msg_find_attr_as_int: int (const struct ldb_message *, const char *, int)
++ldb_msg_find_attr_as_int64: int64_t (const struct ldb_message *, const char *, int64_t)
++ldb_msg_find_attr_as_string: const char *(const struct ldb_message *, const char *, const char *)
++ldb_msg_find_attr_as_uint: unsigned int (const struct ldb_message *, const char *, unsigned int)
++ldb_msg_find_attr_as_uint64: uint64_t (const struct ldb_message *, const char *, uint64_t)
++ldb_msg_find_common_values: int (struct ldb_context *, TALLOC_CTX *, struct ldb_message_element *, struct ldb_message_element *, uint32_t)
++ldb_msg_find_duplicate_val: int (struct ldb_context *, TALLOC_CTX *, const struct ldb_message_element *, struct ldb_val **, uint32_t)
++ldb_msg_find_element: struct ldb_message_element *(const struct ldb_message *, const char *)
++ldb_msg_find_ldb_val: const struct ldb_val *(const struct ldb_message *, const char *)
++ldb_msg_find_val: struct ldb_val *(const struct ldb_message_element *, struct ldb_val *)
++ldb_msg_new: struct ldb_message *(TALLOC_CTX *)
++ldb_msg_normalize: int (struct ldb_context *, TALLOC_CTX *, const struct ldb_message *, struct ldb_message **)
++ldb_msg_remove_attr: void (struct ldb_message *, const char *)
++ldb_msg_remove_element: void (struct ldb_message *, struct ldb_message_element *)
++ldb_msg_rename_attr: int (struct ldb_message *, const char *, const char *)
++ldb_msg_sanity_check: int (struct ldb_context *, const struct ldb_message *)
++ldb_msg_sort_elements: void (struct ldb_message *)
++ldb_next_del_trans: int (struct ldb_module *)
++ldb_next_end_trans: int (struct ldb_module *)
++ldb_next_init: int (struct ldb_module *)
++ldb_next_prepare_commit: int (struct ldb_module *)
++ldb_next_read_lock: int (struct ldb_module *)
++ldb_next_read_unlock: int (struct ldb_module *)
++ldb_next_remote_request: int (struct ldb_module *, struct ldb_request *)
++ldb_next_request: int (struct ldb_module *, struct ldb_request *)
++ldb_next_start_trans: int (struct ldb_module *)
++ldb_op_default_callback: int (struct ldb_request *, struct ldb_reply *)
++ldb_options_copy: const char **(TALLOC_CTX *, const char **)
++ldb_options_find: const char *(struct ldb_context *, const char **, const char *)
++ldb_options_get: const char **(struct ldb_context *)
++ldb_pack_data: int (struct ldb_context *, const struct ldb_message *, struct ldb_val *, uint32_t)
++ldb_parse_control_from_string: struct ldb_control *(struct ldb_context *, TALLOC_CTX *, const char *)
++ldb_parse_control_strings: struct ldb_control **(struct ldb_context *, TALLOC_CTX *, const char **)
++ldb_parse_tree: struct ldb_parse_tree *(TALLOC_CTX *, const char *)
++ldb_parse_tree_attr_replace: void (struct ldb_parse_tree *, const char *, const char *)
++ldb_parse_tree_copy_shallow: struct ldb_parse_tree *(TALLOC_CTX *, const struct ldb_parse_tree *)
++ldb_parse_tree_walk: int (struct ldb_parse_tree *, int (*)(struct ldb_parse_tree *, void *), void *)
++ldb_qsort: void (void * const, size_t, size_t, void *, ldb_qsort_cmp_fn_t)
++ldb_register_backend: int (const char *, ldb_connect_fn, bool)
++ldb_register_extended_match_rule: int (struct ldb_context *, const struct ldb_extended_match_rule *)
++ldb_register_hook: int (ldb_hook_fn)
++ldb_register_module: int (const struct ldb_module_ops *)
++ldb_rename: int (struct ldb_context *, struct ldb_dn *, struct ldb_dn *)
++ldb_reply_add_control: int (struct ldb_reply *, const char *, bool, void *)
++ldb_reply_get_control: struct ldb_control *(struct ldb_reply *, const char *)
++ldb_req_get_custom_flags: uint32_t (struct ldb_request *)
++ldb_req_is_untrusted: bool (struct ldb_request *)
++ldb_req_location: const char *(struct ldb_request *)
++ldb_req_mark_trusted: void (struct ldb_request *)
++ldb_req_mark_untrusted: void (struct ldb_request *)
++ldb_req_set_custom_flags: void (struct ldb_request *, uint32_t)
++ldb_req_set_location: void (struct ldb_request *, const char *)
++ldb_request: int (struct ldb_context *, struct ldb_request *)
++ldb_request_add_control: int (struct ldb_request *, const char *, bool, void *)
++ldb_request_done: int (struct ldb_request *, int)
++ldb_request_get_control: struct ldb_control *(struct ldb_request *, const char *)
++ldb_request_get_status: int (struct ldb_request *)
++ldb_request_replace_control: int (struct ldb_request *, const char *, bool, void *)
++ldb_request_set_state: void (struct ldb_request *, int)
++ldb_reset_err_string: void (struct ldb_context *)
++ldb_save_controls: int (struct ldb_control *, struct ldb_request *, struct ldb_control ***)
++ldb_schema_attribute_add: int (struct ldb_context *, const char *, unsigned int, const char *)
++ldb_schema_attribute_add_with_syntax: int (struct ldb_context *, const char *, unsigned int, const struct ldb_schema_syntax *)
++ldb_schema_attribute_by_name: const struct ldb_schema_attribute *(struct ldb_context *, const char *)
++ldb_schema_attribute_fill_with_syntax: int (struct ldb_context *, TALLOC_CTX *, const char *, unsigned int, const struct ldb_schema_syntax *, struct ldb_schema_attribute *)
++ldb_schema_attribute_remove: void (struct ldb_context *, const char *)
++ldb_schema_attribute_remove_flagged: void (struct ldb_context *, unsigned int)
++ldb_schema_attribute_set_override_handler: void (struct ldb_context *, ldb_attribute_handler_override_fn_t, void *)
++ldb_schema_set_override_GUID_index: void (struct ldb_context *, const char *, const char *)
++ldb_schema_set_override_indexlist: void (struct ldb_context *, bool)
++ldb_search: int (struct ldb_context *, TALLOC_CTX *, struct ldb_result **, struct ldb_dn *, enum ldb_scope, const char * const *, const char *, ...)
++ldb_search_default_callback: int (struct ldb_request *, struct ldb_reply *)
++ldb_sequence_number: int (struct ldb_context *, enum ldb_sequence_type, uint64_t *)
++ldb_set_create_perms: void (struct ldb_context *, unsigned int)
++ldb_set_debug: int (struct ldb_context *, void (*)(void *, enum ldb_debug_level, const char *, va_list), void *)
++ldb_set_debug_stderr: int (struct ldb_context *)
++ldb_set_default_dns: void (struct ldb_context *)
++ldb_set_errstring: void (struct ldb_context *, const char *)
++ldb_set_event_context: void (struct ldb_context *, struct tevent_context *)
++ldb_set_flags: void (struct ldb_context *, unsigned int)
++ldb_set_modules_dir: void (struct ldb_context *, const char *)
++ldb_set_opaque: int (struct ldb_context *, const char *, void *)
++ldb_set_require_private_event_context: void (struct ldb_context *)
++ldb_set_timeout: int (struct ldb_context *, struct ldb_request *, int)
++ldb_set_timeout_from_prev_req: int (struct ldb_context *, struct ldb_request *, struct ldb_request *)
++ldb_set_utf8_default: void (struct ldb_context *)
++ldb_set_utf8_fns: void (struct ldb_context *, void *, char *(*)(void *, void *, const char *, size_t))
++ldb_setup_wellknown_attributes: int (struct ldb_context *)
++ldb_should_b64_encode: int (struct ldb_context *, const struct ldb_val *)
++ldb_standard_syntax_by_name: const struct ldb_schema_syntax *(struct ldb_context *, const char *)
++ldb_strerror: const char *(int)
++ldb_string_to_time: time_t (const char *)
++ldb_string_utc_to_time: time_t (const char *)
++ldb_timestring: char *(TALLOC_CTX *, time_t)
++ldb_timestring_utc: char *(TALLOC_CTX *, time_t)
++ldb_transaction_cancel: int (struct ldb_context *)
++ldb_transaction_cancel_noerr: int (struct ldb_context *)
++ldb_transaction_commit: int (struct ldb_context *)
++ldb_transaction_prepare_commit: int (struct ldb_context *)
++ldb_transaction_start: int (struct ldb_context *)
++ldb_unpack_data: int (struct ldb_context *, const struct ldb_val *, struct ldb_message *)
++ldb_unpack_data_flags: int (struct ldb_context *, const struct ldb_val *, struct ldb_message *, unsigned int)
++ldb_unpack_get_format: int (const struct ldb_val *, uint32_t *)
++ldb_val_dup: struct ldb_val (TALLOC_CTX *, const struct ldb_val *)
++ldb_val_equal_exact: int (const struct ldb_val *, const struct ldb_val *)
++ldb_val_map_local: struct ldb_val (struct ldb_module *, void *, const struct ldb_map_attribute *, const struct ldb_val *)
++ldb_val_map_remote: struct ldb_val (struct ldb_module *, void *, const struct ldb_map_attribute *, const struct ldb_val *)
++ldb_val_string_cmp: int (const struct ldb_val *, const char *)
++ldb_val_to_time: int (const struct ldb_val *, time_t *)
++ldb_valid_attr_name: int (const char *)
++ldb_vdebug: void (struct ldb_context *, enum ldb_debug_level, const char *, va_list)
++ldb_wait: int (struct ldb_handle *, enum ldb_wait_type)
+diff --git lib/ldb/ABI/pyldb-util-2.3.4.sigs lib/ldb/ABI/pyldb-util-2.3.4.sigs
+new file mode 100644
+index 00000000000..164a806b2ff
+--- /dev/null
++++ lib/ldb/ABI/pyldb-util-2.3.4.sigs
+@@ -0,0 +1,3 @@
++pyldb_Dn_FromDn: PyObject *(struct ldb_dn *)
++pyldb_Object_AsDn: bool (TALLOC_CTX *, PyObject *, struct ldb_context *, struct ldb_dn **)
++pyldb_check_type: bool (PyObject *, const char *)
+
+-- 
+2.25.1
+
+
+From 6237c85565332e0be1890dd57cc7e25fb76571d7 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 16 Feb 2022 17:03:10 +1300
+Subject: [PATCH 15/99] CVE-2022-32745 s4/dsdb/samldb: Check for empty values
+ array
+
+This avoids potentially trying to access the first element of an empty
+array.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15008
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ source4/dsdb/samdb/ldb_modules/samldb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git source4/dsdb/samdb/ldb_modules/samldb.c source4/dsdb/samdb/ldb_modules/samldb.c
+index 107e643e492..3625bb42e58 100644
+--- source4/dsdb/samdb/ldb_modules/samldb.c
++++ source4/dsdb/samdb/ldb_modules/samldb.c
+@@ -751,7 +751,7 @@ static int samldb_schema_add_handle_linkid(struct samldb_ctx *ac)
+ 		return ret;
+ 	}
+ 
+-	if (el == NULL) {
++	if (el == NULL || el->num_values == 0) {
+ 		return LDB_SUCCESS;
+ 	}
+ 
+@@ -919,7 +919,7 @@ static int samldb_schema_add_handle_mapiid(struct samldb_ctx *ac)
+ 		return ret;
+ 	}
+ 
+-	if (el == NULL) {
++	if (el == NULL || el->num_values == 0) {
+ 		return LDB_SUCCESS;
+ 	}
+ 
+-- 
+2.25.1
+
+
+From 7c8427e5d2f247921ab44996829acfed1f5f2360 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 17 Feb 2022 11:11:53 +1300
+Subject: [PATCH 16/99] CVE-2022-32745 s4/dsdb/util: Use correct value for loop
+ count limit
+
+Currently, we can crash the server by sending a large number of values
+of a specific attribute (such as sAMAccountName) spread across a few
+message elements. If val_count is larger than the total number of
+elements, we get an access beyond the elements array.
+
+Similarly, we can include unrelated message elements prior to the
+message elements of the attribute in question, so that not all of the
+attribute's values are copied into the returned elements values array.
+This can cause the server to access uninitialised data, likely resulting
+in a crash or unexpected behaviour.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15008
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ source4/dsdb/samdb/ldb_modules/util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git source4/dsdb/samdb/ldb_modules/util.c source4/dsdb/samdb/ldb_modules/util.c
+index 405febf0b3d..14947746837 100644
+--- source4/dsdb/samdb/ldb_modules/util.c
++++ source4/dsdb/samdb/ldb_modules/util.c
+@@ -1546,7 +1546,7 @@ int dsdb_get_expected_new_values(TALLOC_CTX *mem_ctx,
+ 
+ 	v = _el->values;
+ 
+-	for (i = 0; i < val_count; i++) {
++	for (i = 0; i < msg->num_elements; i++) {
+ 		if (ldb_attr_cmp(msg->elements[i].name, attr_name) == 0) {
+ 			if ((operation == LDB_MODIFY) &&
+ 			    (LDB_FLAG_MOD_TYPE(msg->elements[i].flags)
+-- 
+2.25.1
+
+
+From 4d2d30c21b16a53d5547cb803efe49cb6304ce37 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 17 Feb 2022 11:13:38 +1300
+Subject: [PATCH 17/99] CVE-2022-32745 s4/dsdb/util: Don't call memcpy() with a
+ NULL pointer
+
+Doing so is undefined behaviour.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15008
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ source4/dsdb/samdb/ldb_modules/util.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git source4/dsdb/samdb/ldb_modules/util.c source4/dsdb/samdb/ldb_modules/util.c
+index 14947746837..35ae110b5ef 100644
+--- source4/dsdb/samdb/ldb_modules/util.c
++++ source4/dsdb/samdb/ldb_modules/util.c
+@@ -1548,15 +1548,19 @@ int dsdb_get_expected_new_values(TALLOC_CTX *mem_ctx,
+ 
+ 	for (i = 0; i < msg->num_elements; i++) {
+ 		if (ldb_attr_cmp(msg->elements[i].name, attr_name) == 0) {
++			const struct ldb_message_element *tmp_el = &msg->elements[i];
+ 			if ((operation == LDB_MODIFY) &&
+-			    (LDB_FLAG_MOD_TYPE(msg->elements[i].flags)
++			    (LDB_FLAG_MOD_TYPE(tmp_el->flags)
+ 						== LDB_FLAG_MOD_DELETE)) {
+ 				continue;
+ 			}
++			if (tmp_el->values == NULL || tmp_el->num_values == 0) {
++				continue;
++			}
+ 			memcpy(v,
+-			       msg->elements[i].values,
+-			       msg->elements[i].num_values);
+-			v += msg->elements[i].num_values;
++			       tmp_el->values,
++			       tmp_el->num_values);
++			v += tmp_el->num_values;
+ 		}
+ 	}
+ 
+-- 
+2.25.1
+
+
+From 65d96369fa4f915f01e203cfc8b15e48c5b4b440 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Fri, 3 Jun 2022 16:16:31 +1200
+Subject: [PATCH 18/99] CVE-2022-32745 s4/dsdb/util: Correctly copy values into
+ message element
+
+To use memcpy(), we need to specify the number of bytes to copy, rather
+than the number of ldb_val structures.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15008
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ source4/dsdb/samdb/ldb_modules/util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git source4/dsdb/samdb/ldb_modules/util.c source4/dsdb/samdb/ldb_modules/util.c
+index 35ae110b5ef..e7fe8f855df 100644
+--- source4/dsdb/samdb/ldb_modules/util.c
++++ source4/dsdb/samdb/ldb_modules/util.c
+@@ -1559,7 +1559,7 @@ int dsdb_get_expected_new_values(TALLOC_CTX *mem_ctx,
+ 			}
+ 			memcpy(v,
+ 			       tmp_el->values,
+-			       tmp_el->num_values);
++			       tmp_el->num_values * sizeof(*v));
+ 			v += tmp_el->num_values;
+ 		}
+ 	}
+-- 
+2.25.1
+
+
+From 34eb92a2066cc403aac5a3708257b04a40ba19ee Mon Sep 17 00:00:00 2001
+From: Isaac Boukris <iboukris@gmail.com>
+Date: Sat, 19 Sep 2020 14:16:20 +0200
+Subject: [PATCH 19/99] s4:mit-kdb: Force canonicalization for looking up
+ principals
+
+See also
+https://github.com/krb5/krb5/commit/ac8865a22138ab0c657208c41be8fd6bc7968148
+
+Pair-Programmed-With: Andreas Schneider <asn@samba.org>
+Signed-off-by: Isaac Boukris <iboukris@gmail.com>
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Alexander Bokovoy <ab@samba.org>
+
+Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
+Autobuild-Date(master): Mon Nov 29 09:32:26 UTC 2021 on sn-devel-184
+
+(cherry picked from commit 90febd2a33b88af49af595fe0e995d6ba0f33a1b)
+
+[jsutton@samba.org Removed MIT knownfail changes]
+---
+ source4/heimdal/lib/hdb/hdb.h | 1 +
+ source4/kdc/db-glue.c         | 7 ++++++-
+ source4/kdc/mit_samba.c       | 8 ++++++++
+ source4/kdc/sdb.h             | 1 +
+ 4 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git source4/heimdal/lib/hdb/hdb.h source4/heimdal/lib/hdb/hdb.h
+index 5ef9d9565f3..dafaffc6c2d 100644
+--- source4/heimdal/lib/hdb/hdb.h
++++ source4/heimdal/lib/hdb/hdb.h
+@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
+ #define HDB_F_ALL_KVNOS		2048	/* we want all the keys, live or not */
+ #define HDB_F_FOR_AS_REQ	4096	/* fetch is for a AS REQ */
+ #define HDB_F_FOR_TGS_REQ	8192	/* fetch is for a TGS REQ */
++#define HDB_F_FORCE_CANON	16384	/* force canonicalition */
+ 
+ /* hdb_capability_flags */
+ #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
+diff --git source4/kdc/db-glue.c source4/kdc/db-glue.c
+index 3a7e2176653..ac47fe78373 100644
+--- source4/kdc/db-glue.c
++++ source4/kdc/db-glue.c
+@@ -957,11 +957,16 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
+ 			krb5_clear_error_message(context);
+ 			goto out;
+ 		}
+-	} else if ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) {
++	} else if ((flags & SDB_F_FORCE_CANON) ||
++		   ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ))) {
+ 		/*
+ 		 * SDB_F_CANON maps from the canonicalize flag in the
+ 		 * packet, and has a different meaning between AS-REQ
+ 		 * and TGS-REQ.  We only change the principal in the AS-REQ case
++		 *
++		 * The SDB_F_FORCE_CANON if for new MIT KDC code that wants
++		 * the canonical name in all lookups, and takes care to
++		 * canonicalize only when appropriate.
+ 		 */
+ 		ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);
+ 		if (ret) {
+diff --git source4/kdc/mit_samba.c source4/kdc/mit_samba.c
+index e015c5a52db..c2a604045d9 100644
+--- source4/kdc/mit_samba.c
++++ source4/kdc/mit_samba.c
+@@ -195,6 +195,14 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
+ 		return ENOMEM;
+ 	}
+ 
++#if KRB5_KDB_API_VERSION >= 10
++	/*
++	 * The MIT KDC code that wants the canonical name in all lookups, and
++	 * takes care to canonicalize only when appropriate.
++	 */
++	sflags |= SDB_F_FORCE_CANON;
++#endif
++
+ 	if (kflags & KRB5_KDB_FLAG_CANONICALIZE) {
+ 		sflags |= SDB_F_CANON;
+ 	}
+diff --git source4/kdc/sdb.h source4/kdc/sdb.h
+index c929acccce6..a9115ec23d7 100644
+--- source4/kdc/sdb.h
++++ source4/kdc/sdb.h
+@@ -116,6 +116,7 @@ struct sdb_entry_ex {
+ #define SDB_F_KVNO_SPECIFIED	128	/* we want a particular KVNO */
+ #define SDB_F_FOR_AS_REQ	4096	/* fetch is for a AS REQ */
+ #define SDB_F_FOR_TGS_REQ	8192	/* fetch is for a TGS REQ */
++#define SDB_F_FORCE_CANON	16384	/* force canonicalition */
+ 
+ void sdb_free_entry(struct sdb_entry_ex *e);
+ void free_sdb_entry(struct sdb_entry *s);
+-- 
+2.25.1
+
+
+From 06a0a75b16bace9c29568653d9e4bde4050c5ee5 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Tue, 21 Dec 2021 12:17:11 +0100
+Subject: [PATCH 20/99] s4:kdc: Also cannoicalize krbtgt principals when
+ enforcing canonicalization
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Stefan Metzmacher <metze@samba.org>
+(cherry picked from commit f1ec950aeb47283a504018bafa21f54c3282e70c)
+---
+ source4/kdc/db-glue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git source4/kdc/db-glue.c source4/kdc/db-glue.c
+index ac47fe78373..d017741e30a 100644
+--- source4/kdc/db-glue.c
++++ source4/kdc/db-glue.c
+@@ -920,7 +920,7 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
+ 	if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) {
+ 		p->is_krbtgt = true;
+ 
+-		if (flags & (SDB_F_CANON)) {
++		if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) {
+ 			/*
+ 			 * When requested to do so, ensure that the
+ 			 * both realm values in the principal are set
+-- 
+2.25.1
+
+
+From b4005403032b0b33ca88d3abcbf085621b32bd5b Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 11:30:38 +1300
+Subject: [PATCH 21/99] selftest: Check received LDB error code when
+ STRICT_CHECKING=0
+
+We were instead only checking the expected error.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit ad4d6fb01fd8083e68f07c427af8932574810cdc)
+---
+ source4/dsdb/tests/python/priv_attrs.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git source4/dsdb/tests/python/priv_attrs.py source4/dsdb/tests/python/priv_attrs.py
+index aa35dcc1317..4dfdfb9cbb8 100644
+--- source4/dsdb/tests/python/priv_attrs.py
++++ source4/dsdb/tests/python/priv_attrs.py
+@@ -167,7 +167,7 @@ class PrivAttrsTests(samba.tests.TestCase):
+         creds_tmp.set_kerberos_state(DONT_USE_KERBEROS)  # kinit is too expensive to use in a tight loop
+         return creds_tmp
+ 
+-    def assertGotLdbError(self, got, wanted):
++    def assertGotLdbError(self, wanted, got):
+         if not self.strict_checking:
+             self.assertNotEqual(got, ldb.SUCCESS)
+         else:
+-- 
+2.25.1
+
+
+From 6a4ed078902dcc57ab14f701c88e76ec0ac375e7 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 11:53:18 +1300
+Subject: [PATCH 22/99] tests/krb5: Remove unused variable
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 57b1b76154d699b9d70ad04fa5e94c4b30f0e4bf)
+---
+ python/samba/tests/krb5/raw_testcase.py | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git python/samba/tests/krb5/raw_testcase.py python/samba/tests/krb5/raw_testcase.py
+index 42f2e94f5aa..36a6134e6c9 100644
+--- python/samba/tests/krb5/raw_testcase.py
++++ python/samba/tests/krb5/raw_testcase.py
+@@ -2855,7 +2855,6 @@ class RawKerberosTest(TestCaseInTempDir):
+ 
+         expect_etype_info2 = ()
+         expect_etype_info = False
+-        unexpect_etype_info = True
+         expected_aes_type = 0
+         expected_rc4_type = 0
+         if kcrypto.Enctype.RC4 in proposed_etypes:
+@@ -2868,7 +2867,6 @@ class RawKerberosTest(TestCaseInTempDir):
+                 if etype > expected_aes_type:
+                     expected_aes_type = etype
+             if etype in (kcrypto.Enctype.RC4,) and error_code != 0:
+-                unexpect_etype_info = False
+                 if etype > expected_rc4_type:
+                     expected_rc4_type = etype
+ 
+-- 
+2.25.1
+
+
+From 837453d34799f44653d0d6d690d3e3d5eb074993 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 11:34:11 +1300
+Subject: [PATCH 23/99] tests/krb5: Deduplicate AS-REQ tests
+
+salt_tests was running the tests defined in the base class as well as
+its own tests.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit f0b222e3ecf72c8562bc97bedd9f3a92980b60d5)
+---
+ python/samba/tests/krb5/as_req_tests.py | 163 ++++++++++++------------
+ python/samba/tests/krb5/salt_tests.py   |   4 +-
+ 2 files changed, 85 insertions(+), 82 deletions(-)
+
+diff --git python/samba/tests/krb5/as_req_tests.py python/samba/tests/krb5/as_req_tests.py
+index 08081928363..315720f85d6 100755
+--- python/samba/tests/krb5/as_req_tests.py
++++ python/samba/tests/krb5/as_req_tests.py
+@@ -38,87 +38,8 @@ from samba.tests.krb5.rfc4120_constants import (
+ global_asn1_print = False
+ global_hexdump = False
+ 
+-@DynamicTestCase
+-class AsReqKerberosTests(KDCBaseTest):
+-
+-    @classmethod
+-    def setUpDynamicTestCases(cls):
+-        for (name, idx) in cls.etype_test_permutation_name_idx():
+-            for pac in [None, True, False]:
+-                tname = "%s_pac_%s" % (name, pac)
+-                targs = (idx, pac)
+-                cls.generate_dynamic_test("test_as_req_no_preauth", tname, *targs)
+-
+-    def setUp(self):
+-        super(AsReqKerberosTests, self).setUp()
+-        self.do_asn1_print = global_asn1_print
+-        self.do_hexdump = global_hexdump
+-
+-    def _test_as_req_nopreauth(self,
+-                               initial_etypes,
+-                               pac=None,
+-                               initial_kdc_options=None):
+-        client_creds = self.get_client_creds()
+-        client_account = client_creds.get_username()
+-        client_as_etypes = self.get_default_enctypes()
+-        krbtgt_creds = self.get_krbtgt_creds(require_keys=False)
+-        krbtgt_account = krbtgt_creds.get_username()
+-        realm = krbtgt_creds.get_realm()
+-
+-        cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
+-                                          names=[client_account])
+-        sname = self.PrincipalName_create(name_type=NT_SRV_INST,
+-                                          names=[krbtgt_account, realm])
+-
+-        expected_crealm = realm
+-        expected_cname = cname
+-        expected_srealm = realm
+-        expected_sname = sname
+-        expected_salt = client_creds.get_salt()
+-
+-        if any(etype in client_as_etypes and etype in initial_etypes
+-               for etype in (kcrypto.Enctype.AES256,
+-                             kcrypto.Enctype.AES128,
+-                             kcrypto.Enctype.RC4)):
+-            expected_error_mode = KDC_ERR_PREAUTH_REQUIRED
+-        else:
+-            expected_error_mode = KDC_ERR_ETYPE_NOSUPP
+-
+-        kdc_exchange_dict = self.as_exchange_dict(
+-            expected_crealm=expected_crealm,
+-            expected_cname=expected_cname,
+-            expected_srealm=expected_srealm,
+-            expected_sname=expected_sname,
+-            generate_padata_fn=None,
+-            check_error_fn=self.generic_check_kdc_error,
+-            check_rep_fn=None,
+-            expected_error_mode=expected_error_mode,
+-            client_as_etypes=client_as_etypes,
+-            expected_salt=expected_salt,
+-            kdc_options=str(initial_kdc_options),
+-            pac_request=pac)
+-
+-        self._generic_kdc_exchange(kdc_exchange_dict,
+-                                   cname=cname,
+-                                   realm=realm,
+-                                   sname=sname,
+-                                   etypes=initial_etypes)
+-
+-    def _test_as_req_no_preauth_with_args(self, etype_idx, pac):
+-        name, etypes = self.etype_test_permutation_by_idx(etype_idx)
+-        self._test_as_req_nopreauth(
+-                     pac=pac,
+-                     initial_etypes=etypes,
+-                     initial_kdc_options=krb5_asn1.KDCOptions('forwardable'))
+-
+-    def test_as_req_enc_timestamp(self):
+-        client_creds = self.get_client_creds()
+-        self._run_as_req_enc_timestamp(client_creds)
+-
+-    def test_as_req_enc_timestamp_mac(self):
+-        client_creds = self.get_mach_creds()
+-        self._run_as_req_enc_timestamp(client_creds)
+ 
++class AsReqBaseTest(KDCBaseTest):
+     def _run_as_req_enc_timestamp(self, client_creds):
+         client_account = client_creds.get_username()
+         client_as_etypes = self.get_default_enctypes()
+@@ -207,6 +128,88 @@ class AsReqKerberosTests(KDCBaseTest):
+         return etype_info2
+ 
+ 
++@DynamicTestCase
++class AsReqKerberosTests(AsReqBaseTest):
++
++    @classmethod
++    def setUpDynamicTestCases(cls):
++        for (name, idx) in cls.etype_test_permutation_name_idx():
++            for pac in [None, True, False]:
++                tname = "%s_pac_%s" % (name, pac)
++                targs = (idx, pac)
++                cls.generate_dynamic_test("test_as_req_no_preauth", tname, *targs)
++
++    def setUp(self):
++        super(AsReqKerberosTests, self).setUp()
++        self.do_asn1_print = global_asn1_print
++        self.do_hexdump = global_hexdump
++
++    def _test_as_req_nopreauth(self,
++                               initial_etypes,
++                               pac=None,
++                               initial_kdc_options=None):
++        client_creds = self.get_client_creds()
++        client_account = client_creds.get_username()
++        client_as_etypes = self.get_default_enctypes()
++        krbtgt_creds = self.get_krbtgt_creds(require_keys=False)
++        krbtgt_account = krbtgt_creds.get_username()
++        realm = krbtgt_creds.get_realm()
++
++        cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
++                                          names=[client_account])
++        sname = self.PrincipalName_create(name_type=NT_SRV_INST,
++                                          names=[krbtgt_account, realm])
++
++        expected_crealm = realm
++        expected_cname = cname
++        expected_srealm = realm
++        expected_sname = sname
++        expected_salt = client_creds.get_salt()
++
++        if any(etype in client_as_etypes and etype in initial_etypes
++               for etype in (kcrypto.Enctype.AES256,
++                             kcrypto.Enctype.AES128,
++                             kcrypto.Enctype.RC4)):
++            expected_error_mode = KDC_ERR_PREAUTH_REQUIRED
++        else:
++            expected_error_mode = KDC_ERR_ETYPE_NOSUPP
++
++        kdc_exchange_dict = self.as_exchange_dict(
++            expected_crealm=expected_crealm,
++            expected_cname=expected_cname,
++            expected_srealm=expected_srealm,
++            expected_sname=expected_sname,
++            generate_padata_fn=None,
++            check_error_fn=self.generic_check_kdc_error,
++            check_rep_fn=None,
++            expected_error_mode=expected_error_mode,
++            client_as_etypes=client_as_etypes,
++            expected_salt=expected_salt,
++            kdc_options=str(initial_kdc_options),
++            pac_request=pac)
++
++        self._generic_kdc_exchange(kdc_exchange_dict,
++                                   cname=cname,
++                                   realm=realm,
++                                   sname=sname,
++                                   etypes=initial_etypes)
++
++    def _test_as_req_no_preauth_with_args(self, etype_idx, pac):
++        name, etypes = self.etype_test_permutation_by_idx(etype_idx)
++        self._test_as_req_nopreauth(
++                     pac=pac,
++                     initial_etypes=etypes,
++                     initial_kdc_options=krb5_asn1.KDCOptions('forwardable'))
++
++    def test_as_req_enc_timestamp(self):
++        client_creds = self.get_client_creds()
++        self._run_as_req_enc_timestamp(client_creds)
++
++    def test_as_req_enc_timestamp_mac(self):
++        client_creds = self.get_mach_creds()
++        self._run_as_req_enc_timestamp(client_creds)
++
++
+ if __name__ == "__main__":
+     global_asn1_print = False
+     global_hexdump = False
+diff --git python/samba/tests/krb5/salt_tests.py python/samba/tests/krb5/salt_tests.py
+index ecbf618e40e..db777f8b7bc 100755
+--- python/samba/tests/krb5/salt_tests.py
++++ python/samba/tests/krb5/salt_tests.py
+@@ -21,7 +21,7 @@ import os
+ 
+ import ldb
+ 
+-from samba.tests.krb5.as_req_tests import AsReqKerberosTests
++from samba.tests.krb5.as_req_tests import AsReqBaseTest
+ import samba.tests.krb5.kcrypto as kcrypto
+ 
+ sys.path.insert(0, "bin/python")
+@@ -31,7 +31,7 @@ global_asn1_print = False
+ global_hexdump = False
+ 
+ 
+-class SaltTests(AsReqKerberosTests):
++class SaltTests(AsReqBaseTest):
+ 
+     def setUp(self):
+         super().setUp()
+-- 
+2.25.1
+
+
+From 3d48ade670bb5b026d7bc0a26a4fa6775b21653b Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 16:02:00 +1300
+Subject: [PATCH 24/99] tests/krb5: Run test_rpc against member server
+
+We were instead always running against the DC.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 167bd2070483004cd0b9a96ffb40ea73c6ddf579)
+---
+ python/samba/tests/krb5/test_rpc.py | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git python/samba/tests/krb5/test_rpc.py python/samba/tests/krb5/test_rpc.py
+index 03c125f518a..2d483986e83 100755
+--- python/samba/tests/krb5/test_rpc.py
++++ python/samba/tests/krb5/test_rpc.py
+@@ -58,7 +58,7 @@ class RpcTests(KDCBaseTest):
+ 
+         samdb = self.get_samdb()
+ 
+-        mach_name = samdb.host_dns_name()
++        mach_name = self.host
+         service = "cifs"
+ 
+         # Create the user account.
+@@ -67,7 +67,7 @@ class RpcTests(KDCBaseTest):
+             use_cache=False)
+         user_name = user_credentials.get_username()
+ 
+-        mach_credentials = self.get_dc_creds()
++        mach_credentials = self.get_server_creds()
+ 
+         # Talk to the KDC to obtain the service ticket, which gets placed into
+         # the cache. The machine account name has to match the name in the
+@@ -114,8 +114,7 @@ class RpcTests(KDCBaseTest):
+             self.assertEqual(user_name, account_name.string)
+ 
+     def test_rpc_anonymous(self):
+-        samdb = self.get_samdb()
+-        mach_name = samdb.host_dns_name()
++        mach_name = self.host
+ 
+         anon_creds = credentials.Credentials()
+         anon_creds.set_anonymous()
+@@ -125,7 +124,7 @@ class RpcTests(KDCBaseTest):
+ 
+         (account_name, _) = conn.GetUserName(None, None, None)
+ 
+-        self.assertEqual('ANONYMOUS LOGON', account_name.string)
++        self.assertEqual('ANONYMOUS LOGON', account_name.string.upper())
+ 
+ 
+ if __name__ == "__main__":
+-- 
+2.25.1
+
+
+From bf1aa0927895b1007ecea738681235b5be2e6208 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 11:37:35 +1300
+Subject: [PATCH 25/99] tests/krb5: Allow PasswordKey_create() to use s2kparams
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit a560c2e9ad8abb824d1805c86c656943745f81eb)
+---
+ python/samba/tests/krb5/raw_testcase.py | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git python/samba/tests/krb5/raw_testcase.py python/samba/tests/krb5/raw_testcase.py
+index 36a6134e6c9..da3f69c79c6 100644
+--- python/samba/tests/krb5/raw_testcase.py
++++ python/samba/tests/krb5/raw_testcase.py
+@@ -1167,10 +1167,11 @@ class RawKerberosTest(TestCaseInTempDir):
+         key = kcrypto.Key(etype, contents)
+         return RodcPacEncryptionKey(key, kvno)
+ 
+-    def PasswordKey_create(self, etype=None, pwd=None, salt=None, kvno=None):
++    def PasswordKey_create(self, etype=None, pwd=None, salt=None, kvno=None,
++                           params=None):
+         self.assertIsNotNone(pwd)
+         self.assertIsNotNone(salt)
+-        key = kcrypto.string_to_key(etype, pwd, salt)
++        key = kcrypto.string_to_key(etype, pwd, salt, params=params)
+         return RodcPacEncryptionKey(key, kvno)
+ 
+     def PasswordKey_from_etype_info2(self, creds, etype_info2, kvno=None):
+@@ -1182,9 +1183,11 @@ class RawKerberosTest(TestCaseInTempDir):
+             nthash = creds.get_nt_hash()
+             return self.SessionKey_create(etype=e, contents=nthash, kvno=kvno)
+ 
++        params = etype_info2.get('s2kparams')
++
+         password = creds.get_password()
+         return self.PasswordKey_create(
+-            etype=e, pwd=password, salt=salt, kvno=kvno)
++            etype=e, pwd=password, salt=salt, kvno=kvno, params=params)
+ 
+     def TicketDecryptionKey_from_creds(self, creds, etype=None):
+ 
+-- 
+2.25.1
+
+
+From 651db77b1c19c036cf229c44b764b0155e1dc399 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 11:40:35 +1300
+Subject: [PATCH 26/99] tests/krb5: Split out methods to create renewable or
+ invalid tickets
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit e930274aa43810d6485c3c8a7c82958ecb409630)
+---
+ python/samba/tests/krb5/kdc_tgs_tests.py | 68 +++++++++++++-----------
+ 1 file changed, 36 insertions(+), 32 deletions(-)
+
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index abac5a47a56..0578969ba69 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -1786,6 +1786,40 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         self._run_tgs(tgt, expected_error=KDC_ERR_C_PRINCIPAL_UNKNOWN)
+ 
++    def _modify_renewable(self, enc_part):
++        # Set the renewable flag.
++        renewable_flag = krb5_asn1.TicketFlags('renewable')
++        pos = len(tuple(renewable_flag)) - 1
++
++        flags = enc_part['flags']
++        self.assertLessEqual(pos, len(flags))
++
++        new_flags = flags[:pos] + '1' + flags[pos + 1:]
++        enc_part['flags'] = new_flags
++
++        # Set the renew-till time to be in the future.
++        renew_till = self.get_KerberosTime(offset=100 * 60 * 60)
++        enc_part['renew-till'] = renew_till
++
++        return enc_part
++
++    def _modify_invalid(self, enc_part):
++        # Set the invalid flag.
++        invalid_flag = krb5_asn1.TicketFlags('invalid')
++        pos = len(tuple(invalid_flag)) - 1
++
++        flags = enc_part['flags']
++        self.assertLessEqual(pos, len(flags))
++
++        new_flags = flags[:pos] + '1' + flags[pos + 1:]
++        enc_part['flags'] = new_flags
++
++        # Set the ticket start time to be in the past.
++        past_time = self.get_KerberosTime(offset=-100 * 60 * 60)
++        enc_part['starttime'] = past_time
++
++        return enc_part
++
+     def _get_tgt(self,
+                  client_creds,
+                  renewable=False,
+@@ -1880,39 +1914,9 @@ class KdcTgsTests(KDCBaseTest):
+             }
+ 
+         if renewable:
+-            def flags_modify_fn(enc_part):
+-                # Set the renewable flag.
+-                renewable_flag = krb5_asn1.TicketFlags('renewable')
+-                pos = len(tuple(renewable_flag)) - 1
+-
+-                flags = enc_part['flags']
+-                self.assertLessEqual(pos, len(flags))
+-
+-                new_flags = flags[:pos] + '1' + flags[pos + 1:]
+-                enc_part['flags'] = new_flags
+-
+-                # Set the renew-till time to be in the future.
+-                renew_till = self.get_KerberosTime(offset=100 * 60 * 60)
+-                enc_part['renew-till'] = renew_till
+-
+-                return enc_part
++            flags_modify_fn = self._modify_renewable
+         elif invalid:
+-            def flags_modify_fn(enc_part):
+-                # Set the invalid flag.
+-                invalid_flag = krb5_asn1.TicketFlags('invalid')
+-                pos = len(tuple(invalid_flag)) - 1
+-
+-                flags = enc_part['flags']
+-                self.assertLessEqual(pos, len(flags))
+-
+-                new_flags = flags[:pos] + '1' + flags[pos + 1:]
+-                enc_part['flags'] = new_flags
+-
+-                # Set the ticket start time to be in the past.
+-                past_time = self.get_KerberosTime(offset=-100 * 60 * 60)
+-                enc_part['starttime'] = past_time
+-
+-                return enc_part
++            flags_modify_fn = self._modify_invalid
+         else:
+             flags_modify_fn = None
+ 
+-- 
+2.25.1
+
+
+From 1e9ad4246ce7fe7a212da4357e6e11c5ac22a8b2 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 11:52:31 +1300
+Subject: [PATCH 27/99] tests/krb5: Adjust error codes to better match Windows
+ with PacRequestorEnforcement=2
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit d95705172bcf6fe24817800a4c0009e9cc8be595)
+
+[jsutton@samba.org Fixed MIT knownfail conflict]
+---
+ python/samba/tests/krb5/alias_tests.py        |   7 +-
+ python/samba/tests/krb5/kdc_tgs_tests.py      | 130 ++++++++----------
+ .../ms_kile_client_principal_lookup_tests.py  |  39 ++----
+ python/samba/tests/krb5/s4u_tests.py          |  57 ++++----
+ python/samba/tests/krb5/test_rpc.py           |   8 +-
+ selftest/knownfail_heimdal_kdc                |  64 +++++++++
+ selftest/knownfail_mit_kdc                    |   9 ++
+ 7 files changed, 181 insertions(+), 133 deletions(-)
+
+diff --git python/samba/tests/krb5/alias_tests.py python/samba/tests/krb5/alias_tests.py
+index 60213845a44..1f63775c189 100755
+--- python/samba/tests/krb5/alias_tests.py
++++ python/samba/tests/krb5/alias_tests.py
+@@ -28,7 +28,7 @@ from samba.tests.krb5.kdc_base_test import KDCBaseTest
+ from samba.tests.krb5.rfc4120_constants import (
+     AES256_CTS_HMAC_SHA1_96,
+     ARCFOUR_HMAC_MD5,
+-    KDC_ERR_CLIENT_NAME_MISMATCH,
++    KDC_ERR_TGT_REVOKED,
+     NT_PRINCIPAL,
+ )
+ 
+@@ -168,7 +168,7 @@ class AliasTests(KDCBaseTest):
+                                              ctype=None)
+             return [padata], req_body
+ 
+-        expected_error_mode = KDC_ERR_CLIENT_NAME_MISMATCH
++        expected_error_mode = KDC_ERR_TGT_REVOKED
+ 
+         # Make a request using S4U2Self. The request should fail.
+         kdc_exchange_dict = self.tgs_exchange_dict(
+@@ -184,7 +184,8 @@ class AliasTests(KDCBaseTest):
+             tgt=tgt,
+             authenticator_subkey=authenticator_subkey,
+             kdc_options='0',
+-            expect_pac=True)
++            expect_pac=True,
++            expect_edata=False)
+ 
+         rep = self._generic_kdc_exchange(kdc_exchange_dict,
+                                          cname=None,
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index 0578969ba69..7ea15f0fbab 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -23,7 +23,7 @@ import os
+ import ldb
+ 
+ 
+-from samba import dsdb, ntstatus
++from samba import dsdb
+ 
+ from samba.dcerpc import krb5pac, security
+ 
+@@ -38,8 +38,6 @@ from samba.tests.krb5.rfc4120_constants import (
+     KRB_ERROR,
+     KRB_TGS_REP,
+     KDC_ERR_BADMATCH,
+-    KDC_ERR_BADOPTION,
+-    KDC_ERR_CLIENT_NAME_MISMATCH,
+     KDC_ERR_GENERIC,
+     KDC_ERR_MODIFIED,
+     KDC_ERR_POLICY,
+@@ -262,7 +260,7 @@ class KdcTgsTests(KDCBaseTest):
+         authenticator_subkey = self.RandomKey(kcrypto.Enctype.AES256)
+ 
+         if expect_error:
+-            expected_error_mode = KDC_ERR_BADOPTION
++            expected_error_mode = KDC_ERR_TGT_REVOKED
+             check_error_fn = self.generic_check_kdc_error
+             check_rep_fn = None
+         else:
+@@ -288,7 +286,8 @@ class KdcTgsTests(KDCBaseTest):
+             authenticator_subkey=authenticator_subkey,
+             kdc_options=kdc_options,
+             pac_request=pac_request,
+-            expect_pac=expect_pac)
++            expect_pac=expect_pac,
++            expect_edata=False)
+ 
+         rep = self._generic_kdc_exchange(kdc_exchange_dict,
+                                          cname=cname,
+@@ -516,8 +515,7 @@ class KdcTgsTests(KDCBaseTest):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, remove_requester_sid=True)
+ 
+-        self._run_tgs(tgt, expected_error=0, expect_pac=True,
+-                      expect_requester_sid=False)  # Note: not expected
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_tgs_req_no_pac_attrs(self):
+         creds = self._get_creds()
+@@ -531,11 +529,7 @@ class KdcTgsTests(KDCBaseTest):
+                                 revealed_to_rodc=True)
+         tgt = self._get_tgt(creds, from_rodc=True, remove_requester_sid=True)
+ 
+-        samdb = self.get_samdb()
+-        sid = self.get_objectSid(samdb, creds.get_dn())
+-
+-        self._run_tgs(tgt, expected_error=0, expect_pac=True,
+-                      expect_requester_sid=True, expected_sid=sid)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_tgs_req_from_rodc_no_pac_attrs(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -548,101 +542,99 @@ class KdcTgsTests(KDCBaseTest):
+     def test_tgs_no_pac(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, remove_pac=True)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_BADOPTION)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_renew_no_pac(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, renewable=True, remove_pac=True)
+-        self._renew_tgt(tgt, expected_error=KDC_ERR_BADOPTION)
++        self._renew_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_validate_no_pac(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, invalid=True, remove_pac=True)
+-        self._validate_tgt(tgt, expected_error=KDC_ERR_BADOPTION)
++        self._validate_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_s4u2self_no_pac(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, remove_pac=True)
+         self._s4u2self(tgt, creds,
+-                       expected_error=(KDC_ERR_GENERIC, KDC_ERR_BADOPTION),
+-                       expected_status=ntstatus.NT_STATUS_INVALID_PARAMETER,
+-                       expect_edata=True)
++                       expected_error=KDC_ERR_TGT_REVOKED,
++                       expect_edata=False)
+ 
+     def test_user2user_no_pac(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, remove_pac=True)
+-        self._user2user(tgt, creds, expected_error=KDC_ERR_BADOPTION)
++        self._user2user(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     # Test making a request with authdata and without a PAC.
+     def test_tgs_authdata_no_pac(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, remove_pac=True, allow_empty_authdata=True)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_BADOPTION)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_renew_authdata_no_pac(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, renewable=True, remove_pac=True,
+                             allow_empty_authdata=True)
+-        self._renew_tgt(tgt, expected_error=KDC_ERR_BADOPTION)
++        self._renew_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_validate_authdata_no_pac(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, invalid=True, remove_pac=True,
+                             allow_empty_authdata=True)
+-        self._validate_tgt(tgt, expected_error=KDC_ERR_BADOPTION)
++        self._validate_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_s4u2self_authdata_no_pac(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, remove_pac=True, allow_empty_authdata=True)
+         self._s4u2self(tgt, creds,
+-                       expected_error=(KDC_ERR_GENERIC, KDC_ERR_BADOPTION),
+-                       expected_status=ntstatus.NT_STATUS_INVALID_PARAMETER,
+-                       expect_edata=True)
++                       expected_error=KDC_ERR_TGT_REVOKED,
++                       expect_edata=False)
+ 
+     def test_user2user_authdata_no_pac(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, remove_pac=True, allow_empty_authdata=True)
+-        self._user2user(tgt, creds, expected_error=KDC_ERR_BADOPTION)
++        self._user2user(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     # Test changing the SID in the PAC to that of another account.
+     def test_tgs_sid_mismatch_existing(self):
+         creds = self._get_creds()
+         existing_rid = self._get_existing_rid()
+         tgt = self._get_tgt(creds, new_rid=existing_rid)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_renew_sid_mismatch_existing(self):
+         creds = self._get_creds()
+         existing_rid = self._get_existing_rid()
+         tgt = self._get_tgt(creds, renewable=True, new_rid=existing_rid)
+-        self._renew_tgt(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._renew_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_validate_sid_mismatch_existing(self):
+         creds = self._get_creds()
+         existing_rid = self._get_existing_rid()
+         tgt = self._get_tgt(creds, invalid=True, new_rid=existing_rid)
+-        self._validate_tgt(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._validate_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_s4u2self_sid_mismatch_existing(self):
+         creds = self._get_creds()
+         existing_rid = self._get_existing_rid()
+         tgt = self._get_tgt(creds, new_rid=existing_rid)
+         self._s4u2self(tgt, creds,
+-                       expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++                       expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_user2user_sid_mismatch_existing(self):
+         creds = self._get_creds()
+         existing_rid = self._get_existing_rid()
+         tgt = self._get_tgt(creds, new_rid=existing_rid)
+         self._user2user(tgt, creds,
+-                        expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++                        expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_requester_sid_mismatch_existing(self):
+         creds = self._get_creds()
+         existing_rid = self._get_existing_rid()
+         tgt = self._get_tgt(creds, new_rid=existing_rid,
+                             can_modify_logon_info=False)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_logon_info_sid_mismatch_existing(self):
+         creds = self._get_creds()
+@@ -656,49 +648,49 @@ class KdcTgsTests(KDCBaseTest):
+         existing_rid = self._get_existing_rid()
+         tgt = self._get_tgt(creds, new_rid=existing_rid,
+                             remove_requester_sid=True)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     # Test changing the SID in the PAC to a non-existent one.
+     def test_tgs_sid_mismatch_nonexisting(self):
+         creds = self._get_creds()
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, new_rid=nonexistent_rid)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_renew_sid_mismatch_nonexisting(self):
+         creds = self._get_creds()
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, renewable=True,
+                             new_rid=nonexistent_rid)
+-        self._renew_tgt(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._renew_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_validate_sid_mismatch_nonexisting(self):
+         creds = self._get_creds()
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, invalid=True,
+                             new_rid=nonexistent_rid)
+-        self._validate_tgt(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._validate_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_s4u2self_sid_mismatch_nonexisting(self):
+         creds = self._get_creds()
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, new_rid=nonexistent_rid)
+         self._s4u2self(tgt, creds,
+-                       expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++                       expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_user2user_sid_mismatch_nonexisting(self):
+         creds = self._get_creds()
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, new_rid=nonexistent_rid)
+         self._user2user(tgt, creds,
+-                        expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++                        expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_requester_sid_mismatch_nonexisting(self):
+         creds = self._get_creds()
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, new_rid=nonexistent_rid,
+                             can_modify_logon_info=False)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_logon_info_sid_mismatch_nonexisting(self):
+         creds = self._get_creds()
+@@ -712,7 +704,7 @@ class KdcTgsTests(KDCBaseTest):
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, new_rid=nonexistent_rid,
+                             remove_requester_sid=True)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     # Test with an RODC-issued ticket where the client is revealed to the RODC.
+     def test_tgs_rodc_revealed(self):
+@@ -753,7 +745,7 @@ class KdcTgsTests(KDCBaseTest):
+         existing_rid = self._get_existing_rid(replication_allowed=True,
+                                               revealed_to_rodc=True)
+         tgt = self._get_tgt(creds, from_rodc=True, new_rid=existing_rid)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_renew_rodc_sid_mismatch_existing(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -762,7 +754,7 @@ class KdcTgsTests(KDCBaseTest):
+                                               revealed_to_rodc=True)
+         tgt = self._get_tgt(creds, renewable=True, from_rodc=True,
+                             new_rid=existing_rid)
+-        self._renew_tgt(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._renew_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_validate_rodc_sid_mismatch_existing(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -771,7 +763,7 @@ class KdcTgsTests(KDCBaseTest):
+                                        revealed_to_rodc=True)
+         tgt = self._get_tgt(creds, invalid=True, from_rodc=True,
+                             new_rid=existing_rid)
+-        self._validate_tgt(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._validate_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_s4u2self_rodc_sid_mismatch_existing(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -779,7 +771,7 @@ class KdcTgsTests(KDCBaseTest):
+         existing_rid = self._get_existing_rid(replication_allowed=True,
+                                               revealed_to_rodc=True)
+         tgt = self._get_tgt(creds, from_rodc=True, new_rid=existing_rid)
+-        self._s4u2self(tgt, creds, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._s4u2self(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_user2user_rodc_sid_mismatch_existing(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -788,7 +780,7 @@ class KdcTgsTests(KDCBaseTest):
+                                               revealed_to_rodc=True)
+         tgt = self._get_tgt(creds, from_rodc=True, new_rid=existing_rid)
+         self._user2user(tgt, creds,
+-                        expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++                        expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_tgs_rodc_requester_sid_mismatch_existing(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -797,7 +789,7 @@ class KdcTgsTests(KDCBaseTest):
+                                               revealed_to_rodc=True)
+         tgt = self._get_tgt(creds, from_rodc=True, new_rid=existing_rid,
+                             can_modify_logon_info=False)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_tgs_rodc_logon_info_sid_mismatch_existing(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -815,7 +807,7 @@ class KdcTgsTests(KDCBaseTest):
+                                               revealed_to_rodc=True)
+         tgt = self._get_tgt(creds, from_rodc=True, new_rid=existing_rid,
+                             remove_requester_sid=True)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     # Test with an RODC-issued ticket where the SID in the PAC is changed to a
+     # non-existent one.
+@@ -824,7 +816,7 @@ class KdcTgsTests(KDCBaseTest):
+                                 revealed_to_rodc=True)
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, from_rodc=True, new_rid=nonexistent_rid)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_renew_rodc_sid_mismatch_nonexisting(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -832,7 +824,7 @@ class KdcTgsTests(KDCBaseTest):
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, renewable=True, from_rodc=True,
+                             new_rid=nonexistent_rid)
+-        self._renew_tgt(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._renew_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_validate_rodc_sid_mismatch_nonexisting(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -840,14 +832,14 @@ class KdcTgsTests(KDCBaseTest):
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, invalid=True, from_rodc=True,
+                             new_rid=nonexistent_rid)
+-        self._validate_tgt(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._validate_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_s4u2self_rodc_sid_mismatch_nonexisting(self):
+         creds = self._get_creds(replication_allowed=True,
+                                 revealed_to_rodc=True)
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, from_rodc=True, new_rid=nonexistent_rid)
+-        self._s4u2self(tgt, creds, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._s4u2self(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_user2user_rodc_sid_mismatch_nonexisting(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -855,7 +847,7 @@ class KdcTgsTests(KDCBaseTest):
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, from_rodc=True, new_rid=nonexistent_rid)
+         self._user2user(tgt, creds,
+-                        expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++                        expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_tgs_rodc_requester_sid_mismatch_nonexisting(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -863,7 +855,7 @@ class KdcTgsTests(KDCBaseTest):
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, from_rodc=True, new_rid=nonexistent_rid,
+                             can_modify_logon_info=False)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_tgs_rodc_logon_info_sid_mismatch_nonexisting(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -879,7 +871,7 @@ class KdcTgsTests(KDCBaseTest):
+         nonexistent_rid = self._get_non_existent_rid()
+         tgt = self._get_tgt(creds, from_rodc=True, new_rid=nonexistent_rid,
+                             remove_requester_sid=True)
+-        self._run_tgs(tgt, expected_error=KDC_ERR_CLIENT_NAME_MISMATCH)
++        self._run_tgs(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     # Test with an RODC-issued ticket where the client is not revealed to the
+     # RODC.
+@@ -1111,8 +1103,7 @@ class KdcTgsTests(KDCBaseTest):
+                                           names=[user_name])
+ 
+         self._user2user(tgt, creds, sname=sname,
+-                        expected_error=(KDC_ERR_BADMATCH,
+-                                        KDC_ERR_BADOPTION))
++                        expected_error=KDC_ERR_BADMATCH)
+ 
+     def test_user2user_other_sname(self):
+         other_name = self.get_new_username()
+@@ -1134,8 +1125,7 @@ class KdcTgsTests(KDCBaseTest):
+         sname = self.get_krbtgt_sname()
+ 
+         self._user2user(tgt, creds, sname=sname,
+-                        expected_error=(KDC_ERR_BADMATCH,
+-                                        KDC_ERR_BADOPTION))
++                        expected_error=KDC_ERR_BADMATCH)
+ 
+     def test_user2user_wrong_srealm(self):
+         creds = self._get_creds()
+@@ -1206,7 +1196,9 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         tgt = self._modify_tgt(tgt, cname=cname)
+ 
+-        self._user2user(tgt, creds, expected_error=KDC_ERR_C_PRINCIPAL_UNKNOWN)
++        self._user2user(tgt, creds,
++                        expected_error=(KDC_ERR_TGT_REVOKED,
++                                        KDC_ERR_C_PRINCIPAL_UNKNOWN))
+ 
+     def test_user2user_non_existent_sname(self):
+         creds = self._get_creds()
+@@ -1522,8 +1514,7 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._modify_tgt(tgt, renewable=True,
+                                remove_requester_sid=True)
+ 
+-        self._renew_tgt(tgt, expected_error=0, expect_pac=True,
+-                        expect_requester_sid=False)  # Note: not expected
++        self._renew_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_tgs_requester_sid_missing_rodc_renew(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -1539,9 +1530,7 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._modify_tgt(tgt, from_rodc=True, renewable=True,
+                                remove_requester_sid=True)
+ 
+-        self._renew_tgt(tgt, expected_error=0, expect_pac=True,
+-                        expected_sid=sid,
+-                        expect_requester_sid=True)
++        self._renew_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
+     def test_tgs_pac_request_none(self):
+         creds = self._get_creds()
+@@ -1655,10 +1644,10 @@ class KdcTgsTests(KDCBaseTest):
+         creds = self._get_creds()
+         tgt = self.get_tgt(creds, pac_request=False, expect_pac=None)
+ 
+-        ticket = self._s4u2self(tgt, creds, expected_error=0, expect_pac=False)
++        ticket = self._s4u2self(tgt, creds, expected_error=0, expect_pac=True)
+ 
+-        pac = self.get_ticket_pac(ticket, expect_pac=False)
+-        self.assertIsNone(pac)
++        pac = self.get_ticket_pac(ticket)
++        self.assertIsNotNone(pac)
+ 
+     def test_s4u2self_pac_request_true(self):
+         creds = self._get_creds()
+@@ -1753,10 +1742,10 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self.get_tgt(creds, pac_request=False, expect_pac=None)
+         tgt = self._modify_tgt(tgt, from_rodc=True)
+ 
+-        ticket = self._run_tgs(tgt, expected_error=0, expect_pac=False)
++        ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
+ 
+         pac = self.get_ticket_pac(ticket, expect_pac=False)
+-        self.assertIsNone(pac)
++        self.assertIsNotNone(pac)
+ 
+     def test_tgs_rodc_pac_request_true(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -1784,7 +1773,8 @@ class KdcTgsTests(KDCBaseTest):
+                                                    'sAMAccountName')
+         samdb.modify(msg)
+ 
+-        self._run_tgs(tgt, expected_error=KDC_ERR_C_PRINCIPAL_UNKNOWN)
++        self._run_tgs(tgt, expected_error=(KDC_ERR_TGT_REVOKED,
++                                           KDC_ERR_C_PRINCIPAL_UNKNOWN))
+ 
+     def _modify_renewable(self, enc_part):
+         # Set the renewable flag.
+diff --git python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py
+index 0aa3309b814..e6b90d3e16a 100755
+--- python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py
++++ python/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py
+@@ -32,6 +32,7 @@ from samba.tests.krb5.rfc4120_constants import (
+     NT_PRINCIPAL,
+     NT_SRV_INST,
+     KDC_ERR_C_PRINCIPAL_UNKNOWN,
++    KDC_ERR_TGT_REVOKED,
+ )
+ 
+ global_asn1_print = False
+@@ -322,21 +323,10 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest):
+ 
+         (rep, enc_part) = self.tgs_req(
+             cname, sname, uc.get_realm(), ticket, key, etype,
+-            service_creds=mc, expect_pac=False)
+-        self.check_tgs_reply(rep)
+-
+-        # Check the contents of the service ticket
+-        ticket = rep['ticket']
+-        enc_part = self.decode_service_ticket(mc, ticket)
+-        #
+-        # We get an empty authorization-data element in the ticket.
+-        # i.e. no PAC
+-        self.assertEqual([], enc_part['authorization-data'])
+-        # check the crealm and cname
+-        cname = enc_part['cname']
+-        self.assertEqual(NT_PRINCIPAL, cname['name-type'])
+-        self.assertEqual(alt_name.encode('UTF8'), cname['name-string'][0])
+-        self.assertEqual(realm.upper().encode('UTF8'), enc_part['crealm'])
++            service_creds=mc, expect_pac=False,
++            expect_edata=False,
++            expected_error_mode=KDC_ERR_TGT_REVOKED)
++        self.check_error_rep(rep, KDC_ERR_TGT_REVOKED)
+ 
+     def test_nt_principal_step_4_b(self):
+         ''' Step 4, pre-authentication
+@@ -703,21 +693,10 @@ class MS_Kile_Client_Principal_Lookup_Tests(KDCBaseTest):
+ 
+         (rep, enc_part) = self.tgs_req(
+             cname, sname, uc.get_realm(), ticket, key, etype,
+-            service_creds=mc, expect_pac=False)
+-        self.check_tgs_reply(rep)
+-
+-        # Check the contents of the service ticket
+-        ticket = rep['ticket']
+-        enc_part = self.decode_service_ticket(mc, ticket)
+-        #
+-        # We get an empty authorization-data element in the ticket.
+-        # i.e. no PAC
+-        self.assertEqual([], enc_part['authorization-data'])
+-        # check the crealm and cname
+-        cname = enc_part['cname']
+-        self.assertEqual(NT_ENTERPRISE_PRINCIPAL, cname['name-type'])
+-        self.assertEqual(ename.encode('UTF8'), cname['name-string'][0])
+-        self.assertEqual(realm.upper().encode('UTF8'), enc_part['crealm'])
++            service_creds=mc, expect_pac=False,
++            expect_edata=False,
++            expected_error_mode=KDC_ERR_TGT_REVOKED)
++        self.check_error_rep(rep, KDC_ERR_TGT_REVOKED)
+ 
+     def test_nt_enterprise_principal_step_6_b(self):
+         ''' Step 4, pre-authentication
+diff --git python/samba/tests/krb5/s4u_tests.py python/samba/tests/krb5/s4u_tests.py
+index a80a7b3427e..5f37525f393 100755
+--- python/samba/tests/krb5/s4u_tests.py
++++ python/samba/tests/krb5/s4u_tests.py
+@@ -42,6 +42,7 @@ from samba.tests.krb5.rfc4120_constants import (
+     KDC_ERR_INAPP_CKSUM,
+     KDC_ERR_MODIFIED,
+     KDC_ERR_SUMTYPE_NOSUPP,
++    KDC_ERR_TGT_REVOKED,
+     KU_PA_ENC_TIMESTAMP,
+     KU_AS_REP_ENC_PART,
+     KU_TGS_REP_ENC_PART_SUB_KEY,
+@@ -278,6 +279,8 @@ class S4UKerberosTests(KDCBaseTest):
+         etypes = kdc_dict.pop('etypes', (AES256_CTS_HMAC_SHA1_96,
+                                          ARCFOUR_HMAC_MD5))
+ 
++        expect_edata = kdc_dict.pop('expect_edata', None)
++
+         def generate_s4u2self_padata(_kdc_exchange_dict,
+                                      _callback_dict,
+                                      req_body):
+@@ -309,7 +312,8 @@ class S4UKerberosTests(KDCBaseTest):
+             tgt=service_tgt,
+             authenticator_subkey=authenticator_subkey,
+             kdc_options=str(kdc_options),
+-            expect_claims=False)
++            expect_claims=False,
++            expect_edata=expect_edata)
+ 
+         self._generic_kdc_exchange(kdc_exchange_dict,
+                                    cname=None,
+@@ -343,15 +347,14 @@ class S4UKerberosTests(KDCBaseTest):
+ 
+         self._run_s4u2self_test(
+             {
+-                'expected_error_mode': (KDC_ERR_GENERIC,
+-                                        KDC_ERR_BADOPTION),
+-                'expected_status': ntstatus.NT_STATUS_INVALID_PARAMETER,
++                'expected_error_mode': KDC_ERR_TGT_REVOKED,
+                 'client_opts': {
+                     'not_delegated': False
+                 },
+                 'kdc_options': 'forwardable',
+                 'modify_service_tgt_fn': forwardable_no_pac,
+-                'expected_flags': 'forwardable'
++                'expected_flags': 'forwardable',
++                'expect_edata': False
+             })
+ 
+     # Test performing an S4U2Self operation without requesting a forwardable
+@@ -674,8 +677,8 @@ class S4UKerberosTests(KDCBaseTest):
+         # contain a PAC.
+         self._run_delegation_test(
+             {
+-                'expected_error_mode': (KDC_ERR_BADOPTION,
+-                                        KDC_ERR_MODIFIED),
++                'expected_error_mode': (KDC_ERR_MODIFIED,
++                                        KDC_ERR_TGT_REVOKED),
+                 'allow_delegation': True,
+                 'modify_client_tkt_fn': self.remove_ticket_pac,
+                 'expect_edata': False
+@@ -686,9 +689,10 @@ class S4UKerberosTests(KDCBaseTest):
+         # PAC.
+         self._run_delegation_test(
+             {
+-                'expected_error_mode': 0,
++                'expected_error_mode': KDC_ERR_TGT_REVOKED,
+                 'allow_delegation': True,
+-                'modify_service_tgt_fn': self.remove_ticket_pac
++                'modify_service_tgt_fn': self.remove_ticket_pac,
++                'expect_edata': False
+             })
+ 
+     def test_constrained_delegation_no_client_pac_no_auth_data_required(self):
+@@ -696,8 +700,8 @@ class S4UKerberosTests(KDCBaseTest):
+         # contain a PAC.
+         self._run_delegation_test(
+             {
+-                'expected_error_mode': (KDC_ERR_BADOPTION,
+-                                        KDC_ERR_MODIFIED),
++                'expected_error_mode': (KDC_ERR_MODIFIED,
++                                        KDC_ERR_BADOPTION),
+                 'allow_delegation': True,
+                 'modify_client_tkt_fn': self.remove_ticket_pac,
+                 'expect_edata': False,
+@@ -711,13 +715,14 @@ class S4UKerberosTests(KDCBaseTest):
+         # PAC.
+         self._run_delegation_test(
+             {
+-                'expected_error_mode': (KDC_ERR_BADOPTION,
+-                                        KDC_ERR_MODIFIED),
++                'expected_error_mode': KDC_ERR_TGT_REVOKED,
+                 'allow_delegation': True,
+                 'modify_service_tgt_fn': self.remove_ticket_pac,
+                 'service2_opts': {
+                     'no_auth_data_required': True
+-                }
++                },
++                'expect_pac': False,
++                'expect_edata': False
+             })
+ 
+     def test_constrained_delegation_non_forwardable(self):
+@@ -812,12 +817,11 @@ class S4UKerberosTests(KDCBaseTest):
+         # PAC.
+         self._run_delegation_test(
+             {
+-                'expected_error_mode': KDC_ERR_BADOPTION,
+-                'expected_status':
+-                    ntstatus.NT_STATUS_NOT_FOUND,
++                'expected_error_mode': KDC_ERR_TGT_REVOKED,
+                 'allow_rbcd': True,
+                 'pac_options': '0001',  # supports RBCD
+-                'modify_service_tgt_fn': self.remove_ticket_pac
++                'modify_service_tgt_fn': self.remove_ticket_pac,
++                'expect_edata': False
+             })
+ 
+     def test_rbcd_no_client_pac_no_auth_data_required_a(self):
+@@ -858,15 +862,14 @@ class S4UKerberosTests(KDCBaseTest):
+         # PAC.
+         self._run_delegation_test(
+             {
+-                'expected_error_mode': KDC_ERR_BADOPTION,
+-                'expected_status':
+-                    ntstatus.NT_STATUS_NOT_FOUND,
++                'expected_error_mode': KDC_ERR_TGT_REVOKED,
+                 'allow_rbcd': True,
+                 'pac_options': '0001',  # supports RBCD
+                 'modify_service_tgt_fn': self.remove_ticket_pac,
+                 'service2_opts': {
+                     'no_auth_data_required': True
+-                }
++                },
++                'expect_edata': False
+             })
+ 
+     def test_rbcd_non_forwardable(self):
+@@ -941,8 +944,8 @@ class S4UKerberosTests(KDCBaseTest):
+         for checksum in self.pac_checksum_types:
+             with self.subTest(checksum=checksum):
+                 if checksum == krb5pac.PAC_TYPE_TICKET_CHECKSUM:
+-                    expected_error_mode = (KDC_ERR_BADOPTION,
+-                                           KDC_ERR_MODIFIED)
++                    expected_error_mode = (KDC_ERR_MODIFIED,
++                                           KDC_ERR_BADOPTION)
+                 else:
+                     expected_error_mode = KDC_ERR_GENERIC
+ 
+@@ -1061,8 +1064,7 @@ class S4UKerberosTests(KDCBaseTest):
+         for checksum in self.pac_checksum_types:
+             with self.subTest(checksum=checksum):
+                 if checksum == krb5pac.PAC_TYPE_SRV_CHECKSUM:
+-                    expected_error_mode = (KDC_ERR_MODIFIED,
+-                                           KDC_ERR_BAD_INTEGRITY)
++                    expected_error_mode = KDC_ERR_MODIFIED
+                     expected_status = ntstatus.NT_STATUS_WRONG_PASSWORD
+                 else:
+                     expected_error_mode = 0
+@@ -1162,8 +1164,7 @@ class S4UKerberosTests(KDCBaseTest):
+                 with self.subTest(checksum=checksum, ctype=ctype):
+                     if checksum == krb5pac.PAC_TYPE_SRV_CHECKSUM:
+                         if ctype == Cksumtype.SHA1:
+-                            expected_error_mode = (KDC_ERR_SUMTYPE_NOSUPP,
+-                                                   KDC_ERR_BAD_INTEGRITY)
++                            expected_error_mode = KDC_ERR_SUMTYPE_NOSUPP
+                             expected_status = ntstatus.NT_STATUS_LOGON_FAILURE
+                         else:
+                             expected_error_mode = KDC_ERR_GENERIC
+diff --git python/samba/tests/krb5/test_rpc.py python/samba/tests/krb5/test_rpc.py
+index 2d483986e83..5a3c7339cea 100755
+--- python/samba/tests/krb5/test_rpc.py
++++ python/samba/tests/krb5/test_rpc.py
+@@ -24,7 +24,10 @@ import ldb
+ 
+ from samba import NTSTATUSError, credentials
+ from samba.dcerpc import lsa
+-from samba.ntstatus import NT_STATUS_NO_IMPERSONATION_TOKEN
++from samba.ntstatus import (
++    NT_STATUS_ACCESS_DENIED,
++    NT_STATUS_NO_IMPERSONATION_TOKEN
++)
+ 
+ from samba.tests.krb5.kdc_base_test import KDCBaseTest
+ 
+@@ -103,7 +106,8 @@ class RpcTests(KDCBaseTest):
+                 self.fail()
+ 
+             enum, _ = e.args
+-            self.assertEqual(NT_STATUS_NO_IMPERSONATION_TOKEN, enum)
++            self.assertIn(enum, {NT_STATUS_ACCESS_DENIED,
++                                 NT_STATUS_NO_IMPERSONATION_TOKEN})
+             return
+ 
+         (account_name, _) = conn.GetUserName(None, None, None)
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 7eba899966e..1b7e159c381 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -233,16 +233,21 @@
+ # S4U tests
+ #
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_bronze_bit_rbcd_old_checksum
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_client_pac(?!_no_auth_data_required)
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_service_pac\(.*\)$
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_service_pac_no_auth_data_required
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_existing_delegation_info
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_missing_client_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_client_pac_a
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_client_pac_b
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_service_pac
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_service_pac_no_auth_data_required
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_unkeyed_client_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_unkeyed_service_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_client_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_service_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_no_pac
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed
+ #
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_auth_data_required
+@@ -259,3 +264,62 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_not_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_not_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_not_revealed
++#
++# Alias tests
++#
++^samba.tests.krb5.alias_tests.samba.tests.krb5.alias_tests.AliasTests.test_create_alias_delete
++^samba.tests.krb5.alias_tests.samba.tests.krb5.alias_tests.AliasTests.test_create_alias_rename
++^samba.tests.krb5.alias_tests.samba.tests.krb5.alias_tests.AliasTests.test_dc_alias_delete
++^samba.tests.krb5.alias_tests.samba.tests.krb5.alias_tests.AliasTests.test_dc_alias_rename
++#
++# KDC TGS tests
++#
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_remove_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_remove_pac_client_no_auth_data_required
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_remove_pac_service_no_auth_data_required
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_authdata_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_requester_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_requester_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_authdata_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_false
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_rodc_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_authdata_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_requester_sid
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_no_requester_sid
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_renew
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_pac_request_false
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_requester_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_requester_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_authdata_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname_krbtgt
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_authdata_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_sid_mismatch_nonexisting
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 8cd36fe2d96..cc12499bb50 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -390,6 +390,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ #
+ # KDC TGT tests
+ #
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_allowed_denied
+@@ -401,6 +403,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_req
+@@ -418,6 +422,7 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rename
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_allowed_denied
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_denied
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_no_krbtgt_link
+@@ -427,6 +432,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_sname
+@@ -462,6 +469,8 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_sid_mismatch_nonexisting
+ #
+ # PAC attributes tests
+ #
+-- 
+2.25.1
+
+
+From ea82822a5c451df50feed15c5da3501df2b5c106 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 12:04:36 +1300
+Subject: [PATCH 28/99] tests/krb5: Remove unnecessary expect_pac arguments
+
+The value of expect_pac is not considered if we are expecting an error.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 28d501875a98fa2817262eb8ec68bf91528428c2)
+---
+ python/samba/tests/krb5/kdc_tgs_tests.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index 7ea15f0fbab..6160ef649e8 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -412,7 +412,7 @@ class KdcTgsTests(KDCBaseTest):
+         self.assertIsNone(pac)
+ 
+         self._make_tgs_request(client_creds, service_creds, tgt,
+-                               expect_pac=False, expect_error=True)
++                               expect_error=True)
+ 
+     def test_remove_pac_client_no_auth_data_required(self):
+         client_creds = self.get_cached_creds(
+@@ -427,7 +427,7 @@ class KdcTgsTests(KDCBaseTest):
+         self.assertIsNone(pac)
+ 
+         self._make_tgs_request(client_creds, service_creds, tgt,
+-                               expect_pac=False, expect_error=True)
++                               expect_error=True)
+ 
+     def test_remove_pac(self):
+         client_creds = self.get_client_creds()
+@@ -440,7 +440,7 @@ class KdcTgsTests(KDCBaseTest):
+         self.assertIsNone(pac)
+ 
+         self._make_tgs_request(client_creds, service_creds, tgt,
+-                               expect_pac=False, expect_error=True)
++                               expect_error=True)
+ 
+     def test_upn_dns_info_ex_user(self):
+         client_creds = self.get_client_creds()
+-- 
+2.25.1
+
+
+From eb0ed5f4f6d725c49fda97bc8f7aae89f90bd913 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 30 Nov 2021 09:26:40 +1300
+Subject: [PATCH 29/99] tests/krb5: Add tests for invalid TGTs
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 7574ba9f580fca552b80532a49d00e657fbdf4fd)
+
+[jsutton@samba.org Removed some MIT knownfail changes]
+---
+ python/samba/tests/krb5/kdc_tgs_tests.py     | 16 ++++++++++++++++
+ python/samba/tests/krb5/rfc4120_constants.py |  1 +
+ selftest/knownfail_mit_kdc                   |  1 +
+ 3 files changed, 18 insertions(+)
+
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index 6160ef649e8..f5f091610ac 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -44,6 +44,7 @@ from samba.tests.krb5.rfc4120_constants import (
+     KDC_ERR_C_PRINCIPAL_UNKNOWN,
+     KDC_ERR_S_PRINCIPAL_UNKNOWN,
+     KDC_ERR_TGT_REVOKED,
++    KRB_ERR_TKT_NYV,
+     KDC_ERR_WRONG_REALM,
+     NT_PRINCIPAL,
+     NT_SRV_INST,
+@@ -511,6 +512,21 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._get_tgt(creds)
+         self._user2user(tgt, creds, expected_error=0)
+ 
++    def test_tgs_req_invalid(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds, invalid=True)
++        self._run_tgs(tgt, expected_error=KRB_ERR_TKT_NYV)
++
++    def test_s4u2self_req_invalid(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds, invalid=True)
++        self._s4u2self(tgt, creds, expected_error=KRB_ERR_TKT_NYV)
++
++    def test_user2user_req_invalid(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds, invalid=True)
++        self._user2user(tgt, creds, expected_error=KRB_ERR_TKT_NYV)
++
+     def test_tgs_req_no_requester_sid(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, remove_requester_sid=True)
+diff --git python/samba/tests/krb5/rfc4120_constants.py python/samba/tests/krb5/rfc4120_constants.py
+index 5251e291fde..a9fdc5735dd 100644
+--- python/samba/tests/krb5/rfc4120_constants.py
++++ python/samba/tests/krb5/rfc4120_constants.py
+@@ -76,6 +76,7 @@ KDC_ERR_TGT_REVOKED = 20
+ KDC_ERR_PREAUTH_FAILED = 24
+ KDC_ERR_PREAUTH_REQUIRED = 25
+ KDC_ERR_BAD_INTEGRITY = 31
++KRB_ERR_TKT_NYV = 33
+ KDC_ERR_NOT_US = 35
+ KDC_ERR_BADMATCH = 36
+ KDC_ERR_SKEW = 37
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index cc12499bb50..3aacec00870 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -422,6 +422,7 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rename
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_invalid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_allowed_denied
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_denied
+-- 
+2.25.1
+
+
+From 645d30ff371fdf3e16cb1fa69f2e93a848d20bdb Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 12:10:45 +1300
+Subject: [PATCH 30/99] tests/krb5: Add tests for TGS requests with a non-TGT
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 778029c1dc443b87f4ed4b9d2c613d0e6fc45b0d)
+---
+ python/samba/tests/krb5/kdc_tgs_tests.py | 51 ++++++++++++++++++++++++
+ selftest/knownfail_mit_kdc               |  2 +
+ 2 files changed, 53 insertions(+)
+
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index f5f091610ac..52297c963e8 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -40,6 +40,7 @@ from samba.tests.krb5.rfc4120_constants import (
+     KDC_ERR_BADMATCH,
+     KDC_ERR_GENERIC,
+     KDC_ERR_MODIFIED,
++    KDC_ERR_NOT_US,
+     KDC_ERR_POLICY,
+     KDC_ERR_C_PRINCIPAL_UNKNOWN,
+     KDC_ERR_S_PRINCIPAL_UNKNOWN,
+@@ -1234,6 +1235,56 @@ class KdcTgsTests(KDCBaseTest):
+                         expected_error=(KDC_ERR_GENERIC,
+                                         KDC_ERR_S_PRINCIPAL_UNKNOWN))
+ 
++    def test_tgs_service_ticket(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds)
++
++        service_creds = self.get_service_creds()
++        service_ticket = self.get_service_ticket(tgt, service_creds)
++
++        self._run_tgs(service_ticket,
++                      expected_error=(KDC_ERR_NOT_US, KDC_ERR_POLICY))
++
++    def test_renew_service_ticket(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds)
++
++        service_creds = self.get_service_creds()
++        service_ticket = self.get_service_ticket(tgt, service_creds)
++
++        service_ticket = self.modified_ticket(
++            service_ticket,
++            modify_fn=self._modify_renewable,
++            checksum_keys=self.get_krbtgt_checksum_key())
++
++        self._renew_tgt(service_ticket,
++                        expected_error=KDC_ERR_POLICY)
++
++    def test_validate_service_ticket(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds)
++
++        service_creds = self.get_service_creds()
++        service_ticket = self.get_service_ticket(tgt, service_creds)
++
++        service_ticket = self.modified_ticket(
++            service_ticket,
++            modify_fn=self._modify_invalid,
++            checksum_keys=self.get_krbtgt_checksum_key())
++
++        self._validate_tgt(service_ticket,
++                           expected_error=KDC_ERR_POLICY)
++
++    def test_s4u2self_service_ticket(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds)
++
++        service_creds = self.get_service_creds()
++        service_ticket = self.get_service_ticket(tgt, service_creds)
++
++        self._s4u2self(service_ticket, creds,
++                       expected_error=(KDC_ERR_NOT_US, KDC_ERR_POLICY))
++
+     def test_user2user_service_ticket(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds)
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 3aacec00870..98e8a34cd5f 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -403,6 +403,7 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_authdata_no_pac
+@@ -470,6 +471,7 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_sid_mismatch_nonexisting
+ #
+-- 
+2.25.1
+
+
+From 1d616e8e9c0dceabebd1f079fc4d652d6bf2060d Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 12:09:18 +1300
+Subject: [PATCH 31/99] tests/krb5: Add TGS-REQ tests with FAST
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit ec823c2a83c639f1d7c422153a53d366750e5f2a)
+---
+ python/samba/tests/krb5/kdc_tgs_tests.py | 184 ++++++++++++++++++++++-
+ selftest/knownfail_heimdal_kdc           |  13 ++
+ selftest/knownfail_mit_kdc               |  17 +++
+ 3 files changed, 212 insertions(+), 2 deletions(-)
+
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index 52297c963e8..99a91528fa8 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -32,6 +32,7 @@ os.environ["PYTHONUNBUFFERED"] = "1"
+ 
+ import samba.tests.krb5.kcrypto as kcrypto
+ from samba.tests.krb5.kdc_base_test import KDCBaseTest
++from samba.tests.krb5.raw_testcase import Krb5EncryptionKey
+ from samba.tests.krb5.rfc4120_constants import (
+     AES256_CTS_HMAC_SHA1_96,
+     ARCFOUR_HMAC_MD5,
+@@ -513,6 +514,11 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._get_tgt(creds)
+         self._user2user(tgt, creds, expected_error=0)
+ 
++    def test_fast_req(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds)
++        self._fast(tgt, creds, expected_error=0)
++
+     def test_tgs_req_invalid(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, invalid=True)
+@@ -528,6 +534,12 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._get_tgt(creds, invalid=True)
+         self._user2user(tgt, creds, expected_error=KRB_ERR_TKT_NYV)
+ 
++    def test_fast_req_invalid(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds, invalid=True)
++        self._fast(tgt, creds, expected_error=KRB_ERR_TKT_NYV,
++                   expected_sname=self.get_krbtgt_sname())
++
+     def test_tgs_req_no_requester_sid(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, remove_requester_sid=True)
+@@ -583,6 +595,12 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._get_tgt(creds, remove_pac=True)
+         self._user2user(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED)
+ 
++    def test_fast_no_pac(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds, remove_pac=True)
++        self._fast(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED,
++                   expected_sname=self.get_krbtgt_sname())
++
+     # Test making a request with authdata and without a PAC.
+     def test_tgs_authdata_no_pac(self):
+         creds = self._get_creds()
+@@ -613,6 +631,12 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._get_tgt(creds, remove_pac=True, allow_empty_authdata=True)
+         self._user2user(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED)
+ 
++    def test_fast_authdata_no_pac(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds, remove_pac=True, allow_empty_authdata=True)
++        self._fast(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED,
++                   expected_sname=self.get_krbtgt_sname())
++
+     # Test changing the SID in the PAC to that of another account.
+     def test_tgs_sid_mismatch_existing(self):
+         creds = self._get_creds()
+@@ -646,6 +670,14 @@ class KdcTgsTests(KDCBaseTest):
+         self._user2user(tgt, creds,
+                         expected_error=KDC_ERR_TGT_REVOKED)
+ 
++    def test_fast_sid_mismatch_existing(self):
++        creds = self._get_creds()
++        existing_rid = self._get_existing_rid()
++        tgt = self._get_tgt(creds, new_rid=existing_rid)
++        self._fast(tgt, creds,
++                   expected_error=KDC_ERR_TGT_REVOKED,
++                   expected_sname=self.get_krbtgt_sname())
++
+     def test_requester_sid_mismatch_existing(self):
+         creds = self._get_creds()
+         existing_rid = self._get_existing_rid()
+@@ -702,6 +734,14 @@ class KdcTgsTests(KDCBaseTest):
+         self._user2user(tgt, creds,
+                         expected_error=KDC_ERR_TGT_REVOKED)
+ 
++    def test_fast_sid_mismatch_nonexisting(self):
++        creds = self._get_creds()
++        nonexistent_rid = self._get_non_existent_rid()
++        tgt = self._get_tgt(creds, new_rid=nonexistent_rid)
++        self._fast(tgt, creds,
++                   expected_error=KDC_ERR_TGT_REVOKED,
++                   expected_sname=self.get_krbtgt_sname())
++
+     def test_requester_sid_mismatch_nonexisting(self):
+         creds = self._get_creds()
+         nonexistent_rid = self._get_non_existent_rid()
+@@ -799,6 +839,16 @@ class KdcTgsTests(KDCBaseTest):
+         self._user2user(tgt, creds,
+                         expected_error=KDC_ERR_TGT_REVOKED)
+ 
++    def test_fast_rodc_sid_mismatch_existing(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++        existing_rid = self._get_existing_rid(replication_allowed=True,
++                                              revealed_to_rodc=True)
++        tgt = self._get_tgt(creds, from_rodc=True, new_rid=existing_rid)
++        self._fast(tgt, creds,
++                   expected_error=KDC_ERR_TGT_REVOKED,
++                   expected_sname=self.get_krbtgt_sname())
++
+     def test_tgs_rodc_requester_sid_mismatch_existing(self):
+         creds = self._get_creds(replication_allowed=True,
+                                 revealed_to_rodc=True)
+@@ -866,6 +916,15 @@ class KdcTgsTests(KDCBaseTest):
+         self._user2user(tgt, creds,
+                         expected_error=KDC_ERR_TGT_REVOKED)
+ 
++    def test_fast_rodc_sid_mismatch_nonexisting(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++        nonexistent_rid = self._get_non_existent_rid()
++        tgt = self._get_tgt(creds, from_rodc=True, new_rid=nonexistent_rid)
++        self._fast(tgt, creds,
++                   expected_error=KDC_ERR_TGT_REVOKED,
++                   expected_sname=self.get_krbtgt_sname())
++
+     def test_tgs_rodc_requester_sid_mismatch_nonexisting(self):
+         creds = self._get_creds(replication_allowed=True,
+                                 revealed_to_rodc=True)
+@@ -955,6 +1014,14 @@ class KdcTgsTests(KDCBaseTest):
+         self._remove_rodc_partial_secrets()
+         self._user2user(tgt, creds, expected_error=KDC_ERR_POLICY)
+ 
++    def test_fast_rodc_no_partial_secrets(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++        tgt = self._get_tgt(creds, from_rodc=True)
++        self._remove_rodc_partial_secrets()
++        self._fast(tgt, creds, expected_error=KDC_ERR_POLICY,
++                   expected_sname=self.get_krbtgt_sname())
++
+     # Test with an RODC-issued ticket where the RODC account does not have an
+     # msDS-KrbTgtLink.
+     def test_tgs_rodc_no_krbtgt_link(self):
+@@ -992,6 +1059,14 @@ class KdcTgsTests(KDCBaseTest):
+         self._remove_rodc_krbtgt_link()
+         self._user2user(tgt, creds, expected_error=KDC_ERR_POLICY)
+ 
++    def test_fast_rodc_no_krbtgt_link(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++        tgt = self._get_tgt(creds, from_rodc=True)
++        self._remove_rodc_krbtgt_link()
++        self._fast(tgt, creds, expected_error=KDC_ERR_POLICY,
++                   expected_sname=self.get_krbtgt_sname())
++
+     # Test with an RODC-issued ticket where the client is not allowed to
+     # replicate to the RODC.
+     def test_tgs_rodc_not_allowed(self):
+@@ -1019,6 +1094,12 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._get_tgt(creds, from_rodc=True)
+         self._user2user(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED)
+ 
++    def test_fast_rodc_not_allowed(self):
++        creds = self._get_creds(revealed_to_rodc=True)
++        tgt = self._get_tgt(creds, from_rodc=True)
++        self._fast(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED,
++                   expected_sname=self.get_krbtgt_sname())
++
+     # Test with an RODC-issued ticket where the client is denied from
+     # replicating to the RODC.
+     def test_tgs_rodc_denied(self):
+@@ -1051,6 +1132,13 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._get_tgt(creds, from_rodc=True)
+         self._user2user(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED)
+ 
++    def test_fast_rodc_denied(self):
++        creds = self._get_creds(replication_denied=True,
++                                revealed_to_rodc=True)
++        tgt = self._get_tgt(creds, from_rodc=True)
++        self._fast(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED,
++                   expected_sname=self.get_krbtgt_sname())
++
+     # Test with an RODC-issued ticket where the client is both allowed and
+     # denied replicating to the RODC.
+     def test_tgs_rodc_allowed_denied(self):
+@@ -1088,6 +1176,14 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._get_tgt(creds, from_rodc=True)
+         self._user2user(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED)
+ 
++    def test_fast_rodc_allowed_denied(self):
++        creds = self._get_creds(replication_allowed=True,
++                                replication_denied=True,
++                                revealed_to_rodc=True)
++        tgt = self._get_tgt(creds, from_rodc=True)
++        self._fast(tgt, creds, expected_error=KDC_ERR_TGT_REVOKED,
++                   expected_sname=self.get_krbtgt_sname())
++
+     # Test user-to-user with incorrect service principal names.
+     def test_user2user_matching_sname_host(self):
+         creds = self._get_creds()
+@@ -1295,6 +1391,17 @@ class KdcTgsTests(KDCBaseTest):
+         self._user2user(service_ticket, creds,
+                         expected_error=(KDC_ERR_MODIFIED, KDC_ERR_POLICY))
+ 
++    # Expected to fail against Windows, which does not produce a policy error.
++    def test_fast_service_ticket(self):
++        creds = self._get_creds()
++        tgt = self._get_tgt(creds)
++
++        service_creds = self.get_service_creds()
++        service_ticket = self.get_service_ticket(tgt, service_creds)
++
++        self._fast(service_ticket, creds,
++                   expected_error=KDC_ERR_POLICY)
++
+     def test_pac_attrs_none(self):
+         creds = self._get_creds()
+         self.get_tgt(creds, pac_request=None,
+@@ -1792,6 +1899,34 @@ class KdcTgsTests(KDCBaseTest):
+         pac = self.get_ticket_pac(ticket)
+         self.assertIsNotNone(pac)
+ 
++    def test_fast_pac_request_none(self):
++        creds = self._get_creds()
++        tgt = self.get_tgt(creds, pac_request=None)
++
++        ticket = self._fast(tgt, creds, expected_error=0, expect_pac=True)
++
++        pac = self.get_ticket_pac(ticket)
++        self.assertIsNotNone(pac)
++
++    def test_fast_pac_request_false(self):
++        creds = self._get_creds()
++        tgt = self.get_tgt(creds, pac_request=False)
++
++        ticket = self._fast(tgt, creds, expected_error=0,
++                            expect_pac=True)
++
++        pac = self.get_ticket_pac(ticket, expect_pac=True)
++        self.assertIsNotNone(pac)
++
++    def test_fast_pac_request_true(self):
++        creds = self._get_creds()
++        tgt = self.get_tgt(creds, pac_request=True)
++
++        ticket = self._fast(tgt, creds, expected_error=0, expect_pac=True)
++
++        pac = self.get_ticket_pac(ticket)
++        self.assertIsNotNone(pac)
++
+     def test_tgs_rodc_pac_request_none(self):
+         creds = self._get_creds(replication_allowed=True,
+                                 revealed_to_rodc=True)
+@@ -2192,13 +2327,28 @@ class KdcTgsTests(KDCBaseTest):
+                              srealm=srealm,
+                              expect_pac=expect_pac)
+ 
++    def _fast(self, armor_tgt, armor_tgt_creds, expected_error,
++              expected_sname=None, expect_pac=True):
++        user_creds = self._get_mach_creds()
++        user_tgt = self.get_tgt(user_creds)
++
++        target_creds = self.get_service_creds()
++
++        return self._tgs_req(user_tgt, expected_error, target_creds,
++                             armor_tgt=armor_tgt,
++                             expected_sname=expected_sname,
++                             expect_pac=expect_pac)
++
+     def _tgs_req(self, tgt, expected_error, target_creds,
++                 armor_tgt=None,
+                  kdc_options='0',
+                  expected_cname=None,
++                 expected_sname=None,
+                  additional_ticket=None,
+                  generate_padata_fn=None,
+                  sname=None,
+                  srealm=None,
++                 use_fast=False,
+                  expect_claims=True,
+                  expect_pac=True,
+                  expect_pac_attrs=None,
+@@ -2214,7 +2364,8 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         if sname is False:
+             sname = None
+-            expected_sname = self.get_krbtgt_sname()
++            if expected_sname is None:
++                expected_sname = self.get_krbtgt_sname()
+         else:
+             if sname is None:
+                 target_name = target_creds.get_username()
+@@ -2229,7 +2380,8 @@ class KdcTgsTests(KDCBaseTest):
+                         name_type=NT_PRINCIPAL,
+                         names=['host', target_name])
+ 
+-            expected_sname = sname
++            if expected_sname is None:
++                expected_sname = sname
+ 
+         if additional_ticket is not None:
+             additional_tickets = [additional_ticket.ticket]
+@@ -2241,6 +2393,28 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         subkey = self.RandomKey(tgt.session_key.etype)
+ 
++        if armor_tgt is not None:
++            armor_subkey = self.RandomKey(subkey.etype)
++            explicit_armor_key = self.generate_armor_key(armor_subkey,
++                                                         armor_tgt.session_key)
++            armor_key = kcrypto.cf2(explicit_armor_key.key,
++                                    subkey.key,
++                                    b'explicitarmor',
++                                    b'tgsarmor')
++            armor_key = Krb5EncryptionKey(armor_key, None)
++
++            generate_fast_fn = self.generate_simple_fast
++            generate_fast_armor_fn = self.generate_ap_req
++
++            pac_options = '1'  # claims support
++        else:
++            armor_subkey = None
++            armor_key = None
++            generate_fast_fn = None
++            generate_fast_armor_fn = None
++
++            pac_options = None
++
+         etypes = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5)
+ 
+         if expected_error:
+@@ -2260,12 +2434,18 @@ class KdcTgsTests(KDCBaseTest):
+             expected_sname=expected_sname,
+             ticket_decryption_key=decryption_key,
+             generate_padata_fn=generate_padata_fn,
++            generate_fast_fn=generate_fast_fn,
++            generate_fast_armor_fn=generate_fast_armor_fn,
+             check_error_fn=check_error_fn,
+             check_rep_fn=check_rep_fn,
+             check_kdc_private_fn=self.generic_check_kdc_private,
+             expected_error_mode=expected_error,
+             expected_status=expected_status,
+             tgt=tgt,
++            armor_key=armor_key,
++            armor_tgt=armor_tgt,
++            armor_subkey=armor_subkey,
++            pac_options=pac_options,
+             authenticator_subkey=subkey,
+             kdc_options=kdc_options,
+             expect_edata=expect_edata,
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 1b7e159c381..61de06659be 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -274,6 +274,19 @@
+ #
+ # KDC TGS tests
+ #
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_authdata_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_req_invalid
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_allowed_denied
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_denied
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_no_krbtgt_link
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_no_partial_secrets
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_not_allowed
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_remove_pac
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 98e8a34cd5f..3e19ee6c8b9 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -390,6 +390,23 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ #
+ # KDC TGT tests
+ #
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_authdata_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_pac_request_false
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_pac_request_none
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_pac_request_true
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_req
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_req_invalid
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_allowed_denied
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_denied
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_no_krbtgt_link
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_no_partial_secrets
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_not_allowed
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_rodc_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_authdata_no_pac
+-- 
+2.25.1
+
+
+From 5375e2b99cd5fd9e40d6d5f94eb7d46f366f525e Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 12:37:08 +1300
+Subject: [PATCH 32/99] tests/krb5: Align PAC buffer checking to more closely
+ match Windows with PacRequestorEnforcement=2
+
+We set EXPECT_EXTRA_PAC_BUFFERS to 0 for the moment. This signifies that
+these checks are currently not enforced, which avoids a lot of test
+failures.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit ebc9137cee94dee9dcf0e47d5bc0dc83de7aaaa1)
+
+[jsutton@samba.org Fixed conflicts]
+---
+ python/samba/tests/krb5/kdc_tgs_tests.py | 121 ++++++++++++++++-------
+ python/samba/tests/krb5/raw_testcase.py  |  39 ++++++--
+ selftest/knownfail_heimdal_kdc           |   9 ++
+ selftest/knownfail_mit_kdc               |   6 ++
+ source4/selftest/tests.py                |  58 +++++++----
+ 5 files changed, 168 insertions(+), 65 deletions(-)
+
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index 99a91528fa8..f14439a4ab5 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -497,12 +497,18 @@ class KdcTgsTests(KDCBaseTest):
+     def test_renew_req(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, renewable=True)
+-        self._renew_tgt(tgt, expected_error=0)
++        self._renew_tgt(tgt, expected_error=0,
++                        expect_pac_attrs=True,
++                        expect_pac_attrs_pac_request=True,
++                        expect_requester_sid=True)
+ 
+     def test_validate_req(self):
+         creds = self._get_creds()
+         tgt = self._get_tgt(creds, invalid=True)
+-        self._validate_tgt(tgt, expected_error=0)
++        self._validate_tgt(tgt, expected_error=0,
++                           expect_pac_attrs=True,
++                           expect_pac_attrs_pac_request=True,
++                           expect_requester_sid=True)
+ 
+     def test_s4u2self_req(self):
+         creds = self._get_creds()
+@@ -774,13 +780,17 @@ class KdcTgsTests(KDCBaseTest):
+         creds = self._get_creds(replication_allowed=True,
+                                 revealed_to_rodc=True)
+         tgt = self._get_tgt(creds, renewable=True, from_rodc=True)
+-        self._renew_tgt(tgt, expected_error=0)
++        self._renew_tgt(tgt, expected_error=0,
++                        expect_pac_attrs=False,
++                        expect_requester_sid=True)
+ 
+     def test_validate_rodc_revealed(self):
+         creds = self._get_creds(replication_allowed=True,
+                                 revealed_to_rodc=True)
+         tgt = self._get_tgt(creds, invalid=True, from_rodc=True)
+-        self._validate_tgt(tgt, expected_error=0)
++        self._validate_tgt(tgt, expected_error=0,
++                           expect_pac_attrs=False,
++                           expect_requester_sid=True)
+ 
+     def test_s4u2self_rodc_revealed(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -1434,7 +1444,8 @@ class KdcTgsTests(KDCBaseTest):
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+                         expect_pac_attrs=True,
+-                        expect_pac_attrs_pac_request=None)
++                        expect_pac_attrs_pac_request=None,
++                        expect_requester_sid=True)
+ 
+     def test_pac_attrs_renew_false(self):
+         creds = self._get_creds()
+@@ -1447,7 +1458,8 @@ class KdcTgsTests(KDCBaseTest):
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+                         expect_pac_attrs=True,
+-                        expect_pac_attrs_pac_request=False)
++                        expect_pac_attrs_pac_request=False,
++                        expect_requester_sid=True)
+ 
+     def test_pac_attrs_renew_true(self):
+         creds = self._get_creds()
+@@ -1460,7 +1472,8 @@ class KdcTgsTests(KDCBaseTest):
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+                         expect_pac_attrs=True,
+-                        expect_pac_attrs_pac_request=True)
++                        expect_pac_attrs_pac_request=True,
++                        expect_requester_sid=True)
+ 
+     def test_pac_attrs_rodc_renew_none(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -1473,8 +1486,8 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+-                        expect_pac_attrs=True,
+-                        expect_pac_attrs_pac_request=None)
++                        expect_pac_attrs=False,
++                        expect_requester_sid=True)
+ 
+     def test_pac_attrs_rodc_renew_false(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -1487,8 +1500,8 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+-                        expect_pac_attrs=True,
+-                        expect_pac_attrs_pac_request=False)
++                        expect_pac_attrs=False,
++                        expect_requester_sid=True)
+ 
+     def test_pac_attrs_rodc_renew_true(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -1501,8 +1514,8 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+-                        expect_pac_attrs=True,
+-                        expect_pac_attrs_pac_request=True)
++                        expect_pac_attrs=False,
++                        expect_requester_sid=True)
+ 
+     def test_pac_attrs_missing_renew_none(self):
+         creds = self._get_creds()
+@@ -1515,7 +1528,8 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+-                        expect_pac_attrs=False)
++                        expect_pac_attrs=False,
++                        expect_requester_sid=True)
+ 
+     def test_pac_attrs_missing_renew_false(self):
+         creds = self._get_creds()
+@@ -1528,7 +1542,8 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+-                        expect_pac_attrs=False)
++                        expect_pac_attrs=False,
++                        expect_requester_sid=True)
+ 
+     def test_pac_attrs_missing_renew_true(self):
+         creds = self._get_creds()
+@@ -1541,7 +1556,8 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+-                        expect_pac_attrs=False)
++                        expect_pac_attrs=False,
++                        expect_requester_sid=True)
+ 
+     def test_pac_attrs_missing_rodc_renew_none(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -1555,7 +1571,8 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+-                        expect_pac_attrs=False)
++                        expect_pac_attrs=False,
++                        expect_requester_sid=True)
+ 
+     def test_pac_attrs_missing_rodc_renew_false(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -1569,7 +1586,8 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+-                        expect_pac_attrs=False)
++                        expect_pac_attrs=False,
++                        expect_requester_sid=True)
+ 
+     def test_pac_attrs_missing_rodc_renew_true(self):
+         creds = self._get_creds(replication_allowed=True,
+@@ -1583,7 +1601,8 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         self._renew_tgt(tgt, expected_error=0,
+                         expect_pac=True,
+-                        expect_pac_attrs=False)
++                        expect_pac_attrs=False,
++                        expect_requester_sid=True)
+ 
+     def test_tgs_pac_attrs_none(self):
+         creds = self._get_creds()
+@@ -1593,8 +1612,7 @@ class KdcTgsTests(KDCBaseTest):
+                            expect_pac_attrs_pac_request=None)
+ 
+         self._run_tgs(tgt, expected_error=0, expect_pac=True,
+-                      expect_pac_attrs=True,
+-                      expect_pac_attrs_pac_request=None)
++                      expect_pac_attrs=False)
+ 
+     def test_tgs_pac_attrs_false(self):
+         creds = self._get_creds()
+@@ -1603,7 +1621,8 @@ class KdcTgsTests(KDCBaseTest):
+                            expect_pac_attrs=True,
+                            expect_pac_attrs_pac_request=False)
+ 
+-        self._run_tgs(tgt, expected_error=0, expect_pac=False)
++        self._run_tgs(tgt, expected_error=0, expect_pac=False,
++                      expect_pac_attrs=False)
+ 
+     def test_tgs_pac_attrs_true(self):
+         creds = self._get_creds()
+@@ -1613,8 +1632,7 @@ class KdcTgsTests(KDCBaseTest):
+                            expect_pac_attrs_pac_request=True)
+ 
+         self._run_tgs(tgt, expected_error=0, expect_pac=True,
+-                      expect_pac_attrs=True,
+-                      expect_pac_attrs_pac_request=True)
++                      expect_pac_attrs=False)
+ 
+     def test_as_requester_sid(self):
+         creds = self._get_creds()
+@@ -1639,8 +1657,7 @@ class KdcTgsTests(KDCBaseTest):
+                            expect_requester_sid=True)
+ 
+         self._run_tgs(tgt, expected_error=0, expect_pac=True,
+-                      expected_sid=sid,
+-                      expect_requester_sid=True)
++                      expect_requester_sid=False)
+ 
+     def test_tgs_requester_sid_renew(self):
+         creds = self._get_creds()
+@@ -1655,6 +1672,8 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._modify_tgt(tgt, renewable=True)
+ 
+         self._renew_tgt(tgt, expected_error=0, expect_pac=True,
++                        expect_pac_attrs=True,
++                        expect_pac_attrs_pac_request=None,
+                         expected_sid=sid,
+                         expect_requester_sid=True)
+ 
+@@ -1672,6 +1691,7 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self._modify_tgt(tgt, from_rodc=True, renewable=True)
+ 
+         self._renew_tgt(tgt, expected_error=0, expect_pac=True,
++                        expect_pac_attrs=False,
+                         expected_sid=sid,
+                         expect_requester_sid=True)
+ 
+@@ -1738,7 +1758,10 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self.get_tgt(creds, pac_request=None)
+         tgt = self._modify_tgt(tgt, renewable=True)
+ 
+-        tgt = self._renew_tgt(tgt, expected_error=0, expect_pac=None)
++        tgt = self._renew_tgt(tgt, expected_error=0, expect_pac=None,
++                              expect_pac_attrs=True,
++                              expect_pac_attrs_pac_request=None,
++                              expect_requester_sid=True)
+ 
+         ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
+ 
+@@ -1750,7 +1773,10 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self.get_tgt(creds, pac_request=False, expect_pac=None)
+         tgt = self._modify_tgt(tgt, renewable=True)
+ 
+-        tgt = self._renew_tgt(tgt, expected_error=0, expect_pac=None)
++        tgt = self._renew_tgt(tgt, expected_error=0, expect_pac=None,
++                              expect_pac_attrs=True,
++                              expect_pac_attrs_pac_request=False,
++                              expect_requester_sid=True)
+ 
+         ticket = self._run_tgs(tgt, expected_error=0, expect_pac=False)
+ 
+@@ -1762,7 +1788,10 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self.get_tgt(creds, pac_request=True)
+         tgt = self._modify_tgt(tgt, renewable=True)
+ 
+-        tgt = self._renew_tgt(tgt, expected_error=0, expect_pac=None)
++        tgt = self._renew_tgt(tgt, expected_error=0, expect_pac=None,
++                              expect_pac_attrs=True,
++                              expect_pac_attrs_pac_request=True,
++                              expect_requester_sid=True)
+ 
+         ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
+ 
+@@ -1774,7 +1803,10 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self.get_tgt(creds, pac_request=None)
+         tgt = self._modify_tgt(tgt, invalid=True)
+ 
+-        tgt = self._validate_tgt(tgt, expected_error=0, expect_pac=None)
++        tgt = self._validate_tgt(tgt, expected_error=0, expect_pac=None,
++                                 expect_pac_attrs=True,
++                                 expect_pac_attrs_pac_request=None,
++                                 expect_requester_sid=True)
+ 
+         ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
+ 
+@@ -1786,7 +1818,10 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self.get_tgt(creds, pac_request=False, expect_pac=None)
+         tgt = self._modify_tgt(tgt, invalid=True)
+ 
+-        tgt = self._validate_tgt(tgt, expected_error=0, expect_pac=None)
++        tgt = self._validate_tgt(tgt, expected_error=0, expect_pac=None,
++                                 expect_pac_attrs=True,
++                                 expect_pac_attrs_pac_request=False,
++                                 expect_requester_sid=True)
+ 
+         ticket = self._run_tgs(tgt, expected_error=0, expect_pac=False)
+ 
+@@ -1798,7 +1833,10 @@ class KdcTgsTests(KDCBaseTest):
+         tgt = self.get_tgt(creds, pac_request=True)
+         tgt = self._modify_tgt(tgt, invalid=True)
+ 
+-        tgt = self._validate_tgt(tgt, expected_error=0, expect_pac=None)
++        tgt = self._validate_tgt(tgt, expected_error=0, expect_pac=None,
++                                 expect_pac_attrs=True,
++                                 expect_pac_attrs_pac_request=True,
++                                 expect_requester_sid=True)
+ 
+         ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
+ 
+@@ -1946,7 +1984,7 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
+ 
+-        pac = self.get_ticket_pac(ticket, expect_pac=False)
++        pac = self.get_ticket_pac(ticket)
+         self.assertIsNotNone(pac)
+ 
+     def test_tgs_rodc_pac_request_true(self):
+@@ -2279,12 +2317,21 @@ class KdcTgsTests(KDCBaseTest):
+             expect_requester_sid=expect_requester_sid,
+             expected_sid=expected_sid)
+ 
+-    def _validate_tgt(self, tgt, expected_error, expect_pac=True):
++    def _validate_tgt(self, tgt, expected_error, expect_pac=True,
++                      expect_pac_attrs=None,
++                      expect_pac_attrs_pac_request=None,
++                      expect_requester_sid=None,
++                      expected_sid=None):
+         krbtgt_creds = self.get_krbtgt_creds()
+         kdc_options = str(krb5_asn1.KDCOptions('validate'))
+-        return self._tgs_req(tgt, expected_error, krbtgt_creds,
+-                             kdc_options=kdc_options,
+-                             expect_pac=expect_pac)
++        return self._tgs_req(
++            tgt, expected_error, krbtgt_creds,
++            kdc_options=kdc_options,
++            expect_pac=expect_pac,
++            expect_pac_attrs=expect_pac_attrs,
++            expect_pac_attrs_pac_request=expect_pac_attrs_pac_request,
++            expect_requester_sid=expect_requester_sid,
++            expected_sid=expected_sid)
+ 
+     def _s4u2self(self, tgt, tgt_creds, expected_error, expect_pac=True,
+                   expect_edata=False, expected_status=None):
+diff --git python/samba/tests/krb5/raw_testcase.py python/samba/tests/krb5/raw_testcase.py
+index da3f69c79c6..14e655313fc 100644
+--- python/samba/tests/krb5/raw_testcase.py
++++ python/samba/tests/krb5/raw_testcase.py
+@@ -602,6 +602,13 @@ class RawKerberosTest(TestCaseInTempDir):
+             expect_pac = '1'
+         cls.expect_pac = bool(int(expect_pac))
+ 
++        expect_extra_pac_buffers = samba.tests.env_get_var_value(
++            'EXPECT_EXTRA_PAC_BUFFERS',
++            allow_missing=True)
++        if expect_extra_pac_buffers is None:
++            expect_extra_pac_buffers = '1'
++        cls.expect_extra_pac_buffers = bool(int(expect_extra_pac_buffers))
++
+     def setUp(self):
+         super().setUp()
+         self.do_asn1_print = False
+@@ -2624,17 +2631,34 @@ class RawKerberosTest(TestCaseInTempDir):
+         if not self.tkt_sig_support:
+             require_strict.add(krb5pac.PAC_TYPE_TICKET_CHECKSUM)
+ 
++        expect_extra_pac_buffers = rep_msg_type == KRB_AS_REP
++
+         expect_pac_attrs = kdc_exchange_dict['expect_pac_attrs']
++
++        if expect_pac_attrs:
++            expect_pac_attrs_pac_request = kdc_exchange_dict[
++                'expect_pac_attrs_pac_request']
++        else:
++            expect_pac_attrs_pac_request = kdc_exchange_dict[
++                'pac_request']
++
++        if expect_pac_attrs is None:
++            if self.expect_extra_pac_buffers:
++                expect_pac_attrs = expect_extra_pac_buffers
++            else:
++                require_strict.add(krb5pac.PAC_TYPE_ATTRIBUTES_INFO)
+         if expect_pac_attrs:
+             expected_types.append(krb5pac.PAC_TYPE_ATTRIBUTES_INFO)
+-        elif expect_pac_attrs is None:
+-            require_strict.add(krb5pac.PAC_TYPE_ATTRIBUTES_INFO)
+ 
+         expect_requester_sid = kdc_exchange_dict['expect_requester_sid']
++
++        if expect_requester_sid is None:
++            if self.expect_extra_pac_buffers:
++                expect_requester_sid = expect_extra_pac_buffers
++            else:
++                require_strict.add(krb5pac.PAC_TYPE_REQUESTER_SID)
+         if expect_requester_sid:
+             expected_types.append(krb5pac.PAC_TYPE_REQUESTER_SID)
+-        elif expect_requester_sid is None:
+-            require_strict.add(krb5pac.PAC_TYPE_REQUESTER_SID)
+ 
+         buffer_types = [pac_buffer.type
+                         for pac_buffer in pac.buffers]
+@@ -2722,9 +2746,6 @@ class RawKerberosTest(TestCaseInTempDir):
+                 requested_pac = bool(flags & 1)
+                 given_pac = bool(flags & 2)
+ 
+-                expect_pac_attrs_pac_request = kdc_exchange_dict[
+-                    'expect_pac_attrs_pac_request']
+-
+                 self.assertEqual(expect_pac_attrs_pac_request is True,
+                                  requested_pac)
+                 self.assertEqual(expect_pac_attrs_pac_request is None,
+@@ -2734,8 +2755,8 @@ class RawKerberosTest(TestCaseInTempDir):
+                       and expect_requester_sid):
+                 requester_sid = pac_buffer.info.sid
+ 
+-                self.assertIsNotNone(expected_sid)
+-                self.assertEqual(expected_sid, str(requester_sid))
++                if expected_sid is not None:
++                    self.assertEqual(expected_sid, str(requester_sid))
+ 
+     def generic_check_kdc_error(self,
+                                 kdc_exchange_dict,
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 61de06659be..294e06027b1 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -289,11 +289,15 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_false
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_none
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_remove_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_remove_pac_client_no_auth_data_required
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_remove_pac_service_no_auth_data_required
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_existing
+@@ -309,10 +313,14 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_none
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_no_requester_sid
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid(?!_)
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_renew
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_pac_request_false
+@@ -332,6 +340,7 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname_krbtgt
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_sid_mismatch_existing
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 3e19ee6c8b9..6c74657e87d 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -411,6 +411,9 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_pac_request_none
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_pac_request_true
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_req
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_allowed_denied
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_denied
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_no_krbtgt_link
+@@ -479,6 +482,9 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_srealm
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_no_pac
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_pac_request_none
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_pac_request_true
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_req
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_allowed_denied
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_denied
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_no_krbtgt_link
+
+From 3fdfbd08b9460fb486f100d7091984f41ebd9429 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 13:10:52 +1300
+Subject: [PATCH 33/99] tests/krb5: Add tests for validation with requester SID
+ PAC buffer
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit ca80c47406e0f2b6fac2c55229306e21ccef9745)
+---
+ python/samba/tests/krb5/kdc_tgs_tests.py | 67 ++++++++++++++++++++++++
+ selftest/knownfail_heimdal_kdc           |  3 ++
+ selftest/knownfail_mit_kdc               |  4 ++
+ 3 files changed, 74 insertions(+)
+
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index f14439a4ab5..50079a1710c 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -1726,6 +1726,73 @@ class KdcTgsTests(KDCBaseTest):
+ 
+         self._renew_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
+ 
++    def test_tgs_requester_sid_validate(self):
++        creds = self._get_creds()
++
++        samdb = self.get_samdb()
++        sid = self.get_objectSid(samdb, creds.get_dn())
++
++        tgt = self.get_tgt(creds, pac_request=None,
++                           expect_pac=True,
++                           expected_sid=sid,
++                           expect_requester_sid=True)
++        tgt = self._modify_tgt(tgt, invalid=True)
++
++        self._validate_tgt(tgt, expected_error=0, expect_pac=True,
++                           expect_pac_attrs=True,
++                           expect_pac_attrs_pac_request=None,
++                           expected_sid=sid,
++                           expect_requester_sid=True)
++
++    def test_tgs_requester_sid_rodc_validate(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++
++        samdb = self.get_samdb()
++        sid = self.get_objectSid(samdb, creds.get_dn())
++
++        tgt = self.get_tgt(creds, pac_request=None,
++                           expect_pac=True,
++                           expected_sid=sid,
++                           expect_requester_sid=True)
++        tgt = self._modify_tgt(tgt, from_rodc=True, invalid=True)
++
++        self._validate_tgt(tgt, expected_error=0, expect_pac=True,
++                           expect_pac_attrs=False,
++                           expected_sid=sid,
++                           expect_requester_sid=True)
++
++    def test_tgs_requester_sid_missing_validate(self):
++        creds = self._get_creds()
++
++        samdb = self.get_samdb()
++        sid = self.get_objectSid(samdb, creds.get_dn())
++
++        tgt = self.get_tgt(creds, pac_request=None,
++                           expect_pac=True,
++                           expected_sid=sid,
++                           expect_requester_sid=True)
++        tgt = self._modify_tgt(tgt, invalid=True,
++                               remove_requester_sid=True)
++
++        self._validate_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
++
++    def test_tgs_requester_sid_missing_rodc_validate(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++
++        samdb = self.get_samdb()
++        sid = self.get_objectSid(samdb, creds.get_dn())
++
++        tgt = self.get_tgt(creds, pac_request=None,
++                           expect_pac=True,
++                           expected_sid=sid,
++                           expect_requester_sid=True)
++        tgt = self._modify_tgt(tgt, from_rodc=True, invalid=True,
++                               remove_requester_sid=True)
++
++        self._validate_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)
++
+     def test_tgs_pac_request_none(self):
+         creds = self._get_creds()
+         tgt = self.get_tgt(creds, pac_request=None)
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 294e06027b1..f7c5feda872 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -320,7 +320,10 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid(?!_)
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_renew
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_validate
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_validate
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_pac_request_false
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 6c74657e87d..ff287e6cd9d 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -546,8 +546,12 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_renew
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_validate
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_validate
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_validate
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_sid_mismatch_existing
+-- 
+2.25.1
+
+
+From 69233dd323b1ce715387e6015542ed234d909295 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 15:32:32 +1300
+Subject: [PATCH 34/99] tests/krb5: Add comments for tests that fail against
+ Windows
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 749349efab9b401d33a4fc286473a924364a41c9)
+---
+ python/samba/tests/krb5/kdc_tgs_tests.py | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index 50079a1710c..ecc38538e61 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -792,6 +792,8 @@ class KdcTgsTests(KDCBaseTest):
+                            expect_pac_attrs=False,
+                            expect_requester_sid=True)
+ 
++    # This test fails on Windows, which gives KDC_ERR_C_PRINCIPAL_UNKNOWN when
++    # attempting to use S4U2Self with a TGT from an RODC.
+     def test_s4u2self_rodc_revealed(self):
+         creds = self._get_creds(replication_allowed=True,
+                                 revealed_to_rodc=True)
+@@ -2370,6 +2372,8 @@ class KdcTgsTests(KDCBaseTest):
+             expect_requester_sid=expect_requester_sid,
+             expected_sid=expected_sid)
+ 
++    # These tests fail against Windows, which does not implement ticket
++    # renewal.
+     def _renew_tgt(self, tgt, expected_error, expect_pac=True,
+                    expect_pac_attrs=None, expect_pac_attrs_pac_request=None,
+                    expect_requester_sid=None, expected_sid=None):
+@@ -2384,6 +2388,8 @@ class KdcTgsTests(KDCBaseTest):
+             expect_requester_sid=expect_requester_sid,
+             expected_sid=expected_sid)
+ 
++    # These tests fail against Windows, which does not implement ticket
++    # validation.
+     def _validate_tgt(self, tgt, expected_error, expect_pac=True,
+                       expect_pac_attrs=None,
+                       expect_pac_attrs_pac_request=None,
+-- 
+2.25.1
+
+
+From 6dbed53756f6bac8f63847644b3e9cbb7b6181b0 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 18 Nov 2021 13:14:51 +1300
+Subject: [PATCH 35/99] heimdal:kdc: Fix error message for user-to-user
+
+We were checking the wrong variable to see whether a PAC was found or not.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 11fb9476ad3c09415d12b3cdf7934c293cbefcb2)
+---
+ source4/heimdal/kdc/krb5tgs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git source4/heimdal/kdc/krb5tgs.c source4/heimdal/kdc/krb5tgs.c
+index fb2ef8230c9..cde68b41714 100644
+--- source4/heimdal/kdc/krb5tgs.c
++++ source4/heimdal/kdc/krb5tgs.c
+@@ -1629,7 +1629,7 @@ server_lookup:
+ 		ret = KRB5KDC_ERR_BADOPTION;
+ 		kdc_log(context, config, 0,
+ 			"Ticket not signed with PAC; user-to-user failed (%s).",
+-			mspac ? "Ticket unsigned" : "No PAC");
++			user2user_pac ? "Ticket unsigned" : "No PAC");
+ 		goto out;
+ 	    }
+ 
+-- 
+2.25.1
+
+
+From 33d5e5ad3a06ca6a1a62e64d323580ca60f068b8 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 18 Nov 2021 16:22:34 +1300
+Subject: [PATCH 36/99] s4:torture: Fix typo
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 9cfb88ba04818b5e9cec3c96422e8e4a3080d490)
+---
+ source4/torture/krb5/kdc-canon-heimdal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git source4/torture/krb5/kdc-canon-heimdal.c source4/torture/krb5/kdc-canon-heimdal.c
+index cd47182c0ef..059078a4ffb 100644
+--- source4/torture/krb5/kdc-canon-heimdal.c
++++ source4/torture/krb5/kdc-canon-heimdal.c
+@@ -262,7 +262,7 @@ static bool torture_krb5_pre_send_as_req_test(struct torture_krb5_context *test_
+ 						 KRB5_NT_PRINCIPAL,
+ 						 "krb5 libs unexpectedly "
+ 						 "did not set principal "
+-						 "as NT_SRV_HST!");
++						 "as NT_PRINCIPAL!");
+ 		} else {
+ 			torture_assert_int_equal(test_context->tctx,
+ 						 test_context->as_req.req_body.cname->name_type,
+-- 
+2.25.1
+
+
+From 02ceb9be33dca0e3a885fd7d85b1199f76e04670 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 20:41:34 +1300
+Subject: [PATCH 37/99] heimdal:kdc: Adjust no-PAC error code to match Windows
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit f7a2fef8f49a86f63c3dc2f6a2d7d979fb53238a)
+---
+ selftest/knownfail_heimdal_kdc | 19 -------------------
+ source4/heimdal/kdc/krb5tgs.c  |  2 +-
+ 2 files changed, 1 insertion(+), 20 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index f7c5feda872..9ff85fe18fc 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -233,21 +233,15 @@
+ # S4U tests
+ #
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_bronze_bit_rbcd_old_checksum
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_client_pac(?!_no_auth_data_required)
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_service_pac\(.*\)$
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_service_pac_no_auth_data_required
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_existing_delegation_info
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_missing_client_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_client_pac_a
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_client_pac_b
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_service_pac
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_service_pac_no_auth_data_required
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_unkeyed_client_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_unkeyed_service_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_client_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_service_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_no_pac
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed
+ #
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_auth_data_required
+@@ -292,11 +286,6 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_false
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_true
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_remove_pac
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_remove_pac_client_no_auth_data_required
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_remove_pac_service_no_auth_data_required
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_authdata_no_pac
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_nonexisting
+@@ -304,15 +293,11 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_requester_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_requester_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_authdata_no_pac
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_false
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_rodc_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_authdata_no_pac
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_requester_sid
+@@ -333,16 +318,12 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_authdata_no_pac
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname_krbtgt
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_authdata_no_pac
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_nonexisting
+diff --git source4/heimdal/kdc/krb5tgs.c source4/heimdal/kdc/krb5tgs.c
+index cde68b41714..6c5c51aa448 100644
+--- source4/heimdal/kdc/krb5tgs.c
++++ source4/heimdal/kdc/krb5tgs.c
+@@ -78,7 +78,7 @@ check_PAC(krb5_context context,
+ 	return ret;
+ 
+     if (pac == NULL)
+-	return KRB5KDC_ERR_BADOPTION;
++	return KRB5KDC_ERR_TGT_REVOKED;
+ 
+     /* Verify the server signature. */
+     ret = krb5_pac_verify(context, pac, tkt->authtime, client_principal,
+-- 
+2.25.1
+
+
+From 5556f97c782c9be9af47c76f2432bb8480bc0622 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 20:41:45 +1300
+Subject: [PATCH 38/99] kdc: Adjust SID mismatch error code to match Windows
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit d5d22bf84a71492342287e54b555c9f024e7e71c)
+---
+ selftest/knownfail_heimdal_kdc | 35 ----------------------------------
+ selftest/knownfail_mit_kdc     |  8 --------
+ source4/kdc/pac-glue.c         |  6 +-----
+ 3 files changed, 1 insertion(+), 48 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 9ff85fe18fc..bc644587319 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -259,13 +259,6 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_not_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_not_revealed
+ #
+-# Alias tests
+-#
+-^samba.tests.krb5.alias_tests.samba.tests.krb5.alias_tests.AliasTests.test_create_alias_delete
+-^samba.tests.krb5.alias_tests.samba.tests.krb5.alias_tests.AliasTests.test_create_alias_rename
+-^samba.tests.krb5.alias_tests.samba.tests.krb5.alias_tests.AliasTests.test_dc_alias_delete
+-^samba.tests.krb5.alias_tests.samba.tests.krb5.alias_tests.AliasTests.test_dc_alias_rename
+-#
+ # KDC TGS tests
+ #
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_authdata_no_pac
+@@ -281,23 +274,11 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_false
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_revealed
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_requester_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_requester_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_false
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_rodc_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_rodc_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_requester_sid
+@@ -309,23 +290,7 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_validate
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_pac_request_false
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_requester_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_requester_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname_krbtgt
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_sid_mismatch_nonexisting
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index ff287e6cd9d..c6dc1285837 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -407,8 +407,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_only_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_pac_request_none
+@@ -424,8 +422,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_service_ticket
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_req
+@@ -454,8 +450,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_no_sname
+@@ -495,8 +489,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_service_ticket
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_sid_mismatch_nonexisting
+ #
+ # PAC attributes tests
+ #
+diff --git source4/kdc/pac-glue.c source4/kdc/pac-glue.c
+index e0e483662c0..2a96a683cd9 100644
+--- source4/kdc/pac-glue.c
++++ source4/kdc/pac-glue.c
+@@ -1237,11 +1237,7 @@ krb5_error_code samba_kdc_validate_pac_blob(
+ 			"PAC[%s] != CLI[%s]\n",
+ 			dom_sid_str_buf(&pac_sid, &buf1),
+ 			dom_sid_str_buf(client_sid, &buf2));
+-#if defined(KRB5KDC_ERR_CLIENT_NAME_MISMATCH) /* MIT */
+-			code = KRB5KDC_ERR_CLIENT_NAME_MISMATCH;
+-#else /* Heimdal (where this is an enum) */
+-			code = KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
+-#endif
++			code = KRB5KDC_ERR_TGT_REVOKED;
+ 		goto out;
+ 	}
+ 
+-- 
+2.25.1
+
+
+From c62a2b7a218e2c4bdbd476a055049e78b8c0f4ce Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 25 Nov 2021 10:05:17 +1300
+Subject: [PATCH 39/99] tests/krb5: Add test for S4U2Self with wrong sname
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit bac5f75059450898937be891e863826e1350b62c)
+---
+ python/samba/tests/krb5/s4u_tests.py | 32 +++++++++++++++++++++++++++-
+ selftest/knownfail_heimdal_kdc       |  1 +
+ 2 files changed, 32 insertions(+), 1 deletion(-)
+
+diff --git python/samba/tests/krb5/s4u_tests.py python/samba/tests/krb5/s4u_tests.py
+index 5f37525f393..2953766ef21 100755
+--- python/samba/tests/krb5/s4u_tests.py
++++ python/samba/tests/krb5/s4u_tests.py
+@@ -36,6 +36,7 @@ from samba.tests.krb5.raw_testcase import (
+ from samba.tests.krb5.rfc4120_constants import (
+     AES256_CTS_HMAC_SHA1_96,
+     ARCFOUR_HMAC_MD5,
++    KDC_ERR_BADMATCH,
+     KDC_ERR_BADOPTION,
+     KDC_ERR_BAD_INTEGRITY,
+     KDC_ERR_GENERIC,
+@@ -243,7 +244,9 @@ class S4UKerberosTests(KDCBaseTest):
+         client_dn = client_creds.get_dn()
+         sid = self.get_objectSid(samdb, client_dn)
+ 
+-        service_name = service_creds.get_username()[:-1]
++        service_name = kdc_dict.pop('service_name', None)
++        if service_name is None:
++            service_name = service_creds.get_username()[:-1]
+         service_sname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
+                                                   names=['host', service_name])
+ 
+@@ -474,6 +477,33 @@ class S4UKerberosTests(KDCBaseTest):
+                 'expected_flags': 'forwardable'
+             })
+ 
++    # Do an S4U2Self with the sname in the request different to that of the
++    # service. We expect an error.
++    def test_s4u2self_wrong_sname(self):
++        other_creds = self.get_cached_creds(
++            account_type=self.AccountType.COMPUTER,
++            opts={
++                'trusted_to_auth_for_delegation': True,
++                'id': 0
++            })
++        other_sname = other_creds.get_username()[:-1]
++
++        self._run_s4u2self_test(
++            {
++                'expected_error_mode': KDC_ERR_BADMATCH,
++                'expect_edata': False,
++                'client_opts': {
++                    'not_delegated': False
++                },
++                'service_opts': {
++                    'trusted_to_auth_for_delegation': True
++                },
++                'service_name': other_sname,
++                'kdc_options': 'forwardable',
++                'modify_service_tgt_fn': functools.partial(
++                    self.set_ticket_forwardable, flag=True)
++            })
++
+     def _run_delegation_test(self, kdc_dict):
+         client_opts = kdc_dict.pop('client_opts', None)
+         client_creds = self.get_cached_creds(
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index bc644587319..483145f1473 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -243,6 +243,7 @@
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_service_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_wrong_sname
+ #
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_auth_data_required
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_auth_data_required
+-- 
+2.25.1
+
+
+From 46b05cbf803c54cf56dca228fe95a3454027d0cc Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 23 Nov 2021 20:00:07 +1300
+Subject: [PATCH 40/99] kdc: Match Windows error code for mismatching sname
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit b6a25f5f016aef39c3b1d7be8b3ecfe021c03c83)
+---
+ selftest/knownfail_heimdal_kdc | 3 ---
+ source4/kdc/db-glue.c          | 2 +-
+ 2 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 483145f1473..981d7894158 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -243,7 +243,6 @@
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_service_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_wrong_sname
+ #
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_auth_data_required
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_auth_data_required
+@@ -292,6 +291,4 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_pac_request_false
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_sname_krbtgt
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed
+diff --git source4/kdc/db-glue.c source4/kdc/db-glue.c
+index d017741e30a..bed0ff773f9 100644
+--- source4/kdc/db-glue.c
++++ source4/kdc/db-glue.c
+@@ -2599,7 +2599,7 @@ samba_kdc_check_s4u2self(krb5_context context,
+ 	 */
+ 	if (!(orig_sid && target_sid && dom_sid_equal(orig_sid, target_sid))) {
+ 		talloc_free(frame);
+-		return KRB5KDC_ERR_BADOPTION;
++		return KRB5KRB_AP_ERR_BADMATCH;
+ 	}
+ 
+ 	talloc_free(frame);
+-- 
+2.25.1
+
+
+From 93a5264dd68da57e172af50020f670631eeef263 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 23 Nov 2021 20:15:41 +1300
+Subject: [PATCH 41/99] kdc: Always add the PAC if the header TGT is from an
+ RODC
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 690a00a40c0a3f77da6e4dca42b630f2793a98b8)
+---
+ selftest/knownfail_heimdal_kdc | 1 -
+ source4/kdc/wdc-samba4.c       | 2 +-
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 981d7894158..94a4509f45a 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -290,5 +290,4 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_validate
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_pac_request_false
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed
+diff --git source4/kdc/wdc-samba4.c source4/kdc/wdc-samba4.c
+index ecd182702c3..8c3ce71529c 100644
+--- source4/kdc/wdc-samba4.c
++++ source4/kdc/wdc-samba4.c
+@@ -471,7 +471,7 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context,
+ 		goto out;
+ 	}
+ 
+-	if (!server_skdc_entry->is_krbtgt) {
++	if (!is_untrusted && !server_skdc_entry->is_krbtgt) {
+ 		/*
+ 		 * The client may have requested no PAC when obtaining the
+ 		 * TGT.
+-- 
+2.25.1
+
+
+From 4cd44326ce38187965c46c71322caedb7a2fbf6c Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 25 Nov 2021 10:32:44 +1300
+Subject: [PATCH 42/99] tests/krb5: Add tests for renewal and validation of
+ RODC TGTs with PAC requests
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 73a48063469205099f02efdf3b8f0f1040dc7a3d)
+---
+ python/samba/tests/krb5/kdc_tgs_tests.py | 90 ++++++++++++++++++++++++
+ selftest/knownfail_heimdal_kdc           |  6 ++
+ selftest/knownfail_mit_kdc               |  6 ++
+ 3 files changed, 102 insertions(+)
+
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index ecc38538e61..2923d53772a 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -1867,6 +1867,51 @@ class KdcTgsTests(KDCBaseTest):
+         pac = self.get_ticket_pac(ticket)
+         self.assertIsNotNone(pac)
+ 
++    def test_rodc_renew_pac_request_none(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++        tgt = self.get_tgt(creds, pac_request=None)
++        tgt = self._modify_tgt(tgt, renewable=True, from_rodc=True)
++
++        tgt = self._renew_tgt(tgt, expected_error=0, expect_pac=None,
++                              expect_pac_attrs=False,
++                              expect_requester_sid=True)
++
++        ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
++
++        pac = self.get_ticket_pac(ticket)
++        self.assertIsNotNone(pac)
++
++    def test_rodc_renew_pac_request_false(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++        tgt = self.get_tgt(creds, pac_request=False, expect_pac=None)
++        tgt = self._modify_tgt(tgt, renewable=True, from_rodc=True)
++
++        tgt = self._renew_tgt(tgt, expected_error=0, expect_pac=None,
++                              expect_pac_attrs=False,
++                              expect_requester_sid=True)
++
++        ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
++
++        pac = self.get_ticket_pac(ticket)
++        self.assertIsNotNone(pac)
++
++    def test_rodc_renew_pac_request_true(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++        tgt = self.get_tgt(creds, pac_request=True)
++        tgt = self._modify_tgt(tgt, renewable=True, from_rodc=True)
++
++        tgt = self._renew_tgt(tgt, expected_error=0, expect_pac=None,
++                              expect_pac_attrs=False,
++                              expect_requester_sid=True)
++
++        ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
++
++        pac = self.get_ticket_pac(ticket)
++        self.assertIsNotNone(pac)
++
+     def test_validate_pac_request_none(self):
+         creds = self._get_creds()
+         tgt = self.get_tgt(creds, pac_request=None)
+@@ -1912,6 +1957,51 @@ class KdcTgsTests(KDCBaseTest):
+         pac = self.get_ticket_pac(ticket)
+         self.assertIsNotNone(pac)
+ 
++    def test_rodc_validate_pac_request_none(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++        tgt = self.get_tgt(creds, pac_request=None)
++        tgt = self._modify_tgt(tgt, invalid=True, from_rodc=True)
++
++        tgt = self._validate_tgt(tgt, expected_error=0, expect_pac=None,
++                                 expect_pac_attrs=False,
++                                 expect_requester_sid=True)
++
++        ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
++
++        pac = self.get_ticket_pac(ticket)
++        self.assertIsNotNone(pac)
++
++    def test_rodc_validate_pac_request_false(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++        tgt = self.get_tgt(creds, pac_request=False, expect_pac=None)
++        tgt = self._modify_tgt(tgt, invalid=True, from_rodc=True)
++
++        tgt = self._validate_tgt(tgt, expected_error=0, expect_pac=None,
++                                 expect_pac_attrs=False,
++                                 expect_requester_sid=True)
++
++        ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
++
++        pac = self.get_ticket_pac(ticket)
++        self.assertIsNotNone(pac)
++
++    def test_rodc_validate_pac_request_true(self):
++        creds = self._get_creds(replication_allowed=True,
++                                revealed_to_rodc=True)
++        tgt = self.get_tgt(creds, pac_request=True)
++        tgt = self._modify_tgt(tgt, invalid=True, from_rodc=True)
++
++        tgt = self._validate_tgt(tgt, expected_error=0, expect_pac=None,
++                                 expect_pac_attrs=False,
++                                 expect_requester_sid=True)
++
++        ticket = self._run_tgs(tgt, expected_error=0, expect_pac=True)
++
++        pac = self.get_ticket_pac(ticket)
++        self.assertIsNotNone(pac)
++
+     def test_s4u2self_pac_request_none(self):
+         creds = self._get_creds()
+         tgt = self.get_tgt(creds, pac_request=None)
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 94a4509f45a..2de898e73c2 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -278,6 +278,12 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_revealed
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_renew_pac_request_false
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_renew_pac_request_none
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_renew_pac_request_true
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_validate_pac_request_false
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_validate_pac_request_none
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_validate_pac_request_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_false
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_true
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index c6dc1285837..73e64145e42 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -422,6 +422,12 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_service_ticket
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_renew_pac_request_false
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_renew_pac_request_none
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_renew_pac_request_true
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_validate_pac_request_false
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_validate_pac_request_none
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_validate_pac_request_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_req
+-- 
+2.25.1
+
+
+From 925f63f3e464c0fdb91aaa5ed523a6ddb481bfff Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 25 Nov 2021 13:24:57 +1300
+Subject: [PATCH 43/99] Revert "CVE-2020-25719 s4/torture: Expect additional
+ PAC buffers"
+
+This reverts commit fa4c9bcefdeed0a7106aab84df20b02435febc1f.
+
+We should not be generating these additional PAC buffers for service
+tickets, only for TGTs.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit e61983c7f2c4daade83b237efb990d0c0645b3a3)
+---
+ selftest/knownfail_heimdal_kdc   | 39 ++++++++++++++++++++++++++++++++
+ source4/torture/rpc/remote_pac.c | 24 ++------------------
+ 2 files changed, 41 insertions(+), 22 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 2de898e73c2..65e4fee9510 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -297,3 +297,42 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed
++#
++# PAC tests
++#
++^samba4.blackbox.pkinit_pac.STEP1 remote.pac verification.ad_dc:local
++^samba4.blackbox.pkinit_pac.STEP1 remote.pac verification.ad_dc_ntvfs:local
++^samba4.blackbox.pkinit_pac.netr-bdc-aes.verify-sig-aes.ad_dc:local
++^samba4.blackbox.pkinit_pac.netr-bdc-aes.verify-sig-aes.ad_dc_ntvfs:local
++^samba4.blackbox.pkinit_pac.netr-mem-aes.s4u2proxy-aes.ad_dc:local
++^samba4.blackbox.pkinit_pac.netr-mem-aes.s4u2proxy-aes.ad_dc_ntvfs:local
++^samba4.blackbox.pkinit_pac.netr-mem-aes.verify-sig-aes.ad_dc:local
++^samba4.blackbox.pkinit_pac.netr-mem-aes.verify-sig-aes.ad_dc_ntvfs:local
++^samba4.blackbox.pkinit_pac.netr-mem-arcfour.s4u2proxy-arcfour.ad_dc:local
++^samba4.blackbox.pkinit_pac.netr-mem-arcfour.s4u2proxy-arcfour.ad_dc_ntvfs:local
++^samba4.blackbox.pkinit_pac.netr-mem-arcfour.verify-sig-arcfour.ad_dc:local
++^samba4.blackbox.pkinit_pac.netr-mem-arcfour.verify-sig-arcfour.ad_dc_ntvfs:local
++^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2000dc
++^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2003dc
++^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2008dc
++^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2008r2dc
++^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2000dc
++^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2003dc
++^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2008dc
++^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2008r2dc
++^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2000dc
++^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2003dc
++^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2008dc
++^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2008r2dc
++^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2000dc
++^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2003dc
++^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2008dc
++^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2008r2dc
++^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2000dc
++^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2003dc
++^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2008dc
++^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2008r2dc
++^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2000dc
++^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2003dc
++^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008dc
++^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008r2dc
+diff --git source4/torture/rpc/remote_pac.c source4/torture/rpc/remote_pac.c
+index c94decef5ce..14c23f674f1 100644
+--- source4/torture/rpc/remote_pac.c
++++ source4/torture/rpc/remote_pac.c
+@@ -266,7 +266,7 @@ static bool test_PACVerify(struct torture_context *tctx,
+ 				       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
+ 	torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_pull_struct_blob of PAC_DATA structure failed");
+ 
+-	num_pac_buffers = 7;
++	num_pac_buffers = 5;
+ 	if (expect_pac_upn_dns_info) {
+ 		num_pac_buffers += 1;
+ 	}
+@@ -323,18 +323,6 @@ static bool test_PACVerify(struct torture_context *tctx,
+ 		       pac_buf->info != NULL,
+ 		       "PAC_TYPE_TICKET_CHECKSUM info");
+ 
+-	pac_buf = get_pac_buffer(&pac_data_struct, PAC_TYPE_ATTRIBUTES_INFO);
+-	torture_assert_not_null(tctx, pac_buf, "PAC_TYPE_ATTRIBUTES_INFO");
+-	torture_assert(tctx,
+-		       pac_buf->info != NULL,
+-		       "PAC_TYPE_ATTRIBUTES_INFO info");
+-
+-	pac_buf = get_pac_buffer(&pac_data_struct, PAC_TYPE_REQUESTER_SID);
+-	torture_assert_not_null(tctx, pac_buf, "PAC_TYPE_REQUESTER_SID");
+-	torture_assert(tctx,
+-		       pac_buf->info != NULL,
+-		       "PAC_TYPE_REQUESTER_SID info");
+-
+ 	ok = netlogon_validate_pac(tctx, p, server_creds, secure_channel_type, test_machine_name,
+ 				   negotiate_flags, pac_data, session_info);
+ 
+@@ -1094,7 +1082,7 @@ static bool test_S4U2Proxy(struct torture_context *tctx,
+ 				       (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
+ 	torture_assert(tctx, NDR_ERR_CODE_IS_SUCCESS(ndr_err), "ndr_pull_struct_blob of PAC_DATA structure failed");
+ 
+-	num_pac_buffers = 9;
++	num_pac_buffers = 7;
+ 
+ 	torture_assert_int_equal(tctx, pac_data_struct.version, 0, "version");
+ 	torture_assert_int_equal(tctx, pac_data_struct.num_buffers, num_pac_buffers, "num_buffers");
+@@ -1134,14 +1122,6 @@ static bool test_S4U2Proxy(struct torture_context *tctx,
+ 				 talloc_asprintf(tctx, "%s@%s", self_princ, cli_credentials_get_realm(credentials)),
+ 				 "wrong transited_services[0]");
+ 
+-	pac_buf = get_pac_buffer(&pac_data_struct, PAC_TYPE_ATTRIBUTES_INFO);
+-	torture_assert_not_null(tctx, pac_buf, "PAC_TYPE_ATTRIBUTES_INFO");
+-	torture_assert_not_null(tctx, pac_buf->info, "PAC_TYPE_ATTRIBUTES_INFO info");
+-
+-	pac_buf = get_pac_buffer(&pac_data_struct, PAC_TYPE_REQUESTER_SID);
+-	torture_assert_not_null(tctx, pac_buf, "PAC_TYPE_REQUESTER_SID");
+-	torture_assert_not_null(tctx, pac_buf->info, "PAC_TYPE_REQUESTER_SID info");
+-
+ 	return netlogon_validate_pac(tctx, p, server_creds, secure_channel_type, test_machine_name,
+ 				     negotiate_flags, pac_data, session_info);
+ }
+-- 
+2.25.1
+
+
+From 72afa2641c24bd18a32463f0b0de7e91feb54290 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 20:42:22 +1300
+Subject: [PATCH 44/99] kdc: Don't include extra PAC buffers in service tickets
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 90025b6a4d250a15c0f988a9a9150ecfb63069ef)
+---
+ selftest/knownfail_heimdal_kdc | 42 ----------------------------------
+ source4/kdc/wdc-samba4.c       | 31 +++++++++++++++++--------
+ 2 files changed, 21 insertions(+), 52 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 65e4fee9510..ea08cb44122 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -285,11 +285,8 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_validate_pac_request_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_validate_pac_request_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_false
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_none
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_no_requester_sid
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid(?!_)
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_validate
+@@ -297,42 +294,3 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed
+-#
+-# PAC tests
+-#
+-^samba4.blackbox.pkinit_pac.STEP1 remote.pac verification.ad_dc:local
+-^samba4.blackbox.pkinit_pac.STEP1 remote.pac verification.ad_dc_ntvfs:local
+-^samba4.blackbox.pkinit_pac.netr-bdc-aes.verify-sig-aes.ad_dc:local
+-^samba4.blackbox.pkinit_pac.netr-bdc-aes.verify-sig-aes.ad_dc_ntvfs:local
+-^samba4.blackbox.pkinit_pac.netr-mem-aes.s4u2proxy-aes.ad_dc:local
+-^samba4.blackbox.pkinit_pac.netr-mem-aes.s4u2proxy-aes.ad_dc_ntvfs:local
+-^samba4.blackbox.pkinit_pac.netr-mem-aes.verify-sig-aes.ad_dc:local
+-^samba4.blackbox.pkinit_pac.netr-mem-aes.verify-sig-aes.ad_dc_ntvfs:local
+-^samba4.blackbox.pkinit_pac.netr-mem-arcfour.s4u2proxy-arcfour.ad_dc:local
+-^samba4.blackbox.pkinit_pac.netr-mem-arcfour.s4u2proxy-arcfour.ad_dc_ntvfs:local
+-^samba4.blackbox.pkinit_pac.netr-mem-arcfour.verify-sig-arcfour.ad_dc:local
+-^samba4.blackbox.pkinit_pac.netr-mem-arcfour.verify-sig-arcfour.ad_dc_ntvfs:local
+-^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2000dc
+-^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2003dc
+-^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2008dc
+-^samba4.rpc.pac on ncacn_np.netr-bdc-aes.verify-sig-aes.fl2008r2dc
+-^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2000dc
+-^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2003dc
+-^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2008dc
+-^samba4.rpc.pac on ncacn_np.netr-bdc-arcfour.verify-sig-arcfour.fl2008r2dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2000dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2003dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2008dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-aes.s4u2proxy-aes.fl2008r2dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2000dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2003dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2008dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-aes.verify-sig-aes.fl2008r2dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2000dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2003dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2008dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.s4u2proxy-arcfour.fl2008r2dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2000dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2003dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008dc
+-^samba4.rpc.pac on ncacn_np.netr-mem-arcfour.verify-sig-arcfour.fl2008r2dc
+diff --git source4/kdc/wdc-samba4.c source4/kdc/wdc-samba4.c
+index 8c3ce71529c..17af76f4edb 100644
+--- source4/kdc/wdc-samba4.c
++++ source4/kdc/wdc-samba4.c
+@@ -132,6 +132,7 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context,
+ 	krb5_error_code ret;
+ 	NTSTATUS nt_status;
+ 	bool is_in_db, is_untrusted;
++	bool is_krbtgt;
+ 	size_t num_types = 0;
+ 	uint32_t *types = NULL;
+ 	uint32_t forced_next_type = 0;
+@@ -471,7 +472,9 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context,
+ 		goto out;
+ 	}
+ 
+-	if (!is_untrusted && !server_skdc_entry->is_krbtgt) {
++	is_krbtgt = krb5_principal_is_krbtgt(context, server->entry.principal);
++
++	if (!is_untrusted && !is_krbtgt) {
+ 		/*
+ 		 * The client may have requested no PAC when obtaining the
+ 		 * TGT.
+@@ -576,17 +579,25 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context,
+ 			type_blob = data_blob_const(&zero_byte, 1);
+ 			break;
+ 		case PAC_TYPE_ATTRIBUTES_INFO:
+-			/* just copy... */
+-			break;
++			if (is_krbtgt) {
++				/* just copy... */
++				break;
++			} else {
++				continue;
++			}
+ 		case PAC_TYPE_REQUESTER_SID:
+-			/*
+-			 * Replace in the RODC case, otherwise
+-			 * requester_sid_blob is NULL and we just copy.
+-			 */
+-			if (requester_sid_blob != NULL) {
+-				type_blob = *requester_sid_blob;
++			if (is_krbtgt) {
++				/*
++				 * Replace in the RODC case, otherwise
++				 * requester_sid_blob is NULL and we just copy.
++				 */
++				if (requester_sid_blob != NULL) {
++					type_blob = *requester_sid_blob;
++				}
++				break;
++			} else {
++				continue;
+ 			}
+-			break;
+ 		default:
+ 			/* just copy... */
+ 			break;
+-- 
+2.25.1
+
+
+From 29f15fe2d92831dcf5f4eb6d295df866ff689ee3 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 25 Nov 2021 10:53:49 +1300
+Subject: [PATCH 45/99] kdc: Remove PAC_TYPE_ATTRIBUTES_INFO from RODC-issued
+ tickets
+
+Windows ignores PAC_TYPE_ATTRIBUTES_INFO and always issues a PAC when
+presented with an RODC-issued TGT. By removing this PAC buffer from
+RODC-issued tickets, we ensure that an RODC-issued ticket will still
+result in a PAC if it is first renewed or validated by the main DC.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 4b60e9516497c2e7f1545fe50887d0336b9893f2)
+---
+ selftest/knownfail_heimdal_kdc | 13 -------------
+ source4/kdc/wdc-samba4.c       |  2 +-
+ 2 files changed, 1 insertion(+), 14 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index ea08cb44122..5e94cb63d7a 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -274,16 +274,6 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_false
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_none
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_true
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_revealed
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_renew_pac_request_false
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_renew_pac_request_none
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_renew_pac_request_true
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_validate_pac_request_false
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_validate_pac_request_none
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_rodc_validate_pac_request_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_false
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_no_requester_sid
+@@ -291,6 +281,3 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_validate
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_validate
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed
+diff --git source4/kdc/wdc-samba4.c source4/kdc/wdc-samba4.c
+index 17af76f4edb..713720bcb99 100644
+--- source4/kdc/wdc-samba4.c
++++ source4/kdc/wdc-samba4.c
+@@ -579,7 +579,7 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context,
+ 			type_blob = data_blob_const(&zero_byte, 1);
+ 			break;
+ 		case PAC_TYPE_ATTRIBUTES_INFO:
+-			if (is_krbtgt) {
++			if (!is_untrusted && is_krbtgt) {
+ 				/* just copy... */
+ 				break;
+ 			} else {
+-- 
+2.25.1
+
+
+From d3436300745c41226d7ed146f269c929133f8f49 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 25 Nov 2021 12:46:40 +1300
+Subject: [PATCH 46/99] tests/krb5: Add a test for S4U2Self with no
+ authorization data required
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 192d6edfe912105ec344dc554f872a24c03540a3)
+---
+ python/samba/tests/krb5/s4u_tests.py | 34 ++++++++++++++++++++++++++++
+ selftest/knownfail_heimdal_kdc       |  1 +
+ 2 files changed, 35 insertions(+)
+
+diff --git python/samba/tests/krb5/s4u_tests.py python/samba/tests/krb5/s4u_tests.py
+index 2953766ef21..6ec9af11423 100755
+--- python/samba/tests/krb5/s4u_tests.py
++++ python/samba/tests/krb5/s4u_tests.py
+@@ -324,6 +324,13 @@ class S4UKerberosTests(KDCBaseTest):
+                                    sname=service_sname,
+                                    etypes=etypes)
+ 
++        if not expected_error_mode:
++            # Check that the ticket contains a PAC.
++            ticket = kdc_exchange_dict['rep_ticket_creds']
++
++            pac = self.get_ticket_pac(ticket)
++            self.assertIsNotNone(pac)
++
+         # Ensure we used all the parameters given to us.
+         self.assertEqual({}, kdc_dict)
+ 
+@@ -504,6 +511,24 @@ class S4UKerberosTests(KDCBaseTest):
+                     self.set_ticket_forwardable, flag=True)
+             })
+ 
++    # Do an S4U2Self where the service does not require authorization data. The
++    # resulting ticket should still contain a PAC.
++    def test_s4u2self_no_auth_data_required(self):
++        self._run_s4u2self_test(
++            {
++                'client_opts': {
++                    'not_delegated': False
++                },
++                'service_opts': {
++                    'trusted_to_auth_for_delegation': True,
++                    'no_auth_data_required': True
++                },
++                'kdc_options': 'forwardable',
++                'modify_service_tgt_fn': functools.partial(
++                    self.set_ticket_forwardable, flag=True),
++                'expected_flags': 'forwardable'
++            })
++
+     def _run_delegation_test(self, kdc_dict):
+         client_opts = kdc_dict.pop('client_opts', None)
+         client_creds = self.get_cached_creds(
+@@ -654,6 +679,15 @@ class S4UKerberosTests(KDCBaseTest):
+                                    etypes=etypes,
+                                    additional_tickets=additional_tickets)
+ 
++        if not expected_error_mode:
++            # Check whether the ticket contains a PAC.
++            ticket = kdc_exchange_dict['rep_ticket_creds']
++            pac = self.get_ticket_pac(ticket, expect_pac=expect_pac)
++            if expect_pac:
++                self.assertIsNotNone(pac)
++            else:
++                self.assertIsNone(pac)
++
+         # Ensure we used all the parameters given to us.
+         self.assertEqual({}, kdc_dict)
+ 
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 5e94cb63d7a..2025032a278 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -242,6 +242,7 @@
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_client_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_service_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_no_auth_data_required
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed
+ #
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_auth_data_required
+-- 
+2.25.1
+
+
+From 8f97f78dd8023d88d76fc7de063661d94ebe5400 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 23 Nov 2021 17:30:50 +1300
+Subject: [PATCH 47/99] heimdal:kdc: Always generate a PAC for S4U2Self
+
+If we decided not to put a PAC into the ticket, mspac would be NULL
+here, and the resulting ticket would not contain a PAC. This could
+happen if there was a request to omit the PAC or the service did not
+require authorization data. Ensure that we always generate a PAC.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 1f4f3018c5001b289b91959a72d00575c8fc0ac1)
+---
+ selftest/knownfail_heimdal_kdc |  2 --
+ source4/heimdal/kdc/krb5tgs.c  | 13 +++++++------
+ 2 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 2025032a278..53cc8e6b6a2 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -242,7 +242,6 @@
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_client_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_service_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_no_auth_data_required
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed
+ #
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_auth_data_required
+@@ -275,7 +274,6 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_false
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
+diff --git source4/heimdal/kdc/krb5tgs.c source4/heimdal/kdc/krb5tgs.c
+index 6c5c51aa448..dc356b4daa5 100644
+--- source4/heimdal/kdc/krb5tgs.c
++++ source4/heimdal/kdc/krb5tgs.c
+@@ -1846,12 +1846,13 @@ server_lookup:
+ 	    if (mspac) {
+ 		krb5_pac_free(context, mspac);
+ 		mspac = NULL;
+-		ret = _kdc_pac_generate(context, s4u2self_impersonated_client, NULL, NULL, &mspac);
+-		if (ret) {
+-		    kdc_log(context, config, 0, "PAC generation failed for -- %s",
+-			    tpn);
+-		    goto out;
+-		}
++	    }
++
++	    ret = _kdc_pac_generate(context, s4u2self_impersonated_client, NULL, NULL, &mspac);
++	    if (ret) {
++		kdc_log(context, config, 0, "PAC generation failed for -- %s",
++			tpn);
++		goto out;
+ 	    }
+ 
+ 	    /*
+-- 
+2.25.1
+
+
+From 8585333a8ef54295a60faf47689a8978c0740361 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 25 Nov 2021 09:29:42 +1300
+Subject: [PATCH 48/99] selftest: Properly check extra PAC buffers with Heimdal
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit ee4aa21c487fa80082a548b2e4f115a791e30340)
+
+[jsutton@samba.org Fixed conflicts]
+---
+ selftest/knownfail_heimdal_kdc | 12 ++++++++++++
+ source4/selftest/tests.py      |  2 +-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 53cc8e6b6a2..f71b95f306e 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -241,8 +241,15 @@
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_unkeyed_service_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_client_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_service_checksum
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_client_not_delegated
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_no_auth_data_required
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_forwardable
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_nonempty_allowed
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_trusted_empty_allowed
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_trusted_nonempty_allowed
++^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_without_forwardable
+ #
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_auth_data_required
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_auth_data_required
+@@ -274,6 +281,11 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_false
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_none
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_true
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_req(?!_invalid)
++^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
+
+
+From 65bb0e3201d60d87a3f228ea161644d9a5f918c5 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 23 Nov 2021 19:38:35 +1300
+Subject: [PATCH 49/99] heimdal:kdc: Do not generate extra PAC buffers for
+ S4U2Self service ticket
+
+Normally samba_wdc_get_pac() is used to generate the PAC for a TGT, but
+when generating a service ticket for S4U2Self, we want to avoid adding
+the additional PAC_ATTRIBUTES_INFO and PAC_REQUESTER_SID buffers.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 9bd26804852d957f81cb311e5142f9190f9afa65)
+---
+ selftest/knownfail_heimdal_kdc     | 12 ------------
+ source4/heimdal/kdc/kerberos5.c    |  2 +-
+ source4/heimdal/kdc/krb5tgs.c      |  3 ++-
+ source4/heimdal/kdc/windc.c        |  5 +++--
+ source4/heimdal/kdc/windc_plugin.h |  2 ++
+ source4/kdc/wdc-samba4.c           | 11 ++++++++---
+ 6 files changed, 16 insertions(+), 19 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index f71b95f306e..53cc8e6b6a2 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -241,15 +241,8 @@
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_unkeyed_service_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_client_checksum
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_zeroed_service_checksum
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_client_not_delegated
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_forwardable
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_no_auth_data_required
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_forwardable
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_empty_allowed
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_not_trusted_nonempty_allowed
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_trusted_empty_allowed
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_trusted_nonempty_allowed
+-^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_s4u2self_without_forwardable
+ #
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_constrained_delegation_no_auth_data_required
+ ^samba.tests.krb5.s4u_tests.samba.tests.krb5.s4u_tests.S4UKerberosTests.test_rbcd_no_auth_data_required
+@@ -281,11 +274,6 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_false
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_none
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_pac_request_true
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_req(?!_invalid)
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_rodc_revealed
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
+diff --git source4/heimdal/kdc/kerberos5.c source4/heimdal/kdc/kerberos5.c
+index 9684364c519..a9e81336615 100644
+--- source4/heimdal/kdc/kerberos5.c
++++ source4/heimdal/kdc/kerberos5.c
+@@ -1776,7 +1776,7 @@ _kdc_as_rep(krb5_context context,
+ 
+ 	sent_pac_request = send_pac_p(context, req, &pac_request);
+ 
+-	ret = _kdc_pac_generate(context, client, pk_reply_key,
++	ret = _kdc_pac_generate(context, client, server, pk_reply_key,
+ 				sent_pac_request ? &pac_request : NULL,
+ 				&p);
+ 	if (ret) {
+diff --git source4/heimdal/kdc/krb5tgs.c source4/heimdal/kdc/krb5tgs.c
+index dc356b4daa5..38dba8493ae 100644
+--- source4/heimdal/kdc/krb5tgs.c
++++ source4/heimdal/kdc/krb5tgs.c
+@@ -1848,7 +1848,8 @@ server_lookup:
+ 		mspac = NULL;
+ 	    }
+ 
+-	    ret = _kdc_pac_generate(context, s4u2self_impersonated_client, NULL, NULL, &mspac);
++	    ret = _kdc_pac_generate(context, s4u2self_impersonated_client, server,
++				    NULL, NULL, &mspac);
+ 	    if (ret) {
+ 		kdc_log(context, config, 0, "PAC generation failed for -- %s",
+ 			tpn);
+diff --git source4/heimdal/kdc/windc.c source4/heimdal/kdc/windc.c
+index 93b973f576b..0a5ae5025ec 100644
+--- source4/heimdal/kdc/windc.c
++++ source4/heimdal/kdc/windc.c
+@@ -73,6 +73,7 @@ krb5_kdc_windc_init(krb5_context context)
+ krb5_error_code
+ _kdc_pac_generate(krb5_context context,
+ 		  hdb_entry_ex *client,
++		  hdb_entry_ex *server,
+ 		  const krb5_keyblock *pk_reply_key,
+ 		  const krb5_boolean *pac_request,
+ 		  krb5_pac *pac)
+@@ -88,9 +89,9 @@ _kdc_pac_generate(krb5_context context,
+ 
+     if (windcft->pac_pk_generate != NULL && pk_reply_key != NULL)
+ 	return (windcft->pac_pk_generate)(windcctx, context,
+-					  client, pk_reply_key,
++					  client, server, pk_reply_key,
+ 					  pac_request, pac);
+-    return (windcft->pac_generate)(windcctx, context, client,
++    return (windcft->pac_generate)(windcctx, context, client, server,
+ 				   pac_request, pac);
+ }
+ 
+diff --git source4/heimdal/kdc/windc_plugin.h source4/heimdal/kdc/windc_plugin.h
+index c7f2bcb5ed9..d239d0260e7 100644
+--- source4/heimdal/kdc/windc_plugin.h
++++ source4/heimdal/kdc/windc_plugin.h
+@@ -55,12 +55,14 @@ struct hdb_entry_ex;
+ typedef krb5_error_code
+ (*krb5plugin_windc_pac_generate)(void *, krb5_context,
+ 				 struct hdb_entry_ex *, /* client */
++				 struct hdb_entry_ex *, /* server */
+ 				 const krb5_boolean *, /* pac_request */
+ 				 krb5_pac *);
+ 
+ typedef krb5_error_code
+ (*krb5plugin_windc_pac_pk_generate)(void *, krb5_context,
+ 				    struct hdb_entry_ex *, /* client */
++				    struct hdb_entry_ex *, /* server */
+ 				    const krb5_keyblock *, /* pk_replykey */
+ 				    const krb5_boolean *, /* pac_request */
+ 				    krb5_pac *);
+diff --git source4/kdc/wdc-samba4.c source4/kdc/wdc-samba4.c
+index 713720bcb99..b1d011c09a9 100644
+--- source4/kdc/wdc-samba4.c
++++ source4/kdc/wdc-samba4.c
+@@ -37,6 +37,7 @@
+  */
+ static krb5_error_code samba_wdc_get_pac(void *priv, krb5_context context,
+ 					 struct hdb_entry_ex *client,
++					 struct hdb_entry_ex *server,
+ 					 const krb5_keyblock *pk_reply_key,
+ 					 const krb5_boolean *pac_request,
+ 					 krb5_pac *pac)
+@@ -55,6 +56,7 @@ static krb5_error_code samba_wdc_get_pac(void *priv, krb5_context context,
+ 	struct samba_kdc_entry *skdc_entry =
+ 		talloc_get_type_abort(client->ctx,
+ 		struct samba_kdc_entry);
++	bool is_krbtgt;
+ 
+ 	mem_ctx = talloc_named(client->ctx, 0, "samba_get_pac context");
+ 	if (!mem_ctx) {
+@@ -65,13 +67,15 @@ static krb5_error_code samba_wdc_get_pac(void *priv, krb5_context context,
+ 		cred_ndr_ptr = &cred_ndr;
+ 	}
+ 
++	is_krbtgt = krb5_principal_is_krbtgt(context, server->entry.principal);
++
+ 	nt_status = samba_kdc_get_pac_blobs(mem_ctx, skdc_entry,
+ 					    &logon_blob,
+ 					    cred_ndr_ptr,
+ 					    &upn_blob,
+-					    &pac_attrs_blob,
++					    is_krbtgt ? &pac_attrs_blob : NULL,
+ 					    pac_request,
+-					    &requester_sid_blob,
++					    is_krbtgt ? &requester_sid_blob : NULL,
+ 					    NULL);
+ 	if (!NT_STATUS_IS_OK(nt_status)) {
+ 		talloc_free(mem_ctx);
+@@ -101,10 +105,11 @@ static krb5_error_code samba_wdc_get_pac(void *priv, krb5_context context,
+ 
+ static krb5_error_code samba_wdc_get_pac_compat(void *priv, krb5_context context,
+ 						struct hdb_entry_ex *client,
++						struct hdb_entry_ex *server,
+ 						const krb5_boolean *pac_request,
+ 						krb5_pac *pac)
+ {
+-	return samba_wdc_get_pac(priv, context, client, NULL, pac_request, pac);
++	return samba_wdc_get_pac(priv, context, client, server, NULL, pac_request, pac);
+ }
+ 
+ static krb5_error_code samba_wdc_reget_pac2(krb5_context context,
+-- 
+2.25.1
+
+
+From 49aafce0a705d47ffd4753ce6c6f452c4f7aa882 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 24 Nov 2021 20:41:54 +1300
+Subject: [PATCH 50/99] kdc: Require that PAC_REQUESTER_SID buffer is present
+ for TGTs
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+
+Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
+Autobuild-Date(master): Tue Nov 30 03:33:26 UTC 2021 on sn-devel-184
+
+(cherry picked from commit 38c5bad4a853b19fe9a51fb059e150b153c4632a)
+---
+ selftest/knownfail_heimdal_kdc | 6 ------
+ source4/kdc/wdc-samba4.c       | 6 ++++++
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 53cc8e6b6a2..32465cb6042 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -274,9 +274,3 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_requester_sid
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_no_requester_sid
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_renew
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_validate
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_validate
+diff --git source4/kdc/wdc-samba4.c source4/kdc/wdc-samba4.c
+index b1d011c09a9..d7ce34fb3a9 100644
+--- source4/kdc/wdc-samba4.c
++++ source4/kdc/wdc-samba4.c
+@@ -459,6 +459,12 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context,
+ 		talloc_free(mem_ctx);
+ 		return EINVAL;
+ 	}
++	if (delegated_proxy_principal == NULL && requester_sid_idx == -1) {
++		DEBUG(1, ("PAC_TYPE_REQUESTER_SID missing\n"));
++		SAFE_FREE(types);
++		talloc_free(mem_ctx);
++		return KRB5KDC_ERR_TGT_REVOKED;
++	}
+ 
+ 	/*
+ 	 * The server account may be set not to want the PAC.
+-- 
+2.25.1
+
+
+From 3fc519edec0159535baa0b659861b73f40632110 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 7 Dec 2021 13:15:38 +1300
+Subject: [PATCH 51/99] kdc: Canonicalize realm for enterprise principals
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+
+Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
+Autobuild-Date(master): Tue Dec  7 04:54:35 UTC 2021 on sn-devel-184
+
+(cherry picked from commit 8bd7b316bd61ef35f6e0baa0b65f0ef00910112c)
+---
+ selftest/knownfail.d/kdc-enterprise | 63 -----------------------------
+ selftest/knownfail_heimdal_kdc      |  3 --
+ selftest/knownfail_mit_kdc          | 36 +++++++++++++++++
+ source4/kdc/db-glue.c               | 24 +++++------
+ 4 files changed, 47 insertions(+), 79 deletions(-)
+ delete mode 100644 selftest/knownfail.d/kdc-enterprise
+
+diff --git selftest/knownfail.d/kdc-enterprise selftest/knownfail.d/kdc-enterprise
+deleted file mode 100644
+index c9b6c98a2ee..00000000000
+--- selftest/knownfail.d/kdc-enterprise
++++ /dev/null
+@@ -1,63 +0,0 @@
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN_RemoveDollar\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_NetbiosRealm\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_NetbiosRealm_UPN\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UPN\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_NetbiosRealm\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName_NetbiosRealm\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN\(
+-samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_UserCredentials_Enterprise_UpperUserName_UPN\(
+-
+-
+-
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_RemoveDollar_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_RemoveDollar_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN_RemoveDollar_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_RemoveDollar_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_RemoveDollar_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN_AsReqSelf\(
+-^samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN_RemoveDollar_AsReqSelf\(
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 32465cb6042..424a8b81c38 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -5,9 +5,6 @@
+ #
+ # Heimdal currently fails the following MS-KILE client principal lookup
+ # tests
+-^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_1_3
+-^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_4
+-^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_5
+ ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_enterprise_principal_step_6_a
+ ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_enterprise_principal_step_6_b
+ ^samba.tests.krb5.ms_kile_client_principal_lookup_tests.samba.tests.krb5.ms_kile_client_principal_lookup_tests.MS_Kile_Client_Principal_Lookup_Tests.test_nt_principal_step_4_a
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 73e64145e42..4d685af7140 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -56,17 +56,53 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_UPN\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Canonicalize_UpperUserName_UPN_RemoveDollar\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_RemoveDollar_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_RemoveDollar_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UPN_RemoveDollar_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_RemoveDollar_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperRealm_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_RemoveDollar_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_NetbiosRealm_UPN_RemoveDollar_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_RemoveDollar_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN_AsReqSelf\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN_RemoveDollar\(
++samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_Enterprise_UpperUserName_UPN_RemoveDollar_AsReqSelf\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_NetbiosRealm\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_NetbiosRealm_RemoveDollar\(
+ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_tests.KerberosASCanonicalizationTests.test_MachineCredentials_NetbiosRealm_UPN\(
+diff --git source4/kdc/db-glue.c source4/kdc/db-glue.c
+index bed0ff773f9..5752ffb821c 100644
+--- source4/kdc/db-glue.c
++++ source4/kdc/db-glue.c
+@@ -980,19 +980,17 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
+ 			goto out;
+ 		}
+ 
+-		if (smb_krb5_principal_get_type(context, principal) != KRB5_NT_ENTERPRISE_PRINCIPAL) {
+-			/* While we have copied the client principal, tests
+-			 * show that Win2k3 returns the 'corrected' realm, not
+-			 * the client-specified realm.  This code attempts to
+-			 * replace the client principal's realm with the one
+-			 * we determine from our records */
+-			
+-			/* this has to be with malloc() */
+-			ret = smb_krb5_principal_set_realm(context, entry_ex->entry.principal, lpcfg_realm(lp_ctx));
+-			if (ret) {
+-				krb5_clear_error_message(context);
+-				goto out;
+-			}
++		/* While we have copied the client principal, tests
++		 * show that Win2k3 returns the 'corrected' realm, not
++		 * the client-specified realm.  This code attempts to
++		 * replace the client principal's realm with the one
++		 * we determine from our records */
++
++		/* this has to be with malloc() */
++		ret = smb_krb5_principal_set_realm(context, entry_ex->entry.principal, lpcfg_realm(lp_ctx));
++		if (ret) {
++			krb5_clear_error_message(context);
++			goto out;
+ 		}
+ 	}
+ 
+-- 
+2.25.1
+
+
+From 787405ef59b70cef011f005a6ed98898c5d43adb Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 14 Dec 2021 19:16:00 +1300
+Subject: [PATCH 52/99] tests/krb5: Correctly determine whether tickets are
+ service tickets
+
+Previously we expected tickets to contain a ticket checksum if the sname
+was not the krbtgt. However, the ticket checksum should not be present
+if we are performing an AS-REQ to our own account. Now we determine a
+ticket is a service ticket only if the request is also a TGS-REQ.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+(cherry picked from commit 100be7eb8e70ba270a8e92957a5e47466160a901)
+---
+ python/samba/tests/krb5/compatability_tests.py | 10 ++++++----
+ python/samba/tests/krb5/kdc_base_test.py       |  2 +-
+ python/samba/tests/krb5/raw_testcase.py        | 18 ++++++++++--------
+ python/samba/tests/krb5/rodc_tests.py          |  4 ++--
+ 4 files changed, 19 insertions(+), 15 deletions(-)
+
+diff --git python/samba/tests/krb5/compatability_tests.py python/samba/tests/krb5/compatability_tests.py
+index ed2dc565b6d..65e9e3788d5 100755
+--- python/samba/tests/krb5/compatability_tests.py
++++ python/samba/tests/krb5/compatability_tests.py
+@@ -132,13 +132,14 @@ class SimpleKerberosTests(KDCBaseTest):
+         tgt = self.get_tgt(user_creds)
+ 
+         # Ensure the PAC contains the expected checksums.
+-        self.verify_ticket(tgt, key)
++        self.verify_ticket(tgt, key, service_ticket=False)
+ 
+         # Get a service ticket from the DC.
+         service_ticket = self.get_service_ticket(tgt, target_creds)
+ 
+         # Ensure the PAC contains the expected checksums.
+-        self.verify_ticket(service_ticket, key, expect_ticket_checksum=True)
++        self.verify_ticket(service_ticket, key, service_ticket=True,
++                           expect_ticket_checksum=True)
+ 
+     def test_mit_ticket_signature(self):
+         # Ensure that a DC does not issue tickets signed with its krbtgt key.
+@@ -152,13 +153,14 @@ class SimpleKerberosTests(KDCBaseTest):
+         tgt = self.get_tgt(user_creds)
+ 
+         # Ensure the PAC contains the expected checksums.
+-        self.verify_ticket(tgt, key)
++        self.verify_ticket(tgt, key, service_ticket=False)
+ 
+         # Get a service ticket from the DC.
+         service_ticket = self.get_service_ticket(tgt, target_creds)
+ 
+         # Ensure the PAC does not contain the expected checksums.
+-        self.verify_ticket(service_ticket, key, expect_ticket_checksum=False)
++        self.verify_ticket(service_ticket, key, service_ticket=True,
++                           expect_ticket_checksum=False)
+ 
+     def as_pre_auth_req(self, creds, etypes):
+         user = creds.get_username()
+diff --git python/samba/tests/krb5/kdc_base_test.py python/samba/tests/krb5/kdc_base_test.py
+index 6e96b982167..9506048ee2a 100644
+--- python/samba/tests/krb5/kdc_base_test.py
++++ python/samba/tests/krb5/kdc_base_test.py
+@@ -1395,7 +1395,7 @@ class KDCBaseTest(RawKerberosTest):
+             krbtgt_creds = self.get_krbtgt_creds()
+         krbtgt_key = self.TicketDecryptionKey_from_creds(krbtgt_creds)
+         self.verify_ticket(service_ticket_creds, krbtgt_key,
+-                           expect_pac=expect_pac,
++                           service_ticket=True, expect_pac=expect_pac,
+                            expect_ticket_checksum=self.tkt_sig_support)
+ 
+         self.tkt_cache[cache_key] = service_ticket_creds
+diff --git python/samba/tests/krb5/raw_testcase.py python/samba/tests/krb5/raw_testcase.py
+index 14e655313fc..a2241707d44 100644
+--- python/samba/tests/krb5/raw_testcase.py
++++ python/samba/tests/krb5/raw_testcase.py
+@@ -2587,7 +2587,11 @@ class RawKerberosTest(TestCaseInTempDir):
+             self.assertIsNotNone(ticket_decryption_key)
+ 
+         if ticket_decryption_key is not None:
+-            self.verify_ticket(ticket_creds, krbtgt_keys, expect_pac=expect_pac,
++            service_ticket = (not self.is_tgs(expected_sname)
++                              and rep_msg_type == KRB_TGS_REP)
++            self.verify_ticket(ticket_creds, krbtgt_keys,
++                               service_ticket=service_ticket,
++                               expect_pac=expect_pac,
+                                expect_ticket_checksum=expect_ticket_checksum
+                                or self.tkt_sig_support)
+ 
+@@ -2624,14 +2628,14 @@ class RawKerberosTest(TestCaseInTempDir):
+                 expected_types.append(krb5pac.PAC_TYPE_DEVICE_INFO)
+                 expected_types.append(krb5pac.PAC_TYPE_DEVICE_CLAIMS_INFO)
+ 
+-        if not self.is_tgs(expected_sname):
++        if not self.is_tgs(expected_sname) and rep_msg_type == KRB_TGS_REP:
+             expected_types.append(krb5pac.PAC_TYPE_TICKET_CHECKSUM)
+ 
+         require_strict = {krb5pac.PAC_TYPE_CLIENT_CLAIMS_INFO}
+         if not self.tkt_sig_support:
+             require_strict.add(krb5pac.PAC_TYPE_TICKET_CHECKSUM)
+ 
+-        expect_extra_pac_buffers = rep_msg_type == KRB_AS_REP
++        expect_extra_pac_buffers = self.is_tgs(expected_sname)
+ 
+         expect_pac_attrs = kdc_exchange_dict['expect_pac_attrs']
+ 
+@@ -3233,11 +3237,9 @@ class RawKerberosTest(TestCaseInTempDir):
+                                         ticket_blob)
+         self.assertEqual(expected_checksum, checksum)
+ 
+-    def verify_ticket(self, ticket, krbtgt_keys, expect_pac=True,
++    def verify_ticket(self, ticket, krbtgt_keys, service_ticket,
++                      expect_pac=True,
+                       expect_ticket_checksum=True):
+-        # Check if the ticket is a TGT.
+-        is_tgt = self.is_tgt(ticket)
+-
+         # Decrypt the ticket.
+ 
+         key = ticket.decryption_key
+@@ -3336,7 +3338,7 @@ class RawKerberosTest(TestCaseInTempDir):
+                                         kdc_ctype,
+                                         kdc_checksum)
+ 
+-        if is_tgt:
++        if not service_ticket:
+             self.assertNotIn(krb5pac.PAC_TYPE_TICKET_CHECKSUM, checksums)
+         else:
+             ticket_checksum, ticket_ctype = checksums.get(
+diff --git python/samba/tests/krb5/rodc_tests.py python/samba/tests/krb5/rodc_tests.py
+index 0e252d90262..83ee35d650a 100755
+--- python/samba/tests/krb5/rodc_tests.py
++++ python/samba/tests/krb5/rodc_tests.py
+@@ -58,14 +58,14 @@ class RodcKerberosTests(KDCBaseTest):
+         tgt = self.get_tgt(user_creds, to_rodc=True)
+ 
+         # Ensure the PAC contains the expected checksums.
+-        self.verify_ticket(tgt, rodc_key)
++        self.verify_ticket(tgt, rodc_key, service_ticket=False)
+ 
+         # Get a service ticket from the RODC.
+         service_ticket = self.get_service_ticket(tgt, target_creds,
+                                                  to_rodc=True)
+ 
+         # Ensure the PAC contains the expected checksums.
+-        self.verify_ticket(service_ticket, rodc_key)
++        self.verify_ticket(service_ticket, rodc_key, service_ticket=True)
+ 
+ 
+ if __name__ == "__main__":
+-- 
+2.25.1
+
+
+From c0977bee5b8c2f72cb5467e95a6ab034f696eee7 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 8 Feb 2022 12:15:36 +1300
+Subject: [PATCH 53/99] tests/krb5: Add helper function to modify ticket flags
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Stefan Metzmacher <metze@samba.org>
+(cherry picked from commit ded5115f73dff5b8b2f3212988e03f9dbe0c2aa3)
+---
+ python/samba/tests/krb5/kdc_base_test.py | 14 ++++++++++++++
+ python/samba/tests/krb5/kdc_tgs_tests.py | 18 ++----------------
+ python/samba/tests/krb5/s4u_tests.py     | 17 +++--------------
+ 3 files changed, 19 insertions(+), 30 deletions(-)
+
+diff --git python/samba/tests/krb5/kdc_base_test.py python/samba/tests/krb5/kdc_base_test.py
+index 9506048ee2a..58b87eab25b 100644
+--- python/samba/tests/krb5/kdc_base_test.py
++++ python/samba/tests/krb5/kdc_base_test.py
+@@ -1602,6 +1602,20 @@ class KDCBaseTest(RawKerberosTest):
+             enc_part, asn1Spec=krb5_asn1.EncTicketPart())
+         return enc_ticket_part
+ 
++    def modify_ticket_flag(self, enc_part, flag, value):
++        self.assertIsInstance(value, bool)
++
++        flag = krb5_asn1.TicketFlags(flag)
++        pos = len(tuple(flag)) - 1
++
++        flags = enc_part['flags']
++        self.assertLessEqual(pos, len(flags))
++
++        new_flags = flags[:pos] + str(int(value)) + flags[pos + 1:]
++        enc_part['flags'] = new_flags
++
++        return enc_part
++
+     def get_objectSid(self, samdb, dn):
+         ''' Get the objectSID for a DN
+             Note: performs an Ldb query.
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index 2923d53772a..8cd27dec2aa 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -2177,14 +2177,7 @@ class KdcTgsTests(KDCBaseTest):
+ 
+     def _modify_renewable(self, enc_part):
+         # Set the renewable flag.
+-        renewable_flag = krb5_asn1.TicketFlags('renewable')
+-        pos = len(tuple(renewable_flag)) - 1
+-
+-        flags = enc_part['flags']
+-        self.assertLessEqual(pos, len(flags))
+-
+-        new_flags = flags[:pos] + '1' + flags[pos + 1:]
+-        enc_part['flags'] = new_flags
++        enc_part = self.modify_ticket_flag(enc_part, 'renewable', value=True)
+ 
+         # Set the renew-till time to be in the future.
+         renew_till = self.get_KerberosTime(offset=100 * 60 * 60)
+@@ -2194,14 +2187,7 @@ class KdcTgsTests(KDCBaseTest):
+ 
+     def _modify_invalid(self, enc_part):
+         # Set the invalid flag.
+-        invalid_flag = krb5_asn1.TicketFlags('invalid')
+-        pos = len(tuple(invalid_flag)) - 1
+-
+-        flags = enc_part['flags']
+-        self.assertLessEqual(pos, len(flags))
+-
+-        new_flags = flags[:pos] + '1' + flags[pos + 1:]
+-        enc_part['flags'] = new_flags
++        enc_part = self.modify_ticket_flag(enc_part, 'invalid', value=True)
+ 
+         # Set the ticket start time to be in the past.
+         past_time = self.get_KerberosTime(offset=-100 * 60 * 60)
+diff --git python/samba/tests/krb5/s4u_tests.py python/samba/tests/krb5/s4u_tests.py
+index 6ec9af11423..49dd89cd764 100755
+--- python/samba/tests/krb5/s4u_tests.py
++++ python/samba/tests/krb5/s4u_tests.py
+@@ -1336,20 +1336,9 @@ class S4UKerberosTests(KDCBaseTest):
+                                     modify_pac_fn=modify_pac_fn)
+ 
+     def set_ticket_forwardable(self, ticket, flag, update_pac_checksums=True):
+-        flag = '1' if flag else '0'
+-
+-        def modify_fn(enc_part):
+-            # Reset the forwardable flag
+-            forwardable_pos = (len(tuple(krb5_asn1.TicketFlags('forwardable')))
+-                               - 1)
+-
+-            flags = enc_part['flags']
+-            self.assertLessEqual(forwardable_pos, len(flags))
+-            enc_part['flags'] = (flags[:forwardable_pos] +
+-                                 flag +
+-                                 flags[forwardable_pos+1:])
+-
+-            return enc_part
++        modify_fn = functools.partial(self.modify_ticket_flag,
++                                      flag='forwardable',
++                                      value=flag)
+ 
+         if update_pac_checksums:
+             checksum_keys = self.get_krbtgt_checksum_key()
+-- 
+2.25.1
+
+
+From c0395578c50fbc4f1946e2f5a065d94f67212eb0 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 15 Jun 2022 19:37:39 +1200
+Subject: [PATCH 55/99] CVE-2022-2031 s4:kdc: Add MIT support for
+ ATTRIBUTES_INFO and REQUESTER_SID PAC buffers
+
+So that we do not confuse TGTs and kpasswd tickets, it is critical to
+check that the REQUESTER_SID buffer exists in TGTs, and to ensure that
+it is not propagated to service tickets.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+
+[jsutton@samba.org Brought in changes to add ATTRIBUTES_INFO and
+ REQUESTER_SID buffers to new PACs, and updated knownfails]
+
+[jsutton@samba.org Adjusted MIT knownfails]
+---
+ selftest/knownfail_mit_kdc               | 17 -----
+ source4/kdc/mit-kdb/kdb_samba_policies.c |  5 +-
+ source4/kdc/mit_samba.c                  | 93 +++++++++++++++++++++++-
+ source4/kdc/mit_samba.h                  |  1 +
+ 4 files changed, 94 insertions(+), 22 deletions(-)
+
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 4d685af7140..108c6055d0c 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -445,7 +445,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_no_pac
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_pac_request_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_pac_request_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_req
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_allowed_denied
+@@ -482,7 +481,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rename
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_invalid
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_no_requester_sid
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_allowed_denied
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_denied
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_no_krbtgt_link
+@@ -518,7 +516,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_wrong_srealm
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_authdata_no_pac
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_no_pac
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_pac_request_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_pac_request_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_req
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_allowed_denied
+@@ -536,21 +533,17 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ #
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_false
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_missing_renew_false
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_missing_renew_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_missing_renew_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_missing_rodc_renew_false
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_missing_rodc_renew_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_missing_rodc_renew_true
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_renew_false
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_renew_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_renew_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_false
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_rodc_renew_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_pac_attrs_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_false
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_none
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_pac_attrs_true
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_pac_attrs
+ #
+@@ -571,21 +564,11 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ #
+ # PAC requester SID tests
+ #
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_as_requester_sid
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_logon_info_sid_mismatch_nonexisting
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_requester_sid_mismatch_existing
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_requester_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_req_from_rodc_no_requester_sid
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_validate
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_validate
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate
+-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_validate
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_sid_mismatch_existing
+diff --git source4/kdc/mit-kdb/kdb_samba_policies.c source4/kdc/mit-kdb/kdb_samba_policies.c
+index 7bc9a7b3347..3b25fff410b 100644
+--- source4/kdc/mit-kdb/kdb_samba_policies.c
++++ source4/kdc/mit-kdb/kdb_samba_policies.c
+@@ -159,6 +159,7 @@ done:
+ 
+ static krb5_error_code ks_get_pac(krb5_context context,
+ 				  krb5_db_entry *client,
++				  krb5_db_entry *server,
+ 				  krb5_keyblock *client_key,
+ 				  krb5_pac *pac)
+ {
+@@ -173,6 +174,7 @@ static krb5_error_code ks_get_pac(krb5_context context,
+ 	code = mit_samba_get_pac(mit_ctx,
+ 				 context,
+ 				 client,
++				 server,
+ 				 client_key,
+ 				 pac);
+ 	if (code != 0) {
+@@ -439,7 +441,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 	 */
+ 	if (with_pac && generate_pac) {
+ 		DBG_DEBUG("Generate PAC for AS-REQ [%s]\n", client_name);
+-		code = ks_get_pac(context, client_entry, client_key, &pac);
++		code = ks_get_pac(context, client_entry, server, client_key, &pac);
+ 		if (code != 0) {
+ 			goto done;
+ 		}
+@@ -490,6 +492,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 
+ 				code = ks_get_pac(context,
+ 						  client_entry,
++						  server,
+ 						  client_key,
+ 						  &pac);
+ 				if (code != 0 && code != ENOENT) {
+diff --git source4/kdc/mit_samba.c source4/kdc/mit_samba.c
+index c2a604045d9..df2ba0a906f 100644
+--- source4/kdc/mit_samba.c
++++ source4/kdc/mit_samba.c
+@@ -407,6 +407,7 @@ int mit_samba_get_nextkey(struct mit_samba_context *ctx,
+ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
+ 		      krb5_context context,
+ 		      krb5_db_entry *client,
++		      krb5_db_entry *server,
+ 		      krb5_keyblock *client_key,
+ 		      krb5_pac *pac)
+ {
+@@ -417,9 +418,12 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
+ 	DATA_BLOB **cred_ndr_ptr = NULL;
+ 	DATA_BLOB cred_blob = data_blob_null;
+ 	DATA_BLOB *pcred_blob = NULL;
++	DATA_BLOB *pac_attrs_blob = NULL;
++	DATA_BLOB *requester_sid_blob = NULL;
+ 	NTSTATUS nt_status;
+ 	krb5_error_code code;
+ 	struct samba_kdc_entry *skdc_entry;
++	bool is_krbtgt;
+ 
+ 	skdc_entry = talloc_get_type_abort(client->e_data,
+ 					   struct samba_kdc_entry);
+@@ -438,12 +442,16 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
+ 	}
+ #endif
+ 
++	is_krbtgt = ks_is_tgs_principal(smb_ctx, server->princ);
++
+ 	nt_status = samba_kdc_get_pac_blobs(tmp_ctx,
+ 					    skdc_entry,
+ 					    &logon_info_blob,
+ 					    cred_ndr_ptr,
+ 					    &upn_dns_info_blob,
+-					    NULL, NULL, NULL,
++					    is_krbtgt ? &pac_attrs_blob : NULL,
++					    NULL,
++					    is_krbtgt ? &requester_sid_blob : NULL,
+ 					    NULL);
+ 	if (!NT_STATUS_IS_OK(nt_status)) {
+ 		talloc_free(tmp_ctx);
+@@ -471,8 +479,8 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
+ 				   logon_info_blob,
+ 				   pcred_blob,
+ 				   upn_dns_info_blob,
+-				   NULL,
+-				   NULL,
++				   pac_attrs_blob,
++				   requester_sid_blob,
+ 				   NULL,
+ 				   pac);
+ 
+@@ -496,6 +504,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+ 	DATA_BLOB *pac_blob = NULL;
+ 	DATA_BLOB *upn_blob = NULL;
+ 	DATA_BLOB *deleg_blob = NULL;
++	DATA_BLOB *requester_sid_blob = NULL;
+ 	struct samba_kdc_entry *client_skdc_entry = NULL;
+ 	struct samba_kdc_entry *krbtgt_skdc_entry = NULL;
+ 	struct samba_kdc_entry *server_skdc_entry = NULL;
+@@ -511,8 +520,12 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+ 	ssize_t upn_dns_info_idx = -1;
+ 	ssize_t srv_checksum_idx = -1;
+ 	ssize_t kdc_checksum_idx = -1;
++	ssize_t tkt_checksum_idx = -1;
++	ssize_t attrs_info_idx = -1;
++	ssize_t requester_sid_idx = -1;
+ 	krb5_pac new_pac = NULL;
+ 	bool ok;
++	bool is_krbtgt;
+ 
+ 	/* Create a memory context early so code can use talloc_stackframe() */
+ 	tmp_ctx = talloc_named(ctx, 0, "mit_samba_reget_pac context");
+@@ -520,6 +533,8 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+ 		return ENOMEM;
+ 	}
+ 
++	is_krbtgt = ks_is_tgs_principal(ctx, server->princ);
++
+ 	if (client != NULL) {
+ 		client_skdc_entry =
+ 			talloc_get_type_abort(client->e_data,
+@@ -578,7 +593,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+ 						    NULL,
+ 						    &upn_blob,
+ 						    NULL, NULL,
+-						    NULL,
++						    &requester_sid_blob,
+ 						    NULL);
+ 		if (!NT_STATUS_IS_OK(nt_status)) {
+ 			code = EINVAL;
+@@ -737,6 +752,45 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+ 			}
+ 			kdc_checksum_idx = i;
+ 			break;
++		case PAC_TYPE_TICKET_CHECKSUM:
++			if (tkt_checksum_idx != -1) {
++				DBG_WARNING("ticket checksum type[%u] twice "
++					    "[%zd] and [%zu]: \n",
++					    types[i],
++					    tkt_checksum_idx,
++					    i);
++				SAFE_FREE(types);
++				code = EINVAL;
++				goto done;
++			}
++			tkt_checksum_idx = i;
++			break;
++		case PAC_TYPE_ATTRIBUTES_INFO:
++			if (attrs_info_idx != -1) {
++				DBG_WARNING("attributes info type[%u] twice "
++					    "[%zd] and [%zu]: \n",
++					    types[i],
++					    attrs_info_idx,
++					    i);
++				SAFE_FREE(types);
++				code = EINVAL;
++				goto done;
++			}
++			attrs_info_idx = i;
++			break;
++		case PAC_TYPE_REQUESTER_SID:
++			if (requester_sid_idx != -1) {
++				DBG_WARNING("requester sid type[%u] twice"
++					    "[%zd] and [%zu]: \n",
++					    types[i],
++					    requester_sid_idx,
++					    i);
++				SAFE_FREE(types);
++				code = EINVAL;
++				goto done;
++			}
++			requester_sid_idx = i;
++			break;
+ 		default:
+ 			continue;
+ 		}
+@@ -766,6 +820,13 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+ 		code = EINVAL;
+ 		goto done;
+ 	}
++	if (!(flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) &&
++	    requester_sid_idx == -1) {
++		DEBUG(1, ("PAC_TYPE_REQUESTER_SID missing\n"));
++		SAFE_FREE(types);
++		code = KRB5KDC_ERR_TGT_REVOKED;
++		goto done;
++	}
+ 
+ 	/* Build an updated PAC */
+ 	code = krb5_pac_init(context, &new_pac);
+@@ -831,6 +892,10 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+ 			}
+ 			break;
+ 		case PAC_TYPE_SRV_CHECKSUM:
++			if (requester_sid_idx == -1 && requester_sid_blob != NULL) {
++				/* inject REQUESTER_SID */
++				forced_next_type = PAC_TYPE_REQUESTER_SID;
++			}
+ 			/*
+ 			 * This is generated in the main KDC code
+ 			 */
+@@ -840,6 +905,26 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+ 			 * This is generated in the main KDC code
+ 			 */
+ 			continue;
++		case PAC_TYPE_ATTRIBUTES_INFO:
++			if (!is_untrusted && is_krbtgt) {
++				/* just copy... */
++				break;
++			}
++
++			continue;
++		case PAC_TYPE_REQUESTER_SID:
++			if (!is_krbtgt) {
++				continue;
++			}
++
++			/*
++			 * Replace in the RODC case, otherwise
++			 * requester_sid_blob is NULL and we just copy.
++			 */
++			if (requester_sid_blob != NULL) {
++				type_blob = *requester_sid_blob;
++			}
++			break;
+ 		default:
+ 			/* just copy... */
+ 			break;
+diff --git source4/kdc/mit_samba.h source4/kdc/mit_samba.h
+index 636c77ec97c..4431e82a1b2 100644
+--- source4/kdc/mit_samba.h
++++ source4/kdc/mit_samba.h
+@@ -50,6 +50,7 @@ int mit_samba_get_nextkey(struct mit_samba_context *ctx,
+ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
+ 		      krb5_context context,
+ 		      krb5_db_entry *client,
++		      krb5_db_entry *server,
+ 		      krb5_keyblock *client_key,
+ 		      krb5_pac *pac);
+ 
+-- 
+2.25.1
+
+
+From 6843c44a45044808f90687f85183e7111a465d1f Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 16 Jun 2022 10:33:29 +1200
+Subject: [PATCH 56/99] heimdal:kdc: Accommodate NULL data parameter in
+ krb5_pac_get_buffer()
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ source4/heimdal/lib/krb5/pac.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git source4/heimdal/lib/krb5/pac.c source4/heimdal/lib/krb5/pac.c
+index 05bcc523080..100de904662 100644
+--- source4/heimdal/lib/krb5/pac.c
++++ source4/heimdal/lib/krb5/pac.c
+@@ -394,10 +394,12 @@ krb5_pac_get_buffer(krb5_context context, krb5_pac p,
+ 	if (p->pac->buffers[i].type != type)
+ 	    continue;
+ 
+-	ret = krb5_data_copy(data, (unsigned char *)p->data.data + offset, len);
+-	if (ret) {
+-	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
+-	    return ret;
++	if (data) {
++	    ret = krb5_data_copy(data, (unsigned char *)p->data.data + offset, len);
++	    if (ret) {
++		krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
++		return ret;
++	    }
+ 	}
+ 	return 0;
+     }
+-- 
+2.25.1
+
+
+From 1b38a28bcaebdae0128518605a422a194747a60f Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Fri, 27 May 2022 19:17:02 +1200
+Subject: [PATCH 57/99] CVE-2022-2031 s4:kpasswd: Account for missing target
+ principal
+
+This field is supposed to be optional.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/kdc/kpasswd-service-mit.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git source4/kdc/kpasswd-service-mit.c source4/kdc/kpasswd-service-mit.c
+index 2117c1c1696..b53c1a4618a 100644
+--- source4/kdc/kpasswd-service-mit.c
++++ source4/kdc/kpasswd-service-mit.c
+@@ -143,16 +143,18 @@ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
+ 		return KRB5_KPASSWD_HARDERROR;
+ 	}
+ 
+-	target_realm = smb_krb5_principal_get_realm(
+-		mem_ctx, context, target_principal);
+-	code = krb5_unparse_name_flags(context,
+-				       target_principal,
+-				       KRB5_PRINCIPAL_UNPARSE_NO_REALM,
+-				       &target_name);
+-	if (code != 0) {
+-		DBG_WARNING("Failed to parse principal\n");
+-		*error_string = "String conversion failed";
+-		return KRB5_KPASSWD_HARDERROR;
++	if (target_principal != NULL) {
++		target_realm = smb_krb5_principal_get_realm(
++			mem_ctx, context, target_principal);
++		code = krb5_unparse_name_flags(context,
++					       target_principal,
++					       KRB5_PRINCIPAL_UNPARSE_NO_REALM,
++					       &target_name);
++		if (code != 0) {
++			DBG_WARNING("Failed to parse principal\n");
++			*error_string = "String conversion failed";
++			return KRB5_KPASSWD_HARDERROR;
++		}
+ 	}
+ 
+ 	if ((target_name != NULL && target_realm == NULL) ||
+-- 
+2.25.1
+
+
+From f6c5a60336de8fd67a2ef371dd2ee4cf75c53904 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Mon, 30 May 2022 19:17:41 +1200
+Subject: [PATCH 58/99] CVE-2022-2031 s4:kpasswd: Add MIT fallback for decoding
+ setpw structure
+
+The target principal and realm fields of the setpw structure are
+supposed to be optional, but in MIT Kerberos they are mandatory. For
+better compatibility and ease of testing, fall back to parsing the
+simpler (containing only the new password) structure if the MIT function
+fails to decode it.
+
+Although the target principal and realm fields should be optional, one
+is not supposed to specified without the other, so we don't have to deal
+with the case where only one is specified.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/kdc/kpasswd-service-mit.c | 94 ++++++++++++++++++++++++++-----
+ 1 file changed, 79 insertions(+), 15 deletions(-)
+
+diff --git source4/kdc/kpasswd-service-mit.c source4/kdc/kpasswd-service-mit.c
+index b53c1a4618a..9c4d2801669 100644
+--- source4/kdc/kpasswd-service-mit.c
++++ source4/kdc/kpasswd-service-mit.c
+@@ -28,6 +28,7 @@
+ #include "kdc/kpasswd_glue.h"
+ #include "kdc/kpasswd-service.h"
+ #include "kdc/kpasswd-helper.h"
++#include "../lib/util/asn1.h"
+ 
+ #define RFC3244_VERSION 0xff80
+ 
+@@ -35,6 +36,52 @@ krb5_error_code decode_krb5_setpw_req(const krb5_data *code,
+ 				      krb5_data **password_out,
+ 				      krb5_principal *target_out);
+ 
++/*
++ * A fallback for when MIT refuses to parse a setpw structure without the
++ * (optional) target principal and realm
++ */
++static bool decode_krb5_setpw_req_simple(TALLOC_CTX *mem_ctx,
++					 const DATA_BLOB *decoded_data,
++					 DATA_BLOB *clear_data)
++{
++	struct asn1_data *asn1 = NULL;
++	bool ret;
++
++	asn1 = asn1_init(mem_ctx, 3);
++	if (asn1 == NULL) {
++		return false;
++	}
++
++	ret = asn1_load(asn1, *decoded_data);
++	if (!ret) {
++		goto out;
++	}
++
++	ret = asn1_start_tag(asn1, ASN1_SEQUENCE(0));
++	if (!ret) {
++		goto out;
++	}
++	ret = asn1_start_tag(asn1, ASN1_CONTEXT(0));
++	if (!ret) {
++		goto out;
++	}
++	ret = asn1_read_OctetString(asn1, mem_ctx, clear_data);
++	if (!ret) {
++		goto out;
++	}
++
++	ret = asn1_end_tag(asn1);
++	if (!ret) {
++		goto out;
++	}
++	ret = asn1_end_tag(asn1);
++
++out:
++	asn1_free(asn1);
++
++	return ret;
++}
++
+ static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
+ 					       TALLOC_CTX *mem_ctx,
+ 					       struct auth_session_info *session_info,
+@@ -93,9 +140,10 @@ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
+ 					    const char **error_string)
+ {
+ 	krb5_context context = kdc->smb_krb5_context->krb5_context;
++	DATA_BLOB clear_data;
+ 	krb5_data k_dec_data;
+-	krb5_data *k_clear_data;
+-	krb5_principal target_principal;
++	krb5_data *k_clear_data = NULL;
++	krb5_principal target_principal = NULL;
+ 	krb5_error_code code;
+ 	DATA_BLOB password;
+ 	char *target_realm = NULL;
+@@ -114,29 +162,45 @@ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
+ 	code = decode_krb5_setpw_req(&k_dec_data,
+ 				     &k_clear_data,
+ 				     &target_principal);
+-	if (code != 0) {
+-		DBG_WARNING("decode_krb5_setpw_req failed: %s\n",
+-			    error_message(code));
+-		ok = kpasswd_make_error_reply(mem_ctx,
+-					      KRB5_KPASSWD_MALFORMED,
+-					      "Failed to decode packet",
+-					      kpasswd_reply);
++	if (code == 0) {
++		clear_data.data = (uint8_t *)k_clear_data->data;
++		clear_data.length = k_clear_data->length;
++	} else {
++		target_principal = NULL;
++
++		/*
++		 * The MIT decode failed, so fall back to trying the simple
++		 * case, without target_principal.
++		 */
++		ok = decode_krb5_setpw_req_simple(mem_ctx,
++						  decoded_data,
++						  &clear_data);
+ 		if (!ok) {
+-			*error_string = "Failed to create reply";
+-			return KRB5_KPASSWD_HARDERROR;
++			DBG_WARNING("decode_krb5_setpw_req failed: %s\n",
++				    error_message(code));
++			ok = kpasswd_make_error_reply(mem_ctx,
++						      KRB5_KPASSWD_MALFORMED,
++						      "Failed to decode packet",
++						      kpasswd_reply);
++			if (!ok) {
++				*error_string = "Failed to create reply";
++				return KRB5_KPASSWD_HARDERROR;
++			}
++			return 0;
+ 		}
+-		return 0;
+ 	}
+ 
+ 	ok = convert_string_talloc_handle(mem_ctx,
+ 					  lpcfg_iconv_handle(kdc->task->lp_ctx),
+ 					  CH_UTF8,
+ 					  CH_UTF16,
+-					  (const char *)k_clear_data->data,
+-					  k_clear_data->length,
++					  clear_data.data,
++					  clear_data.length,
+ 					  (void **)&password.data,
+ 					  &password.length);
+-	krb5_free_data(context, k_clear_data);
++	if (k_clear_data != NULL) {
++		krb5_free_data(context, k_clear_data);
++	}
+ 	if (!ok) {
+ 		DBG_WARNING("String conversion failed\n");
+ 		*error_string = "String conversion failed";
+-- 
+2.25.1
+
+
+From 6305a55870287191ce4268f6af7fe278ca7f2a30 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 26 May 2022 16:34:01 +1200
+Subject: [PATCH 59/99] CVE-2022-32744 tests/krb5: Correctly handle specifying
+ account kvno
+
+The environment variable is a string, but we expect an integer.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ python/samba/tests/krb5/raw_testcase.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git python/samba/tests/krb5/raw_testcase.py python/samba/tests/krb5/raw_testcase.py
+index a2241707d44..4120edf93b9 100644
+--- python/samba/tests/krb5/raw_testcase.py
++++ python/samba/tests/krb5/raw_testcase.py
+@@ -724,7 +724,7 @@ class RawKerberosTest(TestCaseInTempDir):
+                                 fallback_default=False,
+                                 allow_missing=kvno_allow_missing)
+         if kvno is not None:
+-            c.set_kvno(kvno)
++            c.set_kvno(int(kvno))
+         aes256_key = self.env_get_var('AES256_KEY_HEX', prefix,
+                                       fallback_default=False,
+                                       allow_missing=aes256_allow_missing)
+-- 
+2.25.1
+
+
+From 8917979641abb03ef858ba72b652178475b6e918 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 26 May 2022 20:52:04 +1200
+Subject: [PATCH 60/99] CVE-2022-2031 tests/krb5: Split out _make_tgs_request()
+
+This allows us to make use of it in other tests.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Fixed conflicts due to having older version of
+ _make_tgs_request()]
+---
+ python/samba/tests/krb5/kdc_base_test.py | 77 ++++++++++++++++++++++++
+ python/samba/tests/krb5/kdc_tgs_tests.py | 76 -----------------------
+ 2 files changed, 77 insertions(+), 76 deletions(-)
+
+diff --git python/samba/tests/krb5/kdc_base_test.py python/samba/tests/krb5/kdc_base_test.py
+index 58b87eab25b..2117663b26b 100644
+--- python/samba/tests/krb5/kdc_base_test.py
++++ python/samba/tests/krb5/kdc_base_test.py
+@@ -67,6 +67,7 @@ from samba.tests.krb5.rfc4120_constants import (
+     AES256_CTS_HMAC_SHA1_96,
+     ARCFOUR_HMAC_MD5,
+     KDC_ERR_PREAUTH_REQUIRED,
++    KDC_ERR_TGT_REVOKED,
+     KRB_AS_REP,
+     KRB_TGS_REP,
+     KRB_ERROR,
+@@ -1538,6 +1539,82 @@ class KDCBaseTest(RawKerberosTest):
+ 
+         return ticket_creds
+ 
++    def _make_tgs_request(self, client_creds, service_creds, tgt,
++                          pac_request=None, expect_pac=True,
++                          expect_error=False,
++                          expected_account_name=None,
++                          expected_upn_name=None,
++                          expected_sid=None):
++        client_account = client_creds.get_username()
++        cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
++                                          names=[client_account])
++
++        service_account = service_creds.get_username()
++        sname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
++                                          names=[service_account])
++
++        realm = service_creds.get_realm()
++
++        expected_crealm = realm
++        expected_cname = cname
++        expected_srealm = realm
++        expected_sname = sname
++
++        expected_supported_etypes = service_creds.tgs_supported_enctypes
++
++        etypes = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5)
++
++        kdc_options = str(krb5_asn1.KDCOptions('canonicalize'))
++
++        target_decryption_key = self.TicketDecryptionKey_from_creds(
++            service_creds)
++
++        authenticator_subkey = self.RandomKey(kcrypto.Enctype.AES256)
++
++        if expect_error:
++            expected_error_mode = KDC_ERR_TGT_REVOKED
++            check_error_fn = self.generic_check_kdc_error
++            check_rep_fn = None
++        else:
++            expected_error_mode = 0
++            check_error_fn = None
++            check_rep_fn = self.generic_check_kdc_rep
++
++        kdc_exchange_dict = self.tgs_exchange_dict(
++            expected_crealm=expected_crealm,
++            expected_cname=expected_cname,
++            expected_srealm=expected_srealm,
++            expected_sname=expected_sname,
++            expected_account_name=expected_account_name,
++            expected_upn_name=expected_upn_name,
++            expected_sid=expected_sid,
++            expected_supported_etypes=expected_supported_etypes,
++            ticket_decryption_key=target_decryption_key,
++            check_error_fn=check_error_fn,
++            check_rep_fn=check_rep_fn,
++            check_kdc_private_fn=self.generic_check_kdc_private,
++            expected_error_mode=expected_error_mode,
++            tgt=tgt,
++            authenticator_subkey=authenticator_subkey,
++            kdc_options=kdc_options,
++            pac_request=pac_request,
++            expect_pac=expect_pac,
++            expect_edata=False)
++
++        rep = self._generic_kdc_exchange(kdc_exchange_dict,
++                                         cname=cname,
++                                         realm=realm,
++                                         sname=sname,
++                                         etypes=etypes)
++        if expect_error:
++            self.check_error_rep(rep, expected_error_mode)
++
++            return None
++        else:
++            self.check_reply(rep, KRB_TGS_REP)
++
++            return kdc_exchange_dict['rep_ticket_creds']
++
+     # Named tuple to contain values of interest when the PAC is decoded.
+     PacData = namedtuple(
+         "PacData",
+diff --git python/samba/tests/krb5/kdc_tgs_tests.py python/samba/tests/krb5/kdc_tgs_tests.py
+index 8cd27dec2aa..e52f46152fa 100755
+--- python/samba/tests/krb5/kdc_tgs_tests.py
++++ python/samba/tests/krb5/kdc_tgs_tests.py
+@@ -230,82 +230,6 @@ class KdcTgsTests(KDCBaseTest):
+             pac_data.account_sid,
+             "rep = {%s},%s" % (rep, pac_data))
+ 
+-    def _make_tgs_request(self, client_creds, service_creds, tgt,
+-                          pac_request=None, expect_pac=True,
+-                          expect_error=False,
+-                          expected_account_name=None,
+-                          expected_upn_name=None,
+-                          expected_sid=None):
+-        client_account = client_creds.get_username()
+-        cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
+-                                          names=[client_account])
+-
+-        service_account = service_creds.get_username()
+-        sname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
+-                                          names=[service_account])
+-
+-        realm = service_creds.get_realm()
+-
+-        expected_crealm = realm
+-        expected_cname = cname
+-        expected_srealm = realm
+-        expected_sname = sname
+-
+-        expected_supported_etypes = service_creds.tgs_supported_enctypes
+-
+-        etypes = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5)
+-
+-        kdc_options = str(krb5_asn1.KDCOptions('canonicalize'))
+-
+-        target_decryption_key = self.TicketDecryptionKey_from_creds(
+-            service_creds)
+-
+-        authenticator_subkey = self.RandomKey(kcrypto.Enctype.AES256)
+-
+-        if expect_error:
+-            expected_error_mode = KDC_ERR_TGT_REVOKED
+-            check_error_fn = self.generic_check_kdc_error
+-            check_rep_fn = None
+-        else:
+-            expected_error_mode = 0
+-            check_error_fn = None
+-            check_rep_fn = self.generic_check_kdc_rep
+-
+-        kdc_exchange_dict = self.tgs_exchange_dict(
+-            expected_crealm=expected_crealm,
+-            expected_cname=expected_cname,
+-            expected_srealm=expected_srealm,
+-            expected_sname=expected_sname,
+-            expected_account_name=expected_account_name,
+-            expected_upn_name=expected_upn_name,
+-            expected_sid=expected_sid,
+-            expected_supported_etypes=expected_supported_etypes,
+-            ticket_decryption_key=target_decryption_key,
+-            check_error_fn=check_error_fn,
+-            check_rep_fn=check_rep_fn,
+-            check_kdc_private_fn=self.generic_check_kdc_private,
+-            expected_error_mode=expected_error_mode,
+-            tgt=tgt,
+-            authenticator_subkey=authenticator_subkey,
+-            kdc_options=kdc_options,
+-            pac_request=pac_request,
+-            expect_pac=expect_pac,
+-            expect_edata=False)
+-
+-        rep = self._generic_kdc_exchange(kdc_exchange_dict,
+-                                         cname=cname,
+-                                         realm=realm,
+-                                         sname=sname,
+-                                         etypes=etypes)
+-        if expect_error:
+-            self.check_error_rep(rep, expected_error_mode)
+-
+-            return None
+-        else:
+-            self.check_reply(rep, KRB_TGS_REP)
+-
+-            return kdc_exchange_dict['rep_ticket_creds']
+-
+     def test_request(self):
+         client_creds = self.get_client_creds()
+         service_creds = self.get_service_creds()
+-- 
+2.25.1
+
+
+From 245d9a42329a1bfeb3db8431ef105e7758080e14 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 24 May 2022 19:06:53 +1200
+Subject: [PATCH 61/99] CVE-2022-32744 tests/krb5: Correctly calculate salt for
+ pre-existing accounts
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ python/samba/tests/krb5/kdc_base_test.py | 1 +
+ python/samba/tests/krb5/raw_testcase.py  | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git python/samba/tests/krb5/kdc_base_test.py python/samba/tests/krb5/kdc_base_test.py
+index 2117663b26b..685a6f71f88 100644
+--- python/samba/tests/krb5/kdc_base_test.py
++++ python/samba/tests/krb5/kdc_base_test.py
+@@ -1048,6 +1048,7 @@ class KDCBaseTest(RawKerberosTest):
+ 
+             kvno = int(res[0]['msDS-KeyVersionNumber'][0])
+             creds.set_kvno(kvno)
++            creds.set_workstation(username[:-1])
+             creds.set_dn(dn)
+ 
+             keys = self.get_keys(samdb, dn)
+diff --git python/samba/tests/krb5/raw_testcase.py python/samba/tests/krb5/raw_testcase.py
+index 4120edf93b9..a9a98c36cbf 100644
+--- python/samba/tests/krb5/raw_testcase.py
++++ python/samba/tests/krb5/raw_testcase.py
+@@ -834,6 +834,7 @@ class RawKerberosTest(TestCaseInTempDir):
+                                  allow_missing_password=allow_missing_password,
+                                  allow_missing_keys=allow_missing_keys)
+         c.set_gensec_features(c.get_gensec_features() | FEATURE_SEAL)
++        c.set_workstation('')
+         return c
+ 
+     def get_rodc_krbtgt_creds(self,
+-- 
+2.25.1
+
+
+From f7fad997cc06a14c9ffd101b26e16598f334148b Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 24 May 2022 19:13:54 +1200
+Subject: [PATCH 62/99] CVE-2022-2031 tests/krb5: Add new definitions for
+ kpasswd
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ python/samba/tests/krb5/rfc4120.asn1         |  6 ++++++
+ python/samba/tests/krb5/rfc4120_constants.py | 13 +++++++++++++
+ python/samba/tests/krb5/rfc4120_pyasn1.py    | 13 ++++++++++++-
+ 3 files changed, 31 insertions(+), 1 deletion(-)
+
+diff --git python/samba/tests/krb5/rfc4120.asn1 python/samba/tests/krb5/rfc4120.asn1
+index e0831e1f86f..cac884be985 100644
+--- python/samba/tests/krb5/rfc4120.asn1
++++ python/samba/tests/krb5/rfc4120.asn1
+@@ -567,6 +567,12 @@ PA-FX-FAST-REPLY ::= CHOICE {
+         ...
+ }
+ 
++ChangePasswdDataMS ::= SEQUENCE {
++        newpasswd       [0] OCTET STRING,
++        targname        [1] PrincipalName OPTIONAL,
++        targrealm       [2] Realm OPTIONAL
++}
++
+ -- MS-KILE End
+ --
+ --
+diff --git python/samba/tests/krb5/rfc4120_constants.py python/samba/tests/krb5/rfc4120_constants.py
+index a9fdc5735dd..7f0f44500c7 100644
+--- python/samba/tests/krb5/rfc4120_constants.py
++++ python/samba/tests/krb5/rfc4120_constants.py
+@@ -27,11 +27,13 @@ ARCFOUR_HMAC_MD5 = int(
+ 
+ # Message types
+ KRB_ERROR = int(krb5_asn1.MessageTypeValues('krb-error'))
++KRB_AP_REP = int(krb5_asn1.MessageTypeValues('krb-ap-rep'))
+ KRB_AP_REQ = int(krb5_asn1.MessageTypeValues('krb-ap-req'))
+ KRB_AS_REP = int(krb5_asn1.MessageTypeValues('krb-as-rep'))
+ KRB_AS_REQ = int(krb5_asn1.MessageTypeValues('krb-as-req'))
+ KRB_TGS_REP = int(krb5_asn1.MessageTypeValues('krb-tgs-rep'))
+ KRB_TGS_REQ = int(krb5_asn1.MessageTypeValues('krb-tgs-req'))
++KRB_PRIV = int(krb5_asn1.MessageTypeValues('krb-priv'))
+ 
+ # PAData types
+ PADATA_ENC_TIMESTAMP = int(
+@@ -76,6 +78,7 @@ KDC_ERR_TGT_REVOKED = 20
+ KDC_ERR_PREAUTH_FAILED = 24
+ KDC_ERR_PREAUTH_REQUIRED = 25
+ KDC_ERR_BAD_INTEGRITY = 31
++KDC_ERR_TKT_EXPIRED = 32
+ KRB_ERR_TKT_NYV = 33
+ KDC_ERR_NOT_US = 35
+ KDC_ERR_BADMATCH = 36
+@@ -87,6 +90,16 @@ KDC_ERR_WRONG_REALM = 68
+ KDC_ERR_CLIENT_NAME_MISMATCH = 75
+ KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS = 93
+ 
++# Kpasswd error codes
++KPASSWD_SUCCESS = 0
++KPASSWD_MALFORMED = 1
++KPASSWD_HARDERROR = 2
++KPASSWD_AUTHERROR = 3
++KPASSWD_SOFTERROR = 4
++KPASSWD_ACCESSDENIED = 5
++KPASSWD_BAD_VERSION = 6
++KPASSWD_INITIAL_FLAG_NEEDED = 7
++
+ # Extended error types
+ KERB_AP_ERR_TYPE_SKEW_RECOVERY = int(
+     krb5_asn1.KerbErrorDataTypeValues('kERB-AP-ERR-TYPE-SKEW-RECOVERY'))
+diff --git python/samba/tests/krb5/rfc4120_pyasn1.py python/samba/tests/krb5/rfc4120_pyasn1.py
+index 348dd8c63fb..3c02b0efbc1 100644
+--- python/samba/tests/krb5/rfc4120_pyasn1.py
++++ python/samba/tests/krb5/rfc4120_pyasn1.py
+@@ -1,5 +1,5 @@
+ # Auto-generated by asn1ate v.0.6.1.dev0 from rfc4120.asn1
+-# (last modified on 2021-06-25 12:10:34.484667)
++# (last modified on 2022-05-13 20:03:06.039817)
+ 
+ # KerberosV5Spec2
+ from pyasn1.type import univ, char, namedtype, namedval, tag, constraint, useful
+@@ -364,6 +364,17 @@ Authenticator.componentType = namedtype.NamedTypes(
+ )
+ 
+ 
++class ChangePasswdDataMS(univ.Sequence):
++    pass
++
++
++ChangePasswdDataMS.componentType = namedtype.NamedTypes(
++    namedtype.NamedType('newpasswd', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
++    namedtype.OptionalNamedType('targname', PrincipalName().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1))),
++    namedtype.OptionalNamedType('targrealm', Realm().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2)))
++)
++
++
+ class ChecksumTypeValues(univ.Integer):
+     pass
+ 
+-- 
+2.25.1
+
+
+From 695c662bdc286d7a4699025f00656f8339ceecd8 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 24 May 2022 19:17:45 +1200
+Subject: [PATCH 63/99] CVE-2022-2031 tests/krb5: Add methods to create ASN1
+ kpasswd structures
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ python/samba/tests/krb5/raw_testcase.py | 95 +++++++++++++++++++++++++
+ 1 file changed, 95 insertions(+)
+
+diff --git python/samba/tests/krb5/raw_testcase.py python/samba/tests/krb5/raw_testcase.py
+index a9a98c36cbf..df41dff688d 100644
+--- python/samba/tests/krb5/raw_testcase.py
++++ python/samba/tests/krb5/raw_testcase.py
+@@ -54,6 +54,7 @@ from samba.tests.krb5.rfc4120_constants import (
+     KRB_AS_REP,
+     KRB_AS_REQ,
+     KRB_ERROR,
++    KRB_PRIV,
+     KRB_TGS_REP,
+     KRB_TGS_REQ,
+     KU_AP_REQ_AUTH,
+@@ -63,6 +64,7 @@ from samba.tests.krb5.rfc4120_constants import (
+     KU_FAST_FINISHED,
+     KU_FAST_REP,
+     KU_FAST_REQ_CHKSUM,
++    KU_KRB_PRIV,
+     KU_NON_KERB_CKSUM_SALT,
+     KU_TGS_REP_ENC_PART_SESSION,
+     KU_TGS_REP_ENC_PART_SUB_KEY,
+@@ -1780,6 +1782,99 @@ class RawKerberosTest(TestCaseInTempDir):
+             PA_S4U2Self_obj, asn1Spec=krb5_asn1.PA_S4U2Self())
+         return self.PA_DATA_create(PADATA_FOR_USER, pa_s4u2self)
+ 
++    def ChangePasswdDataMS_create(self,
++                                  new_password,
++                                  target_princ=None,
++                                  target_realm=None):
++        ChangePasswdDataMS_obj = {
++            'newpasswd': new_password,
++        }
++        if target_princ is not None:
++            ChangePasswdDataMS_obj['targname'] = target_princ
++        if target_realm is not None:
++            ChangePasswdDataMS_obj['targrealm'] = target_realm
++
++        change_password_data = self.der_encode(
++            ChangePasswdDataMS_obj, asn1Spec=krb5_asn1.ChangePasswdDataMS())
++
++        return change_password_data
++
++    def KRB_PRIV_create(self,
++                        subkey,
++                        user_data,
++                        s_address,
++                        timestamp=None,
++                        usec=None,
++                        seq_number=None,
++                        r_address=None):
++        EncKrbPrivPart_obj = {
++            'user-data': user_data,
++            's-address': s_address,
++        }
++        if timestamp is not None:
++            EncKrbPrivPart_obj['timestamp'] = timestamp
++        if usec is not None:
++            EncKrbPrivPart_obj['usec'] = usec
++        if seq_number is not None:
++            EncKrbPrivPart_obj['seq-number'] = seq_number
++        if r_address is not None:
++            EncKrbPrivPart_obj['r-address'] = r_address
++
++        enc_krb_priv_part = self.der_encode(
++            EncKrbPrivPart_obj, asn1Spec=krb5_asn1.EncKrbPrivPart())
++
++        enc_data = self.EncryptedData_create(subkey,
++                                             KU_KRB_PRIV,
++                                             enc_krb_priv_part)
++
++        KRB_PRIV_obj = {
++            'pvno': 5,
++            'msg-type': KRB_PRIV,
++            'enc-part': enc_data,
++        }
++
++        krb_priv = self.der_encode(
++            KRB_PRIV_obj, asn1Spec=krb5_asn1.KRB_PRIV())
++
++        return krb_priv
++
++    def kpasswd_create(self,
++                       subkey,
++                       user_data,
++                       version,
++                       seq_number,
++                       ap_req,
++                       local_address,
++                       remote_address):
++        self.assertIsNotNone(self.s, 'call self.connect() first')
++
++        timestamp, usec = self.get_KerberosTimeWithUsec()
++
++        krb_priv = self.KRB_PRIV_create(subkey,
++                                        user_data,
++                                        s_address=local_address,
++                                        timestamp=timestamp,
++                                        usec=usec,
++                                        seq_number=seq_number,
++                                        r_address=remote_address)
++
++        size = 6 + len(ap_req) + len(krb_priv)
++        self.assertLess(size, 0x10000)
++
++        msg = bytearray()
++        msg.append(size >> 8)
++        msg.append(size & 0xff)
++        msg.append(version >> 8)
++        msg.append(version & 0xff)
++        msg.append(len(ap_req) >> 8)
++        msg.append(len(ap_req) & 0xff)
++        # Note: for sets, there could be a little-endian four-byte length here.
++
++        msg.extend(ap_req)
++        msg.extend(krb_priv)
++
++        return msg
++
+     def _generic_kdc_exchange(self,
+                               kdc_exchange_dict,  # required
+                               cname=None,  # optional
+-- 
+2.25.1
+
+
+From ae7dd875cd4362ed4346716db493164c421b889f Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 24 May 2022 19:21:37 +1200
+Subject: [PATCH 64/99] CVE-2022-2031 tests/krb5: Add 'port' parameter to
+ connect()
+
+This allows us to use the kpasswd port, 464.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ python/samba/tests/krb5/raw_testcase.py | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git python/samba/tests/krb5/raw_testcase.py python/samba/tests/krb5/raw_testcase.py
+index df41dff688d..421143781ae 100644
+--- python/samba/tests/krb5/raw_testcase.py
++++ python/samba/tests/krb5/raw_testcase.py
+@@ -638,10 +638,11 @@ class RawKerberosTest(TestCaseInTempDir):
+         if self.do_hexdump:
+             sys.stderr.write("disconnect[%s]\n" % reason)
+ 
+-    def _connect_tcp(self, host):
+-        tcp_port = 88
++    def _connect_tcp(self, host, port=None):
++        if port is None:
++            port = 88
+         try:
+-            self.a = socket.getaddrinfo(host, tcp_port, socket.AF_UNSPEC,
++            self.a = socket.getaddrinfo(host, port, socket.AF_UNSPEC,
+                                         socket.SOCK_STREAM, socket.SOL_TCP,
+                                         0)
+             self.s = socket.socket(self.a[0][0], self.a[0][1], self.a[0][2])
+@@ -654,9 +655,9 @@ class RawKerberosTest(TestCaseInTempDir):
+             self.s.close()
+             raise
+ 
+-    def connect(self, host):
++    def connect(self, host, port=None):
+         self.assertNotConnected()
+-        self._connect_tcp(host)
++        self._connect_tcp(host, port)
+         if self.do_hexdump:
+             sys.stderr.write("connected[%s]\n" % host)
+ 
+-- 
+2.25.1
+
+
+From 13fe7e013eccca2c86258084f4443ddb7abaf089 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 24 May 2022 19:20:28 +1200
+Subject: [PATCH 65/99] CVE-2022-2031 tests/krb5: Add methods to send and
+ receive generic messages
+
+This allows us to send and receive kpasswd messages, while avoiding the
+existing logic for encoding and decoding other Kerberos message types.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ python/samba/tests/krb5/raw_testcase.py | 44 +++++++++++++++----------
+ 1 file changed, 27 insertions(+), 17 deletions(-)
+
+diff --git python/samba/tests/krb5/raw_testcase.py python/samba/tests/krb5/raw_testcase.py
+index 421143781ae..2aed5530455 100644
+--- python/samba/tests/krb5/raw_testcase.py
++++ python/samba/tests/krb5/raw_testcase.py
+@@ -920,24 +920,28 @@ class RawKerberosTest(TestCaseInTempDir):
+         return blob
+ 
+     def send_pdu(self, req, asn1_print=None, hexdump=None):
++        k5_pdu = self.der_encode(
++            req, native_decode=False, asn1_print=asn1_print, hexdump=False)
++        self.send_msg(k5_pdu, hexdump=hexdump)
++
++    def send_msg(self, msg, hexdump=None):
++        header = struct.pack('>I', len(msg))
++        req_pdu = header
++        req_pdu += msg
++        self.hex_dump("send_msg", header, hexdump=hexdump)
++        self.hex_dump("send_msg", msg, hexdump=hexdump)
++
+         try:
+-            k5_pdu = self.der_encode(
+-                req, native_decode=False, asn1_print=asn1_print, hexdump=False)
+-            header = struct.pack('>I', len(k5_pdu))
+-            req_pdu = header
+-            req_pdu += k5_pdu
+-            self.hex_dump("send_pdu", header, hexdump=hexdump)
+-            self.hex_dump("send_pdu", k5_pdu, hexdump=hexdump)
+             while True:
+                 sent = self.s.send(req_pdu, 0)
+                 if sent == len(req_pdu):
+-                    break
++                    return
+                 req_pdu = req_pdu[sent:]
+         except socket.error as e:
+-            self._disconnect("send_pdu: %s" % e)
++            self._disconnect("send_msg: %s" % e)
+             raise
+         except IOError as e:
+-            self._disconnect("send_pdu: %s" % e)
++            self._disconnect("send_msg: %s" % e)
+             raise
+ 
+     def recv_raw(self, num_recv=0xffff, hexdump=None, timeout=None):
+@@ -963,16 +967,14 @@ class RawKerberosTest(TestCaseInTempDir):
+         return rep_pdu
+ 
+     def recv_pdu_raw(self, asn1_print=None, hexdump=None, timeout=None):
+-        rep_pdu = None
+-        rep = None
+         raw_pdu = self.recv_raw(
+             num_recv=4, hexdump=hexdump, timeout=timeout)
+         if raw_pdu is None:
+-            return (None, None)
++            return None
+         header = struct.unpack(">I", raw_pdu[0:4])
+         k5_len = header[0]
+         if k5_len == 0:
+-            return (None, "")
++            return ""
+         missing = k5_len
+         rep_pdu = b''
+         while missing > 0:
+@@ -981,6 +983,14 @@ class RawKerberosTest(TestCaseInTempDir):
+             self.assertGreaterEqual(len(raw_pdu), 1)
+             rep_pdu += raw_pdu
+             missing = k5_len - len(rep_pdu)
++        return rep_pdu
++
++    def recv_reply(self, asn1_print=None, hexdump=None, timeout=None):
++        rep_pdu = self.recv_pdu_raw(asn1_print=asn1_print,
++                                    hexdump=hexdump,
++                                    timeout=timeout)
++        if not rep_pdu:
++            return None, rep_pdu
+         k5_raw = self.der_decode(
+             rep_pdu,
+             asn1Spec=None,
+@@ -1002,9 +1012,9 @@ class RawKerberosTest(TestCaseInTempDir):
+         return (rep, rep_pdu)
+ 
+     def recv_pdu(self, asn1_print=None, hexdump=None, timeout=None):
+-        (rep, rep_pdu) = self.recv_pdu_raw(asn1_print=asn1_print,
+-                                           hexdump=hexdump,
+-                                           timeout=timeout)
++        (rep, rep_pdu) = self.recv_reply(asn1_print=asn1_print,
++                                         hexdump=hexdump,
++                                         timeout=timeout)
+         return rep
+ 
+     def assertIsConnected(self):
+-- 
+2.25.1
+
+
+From ca582250fcaf2ad3c585f7e31a1a4ce568b7ddb7 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 24 May 2022 19:26:56 +1200
+Subject: [PATCH 66/99] tests/krb5: Fix enum typo
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ python/samba/tests/krb5/kdc_base_test.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git python/samba/tests/krb5/kdc_base_test.py python/samba/tests/krb5/kdc_base_test.py
+index 685a6f71f88..14f1d1a243d 100644
+--- python/samba/tests/krb5/kdc_base_test.py
++++ python/samba/tests/krb5/kdc_base_test.py
+@@ -248,9 +248,9 @@ class KDCBaseTest(RawKerberosTest):
+            which is used by tearDownClass to clean up the created accounts.
+         '''
+         if ou is None:
+-            if account_type is account_type.COMPUTER:
++            if account_type is self.AccountType.COMPUTER:
+                 guid = DS_GUID_COMPUTERS_CONTAINER
+-            elif account_type is account_type.SERVER:
++            elif account_type is self.AccountType.SERVER:
+                 guid = DS_GUID_DOMAIN_CONTROLLERS_CONTAINER
+             else:
+                 guid = DS_GUID_USERS_CONTAINER
+-- 
+2.25.1
+
+
+From 5b030b176b853938b1895ec255e838147d8e7fa9 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 24 May 2022 19:30:12 +1200
+Subject: [PATCH 67/99] tests/krb5: Add option for creating accounts with
+ expired passwords
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ python/samba/tests/krb5/kdc_base_test.py | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git python/samba/tests/krb5/kdc_base_test.py python/samba/tests/krb5/kdc_base_test.py
+index 14f1d1a243d..777b3b4aaf1 100644
+--- python/samba/tests/krb5/kdc_base_test.py
++++ python/samba/tests/krb5/kdc_base_test.py
+@@ -242,7 +242,8 @@ class KDCBaseTest(RawKerberosTest):
+ 
+     def create_account(self, samdb, name, account_type=AccountType.USER,
+                        spn=None, upn=None, additional_details=None,
+-                       ou=None, account_control=0, add_dollar=True):
++                       ou=None, account_control=0, add_dollar=True,
++                       expired_password=False):
+         '''Create an account for testing.
+            The dn of the created account is added to self.accounts,
+            which is used by tearDownClass to clean up the created accounts.
+@@ -294,6 +295,8 @@ class KDCBaseTest(RawKerberosTest):
+             details["servicePrincipalName"] = spn
+         if upn is not None:
+             details["userPrincipalName"] = upn
++        if expired_password:
++            details["pwdLastSet"] = "0"
+         if additional_details is not None:
+             details.update(additional_details)
+         samdb.add(details)
+@@ -653,6 +656,7 @@ class KDCBaseTest(RawKerberosTest):
+             'revealed_to_rodc': False,
+             'revealed_to_mock_rodc': False,
+             'no_auth_data_required': False,
++            'expired_password': False,
+             'supported_enctypes': None,
+             'not_delegated': False,
+             'delegation_to_spn': None,
+@@ -695,6 +699,7 @@ class KDCBaseTest(RawKerberosTest):
+                             revealed_to_rodc,
+                             revealed_to_mock_rodc,
+                             no_auth_data_required,
++                            expired_password,
+                             supported_enctypes,
+                             not_delegated,
+                             delegation_to_spn,
+@@ -754,7 +759,8 @@ class KDCBaseTest(RawKerberosTest):
+                                         spn=spn,
+                                         additional_details=details,
+                                         account_control=user_account_control,
+-                                        add_dollar=add_dollar)
++                                        add_dollar=add_dollar,
++                                        expired_password=expired_password)
+ 
+         keys = self.get_keys(samdb, dn)
+         self.creds_set_keys(creds, keys)
+-- 
+2.25.1
+
+
+From 5c41e20fae268e04aa05e821c7f388ea090727af Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 24 May 2022 19:34:59 +1200
+Subject: [PATCH 68/99] CVE-2022-2031 tests/krb5: Allow requesting a TGT to a
+ different sname and realm
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Fixed conflict due to lacking rc4_support parameter]
+
+[jsutton@samba.org Fixed conflicts due to lacking client_name_type and
+ expected_cname parameters]
+---
+ python/samba/tests/krb5/kdc_base_test.py | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git python/samba/tests/krb5/kdc_base_test.py python/samba/tests/krb5/kdc_base_test.py
+index 777b3b4aaf1..c0ca881985a 100644
+--- python/samba/tests/krb5/kdc_base_test.py
++++ python/samba/tests/krb5/kdc_base_test.py
+@@ -1344,10 +1344,12 @@ class KDCBaseTest(RawKerberosTest):
+                            expected_flags=None, unexpected_flags=None,
+                            pac_request=True, expect_pac=True, fresh=False):
+         user_name = tgt.cname['name-string'][0]
++        ticket_sname = tgt.sname
+         if target_name is None:
+             target_name = target_creds.get_username()[:-1]
+         cache_key = (user_name, target_name, service, to_rodc, kdc_options,
+                      pac_request, str(expected_flags), str(unexpected_flags),
++                     str(ticket_sname),
+                      expect_pac)
+ 
+         if not fresh:
+@@ -1414,6 +1416,7 @@ class KDCBaseTest(RawKerberosTest):
+                 expected_flags=None, unexpected_flags=None,
+                 expected_account_name=None, expected_upn_name=None,
+                 expected_sid=None,
++                sname=None, realm=None,
+                 pac_request=True, expect_pac=True,
+                 expect_pac_attrs=None, expect_pac_attrs_pac_request=None,
+                 expect_requester_sid=None,
+@@ -1422,6 +1425,7 @@ class KDCBaseTest(RawKerberosTest):
+         cache_key = (user_name, to_rodc, kdc_options, pac_request,
+                      str(expected_flags), str(unexpected_flags),
+                      expected_account_name, expected_upn_name, expected_sid,
++                     str(sname), str(realm),
+                      expect_pac, expect_pac_attrs,
+                      expect_pac_attrs_pac_request, expect_requester_sid)
+ 
+@@ -1431,15 +1435,21 @@ class KDCBaseTest(RawKerberosTest):
+             if tgt is not None:
+                 return tgt
+ 
+-        realm = creds.get_realm()
++        if realm is None:
++            realm = creds.get_realm()
+ 
+         salt = creds.get_salt()
+ 
+         etype = (AES256_CTS_HMAC_SHA1_96, ARCFOUR_HMAC_MD5)
+         cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
+                                           names=[user_name])
+-        sname = self.PrincipalName_create(name_type=NT_SRV_INST,
+-                                          names=['krbtgt', realm])
++        if sname is None:
++            sname = self.PrincipalName_create(name_type=NT_SRV_INST,
++                                              names=['krbtgt', realm])
++            expected_sname = self.PrincipalName_create(
++                name_type=NT_SRV_INST, names=['krbtgt', realm.upper()])
++        else:
++            expected_sname = sname
+ 
+         till = self.get_KerberosTime(offset=36000)
+ 
+@@ -1505,9 +1515,6 @@ class KDCBaseTest(RawKerberosTest):
+ 
+         expected_realm = realm.upper()
+ 
+-        expected_sname = self.PrincipalName_create(
+-            name_type=NT_SRV_INST, names=['krbtgt', realm.upper()])
+-
+         rep, kdc_exchange_dict = self._test_as_exchange(
+             cname=cname,
+             realm=realm,
+-- 
+2.25.1
+
+
+From 668825ad56ff70715c626bc3209a6868409e4969 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 24 May 2022 19:57:57 +1200
+Subject: [PATCH 69/99] CVE-2022-2031 tests/krb5: Add kpasswd_exchange() method
+
+Now we can test the kpasswd service from Python.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Fixed conflicts in imports]
+---
+ python/samba/tests/krb5/raw_testcase.py | 264 ++++++++++++++++++++++--
+ 1 file changed, 251 insertions(+), 13 deletions(-)
+
+diff --git python/samba/tests/krb5/raw_testcase.py python/samba/tests/krb5/raw_testcase.py
+index 2aed5530455..57010ae73bd 100644
+--- python/samba/tests/krb5/raw_testcase.py
++++ python/samba/tests/krb5/raw_testcase.py
+@@ -26,6 +26,8 @@ import binascii
+ import itertools
+ import collections
+ 
++from enum import Enum
++
+ from pyasn1.codec.der.decoder import decode as pyasn1_der_decode
+ from pyasn1.codec.der.encoder import encode as pyasn1_der_encode
+ from pyasn1.codec.native.decoder import decode as pyasn1_native_decode
+@@ -33,6 +35,8 @@ from pyasn1.codec.native.encoder import encode as pyasn1_native_encode
+ 
+ from pyasn1.codec.ber.encoder import BitStringEncoder
+ 
++from pyasn1.error import PyAsn1Error
++
+ from samba.credentials import Credentials
+ from samba.dcerpc import krb5pac, security
+ from samba.gensec import FEATURE_SEAL
+@@ -50,6 +54,7 @@ from samba.tests.krb5.rfc4120_constants import (
+     KDC_ERR_PREAUTH_FAILED,
+     KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS,
+     KERB_ERR_TYPE_EXTENDED,
++    KRB_AP_REP,
+     KRB_AP_REQ,
+     KRB_AS_REP,
+     KRB_AS_REQ,
+@@ -59,6 +64,7 @@ from samba.tests.krb5.rfc4120_constants import (
+     KRB_TGS_REQ,
+     KU_AP_REQ_AUTH,
+     KU_AS_REP_ENC_PART,
++    KU_AP_REQ_ENC_PART,
+     KU_ENC_CHALLENGE_KDC,
+     KU_FAST_ENC,
+     KU_FAST_FINISHED,
+@@ -73,6 +79,7 @@ from samba.tests.krb5.rfc4120_constants import (
+     KU_TGS_REQ_AUTH_DAT_SESSION,
+     KU_TGS_REQ_AUTH_DAT_SUBKEY,
+     KU_TICKET,
++    NT_PRINCIPAL,
+     NT_SRV_INST,
+     NT_WELLKNOWN,
+     PADATA_ENCRYPTED_CHALLENGE,
+@@ -515,6 +522,10 @@ class KerberosTicketCreds:
+ class RawKerberosTest(TestCaseInTempDir):
+     """A raw Kerberos Test case."""
+ 
++    class KpasswdMode(Enum):
++        SET = object()
++        CHANGE = object()
++
+     pac_checksum_types = {krb5pac.PAC_TYPE_SRV_CHECKSUM,
+                           krb5pac.PAC_TYPE_KDC_CHECKSUM,
+                           krb5pac.PAC_TYPE_TICKET_CHECKSUM}
+@@ -1886,6 +1897,224 @@ class RawKerberosTest(TestCaseInTempDir):
+ 
+         return msg
+ 
++    def get_enc_part(self, obj, key, usage):
++        self.assertElementEqual(obj, 'pvno', 5)
++
++        enc_part = obj['enc-part']
++        self.assertElementEqual(enc_part, 'etype', key.etype)
++        self.assertElementKVNO(enc_part, 'kvno', key.kvno)
++
++        enc_part = key.decrypt(usage, enc_part['cipher'])
++
++        return enc_part
++
++    def kpasswd_exchange(self,
++                         ticket,
++                         new_password,
++                         expected_code,
++                         expected_msg,
++                         mode,
++                         target_princ=None,
++                         target_realm=None,
++                         ap_options=None,
++                         send_seq_number=True):
++        if mode is self.KpasswdMode.SET:
++            version = 0xff80
++            user_data = self.ChangePasswdDataMS_create(new_password,
++                                                       target_princ,
++                                                       target_realm)
++        elif mode is self.KpasswdMode.CHANGE:
++            self.assertIsNone(target_princ,
++                              'target_princ only valid for pw set')
++            self.assertIsNone(target_realm,
++                              'target_realm only valid for pw set')
++
++            version = 1
++            user_data = new_password.encode('utf-8')
++        else:
++            self.fail(f'invalid mode {mode}')
++
++        subkey = self.RandomKey(kcrypto.Enctype.AES256)
++
++        if ap_options is None:
++            ap_options = '0'
++        ap_options = str(krb5_asn1.APOptions(ap_options))
++
++        kdc_exchange_dict = {
++            'tgt': ticket,
++            'authenticator_subkey': subkey,
++            'auth_data': None,
++            'ap_options': ap_options,
++        }
++
++        if send_seq_number:
++            seq_number = random.randint(0, 0xfffffffe)
++        else:
++            seq_number = None
++
++        ap_req = self.generate_ap_req(kdc_exchange_dict,
++                                      None,
++                                      req_body=None,
++                                      armor=False,
++                                      usage=KU_AP_REQ_AUTH,
++                                      seq_number=seq_number)
++
++        self.connect(self.host, port=464)
++        self.assertIsNotNone(self.s)
++
++        family = self.s.family
++
++        if family == socket.AF_INET:
++            addr_type = 2  # IPv4
++        elif family == socket.AF_INET6:
++            addr_type = 24  # IPv6
++        else:
++            self.fail(f'unknown family {family}')
++
++        def create_address(ip):
++            return {
++                'addr-type': addr_type,
++                'address': socket.inet_pton(family, ip),
++            }
++
++        local_ip = self.s.getsockname()[0]
++        local_address = create_address(local_ip)
++
++        # remote_ip = self.s.getpeername()[0]
++        # remote_address = create_address(remote_ip)
++
++        # TODO: due to a bug (?), MIT Kerberos will not accept the request
++        # unless r-address is set to our _local_ address. Heimdal, on the other
++        # hand, requires the r-address is set to the remote address (as
++        # expected). To avoid problems, avoid sending r-address for now.
++        remote_address = None
++
++        msg = self.kpasswd_create(subkey,
++                                  user_data,
++                                  version,
++                                  seq_number,
++                                  ap_req,
++                                  local_address,
++                                  remote_address)
++
++        self.send_msg(msg)
++        rep_pdu = self.recv_pdu_raw()
++
++        self._disconnect('transaction done')
++
++        self.assertIsNotNone(rep_pdu)
++
++        header = rep_pdu[:6]
++        reply = rep_pdu[6:]
++
++        reply_len = (header[0] << 8) | header[1]
++        reply_version = (header[2] << 8) | header[3]
++        ap_rep_len = (header[4] << 8) | header[5]
++
++        self.assertEqual(reply_len, len(rep_pdu))
++        self.assertEqual(1, reply_version)  # KRB5_KPASSWD_VERS_CHANGEPW
++        self.assertLess(ap_rep_len, reply_len)
++
++        self.assertNotEqual(0x7e, rep_pdu[1])
++        self.assertNotEqual(0x5e, rep_pdu[1])
++
++        if ap_rep_len:
++            # We received an AP-REQ and KRB-PRIV as a response. This may or may
++            # not indicate an error, depending on the status code.
++            ap_rep = reply[:ap_rep_len]
++            krb_priv = reply[ap_rep_len:]
++
++            key = ticket.session_key
++
++            ap_rep = self.der_decode(ap_rep, asn1Spec=krb5_asn1.AP_REP())
++            self.assertElementEqual(ap_rep, 'msg-type', KRB_AP_REP)
++            enc_part = self.get_enc_part(ap_rep, key, KU_AP_REQ_ENC_PART)
++            enc_part = self.der_decode(
++                enc_part, asn1Spec=krb5_asn1.EncAPRepPart())
++
++            self.assertElementPresent(enc_part, 'ctime')
++            self.assertElementPresent(enc_part, 'cusec')
++            # self.assertElementMissing(enc_part, 'subkey') # TODO
++            # self.assertElementPresent(enc_part, 'seq-number') # TODO
++
++            try:
++                krb_priv = self.der_decode(krb_priv, asn1Spec=krb5_asn1.KRB_PRIV())
++            except PyAsn1Error:
++                self.fail()
++
++            self.assertElementEqual(krb_priv, 'msg-type', KRB_PRIV)
++            priv_enc_part = self.get_enc_part(krb_priv, subkey, KU_KRB_PRIV)
++            priv_enc_part = self.der_decode(
++                priv_enc_part, asn1Spec=krb5_asn1.EncKrbPrivPart())
++
++            self.assertElementMissing(priv_enc_part, 'timestamp')
++            self.assertElementMissing(priv_enc_part, 'usec')
++            # self.assertElementPresent(priv_enc_part, 'seq-number') # TODO
++            # self.assertElementEqual(priv_enc_part, 's-address', remote_address) # TODO
++            # self.assertElementMissing(priv_enc_part, 'r-address') # TODO
++
++            result_data = priv_enc_part['user-data']
++        else:
++            # We received a KRB-ERROR as a response, indicating an error.
++            krb_error = self.der_decode(reply, asn1Spec=krb5_asn1.KRB_ERROR())
++
++            sname = self.PrincipalName_create(
++                name_type=NT_PRINCIPAL,
++                names=['kadmin', 'changepw'])
++            realm = self.get_krbtgt_creds().get_realm().upper()
++
++            self.assertElementEqual(krb_error, 'pvno', 5)
++            self.assertElementEqual(krb_error, 'msg-type', KRB_ERROR)
++            self.assertElementMissing(krb_error, 'ctime')
++            self.assertElementMissing(krb_error, 'usec')
++            self.assertElementPresent(krb_error, 'stime')
++            self.assertElementPresent(krb_error, 'susec')
++
++            error_code = krb_error['error-code']
++            if isinstance(expected_code, int):
++                self.assertEqual(error_code, expected_code)
++            else:
++                self.assertIn(error_code, expected_code)
++
++            self.assertElementMissing(krb_error, 'crealm')
++            self.assertElementMissing(krb_error, 'cname')
++            self.assertElementEqual(krb_error, 'realm', realm.encode('utf-8'))
++            self.assertElementEqualPrincipal(krb_error, 'sname', sname)
++            self.assertElementMissing(krb_error, 'e-text')
++
++            result_data = krb_error['e-data']
++
++        status = result_data[:2]
++        message = result_data[2:]
++
++        status_code = (status[0] << 8) | status[1]
++        if isinstance(expected_code, int):
++            self.assertEqual(status_code, expected_code)
++        else:
++            self.assertIn(status_code, expected_code)
++
++        if not message:
++            self.assertEqual(0, status_code,
++                             'got an error result, but no message')
++            return
++
++        # Check the first character of the message.
++        if message[0]:
++            if isinstance(expected_msg, bytes):
++                self.assertEqual(message, expected_msg)
++            else:
++                self.assertIn(message, expected_msg)
++        else:
++            # We got AD password policy information.
++            self.assertEqual(30, len(message))
++
++            (empty_bytes,
++             min_length,
++             history_length,
++             properties,
++             expire_time,
++             min_age) = struct.unpack('>HIIIQQ', message)
++
+     def _generic_kdc_exchange(self,
+                               kdc_exchange_dict,  # required
+                               cname=None,  # optional
+@@ -1996,7 +2225,7 @@ class RawKerberosTest(TestCaseInTempDir):
+             self.assertIsNotNone(generate_fast_fn)
+             fast_ap_req = generate_fast_armor_fn(kdc_exchange_dict,
+                                                  callback_dict,
+-                                                 req_body,
++                                                 None,
+                                                  armor=True)
+ 
+             fast_armor_type = kdc_exchange_dict['fast_armor_type']
+@@ -3211,31 +3440,39 @@ class RawKerberosTest(TestCaseInTempDir):
+                         kdc_exchange_dict,
+                         _callback_dict,
+                         req_body,
+-                        armor):
++                        armor,
++                        usage=None,
++                        seq_number=None):
++        req_body_checksum = None
++
+         if armor:
++            self.assertIsNone(req_body)
++
+             tgt = kdc_exchange_dict['armor_tgt']
+             authenticator_subkey = kdc_exchange_dict['armor_subkey']
+-
+-            req_body_checksum = None
+         else:
+             tgt = kdc_exchange_dict['tgt']
+             authenticator_subkey = kdc_exchange_dict['authenticator_subkey']
+-            body_checksum_type = kdc_exchange_dict['body_checksum_type']
+ 
+-            req_body_blob = self.der_encode(req_body,
+-                                            asn1Spec=krb5_asn1.KDC_REQ_BODY())
++            if req_body is not None:
++                body_checksum_type = kdc_exchange_dict['body_checksum_type']
++
++                req_body_blob = self.der_encode(
++                    req_body, asn1Spec=krb5_asn1.KDC_REQ_BODY())
+ 
+-            req_body_checksum = self.Checksum_create(tgt.session_key,
+-                                                     KU_TGS_REQ_AUTH_CKSUM,
+-                                                     req_body_blob,
+-                                                     ctype=body_checksum_type)
++                req_body_checksum = self.Checksum_create(
++                    tgt.session_key,
++                    KU_TGS_REQ_AUTH_CKSUM,
++                    req_body_blob,
++                    ctype=body_checksum_type)
+ 
+         auth_data = kdc_exchange_dict['auth_data']
+ 
+         subkey_obj = None
+         if authenticator_subkey is not None:
+             subkey_obj = authenticator_subkey.export_obj()
+-        seq_number = random.randint(0, 0xfffffffe)
++        if seq_number is None:
++            seq_number = random.randint(0, 0xfffffffe)
+         (ctime, cusec) = self.get_KerberosTimeWithUsec()
+         authenticator_obj = self.Authenticator_create(
+             crealm=tgt.crealm,
+@@ -3250,7 +3487,8 @@ class RawKerberosTest(TestCaseInTempDir):
+             authenticator_obj,
+             asn1Spec=krb5_asn1.Authenticator())
+ 
+-        usage = KU_AP_REQ_AUTH if armor else KU_TGS_REQ_AUTH
++        if usage is None:
++            usage = KU_AP_REQ_AUTH if armor else KU_TGS_REQ_AUTH
+         authenticator = self.EncryptedData_create(tgt.session_key,
+                                                   usage,
+                                                   authenticator_blob)
+-- 
+2.25.1
+
+
+From 450ff39d1c9f538bd828b7b2bee75c88d3dc1ee2 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 24 May 2022 19:59:16 +1200
+Subject: [PATCH 71/99] CVE-2022-2031 tests/krb5: Add tests for kpasswd service
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Fixed conflicts in usage.py and knownfails; removed
+ MIT KDC 1.20-specific knownfails as it's not supported]
+
+[jsutton@samba.org Fixed conflicts in usage.py, knownfails, and
+ tests.py]
+---
+ python/samba/tests/krb5/kdc_base_test.py |    4 +-
+ python/samba/tests/krb5/kpasswd_tests.py | 1021 ++++++++++++++++++++++
+ python/samba/tests/krb5/raw_testcase.py  |    8 +
+ python/samba/tests/usage.py              |    1 +
+ selftest/knownfail_heimdal_kdc           |   26 +
+ selftest/knownfail_mit_kdc               |   26 +
+ source4/selftest/tests.py                |    4 +
+ 7 files changed, 1089 insertions(+), 1 deletion(-)
+ create mode 100755 python/samba/tests/krb5/kpasswd_tests.py
+
+diff --git python/samba/tests/krb5/kdc_base_test.py python/samba/tests/krb5/kdc_base_test.py
+index c0ca881985a..f0306dde110 100644
+--- python/samba/tests/krb5/kdc_base_test.py
++++ python/samba/tests/krb5/kdc_base_test.py
+@@ -1586,7 +1586,9 @@ class KDCBaseTest(RawKerberosTest):
+         authenticator_subkey = self.RandomKey(kcrypto.Enctype.AES256)
+ 
+         if expect_error:
+-            expected_error_mode = KDC_ERR_TGT_REVOKED
++            expected_error_mode = expect_error
++            if expected_error_mode is True:
++                expected_error_mode = KDC_ERR_TGT_REVOKED
+             check_error_fn = self.generic_check_kdc_error
+             check_rep_fn = None
+         else:
+diff --git python/samba/tests/krb5/kpasswd_tests.py python/samba/tests/krb5/kpasswd_tests.py
+new file mode 100755
+index 00000000000..3a6c7d818dc
+--- /dev/null
++++ python/samba/tests/krb5/kpasswd_tests.py
+@@ -0,0 +1,1021 @@
++#!/usr/bin/env python3
++# Unix SMB/CIFS implementation.
++# Copyright (C) Stefan Metzmacher 2020
++# Copyright (C) Catalyst.Net Ltd
++#
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 3 of the License, or
++# (at your option) any later version.
++#
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++#
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <http://www.gnu.org/licenses/>.
++#
++
++import os
++import sys
++
++from functools import partial
++
++from samba import generate_random_password, unix2nttime
++from samba.dcerpc import krb5pac, security
++from samba.sd_utils import SDUtils
++
++from samba.tests.krb5.kdc_base_test import KDCBaseTest
++from samba.tests.krb5.rfc4120_constants import (
++    KDC_ERR_TGT_REVOKED,
++    KDC_ERR_TKT_EXPIRED,
++    KPASSWD_ACCESSDENIED,
++    KPASSWD_HARDERROR,
++    KPASSWD_INITIAL_FLAG_NEEDED,
++    KPASSWD_MALFORMED,
++    KPASSWD_SOFTERROR,
++    KPASSWD_SUCCESS,
++    NT_PRINCIPAL,
++    NT_SRV_INST,
++)
++
++sys.path.insert(0, 'bin/python')
++os.environ['PYTHONUNBUFFERED'] = '1'
++
++global_asn1_print = False
++global_hexdump = False
++
++
++# Note: these tests do not pass on Windows, which returns different error codes
++# to the ones we have chosen, and does not always return additional error data.
++class KpasswdTests(KDCBaseTest):
++
++    def setUp(self):
++        super().setUp()
++        self.do_asn1_print = global_asn1_print
++        self.do_hexdump = global_hexdump
++
++        samdb = self.get_samdb()
++
++        # Get the old 'dSHeuristics' if it was set
++        dsheuristics = samdb.get_dsheuristics()
++
++        # Reset the 'dSHeuristics' as they were before
++        self.addCleanup(samdb.set_dsheuristics, dsheuristics)
++
++        # Set the 'dSHeuristics' to activate the correct 'userPassword'
++        # behaviour
++        samdb.set_dsheuristics('000000001')
++
++        # Get the old 'minPwdAge'
++        minPwdAge = samdb.get_minPwdAge()
++
++        # Reset the 'minPwdAge' as it was before
++        self.addCleanup(samdb.set_minPwdAge, minPwdAge)
++
++        # Set it temporarily to '0'
++        samdb.set_minPwdAge('0')
++
++    def _get_creds(self, expired=False):
++        opts = {
++            'expired_password': expired
++        }
++
++        # Create the account.
++        creds = self.get_cached_creds(account_type=self.AccountType.USER,
++                                      opts=opts,
++                                      use_cache=False)
++
++        return creds
++
++    def issued_by_rodc(self, ticket):
++        krbtgt_creds = self.get_mock_rodc_krbtgt_creds()
++
++        krbtgt_key = self.TicketDecryptionKey_from_creds(krbtgt_creds)
++        checksum_keys = {
++            krb5pac.PAC_TYPE_KDC_CHECKSUM: krbtgt_key,
++        }
++
++        return self.modified_ticket(
++            ticket,
++            new_ticket_key=krbtgt_key,
++            checksum_keys=checksum_keys)
++
++    def get_kpasswd_sname(self):
++        return self.PrincipalName_create(name_type=NT_PRINCIPAL,
++                                         names=['kadmin', 'changepw'])
++
++    def get_ticket_lifetime(self, ticket):
++        enc_part = ticket.ticket_private
++
++        authtime = enc_part['authtime']
++        starttime = enc_part.get('starttime', authtime)
++        endtime = enc_part['endtime']
++
++        starttime = self.get_EpochFromKerberosTime(starttime)
++        endtime = self.get_EpochFromKerberosTime(endtime)
++
++        return endtime - starttime
++
++    def add_requester_sid(self, pac, sid):
++        pac_buffers = pac.buffers
++
++        buffer_types = [pac_buffer.type for pac_buffer in pac_buffers]
++        self.assertNotIn(krb5pac.PAC_TYPE_REQUESTER_SID, buffer_types)
++
++        requester_sid = krb5pac.PAC_REQUESTER_SID()
++        requester_sid.sid = security.dom_sid(sid)
++
++        requester_sid_buffer = krb5pac.PAC_BUFFER()
++        requester_sid_buffer.type = krb5pac.PAC_TYPE_REQUESTER_SID
++        requester_sid_buffer.info = requester_sid
++
++        pac_buffers.append(requester_sid_buffer)
++
++        pac.buffers = pac_buffers
++        pac.num_buffers += 1
++
++        return pac
++
++    # Test setting a password with kpasswd.
++    def test_kpasswd_set(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        expected_code = KPASSWD_SUCCESS
++        expected_msg = b'Password changed'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        # Test the newly set password.
++        creds.update_password(new_password)
++        self.get_tgt(creds, fresh=True)
++
++    # Test changing a password with kpasswd.
++    def test_kpasswd_change(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        expected_code = KPASSWD_SUCCESS
++        expected_msg = b'Password changed'
++
++        # Change the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++        # Test the newly set password.
++        creds.update_password(new_password)
++        self.get_tgt(creds, fresh=True)
++
++    # Test kpasswd without setting the canonicalize option.
++    def test_kpasswd_no_canonicalize(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        sname = self.get_kpasswd_sname()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=sname,
++                              kdc_options='0')
++
++        expected_code = KPASSWD_SUCCESS
++        expected_msg = b'Password changed'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        creds.update_password(new_password)
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=sname,
++                              kdc_options='0')
++
++        # Change the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    # Test kpasswd with the canonicalize option reset and a non-canonical
++    # (by conversion to title case) realm.
++    def test_kpasswd_no_canonicalize_realm_case(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        sname = self.get_kpasswd_sname()
++        realm = creds.get_realm().capitalize()  # We use a title-cased realm.
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=sname,
++                              realm=realm,
++                              kdc_options='0')
++
++        expected_code = KPASSWD_SUCCESS
++        expected_msg = b'Password changed'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        creds.update_password(new_password)
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=sname,
++                              realm=realm,
++                              kdc_options='0')
++
++        # Change the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    # Test kpasswd with the canonicalize option set.
++    def test_kpasswd_canonicalize(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        # Get an initial ticket to kpasswd. We set the canonicalize flag here.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='canonicalize')
++
++        expected_code = KPASSWD_SUCCESS
++        expected_msg = b'Password changed'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        creds.update_password(new_password)
++
++        # Get an initial ticket to kpasswd. We set the canonicalize flag here.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='canonicalize')
++
++        # Change the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    # Test kpasswd with the canonicalize option set and a non-canonical (by
++    # conversion to title case) realm.
++    def test_kpasswd_canonicalize_realm_case(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        sname = self.get_kpasswd_sname()
++        realm = creds.get_realm().capitalize()  # We use a title-cased realm.
++
++        # Get an initial ticket to kpasswd. We set the canonicalize flag here.
++        ticket = self.get_tgt(creds, sname=sname,
++                              realm=realm,
++                              kdc_options='canonicalize')
++
++        expected_code = KPASSWD_SUCCESS
++        expected_msg = b'Password changed'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        creds.update_password(new_password)
++
++        # Get an initial ticket to kpasswd. We set the canonicalize flag here.
++        ticket = self.get_tgt(creds, sname=sname,
++                              realm=realm,
++                              kdc_options='canonicalize')
++
++        # Change the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    # Test kpasswd rejects a password that does not meet complexity
++    # requirements.
++    def test_kpasswd_too_weak(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        expected_code = KPASSWD_SOFTERROR
++        expected_msg = b'Password does not meet complexity requirements'
++
++        # Set the password.
++        new_password = 'password'
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        # Change the password.
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    # Test kpasswd rejects an empty new password.
++    def test_kpasswd_empty(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        expected_code = KPASSWD_SOFTERROR, KPASSWD_HARDERROR
++        expected_msg = (b'Password too short, password must be at least 7 '
++                        b'characters long.',
++                        b'String conversion failed!')
++
++        # Set the password.
++        new_password = ''
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        expected_code = KPASSWD_HARDERROR
++        expected_msg = b'String conversion failed!'
++
++        # Change the password.
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    # Test kpasswd rejects a request that does not include a random sequence
++    # number.
++    def test_kpasswd_no_seq_number(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        expected_code = KPASSWD_HARDERROR
++        expected_msg = b'gensec_unwrap failed - NT_STATUS_ACCESS_DENIED\n'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET,
++                              send_seq_number=False)
++
++        # Change the password.
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE,
++                              send_seq_number=False)
++
++    # Test kpasswd rejects a ticket issued by an RODC.
++    def test_kpasswd_from_rodc(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        # Have the ticket be issued by the RODC.
++        ticket = self.issued_by_rodc(ticket)
++
++        expected_code = KPASSWD_HARDERROR
++        expected_msg = b'gensec_update failed - NT_STATUS_LOGON_FAILURE\n'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        # Change the password.
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    # Test setting a password, specifying the principal of the target user.
++    def test_kpasswd_set_target_princ_only(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++        username = creds.get_username()
++
++        cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
++                                          names=username.split('/'))
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        expected_code = KPASSWD_MALFORMED
++        expected_msg = (b'Realm and principal must be both present, or '
++                        b'neither present',
++                        b'Failed to decode packet')
++
++        # Change the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET,
++                              target_princ=cname)
++
++    # Test that kpasswd rejects a password set specifying only the realm of the
++    # target user.
++    def test_kpasswd_set_target_realm_only(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        expected_code = KPASSWD_MALFORMED, KPASSWD_ACCESSDENIED
++        expected_msg = (b'Realm and principal must be both present, or '
++                        b'neither present',
++                        b'Failed to decode packet',
++                        b'No such user when changing password')
++
++        # Change the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET,
++                              target_realm=creds.get_realm())
++
++    # Show that a user cannot set a password, specifying both principal and
++    # realm of the target user, without having control access.
++    def test_kpasswd_set_target_princ_and_realm_no_access(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++        username = creds.get_username()
++
++        cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
++                                          names=username.split('/'))
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        expected_code = KPASSWD_ACCESSDENIED
++        expected_msg = b'Not permitted to change password'
++
++        # Change the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET,
++                              target_princ=cname,
++                              target_realm=creds.get_realm())
++
++    # Test setting a password, specifying both principal and realm of the
++    # target user, whem the user has control access on their account.
++    def test_kpasswd_set_target_princ_and_realm_access(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++        username = creds.get_username()
++        tgt = self.get_tgt(creds)
++
++        cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
++                                          names=username.split('/'))
++
++        samdb = self.get_samdb()
++        sd_utils = SDUtils(samdb)
++
++        user_dn = creds.get_dn()
++        user_sid = self.get_objectSid(samdb, user_dn)
++
++        # Give the user control access on their account.
++        ace = f'(A;;CR;;;{user_sid})'
++        sd_utils.dacl_add_ace(user_dn, ace)
++
++        # Get a non-initial ticket to kpasswd. Since we have the right to
++        # change the account's password, we don't need an initial ticket.
++        krbtgt_creds = self.get_krbtgt_creds()
++        ticket = self.get_service_ticket(tgt,
++                                         krbtgt_creds,
++                                         service='kadmin',
++                                         target_name='changepw',
++                                         kdc_options='0')
++
++        expected_code = KPASSWD_SUCCESS
++        expected_msg = b'Password changed'
++
++        # Change the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET,
++                              target_princ=cname,
++                              target_realm=creds.get_realm())
++
++    # Test setting a password when the existing password has expired.
++    def test_kpasswd_set_expired_password(self):
++        # Create an account for testing, with an expired password.
++        creds = self._get_creds(expired=True)
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        expected_code = KPASSWD_SUCCESS
++        expected_msg = b'Password changed'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++    # Test changing a password when the existing password has expired.
++    def test_kpasswd_change_expired_password(self):
++        # Create an account for testing, with an expired password.
++        creds = self._get_creds(expired=True)
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        expected_code = KPASSWD_SUCCESS
++        expected_msg = b'Password changed'
++
++        # Change the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    # Check the lifetime of a kpasswd ticket is not more than two minutes.
++    def test_kpasswd_ticket_lifetime(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        # Check the lifetime of the ticket is equal to two minutes.
++        lifetime = self.get_ticket_lifetime(ticket)
++        self.assertEqual(2 * 60, lifetime)
++
++    # Ensure we cannot perform a TGS-REQ with a kpasswd ticket.
++    def test_kpasswd_ticket_tgs(self):
++        creds = self.get_client_creds()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        # Change the sname of the ticket to match that of a TGT.
++        realm = creds.get_realm()
++        krbtgt_sname = self.PrincipalName_create(name_type=NT_SRV_INST,
++                                                 names=['krbtgt', realm])
++        ticket.set_sname(krbtgt_sname)
++
++        # Try to use that ticket to get a service ticket.
++        service_creds = self.get_service_creds()
++
++        # This fails due to missing REQUESTER_SID buffer.
++        self._make_tgs_request(creds, service_creds, ticket,
++                               expect_error=(KDC_ERR_TGT_REVOKED,
++                                             KDC_ERR_TKT_EXPIRED))
++
++    def modify_requester_sid_time(self, ticket, sid, lifetime):
++        # Get the krbtgt key.
++        krbtgt_creds = self.get_krbtgt_creds()
++
++        krbtgt_key = self.TicketDecryptionKey_from_creds(krbtgt_creds)
++        checksum_keys = {
++            krb5pac.PAC_TYPE_KDC_CHECKSUM: krbtgt_key,
++        }
++
++        # Set authtime and starttime to an hour in the past, to show that they
++        # do not affect ticket rejection.
++        start_time = self.get_KerberosTime(offset=-60 * 60)
++
++        # Set the endtime of the ticket relative to our current time, so that
++        # the ticket has 'lifetime' seconds remaining to live.
++        end_time = self.get_KerberosTime(offset=lifetime)
++
++        # Modify the times in the ticket.
++        def modify_ticket_times(enc_part):
++            enc_part['authtime'] = start_time
++            if 'starttime' in enc_part:
++                enc_part['starttime'] = start_time
++
++            enc_part['endtime'] = end_time
++
++            return enc_part
++
++        # We have to set the times in both the ticket and the PAC, otherwise
++        # Heimdal will complain.
++        def modify_pac_time(pac):
++            pac_buffers = pac.buffers
++
++            for pac_buffer in pac_buffers:
++                if pac_buffer.type == krb5pac.PAC_TYPE_LOGON_NAME:
++                    logon_time = self.get_EpochFromKerberosTime(start_time)
++                    pac_buffer.info.logon_time = unix2nttime(logon_time)
++                    break
++            else:
++                self.fail('failed to find LOGON_NAME PAC buffer')
++
++            pac.buffers = pac_buffers
++
++            return pac
++
++        # Add a requester SID to show that the KDC will then accept this
++        # kpasswd ticket as if it were a TGT.
++        def modify_pac_fn(pac):
++            pac = self.add_requester_sid(pac, sid=sid)
++            pac = modify_pac_time(pac)
++            return pac
++
++        # Do the actual modification.
++        return self.modified_ticket(ticket,
++                                    new_ticket_key=krbtgt_key,
++                                    modify_fn=modify_ticket_times,
++                                    modify_pac_fn=modify_pac_fn,
++                                    checksum_keys=checksum_keys)
++
++    # Ensure we cannot perform a TGS-REQ with a kpasswd ticket containing a
++    # requester SID and having a remaining lifetime of two minutes.
++    def test_kpasswd_ticket_requester_sid_tgs(self):
++        creds = self.get_client_creds()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        # Change the sname of the ticket to match that of a TGT.
++        realm = creds.get_realm()
++        krbtgt_sname = self.PrincipalName_create(name_type=NT_SRV_INST,
++                                                 names=['krbtgt', realm])
++        ticket.set_sname(krbtgt_sname)
++
++        # Get the user's SID.
++        samdb = self.get_samdb()
++
++        user_dn = creds.get_dn()
++        user_sid = self.get_objectSid(samdb, user_dn)
++
++        # Modify the ticket to add a requester SID and give it two minutes to
++        # live.
++        ticket = self.modify_requester_sid_time(ticket,
++                                                sid=user_sid,
++                                                lifetime=2 * 60)
++
++        # Try to use that ticket to get a service ticket.
++        service_creds = self.get_service_creds()
++
++        # This fails due to the lifetime being too short.
++        self._make_tgs_request(creds, service_creds, ticket,
++                               expect_error=KDC_ERR_TKT_EXPIRED)
++
++    # Show we can perform a TGS-REQ with a kpasswd ticket containing a
++    # requester SID if the remaining lifetime exceeds two minutes.
++    def test_kpasswd_ticket_requester_sid_lifetime_tgs(self):
++        creds = self.get_client_creds()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=self.get_kpasswd_sname(),
++                              kdc_options='0')
++
++        # Change the sname of the ticket to match that of a TGT.
++        realm = creds.get_realm()
++        krbtgt_sname = self.PrincipalName_create(name_type=NT_SRV_INST,
++                                                 names=['krbtgt', realm])
++        ticket.set_sname(krbtgt_sname)
++
++        # Get the user's SID.
++        samdb = self.get_samdb()
++
++        user_dn = creds.get_dn()
++        user_sid = self.get_objectSid(samdb, user_dn)
++
++        # Modify the ticket to add a requester SID and give it two minutes and
++        # ten seconds to live.
++        ticket = self.modify_requester_sid_time(ticket,
++                                                sid=user_sid,
++                                                lifetime=2 * 60 + 10)
++
++        # Try to use that ticket to get a service ticket.
++        service_creds = self.get_service_creds()
++
++        # This succeeds.
++        self._make_tgs_request(creds, service_creds, ticket,
++                               expect_error=False)
++
++    # Test that kpasswd rejects requests with a service ticket.
++    def test_kpasswd_non_initial(self):
++        # Create an account for testing, and get a TGT.
++        creds = self._get_creds()
++        tgt = self.get_tgt(creds)
++
++        # Get a non-initial ticket to kpasswd.
++        krbtgt_creds = self.get_krbtgt_creds()
++        ticket = self.get_service_ticket(tgt,
++                                         krbtgt_creds,
++                                         service='kadmin',
++                                         target_name='changepw',
++                                         kdc_options='0')
++
++        expected_code = KPASSWD_INITIAL_FLAG_NEEDED
++        expected_msg = b'Expected an initial ticket'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        # Change the password.
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    # Show that kpasswd accepts requests with a service ticket modified to set
++    # the 'initial' flag.
++    def test_kpasswd_initial(self):
++        # Create an account for testing, and get a TGT.
++        creds = self._get_creds()
++
++        krbtgt_creds = self.get_krbtgt_creds()
++
++        # Get a service ticket, and modify it to set the 'initial' flag.
++        def get_ticket():
++            tgt = self.get_tgt(creds, fresh=True)
++
++            # Get a non-initial ticket to kpasswd.
++            ticket = self.get_service_ticket(tgt,
++                                             krbtgt_creds,
++                                             service='kadmin',
++                                             target_name='changepw',
++                                             kdc_options='0',
++                                             fresh=True)
++
++            set_initial_flag = partial(self.modify_ticket_flag, flag='initial',
++                                       value=True)
++
++            checksum_keys = self.get_krbtgt_checksum_key()
++            return self.modified_ticket(ticket,
++                                        modify_fn=set_initial_flag,
++                                        checksum_keys=checksum_keys)
++
++        expected_code = KPASSWD_SUCCESS
++        expected_msg = b'Password changed'
++
++        ticket = get_ticket()
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        creds.update_password(new_password)
++        ticket = get_ticket()
++
++        # Change the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    # Test that kpasswd rejects requests where the ticket is encrypted with a
++    # key other than the krbtgt's.
++    def test_kpasswd_wrong_key(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        sname = self.get_kpasswd_sname()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=sname,
++                              kdc_options='0')
++
++        # Get a key belonging to the Administrator account.
++        admin_creds = self.get_admin_creds()
++        admin_key = self.TicketDecryptionKey_from_creds(admin_creds)
++        self.assertIsNotNone(admin_key.kvno,
++                             'a kvno is required to tell the DB '
++                             'which key to look up.')
++        checksum_keys = {
++            krb5pac.PAC_TYPE_KDC_CHECKSUM: admin_key,
++        }
++
++        # Re-encrypt the ticket using the Administrator's key.
++        ticket = self.modified_ticket(ticket,
++                                      new_ticket_key=admin_key,
++                                      checksum_keys=checksum_keys)
++
++        # Set the sname of the ticket to that of the Administrator account.
++        admin_sname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
++                                                names=['Administrator'])
++        ticket.set_sname(admin_sname)
++
++        expected_code = KPASSWD_HARDERROR
++        expected_msg = b'gensec_update failed - NT_STATUS_LOGON_FAILURE\n'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        # Change the password.
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    def test_kpasswd_wrong_key_service(self):
++        # Create an account for testing.
++        creds = self.get_cached_creds(account_type=self.AccountType.COMPUTER,
++                                      use_cache=False)
++
++        sname = self.get_kpasswd_sname()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=sname,
++                              kdc_options='0')
++
++        # Get a key belonging to our account.
++        our_key = self.TicketDecryptionKey_from_creds(creds)
++        self.assertIsNotNone(our_key.kvno,
++                             'a kvno is required to tell the DB '
++                             'which key to look up.')
++        checksum_keys = {
++            krb5pac.PAC_TYPE_KDC_CHECKSUM: our_key,
++        }
++
++        # Re-encrypt the ticket using our key.
++        ticket = self.modified_ticket(ticket,
++                                      new_ticket_key=our_key,
++                                      checksum_keys=checksum_keys)
++
++        # Set the sname of the ticket to that of our account.
++        username = creds.get_username()
++        sname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
++                                          names=username.split('/'))
++        ticket.set_sname(sname)
++
++        expected_code = KPASSWD_HARDERROR
++        expected_msg = b'gensec_update failed - NT_STATUS_LOGON_FAILURE\n'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        # Change the password.
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++    # Test that kpasswd rejects requests where the ticket is encrypted with a
++    # key belonging to a server account other than the krbtgt.
++    def test_kpasswd_wrong_key_server(self):
++        # Create an account for testing.
++        creds = self._get_creds()
++
++        sname = self.get_kpasswd_sname()
++
++        # Get an initial ticket to kpasswd.
++        ticket = self.get_tgt(creds, sname=sname,
++                              kdc_options='0')
++
++        # Get a key belonging to the DC's account.
++        dc_creds = self.get_dc_creds()
++        dc_key = self.TicketDecryptionKey_from_creds(dc_creds)
++        self.assertIsNotNone(dc_key.kvno,
++                             'a kvno is required to tell the DB '
++                             'which key to look up.')
++        checksum_keys = {
++            krb5pac.PAC_TYPE_KDC_CHECKSUM: dc_key,
++        }
++
++        # Re-encrypt the ticket using the DC's key.
++        ticket = self.modified_ticket(ticket,
++                                      new_ticket_key=dc_key,
++                                      checksum_keys=checksum_keys)
++
++        # Set the sname of the ticket to that of the DC's account.
++        dc_username = dc_creds.get_username()
++        dc_sname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
++                                             names=dc_username.split('/'))
++        ticket.set_sname(dc_sname)
++
++        expected_code = KPASSWD_HARDERROR
++        expected_msg = b'gensec_update failed - NT_STATUS_LOGON_FAILURE\n'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        # Change the password.
++        self.kpasswd_exchange(ticket,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
++
++if __name__ == '__main__':
++    global_asn1_print = False
++    global_hexdump = False
++    import unittest
++    unittest.main()
+diff --git python/samba/tests/krb5/raw_testcase.py python/samba/tests/krb5/raw_testcase.py
+index 57010ae73bd..4a78a8eadf3 100644
+--- python/samba/tests/krb5/raw_testcase.py
++++ python/samba/tests/krb5/raw_testcase.py
+@@ -500,6 +500,10 @@ class KerberosCredentials(Credentials):
+     def get_upn(self):
+         return self.upn
+ 
++    def update_password(self, password):
++        self.set_password(password)
++        self.set_kvno(self.get_kvno() + 1)
++
+ 
+ class KerberosTicketCreds:
+     def __init__(self, ticket, session_key,
+@@ -518,6 +522,10 @@ class KerberosTicketCreds:
+         self.ticket_private = ticket_private
+         self.encpart_private = encpart_private
+ 
++    def set_sname(self, sname):
++        self.ticket['sname'] = sname
++        self.sname = sname
++
+ 
+ class RawKerberosTest(TestCaseInTempDir):
+     """A raw Kerberos Test case."""
+diff --git python/samba/tests/usage.py python/samba/tests/usage.py
+index 6bbd96e7a08..a1210ada579 100644
+--- python/samba/tests/usage.py
++++ python/samba/tests/usage.py
+@@ -109,6 +109,7 @@ EXCLUDE_USAGE = {
+     'python/samba/tests/krb5/alias_tests.py',
+     'python/samba/tests/krb5/test_min_domain_uid.py',
+     'python/samba/tests/krb5/test_idmap_nss.py',
++    'python/samba/tests/krb5/kpasswd_tests.py',
+ }
+ 
+ EXCLUDE_HELP = {
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 424a8b81c38..54e69a48bc1 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -271,3 +271,29 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
++#
++# Kpasswd tests
++#
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_change.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_change_expired_password.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_empty.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_initial.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_seq_number.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_expired_password.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_and_realm_access.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_and_realm_no_access.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_only.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_realm_only.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_too_weak.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 108c6055d0c..53638afc17a 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -575,3 +575,29 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_sid_mismatch_nonexisting
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_requester_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_requester_sid_mismatch_nonexisting
++#
++# Kpasswd tests
++#
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_change.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_change_expired_password.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_empty.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_initial.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_seq_number.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_expired_password.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_and_realm_access.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_and_realm_no_access.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_only.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_realm_only.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_too_weak.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+-- 
+2.25.1
+
+
+From 29ec8b2369b5f5e2a660a3165d2528982514a0f2 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Fri, 27 May 2022 19:21:06 +1200
+Subject: [PATCH 72/99] CVE-2022-2031 s4:kpasswd: Correctly generate error
+ strings
+
+The error_data we create already has an explicit length, and should not
+be zero-terminated, so we omit the trailing null byte. Previously,
+Heimdal builds would leave a superfluous trailing null byte on error
+strings, while MIT builds would omit the final character.
+
+The two bytes added to the string's length are for the prepended error
+code.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Removed MIT KDC 1.20-specific knownfails]
+---
+ selftest/knownfail_heimdal_kdc | 12 ------------
+ selftest/knownfail_mit_kdc     | 15 ---------------
+ source4/kdc/kpasswd-helper.c   | 13 ++++++-------
+ 3 files changed, 6 insertions(+), 34 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 54e69a48bc1..40e24f3155b 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -276,24 +276,12 @@
+ #
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_change.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_change_expired_password.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_empty.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_initial.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_seq_number.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_expired_password.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_and_realm_access.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_and_realm_no_access.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_only.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_realm_only.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_too_weak.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 53638afc17a..a914c4d3492 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -578,26 +578,11 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ #
+ # Kpasswd tests
+ #
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_change.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_change_expired_password.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_empty.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_initial.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_seq_number.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_expired_password.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_and_realm_access.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_and_realm_no_access.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_princ_only.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_set_target_realm_only.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_too_weak.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+diff --git source4/kdc/kpasswd-helper.c source4/kdc/kpasswd-helper.c
+index 995f54825b5..55a2f5b3bf6 100644
+--- source4/kdc/kpasswd-helper.c
++++ source4/kdc/kpasswd-helper.c
+@@ -48,17 +48,16 @@ bool kpasswd_make_error_reply(TALLOC_CTX *mem_ctx,
+ 	}
+ 
+ 	/*
+-	 * The string 's' has two terminating nul-bytes which are also
+-	 * reflected by 'slen'. Normally Kerberos doesn't expect that strings
+-	 * are nul-terminated, but Heimdal does!
++	 * The string 's' has one terminating nul-byte which is also
++	 * reflected by 'slen'. We subtract it from the length.
+ 	 */
+-#ifndef SAMBA4_USES_HEIMDAL
+-	if (slen < 2) {
++	if (slen < 1) {
+ 		talloc_free(s);
+ 		return false;
+ 	}
+-	slen -= 2;
+-#endif
++	slen--;
++
++	/* Two bytes are added to the length to account for the error code. */
+ 	if (2 + slen < slen) {
+ 		talloc_free(s);
+ 		return false;
+-- 
+2.25.1
+
+
+From 3a8da51396f3bf9d4caf8dbd4e75a0314aa47046 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 18 May 2022 16:48:59 +1200
+Subject: [PATCH 73/99] CVE-2022-2031 s4:kpasswd: Don't return AP-REP on
+ failure
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Removed MIT KDC 1.20-specific knownfails]
+---
+ selftest/knownfail_mit_kdc    | 1 -
+ source4/kdc/kpasswd-service.c | 2 ++
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index a914c4d3492..f64291e776d 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -579,7 +579,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ # Kpasswd tests
+ #
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_empty.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
+diff --git source4/kdc/kpasswd-service.c source4/kdc/kpasswd-service.c
+index 8f1679e4a28..a3c57a67dd1 100644
+--- source4/kdc/kpasswd-service.c
++++ source4/kdc/kpasswd-service.c
+@@ -253,6 +253,7 @@ kdc_code kpasswd_process(struct kdc_server *kdc,
+ 				      &kpasswd_dec_reply,
+ 				      &error_string);
+ 	if (code != 0) {
++		ap_rep_blob = data_blob_null;
+ 		error_code = code;
+ 		goto reply;
+ 	}
+@@ -262,6 +263,7 @@ kdc_code kpasswd_process(struct kdc_server *kdc,
+ 			     &kpasswd_dec_reply,
+ 			     &enc_data_blob);
+ 	if (!NT_STATUS_IS_OK(status)) {
++		ap_rep_blob = data_blob_null;
+ 		error_code = KRB5_KPASSWD_HARDERROR;
+ 		error_string = talloc_asprintf(tmp_ctx,
+ 					       "gensec_wrap failed - %s\n",
+-- 
+2.25.1
+
+
+From cf9e37604409ba0c3c5904af40beb2975c309ad4 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Fri, 27 May 2022 19:29:34 +1200
+Subject: [PATCH 74/99] CVE-2022-2031 lib:krb5_wrap: Generate valid error codes
+ in smb_krb5_mk_error()
+
+The error code passed in will be an offset from ERROR_TABLE_BASE_krb5,
+so we need to subtract that before creating the error. Heimdal does this
+internally, so it isn't needed there.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ lib/krb5_wrap/krb5_samba.c | 2 +-
+ selftest/knownfail_mit_kdc | 4 ++++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git lib/krb5_wrap/krb5_samba.c lib/krb5_wrap/krb5_samba.c
+index 76c2dcd2126..610efcc9b87 100644
+--- lib/krb5_wrap/krb5_samba.c
++++ lib/krb5_wrap/krb5_samba.c
+@@ -237,7 +237,7 @@ krb5_error_code smb_krb5_mk_error(krb5_context context,
+ 		return code;
+ 	}
+ 
+-	errpkt.error = error_code;
++	errpkt.error = error_code - ERROR_TABLE_BASE_krb5;
+ 
+ 	errpkt.text.length = 0;
+ 	if (e_text != NULL) {
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index f64291e776d..633bf79e8e0 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -579,9 +579,13 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ # Kpasswd tests
+ #
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_empty.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_seq_number.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+-- 
+2.25.1
+
+
+From cf749fac346ef59c91a9ea87f5e7ddec2e5649c7 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 18 May 2022 16:49:43 +1200
+Subject: [PATCH 75/99] CVE-2022-2031 s4:kpasswd: Return a kpasswd error code
+ in KRB-ERROR
+
+If we attempt to return an error code outside of Heimdal's allowed range
+[KRB5KDC_ERR_NONE, KRB5_ERR_RCSID), it will be replaced with a GENERIC
+error, and the error text will be set to the meaningless result of
+krb5_get_error_message(). Avoid this by ensuring the error code is in
+the correct range.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ selftest/knownfail_heimdal_kdc | 2 --
+ selftest/knownfail_mit_kdc     | 4 ----
+ source4/kdc/kpasswd-service.c  | 2 +-
+ 3 files changed, 1 insertion(+), 7 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 40e24f3155b..3b494baa658 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -276,9 +276,7 @@
+ #
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_empty.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_seq_number.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 633bf79e8e0..f64291e776d 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -579,13 +579,9 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ # Kpasswd tests
+ #
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_empty.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_seq_number.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+diff --git source4/kdc/kpasswd-service.c source4/kdc/kpasswd-service.c
+index a3c57a67dd1..b4706de1ad7 100644
+--- source4/kdc/kpasswd-service.c
++++ source4/kdc/kpasswd-service.c
+@@ -312,7 +312,7 @@ reply:
+ 		}
+ 
+ 		code = smb_krb5_mk_error(kdc->smb_krb5_context->krb5_context,
+-					 error_code,
++					 KRB5KDC_ERR_NONE + error_code,
+ 					 NULL, /* e_text */
+ 					 &k_dec_data,
+ 					 NULL, /* client */
+-- 
+2.25.1
+
+
+From 198256e2184897300e1cea4343437c3b7b6f74ad Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 18 May 2022 16:06:31 +1200
+Subject: [PATCH 76/99] CVE-2022-2031 gensec_krb5: Add helper function to check
+ if client sent an initial ticket
+
+This will be used in the kpasswd service to ensure that the client has
+an initial ticket to kadmin/changepw, and not a service ticket.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/auth/gensec/gensec_krb5.c          | 20 +-----
+ source4/auth/gensec/gensec_krb5_helpers.c  | 72 ++++++++++++++++++++++
+ source4/auth/gensec/gensec_krb5_helpers.h  | 32 ++++++++++
+ source4/auth/gensec/gensec_krb5_internal.h | 47 ++++++++++++++
+ source4/auth/gensec/wscript_build          |  4 ++
+ 5 files changed, 157 insertions(+), 18 deletions(-)
+ create mode 100644 source4/auth/gensec/gensec_krb5_helpers.c
+ create mode 100644 source4/auth/gensec/gensec_krb5_helpers.h
+ create mode 100644 source4/auth/gensec/gensec_krb5_internal.h
+
+diff --git source4/auth/gensec/gensec_krb5.c source4/auth/gensec/gensec_krb5.c
+index 7d87b3ac6b9..104e4639c44 100644
+--- source4/auth/gensec/gensec_krb5.c
++++ source4/auth/gensec/gensec_krb5.c
+@@ -44,27 +44,11 @@
+ #include "../lib/util/asn1.h"
+ #include "auth/kerberos/pac_utils.h"
+ #include "gensec_krb5.h"
++#include "gensec_krb5_internal.h"
++#include "gensec_krb5_helpers.h"
+ 
+ _PUBLIC_ NTSTATUS gensec_krb5_init(TALLOC_CTX *);
+ 
+-enum GENSEC_KRB5_STATE {
+-	GENSEC_KRB5_SERVER_START,
+-	GENSEC_KRB5_CLIENT_START,
+-	GENSEC_KRB5_CLIENT_MUTUAL_AUTH,
+-	GENSEC_KRB5_DONE
+-};
+-
+-struct gensec_krb5_state {
+-	enum GENSEC_KRB5_STATE state_position;
+-	struct smb_krb5_context *smb_krb5_context;
+-	krb5_auth_context auth_context;
+-	krb5_data enc_ticket;
+-	krb5_keyblock *keyblock;
+-	krb5_ticket *ticket;
+-	bool gssapi;
+-	krb5_flags ap_req_options;
+-};
+-
+ static int gensec_krb5_destroy(struct gensec_krb5_state *gensec_krb5_state)
+ {
+ 	if (!gensec_krb5_state->smb_krb5_context) {
+diff --git source4/auth/gensec/gensec_krb5_helpers.c source4/auth/gensec/gensec_krb5_helpers.c
+new file mode 100644
+index 00000000000..21f2f1e884e
+--- /dev/null
++++ source4/auth/gensec/gensec_krb5_helpers.c
+@@ -0,0 +1,72 @@
++/*
++   Unix SMB/CIFS implementation.
++
++   Kerberos backend for GENSEC
++
++   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
++   Copyright (C) Andrew Tridgell 2001
++   Copyright (C) Luke Howard 2002-2003
++   Copyright (C) Stefan Metzmacher 2004-2005
++
++   This program is free software; you can redistribute it and/or modify
++   it under the terms of the GNU General Public License as published by
++   the Free Software Foundation; either version 3 of the License, or
++   (at your option) any later version.
++
++   This program is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++   GNU General Public License for more details.
++
++
++   You should have received a copy of the GNU General Public License
++   along with this program.  If not, see <http://www.gnu.org/licenses/>.
++*/
++
++#include "includes.h"
++#include "auth/auth.h"
++#include "auth/gensec/gensec.h"
++#include "auth/gensec/gensec_internal.h"
++#include "gensec_krb5_internal.h"
++#include "gensec_krb5_helpers.h"
++#include "system/kerberos.h"
++#include "auth/kerberos/kerberos.h"
++
++static struct gensec_krb5_state *get_private_state(const struct gensec_security *gensec_security)
++{
++	struct gensec_krb5_state *gensec_krb5_state = NULL;
++
++	if (strcmp(gensec_security->ops->name, "krb5") != 0) {
++		/* We require that the krb5 mechanism is being used. */
++		return NULL;
++	}
++
++	gensec_krb5_state = talloc_get_type(gensec_security->private_data,
++					    struct gensec_krb5_state);
++	return gensec_krb5_state;
++}
++
++/*
++ * Returns 1 if our ticket has the initial flag set, 0 if not, and -1 in case of
++ * error.
++ */
++int gensec_krb5_initial_ticket(const struct gensec_security *gensec_security)
++{
++	struct gensec_krb5_state *gensec_krb5_state = NULL;
++
++	gensec_krb5_state = get_private_state(gensec_security);
++	if (gensec_krb5_state == NULL) {
++		return -1;
++	}
++
++	if (gensec_krb5_state->ticket == NULL) {
++		/* We don't have a ticket */
++		return -1;
++	}
++
++#ifdef SAMBA4_USES_HEIMDAL
++	return gensec_krb5_state->ticket->ticket.flags.initial;
++#else /* MIT KERBEROS */
++	return (gensec_krb5_state->ticket->enc_part2->flags & TKT_FLG_INITIAL) ? 1 : 0;
++#endif /* SAMBA4_USES_HEIMDAL */
++}
+diff --git source4/auth/gensec/gensec_krb5_helpers.h source4/auth/gensec/gensec_krb5_helpers.h
+new file mode 100644
+index 00000000000..d7b694dad0c
+--- /dev/null
++++ source4/auth/gensec/gensec_krb5_helpers.h
+@@ -0,0 +1,32 @@
++/*
++   Unix SMB/CIFS implementation.
++
++   Kerberos backend for GENSEC
++
++   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
++   Copyright (C) Andrew Tridgell 2001
++   Copyright (C) Luke Howard 2002-2003
++   Copyright (C) Stefan Metzmacher 2004-2005
++
++   This program is free software; you can redistribute it and/or modify
++   it under the terms of the GNU General Public License as published by
++   the Free Software Foundation; either version 3 of the License, or
++   (at your option) any later version.
++
++   This program is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++   GNU General Public License for more details.
++
++
++   You should have received a copy of the GNU General Public License
++   along with this program.  If not, see <http://www.gnu.org/licenses/>.
++*/
++
++struct gensec_security;
++
++/*
++ * Returns 1 if our ticket has the initial flag set, 0 if not, and -1 in case of
++ * error.
++ */
++int gensec_krb5_initial_ticket(const struct gensec_security *gensec_security);
+diff --git source4/auth/gensec/gensec_krb5_internal.h source4/auth/gensec/gensec_krb5_internal.h
+new file mode 100644
+index 00000000000..0bb796f1b2a
+--- /dev/null
++++ source4/auth/gensec/gensec_krb5_internal.h
+@@ -0,0 +1,47 @@
++/*
++   Unix SMB/CIFS implementation.
++
++   Kerberos backend for GENSEC
++
++   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
++   Copyright (C) Andrew Tridgell 2001
++   Copyright (C) Luke Howard 2002-2003
++   Copyright (C) Stefan Metzmacher 2004-2005
++
++   This program is free software; you can redistribute it and/or modify
++   it under the terms of the GNU General Public License as published by
++   the Free Software Foundation; either version 3 of the License, or
++   (at your option) any later version.
++
++   This program is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++   GNU General Public License for more details.
++
++
++   You should have received a copy of the GNU General Public License
++   along with this program.  If not, see <http://www.gnu.org/licenses/>.
++*/
++
++#include "includes.h"
++#include "auth/gensec/gensec.h"
++#include "system/kerberos.h"
++#include "auth/kerberos/kerberos.h"
++
++enum GENSEC_KRB5_STATE {
++	GENSEC_KRB5_SERVER_START,
++	GENSEC_KRB5_CLIENT_START,
++	GENSEC_KRB5_CLIENT_MUTUAL_AUTH,
++	GENSEC_KRB5_DONE
++};
++
++struct gensec_krb5_state {
++	enum GENSEC_KRB5_STATE state_position;
++	struct smb_krb5_context *smb_krb5_context;
++	krb5_auth_context auth_context;
++	krb5_data enc_ticket;
++	krb5_keyblock *keyblock;
++	krb5_ticket *ticket;
++	bool gssapi;
++	krb5_flags ap_req_options;
++};
+diff --git source4/auth/gensec/wscript_build source4/auth/gensec/wscript_build
+index d14a50ff273..20271f1665b 100644
+--- source4/auth/gensec/wscript_build
++++ source4/auth/gensec/wscript_build
+@@ -18,6 +18,10 @@ bld.SAMBA_MODULE('gensec_krb5',
+         enabled=bld.AD_DC_BUILD_IS_ENABLED()
+ 	)
+ 
++bld.SAMBA_SUBSYSTEM('gensec_krb5_helpers',
++    source='gensec_krb5_helpers.c',
++    deps='gensec_krb5',
++    enabled=bld.AD_DC_BUILD_IS_ENABLED())
+ 
+ bld.SAMBA_MODULE('gensec_gssapi',
+ 	source='gensec_gssapi.c',
+-- 
+2.25.1
+
+
+From 6c4fd575d706b2695090941ad7947b30abdb9071 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 18 May 2022 16:52:41 +1200
+Subject: [PATCH 77/99] CVE-2022-2031 s4:kpasswd: Require an initial ticket
+
+Ensure that for password changes the client uses an AS-REQ to get the
+ticket to kpasswd, and not a TGS-REQ.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Removed MIT KDC 1.20-specific knownfails]
+---
+ selftest/knownfail_heimdal_kdc        |  1 -
+ selftest/knownfail_mit_kdc            |  1 -
+ source4/kdc/kpasswd-service-heimdal.c | 17 +++++++++++++++++
+ source4/kdc/kpasswd-service-mit.c     | 17 +++++++++++++++++
+ source4/kdc/wscript_build             |  1 +
+ 5 files changed, 35 insertions(+), 2 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 3b494baa658..5cd8615f6a9 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -277,7 +277,6 @@
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index f64291e776d..46b0f1fa9ed 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -580,7 +580,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ #
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_non_initial.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+diff --git source4/kdc/kpasswd-service-heimdal.c source4/kdc/kpasswd-service-heimdal.c
+index c804852c3a7..1a6c2b60d03 100644
+--- source4/kdc/kpasswd-service-heimdal.c
++++ source4/kdc/kpasswd-service-heimdal.c
+@@ -24,6 +24,7 @@
+ #include "param/param.h"
+ #include "auth/auth.h"
+ #include "auth/gensec/gensec.h"
++#include "gensec_krb5_helpers.h"
+ #include "kdc/kdc-server.h"
+ #include "kdc/kpasswd_glue.h"
+ #include "kdc/kpasswd-service.h"
+@@ -31,6 +32,7 @@
+ 
+ static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
+ 					       TALLOC_CTX *mem_ctx,
++					       const struct gensec_security *gensec_security,
+ 					       struct auth_session_info *session_info,
+ 					       DATA_BLOB *password,
+ 					       DATA_BLOB *kpasswd_reply,
+@@ -42,6 +44,17 @@ static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
+ 	const char *reject_string = NULL;
+ 	struct samr_DomInfo1 *dominfo;
+ 	bool ok;
++	int ret;
++
++	/*
++	 * We're doing a password change (rather than a password set), so check
++	 * that we were given an initial ticket.
++	 */
++	ret = gensec_krb5_initial_ticket(gensec_security);
++	if (ret != 1) {
++		*error_string = "Expected an initial ticket";
++		return KRB5_KPASSWD_INITIAL_FLAG_NEEDED;
++	}
+ 
+ 	status = samdb_kpasswd_change_password(mem_ctx,
+ 					       kdc->task->lp_ctx,
+@@ -81,6 +94,7 @@ static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
+ 
+ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
+ 					    TALLOC_CTX *mem_ctx,
++					    const struct gensec_security *gensec_security,
+ 					    struct auth_session_info *session_info,
+ 					    DATA_BLOB *decoded_data,
+ 					    DATA_BLOB *kpasswd_reply,
+@@ -173,6 +187,7 @@ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
+ 		free_ChangePasswdDataMS(&chpw);
+ 		return kpasswd_change_password(kdc,
+ 					       mem_ctx,
++					       gensec_security,
+ 					       session_info,
+ 					       &password,
+ 					       kpasswd_reply,
+@@ -272,6 +287,7 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
+ 
+ 		return kpasswd_change_password(kdc,
+ 					       mem_ctx,
++					       gensec_security,
+ 					       session_info,
+ 					       &password,
+ 					       kpasswd_reply,
+@@ -280,6 +296,7 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
+ 	case KRB5_KPASSWD_VERS_SETPW: {
+ 		return kpasswd_set_password(kdc,
+ 					    mem_ctx,
++					    gensec_security,
+ 					    session_info,
+ 					    decoded_data,
+ 					    kpasswd_reply,
+diff --git source4/kdc/kpasswd-service-mit.c source4/kdc/kpasswd-service-mit.c
+index 9c4d2801669..de4c6f3f622 100644
+--- source4/kdc/kpasswd-service-mit.c
++++ source4/kdc/kpasswd-service-mit.c
+@@ -24,6 +24,7 @@
+ #include "param/param.h"
+ #include "auth/auth.h"
+ #include "auth/gensec/gensec.h"
++#include "gensec_krb5_helpers.h"
+ #include "kdc/kdc-server.h"
+ #include "kdc/kpasswd_glue.h"
+ #include "kdc/kpasswd-service.h"
+@@ -84,6 +85,7 @@ out:
+ 
+ static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
+ 					       TALLOC_CTX *mem_ctx,
++					       const struct gensec_security *gensec_security,
+ 					       struct auth_session_info *session_info,
+ 					       DATA_BLOB *password,
+ 					       DATA_BLOB *kpasswd_reply,
+@@ -95,6 +97,17 @@ static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
+ 	const char *reject_string = NULL;
+ 	struct samr_DomInfo1 *dominfo;
+ 	bool ok;
++	int ret;
++
++	/*
++	 * We're doing a password change (rather than a password set), so check
++	 * that we were given an initial ticket.
++	 */
++	ret = gensec_krb5_initial_ticket(gensec_security);
++	if (ret != 1) {
++		*error_string = "Expected an initial ticket";
++		return KRB5_KPASSWD_INITIAL_FLAG_NEEDED;
++	}
+ 
+ 	status = samdb_kpasswd_change_password(mem_ctx,
+ 					       kdc->task->lp_ctx,
+@@ -134,6 +147,7 @@ static krb5_error_code kpasswd_change_password(struct kdc_server *kdc,
+ 
+ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
+ 					    TALLOC_CTX *mem_ctx,
++					    const struct gensec_security *gensec_security,
+ 					    struct auth_session_info *session_info,
+ 					    DATA_BLOB *decoded_data,
+ 					    DATA_BLOB *kpasswd_reply,
+@@ -250,6 +264,7 @@ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
+ 
+ 		return kpasswd_change_password(kdc,
+ 					       mem_ctx,
++					       gensec_security,
+ 					       session_info,
+ 					       &password,
+ 					       kpasswd_reply,
+@@ -350,6 +365,7 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
+ 
+ 		return kpasswd_change_password(kdc,
+ 					       mem_ctx,
++					       gensec_security,
+ 					       session_info,
+ 					       &password,
+ 					       kpasswd_reply,
+@@ -358,6 +374,7 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
+ 	case RFC3244_VERSION: {
+ 		return kpasswd_set_password(kdc,
+ 					    mem_ctx,
++					    gensec_security,
+ 					    session_info,
+ 					    decoded_data,
+ 					    kpasswd_reply,
+diff --git source4/kdc/wscript_build source4/kdc/wscript_build
+index 0edca94e75f..13ba3947cf6 100644
+--- source4/kdc/wscript_build
++++ source4/kdc/wscript_build
+@@ -88,6 +88,7 @@ bld.SAMBA_SUBSYSTEM('KPASSWD-SERVICE',
+                          krb5samba
+                          samba_server_gensec
+                          KPASSWD_GLUE
++                         gensec_krb5_helpers
+                          ''')
+ 
+ bld.SAMBA_SUBSYSTEM('KDC-GLUE',
+-- 
+2.25.1
+
+
+From 69e742e6208bd471eb509795bd753a0c98392bf6 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 18 May 2022 17:11:49 +1200
+Subject: [PATCH 78/99] s4:kpasswd: Restructure code for clarity
+
+View with 'git show -b'.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/kdc/kpasswd-service-heimdal.c | 46 +++++++++++++--------------
+ 1 file changed, 22 insertions(+), 24 deletions(-)
+
+diff --git source4/kdc/kpasswd-service-heimdal.c source4/kdc/kpasswd-service-heimdal.c
+index 1a6c2b60d03..a0352d1ad35 100644
+--- source4/kdc/kpasswd-service-heimdal.c
++++ source4/kdc/kpasswd-service-heimdal.c
+@@ -160,30 +160,7 @@ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
+ 		return 0;
+ 	}
+ 
+-	if (chpw.targname != NULL && chpw.targrealm != NULL) {
+-		code = krb5_build_principal_ext(context,
+-					       &target_principal,
+-					       strlen(*chpw.targrealm),
+-					       *chpw.targrealm,
+-					       0);
+-		if (code != 0) {
+-			free_ChangePasswdDataMS(&chpw);
+-			return kpasswd_make_error_reply(mem_ctx,
+-							KRB5_KPASSWD_MALFORMED,
+-							"Failed to parse principal",
+-							kpasswd_reply);
+-		}
+-		code = copy_PrincipalName(chpw.targname,
+-					  &target_principal->name);
+-		if (code != 0) {
+-			free_ChangePasswdDataMS(&chpw);
+-			krb5_free_principal(context, target_principal);
+-			return kpasswd_make_error_reply(mem_ctx,
+-							KRB5_KPASSWD_MALFORMED,
+-							"Failed to parse principal",
+-							kpasswd_reply);
+-		}
+-	} else {
++	if (chpw.targname == NULL || chpw.targrealm == NULL) {
+ 		free_ChangePasswdDataMS(&chpw);
+ 		return kpasswd_change_password(kdc,
+ 					       mem_ctx,
+@@ -193,7 +170,28 @@ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
+ 					       kpasswd_reply,
+ 					       error_string);
+ 	}
++	code = krb5_build_principal_ext(context,
++					&target_principal,
++					strlen(*chpw.targrealm),
++					*chpw.targrealm,
++					0);
++	if (code != 0) {
++		free_ChangePasswdDataMS(&chpw);
++		return kpasswd_make_error_reply(mem_ctx,
++						KRB5_KPASSWD_MALFORMED,
++						"Failed to parse principal",
++						kpasswd_reply);
++	}
++	code = copy_PrincipalName(chpw.targname,
++				  &target_principal->name);
+ 	free_ChangePasswdDataMS(&chpw);
++	if (code != 0) {
++		krb5_free_principal(context, target_principal);
++		return kpasswd_make_error_reply(mem_ctx,
++						KRB5_KPASSWD_MALFORMED,
++						"Failed to parse principal",
++						kpasswd_reply);
++	}
+ 
+ 	if (target_principal->name.name_string.len >= 2) {
+ 		is_service_principal = true;
+-- 
+2.25.1
+
+
+From b5adf7cc6d740c8f4f7b5888f106de24a1181da7 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Tue, 24 May 2022 10:17:00 +0200
+Subject: [PATCH 79/99] CVE-2022-2031 testprogs: Fix auth with smbclient and
+ krb5 ccache
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+
+[jsutton@samba.org Fixed conflict and renamed --use-krb5-ccache to
+ --krb5-ccache]
+---
+ testprogs/blackbox/test_kpasswd_heimdal.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git testprogs/blackbox/test_kpasswd_heimdal.sh testprogs/blackbox/test_kpasswd_heimdal.sh
+index 7351ce022d1..1e895daa162 100755
+--- testprogs/blackbox/test_kpasswd_heimdal.sh
++++ testprogs/blackbox/test_kpasswd_heimdal.sh
+@@ -72,7 +72,7 @@ testit "kinit with user password" \
+ 	do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
+ 
+ test_smbclient "Test login with user kerberos ccache" \
+-	"ls" "$SMB_UNC" -k yes || failed=`expr $failed + 1`
++	"ls" "$SMB_UNC" --krb5-ccache=${KRB5CCNAME} || failed=`expr $failed + 1`
+ 
+ testit "change user password with 'samba-tool user password' (unforced)" \
+ 	$VALGRIND $PYTHON $samba_tool user password -W$DOMAIN -U$TEST_USERNAME%$TEST_PASSWORD -k no --newpassword=$TEST_PASSWORD_NEW || failed=`expr $failed + 1`
+@@ -85,7 +85,7 @@ testit "kinit with user password" \
+ 	do_kinit $TEST_PRINCIPAL $TEST_PASSWORD || failed=`expr $failed + 1`
+ 
+ test_smbclient "Test login with user kerberos ccache" \
+-	"ls" "$SMB_UNC" -k yes || failed=`expr $failed + 1`
++	"ls" "$SMB_UNC" --krb5-ccache=${KRB5CCNAME} || failed=`expr $failed + 1`
+ 
+ ###########################################################
+ ### check that a short password is rejected
+-- 
+2.25.1
+
+
+From 91a1b0955a053f73e6d531f0f12eaa604aca79d7 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Thu, 19 May 2022 16:35:28 +0200
+Subject: [PATCH 80/99] CVE-2022-2031 testprogs: Add kadmin/changepw
+ canonicalization test with MIT kpasswd
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+---
+ selftest/knownfail.d/kadmin_changepw       |  1 +
+ testprogs/blackbox/test_kpasswd_heimdal.sh | 35 +++++++++++++++++++++-
+ 2 files changed, 35 insertions(+), 1 deletion(-)
+ create mode 100644 selftest/knownfail.d/kadmin_changepw
+
+diff --git selftest/knownfail.d/kadmin_changepw selftest/knownfail.d/kadmin_changepw
+new file mode 100644
+index 00000000000..97c14793ea5
+--- /dev/null
++++ selftest/knownfail.d/kadmin_changepw
+@@ -0,0 +1 @@
++^samba4.blackbox.kpasswd.MIT kpasswd.change.user.password
+diff --git testprogs/blackbox/test_kpasswd_heimdal.sh testprogs/blackbox/test_kpasswd_heimdal.sh
+index 1e895daa162..059b7a8e4d1 100755
+--- testprogs/blackbox/test_kpasswd_heimdal.sh
++++ testprogs/blackbox/test_kpasswd_heimdal.sh
+@@ -7,7 +7,7 @@
+ 
+ if [ $# -lt 6 ]; then
+ cat <<EOF
+-Usage: test_passwords.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX SMBCLIENT
++Usage: test_kpasswd_heimdal.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX SMBCLIENT
+ EOF
+ exit 1;
+ fi
+@@ -27,6 +27,8 @@ smbclient="$samba_bindir/smbclient"
+ samba_kinit=$samba_bindir/samba4kinit
+ samba_kpasswd=$samba_bindir/samba4kpasswd
+ 
++mit_kpasswd="$(command -v kpasswd)"
++
+ samba_tool="$samba_bindir/samba-tool"
+ net_tool="$samba_bindir/net"
+ texpect="$samba_bindir/texpect"
+@@ -142,6 +144,37 @@ testit "kpasswd change user password" \
+ TEST_PASSWORD=$TEST_PASSWORD_NEW
+ TEST_PASSWORD_NEW="testPaSS@03%"
+ 
++###########################################################
++### CVE-2022-XXXXX
++###########################################################
++
++if [ -n "${mit_kpasswd}" ]; then
++	cat > "${PREFIX}/tmpkpasswdscript" <<EOF
++expect Password for ${TEST_PRINCIPAL}
++password ${TEST_PASSWORD}\n
++expect Enter new password
++send ${TEST_PASSWORD_NEW}\n
++expect Enter it again
++send ${TEST_PASSWORD_NEW}\n
++expect Password changed.
++EOF
++
++	SAVE_KRB5_CONFIG="${KRB5_CONFIG}"
++	KRB5_CONFIG="${PREFIX}/tmpkrb5.conf"
++	export KRB5_CONFIG
++	sed -e 's/\[libdefaults\]/[libdefaults]\n canonicalize = yes/' \
++		"${SAVE_KRB5_CONFIG}" > "${KRB5_CONFIG}"
++	testit "MIT kpasswd change user password" \
++		"${texpect}" "${PREFIX}/tmpkpasswdscript" "${mit_kpasswd}" \
++		"${TEST_PRINCIPAL}" ||
++		failed=$((failed + 1))
++	KRB5_CONFIG="${SAVE_KRB5_CONFIG}"
++	export KRB5_CONFIG
++fi
++
++TEST_PASSWORD="${TEST_PASSWORD_NEW}"
++TEST_PASSWORD_NEW="testPaSS@03force%"
++
+ ###########################################################
+ ### Force password change at login
+ ###########################################################
+-- 
+2.25.1
+
+
+From 36d94ffb9c99f3e515024424020e3e03e98f34f5 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Tue, 24 May 2022 09:54:18 +0200
+Subject: [PATCH 81/99] CVE-2022-2031 s4:kdc: Implement is_kadmin_changepw()
+ helper function
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+
+[jsutton@samba.org Adapted entry to entry_ex->entry]
+---
+ source4/kdc/db-glue.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git source4/kdc/db-glue.c source4/kdc/db-glue.c
+index 5752ffb821c..45159e6e64d 100644
+--- source4/kdc/db-glue.c
++++ source4/kdc/db-glue.c
+@@ -816,6 +816,14 @@ static int principal_comp_strcmp(krb5_context context,
+ 					 component, string, false);
+ }
+ 
++static bool is_kadmin_changepw(krb5_context context,
++			       krb5_const_principal principal)
++{
++	return krb5_princ_size(context, principal) == 2 &&
++		(principal_comp_strcmp(context, principal, 0, "kadmin") == 0) &&
++		(principal_comp_strcmp(context, principal, 1, "changepw") == 0);
++}
++
+ /*
+  * Construct an hdb_entry from a directory entry.
+  */
+@@ -1110,11 +1118,9 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
+ 		 * 'change password', as otherwise we could get into
+ 		 * trouble, and not enforce the password expirty.
+ 		 * Instead, only do it when request is for the kpasswd service */
+-		if (ent_type == SAMBA_KDC_ENT_TYPE_SERVER
+-		    && krb5_princ_size(context, principal) == 2
+-		    && (principal_comp_strcmp(context, principal, 0, "kadmin") == 0)
+-		    && (principal_comp_strcmp(context, principal, 1, "changepw") == 0)
+-		    && lpcfg_is_my_domain_or_realm(lp_ctx, realm)) {
++		if (ent_type == SAMBA_KDC_ENT_TYPE_SERVER &&
++		    is_kadmin_changepw(context, principal) &&
++		    lpcfg_is_my_domain_or_realm(lp_ctx, realm)) {
+ 			entry_ex->entry.flags.change_pw = 1;
+ 		}
+ 
+-- 
+2.25.1
+
+
+From f68877af829bf73da8e965c9458a9846d1757038 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 18 May 2022 16:56:01 +1200
+Subject: [PATCH 82/99] CVE-2022-2031 s4:kdc: Split out a
+ samba_kdc_get_entry_principal() function
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Adapted entry to entry_ex->entry]
+
+[jsutton@samba.org Fixed conflicts caused by superfluous whitespace]
+---
+ source4/kdc/db-glue.c | 192 +++++++++++++++++++++++-------------------
+ 1 file changed, 107 insertions(+), 85 deletions(-)
+
+diff --git source4/kdc/db-glue.c source4/kdc/db-glue.c
+index 45159e6e64d..ac0c206b5c1 100644
+--- source4/kdc/db-glue.c
++++ source4/kdc/db-glue.c
+@@ -824,6 +824,101 @@ static bool is_kadmin_changepw(krb5_context context,
+ 		(principal_comp_strcmp(context, principal, 1, "changepw") == 0);
+ }
+ 
++static krb5_error_code samba_kdc_get_entry_principal(
++		krb5_context context,
++		struct samba_kdc_db_context *kdc_db_ctx,
++		const char *samAccountName,
++		enum samba_kdc_ent_type ent_type,
++		unsigned flags,
++		krb5_const_principal in_princ,
++		krb5_principal *out_princ)
++{
++	struct loadparm_context *lp_ctx = kdc_db_ctx->lp_ctx;
++	krb5_error_code ret = 0;
++
++	/*
++	 * If we are set to canonicalize, we get back the fixed UPPER
++	 * case realm, and the real username (ie matching LDAP
++	 * samAccountName)
++	 *
++	 * Otherwise, if we are set to enterprise, we
++	 * get back the whole principal as-sent
++	 *
++	 * Finally, if we are not set to canonicalize, we get back the
++	 * fixed UPPER case realm, but the as-sent username
++	 */
++
++	if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) {
++		if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) {
++			/*
++			 * When requested to do so, ensure that the
++			 * both realm values in the principal are set
++			 * to the upper case, canonical realm
++			 */
++			ret = smb_krb5_make_principal(context, out_princ,
++						      lpcfg_realm(lp_ctx), "krbtgt",
++						      lpcfg_realm(lp_ctx), NULL);
++			if (ret) {
++				return ret;
++			}
++			smb_krb5_principal_set_type(context, *out_princ, KRB5_NT_SRV_INST);
++		} else {
++			ret = krb5_copy_principal(context, in_princ, out_princ);
++			if (ret) {
++				return ret;
++			}
++			/*
++			 * this appears to be required regardless of
++			 * the canonicalize flag from the client
++			 */
++			ret = smb_krb5_principal_set_realm(context, *out_princ, lpcfg_realm(lp_ctx));
++			if (ret) {
++				return ret;
++			}
++		}
++
++	} else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && in_princ == NULL) {
++		ret = smb_krb5_make_principal(context, out_princ, lpcfg_realm(lp_ctx), samAccountName, NULL);
++		if (ret) {
++			return ret;
++		}
++	} else if ((flags & SDB_F_FORCE_CANON) ||
++		   ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ))) {
++		/*
++		 * SDB_F_CANON maps from the canonicalize flag in the
++		 * packet, and has a different meaning between AS-REQ
++		 * and TGS-REQ.  We only change the principal in the AS-REQ case
++		 *
++		 * The SDB_F_FORCE_CANON if for new MIT KDC code that wants
++		 * the canonical name in all lookups, and takes care to
++		 * canonicalize only when appropriate.
++		 */
++		ret = smb_krb5_make_principal(context, out_princ, lpcfg_realm(lp_ctx), samAccountName, NULL);
++		if (ret) {
++			return ret;
++		}
++	} else {
++		ret = krb5_copy_principal(context, in_princ, out_princ);
++		if (ret) {
++			return ret;
++		}
++
++		/* While we have copied the client principal, tests
++		 * show that Win2k3 returns the 'corrected' realm, not
++		 * the client-specified realm.  This code attempts to
++		 * replace the client principal's realm with the one
++		 * we determine from our records */
++
++		/* this has to be with malloc() */
++		ret = smb_krb5_principal_set_realm(context, *out_princ, lpcfg_realm(lp_ctx));
++		if (ret) {
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
+ /*
+  * Construct an hdb_entry from a directory entry.
+  */
+@@ -913,93 +1008,8 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
+ 		userAccountControl |= msDS_User_Account_Control_Computed;
+ 	}
+ 
+-	/* 
+-	 * If we are set to canonicalize, we get back the fixed UPPER
+-	 * case realm, and the real username (ie matching LDAP
+-	 * samAccountName) 
+-	 *
+-	 * Otherwise, if we are set to enterprise, we
+-	 * get back the whole principal as-sent 
+-	 *
+-	 * Finally, if we are not set to canonicalize, we get back the
+-	 * fixed UPPER case realm, but the as-sent username
+-	 */
+-
+ 	if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) {
+ 		p->is_krbtgt = true;
+-
+-		if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) {
+-			/*
+-			 * When requested to do so, ensure that the
+-			 * both realm values in the principal are set
+-			 * to the upper case, canonical realm
+-			 */
+-			ret = smb_krb5_make_principal(context, &entry_ex->entry.principal,
+-						      lpcfg_realm(lp_ctx), "krbtgt",
+-						      lpcfg_realm(lp_ctx), NULL);
+-			if (ret) {
+-				krb5_clear_error_message(context);
+-				goto out;
+-			}
+-			smb_krb5_principal_set_type(context, entry_ex->entry.principal, KRB5_NT_SRV_INST);
+-		} else {
+-			ret = krb5_copy_principal(context, principal, &entry_ex->entry.principal);
+-			if (ret) {
+-				krb5_clear_error_message(context);
+-				goto out;
+-			}
+-			/*
+-			 * this appears to be required regardless of
+-			 * the canonicalize flag from the client
+-			 */
+-			ret = smb_krb5_principal_set_realm(context, entry_ex->entry.principal, lpcfg_realm(lp_ctx));
+-			if (ret) {
+-				krb5_clear_error_message(context);
+-				goto out;
+-			}
+-		}
+-
+-	} else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) {
+-		ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);
+-		if (ret) {
+-			krb5_clear_error_message(context);
+-			goto out;
+-		}
+-	} else if ((flags & SDB_F_FORCE_CANON) ||
+-		   ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ))) {
+-		/*
+-		 * SDB_F_CANON maps from the canonicalize flag in the
+-		 * packet, and has a different meaning between AS-REQ
+-		 * and TGS-REQ.  We only change the principal in the AS-REQ case
+-		 *
+-		 * The SDB_F_FORCE_CANON if for new MIT KDC code that wants
+-		 * the canonical name in all lookups, and takes care to
+-		 * canonicalize only when appropriate.
+-		 */
+-		ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);
+-		if (ret) {
+-			krb5_clear_error_message(context);
+-			goto out;
+-		}
+-	} else {
+-		ret = krb5_copy_principal(context, principal, &entry_ex->entry.principal);
+-		if (ret) {
+-			krb5_clear_error_message(context);
+-			goto out;
+-		}
+-
+-		/* While we have copied the client principal, tests
+-		 * show that Win2k3 returns the 'corrected' realm, not
+-		 * the client-specified realm.  This code attempts to
+-		 * replace the client principal's realm with the one
+-		 * we determine from our records */
+-
+-		/* this has to be with malloc() */
+-		ret = smb_krb5_principal_set_realm(context, entry_ex->entry.principal, lpcfg_realm(lp_ctx));
+-		if (ret) {
+-			krb5_clear_error_message(context);
+-			goto out;
+-		}
+ 	}
+ 
+ 	/* First try and figure out the flags based on the userAccountControl */
+@@ -1185,6 +1195,18 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
+ 		}
+ 	}
+ 
++	ret = samba_kdc_get_entry_principal(context,
++					    kdc_db_ctx,
++					    samAccountName,
++					    ent_type,
++					    flags,
++					    principal,
++					    &entry_ex->entry.principal);
++	if (ret != 0) {
++		krb5_clear_error_message(context);
++		goto out;
++	}
++
+ 	entry_ex->entry.valid_start = NULL;
+ 
+ 	entry_ex->entry.max_life = malloc(sizeof(*entry_ex->entry.max_life));
+-- 
+2.25.1
+
+
+From fa4742e1b9dea0b9c379f00666478bd41c021634 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 25 May 2022 17:19:58 +1200
+Subject: [PATCH 83/99] CVE-2022-2031 s4:kdc: Refactor
+ samba_kdc_get_entry_principal()
+
+This eliminates some duplicate branches.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Pair-Programmed-With: Andreas Schneider <asn@samba.org>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/kdc/db-glue.c | 116 ++++++++++++++++++++----------------------
+ 1 file changed, 55 insertions(+), 61 deletions(-)
+
+diff --git source4/kdc/db-glue.c source4/kdc/db-glue.c
+index ac0c206b5c1..385c118a073 100644
+--- source4/kdc/db-glue.c
++++ source4/kdc/db-glue.c
+@@ -834,7 +834,8 @@ static krb5_error_code samba_kdc_get_entry_principal(
+ 		krb5_principal *out_princ)
+ {
+ 	struct loadparm_context *lp_ctx = kdc_db_ctx->lp_ctx;
+-	krb5_error_code ret = 0;
++	krb5_error_code code = 0;
++	bool canon = flags & (SDB_F_CANON|SDB_F_FORCE_CANON);
+ 
+ 	/*
+ 	 * If we are set to canonicalize, we get back the fixed UPPER
+@@ -848,75 +849,68 @@ static krb5_error_code samba_kdc_get_entry_principal(
+ 	 * fixed UPPER case realm, but the as-sent username
+ 	 */
+ 
+-	if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) {
+-		if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) {
+-			/*
+-			 * When requested to do so, ensure that the
+-			 * both realm values in the principal are set
+-			 * to the upper case, canonical realm
+-			 */
+-			ret = smb_krb5_make_principal(context, out_princ,
+-						      lpcfg_realm(lp_ctx), "krbtgt",
+-						      lpcfg_realm(lp_ctx), NULL);
+-			if (ret) {
+-				return ret;
+-			}
+-			smb_krb5_principal_set_type(context, *out_princ, KRB5_NT_SRV_INST);
+-		} else {
+-			ret = krb5_copy_principal(context, in_princ, out_princ);
+-			if (ret) {
+-				return ret;
+-			}
+-			/*
+-			 * this appears to be required regardless of
+-			 * the canonicalize flag from the client
+-			 */
+-			ret = smb_krb5_principal_set_realm(context, *out_princ, lpcfg_realm(lp_ctx));
+-			if (ret) {
+-				return ret;
+-			}
+-		}
++	if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT && canon) {
++		/*
++		 * When requested to do so, ensure that the
++		 * both realm values in the principal are set
++		 * to the upper case, canonical realm
++		 */
++		code = smb_krb5_make_principal(context,
++					       out_princ,
++					       lpcfg_realm(lp_ctx),
++					       "krbtgt",
++					       lpcfg_realm(lp_ctx),
++					       NULL);
++		if (code != 0) {
++			return code;
++		}
++		smb_krb5_principal_set_type(context,
++					    *out_princ,
++					    KRB5_NT_SRV_INST);
+ 
+-	} else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && in_princ == NULL) {
+-		ret = smb_krb5_make_principal(context, out_princ, lpcfg_realm(lp_ctx), samAccountName, NULL);
+-		if (ret) {
+-			return ret;
+-		}
+-	} else if ((flags & SDB_F_FORCE_CANON) ||
+-		   ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ))) {
++		return 0;
++	}
++
++	if ((canon && flags & (SDB_F_FORCE_CANON|SDB_F_FOR_AS_REQ)) ||
++	    (ent_type == SAMBA_KDC_ENT_TYPE_ANY && in_princ == NULL)) {
+ 		/*
+ 		 * SDB_F_CANON maps from the canonicalize flag in the
+ 		 * packet, and has a different meaning between AS-REQ
+-		 * and TGS-REQ.  We only change the principal in the AS-REQ case
++		 * and TGS-REQ.  We only change the principal in the
++		 * AS-REQ case.
+ 		 *
+-		 * The SDB_F_FORCE_CANON if for new MIT KDC code that wants
+-		 * the canonical name in all lookups, and takes care to
+-		 * canonicalize only when appropriate.
++		 * The SDB_F_FORCE_CANON if for new MIT KDC code that
++		 * wants the canonical name in all lookups, and takes
++		 * care to canonicalize only when appropriate.
+ 		 */
+-		ret = smb_krb5_make_principal(context, out_princ, lpcfg_realm(lp_ctx), samAccountName, NULL);
+-		if (ret) {
+-			return ret;
+-		}
+-	} else {
+-		ret = krb5_copy_principal(context, in_princ, out_princ);
+-		if (ret) {
+-			return ret;
+-		}
+-
+-		/* While we have copied the client principal, tests
+-		 * show that Win2k3 returns the 'corrected' realm, not
+-		 * the client-specified realm.  This code attempts to
+-		 * replace the client principal's realm with the one
+-		 * we determine from our records */
++		code = smb_krb5_make_principal(context,
++					      out_princ,
++					      lpcfg_realm(lp_ctx),
++					      samAccountName,
++					      NULL);
++		return code;
++	}
+ 
+-		/* this has to be with malloc() */
+-		ret = smb_krb5_principal_set_realm(context, *out_princ, lpcfg_realm(lp_ctx));
+-		if (ret) {
+-			return ret;
+-		}
++	/*
++	 * For a krbtgt entry, this appears to be required regardless of the
++	 * canonicalize flag from the client.
++	 */
++	code = krb5_copy_principal(context, in_princ, out_princ);
++	if (code != 0) {
++		return code;
+ 	}
+ 
+-	return 0;
++	/*
++	 * While we have copied the client principal, tests show that Win2k3
++	 * returns the 'corrected' realm, not the client-specified realm.  This
++	 * code attempts to replace the client principal's realm with the one
++	 * we determine from our records
++	 */
++	code = smb_krb5_principal_set_realm(context,
++					    *out_princ,
++					    lpcfg_realm(lp_ctx));
++
++	return code;
+ }
+ 
+ /*
+-- 
+2.25.1
+
+
+From 3cab62893668742781551dae6505558e47cf08b5 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 18 May 2022 16:56:01 +1200
+Subject: [PATCH 84/99] CVE-2022-2031 s4:kdc: Fix canonicalisation of
+ kadmin/changepw principal
+
+Since this principal goes through the samba_kdc_fetch_server() path,
+setting the canonicalisation flag would cause the principal to be
+replaced with the sAMAccountName; this meant requests to
+kadmin/changepw@REALM would result in a ticket to krbtgt@REALM. Now we
+properly handle canonicalisation for the kadmin/changepw principal.
+
+View with 'git show -b'.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Pair-Programmed-With: Andreas Schneider <asn@samba.org>
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Adapted entry to entry_ex->entry; removed MIT KDC
+ 1.20-specific knownfails]
+---
+ selftest/knownfail.d/kadmin_changepw |  1 -
+ selftest/knownfail_heimdal_kdc       |  2 -
+ source4/kdc/db-glue.c                | 84 +++++++++++++++-------------
+ 3 files changed, 46 insertions(+), 41 deletions(-)
+ delete mode 100644 selftest/knownfail.d/kadmin_changepw
+
+diff --git selftest/knownfail.d/kadmin_changepw selftest/knownfail.d/kadmin_changepw
+deleted file mode 100644
+index 97c14793ea5..00000000000
+--- selftest/knownfail.d/kadmin_changepw
++++ /dev/null
+@@ -1 +0,0 @@
+-^samba4.blackbox.kpasswd.MIT kpasswd.change.user.password
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 5cd8615f6a9..49ab29f115d 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -274,8 +274,6 @@
+ #
+ # Kpasswd tests
+ #
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+diff --git source4/kdc/db-glue.c source4/kdc/db-glue.c
+index 385c118a073..d2d7136608e 100644
+--- source4/kdc/db-glue.c
++++ source4/kdc/db-glue.c
+@@ -830,6 +830,7 @@ static krb5_error_code samba_kdc_get_entry_principal(
+ 		const char *samAccountName,
+ 		enum samba_kdc_ent_type ent_type,
+ 		unsigned flags,
++		bool is_kadmin_changepw,
+ 		krb5_const_principal in_princ,
+ 		krb5_principal *out_princ)
+ {
+@@ -849,46 +850,52 @@ static krb5_error_code samba_kdc_get_entry_principal(
+ 	 * fixed UPPER case realm, but the as-sent username
+ 	 */
+ 
+-	if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT && canon) {
+-		/*
+-		 * When requested to do so, ensure that the
+-		 * both realm values in the principal are set
+-		 * to the upper case, canonical realm
+-		 */
+-		code = smb_krb5_make_principal(context,
+-					       out_princ,
+-					       lpcfg_realm(lp_ctx),
+-					       "krbtgt",
+-					       lpcfg_realm(lp_ctx),
+-					       NULL);
+-		if (code != 0) {
+-			return code;
+-		}
+-		smb_krb5_principal_set_type(context,
+-					    *out_princ,
+-					    KRB5_NT_SRV_INST);
++	/*
++	 * We need to ensure that the kadmin/changepw principal isn't able to
++	 * issue krbtgt tickets, even if canonicalization is turned on.
++	 */
++	if (!is_kadmin_changepw) {
++		if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT && canon) {
++			/*
++			 * When requested to do so, ensure that the
++			 * both realm values in the principal are set
++			 * to the upper case, canonical realm
++			 */
++			code = smb_krb5_make_principal(context,
++						       out_princ,
++						       lpcfg_realm(lp_ctx),
++						       "krbtgt",
++						       lpcfg_realm(lp_ctx),
++						       NULL);
++			if (code != 0) {
++				return code;
++			}
++			smb_krb5_principal_set_type(context,
++						    *out_princ,
++						    KRB5_NT_SRV_INST);
+ 
+-		return 0;
+-	}
++			return 0;
++		}
+ 
+-	if ((canon && flags & (SDB_F_FORCE_CANON|SDB_F_FOR_AS_REQ)) ||
+-	    (ent_type == SAMBA_KDC_ENT_TYPE_ANY && in_princ == NULL)) {
+-		/*
+-		 * SDB_F_CANON maps from the canonicalize flag in the
+-		 * packet, and has a different meaning between AS-REQ
+-		 * and TGS-REQ.  We only change the principal in the
+-		 * AS-REQ case.
+-		 *
+-		 * The SDB_F_FORCE_CANON if for new MIT KDC code that
+-		 * wants the canonical name in all lookups, and takes
+-		 * care to canonicalize only when appropriate.
+-		 */
+-		code = smb_krb5_make_principal(context,
+-					      out_princ,
+-					      lpcfg_realm(lp_ctx),
+-					      samAccountName,
+-					      NULL);
+-		return code;
++		if ((canon && flags & (SDB_F_FORCE_CANON|SDB_F_FOR_AS_REQ)) ||
++		    (ent_type == SAMBA_KDC_ENT_TYPE_ANY && in_princ == NULL)) {
++			/*
++			 * SDB_F_CANON maps from the canonicalize flag in the
++			 * packet, and has a different meaning between AS-REQ
++			 * and TGS-REQ.  We only change the principal in the
++			 * AS-REQ case.
++			 *
++			 * The SDB_F_FORCE_CANON if for new MIT KDC code that
++			 * wants the canonical name in all lookups, and takes
++			 * care to canonicalize only when appropriate.
++			 */
++			code = smb_krb5_make_principal(context,
++						      out_princ,
++						      lpcfg_realm(lp_ctx),
++						      samAccountName,
++						      NULL);
++			return code;
++		}
+ 	}
+ 
+ 	/*
+@@ -1194,6 +1201,7 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
+ 					    samAccountName,
+ 					    ent_type,
+ 					    flags,
++					    entry_ex->entry.flags.change_pw,
+ 					    principal,
+ 					    &entry_ex->entry.principal);
+ 	if (ret != 0) {
+-- 
+2.25.1
+
+
+From 531e7b596d35785bee61f3b4289e38ece1530f94 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 24 May 2022 17:53:49 +1200
+Subject: [PATCH 85/99] CVE-2022-2031 s4:kdc: Limit kpasswd ticket lifetime to
+ two minutes or less
+
+This matches the behaviour of Windows.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Adapted entry to entry_ex->entry; included
+ samba_kdc.h header file]
+
+[jsutton@samba.org Fixed conflicts]
+---
+ selftest/knownfail_heimdal_kdc             | 1 -
+ selftest/knownfail_mit_kdc                 | 1 -
+ source4/kdc/db-glue.c                      | 5 +++++
+ source4/kdc/mit-kdb/kdb_samba_principals.c | 2 +-
+ source4/kdc/samba_kdc.h                    | 2 ++
+ 5 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 49ab29f115d..387ccea3ba7 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -275,7 +275,6 @@
+ # Kpasswd tests
+ #
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 46b0f1fa9ed..c2a31b4a140 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -580,7 +580,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ #
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_lifetime.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+diff --git source4/kdc/db-glue.c source4/kdc/db-glue.c
+index d2d7136608e..073ec83c8cf 100644
+--- source4/kdc/db-glue.c
++++ source4/kdc/db-glue.c
+@@ -1226,6 +1226,11 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
+ 					        kdc_db_ctx->policy.usr_tkt_lifetime);
+ 	}
+ 
++	if (entry_ex->entry.flags.change_pw) {
++		/* Limit lifetime of kpasswd tickets to two minutes or less. */
++		*entry_ex->entry.max_life = MIN(*entry_ex->entry.max_life, CHANGEPW_LIFETIME);
++	}
++
+ 	entry_ex->entry.max_renew = malloc(sizeof(*entry_ex->entry.max_life));
+ 	if (entry_ex->entry.max_renew == NULL) {
+ 		ret = ENOMEM;
+diff --git source4/kdc/mit-kdb/kdb_samba_principals.c source4/kdc/mit-kdb/kdb_samba_principals.c
+index cc67c2392be..2059ffa855e 100644
+--- source4/kdc/mit-kdb/kdb_samba_principals.c
++++ source4/kdc/mit-kdb/kdb_samba_principals.c
+@@ -27,11 +27,11 @@
+ #include <profile.h>
+ #include <kdb.h>
+ 
++#include "kdc/samba_kdc.h"
+ #include "kdc/mit_samba.h"
+ #include "kdb_samba.h"
+ 
+ #define ADMIN_LIFETIME 60*60*3 /* 3 hours */
+-#define CHANGEPW_LIFETIME 60*5 /* 5 minutes */
+ 
+ krb5_error_code ks_get_principal(krb5_context context,
+ 				 krb5_const_principal principal,
+diff --git source4/kdc/samba_kdc.h source4/kdc/samba_kdc.h
+index e228a82ce6a..8010d7c35ed 100644
+--- source4/kdc/samba_kdc.h
++++ source4/kdc/samba_kdc.h
+@@ -62,4 +62,6 @@ struct samba_kdc_entry {
+ 
+ extern struct hdb_method hdb_samba4_interface;
+ 
++#define CHANGEPW_LIFETIME 60*2 /* 2 minutes */
++
+ #endif /* _SAMBA_KDC_H_ */
+-- 
+2.25.1
+
+
+From abdac4241dd08dd90a08db877edd799f3833c2b4 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Mon, 30 May 2022 19:18:17 +1200
+Subject: [PATCH 86/99] CVE-2022-2031 s4:kdc: Reject tickets during the last
+ two minutes of their life
+
+For Heimdal, this now matches the behaviour of Windows. The object of
+this requirement is to ensure we don't allow kpasswd tickets, not having
+a lifetime of more than two minutes, to be passed off as TGTs.
+
+An existing requirement for TGTs to contain a REQUESTER_SID PAC buffer
+suffices to prevent kpasswd ticket misuse, so this is just an additional
+precaution on top.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org As we don't have access to the ticket or the request
+ in the plugin, rewrote check directly in Heimdal KDC]
+---
+ selftest/knownfail_heimdal_kdc |  1 -
+ source4/heimdal/kdc/krb5tgs.c  | 19 ++++++++++++++++++-
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 387ccea3ba7..afb9bcf1209 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -275,7 +275,6 @@
+ # Kpasswd tests
+ #
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+diff --git source4/heimdal/kdc/krb5tgs.c source4/heimdal/kdc/krb5tgs.c
+index 38dba8493ae..15be136496f 100644
+--- source4/heimdal/kdc/krb5tgs.c
++++ source4/heimdal/kdc/krb5tgs.c
+@@ -33,6 +33,9 @@
+ 
+ #include "kdc_locl.h"
+ 
++/* Awful hack to get access to 'struct samba_kdc_entry'. */
++#include "../../kdc/samba_kdc.h"
++
+ /*
+  * return the realm of a krbtgt-ticket or NULL
+  */
+@@ -130,6 +133,7 @@ check_PAC(krb5_context context,
+ static krb5_error_code
+ check_tgs_flags(krb5_context context,
+ 		krb5_kdc_configuration *config,
++		const hdb_entry_ex *krbtgt_in,
+ 		KDC_REQ_BODY *b, const EncTicketPart *tgt, EncTicketPart *et)
+ {
+     KDCOptions f = b->kdc_options;
+@@ -244,6 +248,17 @@ check_tgs_flags(krb5_context context,
+ 	    et->endtime = min(*et->renew_till, et->endtime);
+     }
+ 
++    if (tgt->endtime - kdc_time <= CHANGEPW_LIFETIME) {
++	/* Check that the ticket has not arrived across a trust. */
++	const struct samba_kdc_entry *skdc_entry = krbtgt_in->ctx;
++	if (!skdc_entry->is_trust) {
++	    /* This may be a kpasswd ticket rather than a TGT, so don't accept it. */
++	    kdc_log(context, config, 0,
++		    "Ticket is not a ticket-granting ticket");
++	    return KRB5KRB_AP_ERR_TKT_EXPIRED;
++	}
++    }
++
+ #if 0
+     /* checks for excess flags */
+     if(f.request_anonymous && !config->allow_anonymous){
+@@ -510,6 +525,7 @@ tgs_make_reply(krb5_context context,
+ 	       hdb_entry_ex *client,
+ 	       krb5_principal client_principal,
+                const char *tgt_realm,
++	       const hdb_entry_ex *krbtgt_in,
+ 	       hdb_entry_ex *krbtgt,
+ 	       krb5_pac mspac,
+ 	       uint16_t rodc_id,
+@@ -538,7 +554,7 @@ tgs_make_reply(krb5_context context,
+     ALLOC(et.starttime);
+     *et.starttime = kdc_time;
+ 
+-    ret = check_tgs_flags(context, config, b, tgt, &et);
++    ret = check_tgs_flags(context, config, krbtgt_in, b, tgt, &et);
+     if(ret)
+ 	goto out;
+ 
+@@ -2129,6 +2145,7 @@ server_lookup:
+ 			 client,
+ 			 cp,
+ 			 tgt_realm,
++			 krbtgt,
+ 			 krbtgt_out,
+ 			 mspac,
+ 			 rodc_id,
+-- 
+2.25.1
+
+
+From 389851bcf399f9511e2cb797350c37ce91aa5849 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Tue, 14 Jun 2022 15:23:55 +1200
+Subject: [PATCH 87/99] CVE-2022-2031 tests/krb5: Test truncated forms of
+ server principals
+
+We should not be able to use krb@REALM instead of krbtgt@REALM.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Fixed conflicts due to having older version of
+ _run_as_req_enc_timestamp()]
+---
+ python/samba/tests/krb5/as_req_tests.py | 40 ++++++++++++++++++++++---
+ selftest/knownfail_heimdal_kdc          |  4 +++
+ selftest/knownfail_mit_kdc              |  4 +++
+ 3 files changed, 44 insertions(+), 4 deletions(-)
+
+diff --git python/samba/tests/krb5/as_req_tests.py python/samba/tests/krb5/as_req_tests.py
+index 315720f85d6..054a49b64aa 100755
+--- python/samba/tests/krb5/as_req_tests.py
++++ python/samba/tests/krb5/as_req_tests.py
+@@ -27,6 +27,7 @@ from samba.tests.krb5.kdc_base_test import KDCBaseTest
+ import samba.tests.krb5.kcrypto as kcrypto
+ import samba.tests.krb5.rfc4120_pyasn1 as krb5_asn1
+ from samba.tests.krb5.rfc4120_constants import (
++    KDC_ERR_S_PRINCIPAL_UNKNOWN,
+     KDC_ERR_ETYPE_NOSUPP,
+     KDC_ERR_PREAUTH_REQUIRED,
+     KU_PA_ENC_TIMESTAMP,
+@@ -40,7 +41,8 @@ global_hexdump = False
+ 
+ 
+ class AsReqBaseTest(KDCBaseTest):
+-    def _run_as_req_enc_timestamp(self, client_creds):
++    def _run_as_req_enc_timestamp(self, client_creds, sname=None,
++                                  expected_error=None):
+         client_account = client_creds.get_username()
+         client_as_etypes = self.get_default_enctypes()
+         client_kvno = client_creds.get_kvno()
+@@ -50,8 +52,9 @@ class AsReqBaseTest(KDCBaseTest):
+ 
+         cname = self.PrincipalName_create(name_type=NT_PRINCIPAL,
+                                           names=[client_account])
+-        sname = self.PrincipalName_create(name_type=NT_SRV_INST,
+-                                          names=[krbtgt_account, realm])
++        if sname is None:
++            sname = self.PrincipalName_create(name_type=NT_SRV_INST,
++                                              names=[krbtgt_account, realm])
+ 
+         expected_crealm = realm
+         expected_cname = cname
+@@ -63,7 +66,10 @@ class AsReqBaseTest(KDCBaseTest):
+ 
+         initial_etypes = client_as_etypes
+         initial_kdc_options = krb5_asn1.KDCOptions('forwardable')
+-        initial_error_mode = KDC_ERR_PREAUTH_REQUIRED
++        if expected_error is not None:
++            initial_error_mode = expected_error
++        else:
++            initial_error_mode = KDC_ERR_PREAUTH_REQUIRED
+ 
+         rep, kdc_exchange_dict = self._test_as_exchange(cname,
+                                                         realm,
+@@ -80,6 +86,10 @@ class AsReqBaseTest(KDCBaseTest):
+                                                         None,
+                                                         initial_kdc_options,
+                                                         pac_request=True)
++
++        if expected_error is not None:
++            return None
++
+         etype_info2 = kdc_exchange_dict['preauth_etype_info2']
+         self.assertIsNotNone(etype_info2)
+ 
+@@ -209,6 +219,28 @@ class AsReqKerberosTests(AsReqBaseTest):
+         client_creds = self.get_mach_creds()
+         self._run_as_req_enc_timestamp(client_creds)
+ 
++    # Ensure we can't use truncated well-known principals such as krb@REALM
++    # instead of krbtgt@REALM.
++    def test_krbtgt_wrong_principal(self):
++        client_creds = self.get_client_creds()
++
++        krbtgt_creds = self.get_krbtgt_creds()
++
++        krbtgt_account = krbtgt_creds.get_username()
++        realm = krbtgt_creds.get_realm()
++
++        # Truncate the name of the krbtgt principal.
++        krbtgt_account = krbtgt_account[:3]
++
++        wrong_krbtgt_princ = self.PrincipalName_create(
++            name_type=NT_SRV_INST,
++            names=[krbtgt_account, realm])
++
++        self._run_as_req_enc_timestamp(
++            client_creds,
++            sname=wrong_krbtgt_princ,
++            expected_error=KDC_ERR_S_PRINCIPAL_UNKNOWN)
++
+ 
+ if __name__ == "__main__":
+     global_asn1_print = False
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index afb9bcf1209..dbfff5784e6 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -278,3 +278,7 @@
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
++#
++# AS-REQ tests
++#
++^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_krbtgt_wrong_principal\(
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index c2a31b4a140..0f90ea10299 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -583,3 +583,7 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
++#
++# AS-REQ tests
++#
++^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_krbtgt_wrong_principal\(
+-- 
+2.25.1
+
+
+From d40593be83144713cfc43e4eb1c7bc2d925a0da0 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 25 May 2022 20:00:55 +1200
+Subject: [PATCH 88/99] CVE-2022-2031 s4:kdc: Don't use strncmp to compare
+ principal components
+
+We would only compare the first 'n' characters, where 'n' is the length
+of the principal component string, so 'k@REALM' would erroneously be
+considered equal to 'krbtgt@REALM'.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ selftest/knownfail_heimdal_kdc |  4 ----
+ selftest/knownfail_mit_kdc     |  4 ----
+ source4/kdc/db-glue.c          | 27 ++++++++++++++++++++++-----
+ 3 files changed, 22 insertions(+), 13 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index dbfff5784e6..afb9bcf1209 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -278,7 +278,3 @@
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+-#
+-# AS-REQ tests
+-#
+-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_krbtgt_wrong_principal\(
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 0f90ea10299..c2a31b4a140 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -583,7 +583,3 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+-#
+-# AS-REQ tests
+-#
+-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_krbtgt_wrong_principal\(
+diff --git source4/kdc/db-glue.c source4/kdc/db-glue.c
+index 073ec83c8cf..cfa2097acbd 100644
+--- source4/kdc/db-glue.c
++++ source4/kdc/db-glue.c
+@@ -769,15 +769,19 @@ static int principal_comp_strcmp_int(krb5_context context,
+ 				     bool do_strcasecmp)
+ {
+ 	const char *p;
+-	size_t len;
+ 
+ #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING)
+ 	p = krb5_principal_get_comp_string(context, principal, component);
+ 	if (p == NULL) {
+ 		return -1;
+ 	}
+-	len = strlen(p);
++	if (do_strcasecmp) {
++		return strcasecmp(p, string);
++	} else {
++		return strcmp(p, string);
++	}
+ #else
++	size_t len;
+ 	krb5_data *d;
+ 	if (component >= krb5_princ_size(context, principal)) {
+ 		return -1;
+@@ -789,13 +793,26 @@ static int principal_comp_strcmp_int(krb5_context context,
+ 	}
+ 
+ 	p = d->data;
+-	len = d->length;
+-#endif
++
++	len = strlen(string);
++
++	/*
++	 * We explicitly return -1 or 1. Subtracting of the two lengths might
++	 * give the wrong result if the result overflows or loses data when
++	 * narrowed to int.
++	 */
++	if (d->length < len) {
++		return -1;
++	} else if (d->length > len) {
++		return 1;
++	}
++
+ 	if (do_strcasecmp) {
+ 		return strncasecmp(p, string, len);
+ 	} else {
+-		return strncmp(p, string, len);
++		return memcmp(p, string, len);
+ 	}
++#endif
+ }
+ 
+ static int principal_comp_strcasecmp(krb5_context context,
+-- 
+2.25.1
+
+
+From 42ba919c06c24c42ef123304de0c2ca8c689591a Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 26 May 2022 16:36:30 +1200
+Subject: [PATCH 89/99] CVE-2022-32744 s4:kdc: Rename keytab_name ->
+ kpasswd_keytab_name
+
+This makes explicitly clear the purpose of this keytab.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Fixed conflicts due to lacking HDBGET support]
+---
+ source4/kdc/kdc-heimdal.c     | 4 ++--
+ source4/kdc/kdc-server.h      | 2 +-
+ source4/kdc/kdc-service-mit.c | 4 ++--
+ source4/kdc/kpasswd-service.c | 2 +-
+ 4 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git source4/kdc/kdc-heimdal.c source4/kdc/kdc-heimdal.c
+index ba74df4f2ec..a4c845b62f8 100644
+--- source4/kdc/kdc-heimdal.c
++++ source4/kdc/kdc-heimdal.c
+@@ -444,8 +444,8 @@ static void kdc_post_fork(struct task_server *task, struct process_details *pd)
+ 		return;
+ 	}
+ 
+-	kdc->keytab_name = talloc_asprintf(kdc, "HDB:samba4&%p", kdc->base_ctx);
+-	if (kdc->keytab_name == NULL) {
++	kdc->kpasswd_keytab_name = talloc_asprintf(kdc, "HDB:samba4&%p", kdc->base_ctx);
++	if (kdc->kpasswd_keytab_name == NULL) {
+ 		task_server_terminate(task,
+ 				      "kdc: Failed to set keytab name",
+ 				      true);
+diff --git source4/kdc/kdc-server.h source4/kdc/kdc-server.h
+index fd883c2e4b4..89b30f122f5 100644
+--- source4/kdc/kdc-server.h
++++ source4/kdc/kdc-server.h
+@@ -40,7 +40,7 @@ struct kdc_server {
+ 	struct ldb_context *samdb;
+ 	bool am_rodc;
+ 	uint32_t proxy_timeout;
+-	const char *keytab_name;
++	const char *kpasswd_keytab_name;
+ 	void *private_data;
+ };
+ 
+diff --git source4/kdc/kdc-service-mit.c source4/kdc/kdc-service-mit.c
+index 5d4180aa7cc..22663b6ecc8 100644
+--- source4/kdc/kdc-service-mit.c
++++ source4/kdc/kdc-service-mit.c
+@@ -291,8 +291,8 @@ NTSTATUS mitkdc_task_init(struct task_server *task)
+ 		return NT_STATUS_INTERNAL_ERROR;
+ 	}
+ 
+-	kdc->keytab_name = talloc_asprintf(kdc, "KDB:");
+-	if (kdc->keytab_name == NULL) {
++	kdc->kpasswd_keytab_name = talloc_asprintf(kdc, "KDB:");
++	if (kdc->kpasswd_keytab_name == NULL) {
+ 		task_server_terminate(task,
+ 				      "KDC: Out of memory",
+ 				      true);
+diff --git source4/kdc/kpasswd-service.c source4/kdc/kpasswd-service.c
+index b4706de1ad7..0d2acd8d9e8 100644
+--- source4/kdc/kpasswd-service.c
++++ source4/kdc/kpasswd-service.c
+@@ -167,7 +167,7 @@ kdc_code kpasswd_process(struct kdc_server *kdc,
+ 
+ 	rv = cli_credentials_set_keytab_name(server_credentials,
+ 					     kdc->task->lp_ctx,
+-					     kdc->keytab_name,
++					     kdc->kpasswd_keytab_name,
+ 					     CRED_SPECIFIED);
+ 	if (rv != 0) {
+ 		DBG_ERR("Failed to set credentials keytab name\n");
+-- 
+2.25.1
+
+
+From 997f50c66471071efb8e02d8efbe4bf5d932e7ee Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Wed, 8 Jun 2022 13:53:29 +1200
+Subject: [PATCH 90/99] s4:kdc: Remove kadmin mode from HDB plugin
+
+It appears we no longer require it.
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/kdc/hdb-samba4-plugin.c | 35 +++++++--------------------------
+ 1 file changed, 7 insertions(+), 28 deletions(-)
+
+diff --git source4/kdc/hdb-samba4-plugin.c source4/kdc/hdb-samba4-plugin.c
+index 6f76124995d..4b90a766f76 100644
+--- source4/kdc/hdb-samba4-plugin.c
++++ source4/kdc/hdb-samba4-plugin.c
+@@ -21,40 +21,20 @@
+ 
+ #include "includes.h"
+ #include "kdc/kdc-glue.h"
+-#include "kdc/db-glue.h"
+-#include "lib/util/samba_util.h"
+ #include "lib/param/param.h"
+-#include "source4/lib/events/events.h"
+ 
+ static krb5_error_code hdb_samba4_create(krb5_context context, struct HDB **db, const char *arg)
+ {
+ 	NTSTATUS nt_status;
+-	void *ptr;
+-	struct samba_kdc_base_context *base_ctx;
+-	
+-	if (sscanf(arg, "&%p", &ptr) == 1) {
+-		base_ctx = talloc_get_type_abort(ptr, struct samba_kdc_base_context);
+-	} else if (arg[0] == '\0' || file_exist(arg)) {
+-		/* This mode for use in kadmin, rather than in Samba */
+-		
+-		setup_logging("hdb_samba4", DEBUG_DEFAULT_STDERR);
+-
+-		base_ctx = talloc_zero(NULL, struct samba_kdc_base_context);
+-		if (!base_ctx) {
+-			return ENOMEM;
+-		}
+-
+-		base_ctx->ev_ctx = s4_event_context_init(base_ctx);
+-		base_ctx->lp_ctx = loadparm_init_global(false);
+-		if (arg[0]) {
+-			lpcfg_load(base_ctx->lp_ctx, arg);
+-		} else {
+-			lpcfg_load_default(base_ctx->lp_ctx);
+-		}
+-	} else {
++	void *ptr = NULL;
++	struct samba_kdc_base_context *base_ctx = NULL;
++
++	if (sscanf(arg, "&%p", &ptr) != 1) {
+ 		return EINVAL;
+ 	}
+ 
++	base_ctx = talloc_get_type_abort(ptr, struct samba_kdc_base_context);
++
+ 	/* The global kdc_mem_ctx and kdc_lp_ctx, Disgusting, ugly hack, but it means one less private hook */
+ 	nt_status = hdb_samba4_create_kdc(base_ctx, context, db);
+ 
+@@ -90,8 +70,7 @@ static void hdb_samba4_fini(void *ctx)
+ 
+ /* Only used in the hdb-backed keytab code
+  * for a keytab of 'samba4&<address>' or samba4, to find
+- * kpasswd's key in the main DB, and to
+- * copy all the keys into a file (libnet_keytab_export)
++ * kpasswd's key in the main DB
+  *
+  * The <address> is the string form of a pointer to a talloced struct hdb_samba_context
+  */
+-- 
+2.25.1
+
+
+From c0c4b7a4bd229bd36d586faec6249baaba8e7adc Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 26 May 2022 16:39:20 +1200
+Subject: [PATCH 91/99] CVE-2022-32744 s4:kdc: Modify HDB plugin to only look
+ up kpasswd principal
+
+This plugin is now only used by the kpasswd service. Thus, ensuring we
+only look up the kadmin/changepw principal means we can't be fooled into
+accepting tickets for other service principals. We make sure not to
+specify a specific kvno, to ensure that we do not accept RODC-issued
+tickets.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Fixed knownfail conflicts]
+
+[jsutton@samba.org Renamed entry to entry_ex; fixed knownfail conflicts;
+ retained knownfail for test_kpasswd_from_rodc which now causes the KDC
+ to panic]
+---
+ selftest/knownfail_heimdal_kdc  |  3 --
+ source4/kdc/hdb-samba4-plugin.c |  2 +-
+ source4/kdc/hdb-samba4.c        | 66 +++++++++++++++++++++++++++++++++
+ source4/kdc/kdc-glue.h          |  3 ++
+ 4 files changed, 70 insertions(+), 4 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index afb9bcf1209..0d93253f999 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -275,6 +275,3 @@
+ # Kpasswd tests
+ #
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+diff --git source4/kdc/hdb-samba4-plugin.c source4/kdc/hdb-samba4-plugin.c
+index 4b90a766f76..dba25e825de 100644
+--- source4/kdc/hdb-samba4-plugin.c
++++ source4/kdc/hdb-samba4-plugin.c
+@@ -36,7 +36,7 @@ static krb5_error_code hdb_samba4_create(krb5_context context, struct HDB **db,
+ 	base_ctx = talloc_get_type_abort(ptr, struct samba_kdc_base_context);
+ 
+ 	/* The global kdc_mem_ctx and kdc_lp_ctx, Disgusting, ugly hack, but it means one less private hook */
+-	nt_status = hdb_samba4_create_kdc(base_ctx, context, db);
++	nt_status = hdb_samba4_kpasswd_create_kdc(base_ctx, context, db);
+ 
+ 	if (NT_STATUS_IS_OK(nt_status)) {
+ 		return 0;
+diff --git source4/kdc/hdb-samba4.c source4/kdc/hdb-samba4.c
+index 43e836f8360..a8aae50b5b0 100644
+--- source4/kdc/hdb-samba4.c
++++ source4/kdc/hdb-samba4.c
+@@ -136,6 +136,47 @@ static krb5_error_code hdb_samba4_fetch_kvno(krb5_context context, HDB *db,
+ 	return code;
+ }
+ 
++static krb5_error_code hdb_samba4_kpasswd_fetch_kvno(krb5_context context, HDB *db,
++						     krb5_const_principal _principal,
++						     unsigned flags,
++						     krb5_kvno _kvno,
++						     hdb_entry_ex *entry_ex)
++{
++	struct samba_kdc_db_context *kdc_db_ctx = NULL;
++	krb5_error_code ret;
++	krb5_principal kpasswd_principal = NULL;
++
++	kdc_db_ctx = talloc_get_type_abort(db->hdb_db,
++					   struct samba_kdc_db_context);
++
++	ret = smb_krb5_make_principal(context, &kpasswd_principal,
++				      lpcfg_realm(kdc_db_ctx->lp_ctx),
++				      "kadmin", "changepw",
++				      NULL);
++	if (ret) {
++		return ret;
++	}
++	smb_krb5_principal_set_type(context, kpasswd_principal, KRB5_NT_SRV_INST);
++
++	/*
++	 * For the kpasswd service, always ensure we get the latest kvno. This
++	 * also means we (correctly) refuse RODC-issued tickets.
++	 */
++	flags &= ~HDB_F_KVNO_SPECIFIED;
++
++	/* Don't bother looking up a client or krbtgt. */
++	flags &= ~(SDB_F_GET_CLIENT|SDB_F_GET_KRBTGT);
++
++	ret = hdb_samba4_fetch_kvno(context, db,
++				    kpasswd_principal,
++				    flags,
++				    0,
++				    entry_ex);
++
++	krb5_free_principal(context, kpasswd_principal);
++	return ret;
++}
++
+ static krb5_error_code hdb_samba4_firstkey(krb5_context context, HDB *db, unsigned flags,
+ 					hdb_entry_ex *entry)
+ {
+@@ -194,6 +235,14 @@ static krb5_error_code hdb_samba4_nextkey(krb5_context context, HDB *db, unsigne
+ 	return ret;
+ }
+ 
++static krb5_error_code hdb_samba4_nextkey_panic(krb5_context context, HDB *db,
++						unsigned flags,
++						hdb_entry_ex *entry)
++{
++	DBG_ERR("Attempt to iterate kpasswd keytab => PANIC\n");
++	smb_panic("hdb_samba4_nextkey_panic: Attempt to iterate kpasswd keytab");
++}
++
+ static krb5_error_code hdb_samba4_destroy(krb5_context context, HDB *db)
+ {
+ 	talloc_free(db);
+@@ -522,3 +571,20 @@ NTSTATUS hdb_samba4_create_kdc(struct samba_kdc_base_context *base_ctx,
+ 
+ 	return NT_STATUS_OK;
+ }
++
++NTSTATUS hdb_samba4_kpasswd_create_kdc(struct samba_kdc_base_context *base_ctx,
++				       krb5_context context, struct HDB **db)
++{
++	NTSTATUS nt_status;
++
++	nt_status = hdb_samba4_create_kdc(base_ctx, context, db);
++	if (!NT_STATUS_IS_OK(nt_status)) {
++		return nt_status;
++	}
++
++	(*db)->hdb_fetch_kvno = hdb_samba4_kpasswd_fetch_kvno;
++	(*db)->hdb_firstkey = hdb_samba4_nextkey_panic;
++	(*db)->hdb_nextkey = hdb_samba4_nextkey_panic;
++
++	return NT_STATUS_OK;
++}
+diff --git source4/kdc/kdc-glue.h source4/kdc/kdc-glue.h
+index c083b8c6429..ff8684e1666 100644
+--- source4/kdc/kdc-glue.h
++++ source4/kdc/kdc-glue.h
+@@ -45,6 +45,9 @@ kdc_code kpasswdd_process(struct kdc_server *kdc,
+ NTSTATUS hdb_samba4_create_kdc(struct samba_kdc_base_context *base_ctx,
+ 			       krb5_context context, struct HDB **db);
+ 
++NTSTATUS hdb_samba4_kpasswd_create_kdc(struct samba_kdc_base_context *base_ctx,
++				       krb5_context context, struct HDB **db);
++
+ /* from kdc-glue.c */
+ int kdc_check_pac(krb5_context krb5_context,
+ 		  DATA_BLOB server_sig,
+-- 
+2.25.1
+
+
+From 340181bc1100fa31c63af88214a3d8328b944fe9 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Mon, 30 May 2022 19:16:02 +1200
+Subject: [PATCH 92/99] CVE-2022-32744 s4:kpasswd: Ensure we pass the kpasswd
+ server principal into krb5_rd_req_ctx()
+
+To ensure that, when decrypting the kpasswd ticket, we look up the
+correct principal and don't trust the sname from the ticket, we should
+pass the principal name of the kpasswd service into krb5_rd_req_ctx().
+However, gensec_krb5_update_internal() will pass in NULL unless the
+principal in our credentials is CRED_SPECIFIED.
+
+At present, our principal will be considered obtained as CRED_SMB_CONF
+(from the cli_credentials_set_conf() a few lines up), so we explicitly
+set the realm again, but this time as CRED_SPECIFIED. Now the value of
+server_in_keytab that we provide to smb_krb5_rd_req_decoded() will not
+be NULL.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Removed knownfail as KDC no longer panics]
+---
+ selftest/knownfail_heimdal_kdc |  4 ----
+ selftest/knownfail_mit_kdc     |  2 --
+ source4/kdc/kpasswd-service.c  | 30 ++++++++++++++++++++++++++++++
+ 3 files changed, 30 insertions(+), 6 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 0d93253f999..424a8b81c38 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -271,7 +271,3 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+-#
+-# Kpasswd tests
+-#
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_from_rodc.ad_dc
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index c2a31b4a140..0d2f5bab6d2 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -581,5 +581,3 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_server.ad_dc
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_wrong_key_service.ad_dc
+diff --git source4/kdc/kpasswd-service.c source4/kdc/kpasswd-service.c
+index 0d2acd8d9e8..b6400be0c49 100644
+--- source4/kdc/kpasswd-service.c
++++ source4/kdc/kpasswd-service.c
+@@ -29,6 +29,7 @@
+ #include "kdc/kdc-server.h"
+ #include "kdc/kpasswd-service.h"
+ #include "kdc/kpasswd-helper.h"
++#include "param/param.h"
+ 
+ #define HEADER_LEN 6
+ #ifndef RFC3244_VERSION
+@@ -158,6 +159,20 @@ kdc_code kpasswd_process(struct kdc_server *kdc,
+ 
+ 	cli_credentials_set_conf(server_credentials, kdc->task->lp_ctx);
+ 
++	/*
++	 * After calling cli_credentials_set_conf(), explicitly set the realm
++	 * with CRED_SPECIFIED. We need to do this so the result of
++	 * principal_from_credentials() called from the gensec layer is
++	 * CRED_SPECIFIED rather than CRED_SMB_CONF, avoiding a fallback to
++	 * match-by-key (very undesirable in this case).
++	 */
++	ok = cli_credentials_set_realm(server_credentials,
++				       lpcfg_realm(kdc->task->lp_ctx),
++				       CRED_SPECIFIED);
++	if (!ok) {
++		goto done;
++	}
++
+ 	ok = cli_credentials_set_username(server_credentials,
+ 					  "kadmin/changepw",
+ 					  CRED_SPECIFIED);
+@@ -165,6 +180,21 @@ kdc_code kpasswd_process(struct kdc_server *kdc,
+ 		goto done;
+ 	}
+ 
++	/* Check that the server principal is indeed CRED_SPECIFIED. */
++	{
++		char *principal = NULL;
++		enum credentials_obtained obtained;
++
++		principal = cli_credentials_get_principal_and_obtained(server_credentials,
++								       tmp_ctx,
++								       &obtained);
++		if (obtained < CRED_SPECIFIED) {
++			goto done;
++		}
++
++		TALLOC_FREE(principal);
++	}
++
+ 	rv = cli_credentials_set_keytab_name(server_credentials,
+ 					     kdc->task->lp_ctx,
+ 					     kdc->kpasswd_keytab_name,
+-- 
+2.25.1
+
+
+From 95afbc2da9b541fb8f2eebdcd411f5873d1675ac Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Fri, 10 Jun 2022 19:17:11 +1200
+Subject: [PATCH 93/99] CVE-2022-2031 tests/krb5: Add test that we cannot
+ provide a TGT to kpasswd
+
+The kpasswd service should require a kpasswd service ticket, and
+disallow TGTs.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Fixed knownfail conflicts]
+
+[jsutton@samba.org Fixed knownfail conflicts]
+---
+ python/samba/tests/krb5/kpasswd_tests.py | 28 ++++++++++++++++++++++++
+ selftest/knownfail_heimdal_kdc           |  4 ++++
+ selftest/knownfail_mit_kdc               |  4 ++++
+ 3 files changed, 36 insertions(+)
+
+diff --git python/samba/tests/krb5/kpasswd_tests.py python/samba/tests/krb5/kpasswd_tests.py
+index 3a6c7d818dc..0db857f7bbd 100755
+--- python/samba/tests/krb5/kpasswd_tests.py
++++ python/samba/tests/krb5/kpasswd_tests.py
+@@ -31,6 +31,7 @@ from samba.tests.krb5.rfc4120_constants import (
+     KDC_ERR_TGT_REVOKED,
+     KDC_ERR_TKT_EXPIRED,
+     KPASSWD_ACCESSDENIED,
++    KPASSWD_AUTHERROR,
+     KPASSWD_HARDERROR,
+     KPASSWD_INITIAL_FLAG_NEEDED,
+     KPASSWD_MALFORMED,
+@@ -779,6 +780,33 @@ class KpasswdTests(KDCBaseTest):
+         self._make_tgs_request(creds, service_creds, ticket,
+                                expect_error=False)
+ 
++    # Show that we cannot provide a TGT to kpasswd to change the password.
++    def test_kpasswd_tgt(self):
++        # Create an account for testing, and get a TGT.
++        creds = self._get_creds()
++        tgt = self.get_tgt(creds)
++
++        # Change the sname of the ticket to match that of kadmin/changepw.
++        tgt.set_sname(self.get_kpasswd_sname())
++
++        expected_code = KPASSWD_AUTHERROR
++        expected_msg = b'A TGT may not be used as a ticket to kpasswd'
++
++        # Set the password.
++        new_password = generate_random_password(32, 32)
++        self.kpasswd_exchange(tgt,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.SET)
++
++        # Change the password.
++        self.kpasswd_exchange(tgt,
++                              new_password,
++                              expected_code,
++                              expected_msg,
++                              mode=self.KpasswdMode.CHANGE)
++
+     # Test that kpasswd rejects requests with a service ticket.
+     def test_kpasswd_non_initial(self):
+         # Create an account for testing, and get a TGT.
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 424a8b81c38..42beccaed58 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -271,3 +271,7 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
++#
++# Kpasswd tests
++#
++^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_tgt.ad_dc
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 0d2f5bab6d2..9fc34e5d8db 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -581,3 +581,7 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
++#
++# Kpasswd tests
++#
++samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_tgt.ad_dc
+-- 
+2.25.1
+
+
+From 4b61092459b403b2945daa9082052366f3508b69 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Fri, 10 Jun 2022 19:18:07 +1200
+Subject: [PATCH 94/99] CVE-2022-2031 auth: Add ticket type field to
+ auth_user_info_dc and auth_session_info
+
+This field may be used to convey whether we were provided with a TGT or
+a non-TGT. We ensure both structures are zeroed out to avoid incorrect
+results being produced by an uninitialised field.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ auth/auth_sam_reply.c              |  2 +-
+ auth/auth_util.c                   |  2 +-
+ librpc/idl/auth.idl                | 23 +++++++++++++++++++++++
+ source4/auth/ntlm/auth_developer.c |  2 +-
+ source4/auth/sam.c                 |  2 +-
+ source4/auth/session.c             |  2 ++
+ source4/auth/system_session.c      |  6 +++---
+ 7 files changed, 32 insertions(+), 7 deletions(-)
+
+diff --git auth/auth_sam_reply.c auth/auth_sam_reply.c
+index b5b6362dc93..2e27e5715d1 100644
+--- auth/auth_sam_reply.c
++++ auth/auth_sam_reply.c
+@@ -416,7 +416,7 @@ NTSTATUS make_user_info_dc_netlogon_validation(TALLOC_CTX *mem_ctx,
+ 		return NT_STATUS_INVALID_LEVEL;
+ 	}
+ 
+-	user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
++	user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
+ 	NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+ 
+ 	/*
+diff --git auth/auth_util.c auth/auth_util.c
+index fe01babd107..ec9094d0f15 100644
+--- auth/auth_util.c
++++ auth/auth_util.c
+@@ -44,7 +44,7 @@ struct auth_session_info *copy_session_info(TALLOC_CTX *mem_ctx,
+ 		return NULL;
+ 	}
+ 
+-	dst = talloc(mem_ctx, struct auth_session_info);
++	dst = talloc_zero(mem_ctx, struct auth_session_info);
+ 	if (dst == NULL) {
+ 		DBG_ERR("talloc failed\n");
+ 		TALLOC_FREE(frame);
+diff --git librpc/idl/auth.idl librpc/idl/auth.idl
+index 1092935b971..f7658cdde28 100644
+--- librpc/idl/auth.idl
++++ librpc/idl/auth.idl
+@@ -75,6 +75,26 @@ interface auth
+ 		[unique,charset(UTF8),string] char *sanitized_username;
+ 	} auth_user_info_unix;
+ 
++	/*
++	 * If the user was authenticated with a Kerberos ticket, this indicates
++	 * the type of the ticket; TGT, or non-TGT (i.e. service ticket). If
++	 * unset, the type is unknown. This indicator is useful for the KDC and
++	 * the kpasswd service, which share the same account and keys. By
++	 * ensuring it is provided with the appopriate ticket type, each service
++	 * avoids accepting a ticket meant for the other.
++	 *
++	 * The heuristic used to determine the type is the presence or absence
++	 * of a REQUESTER_SID buffer in the PAC; we use its presence to assume
++	 * we have a TGT. This heuristic will fail for older Samba versions and
++	 * Windows prior to Nov. 2021 updates, which lack support for this
++	 * buffer.
++	 */
++	typedef enum {
++		TICKET_TYPE_UNKNOWN = 0,
++		TICKET_TYPE_TGT = 1,
++		TICKET_TYPE_NON_TGT = 2
++	} ticket_type;
++
+ 	/* This is the interim product of the auth subsystem, before
+ 	 * privileges and local groups are handled */
+ 	typedef [public] struct {
+@@ -83,6 +103,7 @@ interface auth
+ 		auth_user_info *info;
+ 		[noprint] DATA_BLOB user_session_key;
+ 		[noprint] DATA_BLOB lm_session_key;
++		ticket_type ticket_type;
+ 	} auth_user_info_dc;
+ 
+ 	typedef [public] struct {
+@@ -112,6 +133,8 @@ interface auth
+ 		 * We generate this in auth_generate_session_info()
+ 		 */
+ 	        GUID unique_session_token;
++
++		ticket_type ticket_type;
+ 	} auth_session_info;
+ 
+ 	typedef [public] struct {
+diff --git source4/auth/ntlm/auth_developer.c source4/auth/ntlm/auth_developer.c
+index 1823989c68d..6e92252d5c5 100644
+--- source4/auth/ntlm/auth_developer.c
++++ source4/auth/ntlm/auth_developer.c
+@@ -76,7 +76,7 @@ static NTSTATUS name_to_ntstatus_check_password(struct auth_method_context *ctx,
+ 	}
+ 	NT_STATUS_NOT_OK_RETURN(nt_status);
+ 
+-	user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
++	user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
+ 	NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+ 
+ 	/* This returns a pointer to a struct dom_sid, which is the
+diff --git source4/auth/sam.c source4/auth/sam.c
+index 8b233bab3ad..7c609655fcb 100644
+--- source4/auth/sam.c
++++ source4/auth/sam.c
+@@ -363,7 +363,7 @@ _PUBLIC_ NTSTATUS authsam_make_user_info_dc(TALLOC_CTX *mem_ctx,
+ 	TALLOC_CTX *tmp_ctx;
+ 	struct ldb_message_element *el;
+ 
+-	user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
++	user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
+ 	NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+ 
+ 	tmp_ctx = talloc_new(user_info_dc);
+diff --git source4/auth/session.c source4/auth/session.c
+index 8e44dcd24f1..d6e936dd1f1 100644
+--- source4/auth/session.c
++++ source4/auth/session.c
+@@ -222,6 +222,8 @@ _PUBLIC_ NTSTATUS auth_generate_session_info(TALLOC_CTX *mem_ctx,
+ 
+ 	session_info->credentials = NULL;
+ 
++	session_info->ticket_type = user_info_dc->ticket_type;
++
+ 	talloc_steal(mem_ctx, session_info);
+ 	*_session_info = session_info;
+ 	talloc_free(tmp_ctx);
+diff --git source4/auth/system_session.c source4/auth/system_session.c
+index 85b8f1c4edb..2518d654e8b 100644
+--- source4/auth/system_session.c
++++ source4/auth/system_session.c
+@@ -115,7 +115,7 @@ NTSTATUS auth_system_user_info_dc(TALLOC_CTX *mem_ctx, const char *netbios_name,
+ 	struct auth_user_info_dc *user_info_dc;
+ 	struct auth_user_info *info;
+ 
+-	user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
++	user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
+ 	NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+ 
+ 	/* This returns a pointer to a struct dom_sid, which is the
+@@ -191,7 +191,7 @@ static NTSTATUS auth_domain_admin_user_info_dc(TALLOC_CTX *mem_ctx,
+ 	struct auth_user_info_dc *user_info_dc;
+ 	struct auth_user_info *info;
+ 
+-	user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
++	user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
+ 	NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+ 
+ 	user_info_dc->num_sids = 7;
+@@ -356,7 +356,7 @@ _PUBLIC_ NTSTATUS auth_anonymous_user_info_dc(TALLOC_CTX *mem_ctx,
+ {
+ 	struct auth_user_info_dc *user_info_dc;
+ 	struct auth_user_info *info;
+-	user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
++	user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
+ 	NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+ 
+ 	/* This returns a pointer to a struct dom_sid, which is the
+-- 
+2.25.1
+
+
+From 89c6e36938c27b572573b06d1b35db210bfda99b Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Fri, 10 Jun 2022 19:18:35 +1200
+Subject: [PATCH 95/99] CVE-2022-2031 s4:auth: Use PAC to determine whether
+ ticket is a TGT
+
+We use the presence or absence of a REQUESTER_SID PAC buffer to
+determine whether the ticket is a TGT. We will later use this to reject
+TGTs where a service ticket is expected.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/auth/kerberos/kerberos_pac.c | 44 ++++++++++++++++++++++++++++
+ 1 file changed, 44 insertions(+)
+
+diff --git source4/auth/kerberos/kerberos_pac.c source4/auth/kerberos/kerberos_pac.c
+index 54ef4d61b02..bd0ae20e007 100644
+--- source4/auth/kerberos/kerberos_pac.c
++++ source4/auth/kerberos/kerberos_pac.c
+@@ -282,6 +282,28 @@
+ 	return ret;
+ }
+ 
++static krb5_error_code kerberos_pac_buffer_present(krb5_context context,
++						   const krb5_pac pac,
++						   uint32_t type)
++{
++#ifdef SAMBA4_USES_HEIMDAL
++	return krb5_pac_get_buffer(context, pac, type, NULL);
++#else /* MIT */
++	krb5_error_code ret;
++	krb5_data data;
++
++	/*
++	 * MIT won't let us pass NULL for the data parameter, so we are forced
++	 * to allocate a new buffer and then immediately free it.
++	 */
++	ret = krb5_pac_get_buffer(context, pac, type, &data);
++	if (ret == 0) {
++		krb5_free_data_contents(context, &data);
++	}
++	return ret;
++#endif /* SAMBA4_USES_HEIMDAL */
++}
++
+ krb5_error_code kerberos_pac_to_user_info_dc(TALLOC_CTX *mem_ctx,
+ 					     krb5_pac pac,
+ 					     krb5_context context,
+@@ -414,6 +436,28 @@ krb5_error_code kerberos_pac_to_user_info_dc(TALLOC_CTX *mem_ctx,
+ 			return EINVAL;
+ 		}
+ 	}
++
++	/*
++	 * Based on the presence of a REQUESTER_SID PAC buffer, ascertain
++	 * whether the ticket is a TGT. This helps the KDC and kpasswd service
++	 * ensure they do not accept tickets meant for the other.
++	 *
++	 * This heuristic will fail for older Samba versions and Windows prior
++	 * to Nov. 2021 updates, which lack support for the REQUESTER_SID PAC
++	 * buffer.
++	 */
++	ret = kerberos_pac_buffer_present(context, pac, PAC_TYPE_REQUESTER_SID);
++	if (ret == ENOENT) {
++		/* This probably isn't a TGT. */
++		user_info_dc_out->ticket_type = TICKET_TYPE_NON_TGT;
++	} else if (ret != 0) {
++		talloc_free(tmp_ctx);
++		return ret;
++	} else {
++		/* This probably is a TGT. */
++		user_info_dc_out->ticket_type = TICKET_TYPE_TGT;
++	}
++
+ 	*user_info_dc = user_info_dc_out;
+ 
+ 	return 0;
+-- 
+2.25.1
+
+
+From d5af460403d3949ba266f5c74f051247cd7ce752 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Fri, 10 Jun 2022 19:18:53 +1200
+Subject: [PATCH 96/99] CVE-2022-2031 s4:kpasswd: Do not accept TGTs as kpasswd
+ tickets
+
+If TGTs can be used as kpasswd tickets, the two-minute lifetime of a
+authentic kpasswd ticket may be bypassed. Furthermore, kpasswd tickets
+are not supposed to be cached, but using this flaw, a stolen credentials
+cache containing a TGT may be used to change that account's password,
+and thus is made more valuable to an attacker.
+
+Since all TGTs should be issued with a REQUESTER_SID PAC buffer, and
+service tickets without it, we assert the absence of this buffer to
+ensure we're not accepting a TGT.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+
+[jsutton@samba.org Fixed knownfail conflicts]
+
+[jsutton@samba.org Fixed knownfail conflicts]
+---
+ selftest/knownfail_heimdal_kdc        |  4 ----
+ selftest/knownfail_mit_kdc            |  4 ----
+ source4/kdc/kpasswd-helper.c          | 20 ++++++++++++++++++++
+ source4/kdc/kpasswd-helper.h          |  2 ++
+ source4/kdc/kpasswd-service-heimdal.c | 13 +++++++++++++
+ source4/kdc/kpasswd-service-mit.c     | 13 +++++++++++++
+ 6 files changed, 48 insertions(+), 8 deletions(-)
+
+diff --git selftest/knownfail_heimdal_kdc selftest/knownfail_heimdal_kdc
+index 42beccaed58..424a8b81c38 100644
+--- selftest/knownfail_heimdal_kdc
++++ selftest/knownfail_heimdal_kdc
+@@ -271,7 +271,3 @@
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_service_ticket
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_existing
+ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_fast_sid_mismatch_nonexisting
+-#
+-# Kpasswd tests
+-#
+-^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_tgt.ad_dc
+diff --git selftest/knownfail_mit_kdc selftest/knownfail_mit_kdc
+index 9fc34e5d8db..0d2f5bab6d2 100644
+--- selftest/knownfail_mit_kdc
++++ selftest/knownfail_mit_kdc
+@@ -581,7 +581,3 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_no_canonicalize_realm_case.ad_dc
+ ^samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_ticket_requester_sid_tgs.ad_dc
+-#
+-# Kpasswd tests
+-#
+-samba.tests.krb5.kpasswd_tests.samba.tests.krb5.kpasswd_tests.KpasswdTests.test_kpasswd_tgt.ad_dc
+diff --git source4/kdc/kpasswd-helper.c source4/kdc/kpasswd-helper.c
+index 55a2f5b3bf6..2ffdb79aea5 100644
+--- source4/kdc/kpasswd-helper.c
++++ source4/kdc/kpasswd-helper.c
+@@ -241,3 +241,23 @@ NTSTATUS kpasswd_samdb_set_password(TALLOC_CTX *mem_ctx,
+ 
+ 	return status;
+ }
++
++krb5_error_code kpasswd_check_non_tgt(struct auth_session_info *session_info,
++				      const char **error_string)
++{
++	switch(session_info->ticket_type) {
++	case TICKET_TYPE_TGT:
++		/* TGTs are disallowed here. */
++		*error_string = "A TGT may not be used as a ticket to kpasswd";
++		return KRB5_KPASSWD_AUTHERROR;
++	case TICKET_TYPE_NON_TGT:
++		/* Non-TGTs are permitted, and expected. */
++		break;
++	default:
++		/* In case we forgot to set the type. */
++		*error_string = "Failed to ascertain that ticket to kpasswd is not a TGT";
++		return KRB5_KPASSWD_HARDERROR;
++	}
++
++	return 0;
++}
+diff --git source4/kdc/kpasswd-helper.h source4/kdc/kpasswd-helper.h
+index 8fad81e0a5d..94a6e2acfdd 100644
+--- source4/kdc/kpasswd-helper.h
++++ source4/kdc/kpasswd-helper.h
+@@ -43,4 +43,6 @@ NTSTATUS kpasswd_samdb_set_password(TALLOC_CTX *mem_ctx,
+ 				    enum samPwdChangeReason *reject_reason,
+ 				    struct samr_DomInfo1 **dominfo);
+ 
++krb5_error_code kpasswd_check_non_tgt(struct auth_session_info *session_info,
++				      const char **error_string);
+ #endif /* _KPASSWD_HELPER_H */
+diff --git source4/kdc/kpasswd-service-heimdal.c source4/kdc/kpasswd-service-heimdal.c
+index a0352d1ad35..4d009b9eb24 100644
+--- source4/kdc/kpasswd-service-heimdal.c
++++ source4/kdc/kpasswd-service-heimdal.c
+@@ -253,6 +253,7 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
+ {
+ 	struct auth_session_info *session_info;
+ 	NTSTATUS status;
++	krb5_error_code code;
+ 
+ 	status = gensec_session_info(gensec_security,
+ 				     mem_ctx,
+@@ -264,6 +265,18 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
+ 		return KRB5_KPASSWD_HARDERROR;
+ 	}
+ 
++	/*
++	 * Since the kpasswd service shares its keys with the krbtgt, we might
++	 * have received a TGT rather than a kpasswd ticket. We need to check
++	 * the ticket type to ensure that TGTs cannot be misused in this manner.
++	 */
++	code = kpasswd_check_non_tgt(session_info,
++				     error_string);
++	if (code != 0) {
++		DBG_WARNING("%s\n", *error_string);
++		return code;
++	}
++
+ 	switch(verno) {
+ 	case KRB5_KPASSWD_VERS_CHANGEPW: {
+ 		DATA_BLOB password = data_blob_null;
+diff --git source4/kdc/kpasswd-service-mit.c source4/kdc/kpasswd-service-mit.c
+index de4c6f3f622..6b051567b6e 100644
+--- source4/kdc/kpasswd-service-mit.c
++++ source4/kdc/kpasswd-service-mit.c
+@@ -332,6 +332,7 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
+ {
+ 	struct auth_session_info *session_info;
+ 	NTSTATUS status;
++	krb5_error_code code;
+ 
+ 	status = gensec_session_info(gensec_security,
+ 				     mem_ctx,
+@@ -344,6 +345,18 @@ krb5_error_code kpasswd_handle_request(struct kdc_server *kdc,
+ 		return KRB5_KPASSWD_HARDERROR;
+ 	}
+ 
++	/*
++	 * Since the kpasswd service shares its keys with the krbtgt, we might
++	 * have received a TGT rather than a kpasswd ticket. We need to check
++	 * the ticket type to ensure that TGTs cannot be misused in this manner.
++	 */
++	code = kpasswd_check_non_tgt(session_info,
++				     error_string);
++	if (code != 0) {
++		DBG_WARNING("%s\n", *error_string);
++		return code;
++	}
++
+ 	switch(verno) {
+ 	case 1: {
+ 		DATA_BLOB password;
+-- 
+2.25.1
+
+
+From a6231af1f1c03cd81614332f867916e1748e03a8 Mon Sep 17 00:00:00 2001
+From: Joseph Sutton <josephsutton@catalyst.net.nz>
+Date: Thu, 23 Jun 2022 13:59:11 +1200
+Subject: [PATCH 97/99] CVE-2022-2031 testprogs: Add test for short-lived
+ ticket across an incoming trust
+
+We ensure that the KDC does not reject a TGS-REQ with our short-lived
+TGT over an incoming trust.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
+
+Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
+
+[jsutton@samba.org Changed --use-krb5-ccache to -k yes to match
+ surrounding usage]
+---
+ testprogs/blackbox/test_kinit_trusts_heimdal.sh | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git testprogs/blackbox/test_kinit_trusts_heimdal.sh testprogs/blackbox/test_kinit_trusts_heimdal.sh
+index bf0b81a0473..621434eac35 100755
+--- testprogs/blackbox/test_kinit_trusts_heimdal.sh
++++ testprogs/blackbox/test_kinit_trusts_heimdal.sh
+@@ -54,6 +54,10 @@ testit "kinit with password" $samba4kinit $enctype --password-file=$PREFIX/tmppa
+ test_smbclient "Test login with user kerberos ccache" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
+ rm -rf $KRB5CCNAME_PATH
+ 
++testit "kinit with password and two minute lifetime" $samba4kinit $enctype --password-file=$PREFIX/tmppassfile --request-pac --server=krbtgt/$REALM@$TRUST_REALM --lifetime=2m $TRUST_USERNAME@$TRUST_REALM || failed=`expr $failed + 1`
++test_smbclient "Test login with user kerberos ccache and two minute lifetime" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
++rm -rf $KRB5CCNAME_PATH
++
+ # Test with smbclient4
+ smbclient="$samba4bindir/smbclient4"
+ testit "kinit with password" $samba4kinit $enctype --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM   || failed=`expr $failed + 1`
+@@ -94,5 +98,5 @@ testit "wbinfo check outgoing trust pw" $VALGRIND $wbinfo --check-secret --domai
+ 
+ test_smbclient "Test user login with the changed outgoing secret" 'ls' "$unc" -k yes -U$USERNAME@$REALM%$PASSWORD || failed=`expr $failed + 1`
+ 
+-rm -f $PREFIX/tmpccache tmpccfile tmppassfile tmpuserpassfile tmpuserccache
++rm -f $PREFIX/tmpccache $PREFIX/tmppassfile
+ exit $failed
+-- 
+2.25.1
+
+
+From f6e1750c4fc966c29c2e0663d3c04e87057fa0c3 Mon Sep 17 00:00:00 2001
+From: Jeremy Allison <jra@samba.org>
+Date: Tue, 7 Jun 2022 09:40:45 -0700
+Subject: [PATCH 98/99] CVE-2022-32742: s4: torture: Add raw.write.bad-write
+ test.
+
+Reproduces the test code in:
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15085
+
+Add knownfail.
+
+Signed-off-by: Jeremy Allison <jra@samba.org>
+Reviewed-by: David Disseldorp <ddiss@samba.org>
+---
+ selftest/knownfail.d/bad-write |  2 +
+ source4/torture/raw/write.c    | 89 ++++++++++++++++++++++++++++++++++
+ 2 files changed, 91 insertions(+)
+ create mode 100644 selftest/knownfail.d/bad-write
+
+diff --git selftest/knownfail.d/bad-write selftest/knownfail.d/bad-write
+new file mode 100644
+index 00000000000..5fc16606a13
+--- /dev/null
++++ selftest/knownfail.d/bad-write
+@@ -0,0 +1,2 @@
++^samba3.raw.write.bad-write\(nt4_dc_smb1\)
++^samba3.raw.write.bad-write\(ad_dc_smb1\)
+diff --git source4/torture/raw/write.c source4/torture/raw/write.c
+index 0a2f50f425b..661485bb548 100644
+--- source4/torture/raw/write.c
++++ source4/torture/raw/write.c
+@@ -25,6 +25,7 @@
+ #include "libcli/libcli.h"
+ #include "torture/util.h"
+ #include "torture/raw/proto.h"
++#include "libcli/raw/raw_proto.h"
+ 
+ #define CHECK_STATUS(status, correct) do { \
+ 	if (!NT_STATUS_EQUAL(status, correct)) { \
+@@ -694,6 +695,93 @@ done:
+ 	return ret;
+ }
+ 
++/*
++  test a deliberately bad SMB1 write.
++*/
++static bool test_bad_write(struct torture_context *tctx,
++		       struct smbcli_state *cli)
++{
++	bool ret = false;
++	int fnum = -1;
++	struct smbcli_request *req = NULL;
++	const char *fname = BASEDIR "\\badwrite.txt";
++	bool ok = false;
++
++	if (!torture_setup_dir(cli, BASEDIR)) {
++		torture_fail(tctx, "failed to setup basedir");
++	}
++
++	torture_comment(tctx, "Testing RAW_BAD_WRITE\n");
++
++	fnum = smbcli_open(cli->tree, fname, O_RDWR|O_CREAT, DENY_NONE);
++	if (fnum == -1) {
++		torture_fail_goto(tctx,
++			done,
++			talloc_asprintf(tctx,
++				"Failed to create %s - %s\n",
++				fname,
++				smbcli_errstr(cli->tree)));
++	}
++
++	req = smbcli_request_setup(cli->tree,
++				   SMBwrite,
++				   5,
++				   0);
++	if (req == NULL) {
++		torture_fail_goto(tctx,
++			done,
++			talloc_asprintf(tctx, "talloc fail\n"));
++	}
++
++	SSVAL(req->out.vwv, VWV(0), fnum);
++	SSVAL(req->out.vwv, VWV(1), 65535); /* bad write length. */
++	SIVAL(req->out.vwv, VWV(2), 0); /* offset */
++	SSVAL(req->out.vwv, VWV(4), 0); /* remaining. */
++
++        if (!smbcli_request_send(req)) {
++		torture_fail_goto(tctx,
++			done,
++			talloc_asprintf(tctx, "Send failed\n"));
++        }
++
++        if (!smbcli_request_receive(req)) {
++		torture_fail_goto(tctx,
++			done,
++			talloc_asprintf(tctx, "Reveive failed\n"));
++	}
++
++	/*
++	 * Check for expected error codes.
++	 * ntvfs returns NT_STATUS_UNSUCCESSFUL.
++	 */
++	ok = (NT_STATUS_EQUAL(req->status, NT_STATUS_INVALID_PARAMETER) ||
++	     NT_STATUS_EQUAL(req->status, NT_STATUS_UNSUCCESSFUL));
++
++	if (!ok) {
++		torture_fail_goto(tctx,
++			done,
++			talloc_asprintf(tctx,
++				"Should have returned "
++				"NT_STATUS_INVALID_PARAMETER or "
++				"NT_STATUS_UNSUCCESSFUL "
++				"got %s\n",
++				nt_errstr(req->status)));
++        }
++
++	ret = true;
++
++done:
++	if (req != NULL) {
++		smbcli_request_destroy(req);
++	}
++	if (fnum != -1) {
++		smbcli_close(cli->tree, fnum);
++	}
++	smb_raw_exit(cli->session);
++	smbcli_deltree(cli->tree, BASEDIR);
++	return ret;
++}
++
+ /*
+    basic testing of write calls
+ */
+@@ -705,6 +793,7 @@ struct torture_suite *torture_raw_write(TALLOC_CTX *mem_ctx)
+ 	torture_suite_add_1smb_test(suite, "write unlock", test_writeunlock);
+ 	torture_suite_add_1smb_test(suite, "write close", test_writeclose);
+ 	torture_suite_add_1smb_test(suite, "writex", test_writex);
++	torture_suite_add_1smb_test(suite, "bad-write", test_bad_write);
+ 
+ 	return suite;
+ }
+-- 
+2.25.1
+
+
+From 7720e0acfd7ea6a2339f3e389aa8dcedd6174095 Mon Sep 17 00:00:00 2001
+From: Jeremy Allison <jra@samba.org>
+Date: Wed, 8 Jun 2022 13:50:51 -0700
+Subject: [PATCH 99/99] CVE-2022-32742: s3: smbd: Harden the smbreq_bufrem()
+ macro.
+
+Fixes the raw.write.bad-write test.
+
+NB. We need the two (==0) changes in source3/smbd/reply.c
+as the gcc optimizer now knows that the return from
+smbreq_bufrem() can never be less than zero.
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15085
+
+Remove knownfail.
+
+Signed-off-by: Jeremy Allison <jra@samba.org>
+Reviewed-by: David Disseldorp <ddiss@samba.org>
+---
+ selftest/knownfail.d/bad-write | 2 --
+ source3/include/smb_macros.h   | 2 +-
+ source3/smbd/reply.c           | 4 ++--
+ 3 files changed, 3 insertions(+), 5 deletions(-)
+ delete mode 100644 selftest/knownfail.d/bad-write
+
+diff --git selftest/knownfail.d/bad-write selftest/knownfail.d/bad-write
+deleted file mode 100644
+index 5fc16606a13..00000000000
+--- selftest/knownfail.d/bad-write
++++ /dev/null
+@@ -1,2 +0,0 @@
+-^samba3.raw.write.bad-write\(nt4_dc_smb1\)
+-^samba3.raw.write.bad-write\(ad_dc_smb1\)
+diff --git source3/include/smb_macros.h source3/include/smb_macros.h
+index def122727f0..de1322a503b 100644
+--- source3/include/smb_macros.h
++++ source3/include/smb_macros.h
+@@ -152,7 +152,7 @@
+ 
+ /* the remaining number of bytes in smb buffer 'buf' from pointer 'p'. */
+ #define smb_bufrem(buf, p) (smb_buflen(buf)-PTR_DIFF(p, smb_buf(buf)))
+-#define smbreq_bufrem(req, p) (req->buflen - PTR_DIFF(p, req->buf))
++#define smbreq_bufrem(req, p) ((req)->buflen < PTR_DIFF((p), (req)->buf) ? 0 : (req)->buflen - PTR_DIFF((p), (req)->buf))
+ 
+ 
+ /* Note that chain_size must be available as an extern int to this macro. */
+diff --git source3/smbd/reply.c source3/smbd/reply.c
+index f33326564f7..b5abe588910 100644
+--- source3/smbd/reply.c
++++ source3/smbd/reply.c
+@@ -342,7 +342,7 @@ size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
+ {
+ 	ssize_t bufrem = smbreq_bufrem(req, src);
+ 
+-	if (bufrem < 0) {
++	if (bufrem == 0) {
+ 		*err = NT_STATUS_INVALID_PARAMETER;
+ 		return 0;
+ 	}
+@@ -380,7 +380,7 @@ size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
+ {
+ 	ssize_t bufrem = smbreq_bufrem(req, src);
+ 
+-	if (bufrem < 0) {
++	if (bufrem == 0) {
+ 		return 0;
+ 	}
+ 
+-- 
+2.25.1
+
diff --git a/net/samba413/files/patch-waf-2.0.20 b/net/samba413/files/patch-waf-2.0.20
new file mode 100644
index 000000000000..3c40ea15f0ed
--- /dev/null
+++ b/net/samba413/files/patch-waf-2.0.20
@@ -0,0 +1,1663 @@
+From 5fc3a71d0f54b176d3cb2e399718d0468507e797 Mon Sep 17 00:00:00 2001
+From: David Mulder <dmulder@suse.com>
+Date: Mon, 24 Aug 2020 13:12:46 -0600
+Subject: [PATCH] waf: upgrade to 2.0.20
+
+This contain an important change:
+"Fix gccdeps.scan() returning nodes that no longer exist on disk."
+https://gitlab.com/ita1024/waf/-/merge_requests/2293
+
+Signed-off-by: David Mulder <dmulder@suse.com>
+Reviewed-by: Stefan Metzmacher <metze@samba.org>
+---
+ buildtools/bin/waf                            |   2 +-
+ buildtools/wafsamba/samba_utils.py            |   2 +-
+ buildtools/wafsamba/samba_waf18.py            |   3 +-
+ buildtools/wafsamba/wafsamba.py               |   2 +-
+ third_party/waf/waflib/Configure.py           |  25 +-
+ third_party/waf/waflib/Context.py             |  18 +-
+ third_party/waf/waflib/Options.py             |  31 +-
+ third_party/waf/waflib/Scripting.py           |   6 +-
+ third_party/waf/waflib/Tools/c_aliases.py     |   4 +-
+ third_party/waf/waflib/Tools/c_config.py      |  22 +-
+ third_party/waf/waflib/Tools/c_tests.py       |  15 +-
+ third_party/waf/waflib/Tools/compiler_c.py    |   2 +-
+ third_party/waf/waflib/Tools/compiler_cxx.py  |   2 +-
+ third_party/waf/waflib/Tools/fc.py            |   4 +-
+ third_party/waf/waflib/Tools/irixcc.py        |  14 +-
+ third_party/waf/waflib/Tools/javaw.py         |   2 +-
+ third_party/waf/waflib/Tools/python.py        |   2 +-
+ third_party/waf/waflib/Tools/qt5.py           |   6 +-
+ third_party/waf/waflib/Utils.py               |   2 +-
+ .../extras/clang_compilation_database.py      | 172 ++++--
+ third_party/waf/waflib/extras/doxygen.py      |   1 +
+ third_party/waf/waflib/extras/gccdeps.py      |  15 +-
+ third_party/waf/waflib/extras/javatest.py     | 135 ++++-
+ third_party/waf/waflib/extras/msvc_pdb.py     |  46 ++
+ third_party/waf/waflib/extras/pytest.py       |  17 +-
+ third_party/waf/waflib/extras/wafcache.py     | 524 ++++++++++++++++++
+ 26 files changed, 942 insertions(+), 132 deletions(-)
+ create mode 100644 third_party/waf/waflib/extras/msvc_pdb.py
+ create mode 100644 third_party/waf/waflib/extras/wafcache.py
+
+diff --git buildtools/bin/waf buildtools/bin/waf
+index 11ce8e7480a..feabe25d131 100755
+--- buildtools/bin/waf
++++ buildtools/bin/waf
+@@ -32,7 +32,7 @@ POSSIBILITY OF SUCH DAMAGE.
+ 
+ import os, sys, inspect
+ 
+-VERSION="2.0.18"
++VERSION="2.0.20"
+ REVISION="x"
+ GIT="x"
+ INSTALL="x"
+diff --git buildtools/wafsamba/samba_utils.py buildtools/wafsamba/samba_utils.py
+index 4afee249d33..0587f525aff 100644
+--- buildtools/wafsamba/samba_utils.py
++++ buildtools/wafsamba/samba_utils.py
+@@ -459,7 +459,7 @@ def RECURSE(ctx, directory):
+         return
+     visited_dirs.add(key)
+     relpath = os.path.relpath(abspath, ctx.path.abspath())
+-    if ctxclass in ['tmp', 'OptionsContext', 'ConfigurationContext', 'BuildContext']:
++    if ctxclass in ['tmp', 'OptionsContext', 'ConfigurationContext', 'BuildContext', 'ClangDbContext']:
+         return ctx.recurse(relpath)
+     if 'waflib.extras.compat15' in sys.modules:
+         return ctx.recurse(relpath)
+diff --git buildtools/wafsamba/samba_waf18.py buildtools/wafsamba/samba_waf18.py
+index c0bb6bfcf55..ecf3891f175 100644
+--- buildtools/wafsamba/samba_waf18.py
++++ buildtools/wafsamba/samba_waf18.py
+@@ -5,6 +5,7 @@ from waflib import Build, Configure, Node, Utils, Options, Logs, TaskGen
+ from waflib import ConfigSet
+ from waflib.TaskGen import feature, after
+ from waflib.Configure import conf, ConfigurationContext
++from waflib.extras import clang_compilation_database
+ 
+ from waflib.Tools.flex import decide_ext
+ 
+@@ -37,7 +38,7 @@ TaskGen.declare_chain(
+ )
+ 
+ 
+-for y in (Build.BuildContext, Build.CleanContext, Build.InstallContext, Build.UninstallContext, Build.ListContext):
++for y in (Build.BuildContext, Build.CleanContext, Build.InstallContext, Build.UninstallContext, Build.ListContext, clang_compilation_database.ClangDbContext):
+     class tmp(y):
+         variant = 'default'
+ 
+diff --git buildtools/wafsamba/wafsamba.py buildtools/wafsamba/wafsamba.py
+index 7827d374654..9f6ee4f5c7f 100644
+--- buildtools/wafsamba/wafsamba.py
++++ buildtools/wafsamba/wafsamba.py
+@@ -38,7 +38,7 @@ LIB_PATH="shared"
+ 
+ os.environ['PYTHONUNBUFFERED'] = '1'
+ 
+-if Context.HEXVERSION not in (0x2001200,):
++if Context.HEXVERSION not in (0x2001400,):
+     Logs.error('''
+ Please use the version of waf that comes with Samba, not
+ a system installed version. See http://wiki.samba.org/index.php/Waf
+diff --git third_party/waf/waflib/Configure.py third_party/waf/waflib/Configure.py
+index 5762eb66954..e7333948489 100644
+--- third_party/waf/waflib/Configure.py
++++ third_party/waf/waflib/Configure.py
+@@ -508,23 +508,27 @@ def find_binary(self, filenames, exts, paths):
+ @conf
+ def run_build(self, *k, **kw):
+ 	"""
+-	Create a temporary build context to execute a build. A reference to that build
+-	context is kept on self.test_bld for debugging purposes, and you should not rely
+-	on it too much (read the note on the cache below).
+-	The parameters given in the arguments to this function are passed as arguments for
+-	a single task generator created in the build. Only three parameters are obligatory:
++	Create a temporary build context to execute a build. A temporary reference to that build
++	context is kept on self.test_bld for debugging purposes.
++	The arguments to this function are passed to a single task generator for that build.
++	Only three parameters are mandatory:
+ 
+ 	:param features: features to pass to a task generator created in the build
+ 	:type features: list of string
+ 	:param compile_filename: file to create for the compilation (default: *test.c*)
+ 	:type compile_filename: string
+-	:param code: code to write in the filename to compile
++	:param code: input file contents
+ 	:type code: string
+ 
+-	Though this function returns *0* by default, the build may set an attribute named *retval* on the
++	Though this function returns *0* by default, the build may bind attribute named *retval* on the
+ 	build context object to return a particular value. See :py:func:`waflib.Tools.c_config.test_exec_fun` for example.
+ 
+-	This function also features a cache which can be enabled by the following option::
++	The temporary builds creates a temporary folder; the name of that folder is calculated
++	by hashing input arguments to this function, with the exception of :py:class:`waflib.ConfigSet.ConfigSet`
++	objects which are used for both reading and writing values.
++
++	This function also features a cache which is disabled by default; that cache relies
++	on the hash value calculated as indicated above::
+ 
+ 		def options(opt):
+ 			opt.add_option('--confcache', dest='confcache', default=0,
+@@ -538,7 +542,10 @@ def run_build(self, *k, **kw):
+ 	buf = []
+ 	for key in sorted(kw.keys()):
+ 		v = kw[key]
+-		if hasattr(v, '__call__'):
++		if isinstance(v, ConfigSet.ConfigSet):
++			# values are being written to, so they are excluded from contributing to the hash
++			continue
++		elif hasattr(v, '__call__'):
+ 			buf.append(Utils.h_fun(v))
+ 		else:
+ 			buf.append(str(v))
+diff --git third_party/waf/waflib/Context.py third_party/waf/waflib/Context.py
+index e3305fa3341..3f1b4fa48ab 100644
+--- third_party/waf/waflib/Context.py
++++ third_party/waf/waflib/Context.py
+@@ -6,20 +6,30 @@
+ Classes and functions enabling the command system
+ """
+ 
+-import os, re, imp, sys
++import os, re, sys
+ from waflib import Utils, Errors, Logs
+ import waflib.Node
+ 
++if sys.hexversion > 0x3040000:
++	import types
++	class imp(object):
++		new_module = lambda x: types.ModuleType(x)
++else:
++	import imp
++
+ # the following 3 constants are updated on each new release (do not touch)
+-HEXVERSION=0x2001200
++HEXVERSION=0x2001400
+ """Constant updated on new releases"""
+ 
+-WAFVERSION="2.0.18"
++WAFVERSION="2.0.20"
+ """Constant updated on new releases"""
+ 
+-WAFREVISION="314689b8994259a84f0de0aaef74d7ce91f541ad"
++WAFREVISION="668769470956da8c5b60817cb8884cd7d0f87cd4"
+ """Git revision when the waf version is updated"""
+ 
++WAFNAME="waf"
++"""Application name displayed on --help"""
++
+ ABI = 20
+ """Version of the build data cache file format (used in :py:const:`waflib.Context.DBFILE`)"""
+ 
+diff --git third_party/waf/waflib/Options.py third_party/waf/waflib/Options.py
+index ad802d4b905..d4104917c82 100644
+--- third_party/waf/waflib/Options.py
++++ third_party/waf/waflib/Options.py
+@@ -44,7 +44,7 @@ class opt_parser(optparse.OptionParser):
+ 	"""
+ 	def __init__(self, ctx, allow_unknown=False):
+ 		optparse.OptionParser.__init__(self, conflict_handler='resolve', add_help_option=False,
+-			version='waf %s (%s)' % (Context.WAFVERSION, Context.WAFREVISION))
++			version='%s %s (%s)' % (Context.WAFNAME, Context.WAFVERSION, Context.WAFREVISION))
+ 		self.formatter.width = Logs.get_term_cols()
+ 		self.ctx = ctx
+ 		self.allow_unknown = allow_unknown
+@@ -62,6 +62,21 @@ class opt_parser(optparse.OptionParser):
+ 				else:
+ 					self.error(str(e))
+ 
++	def _process_long_opt(self, rargs, values):
++		# --custom-option=-ftxyz is interpreted as -f -t... see #2280
++		if self.allow_unknown:
++			back = [] + rargs
++			try:
++				optparse.OptionParser._process_long_opt(self, rargs, values)
++			except optparse.BadOptionError:
++				while rargs:
++					rargs.pop()
++				rargs.extend(back)
++				rargs.pop(0)
++				raise
++		else:
++			optparse.OptionParser._process_long_opt(self, rargs, values)
++
+ 	def print_usage(self, file=None):
+ 		return self.print_help(file)
+ 
+@@ -96,11 +111,11 @@ class opt_parser(optparse.OptionParser):
+ 		lst.sort()
+ 		ret = '\n'.join(lst)
+ 
+-		return '''waf [commands] [options]
++		return '''%s [commands] [options]
+ 
+-Main commands (example: ./waf build -j4)
++Main commands (example: ./%s build -j4)
+ %s
+-''' % ret
++''' % (Context.WAFNAME, Context.WAFNAME, ret)
+ 
+ 
+ class OptionsContext(Context.Context):
+@@ -141,9 +156,9 @@ class OptionsContext(Context.Context):
+ 		gr.add_option('-o', '--out', action='store', default='', help='build dir for the project', dest='out')
+ 		gr.add_option('-t', '--top', action='store', default='', help='src dir for the project', dest='top')
+ 
+-		gr.add_option('--no-lock-in-run', action='store_true', default='', help=optparse.SUPPRESS_HELP, dest='no_lock_in_run')
+-		gr.add_option('--no-lock-in-out', action='store_true', default='', help=optparse.SUPPRESS_HELP, dest='no_lock_in_out')
+-		gr.add_option('--no-lock-in-top', action='store_true', default='', help=optparse.SUPPRESS_HELP, dest='no_lock_in_top')
++		gr.add_option('--no-lock-in-run', action='store_true', default=os.environ.get('NO_LOCK_IN_RUN', ''), help=optparse.SUPPRESS_HELP, dest='no_lock_in_run')
++		gr.add_option('--no-lock-in-out', action='store_true', default=os.environ.get('NO_LOCK_IN_OUT', ''), help=optparse.SUPPRESS_HELP, dest='no_lock_in_out')
++		gr.add_option('--no-lock-in-top', action='store_true', default=os.environ.get('NO_LOCK_IN_TOP', ''), help=optparse.SUPPRESS_HELP, dest='no_lock_in_top')
+ 
+ 		default_prefix = getattr(Context.g_module, 'default_prefix', os.environ.get('PREFIX'))
+ 		if not default_prefix:
+@@ -282,6 +297,8 @@ class OptionsContext(Context.Context):
+ 			elif arg != 'options':
+ 				commands.append(arg)
+ 
++		if options.jobs < 1:
++			options.jobs = 1
+ 		for name in 'top out destdir prefix bindir libdir'.split():
+ 			# those paths are usually expanded from Context.launch_dir
+ 			if getattr(options, name, None):
+diff --git third_party/waf/waflib/Scripting.py third_party/waf/waflib/Scripting.py
+index 68dccf29ce0..da83a2166a1 100644
+--- third_party/waf/waflib/Scripting.py
++++ third_party/waf/waflib/Scripting.py
+@@ -306,7 +306,7 @@ def distclean(ctx):
+ 
+ 	# remove a build folder, if any
+ 	cur = '.'
+-	if ctx.options.no_lock_in_top:
++	if os.environ.get('NO_LOCK_IN_TOP') or ctx.options.no_lock_in_top:
+ 		cur = ctx.options.out
+ 
+ 	try:
+@@ -333,9 +333,9 @@ def distclean(ctx):
+ 			remove_and_log(env.out_dir, shutil.rmtree)
+ 
+ 		env_dirs = [env.out_dir]
+-		if not ctx.options.no_lock_in_top:
++		if not (os.environ.get('NO_LOCK_IN_TOP') or ctx.options.no_lock_in_top):
+ 			env_dirs.append(env.top_dir)
+-		if not ctx.options.no_lock_in_run:
++		if not (os.environ.get('NO_LOCK_IN_RUN') or ctx.options.no_lock_in_run):
+ 			env_dirs.append(env.run_dir)
+ 		for k in env_dirs:
+ 			p = os.path.join(k, Options.lockfile)
+diff --git third_party/waf/waflib/Tools/c_aliases.py third_party/waf/waflib/Tools/c_aliases.py
+index 985e048bdb7..928cfe29caa 100644
+--- third_party/waf/waflib/Tools/c_aliases.py
++++ third_party/waf/waflib/Tools/c_aliases.py
+@@ -38,7 +38,7 @@ def sniff_features(**kw):
+ 	:return: the list of features for a task generator processing the source files
+ 	:rtype: list of string
+ 	"""
+-	exts = get_extensions(kw['source'])
++	exts = get_extensions(kw.get('source', []))
+ 	typ = kw['typ']
+ 	feats = []
+ 
+@@ -72,7 +72,7 @@ def sniff_features(**kw):
+ 				feats.append(x + typ)
+ 				will_link = True
+ 		if not will_link and not kw.get('features', []):
+-			raise Errors.WafError('Cannot link from %r, try passing eg: features="c cprogram"?' % kw)
++			raise Errors.WafError('Unable to determine how to link %r, try adding eg: features="c cshlib"?' % kw)
+ 	return feats
+ 
+ def set_features(kw, typ):
+diff --git third_party/waf/waflib/Tools/c_config.py third_party/waf/waflib/Tools/c_config.py
+index 80580cc9fcb..98187fac2e2 100644
+--- third_party/waf/waflib/Tools/c_config.py
++++ third_party/waf/waflib/Tools/c_config.py
+@@ -86,6 +86,10 @@ def parse_flags(self, line, uselib_store, env=None, force_static=False, posix=No
+ 	:type uselib_store: string
+ 	:param env: config set or conf.env by default
+ 	:type env: :py:class:`waflib.ConfigSet.ConfigSet`
++	:param force_static: force usage of static libraries
++	:type force_static: bool default False
++	:param posix: usage of POSIX mode for shlex lexical analiysis library
++	:type posix: bool default True
+ 	"""
+ 
+ 	assert(isinstance(line, str))
+@@ -103,6 +107,8 @@ def parse_flags(self, line, uselib_store, env=None, force_static=False, posix=No
+ 	lex.commenters = ''
+ 	lst = list(lex)
+ 
++	so_re = re.compile(r"\.so(?:\.[0-9]+)*$")
++
+ 	# append_unique is not always possible
+ 	# for example, apple flags may require both -arch i386 and -arch ppc
+ 	uselib = uselib_store
+@@ -144,7 +150,7 @@ def parse_flags(self, line, uselib_store, env=None, force_static=False, posix=No
+ 		elif x.startswith('-std='):
+ 			prefix = 'CXXFLAGS' if '++' in x else 'CFLAGS'
+ 			app(prefix, x)
+-		elif x.startswith('+') or x in ('-pthread', '-fPIC', '-fpic', '-fPIE', '-fpie'):
++		elif x.startswith('+') or x in ('-pthread', '-fPIC', '-fpic', '-fPIE', '-fpie', '-flto', '-fno-lto'):
+ 			app('CFLAGS', x)
+ 			app('CXXFLAGS', x)
+ 			app('LINKFLAGS', x)
+@@ -180,7 +186,7 @@ def parse_flags(self, line, uselib_store, env=None, force_static=False, posix=No
+ 			app('CFLAGS', tmp)
+ 			app('CXXFLAGS', tmp)
+ 			app('LINKFLAGS', tmp)
+-		elif x.endswith(('.a', '.so', '.dylib', '.lib')):
++		elif x.endswith(('.a', '.dylib', '.lib')) or so_re.search(x):
+ 			appu('LINKFLAGS', x) # not cool, #762
+ 		else:
+ 			self.to_log('Unhandled flag %r' % x)
+@@ -246,6 +252,8 @@ def exec_cfg(self, kw):
+ 	* if modversion is given, then return the module version
+ 	* else, execute the *-config* program with the *args* and *variables* given, and set the flags on the *conf.env.FLAGS_name* variable
+ 
++	:param path: the **-config program to use**
++	:type path: list of string
+ 	:param atleast_pkgconfig_version: minimum pkg-config version to use (disable other tests)
+ 	:type atleast_pkgconfig_version: string
+ 	:param package: package name, for example *gtk+-2.0*
+@@ -260,6 +268,12 @@ def exec_cfg(self, kw):
+ 	:type variables: list of string
+ 	:param define_variable: additional variables to define (also in conf.env.PKG_CONFIG_DEFINES)
+ 	:type define_variable: dict(string: string)
++	:param pkg_config_path: paths where pkg-config should search for .pc config files (overrides env.PKG_CONFIG_PATH if exists)
++	:type pkg_config_path: string, list of directories separated by colon
++	:param force_static: force usage of static libraries
++	:type force_static: bool default False
++	:param posix: usage of POSIX mode for shlex lexical analiysis library
++	:type posix: bool default True
+ 	"""
+ 
+ 	path = Utils.to_list(kw['path'])
+@@ -334,6 +348,7 @@ def check_cfg(self, *k, **kw):
+ 	"""
+ 	Checks for configuration flags using a **-config**-like program (pkg-config, sdl-config, etc).
+ 	This wraps internal calls to :py:func:`waflib.Tools.c_config.validate_cfg` and :py:func:`waflib.Tools.c_config.exec_cfg`
++	so check exec_cfg parameters descriptions for more details on kw passed
+ 
+ 	A few examples::
+ 
+@@ -1267,10 +1282,11 @@ def multicheck(self, *k, **kw):
+ 	tasks = []
+ 
+ 	id_to_task = {}
+-	for dct in k:
++	for counter, dct in enumerate(k):
+ 		x = Task.classes['cfgtask'](bld=bld, env=None)
+ 		tasks.append(x)
+ 		x.args = dct
++		x.args['multicheck_counter'] = counter
+ 		x.bld = bld
+ 		x.conf = self
+ 		x.args = dct
+diff --git third_party/waf/waflib/Tools/c_tests.py third_party/waf/waflib/Tools/c_tests.py
+index 7a4094f2450..bdd186c6bc4 100644
+--- third_party/waf/waflib/Tools/c_tests.py
++++ third_party/waf/waflib/Tools/c_tests.py
+@@ -180,9 +180,15 @@ def check_large_file(self, **kw):
+ ########################################################################################
+ 
+ ENDIAN_FRAGMENT = '''
++#ifdef _MSC_VER
++#define testshlib_EXPORT __declspec(dllexport)
++#else
++#define testshlib_EXPORT
++#endif
++
+ short int ascii_mm[] = { 0x4249, 0x4765, 0x6E44, 0x6961, 0x6E53, 0x7953, 0 };
+ short int ascii_ii[] = { 0x694C, 0x5454, 0x656C, 0x6E45, 0x6944, 0x6E61, 0 };
+-int use_ascii (int i) {
++int testshlib_EXPORT use_ascii (int i) {
+ 	return ascii_mm[i] + ascii_ii[i];
+ }
+ short int ebcdic_ii[] = { 0x89D3, 0xE3E3, 0x8593, 0x95C5, 0x89C4, 0x9581, 0 };
+@@ -208,12 +214,12 @@ class grep_for_endianness(Task.Task):
+ 			return -1
+ 
+ @feature('grep_for_endianness')
+-@after_method('process_source')
++@after_method('apply_link')
+ def grep_for_endianness_fun(self):
+ 	"""
+ 	Used by the endianness configuration test
+ 	"""
+-	self.create_task('grep_for_endianness', self.compiled_tasks[0].outputs[0])
++	self.create_task('grep_for_endianness', self.link_task.outputs[0])
+ 
+ @conf
+ def check_endianness(self):
+@@ -223,7 +229,8 @@ def check_endianness(self):
+ 	tmp = []
+ 	def check_msg(self):
+ 		return tmp[0]
+-	self.check(fragment=ENDIAN_FRAGMENT, features='c grep_for_endianness',
++
++	self.check(fragment=ENDIAN_FRAGMENT, features='c cshlib grep_for_endianness',
+ 		msg='Checking for endianness', define='ENDIANNESS', tmp=tmp,
+ 		okmsg=check_msg, confcache=None)
+ 	return tmp[0]
+diff --git third_party/waf/waflib/Tools/compiler_c.py third_party/waf/waflib/Tools/compiler_c.py
+index 2dba3f82704..931dc57efec 100644
+--- third_party/waf/waflib/Tools/compiler_c.py
++++ third_party/waf/waflib/Tools/compiler_c.py
+@@ -37,7 +37,7 @@ from waflib.Logs import debug
+ 
+ c_compiler = {
+ 'win32':  ['msvc', 'gcc', 'clang'],
+-'cygwin': ['gcc'],
++'cygwin': ['gcc', 'clang'],
+ 'darwin': ['clang', 'gcc'],
+ 'aix':    ['xlc', 'gcc', 'clang'],
+ 'linux':  ['gcc', 'clang', 'icc'],
+diff --git third_party/waf/waflib/Tools/compiler_cxx.py third_party/waf/waflib/Tools/compiler_cxx.py
+index 1af65a226dc..09fca7e4dc6 100644
+--- third_party/waf/waflib/Tools/compiler_cxx.py
++++ third_party/waf/waflib/Tools/compiler_cxx.py
+@@ -38,7 +38,7 @@ from waflib.Logs import debug
+ 
+ cxx_compiler = {
+ 'win32':  ['msvc', 'g++', 'clang++'],
+-'cygwin': ['g++'],
++'cygwin': ['g++', 'clang++'],
+ 'darwin': ['clang++', 'g++'],
+ 'aix':    ['xlc++', 'g++', 'clang++'],
+ 'linux':  ['g++', 'clang++', 'icpc'],
+diff --git third_party/waf/waflib/Tools/fc.py third_party/waf/waflib/Tools/fc.py
+index fd4d39c90ae..7fbd76d3650 100644
+--- third_party/waf/waflib/Tools/fc.py
++++ third_party/waf/waflib/Tools/fc.py
+@@ -13,8 +13,8 @@ from waflib.TaskGen import extension
+ from waflib.Configure import conf
+ 
+ ccroot.USELIB_VARS['fc'] = set(['FCFLAGS', 'DEFINES', 'INCLUDES', 'FCPPFLAGS'])
+-ccroot.USELIB_VARS['fcprogram_test'] = ccroot.USELIB_VARS['fcprogram'] = set(['LIB', 'STLIB', 'LIBPATH', 'STLIBPATH', 'LINKFLAGS', 'RPATH', 'LINKDEPS'])
+-ccroot.USELIB_VARS['fcshlib'] = set(['LIB', 'STLIB', 'LIBPATH', 'STLIBPATH', 'LINKFLAGS', 'RPATH', 'LINKDEPS'])
++ccroot.USELIB_VARS['fcprogram_test'] = ccroot.USELIB_VARS['fcprogram'] = set(['LIB', 'STLIB', 'LIBPATH', 'STLIBPATH', 'LINKFLAGS', 'RPATH', 'LINKDEPS', 'LDFLAGS'])
++ccroot.USELIB_VARS['fcshlib'] = set(['LIB', 'STLIB', 'LIBPATH', 'STLIBPATH', 'LINKFLAGS', 'RPATH', 'LINKDEPS', 'LDFLAGS'])
+ ccroot.USELIB_VARS['fcstlib'] = set(['ARFLAGS', 'LINKDEPS'])
+ 
+ @extension('.f','.F','.f90','.F90','.for','.FOR','.f95','.F95','.f03','.F03','.f08','.F08')
+diff --git third_party/waf/waflib/Tools/irixcc.py third_party/waf/waflib/Tools/irixcc.py
+index c3ae1ac915c..0335c13cb61 100644
+--- third_party/waf/waflib/Tools/irixcc.py
++++ third_party/waf/waflib/Tools/irixcc.py
+@@ -13,22 +13,11 @@ from waflib.Configure import conf
+ @conf
+ def find_irixcc(conf):
+ 	v = conf.env
+-	cc = None
+-	if v.CC:
+-		cc = v.CC
+-	elif 'CC' in conf.environ:
+-		cc = conf.environ['CC']
+-	if not cc:
+-		cc = conf.find_program('cc', var='CC')
+-	if not cc:
+-		conf.fatal('irixcc was not found')
+-
++	cc = conf.find_program('cc', var='CC')
+ 	try:
+ 		conf.cmd_and_log(cc + ['-version'])
+ 	except Errors.WafError:
+ 		conf.fatal('%r -version could not be executed' % cc)
+-
+-	v.CC = cc
+ 	v.CC_NAME = 'irix'
+ 
+ @conf
+@@ -57,7 +46,6 @@ def irixcc_common_flags(conf):
+ 
+ def configure(conf):
+ 	conf.find_irixcc()
+-	conf.find_cpp()
+ 	conf.find_ar()
+ 	conf.irixcc_common_flags()
+ 	conf.cc_load_tools()
+diff --git third_party/waf/waflib/Tools/javaw.py third_party/waf/waflib/Tools/javaw.py
+index ceb08c28c87..b7f5dd1f87f 100644
+--- third_party/waf/waflib/Tools/javaw.py
++++ third_party/waf/waflib/Tools/javaw.py
+@@ -251,7 +251,7 @@ def use_javac_files(self):
+ 					base_node = tg.path.get_bld()
+ 
+ 				self.use_lst.append(base_node.abspath())
+-				self.javac_task.dep_nodes.extend([x for x in base_node.ant_glob(JAR_RE, remove=False, quiet=True)])
++				self.javac_task.dep_nodes.extend([dx for dx in base_node.ant_glob(JAR_RE, remove=False, quiet=True)])
+ 
+ 				for tsk in tg.tasks:
+ 					self.javac_task.set_run_after(tsk)
+diff --git third_party/waf/waflib/Tools/python.py third_party/waf/waflib/Tools/python.py
+index 7c45a76ffd2..b1c8dd01285 100644
+--- third_party/waf/waflib/Tools/python.py
++++ third_party/waf/waflib/Tools/python.py
+@@ -620,7 +620,7 @@ def configure(conf):
+ 	v.PYO = getattr(Options.options, 'pyo', 1)
+ 
+ 	try:
+-		v.PYTAG = conf.cmd_and_log(conf.env.PYTHON + ['-c', "import imp;print(imp.get_tag())"]).strip()
++		v.PYTAG = conf.cmd_and_log(conf.env.PYTHON + ['-c', "import sys\ntry:\n print(sys.implementation.cache_tag)\nexcept AttributeError:\n import imp\n print(imp.get_tag())\n"]).strip()
+ 	except Errors.WafError:
+ 		pass
+ 
+diff --git third_party/waf/waflib/Tools/qt5.py third_party/waf/waflib/Tools/qt5.py
+index 287c25374a4..99e021bae61 100644
+--- third_party/waf/waflib/Tools/qt5.py
++++ third_party/waf/waflib/Tools/qt5.py
+@@ -482,8 +482,8 @@ def configure(self):
+ 		self.fatal('No CXX compiler defined: did you forget to configure compiler_cxx first?')
+ 
+ 	# Qt5 may be compiled with '-reduce-relocations' which requires dependent programs to have -fPIE or -fPIC?
+-	frag = '#include <QApplication>\nint main(int argc, char **argv) {return 0;}\n'
+-	uses = 'QT5CORE QT5WIDGETS QT5GUI'
++	frag = '#include <QMap>\nint main(int argc, char **argv) {QMap<int,int> m;return m.keys().size();}\n'
++	uses = 'QT5CORE'
+ 	for flag in [[], '-fPIE', '-fPIC', '-std=c++11' , ['-std=c++11', '-fPIE'], ['-std=c++11', '-fPIC']]:
+ 		msg = 'See if Qt files compile '
+ 		if flag:
+@@ -499,7 +499,7 @@ def configure(self):
+ 
+ 	# FreeBSD does not add /usr/local/lib and the pkg-config files do not provide it either :-/
+ 	if Utils.unversioned_sys_platform() == 'freebsd':
+-		frag = '#include <QApplication>\nint main(int argc, char **argv) { QApplication app(argc, argv); return NULL != (void*) (&app);}\n'
++		frag = '#include <QMap>\nint main(int argc, char **argv) {QMap<int,int> m;return m.keys().size();}\n'
+ 		try:
+ 			self.check(features='qt5 cxx cxxprogram', use=uses, fragment=frag, msg='Can we link Qt programs on FreeBSD directly?')
+ 		except self.errors.ConfigurationError:
+diff --git third_party/waf/waflib/Utils.py third_party/waf/waflib/Utils.py
+index 7472226da58..fc64fa05154 100644
+--- third_party/waf/waflib/Utils.py
++++ third_party/waf/waflib/Utils.py
+@@ -891,7 +891,7 @@ def run_prefork_process(cmd, kwargs, cargs):
+ 	"""
+ 	Delegates process execution to a pre-forked process instance.
+ 	"""
+-	if not 'env' in kwargs:
++	if not kwargs.get('env'):
+ 		kwargs['env'] = dict(os.environ)
+ 	try:
+ 		obj = base64.b64encode(cPickle.dumps([cmd, kwargs, cargs]))
+diff --git third_party/waf/waflib/extras/clang_compilation_database.py third_party/waf/waflib/extras/clang_compilation_database.py
+index 4d9b5e275ae..ff71f22ecfd 100644
+--- third_party/waf/waflib/extras/clang_compilation_database.py
++++ third_party/waf/waflib/extras/clang_compilation_database.py
+@@ -1,6 +1,7 @@
+ #!/usr/bin/env python
+ # encoding: utf-8
+ # Christoph Koke, 2013
++# Alibek Omarov, 2019
+ 
+ """
+ Writes the c and cpp compile commands into build/compile_commands.json
+@@ -8,14 +9,23 @@ see http://clang.llvm.org/docs/JSONCompilationDatabase.html
+ 
+ Usage:
+ 
+-    def configure(conf):
+-        conf.load('compiler_cxx')
+-        ...
+-        conf.load('clang_compilation_database')
++	Load this tool in `options` to be able to generate database
++	by request in command-line and before build:
++
++	$ waf clangdb
++
++	def options(opt):
++		opt.load('clang_compilation_database')
++
++	Otherwise, load only in `configure` to generate it always before build.
++
++	def configure(conf):
++		conf.load('compiler_cxx')
++		...
++		conf.load('clang_compilation_database')
+ """
+ 
+-import sys, os, json, shlex, pipes
+-from waflib import Logs, TaskGen, Task
++from waflib import Logs, TaskGen, Task, Build, Scripting
+ 
+ Task.Task.keep_last_cmd = True
+ 
+@@ -23,63 +33,103 @@ Task.Task.keep_last_cmd = True
+ @TaskGen.after_method('process_use')
+ def collect_compilation_db_tasks(self):
+ 	"Add a compilation database entry for compiled tasks"
+-	try:
+-		clang_db = self.bld.clang_compilation_database_tasks
+-	except AttributeError:
+-		clang_db = self.bld.clang_compilation_database_tasks = []
+-		self.bld.add_post_fun(write_compilation_database)
++	if not isinstance(self.bld, ClangDbContext):
++		return
+ 
+ 	tup = tuple(y for y in [Task.classes.get(x) for x in ('c', 'cxx')] if y)
+ 	for task in getattr(self, 'compiled_tasks', []):
+ 		if isinstance(task, tup):
+-			clang_db.append(task)
+-
+-def write_compilation_database(ctx):
+-	"Write the clang compilation database as JSON"
+-	database_file = ctx.bldnode.make_node('compile_commands.json')
+-	Logs.info('Build commands will be stored in %s', database_file.path_from(ctx.path))
+-	try:
+-		root = json.load(database_file)
+-	except IOError:
+-		root = []
+-	clang_db = dict((x['file'], x) for x in root)
+-	for task in getattr(ctx, 'clang_compilation_database_tasks', []):
++			self.bld.clang_compilation_database_tasks.append(task)
++
++class ClangDbContext(Build.BuildContext):
++	'''generates compile_commands.json by request'''
++	cmd = 'clangdb'
++	clang_compilation_database_tasks = []
++
++	def write_compilation_database(self):
++		"""
++		Write the clang compilation database as JSON
++		"""
++		database_file = self.bldnode.make_node('compile_commands.json')
++		Logs.info('Build commands will be stored in %s', database_file.path_from(self.path))
+ 		try:
+-			cmd = task.last_cmd
+-		except AttributeError:
+-			continue
+-		directory = getattr(task, 'cwd', ctx.variant_dir)
+-		f_node = task.inputs[0]
+-		filename = os.path.relpath(f_node.abspath(), directory)
+-		entry = {
+-			"directory": directory,
+-			"arguments": cmd,
+-			"file": filename,
+-		}
+-		clang_db[filename] = entry
+-	root = list(clang_db.values())
+-	database_file.write(json.dumps(root, indent=2))
+-
+-# Override the runnable_status function to do a dummy/dry run when the file doesn't need to be compiled.
+-# This will make sure compile_commands.json is always fully up to date.
+-# Previously you could end up with a partial compile_commands.json if the build failed.
+-for x in ('c', 'cxx'):
+-	if x not in Task.classes:
+-		continue
+-
+-	t = Task.classes[x]
+-
+-	def runnable_status(self):
+-		def exec_command(cmd, **kw):
+-			pass
+-
+-		run_status = self.old_runnable_status()
+-		if run_status == Task.SKIP_ME:
+-			setattr(self, 'old_exec_command', getattr(self, 'exec_command', None))
+-			setattr(self, 'exec_command', exec_command)
+-			self.run()
+-			setattr(self, 'exec_command', getattr(self, 'old_exec_command', None))
+-		return run_status
+-
+-	setattr(t, 'old_runnable_status', getattr(t, 'runnable_status', None))
+-	setattr(t, 'runnable_status', runnable_status)
++			root = database_file.read_json()
++		except IOError:
++			root = []
++		clang_db = dict((x['file'], x) for x in root)
++		for task in self.clang_compilation_database_tasks:
++			try:
++				cmd = task.last_cmd
++			except AttributeError:
++				continue
++			f_node = task.inputs[0]
++			filename = f_node.path_from(task.get_cwd())
++			entry = {
++				"directory": task.get_cwd().abspath(),
++				"arguments": cmd,
++				"file": filename,
++			}
++			clang_db[filename] = entry
++		root = list(clang_db.values())
++		database_file.write_json(root)
++
++	def execute(self):
++		"""
++		Build dry run
++		"""
++		self.restore()
++
++		if not self.all_envs:
++			self.load_envs()
++
++		self.recurse([self.run_dir])
++		self.pre_build()
++
++		# we need only to generate last_cmd, so override
++		# exec_command temporarily
++		def exec_command(self, *k, **kw):
++			return 0
++
++		for g in self.groups:
++			for tg in g:
++				try:
++					f = tg.post
++				except AttributeError:
++					pass
++				else:
++					f()
++
++				if isinstance(tg, Task.Task):
++					lst = [tg]
++				else: lst = tg.tasks
++				for tsk in lst:
++					tup = tuple(y for y in [Task.classes.get(x) for x in ('c', 'cxx')] if y)
++					if isinstance(tsk, tup):
++						old_exec = tsk.exec_command
++						tsk.exec_command = exec_command
++						tsk.run()
++						tsk.exec_command = old_exec
++
++		self.write_compilation_database()
++
++EXECUTE_PATCHED = False
++def patch_execute():
++	global EXECUTE_PATCHED
++
++	if EXECUTE_PATCHED:
++		return
++
++	def new_execute_build(self):
++		"""
++		Invoke clangdb command before build
++		"""
++		if self.cmd.startswith('build'):
++			Scripting.run_command('clangdb')
++
++		old_execute_build(self)
++
++	old_execute_build = getattr(Build.BuildContext, 'execute_build', None)
++	setattr(Build.BuildContext, 'execute_build', new_execute_build)
++	EXECUTE_PATCHED = True
++
++patch_execute()
+diff --git third_party/waf/waflib/extras/doxygen.py third_party/waf/waflib/extras/doxygen.py
+index 20cd9e1a852..de75bc2738a 100644
+--- third_party/waf/waflib/extras/doxygen.py
++++ third_party/waf/waflib/extras/doxygen.py
+@@ -69,6 +69,7 @@ def parse_doxy(txt):
+ class doxygen(Task.Task):
+ 	vars  = ['DOXYGEN', 'DOXYFLAGS']
+ 	color = 'BLUE'
++	ext_in = [ '.py', '.c', '.h', '.java', '.pb.cc' ]
+ 
+ 	def runnable_status(self):
+ 		'''
+diff --git third_party/waf/waflib/extras/gccdeps.py third_party/waf/waflib/extras/gccdeps.py
+index bfabe72e6fd..c3a809e252a 100644
+--- third_party/waf/waflib/extras/gccdeps.py
++++ third_party/waf/waflib/extras/gccdeps.py
+@@ -27,7 +27,7 @@ if not c_preproc.go_absolute:
+ 	gccdeps_flags = ['-MMD']
+ 
+ # Third-party tools are allowed to add extra names in here with append()
+-supported_compilers = ['gcc', 'icc', 'clang']
++supported_compilers = ['gas', 'gcc', 'icc', 'clang']
+ 
+ def scan(self):
+ 	if not self.__class__.__name__ in self.env.ENABLE_GCCDEPS:
+@@ -175,14 +175,14 @@ def wrap_compiled_task(classname):
+ 	derived_class.scan = scan
+ 	derived_class.sig_implicit_deps = sig_implicit_deps
+ 
+-for k in ('c', 'cxx'):
++for k in ('asm', 'c', 'cxx'):
+ 	if k in Task.classes:
+ 		wrap_compiled_task(k)
+ 
+ @before_method('process_source')
+ @feature('force_gccdeps')
+ def force_gccdeps(self):
+-	self.env.ENABLE_GCCDEPS = ['c', 'cxx']
++	self.env.ENABLE_GCCDEPS = ['asm', 'c', 'cxx']
+ 
+ def configure(conf):
+ 	# in case someone provides a --enable-gccdeps command-line option
+@@ -191,6 +191,15 @@ def configure(conf):
+ 
+ 	global gccdeps_flags
+ 	flags = conf.env.GCCDEPS_FLAGS or gccdeps_flags
++	if conf.env.ASM_NAME in supported_compilers:
++		try:
++			conf.check(fragment='', features='asm force_gccdeps', asflags=flags, compile_filename='test.S', msg='Checking for asm flags %r' % ''.join(flags))
++		except Errors.ConfigurationError:
++			pass
++		else:
++			conf.env.append_value('ASFLAGS', flags)
++			conf.env.append_unique('ENABLE_GCCDEPS', 'asm')
++
+ 	if conf.env.CC_NAME in supported_compilers:
+ 		try:
+ 			conf.check(fragment='int main() { return 0; }', features='c force_gccdeps', cflags=flags, msg='Checking for c flags %r' % ''.join(flags))
+diff --git third_party/waf/waflib/extras/javatest.py third_party/waf/waflib/extras/javatest.py
+index 979b8d8242d..76d40edf250 100755
+--- third_party/waf/waflib/extras/javatest.py
++++ third_party/waf/waflib/extras/javatest.py
+@@ -1,6 +1,6 @@
+ #! /usr/bin/env python
+ # encoding: utf-8
+-# Federico Pellegrin, 2017 (fedepell)
++# Federico Pellegrin, 2019 (fedepell)
+ 
+ """
+ Provides Java Unit test support using :py:class:`waflib.Tools.waf_unit_test.utest`
+@@ -11,6 +11,10 @@ standard waf unit test environment. It has been tested with TestNG and JUnit
+ but should be easily expandable to other frameworks given the flexibility of
+ ut_str provided by the standard waf unit test environment.
+ 
++The extra takes care also of managing non-java dependencies (ie. C/C++ libraries
++using JNI or Python modules via JEP) and setting up the environment needed to run
++them.
++
+ Example usage:
+ 
+ def options(opt):
+@@ -20,15 +24,15 @@ def configure(conf):
+ 	conf.load('java javatest')
+ 
+ def build(bld):
+-	
++
+ 	[ ... mainprog is built here ... ]
+ 
+ 	bld(features = 'javac javatest',
+-		srcdir     = 'test/', 
+-		outdir     = 'test', 
++		srcdir     = 'test/',
++		outdir     = 'test',
+ 		sourcepath = ['test'],
+-		classpath  = [ 'src' ], 
+-		basedir    = 'test', 
++		classpath  = [ 'src' ],
++		basedir    = 'test',
+ 		use = ['JAVATEST', 'mainprog'], # mainprog is the program being tested in src/
+ 		ut_str = 'java -cp ${CLASSPATH} ${JTRUNNER} ${SRC}',
+ 		jtest_source = bld.path.ant_glob('test/*.xml'),
+@@ -53,10 +57,107 @@ The runner class presence on the system is checked for at configuration stage.
+ """
+ 
+ import os
+-from waflib import Task, TaskGen, Options
++from waflib import Task, TaskGen, Options, Errors, Utils, Logs
++from waflib.Tools import ccroot
++
++JAR_RE = '**/*'
++
++def _process_use_rec(self, name):
++	"""
++	Recursively process ``use`` for task generator with name ``name``..
++	Used by javatest_process_use.
++	"""
++	if name in self.javatest_use_not or name in self.javatest_use_seen:
++		return
++	try:
++		tg = self.bld.get_tgen_by_name(name)
++	except Errors.WafError:
++		self.javatest_use_not.add(name)
++		return
++
++	self.javatest_use_seen.append(name)
++	tg.post()
++
++	for n in self.to_list(getattr(tg, 'use', [])):
++		_process_use_rec(self, n)
++
++@TaskGen.feature('javatest')
++@TaskGen.after_method('process_source', 'apply_link', 'use_javac_files')
++def javatest_process_use(self):
++	"""
++	Process the ``use`` attribute which contains a list of task generator names and store
++	paths that later is used to populate the unit test runtime environment.
++	"""
++	self.javatest_use_not = set()
++	self.javatest_use_seen = []
++	self.javatest_libpaths = [] # strings or Nodes
++	self.javatest_pypaths = [] # strings or Nodes
++	self.javatest_dep_nodes = []
++
++	names = self.to_list(getattr(self, 'use', []))
++	for name in names:
++		_process_use_rec(self, name)
++
++	def extend_unique(lst, varlst):
++		ext = []
++		for x in varlst:
++			if x not in lst:
++				ext.append(x)
++		lst.extend(ext)
++
++	# Collect type specific info needed to construct a valid runtime environment
++	# for the test.
++	for name in self.javatest_use_seen:
++		tg = self.bld.get_tgen_by_name(name)
++
++		# Python-Java embedding crosstools such as JEP
++		if 'py' in tg.features:
++			# Python dependencies are added to PYTHONPATH
++			pypath = getattr(tg, 'install_from', tg.path)
++
++			if 'buildcopy' in tg.features:
++				# Since buildcopy is used we assume that PYTHONPATH in build should be used,
++				# not source
++				extend_unique(self.javatest_pypaths, [pypath.get_bld().abspath()])
++
++				# Add buildcopy output nodes to dependencies
++				extend_unique(self.javatest_dep_nodes, [o for task in getattr(tg, 'tasks', []) for o in getattr(task, 'outputs', [])])
++			else:
++				# If buildcopy is not used, depend on sources instead
++				extend_unique(self.javatest_dep_nodes, tg.source)
++				extend_unique(self.javatest_pypaths, [pypath.abspath()])
++
++
++		if getattr(tg, 'link_task', None):
++			# For tasks with a link_task (C, C++, D et.c.) include their library paths:
++			if not isinstance(tg.link_task, ccroot.stlink_task):
++				extend_unique(self.javatest_dep_nodes, tg.link_task.outputs)
++				extend_unique(self.javatest_libpaths, tg.link_task.env.LIBPATH)
++
++				if 'pyext' in tg.features:
++					# If the taskgen is extending Python we also want to add the interpreter libpath.
++					extend_unique(self.javatest_libpaths, tg.link_task.env.LIBPATH_PYEXT)
++				else:
++					# Only add to libpath if the link task is not a Python extension
++					extend_unique(self.javatest_libpaths, [tg.link_task.outputs[0].parent.abspath()])
++
++		if 'javac' in tg.features or 'jar' in tg.features:
++			if hasattr(tg, 'jar_task'):
++				# For Java JAR tasks depend on generated JAR
++				extend_unique(self.javatest_dep_nodes, tg.jar_task.outputs)
++			else:
++				# For Java non-JAR ones we need to glob generated files (Java output files are not predictable)
++				if hasattr(tg, 'outdir'):
++					base_node = tg.outdir
++				else:
++					base_node = tg.path.get_bld()
++
++				self.javatest_dep_nodes.extend([dx for dx in base_node.ant_glob(JAR_RE, remove=False, quiet=True)])
++
++
+ 
+ @TaskGen.feature('javatest')
+-@TaskGen.after_method('apply_java', 'use_javac_files', 'set_classpath')
++@TaskGen.after_method('apply_java', 'use_javac_files', 'set_classpath', 'javatest_process_use')
+ def make_javatest(self):
+ 	"""
+ 	Creates a ``utest`` task with a populated environment for Java Unit test execution
+@@ -65,6 +166,9 @@ def make_javatest(self):
+ 	tsk = self.create_task('utest')
+ 	tsk.set_run_after(self.javac_task)
+ 
++	# Dependencies from recursive use analysis
++	tsk.dep_nodes.extend(self.javatest_dep_nodes)
++
+ 	# Put test input files as waf_unit_test relies on that for some prints and log generation
+ 	# If jtest_source is there, this is specially useful for passing XML for TestNG
+ 	# that contain test specification, use that as inputs, otherwise test sources
+@@ -97,6 +201,21 @@ def make_javatest(self):
+ 
+ 	if not hasattr(self, 'ut_env'):
+ 		self.ut_env = dict(os.environ)
++		def add_paths(var, lst):
++			# Add list of paths to a variable, lst can contain strings or nodes
++			lst = [ str(n) for n in lst ]
++			Logs.debug("ut: %s: Adding paths %s=%s", self, var, lst)
++			self.ut_env[var] = os.pathsep.join(lst) + os.pathsep + self.ut_env.get(var, '')
++
++		add_paths('PYTHONPATH', self.javatest_pypaths)
++
++		if Utils.is_win32:
++			add_paths('PATH', self.javatest_libpaths)
++		elif Utils.unversioned_sys_platform() == 'darwin':
++			add_paths('DYLD_LIBRARY_PATH', self.javatest_libpaths)
++			add_paths('LD_LIBRARY_PATH', self.javatest_libpaths)
++		else:
++			add_paths('LD_LIBRARY_PATH', self.javatest_libpaths)
+ 
+ def configure(ctx):
+ 	cp = ctx.env.CLASSPATH or '.'
+diff --git third_party/waf/waflib/extras/msvc_pdb.py third_party/waf/waflib/extras/msvc_pdb.py
+new file mode 100644
+index 00000000000..077656b4f7e
+--- /dev/null
++++ third_party/waf/waflib/extras/msvc_pdb.py
+@@ -0,0 +1,46 @@
++#!/usr/bin/env python
++# encoding: utf-8
++# Rafaël Kooi 2019
++
++from waflib import TaskGen
++
++@TaskGen.feature('c', 'cxx', 'fc')
++@TaskGen.after_method('propagate_uselib_vars')
++def add_pdb_per_object(self):
++	"""For msvc/fortran, specify a unique compile pdb per object, to work
++	around LNK4099. Flags are updated with a unique /Fd flag based on the
++	task output name. This is separate from the link pdb.
++	"""
++	if not hasattr(self, 'compiled_tasks'):
++		return
++
++	link_task = getattr(self, 'link_task', None)
++
++	for task in self.compiled_tasks:
++		if task.inputs and task.inputs[0].name.lower().endswith('.rc'):
++			continue
++
++		add_pdb = False
++		for flagname in ('CFLAGS', 'CXXFLAGS', 'FCFLAGS'):
++			# several languages may be used at once
++			for flag in task.env[flagname]:
++				if flag[1:].lower() == 'zi':
++					add_pdb = True
++					break
++
++		if add_pdb:
++			node = task.outputs[0].change_ext('.pdb')
++			pdb_flag = '/Fd:' + node.abspath()
++
++			for flagname in ('CFLAGS', 'CXXFLAGS', 'FCFLAGS'):
++				buf = [pdb_flag]
++				for flag in task.env[flagname]:
++					if flag[1:3] == 'Fd' or flag[1:].lower() == 'fs' or flag[1:].lower() == 'mp':
++						continue
++					buf.append(flag)
++				task.env[flagname] = buf
++
++			if link_task and not node in link_task.dep_nodes:
++				link_task.dep_nodes.append(node)
++			if not node in task.outputs:
++				task.outputs.append(node)
+diff --git third_party/waf/waflib/extras/pytest.py third_party/waf/waflib/extras/pytest.py
+index 7dd5a1a087a..fc9ad1c23e4 100644
+--- third_party/waf/waflib/extras/pytest.py
++++ third_party/waf/waflib/extras/pytest.py
+@@ -40,6 +40,8 @@ the following environment variables for the `pytest` test runner:
+ 
+    - `pytest_libpath` attribute is used to manually specify additional linker paths.
+ 
++3. Java class search path (CLASSPATH) of any Java/Javalike dependency
++
+ Note: `pytest` cannot automatically determine the correct `PYTHONPATH` for `pyext` taskgens
+       because the extension might be part of a Python package or used standalone:
+ 
+@@ -119,6 +121,7 @@ def pytest_process_use(self):
+ 	self.pytest_use_seen = []
+ 	self.pytest_paths = [] # strings or Nodes
+ 	self.pytest_libpaths = [] # strings or Nodes
++	self.pytest_javapaths = [] # strings or Nodes
+ 	self.pytest_dep_nodes = []
+ 
+ 	names = self.to_list(getattr(self, 'use', []))
+@@ -157,6 +160,17 @@ def pytest_process_use(self):
+ 				extend_unique(self.pytest_dep_nodes, tg.source)
+ 				extend_unique(self.pytest_paths, [pypath.abspath()])
+ 
++		if 'javac' in tg.features:
++			# If a JAR is generated point to that, otherwise to directory
++			if getattr(tg, 'jar_task', None):
++				extend_unique(self.pytest_javapaths, [tg.jar_task.outputs[0].abspath()])
++			else:
++				extend_unique(self.pytest_javapaths, [tg.path.get_bld()])
++
++			# And add respective dependencies if present
++			if tg.use_lst:
++				extend_unique(self.pytest_javapaths, tg.use_lst)
++
+ 		if getattr(tg, 'link_task', None):
+ 			# For tasks with a link_task (C, C++, D et.c.) include their library paths:
+ 			if not isinstance(tg.link_task, ccroot.stlink_task):
+@@ -212,8 +226,9 @@ def make_pytest(self):
+ 			Logs.debug("ut: %s: Adding paths %s=%s", self, var, lst)
+ 			self.ut_env[var] = os.pathsep.join(lst) + os.pathsep + self.ut_env.get(var, '')
+ 
+-		# Prepend dependency paths to PYTHONPATH and LD_LIBRARY_PATH
++		# Prepend dependency paths to PYTHONPATH, CLASSPATH and LD_LIBRARY_PATH
+ 		add_paths('PYTHONPATH', self.pytest_paths)
++		add_paths('CLASSPATH', self.pytest_javapaths)
+ 
+ 		if Utils.is_win32:
+ 			add_paths('PATH', self.pytest_libpaths)
+diff --git third_party/waf/waflib/extras/wafcache.py third_party/waf/waflib/extras/wafcache.py
+new file mode 100644
+index 00000000000..8b9567faf14
+--- /dev/null
++++ third_party/waf/waflib/extras/wafcache.py
+@@ -0,0 +1,524 @@
++#! /usr/bin/env python
++# encoding: utf-8
++# Thomas Nagy, 2019 (ita)
++
++"""
++Filesystem-based cache system to share and re-use build artifacts
++
++Cache access operations (copy to and from) are delegated to
++independent pre-forked worker subprocesses.
++
++The following environment variables may be set:
++* WAFCACHE: several possibilities:
++  - File cache:
++    absolute path of the waf cache (~/.cache/wafcache_user,
++    where `user` represents the currently logged-in user)
++  - URL to a cache server, for example:
++    export WAFCACHE=http://localhost:8080/files/
++    in that case, GET/POST requests are made to urls of the form
++    http://localhost:8080/files/000000000/0 (cache management is then up to the server)
++  - GCS or S3 bucket
++    gs://my-bucket/
++    s3://my-bucket/
++* WAFCACHE_NO_PUSH: if set, disables pushing to the cache
++* WAFCACHE_VERBOSITY: if set, displays more detailed cache operations
++
++File cache specific options:
++  Files are copied using hard links by default; if the cache is located
++  onto another partition, the system switches to file copies instead.
++* WAFCACHE_TRIM_MAX_FOLDER: maximum amount of tasks to cache (1M)
++* WAFCACHE_EVICT_MAX_BYTES: maximum amount of cache size in bytes (10GB)
++* WAFCACHE_EVICT_INTERVAL_MINUTES: minimum time interval to try
++                                   and trim the cache (3 minutess)
++Usage::
++
++	def build(bld):
++		bld.load('wafcache')
++		...
++
++To troubleshoot::
++
++	waf clean build --zones=wafcache
++"""
++
++import atexit, base64, errno, fcntl, getpass, os, shutil, sys, time, traceback, urllib3
++try:
++	import subprocess32 as subprocess
++except ImportError:
++	import subprocess
++
++base_cache = os.path.expanduser('~/.cache/')
++if not os.path.isdir(base_cache):
++	base_cache = '/tmp/'
++default_wafcache_dir = os.path.join(base_cache, 'wafcache_' + getpass.getuser())
++
++CACHE_DIR = os.environ.get('WAFCACHE', default_wafcache_dir)
++TRIM_MAX_FOLDERS = int(os.environ.get('WAFCACHE_TRIM_MAX_FOLDER', 1000000))
++EVICT_INTERVAL_MINUTES = int(os.environ.get('WAFCACHE_EVICT_INTERVAL_MINUTES', 3))
++EVICT_MAX_BYTES = int(os.environ.get('WAFCACHE_EVICT_MAX_BYTES', 10**10))
++WAFCACHE_NO_PUSH = 1 if os.environ.get('WAFCACHE_NO_PUSH') else 0
++WAFCACHE_VERBOSITY = 1 if os.environ.get('WAFCACHE_VERBOSITY') else 0
++OK = "ok"
++
++try:
++	import cPickle
++except ImportError:
++	import pickle as cPickle
++
++if __name__ != '__main__':
++	from waflib import Task, Logs, Utils, Build
++
++def can_retrieve_cache(self):
++	"""
++	New method for waf Task classes
++	"""
++	if not self.outputs:
++		return False
++
++	self.cached = False
++
++	sig = self.signature()
++	ssig = Utils.to_hex(self.uid() + sig)
++
++	files_to = [node.abspath() for node in self.outputs]
++	err = cache_command(ssig, [], files_to)
++	if err.startswith(OK):
++		if WAFCACHE_VERBOSITY:
++			Logs.pprint('CYAN', '  Fetched %r from cache' % files_to)
++		else:
++			Logs.debug('wafcache: fetched %r from cache', files_to)
++	else:
++		if WAFCACHE_VERBOSITY:
++			Logs.pprint('YELLOW', '  No cache entry %s' % files_to)
++		else:
++			Logs.debug('wafcache: No cache entry %s: %s', files_to, err)
++		return False
++
++	self.cached = True
++	return True
++
++def put_files_cache(self):
++	"""
++	New method for waf Task classes
++	"""
++	if WAFCACHE_NO_PUSH or getattr(self, 'cached', None) or not self.outputs:
++		return
++
++	bld = self.generator.bld
++	sig = self.signature()
++	ssig = Utils.to_hex(self.uid() + sig)
++
++	files_from = [node.abspath() for node in self.outputs]
++	err = cache_command(ssig, files_from, [])
++
++	if err.startswith(OK):
++		if WAFCACHE_VERBOSITY:
++			Logs.pprint('CYAN', '  Successfully uploaded %s to cache' % files_from)
++		else:
++			Logs.debug('wafcache: Successfully uploaded %r to cache', files_from)
++	else:
++		if WAFCACHE_VERBOSITY:
++			Logs.pprint('RED', '  Error caching step results %s: %s' % (files_from, err))
++		else:
++			Logs.debug('wafcache: Error caching results %s: %s', files_from, err)
++
++	bld.task_sigs[self.uid()] = self.cache_sig
++
++def hash_env_vars(self, env, vars_lst):
++	"""
++	Reimplement BuildContext.hash_env_vars so that the resulting hash does not depend on local paths
++	"""
++	if not env.table:
++		env = env.parent
++		if not env:
++			return Utils.SIG_NIL
++
++	idx = str(id(env)) + str(vars_lst)
++	try:
++		cache = self.cache_env
++	except AttributeError:
++		cache = self.cache_env = {}
++	else:
++		try:
++			return self.cache_env[idx]
++		except KeyError:
++			pass
++
++	v = str([env[a] for a in vars_lst])
++	v = v.replace(self.srcnode.abspath().__repr__()[:-1], '')
++	m = Utils.md5()
++	m.update(v.encode())
++	ret = m.digest()
++
++	Logs.debug('envhash: %r %r', ret, v)
++
++	cache[idx] = ret
++
++	return ret
++
++def uid(self):
++	"""
++	Reimplement Task.uid() so that the signature does not depend on local paths
++	"""
++	try:
++		return self.uid_
++	except AttributeError:
++		m = Utils.md5()
++		src = self.generator.bld.srcnode
++		up = m.update
++		up(self.__class__.__name__.encode())
++		for x in self.inputs + self.outputs:
++			up(x.path_from(src).encode())
++		self.uid_ = m.digest()
++		return self.uid_
++
++
++def make_cached(cls):
++	"""
++	Enable the waf cache for a given task class
++	"""
++	if getattr(cls, 'nocache', None) or getattr(cls, 'has_cache', False):
++		return
++
++	m1 = getattr(cls, 'run', None)
++	def run(self):
++		if getattr(self, 'nocache', False):
++			return m1(self)
++		if self.can_retrieve_cache():
++			return 0
++		return m1(self)
++	cls.run = run
++
++	m2 = getattr(cls, 'post_run', None)
++	def post_run(self):
++		if getattr(self, 'nocache', False):
++			return m2(self)
++		ret = m2(self)
++		self.put_files_cache()
++		if hasattr(self, 'chmod'):
++			for node in self.outputs:
++				os.chmod(node.abspath(), self.chmod)
++		return ret
++	cls.post_run = post_run
++	cls.has_cache = True
++
++process_pool = []
++def get_process():
++	"""
++	Returns a worker process that can process waf cache commands
++	The worker process is assumed to be returned to the process pool when unused
++	"""
++	try:
++		return process_pool.pop()
++	except IndexError:
++		filepath = os.path.dirname(os.path.abspath(__file__)) + os.sep + 'wafcache.py'
++		cmd = [sys.executable, '-c', Utils.readf(filepath)]
++		return subprocess.Popen(cmd, stdout=subprocess.PIPE, stdin=subprocess.PIPE, bufsize=0)
++
++def atexit_pool():
++	for k in process_pool:
++		try:
++			os.kill(k.pid, 9)
++		except OSError:
++			pass
++		else:
++			k.wait()
++atexit.register(atexit_pool)
++
++def build(bld):
++	"""
++	Called during the build process to enable file caching
++	"""
++	if process_pool:
++		# already called once
++		return
++
++	for x in range(bld.jobs):
++		process_pool.append(get_process())
++
++	Task.Task.can_retrieve_cache = can_retrieve_cache
++	Task.Task.put_files_cache = put_files_cache
++	Task.Task.uid = uid
++	Build.BuildContext.hash_env_vars = hash_env_vars
++	for x in reversed(list(Task.classes.values())):
++		make_cached(x)
++
++def cache_command(sig, files_from, files_to):
++	"""
++	Create a command for cache worker processes, returns a pickled
++	base64-encoded tuple containing the task signature, a list of files to
++	cache and a list of files files to get from cache (one of the lists
++	is assumed to be empty)
++	"""
++	proc = get_process()
++
++	obj = base64.b64encode(cPickle.dumps([sig, files_from, files_to]))
++	proc.stdin.write(obj)
++	proc.stdin.write('\n'.encode())
++	proc.stdin.flush()
++	obj = proc.stdout.readline()
++	if not obj:
++		raise OSError('Preforked sub-process %r died' % proc.pid)
++	process_pool.append(proc)
++	return cPickle.loads(base64.b64decode(obj))
++
++try:
++	copyfun = os.link
++except NameError:
++	copyfun = shutil.copy2
++
++def atomic_copy(orig, dest):
++	"""
++	Copy files to the cache, the operation is atomic for a given file
++	"""
++	global copyfun
++	tmp = dest + '.tmp'
++	up = os.path.dirname(dest)
++	try:
++		os.makedirs(up)
++	except OSError:
++		pass
++
++	try:
++		copyfun(orig, tmp)
++	except OSError as e:
++		if e.errno == errno.EXDEV:
++			copyfun = shutil.copy2
++			copyfun(orig, tmp)
++		else:
++			raise
++	os.rename(tmp, dest)
++
++def lru_trim():
++	"""
++	the cache folders take the form:
++	`CACHE_DIR/0b/0b180f82246d726ece37c8ccd0fb1cde2650d7bfcf122ec1f169079a3bfc0ab9`
++	they are listed in order of last access, and then removed
++	until the amount of folders is within TRIM_MAX_FOLDERS and the total space
++	taken by files is less than EVICT_MAX_BYTES
++	"""
++	lst = []
++	for up in os.listdir(CACHE_DIR):
++		if len(up) == 2:
++			sub = os.path.join(CACHE_DIR, up)
++			for hval in os.listdir(sub):
++				path = os.path.join(sub, hval)
++
++				size = 0
++				for fname in os.listdir(path):
++					size += os.lstat(os.path.join(path, fname)).st_size
++				lst.append((os.stat(path).st_mtime, size, path))
++
++	lst.sort(key=lambda x: x[0])
++	lst.reverse()
++
++	tot = sum(x[1] for x in lst)
++	while tot > EVICT_MAX_BYTES or len(lst) > TRIM_MAX_FOLDERS:
++		_, tmp_size, path = lst.pop()
++		tot -= tmp_size
++
++		tmp = path + '.tmp'
++		try:
++			shutil.rmtree(tmp)
++		except OSError:
++			pass
++		try:
++			os.rename(path, tmp)
++		except OSError:
++			sys.stderr.write('Could not rename %r to %r' % (path, tmp))
++		else:
++			try:
++				shutil.rmtree(tmp)
++			except OSError:
++				sys.stderr.write('Could not remove %r' % tmp)
++	sys.stderr.write("Cache trimmed: %r bytes in %r folders left\n" % (tot, len(lst)))
++
++
++def lru_evict():
++	"""
++	Reduce the cache size
++	"""
++	lockfile = os.path.join(CACHE_DIR, 'all.lock')
++	try:
++		st = os.stat(lockfile)
++	except EnvironmentError as e:
++		if e.errno == errno.ENOENT:
++			with open(lockfile, 'w') as f:
++				f.write('')
++			return
++		else:
++			raise
++
++	if st.st_mtime < time.time() - EVICT_INTERVAL_MINUTES * 60:
++		# check every EVICT_INTERVAL_MINUTES minutes if the cache is too big
++		# OCLOEXEC is unnecessary because no processes are spawned
++		fd = os.open(lockfile, os.O_RDWR | os.O_CREAT, 0o755)
++		try:
++			try:
++				fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
++			except EnvironmentError:
++				sys.stderr.write('another process is running!\n')
++				pass
++			else:
++				# now dow the actual cleanup
++				lru_trim()
++				os.utime(lockfile, None)
++		finally:
++			os.close(fd)
++
++class netcache(object):
++	def __init__(self):
++		self.http = urllib3.PoolManager()
++
++	def url_of(self, sig, i):
++		return "%s/%s/%s" % (CACHE_DIR, sig, i)
++
++	def upload(self, file_path, sig, i):
++		url = self.url_of(sig, i)
++		with open(file_path, 'rb') as f:
++			file_data = f.read()
++		r = self.http.request('POST', url, timeout=60,
++			fields={ 'file': ('%s/%s' % (sig, i), file_data), })
++		if r.status >= 400:
++			raise OSError("Invalid status %r %r" % (url, r.status))
++
++	def download(self, file_path, sig, i):
++		url = self.url_of(sig, i)
++		with self.http.request('GET', url, preload_content=False, timeout=60) as inf:
++			if inf.status >= 400:
++				raise OSError("Invalid status %r %r" % (url, inf.status))
++			with open(file_path, 'wb') as out:
++				shutil.copyfileobj(inf, out)
++
++	def copy_to_cache(self, sig, files_from, files_to):
++		try:
++			for i, x in enumerate(files_from):
++				if not os.path.islink(x):
++					self.upload(x, sig, i)
++		except Exception:
++			return traceback.format_exc()
++		return OK
++
++	def copy_from_cache(self, sig, files_from, files_to):
++		try:
++			for i, x in enumerate(files_to):
++				self.download(x, sig, i)
++		except Exception:
++			return traceback.format_exc()
++		return OK
++
++class fcache(object):
++	def __init__(self):
++		if not os.path.exists(CACHE_DIR):
++			os.makedirs(CACHE_DIR)
++		if not os.path.exists(CACHE_DIR):
++			raise ValueError('Could not initialize the cache directory')
++
++	def copy_to_cache(self, sig, files_from, files_to):
++		"""
++		Copy files to the cache, existing files are overwritten,
++		and the copy is atomic only for a given file, not for all files
++		that belong to a given task object
++		"""
++		try:
++			for i, x in enumerate(files_from):
++				dest = os.path.join(CACHE_DIR, sig[:2], sig, str(i))
++				atomic_copy(x, dest)
++		except Exception:
++			return traceback.format_exc()
++		else:
++			# attempt trimming if caching was successful:
++			# we may have things to trim!
++			lru_evict()
++		return OK
++
++	def copy_from_cache(self, sig, files_from, files_to):
++		"""
++		Copy files from the cache
++		"""
++		try:
++			for i, x in enumerate(files_to):
++				orig = os.path.join(CACHE_DIR, sig[:2], sig, str(i))
++				atomic_copy(orig, x)
++
++			# success! update the cache time
++			os.utime(os.path.join(CACHE_DIR, sig[:2], sig), None)
++		except Exception:
++			return traceback.format_exc()
++		return OK
++
++class bucket_cache(object):
++	def bucket_copy(self, source, target):
++		if CACHE_DIR.startswith('s3://'):
++			cmd = ['aws', 's3', 'cp', source, target]
++		else:
++			cmd = ['gsutil', 'cp', source, target]
++		proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
++		out, err = proc.communicate()
++		if proc.returncode:
++			raise OSError('Error copy %r to %r using: %r (exit %r):\n  out:%s\n  err:%s' % (
++				source, target, cmd, proc.returncode, out.decode(), err.decode()))
++
++	def copy_to_cache(self, sig, files_from, files_to):
++		try:
++			for i, x in enumerate(files_from):
++				dest = os.path.join(CACHE_DIR, sig[:2], sig, str(i))
++				self.bucket_copy(x, dest)
++		except Exception:
++			return traceback.format_exc()
++		return OK
++
++	def copy_from_cache(self, sig, files_from, files_to):
++		try:
++			for i, x in enumerate(files_to):
++				orig = os.path.join(CACHE_DIR, sig[:2], sig, str(i))
++				self.bucket_copy(orig, x)
++		except EnvironmentError:
++			return traceback.format_exc()
++		return OK
++
++def loop(service):
++	"""
++	This function is run when this file is run as a standalone python script,
++	it assumes a parent process that will communicate the commands to it
++	as pickled-encoded tuples (one line per command)
++
++	The commands are to copy files to the cache or copy files from the
++	cache to a target destination
++	"""
++	# one operation is performed at a single time by a single process
++	# therefore stdin never has more than one line
++	txt = sys.stdin.readline().strip()
++	if not txt:
++		# parent process probably ended
++		sys.exit(1)
++	ret = OK
++
++	[sig, files_from, files_to] = cPickle.loads(base64.b64decode(txt))
++	if files_from:
++		# TODO return early when pushing files upstream
++		ret = service.copy_to_cache(sig, files_from, files_to)
++	elif files_to:
++		# the build process waits for workers to (possibly) obtain files from the cache
++		ret = service.copy_from_cache(sig, files_from, files_to)
++	else:
++		ret = "Invalid command"
++
++	obj = base64.b64encode(cPickle.dumps(ret))
++	sys.stdout.write(obj.decode())
++	sys.stdout.write('\n')
++	sys.stdout.flush()
++
++if __name__ == '__main__':
++	if CACHE_DIR.startswith('s3://') or CACHE_DIR.startswith('gs://'):
++		service = bucket_cache()
++	elif CACHE_DIR.startswith('http'):
++		service = netcache()
++	else:
++		service = fcache()
++	while 1:
++		try:
++			loop(service)
++		except KeyboardInterrupt:
++			break
++
+-- 
+2.37.3
+
diff --git a/net/samba413/files/patch-waf-2.0.21 b/net/samba413/files/patch-waf-2.0.21
new file mode 100644
index 000000000000..01b2d6e6cafe
--- /dev/null
+++ b/net/samba413/files/patch-waf-2.0.21
@@ -0,0 +1,703 @@
+From 6718b5e6d059e5668fc538be802ebd9fbe5ce9af Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <metze@samba.org>
+Date: Wed, 25 Nov 2020 16:29:06 +0100
+Subject: [PATCH] waf: upgrade to 2.0.21
+
+This commit message was wrong:
+
+    commit 5fc3a71d0f54b176d3cb2e399718d0468507e797
+    Author: David Mulder <dmulder@suse.com>
+    Date:   Mon Aug 24 13:12:46 2020 -0600
+
+        waf: upgrade to 2.0.20
+
+        This contain an important change:
+        "Fix gccdeps.scan() returning nodes that no longer exist on disk."
+        https://gitlab.com/ita1024/waf/-/merge_requests/2293
+
+        Signed-off-by: David Mulder <dmulder@suse.com>
+        Reviewed-by: Stefan Metzmacher <metze@samba.org>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+
+The fix was in in waf master, but not included in 2.0.20,
+but it's now included in 2.0.21.
+
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+---
+ buildtools/bin/waf                            |  2 +-
+ buildtools/wafsamba/wafsamba.py               |  2 +-
+ third_party/waf/waflib/Build.py               |  6 ++-
+ third_party/waf/waflib/Context.py             |  8 ++--
+ third_party/waf/waflib/Tools/asm.py           |  5 +-
+ third_party/waf/waflib/Tools/c_config.py      |  1 +
+ third_party/waf/waflib/Tools/msvc.py          |  8 +++-
+ third_party/waf/waflib/Tools/qt5.py           | 26 +++++++++--
+ third_party/waf/waflib/Tools/waf_unit_test.py | 10 +++-
+ third_party/waf/waflib/extras/boost.py        |  5 +-
+ .../waf/waflib/extras/c_dumbpreproc.py        |  2 +-
+ third_party/waf/waflib/extras/doxygen.py      |  4 +-
+ .../waf/waflib/extras/file_to_object.py       |  9 +++-
+ third_party/waf/waflib/extras/gccdeps.py      | 21 +++++++--
+ third_party/waf/waflib/extras/msvcdeps.py     | 27 +++++++++--
+ third_party/waf/waflib/extras/pch.py          |  4 +-
+ third_party/waf/waflib/extras/sphinx.py       | 40 ++++++++++++----
+ third_party/waf/waflib/extras/wafcache.py     | 46 +++++++++++++++----
+ third_party/waf/waflib/extras/xcode6.py       | 18 ++++----
+ 19 files changed, 181 insertions(+), 63 deletions(-)
+
+diff --git buildtools/bin/waf buildtools/bin/waf
+index feabe25d131..041450fc131 100755
+--- buildtools/bin/waf
++++ buildtools/bin/waf
+@@ -32,7 +32,7 @@ POSSIBILITY OF SUCH DAMAGE.
+ 
+ import os, sys, inspect
+ 
+-VERSION="2.0.20"
++VERSION="2.0.21"
+ REVISION="x"
+ GIT="x"
+ INSTALL="x"
+diff --git buildtools/wafsamba/wafsamba.py buildtools/wafsamba/wafsamba.py
+index 9dd6d05b91b..d1baa3b4940 100644
+--- buildtools/wafsamba/wafsamba.py
++++ buildtools/wafsamba/wafsamba.py
+@@ -38,7 +38,7 @@ LIB_PATH="shared"
+ 
+ os.environ['PYTHONUNBUFFERED'] = '1'
+ 
+-if Context.HEXVERSION not in (0x2001400,):
++if Context.HEXVERSION not in (0x2001500,):
+     Logs.error('''
+ Please use the version of waf that comes with Samba, not
+ a system installed version. See http://wiki.samba.org/index.php/Waf
+diff --git third_party/waf/waflib/Build.py third_party/waf/waflib/Build.py
+index 39f0991918b..52837618577 100644
+--- third_party/waf/waflib/Build.py
++++ third_party/waf/waflib/Build.py
+@@ -753,10 +753,12 @@ class BuildContext(Context.Context):
+ 		else:
+ 			ln = self.launch_node()
+ 			if ln.is_child_of(self.bldnode):
+-				Logs.warn('Building from the build directory, forcing --targets=*')
++				if Logs.verbose > 1:
++					Logs.warn('Building from the build directory, forcing --targets=*')
+ 				ln = self.srcnode
+ 			elif not ln.is_child_of(self.srcnode):
+-				Logs.warn('CWD %s is not under %s, forcing --targets=* (run distclean?)', ln.abspath(), self.srcnode.abspath())
++				if Logs.verbose > 1:
++					Logs.warn('CWD %s is not under %s, forcing --targets=* (run distclean?)', ln.abspath(), self.srcnode.abspath())
+ 				ln = self.srcnode
+ 
+ 			def is_post(tg, ln):
+diff --git third_party/waf/waflib/Context.py third_party/waf/waflib/Context.py
+index 3f1b4fa48ab..0ce9df6e91f 100644
+--- third_party/waf/waflib/Context.py
++++ third_party/waf/waflib/Context.py
+@@ -18,13 +18,13 @@ else:
+ 	import imp
+ 
+ # the following 3 constants are updated on each new release (do not touch)
+-HEXVERSION=0x2001400
++HEXVERSION=0x2001500
+ """Constant updated on new releases"""
+ 
+-WAFVERSION="2.0.20"
++WAFVERSION="2.0.21"
+ """Constant updated on new releases"""
+ 
+-WAFREVISION="668769470956da8c5b60817cb8884cd7d0f87cd4"
++WAFREVISION="edde20a6425a5c3eb6b47d5f3f5c4fbc93fed5f4"
+ """Git revision when the waf version is updated"""
+ 
+ WAFNAME="waf"
+@@ -530,7 +530,7 @@ class Context(ctx):
+ 		"""
+ 		Prints a configuration message of the form ``msg: result``.
+ 		The second part of the message will be in colors. The output
+-		can be disabled easly by setting ``in_msg`` to a positive value::
++		can be disabled easily by setting ``in_msg`` to a positive value::
+ 
+ 			def configure(conf):
+ 				self.in_msg = 1
+diff --git third_party/waf/waflib/Tools/asm.py third_party/waf/waflib/Tools/asm.py
+index a57e83bb5ec..1d34ddaca7f 100644
+--- third_party/waf/waflib/Tools/asm.py
++++ third_party/waf/waflib/Tools/asm.py
+@@ -56,13 +56,11 @@ class asm(Task.Task):
+ 	Compiles asm files by gas/nasm/yasm/...
+ 	"""
+ 	color = 'BLUE'
+-	run_str = '${AS} ${ASFLAGS} ${ASMPATH_ST:INCPATHS} ${DEFINES_ST:DEFINES} ${AS_SRC_F}${SRC} ${AS_TGT_F}${TGT}'
++	run_str = '${AS} ${ASFLAGS} ${ASMPATH_ST:INCPATHS} ${ASMDEFINES_ST:DEFINES} ${AS_SRC_F}${SRC} ${AS_TGT_F}${TGT}'
+ 
+ 	def scan(self):
+ 		if self.env.ASM_NAME == 'gas':
+ 			return c_preproc.scan(self)
+-			Logs.warn('There is no dependency scanner for Nasm!')
+-			return  [[], []]
+ 		elif self.env.ASM_NAME == 'nasm':
+ 			Logs.warn('The Nasm dependency scanner is incomplete!')
+ 
+@@ -106,3 +104,4 @@ class asmstlib(stlink_task):
+ 
+ def configure(conf):
+ 	conf.env.ASMPATH_ST = '-I%s'
++	conf.env.ASMDEFINES_ST = '-D%s'
+diff --git third_party/waf/waflib/Tools/c_config.py third_party/waf/waflib/Tools/c_config.py
+index 98187fac2e2..03b6bf61bc0 100644
+--- third_party/waf/waflib/Tools/c_config.py
++++ third_party/waf/waflib/Tools/c_config.py
+@@ -68,6 +68,7 @@ MACRO_TO_DEST_CPU = {
+ '__s390__'    : 's390',
+ '__sh__'      : 'sh',
+ '__xtensa__'  : 'xtensa',
++'__e2k__'     : 'e2k',
+ }
+ 
+ @conf
+diff --git third_party/waf/waflib/Tools/msvc.py third_party/waf/waflib/Tools/msvc.py
+index f169c7f441b..37233be8242 100644
+--- third_party/waf/waflib/Tools/msvc.py
++++ third_party/waf/waflib/Tools/msvc.py
+@@ -99,7 +99,13 @@ all_icl_platforms = [ ('intel64', 'amd64'), ('em64t', 'amd64'), ('ia32', 'x86'),
+ """List of icl platforms"""
+ 
+ def options(opt):
+-	opt.add_option('--msvc_version', type='string', help = 'msvc version, eg: "msvc 10.0,msvc 9.0"', default='')
++	default_ver = ''
++	vsver = os.getenv('VSCMD_VER')
++	if vsver:
++		m = re.match(r'(^\d+\.\d+).*', vsver)
++		if m:
++			default_ver = 'msvc %s' % m.group(1)
++	opt.add_option('--msvc_version', type='string', help = 'msvc version, eg: "msvc 10.0,msvc 9.0"', default=default_ver)
+ 	opt.add_option('--msvc_targets', type='string', help = 'msvc targets, eg: "x64,arm"', default='')
+ 	opt.add_option('--no-msvc-lazy', action='store_false', help = 'lazily check msvc target environments', default=True, dest='msvc_lazy')
+ 
+diff --git third_party/waf/waflib/Tools/qt5.py third_party/waf/waflib/Tools/qt5.py
+index 99e021bae61..cff2028174f 100644
+--- third_party/waf/waflib/Tools/qt5.py
++++ third_party/waf/waflib/Tools/qt5.py
+@@ -57,7 +57,23 @@ A few options (--qt{dir,bin,...}) and environment variables
+ (QT5_{ROOT,DIR,MOC,UIC,XCOMPILE}) allow finer tuning of the tool,
+ tool path selection, etc; please read the source for more info.
+ 
+-The detection uses pkg-config on Linux by default. To force static library detection use:
++The detection uses pkg-config on Linux by default. The list of
++libraries to be requested to pkg-config is formulated by scanning
++in the QTLIBS directory (that can be passed via --qtlibs or by
++setting the environment variable QT5_LIBDIR otherwise is derived
++by querying qmake for QT_INSTALL_LIBS directory) for shared/static
++libraries present.
++Alternatively the list of libraries to be requested via pkg-config
++can be set using the qt5_vars attribute, ie:
++
++      conf.qt5_vars = ['Qt5Core', 'Qt5Gui', 'Qt5Widgets', 'Qt5Test'];
++
++This can speed up configuration phase if needed libraries are
++known beforehand, can improve detection on systems with a
++sparse QT5 libraries installation (ie. NIX) and can improve
++detection of some header-only Qt modules (ie. Qt5UiPlugin).
++
++To force static library detection use:
+ QT5_XCOMPILE=1 QT5_FORCE_STATIC=1 waf configure
+ """
+ 
+@@ -466,6 +482,9 @@ def configure(self):
+ 
+ 	The detection uses the program ``pkg-config`` through :py:func:`waflib.Tools.config_c.check_cfg`
+ 	"""
++	if 'COMPILER_CXX' not in self.env:
++		self.fatal('No CXX compiler defined: did you forget to configure compiler_cxx first?')
++
+ 	self.find_qt5_binaries()
+ 	self.set_qt5_libs_dir()
+ 	self.set_qt5_libs_to_check()
+@@ -478,9 +497,6 @@ def configure(self):
+ 	if not has_xml:
+ 		Logs.error('No xml.sax support was found, rcc dependencies will be incomplete!')
+ 
+-	if 'COMPILER_CXX' not in self.env:
+-		self.fatal('No CXX compiler defined: did you forget to configure compiler_cxx first?')
+-
+ 	# Qt5 may be compiled with '-reduce-relocations' which requires dependent programs to have -fPIE or -fPIC?
+ 	frag = '#include <QMap>\nint main(int argc, char **argv) {QMap<int,int> m;return m.keys().size();}\n'
+ 	uses = 'QT5CORE'
+@@ -637,7 +653,7 @@ def set_qt5_libs_dir(self):
+ 		except Errors.WafError:
+ 			qtdir = self.cmd_and_log(env.QMAKE + ['-query', 'QT_INSTALL_PREFIX']).strip()
+ 			qtlibs = os.path.join(qtdir, 'lib')
+-	self.msg('Found the Qt5 libraries in', qtlibs)
++	self.msg('Found the Qt5 library path', qtlibs)
+ 	env.QTLIBS = qtlibs
+ 
+ @conf
+diff --git third_party/waf/waflib/Tools/waf_unit_test.py third_party/waf/waflib/Tools/waf_unit_test.py
+index 6ff6f72739f..dc66fe9c184 100644
+--- third_party/waf/waflib/Tools/waf_unit_test.py
++++ third_party/waf/waflib/Tools/waf_unit_test.py
+@@ -97,6 +97,7 @@ def make_interpreted_test(self):
+ 		if isinstance(v, str):
+ 			v = v.split(os.pathsep)
+ 		self.ut_env[k] = os.pathsep.join(p + v)
++	self.env.append_value('UT_DEPS', ['%r%r' % (key, self.ut_env[key]) for key in self.ut_env])
+ 
+ @feature('test')
+ @after_method('apply_link', 'process_use')
+@@ -108,7 +109,8 @@ def make_test(self):
+ 	tsk = self.create_task('utest', self.link_task.outputs)
+ 	if getattr(self, 'ut_str', None):
+ 		self.ut_run, lst = Task.compile_fun(self.ut_str, shell=getattr(self, 'ut_shell', False))
+-		tsk.vars = lst + tsk.vars
++		tsk.vars = tsk.vars + lst
++		self.env.append_value('UT_DEPS', self.ut_str)
+ 
+ 	self.handle_ut_cwd('ut_cwd')
+ 
+@@ -139,6 +141,10 @@ def make_test(self):
+ 	if not hasattr(self, 'ut_cmd'):
+ 		self.ut_cmd = getattr(Options.options, 'testcmd', False)
+ 
++	self.env.append_value('UT_DEPS', str(self.ut_cmd))
++	self.env.append_value('UT_DEPS', self.ut_paths)
++	self.env.append_value('UT_DEPS', ['%r%r' % (key, self.ut_env[key]) for key in self.ut_env])
++
+ @taskgen_method
+ def add_test_results(self, tup):
+ 	"""Override and return tup[1] to interrupt the build immediately if a test does not run"""
+@@ -159,7 +165,7 @@ class utest(Task.Task):
+ 	"""
+ 	color = 'PINK'
+ 	after = ['vnum', 'inst']
+-	vars = []
++	vars = ['UT_DEPS']
+ 
+ 	def runnable_status(self):
+ 		"""
+diff --git third_party/waf/waflib/extras/boost.py third_party/waf/waflib/extras/boost.py
+index c2aaaa938a2..93b312a1e6e 100644
+--- third_party/waf/waflib/extras/boost.py
++++ third_party/waf/waflib/extras/boost.py
+@@ -270,10 +270,12 @@ def boost_get_libs(self, *k, **kw):
+ 				return file
+ 		return None
+ 
++	# extensions from Tools.ccroot.lib_patterns
++	wo_ext = re.compile(r"\.(a|so|lib|dll|dylib)(\.[0-9\.]+)?$")
+ 	def format_lib_name(name):
+ 		if name.startswith('lib') and self.env.CC_NAME != 'msvc':
+ 			name = name[3:]
+-		return name[:name.rfind('.')]
++		return wo_ext.sub("", name)
+ 
+ 	def match_libs(lib_names, is_static):
+ 		libs = []
+@@ -522,4 +524,3 @@ def install_boost(self):
+ 		except:
+ 			continue
+ install_boost.done = False
+-
+diff --git third_party/waf/waflib/extras/c_dumbpreproc.py third_party/waf/waflib/extras/c_dumbpreproc.py
+index ce9e1a400b9..1fdd5c364ae 100644
+--- third_party/waf/waflib/extras/c_dumbpreproc.py
++++ third_party/waf/waflib/extras/c_dumbpreproc.py
+@@ -66,7 +66,7 @@ class dumb_parser(parser):
+ 			if x == c_preproc.POPFILE:
+ 				self.currentnode_stack.pop()
+ 				continue
+-			self.tryfind(y)
++			self.tryfind(y, env=env)
+ 
+ c_preproc.c_parser = dumb_parser
+ 
+diff --git third_party/waf/waflib/extras/doxygen.py third_party/waf/waflib/extras/doxygen.py
+index de75bc2738a..0fda70361f3 100644
+--- third_party/waf/waflib/extras/doxygen.py
++++ third_party/waf/waflib/extras/doxygen.py
+@@ -208,10 +208,10 @@ def process_doxy(self):
+ 		self.bld.fatal('doxygen file %s not found' % self.doxyfile)
+ 
+ 	# the task instance
+-	dsk = self.create_task('doxygen', node)
++	dsk = self.create_task('doxygen', node, always_run=getattr(self, 'always', False))
+ 
+ 	if getattr(self, 'doxy_tar', None):
+-		tsk = self.create_task('tar')
++		tsk = self.create_task('tar', always_run=getattr(self, 'always', False))
+ 		tsk.input_tasks = [dsk]
+ 		tsk.set_outputs(self.path.find_or_declare(self.doxy_tar))
+ 		if self.doxy_tar.endswith('bz2'):
+diff --git third_party/waf/waflib/extras/file_to_object.py third_party/waf/waflib/extras/file_to_object.py
+index 1393b511d63..13d2aef37df 100644
+--- third_party/waf/waflib/extras/file_to_object.py
++++ third_party/waf/waflib/extras/file_to_object.py
+@@ -31,7 +31,7 @@ Known issues:
+ 
+ """
+ 
+-import os
++import os, sys
+ from waflib import Task, TaskGen, Errors
+ 
+ def filename_c_escape(x):
+@@ -95,12 +95,17 @@ class file_to_object_c(Task.Task):
+ 
+ 		name = "_binary_" + "".join(name)
+ 
++		def char_to_num(ch):
++			if sys.version_info[0] < 3:
++				return ord(ch)
++			return ch
++
+ 		data = self.inputs[0].read('rb')
+ 		lines, line = [], []
+ 		for idx_byte, byte in enumerate(data):
+ 			line.append(byte)
+ 			if len(line) > 15 or idx_byte == size-1:
+-				lines.append(", ".join(("0x%02x" % ord(x)) for x in line))
++				lines.append(", ".join(("0x%02x" % char_to_num(x)) for x in line))
+ 				line = []
+ 		data = ",\n ".join(lines)
+ 
+diff --git third_party/waf/waflib/extras/gccdeps.py third_party/waf/waflib/extras/gccdeps.py
+index c3a809e252a..1fc9373489a 100644
+--- third_party/waf/waflib/extras/gccdeps.py
++++ third_party/waf/waflib/extras/gccdeps.py
+@@ -163,10 +163,25 @@ def post_run(self):
+ def sig_implicit_deps(self):
+ 	if not self.__class__.__name__ in self.env.ENABLE_GCCDEPS:
+ 		return super(self.derived_gccdeps, self).sig_implicit_deps()
++	bld = self.generator.bld
++
+ 	try:
+-		return Task.Task.sig_implicit_deps(self)
+-	except Errors.WafError:
+-		return Utils.SIG_NIL
++		return self.compute_sig_implicit_deps()
++	except Errors.TaskNotReady:
++		raise ValueError("Please specify the build order precisely with gccdeps (asm/c/c++ tasks)")
++	except EnvironmentError:
++		# If a file is renamed, assume the dependencies are stale and must be recalculated
++		for x in bld.node_deps.get(self.uid(), []):
++			if not x.is_bld() and not x.exists():
++				try:
++					del x.parent.children[x.name]
++				except KeyError:
++					pass
++
++	key = self.uid()
++	bld.node_deps[key] = []
++	bld.raw_deps[key] = []
++	return Utils.SIG_NIL
+ 
+ def wrap_compiled_task(classname):
+ 	derived_class = type(classname, (Task.classes[classname],), {})
+diff --git third_party/waf/waflib/extras/msvcdeps.py third_party/waf/waflib/extras/msvcdeps.py
+index 873a4193150..52985dce058 100644
+--- third_party/waf/waflib/extras/msvcdeps.py
++++ third_party/waf/waflib/extras/msvcdeps.py
+@@ -150,11 +150,25 @@ def scan(self):
+ def sig_implicit_deps(self):
+ 	if self.env.CC_NAME not in supported_compilers:
+ 		return super(self.derived_msvcdeps, self).sig_implicit_deps()
++	bld = self.generator.bld
+ 
+ 	try:
+-		return Task.Task.sig_implicit_deps(self)
+-	except Errors.WafError:
+-		return Utils.SIG_NIL
++		return self.compute_sig_implicit_deps()
++	except Errors.TaskNotReady:
++		raise ValueError("Please specify the build order precisely with msvcdeps (c/c++ tasks)")
++	except EnvironmentError:
++		# If a file is renamed, assume the dependencies are stale and must be recalculated
++		for x in bld.node_deps.get(self.uid(), []):
++			if not x.is_bld() and not x.exists():
++				try:
++					del x.parent.children[x.name]
++				except KeyError:
++					pass
++
++	key = self.uid()
++	bld.node_deps[key] = []
++	bld.raw_deps[key] = []
++	return Utils.SIG_NIL
+ 
+ def exec_command(self, cmd, **kw):
+ 	if self.env.CC_NAME not in supported_compilers:
+@@ -211,11 +225,14 @@ def exec_command(self, cmd, **kw):
+ 			# get one from the exception object
+ 			ret = getattr(e, 'returncode', 1)
+ 
++		Logs.debug('msvcdeps: Running for: %s' % self.inputs[0])
+ 		for line in raw_out.splitlines():
+ 			if line.startswith(INCLUDE_PATTERN):
+-				inc_path = line[len(INCLUDE_PATTERN):].strip()
++				# Only strip whitespace after log to preserve
++				# dependency structure in debug output
++				inc_path = line[len(INCLUDE_PATTERN):]
+ 				Logs.debug('msvcdeps: Regex matched %s', inc_path)
+-				self.msvcdeps_paths.append(inc_path)
++				self.msvcdeps_paths.append(inc_path.strip())
+ 			else:
+ 				out.append(line)
+ 
+diff --git third_party/waf/waflib/extras/pch.py third_party/waf/waflib/extras/pch.py
+index 103e752838c..b44c7a2e8fd 100644
+--- third_party/waf/waflib/extras/pch.py
++++ third_party/waf/waflib/extras/pch.py
+@@ -90,7 +90,7 @@ def apply_pch(self):
+ 
+ 	if getattr(self, 'name', None):
+ 		try:
+-			task = self.bld.pch_tasks["%s.%s" % (self.name, self.idx)]
++			task = self.bld.pch_tasks[self.name]
+ 			self.bld.fatal("Duplicated 'pch' task with name %r" % "%s.%s" % (self.name, self.idx))
+ 		except KeyError:
+ 			pass
+@@ -104,7 +104,7 @@ def apply_pch(self):
+ 
+ 	self.pch_task = task
+ 	if getattr(self, 'name', None):
+-		self.bld.pch_tasks["%s.%s" % (self.name, self.idx)] = task
++		self.bld.pch_tasks[self.name] = task
+ 
+ @TaskGen.feature('cxx')
+ @TaskGen.after_method('process_source', 'propagate_uselib_vars')
+diff --git third_party/waf/waflib/extras/sphinx.py third_party/waf/waflib/extras/sphinx.py
+index ce11110e634..71d1028393b 100644
+--- third_party/waf/waflib/extras/sphinx.py
++++ third_party/waf/waflib/extras/sphinx.py
+@@ -20,7 +20,7 @@ def build(bld):
+ 
+ from waflib.Node import Node
+ from waflib import Utils
+-from waflib.Task import Task
++from waflib import Task
+ from waflib.TaskGen import feature, after_method
+ 
+ 
+@@ -55,13 +55,9 @@ def build_sphinx(self):
+     sphinx_build_task.set_outputs(self.path.get_bld())
+ 
+     # the sphinx-build results are in <build + output_format> directory
+-    sphinx_output_directory = self.path.get_bld().make_node(self.env.SPHINX_OUTPUT_FORMAT)
+-    sphinx_output_directory.mkdir()
++    self.sphinx_output_directory = self.path.get_bld().make_node(self.env.SPHINX_OUTPUT_FORMAT)
++    self.sphinx_output_directory.mkdir()
+     Utils.def_attrs(self, install_path=get_install_path(self))
+-    self.add_install_files(install_to=self.install_path,
+-                           install_from=sphinx_output_directory.ant_glob('**/*'),
+-                           cwd=sphinx_output_directory,
+-                           relative_trick=True)
+ 
+ 
+ def get_install_path(tg):
+@@ -73,9 +69,37 @@ def get_install_path(tg):
+         return tg.env.DOCDIR
+ 
+ 
+-class SphinxBuildingTask(Task):
++class SphinxBuildingTask(Task.Task):
+     color = 'BOLD'
+     run_str = '${SPHINX_BUILD} -M ${SPHINX_OUTPUT_FORMAT} ${SRC} ${TGT} ${SPHINX_OPTIONS}'
+ 
+     def keyword(self):
+         return 'Compiling (%s)' % self.env.SPHINX_OUTPUT_FORMAT
++
++    def runnable_status(self):
++
++        for x in self.run_after:
++            if not x.hasrun:
++                return Task.ASK_LATER
++
++        self.signature()
++        ret = Task.Task.runnable_status(self)
++        if ret == Task.SKIP_ME:
++            # in case the files were removed
++            self.add_install()
++        return ret
++
++
++    def post_run(self):
++        self.add_install()
++        return Task.Task.post_run(self)
++
++
++    def add_install(self):
++        nodes = self.generator.sphinx_output_directory.ant_glob('**/*', quiet=True)
++        self.outputs += nodes
++        self.generator.add_install_files(install_to=self.generator.install_path,
++                                         install_from=nodes,
++                                         postpone=False,
++                                         cwd=self.generator.sphinx_output_directory,
++                                         relative_trick=True)
+diff --git third_party/waf/waflib/extras/wafcache.py third_party/waf/waflib/extras/wafcache.py
+index 8b9567faf14..088fd0d098d 100644
+--- third_party/waf/waflib/extras/wafcache.py
++++ third_party/waf/waflib/extras/wafcache.py
+@@ -16,10 +16,19 @@ The following environment variables may be set:
+   - URL to a cache server, for example:
+     export WAFCACHE=http://localhost:8080/files/
+     in that case, GET/POST requests are made to urls of the form
+-    http://localhost:8080/files/000000000/0 (cache management is then up to the server)
+-  - GCS or S3 bucket
+-    gs://my-bucket/
+-    s3://my-bucket/
++    http://localhost:8080/files/000000000/0 (cache management is delegated to the server)
++  - GCS, S3 or MINIO bucket
++    gs://my-bucket/    (uses gsutil command line tool or WAFCACHE_CMD)
++    s3://my-bucket/    (uses aws command line tool or WAFCACHE_CMD)
++    minio://my-bucket/ (uses mc command line tool or WAFCACHE_CMD)
++* WAFCACHE_CMD: bucket upload/download command, for example:
++    WAFCACHE_CMD="gsutil cp %{SRC} %{TGT}"
++  Note that the WAFCACHE bucket value is used for the source or destination
++  depending on the operation (upload or download). For example, with:
++    WAFCACHE="gs://mybucket/"
++  the following commands may be run:
++    gsutil cp build/myprogram  gs://mybucket/aa/aaaaa/1
++    gsutil cp gs://mybucket/bb/bbbbb/2 build/somefile
+ * WAFCACHE_NO_PUSH: if set, disables pushing to the cache
+ * WAFCACHE_VERBOSITY: if set, displays more detailed cache operations
+ 
+@@ -30,6 +39,7 @@ File cache specific options:
+ * WAFCACHE_EVICT_MAX_BYTES: maximum amount of cache size in bytes (10GB)
+ * WAFCACHE_EVICT_INTERVAL_MINUTES: minimum time interval to try
+                                    and trim the cache (3 minutess)
++
+ Usage::
+ 
+ 	def build(bld):
+@@ -41,7 +51,7 @@ To troubleshoot::
+ 	waf clean build --zones=wafcache
+ """
+ 
+-import atexit, base64, errno, fcntl, getpass, os, shutil, sys, time, traceback, urllib3
++import atexit, base64, errno, fcntl, getpass, os, re, shutil, sys, time, traceback, urllib3, shlex
+ try:
+ 	import subprocess32 as subprocess
+ except ImportError:
+@@ -53,6 +63,7 @@ if not os.path.isdir(base_cache):
+ default_wafcache_dir = os.path.join(base_cache, 'wafcache_' + getpass.getuser())
+ 
+ CACHE_DIR = os.environ.get('WAFCACHE', default_wafcache_dir)
++WAFCACHE_CMD = os.environ.get('WAFCACHE_CMD')
+ TRIM_MAX_FOLDERS = int(os.environ.get('WAFCACHE_TRIM_MAX_FOLDER', 1000000))
+ EVICT_INTERVAL_MINUTES = int(os.environ.get('WAFCACHE_EVICT_INTERVAL_MINUTES', 3))
+ EVICT_MAX_BYTES = int(os.environ.get('WAFCACHE_EVICT_MAX_BYTES', 10**10))
+@@ -60,6 +71,8 @@ WAFCACHE_NO_PUSH = 1 if os.environ.get('WAFCACHE_NO_PUSH') else 0
+ WAFCACHE_VERBOSITY = 1 if os.environ.get('WAFCACHE_VERBOSITY') else 0
+ OK = "ok"
+ 
++re_waf_cmd = re.compile('(?P<src>%{SRC})|(?P<tgt>%{TGT})')
++
+ try:
+ 	import cPickle
+ except ImportError:
+@@ -233,8 +246,9 @@ def build(bld):
+ 		# already called once
+ 		return
+ 
+-	for x in range(bld.jobs):
+-		process_pool.append(get_process())
++	# pre-allocation
++	processes = [get_process() for x in range(bld.jobs)]
++	process_pool.extend(processes)
+ 
+ 	Task.Task.can_retrieve_cache = can_retrieve_cache
+ 	Task.Task.put_files_cache = put_files_cache
+@@ -449,10 +463,20 @@ class fcache(object):
+ 
+ class bucket_cache(object):
+ 	def bucket_copy(self, source, target):
+-		if CACHE_DIR.startswith('s3://'):
++		if WAFCACHE_CMD:
++			def replacer(match):
++				if match.group('src'):
++					return source
++				elif match.group('tgt'):
++					return target
++			cmd = [re_waf_cmd.sub(replacer, x) for x in shlex.split(WAFCACHE_CMD)]
++		elif CACHE_DIR.startswith('s3://'):
+ 			cmd = ['aws', 's3', 'cp', source, target]
+-		else:
++		elif CACHE_DIR.startswith('gs://'):
+ 			cmd = ['gsutil', 'cp', source, target]
++		else:
++			cmd = ['mc', 'cp', source, target]
++
+ 		proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+ 		out, err = proc.communicate()
+ 		if proc.returncode:
+@@ -510,7 +534,9 @@ def loop(service):
+ 	sys.stdout.flush()
+ 
+ if __name__ == '__main__':
+-	if CACHE_DIR.startswith('s3://') or CACHE_DIR.startswith('gs://'):
++	if CACHE_DIR.startswith('s3://') or CACHE_DIR.startswith('gs://') or CACHE_DIR.startswith('minio://'):
++		if CACHE_DIR.startswith('minio://'):
++			CACHE_DIR = CACHE_DIR[8:]   # minio doesn't need the protocol part, uses config aliases
+ 		service = bucket_cache()
+ 	elif CACHE_DIR.startswith('http'):
+ 		service = netcache()
+diff --git third_party/waf/waflib/extras/xcode6.py third_party/waf/waflib/extras/xcode6.py
+index 91bbff181ec..c5b309120c9 100644
+--- third_party/waf/waflib/extras/xcode6.py
++++ third_party/waf/waflib/extras/xcode6.py
+@@ -99,7 +99,7 @@ env.PROJ_CONFIGURATION = {
+ 		...
+ 	}
+ 	'Release': {
+-		'ARCHS' x86_64'
++		'ARCHS': x86_64'
+ 		...
+ 	}
+ }
+@@ -163,12 +163,12 @@ class XCodeNode(object):
+ 			result = result + "\t\t}"
+ 			return result
+ 		elif isinstance(value, str):
+-			return "\"%s\"" % value
++			return '"%s"' % value.replace('"', '\\\\\\"')
+ 		elif isinstance(value, list):
+ 			result = "(\n"
+ 			for i in value:
+-				result = result + "\t\t\t%s,\n" % self.tostring(i)
+-			result = result + "\t\t)"
++				result = result + "\t\t\t\t%s,\n" % self.tostring(i)
++			result = result + "\t\t\t)"
+ 			return result
+ 		elif isinstance(value, XCodeNode):
+ 			return value._id
+@@ -565,13 +565,13 @@ def process_xcode(self):
+ 	# Override target specific build settings
+ 	bldsettings = {
+ 		'HEADER_SEARCH_PATHS': ['$(inherited)'] + self.env['INCPATHS'],
+-		'LIBRARY_SEARCH_PATHS': ['$(inherited)'] + Utils.to_list(self.env.LIBPATH) + Utils.to_list(self.env.STLIBPATH) + Utils.to_list(self.env.LIBDIR) ,
++		'LIBRARY_SEARCH_PATHS': ['$(inherited)'] + Utils.to_list(self.env.LIBPATH) + Utils.to_list(self.env.STLIBPATH) + Utils.to_list(self.env.LIBDIR),
+ 		'FRAMEWORK_SEARCH_PATHS': ['$(inherited)'] + Utils.to_list(self.env.FRAMEWORKPATH),
+-		'OTHER_LDFLAGS': libs + ' ' + frameworks,
+-		'OTHER_LIBTOOLFLAGS': bld.env['LINKFLAGS'],
++		'OTHER_LDFLAGS': libs + ' ' + frameworks + ' ' + ' '.join(bld.env['LINKFLAGS']),
+ 		'OTHER_CPLUSPLUSFLAGS': Utils.to_list(self.env['CXXFLAGS']),
+ 		'OTHER_CFLAGS': Utils.to_list(self.env['CFLAGS']),
+-		'INSTALL_PATH': []
++		'INSTALL_PATH': [],
++		'GCC_PREPROCESSOR_DEFINITIONS': self.env['DEFINES']
+ 	}
+ 
+ 	# Install path
+@@ -591,7 +591,7 @@ def process_xcode(self):
+ 
+ 	# The keys represents different build configuration, e.g. Debug, Release and so on..
+ 	# Insert our generated build settings to all configuration names
+-	keys = set(settings.keys() + bld.env.PROJ_CONFIGURATION.keys())
++	keys = set(settings.keys()) | set(bld.env.PROJ_CONFIGURATION.keys())
+ 	for k in keys:
+ 		if k in settings:
+ 			settings[k].update(bldsettings)
+-- 
+2.37.3
+
diff --git a/net/samba413/files/patch-waf-2.0.22 b/net/samba413/files/patch-waf-2.0.22
new file mode 100644
index 000000000000..db3c8edff8d3
--- /dev/null
+++ b/net/samba413/files/patch-waf-2.0.22
@@ -0,0 +1,596 @@
+From 59ed09928541d40df72592419247add608a54aca Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Wed, 25 Aug 2021 15:34:58 +0200
+Subject: [PATCH] third_party: Update waf to version 2.0.22
+
+New in waf 2.0.22
+
+* Fix stdin propagation with faulty vcvarsall scripts #2315
+* Enable mixing Unix-style paths with destdir on Windows platforms #2337
+* Fix shell escaping unit test parameters #2314
+* Improve extras/clang_compilation_database and extras/swig compatibility #2336
+* Propagate C++ flags to the Cuda compiler in extras/cuda #2311
+* Fix detection of Qt 5.0.0 (preparation for Qt6) #2331
+* Enable Haxe processing #2308
+* Fix regression in MACOSX_DEPLOYMENT_TARGET caused by distutils #2330
+* Fix extras/wafcache concurrent trimming issues #2312
+* Fix extras/wafcache symlink handling #2327
+
+The import was done like this:
+
+./third_party/waf/update.sh
+
+Then changing buildtools/bin/waf and buildtools/wafsamba/wafsamba.py
+by hand.
+
+Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Reviewed-by: Andrew Bartlett <abartlet@samba.org>
+
+Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
+Autobuild-Date(master): Thu Sep  2 21:22:17 UTC 2021 on sn-devel-184
+---
+ buildtools/bin/waf                            |   2 +-
+ buildtools/wafsamba/wafsamba.py               |   2 +-
+ third_party/waf/waflib/Build.py               |   4 +-
+ third_party/waf/waflib/Context.py             |   6 +-
+ third_party/waf/waflib/Tools/msvc.py          |   2 +-
+ third_party/waf/waflib/Tools/python.py        |   2 +-
+ third_party/waf/waflib/Tools/qt5.py           |   6 +-
+ third_party/waf/waflib/Tools/waf_unit_test.py |   2 +-
+ third_party/waf/waflib/Utils.py               |  15 +-
+ .../extras/clang_compilation_database.py      |  28 ++--
+ third_party/waf/waflib/extras/haxe.py         | 131 ++++++++++++++++++
+ third_party/waf/waflib/extras/wafcache.py     |  59 ++++++--
+ 12 files changed, 215 insertions(+), 44 deletions(-)
+ create mode 100644 third_party/waf/waflib/extras/haxe.py
+
+diff --git buildtools/bin/waf buildtools/bin/waf
+index 041450fc131..b0ccb09a877 100755
+--- buildtools/bin/waf
++++ buildtools/bin/waf
+@@ -32,7 +32,7 @@ POSSIBILITY OF SUCH DAMAGE.
+ 
+ import os, sys, inspect
+ 
+-VERSION="2.0.21"
++VERSION="2.0.22"
+ REVISION="x"
+ GIT="x"
+ INSTALL="x"
+diff --git buildtools/wafsamba/wafsamba.py buildtools/wafsamba/wafsamba.py
+index 4fe9daf160e..dee007bf84e 100644
+--- buildtools/wafsamba/wafsamba.py
++++ buildtools/wafsamba/wafsamba.py
+@@ -38,7 +38,7 @@ LIB_PATH="shared"
+ 
+ os.environ['PYTHONUNBUFFERED'] = '1'
+ 
+-if Context.HEXVERSION not in (0x2001500,):
++if Context.HEXVERSION not in (0x2001600,):
+     Logs.error('''
+ Please use the version of waf that comes with Samba, not
+ a system installed version. See http://wiki.samba.org/index.php/Waf
+diff --git third_party/waf/waflib/Build.py third_party/waf/waflib/Build.py
+index 52837618577..b49dd8302b1 100644
+--- third_party/waf/waflib/Build.py
++++ third_party/waf/waflib/Build.py
+@@ -1066,9 +1066,9 @@ class inst(Task.Task):
+ 		else:
+ 			dest = os.path.normpath(Utils.subst_vars(self.install_to, self.env))
+ 		if not os.path.isabs(dest):
+-		    dest = os.path.join(self.env.PREFIX, dest)
++			dest = os.path.join(self.env.PREFIX, dest)
+ 		if destdir and Options.options.destdir:
+-			dest = os.path.join(Options.options.destdir, os.path.splitdrive(dest)[1].lstrip(os.sep))
++			dest = Options.options.destdir.rstrip(os.sep) + os.sep + os.path.splitdrive(dest)[1].lstrip(os.sep)
+ 		return dest
+ 
+ 	def copy_fun(self, src, tgt):
+diff --git third_party/waf/waflib/Context.py third_party/waf/waflib/Context.py
+index 0ce9df6e91f..07ee1201f03 100644
+--- third_party/waf/waflib/Context.py
++++ third_party/waf/waflib/Context.py
+@@ -18,13 +18,13 @@ else:
+ 	import imp
+ 
+ # the following 3 constants are updated on each new release (do not touch)
+-HEXVERSION=0x2001500
++HEXVERSION=0x2001600
+ """Constant updated on new releases"""
+ 
+-WAFVERSION="2.0.21"
++WAFVERSION="2.0.22"
+ """Constant updated on new releases"""
+ 
+-WAFREVISION="edde20a6425a5c3eb6b47d5f3f5c4fbc93fed5f4"
++WAFREVISION="816d5bc48ba2abc4ac22f2b44d94d322bf992b9c"
+ """Git revision when the waf version is updated"""
+ 
+ WAFNAME="waf"
+diff --git third_party/waf/waflib/Tools/msvc.py third_party/waf/waflib/Tools/msvc.py
+index 37233be8242..0c4703aaee9 100644
+--- third_party/waf/waflib/Tools/msvc.py
++++ third_party/waf/waflib/Tools/msvc.py
+@@ -193,7 +193,7 @@ echo PATH=%%PATH%%
+ echo INCLUDE=%%INCLUDE%%
+ echo LIB=%%LIB%%;%%LIBPATH%%
+ """ % (vcvars,target))
+-	sout = conf.cmd_and_log(['cmd.exe', '/E:on', '/V:on', '/C', batfile.abspath()])
++	sout = conf.cmd_and_log(['cmd.exe', '/E:on', '/V:on', '/C', batfile.abspath()], stdin=getattr(Utils.subprocess, 'DEVNULL', None))
+ 	lines = sout.splitlines()
+ 
+ 	if not lines[0]:
+diff --git third_party/waf/waflib/Tools/python.py third_party/waf/waflib/Tools/python.py
+index b1c8dd01285..07442561dff 100644
+--- third_party/waf/waflib/Tools/python.py
++++ third_party/waf/waflib/Tools/python.py
+@@ -327,7 +327,7 @@ def check_python_headers(conf, features='pyembed pyext'):
+ 	dct = dict(zip(v, lst))
+ 	x = 'MACOSX_DEPLOYMENT_TARGET'
+ 	if dct[x]:
+-		env[x] = conf.environ[x] = dct[x]
++		env[x] = conf.environ[x] = str(dct[x])
+ 	env.pyext_PATTERN = '%s' + dct['SO'] # not a mistake
+ 
+ 
+diff --git third_party/waf/waflib/Tools/qt5.py third_party/waf/waflib/Tools/qt5.py
+index cff2028174f..82c83e18c8a 100644
+--- third_party/waf/waflib/Tools/qt5.py
++++ third_party/waf/waflib/Tools/qt5.py
+@@ -566,7 +566,7 @@ def find_qt5_binaries(self):
+ 	# at the end, try to find qmake in the paths given
+ 	# keep the one with the highest version
+ 	cand = None
+-	prev_ver = ['5', '0', '0']
++	prev_ver = ['0', '0', '0']
+ 	for qmk in ('qmake-qt5', 'qmake5', 'qmake'):
+ 		try:
+ 			qmake = self.find_program(qmk, path_list=paths)
+@@ -580,7 +580,7 @@ def find_qt5_binaries(self):
+ 			else:
+ 				if version:
+ 					new_ver = version.split('.')
+-					if new_ver > prev_ver:
++					if new_ver[0] == '5' and new_ver > prev_ver:
+ 						cand = qmake
+ 						prev_ver = new_ver
+ 
+@@ -783,7 +783,7 @@ def set_qt5_libs_to_check(self):
+ 			pat = self.env.cxxstlib_PATTERN
+ 		if Utils.unversioned_sys_platform() == 'darwin':
+ 			pat = r"%s\.framework"
+-		re_qt = re.compile(pat%'Qt5?(?P<name>.*)'+'$')
++		re_qt = re.compile(pat % 'Qt5?(?P<name>\\D+)' + '$')
+ 		for x in dirlst:
+ 			m = re_qt.match(x)
+ 			if m:
+diff --git third_party/waf/waflib/Tools/waf_unit_test.py third_party/waf/waflib/Tools/waf_unit_test.py
+index dc66fe9c184..8cff89bdeb9 100644
+--- third_party/waf/waflib/Tools/waf_unit_test.py
++++ third_party/waf/waflib/Tools/waf_unit_test.py
+@@ -206,7 +206,7 @@ class utest(Task.Task):
+ 		self.ut_exec = getattr(self.generator, 'ut_exec', [self.inputs[0].abspath()])
+ 		ut_cmd = getattr(self.generator, 'ut_cmd', False)
+ 		if ut_cmd:
+-			self.ut_exec = shlex.split(ut_cmd % ' '.join(self.ut_exec))
++			self.ut_exec = shlex.split(ut_cmd % Utils.shell_escape(self.ut_exec))
+ 
+ 		return self.exec_command(self.ut_exec)
+ 
+diff --git third_party/waf/waflib/Utils.py third_party/waf/waflib/Utils.py
+index fc64fa05154..669490ca908 100644
+--- third_party/waf/waflib/Utils.py
++++ third_party/waf/waflib/Utils.py
+@@ -11,7 +11,7 @@ through Python versions 2.5 to 3.X and across different platforms (win32, linux,
+ 
+ from __future__ import with_statement
+ 
+-import atexit, os, sys, errno, inspect, re, datetime, platform, base64, signal, functools, time
++import atexit, os, sys, errno, inspect, re, datetime, platform, base64, signal, functools, time, shlex
+ 
+ try:
+ 	import cPickle
+@@ -577,10 +577,13 @@ def quote_define_name(s):
+ 	fu = fu.upper()
+ 	return fu
+ 
+-re_sh = re.compile('\\s|\'|"')
+-"""
+-Regexp used for shell_escape below
+-"""
++# shlex.quote didn't exist until python 3.3. Prior to that it was a non-documented
++# function in pipes.
++try:
++	shell_quote = shlex.quote
++except AttributeError:
++	import pipes
++	shell_quote = pipes.quote
+ 
+ def shell_escape(cmd):
+ 	"""
+@@ -589,7 +592,7 @@ def shell_escape(cmd):
+ 	"""
+ 	if isinstance(cmd, str):
+ 		return cmd
+-	return ' '.join(repr(x) if re_sh.search(x) else x for x in cmd)
++	return ' '.join(shell_quote(x) for x in cmd)
+ 
+ def h_list(lst):
+ 	"""
+diff --git third_party/waf/waflib/extras/clang_compilation_database.py third_party/waf/waflib/extras/clang_compilation_database.py
+index ff71f22ecfd..17f66949376 100644
+--- third_party/waf/waflib/extras/clang_compilation_database.py
++++ third_party/waf/waflib/extras/clang_compilation_database.py
+@@ -29,22 +29,9 @@ from waflib import Logs, TaskGen, Task, Build, Scripting
+ 
+ Task.Task.keep_last_cmd = True
+ 
+-@TaskGen.feature('c', 'cxx')
+-@TaskGen.after_method('process_use')
+-def collect_compilation_db_tasks(self):
+-	"Add a compilation database entry for compiled tasks"
+-	if not isinstance(self.bld, ClangDbContext):
+-		return
+-
+-	tup = tuple(y for y in [Task.classes.get(x) for x in ('c', 'cxx')] if y)
+-	for task in getattr(self, 'compiled_tasks', []):
+-		if isinstance(task, tup):
+-			self.bld.clang_compilation_database_tasks.append(task)
+-
+ class ClangDbContext(Build.BuildContext):
+ 	'''generates compile_commands.json by request'''
+ 	cmd = 'clangdb'
+-	clang_compilation_database_tasks = []
+ 
+ 	def write_compilation_database(self):
+ 		"""
+@@ -78,6 +65,8 @@ class ClangDbContext(Build.BuildContext):
+ 		Build dry run
+ 		"""
+ 		self.restore()
++		self.cur_tasks = []
++		self.clang_compilation_database_tasks = []
+ 
+ 		if not self.all_envs:
+ 			self.load_envs()
+@@ -103,8 +92,21 @@ class ClangDbContext(Build.BuildContext):
+ 					lst = [tg]
+ 				else: lst = tg.tasks
+ 				for tsk in lst:
++					if tsk.__class__.__name__ == "swig":
++						tsk.runnable_status()
++						if hasattr(tsk, 'more_tasks'):
++							lst.extend(tsk.more_tasks)
++					# Not all dynamic tasks can be processed, in some cases
++					# one may have to call the method "run()" like this:
++					#elif tsk.__class__.__name__ == 'src2c':
++					#	tsk.run()
++					#	if hasattr(tsk, 'more_tasks'):
++					#		lst.extend(tsk.more_tasks)
++
+ 					tup = tuple(y for y in [Task.classes.get(x) for x in ('c', 'cxx')] if y)
+ 					if isinstance(tsk, tup):
++						self.clang_compilation_database_tasks.append(tsk)
++						tsk.nocache = True
+ 						old_exec = tsk.exec_command
+ 						tsk.exec_command = exec_command
+ 						tsk.run()
+diff --git third_party/waf/waflib/extras/haxe.py third_party/waf/waflib/extras/haxe.py
+new file mode 100644
+index 00000000000..cb3ba6a949c
+--- /dev/null
++++ third_party/waf/waflib/extras/haxe.py
+@@ -0,0 +1,131 @@
++import os, re
++from waflib import Utils, Task, Errors
++from waflib.TaskGen import extension, taskgen_method, feature
++from waflib.Configure import conf
++
++@conf
++def libname_haxe(self, libname):
++	return libname
++
++@conf
++def check_lib_haxe(self, libname, uselib_store=None):
++	haxe_libs = [node.name for node in self.root.find_node('haxe_libraries').ant_glob()]
++	changed = False
++	self.start_msg('Checking for library %s' % libname)
++	if libname + '.hxml' in haxe_libs:
++		self.end_msg('yes')
++	else:
++		changed = True
++		try:
++			cmd = self.env.LIX + ['+lib', libname]
++			res = self.cmd_and_log(cmd)
++			if (res):
++				raise Errors.WafError(res)
++			else:
++				self.end_msg('downloaded', color = 'YELLOW')
++		except Errors.WafError as e:
++			self.end_msg('no', color = 'RED')
++			self.fatal('Getting %s has failed' % libname)
++
++	postfix = uselib_store if uselib_store else libname.upper()
++	self.env['LIB_' + postfix] += [self.libname_haxe(libname)]
++	return changed
++
++@conf
++def check_libs_haxe(self, libnames, uselib_store=None):
++	changed = False
++	for libname in Utils.to_list(libnames):
++		if self.check_lib_haxe(libname, uselib_store):
++			changed = True
++	return changed
++
++@conf
++def ensure_lix_pkg(self, *k, **kw):
++	if kw.get('compiler') == 'hx':
++		if isinstance(kw.get('libs'), list) and len(kw.get('libs')):
++			changed = self.check_libs_haxe(kw.get('libs'), kw.get('uselib_store'))
++			if changed:
++				try:
++					cmd = self.env.LIX + ['download']
++					res = self.cmd_and_log(cmd)
++					if (res):
++						raise Errors.WafError(res)
++				except Errors.WafError as e:
++					self.fatal('lix download has failed')
++		else:
++			self.check_lib_haxe(kw.get('lib'), kw.get('uselib_store'))
++
++@conf
++def haxe(bld, *k, **kw):
++	task_gen = bld(*k, **kw)
++
++class haxe(Task.Task):
++	vars = ['HAXE', 'HAXE_VERSION', 'HAXEFLAGS']
++	ext_out = ['.hl', '.c', '.h']
++
++	def run(self):
++		cmd = self.env.HAXE + self.env.HAXEFLAGS
++		return self.exec_command(cmd, stdout = open(os.devnull, 'w'))
++
++@taskgen_method
++def init_haxe_task(self, node):
++	def addflags(flags):
++		self.env.append_value('HAXEFLAGS', flags)
++
++	if node.suffix() == '.hxml':
++		addflags(self.path.abspath() + '/' + node.name)
++	else:
++		addflags(['-main', node.name])
++	addflags(['-hl', self.path.get_bld().make_node(self.target).abspath()])
++	addflags(['-cp', self.path.abspath()])
++	addflags(['-D', 'resourcesPath=%s' % getattr(self, 'res', '')])
++	if hasattr(self, 'use'):
++		for dep in self.use:
++			if self.env['LIB_' + dep]:
++				for lib in self.env['LIB_' + dep]: addflags(['-lib', lib])
++
++@extension('.hx', '.hxml')
++def haxe_file(self, node):
++	if len(self.source) > 1:
++		self.bld.fatal('Use separate task generators for multiple files')
++
++	try:
++		haxetask = self.haxetask
++	except AttributeError:
++		haxetask = self.haxetask = self.create_task('haxe')
++		self.init_haxe_task(node)
++
++	haxetask.inputs.append(node)
++	haxetask.outputs.append(self.path.get_bld().make_node(self.target))
++
++@conf
++def find_haxe(self, min_version):
++	npx = self.env.NPX = self.find_program('npx')
++	self.env.LIX = npx + ['lix']
++	npx_haxe = self.env.HAXE = npx + ['haxe']
++	try:
++		output = self.cmd_and_log(npx_haxe + ['-version'])
++	except Errors.WafError:
++		haxe_version = None
++	else:
++		ver = re.search(r'\d+.\d+.\d+', output).group().split('.')
++		haxe_version = tuple([int(x) for x in ver])
++
++	self.msg('Checking for haxe version',
++	         haxe_version, haxe_version and haxe_version >= min_version)
++	if npx_haxe and haxe_version < min_version:
++		self.fatal('haxe version %r is too old, need >= %r' % (haxe_version, min_version))
++
++	self.env.HAXE_VERSION = haxe_version
++	return npx_haxe
++
++@conf
++def check_haxe(self, min_version=(4,1,4)):
++	if self.env.HAXE_MINVER:
++		min_version = self.env.HAXE_MINVER
++	find_haxe(self, min_version)
++
++def configure(self):
++	self.env.HAXEFLAGS = []
++	self.check_haxe()
++	self.add_os_flags('HAXEFLAGS', dup = False)
+diff --git third_party/waf/waflib/extras/wafcache.py third_party/waf/waflib/extras/wafcache.py
+index 088fd0d098d..cc23fcd6673 100644
+--- third_party/waf/waflib/extras/wafcache.py
++++ third_party/waf/waflib/extras/wafcache.py
+@@ -31,6 +31,7 @@ The following environment variables may be set:
+     gsutil cp gs://mybucket/bb/bbbbb/2 build/somefile
+ * WAFCACHE_NO_PUSH: if set, disables pushing to the cache
+ * WAFCACHE_VERBOSITY: if set, displays more detailed cache operations
++* WAFCACHE_STATS: if set, displays cache usage statistics on exit
+ 
+ File cache specific options:
+   Files are copied using hard links by default; if the cache is located
+@@ -69,6 +70,7 @@ EVICT_INTERVAL_MINUTES = int(os.environ.get('WAFCACHE_EVICT_INTERVAL_MINUTES', 3
+ EVICT_MAX_BYTES = int(os.environ.get('WAFCACHE_EVICT_MAX_BYTES', 10**10))
+ WAFCACHE_NO_PUSH = 1 if os.environ.get('WAFCACHE_NO_PUSH') else 0
+ WAFCACHE_VERBOSITY = 1 if os.environ.get('WAFCACHE_VERBOSITY') else 0
++WAFCACHE_STATS = 1 if os.environ.get('WAFCACHE_STATS') else 0
+ OK = "ok"
+ 
+ re_waf_cmd = re.compile('(?P<src>%{SRC})|(?P<tgt>%{TGT})')
+@@ -93,6 +95,9 @@ def can_retrieve_cache(self):
+ 	sig = self.signature()
+ 	ssig = Utils.to_hex(self.uid() + sig)
+ 
++	if WAFCACHE_STATS:
++		self.generator.bld.cache_reqs += 1
++
+ 	files_to = [node.abspath() for node in self.outputs]
+ 	err = cache_command(ssig, [], files_to)
+ 	if err.startswith(OK):
+@@ -100,6 +105,8 @@ def can_retrieve_cache(self):
+ 			Logs.pprint('CYAN', '  Fetched %r from cache' % files_to)
+ 		else:
+ 			Logs.debug('wafcache: fetched %r from cache', files_to)
++		if WAFCACHE_STATS:
++			self.generator.bld.cache_hits += 1
+ 	else:
+ 		if WAFCACHE_VERBOSITY:
+ 			Logs.pprint('YELLOW', '  No cache entry %s' % files_to)
+@@ -117,11 +124,17 @@ def put_files_cache(self):
+ 	if WAFCACHE_NO_PUSH or getattr(self, 'cached', None) or not self.outputs:
+ 		return
+ 
++	files_from = []
++	for node in self.outputs:
++		path = node.abspath()
++		if not os.path.isfile(path):
++			return
++		files_from.append(path)
++
+ 	bld = self.generator.bld
+ 	sig = self.signature()
+ 	ssig = Utils.to_hex(self.uid() + sig)
+ 
+-	files_from = [node.abspath() for node in self.outputs]
+ 	err = cache_command(ssig, files_from, [])
+ 
+ 	if err.startswith(OK):
+@@ -129,6 +142,8 @@ def put_files_cache(self):
+ 			Logs.pprint('CYAN', '  Successfully uploaded %s to cache' % files_from)
+ 		else:
+ 			Logs.debug('wafcache: Successfully uploaded %r to cache', files_from)
++		if WAFCACHE_STATS:
++			self.generator.bld.cache_puts += 1
+ 	else:
+ 		if WAFCACHE_VERBOSITY:
+ 			Logs.pprint('RED', '  Error caching step results %s: %s' % (files_from, err))
+@@ -193,6 +208,10 @@ def make_cached(cls):
+ 	if getattr(cls, 'nocache', None) or getattr(cls, 'has_cache', False):
+ 		return
+ 
++	full_name = "%s.%s" % (cls.__module__, cls.__name__)
++	if full_name in ('waflib.Tools.ccroot.vnum', 'waflib.Build.inst'):
++		return
++
+ 	m1 = getattr(cls, 'run', None)
+ 	def run(self):
+ 		if getattr(self, 'nocache', False):
+@@ -208,9 +227,6 @@ def make_cached(cls):
+ 			return m2(self)
+ 		ret = m2(self)
+ 		self.put_files_cache()
+-		if hasattr(self, 'chmod'):
+-			for node in self.outputs:
+-				os.chmod(node.abspath(), self.chmod)
+ 		return ret
+ 	cls.post_run = post_run
+ 	cls.has_cache = True
+@@ -257,6 +273,19 @@ def build(bld):
+ 	for x in reversed(list(Task.classes.values())):
+ 		make_cached(x)
+ 
++	if WAFCACHE_STATS:
++		# Init counter for statistics and hook to print results at the end
++		bld.cache_reqs = bld.cache_hits = bld.cache_puts = 0
++
++		def printstats(bld):
++			hit_ratio = 0
++			if bld.cache_reqs > 0:
++				hit_ratio = (bld.cache_hits / bld.cache_reqs) * 100
++			Logs.pprint('CYAN', '  wafcache stats: requests: %s, hits, %s, ratio: %.2f%%, writes %s' %
++					 (bld.cache_reqs, bld.cache_hits, hit_ratio, bld.cache_puts) )
++
++		bld.add_post_fun(printstats)
++
+ def cache_command(sig, files_from, files_to):
+ 	"""
+ 	Create a command for cache worker processes, returns a pickled
+@@ -320,7 +349,10 @@ def lru_trim():
+ 
+ 				size = 0
+ 				for fname in os.listdir(path):
+-					size += os.lstat(os.path.join(path, fname)).st_size
++					try:
++						size += os.lstat(os.path.join(path, fname)).st_size
++					except OSError:
++						pass
+ 				lst.append((os.stat(path).st_mtime, size, path))
+ 
+ 	lst.sort(key=lambda x: x[0])
+@@ -331,7 +363,7 @@ def lru_trim():
+ 		_, tmp_size, path = lst.pop()
+ 		tot -= tmp_size
+ 
+-		tmp = path + '.tmp'
++		tmp = path + '.remove'
+ 		try:
+ 			shutil.rmtree(tmp)
+ 		except OSError:
+@@ -339,12 +371,12 @@ def lru_trim():
+ 		try:
+ 			os.rename(path, tmp)
+ 		except OSError:
+-			sys.stderr.write('Could not rename %r to %r' % (path, tmp))
++			sys.stderr.write('Could not rename %r to %r\n' % (path, tmp))
+ 		else:
+ 			try:
+ 				shutil.rmtree(tmp)
+ 			except OSError:
+-				sys.stderr.write('Could not remove %r' % tmp)
++				sys.stderr.write('Could not remove %r\n' % tmp)
+ 	sys.stderr.write("Cache trimmed: %r bytes in %r folders left\n" % (tot, len(lst)))
+ 
+ 
+@@ -371,8 +403,8 @@ def lru_evict():
+ 			try:
+ 				fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+ 			except EnvironmentError:
+-				sys.stderr.write('another process is running!\n')
+-				pass
++				if WAFCACHE_VERBOSITY:
++					sys.stderr.write('wafcache: another cleaning process is running\n')
+ 			else:
+ 				# now dow the actual cleanup
+ 				lru_trim()
+@@ -443,7 +475,10 @@ class fcache(object):
+ 		else:
+ 			# attempt trimming if caching was successful:
+ 			# we may have things to trim!
+-			lru_evict()
++			try:
++				lru_evict()
++			except Exception:
++				return traceback.format_exc()
+ 		return OK
+ 
+ 	def copy_from_cache(self, sig, files_from, files_to):
+@@ -481,7 +516,7 @@ class bucket_cache(object):
+ 		out, err = proc.communicate()
+ 		if proc.returncode:
+ 			raise OSError('Error copy %r to %r using: %r (exit %r):\n  out:%s\n  err:%s' % (
+-				source, target, cmd, proc.returncode, out.decode(), err.decode()))
++				source, target, cmd, proc.returncode, out.decode(errors='replace'), err.decode(errors='replace')))
+ 
+ 	def copy_to_cache(self, sig, files_from, files_to):
+ 		try:
+-- 
+2.37.3
+
diff --git a/net/samba413/files/patch-waf-2.0.23 b/net/samba413/files/patch-waf-2.0.23
new file mode 100644
index 000000000000..36a70e32e8c3
--- /dev/null
+++ b/net/samba413/files/patch-waf-2.0.23
@@ -0,0 +1,877 @@
+From fb175576b698f43224dab815fd6c0763a12db2b2 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Thu, 17 Feb 2022 15:40:20 +0100
+Subject: [PATCH] third_party: Update waf to verison 2.0.23
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Alexander Bokovoy <ab@samba.org>
+
+Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
+Autobuild-Date(master): Mon Feb 21 10:06:27 UTC 2022 on sn-devel-184
+---
+ buildtools/bin/waf                            |  3 +-
+ buildtools/wafsamba/wafsamba.py               |  2 +-
+ third_party/waf/waflib/Context.py             |  6 +-
+ third_party/waf/waflib/Runner.py              |  4 +-
+ third_party/waf/waflib/TaskGen.py             |  8 +-
+ third_party/waf/waflib/Tools/c_config.py      |  1 +
+ third_party/waf/waflib/Tools/compiler_c.py    | 25 +++---
+ third_party/waf/waflib/Tools/compiler_cxx.py  | 25 +++---
+ third_party/waf/waflib/Tools/python.py        |  7 +-
+ third_party/waf/waflib/Tools/qt5.py           |  4 +-
+ third_party/waf/waflib/Tools/winres.py        | 35 ++++++++
+ .../extras/clang_compilation_database.py      |  2 +-
+ .../waf/waflib/extras/classic_runner.py       | 68 +++++++++++++++
+ third_party/waf/waflib/extras/color_gcc.py    |  2 +-
+ third_party/waf/waflib/extras/eclipse.py      | 74 ++++++++++++++++-
+ third_party/waf/waflib/extras/gccdeps.py      | 82 ++++++++++---------
+ third_party/waf/waflib/extras/msvcdeps.py     | 54 ++++++++----
+ third_party/waf/waflib/extras/msvs.py         |  6 +-
+ third_party/waf/waflib/extras/swig.py         |  2 +-
+ third_party/waf/waflib/extras/wafcache.py     | 26 +++---
+ third_party/waf/waflib/fixpy2.py              |  2 +-
+ 21 files changed, 325 insertions(+), 113 deletions(-)
+ create mode 100644 third_party/waf/waflib/extras/classic_runner.py
+
+diff --git buildtools/bin/waf buildtools/bin/waf
+index b0ccb09a877..2001ccdbd8a 100755
+--- buildtools/bin/waf
++++ buildtools/bin/waf
+@@ -32,7 +32,7 @@ POSSIBILITY OF SUCH DAMAGE.
+ 
+ import os, sys, inspect
+ 
+-VERSION="2.0.22"
++VERSION="2.0.23"
+ REVISION="x"
+ GIT="x"
+ INSTALL="x"
+@@ -164,4 +164,3 @@ if __name__ == '__main__':
+ 
+ 	from waflib import Scripting
+ 	Scripting.waf_entry_point(cwd, VERSION, wafdir[0])
+-
+diff --git buildtools/wafsamba/wafsamba.py buildtools/wafsamba/wafsamba.py
+index 185ef3b73a2..710b82af663 100644
+--- buildtools/wafsamba/wafsamba.py
++++ buildtools/wafsamba/wafsamba.py
+@@ -38,7 +38,7 @@ LIB_PATH="shared"
+ 
+ os.environ['PYTHONUNBUFFERED'] = '1'
+ 
+-if Context.HEXVERSION not in (0x2001600,):
++if Context.HEXVERSION not in (0x2001700,):
+     Logs.error('''
+ Please use the version of waf that comes with Samba, not
+ a system installed version. See http://wiki.samba.org/index.php/Waf
+diff --git third_party/waf/waflib/Context.py third_party/waf/waflib/Context.py
+index 07ee1201f03..36d1ca74fef 100644
+--- third_party/waf/waflib/Context.py
++++ third_party/waf/waflib/Context.py
+@@ -18,13 +18,13 @@ else:
+ 	import imp
+ 
+ # the following 3 constants are updated on each new release (do not touch)
+-HEXVERSION=0x2001600
++HEXVERSION=0x2001700
+ """Constant updated on new releases"""
+ 
+-WAFVERSION="2.0.22"
++WAFVERSION="2.0.23"
+ """Constant updated on new releases"""
+ 
+-WAFREVISION="816d5bc48ba2abc4ac22f2b44d94d322bf992b9c"
++WAFREVISION="cc6b34cf555d354c34f554c41206134072588de7"
+ """Git revision when the waf version is updated"""
+ 
+ WAFNAME="waf"
+diff --git third_party/waf/waflib/Runner.py third_party/waf/waflib/Runner.py
+index 91d55479e20..350c86a22c0 100644
+--- third_party/waf/waflib/Runner.py
++++ third_party/waf/waflib/Runner.py
+@@ -71,7 +71,7 @@ class Consumer(Utils.threading.Thread):
+ 		"""Task to execute"""
+ 		self.spawner = spawner
+ 		"""Coordinator object"""
+-		self.setDaemon(1)
++		self.daemon = True
+ 		self.start()
+ 	def run(self):
+ 		"""
+@@ -98,7 +98,7 @@ class Spawner(Utils.threading.Thread):
+ 		""":py:class:`waflib.Runner.Parallel` producer instance"""
+ 		self.sem = Utils.threading.Semaphore(master.numjobs)
+ 		"""Bounded semaphore that prevents spawning more than *n* concurrent consumers"""
+-		self.setDaemon(1)
++		self.daemon = True
+ 		self.start()
+ 	def run(self):
+ 		"""
+diff --git third_party/waf/waflib/TaskGen.py third_party/waf/waflib/TaskGen.py
+index f8f92bd57c1..89f63169910 100644
+--- third_party/waf/waflib/TaskGen.py
++++ third_party/waf/waflib/TaskGen.py
+@@ -631,12 +631,8 @@ def process_rule(self):
+ 			cls.scan = self.scan
+ 		elif has_deps:
+ 			def scan(self):
+-				nodes = []
+-				for x in self.generator.to_list(getattr(self.generator, 'deps', None)):
+-					node = self.generator.path.find_resource(x)
+-					if not node:
+-						self.generator.bld.fatal('Could not find %r (was it declared?)' % x)
+-					nodes.append(node)
++				deps = getattr(self.generator, 'deps', None)
++				nodes = self.generator.to_nodes(deps)
+ 				return [nodes, []]
+ 			cls.scan = scan
+ 
+diff --git third_party/waf/waflib/Tools/c_config.py third_party/waf/waflib/Tools/c_config.py
+index 03b6bf61bc0..f5ab19bf6ce 100644
+--- third_party/waf/waflib/Tools/c_config.py
++++ third_party/waf/waflib/Tools/c_config.py
+@@ -69,6 +69,7 @@ MACRO_TO_DEST_CPU = {
+ '__sh__'      : 'sh',
+ '__xtensa__'  : 'xtensa',
+ '__e2k__'     : 'e2k',
++'__riscv'     : 'riscv',
+ }
+ 
+ @conf
+diff --git third_party/waf/waflib/Tools/compiler_c.py third_party/waf/waflib/Tools/compiler_c.py
+index 931dc57efec..e033ce6c5c3 100644
+--- third_party/waf/waflib/Tools/compiler_c.py
++++ third_party/waf/waflib/Tools/compiler_c.py
+@@ -36,18 +36,19 @@ from waflib import Utils
+ from waflib.Logs import debug
+ 
+ c_compiler = {
+-'win32':  ['msvc', 'gcc', 'clang'],
+-'cygwin': ['gcc', 'clang'],
+-'darwin': ['clang', 'gcc'],
+-'aix':    ['xlc', 'gcc', 'clang'],
+-'linux':  ['gcc', 'clang', 'icc'],
+-'sunos':  ['suncc', 'gcc'],
+-'irix':   ['gcc', 'irixcc'],
+-'hpux':   ['gcc'],
+-'osf1V':  ['gcc'],
+-'gnu':    ['gcc', 'clang'],
+-'java':   ['gcc', 'msvc', 'clang', 'icc'],
+-'default':['clang', 'gcc'],
++'win32':       ['msvc', 'gcc', 'clang'],
++'cygwin':      ['gcc', 'clang'],
++'darwin':      ['clang', 'gcc'],
++'aix':         ['xlc', 'gcc', 'clang'],
++'linux':       ['gcc', 'clang', 'icc'],
++'sunos':       ['suncc', 'gcc'],
++'irix':        ['gcc', 'irixcc'],
++'hpux':        ['gcc'],
++'osf1V':       ['gcc'],
++'gnu':         ['gcc', 'clang'],
++'java':        ['gcc', 'msvc', 'clang', 'icc'],
++'gnukfreebsd': ['gcc', 'clang'],
++'default':     ['clang', 'gcc'],
+ }
+ """
+ Dict mapping platform names to Waf tools finding specific C compilers::
+diff --git third_party/waf/waflib/Tools/compiler_cxx.py third_party/waf/waflib/Tools/compiler_cxx.py
+index 09fca7e4dc6..42658c5847e 100644
+--- third_party/waf/waflib/Tools/compiler_cxx.py
++++ third_party/waf/waflib/Tools/compiler_cxx.py
+@@ -37,18 +37,19 @@ from waflib import Utils
+ from waflib.Logs import debug
+ 
+ cxx_compiler = {
+-'win32':  ['msvc', 'g++', 'clang++'],
+-'cygwin': ['g++', 'clang++'],
+-'darwin': ['clang++', 'g++'],
+-'aix':    ['xlc++', 'g++', 'clang++'],
+-'linux':  ['g++', 'clang++', 'icpc'],
+-'sunos':  ['sunc++', 'g++'],
+-'irix':   ['g++'],
+-'hpux':   ['g++'],
+-'osf1V':  ['g++'],
+-'gnu':    ['g++', 'clang++'],
+-'java':   ['g++', 'msvc', 'clang++', 'icpc'],
+-'default': ['clang++', 'g++']
++'win32':       ['msvc', 'g++', 'clang++'],
++'cygwin':      ['g++', 'clang++'],
++'darwin':      ['clang++', 'g++'],
++'aix':         ['xlc++', 'g++', 'clang++'],
++'linux':       ['g++', 'clang++', 'icpc'],
++'sunos':       ['sunc++', 'g++'],
++'irix':        ['g++'],
++'hpux':        ['g++'],
++'osf1V':       ['g++'],
++'gnu':         ['g++', 'clang++'],
++'java':        ['g++', 'msvc', 'clang++', 'icpc'],
++'gnukfreebsd': ['g++', 'clang++'],
++'default':     ['clang++', 'g++']
+ }
+ """
+ Dict mapping the platform names to Waf tools finding specific C++ compilers::
+diff --git third_party/waf/waflib/Tools/python.py third_party/waf/waflib/Tools/python.py
+index 07442561dff..fb641e5e20d 100644
+--- third_party/waf/waflib/Tools/python.py
++++ third_party/waf/waflib/Tools/python.py
+@@ -416,9 +416,14 @@ def check_python_headers(conf, features='pyembed pyext'):
+ 
+ 		if not result:
+ 			path = [os.path.join(dct['prefix'], "libs")]
+-			conf.to_log("\n\n# try again with -L$prefix/libs, and pythonXY name rather than pythonX.Y (win32)\n")
++			conf.to_log("\n\n# try again with -L$prefix/libs, and pythonXY rather than pythonX.Y (win32)\n")
+ 			result = conf.check(lib=name, uselib='PYEMBED', libpath=path, mandatory=False, msg='Checking for library %s in $prefix/libs' % name)
+ 
++		if not result:
++			path = [os.path.normpath(os.path.join(dct['INCLUDEPY'], '..', 'libs'))]
++			conf.to_log("\n\n# try again with -L$INCLUDEPY/../libs, and pythonXY rather than pythonX.Y (win32)\n")
++			result = conf.check(lib=name, uselib='PYEMBED', libpath=path, mandatory=False, msg='Checking for library %s in $INCLUDEPY/../libs' % name)
++
+ 		if result:
+ 			break # do not forget to set LIBPATH_PYEMBED
+ 
+diff --git third_party/waf/waflib/Tools/qt5.py third_party/waf/waflib/Tools/qt5.py
+index 82c83e18c8a..b3e61325e50 100644
+--- third_party/waf/waflib/Tools/qt5.py
++++ third_party/waf/waflib/Tools/qt5.py
+@@ -783,8 +783,8 @@ def set_qt5_libs_to_check(self):
+ 			pat = self.env.cxxstlib_PATTERN
+ 		if Utils.unversioned_sys_platform() == 'darwin':
+ 			pat = r"%s\.framework"
+-		re_qt = re.compile(pat % 'Qt5?(?P<name>\\D+)' + '$')
+-		for x in dirlst:
++		re_qt = re.compile(pat % 'Qt5?(?P<name>\\w+)' + '$')
++		for x in sorted(dirlst):
+ 			m = re_qt.match(x)
+ 			if m:
+ 				self.qt5_vars.append("Qt5%s" % m.group('name'))
+diff --git third_party/waf/waflib/Tools/winres.py third_party/waf/waflib/Tools/winres.py
+index 9be1ed66009..73c0e95315b 100644
+--- third_party/waf/waflib/Tools/winres.py
++++ third_party/waf/waflib/Tools/winres.py
+@@ -4,10 +4,12 @@
+ 
+ "Process *.rc* files for C/C++: X{.rc -> [.res|.rc.o]}"
+ 
++import os
+ import re
+ from waflib import Task
+ from waflib.TaskGen import extension
+ from waflib.Tools import c_preproc
++from waflib import Utils
+ 
+ @extension('.rc')
+ def rc_file(self, node):
+@@ -61,6 +63,39 @@ class winrc(Task.Task):
+ 		tmp.start(self.inputs[0], self.env)
+ 		return (tmp.nodes, tmp.names)
+ 
++	def exec_command(self, cmd, **kw):
++		if self.env.WINRC_TGT_F == '/fo':
++			# Since winres include paths may contain spaces, they do not fit in
++			# response files and are best passed as environment variables
++			replace_cmd = []
++			incpaths = []
++			while cmd:
++				# filter include path flags
++				flag = cmd.pop(0)
++				if flag.upper().startswith('/I'):
++					if len(flag) == 2:
++						incpaths.append(cmd.pop(0))
++					else:
++						incpaths.append(flag[2:])
++				else:
++					replace_cmd.append(flag)
++			cmd = replace_cmd
++			if incpaths:
++				# append to existing environment variables in INCLUDE
++				env = kw['env'] = dict(kw.get('env') or self.env.env or os.environ)
++				pre_includes = env.get('INCLUDE', '')
++				env['INCLUDE'] = pre_includes + os.pathsep + os.pathsep.join(incpaths)
++
++		return super(winrc, self).exec_command(cmd, **kw)
++
++	def quote_flag(self, flag):
++		if self.env.WINRC_TGT_F == '/fo':
++			# winres does not support quotes around flags in response files
++			return flag
++
++		return super(winrc, self).quote_flag(flag)
++
++
+ def configure(conf):
+ 	"""
+ 	Detects the programs RC or windres, depending on the C/C++ compiler in use
+diff --git third_party/waf/waflib/extras/clang_compilation_database.py third_party/waf/waflib/extras/clang_compilation_database.py
+index 17f66949376..bd29db93fd5 100644
+--- third_party/waf/waflib/extras/clang_compilation_database.py
++++ third_party/waf/waflib/extras/clang_compilation_database.py
+@@ -126,7 +126,7 @@ def patch_execute():
+ 		Invoke clangdb command before build
+ 		"""
+ 		if self.cmd.startswith('build'):
+-			Scripting.run_command('clangdb')
++			Scripting.run_command(self.cmd.replace('build','clangdb'))
+ 
+ 		old_execute_build(self)
+ 
+diff --git third_party/waf/waflib/extras/classic_runner.py third_party/waf/waflib/extras/classic_runner.py
+new file mode 100644
+index 00000000000..b08c794e880
+--- /dev/null
++++ third_party/waf/waflib/extras/classic_runner.py
+@@ -0,0 +1,68 @@
++#!/usr/bin/env python
++# encoding: utf-8
++# Thomas Nagy, 2021 (ita)
++
++from waflib import Utils, Runner
++
++"""
++Re-enable the classic threading system from waf 1.x
++
++def configure(conf):
++	conf.load('classic_runner')
++"""
++
++class TaskConsumer(Utils.threading.Thread):
++	"""
++	Task consumers belong to a pool of workers
++
++	They wait for tasks in the queue and then use ``task.process(...)``
++	"""
++	def __init__(self, spawner):
++		Utils.threading.Thread.__init__(self)
++		"""
++		Obtain :py:class:`waflib.Task.TaskBase` instances from this queue.
++		"""
++		self.spawner = spawner
++		self.daemon = True
++		self.start()
++
++	def run(self):
++		"""
++		Loop over the tasks to execute
++		"""
++		try:
++			self.loop()
++		except Exception:
++			pass
++
++	def loop(self):
++		"""
++		Obtain tasks from :py:attr:`waflib.Runner.TaskConsumer.ready` and call
++		:py:meth:`waflib.Task.TaskBase.process`. If the object is a function, execute it.
++		"""
++		master = self.spawner.master
++		while 1:
++			if not master.stop:
++				try:
++					tsk = master.ready.get()
++					if tsk:
++						tsk.log_display(tsk.generator.bld)
++						master.process_task(tsk)
++					else:
++						break
++				finally:
++					master.out.put(tsk)
++
++class Spawner(object):
++	"""
++	Daemon thread that consumes tasks from :py:class:`waflib.Runner.Parallel` producer and
++	spawns a consuming thread :py:class:`waflib.Runner.Consumer` for each
++	:py:class:`waflib.Task.Task` instance.
++	"""
++	def __init__(self, master):
++		self.master = master
++		""":py:class:`waflib.Runner.Parallel` producer instance"""
++
++		self.pool = [TaskConsumer(self) for i in range(master.numjobs)]
++
++Runner.Spawner = Spawner
+diff --git third_party/waf/waflib/extras/color_gcc.py third_party/waf/waflib/extras/color_gcc.py
+index b68c5ebf2df..09729035fec 100644
+--- third_party/waf/waflib/extras/color_gcc.py
++++ third_party/waf/waflib/extras/color_gcc.py
+@@ -19,7 +19,7 @@ class ColorGCCFormatter(Logs.formatter):
+ 			func = frame.f_code.co_name
+ 			if func == 'exec_command':
+ 				cmd = frame.f_locals.get('cmd')
+-				if isinstance(cmd, list) and ('gcc' in cmd[0] or 'g++' in cmd[0]):
++				if isinstance(cmd, list) and (len(cmd) > 0) and ('gcc' in cmd[0] or 'g++' in cmd[0]):
+ 					lines = []
+ 					for line in rec.msg.splitlines():
+ 						if 'warning: ' in line:
+diff --git third_party/waf/waflib/extras/eclipse.py third_party/waf/waflib/extras/eclipse.py
+index bb787416e9f..49ca9686b7b 100644
+--- third_party/waf/waflib/extras/eclipse.py
++++ third_party/waf/waflib/extras/eclipse.py
+@@ -10,6 +10,9 @@ Usage:
+ def options(opt):
+ 	opt.load('eclipse')
+ 
++To add additional targets beside standard ones (configure, dist, install, check)
++the environment ECLIPSE_EXTRA_TARGETS can be set (ie. to ['test', 'lint', 'docs'])
++
+ $ waf configure eclipse
+ """
+ 
+@@ -25,6 +28,8 @@ cdt_core = oe_cdt + '.core'
+ cdt_bld = oe_cdt + '.build.core'
+ extbuilder_dir = '.externalToolBuilders'
+ extbuilder_name = 'Waf_Builder.launch'
++settings_dir = '.settings'
++settings_name = 'language.settings.xml'
+ 
+ class eclipse(Build.BuildContext):
+ 	cmd = 'eclipse'
+@@ -131,9 +136,11 @@ class eclipse(Build.BuildContext):
+ 					path = p.path_from(self.srcnode)
+ 
+ 					if (path.startswith("/")):
+-						cpppath.append(path)
++						if path not in cpppath:
++							cpppath.append(path)
+ 					else:
+-						workspace_includes.append(path)
++						if path not in workspace_includes:
++							workspace_includes.append(path)
+ 
+ 					if is_cc and path not in source_dirs:
+ 						source_dirs.append(path)
+@@ -156,6 +163,61 @@ class eclipse(Build.BuildContext):
+ 			project = self.impl_create_javaproject(javasrcpath, javalibpath)
+ 			self.write_conf_to_xml('.classpath', project)
+ 
++		# Create editor language settings to have correct standards applied in IDE, as per project configuration
++		try:
++			os.mkdir(settings_dir)
++		except OSError:
++			pass	# Ignore if dir already exists
++
++		lang_settings = Document()
++		project = lang_settings.createElement('project')
++
++		# Language configurations for C and C++ via cdt
++		if hasc:
++			configuration = self.add(lang_settings, project, 'configuration',
++							{'id' : 'org.eclipse.cdt.core.default.config.1', 'name': 'Default'})
++
++			extension = self.add(lang_settings, configuration, 'extension', {'point': 'org.eclipse.cdt.core.LanguageSettingsProvider'})
++
++			provider = self.add(lang_settings, extension, 'provider',
++							{ 'copy-of': 'extension',
++							  'id': 'org.eclipse.cdt.ui.UserLanguageSettingsProvider'})
++
++			provider = self.add(lang_settings, extension, 'provider-reference',
++							{ 'id': 'org.eclipse.cdt.core.ReferencedProjectsLanguageSettingsProvider',
++							  'ref': 'shared-provider'})
++
++			provider = self.add(lang_settings, extension, 'provider-reference',
++							{ 'id': 'org.eclipse.cdt.managedbuilder.core.MBSLanguageSettingsProvider',
++							  'ref': 'shared-provider'})
++
++			# C and C++ are kept as separated providers so appropriate flags are used also in mixed projects
++			if self.env.CC:
++				provider = self.add(lang_settings, extension, 'provider',
++							{ 'class': 'org.eclipse.cdt.managedbuilder.language.settings.providers.GCCBuiltinSpecsDetector',
++							  'console': 'false',
++							  'id': 'org.eclipse.cdt.managedbuilder.language.settings.providers.GCCBuiltinSpecsDetector.1',
++							  'keep-relative-paths' : 'false',
++							  'name': 'CDT GCC Built-in Compiler Settings',
++							  'parameter': '%s %s ${FLAGS} -E -P -v -dD "${INPUTS}"'%(self.env.CC[0],' '.join(self.env['CFLAGS'])),
++							  'prefer-non-shared': 'true' })
++
++				self.add(lang_settings, provider, 'language-scope', { 'id': 'org.eclipse.cdt.core.gcc'})
++
++			if self.env.CXX:
++				provider = self.add(lang_settings, extension, 'provider',
++							{ 'class': 'org.eclipse.cdt.managedbuilder.language.settings.providers.GCCBuiltinSpecsDetector',
++							  'console': 'false',
++							  'id': 'org.eclipse.cdt.managedbuilder.language.settings.providers.GCCBuiltinSpecsDetector.2',
++							  'keep-relative-paths' : 'false',
++							  'name': 'CDT GCC Built-in Compiler Settings',
++							  'parameter': '%s %s ${FLAGS} -E -P -v -dD "${INPUTS}"'%(self.env.CXX[0],' '.join(self.env['CXXFLAGS'])),
++							  'prefer-non-shared': 'true' })
++				self.add(lang_settings, provider, 'language-scope', { 'id': 'org.eclipse.cdt.core.g++'})
++
++		lang_settings.appendChild(project)
++		self.write_conf_to_xml('%s%s%s'%(settings_dir, os.path.sep, settings_name), lang_settings)
++
+ 	def impl_create_project(self, executable, appname, hasc, hasjava, haspython, waf_executable):
+ 		doc = Document()
+ 		projectDescription = doc.createElement('projectDescription')
+@@ -341,6 +403,8 @@ class eclipse(Build.BuildContext):
+ 		addTargetWrap('dist', False)
+ 		addTargetWrap('install', False)
+ 		addTargetWrap('check', False)
++		for addTgt in self.env.ECLIPSE_EXTRA_TARGETS or []:
++			addTargetWrap(addTgt, False)
+ 
+ 		storageModule = self.add(doc, cproject, 'storageModule',
+ 							{'moduleId': 'cdtBuildSystem',
+@@ -348,6 +412,12 @@ class eclipse(Build.BuildContext):
+ 
+ 		self.add(doc, storageModule, 'project', {'id': '%s.null.1'%appname, 'name': appname})
+ 
++		storageModule = self.add(doc, cproject, 'storageModule',
++							{'moduleId': 'org.eclipse.cdt.core.LanguageSettingsProviders'})
++
++		storageModule = self.add(doc, cproject, 'storageModule',
++							{'moduleId': 'scannerConfiguration'})
++
+ 		doc.appendChild(cproject)
+ 		return doc
+ 
+diff --git third_party/waf/waflib/extras/gccdeps.py third_party/waf/waflib/extras/gccdeps.py
+index 1fc9373489a..9e9952f2f7d 100644
+--- third_party/waf/waflib/extras/gccdeps.py
++++ third_party/waf/waflib/extras/gccdeps.py
+@@ -29,13 +29,6 @@ if not c_preproc.go_absolute:
+ # Third-party tools are allowed to add extra names in here with append()
+ supported_compilers = ['gas', 'gcc', 'icc', 'clang']
+ 
+-def scan(self):
+-	if not self.__class__.__name__ in self.env.ENABLE_GCCDEPS:
+-		return super(self.derived_gccdeps, self).scan()
+-	nodes = self.generator.bld.node_deps.get(self.uid(), [])
+-	names = []
+-	return (nodes, names)
+-
+ re_o = re.compile(r"\.o$")
+ re_splitter = re.compile(r'(?<!\\)\s+') # split by space, except when spaces are escaped
+ 
+@@ -61,28 +54,30 @@ def path_to_node(base_node, path, cached_nodes):
+ 	else:
+ 		# Not hashable, assume it is a list and join into a string
+ 		node_lookup_key = (base_node, os.path.sep.join(path))
++
+ 	try:
+-		lock.acquire()
+ 		node = cached_nodes[node_lookup_key]
+ 	except KeyError:
+-		node = base_node.find_resource(path)
+-		cached_nodes[node_lookup_key] = node
+-	finally:
+-		lock.release()
++		# retry with lock on cache miss
++		with lock:
++			try:
++				node = cached_nodes[node_lookup_key]
++			except KeyError:
++				node = cached_nodes[node_lookup_key] = base_node.find_resource(path)
++
+ 	return node
+ 
+ def post_run(self):
+ 	if not self.__class__.__name__ in self.env.ENABLE_GCCDEPS:
+ 		return super(self.derived_gccdeps, self).post_run()
+ 
+-	name = self.outputs[0].abspath()
+-	name = re_o.sub('.d', name)
++	deps_filename = self.outputs[0].abspath()
++	deps_filename = re_o.sub('.d', deps_filename)
+ 	try:
+-		txt = Utils.readf(name)
++		deps_txt = Utils.readf(deps_filename)
+ 	except EnvironmentError:
+ 		Logs.error('Could not find a .d dependency file, are cflags/cxxflags overwritten?')
+ 		raise
+-	#os.remove(name)
+ 
+ 	# Compilers have the choice to either output the file's dependencies
+ 	# as one large Makefile rule:
+@@ -102,15 +97,16 @@ def post_run(self):
+ 	# So the first step is to sanitize the input by stripping out the left-
+ 	# hand side of all these lines. After that, whatever remains are the
+ 	# implicit dependencies of task.outputs[0]
+-	txt = '\n'.join([remove_makefile_rule_lhs(line) for line in txt.splitlines()])
++	deps_txt = '\n'.join([remove_makefile_rule_lhs(line) for line in deps_txt.splitlines()])
+ 
+ 	# Now join all the lines together
+-	txt = txt.replace('\\\n', '')
++	deps_txt = deps_txt.replace('\\\n', '')
+ 
+-	val = txt.strip()
+-	val = [x.replace('\\ ', ' ') for x in re_splitter.split(val) if x]
++	dep_paths = deps_txt.strip()
++	dep_paths = [x.replace('\\ ', ' ') for x in re_splitter.split(dep_paths) if x]
+ 
+-	nodes = []
++	resolved_nodes = []
++	unresolved_names = []
+ 	bld = self.generator.bld
+ 
+ 	# Dynamically bind to the cache
+@@ -119,39 +115,41 @@ def post_run(self):
+ 	except AttributeError:
+ 		cached_nodes = bld.cached_nodes = {}
+ 
+-	for x in val:
++	for path in dep_paths:
+ 
+ 		node = None
+-		if os.path.isabs(x):
+-			node = path_to_node(bld.root, x, cached_nodes)
++		if os.path.isabs(path):
++			node = path_to_node(bld.root, path, cached_nodes)
+ 		else:
+ 			# TODO waf 1.9 - single cwd value
+-			path = getattr(bld, 'cwdx', bld.bldnode)
++			base_node = getattr(bld, 'cwdx', bld.bldnode)
+ 			# when calling find_resource, make sure the path does not contain '..'
+-			x = [k for k in Utils.split_path(x) if k and k != '.']
+-			while '..' in x:
+-				idx = x.index('..')
++			path = [k for k in Utils.split_path(path) if k and k != '.']
++			while '..' in path:
++				idx = path.index('..')
+ 				if idx == 0:
+-					x = x[1:]
+-					path = path.parent
++					path = path[1:]
++					base_node = base_node.parent
+ 				else:
+-					del x[idx]
+-					del x[idx-1]
++					del path[idx]
++					del path[idx-1]
+ 
+-			node = path_to_node(path, x, cached_nodes)
++			node = path_to_node(base_node, path, cached_nodes)
+ 
+ 		if not node:
+-			raise ValueError('could not find %r for %r' % (x, self))
++			raise ValueError('could not find %r for %r' % (path, self))
++
+ 		if id(node) == id(self.inputs[0]):
+ 			# ignore the source file, it is already in the dependencies
+ 			# this way, successful config tests may be retrieved from the cache
+ 			continue
+-		nodes.append(node)
+ 
+-	Logs.debug('deps: gccdeps for %s returned %s', self, nodes)
++		resolved_nodes.append(node)
+ 
+-	bld.node_deps[self.uid()] = nodes
+-	bld.raw_deps[self.uid()] = []
++	Logs.debug('deps: gccdeps for %s returned %s', self, resolved_nodes)
++
++	bld.node_deps[self.uid()] = resolved_nodes
++	bld.raw_deps[self.uid()] = unresolved_names
+ 
+ 	try:
+ 		del self.cache_sig
+@@ -160,6 +158,14 @@ def post_run(self):
+ 
+ 	Task.Task.post_run(self)
+ 
++def scan(self):
++	if not self.__class__.__name__ in self.env.ENABLE_GCCDEPS:
++		return super(self.derived_gccdeps, self).scan()
++
++	resolved_nodes = self.generator.bld.node_deps.get(self.uid(), [])
++	unresolved_names = []
++	return (resolved_nodes, unresolved_names)
++
+ def sig_implicit_deps(self):
+ 	if not self.__class__.__name__ in self.env.ENABLE_GCCDEPS:
+ 		return super(self.derived_gccdeps, self).sig_implicit_deps()
+diff --git third_party/waf/waflib/extras/msvcdeps.py third_party/waf/waflib/extras/msvcdeps.py
+index 52985dce058..e8985bde7c7 100644
+--- third_party/waf/waflib/extras/msvcdeps.py
++++ third_party/waf/waflib/extras/msvcdeps.py
+@@ -32,7 +32,6 @@ from waflib.Tools import c_preproc, c, cxx, msvc
+ from waflib.TaskGen import feature, before_method
+ 
+ lock = threading.Lock()
+-nodes = {} # Cache the path -> Node lookup
+ 
+ PREPROCESSOR_FLAG = '/showIncludes'
+ INCLUDE_PATTERN = 'Note: including file:'
+@@ -50,23 +49,47 @@ def apply_msvcdeps_flags(taskgen):
+ 		if taskgen.env.get_flat(flag).find(PREPROCESSOR_FLAG) < 0:
+ 			taskgen.env.append_value(flag, PREPROCESSOR_FLAG)
+ 
++
++def get_correct_path_case(base_path, path):
++	'''
++	Return a case-corrected version of ``path`` by searching the filesystem for
++	``path``, relative to ``base_path``, using the case returned by the filesystem.
++	'''
++	components = Utils.split_path(path)
++
++	corrected_path = ''
++	if os.path.isabs(path):
++		corrected_path = components.pop(0).upper() + os.sep
++
++	for part in components:
++		part = part.lower()
++		search_path = os.path.join(base_path, corrected_path)
++		if part == '..':
++			corrected_path = os.path.join(corrected_path, part)
++			search_path = os.path.normpath(search_path)
++			continue
++
++		for item in sorted(os.listdir(search_path)):
++			if item.lower() == part:
++				corrected_path = os.path.join(corrected_path, item)
++				break
++		else:
++			raise ValueError("Can't find %r in %r" % (part, search_path))
++
++	return corrected_path
++
++
+ def path_to_node(base_node, path, cached_nodes):
+ 	'''
+ 	Take the base node and the path and return a node
+ 	Results are cached because searching the node tree is expensive
+ 	The following code is executed by threads, it is not safe, so a lock is needed...
+ 	'''
+-	# normalize the path because ant_glob() does not understand
+-	# parent path components (..)
++	# normalize the path to remove parent path components (..)
+ 	path = os.path.normpath(path)
+ 
+ 	# normalize the path case to increase likelihood of a cache hit
+-	path = os.path.normcase(path)
+-
+-	# ant_glob interprets [] and () characters, so those must be replaced
+-	path = path.replace('[', '?').replace(']', '?').replace('(', '[(]').replace(')', '[)]')
+-
+-	node_lookup_key = (base_node, path)
++	node_lookup_key = (base_node, os.path.normcase(path))
+ 
+ 	try:
+ 		node = cached_nodes[node_lookup_key]
+@@ -76,8 +99,8 @@ def path_to_node(base_node, path, cached_nodes):
+ 			try:
+ 				node = cached_nodes[node_lookup_key]
+ 			except KeyError:
+-				node_list = base_node.ant_glob([path], ignorecase=True, remove=False, quiet=True, regex=False)
+-				node = cached_nodes[node_lookup_key] = node_list[0] if node_list else None
++				path = get_correct_path_case(base_node.abspath(), path)
++				node = cached_nodes[node_lookup_key] = base_node.find_node(path)
+ 
+ 	return node
+ 
+@@ -89,9 +112,9 @@ def post_run(self):
+ 	if getattr(self, 'cached', None):
+ 		return Task.Task.post_run(self)
+ 
+-	bld = self.generator.bld
+-	unresolved_names = []
+ 	resolved_nodes = []
++	unresolved_names = []
++	bld = self.generator.bld
+ 
+ 	# Dynamically bind to the cache
+ 	try:
+@@ -124,11 +147,14 @@ def post_run(self):
+ 					continue
+ 
+ 			if id(node) == id(self.inputs[0]):
+-				# Self-dependency
++				# ignore the source file, it is already in the dependencies
++				# this way, successful config tests may be retrieved from the cache
+ 				continue
+ 
+ 			resolved_nodes.append(node)
+ 
++	Logs.debug('deps: msvcdeps for %s returned %s', self, resolved_nodes)
++
+ 	bld.node_deps[self.uid()] = resolved_nodes
+ 	bld.raw_deps[self.uid()] = unresolved_names
+ 
+diff --git third_party/waf/waflib/extras/msvs.py third_party/waf/waflib/extras/msvs.py
+index 8aa2db0b751..03b739f849c 100644
+--- third_party/waf/waflib/extras/msvs.py
++++ third_party/waf/waflib/extras/msvs.py
+@@ -787,8 +787,12 @@ class msvs_generator(BuildContext):
+ 		self.collect_dirs()
+ 		default_project = getattr(self, 'default_project', None)
+ 		def sortfun(x):
+-			if x.name == default_project:
++			# folders should sort to the top
++			if getattr(x, 'VS_GUID_SOLUTIONFOLDER', None):
+ 				return ''
++			# followed by the default project
++			elif x.name == default_project:
++				return ' '
+ 			return getattr(x, 'path', None) and x.path.win32path() or x.name
+ 		self.all_projects.sort(key=sortfun)
+ 
+diff --git third_party/waf/waflib/extras/swig.py third_party/waf/waflib/extras/swig.py
+index 740ab46d963..967caeb5a82 100644
+--- third_party/waf/waflib/extras/swig.py
++++ third_party/waf/waflib/extras/swig.py
+@@ -17,7 +17,7 @@ tasks have to be added dynamically:
+ 
+ SWIG_EXTS = ['.swig', '.i']
+ 
+-re_module = re.compile(r'%module(?:\s*\(.*\))?\s+(.+)', re.M)
++re_module = re.compile(r'%module(?:\s*\(.*\))?\s+([^\r\n]+)', re.M)
+ 
+ re_1 = re.compile(r'^%module.*?\s+([\w]+)\s*?$', re.M)
+ re_2 = re.compile(r'[#%](?:include|import(?:\(module=".*"\))+|python(?:begin|code)) [<"](.*)[">]', re.M)
+diff --git third_party/waf/waflib/extras/wafcache.py third_party/waf/waflib/extras/wafcache.py
+index cc23fcd6673..2cef46c0e1c 100644
+--- third_party/waf/waflib/extras/wafcache.py
++++ third_party/waf/waflib/extras/wafcache.py
+@@ -258,6 +258,19 @@ def build(bld):
+ 	"""
+ 	Called during the build process to enable file caching
+ 	"""
++	if WAFCACHE_STATS:
++		# Init counter for statistics and hook to print results at the end
++		bld.cache_reqs = bld.cache_hits = bld.cache_puts = 0
++
++		def printstats(bld):
++			hit_ratio = 0
++			if bld.cache_reqs > 0:
++				hit_ratio = (bld.cache_hits / bld.cache_reqs) * 100
++			Logs.pprint('CYAN', '  wafcache stats: requests: %s, hits, %s, ratio: %.2f%%, writes %s' %
++					 (bld.cache_reqs, bld.cache_hits, hit_ratio, bld.cache_puts) )
++
++		bld.add_post_fun(printstats)
++
+ 	if process_pool:
+ 		# already called once
+ 		return
+@@ -273,19 +286,6 @@ def build(bld):
+ 	for x in reversed(list(Task.classes.values())):
+ 		make_cached(x)
+ 
+-	if WAFCACHE_STATS:
+-		# Init counter for statistics and hook to print results at the end
+-		bld.cache_reqs = bld.cache_hits = bld.cache_puts = 0
+-
+-		def printstats(bld):
+-			hit_ratio = 0
+-			if bld.cache_reqs > 0:
+-				hit_ratio = (bld.cache_hits / bld.cache_reqs) * 100
+-			Logs.pprint('CYAN', '  wafcache stats: requests: %s, hits, %s, ratio: %.2f%%, writes %s' %
+-					 (bld.cache_reqs, bld.cache_hits, hit_ratio, bld.cache_puts) )
+-
+-		bld.add_post_fun(printstats)
+-
+ def cache_command(sig, files_from, files_to):
+ 	"""
+ 	Create a command for cache worker processes, returns a pickled
+diff --git third_party/waf/waflib/fixpy2.py third_party/waf/waflib/fixpy2.py
+index 24176e06645..c99bff4b9ae 100644
+--- third_party/waf/waflib/fixpy2.py
++++ third_party/waf/waflib/fixpy2.py
+@@ -56,7 +56,7 @@ def r1(code):
+ @subst('Runner.py')
+ def r4(code):
+ 	"generator syntax"
+-	return code.replace('next(self.biter)', 'self.biter.next()')
++	return code.replace('next(self.biter)', 'self.biter.next()').replace('self.daemon = True', 'self.setDaemon(1)')
+ 
+ @subst('Context.py')
+ def r5(code):
+-- 
+2.37.3
+
diff --git a/net/samba413/files/patch-waf-2.0.24 b/net/samba413/files/patch-waf-2.0.24
new file mode 100644
index 000000000000..2c5c76e6ca3b
--- /dev/null
+++ b/net/samba413/files/patch-waf-2.0.24
@@ -0,0 +1,164 @@
+From d19dfe1efb2f6cb0dcf0a63b957df584d8ed5945 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Mon, 23 May 2022 07:54:06 +0200
+Subject: [PATCH] third_party: Update waf to version 2.0.24
+
+This fixes building of python libraries with Python 3.11!
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=15071
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Stefan Metzmacher <metze@samba.org>
+
+Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
+Autobuild-Date(master): Mon May 23 09:34:51 UTC 2022 on sn-devel-184
+---
+ buildtools/bin/waf                     |  2 +-
+ buildtools/wafsamba/wafsamba.py        |  2 +-
+ third_party/waf/waflib/Context.py      |  8 ++++----
+ third_party/waf/waflib/Tools/ccroot.py |  1 +
+ third_party/waf/waflib/Tools/msvc.py   | 17 ++++++++++++++++-
+ third_party/waf/waflib/Tools/python.py |  4 ++--
+ third_party/waf/waflib/Tools/tex.py    |  1 +
+ 7 files changed, 26 insertions(+), 9 deletions(-)
+
+diff --git buildtools/bin/waf buildtools/bin/waf
+index 2001ccdbd8a..d9cba343623 100755
+--- buildtools/bin/waf
++++ buildtools/bin/waf
+@@ -32,7 +32,7 @@ POSSIBILITY OF SUCH DAMAGE.
+ 
+ import os, sys, inspect
+ 
+-VERSION="2.0.23"
++VERSION="2.0.24"
+ REVISION="x"
+ GIT="x"
+ INSTALL="x"
+diff --git buildtools/wafsamba/wafsamba.py buildtools/wafsamba/wafsamba.py
+index 4bd4e9f7fe3..79fe8b5e575 100644
+--- buildtools/wafsamba/wafsamba.py
++++ buildtools/wafsamba/wafsamba.py
+@@ -38,7 +38,7 @@ LIB_PATH="shared"
+ 
+ os.environ['PYTHONUNBUFFERED'] = '1'
+ 
+-if Context.HEXVERSION not in (0x2001700,):
++if Context.HEXVERSION not in (0x2001800,):
+     Logs.error('''
+ Please use the version of waf that comes with Samba, not
+ a system installed version. See http://wiki.samba.org/index.php/Waf
+diff --git third_party/waf/waflib/Context.py third_party/waf/waflib/Context.py
+index 36d1ca74fef..4a0130b24a0 100644
+--- third_party/waf/waflib/Context.py
++++ third_party/waf/waflib/Context.py
+@@ -18,13 +18,13 @@ else:
+ 	import imp
+ 
+ # the following 3 constants are updated on each new release (do not touch)
+-HEXVERSION=0x2001700
++HEXVERSION=0x2001800
+ """Constant updated on new releases"""
+ 
+-WAFVERSION="2.0.23"
++WAFVERSION="2.0.24"
+ """Constant updated on new releases"""
+ 
+-WAFREVISION="cc6b34cf555d354c34f554c41206134072588de7"
++WAFREVISION="1af97c71f5a6756abf36d0f78ed8fd551596d7cb"
+ """Git revision when the waf version is updated"""
+ 
+ WAFNAME="waf"
+@@ -144,7 +144,7 @@ class Context(ctx):
+ 	:type fun: string
+ 
+ 	.. inheritance-diagram:: waflib.Context.Context waflib.Build.BuildContext waflib.Build.InstallContext waflib.Build.UninstallContext waflib.Build.StepContext waflib.Build.ListContext waflib.Configure.ConfigurationContext waflib.Scripting.Dist waflib.Scripting.DistCheck waflib.Build.CleanContext
+-
++	   :top-classes: waflib.Context.Context
+ 	"""
+ 
+ 	errors = Errors
+diff --git third_party/waf/waflib/Tools/ccroot.py third_party/waf/waflib/Tools/ccroot.py
+index 579d5b2b72b..76deff54dcb 100644
+--- third_party/waf/waflib/Tools/ccroot.py
++++ third_party/waf/waflib/Tools/ccroot.py
+@@ -128,6 +128,7 @@ class link_task(Task.Task):
+ 	Base class for all link tasks. A task generator is supposed to have at most one link task bound in the attribute *link_task*. See :py:func:`waflib.Tools.ccroot.apply_link`.
+ 
+ 	.. inheritance-diagram:: waflib.Tools.ccroot.stlink_task waflib.Tools.c.cprogram waflib.Tools.c.cshlib waflib.Tools.cxx.cxxstlib  waflib.Tools.cxx.cxxprogram waflib.Tools.cxx.cxxshlib waflib.Tools.d.dprogram waflib.Tools.d.dshlib waflib.Tools.d.dstlib waflib.Tools.ccroot.fake_shlib waflib.Tools.ccroot.fake_stlib waflib.Tools.asm.asmprogram waflib.Tools.asm.asmshlib waflib.Tools.asm.asmstlib
++	  :top-classes: waflib.Tools.ccroot.link_task
+ 	"""
+ 	color   = 'YELLOW'
+ 
+diff --git third_party/waf/waflib/Tools/msvc.py third_party/waf/waflib/Tools/msvc.py
+index 0c4703aaee9..026a4c7fc48 100644
+--- third_party/waf/waflib/Tools/msvc.py
++++ third_party/waf/waflib/Tools/msvc.py
+@@ -109,6 +109,21 @@ def options(opt):
+ 	opt.add_option('--msvc_targets', type='string', help = 'msvc targets, eg: "x64,arm"', default='')
+ 	opt.add_option('--no-msvc-lazy', action='store_false', help = 'lazily check msvc target environments', default=True, dest='msvc_lazy')
+ 
++class MSVCVersion(object):
++	def __init__(self, ver):
++		m = re.search('^(.*)\s+(\d+[.]\d+)', ver)
++		if m:
++			self.name = m.group(1)
++			self.number = float(m.group(2))
++		else:
++			self.name = ver
++			self.number = 0.
++
++	def __lt__(self, other):
++		if self.number == other.number:
++			return self.name < other.name
++		return self.number < other.number
++
+ @conf
+ def setup_msvc(conf, versiondict):
+ 	"""
+@@ -125,7 +140,7 @@ def setup_msvc(conf, versiondict):
+ 		platforms=Utils.to_list(conf.env.MSVC_TARGETS) or [i for i,j in all_msvc_platforms+all_icl_platforms+all_wince_platforms]
+ 	desired_versions = getattr(Options.options, 'msvc_version', '').split(',')
+ 	if desired_versions == ['']:
+-		desired_versions = conf.env.MSVC_VERSIONS or list(reversed(sorted(versiondict.keys())))
++		desired_versions = conf.env.MSVC_VERSIONS or list(sorted(versiondict.keys(), key=MSVCVersion, reverse=True))
+ 
+ 	# Override lazy detection by evaluating after the fact.
+ 	lazy_detect = getattr(Options.options, 'msvc_lazy', True)
+diff --git third_party/waf/waflib/Tools/python.py third_party/waf/waflib/Tools/python.py
+index fb641e5e20d..a23bd019335 100644
+--- third_party/waf/waflib/Tools/python.py
++++ third_party/waf/waflib/Tools/python.py
+@@ -315,7 +315,7 @@ def check_python_headers(conf, features='pyembed pyext'):
+ 		conf.fatal('Could not find the python executable')
+ 
+ 	# so we actually do all this for compatibility reasons and for obtaining pyext_PATTERN below
+-	v = 'prefix SO LDFLAGS LIBDIR LIBPL INCLUDEPY Py_ENABLE_SHARED MACOSX_DEPLOYMENT_TARGET LDSHARED CFLAGS LDVERSION'.split()
++	v = 'prefix SO EXT_SUFFIX LDFLAGS LIBDIR LIBPL INCLUDEPY Py_ENABLE_SHARED MACOSX_DEPLOYMENT_TARGET LDSHARED CFLAGS LDVERSION'.split()
+ 	try:
+ 		lst = conf.get_python_variables(["get_config_var('%s') or ''" % x for x in v])
+ 	except RuntimeError:
+@@ -328,7 +328,7 @@ def check_python_headers(conf, features='pyembed pyext'):
+ 	x = 'MACOSX_DEPLOYMENT_TARGET'
+ 	if dct[x]:
+ 		env[x] = conf.environ[x] = str(dct[x])
+-	env.pyext_PATTERN = '%s' + dct['SO'] # not a mistake
++	env.pyext_PATTERN = '%s' + (dct['EXT_SUFFIX'] or dct['SO']) # SO is deprecated in 3.5 and removed in 3.11
+ 
+ 
+ 	# Try to get pythonX.Y-config
+diff --git third_party/waf/waflib/Tools/tex.py third_party/waf/waflib/Tools/tex.py
+index eaf9fdb5802..b4792c3fe87 100644
+--- third_party/waf/waflib/Tools/tex.py
++++ third_party/waf/waflib/Tools/tex.py
+@@ -90,6 +90,7 @@ class tex(Task.Task):
+ 	Compiles a tex/latex file.
+ 
+ 	.. inheritance-diagram:: waflib.Tools.tex.latex waflib.Tools.tex.xelatex waflib.Tools.tex.pdflatex
++	   :top-classes: waflib.Tools.tex.tex
+ 	"""
+ 
+ 	bibtex_fun, _ = Task.compile_fun('${BIBTEX} ${BIBTEXFLAGS} ${SRCFILE}', shell=False)
+-- 
+2.37.3
+
diff --git a/net/samba413/pkg-plist.ad_dc b/net/samba413/pkg-plist.ad_dc
index 13dbcc536782..b7c8a91fbba4 100644
--- a/net/samba413/pkg-plist.ad_dc
+++ b/net/samba413/pkg-plist.ad_dc
@@ -5,7 +5,6 @@ sbin/samba_dnsupdate
 sbin/samba_kcc
 sbin/samba_spnupdate
 sbin/samba_upgradedns
-sbin/samba-gpupdate
 include/samba4/dcerpc_server.h
 lib/samba4/libdcerpc-server.so
 lib/samba4/libdcerpc-server.so.0
@@ -172,4 +171,3 @@ lib/samba4/private/libscavenge-dns-records-samba4.so
 @dir %%DATADIR%%/setup/ad-schema
 @dir %%DATADIR%%/setup
 @dir %%DATADIR%%
-man/man8/samba-gpupdate.8.gz
diff --git a/net/samba413/pkg-plist.python b/net/samba413/pkg-plist.python
index c931ab22f63e..6de93c2891d0 100644
--- a/net/samba413/pkg-plist.python
+++ b/net/samba413/pkg-plist.python
@@ -1,5 +1,7 @@
 bin/smbtorture
+sbin/samba-gpupdate
 man/man1/smbtorture.1.gz
+man/man8/samba-gpupdate.8.gz
 include/samba4/policy.h
 lib/samba4/libsamba-policy%%PYTHON_EXT_SUFFIX%%.so
 lib/samba4/libsamba-policy%%PYTHON_EXT_SUFFIX%%.so.0
@@ -258,6 +260,7 @@ lib/samba4/private/libsamba-python%%PYTHON_EXT_SUFFIX%%-samba4.so
 %%PYTHON_SITELIBDIR%%/samba/tests/krb5/kdc_base_test.py
 %%PYTHON_SITELIBDIR%%/samba/tests/krb5/kdc_tests.py
 %%PYTHON_SITELIBDIR%%/samba/tests/krb5/kdc_tgs_tests.py
+%%PYTHON_SITELIBDIR%%/samba/tests/krb5/kpasswd_tests.py
 %%PYTHON_SITELIBDIR%%/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py
 %%PYTHON_SITELIBDIR%%/samba/tests/krb5/raw_testcase.py
 %%PYTHON_SITELIBDIR%%/samba/tests/krb5/rfc4120_constants.py