Use two queues for concurrent t_otp.py daemons

Use-two-queues-for-concurrent-t_otp.py-daemons.patch

@@ -0,0 +1,41 @@
+From 8e08f01d73ddca1b828788710ec6bb3e0354727a Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Wed, 4 Mar 2020 17:18:51 -0500
+Subject: [PATCH] Use two queues for concurrent t_otp.py daemons
+
+t_otp.py occasionally fails during the #8708 regression test, reading
+a true answer instead of the expected false answer during the first
+verify() call.  Most likely the daemons are writing their answers to
+the shared queue out of order.  Use a separate queue for the second
+daemon to ensure correct correlation of results.
+
+(cherry picked from commit c03f67eefec05db19e84e889fab7c25904929633)
+---
+ src/tests/t_otp.py | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/src/tests/t_otp.py b/src/tests/t_otp.py
+index cba871a0f..c3b820a41 100755
+--- a/src/tests/t_otp.py
++++ b/src/tests/t_otp.py
+@@ -256,16 +256,17 @@ verify(daemon, queue, True, realm.user_princ, 'accept')
+ ## tokens configured, with the first rejecting and the second
+ ## accepting.  With the bug, the KDC incorrectly rejects the request
+ ## and then performs invalid memory accesses, most likely crashing.
++queue2 = Queue()
+ daemon1 = UDPRadiusDaemon(args=(server_addr, secret_file, 'accept1', queue))
+-daemon2 = UnixRadiusDaemon(args=(socket_file, None, 'accept2', queue))
++daemon2 = UnixRadiusDaemon(args=(socket_file, None, 'accept2', queue2))
+ daemon1.start()
+ queue.get()
+ daemon2.start()
+-queue.get()
++queue2.get()
+ oconf = '[' + otpconfig_1('udp') + ', ' + otpconfig_1('unix') + ']'
+ realm.run([kadminl, 'setstr', realm.user_princ, 'otp', oconf])
+ realm.kinit(realm.user_princ, 'accept2', flags=flags)
+ verify(daemon1, queue, False, realm.user_princ.split('@')[0], 'accept2')
+-verify(daemon2, queue, True, realm.user_princ, 'accept2')
++verify(daemon2, queue2, True, realm.user_princ, 'accept2')
+ 
+ success('OTP tests')

krb5.spec

@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.18.2
 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces)
-Release: 8%{?dist}
+Release: 9%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz
@@ -67,6 +67,7 @@ Patch28: Implement-KERB_AP_OPTIONS_CBT-server-side.patch
 Patch29: Add-client_aware_channel_bindings-option.patch
 Patch30: Pass-channel-bindings-through-SPNEGO.patch
 Patch31: Add-channel-bindings-tests.patch
+Patch32: Use-two-queues-for-concurrent-t_otp.py-daemons.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -621,6 +622,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Mon Jun 15 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-9
+- Use two queues for concurrent t_otp.py daemons
+
 * Mon Jun 15 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-8
 - Match Heimdal behavior for channel bindings