Add missing test cases for ASN.1 types

Add test cases for ASN.1 types which didn't previously have them.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25610 dc483132-0cff-0310-8789-dd5450dbe970

10 files changed, 446 insertions, 3 deletions

diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports
index 2d65e7f5b5..a62bcf9cce 100644
--- a/src/lib/krb5/libkrb5.exports
+++ b/src/lib/krb5/libkrb5.exports
@@ -22,11 +22,13 @@ decode_krb5_error
 decode_krb5_etype_info
 decode_krb5_etype_info2
 decode_krb5_fast_req
+decode_krb5_fast_response
 decode_krb5_iakerb_finished
 decode_krb5_iakerb_header
 decode_krb5_kdc_req_body
 decode_krb5_pa_enc_ts
 decode_krb5_pa_for_user
+decode_krb5_pa_fx_fast_reply
 decode_krb5_pa_fx_fast_request
 decode_krb5_pa_pac_req
 decode_krb5_pa_s4u_x509_user
@@ -37,6 +39,8 @@ decode_krb5_pwd_data
 decode_krb5_pwd_sequence
 decode_krb5_safe
 decode_krb5_sam_challenge
+decode_krb5_sam_challenge_2
+decode_krb5_sam_challenge_2_body
 decode_krb5_sam_response
 decode_krb5_sam_response_2
 decode_krb5_setpw_req
@@ -294,6 +298,7 @@ krb5_free_error_message
 krb5_free_etype_info
 krb5_free_fast_armored_req
 krb5_free_fast_req
+krb5_free_fast_response
 krb5_free_host_realm
 krb5_free_iakerb_finished
 krb5_free_iakerb_header
diff --git a/src/tests/asn.1/krb5_decode_leak.c b/src/tests/asn.1/krb5_decode_leak.c
index a8c144fdfb..e0bd32c792 100644
--- a/src/tests/asn.1/krb5_decode_leak.c
+++ b/src/tests/asn.1/krb5_decode_leak.c
@@ -505,13 +505,15 @@ main(int argc, char **argv)
     }
 
     /****************************************************************/
-    /* encode_padata_sequence */
+    /* encode_padata_sequence and encode_typed_data */
     {
         krb5_pa_data **pa, **tmp;
 
         ktest_make_sample_pa_data_array(&pa);
         leak_test(*pa, encode_krb5_padata_sequence,
                   decode_krb5_padata_sequence, krb5_free_pa_data);
+        leak_test(*pa, encode_krb5_typed_data,
+                  decode_krb5_typed_data, krb5_free_pa_data);
         ktest_destroy_pa_data_array(&pa);
     }
 
@@ -614,6 +616,27 @@ main(int argc, char **argv)
         ktest_empty_sam_challenge(&sam_ch);
     }
     /****************************************************************/
+    /* encode_krb5_sam_challenge_2 */
+    {
+        krb5_sam_challenge_2 sam_ch2, *tmp;
+
+        ktest_make_sample_sam_challenge_2(&sam_ch2);
+        leak_test(sam_ch2, encode_krb5_sam_challenge_2,
+                  decode_krb5_sam_challenge_2, krb5_free_sam_challenge_2);
+        ktest_empty_sam_challenge_2(&sam_ch2);
+    }
+    /****************************************************************/
+    /* encode_krb5_sam_challenge_2 */
+    {
+        krb5_sam_challenge_2_body body, *tmp;
+
+        ktest_make_sample_sam_challenge_2_body(&body);
+        leak_test(body, encode_krb5_sam_challenge_2_body,
+                  decode_krb5_sam_challenge_2_body,
+                  krb5_free_sam_challenge_2_body);
+        ktest_empty_sam_challenge_2_body(&body);
+    }
+    /****************************************************************/
     /* encode_krb5_sam_response */
     {
         krb5_sam_response sam_ch, *tmp;
@@ -667,6 +690,15 @@ main(int argc, char **argv)
         ktest_empty_enc_sam_response_enc_2(&sam_ch2);
     }
     /****************************************************************/
+    /* encode_krb5_pa_for_user */
+    {
+        krb5_pa_for_user foru, *tmp;
+        ktest_make_sample_pa_for_user(&foru);
+        leak_test(foru, encode_krb5_pa_for_user, decode_krb5_pa_for_user,
+                  krb5_free_pa_for_user);
+        ktest_empty_pa_for_user(&foru);
+    }
+    /****************************************************************/
     /* encode_krb5_pa_s4u_x509_user */
     {
         krb5_pa_s4u_x509_user s4u, *tmp;
@@ -728,6 +760,24 @@ main(int argc, char **argv)
                   krb5_free_iakerb_finished);
         ktest_empty_iakerb_finished(&ih);
     }
+    /****************************************************************/
+    /* encode_krb5_fast_response */
+    {
+        krb5_fast_response fr, *tmp;
+        ktest_make_sample_fast_response(&fr);
+        leak_test(fr, encode_krb5_fast_response, decode_krb5_fast_response,
+                  krb5_free_fast_response);
+        ktest_empty_fast_response(&fr);
+    }
+    /****************************************************************/
+    /* encode_krb5_pa_fx_fast_reply */
+    {
+        krb5_enc_data enc, *tmp;
+        ktest_make_sample_enc_data(&enc);
+        leak_test(enc, encode_krb5_pa_fx_fast_reply,
+                  decode_krb5_pa_fx_fast_reply, krb5_free_enc_data);
+        ktest_destroy_enc_data(&enc);
+    }
     krb5_free_context(test_context);
     return 0;
 }
diff --git a/src/tests/asn.1/krb5_decode_test.c b/src/tests/asn.1/krb5_decode_test.c
index b9de342a69..ffa10a08af 100644
--- a/src/tests/asn.1/krb5_decode_test.c
+++ b/src/tests/asn.1/krb5_decode_test.c
@@ -747,7 +747,7 @@ int main(argc, argv)
     }
 
     /****************************************************************/
-    /* decode_krb5_padata_sequence */
+    /* decode_krb5_padata_sequence and decode_krb5_typed_data */
     {
         krb5_pa_data **ref, **var;
         ktest_make_sample_pa_data_array(&ref);
@@ -761,6 +761,16 @@ int main(argc, argv)
         test(ktest_equal_sequence_of_pa_data(ref,var),"pa_data\n");
         krb5_free_pa_data(test_context, var);
         krb5_free_data_contents(test_context, &code);
+        retval = krb5_data_hex_parse(&code,"30 24 30 10 A0 03 02 01 0D A1 09 04 07 70 61 2D 64 61 74 61 30 10 A0 03 02 01 0D A1 09 04 07 70 61 2D 64 61 74 61");
+        if (retval) {
+            com_err("parsing padata_sequence",retval,"");
+            exit(1);
+        }
+        retval = decode_krb5_typed_data(&code,&var);
+        if (retval) com_err("decoding typed_data",retval,"");
+        test(ktest_equal_sequence_of_pa_data(ref,var),"typed_data\n");
+        krb5_free_pa_data(test_context, var);
+        krb5_free_data_contents(test_context, &code);
         ktest_destroy_pa_data_array(&ref);
     }
 
@@ -884,6 +894,24 @@ int main(argc, argv)
     }
 
     /****************************************************************/
+    /* decode_sam_challenge_2 */
+    {
+        setup(krb5_sam_challenge_2,ktest_make_sample_sam_challenge_2);
+        decode_run("sam_challenge_2","","30 22 A0 0D 30 0B 04 09 63 68 61 6C 6C 65 6E 67 65 A1 11 30 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34",decode_krb5_sam_challenge_2,ktest_equal_sam_challenge_2,krb5_free_sam_challenge_2);
+        ktest_empty_sam_challenge_2(&ref);
+
+    }
+
+    /****************************************************************/
+    /* decode_sam_challenge_2_body */
+    {
+        setup(krb5_sam_challenge_2_body,ktest_make_sample_sam_challenge_2_body);
+        decode_run("sam_challenge_2_body","","30 64 A0 03 02 01 2A A1 07 03 05 00 80 00 00 00 A2 0B 04 09 74 79 70 65 20 6E 61 6D 65 A4 11 04 0F 63 68 61 6C 6C 65 6E 67 65 20 6C 61 62 65 6C A5 10 04 0E 63 68 61 6C 6C 65 6E 67 65 20 69 70 73 65 A6 16 04 14 72 65 73 70 6F 6E 73 65 5F 70 72 6F 6D 70 74 20 69 70 73 65 A8 05 02 03 54 32 10 A9 03 02 01 01",decode_krb5_sam_challenge_2_body,ktest_equal_sam_challenge_2_body,krb5_free_sam_challenge_2_body);
+        ktest_empty_sam_challenge_2_body(&ref);
+
+    }
+
+    /****************************************************************/
     /* decode_sam_response */
     {
         setup(krb5_sam_response,ktest_make_sample_sam_response);
@@ -893,6 +921,14 @@ int main(argc, argv)
     }
 
     /****************************************************************/
+    /* decode_pa_for_user */
+    {
+        setup(krb5_pa_for_user,ktest_make_sample_pa_for_user);
+        decode_run("pa_for_user","","30 4B A0 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A2 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A3 0A 1B 08 6B 72 62 35 64 61 74 61",decode_krb5_pa_for_user,ktest_equal_pa_for_user,krb5_free_pa_for_user);
+        ktest_empty_pa_for_user(&ref);
+    }
+
+    /****************************************************************/
     /* decode_pa_s4u_x509_user */
     {
         setup(krb5_pa_s4u_x509_user,ktest_make_sample_pa_s4u_x509_user);
@@ -932,6 +968,22 @@ int main(argc, argv)
         ktest_empty_iakerb_finished(&ref);
     }
 
+    /****************************************************************/
+    /* decode_fast_response */
+    {
+        setup(krb5_fast_response,ktest_make_sample_fast_response);
+        decode_run("fast_response","","30 81 9F A0 26 30 24 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 A1 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A2 5B 30 59 A0 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A1 05 02 03 01 E2 40 A2 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A3 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A4 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A3 03 02 01 2A",decode_krb5_fast_response,ktest_equal_fast_response,krb5_free_fast_response);
+        ktest_empty_fast_response(&ref);
+    }
+
+    /****************************************************************/
+    /* decode_pa_fx_fast_reply */
+    {
+        setup(krb5_enc_data,ktest_make_sample_enc_data);
+        decode_run("pa_fx_fast_reply","","A0 29 30 27 A0 25 30 23 A0 03 02 01 00 A1 03 02 01 05 A2 17 04 15 6B 72 62 41 53 4E 2E 31 20 74 65 73 74 20 6D 65 73 73 61 67 65",decode_krb5_pa_fx_fast_reply,ktest_equal_enc_data,krb5_free_enc_data);
+        ktest_destroy_enc_data(&ref);
+    }
+
 #ifdef ENABLE_LDAP
     /* ldap sequence_of_keys */
     {
diff --git a/src/tests/asn.1/krb5_encode_test.c b/src/tests/asn.1/krb5_encode_test.c
index 7c0bd68d79..34f94d732b 100644
--- a/src/tests/asn.1/krb5_encode_test.c
+++ b/src/tests/asn.1/krb5_encode_test.c
@@ -503,7 +503,7 @@ main(argc, argv)
     }
 
     /****************************************************************/
-    /* encode_padata_sequence */
+    /* encode_padata_sequence and encode_krb5_typed_data */
     {
         krb5_pa_data **pa;
 
@@ -514,6 +514,12 @@ main(argc, argv)
             exit(1);
         }
         encoder_print_results(code, "padata_sequence", "");
+        retval = encode_krb5_typed_data(pa, &code);
+        if (retval) {
+            com_err("encoding typed_data", retval, "");
+            exit(1);
+        }
+        encoder_print_results(code, "typed_data", "");
 
         ktest_destroy_pa_data_array(&pa);
     }
@@ -638,6 +644,24 @@ main(argc, argv)
         ktest_empty_sam_challenge(&sam_ch);
     }
     /****************************************************************/
+    /* encode_krb5_sam_challenge_2 */
+    {
+        krb5_sam_challenge_2 sam_ch2;
+        ktest_make_sample_sam_challenge_2(&sam_ch2);
+        encode_run(sam_ch2,krb5_sam_challenge_2,"sam_challenge_2","",
+                   encode_krb5_sam_challenge_2);
+        ktest_empty_sam_challenge_2(&sam_ch2);
+    }
+    /****************************************************************/
+    /* encode_krb5_sam_challenge_2_body */
+    {
+        krb5_sam_challenge_2_body body;
+        ktest_make_sample_sam_challenge_2_body(&body);
+        encode_run(body,krb5_sam_challenge_2_body,"sam_challenge_2_body","",
+                   encode_krb5_sam_challenge_2_body);
+        ktest_empty_sam_challenge_2_body(&body);
+    }
+    /****************************************************************/
     /* encode_krb5_sam_response */
     {
         krb5_sam_response sam_ch;
@@ -693,6 +717,15 @@ main(argc, argv)
         ktest_empty_enc_sam_response_enc_2(&sam_ch2);
     }
     /****************************************************************/
+    /* encode_krb5_pa_for_user */
+    {
+        krb5_pa_for_user s4u;
+        ktest_make_sample_pa_for_user(&s4u);
+        encode_run(s4u, krb5_pa_for_user, "pa_for_user", "",
+                   encode_krb5_pa_for_user);
+        ktest_empty_pa_for_user(&s4u);
+    }
+    /****************************************************************/
     /* encode_krb5_pa_s4u_x509_user */
     {
         krb5_pa_s4u_x509_user s4u;
@@ -752,6 +785,24 @@ main(argc, argv)
                    encode_krb5_iakerb_finished);
         ktest_empty_iakerb_finished(&ih);
     }
+    /****************************************************************/
+    /* encode_krb5_fast_response */
+    {
+        krb5_fast_response fr;
+        ktest_make_sample_fast_response(&fr);
+        encode_run(fr, krb5_fast_response, "fast_response", "",
+                   encode_krb5_fast_response);
+        ktest_empty_fast_response(&fr);
+    }
+    /****************************************************************/
+    /* encode_krb5_pa_fx_fast_reply */
+    {
+        krb5_enc_data enc_data;
+        ktest_make_sample_enc_data(&enc_data);
+        encode_run(enc_data, krb5_enc_data, "pa_fx_fast_reply", "",
+                   encode_krb5_pa_fx_fast_reply);
+        ktest_destroy_enc_data(&enc_data);
+    }
 #ifndef DISABLE_PKINIT
     /****************************************************************/
     /* encode_krb5_pa_pk_as_req */
diff --git a/src/tests/asn.1/ktest.c b/src/tests/asn.1/ktest.c
index f89157c7bf..4f348f4bb3 100644
--- a/src/tests/asn.1/ktest.c
+++ b/src/tests/asn.1/ktest.c
@@ -531,6 +531,33 @@ ktest_make_sample_sam_challenge(krb5_sam_challenge *p)
 }
 
 void
+ktest_make_sample_sam_challenge_2(krb5_sam_challenge_2 *p)
+{
+    /* Need a valid DER sequence encoding here; this one contains the OCTET
+     * STRING "challenge". */
+    krb5_data_parse(&p->sam_challenge_2_body, "\x30\x0B\x04\x09" "challenge");
+    p->sam_cksum = ealloc(2 * sizeof(krb5_checksum *));
+    p->sam_cksum[0] = ealloc(sizeof(krb5_checksum));
+    ktest_make_sample_checksum(p->sam_cksum[0]);
+    p->sam_cksum[1] = NULL;
+}
+
+void
+ktest_make_sample_sam_challenge_2_body(krb5_sam_challenge_2_body *p)
+{
+    p->sam_type = 42;
+    p->sam_flags = KRB5_SAM_USE_SAD_AS_KEY;
+    krb5_data_parse(&p->sam_type_name, "type name");
+    p->sam_track_id = empty_data();
+    krb5_data_parse(&p->sam_challenge_label, "challenge label");
+    krb5_data_parse(&p->sam_challenge, "challenge ipse");
+    krb5_data_parse(&p->sam_response_prompt, "response_prompt ipse");
+    p->sam_pk_for_sad = empty_data();
+    p->sam_nonce = 0x543210;
+    p->sam_etype = ENCTYPE_DES_CBC_CRC;
+}
+
+void
 ktest_make_sample_sam_response(krb5_sam_response *p)
 {
     p->magic = KV5M_SAM_RESPONSE;
@@ -586,6 +613,14 @@ ktest_make_sample_enc_sam_response_enc_2(krb5_enc_sam_response_enc_2 *p)
 }
 
 void
+ktest_make_sample_pa_for_user(krb5_pa_for_user *p)
+{
+    ktest_make_sample_principal(&p->user);
+    ktest_make_sample_checksum(&p->cksum);
+    ktest_make_sample_data(&p->auth_package);
+}
+
+void
 ktest_make_sample_pa_s4u_x509_user(krb5_pa_s4u_x509_user *p)
 {
     krb5_s4u_userid *u = &p->user_id;
@@ -641,6 +676,26 @@ ktest_make_sample_iakerb_finished(krb5_iakerb_finished *ih)
     ktest_make_sample_checksum(&ih->checksum);
 }
 
+static void
+ktest_make_sample_fast_finished(krb5_fast_finished *p)
+{
+    p->timestamp = SAMPLE_TIME;
+    p->usec = SAMPLE_USEC;
+    ktest_make_sample_principal(&p->client);
+    ktest_make_sample_checksum(&p->ticket_checksum);
+}
+
+void
+ktest_make_sample_fast_response(krb5_fast_response *p)
+{
+    ktest_make_sample_pa_data_array(&p->padata);
+    p->strengthen_key = ealloc(sizeof(krb5_keyblock));
+    ktest_make_sample_keyblock(p->strengthen_key);
+    p->finished = ealloc(sizeof(krb5_fast_finished));
+    ktest_make_sample_fast_finished(p->finished);
+    p->nonce = SAMPLE_NONCE;
+}
+
 #ifndef DISABLE_PKINIT
 
 static void
@@ -1383,6 +1438,31 @@ ktest_empty_sam_challenge(krb5_sam_challenge *p)
 }
 
 void
+ktest_empty_sam_challenge_2(krb5_sam_challenge_2 *p)
+{
+    krb5_checksum **ck;
+
+    ktest_empty_data(&p->sam_challenge_2_body);
+    if (p->sam_cksum != NULL) {
+        for (ck = p->sam_cksum; *ck != NULL; ck++)
+            ktest_destroy_checksum(ck);
+        free(p->sam_cksum);
+        p->sam_cksum = NULL;
+    }
+}
+
+void
+ktest_empty_sam_challenge_2_body(krb5_sam_challenge_2_body *p)
+{
+    ktest_empty_data(&p->sam_type_name);
+    ktest_empty_data(&p->sam_track_id);
+    ktest_empty_data(&p->sam_challenge_label);
+    ktest_empty_data(&p->sam_challenge);
+    ktest_empty_data(&p->sam_response_prompt);
+    ktest_empty_data(&p->sam_pk_for_sad);
+}
+
+void
 ktest_empty_sam_response(krb5_sam_response *p)
 {
     ktest_empty_data(&p->sam_track_id);
@@ -1424,6 +1504,14 @@ ktest_empty_enc_sam_response_enc_2(krb5_enc_sam_response_enc_2 *p)
 }
 
 void
+ktest_empty_pa_for_user(krb5_pa_for_user *p)
+{
+    ktest_destroy_principal(&p->user);
+    ktest_empty_checksum(&p->cksum);
+    ktest_empty_data(&p->auth_package);
+}
+
+void
 ktest_empty_pa_s4u_x509_user(krb5_pa_s4u_x509_user *p)
 {
     ktest_destroy_principal(&p->user_id.user);
@@ -1485,6 +1573,25 @@ ktest_empty_iakerb_finished(krb5_iakerb_finished *p)
     krb5_free_checksum_contents(NULL, &p->checksum);
 }
 
+static void
+ktest_empty_fast_finished(krb5_fast_finished *p)
+{
+    ktest_destroy_principal(&p->client);
+    ktest_empty_checksum(&p->ticket_checksum);
+}
+
+void
+ktest_empty_fast_response(krb5_fast_response *p)
+{
+    ktest_destroy_pa_data_array(&p->padata);
+    ktest_destroy_keyblock(&p->strengthen_key);
+    if (p->finished != NULL) {
+        ktest_empty_fast_finished(p->finished);
+        free(p->finished);
+        p->finished = NULL;
+    }
+}
+
 #ifndef DISABLE_PKINIT
 
 static void
diff --git a/src/tests/asn.1/ktest.h b/src/tests/asn.1/ktest.h
index 8deb39ac8f..3811f964f3 100644
--- a/src/tests/asn.1/ktest.h
+++ b/src/tests/asn.1/ktest.h
@@ -81,18 +81,22 @@ void ktest_make_sample_etype_info(krb5_etype_info_entry ***p);
 void ktest_make_sample_etype_info2(krb5_etype_info_entry ***p);
 void ktest_make_sample_pa_enc_ts(krb5_pa_enc_ts *am);
 void ktest_make_sample_sam_challenge(krb5_sam_challenge *p);
+void ktest_make_sample_sam_challenge_2(krb5_sam_challenge_2 *p);
+void ktest_make_sample_sam_challenge_2_body(krb5_sam_challenge_2_body *p);
 void ktest_make_sample_sam_response(krb5_sam_response *p);
 void ktest_make_sample_sam_response_2(krb5_sam_response_2 *p);
 void ktest_make_sample_sam_key(krb5_sam_key *p);
 void ktest_make_sample_enc_sam_response_enc(krb5_enc_sam_response_enc *p);
 void ktest_make_sample_predicted_sam_response(krb5_predicted_sam_response *p);
 void ktest_make_sample_enc_sam_response_enc_2(krb5_enc_sam_response_enc_2 *p);
+void ktest_make_sample_pa_for_user(krb5_pa_for_user *p);
 void ktest_make_sample_pa_s4u_x509_user(krb5_pa_s4u_x509_user *p);
 void ktest_make_sample_ad_kdcissued(krb5_ad_kdcissued *p);
 void ktest_make_sample_ad_signedpath_data(krb5_ad_signedpath_data *p);
 void ktest_make_sample_ad_signedpath(krb5_ad_signedpath *p);
 void ktest_make_sample_iakerb_header(krb5_iakerb_header *p);
 void ktest_make_sample_iakerb_finished(krb5_iakerb_finished *p);
+void ktest_make_sample_fast_response(krb5_fast_response *p);
 
 #ifndef DISABLE_PKINIT
 void ktest_make_sample_pa_pk_as_req(krb5_pa_pk_as_req *p);
@@ -166,18 +170,22 @@ void ktest_empty_passwd_phrase_element(passwd_phrase_element *ppe);
 void ktest_empty_pwd_data(krb5_pwd_data *pd);
 void ktest_empty_alt_method(krb5_alt_method *am);
 void ktest_empty_sam_challenge(krb5_sam_challenge *p);
+void ktest_empty_sam_challenge_2(krb5_sam_challenge_2 *p);
+void ktest_empty_sam_challenge_2_body(krb5_sam_challenge_2_body *p);
 void ktest_empty_sam_response(krb5_sam_response *p);
 void ktest_empty_sam_key(krb5_sam_key *p);
 void ktest_empty_enc_sam_response_enc(krb5_enc_sam_response_enc *p);
 void ktest_empty_predicted_sam_response(krb5_predicted_sam_response *p);
 void ktest_empty_sam_response_2(krb5_sam_response_2 *p);
 void ktest_empty_enc_sam_response_enc_2(krb5_enc_sam_response_enc_2 *p);
+void ktest_empty_pa_for_user(krb5_pa_for_user *p);
 void ktest_empty_pa_s4u_x509_user(krb5_pa_s4u_x509_user *p);
 void ktest_empty_ad_kdcissued(krb5_ad_kdcissued *p);
 void ktest_empty_ad_signedpath_data(krb5_ad_signedpath_data *p);
 void ktest_empty_ad_signedpath(krb5_ad_signedpath *p);
 void ktest_empty_iakerb_header(krb5_iakerb_header *p);
 void ktest_empty_iakerb_finished(krb5_iakerb_finished *p);
+void ktest_empty_fast_response(krb5_fast_response *p);
 
 #ifndef DISABLE_PKINIT
 void ktest_empty_pa_pk_as_req(krb5_pa_pk_as_req *p);
diff --git a/src/tests/asn.1/ktest_equal.c b/src/tests/asn.1/ktest_equal.c
index 209d6a9cd4..019bbeb1f0 100644
--- a/src/tests/asn.1/ktest_equal.c
+++ b/src/tests/asn.1/ktest_equal.c
@@ -520,6 +520,38 @@ ktest_equal_sam_challenge(krb5_sam_challenge *ref, krb5_sam_challenge *var)
 }
 
 int
+ktest_equal_sam_challenge_2_body(krb5_sam_challenge_2_body *ref,
+                                 krb5_sam_challenge_2_body *var)
+{
+    int p = TRUE;
+    if (ref == var) return TRUE;
+    else if (ref == NULL || var == NULL) return FALSE;
+    p = p && scalar_equal(sam_type);
+    p = p && scalar_equal(sam_flags);
+    p = p && equal_str(sam_type_name);
+    p = p && equal_str(sam_track_id);
+    p = p && equal_str(sam_challenge_label);
+    p = p && equal_str(sam_challenge);
+    p = p && equal_str(sam_response_prompt);
+    p = p && equal_str(sam_pk_for_sad);
+    p = p && scalar_equal(sam_nonce);
+    p = p && scalar_equal(sam_etype);
+    return p;
+}
+
+int
+ktest_equal_sam_challenge_2(krb5_sam_challenge_2 *ref,
+                            krb5_sam_challenge_2 *var)
+{
+    int p = TRUE;
+    if (ref == var) return TRUE;
+    else if (ref == NULL || var == NULL) return FALSE;
+    p = p && equal_str(sam_challenge_2_body);
+    p = p && ptr_equal(sam_cksum,ktest_equal_sequence_of_checksum);
+    return p;
+}
+
+int
 ktest_equal_sam_response(krb5_sam_response *ref, krb5_sam_response *var)
 {
     int p = TRUE;
@@ -536,6 +568,18 @@ ktest_equal_sam_response(krb5_sam_response *ref, krb5_sam_response *var)
 }
 
 int
+ktest_equal_pa_for_user(krb5_pa_for_user *ref, krb5_pa_for_user *var)
+{
+    int p = TRUE;
+    if (ref == var) return TRUE;
+    else if (ref == NULL || var == NULL) return FALSE;
+    p = p && ptr_equal(user, ktest_equal_principal_data);
+    p = p && struct_equal(cksum, ktest_equal_checksum);
+    p = p && equal_str(auth_package);
+    return p;
+}
+
+int
 ktest_equal_pa_s4u_x509_user(krb5_pa_s4u_x509_user *ref,
                              krb5_pa_s4u_x509_user *var)
 {
@@ -612,6 +656,32 @@ ktest_equal_iakerb_finished(krb5_iakerb_finished *ref,
     return p;
 }
 
+static int
+ktest_equal_fast_finished(krb5_fast_finished *ref, krb5_fast_finished *var)
+{
+    int p = TRUE;
+    if (ref == var) return TRUE;
+    else if (ref == NULL || var == NULL) return FALSE;
+    p = p && scalar_equal(timestamp);
+    p = p && scalar_equal(usec);
+    p = p && ptr_equal(client, ktest_equal_principal_data);
+    p = p && struct_equal(ticket_checksum, ktest_equal_checksum);
+    return p;
+}
+
+int
+ktest_equal_fast_response(krb5_fast_response *ref, krb5_fast_response *var)
+{
+    int p = TRUE;
+    if (ref == var) return TRUE;
+    else if (ref == NULL || var == NULL) return FALSE;
+    p = p && ptr_equal(padata, ktest_equal_sequence_of_pa_data);
+    p = p && ptr_equal(strengthen_key, ktest_equal_keyblock);
+    p = p && ptr_equal(finished, ktest_equal_fast_finished);
+    p = p && scalar_equal(nonce);
+    return p;
+}
+
 #ifdef ENABLE_LDAP
 static int
 equal_key_data(krb5_key_data *ref, krb5_key_data *var)
@@ -769,3 +839,9 @@ ktest_equal_etype_info(krb5_etype_info_entry **ref, krb5_etype_info_entry **var)
 {
     array_compare(ktest_equal_krb5_etype_info_entry);
 }
+
+int
+ktest_equal_sequence_of_checksum(krb5_checksum **ref, krb5_checksum **var)
+{
+    array_compare(ktest_equal_checksum);
+}
diff --git a/src/tests/asn.1/ktest_equal.h b/src/tests/asn.1/ktest_equal.h
index ee90f4ff4f..999730dae0 100644
--- a/src/tests/asn.1/ktest_equal.h
+++ b/src/tests/asn.1/ktest_equal.h
@@ -85,6 +85,8 @@ generic(ktest_equal_krb5_alt_method,krb5_alt_method);
 generic(ktest_equal_krb5_pa_enc_ts,krb5_pa_enc_ts);
 
 generic(ktest_equal_sam_challenge,krb5_sam_challenge);
+generic(ktest_equal_sam_challenge_2,krb5_sam_challenge_2);
+generic(ktest_equal_sam_challenge_2_body,krb5_sam_challenge_2_body);
 generic(ktest_equal_sam_response,krb5_sam_response);
 
 int ktest_equal_last_req(krb5_last_req_entry **ref, krb5_last_req_entry **var);
@@ -94,6 +96,7 @@ int ktest_equal_sequence_of_cred_info(krb5_cred_info **ref,
                                       krb5_cred_info **var);
 int ktest_equal_sequence_of_principal(krb5_principal *ref,
                                       krb5_principal *var);
+int ktest_equal_sequence_of_checksum(krb5_checksum **ref, krb5_checksum **var);
 
 len_array(ktest_equal_array_of_enctype,krb5_enctype);
 len_array(ktest_equal_array_of_data,krb5_data);
@@ -110,6 +113,7 @@ int ktest_equal_etype_info(krb5_etype_info_entry **ref,
 
 int ktest_equal_krb5_etype_info_entry(krb5_etype_info_entry *ref,
                                       krb5_etype_info_entry *var);
+int ktest_equal_pa_for_user(krb5_pa_for_user *ref, krb5_pa_for_user *var);
 int ktest_equal_pa_s4u_x509_user(krb5_pa_s4u_x509_user *ref,
                                  krb5_pa_s4u_x509_user *var);
 int ktest_equal_ad_kdcissued(krb5_ad_kdcissued *ref, krb5_ad_kdcissued *var);
@@ -121,6 +125,8 @@ int ktest_equal_iakerb_header(krb5_iakerb_header *ref,
                               krb5_iakerb_header *var);
 int ktest_equal_iakerb_finished(krb5_iakerb_finished *ref,
                                 krb5_iakerb_finished *var);
+int ktest_equal_fast_response(krb5_fast_response *ref,
+                              krb5_fast_response *var);
 
 int ktest_equal_ldap_sequence_of_keys(ldap_seqof_key_data *ref,
                                       ldap_seqof_key_data *var);
diff --git a/src/tests/asn.1/reference_encode.out b/src/tests/asn.1/reference_encode.out
index 92d21b1a9d..40587e3d0b 100644
--- a/src/tests/asn.1/reference_encode.out
+++ b/src/tests/asn.1/reference_encode.out
@@ -38,6 +38,7 @@ encode_krb5_authorization_data: 30 22 30 0F A0 03 02 01 01 A1 08 04 06 66 6F 6F
 encode_krb5_pwd_sequence: 30 18 A0 0A 04 08 6B 72 62 35 64 61 74 61 A1 0A 04 08 6B 72 62 35 64 61 74 61
 encode_krb5_pwd_data: 30 3D A0 03 02 01 02 A1 36 30 34 30 18 A0 0A 04 08 6B 72 62 35 64 61 74 61 A1 0A 04 08 6B 72 62 35 64 61 74 61 30 18 A0 0A 04 08 6B 72 62 35 64 61 74 61 A1 0A 04 08 6B 72 62 35 64 61 74 61
 encode_krb5_padata_sequence: 30 24 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61
+encode_krb5_typed_data: 30 24 30 10 A0 03 02 01 0D A1 09 04 07 70 61 2D 64 61 74 61 30 10 A0 03 02 01 0D A1 09 04 07 70 61 2D 64 61 74 61
 encode_krb5_padata_sequence(empty): 30 00
 encode_krb5_alt_method: 30 0F A0 03 02 01 2A A1 08 04 06 73 65 63 72 65 74
 encode_krb5_alt_method (no data): 30 05 A0 03 02 01 2A
@@ -50,15 +51,20 @@ encode_krb5_pa_enc_ts: 30 1A A0 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31
 encode_krb5_pa_enc_ts (no usec): 30 13 A0 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A
 encode_krb5_enc_data: 30 23 A0 03 02 01 00 A1 03 02 01 05 A2 17 04 15 6B 72 62 41 53 4E 2E 31 20 74 65 73 74 20 6D 65 73 73 61 67 65
 encode_krb5_sam_challenge: 30 70 A0 03 02 01 2A A1 07 03 05 00 80 00 00 00 A2 0B 04 09 74 79 70 65 20 6E 61 6D 65 A4 11 04 0F 63 68 61 6C 6C 65 6E 67 65 20 6C 61 62 65 6C A5 10 04 0E 63 68 61 6C 6C 65 6E 67 65 20 69 70 73 65 A6 16 04 14 72 65 73 70 6F 6E 73 65 5F 70 72 6F 6D 70 74 20 69 70 73 65 A8 05 02 03 54 32 10 A9 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
+encode_krb5_sam_challenge_2: 30 22 A0 0D 30 0B 04 09 63 68 61 6C 6C 65 6E 67 65 A1 11 30 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
+encode_krb5_sam_challenge_2_body: 30 64 A0 03 02 01 2A A1 07 03 05 00 80 00 00 00 A2 0B 04 09 74 79 70 65 20 6E 61 6D 65 A4 11 04 0F 63 68 61 6C 6C 65 6E 67 65 20 6C 61 62 65 6C A5 10 04 0E 63 68 61 6C 6C 65 6E 67 65 20 69 70 73 65 A6 16 04 14 72 65 73 70 6F 6E 73 65 5F 70 72 6F 6D 70 74 20 69 70 73 65 A8 05 02 03 54 32 10 A9 03 02 01 01
 encode_krb5_sam_response: 30 6A A0 03 02 01 2A A1 07 03 05 00 80 00 00 00 A2 0C 04 0A 74 72 61 63 6B 20 64 61 74 61 A3 14 30 12 A0 03 02 01 01 A1 04 02 02 07 96 A2 05 04 03 6B 65 79 A4 1C 30 1A A0 03 02 01 01 A1 04 02 02 0D 36 A2 0D 04 0B 6E 6F 6E 63 65 20 6F 72 20 74 73 A5 05 02 03 54 32 10 A6 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A
 encode_krb5_sam_key: 30 15 A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38
 encode_krb5_enc_sam_response_enc: 30 38 A0 05 02 03 01 33 2A A1 11 18 0F 31 39 37 30 30 31 30 32 30 33 34 36 33 39 5A A2 04 02 02 01 8F A3 16 04 14 65 6E 63 5F 73 61 6D 5F 72 65 73 70 6F 6E 73 65 5F 65 6E 63
 encode_krb5_predicted_sam_response: 30 6D A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 07 03 05 00 00 00 00 09 A2 11 18 0F 31 39 37 30 30 31 30 31 30 30 30 30 31 37 5A A3 03 02 01 12 A4 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A5 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A6 07 04 05 68 65 6C 6C 6F
 encode_krb5_sam_response_2: 30 42 A0 03 02 01 2B A1 07 03 05 00 80 00 00 00 A2 0C 04 0A 74 72 61 63 6B 20 64 61 74 61 A3 1D 30 1B A0 03 02 01 01 A1 04 02 02 0D 36 A2 0E 04 0C 6E 6F 6E 63 65 20 6F 72 20 73 61 64 A4 05 02 03 54 32 10
 encode_krb5_enc_sam_response_enc_2: 30 1F A0 03 02 01 58 A1 18 04 16 65 6E 63 5F 73 61 6D 5F 72 65 73 70 6F 6E 73 65 5F 65 6E 63 5F 32
+encode_krb5_pa_for_user: 30 4B A0 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A2 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A3 0A 1B 08 6B 72 62 35 64 61 74 61
 encode_krb5_pa_s4u_x509_user: 30 68 A0 55 30 53 A0 06 02 04 00 CA 14 9A A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A2 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A3 12 04 10 70 61 5F 73 34 75 5F 78 35 30 39 5F 75 73 65 72 A4 07 03 05 00 80 00 00 00 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
 encode_krb5_ad_kdcissued: 30 65 A0 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A2 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A3 24 30 22 30 0F A0 03 02 01 01 A1 08 04 06 66 6F 6F 62 61 72 30 0F A0 03 02 01 01 A1 08 04 06 66 6F 6F 62 61 72
 encode_krb5_ad_signedpath_data: 30 81 C7 A0 30 30 2E A0 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 32 30 30 30 2E A0 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A3 26 30 24 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 A4 24 30 22 30 0F A0 03 02 01 01 A1 08 04 06 66 6F 6F 62 61 72 30 0F A0 03 02 01 01 A1 08 04 06 66 6F 6F 62 61 72
 encode_krb5_ad_signedpath: 30 3E A0 03 02 01 01 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A3 26 30 24 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61
 encode_krb5_iakerb_header: 30 18 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0A 04 08 6B 72 62 35 64 61 74 61
 encode_krb5_iakerb_finished: 30 11 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
+encode_krb5_fast_response: 30 81 9F A0 26 30 24 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 30 10 A1 03 02 01 0D A2 09 04 07 70 61 2D 64 61 74 61 A1 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A2 5B 30 59 A0 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A1 05 02 03 01 E2 40 A2 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A3 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A4 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A3 03 02 01 2A
+encode_krb5_pa_fx_fast_reply: A0 29 30 27 A0 25 30 23 A0 03 02 01 00 A1 03 02 01 05 A2 17 04 15 6B 72 62 41 53 4E 2E 31 20 74 65 73 74 20 6D 65 73 73 61 67 65
diff --git a/src/tests/asn.1/trval_reference.out b/src/tests/asn.1/trval_reference.out
index cc1daf3a23..69656170e8 100644
--- a/src/tests/asn.1/trval_reference.out
+++ b/src/tests/asn.1/trval_reference.out
@@ -1086,6 +1086,16 @@ encode_krb5_padata_sequence:
 .  .  [1] [Integer] 13
 .  .  [2] [Octet String] "pa-data"
 
+encode_krb5_typed_data:
+
+[Sequence/Sequence Of] 
+.  [Sequence/Sequence Of] 
+.  .  [0] [Integer] 13
+.  .  [1] [Octet String] "pa-data"
+.  [Sequence/Sequence Of] 
+.  .  [0] [Integer] 13
+.  .  [1] [Octet String] "pa-data"
+
 encode_krb5_padata_sequence(empty):
 
 [Sequence/Sequence Of] 
@@ -1179,6 +1189,28 @@ encode_krb5_sam_challenge:
 .  .  [0] [Integer] 1
 .  .  [1] [Octet String] "1234"
 
+encode_krb5_sam_challenge_2:
+
+[Sequence/Sequence Of] 
+.  [0] [Sequence/Sequence Of] 
+.  .  [Octet String] "challenge"
+.  [1] [Sequence/Sequence Of] 
+.  .  [Sequence/Sequence Of] 
+.  .  .  [0] [Integer] 1
+.  .  .  [1] [Octet String] "1234"
+
+encode_krb5_sam_challenge_2_body:
+
+[Sequence/Sequence Of] 
+.  [0] [Integer] 42
+.  [1] [Bit String] 0x80000000
+.  [2] [Octet String] "type name"
+.  [4] [Octet String] "challenge label"
+.  [5] [Octet String] "challenge ipse"
+.  [6] [Octet String] "response_prompt ipse"
+.  [8] [Integer] 5517840
+.  [9] [Integer] 1
+
 encode_krb5_sam_response:
 
 [Sequence/Sequence Of] 
@@ -1246,6 +1278,20 @@ encode_krb5_enc_sam_response_enc_2:
 .  [0] [Integer] 88
 .  [1] [Octet String] "enc_sam_response_enc_2"
 
+encode_krb5_pa_for_user:
+
+[Sequence/Sequence Of] 
+.  [0] [Sequence/Sequence Of] 
+.  .  [0] [Integer] 1
+.  .  [1] [Sequence/Sequence Of] 
+.  .  .  [General string] "hftsai"
+.  .  .  [General string] "extra"
+.  [1] [General string] "ATHENA.MIT.EDU"
+.  [2] [Sequence/Sequence Of] 
+.  .  [0] [Integer] 1
+.  .  [1] [Octet String] "1234"
+.  [3] [General string] "krb5data"
+
 encode_krb5_pa_s4u_x509_user:
 
 [Sequence/Sequence Of] 
@@ -1345,3 +1391,39 @@ encode_krb5_iakerb_finished:
 .  .  [0] [Integer] 1
 .  .  [1] [Octet String] "1234"
 
+encode_krb5_fast_response:
+
+[Sequence/Sequence Of] 
+.  [0] [Sequence/Sequence Of] 
+.  .  [Sequence/Sequence Of] 
+.  .  .  [1] [Integer] 13
+.  .  .  [2] [Octet String] "pa-data"
+.  .  [Sequence/Sequence Of] 
+.  .  .  [1] [Integer] 13
+.  .  .  [2] [Octet String] "pa-data"
+.  [1] [Sequence/Sequence Of] 
+.  .  [0] [Integer] 1
+.  .  [1] [Octet String] "12345678"
+.  [2] [Sequence/Sequence Of] 
+.  .  [0] [Generalized Time] "19940610060317Z"
+.  .  [1] [Integer] 123456
+.  .  [2] [General string] "ATHENA.MIT.EDU"
+.  .  [3] [Sequence/Sequence Of] 
+.  .  .  [0] [Integer] 1
+.  .  .  [1] [Sequence/Sequence Of] 
+.  .  .  .  [General string] "hftsai"
+.  .  .  .  [General string] "extra"
+.  .  [4] [Sequence/Sequence Of] 
+.  .  .  [0] [Integer] 1
+.  .  .  [1] [Octet String] "1234"
+.  [3] [Integer] 42
+
+encode_krb5_pa_fx_fast_reply:
+
+[CONT 0] 
+.  [Sequence/Sequence Of] 
+.  .  [0] [Sequence/Sequence Of] 
+.  .  .  [0] [Integer] 0
+.  .  .  [1] [Integer] 5
+.  .  .  [2] [Octet String] "krbASN.1 test message"
+