Null pointer deref in kadmind [CVE-2012-1013]

The fix for #6626 could cause kadmind to dereference a null pointer if
a create-principal request contains no password but does contain the
KRB5_KDB_DISALLOW_ALL_TIX flag (e.g. "addprinc -randkey -allow_tix
name").  Only clients authorized to create principals can trigger the
bug.  Fix the bug by testing for a null password in check_1_6_dummy.

CVSSv2 vector: AV:N/AC:M/Au:S/C:N/I:N/A:P/E:H/RL:O/RC:C

[ghudson@mit.edu: Minor style change and commit message]

ticket: 7152
target_version: 1.10.2
tags: pullup
Add a copy of the BSD <sys/queue.h> as k5-queue.h

queue.h implements various types of linked lists as cpp macros,
without needing any library support.
Use a hash table in the KDC lookaside cache

Add a hash table to kdc/replay.c for fast lookup of incoming packets.
Continue to keep a time-ordered linked list of all entries for fast
expiry of stale entries.  The preprocessor constant
LOOKASIDE_HASH_SIZE can be used to change the size of the hash table.
Use correct profile var in krb5_get_tgs_ktypes

In r21879, when we converted to using KRB5_CONF macros for profile
variable names, we made a typo in krb5_get_tgs_ktypes and erroneously
started using default_tkt_enctypes instead of default_tgs_enctypes for
TGS requests.  Fix the typo and return to the documented behavior.

ticket: 7155
target_version: 1.10.3
tags: pullup
Sphinx HTML: Collapse l4 in ToC in the sidebar

Also,
- resize the width of the document vs sidebar;
- decrease padding in the sidebar;
- mark current l2 in ToC in the sidebar.
Tighten up error checking in t_keytab.c

When checking for specific error codes, using CHECK() meant that we
wouldn't properly fail if we got error code 0.  Define and use a
CHECK_ERR() to test for a specific error code, and define CHECK() in
terms of it.
Add krb5_kt_have_content API

Add the krb5_kt_have_content API from Heimdal, which can be used to
test whether a keytab exists and contains entries.  Add tests to
t_keytab.c.

There is a deviation from Heimdal in the function signature.
Heimdal's signature returns a krb5_boolean at the moment, because the
Heimdal implementation actually returns a krb5_error_code.  These are
generally the same type anyway (int).

ticket: 7158 (new)
Remove outdated comment in k5test.py
Improve error message from krb5_kt_have_content
Use first mech's status in gss_acquire_cred

If we can't acquire creds for any mech in gss_acquire_cred, return the
status of the first mech instead of the last mech, as it's more useful
in the typical case (where the first mech is krb5 and the last mech is
SPNEGO).  This error reporting is not ideal when the user was
expecting to use some mech other than krb5, but it's about as good as
things were prior to #6894.

ticket: 6973
Fail from gss_acquire_cred if we have no keytab

If a caller tries to acquire krb5 acceptor creds with no desired name
and we have no keytab keys, fail from gss_acquire_cred instead of
deferring until gss_accept_sec_context.

ticket: 7159 (new)
Fix -DDEBUG compilation errors

ticket: 7150
Fix trace log unit test

Only use common denominator Bourne shell syntax for exporting
environment variables.  Don't rely on /dev/stdout working.  Compare
the output with a reference file to detect changes, instead of just
sending it to stdout.
Disable trace test comparison for now

The t_trace output isn't consistent from run to run.  To fix "make
check", disable the comparison against the reference file until we can
make the output consistent.
Fix uninitialized memory errors in t_trace.c
Fix k5test.py hostname canonicalization

r25844 (#7124) stopped using AI_ADDRCONFIG when canonicalizing
hostnames in sn2princ.  So we need to also stop using it in k5test.c's
_get_hostname() or we could come up with a different result on a
system where forward and reverse resolution via IPv4 and IPv6 produce
different results.  That in turn causes a t_gssapi.py test (the one
using the un-canonicalized hostname) to fail, because libkrb5 looks
for a different host principal than k5test.py put in the keytab.