Branch for fast negotiation

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23315 dc483132-0cff-0310-8789-dd5450dbe970
Integrate Apple APIs for storing configuration parameters in a ccache

* krb5_cc_get_config: get a config parameter from a ccache
* krb5_cc_set_config: set a configuration parameter in a ccache
* krb5_is_config_principal: should this principal be skipped during ccache iteration
* klist: skip config principals

ticket: 6206

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23316 dc483132-0cff-0310-8789-dd5450dbe970
fix signed vs unsigned warning

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23317 dc483132-0cff-0310-8789-dd5450dbe970
Expose {decode,encode}_krb5_checksum

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23318 dc483132-0cff-0310-8789-dd5450dbe970
Implement fast negotiation per discussion with Larry

This implementation is sloppy in that it always includes the padata
requesting reply checksum even though that will interact badly with some of our older KDCs.

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23323 dc483132-0cff-0310-8789-dd5450dbe970
KDC MUST NOT accept ap-request armor in FAST TGS

Per the latest preauth framework spec, the working group has decided
to forbid ap-request armor in the TGS request because of security
problems with that armor type.

This commit was tested against an implementation of FAST TGS client to
confirm that if explicit armor is sent, the request is rejected.

ticket: 6585
target_version: 1.7.1
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23324 dc483132-0cff-0310-8789-dd5450dbe970
krb5_k_make_checksum: 0 cksumtype means use mandatory cksum for given enctype

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23326 dc483132-0cff-0310-8789-dd5450dbe970
Constants for FAST negotiation

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23327 dc483132-0cff-0310-8789-dd5450dbe970
As and TGS path: cliam to support FAST negotiation in ticket flag; restructure enc_padata path to prepare for additional padata

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23328 dc483132-0cff-0310-8789-dd5450dbe970
Remove constants from fast.c now that they are in krb5.h

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23329 dc483132-0cff-0310-8789-dd5450dbe970
fix warning

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23330 dc483132-0cff-0310-8789-dd5450dbe970
Implement KDC side of protected negotiation:

* Move return_enc_padata so reply key is available
* Include checksum of reply if requested
* export encode_krb5_checksum so we can call it from the KDC

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23331 dc483132-0cff-0310-8789-dd5450dbe970
Fix ordering of  call to request_enc_pa_rep

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23332 dc483132-0cff-0310-8789-dd5450dbe970
Add
krb5_get_init_creds_opt_{set_fast_flags|get_fast_flags|set_out_ccache}

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23333 dc483132-0cff-0310-8789-dd5450dbe970
Use krb5_get_init_creds_opt_set_out_ccache to set the output ccache for kinit.
Support this function in krb5_get_init_creds

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23334 dc483132-0cff-0310-8789-dd5450dbe970
Initialize creds to 0

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23335 dc483132-0cff-0310-8789-dd5450dbe970
Store configuration information about whether FAST is available  in the ccache based on FAST negotiation

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23336 dc483132-0cff-0310-8789-dd5450dbe970
If FAST is available and an armor ticket is supplied, use it; otherwise do not unless KRB5_FAST_REQUIRED is set

* KRB5_FAST_REQUIRED: new FAST flag
* krb5int_fast_as_armor:  examine negotiation state

As a result of this change cross-realm armor tickets will generally
not be used unless KRB5_FAST_REQUIRED is set in the gic_options.

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23337 dc483132-0cff-0310-8789-dd5450dbe970
Implement upgrade to FAST when the KDC supports FAST.  Implement fall
back to no negotiation when the KDC doesn't appear to support it.

In order to do this control flow for get_init_creds is changed significantly.
A comment in the diff explains the logic.

* Move preauth_request_init into loop
* move preauth gic option handling into loop
* New function krb5int_upgrade_to_fast_p
* New fast state flag: KRB5INT_FAST_ARMOR_AVAIL

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23338 dc483132-0cff-0310-8789-dd5450dbe970
Fix memory leak

ticket: 6585

git-svn-id: svn://anonsvn.mit.edu/krb5/users/hartmans/fast-negotiate@23383 dc483132-0cff-0310-8789-dd5450dbe970