Correct and clarify keytab API documentation
Remove an outdated reference to DES in klist help
Try harder to make keytab-based AS requests work

When making a keytab-based AS request, a client has to choose between
sending its reply key enctype preference list (the enctypes it has in
the keytab) and its session key enctype preference list (all of the
enctypes it supports).  Heimdal and MIT krb5 1.11 clients send the
reply key preference list.  If this list doesn't overlap with the
server principal keys (say, because the krbtgt principal has only a
DES key), then the AS request will fail.

Try to make this work by making the KDC optimistically pick the first
permitted enctype in the request as the session key, even though it
can't be certain that other KDCs in the realm support that enctype.

Make sure to exercise this case in t_keytab.py by doing a multipass
keytab kinit test.

ticket: 7190 (new)
Get default cred only once in gss-krb5 initiator

In the regular krb5 code path, only get a default krb5 cred for the
initial token, since we don't need the cred for mutual_auth anyway.

In the IAKERB mechanism, cache the default cred in iakerb_ctx_id_rec
so we don't have to construct it again for each token.  Also, get an
IAKERB default cred, not a regular krb5 cred (a bug which is harmless
now, but becomes more of a problem with keytab initiation changes).
Add krb5_kt_client_default API

The default client keytab is intended to be used to automatically
acquire initial credentials for client applications.  The current
hardcoded default is a placeholder, and will likely change before
1.11.

Add test framework settings to ensure that a system default client
keytab doesn't interfere with tests, and to allow tests to be written
to deliberately use the default client keytab.

Add documentation about keytabs to the concepts section of the RST
docs, and describe the default client keytab there.

ticket: 7188 (new)
Document GSSAPI name type behavior

Separate out the general interpretation of GSSAPI name types by the
krb5 mechanism from the specific behavior of host-based and principal
name types when used as acceptor names.
Add client keytab initiation support

Support acquiring GSSAPI krb5 credentials by fetching initial
credentials using the client keytab.  Credentials obtained this way
will be stored in the default ccache or collection, and will be
refreshed when they are halfway to expiring.

ticket: 7189 (new)
Include all default etypes in gic_keytab requests

Revert 18b02f3e839c007fff54fc9b693f479b7563ec73 in the KDC.  Instead,
when making an initial request with a keytab, transmit the whole
default_tkt_enctypes list, but sorted with the enctypes we have in the
keytab first.  That way the KDC should prefer enctypes which we have
keys for (for both reply key and session key), but the other enctypes
are still available for use as ticket session keys.

ticket: 7190
Minor rst markup fix
Check sort_enctypes return value in gic_keytab
Fix minor memory leaks in acquire_cred.c
Comment fall-throughs in iakerb switch statement
Fix kdc_free_lookaside() krb5_context usage

Use the provided krb5_context, not kdc_context, which isn't valid when
kdc_free_lookaside() is called.
Add krb5_kt_client_default to krb5_32.def
Increase MAX_DGRAM_SIZE

Accept UDP datagrams up to 64K in size.  We should still detect when
an oversized datagram comes in by comparing against the maximum size,
but this is trivial and covers 90% of the practical issues.

ticket: 6566
status: open
Resolve no-previous-prototype warning in os/cm.c

The warning is
../../../../krb5/src/lib/krb5/os/cm.c:43: warning: no previous prototype for 'k5
_getcurtime'
which occurs because
int k5_getcurtime(struct timeval *tvp)
is defined (and used) in cm.c but there is no forward declaration.
Include the os-proto.h (internal) header which declares this function
to eliminate the warning.  k5_getcurtime() is the first declaration in
cm.c, so there is not an ABI concern.

The only other consumer of k5_getcurtime(), sendto_kdc.c, already includes
os-proto.h, so this issue is purely cosmetic.
Improve printf handling of size_t args

The %*s format takes two arguments, a precision length/width and
an actual string; the length is specified as a signed integer.
The size_t length field of the gss_buffer_desc type is an unsigned
type, which must be cast or otherwise converted to a signed type
to match the format string expectations.
I do not think that the length will approach SIZE_T_MAX in practice,
due to buffer constraints, so do not include handling for the
edge case.

There is a '%zu' format string for printing size_ts, but it is not
available everywhere (e.g., AIX).  Instead, use the
unsigned long long abomination.
Avoid unsigned/signed comparison in loop condition

The gid_len length is declared as an unsigned int, and loop
index 'i' is a signed int.  This could manifest as an infinite
loop if gid_len is very large.  In practice, gid_len should be small,
but make 'i' the same type for consistency.
Use consistent types for overflow comparison

Unsigned long might not be 32-bits, in which case the overflow check
fails for a 32-bit kdb_sno_t.  Cast from -1 explicitly as a more
robust check.
Minor cleanups relating to size_t being unsigned

In order to use -1 as a sentinel value, we should explicitly cast
to make it clear what we are doing.  It might be better to use
a less convoluted sentinel value such as SIZE_T_MAX, though.

Additionally, since size_t is unsigned and at least as wide as
an int, a loop with int index variable that compares against a
size_t for its termination check could become an infinite loop.
Make the loop index size_t for consistency.