Work around lack of isblank() on Solaris 8

(cherry picked from commit 4d75811f329fdf893bd7bd5aff84dcfd37cdab89)

ticket: 7175 (new)
version_fixed: 1.8.7
status: resolved
Use correct name-type in TGS-REQs for 2008R2 RODCs

Correctly set the name-type for the TGS principals to KRB5_NT_SRV_INST
in TGS-REQs.  (Previously, only AS-REQs had the name-type set in this
way.)  Windows Server 2008 R2 read-only domain controllers (RODCs)
insist on having the correct name-type for the TGS principal in
TGS-REQs as well as AS-REQs, at least for the TGT-forwarding case.

Thanks to Sebastian Galiano for reporting this bug and helping with
testing.

(back ported from commit 5994d8928b8ff88751b14bc60c7d7bfce8b30e57)

ticket: 7176 (new)
version_fixed: 1.8.7
status: resolved
Make password change work without default realm

This fix is not very general or clean, but is suitable for backporting
because it is minimally invasive.  A more comprehensive fix will
follow.

(cherry picked from commit b9ff95a51ef11742abc9687a70b6d8324eda6803)

ticket: 7177 (new)
version_fixed: 1.8.7
status: resolved
Null pointer deref in kadmind [CVE-2012-1013]

The fix for #6626 could cause kadmind to dereference a null pointer if
a create-principal request contains no password but does contain the
KRB5_KDB_DISALLOW_ALL_TIX flag (e.g. "addprinc -randkey -allow_tix
name").  Only clients authorized to create principals can trigger the
bug.  Fix the bug by testing for a null password in check_1_6_dummy.

CVSSv2 vector: AV:N/AC:M/Au:S/C:N/I:N/A:P/E:H/RL:O/RC:C

[ghudson@mit.edu: Minor style change and commit message]

(cherry picked from commit c5be6209311d4a8f10fda37d0d3f876c1b33b77b)

ticket: 7178 (new)
version_fixed: 1.8.7
status: resolved
Try all history keys to decrypt password history

A database created prior to 1.3 will have multiple password history
keys, and kadmin prior to 1.8 won't necessarily choose the first one.
So if there are multiple keys, we have to try them all.  If none of
the keys can decrypt a password history entry, don't fail the password
change operation; it's not worth it without positive evidence of
password reuse.

(back ported from commit 2782e80a12bccd920fa71e23166ac97c4470a637)

ticket: 7180 (new)
version_fixed: 1.8.7
status: resolved
Export gss_mech_krb5_wrong from libgssapi_krb5

Although there are few legitimate reasons to use gss_mech_krb5_wrong,
it's declared in the public header and exported in the Windows DLL.
So export it from the Unix library as well.

(cherry picked from commit 9b693c2c5370a3a792f594ccb08475465438cd19)

ticket: 7181 (new)
version_fixed: 1.8.7
status: resolved
Always pass -W to kdb5_util create in testing

(cherry picked from commit ccc2543ecf06b31cdd29907b0c5dd00641b12b65)

ticket: 7182 (new)
version_fixed: 1.8.7
status: resolved
Work around glibc getaddrinfo PTR lookups

In krb5_sname_to_principal(), we always do a forward canonicalization
using getaddrinfo() with AI_CANONNAME set.  Then, we do a reverse
canonicalization with getnameinfo() if rdns isn't set to false in
libdefaults.

Current glibc (tested with eglibc 2.11.1) has the arguably buggy
behavior of doing PTR lookups in getaddrinfo() to get the canonical
name, if hints.ai_family is set to something other than AF_UNSPEC.
This behavior defeats the ability to turn off rdns.  Work around this
behavior by using AF_UNSPEC in krb5_sname_to_principal() from the
start, instead of starting with AF_INET and falling back.  Specify
AI_ADDRCONFIG to avoid AAAA lookups on hosts with no IPv6 addresses.

(cherry picked from commit bc8594e7c388c8a5cfb9516a0980877cb1321d32)

In sn2princ, getaddrinfo without AI_ADDRCONFIG

When canonicalizing a principal, use AI_CANONNAME alone in the hint
flags for getaddrinfo, for two reasons.  First, it works around a gnu
libc bug where getaddrinfo does a PTR lookup for the canonical name
(we tried to work around this in r24977 bug the addition of
AI_ADDRCONFIG caused the same problem as the use of AF_INET).  Second,
an IPv4-only host should be able create a principal for an IPv6-only
host even if it can't contact the host.

This does result in extra AAAA queries in the common case (IPv4-only
host contacting IPv4-only service), which is unfortunate.  But we need
to leave that optimization up to the platform at this point.

(cherry picked from commit c3ab5fe0b01a68b14d5657740006488721b48b7b)

ticket: 7184 (new)
version_fixed: 1.8.7
status: resolved
Fix kvno ASN.1 encoding interop with Windows RODCs

RFC 4120 defines the EncryptedData kvno field as an integer in the
range of unsigned 32-bit numbers.  Windows encodes and decodes the
field as a signed 32-bit integer.  Historically we do the same in our
encoder in 1.6 and prior, and in our decoder through 1.10.  (Actually,
our decoder through 1.10 decoded the value as a long and then cast the
result to unsigned int, so it would accept positive values >= 2^31 on
64-bit platforms but not on 32-bit platforms.)

kvno values that large (or negative) are only likely to appear in the
context of Windows read-only domain controllers.  So do what Windows
does instead of what RFC 4120 says.

(back ported from commit 7558fb3af9f9fdfb8195333c11a70ab7b354f82c)

Add test cases for Windows RODC kvno compatibility

(back ported from commit 8b33ff2daebcf3e4ccff6a938b410239b76ba287)

Eliminate trailing whitespace in trval output

Modify the trval output slightly so that the reference trval output
files don't containing trailing whitespace, to make them friendlier to
our git hooks.  (The pkinit and ldap trval reference files now contain
a leading blank line, which isn't very elegant, but avoiding that
requires too much Makefile.in complexity.)  Also correct a typo.

(back ported from cff6ea939f061d17a5742a04b8eeb2905c1813dc)

Restore some spaces in trval

This is a cosmetic change to reintroduce some space characters that
cff6ea939f061d17a5742a04b8eeb2905c1813dc removed, e.g. between the tag
and the length or short value.

(back ported from 0f976348054ca2f51187fe083a8c4668841f0b6d)

ticket: 7186 (new)
version_fixed: 1.8.7
status: resolved