Remove eDirectory support code in LDAP KDB module
De-indent process_k5beta6_record()
Fix ugly ladder in src/kadmin/cli/kadmin.c
Policy extensions + new policy: allowed ks types

This simply adds KADM5_API_VERSION_4 and various fields to the
policy structures:

 - attributes         (policy-ish principal attributes)
 - max_life           (max ticket life)
 - max_renewable_life (max ticket renewable life)
 - allowed_keysalts   (allowed key/salt types)
 - TL data            (future policy extensions)

Of these only allowed_keysalts is currently implemented.

Some refactoring of TL data handling is also done.

ticket: 7223 (new)
Constify krb5_string_to_keysalts()'s string arg
Add LDAP back end support for policy extensions

ticket: 7223
Revert an out-of-scope change in policy extensions
Fix edge-case bugs in kdb5_util load

* fscanf field widths must be less than the buffer size, not equal to
  it.
* Check for negative values of lengths we're going to allocate.
* Eliminate a warning in the comparison of the regexp end offset.
* process_r1_8 policy doesn't actually ignore additional values, so
  get rid of the comment and inequality test suggesting that it does.

ticket: 7224 (new)
Updated logs URL for #krbdev channel
Doc the need to restart KDC if kdc.conf changed
Fix KDC heap corruption vuln [CVE-2012-1015]

Fix KDC heap corruption vulnerability [MITKRB5-SA-2012-001
CVE-2012-1015].  The cleanup code in
kdc_handle_protected_negotiation() in kdc_util.c could free an
uninitialized pointer in some error conditions involving "similar"
enctypes and a failure in krb5_c_make_checksum().

Additionally, adjust the handling of "similar" enctypes to avoid
advertising enctypes that could lead to inadvertent triggering of this
vulnerability (possibly in unpatched KDCs).

Note that CVE-2012-1014 (also described in MITKRB5-SA-2012-001) only
applies to the krb5-1.10 branch and doesn't affect the master branch
or releases prior to krb5-1.10.

ticket: 7225 (new)
target_version: 1.9.5
tags: pullup
Add %{username} token to path expansion

For Unix-like platforms, add %{username} to the path expansion
facility, expanding to the result of getpwuid on the euid.

Also, for manual testing convenience, make t_expand_path print the
result if no second argument is given.
Explain memory allocation policy in oid_ops.c
Our kadmind uses its assigned port by default

Do not leave anyone thinking that they might have to specify it
in the config file to get the standard behavior.
Grammar and spelling
Fix default substitution of ccache/keytab names

Tie up some loose ends in substitution of the default ccache/keytab
names after 688a2702d2045abf5f99acfb59f3f372391e5be4:

* Fix the substhtml target in src/doc/Makefile.in
* Don't add FILE: when substituting the default keytab and client
  keytab names, as the defaults already have it.
Change default client keytab name

Change the default client keytab name, if not overridden at build
time, to FILE:$localstatedir/krb5/user/%{euid}/client.keytab.
Introduce a second file from the autoconf archives in order to
recursively expand $localstatedir within configure.in.
Minor correction of [realms] text of kdc.conf
Fix oid set construction in gss_inquire_cred()

Use gssapi calls to construct the oid sets.  It is not safe on windows
to use malloc to hand-construct the set and then call gss_release_oid_set()
to clean it up.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>

ticket: 7227 (new)
tags: pullup
Fix malformed Parameter Expansion table in docs