Remove dead code

This (hair-raising) macro is not referenced anywhere in the tree,
so remove it and the associated comment.
Enable all localizations in main functions

Bite the bullet and pass LC_ALL to setlocale() instead of just
LC_MESSAGES.  Calls to setlocale() itself were introduced in
fabbf9e443459e8c0161c84563690ed70c7f6a61 for ticket 6918, but
only for LC_MESSAGES since only localized strings were needed
and that was the most conservative option.
However, klist, kadmin, and kinit (and perhaps others) would benefit
from localized formats for times (i.e., LC_TIME).  If potentially
localized data is being sent on the wire, that is a bug that should
be fixed.  No such bugs are found with the current test suite, so we
are comfortable enabling LC_ALL at this time.

ticket: 7192
Document absolute times for 'kinit -s'

kinit's -s argument takes a parameter, which is first interpreted
as a time interval ("deltat"), in the same format used for
the -l and -r arguments.  However, if that fails, the
time argument is interpreted as an absolute time, in one of
twelve different possible formats, some of which are subject to
localization via strptime().  Explicitly listing all twelve
possible interpretations is overkill, but give the user a hint that
absolute times are possible at all.
Pass the user's CPPFLAGS in ALL_CFLAGS

We need them if any headers we depend on are not in the default
search path (e.g., gettext.h).  These files are built for
'make check' but not for the normal build.
Allow using locales when gettext is absent

Previously, if configure did not detect dgettext(), we disabled
anything that smelled like localization, inadvertently including
setlocale().  Now that we use setlocale(LC_ALL, ""), we have
localized dates available as well as messages, so we should not
disable calls to setlocale() any more.
Since the routines from locale.h are only used in a relatively
small number of places, just include the header directly in those
files and remove it from k5-platform.h.
Revert "Document absolute times for 'kinit -s'"

This reverts commit 20f85a81151f69689e3c060e89852687eb6c5a3c.
The ability of 'kinit -s' to accept an absolute time is
intentionally undocumented and remains only for backwards
compatibility.
Leave a comment in the source to this effect, for future generations.
Reject extra realm separators in principal names

Commit f609e5caff410cc8f71db7d95b4da219541437db accidentally omitted
the check for extra realm separators, leading to an assertion error
when parsing x@y@z or similar.  Restore the check.
Avoid mapping GSSAPI minor code on success

In gssint_import_internal_name, don't map the minor code from
mech->gss_duplicate_name if it returned successfully.  Fixes an
"unexpected non-zero minor status" error reported by SAP's gsstest
when it invokes gss_canonicalize_name().

ticket: 7194 (new)
Add *~ to .gitignore

This covers src/include/autoconf.h.in~ which can be created by
util/reconf.
Updated Example section in kdc.conf
Sphinx html: reorder admin/user commands index
Automatically create DIR ccache directories

If the directory for a DIR ccache doesn't exist yet, try to create it
(but not its parents) with mode 700.  Exercise this in test scripts by
not pre-creating directories.

ticket: 7196 (new)
Allow full ccache name in k5test's K5Realm.klist
Translate WinSock errors to Posix counterparts

MSVC 2010 defines both Posix and WinSock error values so we can no longer
simply #define the Posix error values to be their WinSock counterpart.
This patch explicitly #includes <errno.h> in port-sockets.h and still
conditionally defines the Posix error values for compatibility with older
MSVC but also translates WinSock errors to Posix for MSVC 2010
compatibility.

The downside to this approach is that there are some Posix errors we
do not currently detect (e.g. EADDRINUSE) that are neither #defined nor
translated.  If we use one of those in the future but fail to update
TranslateWSAGetLastError() we'll once again be in the situation that the
windows build will compile but fail to work, possibly only when some rare
error condition occurs.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>

ticket: 7197 (new)
tags: pullup
Implement switch_to for ccapiv3

krb5_stdccv3_switch_to() calls cc_ccache_set_default().
krb5_stdccv3_resolve() checks for NULL or empty residual and calls
cc_context_get_default_ccache_name() in those cases.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>

ticket: 7198 (new)
tags: pullup
Add krb5int_cc_user_set_default_name

Set the default credential cache name for all processes for the current
user.  Currently implemented, for windows only, by setting
HKEY_CURRENT_USER\Software\MIT\Kerberos5:ccname to the specified
ccache name.  This will not override the environment variable 'KRB5CCNAME'.
It will override HKEY_LOCAL_MACHINE and 'indirect' registry values.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>

ticket: 7199 (new)
tags: pullup
Add comment documenting make_toolong_error()

The KDC doesn't obviously call make_toolong_error(), but some code in
net-server.c (which is linked into the KDC) does.  Document this fact.
Always recreate acl files during dejagnu tests

The dejagnu tests create some persistent acl files containing
hostname-derived principal names.  These can get out of date if the
host has changed names since the last time the dejagnu tests were run,
causing failures (notably in iprop.exp).  To avoid this problem,
change the dejagnu tests to always create new acl files for each test
run.

ticket: 7200 (new)
tags: pullup
target_version: 1.10.3
Correct comments in port-sockets.h
Turn off use of a replay cache in krb5_verify_init_creds(). The library isn't attempting a replay attack on itself, so any detected replays are only going to be false-positives.