Avoid leaks on gss_accept_sec_context errors

Failure handling during the postprocessing of
mech->gss_accept_sec_context was inconsistent.  In one case we delete
the output token but leave the partly-constructed context present in
*context_handle (violating RFC 2744 if this is the first call); in
other cases we leave the output token in the caller's buffer but do
destroy the partly-constructed context.  Make this more consistent by
always destroying the output token and partly-constructed context.
(RFC 2744 prefers, but does not require, leaving the
partly-constructed context present on error if it was present on
entry.  At the moment we are ignoring that preference.)

[ghudson@mit.edu: Rewrote commit message with more details]
Add tests for gss_inquire_mechs_for_name
Simplify gss_inquire_mechs_for_name

Use gss_indicate_mechs instead of gssint_get_mechanisms and
gssint_mech_to_oid to iterate over the list of mechanism OIDs.  Use a
static helper to determine whether a mech supports a name type,
avoiding most of the work done in the for loop.  Use a cleanup
handler.  Don't leave partial results in the output parameter on
error.
Delete unused internal mechglue functions

Get rid of gssint_get_mechanisms, gssint_mech_to_oid, and
gssint_oid_to_mech, which constructed a list of mechanism names and
mapped between mech names and OIDs.  These functions were only used by
gss_inquire_mechs_for_name, which now uses gss_indicate_mechs instead.
Refactor gss mech config parser

Use helper functions to shorten and clarify loadConfigFile.
Remove NSIS installs when upgrading to 64-bit

The NSIS installer appears to have only ever existed as a 32-bit
software.  As such, unconditionally check the 32-bit registry tree
for an uninstall string; the architecture of the current package
being installed is not relevant to what was previously installed.

ticket: 7362 (new)
queue: kfw
target_version: 1.10.4
tags: pullup
Resolve verifier cred in accept_sec_context

If the verifier cred handle is of type GSS_C_BOTH, we need to resolve
the initiator part of it in order to create a s4u2proxy delegated
credential handle.  (If it's of type GSS_C_ACCEPT, kg_resolve_cred
won't do anything beyond locking and validating the credential.)

ticket: 7356
Keep verifier cred locked in accept_sec_context

It might have been safe to access the krb5 verifier cred without a
lock before constrained delegation, but it is less likely to be safe
now that we might access both the initiator and acceptor parts of the
cred.  Hold a lock on the cred for the full accept_sec_context
operation.

ticket: 7366 (new)
Export krb5_rc_recover_or_initialize on Windows

krb5_rc_recover_or_initialize is not a public function, but is now
used by the krb5 mechanism when importing a credential.  Mark it as
PRIVATE GSSAPI in the export list.
Export more krb5_rc symbols on Windows

krb5_rc_resolve_full, krb5_rc_resolve_get_name, and
krb5_rc_resolve_get_type are also now used in the krb5 mech.
Fix typo
Fix t_s4u2proxy_krb5 cleanup

Unlike most GSS test programs, t_s4u2proxy_krb5 uses a cleanup
handler, so we have to be careful to initialize everything we clean
up--particularly service2_name, which is initialized after a possible
goto.  Also, remember to release acceptor_name.
Update windows/README

The build instructions have changed somewhat, as have the requirements
for a build environment.
The default behavior for KRB5_CONFIG and KRB5CCNAME has also changed.
Attempt to remove mention of overly specific Windows versions that
are now quite old when the behavior persists in newer versions of Windows.
Document the usage of DNS by default and the reduced need for a large
krb5.ini file.
Talk a little more about the LSA cache.

The kerbsrc.win target is no longer supported.

ticket: 7363 (new)
target_version: 1.10.4
tags: pullup
Do not add empty dir to the include search list

windows/leashdll/include contains only a krb4 directory.
We have a dubious need for the latter through AFSroutines.c,
but the former can be eliminated.
Update FILES and WINFILES for kerbsrc.zip

Note that windows/wshelper/* was removed from the list, as it doesn't
exist.

The kerbsrc.zip target is slated for removal, but attempt to make it
more correct before removing it should it need to be revived.

Submitted by: Blaine Elzey  blaine.elzey at alcatel-lucent.com

ticket: 7364 (new)
Remove kerbsrc83

It's been a long time since systems were limited to 8.3 format
for file names.  No one should be thinking to try and build this
target, and if they do, we don't need a custom error message anymore.
Clean out the unneeded code from the Makefile.in.
Remove kerbsrc-nt

NT is long-gone; we don't need to keep a special-case error message
around telling people not to use it.
Clean out the unneeded code from the Makefile.in
Remove kerbsrc.win

It has been unloved and broken repeatedly for many years, requiring
updating of several variables whenever new directories are added
and similar tedia.  It was originally intended to avoid the need
for Unix utilities on Windows, but Microsoft provides the Utilities
and SDK for UNIX-based Applications which is enough rope to do a
native build.

Leave behind a warning message to anyone who does try to build the
target.

Clean up some now-unused infrastructure in the build system.

ticket: 7367 (new)
Remove some dead Makefile code

FILES is unused in util/{ss,et}/Makefile.in; some other unused
variables were nearby.
Fix typo

Actually expand the OUTPRE variable instead of just using a literal
string.

ticket: 7387 (new)
subject: Windows build leaves (OUTPRE)/krb5ccNN.res in ccapi/lib/win/srctmp
tags: pullup
target_version: 1.10.4