Support kdc_timesync offsets in memory ccache

When using v4 file credentials caches, client clock skew offsets
obtained when running with the kdc_timesync option set are persisted in
the ccache. This allows the offsets to be used across separate contexts,
e.g. when obtaining credentials using krb5 interfaces and subsequently
importing those credentials for use in gssapi. This patch adds similar
support for memory credentials caches.

[ghudson@mit.edu: Minor style corrections.]

ticket: 7346 (new)
Add support for GSS_C_NT_COMPOSITE_EXPORT

ticket: 7347 (new)
Use separate components for shortcuts

Since the Start Menu and Desktop are different folders, we should
use different components for the shortcuts in those folders, given
that components operate at directory granularity.

Take the opportunity to use the newer style for installing shortcuts
and registry keys, and make the names more descriptive.

Increment the buildlevel to ensure new files are installed.

ticket: 7348 (new)
subject: Use more meaningfully named registry keys for shortcuts
queue: kfw
target_version: 1.10.4
tags: pullup
Try harder not to use clock_gettime in verto-k5ev

We already define EV_USE_REALTIME to 0 to avoid the use of
clock_gettime() (to avoid depending on librt).  But in some build
environments libev can detect support for a monotonic clock, which
also results in using clock_gettime().  Define EV_USE_MONOTONIC to 0
as well to prevent this.

ticket: 7350 (new)
target_version: 1.10.4
tags: pullup
Update bundled libverto to 0.2.5
Avoid libdl dependencies in bundled libverto

The upstream libverto depends on dynamic loading and in particular on
dladdr(), which is not universal.  To avoid this dependency, stub out
support for module loading (by replacing module.c) and instead
integrate the k5ev module directly into the bundled verto library.

This change removes the need to link, include, and invoke libverto
differently depending on whether we're using the bundled library; we
can always just link with -lverto and call verto_default().

bigredbutton: whitespace
ticket: 7351 (new)
Add asn1c test vectors for alg-agility types

For the test-vectors target in tests/asn.1, add ASN.1 modules from RFC
4556 and draft-ietf-krb-wg-pkinit-alg-agility-06.txt, and output test
encodings for PrincipalName, KRB5PrincipalName, OtherInfo, and
PkinitSuppPubInfo.  In the alg-agility module, AuthPack and DHRepInfo
are renamed, as asn1c otherwise rejects them as conflicting with the
RFC 4556 definitions.
Define SED in util/verto/Makefile.in

When the rules from util/k5ev/Makefile.in were moved to
util/verto/Makefile.in, the rule to make rename.h was broken on
non-gmake makes because the definition of SED wasn't carried over.
Define it now.
Removed unused leash help file

The file 'checkbox blank.png' is unneeded and contains a space in the
name, unnecessarily interfering with running find | xargs over the
source tree.  Remove it.

ticket: 7352 (new)
queue: kfw
target_version: 1.10.4
tags: pullup
Add zapfreestr() helper to k5-int.h

Since zapfree(str, strlen(str)) won't work for possibly-null values of
str, add a helper zapfreestr() which only calls strlen() if the string
value is non-null.
Add cred store functions to gssapi32.def

25ee704e83c2c63d4b5ecd12ea31c1979239041e added three new public GSSAPI
functions; add them to the DLL export file.

ticket: 7217
Add responder feature for initial cred exchanges

Add new APIs:
* krb5_get_init_creds_opt_set_responder
* krb5_responder_get_challenge
* krb5_responder_list_questions
* krb5_responder_set_answer

If a caller sets a responder, it will be invoked after preauth modules
have had a chance to review their incoming padata but before they produce
outgoing padata.  The responder will be presented a set of questions with
optional challenges.  The responder should then answer all questions it knows
how to handle.  Both the answers and the challenges are printable UTF-8 and
may contain encoded, structured data specific to the question asked.

Add two new callbacks and one optional method to the clpreauth
interface.  The new method (prep_questions) allows modules to ask questions
by setting them in the responder context using one of the new callbacks
(ask_responder_question).  The other new callback (get_responder_answer) is
used by the process method to read the answers to the questions asked.

ticket: 7355 (new)
Add internal base64 encoding and decoding support

Add base64 support based on Heimdal's libroken base64 code.
Add internal JSON encoding and decoding support

Add JSON support based loosely on Heimdal's heimbase code.
Introduce gss_export_cred and gss_import_cred

Add gss_export_cred and gss_import_cred mechglue functions to
serialize and unserialize GSSAPI credential handles.  Mechanism
implementations and tests will follow.

ticket: 7354 (new)
Add krb5 support for GSS cred export and import

Using the new internal JSON support to implement serialization and
unserialization of krb5 GSS credentials.

ticket: 7354
Add SPNEGO support for GSS cred export and import

ticket: 7354
Add tests for GSS cred export and import

ticket: 7354
Add new api to Sphinx doc; doc introduced version
Do not retrieve zero-length creds

In the MSLSA cache, if we get back a zero-length ticket, don't
accept it as success; continue on to try and get an acceptable
ticket.

ticket: 7349 (new)
subject: SapGUI sometimes crashes on new session with MSLSA cache
target_version: 1.10.4
tags: pullup