Add asn1c test vectors for alg-agility types

For the test-vectors target in tests/asn.1, add ASN.1 modules from RFC
4556 and draft-ietf-krb-wg-pkinit-alg-agility-06.txt, and output test
encodings for PrincipalName, KRB5PrincipalName, OtherInfo, and
PkinitSuppPubInfo.  In the alg-agility module, AuthPack and DHRepInfo
are renamed, as asn1c otherwise rejects them as conflicting with the
RFC 4556 definitions.
Define SED in util/verto/Makefile.in

When the rules from util/k5ev/Makefile.in were moved to
util/verto/Makefile.in, the rule to make rename.h was broken on
non-gmake makes because the definition of SED wasn't carried over.
Define it now.
Removed unused leash help file

The file 'checkbox blank.png' is unneeded and contains a space in the
name, unnecessarily interfering with running find | xargs over the
source tree.  Remove it.

ticket: 7352 (new)
queue: kfw
target_version: 1.10.4
tags: pullup
Add zapfreestr() helper to k5-int.h

Since zapfree(str, strlen(str)) won't work for possibly-null values of
str, add a helper zapfreestr() which only calls strlen() if the string
value is non-null.
Add cred store functions to gssapi32.def

25ee704e83c2c63d4b5ecd12ea31c1979239041e added three new public GSSAPI
functions; add them to the DLL export file.

ticket: 7217
Add responder feature for initial cred exchanges

Add new APIs:
* krb5_get_init_creds_opt_set_responder
* krb5_responder_get_challenge
* krb5_responder_list_questions
* krb5_responder_set_answer

If a caller sets a responder, it will be invoked after preauth modules
have had a chance to review their incoming padata but before they produce
outgoing padata.  The responder will be presented a set of questions with
optional challenges.  The responder should then answer all questions it knows
how to handle.  Both the answers and the challenges are printable UTF-8 and
may contain encoded, structured data specific to the question asked.

Add two new callbacks and one optional method to the clpreauth
interface.  The new method (prep_questions) allows modules to ask questions
by setting them in the responder context using one of the new callbacks
(ask_responder_question).  The other new callback (get_responder_answer) is
used by the process method to read the answers to the questions asked.

ticket: 7355 (new)
Add internal base64 encoding and decoding support

Add base64 support based on Heimdal's libroken base64 code.
Add internal JSON encoding and decoding support

Add JSON support based loosely on Heimdal's heimbase code.
Introduce gss_export_cred and gss_import_cred

Add gss_export_cred and gss_import_cred mechglue functions to
serialize and unserialize GSSAPI credential handles.  Mechanism
implementations and tests will follow.

ticket: 7354 (new)
Add krb5 support for GSS cred export and import

Using the new internal JSON support to implement serialization and
unserialization of krb5 GSS credentials.

ticket: 7354
Add SPNEGO support for GSS cred export and import

ticket: 7354
Add tests for GSS cred export and import

ticket: 7354
Add new api to Sphinx doc; doc introduced version
Do not retrieve zero-length creds

In the MSLSA cache, if we get back a zero-length ticket, don't
accept it as success; continue on to try and get an acceptable
ticket.

ticket: 7349 (new)
subject: SapGUI sometimes crashes on new session with MSLSA cache
target_version: 1.10.4
tags: pullup
make depend
Unregister error message key on library unload

Revision fcdd2de1 added the K5_KEY_GSS_KRB5_ERROR_MESSAGE key, and
registered it in the gssapi library initialization routine, but
did not unregister it in the libary finalization routine.
When the library is unloaded and reloaded in the same process,
this leads to an assertion failure, since we check that
destructors_set[keynum] is zero (no destructor set) when registering
a key in util/support/threads.c.
Unregister the key on library cleanup to resolve the error.

ticket: 7353
target_version: 1.10.4
tags: pullup
Map CANTLOCK_DB to SVC_UNAVAILABLE in krb5kdc

The KDC should not return KRB5KRB_ERR_GENERIC (KRB_ERR_GENERIC) when the
KDB plugin returns KRB5_KDB_CANTLOCK_DB: it should return
KRB5KDC_ERR_SVC_UNAVAILABLE (KDC_ERR_SVC_UNAVAILABLE) instead.  This
allows clients to immediately fallback onto other KDCs.

When we switch to using blocking locks in the db2 KDB backend we'll very
rarely hit this code path, perhaps only when racing against a kdb5_util load.
Other KDB backends might still return KRB5_KDB_CANTLOCK_DB often enough that
this change is desirable.

ticket: 7358 (new)
Use blocking locks in krb5kdc and libkadm5srv

We don't really need or want to use non-blocking locks, and we certainly
don't want to sleep(1) in krb5kdc (possibly several times, as there was
a loop over this) when either of the principal or policy DB is locked.
Some callers still request non-blocking locks, and ctx_lock() still
honors this.

ticket: 7359 (new)
Fix lock inconsistency in ctx_unlock()

The lock inconsistency fixed here is quite possibly the same as
described in https://bugzilla.redhat.com/show_bug.cgi?id=586032 .

The problem is that ctx_unlock() fails to unlock the principal DB if
it fails to unlock the policy DB, and this happens when ctx_lock()
fails to lock the policy DB (likely because the caller is racing
against a kdb5_util load, which will be using a "permanent" lock,
meaning that the lock file will be unlinked after acquiring the
lock).  The fix is to perform both unlock operations *then* handle
any errors that either or both might have returned.

Additionally, we don't really need or want to use non-blocking locks,
and we certainly don't want to sleep(1) in krb5kdc (possibly several
times, as there was a loop over this) when either of the principal or
policy DB is locked.  Some callers still request non-blocking locks,
and ctx_lock() still honors this.

ticket: 7360 (new)
Test the inconsistent locking fix and svc unavail

Test the fix for https://bugzilla.redhat.com/show_bug.cgi?id=586032 .

Also test that krb5kdc can return svc unavailable