Try all history keys to decrypt password history

A database created prior to 1.3 will have multiple password history
keys, and kadmin prior to 1.8 won't necessarily choose the first one.
So if there are multiple keys, we have to try them all.  If none of
the keys can decrypt a password history entry, don't fail the password
change operation; it's not worth it without positive evidence of
password reuse.

(back ported from commit 2782e80a12bccd920fa71e23166ac97c4470a637)

ticket: 7156 (new)
version_fixed: 1.9.4
status: resolved
Fix omitted variable changes from previous

Some changes of hist_keyblock to hist_keyblocks did not make it into
the previous commit due to merge conflicts.

ticket: 7156
status: resolved
Work around glibc getaddrinfo PTR lookups

In krb5_sname_to_principal(), we always do a forward canonicalization
using getaddrinfo() with AI_CANONNAME set.  Then, we do a reverse
canonicalization with getnameinfo() if rdns isn't set to false in
libdefaults.

Current glibc (tested with eglibc 2.11.1) has the arguably buggy
behavior of doing PTR lookups in getaddrinfo() to get the canonical
name, if hints.ai_family is set to something other than AF_UNSPEC.
This behavior defeats the ability to turn off rdns.  Work around this
behavior by using AF_UNSPEC in krb5_sname_to_principal() from the
start, instead of starting with AF_INET and falling back.  Specify
AI_ADDRCONFIG to avoid AAAA lookups on hosts with no IPv6 addresses.

(cherry picked from commit bc8594e7c388c8a5cfb9516a0980877cb1321d32)

In sn2princ, getaddrinfo without AI_ADDRCONFIG

When canonicalizing a principal, use AI_CANONNAME alone in the hint
flags for getaddrinfo, for two reasons.  First, it works around a gnu
libc bug where getaddrinfo does a PTR lookup for the canonical name
(we tried to work around this in r24977 bug the addition of
AI_ADDRCONFIG caused the same problem as the use of AF_INET).  Second,
an IPv4-only host should be able create a principal for an IPv6-only
host even if it can't contact the host.

This does result in extra AAAA queries in the common case (IPv4-only
host contacting IPv4-only service), which is unfortunate.  But we need
to leave that optimization up to the platform at this point.

(cherry picked from commit c3ab5fe0b01a68b14d5657740006488721b48b7b)

ticket: 7164 (new)
version_fixed: 1.9.4
status: resolved
Make password change work without default realm

This fix is not very general or clean, but is suitable for backporting
because it is minimally invasive.  A more comprehensive fix will
follow.

(cherry picked from commit b9ff95a51ef11742abc9687a70b6d8324eda6803)

ticket: 7165 (new)
version_fixed: 1.9.4
status: resolved
Null pointer deref in kadmind [CVE-2012-1013]

The fix for #6626 could cause kadmind to dereference a null pointer if
a create-principal request contains no password but does contain the
KRB5_KDB_DISALLOW_ALL_TIX flag (e.g. "addprinc -randkey -allow_tix
name").  Only clients authorized to create principals can trigger the
bug.  Fix the bug by testing for a null password in check_1_6_dummy.

CVSSv2 vector: AV:N/AC:M/Au:S/C:N/I:N/A:P/E:H/RL:O/RC:C

[ghudson@mit.edu: Minor style change and commit message]

(cherry picked from commit c5be6209311d4a8f10fda37d0d3f876c1b33b77b)

ticket: 7168 (new)
version_fixed: 1.9.4
status: resolved
Export krb5_set_trace_callback/filename

krb5_set_trace_callback and krb5_set_trace_filename were added to
krb5.h in krb5 1.9, but were mistakenly left out of the library export
lists.  Add them now.  Reported by Russ Allbery.

(cherry picked from commit 61e6ab231b75f7ac3ff8967f002436e48ce05620)

ticket: 7169 (new)
target_version: 1.9.4
status: resolved
Export gss_mech_krb5_wrong from libgssapi_krb5

Although there are few legitimate reasons to use gss_mech_krb5_wrong,
it's declared in the public header and exported in the Windows DLL.
So export it from the Unix library as well.

(cherry picked from commit 9b693c2c5370a3a792f594ccb08475465438cd19)

ticket: 7170 (new)
version_fixed: 1.9.4
status: resolved
Update acknowledgments
Update README and patchlevel.h for krb5-1.9.4
Update patchlevel.h to krb5-1.9.4-postrelease