Fix S4U2Self against non-FAST KDCs

When we added FAST TGS support in 1.11, we broke S4U2Self against KDCs
which don't support FAST, because the S4U2Self padata is only present
within the FAST request.  For now, duplicate that padata in the outer
request so that both FAST and non-FAST KDCs can see it.

ticket: 7791
target_version: 1.11.5
tags: pullup
Avoid malloc(0) in SPNEGO get_input_token

If we read a zero-length token in spnego_mech.c's get_input_token(),
set the value pointer to NULL instead of calling malloc(0).

ticket: 7794 (new)
Better keysalt docs

Add a new section to kdc_conf.rst to describe keysalt lists, and
update other documentation to better distinguish enctype lists from
keysalt lists.

ticket: 7608
target_version: 1.12
tags: pullup
make depend
Update man pages
Modernize sn2princ.c

Refactor and edit sn2princ.c to match current coding style.  No
behavior changes, except to be less chatty in trace logs.
Allow ":port" suffixes in sn2princ hostnames

MSSQLSvc principal names can contain a ":port" or ":instance" trailer
on the hostname part.  If we see that in the hostname argument of
krb5_sname_to_principal(), remove it before canonicalizing the
hostname and put it back on afterwards.

ticket: 7795 (new)
Add tests for krb5_sname_to_principal
Fix up tests directory ignores, deps, cleanup

A few test programs didn't make it into .gitignore, OBJS, or
EXTRADEPSRCS.
Fix SPNEGO one-hop interop against old IIS

IIS 6.0 and similar return a zero length reponse buffer in the last
SPNEGO packet when context initiation is performed without mutual
authentication.  In this case the underlying Kerberos mechanism has
already completed successfully on the first invocation, and SPNEGO
does not expect a mech response token in the answer.  If we get an
empty mech response token when the mech is complete during
negotiation, ignore it.

[ghudson@mit.edu: small code style and commit message changes]

ticket: 7797 (new)
target_version: 1.12.1
tags: pullup
Remove unneeded check in SPNEGO initiator

In init_ctx_cont, if the response token contains no fields, we set a
return value but don't actually quit out of the function.  We do not
need this check (we will fail later on if a piece of required
information isn't present), so just remove it.  Reported by
simo@redhat.com.
Fix memory leak in SPNEGO initiator

If we eliminate a mechanism from the initiator list because
gss_init_sec_context fails, free the memory for that mech OID before
removing it from the list.

[ghudson@mit.edu: clarified commit message]

ticket: 7803 (new)
target_version: 1.12.1
tags: pullup
Fix GSS krb5 acceptor acquire_cred error handling

When acquiring acceptor creds with a specified name, if we fail to
open a replay cache, we leak the keytab handle.  If there is no
specified name and we discover that there is no content in the keytab,
we leak the keytab handle and return the wrong major code.  Memory
leak reported by Andrea Campi.

ticket: 7805
target_version: 1.12.1
tags: pullup
Don't require krb5.conf without KRB5_DNS_LOOKUP

For a long time we have allowed krb5 contexts to be initialized in the
absence of krb5.conf--but only if KRB5_DNS_LOOKUP is defined,
presumably on the theory that no KDCs could be contacted without
either DNS support or profile configuration.  But locate plugins could
provide the ability to find KDCs, and some libkrb5 operations (such as
IAKERB initiation) could succeed without needing to locate KDCs.

Also get rid of the profile_in_memory context flag, since we don't use
it any more.
Remove BADSYMS

We haven't been using it or keeping it up to date, and there's no
need to keep it checked in.
Clarify klist -s documentation

The documentation for klist -s erroneously suggests that it doesn't
affect the exit status behavior and that it merely checks for the
existence of the ccache (only mentioning the expired ticket check at
the end).  Make it clearer and simpler, but avoid going into a lot of
detail about the nature of the expiration check.

ticket: 7806 (new)
target_version: 1.12.1
tags: pullup
Set an error message when keyring get_princ fails

When attempting to use a keyring cache that doesn't exist, set an error
message when we fail to read a principal name, as we do when we return
the same error code when using a file ccache.
Handle no-such-cache where cc_set_flags() succeeds

Calls to krb5_cc_set_flags() fail for file ccaches, but not for all
types.  Account for that in places where that affects whether or not we
return an error to a caller or produce a different diagnostic.