Mention old preauth header file in docs

The previous commit updated the header file references for 1.12 in the
clpreauth and kdcpreauth plugin interface documentation.  Add a
parenthetical so that the reference is still useful for prior
releases.
Add libkrad

The new library libkrad provides code for the parsing of RADIUS packets
as well as client implementation based around libverto.  This library
should be considered unstable.

ticket: 7678 (new)
Add server-side otp preauth plugin

This plugin implements the proposal for providing OTP support by
proxying requests to RADIUS. Details can be found inside the
provided documentation as well as on the project page.

http://k5wiki.kerberos.org/wiki/Projects/OTPOverRADIUS

ticket: 7678
Fix skip logic in t_otp.py

Reorder (and trim) the imports in t_otp.py so that k5test is pulled in
before we try to import pyrad and multiprocessing.  Otherwise
success() isn't defined in the case where we decide to skip the entire
test script.
Add k5calloc internal helper function

Letting calloc() do multiplication helps avoid overflow bugs, so
provide an internal k5calloc() helper which accepts both calloc
arguments, and reimplement k5alloc() in terms of it.
Use k5calloc instead of k5alloc where appropriate

Wherever we use k5alloc with a multiplication in the size parameter,,
use the new k5calloc helper function instead.
Fix minor type issues in krad tests

Use unsigned char for test encodings, since the initializers use
values greater than 127.
Use pipe instead of sigwait for krad tests

We've never used sigwait() before, and it has some problems on Solaris
10 (a nonconformant prototype by default, and experimentally it didn't
seem to work correctly with _POSIX_PTHREAD_SEMANTICS defined).  Use a
pipe instead.  Make t_daemon.py less chatty on stdout to avoid filling
the pipe buffer.
Don't leak the reply key's memory during PKINIT
Don't leak PKINIT CMS signed data certs and CRLs

The stacks of certificates and CRLs that we retrieve from CMS objects
include newly-owned references to the certificates and CRLs, so when we
go to free them, we need to remember to free those.

[ghudson@mit.edu: minor formatting change; removed unrelated style fix]
Fix minor leaks in klist

When walking the cache, if we skip a cred because it's a config entry,
make sure to free it.  Also free the result of krb5_cc_get_principal.
Based on a patch from Nalin Dahyabhai.
Fix a leak when parsing PKINIT cert SANs with NSS

When retrieving the list of a certificate's subjectAltName values, we
weren't freeing some of the temporary memory we used.
Avoid allocating zero key_data structures

When we allocate space for an array of key_data structures, make sure
we allocate at least one, so we don't spuriously fail on platforms
where malloc(0) returns NULL.  Where we use malloc, use k5calloc
instead.  Where we use krb5_db_alloc or realloc, just allocate an
extra entry.
Add kadmin support for principals without keys

Add kadmin support for "addprinc -nokey", which creates a principal
with no keys, and "purgekeys -all", which deletes all keys from a
principal.  The KDC was modified by #7630 to support principals
without keys.

ticket: 7679 (new)