Fix iprop safety net in kdb5_util load

The error message was missing a newline, and the exit behavior causes
the database to be destroyed.

ticket: 7370
target_version: 1.11.1
tags: pullup
Clean up iprop flow control in kdb5.c

Add a helper predicate to determine whether to log operations.  In the
predicate, check if the ulog is actually mapped.  Use a single cleanup
label in krb5_db_put_principal.  Use a cleanup label in
krb5_db_delete_principal instead of releasing resources individually
at each exit point.  Avoid locking and unlocking the ulog if we're not
logging (although it would be a no-op).

Based on a patch from Nico Williams <nico@cryptonector.com>.
Modernize style of kdb_log.c

ulog_get_entries had an unreachable branch which was removed during
de-indentation.
Fix iprop log reinitialization

If the master iprop log is reinitialized to serial number 0, slaves
will need to take a full dump--but after that happens, we need to know
whether the slave has taken that full dump, we we don't offering full
dumps indefinitely.

So, record a timestamp in kdb_last_time when we reinitialize the log
header, and compare the slave timestamp to kdb_last_time whenever it
has the current serial number, even if it's 0.  Test this by
performing a propagation with sno 0 in t_iprop.py and detecting
whether kpropd gets a second UPDATE_FULL_RESYNC_NEEDED response from
kadmind.

ticket: 7550 (new)
Verify iprop test results more thoroughly

In k5test.py, allow run_kadminl to take an environment argument.  In
t_iprop.py, perform some queries on the slaves after each propagation
to spot-check that it got modifications from master.  Use a helper
function to check serial numbers for conciseness.
Propagate policy changes over iprop via full dump

Since iprop cannot carry policy changes, force a full resync to happen
each time a policy change occurs.  Based on a patch from
Richard Basch <basch@alum.mit.edu>.

ticket: 7522
Remove ulog_check(); the ulog is not a DB journal

The db2 DB is not power-fail safe.  There's no point trying to
replay an incompletely committed entry from the ulog at kadmind
startup time.  For that matter, even if the db2 DB was power-fail
safe there'd be no point replaying an uncommitted entry from the
ulog as the libkadm5srv app (nor any client of it, as in the case of
kadmind) will not have received any notice of success -- it'd be
wrong to complete that operation later when the user thought it'd
failed.

[ghudson@mit.edu: merge with master, adjust comment]

ticket: 7552 (new)
Adjust kdb5.c check for ulog being mapped

Check the ulog pointer, which is a little more direct, rather than the
ulogfd field.  (ulogfd is currently initialized to 0 prior to
ulog_map; we could fix that instead, but this feels simpler.)
Quiet kpropd.c signed/unsigned comparison warnings

[ghudson@mit.edu: simplify slightly]
Check for negative poll timeout in k5_sendto_kdc

ticket: 7553
target_version: 1.11.1
tags: pullup
Make kproplog handle underfull iprop logs

kproplog currently assumes that an iprop log is full once it has
circled--which is true right now but will need to change for
hierarchical slaves.  Avoid this assumption by using the correct
index modulus in print_update whether or not the log is full.

Based on a patch from Richard Basch <basch@alum.mit.edu>.
Refactor LDAP DB option parsing code

krb5_ldap_open and krb5_ldap_create contain two large, almost
identical blocks of DB option processing code.  Factor it out into a
new function krb5_ldap_parse_db_params in ldap_misc.c, and simplify
the factored-out code.  Create a helper function to add server entries
and use it to simplify krb5_ldap_read_server_params as well as DB
option parsing.  Since the new DB option helper uses isspace instead
of isblank, we no longer require portability goop for isblank.
Add LDAP debug DB option

Add a DB option in the LDAP KDB module to turn on debugging messages.
Adapted from a patch by Zoran Pericic <zpericic@inet.hr>.

ticket: 7551 (new)
Fix prepend_err_str in LDAP KDB module

Use the oerr parameter to fetch the existing message.  Stop handling
oerr == 0, since no call sites were using it.  Free the old error
message before returning.
Note which release -x debug was added in
Fix is_referral flag in KDC TGS code

A server response which is a cross-realm TGT is not a referral if it
was directly requested by the client.  Misclassifying such a response
as a referral means we don't mirror the request's name type, which has
been observed to break older Java clients.

ticket: 7555 (new)
Revert previous change to process_tgs_req

Commit c072b059ecff257e7600be0e86869decd135d422 did not have the
intended effect because, at the point where is_referral is set,
request->server has already been modified to contain server->princ.

ticket: 7555
status: open
Fix COPY_FIRST_CANONNAME hostent search

In fake-addrinfo.c, the COPY_FIRST_CANONNAME logic erroneously assumes
that h_name is the same as h_aliases[0].  Look at h_name before
h_aliases for an FQDN, since h_name is normally the
forward-canonicalized name and h_aliases are not.

[ghudson@mit.edu: rewrote commit message]

ticket: 7556 (new)
New section: Contributing to Kerb documentation
Remove partial LDAP client cert support

The LDAP KDB module has some code to interpret {FILE} values in stash
files, and set the service_cert_path/pass fields in the ldap context.
But there was no code to actually use those values to do client cert
authentication, so it wasn't useful.  Remove the partial
implementation.