kpasswd: move roken.h after config.h in kpasswd_local.h

With roken.h at the end of the include list two different versions
of Winsock get imported on Windows.  roken.h should always be
immediately after config.h if included.

Change-Id: Id3f6761028ddaa5b44183fe6648c5ab292ca8865
asn1 check-der use roken

Rely on roken to determine which random function should be
used.

Rename parameter "rand" to "randbytes" to avoid collision with
functions named "rand()".

Change-Id: Ic07cf149daef1cd568b58277773fbe27aef04f7b
krb5 tests on windows

Execute tests that were built on Windows but previously skipped.

Remove the duplicate build rules for test-rfc3961.exe.

Change-Id: Icc84c07a33afbdc6ffa509222a3c81de35168eaf
krb5: windows sysplugin_dirs

Do not look for plugin DLLs in either

  $ORIGIN/../lib/plugin/krb5
  $ORIGIN/../lib

Only look for plugin DLLs in $ORIGIN

Change-Id: I432cd81720b172e7451601b56ea7bba3c03d7d47
fcc_open: disable checks on Windows

st_dev and st_ino are not set in a consistent fashion by stat()
and fstat() so disable the symlink test.

disable the open group/other readable test because st_mode
cannot be used to perform such a test on Windows.

Change-Id: I1b68c672f882018def7e6d40d4bc7f7add58df36
roken: windows opendir() initialize path buffer

Change-Id: If6ef39b3a7b256c78ecd7786cc939903f7823931
roken: prototype dladdr()

Change-Id: Ia21414ca327b6ede44beb53fe96a6adc73119797
ISPATHSEP and ISTILDE macros; Windows portability

Windows treats '\\' and '/' equivalently but we cannot control
the form that will be used by end users.  Introduce ISPATHSEP()
macro which tests only for '/' on UNIX and both on Windows.
Introduce ISTILDE() macro to test for '~'.   When testing for
'/' with strchr() or strrchr() add conditional checks for '\\' on
Windows.

Change-Id: Ia85e698fc88f15a6a71db649db5417f02ef7e5fe
krb5: sync export lists

Sync the Windows and UNIX export lists for lib/krb5

Change-Id: I992921058c463335d0a3037ec035afd7f9d511b0
pcache: rename and fix callback()

rename callback() to cc_plugin_register_to_context() and document
its purpose.

The parameter that is the cc_ops structure is 'plugctx' not 'plug'.
This is critical because 'plug' is the common_plugin_model structure
and casting the wrong object leads to random behavior including
crashes.

The test to exit without action was reversed.

With these changes ccache plugins can be registered on each
krb5_init_context() operation.

Change-Id: I295ea91759f69b36ac13b1bfff87306d40df4a26
krb5 plugin fix typo in comment

Change-Id: Ic73d44fa14f38f078dbc97a0aa94d2b0ba1f5028
_krb5_load_plugins: Windows naming rules

Windows plugins must be loaded from the same directory as the
heimdal.dll in order to ensure that "DLL Hell" is not revisited.
Since plugins cannot be grouped in a directory by "module" name
the plugins must have a name of the form:

  plugin_<module>_<name>.dll

Construct the "plugin_<module>_" prefix string dynamically and
test for both the prefix and the ".dll" extension when building
the list of plugins to load.

Change-Id: I0ff7bf7287f8fb38061c226f0844d7d0f1fb59ec
test_rfc3961.exe link to comerr.lib

Change-Id: I05941496af744a54380c04f0ecd0a9d608387980
krb5_sendto_context potentially uninitialized ret

Change-Id: Ia1f54f90900f78f25bb6e0573f707b4d2a7f6055
lib/hdb/db3.c:DB_open() needs to DB_close() more

Without this the KDC can trip the assert in DB_open().
Use KRB5_TC_MATCH_TIMES when looking for creds
Make fcc_remove_cred() better

Don't use a memory ccache go between, just copy all but the matching
credential(s).
Make Refuses to open symlinks msg less spurious

If we're racing enough we could complain about symlinks where there were
none.  This was very surprising.  Make it surprise less.

We should really #ifndef O_NOFOLLOW that code chunk too, for the obvious
reason that we don't need to worry about symlinks if we have and use
O_NOFOLLOW.

Also, since all uses of fcc_open() use O_NOFOLLOW we should move that
into fcc_open().  Ditto O_BINARY and O_CLOEXEC.
Fix racy file ccache corruption in cred_delete()

We *really* need a ccache instance ID tag.  In fact, we should probably
never krb5_cc_initialize() a ccache that doesn't have such a tag.  But
for now cred_delete() is now safe enough.
Only gate the st_uid fcache checks