Add rxkad server hook function to decrypt more types of tokens

Allow tokens to be encrypted with algorithms other than DES.
The security object owner must provide an implementation
by calling rxkad_SetAltDecryptProc.

Make sure plainsiz is initialized before calling the alternate decrypt
proc.
New optional rxkad functionality for decypting krb5 tokens

An additional, optional mechanism for decrypting krb5-format tokens
is provided that uses the krb5 api with a key from a keytab
instead of using libdes and the AFS KeyFile.

The AIX compat stub for krb5_c_decrypt is contributed by Andrew Deason.

Change-Id: I97c08122c60482b84d602d6fa6482f1d5deef142
Integrate keytab-based decryption into afsconf_BuildServerSecurityObjects

Now all servers can have it.

authcon.o grows a krb5 dependency and needs to get KRB5_CPPFLAGS.

Change-Id: I95fecb3f88c19b3d5193ea8200fa20c86ec08ad7
Derive DES/fcrypt session key from other key types

If a kerberos 5 ticket has a session key with a non-DES enctype,
use the NIST SP800-108 KDF in counter mode with HMAC_MD5 as the PRF to
construct a DES key to be used by rxkad.

To satisfy the requirements of the KDF, DES3 keys are first compressed into a
168 bit form by reversing the RFC3961 random-to-key algorithm

Change-Id: I4dc8e83a641f9892b31c109fb9025251de3dcb27
Move akimpersonate to libauth

Give it its own source file and header, install the header at
depinstall time, and have aklog get the akimpersonate functionality
from libauth.

Keep the linux box copyright from aklog_main.c (but strip the trailing
whitespace), as that block was added with the akimpersonate code.

Remove all calls to afs_com_err() as is fitting for library code,
to let it build.  Do not bother removing curly braces which are
no longer needed; a future cleanup commit will catch that.
Clean up akimpersonate and use for server-to-server

Since a6d7cacfd, aklog has been able to print a krb5 ticket to
itself for an arbitrary client principal, allowing a user with
access to the cell's krb5 key to get tokens as an arbitrary user.

Now that it is possible to use native krb5 tickets with non-DES
enctypes for authentication, and akimpersonate is available from libauth,
use printed native krb5 tickets for server-to-server communication (as well
as the -localauth versions of the client utilities).

Remove the early call to afsconf_GetLatestKey() in
afsconf_PickClientSecObj() so that we do not end up picking an old DES
key before we try to find a better key to use.

Before doing so, refactor the akimpersonate code to be more usable
and readable, and eliminate some dead code.  For example, we always printed
addressless tickets, so that code could be removed.  Other code had excessive
stack usage for a library routine, which is eliminated.  Use a start time
of 0 instead of 300 so that the printed ticket will always be
detected as infinite-lifetime.

In order to ensure usability on all platforms (in particular Solaris),
provide a couple more compat shims to implement routines which are not
always available from the krb5 library, in particular encode_krb5_ticket
and encode_krb5_enc_tkt_part.  Thanks to Andrew Deason for implementing
these compatability routines.

UKERNEL doesn't need this stuff.
auth: Do not always fallback to noauth

Make afsconf_PickClientSecObj error out if we can't construct
localauth tokens (unless the caller explicitly requested rxnull
fallback). afsconf_ClientAuth{,Secure} still falls back, as always.
Avoid calling afsconf_GetLatestKey directly

Don't call afsconf_GetLatestKey to determine whether we can print our
own local tokens, since we may have keytab 'local' keys, but no DES
keys. Just try to construct them and see if it fails, using
afsconf_PickClientSecObj or afsconf_ClientAuth{,Secure} as
appropriate.
Reload rxkad.keytab on CellServDB modification

Make the reloading of rxkad.keytab keys occur in the same way that
KeyFile keys are reloaded. That is, we only try to reload them if the
CellServDB mtime has changed. This is intended to have exactly the
same reloading behavior as KeyFile reloads.

I would have triggered this from afsconf_Check, but that approach
has annoyances. (Calling ticket5_keytab functions directly from
cellconfig pulls in libkrb5 dependencies for everything that uses
cellconfig, and we'd have to trigger an afsconf_Check call by calling
some other cellconfig function.)

9102f49a3bdc67ed74e254349eb55b529472f45c
Add support for deriving DES keys to klog.krb5

(cherry picked from commit e79102e7918ce5196e870a806879135743ec3abb)

Change-Id: Ia7ebfdd10dcfd6cd164b10275016147630748bac
Make OpenAFS 1.6.5

Change-Id: I693297ef6e20358966930cb29116d45b9151811f
ubik: Fix encryption selection in ugen

Make sure that we encrypt when requested to by the application

Change-Id: If4c2ba2257bf060d3e9169ccdbcae54f54dfe5d7
Merge branch 'rxkad-kdf-1.6' into origin/openafs-stable-1_6_x

Merge the changes necessary for OpenAFS-SA-2013-003 and
OpenAFS-SA-2013-004 back into the stable branch.