Don't reopen the KDB in update_princ_encryption

kdb5_util update_princ_encryption iterates over the KDB and writes
modified entries.  With the DB2 back end, the first write operation
has to upgrade the lock and reopen the DB, which resets the cursor
state.  Take out an explicit write lock before iterating to avoid this
step.

ticket: 7684 (new)
Document krb5_db_iterate restriction on writing
Fix leak in krb5_krcc_unparse_cred on error

Based on a patch from simo@redhat.com.
Remove unused function arguments in cc_keyring.c

The credential serialization functions do not operate on a ccache, so
do not need it as an argument.

[ghudson@mit.edu: clarified commit message, rewrapped shortened lines]
Correct an error in kdb.h comments

The check_policy functions return com_err codes, not protocol codes,
so use a com_err constant in the example.
Update config.guess and config.sub

Copy in the latest config.guess and config.sub from upstream git
master as of 2013-07-26 (revision 79c4c50fc754d742286706b4db5ed8ce2a0de925).
Our previous version didn't recognize arm64.

Reported as Debian bug 717840.

ticket: 7683 (new)
tags: pullup
target_version: 1.11.4
Report KDC response sizes in trace logs
Fix gss_krb5_set_allowable_enctypes for acceptor

The acceptor implementation of gss_krb5_set_allowable_enctypes (added
in 1.9.1) is intended to restrict the acceptor subkey negotiated by
krb5_rd_req().  It uses the same approach as the initiator, calling
krb5_set_default_tgs_enctypes on the context.  This has the unwanted
side effect of restricting the encryption key of the ticket, because
krb5_decrypt_tkt_part has checked krb5_is_permitted_enctype on the
ticket encryption key since 1.8.

Instead, use krb5_auth_con_setpermetypes on the auth context.  This
list is only used for session key enctype negotiation.  Also add
automated tests to verify that gss_krb5_set_allowable_enctypes works
as desired.

ticket: 7688 (new)
target_version: 1.11.4
tags: pullup
Add trace logging for TXT lookups

Rename krb5_try_realm_txt_rr (an internal function despite the name)
and add a context parameter.  Generate trace logs when we successfully
look up a record and when a record is not found.
Actually build t_enctypes

Commit 2e956074b228ff4df3b7462037ab69e4e88ffffe omitted adding a
dependency to the "all" target to force the build of the t_enctypes
test program.

ticket: 7688
Fix localauth memory leak

localauth modules were not freed by krb5_free_context(), causing a
memory leak.
Remove redundant domain_realm mappings

This fixes a long-standing documentation bug where we claimed that
a domain_realm mapping for a host name would not affect entries
under that domain name.  The code has always had the behavior where
a host name mapping implies the corresponding domain name mapping,
since the 1.0 release.

While here, replace media-lab with csail in example files, as the
media lab realm is no longer in use.  Also strip port 88 from KDC
specifications, and drop the harmful default_{tgs,tkt}_enctypes
lines from src/util/profile/krb5.conf.

Further cleanup on these files to remove defunct realms may be in order.

ticket: 7690 (new)
tags: pullup
target_version: 1.11.4
Fix windows build

This routine is now used in the gssapi library and must be exported
as such.

ticket: 7688
Remove KRB5_DNS_LOOKUP_KDC

It has been unconditionally activated by all supported build systems
for almost two years, and no complaints or issues have been reported.
In particular, aclocal.m4 has had an unconditional AC_DEFINE() since
3d708e55 in 2003, and win-pre.in has unconditionally set KRB5_USE_DNS_KDC
since 17ffebf7 in 2011.

While here, simplify some other DNS conditionals in win-pre.in where
only one branch was ever taken.

ticket: 7691 (new)
Add hostrealm pluggable interface definition

ticket: 7687 (new)
Use hostrealm interface for realm mapping

Reimplement krb5_get_host_realm, krb5_get_fallback_host_realm, and
krb5_get_default_realm in terms of the hostrealm interface.  Three
built-in modules (dns, domain, and profile) implement the current
behavior.

ticket: 7687
Move utility functions to hostrealm.c

Move the remaining internal functions from hst_realm.c to hostrealm.c,
and get rid of hst_realm.c.

ticket: 7687
Add hostrealm interface tests

Create a test module for the hostrealm interface, a harness to call
the realm mapping functions and display their results, and a Python
script to exercise the functionality of the interface and each module
(except the dns module, which we cannot easily test since it relies on
TXT records in the public DNS).

ticket: 7687
Document hostrealm interface

ticket: 7687
Use dry-run unparses in keyring ccache

Support credentials larger than 4K in cc_keyring.c by calculating the
payload size in one pass, allocating a buffer of precisely the right
size, and then unparsing into that buffer.

[ghudson@mit.edu: squashed two commits; rewrote message; added length
field instead of doing pointer arithmetic on null pointers; used
proper English comments and clarified what code they apply to.]