Fix spurious clock skew caused by gak_fct delay

In get_in_tkt.c, a time offset is computed between the KDC's auth_time
and the current system time after the reply is decrypted.  Time may
have elapsed between these events because of a gak_fct invocation
which blocks on user input.  The resulting spurious time offset can
cause subsequent TGS-REQs to fail and can also cause the end time of
the next AS request to be in the past (issue #889) in cases where the
old ccache is opened to find the default principal.

Use the system time, without offset, for the request time of an AS
request, for more predictable kinit behavior.  Use this request time,
rather than the current time, when computing the clock skew after the
reply is decrypted.

(cherry picked from commit 37b0e55e21926c7875b7176e24e13005920915a6)

ticket: 7610 (new)
version_fixed: 1.9.5
status: resolved
Don't return a host referral to the service realm

A host referral to the same realm we just looked up the principal in
is useless at best and confusing to the client at worst.  Don't
respond with one in the KDC.

(back ported from commit ee0d5eac353a13a194759b72cb44203fda1bf0fa)

(cherry picked from commit 745c0194ee93318cf4d44f6f8ccb7739523d448e)

ticket: 7609 (new)
version_fixed: 1.9.5
status: resolved
Ensure null termination of AFS salts

Use krb5int_copy_data_contents_add0 when copying a pa-pw-salt or
pa-afs3-salt value in pa_salt().  If it's an afs3-salt, we're going to
throw away the length and use strcspn in krb5int_des_string_to_key,
which isn't safe if the value is unterminated.

(cherry picked from commit f566fee75f2455d6e5e7ee4fcdf5a0d327808639)

ticket: 7611 (new)
version_fixed: 1.9.5
status: resolved
Make verify_init_creds work with existing ccache

As the file ccache implementation currently stands, we don't want to
turn off TC_OPENCLOSE on a file cache we're writing to, or it will be
opened read-only and stores to it will fail.  Reported by Russ
Allbery.

(cherry picked from commit 0ae663d35b7dcbf2c469ad0688a67f4d1c0e425e)

ticket: 7612 (new)
version_fixed: 1.9.5
status: resolved
Fail during configure if unable to find ar

Fail during configure time if the configure script can't locate the
"ar" program, instead of producing a delayed failure during build time
by running the "false" command.  Some Solaris releases have ar in
/usr/ccs/bin, which is not in the default path for some users.

(cherry picked from commit 2c990e6418cd7cee7ca178a3175b07ed6a01ffae)

ticket: 7613 (new)
version_fixed: 1.9.5
status: resolved