Don't warn or error on variadic macros

Our portability assumptions now allow the use of variadic macros, so
don't warn or error on them.

(cherry picked from commit d211001ba17fddfb952beb00118dc5c7e598355e)

ticket: 7702
version_fixed: 1.11.4
status: resolved
Fix GSSAPI krb5 cred ccache import

json_to_ccache was incorrectly indexing the JSON array when restoring
a memory ccache.  Fix it.

Add test coverage for a multi-cred ccache by exporting/importing the
synthesized S4U2Proxy delegated cred in t_s4u2proxy_krb5.c; move
export_import_cred from t_export_cred.c to common.c to facilitate
this.  Make a note in t_export_cred.py that this case is covered in
t_s4u.py.

(cherry picked from commit 48dd01f29b893a958a64dcf6eb0b734e8463425b)

ticket: 7723 (new)
version_fixed: 1.11.4
status: resolved
Change KRB5KDC_ERR_NO_ACCEPTABLE_KDF to 100

draft-ietf-krb-wg-pkinit-alg-agility-07 specifies
KDC_ERR_NO_ACCEPTABLE_KDF as 82, but this value conflicts with
KRB_AP_ERR_PRINCIPAL_UNKNOWN from RFC 6111.  The former value has been
reassigned to 100 to fix the conflict.  Use the correct value.

We believe that this error won't crop up in practice for a long time
(when SHA-2 has been superceded by other hash algorithms and people
are desupporting it), by which time implementations will mostly have
been upgraded to use the new value.

(cherry picked from commit 2938851a5ec77ab68bcd1f5cfd07991c7ccabea6)

ticket: 7724 (new)
version_fixed: 1.11.4
status: resolved
Use protocol error for PKINIT cert expiry

If we fail to create a cert chain in cms_signeddata_create(), return
KRB5KDC_ERR_PREAUTH_FAILED, which corresponds to a protocol code,
rather than KRB5_PREAUTH_FAILED, which doesn't.  This is also more
consistent with other error clauses in the same function.

(cherry picked from commit cd59782cb32b79e4001a86b0fe47af8b6275ef0c)

ticket: 7726 (new)
version_fixed: 1.11.4
status: resolved
Discuss cert expiry, no-key princs in PKINIT docs

In pkinit.rst, add "-days" options to the example commands for
creating certificate and briefly discuss the issue of expiration dates
so that the administrator thinks about it.  In troubleshoot.rst, add
an entry for the "certificate has expired" error which results from
PKINIT (when linked with OpenSSL) when a certificate has expired.

(cherry picked from commit f3977b6883f0172a2af9006522a1b35546f86749)

ticket: 7727 (new)
version_fixed: 1.11.4
status: resolved