Correct comments in ccselect_plugin.h

Some text mistakenly referred to password quality plugin.
Add GSSAPI IOV MIC functions

Add gss_get_mic_iov, gss_get_mic_iov_length, and gss_verify_mic_iov
functions, which work similarly to the corresponding IOV wrap
functions.  Add a new buffer type GSS_IOV_BUFFER_TYPE_MIC_TOKEN for
the destination buffer.

Most of the internal code for this was already present, and just
needed to be fixed up and adjusted to use the new buffer type for the
MIC token.

ticket: 7705 (new)
Document AEAD and IOV GSSAPI extensions
Release krb5-1.9 is not supported anymore

Release 1.9.5 was the last planned release for the krb5-1.9 series.
Use macros instead of magic numbers in json.c

Avoid using "magic numbers" for better maintainability.
Fix literal blocks in gssapi.rst

Some literal blocks in the new AEAD and IOV documentation in
gssapi.rst started with ":" instead of "::", causing documentation
build errors.
Err codes in KRB_ERROR protocol messages are < 128

If the error code is out of [0,127] range, assign it to KRB_ERR_GENERIC.
This fix is to correct the previous behavior with [0,128] range.
For more information see  krb5_err.et
Re-factoring of service processing code in AS-REQ

Take one step toward re-factoring of the KDC code:
keep the service principal related code in one place.

The code pattern was changed from:
   - unparse client -
   - unparse service -
   - db_get_ client -
   - client referrals -
   - db_get_ service -
   - validate policies etc
into:
   - unparse client -
   - db_get_ client -
   - client referrals -
   - unparse service -
   - db_get_ service -
   - validate policies etc
Factor out krb5int_random_string() routine

Make krb5int_random_string() function available outside ccache code.
Move it into a separate file under lib/krb5/krb hierarchy.
Add ccache collection tests using API

Create a new test program in lib/krb5/ccache named t_cccol.c which
verifies collection semantics using the API.  Run it with an empty DIR
collection in t_cccol.py.
Support authoritative KDB check_transited methods

In kdc_check_transited_list, consult the KDB module first.  If it
succeeds, treat this as authoritative and do not use the core
transited mechanisms.  Modules can return KRB5_PLUGIN_NO_HANDLE to
fall back to core mechanisms.

ticket: 7709
Improve kinit output credential cache selection

If kinit chooses a client principal based on anything other than the
current default ccache's principal name, apply collection rules if
possible.  When applying collection rules, if we don't find an
existing cache for the client principal, use the default cache if it
is uninitialized, instead of creating a new one.

ticket: 7689
Add "which" function to k5test

Add a utility function in k5test.py to look for a command in the
executable path, and remove it from t_kdb.py.
Defer KEYRING key creation until initialize

If we resolve a KEYRING cache and the key does not exist, wait until
initialize time to create it, to avoid wasting precious kernel memory
on a cache which might not ever be created.  Properly error out if
store_cred or start_seq_get is called on an uninitialized cache, as we
would for a FILE cache.

Adapted from a patch by simo@redhat.com.
Clarify variable names in cc_keyring.c

Consistently use "cache_name" and "cache_id" to talk about the name
and ID of the keyring containing the cache.  In krb5_krcc_resolve, use
"residual" for the residual string as we are no longer using it for
the cache keyring name, and use "anchor_id" for the keyring identified
by the prefix to make it clear that it is not the cache keyring.

Adapted from a patch by simo@redhat.com.
Add collection support for KEYRING ccache type

Augment the KEYRING ccache type to support collection semantics
similar to those of the DIR type.  For keyrings with no anchor prefix,
maintain compatibility with old code by linking the initial primary
cache directly from the session keyring and naming it after the
collection.

See http://k5wiki.kerberos.org/wiki/Projects/Keyring_collection_cache
for more information.  Adapted from a patch by simo@redhat.com.

ticket: 7711 (new)
Support new KEYRING anchor names and big_key keys

Add support for the new anchor names persistent, user, and session.
The persistent anchor attempts to use a persistent keyring for a
specified uid, and falls back to the user keyring if it cannot; the
collection is stored at a fixed name within the persistent or user
keyring.  The session anchor uses the session keyring without legacy
semantics.

For all keyring types except legacy, attempt to use the "big_key" key
type on systems which have keyctl_get_persistent.  (They are
essentially unrelated features, but were added at the same time.)
This key type is stored in a kernel tmpfs and can store larger
tickets.

Since kernel commit 96b5c8fea6c0861621051290d705ec2e971963f1, new keys
created by add_key() only have VIEW permission for the user, and the
rest of the permissions require "possession," which means there is a
path from the thread, process, or session keyring to the key.  For the
user and persistent anchor types, we link the collection into the
process keyring to ensure that we have a possession rights on the
collection.

Adapted from a patch by simo@redhat.com.

ticket: 7711
Conditionally test KEYRING ccache type

If the keyctl command is found and klist recognizes the KEYRING
credential cache type, then run several tests against keyring ccaches:
the collection test program in lib/krb5/ccache, the command-line
collection tests in tests/t_ccache.py, and some new tests to verify
legacy session cache behavior.  Much of the Python code in t_ccache.py
is moved into a new function named "collection_test" so we can run it
once against a DIR collection and once against a KEYRING collection.

Also: fix a memory leak in the collection test program; add a test for
iteration when the default cache name is a subsidiary name; use a
process keyring ccache in t_cc.c to avoid leaving behind empty
collections in the session keyring after each test run.

Adapted from a patch by simo@redhat.com.

ticket: 7711
Add an internal constant-time comparison function

k5_bcmp acts similarly to the deprecated Unix bcmp() function,
returning zero if two memory regions are equal and nonzero if they are
not.  It is implemented such that it should take the same amount of
time regardless of how many bytes are equal within the memory regions.
Use constant-time comparisons for checksums