Remove dangling reference to $with_edirectory

Remove a reference to eDirectory that persisted after support for
eDirectory was removed.  Almost certainly harmless anyway.

[ghudson@mit.edu: also quote $with_ldap]
Remove some apparently-accidental debug whitespace
Fix checking unencrypted PKCS12: twice

The test, as submitted, included a copy/paste error which caused it to
test PKINIT using unencrypted PKCS12 bundles twice, and to not test a
DIR: location containing unencrypted PEM-formatted keys at all.
Fix a typo that caused us to not skip removing "."

When attempting to clean the files out from our temporary directory,
correct the test which was supposed to let us skip over "." and ".." so
that we actually don't try to remove them with remove().
Make reassembled PKCS11 names parseable

The reassembled names used "," as a separator between attributes, when
passed-in values use ":".  This was due to the original submitter being
confused - they weren't intended to be different.
Improve LDAP password file error messages

If we cannot open the LDAP password file or cannot find the bind DN in
it, include the filename and DN in the error message.

ticket: 7632
fix crypto openssl hmac warning

ticket: 7634
Add test case for CVE-2013-1416

ticket: 7635 (new)
Fix check for KDB: prefix in kinit

The string "KDB:" has four characters, not three; check for all four
of them.

[ghudson@mit.edu: commit message]

ticket: 7636
Fix type mismatch in db2_exp.c

The locking wrapper for audit_as_req used the wrong function
signature, which was harmless but produced a couple of warnings.  Fix
it.
Don't fail if a candidate certificate has no SANs

When we're doing certificate matching and we're asked for the list of
SAN values for a certifiate, and it contains none, don't return an
error, as that will eventually cause the module to just return an error.
Instead, just return an empty list of SAN values so that processing will
continue on to check if other certificates match.
Make the text of NSS's prompts look like OpenSSL's

When PKINIT is built with NSS, make the text of prompts that we issue to
the user better match the text we use when we build with OpenSSL: ask
for a pass phrase when we're asking about a hardware token, ask for a
password the rest of the time, and take advantage of translations for
requests for a password.
Only call SEC_PKCS12DecoderFinish() once

We already call SEC_PKCS12DecoderFinish() before entering the switch()
statement, so don't call it again.
Traverse tokens like we do with OpenSSL for NSS

When PKINIT is built with NSS, change how it traverses tokens to match
the way it's done when built using OpenSSL: ignore slot names (we used
to treat the token label as a possible slot label, too), and either only
look at the token with the specified label, or the first token if a no
token label was specified.
When DEBUG=1, log why we fail to log in to a token

Use PORT_ErrorToName() to let us print an error name instead of an error
code in a couple of debug messages, since in practice we just end up
looking up the code in <secerr.h> anyway.
In PKINIT NSS crypto code, load certificates first

When using NSS's CMS API to generate signed-data messages, we identify
the key that we want to use for signing by specifying a certificate.
The library then looks up the corresponding private key when it needs to
generate the signature.  This lookup fails if a certificate and a its
corresponding private key were loaded key-first, but succeeds if they
were loaded certificate-first (RHBZ#859535).  To work around this,
switch to loading the certificate first.  (We switch to using different
_pkinit_identity_crypto_file pointers for each instead of reusing just
one, so the diff is messier than it might have been.)
Get better at locating the just-loaded certificate

When loading certificates using the PEM module, use a better method for
finding the just-loaded certificate that will still work if we've
already got a copy of the certificate loaded somewhere else.
In PKINIT NSS crypto, support encrypted PEM keys

When the PEM module is given an encrypted key, it changes its token
flags to indicate that a password is required (by setting needs-login)
to signal the application that we need to supply a password to decrypt
it.  Attempts to load any other items will fail until the flag is
cleared.

If we detect that the flag is set after we've attempted to load a
private key, attempt to "log in" to the "token" using a password.  Even
if we fail, the token will reset its needs-login flag, which is
necessary before we can import anything else.
Fixes for leaking of refcounted resources

Some fixes, some use of different APIs which seem to clean things up
better, with the goal of being able to cleanly shut down NSS when we're
done using it.

* Use PK11_FreeSlot() instead of SECMOD_CloseUserDB() to close a
  database opened with SECMOD_OpenUserDB().
* Fix a typo and use PK11_DestroyGenericObject() instead of
  PK11_DestroyGenericObjects() to destroy one object.
* Use SECMOD_DestroyModule() instead of SECMOD_UnloadUserModule()
  to close a module loaded with SECMOD_LoadUserModule().
* crypto_check_for_revocation_information(): don't leak a reference
  to the CRL, or to intermediate issuers.
* Don't leak a reference to a PEM private key.
Fix kpasswd UDP ping-pong [CVE-2002-2443]

The kpasswd service provided by kadmind was vulnerable to a UDP
"ping-pong" attack [CVE-2002-2443].  Don't respond to packets unless
they pass some basic validation, and don't respond to our own error
packets.

Some authors use CVE-1999-0103 to refer to the kpasswd UDP ping-pong
attack or UDP ping-pong attacks in general, but there is discussion
leading toward narrowing the definition of CVE-1999-0103 to the echo,
chargen, or other similar built-in inetd services.

Thanks to Vincent Danen for alerting us to this issue.

CVSSv2: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:P/RL:O/RC:C

ticket: 7637 (new)
target_version: 1.11.3
tags: pullup