Enforce minimum PBKDF2 iteration count

Also add a testing interface to allow weak iteration counts.
(Published test vectors use weak iteration counts.)

(cherry picked from commit 7a7736a3ea321aeb4b281ae2712e27becb00d720)

ticket: 7465
version_fixed: 1.12
status: resolved
Set expiration time on keys and keyrings

By setting the timeout based on the credetial's timeout we let the
system automatically cleanup expired credentials.

[ghudson@mit.edu: simplified code slightly]

(cherry picked from commit 29e60c5b7ac0980606971afc6fd6028bcf0c7f0f)

ticket: 7769
version_fixed: 1.12
status: resolved
Add support to store time offsets in cc_keyring

The code follows the same model used for the memory ccache type.  Time
offsets are stored in each credential cache in a special key just like
the principal name.  Legacy session caches do not store timestamps as
legacy code would fail when iterating over the new offset key.

[ghudson@mit.edu: minor formatting changes; note legacy session
exception in commit message]

(cherry picked from commit fb4817a32d0c369049e0868468dd2eb75487630d)

ticket: 7768
version_fixed: 1.12
status: resolved
Remove dangling --with-kdc-kdb-update references

This configure option hasn't done anything since 1.8, so don't mention
it in configure --help or the documentation.  The disable_last_success
and disable_lockout DB options are now used to turn it off.

(cherry picked from commit 0b3225d63f50d4e6297be5d751cae1d3368fcdb1)

ticket: 7771 (new)
version_fixed: 1.12
status: resolved
Clarify lockout replication issues in docs

In the "KDC replication and account lockout" section of lockout.rst,
specifically call out kprop and incremental propagation as the
mechanisms which do not replicate account lockout state, and add a
note that KDCs using LDAP may not be affected by that section's
concerns.

(cherry picked from commit 8eb9e6fe1b01faa875dcf91b618ad4cd7793438a)

ticket: 7773
version_fixed: 1.12
status: resolved
Correct kadm5.acl back-reference documentation

In kadm5.acl, *N in the target principal name refers to the Nth
wildcard in the acting principal pattern, not the Nth component.

(cherry picked from commit 39bac22ed7f5ff583e92d082b34f0c5a2a3cad4c)

ticket: 7774
version_fixed: 1.12
status: resolved
Improve default ccache name API documentation

Document the lifetime and caching behavior of the
krb5_cc_default_name() return value.  Document that
krb5_cc_set_default_name() may be called with NULL to purge the cached
value.  Correct a typo in the krb5_cc_default() summary and explicitly
reference krb5_cc_default_name().

(cherry picked from commit 3e5fe754b9f9742d1c9b1564633d4172277166db)

ticket: 7775
version_fixed: 1.12
status: resolved
Added a new ccache doc to "Kerberos V5 concepts"

This is to add a short introductory document on credential
caches to the Concepts section of Kerberos documentation.

(cherry picked from commit 251f94621328277044e3ae1a10ecd3ddfdda1dbb)

ticket: 7776
Edit ccache_def.rst

Re-fill to 70 columns.  Replace non-ascii apostrophes with ASCII ones.
Edit wording slightly.

(cherry picked from commit 482869d393807d02668cf49ce74666d682cf77a6)

ticket: 7776
version_fixed: 1.12
status: resolved
Update doc for current kdb5_util dump version

kdb5_util.rst incorrectly describes the current default dump format
version as 6 when it should be 7.  Reported by Jeff D'Angelo.

(cherry picked from commit f0d7309a20665ac16a22856e0c8cffdb156f2d24)

ticket: 7777
version_fixed: 1.12
status: resolved
Add new versions of log_badauth gssrpc callbacks

libgssrpc supports two callbacks for gss_accept_sec_context failures
on servers (one for AUTH_GSS and one for AUTH_GSSAPI), which are
IPv4-specific.  Provide an alternate version which supplies the
transport handle instead of the address, so that we can get the
address via the file descriptor for TCP connections.

(cherry picked from commit 4c57a429760a3b3aa89938a13708742675f9548b)

ticket: 7770
Correctly log IPv6 addresses in kadmind

Define client_addr() in server_stubs.c and use it consistently in that
file and ipropd_svc.c to get the client address from a transport
handle.  In it, call getpeername() on the client socket and use
inet_ntop() on the result, instead of using inet_ntoa() on the IPv4
socket address.  Provide a log_badauth2 callback to GSSRPC, so that we
get a transport handle instead of an IPv4 socket address, and use
client_addr() within it instead of inet_ntoa().

(cherry picked from commit 5384f45e728957da20ecf82d8cf567945a2bbf6e)

ticket: 7770
version_fixed: 1.12
status: resolved
Bump libgssrpc minor version

Bump minor version for the new log_badauth2 interfaces.

(cherry picked from commit af5f5d63efe938c568a33bfb64ba5154982d6fb2)

ticket: 7770
status: resolved
Update man pages
Updates for krb5-1.12-beta2
Update for krb5-1.12-beta2-postrelease
Merge remote branch 'upstream' into krb5-1.12
Added facility to notify iprop slaves of pending updates.

When kadmin processes an iprop get_updates, the slave will be added to the
notification list. When a database update is processed, the slave will be
notified of pending updates (kprop will be spawned to signal the slave kpropd
vial the full kprop listener; that listener will then signal the iprop process
via USR1 to reset its timer to contact the master immediately).

In addition to the notification when an update is performed, kadmind will also
check for ulog updates every 1s (in case an update occured via kadmin.local or
other mechanisms, such as are used in the tree propagation patches).

No extensions were done to the "protocol", but older versions of kpropd which
do not understand the notification will merely potentially log a generic error
with the supplied error text which indicates there were pending ulog updates.