Use krb5_init_creds_context as clpreauth rock

The clpreauth rock had become a collection of alias pointers into the
init_creds context structure.  Get rid of it and just pass the context
(suitably casted) to clpreauth modules.  Simplify the signatures of
k5_preauth(), k5_preauth_tryagain(), process_pa_data(), and
fill_response_items() by referencing fields from the init_creds
context.

Since we can't use the non-nullity of rock->selected_preauth_type to
determine whether to record the selected preauth type, k5_preauth now
reports it in an output parameter, and get_in_tkt.c decides whether or
not to record it.
Add more formats to krb5_timestamp_to_sfstring

krb5_timestamp_to_string() can produce ambiguous dates.  The final
fallback, "%d/%m/%Y %R", contains a European order date format that
can be confused with a US date format.  Add some additional strftime()
format strings, including locale-dependent formats and some ISO 8601
formats.  Remove the hardcoded strftime() format that had an ambiguous
date order.

ticket: 7458
target_version: 1.11
tags: pullup
Delete timestamp_to_sfstring sprintf fallback

The final fallback for krb5_timestamp_to_sfstring() is an explicit
European date-order format string passed to sprintf().  This can be
confused with a conventional US date format.  Because we attempt to
build a strftime() replacement anyway, and we try passing some
unambiguous ISO 8601 date and time formats to strftime(), remove this
final fallback.

ticket: 7518 (new)
Fix DPRINT in ipropd_svc.c

cea0b28045b262b1098f17f17f78b2efbf89a6c1 contained an incorrect
definition of DPRINT.  Fix it.

[ghudson@mit.edu: commit message]

ticket: 7525 (new)
target_version: 1.11.1
tags: pullup
Fix gss_str_to_oid for OIDs with zero-valued arcs

gss_str_to_oid wasn't outputting any bytes for a zero-valued arc.  It
should output one byte with value 0.

[ghudson@mit.edu: commit message]

ticket: 7523 (new)
target_version: 1.11.1
tags: pullup
Fix a small memory leak in util_errmap

Calls to gssint_mecherrmap_map_errcode would result in calling
mecherror_copy with a zero-length mech OID, which would result in an
OID with 0 for length and malloc(0) for elements.  On platforms which
return non-null from malloc(0), gssint_mecherrmap_destroy() wouldn't
free the elements pointer.

Avoid calling malloc(0) and don't use the length field to decide
whether to free an elements pointer.
Fix gss_str_to_oid and gss_oid_to_str edge cases

Neither function correctly handled OIDs whose second arc exceeds 47
(theoretically possible if the first arc is 2).  gss_str_to_oid had
additional problems: it used scanf, it didn't consistently protect
against read overrun if the input buffer wasn't null-terminated, and
it could get confused by + or - characters in the first two arcs.  Fix
gss_oid_to_str and rewrite gss_str_to_oid.

Also add a test program.

ticket: 7524 (new)
Move krb5-config to new src/build-tools directory

In preparation for adding a bunch of pkg-config data files, move
krb5-config into a new source tree subdirectory containing tools we
provide as outputs to other build systems.
Install pkg-config data files

Add seven data files for pkg-config, corresponding to the five modules
supported by krb5-config.  For krb5 and krb5-gssapi, we also provide
mit- versions for callers desiring to distinguish between our
implementation and Heimdal's.

Based on a patch from Stef Walter <stefw@gnome.org>.

ticket: 7529 (new)
Fix initial call to svcraw_create

gssrpc raw services could not work because svcraw_create did not set
svcraw_private after allocating memory for it.

[ghudson@mit.edu: commit message, patch splitting]

ticket: 7534
Fix various result checks

Correct three cases where the wrong expression was checked to see if
an allocation function returned null.

[ghudson@mit.edu: commit message, patch splitting]

ticket: 7534
target_version: 1.11.1
tags: pullup
Document "first introduced version" in conf files

For the config options that were introduced starting from release 1.9,
specify the release number.
Fix void pointer arithmetic in oid_ops.c

When asserting that out has advanced the expected number of bytes in
generic_gss_str_to_oid, avoid adding to oid->elements, which is a void
pointer.  Instead subtract from out and compare.

ticket: 7524
Error on void pointer arithmetic with gcc

Add -Werror=pointer-arith to the gcc warning flags.  The equivalent
was added to the Solaris compiler flags in
2dc1ef4078acd7ca463a8eee2ef20de54e672f37 (r21886).
In MIT feature list doc update release number,refs
Update release numbers, refs in feature list doc

At the moment the latest release number is 1.11 and the  supported releases
are 1.10 and 1.9.
Also, update some references to the documents and fix typos.
Rename ccache configuration macros

KRB5_CONF_ prefix should be used for the krb5/kdc.conf parameters.
Use KRB5_CC_CONF_ prefix for cache configuration variables.
Stop loading policy for pw_expiration in LDAP

populate_krb5_db_entry() performs a subsidiary LDAP search to load the
password policy, which it uses to update the pw_expiration field.
This has some minimal value (it causes pw_expiration values in
principals to auto-update whenever the pw_max_life field of a policy
changes), but it's complicated, expensive, and inconsistent with the
DB2 back end.  Get rid of it.

ticket: 7535 (new)
Allow principals to refer to nonexistent policies

Stop using and maintaining the policy_refcnt field, and do not try to
prevent deletion of a policy which is still referenced by principals.
Instead, allow principals to refer to policy names which do not exist
as policy objects; treat those principals as having no associated
policy.

In the kadmin client, warn if addprinc or modprinc tries to reference
a policy which doesn't exist, since the server will no longer error
out in this case.

ticket: 7385
Consolidate policy tests into t_policy.py

Create a combined script for policy-related tests, and fold in the
existing lockout, password history, and allowed-keysalts tests.