Update the Copyright year to 2012-2013
Fix no_host_referral concatention in KDC

If no_host_referral is set in both [kdcdefaults] and the realm
subsection, we're supposed to concatenate their values.  But the logic
in handle_referral_params would overwrite the value with the
non-concatenated realm value.  Similar bugs of this nature were fixed
in 639c9d0f5a7c68dc98a2a452abc05ca32443cddf (r22037) but this one was
missed.

ticket: 7539 (new)
target_version: 1.11.1
tags: pullup
Clean up k5_locate_server error handling

profile_get_values() cannot return success with an empty list of
values, so don't bother counting them.  Return 0 from
locate_srv_conf_1 if no profile values exist and from
dns_locate_server if we decide not to make a SRV query.  Adjust
k5_locate_server to match the new helper behavior, and return
KRB5_REALM_UNKNOWN if neither profile nor DNS come up with any answers
(not KRB5_REALM_CANT_RESOLVE, which doesn't make sense now that we're
deferring KDC hostname resolution).
Add k5test support for KDC special environments

Accept environment parameters in the K5Realm start_kdc and
start_kadmind methods, so that krb5kdc or kadmind can be started or
restarted with a modified configuration.
Test KDC host-based referral support

Test the KDC host-based referral support in t_referral.py, using a new
harness to call krb5_get_credentials with a specified server name
type.  Also use this new harness for the #7483 regression test, to
avoid relying on an undocumented kvno extension.
Remove manual kdc_realm tests
Test multi-value host referral variables

host_based_services and no_host_referral are allowed to have multiple
relations in each place they appear, so alter a couple of the test
cases to exercise that.
Simplify KDC host referral code

Remove some unnecessary optimizations to reduce code complexity.  Get
rid of krb5_match_config_pattern in favor of a simpler helper function
in do_tgs_req_c.  Get rid of KRB5_CONF_ASTERISK and just use "*"
instead.  Use a helper function to combine [kdcdefaults] and realm
subsection values of variables, and don't bother adding leading and
trailing spaces.  Consistently use the names "hostbased" and
"no_referral" to refer to variable values (with a "realm_" prefix for
structures which currently use it).
Remove dangling reference to $with_edirectory
Fix a compiler warning when checking for DH mode

As noted by others, and the compiler, rep->choice can't ever be set to
choice_pa_pk_as_rep_draft9_dhSignedData, so check for it in the correct
structure.
Avoid writing krbLastAdminUnlock during auditing

Try to avoid writing krbLastAdminUnlock when we're just doing auditing
in the KDC.  Because we know that kdb5_ldap_put_principal() only writes
the attribute when it's nonzero, we temporarily reset the value to make
sure that it isn't written.  This approach is a bit of a hack, but it
keeps the number of code paths affected by this change low.
Add an undocumented -x option for responder values

Add an undocumented -x option in the vein of the -X option, which
accepts question/answer pairs to be supplied by a responder callback.
Expected to only ever be useful for testing.
Add quick docs for KRB5_RESPONDER_QUESTION_PKINIT

Add some examples for KRB5_RESPONDER_QUESTION_PKINIT to the header
files.
Make the text of NSS's prompts look like OpenSSL's

When built with NSS, make the text of prompts that we issue to the user
better mirror the text we use when we build with OpenSSL.
Learn to prompt for passwords for PEM files

When we don't supply our own callback to PEM_read_bio_PrivateKey(), the
library uses its own, which interacts with the user via the controlling
terminal.  Here we provide a callback that calls the prompter instead.
Rename a couple of parameters for readability

We'll be adding another variable named "identity" later, to track the
name of the identity, so go ahead and give "label" and "id" names which
make it clearer that they're not identity names, but attributes of the
identity which were supplied by the caller.
Formatting fixup
Include an error name in one trace error message

When we fail to sign data, include the name of the library error if
we're built with debugging support.
Only call SEC_PKCS12DecoderFinish() once

We already call SEC_PKCS12DecoderFinish() before entering the switch()
statement, so don't call it again.  Failures to parse PKCS12 data due to
reasons other than not having a decryption password probably didn't end
well before now.
Use different variables for PEM keys and certs

Use different variables to hold the generic object pointers for
certificates and private keys when we load them, so that we don't lose
track of the certificate while we attempt to load the key.