Fix use-before-init in two test programs

If krb5_init_context fails, use a null context for getting the error
message, not a context we haven't yet initialized.  Observed by David
Benjamin <davidben@mit.edu> using clang.
Allocate space for NUL byte in test code

Caught by ASan.
Fix condition with empty body

Found by clang's warnings.

ticket: 7591 (new)
target_version: 1.11.2
tags: pullup
Fix kadmin_getpol format string

Commit 0780e46fc13dbafa177525164997cd204cc50b51 matched a %ld format
string with the integer 0, which is an int rather than a long.  Just
put 0 in the format string instead.  Noted by David Benjamin
<davidben@mit.edu>.
Fix argument type in kg_unseal_v1

The caller of kg_unseal_v1 passes a gss_qop_t * for the qop_state
parameter, so make it use that type instead of an int *.  Noted by
David Benjamin <davidben@mit.edu>.
Eliminate unused variables
Learn to prompt for passwords for PEM files

When we don't supply our own callback to PEM_read_bio_PrivateKey(), the
library uses its own, which interacts with the user via the controlling
terminal.  Here we provide a callback that calls the prompter instead.
Remove dangling reference to $with_edirectory
Formatting fixups
Avoid writing krbLastAdminUnlock during auditing

Try to avoid writing krbLastAdminUnlock when we're just doing auditing
in the KDC.  Because we know that kdb5_ldap_put_principal() only writes
the attribute when it's nonzero, we temporarily reset the value to make
sure that it isn't written.  This approach is a bit of a hack, but it
keeps the number of code paths affected by this change low.
Make reassembled PKCS11 names parseable

The reassembled names used "," as a separator between attributes, when
passed-in values use ":".  They weren't intended to be different, so
correct it.
Don't fail if a candidate certificate has no SANs

Don't return an error, which will eventually cause the module to just
return an error, if we don't find any SANs in the candidate certificate:
just return the empty list of values so that processing can continue on
to other certificates.
Add quick docs for KRB5_RESPONDER_QUESTION_PKINIT

Add some examples for KRB5_RESPONDER_QUESTION_PKINIT to the header
files.
Make the text of NSS's prompts look like OpenSSL's

When built with NSS, make the text of prompts that we issue to the user
better mirror the text we use when we build with OpenSSL.
Rename a couple of parameters for readability

We'll be adding another variable named "identity" later, to track the
name of the identity, so go ahead and give "label" and "id" names which
make it clearer that they're not identity names, but attributes of the
identity which were supplied by the caller.
Include an error name in one trace error message

When we fail to sign data, include the name of the library error if
we're built with debugging support.
Only call SEC_PKCS12DecoderFinish() once

We already call SEC_PKCS12DecoderFinish() before entering the switch()
statement, so don't call it again.  Failures to parse PKCS12 data due to
reasons other than not having a decryption password probably didn't end
well before now.
Split pkinit_identity_initialize into two phases

Split part of pkinit_identity_initialize() into a second piece named
pkinit_identity_prompt().  Have each piece pass a new boolean flag to
crypto_load_certs() to indicate if it should defer prompting for a
password or PIN for client identities.  Otherwise, it should go ahead
and use a prompter to prompt for that information.
Traverse tokens like we do with OpenSSL for NSS

When built with NSS, change our token traversal strategy to mimic the
way we do things when we're using OpenSSL: forget about slot names, and
only look at the specified token, or the first one if one isn't
specified.
Add support for tracking deferred identity prompts

Track a list of deferred identities, for which we want to prompt for
passwords or PINs, in pkinit_identity_crypto_context structures, along
with associated warnings.  These are opaque outside of
pkinit_crypto_openssl and pkinit_crypto_nss, so both need to provide
functions that can be called from elsewhere to populate and query the
lists.