Don't warn or error on variadic macros

Our portability assumptions now allow the use of variadic macros, so
don't warn or error on them.

(cherry picked from commit d211001ba17fddfb952beb00118dc5c7e598355e)

ticket: 7702
version_fixed: 1.11.4
status: resolved
Fix GSSAPI krb5 cred ccache import

json_to_ccache was incorrectly indexing the JSON array when restoring
a memory ccache.  Fix it.

Add test coverage for a multi-cred ccache by exporting/importing the
synthesized S4U2Proxy delegated cred in t_s4u2proxy_krb5.c; move
export_import_cred from t_export_cred.c to common.c to facilitate
this.  Make a note in t_export_cred.py that this case is covered in
t_s4u.py.

(cherry picked from commit 48dd01f29b893a958a64dcf6eb0b734e8463425b)

ticket: 7723 (new)
version_fixed: 1.11.4
status: resolved
Change KRB5KDC_ERR_NO_ACCEPTABLE_KDF to 100

draft-ietf-krb-wg-pkinit-alg-agility-07 specifies
KDC_ERR_NO_ACCEPTABLE_KDF as 82, but this value conflicts with
KRB_AP_ERR_PRINCIPAL_UNKNOWN from RFC 6111.  The former value has been
reassigned to 100 to fix the conflict.  Use the correct value.

We believe that this error won't crop up in practice for a long time
(when SHA-2 has been superceded by other hash algorithms and people
are desupporting it), by which time implementations will mostly have
been upgraded to use the new value.

(cherry picked from commit 2938851a5ec77ab68bcd1f5cfd07991c7ccabea6)

ticket: 7724 (new)
version_fixed: 1.11.4
status: resolved
Use protocol error for PKINIT cert expiry

If we fail to create a cert chain in cms_signeddata_create(), return
KRB5KDC_ERR_PREAUTH_FAILED, which corresponds to a protocol code,
rather than KRB5_PREAUTH_FAILED, which doesn't.  This is also more
consistent with other error clauses in the same function.

(cherry picked from commit cd59782cb32b79e4001a86b0fe47af8b6275ef0c)

ticket: 7726 (new)
version_fixed: 1.11.4
status: resolved
Discuss cert expiry, no-key princs in PKINIT docs

In pkinit.rst, add "-days" options to the example commands for
creating certificate and briefly discuss the issue of expiration dates
so that the administrator thinks about it.  In troubleshoot.rst, add
an entry for the "certificate has expired" error which results from
PKINIT (when linked with OpenSSL) when a certificate has expired.

(cherry picked from commit f3977b6883f0172a2af9006522a1b35546f86749)

ticket: 7727 (new)
version_fixed: 1.11.4
status: resolved
Fix typos in kdb5_util master key command outputs

kdb5_util list_mkeys was beginning lines with "KNVO" instead of
"KVNO".  kdb5_util purge_mkeys was displaying "follwing" instead of
"following" for both dry-run and normal cases.

(cherry picked from commit 7fee58ccadf1b61eec9a8c62f47dac43986e2ad1)

ticket: 7734 (new)
version_fixed: 1.11.4
status: resolved
Use active master key in update_princ_encryption

kdb5_util update_princ_encryption should update to the active master
key version, not the most recent.

(cherry picked from commit 4ccc18bc3ddc49d0fd0d2de00ec91c0fa44c53a8)

ticket: 7735 (new)
version_fixed: 1.11.4
status: resolved
Correctly activate master keys in pre-1.7 KDBs

Starting with 1.7, databases are created with actkvno tl-data in the
K/M entry which gives the initial master key version an activation
time of 0.  A database created before 1.7 will not have this tl-data,
but we should behave in the same way as we do for a more recent
database.

Move the actkvno list synthesis code from krb5_dbe_fetch_act_key_list
to krb5_dbe_lookup_actkvno so it applies to kdb5_util commands as well
as libkadm5.  Synthesize the same list as we would have initialized
the KDB with, with an activation time of 0 for the earliest master
key.

(cherry picked from commit ec560fac83912abaa15fb158101c8174497081c5)

ticket: 7737 (new)
version_fixed: 1.11.4
status: resolved
Reset key-generation parameters for each enctype

In add_key_pwd, initialize s2k_params to NULL inside the loop over
enctypes instead of outside the loop, so that if the afs3 salt type
is used it does not contaminate later enctype/salt pairs in the list.

(cherry picked from commit 381cf01afb13ad28de0927de37f8e1d12749bf49)

ticket: 7742 (new)
version_fixed: 1.11.4
status: resolved
Fix decoding of mkey kvno in mkey_aux tl-data

krb5_dbe_lookup_mkey_aux was decoding a 16-bit value directly into an
int, resulting in the wrong value on big-endian platforms.  The
consequences are mostly invisible because we ignore this field and try
all mkey_aux nodes in krb5_def_fetch_mkey_list.

(cherry picked from commit 64ec2941af1561ef06e7e885b2ffb65a675516ce)

ticket: 7746 (new)
version_fixed: 1.11.4
status: resolved
Improve LDAP KDB initialization error messages

In krb5_ldap_initialize, don't just blat the LDAP error into the
extended message; give an indication of which LDAP operation we were
trying to do and show what parameters we gave to it.

(Also, krb5_set_error_message can handle a null context argument, so
don't bother to check before calling.)

(cherry picked from commit 5a77bb85294f37d1dfa4c7faedfdfb0d7faaf8dc)

ticket: 7747 (new)
version_fixed: 1.11.4
status: resolved
Document master key rollover

Add a new section to database.rst documenting the procedure for
rolling the master key.

(cherry picked from commit e4b5d426a1e1e00367cc44a9619535ab71b20393)

ticket: 7748 (new)
version_fixed: 1.11.4
status: resolved
Clarify kpropd standalone mode documentation

The kpropd -S option is no longer needed to run kpropd in standalone
mode, but its functionality is not deprecated; standalone mode is
automatically activated when appropriate.  Clarify the kpropd
documentation on standalone mode to avoid giving the impression that
the mode is deprecated.

(cherry picked from commit bfec0671ca6df811453d46a2f47afc7168b980fc)

ticket: 7752 (new)
version_fixed: 1.11.4
status: resolved
Multi-realm KDC null deref [CVE-2013-1418]

If a KDC serves multiple realms, certain requests can cause
setup_server_realm() to dereference a null pointer, crashing the KDC.

CVSSv2: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C

A related but more minor vulnerability requires authentication to
exploit, and is only present if a third-party KDC database module can
dereference a null pointer under certain conditions.

(back ported from commit 5d2d9a1abe46a2c1a8614d4672d08d9d30a5f8bf)

ticket: 7756 (new)
version_fixed: 1.11.4
status: resolved
Fix reference for trace logging

The documentation change in #7727 depends on missing link target for
the trace logging section in doc/admin/troubleshoot.rst.  Add it.

ticket: 7758 (new)
version_fixed: 1.11.4
status: resolved
Updates for krb5-1.11.4
Update for krb5-1.11.4-postrelease
Clarify realm and dbmodules configuration docs

In kdc_conf.rst, add examples showing how to configure a realm
parameter and a database parameter.  Document that the default DB
configuration section is the realm name, and use that in the example.
Move the db_module_dir description to the end of the [dbmodules]
documentation since it is rarely used and could confuse a reader about
the usual structure of the section.

(cherry picked from commit 689d769c10c53bd4fa40e82421c89b96cc86cbae)

ticket: 7762 (new)
version_fixed: 1.11.5
status: resolved
Fix use-before-init in two test programs

If krb5_init_context fails, use a null context for getting the error
message, not a context we haven't yet initialized.  Observed by David
Benjamin <davidben@mit.edu> using clang.

(cherry picked from commit 525eafc83a0fbe8f215b7749b5774d54468a19d1)

ticket: 7760
version_fixed: 1.11.5
status: resolved
Merge remote branch 'upstream/krb5-1.11' into krb5-1.11