Fix a memory leak in krb5_get_init_creds_keytab

lookup_etypes_for_keytab was not freeing the keytab entries it
iterated over.  Reported by nalin@redhat.com.

ticket: 7586
target_version: 1.11.2
tags: pullup
Simplify and clarify lookup_etypes_for_keytab
Fix dependencies in tests/gssapi

Use $(COMMON_DEPS) instead of $(COMMON_DEPLIBS) for dependencies; the
latter appears to be a typo.  Fixes build when using "make -j".

ticket: 7587 (new)
target_version: 1.11.2
tags: pullup
Add localauth pluggable interface

Add a new pluggable interface for local authorization, and replace the
existing krb5_aname_to_localname and krb5_kuserok implementations with
implementations based on the pluggable interface.

ticket: 7583 (new)
Add tests for localauth interface

Create a test module, program, and script to exercise the
krb5_aname_to_localname and krb5_k5userok functions as well as the
localauth pluggable interface.

ticket: 7583
Document localauth interface

ticket: 7583
Remove stray include in localauth_plugin.h

This unnecessary include was causing build failures on some systems by
making libkrb5 sources depend on gssapi.h.
Add support for k5srvutil -e keysalts

k5srvutil is a little more convenient to use for rolling keys than
kadmin is.  When migrating off 1DES, though, it may be desirable to
explicitly specify the desired keysalts.  This adds an option, -e, to
k5srvutil to specify desired keysalts.

[ghudson@mit.edu: style fix; make whitespace in keysalt list work]

ticket: 7589 (new)
Initialize status in krb5_ldap_parse_db_params

If db_args is non-null but empty, status could be returned without
being initialized; gcc with optimization correctly warns about this,
causing a build failure.  (This bug was introduced by
0b1dc2f93da4c860dd27f1ac997617b712dff383 which was pushed after the
1.11 release branch, so it isn't in any release.)
Fix use-before-init in two test programs

If krb5_init_context fails, use a null context for getting the error
message, not a context we haven't yet initialized.  Observed by David
Benjamin <davidben@mit.edu> using clang.
Allocate space for NUL byte in test code

Caught by ASan.
Fix condition with empty body

Found by clang's warnings.

ticket: 7591 (new)
target_version: 1.11.2
tags: pullup
Fix kadmin_getpol format string

Commit 0780e46fc13dbafa177525164997cd204cc50b51 matched a %ld format
string with the integer 0, which is an int rather than a long.  Just
put 0 in the format string instead.  Noted by David Benjamin
<davidben@mit.edu>.
Fix argument type in kg_unseal_v1

The caller of kg_unseal_v1 passes a gss_qop_t * for the qop_state
parameter, so make it use that type instead of an int *.  Noted by
David Benjamin <davidben@mit.edu>.
Eliminate unused variables
Add PEM password prompter callback in PKINIT

Supply a callack to PEM_read_bio_PrivateKey() using the prompter to
request a password for encrypted PEM data.  Otherwise OpenSSL will use
the controlling terminal.

[ghudson@mit.edu: minor style cleanup, commit message]

ticket: 7590
Reset ulog header if iprop load fails

If an iprop slave tries to load a dump from the master and it fails,
reset the ulog header so we take another full dump, instead of
reporting that the slave is current when it isn't.  Reported by
Richard Basch <basch@alum.mit.edu>.

ticket: 7588
target_version: 1.11.2
tags: pullup
Update shlib.conf for FreeBSD

FreeBSD has not emitted a.out binaries by default for a very long
time; elf is the standard.

Take sparc64 conditional for PICFLAGS from downstream.

Enable "new" dtags (supported since FreeBSD 5.0) -- this
prevents rpath entries in libraries from taking precedence over
LD_LIBRARY_PATH, useful for testing.
Documentation Copyrights notice dates: 1985-2013
Clean up getclhoststr in ipropd_svc.c

Based on a patch from Xi Wang <xi@mit.edu>.