Properly handle use_master in k5_init_creds_get

If we make multiple requests in an initial creds exchange, the
krb5_sendto_kdc call in k5_init_creds_get may flip the use_master
value from 0 to 1 if it detects that the response was from a master
KDC.  Don't turn this into a requirement for future requests during
the same exchange, or we may have trouble following AS referrals.
Reported by Sumit Bose.

(cherry picked from commit a12a5ddb9b932061bad7b83df058c7c6e2e4b044)

ticket: 7650
version_fixed: 1.11.4
status: resolved
Build with Visual Studio 2012

It's more aggressive about enforcing that keywords are not macros
in C++ mode, and has bumped the MFC version to 11.

Keep compatibility with older versions of Visual Studio, appropriately
conditionalized.

(cherry picked from commit 7bca89626e53f258397818a9b0d838a0a3e00f5b)

ticket: 7664
version_fixed: 1.11.4
status: resolved
Fix spin loop reading from KDC TCP socket

In the k5_sendto code for reading from a TCP socket, detect
end-of-stream when reading the length.  Otherwise we can get stuck in
an infinite loop of poll() and read().

[ghudson@mit.edu: commit message]

(back ported from commit 53e5c850e05f011e9e7f25c2032aec51d8b352a9)

ticket: 7508
version_fixed: 1.11.4
status: resolved
Install ccselect_plugin.h

The ccselect pluggable interface was added in release 1.10, but we
neglected to install its header file.

(back ported from commit a1933d02c87e9d78ddbc586d460028aabbd747cb)

ticket: 7671
version_fixed: 1.11.4
status: resolved
KDC null deref due to referrals [CVE-2013-1417]

An authenticated remote client can cause a KDC to crash by making a
valid TGS-REQ to a KDC serving a realm with a single-component name.
The process_tgs_req() function dereferences a null pointer because an
unusual failure condition causes a helper function to return success.

While attempting to provide cross-realm referrals for host-based
service principals, the find_referral_tgs() function could return a
TGS principal for a zero-length realm name (indicating that the
hostname in the service principal has no known realm associated with
it).

Subsequently, the find_alternate_tgs() function would attempt to
construct a path to this empty-string realm, and return success along
with a null pointer in its output parameter.  This happens because
krb5_walk_realm_tree() returns a list of length one when it attempts
to construct a transit path between a single-component realm and the
empty-string realm.  This list causes a loop in find_alternate_tgs()
to iterate over zero elements, resulting in the unexpected output of a
null pointer, which process_tgs_req() proceeds to dereference because
there is no error condition.

Add an error condition to find_referral_tgs() when
krb5_get_host_realm() returns an empty realm name.  Also add an error
condition to find_alternate_tgs() to handle the length-one output from
krb5_walk_realm_tree().

The vulnerable configuration is not likely to arise in practice.
(Realm names that have a single component are likely to be test
realms.)  Releases prior to krb5-1.11 are not vulnerable.

Thanks to Sol Jerome for reporting this problem.

CVSSv2: AV:N/AC:M/Au:S/C:N/I:N/A:P/E:H/RL:O/RC:C

(cherry picked from commit 3c7f1c21ffaaf6c90f1045f0f5440303c766acc0)

ticket: 7668
version_fixed: 1.11.4
status: resolved
Add test case for CVE-2013-1417

(back ported from commit f3328214a01fe9ca4de72cb9593ee10c39c638e9)

ticket: 7670
version_fixed: 1.11.4
status: resolved