Load cred store functions from GSS modules

When the credential store feature was implement the related functions
were added to struct gss_config, but the initialization function that
dynamically loads modules was not changed to see if the plugin being
loaded provided such functions.

This will allow non-builtin mechanism and interposer mechanism to
implement custom credential store extensions if they wish.

ticket: 7682
Load import/export cred functions from GSS modules

When the import/export credential feature was implement the related
functions were added to struct gss_config, but the initialization
function that dynamically loads modules was not changed to see if
the plugin being loaded provided such functions.

This will allow non-builtin mechanism and interposer mechanism to
implement custom import/export credential extensions if they wish.

ticket: 7682
Don't ask empty responder questions in PKINIT

When putting together the set of identity prompts for a responder
challenge, if we don't need a PIN or password of some kind, don't ask
an empty question.

[ghudson@mit.edu: squashed commits, modified commit message, merged
PKCS11 test with current Python script]
Add base64 functions to libkrb5support exports

This was previously not an issue because nothing outside of
libkrb5support used them.
Remove is_udp field in sendto_kdc.c conn_state

This field is redundant with addr.type.

[ghudson@mit.edu: removed extraneous changes; clarified commit
message]
Remove old comments in sendto_kdc.c

The commented code in question is present in set_conn_state_msg_length
which is called immediately after the comments.

[ghudson@mit.edu: clarified commit message]
Don't reopen the KDB in update_princ_encryption

kdb5_util update_princ_encryption iterates over the KDB and writes
modified entries.  With the DB2 back end, the first write operation
has to upgrade the lock and reopen the DB, which resets the cursor
state.  Take out an explicit write lock before iterating to avoid this
step.

ticket: 7684 (new)
Document krb5_db_iterate restriction on writing
Fix leak in krb5_krcc_unparse_cred on error

Based on a patch from simo@redhat.com.
Remove unused function arguments in cc_keyring.c

The credential serialization functions do not operate on a ccache, so
do not need it as an argument.

[ghudson@mit.edu: clarified commit message, rewrapped shortened lines]
Correct an error in kdb.h comments

The check_policy functions return com_err codes, not protocol codes,
so use a com_err constant in the example.
Update config.guess and config.sub

Copy in the latest config.guess and config.sub from upstream git
master as of 2013-07-26 (revision 79c4c50fc754d742286706b4db5ed8ce2a0de925).
Our previous version didn't recognize arm64.

Reported as Debian bug 717840.

ticket: 7683 (new)
tags: pullup
target_version: 1.11.4
Report KDC response sizes in trace logs
Fix gss_krb5_set_allowable_enctypes for acceptor

The acceptor implementation of gss_krb5_set_allowable_enctypes (added
in 1.9.1) is intended to restrict the acceptor subkey negotiated by
krb5_rd_req().  It uses the same approach as the initiator, calling
krb5_set_default_tgs_enctypes on the context.  This has the unwanted
side effect of restricting the encryption key of the ticket, because
krb5_decrypt_tkt_part has checked krb5_is_permitted_enctype on the
ticket encryption key since 1.8.

Instead, use krb5_auth_con_setpermetypes on the auth context.  This
list is only used for session key enctype negotiation.  Also add
automated tests to verify that gss_krb5_set_allowable_enctypes works
as desired.

ticket: 7688 (new)
target_version: 1.11.4
tags: pullup
Add trace logging for TXT lookups

Rename krb5_try_realm_txt_rr (an internal function despite the name)
and add a context parameter.  Generate trace logs when we successfully
look up a record and when a record is not found.
Actually build t_enctypes

Commit 2e956074b228ff4df3b7462037ab69e4e88ffffe omitted adding a
dependency to the "all" target to force the build of the t_enctypes
test program.

ticket: 7688
Fix localauth memory leak

localauth modules were not freed by krb5_free_context(), causing a
memory leak.
Remove redundant domain_realm mappings

This fixes a long-standing documentation bug where we claimed that
a domain_realm mapping for a host name would not affect entries
under that domain name.  The code has always had the behavior where
a host name mapping implies the corresponding domain name mapping,
since the 1.0 release.

While here, replace media-lab with csail in example files, as the
media lab realm is no longer in use.  Also strip port 88 from KDC
specifications, and drop the harmful default_{tgs,tkt}_enctypes
lines from src/util/profile/krb5.conf.

Further cleanup on these files to remove defunct realms may be in order.

ticket: 7690 (new)
tags: pullup
target_version: 1.11.4
Fix windows build

This routine is now used in the gssapi library and must be exported
as such.

ticket: 7688
Remove KRB5_DNS_LOOKUP_KDC

It has been unconditionally activated by all supported build systems
for almost two years, and no complaints or issues have been reported.
In particular, aclocal.m4 has had an unconditional AC_DEFINE() since
3d708e55 in 2003, and win-pre.in has unconditionally set KRB5_USE_DNS_KDC
since 17ffebf7 in 2011.

While here, simplify some other DNS conditionals in win-pre.in where
only one branch was ever taken.

ticket: 7691 (new)