Allow multi-hop SAM-2 exchanges

Prior to 1.11, it was possible to do SAM-2 preauth exchanges with
multiple hops by sending repeated preauth-required errors with
different challenges (which is not the way multi-hop exchanges are
described in RFC 6113, but it can still work).  This stopped working
when SAM-2 was converted to a built-in module.  Make it work again.

ticket: 7571 (new)
target_version: 1.11.1
tags: pullup
Fix memory leak closing DIR ccaches

A ccache type's close function is supposed to free the cache container
as well as the type-specific data.  dcc_close was not doing so,
causing a small memory leak each time a ccache is created or
destroyed.

ticket: 7574 (new)
target_version: 1.11.1
tags: pullup
Fix fd leak in DIR ccache cursor function

If dcc_ptcursor_next reached the end of a directory, it called free()
on the directory handle instead of closedir(), causing the directory
fd to be leaked.  Call closedir() instead.

ticket: 7573
target_version: 1.11.1
tags: pullup
Update acknowledgments in README

Also update copyright years.
Fix windows build

Catch up to the split of preauth_plugin.h into client and
kdc specific portions.  While here, use copy's /y flag to suppress
an override-confirmation prompt (though we do not list any dependencies
for this target at the moment, so no such prompt will be generated).

Do not disable library finalizers for windows, erroneously disabled
in 4538146e1452e0966164119cefb0804993ce6bbb.
Add missing .gitignore entries and clean rules

ticket: 7585
Add krb5_free_enctypes API

Rename krb5_free_ktypes to krb5_free_enctypes and add it to the public
API.

ticket: 7584
Fix a memory leak in krb5_get_init_creds_keytab

lookup_etypes_for_keytab was not freeing the keytab entries it
iterated over.  Reported by nalin@redhat.com.

ticket: 7586
target_version: 1.11.2
tags: pullup
Simplify and clarify lookup_etypes_for_keytab
Fix dependencies in tests/gssapi

Use $(COMMON_DEPS) instead of $(COMMON_DEPLIBS) for dependencies; the
latter appears to be a typo.  Fixes build when using "make -j".

ticket: 7587 (new)
target_version: 1.11.2
tags: pullup
Add localauth pluggable interface

Add a new pluggable interface for local authorization, and replace the
existing krb5_aname_to_localname and krb5_kuserok implementations with
implementations based on the pluggable interface.

ticket: 7583 (new)
Add tests for localauth interface

Create a test module, program, and script to exercise the
krb5_aname_to_localname and krb5_k5userok functions as well as the
localauth pluggable interface.

ticket: 7583
Document localauth interface

ticket: 7583
Remove stray include in localauth_plugin.h

This unnecessary include was causing build failures on some systems by
making libkrb5 sources depend on gssapi.h.
Add support for k5srvutil -e keysalts

k5srvutil is a little more convenient to use for rolling keys than
kadmin is.  When migrating off 1DES, though, it may be desirable to
explicitly specify the desired keysalts.  This adds an option, -e, to
k5srvutil to specify desired keysalts.

[ghudson@mit.edu: style fix; make whitespace in keysalt list work]

ticket: 7589 (new)
Initialize status in krb5_ldap_parse_db_params

If db_args is non-null but empty, status could be returned without
being initialized; gcc with optimization correctly warns about this,
causing a build failure.  (This bug was introduced by
0b1dc2f93da4c860dd27f1ac997617b712dff383 which was pushed after the
1.11 release branch, so it isn't in any release.)
Fix use-before-init in two test programs

If krb5_init_context fails, use a null context for getting the error
message, not a context we haven't yet initialized.  Observed by David
Benjamin <davidben@mit.edu> using clang.
Allocate space for NUL byte in test code

Caught by ASan.
Fix condition with empty body

Found by clang's warnings.

ticket: 7591 (new)
target_version: 1.11.2
tags: pullup
Fix kadmin_getpol format string

Commit 0780e46fc13dbafa177525164997cd204cc50b51 matched a %ld format
string with the integer 0, which is an int rather than a long.  Just
put 0 in the format string instead.  Noted by David Benjamin
<davidben@mit.edu>.