Use krb5_init_creds_context as clpreauth rock

The clpreauth rock had become a collection of alias pointers into the
init_creds context structure.  Get rid of it and just pass the context
(suitably casted) to clpreauth modules.  Simplify the signatures of
k5_preauth(), k5_preauth_tryagain(), process_pa_data(), and
fill_response_items() by referencing fields from the init_creds
context.

Since we can't use the non-nullity of rock->selected_preauth_type to
determine whether to record the selected preauth type, k5_preauth now
reports it in an output parameter, and get_in_tkt.c decides whether or
not to record it.
Add more formats to krb5_timestamp_to_sfstring

krb5_timestamp_to_string() can produce ambiguous dates.  The final
fallback, "%d/%m/%Y %R", contains a European order date format that
can be confused with a US date format.  Add some additional strftime()
format strings, including locale-dependent formats and some ISO 8601
formats.  Remove the hardcoded strftime() format that had an ambiguous
date order.

ticket: 7458
target_version: 1.11
tags: pullup
Delete timestamp_to_sfstring sprintf fallback

The final fallback for krb5_timestamp_to_sfstring() is an explicit
European date-order format string passed to sprintf().  This can be
confused with a conventional US date format.  Because we attempt to
build a strftime() replacement anyway, and we try passing some
unambiguous ISO 8601 date and time formats to strftime(), remove this
final fallback.

ticket: 7518 (new)
Fix DPRINT in ipropd_svc.c

cea0b28045b262b1098f17f17f78b2efbf89a6c1 contained an incorrect
definition of DPRINT.  Fix it.

[ghudson@mit.edu: commit message]

ticket: 7525 (new)
target_version: 1.11.1
tags: pullup
Fix gss_str_to_oid for OIDs with zero-valued arcs

gss_str_to_oid wasn't outputting any bytes for a zero-valued arc.  It
should output one byte with value 0.

[ghudson@mit.edu: commit message]

ticket: 7523 (new)
target_version: 1.11.1
tags: pullup
Fix a small memory leak in util_errmap

Calls to gssint_mecherrmap_map_errcode would result in calling
mecherror_copy with a zero-length mech OID, which would result in an
OID with 0 for length and malloc(0) for elements.  On platforms which
return non-null from malloc(0), gssint_mecherrmap_destroy() wouldn't
free the elements pointer.

Avoid calling malloc(0) and don't use the length field to decide
whether to free an elements pointer.
Fix gss_str_to_oid and gss_oid_to_str edge cases

Neither function correctly handled OIDs whose second arc exceeds 47
(theoretically possible if the first arc is 2).  gss_str_to_oid had
additional problems: it used scanf, it didn't consistently protect
against read overrun if the input buffer wasn't null-terminated, and
it could get confused by + or - characters in the first two arcs.  Fix
gss_oid_to_str and rewrite gss_str_to_oid.

Also add a test program.

ticket: 7524 (new)
Move krb5-config to new src/build-tools directory

In preparation for adding a bunch of pkg-config data files, move
krb5-config into a new source tree subdirectory containing tools we
provide as outputs to other build systems.
Install pkg-config data files

Add seven data files for pkg-config, corresponding to the five modules
supported by krb5-config.  For krb5 and krb5-gssapi, we also provide
mit- versions for callers desiring to distinguish between our
implementation and Heimdal's.

Based on a patch from Stef Walter <stefw@gnome.org>.

ticket: 7529 (new)
Fix initial call to svcraw_create

gssrpc raw services could not work because svcraw_create did not set
svcraw_private after allocating memory for it.

[ghudson@mit.edu: commit message, patch splitting]

ticket: 7534
Fix various result checks

Correct three cases where the wrong expression was checked to see if
an allocation function returned null.

[ghudson@mit.edu: commit message, patch splitting]

ticket: 7534
target_version: 1.11.1
tags: pullup
Remove dangling reference to $with_edirectory
Fix a compiler warning when checking for DH mode

As noted by others, and the compiler, rep->choice can't ever be set to
choice_pa_pk_as_rep_draft9_dhSignedData, so check for it in the correct
structure.
Avoid writing krbLastAdminUnlock during auditing

Try to avoid writing krbLastAdminUnlock when we're just doing auditing
in the KDC.  Because we know that kdb5_ldap_put_principal() only writes
the attribute when it's nonzero, we temporarily reset the value to make
sure that it isn't written.  This approach is a bit of a hack, but it
keeps the number of code paths affected by this change low.
Add an undocumented -x option for responder values

Add an undocumented -x option in the vein of the -X option, which
accepts question/answer pairs to be supplied by a responder callback.
Expected to only ever be useful for testing.
Add quick docs for KRB5_RESPONDER_QUESTION_PKINIT

Add some examples for KRB5_RESPONDER_QUESTION_PKINIT to the header
files.
Make the text of NSS's prompts look like OpenSSL's

When built with NSS, make the text of prompts that we issue to the user
better mirror the text we use when we build with OpenSSL.
Learn to prompt for passwords for PEM files

When we don't supply our own callback to PEM_read_bio_PrivateKey(), the
library uses its own, which interacts with the user via the controlling
terminal.  Here we provide a callback that calls the prompter instead.
Rename a couple of parameters for readability

We'll be adding another variable named "identity" later, to track the
name of the identity, so go ahead and give "label" and "id" names which
make it clearer that they're not identity names, but attributes of the
identity which were supplied by the caller.
Formatting fixup