Assume mutex locking cannot fail

Locking and unlocking a non-recursive mutex is a simple memory
operation and should not fail on any reasonable platform with correct
usage.  A pthread mutex can return EDEADLK on lock or EPERM on unlock,
or EINVAL if the mutex is uninitialized, but all of these conditions
would reflect serious bugs in the calling code.

Change the k5_mutex_lock and k5_mutex_unlock wrappers to return void
and adjust all call sites.  Propagate this change through
k5_cc_mutex_lock and k5_cc_mutex_unlock as well.
Fix NSS crypto back end for mutex changes

Adjust a stray k5_mutex_lock invocation in the NSS crypto back end
after 6350fd0c909d84c00200885e722cc902049ada05.
Fix windows build

Catch a few stragglers that missed the memo that k5_mutex_lock
cannot fail, and sprinkle some cc-int.h as needed.
Remove unused build system variables
Reduce boilerplate in makefiles

Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH,
SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be
specified in the common case.  Rename KRB5_RUN_ENV and KRB5_RUN_VARS
to RUN_SETUP (already the most commonly used name) and RUN_VARS.  Make
sure to use DEFINES for local defines (not DEFS).  Remove some other
unnecessary makefile content.
Try to use best DNS search functions in dnsglue.c

Create macros to declare a DNS search handle, initialize a handle,
perform a search, and destroy a handle.  On OS X, use the native
dns_open, dns_search, and dns_free functions, since using the res_*
interfaces may not contact the correct servers.  On systems with
res_ninit, use res_nclose if we don't have res_ndestroy.

Based on a patch by Nate Rosenblum.
Clarify that kdc.conf and krb5.conf are merged

These two files are merged into the profile for KDC applications
Fix transited handling for GSSAPI acceptors

The Acceptor Names project (#6855) extended krb5_rd_req so that it can
accept a "matching principal" in the server parameter.  If the
matching principal has an empty realm, rd_req_decoded_opt attempted to
do transited checking with an empty server realm.

To fix this, always reset server to req->ticket->server for future
processing steps if we decrypt the ticket using a keytab.
decrypt_ticket replaces req->ticket->server with the principal name
from the keytab entry, so we know this name is correct.

Based on a bug report and patch from nalin@redhat.com.

ticket: 7639
target_version: 1.11.3
tags: pullup
Clarify krb5_rd_req documentation

For the user-to-user case, document that callers should pass a server
principal to krb5_rd_req.  For the keytab case, more accurately
document which keytab keys are tried against the ticket.

ticket: 7641 (new)
target_version: 1.11.3
tags: pullup
Fix krb5_rd_req usage in user-to-user sample app

Pass the server principal to krb5_rd_req so it can do proper transited
checking.
Simplify crypto IOV helpers

Expand the concept of an IOV block state into a cursor which remembers
the IOV set being iterated over, the block size, and both input and
output positions.  Eliminate the no-copy inline block getter for now,
but provide helpers to grab contiguous chains of blocks from a cursor.
Also provide an inline helper to sum the total length of an iov chain.
Refactor AES, Camellia builtin enc providers

In preparation for AES-NI support, adjust the block encryption helpers
in the AES enc provider so that the cache is only touched by helpers,
and reframe the CTS operations in terms of CBC operations.  Change the
Camellia enc provider as well for consistency.
Add Intel AESNI assembly files

Add assembly files from the Intel AESNI Sample Library, version 1.2,
which implement AES encryption using AES-NI instructions.  Trailing
whitespace was removed.
Adjust AESNI sources for krb5 tree

Remove functions we don't need.  Add macros to redefine functions with
an appropriate namespace prefix.
Add AES-NI support on Linux

If yasm and cpuid.h are present on a Linux i686 or x64 system, compile
the modified Intel AES-NI assembly sources.  In the builtin AES enc
provider, check at runtime whether the CPU supports AES-NI
instructions and use the assembly functions if so.
Don't warn or error on variadic macros

Our portability assumptions now allow the use of variadic macros, so
don't warn or error on them.
Fix rc4 string-to-key on unterminated inputs

The internal UTF-8 to UCS-2 conversion functions did not properly
respect their length arguments, instead assuming that the input string
is terminated with a zero bytes.  As a result,
krb5int_arcfour_string_to_key could fail on unterminated inputs.  Fix
the underlying support functions to read their inputs only up to the
specified length.

ticket: 7643 (new)
Make empty passwords work via init_creds APIs

In the gak_data value used by krb5_get_as_key_password, separate the
already-known password from the storage we might have allocated to put
it in, so that we no longer use an empty data buffer to determine
whether we know the password.  This allows empty passwords to work via
the API.

Remove the kadm5 test which explicitly uses an empty password.

Based on a patch from Stef Walter.

ticket: 7642