Remove pkinit_win2k_require_binding option

When constructing a draft9 PKINIT request, always include
KRB5_PADATA_AS_CHECKSUM padata to ask for an RFC 4556 ReplyKeyPack.
Do not accept a draft9 ReplyKeyPack in the KDC response.

For now, retain the krb5_reply_key_pack_draft9 ASN.1 codec and the KDC
support for generating a draft9 ReplyKeyPack when a draft9 PKINIT
request does not contain KRB5_PADATA_AS_CHECKSUM.

ticket: 7933
Update the kadm5.acl example

Make the example and documentation a closer match to reality.
In particular, the list permission is all-or-nothing; it is not
restricted in scope by the target_principal field.  Change the
table entry to try and indicate this fact, and do not put list
permissions on any example line that is scoped by a target_principal
pattern.

While here, remove the nonsensical granting of global inquire
permissions to */* (inaccurately described as "all principals"),
and the granting of privileges to foreign-realm principals.
It is not possible to obtain an initial ticket (as required by
the kadmin service) for a principal in a different realm, and
the current kadmind implementation can serve only a single realm
at a time -- this permission literally has no effect.  Replace
it with a (presumably automated) "Service Management System"
example, where it might make sense to limit the principals which
are automatically created.

ticket: 7939
Tidy up k5-int.h variable name constants

Fix three mismatched constant names, and properly alphabetize and
columnize the lists of definitions.  No functional changes.
Consolidate DB option documentation

Document DB options in the kadmin/kadmin.local man page, in their own
section.  Refer to that section from the documentation of the -x
parameter of each other command which supports DB options.  Add
documentation for the "dbname" DB2 option.

ticket: 7946 (new)
target_version: 1.12.2
tags: pullup
Fix error checking in PKINIT authdata creation

In create_identifiers_from_stack: check for allocation errors from
PKCS7_ISSUER_AND_SERIAL_new and M_ASN1_INTEGER_dup.  Use
PKCS7_ISSUER_AND_SERIAL_free to more concisely clean up the OpenSSL
issuer variable, and make sure that any partially processed value is
cleaned up on error.  Use calloc to allocate krb5_cas so that all of
its pointers are initially nulled, so that
free_krb5_external_principal_identifier can operate on it safely in
case of error.  Eliminate the retval variable as it was not used
safely.  Rename the error label from "cleanup" to "oom" and separate
it from the successful return path (which has nothing to clean up).

ticket: 7943 (new)
target_version: 1.12.2
tags: pullup
Fix unlikely null dereference in mk_cred()

If krb5_encrypt_keyhelper() returns an error, the ciphertext structure
may contain a non-zero length, but it will already have freed the
pointer to its data, making encrypt_credencpart()'s subsequent attempt
to clear and free the memory fail.  Remove that logic.

Based on a patch from Jatin Nansi.

ticket: 7948 (new)
target_version: 1.12.2
tags: pullup
Load plugins with RTLD_NODELETE if possible

On platforms which support RTLD_NODELETE, use it to load plugin
modules.  While using this flag makes plugins stay in the process map
after libkrb5/libgssapi_krb5 are unloaded, it solves several problems:

1. It prevents plugin modules which link against OpenSSL (PKINIT and
k5tls) from repeatedly initializing instances of libssl or libcrypto,
leaking heap memory each time.  This is only an issue because we
cannot safely uninitialize OpenSSL.

2. It prevents finalization ordering issues from causing a process
crash when unloading libgssapi_krb5 (issue #7135).

3. It makes memory leak tracing with valgrind easier.

ticket: 7947 (new)
Handle invalid RFC 1964 tokens [CVE-2014-4341...]

Detect the following cases which would otherwise cause invalid memory
accesses and/or integer underflow:

* An RFC 1964 token being processed by an RFC 4121-only context
  [CVE-2014-4342]

* A header with fewer than 22 bytes after the token ID or an
  incomplete checksum [CVE-2014-4341 CVE-2014-4342]

* A ciphertext shorter than the confounder [CVE-2014-4341]

* A declared padding length longer than the plaintext [CVE-2014-4341]

If we detect a bad pad byte, continue on to compute the checksum to
avoid creating a padding oracle, but treat the checksum as invalid
even if it compares equal.

CVE-2014-4341:

In MIT krb5, an unauthenticated remote attacker with the ability to
inject packets into a legitimately established GSSAPI application
session can cause a program crash due to invalid memory references
when attempting to read beyond the end of a buffer.

    CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C

CVE-2014-4342:

In MIT krb5 releases krb5-1.7 and later, an unauthenticated remote
attacker with the ability to inject packets into a legitimately
established GSSAPI application session can cause a program crash due
to invalid memory references when reading beyond the end of a buffer
or by causing a null pointer dereference.

    CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C

[tlyu@mit.edu: CVE summaries, CVSS]

ticket: 7949 (new)
subject: Handle invalid RFC 1964 tokens [CVE-2014-4341 CVE-2014-4342]
taget_version: 1.12.2
tags: pullup
Add tests for invalid GSSAPI per-message tokens

ticket: 7949