Use gssalloc_malloc for GSS error tokens

In kg_accept_krb5, use gssalloc_malloc when allocating space for the
error token, since it will be freed with gssalloc_free.  Using malloc
can cause heap corruption on Windows.  This bug was masked by #1445
before 1.12.

ticket: 8024 (new)
target_version: 1.13.1
tags: pullup
Document that newer AFS supports stronger crypto

Modern OpenAFS releases support using encryption stronger than single
DES with Kerberos.  Update the documentation accordingly.

ticket: 7761
target_version: 1.13
tags: pullup
Separate ccache display and checking in klist

In klist, use separate functions to display a ccache and check its
status.  Also use a helper function to check if a credential's server
principal is the local krbtgt principal for the realm.
Improve klist check for expired cache

Make klist -s succeed for a cache which contains a non-expired
credential and no TGT cred.

ticket: 8022
Fix klist -A -s output

In show_all_ccaches, don't output newlines if status_only is set.
Add tests for klist -s
Better document how to verify PGP signature

Add text clarifying our unusual packaging of the PGP signature inside
a tar file.

ticket: 7927
target_version: 1.13
tags: pullup
Fix typo in doc for krb5_get_init_creds_keytab()

ticket: 7880
target_version: 1.13.1
tags: pullup
Update mitK5features.rst for 1.13
Parse "ktadd -norandkey" in remote kadmin client

The remote kadmin client would not parse the "-norandkey" option to
the ktadd subcommand, terminating option parsing and possibly causing
options to be interpreted as principal names.

ticket: 7962
target_version: 1.13.1
tags: pullup
Report output ccache errors getting initial creds

In init_creds_step_reply, if we get an error storing output
credentials, do set ctx->complete (since retrieving creds or times
will work at this point) but don't suppress the error code.

ticket: 8028 (new)
target_version: 1.13.1
tags: pullup
Add test for kinit output ccache error

ticket: 8028
Fix cursor leak in krb5_verify_init_creds

In copy_creds_except, call krb5_cc_end_seq_get so we don't leak the
ccache cursor.

ticket: 8029 (new)
target_version: 1.13.1
tags: pullup
Remove unused variables from kprop.c

Commit 29dee7d2cece615bec4616fa9b727e77210051db removed the
need for a ccache to hold the credentials used by the process,
but did not remove the ccname and ccache variables which became
unused as a result.
Make it easier to find ASN.1 codec functions

Expand out MAKE_CODEC macro invocations into MAKE_ENCODER and
MAKE_DECODER invocations, so that the defined function names appear in
the macro calls.  This makes it easier to find the function
definitions using grep, although one still has to look up the macro to
see what it does.
Remove length limit on PKINIT PKCS#12 prompt

Long pathnames can trigger the 128-byte prompt length limit in
pkinit_get_certs_pkcs12.  Use asprintf instead of snprintf.  Also
check the result of the prompter invocation.

ticket: 8011
target_version: 1.13.1
tags: pullup
Adjust asn1c test vector code for new asn1c

asn1c 0.9.22 added support for representing integers using unsigned
types if they have appropriate constraints.  This changes the
representation of RFC4120's UInt32 type from Integer_t to unsigned
long.  In make-vectors.c, this means we can use a static initializer
for kvno, and that the old method of calling asn_long2INTEGER doesn't
work.  Adjust make-vectors.c to assume the newer version of asn1c.
Remove KRB5_TC_OPENCLOSE handling in FILE ccache

Stop processing the KRB5_TC_OPENCLOSE flag in cc_file.c; always reopen
the file instead.  This will be replaced with more efficient cursor
handling.  Also remove some unused KRB5_TC_OPENCLOSE macros in scc.h.
Stop using KRB5_TC_OPENCLOSE

Since KRB5_TC_OPENCLOSE no longer does anything, stop setting it when
we iterate over ccaches.

ticket: 7804
Remove cc_file.c global lookup table

The FILE ccache type maintains a global reference-counted table of
handles, which is perhaps an imperfect workaround for POSIX
per-process file locks.  Remove this table, since we plan to maintain
read fds in cursors and use O_APPEND writes to render locking less
important.