Fix HP-UX build support

Rename hpux10.exports to hpux.exports.  In the HP-UX section of
shlib.conf, remove '+s' because it just specifies a default, add a
MAKE_SHLIB_COMMAND, and set SHLIBEXT based on the host CPU.

[ghudson@mit.edu: squashed commits, condensed commit message]

ticket: 7990 (new)
target_version: 1.13
tags: pullup
Fix test syntax in configure.in

Commits 1e4bdcfe and 8df1965d used the wrong test equality operator.
Some versions of test allow == for equality, but others (such as the
HP-UX version) do not.  Use a single = for correctness.

[ghudson@mit.edu: clarified commit message]

ticket: 7992 (new)
target_version: 1.13
tags: pullup
Autodetect OpenSSL CMS for LibreSSL compatibility

LibreSSL currently does not support CMS, so checking for CMS via
OPENSSL_VERSION_NUMBER isn't reliable.  Detect CMS support via
autoconf instead.

[ghudson@mit.edu: clarified commit message; minor style changes]

ticket: 7993 (new)
target_version: 1.13
tags: pullup
Simplify and improve ksu cred verification

When verifying the user's initial credentials, don't compute a server
name and preemptively obtain creds for it.  This change allows
krb5_verify_init_creds to use any host key in the keytab, and not just
the one for the canonicalized local hostname.

[ghudson@mit.edu: rewrote commit message]

ticket: 7996 (new)
target_version: 1.13
tags: pullup
kadm5_randkey_principal interop with Solaris KDC

When kadm5_randkey_principal is called on Solaris kadmind (as opposed
to kadm5_randkey_principal_3), the KDC assumes the peer is a Solaris 9
system, and only creates DES keys.

For better interoperability, always call kadm5_randkey_principal_3
first.  If this procedure is not present on the remote server, fall
back to calling kadm5_randkey_principal if possible.

[ghudson@mit.edu: adjusted comments, argument wrapping, commit
message]

ticket: 7997 (new)
target_version: 1.13
tags: pullup
cc_mslsa: Remove Windows NT "support"

We had some compatability shims to detect if the running system
was older than Windows 2000, that is, whether it was Windows NT.
Remove those checks, and the fallback behavior (which was to
fail early, gracefully).

The checks were effected by the is_windows_2000() function, which,
despite the name, was actually checking for whether the running
OS was windows 2000 *or newer*.  That is, it was checking for whether
this was some truly ancient system such as Windows 98 or the original
Windows NT.  Such systems have been unsupported for a very long time,
so there is no need to retain this check.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Remove Windows 2000 support

Windows 2000 is long-gone.  Remove the is_windows_xp() function
that was checking whether we were running on XP or any newer system
(that is, whether we were running on Windows 2000) and simplify
conditional code as appropriate.

De-indent chunks that are no longer conditional, and add a
set of braces to clarify the nested conditional.  Update the style
of modified chunks to match current practices.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Remove the unused is_windows_vista()

It appears to have never been used.  N.B. that current Microsoft
documentation recommends against using version checks to conditionalize
functionality.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Remove is_broken_wow64()

The issue worked around by this function would cause crashes at
runtime, as described by Microsoft's Article ID 960077.  That article
indicates that a hotfix was available, and it appears that that fix
has made it into a subsequent update for Windows Server 2003 SP2.
Since Windows XP SP2 is also listed as affected, I assume that

Since there are not believed to be any affected systems anymore,
it is safe to remove the workaround.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Remove does_retrieve_ticket_cache_ticket()

This helper queries (and caches) whether the
KERB_RETRIEVE_TICKET_CACHE_TICKET flag is supported in the
KERB_RETRIEVE_TKT_REQUEST structure.  The documentation of that
structure on MSDN states that the KERB_RETRIEVE_TICKET_CACHE_TICKET
flag is not available on Windows XP with SP1 and earlier, and
Windows Server 2003.  Those platforms are no longer supported
(most notably, there are newer service packs), so this code can
safely be removed.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Remove compiler support for winxp SP2

All supported systems will have these data structures; we can
use them unconditionally.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Remove PreserveInitialTicketIdentity()

It is unused.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: comment some impending cleanup

The function does_query_ticket_cache_ex2() will not be needed once
Windows Server 2003 drops out of support in approximately one year's
time.  Note the doom timer at its definition, to facilitate future
cleanup.

ticket: 7989
tags: pullup
target_version: 1.11.6
cc_mslsa: Remove unused function IsKerberosLogon()

There was one potential callsite, in lcc_resolve(), which
was disabled.  It is perfectly reasonable to want to use the
MSLSA cache on a non-domain-joined workstation, as it is now
a read-write cache type, so we need not concern ourselves whether
the logon was performed or may have been performed using kerberos.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Remove ENABLE_PURGING

It's been enabled for a long time.  We don't need to support
this anymore.
cc_mslsa: Remove debugging knob (?) PURGE_ALL

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Rename routines to avoid OS versions

We don't care about XP versus non-XP; just indicate which
revision of the data type is being used.

Standardize on the lowercase 'x' in "Ex", for both the "Ex" and
"Ex2" forms.

While here, adjust the function definition prototypes to match
current style.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Move realm conversion into helper

All the callers of UnicodeStringToMITPrinc() were already converting
a UnicodeString into a wchar* just to pass it in as the realm.

Simplify everyone's life by making the helper do the conversion.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Don't try to get a TGT in lcc_resolve()

We were only using it to get a client principal name, which can
be done using operations that require less privilege.

ticket: 7989
tags: pullup
target_version: 1.12.3
cc_mslsa: Don't get a TGT in get_principal

Use KERB_QUERY_TKT_CACHE_EX_RESPONSE for lcc_get_principal();
there's no real need to get a fully-fledged TGT, which is not
possible when UAC is enabled.

ticket: 7989
tags: pullup
target_version: 1.12.3