Fix HP-UX build support

Rename hpux10.exports to hpux.exports.  In the HP-UX section of
shlib.conf, remove '+s' because it just specifies a default, add a
MAKE_SHLIB_COMMAND, and set SHLIBEXT based on the host CPU.

[ghudson@mit.edu: squashed commits, condensed commit message]

ticket: 7990 (new)
target_version: 1.13
tags: pullup
Fix test syntax in configure.in

Commits 1e4bdcfe and 8df1965d used the wrong test equality operator.
Some versions of test allow == for equality, but others (such as the
HP-UX version) do not.  Use a single = for correctness.

[ghudson@mit.edu: clarified commit message]

ticket: 7992 (new)
target_version: 1.13
tags: pullup
Autodetect OpenSSL CMS for LibreSSL compatibility

LibreSSL currently does not support CMS, so checking for CMS via
OPENSSL_VERSION_NUMBER isn't reliable.  Detect CMS support via
autoconf instead.

[ghudson@mit.edu: clarified commit message; minor style changes]

ticket: 7993 (new)
target_version: 1.13
tags: pullup
Simplify and improve ksu cred verification

When verifying the user's initial credentials, don't compute a server
name and preemptively obtain creds for it.  This change allows
krb5_verify_init_creds to use any host key in the keytab, and not just
the one for the canonicalized local hostname.

[ghudson@mit.edu: rewrote commit message]

ticket: 7996 (new)
target_version: 1.13
tags: pullup
kadm5_randkey_principal interop with Solaris KDC

When kadm5_randkey_principal is called on Solaris kadmind (as opposed
to kadm5_randkey_principal_3), the KDC assumes the peer is a Solaris 9
system, and only creates DES keys.

For better interoperability, always call kadm5_randkey_principal_3
first.  If this procedure is not present on the remote server, fall
back to calling kadm5_randkey_principal if possible.

[ghudson@mit.edu: adjusted comments, argument wrapping, commit
message]

ticket: 7997 (new)
target_version: 1.13
tags: pullup
Make randkey update principal mkvno

In kadm5_randkey_principal_3, after updating the principal's keys,
update its mkvno tl-data to indicate the master key version we
encrypted the new keys with.

ticket: 7994
target_version: 1.13
tags: pullup
Add test case for randkey mkvno update

ticket: 7994
Export gssrpc_bindresvport_sa

It was added in commit 0d04b60d159ab83b943e43802b1449a3b074bc83, but
was not added to the library export symbol list, and thus was unusable
on systems that enforced library export lists.

ticket: 8003 (new)
tags: pullup
target_version: 1.13
Map .hin files to the C language for doxygen

In Debian unstable, the current version of doxygen is unhappy with
our generated Doxyfile, and does not handle krb5.hin in the expected
fashion (as a C header).  Work around this issue by explicitly
specifying that files with the .hin extension are to be treated
as C language files.

ticket: 8004 (new)
tags: pullup
target_version: 1.13
Initialize iterflags in update_princ_encryption

It is only assigned to in the non-dry-run case, which clang detects
and aborts the build (when maintainer mode is enabled).

ticket: 8005 (new)
tags: pullup
target_version: 1.13
Allow logger.c to work with redirected stderr

In lib/kadm5/logger.c:krb5_klog_init(), if the configuration requests
STDERR logging, call fdopen() using mode "w" instead of "a+", to avoid
errors when stderr happens to be opened for write only.

ticket: 8001 (new)
target_version: 1.13
tags: pullup
Fix KCM ccache per-type cursor

The KCM per-type cursor was too simplistic and did not obey the
conventions of the other ccache types.  Fix it to return a singleton
cursor when the default cache is a subsidiary and to return the
primary cache first.

For internal convenience, make_cache now accepts a context parameter
and creates a kcmio if necessary.

ticket: 8002 (new)
target_version: 1.13
Fix unlikely memory leak in KCM client

Commit 956cbd24e645609c94fbc836840ce0f87ba3ce79 created a memory leak
if the KCM_OP_GET_DEFAULT_CACHE call fails inside kcm_ptcursor_new
after the KCM_OP_GET_CACHE_UUID_LIST call succeeds.  Fix it.

ticket: 8002
Update NOTICE with new changes for 1.13

The KCM RPC definitions are copyright KTH/Apple, since it is present
for interoperability with OS X.

Add MS-KKDCP client copyright; alas, it does not match the existing
Red Hat copyrights, since the new code is a 2-clause BSD license, and
there was only a 3-clause Red Hat copyright block present already.

The actual Sphinx output for NOTICE would adjust the wrapping and
indentation of some existing content, but those changes were removed
by hand, so this commit only reflects new added content.

ticket: 8006
tags: pullup
target_version: 1.13
Re-encrypt preserved key data in new master key

When we are preserving old key data in kdb_cpw.c, ensure that it is
encrypted with the same master key as the new key data.  This ensures
that the KRB5_TL_MKVNO tl-data on the principal entry applies to all
of the key data, not just some of it.

ticket: 7995
target_version: 1.13
tags: pullup
Add test case for -keepold mkey re-encryption

ticket: 7995
Simplify kdb_cpw.c

In add_key_rnd, stop looking up the krbtgt DB entry; we have not used
it since 1.1.

Use copy_key_data in add_key_rnd and add_key_pwd.

krb5_dbe_crk, krb5_dbe_ark, krb5_dbe_def_cpw, and krb5_dbe_apw all
contained similar logic.  Consolidate all of them into a static helper
function which does the work of all four.  The ark/apw variants had
slightly different behavior then crk/cpw with keepold=true, so
introduce a three-value enum to express all three behaviors.
Fix uninitialized variable bug in kdb_cpw.c

Now that add_key_rnd isn't looking up the TGT principal entry, it
could use retval before initializing it if the loop runs for zero
iterations.  Get rid of the add_key_rnd label (as it no longer does
anything) and just return 0 after the loop ends.
In ksu, handle typeless default_ccache_name values

When a configured or compiled-in default ccache name doesn't contain a
cache type and ':' as a prefix, add one to the writeable value that we
construct when we go to look it up.  This lets the rest of the
application always assume that it'll be there.

[ghudson@mit.edu: minor style changes]

ticket: 8007 (new)
target_version: 1.13
tags: pullup
Document clock skew tolerance for ticket times

KDC and application server checks on ticket start and expiration times
are subject to clock skew tolerance.  Document this grace period.

[tlyu@mit.edu: edit commit message, adjust wording to conform to
existing style, document start time clock skew]

ticket: 8008 (new)
target_version: 1.13
tags: pullup