Let SPNEGO display mechanism errors

To avoid potential recursion we use a thread local variable that tells
us whether the ancestor was called via spnego_gss_display_name().  If
we detect recursion, we assume that we returned a com_err code like
ENOMEM and call error_message(); in the worst case that will result in
an "Unknown error" message.

[ghudson@mit.edu: Edited comments and commit message; removed an
unneeded line of code.]

(cherry picked from commit d160bc733a3dbeb6d84f4e175234ff18738d9f66)

ticket: 7823 (new)
Test SPNEGO error message in t_s4u.py

Now that #7045 is fixed, we can check for the correct error message
from t_s4u2proxy_krb5 with --spnego.

(back ported from commit 4faca53e3a8ee213d43da8998f6889e7bfd36248)

ticket: 7823
version_fixed: 1.11.5
status: resolved
Fix S4U2Self against non-FAST KDCs

When we added FAST TGS support in 1.11, we broke S4U2Self against KDCs
which don't support FAST, because the S4U2Self padata is only present
within the FAST request.  For now, duplicate that padata in the outer
request so that both FAST and non-FAST KDCs can see it.

(cherry picked from commit 55c3a5f69919c2b5435bac0cb48ab09b11be869c)

ticket: 7824 (new)
version_fixed: 1.11.5
status: resolved
Avoid malloc(0) in SPNEGO get_input_token

If we read a zero-length token in spnego_mech.c's get_input_token(),
set the value pointer to NULL instead of calling malloc(0).

(cherry picked from commit 13fd26e1863c79f616653f6a10a58c01f65fceff)

ticket: 7825 (new)
version_fixed: 1.11.5
status: resolved
Fix SPNEGO one-hop interop against old IIS

IIS 6.0 and similar return a zero length reponse buffer in the last
SPNEGO packet when context initiation is performed without mutual
authentication.  In this case the underlying Kerberos mechanism has
already completed successfully on the first invocation, and SPNEGO
does not expect a mech response token in the answer.  If we get an
empty mech response token when the mech is complete during
negotiation, ignore it.

[ghudson@mit.edu: small code style and commit message changes]

(cherry picked from commit 37af638b742dbd642eb70092e4f7781c3f69d86d)

ticket: 7827 (new)
version_fixed: 1.11.5
status: resolved
Fix memory leak in SPNEGO initiator

If we eliminate a mechanism from the initiator list because
gss_init_sec_context fails, free the memory for that mech OID before
removing it from the list.

[ghudson@mit.edu: clarified commit message]

(cherry picked from commit 1cda48a7ed4069cfc052f974ec3d76a9137c8c5a)

ticket: 7828 (new)
version_fixed: 1.11.5
status: resolved
Fix GSS krb5 acceptor acquire_cred error handling

When acquiring acceptor creds with a specified name, if we fail to
open a replay cache, we leak the keytab handle.  If there is no
specified name and we discover that there is no content in the keytab,
we leak the keytab handle and return the wrong major code.  Memory
leak reported by Andrea Campi.

(cherry picked from commit decccbcb5075f8fbc28a535a9b337afc84a15dee)

ticket: 7829 (new)
version_fixed: 1.11.5
status: resolved
Clarify klist -s documentation

The documentation for klist -s erroneously suggests that it doesn't
affect the exit status behavior and that it merely checks for the
existence of the ccache (only mentioning the expired ticket check at
the end).  Make it clearer and simpler, but avoid going into a lot of
detail about the nature of the expiration check.

(cherry picked from commit bf1d3c7b0b060be4b3e9e793b633c07e489ac76f)

ticket: 7830 (new)
version_fixed: 1.11.5
status: resolved
Fix krb5_copy_context

krb5_copy_context has been broken since 1.8 (it broke in r22456)
because k5_copy_etypes crashes on null enctype lists.  Subsequent
additions to the context structure were not reflected in
krb5_copy_context, creating double-free bugs.  Make k5_copy_etypes
handle null input and account for all new fields in krb5_copy_context.
Reported by Arran Cudbard-Bell.

(back ported from commit c452644d91d57d8b05ef396a029e34d0c7a48920)

ticket: 7826 (new)
Add a test program for krb5_copy_context

This test program isn't completely proof against the kind of mistakes
we've made with krb5_copy_context in the past, but it at least
exercises krb5_copy_context and can detect some kinds of bugs.

(back ported from commit b78c3c8c5025aec870d20472f80d4a652062f921)

ticket: 7826
Fix typo that broke 'make clean'

Missing $

(cherry picked from commit 28633f186a943721b6948875ca85a4a34bc87da4)

ticket: 7826
version_fixed: 1.11.5
status: resolved
Log service princ in KDC more reliably

Under some error conditions, the KDC would log "<unknown server>" for
the service principal because service principal information is not yet
available to the logging functions.  Set the appropriate variables
earlier.

do_as_req.c: After unparsing the client, immediately unparse the
server before searching for the client principal in the KDB.

do_tgs_req.c: Save a pointer to the client-requested service
principal, to make sure it gets logged if an error happens before
search_sprinc() successfully completes.

[tlyu@mit.edu: commit message; fix TGS to catch more error cases]

ticket: 7831 (new)
Fix possible null deref in previous

My rework of the do_tgs_req.c patch introduced a null deref if
decode_krb5_tgs_req() failed.

(cherry picked from commit 30589b2a1636de9f9b68591f0e546cb0fa21989f)

ticket: 7831
version_fixed: 1.11.5
status: resolved
Test bogus KDC-REQs

Send encodings that are invalid KDC-REQs, but pass krb5_is_as_req()
and krb5_is_tgs_req(), to make sure that the KDC recovers correctly
from failures in decode_krb5_as_req() and decode_krb5_tgs_req().  Also
send an encoding that isn't a valid KDC-REQ.

(back ported from commit dae7693f8bf970d89d4c697f3d66a7d458281b93)

ticket: 7832 (new)
version_fixed: 1.11.5
status: resolved
Fix typo in sphinx manpage output

Some versions of the sphinx manpage writer have a typo in the name
'reStructuredText' written into the comments.  Add a sed command to
fix this.

(cherry picked from commit 4d30cc5d0838f6b5b3873046b0dfe72df2bdad11)

ticket: 7833 (new)
version_fixed: 1.11.5
status: resolved
Remove mentions of krb5-send-pr

Start the process of deprecating krb5-send-pr.  In practice, it causes
frustration for some users, and free-form email is good enough for
most bug reports.

Continue to install krb5-send-pr for now, but plan to remove it from
the tree in the future, probably replaced by a script that instructs
the user to send email manually.

(cherry picked from commit e972ce069dd45aad74e4f4853570ab27cfea05c2)

ticket: 7834 (new)
version_fixed: 1.11.5
status: resolved
Sort file list for msgfmt

The list of input files for msgfmt was unsorted find output, resulting
in excessively large changes when running "make update-po".

(cherry picked from commit f131c5a4e266d07753a1f219d35c1bf82d98c0fb)

ticket: 7835 (new)
version_fixed: 1.11.5
status: resolved