Refactor cm functions in sendto_kdc.c

Move get_curtime_ms and the cm functions near the top of the file
right after structure definitions.  Except for cm_select_or_poll,
define each cm function separately for poll and for select, since the
implementations don't share much in common.  Instead of
cm_unset_write, define cm_read and cm_write functions to put an fd in
read-only or write-only state.  Remove the ssflags argument from
cm_add_fd and just expect the caller to make a subsequent call to
cm_read or cm_write.  Always select for exceptions when using select.
(Polling for exceptions is implicit with poll).

With these changes, we no longer select/poll for reading on a TCP
connection until we are done writing to it.  So in service_tcp_fd,
remove the check for unexpected read events.
Fix leak in kadm5_flush with LDAP KDB

Due to an inverted test in adb_policy_init, kadm5_flush calls
krb5_db_open twice.  With the DB2 KDB module, the second open is a
no-op, but with the LDAP module, a new DB handle is allocated and the
old one is leaked.

[ghudson@mit.edu: rewrote commit message]

ticket: 7897 (new)
target_version: 1.12.2
tags: pullup
Remove adb_policy_init and adb_policy_close

Since f72c3ffa the policy is initialized as part of database.
adb_policy_close is now a no-op, and adb_policy_init just makes sure
the database is initialized.  adb_policy_init is only called from
kadm5_flush, and only if database initialization was successful
beforehand, rendering this call redundant.

Remove adb_policy_init and adb_policy_close and all their references
in the code and documentation.
Fix sendto_kdc.c on OS X after cm refactoring

Treat POLLHUP without POLLIN or POLLOUT as an exception in the poll
version of cm_get_ssflags, to correctly handle TCP connection errors
on OS X.
Update sample configs to include master_kdc

Where we have ATHENA.MIT.EDU stanzas in sample or test krb5.conf files
which define kdc entries, also define a master_kdc entry.  Remove
default_domain and v4_instance_convert entries in examples as they are
only needed for krb5/krb4 principal conversions.  In the krb5_conf.rst
example, remove enctype specifications as we don't want to encourage
their use when they aren't necessary, and remove a redundant
domain_realm entry.

ticket: 7901 (new)
In PKINIT, use library initializer for OpenSSL

Use a library initializer to prevent multiple threads using PKINIT
from concurently initializing OpenSSL functions.  For cases where
MT-safety is not assured by registering OpenSSL locking callbacks,
this significantly lowers the odds of crashes caused by races in
OpenSSL initialization.  (If OpenSSL initialization functions are
called by some other thread directly, crashes are still possible.)

[ghudson@mit.edu: simplify code changes and commit message]

ticket: 6413
Check for asprintf failure in kdb5_util create

In add_admin_princ, remove build_name_with_realm and call asprintf
directly instead.  Check for asprintf failure to avoid passing an
undefined pointer to krb5_parse_name.

[ghudson@mit.edu: rewrite commit message]

ticket: 7902 (new)
target_version: 1.12.2
tags: pullup
Refactor KDC option/flag processing

A lot of KDC code was spent copying options to flags, and copying
header_ticket flags to the output ticket.

Behavior change: previous code didn't copy PROXY from the
header_ticket, but this seems to have been a minor bug rather than
intentional.  This also seems to have been an omission from RFC 4120.
Remove compile_et.c

We have used awk scripts in preference to the C version of compile_et
since 1994 (r4426).  Get rid of the sources for the C version and all
of the Makefile.in references to them.
Add helper to change extended error message code

k5_change_error_message_code allows an extended error message to be
used when an error code is remapped.
Use k5_change_error_message_code in krb5 GSS mech

Simplify acquire_accept_cred using the new helper function.
Improve krb5_rd_req decryption failure errors

When krb5_rd_req cannot decrypt a ticket, try to produce the most
helpful diagnostic we can, and return an error code which corresponds
to the most applicable Kerberos protocol error.  Add a trace log
containing the error message for ticket decryption failures, in case
the application server does not log it.

Add new tests to cover krb5_rd_req error messages and adjust existing
tests to match the new messages.  Also adjust svc_auth_gssapi.c to
look for KRB5KRB_AP_ERR_NOT_US instead of KRB5KRB_AP_WRONG_PRINC.

ticket: 7232
Don't remove ccache creds before storing them

Revert #6291, which attempts to suppress duplicate credentials by
calling krb5_cc_remove in krb5_cc_store_cred.  Most of our ccache
types don't implement remove_cred, and avoiding duplicate credentials
is a responsibility better suited to the ccache implementation for
atomicity reasons.

Removing this call gets rid of the misleading "Removing ... from ..."
messages in trace logs.

ticket: 7906 (new)
Fix unlikely memory leak exporting lucid context

If the GSSAPI context has an unrecognized proto field (which should
never happen), free the context we allocated before returning EINVAL.

[ghudson@mit.edu: clarify commit message]
Fix unlikely memory error in krb5_rd_cred

If an error occurs in the for loop in krb5_rd_cred_basic (which should
only happen on an ENOMEM), do not leave the caller with a dangling
reference to the freed credential array.

ticket: 7908 (new)
target_version: 1.12.2
Allow GSS mechs to force mechlistMIC in SPNEGO

During a SPNEGO negotiation, if the NTLMSSP mechanism is used and a
MIC is produced within the final initiator mechanism token, Microsoft
servers require a mechlistMIC even if NTLMSSP was the most preferred
mechanism.

In spnego_mech.c, add a helper function mech_requires_mechlistMIC
which queries the mechanism to determine whether we might need to
produce a mechlistMIC for interoperability.  Call it after each call
to the mechanism's gss_init_sec_context and set sc->mic_reqd if it
returns true.  Although only the second call to NTLMSSP will actually
ever return true, the first call makes the mechanism aware that the
SPNEGO implementation supports this feature.

[ghudson@mit.edu: clarified commit message and code]

ticket: 7907 (new)
Modernize rd_cred.c

Adjust the internal abstractions so that decrypt_encpart is
responsible for the fallback from receiving subkey to session key, and
krb5_rd_cred is responsible for decoding and calling decrypt_encpart.
Rename krb5_rd_cred_basic to make_cred_list since it is now only
responsible for constructing the list.
Add k5_buf_get_space

Add a new k5_buf method to make room in the buffer for the caller to
fill in.
Add k5-input.h

Add a header containing a declaration for struct k5input and static
inline functions to use it.  A k5input structure can be used to safely
extract bytes and integers from a fixed-sized input buffer without
overrunning the buffer.  It supports deferred error checking (similar
to k5buf) by returning dummy values and storing a status value in the
input structure.
Add cred marshalling functions

Add a new file ccmarshal.c containing functions to marshal and
unmarshal credentials in file formats version 1-4.  These will replace
the functions in cc_file.c and cc_keyring.c, and can be used for KCM
in the future.