Log service princ in KDC more reliably

Under some error conditions, the KDC would log "<unknown server>" for
the service principal because service principal information is not yet
available to the logging functions.  Set the appropriate variables
earlier.

do_as_req.c: After unparsing the client, immediately unparse the
server before searching for the client principal in the KDB.

do_tgs_req.c: Save a pointer to the client-requested service
principal, to make sure it gets logged if an error happens before
search_sprinc() successfully completes.

[tlyu@mit.edu: commit message; fix TGS to catch more error cases]

ticket: 7802
target_version: 1.12.1
tags: pullup
Fix possible null deref in previous

My rework of the do_tgs_req.c patch introduced a null deref if
decode_krb5_tgs_req() failed.

ticket: 7802
Test bogus KDC-REQs

Send encodings that are invalid KDC-REQs, but pass krb5_is_as_req()
and krb5_is_tgs_req(), to make sure that the KDC recovers correctly
from failures in decode_krb5_as_req() and decode_krb5_tgs_req().  Also
send an encoding that isn't a valid KDC-REQ.

ticket: 7811 (new)
target_version: 1.12.1
tags: pullup
Mark AESNI files as not needing executable stacks

Some Linux systems now come with facilities to mark the stack as
non-executable, making it more difficult to exploit buffer overrun
bugs.  For this to work, object files built from assembly need a
section added to note whether they require an executable stack.

Patch from Dhiru Kholia with comments added.  More information at:
https://bugzilla.redhat.com/show_bug.cgi?id=1045699
https://wiki.gentoo.org/wiki/Hardened/GNU_stack_quickstart

ticket: 7813
target_version: 1.12.1
tags: pullup
Default to normal salt instead of "ignore"

krb5_string_to_keysalts() treats an empty salt field as -1 ("ignore"),
rather than as the normal salttype.  Default to normal instead, so
that omitting a salttype works as expected.

ticket: 6042
Make salt defaulting work for keysalts

Make krb5_string_to_keysalts() default to only ":" as a key:salt
separator character.  Change most of its callers to pass NULL so they
get the default separators.

Adapted from a patch proposed by Jon Looney.

ticket: 884
Add test for salttype defaulting

ticket: 884
Refactor krb5_string_to_keysalts()

Use various standard C library functions rather than rolling our own.
Previous code spent many lines reimplementing realloc(), strpbrk(),
strtok_r(), etc.

Make a separate string_to_keysalt() parser for an individual keysalt
pair, which for now is private and destructive.
Work around Linux session keyring write behavior

If the session keyring matches the user session keyring, write
explicitly to the user session keyring.  Otherwise the kernel might
create a new session keyring for the process, making the resulting
cache collection invisible to other processes.

ticket: 7814
target_version: 1.12.1
tags: pullup
Avoid text relocations in iaesx86.s

Use PC-relative addressing to avoid runtime text relocations on i386.

Adapted patch from Nalin Dahyabhai.

ticket: 7815
target_version: 1.12.1
tags: pullup
Clean up AES-NI code

Items in .data other than shuffle_mask are unused; delete them.
Delete the unused macro load_and_inc4.  Move shuffle_mask to .rodata.
Restrict AES-NI support to ELF platforms for now

Since we explicitly specify the ELF object format when building
iaesx86.s or iaesx64.s, we need to restrict it to operating systems we
know to be ELF platforms.  Otherwise we can break the build on OS X,
which uses the Mach-O object format.

ticket: 7812
target_version: 1.12.1
tags: pullup
Don't produce context deletion token in krb5 mech

RFCs 2743 and 4121 recommend that implementations produce empty tokens
from gss_delete_sec_context, and trying to produce one can cause
gss_delete_sec_context to fail on a partially established context.
Patch from Tomas Kuthan.

ticket: 7816 (new)
Fix typo in sphinx manpage output

Some versions of the sphinx manpage writer have a typo in the name
'reStructuredText' written into the comments.  Add a sed command to
fix this.

ticket: 7817 (new)
target_version: 1.12.1
tags: pullup
Remove mentions of krb5-send-pr

Start the process of deprecating krb5-send-pr.  In practice, it causes
frustration for some users, and free-form email is good enough for
most bug reports.

Continue to install krb5-send-pr for now, but plan to remove it from
the tree in the future, probably replaced by a script that instructs
the user to send email manually.

ticket: 5566
target_version: 1.12.1
tags: pullup
Sort file list for msgfmt

The list of input files for msgfmt was unsorted find output, resulting
in excessively large changes when running "make update-po".

ticket: 7821 (new)
target_version: 1.12.1
tags: pullup
make update-po
Update copyright years
Get time offsets for all keyring ccaches

Move the time offset lookup from krb5_krcc_resolve to make_cache, so
that we fetch time offsets for caches created by
krb5_krcc_ptcursor_next.

ticket: 7820
target_version: 1.12.2
tags: pullup
Update copyright years and acknowledgments