Make randkey update principal mkvno

In kadm5_randkey_principal_3, after updating the principal's keys,
update its mkvno tl-data to indicate the master key version we
encrypted the new keys with.

ticket: 7994
target_version: 1.13
tags: pullup
Add test case for randkey mkvno update

ticket: 7994
Export gssrpc_bindresvport_sa

It was added in commit 0d04b60d159ab83b943e43802b1449a3b074bc83, but
was not added to the library export symbol list, and thus was unusable
on systems that enforced library export lists.

ticket: 8003 (new)
tags: pullup
target_version: 1.13
Map .hin files to the C language for doxygen

In Debian unstable, the current version of doxygen is unhappy with
our generated Doxyfile, and does not handle krb5.hin in the expected
fashion (as a C header).  Work around this issue by explicitly
specifying that files with the .hin extension are to be treated
as C language files.

ticket: 8004 (new)
tags: pullup
target_version: 1.13
Initialize iterflags in update_princ_encryption

It is only assigned to in the non-dry-run case, which clang detects
and aborts the build (when maintainer mode is enabled).

ticket: 8005 (new)
tags: pullup
target_version: 1.13
Try to scan_ccache() after leash picks a cache

We need to call scan_ccache() in order to notice that there
are credentials and read their expire time.

The call to scan_ccache() in the Leash case was inadvertently
removed as part of commit 8651f3339ccc5a623172a8edfb9cf522883acacd.

ticket: 7998 (new)
tags: pullup
target_version: 1.12.3
subject: gssapi.dll tries to get initial creds even when some are present
Leash: Add some KDC entries to the registry

Though our library happily uses DNS, I can't get Windows to
successfully contact KDCs found through the SRV records.
So, we do need to stay in the business of shipping around
KDC entries, after all.

ticket: 7999 (new)
queue: kfw
tags: pullup
target_version: 1.12.3
Let libgssapi see TGTs in the MSLSA cache

When the current user is a local administrator of a windows machine
where User Account Control (UAC) is enabled, the Windows LSA will
return a block of zeros as the session key for any TGT entry in the
MSLSA: cache.  The lcc_retrieve() implementation checks for such
"null" session keys and prevents them from escaping to callers (as
attempts to use them would encounger strange errors).  However,
when the TGT is the only entry in the cache, this filtering prevents
scan_ccache() from detecting that the cache contains non-expired
credentials (and that there is a TGT present).

Since scan_ccache() is only looking at metadata in the cache entries,
and does not need to actually use any tickets or session keys, set
the KRB5_TC_NOTICKET flag on the ccache before scanning it.  This
will allow the MSLSA implementation to return a cred for the TGT
entry and cause the GSSAPI credential selection algorithm to function
properly.

ticket: 8000 (new)
tags: pullup
target_version: 1.12.3
subject: gssapi.dll fails to detect TGTs in the MSLSA cache when UAC is enabled
Remove old Windows support from cc_mslsa.c

The original version of cc_mslsa.c was implemented when Windows NT was
current, and things like Windows 2000 and Windows XP were new.  The
behavior of the Windows LSA was evolving rapidly at that time,
requiring lots of conditional behavior in code attempting to support
running and building on all versions of Windows.  In the intervening
time period, we have had three service packs for Windows XP and two
for Windows Server 2003, and several new releases of Windows.  No
version of Windows XP remains in support, and Windows Server 2003 SP2
has roughly a year of support left.  The LSA functionality has
stabilized in the currently supported releases, and we can safely
remove much of the conditional code intended to support very old
versions of Windows. In roughly chronological order:

We had some compatability shims to detect if the running system
was older than Windows 2000, that is, whether it was Windows NT.
Remove those checks, and the fallback behavior (which was to
fail early, gracefully).  The checks were effected by the
is_windows_2000() function, which, despite the name, was actually
checking for whether the running OS was windows 2000 *or newer*.  That
is, it was checking for whether this was some truly ancient system
such as Windows 98 or the original Windows NT.  Such systems have been
unsupported for a very long time, so there is no need to retain this
check.

Windows 2000 is long-gone.  Remove the is_windows_xp() function
that was checking whether we were running on XP or any newer system
(that is, whether we were running on Windows 2000) and simplify
conditional code as appropriate.  De-indent chunks that are no longer
conditional, and add a set of braces to clarify the nested
conditional.  Update the style of modified chunks to match current
practices.

A helper function is_windows_vista() was added to determine whether
the running OS was Windows Vista or newer, but it appears to have
never been used, so remove it.  N.B. that current Microsoft
documentation recommends against using version checks to
conditionalize functionality.

A helper function is_broken_wow64() was present to work around an
issue that would cause crashes at runtime, as described by Microsoft's
Article ID 960077.  That article indicates that a hotfix was
available, and it appears that that fix has made it into a subsequent
update for Windows Server 2003 SP2.  Since there are not believed to
be any affected systems anymore, it is safe to remove the workaround.

A helper function does_retrieve_ticket_cache_ticket() was used to
query and cache whether the KERB_RETRIEVE_TICKET_CACHE_TICKET flag is
supported in the KERB_RETRIEVE_TKT_REQUEST structure.  The
documentation of that structure on MSDN states that the
KERB_RETRIEVE_TICKET_CACHE_TICKET flag is not available on Windows XP
with SP1 and earlier, and Windows Server 2003.  Those platforms are no
longer supported (most notably, there are newer service packs), so
this code can safely be removed.  Since we always have build support
for the flag, remove the fallback where we would define it ourself.

Several preprocessor conditionals were present in the old code to
allow it to build when old versions of the Windows SDK were in use.
However, all current versions of the Windows SDK provide the needed
functionality, so we can remove the conditionals on
TRUST_ATTRIBUTE_TRUST_USES_AES_KEYS, HAVE_CACHE_INFO_EX2, and
KERB_SUBMIT_TICKET.

ticket: 7989
comment some future cleanup for cc_mslsa.c

The function does_query_ticket_cache_ex2() will not be needed once
Windows Server 2003 drops out of support in approximately one year's
time.  Note the doom timer at its definition, to facilitate future
cleanup.

ticket: 7989
Remove unused code from cc_mslsa.c

Remove PreserveInitialTicketIdentity() and IsKerberosLogon(), as well
as the preprocessor conditionals ENABLE_PURGING and PURGE_ALL, which
have not been used in a very long time, if ever.

There was one potential callsite of IsKerberosLogon(), in
lcc_resolve(), which was disabled.  It is perfectly reasonable to want
to use the MSLSA cache on a non-domain-joined workstation, as it is
now a read-write cache type, so we need not concern ourselves whether
the logon was performed or may have been performed using kerberos.

ticket: 7989
Rename cc_mslsa.c routines to avoid OS versions

We don't care about XP versus non-XP; just indicate which
revision of the data type is being used.

Standardize on the lowercase 'x' in "Ex", for both the "Ex" and
"Ex2" forms.

While here, adjust the function definition prototypes to match
current style.

ticket: 7989
Move realm conversion into helper in cc_mslsa.c

All the callers of UnicodeStringToMITPrinc() were already converting
a UnicodeString into a wchar* just to pass it in as the realm.

Simplify everyone's life by making the helper do the conversion.

ticket: 7989
Avoid unneeded GetMSTGT() calls in cc_mslsa.c

both lcc_resolve() and lcc_get_principal() were using GetMSTGT()
to fetch a ticket from which to obtain the client principal name
of the credentials cache.  However, that name is contained in
the results of the the cache information query; there is no need
to retrieve a full ticket of any sort to get it.  Since there
may sometimes be difficulties obtaining a TGT when UAC is enabled,
avoid these unneeded calls.

ticket: 7989