Updates for krb5-1.13-alpha1
krb5-1.13-alpha1-postrelease
Fix HP-UX build support

Rename hpux10.exports to hpux.exports.  In the HP-UX section of
shlib.conf, remove '+s' because it just specifies a default, add a
MAKE_SHLIB_COMMAND, and set SHLIBEXT based on the host CPU.

[ghudson@mit.edu: squashed commits, condensed commit message]

(cherry picked from commit fdd1c69471bbe5fec0da9f9bcaa9d0a7739db77f)

ticket: 7990
version_fixed: 1.13
status: resolved
Fix test syntax in configure.in

Commits 1e4bdcfe and 8df1965d used the wrong test equality operator.
Some versions of test allow == for equality, but others (such as the
HP-UX version) do not.  Use a single = for correctness.

[ghudson@mit.edu: clarified commit message]

(cherry picked from commit fefd465614f11f374f5ff183e6eb6cbc1b550de5)

ticket: 7992
version_fixed: 1.13
status: resolved
Autodetect OpenSSL CMS for LibreSSL compatibility

LibreSSL currently does not support CMS, so checking for CMS via
OPENSSL_VERSION_NUMBER isn't reliable.  Detect CMS support via
autoconf instead.

[ghudson@mit.edu: clarified commit message; minor style changes]

(cherry picked from commit a7a8e3186a21c15132cd8fb6c141afcf25a1fb74)

ticket: 7993
version_fixed: 1.13
status: resolved
Simplify and improve ksu cred verification

When verifying the user's initial credentials, don't compute a server
name and preemptively obtain creds for it.  This change allows
krb5_verify_init_creds to use any host key in the keytab, and not just
the one for the canonicalized local hostname.

[ghudson@mit.edu: rewrote commit message]

(cherry picked from commit bbfe19f03bdeca7b05b542dbae4c1692c9800c70)

ticket: 7996
version_fixed: 1.13
status: resolved
kadm5_randkey_principal interop with Solaris KDC

When kadm5_randkey_principal is called on Solaris kadmind (as opposed
to kadm5_randkey_principal_3), the KDC assumes the peer is a Solaris 9
system, and only creates DES keys.

For better interoperability, always call kadm5_randkey_principal_3
first.  If this procedure is not present on the remote server, fall
back to calling kadm5_randkey_principal if possible.

[ghudson@mit.edu: adjusted comments, argument wrapping, commit
message]

(cherry picked from commit e86e3baaa684a7e891ffe852d74095c1a8b630ba)

ticket: 7997
version_fixed: 1.13
status: resolved
Make randkey update principal mkvno

In kadm5_randkey_principal_3, after updating the principal's keys,
update its mkvno tl-data to indicate the master key version we
encrypted the new keys with.

(cherry picked from commit 05a3b205c5d7ee491a64e24581cb4def3814c05b)

ticket: 7994
Add test case for randkey mkvno update

(cherry picked from commit b96f562888e3e7733e449a922920158e84e0a933)

ticket: 7994
version_fixed: 1.13
status: resolved
Export gssrpc_bindresvport_sa

It was added in commit 0d04b60d159ab83b943e43802b1449a3b074bc83, but
was not added to the library export symbol list, and thus was unusable
on systems that enforced library export lists.

(cherry picked from commit f749c07bb18878f34f63aa3997bb0ef1360a9a0a)

ticket: 8003
version_fixed: 1.13
status: resolved
Map .hin files to the C language for doxygen

In Debian unstable, the current version of doxygen is unhappy with
our generated Doxyfile, and does not handle krb5.hin in the expected
fashion (as a C header).  Work around this issue by explicitly
specifying that files with the .hin extension are to be treated
as C language files.

(cherry picked from commit b7a4d695263f1a5b7fe72b1eadce4acdc3f0490b)

ticket: 8004
version_fixed: 1.13
status: resolved
Initialize iterflags in update_princ_encryption

It is only assigned to in the non-dry-run case, which clang detects
and aborts the build (when maintainer mode is enabled).

(cherry picked from commit bf040d0c4072742efab854ab01af162569f0a8f7)

ticket: 8005
version_fixed: 1.13
status: resolved
Allow logger.c to work with redirected stderr

In lib/kadm5/logger.c:krb5_klog_init(), if the configuration requests
STDERR logging, call fdopen() using mode "w" instead of "a+", to avoid
errors when stderr happens to be opened for write only.

(cherry picked from commit a85923073ad2d1f5d0314ab330fd6c5f07749be8)

ticket: 8001
version_fixed: 1.13
status: resolved
Update NOTICE with new changes for 1.13

The KCM RPC definitions are copyright KTH/Apple, since it is present
for interoperability with OS X.

Add MS-KKDCP client copyright; alas, it does not match the existing
Red Hat copyrights, since the new code is a 2-clause BSD license, and
there was only a 3-clause Red Hat copyright block present already.

The actual Sphinx output for NOTICE would adjust the wrapping and
indentation of some existing content, but those changes were removed
by hand, so this commit only reflects new added content.

(cherry picked from commit 2cb54d39316f9a0cc8e75b791b2faf6f051c9495)

ticket: 8006
version_fixed: 1.13
status: resolved
Add test case for -keepold mkey re-encryption

(cherry picked from commit 8ee40f56e6c789a87dc403bf70d524d2b3b21dbf)

ticket: 7995
version_fixed: 1.13
status: resolved
Re-encrypt preserved key data in new master key

When we are preserving old key data in kdb_cpw.c, ensure that it is
encrypted with the same master key as the new key data.  This ensures
that the KRB5_TL_MKVNO tl-data on the principal entry applies to all
of the key data, not just some of it.

(cherry picked from commit 32c9b8f1aa1b348388ed227394cc609e68ed833b)

ticket: 7995
version_fixed: 1.13
status: resolved
In ksu, handle typeless default_ccache_name values

When a configured or compiled-in default ccache name doesn't contain a
cache type and ':' as a prefix, add one to the writeable value that we
construct when we go to look it up.  This lets the rest of the
application always assume that it'll be there.

[ghudson@mit.edu: minor style changes]

(cherry picked from commit bda574576a5a2d0613fecf12d820e0adcbedf95c)

ticket: 8007
version_fixed: 1.13
status: resolved
Document clock skew tolerance for ticket times

KDC and application server checks on ticket start and expiration times
are subject to clock skew tolerance.  Document this grace period.

[tlyu@mit.edu: edit commit message, adjust wording to conform to
existing style, document start time clock skew]

(cherry picked from commit e56f3d43a746c198b1fd1889dc1211b9feedbfc3)

ticket: 8008
version_fixed: 1.13
status: resolved
Try to scan_ccache() after leash picks a cache

We need to call scan_ccache() in order to notice that there
are credentials and read their expire time.

The call to scan_ccache() in the Leash case was inadvertently
removed as part of commit 8651f3339ccc5a623172a8edfb9cf522883acacd.

(cherry picked from commit 674f7d7abe2d4f8bc3fe791e4347a332e3ccfd41)

ticket: 7998
version_fixed: 1.13
status: resolved
Add some KDC entries to the registry via WiX

Though our library happily uses DNS, I can't get Windows to
successfully contact KDCs found through the SRV records.
So, we do need to stay in the business of shipping around
KDC entries, after all.

(cherry picked from commit d2b76e1ba0f4bb0ec7e560a9a681d938f45f950c)

ticket: 7999