Fix error checking in PKINIT authdata creation

In create_identifiers_from_stack: check for allocation errors from
PKCS7_ISSUER_AND_SERIAL_new and M_ASN1_INTEGER_dup.  Use
PKCS7_ISSUER_AND_SERIAL_free to more concisely clean up the OpenSSL
issuer variable, and make sure that any partially processed value is
cleaned up on error.  Use calloc to allocate krb5_cas so that all of
its pointers are initially nulled, so that
free_krb5_external_principal_identifier can operate on it safely in
case of error.  Eliminate the retval variable as it was not used
safely.  Rename the error label from "cleanup" to "oom" and separate
it from the successful return path (which has nothing to clean up).

ticket: 7943 (new)
target_version: 1.12.2
tags: pullup
Fix several memory leaks in LDAP KDB modules

Fix memory leaks discovered by running valgrind over kdbtest, and some
related leaks.  Many of them result from not calling ldap_msgfree
after an unsuccessful search (as the OpenLDAP documentation requires)
or after an exception following a search, so many of the fixes move or
add ldap_msgfree calls to cleanup labels.

ldap_osa_free_princ_ent was not used, and could not be used because it
frees the container while krb5_lookup_tl_kadm_data uses a
caller-allocated container.  Change it to leave the container alone,
but to correctly destroy xdrs.  Use it in krb5_ldap_put_principal
where princ_ent was leaked.

In krb5_ldap_put_principal, subtreelist is declared twice in interior
scopes and not properly freed; move it to function scope and free it
up in the cleanup label.  Also in krb5_ldap_put_principal, avoiding
decoding multiple KBR5_TL_KADM_DATA values (which we don't expect to
see) as later decodes would cause earlier decodes to leak.

In krb5_encode_krbsecretkey, fix a leak of the krb5_data container and
also add an error check when calling asn1_encode_sequence_of_keys;
otherwise we would dereference a null pointer if we run out of memory
encoding keys (very unlikely).

ticket: 7941 (new)
target_version: 1.12.2
tags: pullup
Modernize some LDAP sources

Bring ldap_misc.c up to date with current practices and make limited
changes to other files.  Of note:

* krb5_decode_krbsecretkey was freeing its bvalues argument; make that
  the caller's responsibility.
* Make is_principal_in_realm and has_modify_increment return
  krb5_boolean, reversing the sense of their results.
* Remove broken code path in decode_tl_data when an integer value has
  a length other than 2 (which should never happen).
* Simplify krb5_ldap_readpassword and make it take filename/name
  parameters instead of an LDAP context.
* Make krb5_ldap_bind (renamed to authenticate) responsible for
  setting a useful error message, so that its caller doesn't assume
  knowledge of the bind parameters.
* Make krb5_ldap_initialize (renamed to initialize_server) responsible
  for updating the handle list, and remove the otherwise unused
  krb5_update_ldap_handle.
* Remove remaining skeletal certificate support, including the unused
  has_sasl_external_mech function.
* Remove unused krb5_get_containerdn and KDB_TL_CONTAINERDN.
* Remove kdb_xdr.h; all of its prototypes were for functions that
  don't exist in the module or were duplicated in other headers.
Add SASL support to LDAP KDB module

Add variables for the SASL mechanism, authcid, authzid, and realm.  If
a SASL mechanism is set, perform an interactive bind with that
mechanism.  If <sasl/sasl.h> is found at build time, provide the
authcid, authzid, and realm in the interaction function, and provide a
SASL secret read from the service password file (under the authcid) if
we found one.

Based on a patch from Zoran Pericic <zpericic@netst.org>.

ticket: 7944 (new)
Add tests for LDAP SASL support

In t_kdb.py, add a test case for EXTERNAL, and a test case for
DIGEST-MD5 if we built with the SASL header file and found the core
schema file.

ticket: 7944
Document LDAP SASL configuration

Document the LDAP SASL profile tags and DB options.  For consistency,
also condense the kdc.conf documentation for the two bind DN variables
into one entry.

ticket: 7944