Remove dangling --with-kdc-kdb-update references

This configure option hasn't done anything since 1.8, so don't mention
it in configure --help or the documentation.  The disable_last_success
and disable_lockout DB options are now used to turn it off.

(back ported from commit 0b3225d63f50d4e6297be5d751cae1d3368fcdb1)

ticket: 7837 (new)
version_fixed: 1.10.8
status: resolved
Avoid malloc(0) in SPNEGO get_input_token

If we read a zero-length token in spnego_mech.c's get_input_token(),
set the value pointer to NULL instead of calling malloc(0).

(cherry picked from commit 13fd26e1863c79f616653f6a10a58c01f65fceff)

ticket: 7841 (new)
version_fixed: 1.10.8
status: resolved
Fix SPNEGO one-hop interop against old IIS

IIS 6.0 and similar return a zero length reponse buffer in the last
SPNEGO packet when context initiation is performed without mutual
authentication.  In this case the underlying Kerberos mechanism has
already completed successfully on the first invocation, and SPNEGO
does not expect a mech response token in the answer.  If we get an
empty mech response token when the mech is complete during
negotiation, ignore it.

[ghudson@mit.edu: small code style and commit message changes]

(cherry picked from commit 37af638b742dbd642eb70092e4f7781c3f69d86d)

ticket: 7842 (new)
version_fixed: 1.10.8
status: resolved
Fix memory leak in SPNEGO initiator

If we eliminate a mechanism from the initiator list because
gss_init_sec_context fails, free the memory for that mech OID before
removing it from the list.

[ghudson@mit.edu: clarified commit message]

(cherry picked from commit 1cda48a7ed4069cfc052f974ec3d76a9137c8c5a)

ticket: 7843 (new)
version_fixed: 1.10.8
status: resolved
Fix GSS krb5 acceptor acquire_cred error handling

When acquiring acceptor creds with a specified name, if we fail to
open a replay cache, we leak the keytab handle.  If there is no
specified name and we discover that there is no content in the keytab,
we leak the keytab handle and return the wrong major code.  Memory
leak reported by Andrea Campi.

(cherry picked from commit decccbcb5075f8fbc28a535a9b337afc84a15dee)

ticket: 7844 (new)
version_fixed: 1.10.8
status: resolved
Fix krb5_copy_context

krb5_copy_context has been broken since 1.8 (it broke in r22456)
because k5_copy_etypes crashes on null enctype lists.  Subsequent
additions to the context structure were not reflected in
krb5_copy_context, creating double-free bugs.  Make k5_copy_etypes
handle null input and account for all new fields in krb5_copy_context.
Reported by Arran Cudbard-Bell.

(back ported from commit c452644d91d57d8b05ef396a029e34d0c7a48920)

ticket: 7845 (new)
Add a test program for krb5_copy_context

This test program isn't completely proof against the kind of mistakes
we've made with krb5_copy_context in the past, but it at least
exercises krb5_copy_context and can detect some kinds of bugs.

(back ported from commit b78c3c8c5025aec870d20472f80d4a652062f921)

ticket: 7845
Fix typo that broke 'make clean'

Missing $

(back ported from commit 28633f186a943721b6948875ca85a4a34bc87da4)

ticket: 7845
version_fixed: 1.10.8
status: resolved
Test bogus KDC-REQs

Send encodings that are invalid KDC-REQs, but pass krb5_is_as_req()
and krb5_is_tgs_req(), to make sure that the KDC recovers correctly
from failures in decode_krb5_as_req() and decode_krb5_tgs_req().  Also
send an encoding that isn't a valid KDC-REQ.

(back ported from commit dae7693f8bf970d89d4c697f3d66a7d458281b93)

ticket: 7846 (new)
version_fixed: 1.10.8
status: resolved
Remove mentions of krb5-send-pr

Start the process of deprecating krb5-send-pr.  In practice, it causes
frustration for some users, and free-form email is good enough for
most bug reports.

Continue to install krb5-send-pr for now, but plan to remove it from
the tree in the future, probably replaced by a script that instructs
the user to send email manually.

(cherry picked from commit e972ce069dd45aad74e4f4853570ab27cfea05c2)

ticket: 7847 (new)
version_fixed: 1.10.8
status: resolved
Sort file list for msgfmt

The list of input files for msgfmt was unsorted find output, resulting
in excessively large changes when running "make update-po".

(cherry picked from commit f131c5a4e266d07753a1f219d35c1bf82d98c0fb)

ticket: 7848 (new)
version_fixed: 1.10.8
status: resolved