Fix several memory leaks in LDAP KDB modules

Fix memory leaks discovered by running valgrind over kdbtest, and some
related leaks.  Many of them result from not calling ldap_msgfree
after an unsuccessful search (as the OpenLDAP documentation requires)
or after an exception following a search, so many of the fixes move or
add ldap_msgfree calls to cleanup labels.

ldap_osa_free_princ_ent was not used, and could not be used because it
frees the container while krb5_lookup_tl_kadm_data uses a
caller-allocated container.  Change it to leave the container alone,
but to correctly destroy xdrs.  Use it in krb5_ldap_put_principal
where princ_ent was leaked.

In krb5_ldap_put_principal, subtreelist is declared twice in interior
scopes and not properly freed; move it to function scope and free it
up in the cleanup label.  Also in krb5_ldap_put_principal, avoiding
decoding multiple KBR5_TL_KADM_DATA values (which we don't expect to
see) as later decodes would cause earlier decodes to leak.

In krb5_encode_krbsecretkey, fix a leak of the krb5_data container and
also add an error check when calling asn1_encode_sequence_of_keys;
otherwise we would dereference a null pointer if we run out of memory
encoding keys (very unlikely).

ticket: 7941 (new)
target_version: 1.12.2
tags: pullup
Remove unused variables

[ghudson@mit.edu: squashed with similar commits]
Fix invalid test strings in t_oid.c

A missing comma caused two invalid strings to be concatenated.  The
resulting string was still invalid so the tests passed.

[ghudson@mit.edu: clarified commit message]
Fix error handling in k5_expand_path_tokens_extra

If strdup fails when copying extra tokens, we must terminate the
argument traversal before returning.

[ghudson@mit.edu: clarified commit message]
Fix argment validation in krb5_make_fulladdr

Check kaddr and kport, not kport twice.

[ghudson@mit.edu: clarified commit message, minor style change]
Avoid closing fd -1 in libkrad

If a krad_remote is released before its fd is set, we could close the
file descriptor -1, which is harmless but incorrect.  Check the fd in
remote_disconnect to avoid this.

[ghudson@mit.edu: clarified commit message, minor style change]
Fix error check in krb5_ldap_parse_principal_name

Test the correct variable for NULL to detect a strdup failure.

[ghudson@mit.edu: clarified commit message]
Improve indentation of t_otp.py

Move the RADIUS attribute dictionary text to a global variable defined
at indent level 0, so that we don't go back to indent level 0 in the
middle of the RadiusDaemon class definition.

[ghudson@mit.edu: clarified commit message, moved comment, changed
variable name]
Improve error message for PRNG seeding failure

In prng_fortuna.c, if krb5_c_random_make_octets detects that we do not
have entropy, set an error message saying that the random number
generator could not be seeded, as we likely failed previously to read
from /dev/urandom or the Windows equivalent.

ticket: 7968 (new)
Remove copyright statement added to bindresvport.c

Andreas's copyright statement was added to the Oracle license
statement by mistake; the code changes made to turn bindresvport into
bindresvport_sa are minimal.  Remove it with Andreas's permission.

ticket: 7935
Fix calloc check in krb5_authdata_context_init

ticket: 7973
target_version: 1.12.2
tags: pullup
Move KKDCP OpenSSL code to an internal plugin

Create an internal pluggable interface "tls" with one in-tree dynamic
plugin module named "k5tls".  Move all of the OpenSSL calls to the
plugin module, and make the libkrb5 code load and invoke the plugin.
This way we do not load or initialize libssl unless an HTTP proxy is
used.

ticket: 7929
Rename --with-proxy-tls-impl to --with-tls-impl

Make the configure option for TLS implementation more generic, in case
we use the k5tls module for something other than KDC proxy support.
Rename all of the associated symbols for consistency.

ticket: 7929
Modernize some LDAP sources

Bring ldap_misc.c up to date with current practices and make limited
changes to other files.  Of note:

* krb5_decode_krbsecretkey was freeing its bvalues argument; make that
  the caller's responsibility.
* Make is_principal_in_realm and has_modify_increment return
  krb5_boolean, reversing the sense of their results.
* Remove broken code path in decode_tl_data when an integer value has
  a length other than 2 (which should never happen).
* Simplify krb5_ldap_readpassword and make it take filename/name
  parameters instead of an LDAP context.
* Make krb5_ldap_bind (renamed to authenticate) responsible for
  setting a useful error message, so that its caller doesn't assume
  knowledge of the bind parameters.
* Make krb5_ldap_initialize (renamed to initialize_server) responsible
  for updating the handle list, and remove the otherwise unused
  krb5_update_ldap_handle.
* Remove remaining skeletal certificate support, including the unused
  has_sasl_external_mech function.
* Remove unused krb5_get_containerdn and KDB_TL_CONTAINERDN.
* Remove kdb_xdr.h; all of its prototypes were for functions that
  don't exist in the module or were duplicated in other headers.
* Remove krb5_ldap_get_strings and use ldap_get_values directly at
  its call sites; there was no need to copy the result.
Add SASL support to LDAP KDB module

Add variables for the SASL mechanism, authcid, authzid, and realm.  If
a SASL mechanism is set, perform an interactive bind with that
mechanism.  If <sasl/sasl.h> is found at build time, provide the
authcid, authzid, and realm in the interaction function, and provide a
SASL secret read from the service password file (under the authcid) if
we found one.

Based on a patch from Zoran Pericic <zpericic@netst.org>.

ticket: 7944 (new)
Add tests for LDAP SASL support

In t_kdb.py, add a test case for EXTERNAL, and a test case for
DIGEST-MD5 if we built with the SASL header file and found the core
schema file.

ticket: 7944
Document LDAP SASL configuration

Document the LDAP SASL profile tags and DB options.  For consistency,
also condense the kdc.conf documentation for the two bind DN variables
into one entry.

ticket: 7944
Fix doc build

Commit 15b7e405ff7b62ab96af45999d1350455948e602 contained an
indentation error which broke the doc build.  Fix it.

ticket: 7944
Fix leak on GSS module symbol resolution error

If krb5int_get_plugin_func fails, errinfo may contain an allocated
error message.  Free it on error when loading GSS modules.

[ghudson@mit.edu: also fix GSS_ADD_DYNAMIC_METHOD; clarify commit
message]

ticket: 7966 (new)
target_version: 1.12.2
tags: pullup
Fix double-free in SPNEGO [CVE-2014-4343]

In commit cd7d6b08 ("Verify acceptor's mech in SPNEGO initiator") the
pointer sc->internal_mech became an alias into sc->mech_set->elements,
which should be considered constant for the duration of the SPNEGO
context.  So don't free it.

CVE-2014-4343:

In MIT krb5 releases 1.10 and newer, an unauthenticated remote
attacker with the ability to spoof packets appearing to be from a
GSSAPI acceptor can cause a double-free condition in GSSAPI initiators
(clients) which are using the SPNEGO mechanism, by returning a
different underlying mechanism than was proposed by the initiator.  At
this stage of the negotiation, the acceptor is unauthenticated, and
the acceptor's response could be spoofed by an attacker with the
ability to inject traffic to the initiator.

Historically, some double-free vulnerabilities can be translated into
remote code execution, though the necessary exploits must be tailored
to the individual application and are usually quite
complicated. Double-frees can also be exploited to cause an
application crash, for a denial of service.  However, most GSSAPI
client applications are not vulnerable, as the SPNEGO mechanism is not
used by default (when GSS_C_NO_OID is passed as the mech_type argument
to gss_init_sec_context()).  The most common use of SPNEGO is for
HTTP-Negotiate, used in web browsers and other web clients.  Most such
clients are believed to not offer HTTP-Negotiate by default, instead
requiring a whitelist of sites for which it may be used to be
configured.  If the whitelist is configured to only allow
HTTP-Negotiate over TLS connections ("https://"), a successful
attacker must also spoof the web server's SSL certificate, due to the
way the WWW-Authenticate header is sent in a 401 (Unauthorized)
response message.  Unfortunately, many instructions for enabling
HTTP-Negotiate in common web browsers do not include a TLS
requirement.

    CVSSv2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C

[kaduk@mit.edu: CVE summary and CVSSv2 vector]

ticket: 7969 (new)
target_version: 1.12.2
tags: pullup