1.6.99
Windows: 1.6.99

Change-Id: Ifd124db0de542f9dea9bbd0347b0915cd9d45c72
Fix krb5's gss_pseudo_random() (n is big-endian)

The first enctype RFC3961 prf output length's bytes are correct because
the little- and big-endian representations of unsigned zero are the
same.  The second block of output was wrong because the counter was not
being encoded as big-endian.

This change could break applications.  But those applications would not
have been interoperating with other implementations anyways (in
particular: MIT's).
check that e have sane values
Minor language problems
bump libheimntlm to the version from OSX 10.9 Mavericks
use constants
try to use the right domain/hostname offset/ucs2 encoding

reported by Joe Mason
test type1 encodings
Include heimbase.h in hx509.h; required for heim_err_t.

Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
Fix bug in loading MIT dumps
Be verbose about MIT dump entry parsing failures
Fix MIT dump entry parsing bug that forced 2048 sz
Add very large MIT KDB princ entry for testing

Constructed by doing repeated kadmin.local cpw commands with a policy
with -history 9.
Fix callers of heim_ntlm_encode_type3; make build
Merge pull request #45 from jelmer/hx509-heimbase

Include heimbase.h in hx509.h; required for heim_err_t.
Add heimdal-krb5.pc file, with krb5.pc depending on it.

This makes it easier to install Heimdal and MIT kerberos on
the same system by just providing the heimdal-krb5.pc file;
the krb5.pc file is provided by both.

This is similar to what's done with heimdal-gssapi.pc/krb5-gssapi.pc.

Signed-off-by: Jelmer Vernooij <jelmer@samba.org>
Fix never valid error condition in KDC

The TGS was incorrectly using authtime to compute renew_till for new
tickets, which was in turn leading to endtime potentially being equal to
starttime, which caused the TGS to return KRB5KDC_ERR_NEVER_VALID.

This happens when the TGT renewal lifetime is longer than the max renew
lifetime of any other services, after that much time (target services'
max renew life) passes.  The TGT is still good but TGS-REQs fail.
Also validate kdigest hacks

Add validation of the kdigest configuration parameters
Merge pull request #48 from pettai/master

Allow validation of kdigest stuff