Fix deleted node handling in libprofile

In profile_find_node, skip deleted nodes when finding the second
match.  Otherwise, profile_clear_nodes could return an error if a node
has some values to clear but the last one is deleted.

In profile_node_iterator, skip deleted nodes when looking up the
section names.  Otherwise we could iterate over a deleted section
and/or ignore its replacement.

ticket: 7971 (new)
target_version: 1.12.2
tags: pullup
Fix creation/rename of top-level profile sections

profile_rename_section should demand only one name.

profile_add_relation should demand only one name if it is creating a
new section.  It aso needs to reset state before calling
profile_find_node for the section, in case it didn't look up any
parent sections previously.

ticket: 7972 (new)
target_version: 1.12.2
tags: pullup
Add profile tests for deletion bugs

Add three new libprofile tests to prof_test1, two to test for the bugs
in #7971 and one to test a bug which would have been introduced by a
candidate fix.
Modify k5buf interfaces for easier use

Make struct k5buf less opaque and get rid of k5buf-int.h.  Make it
easy to initialize a k5buf in an error state so that it can be freed
in a cleanup handler.  Add a function k5_buf_status which returns 0 or
ENOMEM.  Remove k5_buf_data and k5_buf_len.  Rename k5_free_buf to
k5_buf_free.  Adjust all callers to match.
Adjust marshalling interfaces for KCM

Make k5_marshal_cred and k5_marshal_princ write to an existing struct
k5buf instead of allocating a new one, so that they can be marshalled
before or after other data.
Add KCM credential cache type (client only)

Add a new credential cache type "KCM" which performs cache operations
by speaking to a Heimdal or OS X KCM daemon, via either Unix domain
sockets or (on OS X only) Mach RPC.  Add "kcm_socket" and
"kcm_mach_service" profile variables to control the socket path and
bootstrap service name respectively.  In ccmarshal.c, add
k5_marshal_mcred to marshal matching credentials in the KCM protocol
representation.

This cache type is not currently supported on Windows, as Windows does
not support Unix domain sockets.

As with the keyring cache type, the lastchange method of this cache
type is mostly useless, reporting only the time of the last change
made through that cache handle.  The KCM protocol currently has no
support for obtaining the last change time of the cache itself.

ticket: 7964 (new)
Make KCM the default ccache on OS X

If we do not find a default ccache value from krb5-config and we
detect that the host platform is OS X 10.7 or higher, use KCM: as the
default ccache name instead of FILE:/tmp/krb5cc_%{uid}.

ticket: 7964
Document KCM ccache type

Document the new KCM ccache type in ccache_def.rst.  Document the
kcm_socket and kcm_mach_service variables in krb5_conf.rst.

ticket: 7964
Simplify kdb5_ldap_util special princ creation

In kdb5_ldap_realm.c, factor out special principal creation into three
helper functions to reduce the amount of verbiage in kdb5_ldap_create.
Add kiprop/<master-hostname> during KDB creation

To reduce the number of steps in the deployment of iprop, create the
kiprop/hostname principal for the master KDC during KDB creation.
Adjust tests to match the new behavior.

[ghudson@mit.edu: clarified commit message; avoided applying kadmin
flags/lifetime to kiprop principal]

ticket: 7979 (new)
Add flag word to KDB iteration APIs

ticket: 7977 (new)
subject: Enable unlocked KDB iteration
Support write locks in DB2 iteration

Add support to krb5_db_iterate() for requesting write locks in the DB2
back end.

ticket: 7977
Use write lock flag for update_princ_encryption

In kdb5_util update_princ_encryption, instead of getting a write lock
on the KDB surrounding the call to krb5_db_iterate(), use the
iterflags parameter of krb5_db_iterate() to request that it obtain a
write lock around the iteration.

ticket: 7977
Support unlocked iteration in DB2

Add support to the DB2 KDB back end to optionally release the lock
when calling the iterator callback.  This prevents the blocking of
other processes when dumps of large databases are taking place.

Also add support for reversed iteration.

ticket: 7977
Tests for unlocked iteration

ticket: 7977
Ignore iprop deletion of deleted princ

Now that an iprop full dump might not hold a lock around the entire
dump, it's possible that iprop will queue an incremental update while
the dump is in progress.  If a principal is deleted while the dump is
in progress, the dump could omit that principal, yet the deletion
event would still be queued in the ulog.  Ignore that deletion without
generating an error.

This is the same basic change as for ticket #7753.

ticket: 7977
Stop locking around iprop dumps

ticket: 7977
Document unlockiter

ticket: 7977
Support kdb5_util dump -rev again

Restore kdb5_util dump support for reversed dumps.

ticket: 7978 (new)
Correct includes for unlockiter.c

Some platforms (e.g., Solaris) need a declaration of memset() for the
FD_ZERO() macro to work, contrary to POSIX standards.  Add an
inclusion of <string.h> to accommodate them.  Also add <sys/time.h>,
possibly needed by some older platforms, and remove a spurious
inclusion of <sys/socket.h>.

ticket: 7977