Fix invalid JSON handling in KDC OTP module

If the OTP configuration for a principal contains invalid JSON, the
KDC OTP module calls k5_json_get_tid on a null pointer, causing the
KDC process to crash.  Fix this bug by checking the return value of
k5_json_decode in decode_config_json.

(cherry picked from commit dab1c234e15afdc64dfe776bdbc65bbc17d07e12)

ticket: 7912
version_fixed: 1.12.2
status: resolved
Fix krb5int_c_combine_keys

When krb5int_c_combine_keys was updated to use the new crypto
interface, a small bug was introduced.  It turns out the temporary
keyblock created needs to have its enctype set; otherwise, when
krb5int_derive_keyblock() is called later, it will fail with
KRB5_BAD_ENCTYPE.

(cherry picked from commit 89803a5a781107365d5a4534eebf48dbaf010f96)

ticket: 7914
version_fixed: 1.12.2
status: resolved
Add tests for krb5int_c_combine_keys

krb5int_c_combine_keys is used only by SAM-2 preauth with neither the
send-encrypted-sad nor use-sad-as-key flags, so it isn't covered by
any automated function tests.  Add some unit tests to make sure that
it works and returns the expected results for two randomly generated
test vectors.

(cherry picked from commit 6e8b2fba84df2ef74ce071330b4c3f843f4b7541)

ticket: 7914
version_fixed: 1.12.2
status: resolved
Fix fencepost error in krad timeout handler

(cherry picked from commit f4fce5afd8c4bb5e46aa7041f10118026c5152f0)

ticket: 7911
version_fixed: 1.12.2
status: resolved
Don't blindly use PKCS11 slot IDs in PKINIT

Passing invalid slot IDs to C_OpenSession can cause some PKCS #11
implementations (such as the Solaris one) to crash.  If a PKINIT
identity specifies a slotid, use it to filter the result of
C_GetSlotList, but don't try it if it does not appear in the list.

(cherry picked from commit ac406bac3d73a7e4efcc74adbb90c722457da969)

ticket: 7916
version_fixed: 1.12.2
status: resolved
Properly handle PKCS11 label in PKINIT

The CK_TOKEN_INFO label field is defined to be zero-filled, but it may
not be zero-terminated if all bytes of the field are used.  Use only
length-counted operations to process it.  Also avoid underrunning the
buffer pointer if the label is empty or contains only whitespace.

(cherry picked from commit f8b42ef541a463f56720ec9358dd07716b04c5e2)

ticket: 7917
version_fixed: 1.12.2
status: resolved
Change example module name in host_config.rst

Don't use "otp" as the example clpreauth module name in
host_config.rst, since we now ship an effectively built-in otp
clpreauth module.  Instead use "mypreauth".

(cherry picked from commit 26a43afbc214e8d24cf261f245007192eccb7ed5)

ticket: 7920
version_fixed: 1.12.2
status: resolved
Do not document pkinit_mapping_file

This feature was never implemented in the PKINIT code as it was
contributed; there was only stub support for reading the filename.

(cherry picked from commit 8da21b0ec18cf9306a8c1b3410d5c6ab36acdd21)

ticket: 7928
version_fixed: 1.12.2
status: resolved