Let SPNEGO display mechanism errors

To avoid potential recursion we use a thread local variable that tells
us whether the ancestor was called via spnego_gss_display_name().  If
we detect recursion, we assume that we returned a com_err code like
ENOMEM and call error_message(); in the worst case that will result in
an "Unknown error" message.

[ghudson@mit.edu: Edited comments and commit message; removed an
unneeded line of code.]

(cherry picked from commit d160bc733a3dbeb6d84f4e175234ff18738d9f66)

ticket: 7045
Test SPNEGO error message in t_s4u.py

Now that #7045 is fixed, we can check for the correct error message
from t_s4u2proxy_krb5 with --spnego.

(cherry picked from commit 4faca53e3a8ee213d43da8998f6889e7bfd36248)

ticket: 7045
version_fixed: 1.12.1
status: resolved
Fix S4U2Self against non-FAST KDCs

When we added FAST TGS support in 1.11, we broke S4U2Self against KDCs
which don't support FAST, because the S4U2Self padata is only present
within the FAST request.  For now, duplicate that padata in the outer
request so that both FAST and non-FAST KDCs can see it.

(cherry picked from commit 55c3a5f69919c2b5435bac0cb48ab09b11be869c)

ticket: 7791
version_fixed: 1.12.1
status: resolved
Avoid malloc(0) in SPNEGO get_input_token

If we read a zero-length token in spnego_mech.c's get_input_token(),
set the value pointer to NULL instead of calling malloc(0).

(cherry picked from commit 13fd26e1863c79f616653f6a10a58c01f65fceff)

ticket: 7794
version_fixed: 1.12.1
status: resolved
Fix SPNEGO one-hop interop against old IIS

IIS 6.0 and similar return a zero length reponse buffer in the last
SPNEGO packet when context initiation is performed without mutual
authentication.  In this case the underlying Kerberos mechanism has
already completed successfully on the first invocation, and SPNEGO
does not expect a mech response token in the answer.  If we get an
empty mech response token when the mech is complete during
negotiation, ignore it.

[ghudson@mit.edu: small code style and commit message changes]

(cherry picked from commit 37af638b742dbd642eb70092e4f7781c3f69d86d)

ticket: 7797
version_fixed: 1.12.1
status: resolved
Fix memory leak in SPNEGO initiator

If we eliminate a mechanism from the initiator list because
gss_init_sec_context fails, free the memory for that mech OID before
removing it from the list.

[ghudson@mit.edu: clarified commit message]

(cherry picked from commit 1cda48a7ed4069cfc052f974ec3d76a9137c8c5a)

ticket: 7803
version_fixed: 1.12.1
status: resolved
Fix GSS krb5 acceptor acquire_cred error handling

When acquiring acceptor creds with a specified name, if we fail to
open a replay cache, we leak the keytab handle.  If there is no
specified name and we discover that there is no content in the keytab,
we leak the keytab handle and return the wrong major code.  Memory
leak reported by Andrea Campi.

(cherry picked from commit decccbcb5075f8fbc28a535a9b337afc84a15dee)

ticket: 7805
version_fixed: 1.12.1
status: resolved
Clarify klist -s documentation

The documentation for klist -s erroneously suggests that it doesn't
affect the exit status behavior and that it merely checks for the
existence of the ccache (only mentioning the expired ticket check at
the end).  Make it clearer and simpler, but avoid going into a lot of
detail about the nature of the expiration check.

(cherry picked from commit bf1d3c7b0b060be4b3e9e793b633c07e489ac76f)

ticket: 7806
version_fixed: 1.12.1
status: resolved
Fix krb5_copy_context

krb5_copy_context has been broken since 1.8 (it broke in r22456)
because k5_copy_etypes crashes on null enctype lists.  Subsequent
additions to the context structure were not reflected in
krb5_copy_context, creating double-free bugs.  Make k5_copy_etypes
handle null input and account for all new fields in krb5_copy_context.
Reported by Arran Cudbard-Bell.

(back ported from commit c452644d91d57d8b05ef396a029e34d0c7a48920)

ticket: 7807
Add a test program for krb5_copy_context

This test program isn't completely proof against the kind of mistakes
we've made with krb5_copy_context in the past, but it at least
exercises krb5_copy_context and can detect some kinds of bugs.

(cherry picked from commit b78c3c8c5025aec870d20472f80d4a652062f921)

ticket: 7807
Fix typo that broke 'make clean'

(cherry picked from commit 28633f186a943721b6948875ca85a4a34bc87da4)

ticket: 7807
version_fixed: 1.12.1
status: resolved
Test for verto_set_flags in system libverto

libkrad relies on verto_set_flags, which was added to libverto in
release 0.2.4.  Make sure the system libverto has this function before
choosing it over the built-in version.

(cherry picked from commit a47d639770f32418c6e3fa8a0503019c9b376d2a)

ticket: 7808
version_fixed: 1.12.1
status: resolved
Set an error message when keyring get_princ fails

When attempting to use a keyring cache that doesn't exist, set an error
message when we fail to read a principal name, as we do when we return
the same error code when using a file ccache.

[ghudson: removed unnecessary check for d->name nullity.]

(cherry picked from commit c25fc42e8eac7350209df61e4a7b9960d17755ca)

ticket: 7809
Use an extended com_err hook in klist

Add an adapted version of extended_com_err_fn from kinit to klist and
use it.  In do_ccache(), rely on the ccache type to set a reasonable
message if krb5_cc_set_flags() or krb5_cc_get_principal() fails due to
a nonexistent or unreadable ccache, and don't confuse the user with
the name of the ccache operation that failed.

(cherry picked from commit ae027dd69fc80cca549c9198d10afad389f30873)

ticket: 7809
version_fixed: 1.12.1
status: resolved
Avoid keyctl purge in keyring ccache tests

keyctl purge was added in keyutils 1.5 (released in March 2011).  Use
keyctl unlink to clean up keys instead, as it is more universal.

(cherry picked from commit 94da4584645475272abec6259d1666e34bd59594)

ticket: 7810
version_fixed: 1.12.1
status: resolved
Log service princ in KDC more reliably

Under some error conditions, the KDC would log "<unknown server>" for
the service principal because service principal information is not yet
available to the logging functions.  Set the appropriate variables
earlier.

do_as_req.c: After unparsing the client, immediately unparse the
server before searching for the client principal in the KDB.

do_tgs_req.c: Save a pointer to the client-requested service
principal, to make sure it gets logged if an error happens before
search_sprinc() successfully completes.

[tlyu@mit.edu: commit message; fix TGS to catch more error cases]

(cherry picked from commit f37067776f9431879769f3874fdab6120ba3f155)

ticket: 7802
Fix possible null deref in previous

My rework of the do_tgs_req.c patch introduced a null deref if
decode_krb5_tgs_req() failed.

(cherry picked from commit 30589b2a1636de9f9b68591f0e546cb0fa21989f)

ticket: 7802
version_fixed: 1.12.1
status: resolved
Test bogus KDC-REQs

Send encodings that are invalid KDC-REQs, but pass krb5_is_as_req()
and krb5_is_tgs_req(), to make sure that the KDC recovers correctly
from failures in decode_krb5_as_req() and decode_krb5_tgs_req().  Also
send an encoding that isn't a valid KDC-REQ.

(back ported from commit dae7693f8bf970d89d4c697f3d66a7d458281b93)

ticket: 7811
version_fixed: 1.12.1
status: resolved
Mark AESNI files as not needing executable stacks

Some Linux systems now come with facilities to mark the stack as
non-executable, making it more difficult to exploit buffer overrun
bugs.  For this to work, object files built from assembly need a
section added to note whether they require an executable stack.

Patch from Dhiru Kholia with comments added.  More information at:
https://bugzilla.redhat.com/show_bug.cgi?id=1045699
https://wiki.gentoo.org/wiki/Hardened/GNU_stack_quickstart

(cherry picked from commit c64e39c69a9a7ee32c00b0cf7918f6274a565544)

ticket: 7813
version_fixed: 1.12.1
status: resolved