Get time offsets for all keyring ccaches

Move the time offset lookup from krb5_krcc_resolve to make_cache, so
that we fetch time offsets for caches created by
krb5_krcc_ptcursor_next.

(cherry picked from commit e99c688913a7761c6adea9488ea9355f43539883)

ticket: 7820
version_fixed: 1.12.2
status: resolved
Clean up rcache if GSS krb5 acquire_cred fails

The error handler in acquire_cred_context didn't release the rcache,
which would cause it to leak if we failed after acquire_accept_cred.

(cherry picked from commit 9df0c4bdce6b88a01af51e4bbb9a365db00256d5)

ticket: 7818
version_fixed: 1.12.2
status: resolved
Avoid assertion failure in error_message

r17942 added a call to get_thread_buffer in the first part of
error_message, prior to the call to com_err_initialize.  This can
cause an assertion failure from k5_getspecific if error_message is
called on a system error before any other com_err functions are
called.  Move the initialization call earlier to prevent this.

(cherry picked from commit 6bdaa746fec1cf29adcbe5b8e65c4b8993770b84)

ticket: 7822
version_fixed: 1.12.2
status: resolved
Allow empty store in gss_acquire_cred_from

There is no reason to deny a zero-length cred store, so don't check
for it in val_acq_cred_args or val_add_cred_args.

(cherry picked from commit 970304b558a360e08d8421ef92245d2df0ac5e49)

ticket: 7836
version_fixed: 1.12.2
status: resolved
Reinitialize ulog when wrapping serial number

When we wrap the serial number, reinitialize the ulog so that kdb_num
starts counting from 1, instead of leaving the ulog in a weird state
where kdb_num == ulogentries but kdb_last_sno == 1 and the serial
numbers in the circular array aren't necessarily contiguous.

(cherry picked from commit 3c147860df11d8ef24dabf07d32f36915f3b640c)

ticket: 7839
version_fixed: 1.12.2
status: resolved
Check for unstable ulog in ulog_get_entries

If a process terminates in the middle of a logged database update, it
will release its lock and leave the ulog in the KDB_UNSTABLE state.
kadmind should notice this when it calls ulog_get_entries, but right
now it only checks for the KDB_CORRUPT state (which is never set any
more) and does not recover.  Check for any state other than KDB_STABLE
and recover by resetting the ulog and forcing full resyncs to slaves.

(cherry picked from commit 91ef7d4c3f892b99630422a71780788f2d1c04d7)

ticket: 7853
version_fixed: 1.12.2
status: resolved
Fix kpropd -x

A missing break in the switch statement caused kpropd -x to error out
with a usage message.

(cherry picked from commit 75b2ec88c4d75e7215322d2f0019307310cc9701)

ticket: 7854
version_fixed: 1.12.2
status: resolved
Properly reflect MS krb5 mech in SPNEGO acceptor

r25590 changed negotiate_mech() to return an alias into the acceptor's
mech set, with the unfortunate side effect of transforming the
erroneous Microsoft krb5 mech OID into the correct krb5 mech OID,
meaning that we answer with a different OID than the requested one.
Return an alias into the initiator's mech set instead, and store that
in mech_set field the SPNEGO context.  The acceptor code only uses
mech_set to hold the allocated storage pointed into by internal_mech,
so this change is safe.

(cherry picked from commit 8255613476d4c1583a5e810b50444f188fde871f)

ticket: 7858
version_fixed: 1.12.2
status: resolved
Test SPNEGO acceptor response to MS krb5 mech OID

In t_spnego.c, add code to make a SPNEGO request with the erroneous
Microsoft OID value and examine the response to make sure that it uses
the same OID value as the request did.  The token and tmp variables
were unused, so rename them to itok and atok for the purpose of the
new test code.

(cherry picked from commit 53cfb8327c452bd72a8e915338fb5ec838079cd3)

ticket: 7858
version_fixed: 1.12.2
status: resolved
Fix SAM-2 preauth when password argument is used

sam2_process accesses gak_data to get the password, so that it can do
string-to-key with the etype in the SAM-2 challenge.  When #7642
changed gic_pwd.c to use struct gak_password instead of krb5_data,
sam2_process wasn't altered to match.  We don't see a problem when the
password is read through the prompter (as with kinit), because the
password winds up in the storage field at the beginning of the
gak_password structure.  But when a password is supplied as a
parameter (as with ksu), the storage field is empty and we get the
wrong answer from sam2_process.

(cherry picked from commit 3bedfe7c3724b0d22c72d1684f1cf76cfb600fdd)

ticket: 7862
version_fixed: 1.12.2
status: resolved
Update doc build instructions

Documentation build instructions in doc/README were out of date.
Update them.

(cherry picked from commit bfc8f194ae431fc4fadaa431a2a636b4e9b025dd)

ticket: 7864
version_fixed: 1.12.2
status: resolved
Support referrals from Windows Server 2003

Although RFC 6806 Section 7 requires servers to indicate a client
referral in a WRONG_REALM message, Microsoft Windows Server 2003
returns this information in a message with error code
PRINCIPAL_UNKNOWN.  Failure to follow the referral in these messages
prevents referral chasing in Windows Server 2003 forests.  Detect
referral messages of this type by checking for a non-empty
client.realm field in the response, and activate the referral logic in
these cases.

[tlyu@mit.edu: style, comments, and commit message]

(cherry picked from commit 3093b92734adfe2deb9ad6bad5a221acc967fd8b)

ticket: 7856
version_fixed: 1.12.2
status: resolved
Avoid duplicate "/etc/krb5.conf" in profile path

If configure gets run with --sysconfdir=/etc, "/etc/krb5.conf" shows
up twice in the profile path, which causes its contents to be read
twice.  This can cause some confusing and possibly problematic
behavior.

Add some logic to configure.in to avoid adding the duplicate entry for
"/etc/krb5.conf".

Reported independently by Denis Vlasenko and Fredrik Tolf.

(back ported from commit 8df1965d1ccdbcb8d74a3e68ad35d7579db9ac44)

ticket: 3277
version_fixed: 1.12.2
status: resolved
Correct docs for "kdb5_util load" switches

Remove obsolete parenthetical statement in the description of the
"-update" switch to "kdb5_util load".  Using the "-update" flag to
load a second dump made using the "-ov" switch is no longer necessary
now that the "-r13" format is the default.  Add statement that the
"-b7" dump format was the default for versions prior to 1.2.2 (to
match the statement from "dump" section).

[tlyu@mit.edu: commit message]

(cherry picked from commit 2d0f2fa48df1ea81363de5c78ab7e8cf1ab6d214)

ticket: 7865
version_fixed: 1.12.2
status: resolved
Conditionalize use of LDAP_OPT_DEBUG_LEVEL

The LDAP debug level option (#7551) causes a build failure with the
Solaris LDAP library, which does not have LDAP_OPT_DEBUG_LEVEL.

(cherry picked from commit 0364d0da094be0fbf3a9a08b79b6e23eaaf0d2d7)

ticket: 7870
version_fixed: 1.12.2
status: resolved
Check for malloc failure in process_chpw_request

(cherry picked from commit 4356deefa2d2fe0bc7b52f3b62a387c7ec1eb369)

ticket: 7866
version_fixed: 1.12.2
status: resolved
Update iprop_master_ulogsize documentation

When we removed the maximum number of ulog entries (#7368), we did not
update the documentation for that parameter in kdc.conf.  Reported by
Richard Basch.

(cherry picked from commit 5fa7e666bd81a2222b155bdf3f0c3fc1bc3fabf5)

ticket: 7849
version_fixed: 1.12.2
status: resolved
Initialize err variable in krb5_sendto_kdc

When we get an KRB5_KDC_UNREACH error back from k5_sendto, we check if
the err variable we passed for use by our message handler has been set
to KDC_ERR_SVC_UNAVAILABLE.  If k5_sendto doesn't receive any
response, though, the handler isn't called, so we're reading an
uninitialized variable.  Initialize it to a value other than
KDC_ERR_SVC_UNAVAILABLE to be sure.

[ghudson@mit.edu: initialize err just before calling k5_sendto; edit
commit message]

(cherry picked from commit 1ed3f68c2394fbb48731bba4e4e9a60c8b925ca5)

ticket: 7874
version_fixed: 1.12.2
status: resolved
Fix memory leak in krb5_verify_init_creds

When copying most of the credentials from one cache to another in
copy_creds_except (called from get_vfy_cred, from
krb5_verify_init_creds), we need to free all of the credentials that
we read, not just the ones we copied.

[ghudson@mit.edu: edited commit message]

(cherry picked from commit 27b136d2e3181e787b2d4a03ee712d5d5137f5cd)

ticket: 7875
version_fixed: 1.12.2
status: resolved
Mention k5login_authoritative in k5login docs

In particular, it is set by default.  This can lead to confusing
behavior wherein adding a k5login file removes a user's remote
access.

Make an example more concrete to account for this case.

(cherry picked from commit 8cdc21ef051f43ea8dcabf42540d5cff13b5adeb)

ticket: 7876
version_fixed: 1.12.2
status: resolved