Allow logger.c to work with redirected stderr

In lib/kadm5/logger.c:krb5_klog_init(), if the configuration requests
STDERR logging, call fdopen() using mode "w" instead of "a+", to avoid
errors when stderr happens to be opened for write only.

ticket: 8001 (new)
target_version: 1.13
tags: pullup
Fix KCM ccache per-type cursor

The KCM per-type cursor was too simplistic and did not obey the
conventions of the other ccache types.  Fix it to return a singleton
cursor when the default cache is a subsidiary and to return the
primary cache first.

For internal convenience, make_cache now accepts a context parameter
and creates a kcmio if necessary.

ticket: 8002 (new)
target_version: 1.13
Fix unlikely memory leak in KCM client

Commit 956cbd24e645609c94fbc836840ce0f87ba3ce79 created a memory leak
if the KCM_OP_GET_DEFAULT_CACHE call fails inside kcm_ptcursor_new
after the KCM_OP_GET_CACHE_UUID_LIST call succeeds.  Fix it.

ticket: 8002
Update NOTICE with new changes for 1.13

The KCM RPC definitions are copyright KTH/Apple, since it is present
for interoperability with OS X.

Add MS-KKDCP client copyright; alas, it does not match the existing
Red Hat copyrights, since the new code is a 2-clause BSD license, and
there was only a 3-clause Red Hat copyright block present already.

The actual Sphinx output for NOTICE would adjust the wrapping and
indentation of some existing content, but those changes were removed
by hand, so this commit only reflects new added content.

ticket: 8006
tags: pullup
target_version: 1.13
Re-encrypt preserved key data in new master key

When we are preserving old key data in kdb_cpw.c, ensure that it is
encrypted with the same master key as the new key data.  This ensures
that the KRB5_TL_MKVNO tl-data on the principal entry applies to all
of the key data, not just some of it.

ticket: 7995
target_version: 1.13
tags: pullup
Add test case for -keepold mkey re-encryption

ticket: 7995
Simplify kdb_cpw.c

In add_key_rnd, stop looking up the krbtgt DB entry; we have not used
it since 1.1.

Use copy_key_data in add_key_rnd and add_key_pwd.

krb5_dbe_crk, krb5_dbe_ark, krb5_dbe_def_cpw, and krb5_dbe_apw all
contained similar logic.  Consolidate all of them into a static helper
function which does the work of all four.  The ark/apw variants had
slightly different behavior then crk/cpw with keepold=true, so
introduce a three-value enum to express all three behaviors.
Fix uninitialized variable bug in kdb_cpw.c

Now that add_key_rnd isn't looking up the TGT principal entry, it
could use retval before initializing it if the loop runs for zero
iterations.  Get rid of the add_key_rnd label (as it no longer does
anything) and just return 0 after the loop ends.
In ksu, handle typeless default_ccache_name values

When a configured or compiled-in default ccache name doesn't contain a
cache type and ':' as a prefix, add one to the writeable value that we
construct when we go to look it up.  This lets the rest of the
application always assume that it'll be there.

[ghudson@mit.edu: minor style changes]

ticket: 8007 (new)
target_version: 1.13
tags: pullup
Document clock skew tolerance for ticket times

KDC and application server checks on ticket start and expiration times
are subject to clock skew tolerance.  Document this grace period.

[tlyu@mit.edu: edit commit message, adjust wording to conform to
existing style, document start time clock skew]

ticket: 8008 (new)
target_version: 1.13
tags: pullup
Try to scan_ccache() after leash picks a cache

We need to call scan_ccache() in order to notice that there
are credentials and read their expire time.

The call to scan_ccache() in the Leash case was inadvertently
removed as part of commit 8651f3339ccc5a623172a8edfb9cf522883acacd.

ticket: 7998 (new)
tags: pullup
target_version: 1.12.3
subject: gssapi.dll tries to get initial creds even when some are present
Add some KDC entries to the registry via WiX

Though our library happily uses DNS, I can't get Windows to
successfully contact KDCs found through the SRV records.
So, we do need to stay in the business of shipping around
KDC entries, after all.

ticket: 7999 (new)
queue: kfw
tags: pullup
target_version: 1.12.3
Let libgssapi see TGTs in the MSLSA cache

When the current user is a local administrator of a windows machine
where User Account Control (UAC) is enabled, the Windows LSA will
return a block of zeros as the session key for any TGT entry in the
MSLSA: cache.  The lcc_retrieve() implementation checks for such
"null" session keys and prevents them from escaping to callers (as
attempts to use them would encounger strange errors).  However,
when the TGT is the only entry in the cache, this filtering prevents
scan_ccache() from detecting that the cache contains non-expired
credentials (and that there is a TGT present).

Since scan_ccache() is only looking at metadata in the cache entries,
and does not need to actually use any tickets or session keys, set
the KRB5_TC_NOTICKET flag on the ccache before scanning it.  This
will allow the MSLSA implementation to return a cred for the TGT
entry and cause the GSSAPI credential selection algorithm to function
properly.

ticket: 8000 (new)
tags: pullup
target_version: 1.12.3
subject: gssapi.dll fails to detect TGTs in the MSLSA cache when UAC is enabled
Remove old Windows support from cc_mslsa.c

It is safe to remove is_windows_2000(), is_windows_xp(), and
is_windows_vista(), since the former two only check for very old
versions of windows which are no longer supported, and
is_windows_vista() was unused.  Note that the check being implemented
was whether the running OS was the named version or higher, not an
exact match.  The current Microsoft documentation recommends against
the sort of OS version checks that were employed here, in favor of
explicit feature tests.

Remove is_broken_wow64() as the problem it works around (Microsoft
Article ID 960077) is believed to have been fixed in subsequent
updates to Windows Server 2003 and XP.

Remove does_retrieve_ticket_cache_ticket() since support for the
KERB_RETRIEVE_TICKET_CACHE_TICKET flag in the
KERB_RETRIEVE_TKT_REQUEST structure was added in service packs for
Windows Server 2003 and XP.  Also remove buildtime fallbacks that
are no longer needed.

Remove the conditionals TRUST_ATTRIBUTE_TRUST_USES_AES_KEYS,
HAVE_CACHE_INFO_EX2, and KERB_SUBMIT_TICKET as all current SDK
versions have the relevant functionality.

In all cases, de-indent chunks that are no longer conditional.
Where indentation levels changed, update the style of the reindented
code to current practices.

ticket: 7989
comment some future cleanup for cc_mslsa.c

The function does_query_ticket_cache_ex2() will not be needed once
Windows Server 2003 drops out of support in approximately one year's
time.  Note the doom timer at its definition, to facilitate future
cleanup.

ticket: 7989
Remove unused code from cc_mslsa.c

Remove PreserveInitialTicketIdentity() and IsKerberosLogon(), as well
as the preprocessor conditionals ENABLE_PURGING and PURGE_ALL, which
have not been used in a very long time, if ever.

There was one potential callsite of IsKerberosLogon(), in
lcc_resolve(), which was disabled.  It is perfectly reasonable to want
to use the MSLSA cache on a non-domain-joined workstation, as it is
now a read-write cache type, so we need not concern ourselves whether
the logon was performed or may have been performed using kerberos.

ticket: 7989
Rename cc_mslsa.c routines to avoid OS versions

We don't care about XP versus non-XP; just indicate which
revision of the data type is being used.

Standardize on the lowercase 'x' in "Ex", for both the "Ex" and
"Ex2" forms.

While here, adjust the function definition prototypes to match
current style.

ticket: 7989
Move realm conversion into helper in cc_mslsa.c

All the callers of UnicodeStringToMITPrinc() were already converting
a UnicodeString into a wchar* just to pass it in as the realm.

Simplify everyone's life by making the helper do the conversion.

ticket: 7989
Avoid unneeded GetMSTGT() calls in cc_mslsa.c

both lcc_resolve() and lcc_get_principal() were using GetMSTGT()
to fetch a ticket from which to obtain the client principal name
of the credentials cache.  However, that name is contained in
the results of the the cache information query; there is no need
to retrieve a full ticket of any sort to get it.  Since there
may sometimes be difficulties obtaining a TGT when UAC is enabled,
avoid these unneeded calls.

ticket: 7989