Export gssrpc_bindresvport_sa

It was added in commit 0d04b60d159ab83b943e43802b1449a3b074bc83, but
was not added to the library export symbol list, and thus was unusable
on systems that enforced library export lists.

ticket: 8003 (new)
tags: pullup
target_version: 1.13
Map .hin files to the C language for doxygen

In Debian unstable, the current version of doxygen is unhappy with
our generated Doxyfile, and does not handle krb5.hin in the expected
fashion (as a C header).  Work around this issue by explicitly
specifying that files with the .hin extension are to be treated
as C language files.

ticket: 8004 (new)
tags: pullup
target_version: 1.13
Initialize iterflags in update_princ_encryption

It is only assigned to in the non-dry-run case, which clang detects
and aborts the build (when maintainer mode is enabled).

ticket: 8005 (new)
tags: pullup
target_version: 1.13
Allow logger.c to work with redirected stderr

In lib/kadm5/logger.c:krb5_klog_init(), if the configuration requests
STDERR logging, call fdopen() using mode "w" instead of "a+", to avoid
errors when stderr happens to be opened for write only.

ticket: 8001 (new)
target_version: 1.13
tags: pullup
Fix KCM ccache per-type cursor

The KCM per-type cursor was too simplistic and did not obey the
conventions of the other ccache types.  Fix it to return a singleton
cursor when the default cache is a subsidiary and to return the
primary cache first.

For internal convenience, make_cache now accepts a context parameter
and creates a kcmio if necessary.

ticket: 8002 (new)
target_version: 1.13
Fix unlikely memory leak in KCM client

Commit 956cbd24e645609c94fbc836840ce0f87ba3ce79 created a memory leak
if the KCM_OP_GET_DEFAULT_CACHE call fails inside kcm_ptcursor_new
after the KCM_OP_GET_CACHE_UUID_LIST call succeeds.  Fix it.

ticket: 8002
Update NOTICE with new changes for 1.13

The KCM RPC definitions are copyright KTH/Apple, since it is present
for interoperability with OS X.

Add MS-KKDCP client copyright; alas, it does not match the existing
Red Hat copyrights, since the new code is a 2-clause BSD license, and
there was only a 3-clause Red Hat copyright block present already.

The actual Sphinx output for NOTICE would adjust the wrapping and
indentation of some existing content, but those changes were removed
by hand, so this commit only reflects new added content.

ticket: 8006
tags: pullup
target_version: 1.13
Re-encrypt preserved key data in new master key

When we are preserving old key data in kdb_cpw.c, ensure that it is
encrypted with the same master key as the new key data.  This ensures
that the KRB5_TL_MKVNO tl-data on the principal entry applies to all
of the key data, not just some of it.

ticket: 7995
target_version: 1.13
tags: pullup
Add test case for -keepold mkey re-encryption

ticket: 7995
Simplify kdb_cpw.c

In add_key_rnd, stop looking up the krbtgt DB entry; we have not used
it since 1.1.

Use copy_key_data in add_key_rnd and add_key_pwd.

krb5_dbe_crk, krb5_dbe_ark, krb5_dbe_def_cpw, and krb5_dbe_apw all
contained similar logic.  Consolidate all of them into a static helper
function which does the work of all four.  The ark/apw variants had
slightly different behavior then crk/cpw with keepold=true, so
introduce a three-value enum to express all three behaviors.
Fix uninitialized variable bug in kdb_cpw.c

Now that add_key_rnd isn't looking up the TGT principal entry, it
could use retval before initializing it if the loop runs for zero
iterations.  Get rid of the add_key_rnd label (as it no longer does
anything) and just return 0 after the loop ends.