Change example module name in host_config.rst

Don't use "otp" as the example clpreauth module name in
host_config.rst, since we now ship an effectively built-in otp
clpreauth module.  Instead use "mypreauth".

ticket: 7920 (new)
target_version: 1.12.2
tags: pullup
Make x-deltat.y work with bison 3

Bison 3 removed support for YYPARSE_PARAM and YYLEX_PARAM, breaking
x-deltat.y.  Use %parse-param and %lex-param instead.  (In Bison 3 we
could use just %param, but that doesn't work in 2.x.)  The parameter
added by %parse-param is also passed to yyerror, so adjust the macro
we use to suppress yyerror accordingly.

Also use "%define api.pure" instead of "%pure_parser", which was
deprecated in bison 2.3b.  (The correct spelling was actually
"%pure-parser", and bison 3 generates a warning about the underscore
spelling.)

Regenerate deltat.c using the new x-deltat.y and bison 3.0.2.

ticket: 7923
Simplify sendto_kdc.c

* Get rid of the "x" member of conn_state, which used to be a union
  but hasn't been since r14742.
* Define a structure type for the "out" member of conn_state.
* Rename incoming_krb5_message to incoming_message for brevity.
* Make the "pos" member of incoming_message an offset instead of a
  pointer, simplifying several present and future computations.
* Use "in" and "out" aliases to the conn_state in and out members
  where it improves brevity.
* Rename set_conn_state_msg_length to set_transport_message and give
  it a descriptive comment.
* Call set_transport_message from start_connection only, instead of
  once in add_connection and perhaps again in start_connection.  To
  make this possible, pass the original message argument to maybe_send
  and start_connection.
* Use make_data and empty_data helpers where appropriate.
Add helper to determine if a KDC is the master

Add a new function k5_kdc_is_master in locate_kdc.c to determine
whether a KDC matches one of the masters, and use it in
krb5_sendto_kdc.
Use k5_transport(_strategy) enums for k5_sendto

In k5_sendto and k5_locate_server, replace "socktype" parameters with
a new enumerator k5_transport, so that we can add new transports which
are not in the socket type namespace.  Control the order in which we
make connections of different types using a new k5_transport_strategy
enumerator, to simplify the logic for adding new transports later.
Control the result of k5_locate_server with a no_udp boolean rather
than a socket type.

[ghudson@mit.edu: renamed type to k5_transport; k5_locate_server
 no_udp change; clarified commit message; fix for Solaris getaddrinfo]
[kaduk@mit.edu: name variables of type k5_transport 'transport']
[nalin@redhat.com: use transport rather than sock_type in more places,
 add and use k5_transport_strategy, update the test program]

ticket: 7929
Build support for TLS used by HTTPS proxy support

Add a --with-proxy-tls-impl option to configure, taking 'openssl',
'auto', or invocation as --without-proxy-tls-impl.  Use related CFLAGS
when building lib/krb5/os, and LIBS when linking libkrb5.  Call the
OpenSSL library startup functions during library initialization.

ticket: 7929
Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGE

Handle encoding and decoding [MS-KKDCP] proxy messages, including
handling of the additional length bytes.  Early versions of [MS-KKDCP]
incorrectly omit that the size of the proxied message is prepended to
the proxied message, as it is when we're using plain TCP, before
encoding the proxy-message structure.  This is fixed at least as of
version 2.1 of the spec.

[nalin@redhat.com: add tests]

ticket: 7929
Dispatch-style protocol switching for transport

Switch to using per-transport-type functions when a socket that we're
using to communicate with a server becomes readable or writable, and add
them as pointers to the connection state.  The functions are passed the
name of the realm of the server being contacted, as we expect to need
this in the near future.

[nalin@redhat.com: replace macros with typedefs]
[nalin@redhat.com: compare transports with TCP_OR_UDP rather than with 0]

ticket: 7929
HTTPS transport (Microsoft KKDCPP implementation)

Add an 'HTTPS' transport type which connects to an [MS-KKDCP] proxy
server using HTTPS to communicate with a KDC.  The KDC's name should
take the form of an HTTPS URL (e.g. "https://proxybox/KdcProxy").

An HTTPS connection's encryption layer can be reading and writing when
the application layer is expecting to write and read, so the HTTPS
callbacks have to handle being called multiple times.

[nalin@redhat.com: use cleanup labels, make sure we always send the
 realm name, keep a copy of the URI on-hand, move most of the
 conditionally-compiled sections into their own conditionally-built
 functions, break out HTTPS request formatting into a helper function,
 handle the MS-KKDCP length bytes, update comments to mention specific
 versions of the MS-KKDCP spec, differentiate TCP and HTTP trace
 messages, trace unparseable responses]

ticket: 7929
Load custom anchors when using KKDCP

Add an http_anchors per-realm setting which we'll apply when using an
HTTPS proxy, more or less mimicking the syntax of its similarly-named
PKINIT counterpart.  We only check the [realms] section, though.

ticket: 7929
Check names in the server's cert when using KKDCP

When we connect to a KDC using an HTTPS proxy, check that the naming
information in the certificate matches the name or address which we
extracted from the server URL in the configuration.

ticket: 7929
Add some longer-form docs for HTTPS

Add some longer-form documentation for the new HTTPS support, walking a
prospective administrator through generating a bare minimal signing
setup, deploying a WSGI-based proxy server onto an Apache httpd server
using mod_ssl and mod_wsgi, and configuring clients to use it.

ticket: 7929
Have k5test.py provide 'runenv' to python tests

Expose the formerly-internal _runenv module as k5test.runenv, so that
settings we store in the top-level runenv.py will be available to them.

ticket: 7929
Add a simple KDC proxy test server

This proxy server uses python-paste to run the kdcproxy from
https://pypi.python.org/pypi/kdcproxy.  It should be used along
with the proxy.pem certificate in ../tests/dejagnu/proxy-certs.

ticket: 7929
Add tests for MS-KKDCP client support

Exercise the MS-KKDCP client support using the test proxy server, for
AS, TGS, and kpasswd requests while also checking the certificate
verification and name checks.

ticket: 7929
Remove stub pkinit_mapping_file code

As contributed, the PKINIT code contained code to read a mapping
filename, but never used the resulting structure variable.  Get rid of
the structure field and the code to populate it.
Do not document pkinit_mapping_file

This feature was never implemented in the PKINIT code as it was
contributed; there was only stub support for reading the filename.

ticket: 7928 (new)
target_version: 1.12.2
tags: pullup
Unlocked db2 KDB iteration

Try to make an optional db2 iterator that unlocks (and therefore
closes) the KDB between iterations, to allow large KDBs to be dumped
without blocking writes for a long time.

This is a hackish proof of concept.  It won't work for all consumers
of db_iterate, especially ones that need to hold other locks while
iterating.