Edit README.asn1

Add another blank line before section headers.  Avoid contractions.
Change some whiches to thats where it seems appropriate.  Fix some
missing or extra words.
Fix error message quotations in install_kdc.rst

Some error messages that kprop could print were quoted incorrectly in
install_kdc.rst.

Also fix minor typos.

ticket: 7785 (new)
target_version: 1.12
tags: pullup
Fix S4U2Self against non-FAST KDCs

When we added FAST TGS support in 1.11, we broke S4U2Self against KDCs
which don't support FAST, because the S4U2Self padata is only present
within the FAST request.  For now, duplicate that padata in the outer
request so that both FAST and non-FAST KDCs can see it.

ticket: 7791
target_version: 1.11.5
tags: pullup
Avoid malloc(0) in SPNEGO get_input_token

If we read a zero-length token in spnego_mech.c's get_input_token(),
set the value pointer to NULL instead of calling malloc(0).

ticket: 7794 (new)
Better keysalt docs

Add a new section to kdc_conf.rst to describe keysalt lists, and
update other documentation to better distinguish enctype lists from
keysalt lists.

ticket: 7608
target_version: 1.12
tags: pullup
make depend
Update man pages
Modernize sn2princ.c

Refactor and edit sn2princ.c to match current coding style.  No
behavior changes, except to be less chatty in trace logs.
Allow ":port" suffixes in sn2princ hostnames

MSSQLSvc principal names can contain a ":port" or ":instance" trailer
on the hostname part.  If we see that in the hostname argument of
krb5_sname_to_principal(), remove it before canonicalizing the
hostname and put it back on afterwards.

ticket: 7795 (new)
Add tests for krb5_sname_to_principal
Fix up tests directory ignores, deps, cleanup

A few test programs didn't make it into .gitignore, OBJS, or
EXTRADEPSRCS.
Fix SPNEGO one-hop interop against old IIS

IIS 6.0 and similar return a zero length reponse buffer in the last
SPNEGO packet when context initiation is performed without mutual
authentication.  In this case the underlying Kerberos mechanism has
already completed successfully on the first invocation, and SPNEGO
does not expect a mech response token in the answer.  If we get an
empty mech response token when the mech is complete during
negotiation, ignore it.

[ghudson@mit.edu: small code style and commit message changes]

ticket: 7797 (new)
target_version: 1.12.1
tags: pullup
Remove unneeded check in SPNEGO initiator

In init_ctx_cont, if the response token contains no fields, we set a
return value but don't actually quit out of the function.  We do not
need this check (we will fail later on if a piece of required
information isn't present), so just remove it.  Reported by
simo@redhat.com.
Fix memory leak in SPNEGO initiator

If we eliminate a mechanism from the initiator list because
gss_init_sec_context fails, free the memory for that mech OID before
removing it from the list.

[ghudson@mit.edu: clarified commit message]

ticket: 7803 (new)
target_version: 1.12.1
tags: pullup
Fix GSS krb5 acceptor acquire_cred error handling

When acquiring acceptor creds with a specified name, if we fail to
open a replay cache, we leak the keytab handle.  If there is no
specified name and we discover that there is no content in the keytab,
we leak the keytab handle and return the wrong major code.  Memory
leak reported by Andrea Campi.

ticket: 7805
target_version: 1.12.1
tags: pullup
Don't require krb5.conf without KRB5_DNS_LOOKUP

For a long time we have allowed krb5 contexts to be initialized in the
absence of krb5.conf--but only if KRB5_DNS_LOOKUP is defined,
presumably on the theory that no KDCs could be contacted without
either DNS support or profile configuration.  But locate plugins could
provide the ability to find KDCs, and some libkrb5 operations (such as
IAKERB initiation) could succeed without needing to locate KDCs.

Also get rid of the profile_in_memory context flag, since we don't use
it any more.
Remove BADSYMS

We haven't been using it or keeping it up to date, and there's no
need to keep it checked in.
Clarify klist -s documentation

The documentation for klist -s erroneously suggests that it doesn't
affect the exit status behavior and that it merely checks for the
existence of the ccache (only mentioning the expired ticket check at
the end).  Make it clearer and simpler, but avoid going into a lot of
detail about the nature of the expiration check.

ticket: 7806 (new)
target_version: 1.12.1
tags: pullup
Remove unused krb5_context fields

The vtbl and locate_fptrs fields were ostensibly related to the locate
pluggable interface, but weren't actually used.
Let SPNEGO display mechanism errors

To avoid potential recursion we use a thread local variable that tells
us whether the ancestor was called via spnego_gss_display_name().  If
we detect recursion, we assume that we returned a com_err code like
ENOMEM and call error_message(); in the worst case that will result in
an "Unknown error" message.

[ghudson@mit.edu: Edited comments and commit message; removed an
unneeded line of code.]

ticket: 7045
target_version: 1.12.1
tags: pullup