Fix fencepost error in krad timeout handler

ticket: 7911
target_version: 1.12.2
tags: pullup
Improve pointer hygiene around gss_display_name

GSSAPI functions are responsible for setting their output parameters
on failure.  Take greater care to do so in krb5_gss_display_name.

The mechglue is generally defensive about initializing variables used
as outputs, and not assuming that mechs will set them on failure.
Make gssint_convert_name_to_union_name initialize
union_name->external_name before calling mech->gss_display_name, so
that if the mech's gss_display_name doesn't touch it, we don't free an
uninitialized pointer.

Either one of these changes prevents an unlikely memory bug which
could occur if krb5_gss_init_context fails within
krb5_gss_display_name when called from
gssint_convert_name_to_union_name.

ticket: 7915 (new)
target_version: 1.12.2
Don't blindly use PKCS11 slot IDs in PKINIT

Passing invalid slot IDs to C_OpenSession can cause some PKCS #11
implementations (such as the Solaris one) to crash.  If a PKINIT
identity specifies a slotid, use it to filter the result of
C_GetSlotList, but don't try it if it does not appear in the list.

ticket: 7916
target_version: 1.12.2
tags: pullup
Properly handle PKCS11 label in PKINIT

The CK_TOKEN_INFO label field is defined to be zero-filled, but it may
not be zero-terminated if all bytes of the field are used.  Use only
length-counted operations to process it.  Also avoid underrunning the
buffer pointer if the label is empty or contains only whitespace.

ticket: 7917
target_version: 1.12.2
tags: pullup
profile: profile_get_boolean_by_path, profile_get_integer_by_path, profile_get_string_by_path

Allows variable path depth instead of 3 level path with current profile_get_boolean etc.
so we could use more subsections levels without profile_iterator...
kdb_ldap: New config parsing

- Introduced 4 new subsection ldap_kdc, ldap_kadmin, ldap_kpasswd, ldap_other
- Replaced ldap_kdc_dn, ldap_kpasswd_dn, ldap_kadmin_dn with one ldap_dn
- Options are searched in this oreder
    1. Server specific section (eg. ldap_kdc, ldap_kadmin, ldap_kpasswd, ldap_other)
    2. Module specific section within dbmodules (KDB_MODULE_SECTION)
    3. dbdefaults section (KDB_MODULE_DEF_SECTION)
- Options ldap_servers, ldap_dn, ldap_conns_per_server, ldap_service_password_file
  can now be in any relevant section

[dbdefaults]
    ldap_servers = ldap://slave.test

[dbmodules]
    ldapconf = {
        dbname = ldap
        db_library = kldap
        ldap_kerberos_container_dn = "ou=Kerberos,dc=st"
        ldap_servers = ldap://master.test

        ldap_kdc = {
            ldap_servers = ldap://slave.test
            ldap_dn = "dn=kdcdn,dc=test"
            ldap_conns_per_server = 2
            ldap_service_password_file = /etc/krb5_kdc.service
        }
        ldap_kadmin = {
            ldap_dn = "dn=kadmindn,dc=test"
            ldap_conns_per_server = 3
            ldap_service_password_file = /etc/krb5_kadmin.service
        }
        ldap_kpasswd = {
            ldap_dn = "dn=kpasswddn,dc=test"
            ldap_conns_per_server = 4
            ldap_service_password_file = /etc/krb5_kpasswd.service
        }
	ldap_other = {
            ldap_dn = "dn=kdb,dc=test"
            ldap_conns_per_server = 4
            ldap_service_password_file = /etc/krb5_kdb.service
	}
    }
kdb_ldap: SASL support

- Add support for SASL authentification
- Remove old SASL implementation

Valid config options:
ldap_debug (int)
- The  debug  level  of  the  client  library. See ldap_set_option(3).

ldap_starttls (boolean)
- Should we start StartTLS. StartTLS would not be issued if server uri starts with ldaps://.

ldap_auth_method (string) { none | simple | sasl }
- "none" for anonymous bind
- "simple" for simple bind
- "sasl" for SASL bind

ldap_sasl_mech (string)
- SASL mechanism. See SASL documentations.

ldap_sasl_user (string)
- The username to authenticate. See SASL documentations.

ldap_sasl_auth_user (string)
- The username to use for proxy authorization. See SASL documentations.

ldap_sasl_realm (string)
- The realm for the authentication attempt. See SASL documentations.

ldap_sasl_secret (string)
- The password for the provided username. See SASL documentations.

ldap_tls_cacert_file (string)
- The full-path of CA certificate file.

ldap_tls_cacert_dir (string)
- Path to CA certification dir.

ldap_tls_cert_file (string)
- The full-path of certificate to be used for EXTERNAL mech.

ldap_tls_cert_key_file (string)
- Filename of Certificate key to be used for EXTERNAL mech.

ldap_tls_reqcert (string) { none | allow | try | demand | hard }
- The peer certificate checking strategy. See SSL/LDAP documentation.

ldap_tls_crl_file (string)
- The full-path of the CRL file. Depands on SSL implementation. See ldap_set_option(3)

ldap_tls_crlcheck (string) { none | peer | all }
- The  CRL evaluation strategy. Depands on SSL implementation. See ldap_set_option(3)

Here is sample config for SASL EXTERNAL

[dbmodules]
     ldapconf = {
         dbname = ldap
         db_library = kldap
         ldap_kerberos_container_dn = "ou=Kerberos,dc=example"
         ldap_servers = ldap://server.example
         ldap_starttls = 1
         ldap_conns_per_server = 5
         ldap_auth_method = sasl
         ldap_sasl_mech = EXTERNAL
         ldap_tls_cacert_file = /etc/pki/tls/certs/cacert.pem
         ldap_tls_cert_file = /etc/pki/tls/certs/server.pem
         ldap_tls_cert_key_file = /etc/pki/tls/private/server.key
         ldap_tls_reqcert = demand
         }

Conflicts:

	src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
	src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
	src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
	src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c