Always include salt in LDAP KrbKey encoding

In the LDAP KDB module, ensure that every krb5_key_data we pass to
asn1_encode_sequence_of_keys includes a salt type, for compatibility
with the decoder in unpatched krb5 1.11 and 1.12.

This is not a behavior change by itself; since 1.7 the encoder has
always included a KrbKey salt field because it erroneously treats that
field as non-optional.  (Luckily, the encoded salt always happens to
have salt type 0 because krb5_key_data constructors start with zeroed
memory.)  The next commit will fix the encoder and decoder to properly
treat the KrbKey salt field as optional, so we need this change to
ensure that our encodings remain compatible.

Also fix the ASN.1 tests to set key_data_ver correctly for the sample
test key data.

(cherry picked from commit 1825455ede7e61ab934b16262fb5b12b78a52f1a)

ticket: 7919
version_fixed: 1.12.2
status: resolved
Treat LDAP KrbKey salt field as optional

Per the ASN.1 definition, the KrbKey salt field is optional.  Since
1.7, we have been treating it as mandatory in the encoder; since 1.11,
we have been treating it as mandatory in the decoder.  Mostly by luck,
we have been encoding a salt type of 0 when key_data_ver is 1, but we
really should not be looking at key_data_type[1] or key_data_length[1]
in this situation.  Treat the salt field as optional in the encoder
and decoder.  Although the previous commit ensures that we continue to
always encode a salt (without any dangerous assumptions about
krb5_key_data constructors), this change will allow us to decode key
data encoded by 1.6 without salt fields.

This also fixes issue #7918, by properly setting key_data_ver to 2 if
a salt type but no salt value is present.  It is difficult to get the
decoder to actually assign 2 to key_data_ver just because the salt
field is there, so take care of that in asn1_decode_sequence_of_keys.

Adjust kdbtest.c to match the new behavior by setting key_data_ver to
2 in both test keys.

(cherry picked from commit fb5cd8df0dbd04dac4f610e68cba5b80a3cb8d48)

ticket: 7919
version_fixed: 1.12.2
status: resolved
Do not loop on add_cred_from and other new methods

Several new GSS-API methods were added but GSSAPI_ADD_METHOD was
called to add them rather than GSSAPI_ADD_METHOD_NOLOOP.  This means
that the implementation from the GSS-API mechglue would be used if the
mechanism had no implementation.  As a result, the mechglue will call
into itself exhausting the call stack in an endless loop when one of
these methods is called.

(cherry picked from commit 41d38531043b99e8daa334f2b6ddf376adf1e878)

ticket: 7926
version_fixed: 1.12.2
status: resolved
Add missing profile functions to libkrb5 exports

profile_flush_to_buffer, profile_flush_to_file, profile_free_buffer,
profile_init_flags, and profile_init_vtable are all public profile
functions, but are inaccessible to libkrb5 applications on some
platforms because they were never added to the export list.  Add them
now.

(libprofile functions have never been part of the Windows DLL export
list, so do not change krb5_32.def at this time.)

(cherry picked from commit dc1a76ccc5d3a6972d0f21d38389ff39e54f283a)

ticket: 7930
version_fixed: 1.12.2
status: resolved
Do not document pkinit_win2k

This variable was never used in the PKINIT code as it was contributed;
there was only code to read its value.

(cherry picked from commit e161636590429aa78a3f04a8bbe0a36dda48a8ab)

ticket: 7932
version_fixed: 1.12.2
status: resolved
Improve PKINIT certificate documentation

Describe how to use a commercially-issued server certificate for
anonymous PKINIT.  Separate the KDC and client configuration
instructions so that the steps necessary for anonymous PKINIT are not
combined with the additional steps necessary for regular PKINIT.
Describe kpServerAuth as the EKU used in commercially issued server
certificates, not as the value used by Microsoft (which does not
appear to be true according to [MS-PKCA]).

(cherry picked from commit 677c7753923e5efa078074611d4474fbcc10f6a1)

ticket: 7931
version_fixed: 1.12.2
status: resolved
Consolidate DB option documentation

Document DB options in the kadmin/kadmin.local man page, in their own
section.  Refer to that section from the documentation of the -x
parameter of each other command which supports DB options.  Add
documentation for the "dbname" DB2 option.

(cherry picked from commit 1cddc360c25386a55dc2f2d44056c88721784dd6)

ticket: 7946
version_fixed: 1.12.2
status: resolved