ticket: 7585

Add k5-int.h static functions to duplicate byte ranges, optionally
with a trailing zero byte, and set an error code like k5alloc does.
Use them where they would shorten existing code.

Mostly this gets rid of the trailing space on line 2 after
bb76891f5386526bdf91bc790c614fc9296cb5fa.

Correct three cases where the wrong expression was checked to see if
an allocation function returned null.

[ghudson@mit.edu: commit message, patch splitting]

ticket: 7534
target_version: 1.11.1
tags: pullup

An error case in __bt_first would deference a null pointer.  This is
an old upstream BDB bug.  Use a separate variable to hold the result
of mpool_get() until it has been checked.  Reported by Nickolai
Zeldovich <nickolai@csail.mit.edu>.

ticket: 7511

Since there is no overlap between the clpreauth and kdcpreauth
interface declarations, there's no particular reason to combine them
into one header.  For backward compatibility and convenience, leave
behind a preauth_plugin.h which includes both.

In the db2 kdb module, use blocking locks for the policy DB as well as
the principal DB.

ticket: 7359

This function wasn't used anywhere.  Also remove the declaration for
osa_adb_close_policy(), which doesn't exist.

The lock inconsistency fixed here is quite possibly the same as
described in https://bugzilla.redhat.com/show_bug.cgi?id=586032 .

The problem is that ctx_unlock() fails to unlock the principal DB if
it fails to unlock the policy DB, and this happens when ctx_lock()
fails to lock the policy DB (likely because the caller is racing
against a kdb5_util load, which will be using a "permanent" lock,
meaning that the lock file will be unlinked after acquiring the
lock).  The fix is to perform both unlock operations *then* handle
any errors that either or both might have returned.

Additionally, we don't really need or want to use non-blocking locks,
and we certainly don't want to sleep(1) in krb5kdc (possibly several
times, as there was a loop over this) when either of the principal or
policy DB is locked.  Some callers still request non-blocking locks,
and ctx_lock() still honors this.

ticket: 7360 (new)