In profile_iterator(), return PROF_MAGIC_ITERATOR if *iter_p is NULL,
instead of dereferencing a null pointer, as we did prior to 1.10.
Correct calling code will not trigger this case, but incorrect code
has been reported in the field.

ticket: 8059 (new)
target_version: 1.13.1
tags: pullup

Windows does not provide the glob() functionality used to implement
the /etc/gss/mechs.d/ feature, so we must avoid compiling the
relevant code for windows.  (It would never have been called, anyway.)

Adjust the ccache/Makefile.in rules to not use '-' or '@' in
make variable names that are processed by nmake.

Also in ccache/Makefile.in, remove some latent leading whitespace that
had been previously hidden by the previous rule; this exposed some
flawed dependencies that are now removed.

Windows does not provide sys/socket.h or sys/un.h, so don't try
to include them in cc_kcm.c.

The commit which moved the KKDCP TLS support to a plugin left some
dangling references to checkhost.c byproducts in os/Makefile.in,
which can be safely removed.

Use k5-platform.h in support/json.c instead of a set of system includes;
this lets windows build the static inline helper functions therein.

Add a new credential cache type "KCM" which performs cache operations
by speaking to a Heimdal or OS X KCM daemon, via either Unix domain
sockets or (on OS X only) Mach RPC.  Add "kcm_socket" and
"kcm_mach_service" profile variables to control the socket path and
bootstrap service name respectively.  In ccmarshal.c, add
k5_marshal_mcred to marshal matching credentials in the KCM protocol
representation.

This cache type is not currently supported on Windows, as Windows does
not support Unix domain sockets.

As with the keyring cache type, the lastchange method of this cache
type is mostly useless, reporting only the time of the last change
made through that cache handle.  The KCM protocol currently has no
support for obtaining the last change time of the cache itself.

ticket: 7964 (new)

Make struct k5buf less opaque and get rid of k5buf-int.h.  Make it
easy to initialize a k5buf in an error state so that it can be freed
in a cleanup handler.  Add a function k5_buf_status which returns 0 or
ENOMEM.  Remove k5_buf_data and k5_buf_len.  Rename k5_free_buf to
k5_buf_free.  Adjust all callers to match.

Add three new libprofile tests to prof_test1, two to test for the bugs
in #7971 and one to test a bug which would have been introduced by a
candidate fix.

profile_rename_section should demand only one name.

profile_add_relation should demand only one name if it is creating a
new section.  It aso needs to reset state before calling
profile_find_node for the section, in case it didn't look up any
parent sections previously.

ticket: 7972 (new)
target_version: 1.12.2
tags: pullup

In profile_find_node, skip deleted nodes when finding the second
match.  Otherwise, profile_clear_nodes could return an error if a node
has some values to clear but the last one is deleted.

In profile_node_iterator, skip deleted nodes when looking up the
section names.  Otherwise we could iterate over a deleted section
and/or ignore its replacement.

ticket: 7971 (new)
target_version: 1.12.2
tags: pullup

Make the configure option for TLS implementation more generic, in case
we use the k5tls module for something other than KDC proxy support.
Rename all of the associated symbols for consistency.

ticket: 7929

[ghudson@mit.edu: squashed with similar commits]