pull up r20413 from trunk

pull up r20413 from trunk

 r20413@cathode-dark-space:  jaltman | 2008-06-18 15:36:49 -0400
 ticket: 5924
 tags: pullup

 This patch is derived from a patch originally submitted to RT
 by: Nik Conwell <nik@bu.edu>

 krb5_set_real_time() accepts as input the time of the KDC
 or an application server as a combination of seconds and
 microseconds.  Often it is the case that the time source
 does not provide the real time with less than one second
 granularity.  Up until this patch such a caller would fill
 in the microseconds parameter as zero.   krb5_set_real_time()
 would treat the zero microseconds as the actual reported
 time and compute a microsecond based offset.

 During a one second window subsequent calls to
 krb5_set_real_time() would have an ever increasing offset
 size until the number of seconds is incremented.  This
 in turn produces a side effect in which the microseconds
 value of the local clock is effectively erased.

 If there are multiple processes or threads on the same
 machine each requesting service tickets using the same
 client principal for the same service principal where
 the number of seconds reported by the KDC are equivalent,
 then they will now all create authenticators with
 exactly the same timestamp.  As a result, the authenticating
 service will detect a replay attack even though the
 authenticators are actually unique.  The replay cache
 only maintains a tuple of client, server and timestamp.

 This patch modifies the interpretation of the microseconds
 parameter.  If -1 is specified, the microseconds offset is
 ignored.

ticket: 5924
version_fixed: 1.6.4

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-6@20519 dc483132-0cff-0310-8789-dd5450dbe970