Add warnings for Kerberos GSS algorithms deprecated in RFCs 6649 and 8429.

[jhb]

Summary

All of these algorithms are explicitly marked SHOULD NOT in one of these
RFCs.

Specifically, RFC 6649 deprecates all algorithms using DES as well as
the "export-friendly" variant of RC4. RFC 8429 deprecates Triple DES
and the remaining RC4 algorithms.

Test Plan

• I have not tested this and don't even know where to begin with starting to test it (I've never used Kerberos).

[cem]

Note that these macros are printed every time a routine is invoked and don't have rate limiting built in. That may be spammy for this use. (Maybe they should have rate-limiting built in.)

[jhb]

From my code reading these init routines should be called rarely (during session setup as opposed to per-packet). If someone is able to test this and finds it is in fact spammy I'd be happy to rate limit it.

[cem]

In D20343#438694, @jhb wrote:

From my code reading these init routines should be called rarely (during session setup as opposed to per-packet). If someone is able to test this and finds it is in fact spammy I'd be happy to rate limit it.

That seems ok to me. I might have worded it poorly earlier; I'm just saying I'm unfamiliar with this code and how frequently these functions are called. :-)

[rmacklem]

I haven't had a Kerberos setup for quite a while.
However, Peter Errikson uses Kerberized NFS and even with a Windows KDC, I think?

He has been quite willing to test other NFS stuff for me, so he might be willing to
test this?

His email is: [e-mail]

[jhb]

Added ratelimiting.

[jhb]

I still haven't setup GSSAPI for NFS to run test this, but I did some more code reading and am convinced that just a single call to gss_init_sec_context or gss_alloc_sec_context() which ends up call get_keys() can result in multiple calls to krb5_alloc_key and possibly multiple calls to krb5_derive_key, and each call to krb5_alloc_key or krb5_derive_key runs the init routine that contains the warning. As a result, I decided to add rate limiting with the rate limit set to only whining once per hour. This should avoid spamming while still getting the point across.