openssh: Support building with MIT KRB5

Remove HEIMDAL=1 from openssh/krb5_config.h and move the definition
to the Makefile in order to control whether we're building under
Heimdal or MIT.

Add MIT KRB5 LIBS and INCLUDES to the openssh build.

Sponsored by:		The FreeBSD Foundation
Reviewed by:		markj
Differential revision:	https://reviews.freebsd.org/D50782

crypto/openssh/krb5_config.h

@@ -6,5 +6,4 @@
 #define HAVE_KRB5_CC_NEW_UNIQUE 1
 #define HAVE_KRB5_FREE_ERROR_MESSAGE 1
 #define HAVE_KRB5_GET_ERROR_MESSAGE 1
-#define HEIMDAL 1
 #define KRB5 1

secure/libexec/sshd-session/Makefile

@@ -40,6 +40,15 @@ LDFLAGS+=-L${LIBBLACKLISTDIR}
 
 .if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
 LIBADD+=	gssapi_krb5 gssapi krb5
+.if ${MK_MITKRB5} != "no"
+.include "../../krb5/Makefile.inc"
+CFLAGS+=	-I${KRB5_DIR}/include \
+		-I${KRB5_SRCTOP}/include \
+		-I${KRB5_OBJTOP}/lib \
+		-I${KRB5_DIR}/lib/gssapi/generic \
+		-I${KRB5_DIR}/lib/gssapi/krb5 \
+		-I${KRB5_DIR}/lib/gssapi/mechglue
+.endif
 .endif
 
 .if ${MK_TCP_WRAPPERS} != "no"

secure/ssh.mk

@@ -11,6 +11,10 @@ CFLAGS+= -I${SSHDIR} -include ssh_namespace.h
 
 .if ${MK_GSSAPI} != "no" && ${MK_KERBEROS_SUPPORT} != "no"
 CFLAGS+= -include krb5_config.h
+.if ${MK_MITKRB5} == "no"
+CFLAGS+= -DHEIMDAL=1
+.endif
+
 .endif
 
 CFLAGS+= -DXAUTH_PATH=\"${LOCALBASE:U/usr/local}/bin/xauth\"