Minor correction of [realms] text of kdc.conf
Fix oid set construction in gss_inquire_cred()

Use gssapi calls to construct the oid sets.  It is not safe on windows
to use malloc to hand-construct the set and then call gss_release_oid_set()
to clean it up.

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>

ticket: 7227 (new)
tags: pullup
Fix malformed Parameter Expansion table in docs
Further fixes for WSA/Posix error translation

Don't translate '0' (no error).
Handle WSAEAFNOSUPPORT and WSAEINVAL.
Add Posix->WSA translation.
Add default translation for unrecognized errors.

[ghudson@mit.edu: Merged with master and adjusted comments.]

Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>

ticket: 7228 (new)
tags: pullup
New documention for kadm5.acl
Cross-reference to  kadm5.acl in documentation
Produce man page for kadm5.acl
Remove "Synopsis" from .k5login .k5identity docs
Make gss_ctx_id_t truly opaque

This allows us to still use it for type safety in the APIs while at
the same time prevent code from trying to dereference internal_ctx_id
by mistake.
Always consider desired_mechs empty in spnego

The only case where the spnego gss_aquire_cred function can be called
with specific OIDs is if the mechglue calls spenego with the spengo
oid, which we never want to loop on anyway. So always consider it as
null, it's the correct behavior with current semantics.
Add "feedback" button to the header in Sphinx HTML
Announce myself as a member of the Kerberos Team
Reuse code to free gss_mech_info structure
Clarify example in kadm5.acl document
Doc "version introduced" for some kdc.conf tags

Also, move [logging] section documentation after [dbmodules]
documentation.
Always consider desired_mechs empty in spnego (2)

Follow previous change to add_cred_from.
The only case where the spnego gss_*_cred_* functions can be called
with specific OIDs is if the mechglue calls spnego with the spengo
oid, which we never want to loop on anyway. So always consider it as
null, it's the correct behavior with current semantics.
Pass the actual mech oid in creds functions

This way the mechanism handler knows what mech type is intended.
This allows plugin that implement multiple mechanisms or interposer
plugins to know what they are being asked to do.
Turn off replay cache in krb5_verify_init_creds()

The library isn't attempting a replay attack on itself, so any detected
replays are only going to be false-positives.

ticket: 7229 (new)
Use '---' for em dashes in rst source

Our sphinx configuration uses SmartyPants, which produces smart
quotes and dashes in HTML output, using '--' for en dash and
'---' for em dash.  (This is also the LaTeX convention.)
These points in the text are meant to be em dashes, so format them
as such.  Also standardize on no spaces around the dash per
Chicago Manual of Style (and others).
Remove dash from man page rst source

This page gets rendered for the web with Sphinx but is also turned
into the krb5_conf.5 manual page.  We need to use three-hyphen
em dashes for the Sphynx config, but those are a bit long for
monospace terminal output.  Since the dash here can easily be
changed to a comma, do so, and avoid the conflict of formatting.