Update mkrel for SPHINX_ARGS

Update mkrel so that it will explicitly set SPHINX_ARGS=-W to make
warnings fatal and so that it will work in an unconfigured tree.

ticket: 7497 (new)
target_version: 1.11
tags: pullup
Document principal name interactions with DNS

Add princ_dns.rst to document the interactions of host-based Keberos
service principal names and DNS.

ticket: 7498 (new)
target_version: 1.11
tags: pullup
Use an empty challenge for the password question

If a question's challenge is NULL, it is unnecessarily difficult for a
responder callback to detect whether it was asked.  So it's better to
use an empty challenge when there is no challenge data to communicate.
Do this for the "password" question.

ticket: 7499 (new)
target_version: 1.11
tags: pullup
Add examples to init_creds.rst

ticket: 7500 (new)
target_version: 1.11
tags: pullup
Make the doc build quieter

Don't print out every node processed (or not processed) in the
doxygen-Sphinx bridge, nor print out a summary of how many types
or functions were processed.

While here, tell doxygen to be quiet in its output as well, and
not print out each file that is generated.  It still outputs
warnings, though.

ticket: 7495 (new)
tags: pullup
target_version: 1.11
Better names for doxygen-Sphinx bridge functions

It is confusing when the codepath for the production doc build
involves calling functions with names like "test".  Rename things
which are in active use so that routines which are actually only
used for testing are more discernable as such.

ticket: 7505 (new)
tags: pullup
target_version: 1.11
Fix documentation browser resizing behavior

Remove hardcoded dimensions from a few CSS parameters to prevent
layout problems when readers resize their browsers to have a narrower
window.

Set a max-width: 60em on the main content so that text remains
readable on wide browser windows.

ticket: 7503 (new)
target_version: 1.11
tags: pullup
Conditionally include MITKC logo in HTML doc

Conditionally include the MITKC logo in the HTML output from Sphinx if
the environment variable HTML_LOGO is set.  During official builds for
the web site, that environment variable will point to an appropriately
scaled copy of the MITKC logo.

Adjust HTML document colors to match logo.

ticket: 7504 (new)
target_version: 1.11
tags: pullup
PKINIT (draft9) null ptr deref [CVE-2012-1016]

Don't check for an agility KDF identifier in the non-draft9 reply
structure when we're building a draft9 reply, because it'll be NULL.

The KDC plugin for PKINIT can dereference a null pointer when handling
a draft9 request, leading to a crash of the KDC process.  An attacker
would need to have a valid PKINIT certificate, or an unauthenticated
attacker could execute the attack if anonymous PKINIT is enabled.

CVSSv2 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:P/RL:O/RC:C

[tlyu@mit.edu: reformat comment and edit log message]

ticket: 7506 (new)
target_version: 1.11
tags: pullup
Update README for Sphinx documentation

The README pointed at the obsolete Texinfo documentation.  Update it
to point at the Sphinx documentation.

ticket: 7509 (new)
target_version: 1.11
tags: pullup
Add copyright footer to HTML docs

The technique we use for inserting the feedback link in the footer
overrides the Sphinx basic/layout.html and agogo/layout.html footers
in a way that prevents us from getting the copyright link footer.
Copy the relevant part of the Sphinx basic/layout.html for now.

Add a copyright.rst that links to mitK5license.rst.

ticket: 7510 (new)
target_version: 1.11
tags: pullup
Document enctypes

Add enctypes.rst to document Kerberos enctypes, including some
considerations about configuring and choosing enctypes.

[kaduk@mit.edu: normalize formatting and describe reply keys a bit more.]

ticket: 7507 (new)
target_version: 1.11
tags: pullup
Update retiring-des with real-world experience

We took notes when upgrading the ZONE.MIT.EDU realm to reduce
its usage of single-DES.  Use these to give examples for the upgrade
procedure, and flesh out some parts of it that were missing or
under-specified.

ticket: 7501 (new)
tags: pullup
target_version: 1.11
Add web pages to resources.rst

In resources.rst, add links to the MIT Kerberos software and MIT
Kerberos Consortium web pages.

ticket: 7512 (new)
target_version: 1.11
tags: pullup
Clarify enctype settings in krb5_conf.rst

Clarify the krb5.conf settings default_tkt_enctypes and
default_tgs_enctypes in krb5_conf.rst.

ticket: 7513 (new)
target_version: 1.11
tags: pullup
Regenerate manpages
Update acknowledgments
Add release string to index.rst page heading

ticket: 7515 (new)
target_version: 1.11
tags: pullup
Style cleanup for internal error handling

Fix style issues in kerrs.c and errors.c.  Rename error handling
functions to use shorter k5_ prefix.  Eliminate an inoperable
krb5int_set_error() call in gic_opte_alloc and convert the other
call to use krb5_set_error_message().
Simplify error message retrieval

Eliminate the scratch_buf field of struct error_info and just return a
non-localized constant error message if we can't allocate a copy of
the real one.  Also rely on a conformant strerror().