Don't use void * arithmetic in interposed_oid
Eliminate races in t_iprop.py

After we start kpropd, read about the initial full dump before making
changes on the master.  Avoid prodding kpropd for this read (by
shifting responsibility for the initial prod to the caller) since
kpropd doesn't sleep before its first request.

When waiting for sync, note whether we got a full propagation and
match that up with our expectations.

Use a long polling interval so kpropd doesn't wake up on its own and
confuse the test script with an extra incremental update.
Add an input ccache get_init_creds option

Add a krb5_get_init_creds_opt_set_in_ccache() function.  An input
ccache may hold configuration data which the client libraries can
use to influence their decisions.
Use hex escaping for non-printable trace data

When adding {str}, {lenstr}, or {data} to trace output, scan for
bytes which might be non-printable, and add them as hex-escaped
versions of themselves if any are found.
Add a -C flag to klist to also show config entries
Add "pa_types" configuration to ccaches

* When producing preauth data, keep track of the types of padata which
  the module that produced the data can handle.  Originally this was
  just the type of data we'd produced, but that caused problems for
  PKINIT.
* After obtaining credentials, store that list of preauth types as a
  "pa_types" configuration item in the out_ccache.
* Read a list of allowed preauth types from an in_ccache, if possible.
* If we have a list of allowed preauth types, skip any "real" modules
  which aren't in that list.
Test in_ccache and pa_types functionality

* Add a krb5int_build_conf_principals() function to allow our get/set
  code to directly prune out duplicate config entries.
* Verify that when we specify pa_types, they affect whether or not we
  will use a particular preauth mechanism.
* Verify that we correctly save the list of preauth mechanisms that are
  used in out_ccaches.
Add "pa_config_data" configuration to ccaches

* Read a "pa_config_data" item from an in_ccache, if provided, and add a
  callback which client preauth plugins can use to retrieve a string
  value that's keyed by a string.
* Add a callback which client preauth plugins can use to provide string
  key/value pairs to be stored in the ccache.
Use config storage for client identity selection

* Keep track of the names of client identities when we load them.
* Store the client identity we just used when we create or retry a
  client request.
* If we read a client identity from the configuration, treat it like the
  KDC does: pick the "this is it, there is no other" logic branch.
Use config storage for client OTP token selection

* Save the vendor name of the token we used to create the challenge.
* If we saved the name of a token vendor previously, prune out any
  tokeninfos which contain different vendor names.
Reset the prompt_types list after calling prompter

Reset the prompt_types list immediately after the prompter callback
returns, as is done everywhere else.
Sanity-check loading keys and certs from PEM files

Print a debug message if we're unable to locate the matching private key
for a certificate when we've just loaded both of them from PEM files.
Don't try to free an uninitialized keyblock
Make sure that pkinit_octetstring_hkdf() inits NSS

Create an NSS context for use when performing KDF, so that the tests,
which call into the function directly, will work.
Handle anonymous-as-signed-data-with-no-signers

Update to generate and consume signed-data with no signer-info, which we
need for anonymous PKINIT.
Whitespace fixup

Use a temporary variable to hold the chain-inclusion setting for CMS.
project page draft; do not merge
Export krb5_cc_move()
Correct type mismatches for get_as_key callbacks