Document principal name interactions with DNS

Add princ_dns.rst to document the interactions of host-based Keberos
service principal names and DNS.

(cherry picked from commit 85c378e9e44ca184209056f118e75b6511cb40b8)

ticket: 7498
version_fixed: 1.11
status: resolved
Use an empty challenge for the password question

If a question's challenge is NULL, it is unnecessarily difficult for a
responder callback to detect whether it was asked.  So it's better to
use an empty challenge when there is no challenge data to communicate.
Do this for the "password" question.

(cherry picked from commit 70f2d9a093c71624269b2317c62ad0993126bc40)

ticket: 7499
version_fixed: 1.11
status: resolved
Add examples to init_creds.rst

(cherry picked from commit 4dade44544dc838a2ca8929111c131b0dc5fe53a)

ticket: 7500
version_fixed: 1.11
status: resolved
Make the doc build quieter

Don't print out every node processed (or not processed) in the
doxygen-Sphinx bridge, nor print out a summary of how many types
or functions were processed.

While here, tell doxygen to be quiet in its output as well, and
not print out each file that is generated.  It still outputs
warnings, though.

(cherry picked from commit 311347e5e9d9208e2d341b8f8aed37791a4de090)

ticket: 7495
version_fixed: 1.11
status: resolved
Better names for doxygen-Sphinx bridge functions

It is confusing when the codepath for the production doc build
involves calling functions with names like "test".  Rename things
which are in active use so that routines which are actually only
used for testing are more discernable as such.

(cherry picked from commit 060b1eb1e38b294495adab784da32ca4e9871d20)

ticket: 7505
version_fixed: 1.11
status: resolved
Fix documentation browser resizing behavior

Remove hardcoded dimensions from a few CSS parameters to prevent
layout problems when readers resize their browsers to have a narrower
window.

Set a max-width: 60em on the main content so that text remains
readable on wide browser windows.

(cherry picked from commit bba7ed92a0b9800d9f5fdb14f5f66f755e9d92fa)

ticket: 7503
version_fixed: 1.11
status: resolved
Conditionally include MITKC logo in HTML doc

Conditionally include the MITKC logo in the HTML output from Sphinx if
the environment variable HTML_LOGO is set.  During official builds for
the web site, that environment variable will point to an appropriately
scaled copy of the MITKC logo.

Adjust HTML document colors to match logo.

(cherry picked from commit 7a0f65b38e471a69f2f7d900758260ed1f242d5f)

ticket: 7504
version_fixed: 1.11
status: resolved
PKINIT (draft9) null ptr deref [CVE-2012-1016]

Don't check for an agility KDF identifier in the non-draft9 reply
structure when we're building a draft9 reply, because it'll be NULL.

The KDC plugin for PKINIT can dereference a null pointer when handling
a draft9 request, leading to a crash of the KDC process.  An attacker
would need to have a valid PKINIT certificate, or an unauthenticated
attacker could execute the attack if anonymous PKINIT is enabled.

CVSSv2 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:P/RL:O/RC:C

[tlyu@mit.edu: reformat comment and edit log message]

(cherry picked from commit cd5ff932c9d1439c961b0cf9ccff979356686aff)

ticket: 7506
version_fixed: 1.11
status: resolved