Update hst_realm.c coding style

Bring this file up to date with current coding style.  No functional
changes, except some trace logs were removed.
Allow numeric addresses as service hostnames

Since krb5 1.3, krb5_get_host_realm (and therefore
krb5_sname_to_principal) has refused hostnames which appear to be
numeric addresses--with the exception of 1.6, which was ignoring
errors from clean_hostname.  In specialized environments, it may be
desirable to use IP addresses in service principal names, and there's
no compelling reason for us to get in the way of that.

Move the numeric address check out of k5_clean_hostname into a new
helper function, and simply skip the domain-based mechanisms if it
returns true.  Factor out the [domain_realm] search into a second new
helper function to make it easier to skip.

ticket: 7603 (new)
Tighten up fixed buffer usage in hst_realm.c

Avoid or notice truncations, rather than letting them happen silently.
Trace log with a subset of struct conn_state

In struct conn_state, collect together the fields for the remote
address and put them in a substructure.  Pass this substructure to
trace logging macros instead of the entire conn_state structure, so
that trace.c doesn't have to know about the whole structure.
Get rid of cm.c and cm.h

Since net-server.c now uses libverto, only sendto_kdc.c consumes cm.c.
Move stuff out of cm.c and cm.h into sendto_kdc.c and get rid of them.
Change the sendto_kdc callback (used by chpw.c) to receive the socket
descriptor instead of the entire conn_state structure, and move the
declarations into os-proto.h.  struct remote_address also needs to be
in os-proto.h so that trace.c and t_trace.c can use it.  k5_curtime
isn't needed since k5-platform.h now guarantees the presence of
gettimeofday().
Use millisecond timeouts in sendto_kdc.c

Replace the end_time field of struct select_state with an endtime
argument to cm_select_or_poll, expressed in milliseconds since the
epoch.  Add a helper function to get the current time in that format.
Use a millisecond interval argument to service_fds for consistency.

[ghudson@mit.edu: fix overflow issue in get_curtime_ms; service_fds
interval argument change; log message]
Dynamically expand timeout when TCP connects

Wait ten seconds for a TCP connection to succeed or fail before moving
on.  During this wait time, other TCP connections will be serviced if
we already initiated them, but no new TCP connections will be created
and no UDP packets will be retransmitted.

[ghudson@mit.edu: minor adjustments; commit message]

ticket: 7604 (new)
Remove sendto_kdc debugging code

It's a lot of code, and trace logging should cover most of the cases
where it's useful.
Simplify sendto_kdc exception handling
Ignore missing Q in dh_params

Some implementations don't send the required Q value in dh_params, so
allow it to be absent.

ticket: 7596
target_version: 1.11.3
tags: pullup
Simplify pkinit_check_dh_params

Change pkinit_check_dh_params() to take two DH* parameters, and only
compare p and g, because q is fully determined by them and might be
missing.

Also refactor some parameter checks into check_dh_wellknown() that
were previously done separately in the pkinit_process_td_dh_params()
and server_check_dh().
Allow config of dh_min_bits < 2048

Allow configuration to override the default dh_min_bits of 2048 to
1024.  Disallow configuration of dh_min_bits < 1024, but continue to
default to 2048.

ticket: 7602
target_version: 1.11.3
tags: pullup
Set msg_type when decoding FAST requests

An RFC 6113 KrbFastReq contains a padata sequence and a KDC-REQ-BODY,
neither of which contain the msg-type field found in a KDC-REQ.  So
when we decode the FAST request, the resulting krb5_kdc_req structure
has a msg_type of 0.  Copy msg_type from the outer body, since we make
use of it in further KDC processing.

ticket: 7605 (new)
target_version: 1.11.3
tags: pullup
Use macro for IANA assigned PA-AS-CHECKSUM number

Replace numeric value '132' by the macro KRB5_PADATA_AS_CHECKSUM
in preauth plugin.
Add a few comments to `PADATA types` in krb5.hin

Mostly, based on
http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xml
Fix doc build

The addition of the KRB5_PADATA_AS_CHECKSUM macro in d7d74867952f caused
the doxygen bridge to emit a new RST file.  This file was not included in
the API reference toctree, causing a build failure in maintainer-mode.
Include default DIR::file ccache in collection

If the context's default ccache name is a subsidiary file of a
directory collection, include that single cache in the cursor walk
over the DIR type.

ticket: 7172
Add a script for [re]generating test PKI creds

[ghudson@mit.edu: reformatted to limit lines to 79 columns]
Add various client-authenticating PKINIT tests

Add tests for non-anonymous PKINIT:
* FILE: with no password
* FILE: with a password
* DIR: with no password
* DIR: with a password
* PKCS12: with no password
* PKCS12: with a password
* PKCS11: with a password, if soft-pkcs11.so is found via ctypes

[ghudson@mit.edu: reformatted to 79 columns; removed intermediate
success() calls]
Don't use expired TGTs in TGS-REQs

ticket: 6948