Adjust kdb5.c check for ulog being mapped

Check the ulog pointer, which is a little more direct, rather than the
ulogfd field.  (ulogfd is currently initialized to 0 prior to
ulog_map; we could fix that instead, but this feels simpler.)
Quiet kpropd.c signed/unsigned comparison warnings

[ghudson@mit.edu: simplify slightly]
Check for negative poll timeout in k5_sendto_kdc

ticket: 7553
target_version: 1.11.1
tags: pullup
Make kproplog handle underfull iprop logs

kproplog currently assumes that an iprop log is full once it has
circled--which is true right now but will need to change for
hierarchical slaves.  Avoid this assumption by using the correct
index modulus in print_update whether or not the log is full.

Based on a patch from Richard Basch <basch@alum.mit.edu>.
Refactor LDAP DB option parsing code

krb5_ldap_open and krb5_ldap_create contain two large, almost
identical blocks of DB option processing code.  Factor it out into a
new function krb5_ldap_parse_db_params in ldap_misc.c, and simplify
the factored-out code.  Create a helper function to add server entries
and use it to simplify krb5_ldap_read_server_params as well as DB
option parsing.  Since the new DB option helper uses isspace instead
of isblank, we no longer require portability goop for isblank.
Add LDAP debug DB option

Add a DB option in the LDAP KDB module to turn on debugging messages.
Adapted from a patch by Zoran Pericic <zpericic@inet.hr>.

ticket: 7551 (new)
Fix prepend_err_str in LDAP KDB module

Use the oerr parameter to fetch the existing message.  Stop handling
oerr == 0, since no call sites were using it.  Free the old error
message before returning.
Note which release -x debug was added in
Fix is_referral flag in KDC TGS code

A server response which is a cross-realm TGT is not a referral if it
was directly requested by the client.  Misclassifying such a response
as a referral means we don't mirror the request's name type, which has
been observed to break older Java clients.

ticket: 7555 (new)
Revert previous change to process_tgs_req

Commit c072b059ecff257e7600be0e86869decd135d422 did not have the
intended effect because, at the point where is_referral is set,
request->server has already been modified to contain server->princ.

ticket: 7555
status: open
Fix COPY_FIRST_CANONNAME hostent search

In fake-addrinfo.c, the COPY_FIRST_CANONNAME logic erroneously assumes
that h_name is the same as h_aliases[0].  Look at h_name before
h_aliases for an FQDN, since h_name is normally the
forward-canonicalized name and h_aliases are not.

[ghudson@mit.edu: rewrote commit message]

ticket: 7556 (new)
New section: Contributing to Kerb documentation
Remove partial LDAP client cert support

The LDAP KDB module has some code to interpret {FILE} values in stash
files, and set the service_cert_path/pass fields in the ldap context.
But there was no code to actually use those values to do client cert
authentication, so it wasn't useful.  Remove the partial
implementation.
Fix h1 end tag in Sphinx header titles

A </h1> end tag was incorrectly written as <h1>.  Also adjust style
settings so that the resulting computed style remains the same for
div.rel.

ticket: 7557 (new)
target_version: 1.11.1
tags: pullup
Fix typos in layout.html

There were multiple misplaced semicolons, etc.

ticket: 7558 (new)
target_version: 1.11.1
tags: pullup
Fix "search" accesskey in layout.html

The accesskey for the "search" link conflicted with the one for the
"contents" link.

ticket: 7559 (new)
target_version: 1.11.1
tags: pullup
Consolidate style settings in kerb.css

Move style settings that were previously in layout.html to kerb.css.
Rename kerb.css kerb.css_t, making it a template, to allow
parameterized style settings to remain parameterized.
Reduce copied code in layout.html

layout.html unneccesarily copied code from the parent
agogo/layout.html content block just to alter the sidebar.  Override
various subblocks of the sidebar instead.
Refactor rellinks formatting in layout.html
Simplify LDAP password decoding

Make dec_password a static function in ldap_service_stash.c and remove
some impedance mismatch with krb5_ldap_readpassword() by making it
operate on C strings and return a krb5_error_code.