Clarify lockout replication issues in docs

In the "KDC replication and account lockout" section of lockout.rst,
specifically call out kprop and incremental propagation as the
mechanisms which do not replicate account lockout state, and add a
note that KDCs using LDAP may not be affected by that section's
concerns.

ticket: 7773 (new)
target_version: 1.12
tags: pullup
Add another kadmin ACL test for backreferences

Add a test using backreferences which don't correspond directly to
principal components, to verify that *N refers to the Nth wildcard and
not the Nth component.
Correct kadm5.acl back-reference documentation

In kadm5.acl, *N in the target principal name refers to the Nth
wildcard in the acting principal pattern, not the Nth component.

ticket: 7774 (new)
target_version: 1.12
tags: pullup
Improve default ccache name API documentation

Document the lifetime and caching behavior of the
krb5_cc_default_name() return value.  Document that
krb5_cc_set_default_name() may be called with NULL to purge the cached
value.  Correct a typo in the krb5_cc_default() summary and explicitly
reference krb5_cc_default_name().

ticket: 7775 (new)
target_version: 1.12
tags: pullup
Added a new ccache doc to "Kerberos V5 concepts"

This is to add a short introductory document on credential
caches to the Concepts section of Kerberos documentation.

ticket: 7776 (new)
target_version: 1.12
tags: pullup
Edit ccache_def.rst

Re-fill to 70 columns.  Replace non-ascii apostrophes with ASCII ones.
Edit wording slightly.

ticket: 7776
Update doc for current kdb5_util dump version

kdb5_util.rst incorrectly describes the current default dump format
version as 6 when it should be 7.  Reported by Jeff D'Angelo.

ticket: 7777
target_version: 1.12
tags: pullup
Remove inet_ntoa() prototype from getrpcent.c

It is not needed.

In general, we shouldn't be using inet_ntoa(), anyway, as it is
IPv4-specific and we have IPv6 support almost everywhere.
Add new versions of log_badauth gssrpc callbacks

libgssrpc supports two callbacks for gss_accept_sec_context failures
on servers (one for AUTH_GSS and one for AUTH_GSSAPI), which are
IPv4-specific.  Provide an alternate version which supplies the
transport handle instead of the address, so that we can get the
address via the file descriptor for TCP connections.

ticket: 7770
Correctly log IPv6 addresses in kadmind

Define client_addr() in server_stubs.c and use it consistently in that
file and ipropd_svc.c to get the client address from a transport
handle.  In it, call getpeername() on the client socket and use
inet_ntop() on the result, instead of using inet_ntoa() on the IPv4
socket address.  Provide a log_badauth2 callback to GSSRPC, so that we
get a transport handle instead of an IPv4 socket address, and use
client_addr() within it instead of inet_ntoa().

ticket: 7770
target_version: 1.12
tags: pullup
Bump libgssrpc minor version

Bump minor version for the new log_badauth2 interfaces.

ticket: 7770
Edit README.asn1

Add another blank line before section headers.  Avoid contractions.
Change some whiches to thats where it seems appropriate.  Fix some
missing or extra words.
Fix error message quotations in install_kdc.rst

Some error messages that kprop could print were quoted incorrectly in
install_kdc.rst.

Also fix minor typos.

ticket: 7785 (new)
target_version: 1.12
tags: pullup
Fix S4U2Self against non-FAST KDCs

When we added FAST TGS support in 1.11, we broke S4U2Self against KDCs
which don't support FAST, because the S4U2Self padata is only present
within the FAST request.  For now, duplicate that padata in the outer
request so that both FAST and non-FAST KDCs can see it.

ticket: 7791
target_version: 1.11.5
tags: pullup
Avoid malloc(0) in SPNEGO get_input_token

If we read a zero-length token in spnego_mech.c's get_input_token(),
set the value pointer to NULL instead of calling malloc(0).

ticket: 7794 (new)
Better keysalt docs

Add a new section to kdc_conf.rst to describe keysalt lists, and
update other documentation to better distinguish enctype lists from
keysalt lists.

ticket: 7608
target_version: 1.12
tags: pullup
make depend
Update man pages
Modernize sn2princ.c

Refactor and edit sn2princ.c to match current coding style.  No
behavior changes, except to be less chatty in trace logs.
Allow ":port" suffixes in sn2princ hostnames

MSSQLSvc principal names can contain a ":port" or ":instance" trailer
on the hostname part.  If we see that in the hostname argument of
krb5_sname_to_principal(), remove it before canonicalizing the
hostname and put it back on afterwards.

ticket: 7795 (new)