diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/.gitignore b/.gitignore
index 523856e..40603ef 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,49 +1,50 @@
-krb5-1.3.4.tar.gz
-krb5-1.3.5.tar.gz
-krb5-1.3.5.tar.gz.asc
-krb5-1.3.6.tar.gz
-krb5-1.3.6.tar.gz.asc
-krb5-1.4.tar.gz
-krb5-1.4.tar.gz.asc
-krb5-1.4.1.tar.gz
-krb5-1.4.1.tar.gz.asc
-krb5-1.4.2.tar.gz
-krb5-1.4.2.tar.gz.asc
-krb5-1.4.3.tar.gz
-krb5-1.4.3.tar.gz.asc
-krb5-1.5.tar.gz
-krb5-1.5.tar.gz.asc
-krb5-1.6.tar.gz
-krb5-1.6.tar.gz.asc
-krb5-1.6-pdf.tar.gz
-krb5-1.6.1.tar.gz
-krb5-1.6.1.tar.gz.asc
-krb5-1.6.1-pdf.tar.gz
-krb5-1.6.2.tar.gz
-krb5-1.6.2.tar.gz.asc
-krb5-1.6.2-pdf.tar.gz
-krb5-1.6.3.tar.gz
-krb5-1.6.3.tar.gz.asc
-krb5-1.6.3-pdf.tar.gz
-krb5-1.7.tar.gz
-krb5-1.7.tar.gz.asc
-krb5-1.7-pdf.tar.gz
-krb5-1.7.1.tar.gz
-krb5-1.7.1.tar.gz.asc
-krb5-1.7.1-pdf.tar.gz
-krb5-1.8.tar.gz
-krb5-1.8.tar.gz.asc
-krb5-appl-1.0.tar.gz
-krb5-appl-1.0.tar.gz.asc
-krb5-1.8-pdf.tar.gz
-krb5-1.8.1.tar.gz
-krb5-1.8.1.tar.gz.asc
-krb5-1.8.1-pdf.tar.gz
-krb5-1.8.2.tar.gz.asc
-krb5-1.8.2-pdf.tar.gz
-krb5-1.8.3.tar.gz
-krb5-1.8.3.tar.gz.asc
-krb5-1.8.3-pdf.tar.gz
+/results_krb5
+/krb5-1.3.4.tar.gz
+/krb5-1.3.5.tar.gz
+/krb5-1.3.5.tar.gz.asc
+/krb5-1.3.6.tar.gz
+/krb5-1.3.6.tar.gz.asc
+/krb5-1.4.tar.gz
+/krb5-1.4.tar.gz.asc
+/krb5-1.4.1.tar.gz
+/krb5-1.4.1.tar.gz.asc
+/krb5-1.4.2.tar.gz
+/krb5-1.4.2.tar.gz.asc
+/krb5-1.4.3.tar.gz
+/krb5-1.4.3.tar.gz.asc
+/krb5-1.5.tar.gz
+/krb5-1.5.tar.gz.asc
+/krb5-1.6.tar.gz
+/krb5-1.6.tar.gz.asc
+/krb5-1.6-pdf.tar.gz
+/krb5-1.6.1.tar.gz
+/krb5-1.6.1.tar.gz.asc
+/krb5-1.6.1-pdf.tar.gz
+/krb5-1.6.2.tar.gz
+/krb5-1.6.2.tar.gz.asc
+/krb5-1.6.2-pdf.tar.gz
+/krb5-1.6.3.tar.gz
+/krb5-1.6.3.tar.gz.asc
+/krb5-1.6.3-pdf.tar.gz
+/krb5-1.7.tar.gz
+/krb5-1.7.tar.gz.asc
+/krb5-1.7-pdf.tar.gz
+/krb5-1.7.1.tar.gz
+/krb5-1.7.1.tar.gz.asc
+/krb5-1.7.1-pdf.tar.gz
+/krb5-1.8.tar.gz
+/krb5-1.8.tar.gz.asc
+/krb5-appl-1.0.tar.gz
+/krb5-appl-1.0.tar.gz.asc
+/krb5-1.8-pdf.tar.gz
+/krb5-1.8.1.tar.gz
+/krb5-1.8.1.tar.gz.asc
+/krb5-1.8.1-pdf.tar.gz
+/krb5-1.8.2.tar.gz.asc
+/krb5-1.8.2-pdf.tar.gz
+/krb5-1.8.3.tar.gz
+/krb5-1.8.3.tar.gz.asc
+/krb5-1.8.3-pdf.tar.gz
 /krb5-1.9-beta2.tar.gz
 /krb5-1.9-beta2.tar.gz.asc
 /krb5-1.9-beta2-pdf.tar.bz2
@@ -175,3 +176,35 @@ krb5-1.8.3-pdf.tar.gz
 /krb5-1.17-pdfs.tar
 /krb5-1.17.tar.gz
 /krb5-1.17.tar.gz.asc
+/krb5-1.17.1.tar.gz
+/krb5-1.17.1.tar.gz.asc
+/krb5-1.18-beta1.tar.gz
+/krb5-1.18-beta1.tar.gz.asc
+/krb5-1.18-beta2.tar.gz
+/krb5-1.18-beta2.tar.gz.asc
+/krb5-1.18.tar.gz
+/krb5-1.18.tar.gz.asc
+/krb5-1.18.1.tar.gz
+/krb5-1.18.1.tar.gz.asc
+/krb5-1.18.2.tar.gz
+/krb5-1.18.2.tar.gz.asc
+/krb5-1.18.3.tar.gz
+/krb5-1.18.3.tar.gz.asc
+/krb5-1.19-beta1.tar.gz
+/krb5-1.19-beta1.tar.gz.asc
+/krb5-1.19-beta2.tar.gz
+/krb5-1.19-beta2.tar.gz.asc
+/krb5-1.19.tar.gz
+/krb5-1.19.tar.gz.asc
+/krb5-1.19.1.tar.gz
+/krb5-1.19.1.tar.gz.asc
+/krb5-1.19.2.tar.gz
+/krb5-1.19.2.tar.gz.asc
+/krb5-1.20.1.tar.gz
+/krb5-1.20.1.tar.gz.asc
+/krb5-1.21.tar.gz
+/krb5-1.21.tar.gz.asc
+/krb5-1.21.2.tar.gz
+/krb5-1.21.2.tar.gz.asc
+/krb5-1.21.3.tar.gz
+/krb5-1.21.3.tar.gz.asc
diff --git a/0001-downstream-Revert-Don-t-issue-session-keys-with-depr.patch b/0001-downstream-Revert-Don-t-issue-session-keys-with-depr.patch
new file mode 100644
index 0000000..84d04bf
--- /dev/null
+++ b/0001-downstream-Revert-Don-t-issue-session-keys-with-depr.patch
@@ -0,0 +1,310 @@
+From 6f7fd964539dfe4a885068f43a91db9738661870 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Tue, 9 Jul 2024 11:15:33 +0200
+Subject: [PATCH] [downstream] Revert "Don't issue session keys with
+ deprecated enctypes"
+
+This reverts commit 1b57a4d134bbd0e7c52d5885a92eccc815726463.
+---
+ doc/admin/conf_files/krb5_conf.rst | 12 ------------
+ doc/admin/enctypes.rst             | 23 +++-------------------
+ src/include/k5-int.h               |  4 ----
+ src/kdc/kdc_util.c                 | 10 ----------
+ src/lib/krb5/krb/get_in_tkt.c      | 31 +++++++++++-------------------
+ src/lib/krb5/krb/init_ctx.c        | 10 ----------
+ src/tests/gssapi/t_enctypes.py     |  3 +--
+ src/tests/t_etype_info.py          |  2 +-
+ src/tests/t_sesskeynego.py         | 28 ++-------------------------
+ src/util/k5test.py                 |  4 ++--
+ 10 files changed, 20 insertions(+), 107 deletions(-)
+
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index ecdf917501..f22d5db11b 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -95,18 +95,6 @@ Additionally, krb5.conf may include any of the relations described in
+ 
+ The libdefaults section may contain any of the following relations:
+ 
+-**allow_des3**
+-    Permit the KDC to issue tickets with des3-cbc-sha1 session keys.
+-    In future releases, this flag will allow des3-cbc-sha1 to be used
+-    at all.  The default value for this tag is false.  (Added in
+-    release 1.21.)
+-
+-**allow_rc4**
+-    Permit the KDC to issue tickets with arcfour-hmac session keys.
+-    In future releases, this flag will allow arcfour-hmac to be used
+-    at all.  The default value for this tag is false.  (Added in
+-    release 1.21.)
+-
+ **allow_weak_crypto**
+     If this flag is set to false, then weak encryption types (as noted
+     in :ref:`Encryption_types` in :ref:`kdc.conf(5)`) will be filtered
+diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
+index dce19ad43e..694922c0d9 100644
+--- a/doc/admin/enctypes.rst
++++ b/doc/admin/enctypes.rst
+@@ -48,15 +48,12 @@ Session key selection
+ The KDC chooses the session key enctype by taking the intersection of
+ its **permitted_enctypes** list, the list of long-term keys for the
+ most recent kvno of the service, and the client's requested list of
+-enctypes.  Starting in krb5-1.21, all services are assumed to support
+-aes256-cts-hmac-sha1-96; also, des3-cbc-sha1 and arcfour-hmac session
+-keys will not be issued by default.
++enctypes.
+ 
+ Starting in krb5-1.11, it is possible to set a string attribute on a
+ service principal to control what session key enctypes the KDC may
+-issue for service tickets for that principal, overriding the service's
+-long-term keys and the assumption of aes256-cts-hmac-sha1-96 support.
+-See :ref:`set_string` in :ref:`kadmin(1)` for details.
++issue for service tickets for that principal.  See :ref:`set_string`
++in :ref:`kadmin(1)` for details.
+ 
+ 
+ Choosing enctypes for a service
+@@ -90,20 +87,6 @@ affect how enctypes are chosen.
+     acceptable risk for your environment and the weak enctypes are
+     required for backward compatibility.
+ 
+-**allow_des3**
+-    was added in release 1.21 and defaults to *false*.  Unless this
+-    flag is set to *true*, the KDC will not issue tickets with
+-    des3-cbc-sha1 session keys.  In a future release, this flag will
+-    control whether des3-cbc-sha1 is permitted in similar fashion to
+-    weak enctypes.
+-
+-**allow_rc4**
+-    was added in release 1.21 and defaults to *false*.  Unless this
+-    flag is set to *true*, the KDC will not issue tickets with
+-    arcfour-hmac session keys.  In a future release, this flag will
+-    control whether arcfour-hmac is permitted in similar fashion to
+-    weak enctypes.
+-
+ **permitted_enctypes**
+     controls the set of enctypes that a service will permit for
+     session keys and for ticket and authenticator encryption.  The KDC
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index 2f7791b775..1d1c8293f4 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -180,8 +180,6 @@ typedef unsigned char   u_char;
+  * matches the variable name.  Keep these alphabetized. */
+ #define KRB5_CONF_ACL_FILE                     "acl_file"
+ #define KRB5_CONF_ADMIN_SERVER                 "admin_server"
+-#define KRB5_CONF_ALLOW_DES3                   "allow_des3"
+-#define KRB5_CONF_ALLOW_RC4                    "allow_rc4"
+ #define KRB5_CONF_ALLOW_WEAK_CRYPTO            "allow_weak_crypto"
+ #define KRB5_CONF_AUTH_TO_LOCAL                "auth_to_local"
+ #define KRB5_CONF_AUTH_TO_LOCAL_NAMES          "auth_to_local_names"
+@@ -1240,8 +1238,6 @@ struct _krb5_context {
+     struct _kdb_log_context *kdblog_context;
+ 
+     krb5_boolean allow_weak_crypto;
+-    krb5_boolean allow_des3;
+-    krb5_boolean allow_rc4;
+     krb5_boolean ignore_acceptor_hostname;
+     krb5_boolean enforce_ok_as_delegate;
+     enum dns_canonhost dns_canonicalize_hostname;
+diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
+index e54cc751f9..75e04b73db 100644
+--- a/src/kdc/kdc_util.c
++++ b/src/kdc/kdc_util.c
+@@ -1088,16 +1088,6 @@ select_session_keytype(krb5_context context, krb5_db_entry *server,
+         if (!krb5_is_permitted_enctype(context, ktype[i]))
+             continue;
+ 
+-        /*
+-         * Prevent these deprecated enctypes from being used as session keys
+-         * unless they are explicitly allowed.  In the future they will be more
+-         * comprehensively disabled and eventually removed.
+-         */
+-        if (ktype[i] == ENCTYPE_DES3_CBC_SHA1 && !context->allow_des3)
+-            continue;
+-        if (ktype[i] == ENCTYPE_ARCFOUR_HMAC && !context->allow_rc4)
+-            continue;
+-
+         if (dbentry_supports_enctype(context, server, ktype[i]))
+             return ktype[i];
+     }
+diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
+index ea089f0fcc..1b420a3ac2 100644
+--- a/src/lib/krb5/krb/get_in_tkt.c
++++ b/src/lib/krb5/krb/get_in_tkt.c
+@@ -1582,31 +1582,22 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options,
+     (*prompter)(context, data, 0, banner, 0, 0);
+ }
+ 
+-/* Display a warning via the prompter if a deprecated enctype was used for
+- * either the reply key or the session key. */
++/* Display a warning via the prompter if des3-cbc-sha1 was used for either the
++ * reply key or the session key. */
+ static void
+-warn_deprecated(krb5_context context, krb5_init_creds_context ctx,
+-                krb5_enctype as_key_enctype)
++warn_des3(krb5_context context, krb5_init_creds_context ctx,
++          krb5_enctype as_key_enctype)
+ {
+-    krb5_enctype etype;
+-    char encbuf[128], banner[256];
++    const char *banner;
+ 
+-    if (ctx->prompter == NULL)
+-        return;
+-
+-    if (krb5int_c_deprecated_enctype(as_key_enctype))
+-        etype = as_key_enctype;
+-    else if (krb5int_c_deprecated_enctype(ctx->cred.keyblock.enctype))
+-        etype = ctx->cred.keyblock.enctype;
+-    else
++    if (as_key_enctype != ENCTYPE_DES3_CBC_SHA1 &&
++        ctx->cred.keyblock.enctype != ENCTYPE_DES3_CBC_SHA1)
+         return;
+-
+-    if (krb5_enctype_to_name(etype, FALSE, encbuf, sizeof(encbuf)) != 0)
++    if (ctx->prompter == NULL)
+         return;
+-    snprintf(banner, sizeof(banner),
+-             _("Warning: encryption type %s used for authentication is "
+-               "deprecated and will be disabled"), encbuf);
+ 
++    banner = _("Warning: encryption type des3-cbc-sha1 used for "
++               "authentication is weak and will be disabled");
+     /* PROMPTER_INVOCATION */
+     (*ctx->prompter)(context, ctx->prompter_data, NULL, banner, 0, NULL);
+ }
+@@ -1857,7 +1848,7 @@ init_creds_step_reply(krb5_context context,
+     ctx->complete = TRUE;
+     warn_pw_expiry(context, ctx->opt, ctx->prompter, ctx->prompter_data,
+                    ctx->in_tkt_service, ctx->reply);
+-    warn_deprecated(context, ctx, encrypting_key.enctype);
++    warn_des3(context, ctx, encrypting_key.enctype);
+ 
+ cleanup:
+     krb5_free_pa_data(context, kdc_padata);
+diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
+index a6c2bbeb54..87b486c53f 100644
+--- a/src/lib/krb5/krb/init_ctx.c
++++ b/src/lib/krb5/krb/init_ctx.c
+@@ -221,16 +221,6 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+         goto cleanup;
+     ctx->allow_weak_crypto = tmp;
+ 
+-    retval = get_boolean(ctx, KRB5_CONF_ALLOW_DES3, 0, &tmp);
+-    if (retval)
+-        goto cleanup;
+-    ctx->allow_des3 = tmp;
+-
+-    retval = get_boolean(ctx, KRB5_CONF_ALLOW_RC4, 0, &tmp);
+-    if (retval)
+-        goto cleanup;
+-    ctx->allow_rc4 = tmp;
+-
+     retval = get_boolean(ctx, KRB5_CONF_IGNORE_ACCEPTOR_HOSTNAME, 0, &tmp);
+     if (retval)
+         goto cleanup;
+diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
+index f5f11842e2..7494d7fcdb 100755
+--- a/src/tests/gssapi/t_enctypes.py
++++ b/src/tests/gssapi/t_enctypes.py
+@@ -18,8 +18,7 @@ d_rc4 = 'DEPRECATED:arcfour-hmac'
+ # These tests make assumptions about the default enctype lists, so set
+ # them explicitly rather than relying on the library defaults.
+ supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal'
+-conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4',
+-                        'allow_des3': 'true', 'allow_rc4': 'true'},
++conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4'},
+         'realms': {'$realm': {'supported_enctypes': supp}}}
+ realm = K5Realm(krb5_conf=conf)
+ shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save'))
+diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
+index 38cf96ca8f..c982508d8b 100644
+--- a/src/tests/t_etype_info.py
++++ b/src/tests/t_etype_info.py
+@@ -1,7 +1,7 @@
+ from k5test import *
+ 
+ supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac'
+-conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'},
++conf = {'libdefaults': {'allow_weak_crypto': 'true'},
+         'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
+ realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf)
+ 
+diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py
+index 5a213617b5..9024aee838 100755
+--- a/src/tests/t_sesskeynego.py
++++ b/src/tests/t_sesskeynego.py
+@@ -25,8 +25,6 @@ conf3 = {'libdefaults': {
+         'default_tkt_enctypes': 'aes128-cts',
+         'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}}
+ conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}}
+-conf5 = {'libdefaults': {'allow_rc4': 'true'}}
+-conf6 = {'libdefaults': {'allow_des3': 'true'}}
+ # Test with client request and session_enctypes preferring aes128, but
+ # aes256 long-term key.
+ realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False)
+@@ -56,12 +54,10 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes',
+            'aes128-cts,aes256-cts'])
+ test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96')
+ 
+-# 3b: Skip RC4 (as the KDC does not allow it for session keys by
+-# default) and negotiate aes128-cts session key, with only an aes256
+-# long-term service key.
++# 3b: Negotiate rc4-hmac session key when principal only has aes256 long-term.
+ realm.run([kadminl, 'setstr', 'server', 'session_enctypes',
+            'rc4-hmac,aes128-cts,aes256-cts'])
+-test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96')
++test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
+ realm.stop()
+ 
+ # 4: Check that permitted_enctypes is a default for session key enctypes.
+@@ -71,24 +67,4 @@ realm.run([kvno, 'user'],
+           expected_trace=('etypes requested in TGS request: aes256-cts',))
+ realm.stop()
+ 
+-# 5: allow_rc4 permits negotiation of rc4-hmac session key.
+-realm = K5Realm(krb5_conf=conf5, create_host=False, get_creds=False)
+-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
+-realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac'])
+-test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
+-realm.stop()
+-
+-# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key.
+-realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False)
+-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
+-realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1'])
+-test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96')
+-realm.stop()
+-
+-# 7: default config negotiates aes256-sha1 session key for RC4-only service.
+-realm = K5Realm(create_host=False, get_creds=False)
+-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server'])
+-test_kvno(realm, 'aes256-cts-hmac-sha1-96', 'DEPRECATED:arcfour-hmac')
+-realm.stop()
+-
+ success('sesskeynego')
+diff --git a/src/util/k5test.py b/src/util/k5test.py
+index 8e5f5ba8e9..2a86c5cdfc 100644
+--- a/src/util/k5test.py
++++ b/src/util/k5test.py
+@@ -1340,14 +1340,14 @@ _passes = [
+ 
+     # Exercise the DES3 enctype.
+     ('des3', None,
+-     {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}},
++     {'libdefaults': {'permitted_enctypes': 'des3'}},
+      {'realms': {'$realm': {
+                     'supported_enctypes': 'des3-cbc-sha1:normal',
+                     'master_key_type': 'des3-cbc-sha1'}}}),
+ 
+     # Exercise the arcfour enctype.
+     ('arcfour', None,
+-     {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}},
++     {'libdefaults': {'permitted_enctypes': 'rc4'}},
+      {'realms': {'$realm': {
+                     'supported_enctypes': 'arcfour-hmac:normal',
+                     'master_key_type': 'arcfour-hmac'}}}),
+-- 
+2.45.1
+
diff --git a/krb5-1.12.1-pam.patch b/0002-downstream-ksu-pam-integration.patch
similarity index 95%
rename from krb5-1.12.1-pam.patch
rename to 0002-downstream-ksu-pam-integration.patch
index 10892d4..9afd094 100644
--- a/krb5-1.12.1-pam.patch
+++ b/0002-downstream-ksu-pam-integration.patch
@@ -1,7 +1,7 @@
-From c8f2e321b2d8471feee69bbca3179e675228bd8a Mon Sep 17 00:00:00 2001
+From de4205c45e310ceaaa7cd7958af7293322fa43a6 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:29:58 -0400
-Subject: [PATCH] krb5-1.12.1-pam.patch
+Subject: [PATCH] [downstream] ksu pam integration
 
 Modify ksu so that it performs account and session management on behalf of
 the target user account, mimicking the action of regular su.  The default
@@ -16,25 +16,28 @@ When enabled, ksu gains a dependency on libpam.
 Originally RT#5939, though it's changed since then to perform the account
 and session management before dropping privileges, and to apply on top of
 changes we're proposing for how it handles cache collections.
+
+Last-updated: krb5-1.18-beta1
 ---
- src/aclocal.m4              |  67 +++++++
+ src/aclocal.m4              |  69 +++++++
  src/clients/ksu/Makefile.in |   8 +-
  src/clients/ksu/main.c      |  88 +++++++-
  src/clients/ksu/pam.c       | 389 ++++++++++++++++++++++++++++++++++++
  src/clients/ksu/pam.h       |  57 ++++++
- src/configure.in            |   2 +
- 6 files changed, 608 insertions(+), 3 deletions(-)
+ src/configure.ac            |   2 +
+ 6 files changed, 610 insertions(+), 3 deletions(-)
  create mode 100644 src/clients/ksu/pam.c
  create mode 100644 src/clients/ksu/pam.h
 
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index 3752d9bd5..340546d80 100644
+index 3d66a876b3..ce3c5a9bac 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
-@@ -1697,3 +1697,70 @@ AC_DEFUN(KRB5_AC_PERSISTENT_KEYRING,[
-       ]))
+@@ -1458,3 +1458,72 @@ if test "$with_ldap" = yes; then
+   OPENLDAP_PLUGIN=yes
+ fi
  ])dnl
- dnl
++dnl
 +dnl
 +dnl Use PAM instead of local crypt() compare for checking local passwords,
 +dnl and perform PAM account, session management, and password-changing where
@@ -102,12 +105,13 @@ index 3752d9bd5..340546d80 100644
 +AC_SUBST(PAM_MAN)
 +AC_SUBST(NON_PAM_MAN)
 +])dnl
++
 diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in
-index b2fcbf240..5755bb58a 100644
+index 8b4edce4d8..9d58f29b5d 100644
 --- a/src/clients/ksu/Makefile.in
 +++ b/src/clients/ksu/Makefile.in
 @@ -3,12 +3,14 @@ BUILDTOP=$(REL)..$(S)..
- DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/bin /local/bin"'
+ DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/usr/local/sbin /usr/local/bin /sbin /bin /usr/sbin /usr/bin"'
  
  KSU_LIBS=@KSU_LIBS@
 +PAM_LIBS=@PAM_LIBS@
@@ -141,11 +145,11 @@ index b2fcbf240..5755bb58a 100644
  clean:
  	$(RM) ksu
 diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
-index d9596d948..ec06788bc 100644
+index af12861729..931f054041 100644
 --- a/src/clients/ksu/main.c
 +++ b/src/clients/ksu/main.c
 @@ -26,6 +26,7 @@
-  * KSU was writen by:  Ari Medvinsky, ari@isi.edu
+  * KSU was written by:  Ari Medvinsky, ari@isi.edu
   */
  
 +#include "autoconf.h"
@@ -171,7 +175,7 @@ index d9596d948..ec06788bc 100644
  /***********/
  
  #define KS_TEMPORARY_CACHE "MEMORY:_ksu"
-@@ -528,6 +534,23 @@ main (argc, argv)
+@@ -536,6 +542,23 @@ main (argc, argv)
                 prog_name,target_user,client_name,
                 source_user,ontty());
  
@@ -195,7 +199,7 @@ index d9596d948..ec06788bc 100644
          /* Run authorization as target.*/
          if (krb5_seteuid(target_uid)) {
              com_err(prog_name, errno, _("while switching to target for "
-@@ -588,6 +611,24 @@ main (argc, argv)
+@@ -596,6 +619,24 @@ main (argc, argv)
  
              exit(1);
          }
@@ -220,7 +224,7 @@ index d9596d948..ec06788bc 100644
      }
  
      if( some_rest_copy){
-@@ -645,6 +686,30 @@ main (argc, argv)
+@@ -653,6 +694,30 @@ main (argc, argv)
          exit(1);
      }
  
@@ -251,7 +255,7 @@ index d9596d948..ec06788bc 100644
      /* set permissions */
      if (setgid(target_pwd->pw_gid) < 0) {
          perror("ksu: setgid");
-@@ -742,7 +807,7 @@ main (argc, argv)
+@@ -750,7 +815,7 @@ main (argc, argv)
          fprintf(stderr, "program to be execed %s\n",params[0]);
      }
  
@@ -260,7 +264,7 @@ index d9596d948..ec06788bc 100644
          execv(params[0], params);
          com_err(prog_name, errno, _("while trying to execv %s"), params[0]);
          sweep_up(ksu_context, cc_target);
-@@ -772,16 +837,35 @@ main (argc, argv)
+@@ -780,16 +845,35 @@ main (argc, argv)
              if (ret_pid == -1) {
                  com_err(prog_name, errno, _("while calling waitpid"));
              }
@@ -299,7 +303,7 @@ index d9596d948..ec06788bc 100644
      }
 diff --git a/src/clients/ksu/pam.c b/src/clients/ksu/pam.c
 new file mode 100644
-index 000000000..cbfe48704
+index 0000000000..cbfe487047
 --- /dev/null
 +++ b/src/clients/ksu/pam.c
 @@ -0,0 +1,389 @@
@@ -694,7 +698,7 @@ index 000000000..cbfe48704
 +#endif
 diff --git a/src/clients/ksu/pam.h b/src/clients/ksu/pam.h
 new file mode 100644
-index 000000000..0ab76569c
+index 0000000000..0ab76569cb
 --- /dev/null
 +++ b/src/clients/ksu/pam.h
 @@ -0,0 +1,57 @@
@@ -755,11 +759,11 @@ index 000000000..0ab76569c
 +int appl_pam_cred_init(void);
 +void appl_pam_cleanup(void);
 +#endif
-diff --git a/src/configure.in b/src/configure.in
-index 61ef738dc..e9a12ac16 100644
---- a/src/configure.in
-+++ b/src/configure.in
-@@ -1352,6 +1352,8 @@ AC_SUBST([VERTO_VERSION])
+diff --git a/src/configure.ac b/src/configure.ac
+index 77be7a2025..587221936e 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -1399,6 +1399,8 @@ AC_SUBST([VERTO_VERSION])
  
  AC_PATH_PROG(GROFF, groff)
  
@@ -768,3 +772,6 @@ index 61ef738dc..e9a12ac16 100644
  # Make localedir work in autoconf 2.5x.
  if test "${localedir+set}" != set; then
      localedir='$(datadir)/locale'
+-- 
+2.45.1
+
diff --git a/krb5-1.17-beta1-selinux-label.patch b/0003-downstream-SELinux-integration.patch
similarity index 89%
rename from krb5-1.17-beta1-selinux-label.patch
rename to 0003-downstream-SELinux-integration.patch
index bf5d4eb..a3b32c3 100644
--- a/krb5-1.17-beta1-selinux-label.patch
+++ b/0003-downstream-SELinux-integration.patch
@@ -1,7 +1,7 @@
-From e1c4f8894d22da9c157bfcf31e28f9ceaeebe39e Mon Sep 17 00:00:00 2001
+From 30ff501e4b519396f5aea25e24919be817863e7c Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:30:53 -0400
-Subject: [PATCH] krb5-1.17-beta1-selinux-label.patch
+Subject: [PATCH] [downstream] SELinux integration
 
 SELinux bases access to files on the domain of the requesting process,
 the operation being performed, and the context applied to the file.
@@ -35,11 +35,15 @@ stomp all over us.
 The selabel APIs for looking up the context should be thread-safe (per
 Red Hat #273081), so switching to using them instead of matchpathcon(),
 which we used earlier, is some improvement.
+
+Last-updated: krb5-1.20.1
+[jrische@redhat.com: Replace deprecated security_context_t by char *:
+    - src/util/support/selinux.c]
 ---
- src/aclocal.m4                                |  49 +++
+ src/aclocal.m4                                |  48 +++
  src/build-tools/krb5-config.in                |   3 +-
  src/config/pre.in                             |   3 +-
- src/configure.in                              |   2 +
+ src/configure.ac                              |   2 +
  src/include/k5-int.h                          |   1 +
  src/include/k5-label.h                        |  32 ++
  src/include/krb5/krb5.hin                     |   6 +
@@ -51,7 +55,6 @@ which we used earlier, is some improvement.
  src/lib/krb5/ccache/cc_dir.c                  |  26 +-
  src/lib/krb5/keytab/kt_file.c                 |   4 +-
  src/lib/krb5/os/trace.c                       |   2 +-
- src/lib/krb5/rcache/rc_dfl.c                  |  13 +
  src/plugins/kdb/db2/adb_openclose.c           |   2 +-
  src/plugins/kdb/db2/kdb_db2.c                 |   4 +-
  src/plugins/kdb/db2/libdb2/btree/bt_open.c    |   3 +-
@@ -60,16 +63,16 @@ which we used earlier, is some improvement.
  .../kdb/ldap/ldap_util/kdb5_ldap_services.c   |  11 +-
  src/util/profile/prof_file.c                  |   3 +-
  src/util/support/Makefile.in                  |   3 +-
- src/util/support/selinux.c                    | 406 ++++++++++++++++++
- 25 files changed, 587 insertions(+), 21 deletions(-)
+ src/util/support/selinux.c                    | 405 ++++++++++++++++++
+ 24 files changed, 572 insertions(+), 21 deletions(-)
  create mode 100644 src/include/k5-label.h
  create mode 100644 src/util/support/selinux.c
 
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index 340546d80..a7afec09e 100644
+index ce3c5a9bac..3331970930 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
-@@ -89,6 +89,7 @@ AC_SUBST_FILE(libnodeps_frag)
+@@ -85,6 +85,7 @@ AC_SUBST_FILE(libnodeps_frag)
  dnl
  KRB5_AC_PRAGMA_WEAK_REF
  WITH_LDAP
@@ -77,7 +80,7 @@ index 340546d80..a7afec09e 100644
  KRB5_LIB_PARAMS
  KRB5_AC_INITFINI
  KRB5_AC_ENABLE_THREADS
-@@ -1764,3 +1765,51 @@ AC_SUBST(PAM_LIBS)
+@@ -1526,4 +1527,51 @@ AC_SUBST(PAM_LIBS)
  AC_SUBST(PAM_MAN)
  AC_SUBST(NON_PAM_MAN)
  ])dnl
@@ -100,7 +103,7 @@ index 340546d80..a7afec09e 100644
 +                       AC_MSG_ERROR([Unable to locate selinux/selinux.h.])
 +               fi
 +       fi
-+
+ 
 +       LIBS=
 +       unset ac_cv_func_setfscreatecon
 +       AC_CHECK_FUNCS(setfscreatecon selabel_open)
@@ -130,10 +133,10 @@ index 340546d80..a7afec09e 100644
 +AC_SUBST(SELINUX_LIBS)
 +])dnl
 diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
-index f6184da3f..c17cb5eb5 100755
+index 8e6eb86601..7677f37359 100755
 --- a/src/build-tools/krb5-config.in
 +++ b/src/build-tools/krb5-config.in
-@@ -41,6 +41,7 @@ DL_LIB='@DL_LIB@'
+@@ -40,6 +40,7 @@ DL_LIB='@DL_LIB@'
  DEFCCNAME='@DEFCCNAME@'
  DEFKTNAME='@DEFKTNAME@'
  DEFCKTNAME='@DEFCKTNAME@'
@@ -141,7 +144,7 @@ index f6184da3f..c17cb5eb5 100755
  
  LIBS='@LIBS@'
  GEN_LIB=@GEN_LIB@
-@@ -255,7 +256,7 @@ if test -n "$do_libs"; then
+@@ -253,7 +254,7 @@ if test -n "$do_libs"; then
      fi
  
      # If we ever support a flag to generate output suitable for static
@@ -151,7 +154,7 @@ index f6184da3f..c17cb5eb5 100755
  
      echo $lib_flags
 diff --git a/src/config/pre.in b/src/config/pre.in
-index ce87e21ca..917357df9 100644
+index a0c60c70b3..7eaa2f351c 100644
 --- a/src/config/pre.in
 +++ b/src/config/pre.in
 @@ -177,6 +177,7 @@ LD = $(PURE) @LD@
@@ -162,7 +165,7 @@ index ce87e21ca..917357df9 100644
  
  INSTALL=@INSTALL@
  INSTALL_STRIP=
-@@ -402,7 +403,7 @@ SUPPORT_LIB			= -l$(SUPPORT_LIBNAME)
+@@ -379,7 +380,7 @@ SUPPORT_LIB			= -l$(SUPPORT_LIBNAME)
  # HESIOD_LIBS is -lhesiod...
  HESIOD_LIBS	= @HESIOD_LIBS@
  
@@ -171,11 +174,11 @@ index ce87e21ca..917357df9 100644
  KDB5_LIBS	= $(KDB5_LIB) $(GSSRPC_LIBS)
  GSS_LIBS	= $(GSS_KRB5_LIB)
  # needs fixing if ever used on macOS!
-diff --git a/src/configure.in b/src/configure.in
-index e9a12ac16..93aec682e 100644
---- a/src/configure.in
-+++ b/src/configure.in
-@@ -1354,6 +1354,8 @@ AC_PATH_PROG(GROFF, groff)
+diff --git a/src/configure.ac b/src/configure.ac
+index 587221936e..69be9030f8 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -1401,6 +1401,8 @@ AC_PATH_PROG(GROFF, groff)
  
  KRB5_WITH_PAM
  
@@ -185,7 +188,7 @@ index e9a12ac16..93aec682e 100644
  if test "${localedir+set}" != set; then
      localedir='$(datadir)/locale'
 diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index 652242207..8f9329c59 100644
+index 1d1c8293f4..768110e5ef 100644
 --- a/src/include/k5-int.h
 +++ b/src/include/k5-int.h
 @@ -128,6 +128,7 @@ typedef unsigned char   u_char;
@@ -198,7 +201,7 @@ index 652242207..8f9329c59 100644
  #define KRB5_KDB_MAX_RLIFE      (60*60*24*7) /* one week */
 diff --git a/src/include/k5-label.h b/src/include/k5-label.h
 new file mode 100644
-index 000000000..dfaaa847c
+index 0000000000..dfaaa847cb
 --- /dev/null
 +++ b/src/include/k5-label.h
 @@ -0,0 +1,32 @@
@@ -235,10 +238,10 @@ index 000000000..dfaaa847c
 +#endif
 +#endif
 diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
-index c40a6cca8..3ff86d7ff 100644
+index 4e09ed345d..09f800be52 100644
 --- a/src/include/krb5/krb5.hin
 +++ b/src/include/krb5/krb5.hin
-@@ -87,6 +87,12 @@
+@@ -83,6 +83,12 @@
  #define THREEPARAMOPEN(x,y,z) open(x,y,z)
  #endif
  
@@ -252,7 +255,7 @@ index c40a6cca8..3ff86d7ff 100644
  
  #include <stdlib.h>
 diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c
-index c9574c6e1..8301a33d0 100644
+index a89b5144f6..4d6cc0bdf9 100644
 --- a/src/kadmin/dbutil/dump.c
 +++ b/src/kadmin/dbutil/dump.c
 @@ -148,12 +148,21 @@ create_ofile(char *ofile, char **tmpname)
@@ -287,10 +290,10 @@ index c9574c6e1..8301a33d0 100644
          com_err(progname, errno, _("while creating 'ok' file, '%s'"), file_ok);
          goto cleanup;
 diff --git a/src/kdc/main.c b/src/kdc/main.c
-index 408c723f5..663fd6303 100644
+index bfdfef5c48..b43fe9a082 100644
 --- a/src/kdc/main.c
 +++ b/src/kdc/main.c
-@@ -858,7 +858,7 @@ write_pid_file(const char *path)
+@@ -844,7 +844,7 @@ write_pid_file(const char *path)
      FILE *file;
      unsigned long pid;
  
@@ -300,7 +303,7 @@ index 408c723f5..663fd6303 100644
          return errno;
      pid = (unsigned long) getpid();
 diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c
-index 68323dd0f..4cc035dc6 100644
+index aa3c81ea30..cb9785aaeb 100644
 --- a/src/kprop/kpropd.c
 +++ b/src/kprop/kpropd.c
 @@ -488,6 +488,9 @@ doit(int fd)
@@ -330,10 +333,10 @@ index 68323dd0f..4cc035dc6 100644
                              KRB5_LOCKMODE_EXCLUSIVE | KRB5_LOCKMODE_DONTBLOCK);
      if (retval) {
 diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c
-index c6885edf2..9aec3c05e 100644
+index e14da53790..b879a4049b 100644
 --- a/src/lib/kadm5/logger.c
 +++ b/src/lib/kadm5/logger.c
-@@ -309,7 +309,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do
+@@ -310,7 +310,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do
                       */
                      append = (cp[4] == ':') ? O_APPEND : 0;
                      if (append || cp[4] == '=') {
@@ -342,7 +345,7 @@ index c6885edf2..9aec3c05e 100644
                                    S_IRUSR | S_IWUSR | S_IRGRP);
                          if (fd != -1)
                              f = fdopen(fd, append ? "a" : "w");
-@@ -776,7 +776,7 @@ krb5_klog_reopen(krb5_context kcontext)
+@@ -777,7 +777,7 @@ krb5_klog_reopen(krb5_context kcontext)
               * In case the old logfile did not get moved out of the
               * way, open for append to prevent squashing the old logs.
               */
@@ -352,7 +355,7 @@ index c6885edf2..9aec3c05e 100644
                  set_cloexec_file(f);
                  log_control.log_entries[lindex].lfu_filep = f;
 diff --git a/src/lib/kdb/kdb_log.c b/src/lib/kdb/kdb_log.c
-index 2659a2501..e9b95fce5 100644
+index 2659a25018..e9b95fce59 100644
 --- a/src/lib/kdb/kdb_log.c
 +++ b/src/lib/kdb/kdb_log.c
 @@ -480,7 +480,7 @@ ulog_map(krb5_context context, const char *logname, uint32_t ulogentries)
@@ -365,7 +368,7 @@ index 2659a2501..e9b95fce5 100644
              retval = errno;
              goto cleanup;
 diff --git a/src/lib/krb5/ccache/cc_dir.c b/src/lib/krb5/ccache/cc_dir.c
-index bba64e516..73f0fe62d 100644
+index 1da40b51d0..f3ab7340a6 100644
 --- a/src/lib/krb5/ccache/cc_dir.c
 +++ b/src/lib/krb5/ccache/cc_dir.c
 @@ -183,10 +183,19 @@ write_primary_file(const char *primary_path, const char *contents)
@@ -415,10 +418,10 @@ index bba64e516..73f0fe62d 100644
                    _("Credential cache directory %s does not exist"),
                    dirname);
 diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c
-index 89cb68680..21c80d419 100644
+index e510211fc5..f3ea28c8ec 100644
 --- a/src/lib/krb5/keytab/kt_file.c
 +++ b/src/lib/krb5/keytab/kt_file.c
-@@ -1024,14 +1024,14 @@ krb5_ktfileint_open(krb5_context context, krb5_keytab id, int mode)
+@@ -735,14 +735,14 @@ krb5_ktfileint_open(krb5_context context, krb5_keytab id, int mode)
  
      KTCHECKLOCK(id);
      errno = 0;
@@ -436,10 +439,10 @@ index 89cb68680..21c80d419 100644
                  goto report_errno;
              writevno = 1;
 diff --git a/src/lib/krb5/os/trace.c b/src/lib/krb5/os/trace.c
-index 4fff8f38c..40a9e7b10 100644
+index 4cbbbb270a..c4058ddc96 100644
 --- a/src/lib/krb5/os/trace.c
 +++ b/src/lib/krb5/os/trace.c
-@@ -458,7 +458,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename)
+@@ -460,7 +460,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename)
      fd = malloc(sizeof(*fd));
      if (fd == NULL)
          return ENOMEM;
@@ -448,40 +451,8 @@ index 4fff8f38c..40a9e7b10 100644
      if (*fd == -1) {
          free(fd);
          return errno;
-diff --git a/src/lib/krb5/rcache/rc_dfl.c b/src/lib/krb5/rcache/rc_dfl.c
-index 1e0cb22c9..f5e93b1ab 100644
---- a/src/lib/krb5/rcache/rc_dfl.c
-+++ b/src/lib/krb5/rcache/rc_dfl.c
-@@ -793,6 +793,9 @@ krb5_rc_dfl_expunge_locked(krb5_context context, krb5_rcache id)
-     krb5_error_code retval = 0;
-     krb5_rcache tmp;
-     krb5_deltat lifespan = t->lifespan;  /* save original lifespan */
-+#ifdef USE_SELINUX
-+    void *selabel;
-+#endif
- 
-     if (! t->recovering) {
-         name = t->name;
-@@ -814,7 +817,17 @@ krb5_rc_dfl_expunge_locked(krb5_context context, krb5_rcache id)
-     retval = krb5_rc_resolve(context, tmp, 0);
-     if (retval)
-         goto cleanup;
-+#ifdef USE_SELINUX
-+    if (t->d.fn != NULL)
-+        selabel = krb5int_push_fscreatecon_for(t->d.fn);
-+    else
-+        selabel = NULL;
-+#endif
-     retval = krb5_rc_initialize(context, tmp, lifespan);
-+#ifdef USE_SELINUX
-+    if (selabel != NULL)
-+        krb5int_pop_fscreatecon(selabel);
-+#endif
-     if (retval)
-         goto cleanup;
-     for (q = t->a; q; q = q->na) {
 diff --git a/src/plugins/kdb/db2/adb_openclose.c b/src/plugins/kdb/db2/adb_openclose.c
-index 7db30a33b..2b9d01921 100644
+index 9a506e9d44..f92ab47143 100644
 --- a/src/plugins/kdb/db2/adb_openclose.c
 +++ b/src/plugins/kdb/db2/adb_openclose.c
 @@ -152,7 +152,7 @@ osa_adb_init_db(osa_adb_db_t *dbp, char *filename, char *lockfilename,
@@ -494,7 +465,7 @@ index 7db30a33b..2b9d01921 100644
               * maybe someone took away write permission so we could only
               * get shared locks?
 diff --git a/src/plugins/kdb/db2/kdb_db2.c b/src/plugins/kdb/db2/kdb_db2.c
-index 5106a5c99..e481e8121 100644
+index 2c163d91cc..9a344a603e 100644
 --- a/src/plugins/kdb/db2/kdb_db2.c
 +++ b/src/plugins/kdb/db2/kdb_db2.c
 @@ -694,8 +694,8 @@ ctx_create_db(krb5_context context, krb5_db2_context *dbc)
@@ -509,7 +480,7 @@ index 5106a5c99..e481e8121 100644
          retval = errno;
          goto cleanup;
 diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_open.c b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
-index 2977b17f3..d5809a5a9 100644
+index 2977b17f3a..d5809a5a93 100644
 --- a/src/plugins/kdb/db2/libdb2/btree/bt_open.c
 +++ b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
 @@ -60,6 +60,7 @@ static char sccsid[] = "@(#)bt_open.c	8.11 (Berkeley) 11/2/95";
@@ -530,7 +501,7 @@ index 2977b17f3..d5809a5a9 100644
  
  	} else {
 diff --git a/src/plugins/kdb/db2/libdb2/hash/hash.c b/src/plugins/kdb/db2/libdb2/hash/hash.c
-index 862dbb164..686a960c9 100644
+index 862dbb1640..686a960c96 100644
 --- a/src/plugins/kdb/db2/libdb2/hash/hash.c
 +++ b/src/plugins/kdb/db2/libdb2/hash/hash.c
 @@ -51,6 +51,7 @@ static char sccsid[] = "@(#)hash.c	8.12 (Berkeley) 11/7/95";
@@ -551,7 +522,7 @@ index 862dbb164..686a960c9 100644
  		(void)fcntl(hashp->fp, F_SETFD, 1);
  	}
 diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_open.c b/src/plugins/kdb/db2/libdb2/recno/rec_open.c
-index d8b26e701..b0daa7c02 100644
+index d8b26e7011..b0daa7c021 100644
 --- a/src/plugins/kdb/db2/libdb2/recno/rec_open.c
 +++ b/src/plugins/kdb/db2/libdb2/recno/rec_open.c
 @@ -51,6 +51,7 @@ static char sccsid[] = "@(#)rec_open.c	8.12 (Berkeley) 11/18/94";
@@ -573,10 +544,10 @@ index d8b26e701..b0daa7c02 100644
  
  	if (fname != NULL && fcntl(rfd, F_SETFD, 1) == -1) {
 diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
-index 1ed72afe9..ce038fc3d 100644
+index e87688d666..30f7c00ab5 100644
 --- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
 +++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
-@@ -194,7 +194,7 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
+@@ -190,7 +190,7 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
  
      /* set password in the file */
      old_mode = umask(0177);
@@ -585,7 +556,7 @@ index 1ed72afe9..ce038fc3d 100644
      if (pfile == NULL) {
          com_err(me, errno, _("Failed to open file %s: %s"), file_name,
                  strerror (errno));
-@@ -235,6 +235,9 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
+@@ -231,6 +231,9 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
           * Delete the existing entry and add the new entry
           */
          FILE *newfile;
@@ -595,7 +566,7 @@ index 1ed72afe9..ce038fc3d 100644
  
          mode_t omask;
  
-@@ -246,7 +249,13 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
+@@ -242,7 +245,13 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
          }
  
          omask = umask(077);
@@ -610,7 +581,7 @@ index 1ed72afe9..ce038fc3d 100644
          if (newfile == NULL) {
              com_err(me, errno, _("Error creating file %s"), tmp_file);
 diff --git a/src/util/profile/prof_file.c b/src/util/profile/prof_file.c
-index 24e41fb80..0dcb6b543 100644
+index aa951df05f..79f9500f69 100644
 --- a/src/util/profile/prof_file.c
 +++ b/src/util/profile/prof_file.c
 @@ -33,6 +33,7 @@
@@ -631,10 +602,10 @@ index 24e41fb80..0dcb6b543 100644
          retval = errno;
          if (retval == 0)
 diff --git a/src/util/support/Makefile.in b/src/util/support/Makefile.in
-index db7b030b8..321672bcb 100644
+index 86d5a950a6..1052d53a1e 100644
 --- a/src/util/support/Makefile.in
 +++ b/src/util/support/Makefile.in
-@@ -69,6 +69,7 @@ IPC_SYMS= \
+@@ -74,6 +74,7 @@ IPC_SYMS= \
  
  STLIBOBJS= \
  	threads.o \
@@ -642,7 +613,7 @@ index db7b030b8..321672bcb 100644
  	init-addrinfo.o \
  	plugins.o \
  	errors.o \
-@@ -160,7 +161,7 @@ SRCS=\
+@@ -168,7 +169,7 @@ SRCS=\
  
  SHLIB_EXPDEPS =
  # Add -lm if dumping thread stats, for sqrt.
@@ -653,10 +624,10 @@ index db7b030b8..321672bcb 100644
  
 diff --git a/src/util/support/selinux.c b/src/util/support/selinux.c
 new file mode 100644
-index 000000000..6d41f3244
+index 0000000000..807d039da3
 --- /dev/null
 +++ b/src/util/support/selinux.c
-@@ -0,0 +1,406 @@
+@@ -0,0 +1,405 @@
 +/*
 + * Copyright 2007,2008,2009,2011,2012,2013,2016 Red Hat, Inc.  All Rights Reserved.
 + *
@@ -755,17 +726,16 @@ index 000000000..6d41f3244
 +    }
 +}
 +
-+static security_context_t
++static char *
 +push_fscreatecon(const char *pathname, mode_t mode)
 +{
-+    security_context_t previous, configuredsc, currentsc, derivedsc;
++    char *previous, *configuredsc, *currentsc, *genpath;
++    const char *derivedsc, *fullpath, *currentuser;
 +    context_t current, derived;
-+    const char *fullpath, *currentuser;
-+    char *genpath;
 +
-+    previous = configuredsc = currentsc = derivedsc = NULL;
++    previous = configuredsc = currentsc = genpath = NULL;
++    derivedsc = NULL;
 +    current = derived = NULL;
-+    genpath = NULL;
 +
 +    fullpath = pathname;
 +
@@ -893,7 +863,7 @@ index 000000000..6d41f3244
 +}
 +
 +static void
-+pop_fscreatecon(security_context_t previous)
++pop_fscreatecon(char *previous)
 +{
 +    if (!is_selinux_enabled()) {
 +        return;
@@ -947,7 +917,7 @@ index 000000000..6d41f3244
 +{
 +    FILE *fp;
 +    int errno_save;
-+    security_context_t ctx;
++    char *ctx;
 +
 +    if ((strcmp(mode, "r") == 0) ||
 +        (strcmp(mode, "rb") == 0)) {
@@ -973,7 +943,7 @@ index 000000000..6d41f3244
 +{
 +    int fd;
 +    int errno_save;
-+    security_context_t ctx;
++    char *ctx;
 +
 +    k5_once(&labeled_once, label_mutex_init);
 +    k5_mutex_lock(&labeled_mutex);
@@ -994,7 +964,7 @@ index 000000000..6d41f3244
 +{
 +    int ret;
 +    int errno_save;
-+    security_context_t ctx;
++    char *ctx;
 +
 +    k5_once(&labeled_once, label_mutex_init);
 +    k5_mutex_lock(&labeled_mutex);
@@ -1015,7 +985,7 @@ index 000000000..6d41f3244
 +{
 +    int ret;
 +    int errno_save;
-+    security_context_t ctx;
++    char *ctx;
 +
 +    k5_once(&labeled_once, label_mutex_init);
 +    k5_mutex_lock(&labeled_mutex);
@@ -1036,7 +1006,7 @@ index 000000000..6d41f3244
 +{
 +    int fd;
 +    int errno_save;
-+    security_context_t ctx;
++    char *ctx;
 +    mode_t mode;
 +    va_list ap;
 +
@@ -1063,3 +1033,6 @@ index 000000000..6d41f3244
 +}
 +
 +#endif /* USE_SELINUX */
+-- 
+2.45.1
+
diff --git a/krb5-1.9-debuginfo.patch b/0004-downstream-fix-debuginfo-with-y.tab.c.patch
similarity index 85%
rename from krb5-1.9-debuginfo.patch
rename to 0004-downstream-fix-debuginfo-with-y.tab.c.patch
index 89f5729..c21b269 100644
--- a/krb5-1.9-debuginfo.patch
+++ b/0004-downstream-fix-debuginfo-with-y.tab.c.patch
@@ -1,18 +1,20 @@
-From d205539d89b857f7bd2b09dfc875d5cdd79167b7 Mon Sep 17 00:00:00 2001
+From 393830d96000ed692aa9a99ef87187d6f2863931 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:49:25 -0400
-Subject: [PATCH] krb5-1.9-debuginfo.patch
+Subject: [PATCH] [downstream] fix debuginfo with y.tab.c
 
 We want to keep these y.tab.c files around because the debuginfo points to
 them.  It would be more elegant at the end to use symbolic links, but that
 could mess up people working in the tree on other things.
+
+Last-updated: krb5-1.9
 ---
  src/kadmin/cli/Makefile.in                 | 5 +++++
  src/plugins/kdb/ldap/ldap_util/Makefile.in | 2 +-
  2 files changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/src/kadmin/cli/Makefile.in b/src/kadmin/cli/Makefile.in
-index adfea6e2b..d1327e400 100644
+index adfea6e2b5..d1327e400b 100644
 --- a/src/kadmin/cli/Makefile.in
 +++ b/src/kadmin/cli/Makefile.in
 @@ -37,3 +37,8 @@ clean-unix::
@@ -25,7 +27,7 @@ index adfea6e2b..d1327e400 100644
 +	$(YACC.y) $< 
 +	$(CP) y.tab.c $@
 diff --git a/src/plugins/kdb/ldap/ldap_util/Makefile.in b/src/plugins/kdb/ldap/ldap_util/Makefile.in
-index 8669c2436..a22f23c02 100644
+index 8669c2436c..a22f23c02c 100644
 --- a/src/plugins/kdb/ldap/ldap_util/Makefile.in
 +++ b/src/plugins/kdb/ldap/ldap_util/Makefile.in
 @@ -20,7 +20,7 @@ $(PROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIB) $(GETDATE)
@@ -37,3 +39,6 @@ index 8669c2436..a22f23c02 100644
  
  install:
  	$(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG)
+-- 
+2.45.1
+
diff --git a/Remove-3des-support.patch b/0005-downstream-Remove-3des-support.patch
similarity index 89%
rename from Remove-3des-support.patch
rename to 0005-downstream-Remove-3des-support.patch
index f3b07fc..fcdb136 100644
--- a/Remove-3des-support.patch
+++ b/0005-downstream-Remove-3des-support.patch
@@ -1,51 +1,61 @@
-From 17365a6131488b518b0f50e08d24697acce79d44 Mon Sep 17 00:00:00 2001
+From 7d697742abb370cfc7241c1faa78ba08d7650f6a Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 26 Mar 2019 18:51:10 -0400
-Subject: [PATCH] Remove 3des support
+Subject: [PATCH] [downstream] Remove 3des support
 
 Completely remove support for all DES3 enctypes (des3-cbc-raw,
 des3-hmac-sha1, des3-cbc-sha1-kd).  Update all tests and documentation
 to user other enctypes.  Mark the 3DES enctypes UNSUPPORTED and retain
 their constants.
 
-(cherry picked from commit 57a8a84e035000b515ca9efd56e5cbe1568b95e7)
+Last-updated: 1.21.1-final
+[antorres@redhat.com: remove diffs for:
+     - src/kdamin/testing/proto/kdc.conf.proto
+     - src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
+     - src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
+     - src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
+ since they were removed by Remove-TCL-based-libkadm5-API-tests.patch]
+[jrische@redhat.com: restore supportedCMSTypes (not using 3DES any more):
+    - src/plugins/preauth/pkinit/pkinit_crypto.h
+    - src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+    - src/plugins/preauth/pkinit/pkinit_clnt.c]
 ---
  doc/admin/advanced/retiring-des.rst           |  11 +
  doc/admin/conf_files/kdc_conf.rst             |   7 +-
- doc/admin/enctypes.rst                        |  13 +-
+ doc/admin/enctypes.rst                        |  10 +-
  doc/admin/troubleshoot.rst                    |   9 +-
  doc/appdev/refs/macros/index.rst              |   1 -
+ doc/conf.py                                   |   2 +-
  doc/mitK5features.rst                         |   2 +-
  src/Makefile.in                               |   4 +-
- src/configure.in                              |   1 -
+ src/configure.ac                              |   4 +-
  src/include/krb5/krb5.hin                     |  10 +-
- src/kadmin/testing/proto/kdc.conf.proto       |   4 +-
  src/kdc/kdc_util.c                            |   4 -
  src/lib/crypto/Makefile.in                    |   8 +-
- src/lib/crypto/builtin/Makefile.in            |   6 +-
+ src/lib/crypto/builtin/Makefile.in            |   4 +-
  src/lib/crypto/builtin/des/ISSUES             |  13 -
- src/lib/crypto/builtin/des/Makefile.in        |  80 ----
- src/lib/crypto/builtin/des/d3_aead.c          | 133 ------
- src/lib/crypto/builtin/des/d3_kysched.c       |  51 ---
- src/lib/crypto/builtin/des/deps               | 148 -------
+ src/lib/crypto/builtin/des/Makefile.in        |  82 ----
+ src/lib/crypto/builtin/des/d3_aead.c          | 137 ------
+ src/lib/crypto/builtin/des/d3_kysched.c       |  55 ---
+ src/lib/crypto/builtin/des/deps               | 146 -------
  src/lib/crypto/builtin/des/des_int.h          | 285 -------------
- src/lib/crypto/builtin/des/des_keys.c         |  40 --
+ src/lib/crypto/builtin/des/des_keys.c         |  38 --
  src/lib/crypto/builtin/des/destest.c          | 240 -----------
  src/lib/crypto/builtin/des/doc/libdes.doc     | 208 ---------
- src/lib/crypto/builtin/des/f_aead.c           | 173 --------
+ src/lib/crypto/builtin/des/f_aead.c           | 177 --------
  src/lib/crypto/builtin/des/f_cbc.c            | 256 ------------
- src/lib/crypto/builtin/des/f_cksum.c          | 136 ------
- src/lib/crypto/builtin/des/f_parity.c         |  56 ---
- src/lib/crypto/builtin/des/f_sched.c          | 359 ----------------
- src/lib/crypto/builtin/des/f_tables.c         | 370 ----------------
+ src/lib/crypto/builtin/des/f_cksum.c          | 141 -------
+ src/lib/crypto/builtin/des/f_parity.c         |  64 ---
+ src/lib/crypto/builtin/des/f_sched.c          | 363 ----------------
+ src/lib/crypto/builtin/des/f_tables.c         | 375 -----------------
  src/lib/crypto/builtin/des/f_tables.h         | 285 -------------
- src/lib/crypto/builtin/des/key_sched.c        |  62 ---
+ src/lib/crypto/builtin/des/key_sched.c        |  66 ---
  src/lib/crypto/builtin/des/keytest.data       | 171 --------
  src/lib/crypto/builtin/des/t_verify.c         | 395 ------------------
- src/lib/crypto/builtin/des/weak_key.c         |  86 ----
- .../crypto/builtin/enc_provider/Makefile.in   |   6 +-
- src/lib/crypto/builtin/enc_provider/deps      |  12 -
- src/lib/crypto/builtin/enc_provider/des3.c    | 105 -----
+ src/lib/crypto/builtin/des/weak_key.c         |  90 ----
+ .../crypto/builtin/enc_provider/Makefile.in   |   5 +-
+ src/lib/crypto/builtin/enc_provider/deps      |  11 -
+ src/lib/crypto/builtin/enc_provider/des3.c    | 109 -----
  src/lib/crypto/crypto_tests/t_cf2.expected    |   1 -
  src/lib/crypto/crypto_tests/t_cf2.in          |   5 -
  src/lib/crypto/crypto_tests/t_cksums.c        |  10 -
@@ -54,22 +64,24 @@ their constants.
  src/lib/crypto/crypto_tests/t_encrypt.c       |   1 -
  src/lib/crypto/crypto_tests/t_short.c         |   1 -
  src/lib/crypto/crypto_tests/t_str2key.c       |  52 ---
+ src/lib/crypto/crypto_tests/vectors.c         |   4 -
  src/lib/crypto/krb/Makefile.in                |   3 -
  src/lib/crypto/krb/cksumtypes.c               |   6 -
- src/lib/crypto/krb/crypto_int.h               |  16 -
+ src/lib/crypto/krb/crypto_int.h               |  11 -
  src/lib/crypto/krb/default_state.c            |  10 -
  src/lib/crypto/krb/enctype_util.c             |   3 +
  src/lib/crypto/krb/etypes.c                   |  21 -
  src/lib/crypto/krb/prf_des.c                  |  47 ---
- src/lib/crypto/krb/random_to_key.c            |  45 --
+ src/lib/crypto/krb/random_to_key.c            |  28 --
  src/lib/crypto/libk5crypto.exports            |   1 -
- src/lib/crypto/openssl/Makefile.in            |   8 +-
+ src/lib/crypto/openssl/Makefile.in            |   4 +-
  src/lib/crypto/openssl/des/Makefile.in        |  20 -
- src/lib/crypto/openssl/des/deps               |  15 -
- src/lib/crypto/openssl/des/des_keys.c         |  40 --
+ src/lib/crypto/openssl/des/deps               |  14 -
+ src/lib/crypto/openssl/des/des_keys.c         |  39 --
  .../crypto/openssl/enc_provider/Makefile.in   |   3 -
  src/lib/crypto/openssl/enc_provider/deps      |  11 -
- src/lib/crypto/openssl/enc_provider/des3.c    | 184 --------
+ src/lib/crypto/openssl/enc_provider/des3.c    | 188 ---------
+ src/lib/crypto/openssl/kdf.c                  |   2 -
  src/lib/gssapi/krb5/accept_sec_context.c      |   1 -
  src/lib/gssapi/krb5/gssapiP_krb5.h            |   6 +-
  src/lib/gssapi/krb5/k5seal.c                  |  35 +-
@@ -77,35 +89,27 @@ their constants.
  src/lib/gssapi/krb5/k5unseal.c                |  88 ++--
  src/lib/gssapi/krb5/k5unsealiov.c             |  38 +-
  src/lib/gssapi/krb5/util_crypt.c              |  11 -
- .../api.current/chpass-principal-v2.exp       |   4 +-
- .../api.current/get-principal-v2.exp          |   4 +-
- .../api.current/randkey-principal-v2.exp      |   4 +-
  src/lib/krb5/krb/init_ctx.c                   |   3 -
  src/lib/krb5/krb/s4u_creds.c                  |   2 -
- src/lib/krb5/krb/t_copy_context.c             |   2 +-
  src/lib/krb5/krb/t_etypes.c                   |  48 +--
  src/lib/krb5/os/t_trace.c                     |   4 +-
  src/lib/krb5/os/t_trace.ref                   |   2 +-
  src/plugins/preauth/pkinit/pkcs11.h           |   6 +-
- src/plugins/preauth/pkinit/pkinit_clnt.c      |   8 -
- src/plugins/preauth/pkinit/pkinit_crypto.h    |  12 -
- .../preauth/pkinit/pkinit_crypto_openssl.c    |  38 --
- src/plugins/preauth/pkinit/pkinit_kdf_test.c  |  31 --
+ src/plugins/preauth/pkinit/pkinit_crypto.h    |  10 +-
+ src/plugins/preauth/pkinit/pkinit_kdf_test.c  |  30 --
  src/plugins/preauth/spake/t_vectors.c         |  25 --
- src/tests/dejagnu/config/default.exp          |  78 ----
- src/tests/dejagnu/krb-standalone/kprop.exp    |   2 +-
  src/tests/gssapi/t_enctypes.py                |  33 +-
  src/tests/gssapi/t_invalid.c                  |  12 -
  src/tests/gssapi/t_pcontok.c                  |  16 +-
  src/tests/gssapi/t_prf.c                      |   7 -
  src/tests/t_authdata.py                       |   2 +-
- src/tests/t_etype_info.py                     |  18 +-
+ src/tests/t_etype_info.py                     |  21 +-
  src/tests/t_keyrollover.py                    |   8 +-
  src/tests/t_mkey.py                           |  35 --
  src/tests/t_salt.py                           |   5 +-
- src/util/k5test.py                            |  10 -
+ src/util/k5test.py                            |   7 -
  .../leash/htmlhelp/html/Encryption_Types.htm  |  13 -
- 95 files changed, 155 insertions(+), 4829 deletions(-)
+ 89 files changed, 149 insertions(+), 4712 deletions(-)
  delete mode 100644 src/lib/crypto/builtin/des/ISSUES
  delete mode 100644 src/lib/crypto/builtin/des/Makefile.in
  delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c
@@ -134,7 +138,7 @@ their constants.
  delete mode 100644 src/lib/crypto/openssl/enc_provider/des3.c
 
 diff --git a/doc/admin/advanced/retiring-des.rst b/doc/admin/advanced/retiring-des.rst
-index 4a964c15c..cb6258d77 100644
+index 38f76d3f45..d5e3c30c04 100644
 --- a/doc/admin/advanced/retiring-des.rst
 +++ b/doc/admin/advanced/retiring-des.rst
 @@ -10,6 +10,13 @@ ability have rendered DES vulnerable to brute force attacks on its 56-bit
@@ -163,19 +167,19 @@ index 4a964c15c..cb6258d77 100644
  -------------
  
 diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst
-index 2c6ea1855..a9ecaf4a9 100644
+index 74a0a2acef..846c58ed82 100644
 --- a/doc/admin/conf_files/kdc_conf.rst
 +++ b/doc/admin/conf_files/kdc_conf.rst
-@@ -841,8 +841,6 @@ Encryption types marked as "weak" are available for compatibility but
- not recommended for use.
+@@ -854,8 +854,6 @@ Encryption types marked as "weak" and "deprecated" are available for
+ compatibility but not recommended for use.
  
  ==================================================== =========================================================
 -des3-cbc-raw                                         Triple DES cbc mode raw (weak)
--des3-cbc-sha1 des3-hmac-sha1 des3-cbc-sha1-kd        Triple DES cbc mode with HMAC/sha1
+-des3-cbc-sha1 des3-hmac-sha1 des3-cbc-sha1-kd        Triple DES cbc mode with HMAC/sha1 (deprecated)
  aes256-cts-hmac-sha1-96 aes256-cts aes256-sha1       AES-256 CTS mode with 96-bit SHA-1 HMAC
  aes128-cts-hmac-sha1-96 aes128-cts aes128-sha1       AES-128 CTS mode with 96-bit SHA-1 HMAC
  aes256-cts-hmac-sha384-192 aes256-sha2               AES-256 CTS mode with 192-bit SHA-384 HMAC
-@@ -851,7 +849,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5               RC4 with HMAC/MD5
+@@ -864,7 +862,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5               RC4 with HMAC/MD5 (deprecat
  arcfour-hmac-exp rc4-hmac-exp arcfour-hmac-md5-exp   Exportable RC4 with HMAC/MD5 (weak)
  camellia256-cts-cmac camellia256-cts                 Camellia-256 CTS mode with CMAC
  camellia128-cts-cmac camellia128-cts                 Camellia-128 CTS mode with CMAC
@@ -183,7 +187,7 @@ index 2c6ea1855..a9ecaf4a9 100644
  aes                                                  The AES family: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128
  rc4                                                  The RC4 family: arcfour-hmac
  camellia                                             The Camellia family: camellia256-cts-cmac and camellia128-cts-cmac
-@@ -863,8 +860,8 @@ from the current list by prefixing them with a minus sign ("-").
+@@ -876,8 +873,8 @@ from the current list by prefixing them with a minus sign ("-").
  Types or families can be prefixed with a plus sign ("+") for symmetry;
  it has the same meaning as just listing the type or family.  For
  example, "``DEFAULT -rc4``" would be the default set of encryption
@@ -195,35 +199,35 @@ index 2c6ea1855..a9ecaf4a9 100644
  
  While **aes128-cts** and **aes256-cts** are supported for all Kerberos
 diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
-index 84183a53c..b3fdc7c8b 100644
+index 694922c0d9..c4d5499d3b 100644
 --- a/doc/admin/enctypes.rst
 +++ b/doc/admin/enctypes.rst
-@@ -125,7 +125,7 @@ enctype                    weak? krb5     Windows
- des-cbc-crc                weak  <1.18    >=2000
- des-cbc-md4                weak  <1.18    ?
- des-cbc-md5                weak  <1.18    >=2000
--des3-cbc-sha1                    >=1.1    none
-+des3-cbc-sha1                    <1.18    none
- arcfour-hmac                     >=1.3    >=2000
- arcfour-hmac-exp           weak  >=1.3    >=2000
- aes128-cts-hmac-sha1-96          >=1.3    >=Vista
-@@ -136,7 +136,10 @@ camellia128-cts-cmac             >=1.9    none
- camellia256-cts-cmac             >=1.9    none
- ========================== ===== ======== =======
- 
--krb5 releases 1.18 and later do not support single-DES.  krb5 releases
--1.8 and later disable the single-DES enctypes by default.  Microsoft
--Windows releases Windows 7 and later disable single-DES enctypes by
--default.
-+krb5 releases 1.8 and later disable the single-DES enctypes by
-+default.  Microsoft Windows releases Windows 7 and later disable
-+single-DES enctypes by default.
+@@ -129,7 +129,7 @@ enctype                    weak?      krb5     Windows
+ des-cbc-crc                weak       <1.18    >=2000
+ des-cbc-md4                weak       <1.18    ?
+ des-cbc-md5                weak       <1.18    >=2000
+-des3-cbc-sha1              deprecated >=1.1    none
++des3-cbc-sha1              deprecated <1.18    none
+ arcfour-hmac               deprecated >=1.3    >=2000
+ arcfour-hmac-exp           weak       >=1.3    >=2000
+ aes128-cts-hmac-sha1-96               >=1.3    >=Vista
+@@ -148,9 +148,11 @@ default.
+ krb5 releases 1.17 and later flag deprecated encryption types
+ (including ``des3-cbc-sha1`` and ``arcfour-hmac``) in KDC logs and
+ kadmin output.  krb5 release 1.19 issues a warning during initial
+-authentication if ``des3-cbc-sha1`` is used.  Future releases will
+-disable ``des3-cbc-sha1`` by default and eventually remove support for
+-it.
++authentication if ``des3-cbc-sha1`` is used.
 +
 +krb5 releases 1.18 and later remove single-DES and 3DES
 +(downstream-only patch) enctype support.  Microsoft Windows never
 +supported 3DES.
+ 
+ 
+ Migrating away from older encryption types
 diff --git a/doc/admin/troubleshoot.rst b/doc/admin/troubleshoot.rst
-index 6a0c7f89b..263fc9c97 100644
+index ade5e1f87a..e4dc54f7e5 100644
 --- a/doc/admin/troubleshoot.rst
 +++ b/doc/admin/troubleshoot.rst
 @@ -73,11 +73,10 @@ credential verification failed: KDC has no support for encryption type
@@ -243,7 +247,7 @@ index 6a0c7f89b..263fc9c97 100644
  
  .. _err_cert_chain_cert_expired:
 diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst
-index 534795d15..9542611ea 100644
+index 45fe160d7f..b4b1f3bd93 100644
 --- a/doc/appdev/refs/macros/index.rst
 +++ b/doc/appdev/refs/macros/index.rst
 @@ -36,7 +36,6 @@ Public
@@ -254,8 +258,21 @@ index 534795d15..9542611ea 100644
     CKSUMTYPE_MD5_HMAC_ARCFOUR.rst
     CKSUMTYPE_NIST_SHA.rst
     CKSUMTYPE_RSA_MD4.rst
+diff --git a/doc/conf.py b/doc/conf.py
+index ecf9020a72..db7fa377ef 100644
+--- a/doc/conf.py
++++ b/doc/conf.py
+@@ -281,7 +281,7 @@ else:
+     rst_epilog += '''
+ .. |krb5conf| replace:: ``/etc/krb5.conf``
+ .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal``
+-.. |defetypes| replace:: ``aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac``
++.. |defetypes| replace:: ``aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac``
+ .. |defmkey| replace:: ``aes256-cts-hmac-sha1-96``
+ .. |copy| unicode:: U+000A9
+ '''
 diff --git a/doc/mitK5features.rst b/doc/mitK5features.rst
-index a19068e26..5bfdc3936 100644
+index 10effcf175..cad0855724 100644
 --- a/doc/mitK5features.rst
 +++ b/doc/mitK5features.rst
 @@ -37,7 +37,7 @@ Database backends: LDAP, DB2, LMDB
@@ -268,10 +285,10 @@ index a19068e26..5bfdc3936 100644
  Interoperability
  ----------------
 diff --git a/src/Makefile.in b/src/Makefile.in
-index 91a5f4bf8..0197e5b6d 100644
+index 8f14e9bf2c..ba3bb18eec 100644
 --- a/src/Makefile.in
 +++ b/src/Makefile.in
-@@ -129,7 +129,7 @@ WINMAKEFILES=Makefile \
+@@ -130,7 +130,7 @@ WINMAKEFILES=Makefile \
  	lib\Makefile lib\crypto\Makefile lib\crypto\krb\Makefile \
  	lib\crypto\builtin\Makefile lib\crypto\builtin\aes\Makefile \
  	lib\crypto\builtin\enc_provider\Makefile \
@@ -280,7 +297,7 @@ index 91a5f4bf8..0197e5b6d 100644
  	lib\crypto\builtin\camellia\Makefile lib\crypto\builtin\md4\Makefile \
  	lib\crypto\builtin\hash_provider\Makefile \
  	lib\crypto\builtin\sha2\Makefile lib\crypto\builtin\sha1\Makefile \
-@@ -201,8 +201,6 @@ WINMAKEFILES=Makefile \
+@@ -202,8 +202,6 @@ WINMAKEFILES=Makefile \
  ##DOS##	$(WCONFIG) config < $@.in > $@
  ##DOS##lib\crypto\builtin\enc_provider\Makefile: lib\crypto\builtin\enc_provider\Makefile.in $(MKFDEP)
  ##DOS##	$(WCONFIG) config < $@.in > $@
@@ -289,23 +306,30 @@ index 91a5f4bf8..0197e5b6d 100644
  ##DOS##lib\crypto\builtin\md5\Makefile: lib\crypto\builtin\md5\Makefile.in $(MKFDEP)
  ##DOS##	$(WCONFIG) config < $@.in > $@
  ##DOS##lib\crypto\builtin\camellia\Makefile: lib\crypto\builtin\camellia\Makefile.in $(MKFDEP)
-diff --git a/src/configure.in b/src/configure.in
-index 8d781a7c8..a19a0ea97 100644
---- a/src/configure.in
-+++ b/src/configure.in
-@@ -1443,7 +1443,6 @@ V5_AC_OUTPUT_MAKEFILE(.
- 	lib/crypto lib/crypto/krb lib/crypto/$CRYPTO_IMPL
- 	lib/crypto/$CRYPTO_IMPL/enc_provider
- 	lib/crypto/$CRYPTO_IMPL/hash_provider
--	lib/crypto/$CRYPTO_IMPL/des
- 	lib/crypto/$CRYPTO_IMPL/md4 lib/crypto/$CRYPTO_IMPL/md5
-         lib/crypto/$CRYPTO_IMPL/sha1 lib/crypto/$CRYPTO_IMPL/sha2
- 	lib/crypto/$CRYPTO_IMPL/aes lib/crypto/$CRYPTO_IMPL/camellia
+diff --git a/src/configure.ac b/src/configure.ac
+index 69be9030f8..2561e917a2 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -1513,12 +1513,12 @@ V5_AC_OUTPUT_MAKEFILE(.
+ 	lib lib/kdb
+ 
+ 	lib/crypto lib/crypto/krb lib/crypto/crypto_tests
+-	lib/crypto/builtin lib/crypto/builtin/des
++	lib/crypto/builtin
+ 	lib/crypto/builtin/aes lib/crypto/builtin/camellia
+ 	lib/crypto/builtin/md4 lib/crypto/builtin/md5
+ 	lib/crypto/builtin/sha1 lib/crypto/builtin/sha2
+ 	lib/crypto/builtin/enc_provider lib/crypto/builtin/hash_provider
+-	lib/crypto/openssl lib/crypto/openssl/des
++	lib/crypto/openssl
+ 	lib/crypto/openssl/enc_provider lib/crypto/openssl/hash_provider
+ 
+ 	lib/krb5 lib/krb5/error_tables lib/krb5/asn.1 lib/krb5/ccache
 diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
-index 5f596d1fc..9a05ce32d 100644
+index 09f800be52..c5a625db8f 100644
 --- a/src/include/krb5/krb5.hin
 +++ b/src/include/krb5/krb5.hin
-@@ -426,8 +426,8 @@ typedef struct _krb5_crypto_iov {
+@@ -422,8 +422,8 @@ typedef struct _krb5_crypto_iov {
  #define ENCTYPE_DES_CBC_MD4     0x0002  /**< @deprecated no longer supported */
  #define ENCTYPE_DES_CBC_MD5     0x0003  /**< @deprecated no longer supported */
  #define ENCTYPE_DES_CBC_RAW     0x0004  /**< @deprecated no longer supported */
@@ -316,7 +340,7 @@ index 5f596d1fc..9a05ce32d 100644
  #define ENCTYPE_DES_HMAC_SHA1   0x0008  /**< @deprecated no longer supported */
  /* PKINIT */
  #define ENCTYPE_DSA_SHA1_CMS    0x0009  /**< DSA with SHA1, CMS signature */
-@@ -436,9 +436,9 @@ typedef struct _krb5_crypto_iov {
+@@ -432,9 +432,9 @@ typedef struct _krb5_crypto_iov {
  #define ENCTYPE_RC2_CBC_ENV     0x000c  /**< RC2 cbc mode, CMS enveloped data */
  #define ENCTYPE_RSA_ENV         0x000d  /**< RSA encryption, CMS enveloped data */
  #define ENCTYPE_RSA_ES_OAEP_ENV 0x000e  /**< RSA w/OEAP encryption, CMS enveloped data */
@@ -328,33 +352,20 @@ index 5f596d1fc..9a05ce32d 100644
  #define ENCTYPE_AES128_CTS_HMAC_SHA1_96     0x0011 /**< RFC 3962 */
  #define ENCTYPE_AES256_CTS_HMAC_SHA1_96     0x0012 /**< RFC 3962 */
  #define ENCTYPE_AES128_CTS_HMAC_SHA256_128  0x0013 /**< RFC 8009 */
-@@ -458,7 +458,7 @@ typedef struct _krb5_crypto_iov {
+@@ -459,7 +459,7 @@ typedef struct _krb5_crypto_iov {
  #define CKSUMTYPE_RSA_MD5       0x0007
  #define CKSUMTYPE_RSA_MD5_DES   0x0008
  #define CKSUMTYPE_NIST_SHA      0x0009
 -#define CKSUMTYPE_HMAC_SHA1_DES3      0x000c
 +#define CKSUMTYPE_HMAC_SHA1_DES3      0x000c /* @deprecated removed */
+ #define CKSUMTYPE_SHA1          0x000e /**< RFC 3961 */
  #define CKSUMTYPE_HMAC_SHA1_96_AES128 0x000f /**< RFC 3962. Used with
                                                  ENCTYPE_AES128_CTS_HMAC_SHA1_96 */
- #define CKSUMTYPE_HMAC_SHA1_96_AES256 0x0010 /**< RFC 3962. Used with
-diff --git a/src/kadmin/testing/proto/kdc.conf.proto b/src/kadmin/testing/proto/kdc.conf.proto
-index 8a4b87de1..d7f1d076b 100644
---- a/src/kadmin/testing/proto/kdc.conf.proto
-+++ b/src/kadmin/testing/proto/kdc.conf.proto
-@@ -11,6 +11,6 @@
- 		dict_file = __K5ROOT__/ovsec_adm.dict
- 		kadmind_port = 1751
- 		kpasswd_port = 1752
--		master_key_type = des3-hmac-sha1
--		supported_enctypes = des3-hmac-sha1:normal aes256-cts:normal aes128-cts:normal aes256-sha2:normal aes128-sha2:normal
-+		master_key_type = aes256-cts
-+		supported_enctypes = aes256-cts:normal aes128-cts:normal aes256-sha2:normal aes128-sha2:normal
- 	}
 diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
-index df1ba6acf..23ad6c584 100644
+index 75e04b73db..fe4e48209a 100644
 --- a/src/kdc/kdc_util.c
 +++ b/src/kdc/kdc_util.c
-@@ -1077,8 +1077,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen)
+@@ -1154,8 +1154,6 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen)
          name = "rsaEncryption-EnvOID";
      else if (ktype == ENCTYPE_RSA_ES_OAEP_ENV)
          name = "id-RSAES-OAEP-EnvOID";
@@ -363,7 +374,7 @@ index df1ba6acf..23ad6c584 100644
      else
          return krb5_enctype_to_name(ktype, FALSE, buf, buflen);
  
-@@ -1741,8 +1739,6 @@ krb5_boolean
+@@ -1647,8 +1645,6 @@ krb5_boolean
  enctype_requires_etype_info_2(krb5_enctype enctype)
  {
      switch(enctype) {
@@ -373,28 +384,25 @@ index df1ba6acf..23ad6c584 100644
      case ENCTYPE_ARCFOUR_HMAC_EXP :
          return 0;
 diff --git a/src/lib/crypto/Makefile.in b/src/lib/crypto/Makefile.in
-index c3fcfd7e8..890d54adf 100644
+index 10e8c74cf8..25c4f40cc3 100644
 --- a/src/lib/crypto/Makefile.in
 +++ b/src/lib/crypto/Makefile.in
-@@ -13,7 +13,7 @@ STOBJLISTS=$(CRYPTO_IMPL)/enc_provider/OBJS.ST				\
- 	$(CRYPTO_IMPL)/hash_provider/OBJS.ST				\
- 	$(CRYPTO_IMPL)/md4/OBJS.ST $(CRYPTO_IMPL)/md5/OBJS.ST		\
- 	$(CRYPTO_IMPL)/sha1/OBJS.ST $(CRYPTO_IMPL)/sha2/OBJS.ST		\
--	$(CRYPTO_IMPL)/aes/OBJS.ST $(CRYPTO_IMPL)/des/OBJS.ST		\
-+	$(CRYPTO_IMPL)/aes/OBJS.ST					\
- 	$(CRYPTO_IMPL)/camellia/OBJS.ST krb/OBJS.ST			\
- 	$(CRYPTO_IMPL)/OBJS.ST
+@@ -10,12 +10,12 @@ LIBMINOR=1
+ RELDIR=crypto
  
-@@ -21,7 +21,7 @@ SUBDIROBJLISTS=$(CRYPTO_IMPL)/enc_provider/OBJS.ST			\
- 	$(CRYPTO_IMPL)/hash_provider/OBJS.ST				\
- 	$(CRYPTO_IMPL)/md4/OBJS.ST $(CRYPTO_IMPL)/md5/OBJS.ST		\
- 	$(CRYPTO_IMPL)/sha1/OBJS.ST $(CRYPTO_IMPL)/sha2/OBJS.ST		\
--	$(CRYPTO_IMPL)/aes/OBJS.ST $(CRYPTO_IMPL)/des/OBJS.ST		\
-+	$(CRYPTO_IMPL)/aes/OBJS.ST					\
- 	$(CRYPTO_IMPL)/camellia/OBJS.ST krb/OBJS.ST			\
- 	$(CRYPTO_IMPL)/OBJS.ST
+ STOBJLISTS=krb/OBJS.ST						\
+-	builtin/OBJS.ST builtin/des/OBJS.ST			\
++	builtin/OBJS.ST						\
+ 	builtin/aes/OBJS.ST builtin/camellia/OBJS.ST		\
+ 	builtin/md4/OBJS.ST builtin/md5/OBJS.ST			\
+ 	builtin/sha1/OBJS.ST builtin/sha2/OBJS.ST		\
+ 	builtin/enc_provider/OBJS.ST builtin/hash_provider/OBJS.ST \
+-	openssl/OBJS.ST openssl/des/OBJS.ST			\
++	openssl/OBJS.ST						\
+ 	openssl/enc_provider/OBJS.ST openssl/hash_provider/OBJS.ST
  
-@@ -34,8 +34,8 @@ SHLIB_EXPDEPLIBS= $(SUPPORT_DEPLIB)
+ SUBDIROBJLISTS=$(STOBJLISTS)
+@@ -28,8 +28,8 @@ SHLIB_EXPDEPLIBS= $(SUPPORT_DEPLIB)
  SHLIB_LDFLAGS= $(LDFLAGS) @SHLIB_RPATH_DIRS@
  
  ##DOS##LIBNAME=$(OUTPRE)crypto.lib
@@ -406,7 +414,7 @@ index c3fcfd7e8..890d54adf 100644
  all-unix: all-liblinks
  install-unix: install-libs
 diff --git a/src/lib/crypto/builtin/Makefile.in b/src/lib/crypto/builtin/Makefile.in
-index baf5d974f..82adf1dec 100644
+index 243bb17ba3..30bfcd30c0 100644
 --- a/src/lib/crypto/builtin/Makefile.in
 +++ b/src/lib/crypto/builtin/Makefile.in
 @@ -1,6 +1,6 @@
@@ -414,22 +422,13 @@ index baf5d974f..82adf1dec 100644
  BUILDTOP=$(REL)..$(S)..$(S)..
 -SUBDIRS=camellia des aes md4 md5 sha1 sha2 enc_provider hash_provider
 +SUBDIRS=camellia aes md4 md5 sha1 sha2 enc_provider hash_provider
- LOCALINCLUDES = -I$(srcdir)/../krb -I$(srcdir)
+ LOCALINCLUDES=-I$(srcdir)/../krb $(CRYPTO_IMPL_CFLAGS)
  
  ##DOS##BUILDTOP = ..\..\..
-@@ -22,7 +22,7 @@ SRCS=\
- 	$(srcdir)/init.c	\
+@@ -25,7 +25,7 @@ SRCS=\
+ 	$(srcdir)/kdf.c		\
  	$(srcdir)/pbkdf2.c	
  
--STOBJLISTS= des/OBJS.ST md4/OBJS.ST 	\
-+STOBJLISTS= md4/OBJS.ST 		\
- 	md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST	\
- 	enc_provider/OBJS.ST 		\
- 	hash_provider/OBJS.ST 		\
-@@ -30,7 +30,7 @@ STOBJLISTS= des/OBJS.ST md4/OBJS.ST 	\
- 	camellia/OBJS.ST 		\
- 	OBJS.ST
- 
 -SUBDIROBJLISTS= des/OBJS.ST md4/OBJS.ST 	\
 +SUBDIROBJLISTS= md4/OBJS.ST	 	\
  		md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST 	\
@@ -437,7 +436,7 @@ index baf5d974f..82adf1dec 100644
  		hash_provider/OBJS.ST 		\
 diff --git a/src/lib/crypto/builtin/des/ISSUES b/src/lib/crypto/builtin/des/ISSUES
 deleted file mode 100644
-index 157891103..000000000
+index 1578911033..0000000000
 --- a/src/lib/crypto/builtin/des/ISSUES
 +++ /dev/null
 @@ -1,13 +0,0 @@
@@ -456,13 +455,13 @@ index 157891103..000000000
 -const?
 diff --git a/src/lib/crypto/builtin/des/Makefile.in b/src/lib/crypto/builtin/des/Makefile.in
 deleted file mode 100644
-index ed25dab7c..000000000
+index 397ac87ed4..0000000000
 --- a/src/lib/crypto/builtin/des/Makefile.in
 +++ /dev/null
-@@ -1,80 +0,0 @@
+@@ -1,82 +0,0 @@
 -mydir=lib$(S)crypto$(S)builtin$(S)des
 -BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
--LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir)/../../krb
+-LOCALINCLUDES=-I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS)
 -
 -##DOS##BUILDTOP = ..\..\..\..
 -##DOS##PREFIXDIR = builtin\des
@@ -513,14 +512,16 @@ index ed25dab7c..000000000
 -verify$(EXEEXT): t_verify.$(OBJEXT) $(TOBJS) f_parity.$(OBJEXT) \
 -	$(COM_ERR_DEPLIB) $(SUPPORT_DEPLIB)
 -	$(CC_LINK) -o $@ t_verify.$(OBJEXT) $(TOBJS) f_parity.$(OBJEXT) \
--		-lcom_err $(SUPPORT_LIB)
+-		$(COM_ERR_LIB) $(SUPPORT_LIB)
 -
 -destest$(EXEEXT): destest.$(OBJEXT) $(TOBJS) $(SUPPORT_DEPLIB)
 -	$(CC_LINK) -o $@ destest.$(OBJEXT) $(TOBJS) $(SUPPORT_LIB)
 -
 -all-unix: all-libobjs
 -
--check-unix: verify destest
+-check-unix: check-unix-@CRYPTO_BUILTIN_TESTS@
+-check-unix-no:
+-check-unix-yes: verify destest
 -	$(RUN_TEST) ./verify -z
 -	$(RUN_TEST) ./verify -m
 -	$(RUN_TEST) ./verify
@@ -542,10 +543,10 @@ index ed25dab7c..000000000
 -
 diff --git a/src/lib/crypto/builtin/des/d3_aead.c b/src/lib/crypto/builtin/des/d3_aead.c
 deleted file mode 100644
-index bddf75a47..000000000
+index fb83f73b43..0000000000
 --- a/src/lib/crypto/builtin/des/d3_aead.c
 +++ /dev/null
-@@ -1,133 +0,0 @@
+@@ -1,137 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/*
 - * Copyright (C) 2008 by the Massachusetts Institute of Technology.
@@ -574,6 +575,8 @@ index bddf75a47..000000000
 -#include "des_int.h"
 -#include "f_tables.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -void
 -krb5int_des3_cbc_encrypt(krb5_crypto_iov *data, unsigned long num_data,
 -                         const mit_des_key_schedule ks1,
@@ -679,12 +682,14 @@ index bddf75a47..000000000
 -        store_32_be(ocipherr, ivec + 4);
 -    }
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/d3_kysched.c b/src/lib/crypto/builtin/des/d3_kysched.c
 deleted file mode 100644
-index ebd1050b1..000000000
+index 55fb9449b5..0000000000
 --- a/src/lib/crypto/builtin/des/d3_kysched.c
 +++ /dev/null
-@@ -1,51 +0,0 @@
+@@ -1,55 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/*
 - * Copyright 1995 by Richard P. Basch.  All Rights Reserved.
@@ -708,9 +713,11 @@ index ebd1050b1..000000000
 - * express or implied warranty.
 - */
 -
--#include "k5-int.h"
+-#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -int
 -mit_des3_key_sched(mit_des3_cblock k, mit_des3_key_schedule schedule)
 -{
@@ -736,19 +743,20 @@ index ebd1050b1..000000000
 -    /* if key was good, return 0 */
 -    return 0;
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/deps b/src/lib/crypto/builtin/des/deps
 deleted file mode 100644
-index df2a31dac..000000000
+index 1c1239d696..0000000000
 --- a/src/lib/crypto/builtin/des/deps
 +++ /dev/null
-@@ -1,148 +0,0 @@
+@@ -1,146 +0,0 @@
 -#
 -# Generated makefile dependencies follow.
 -#
 -d3_aead.so d3_aead.po $(OUTPRE)d3_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
 -  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
--  $(srcdir)/../aes/aes.h $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \
 -  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
 -  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
 -  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -760,31 +768,28 @@ index df2a31dac..000000000
 -d3_kysched.so d3_kysched.po $(OUTPRE)d3_kysched.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  d3_kysched.c des_int.h
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+-  $(top_srcdir)/include/socket-utils.h d3_kysched.c des_int.h
 -des_keys.so des_keys.po $(OUTPRE)des_keys.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \
--  $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \
--  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  des_int.h des_keys.c
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+-  $(top_srcdir)/include/socket-utils.h des_int.h des_keys.c
 -f_aead.so f_aead.po $(OUTPRE)f_aead.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
 -  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
--  $(srcdir)/../aes/aes.h $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \
 -  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
 -  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
 -  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
@@ -795,69 +800,71 @@ index df2a31dac..000000000
 -  des_int.h f_aead.c f_tables.h
 -f_cksum.so f_cksum.po $(OUTPRE)f_cksum.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
--  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
--  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
--  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
--  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h des_int.h f_cksum.c \
--  f_tables.h
+-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+-  des_int.h f_cksum.c f_tables.h
 -f_parity.so f_parity.po $(OUTPRE)f_parity.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  des_int.h f_parity.c
--f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
--  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
 -  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
 -  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
 -  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
 -  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
 -  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
 -  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h des_int.h f_sched.c
+-  $(top_srcdir)/include/socket-utils.h des_int.h f_parity.c
+-f_sched.so f_sched.po $(OUTPRE)f_sched.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
+-  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
+-  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
+-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+-  des_int.h f_sched.c
 -f_tables.so f_tables.po $(OUTPRE)f_tables.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  des_int.h f_tables.c f_tables.h
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+-  $(top_srcdir)/include/socket-utils.h des_int.h f_tables.c \
+-  f_tables.h
 -key_sched.so key_sched.po $(OUTPRE)key_sched.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  des_int.h key_sched.c
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+-  $(top_srcdir)/include/socket-utils.h des_int.h key_sched.c
 -weak_key.so weak_key.po $(OUTPRE)weak_key.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  des_int.h weak_key.c
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+-  $(top_srcdir)/include/socket-utils.h des_int.h weak_key.c
 -destest.so destest.po $(OUTPRE)destest.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
 -  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
@@ -892,7 +899,7 @@ index df2a31dac..000000000
 -  des_int.h t_verify.c
 diff --git a/src/lib/crypto/builtin/des/des_int.h b/src/lib/crypto/builtin/des/des_int.h
 deleted file mode 100644
-index f8dc6b296..000000000
+index f8dc6b296a..0000000000
 --- a/src/lib/crypto/builtin/des/des_int.h
 +++ /dev/null
 @@ -1,285 +0,0 @@
@@ -1183,10 +1190,10 @@ index f8dc6b296..000000000
 -#endif  /*DES_INTERNAL_DEFS*/
 diff --git a/src/lib/crypto/builtin/des/des_keys.c b/src/lib/crypto/builtin/des/des_keys.c
 deleted file mode 100644
-index 32b119aad..000000000
+index 027b09d728..0000000000
 --- a/src/lib/crypto/builtin/des/des_keys.c
 +++ /dev/null
-@@ -1,40 +0,0 @@
+@@ -1,38 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/des_keys.c - Key functions used by Kerberos code */
 -/*
@@ -1216,20 +1223,18 @@ index 32b119aad..000000000
 -#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES_KEY_PARITY
+-
 -void
 -k5_des_fixup_key_parity(unsigned char *keybits)
 -{
 -    mit_des_fixup_key_parity(keybits);
 -}
 -
--krb5_boolean
--k5_des_is_weak_key(unsigned char *keybits)
--{
--    return mit_des_is_weak_key(keybits);
--}
+-#endif /* K5_BUILTIN_DES_KEY_PARITY */
 diff --git a/src/lib/crypto/builtin/des/destest.c b/src/lib/crypto/builtin/des/destest.c
 deleted file mode 100644
-index 52114304e..000000000
+index 52114304e3..0000000000
 --- a/src/lib/crypto/builtin/des/destest.c
 +++ /dev/null
 @@ -1,240 +0,0 @@
@@ -1475,7 +1480,7 @@ index 52114304e..000000000
 -}
 diff --git a/src/lib/crypto/builtin/des/doc/libdes.doc b/src/lib/crypto/builtin/des/doc/libdes.doc
 deleted file mode 100644
-index 19c03c1d3..000000000
+index 6e9431ed2e..0000000000
 --- a/src/lib/crypto/builtin/des/doc/libdes.doc
 +++ /dev/null
 @@ -1,208 +0,0 @@
@@ -1630,7 +1635,7 @@ index 19c03c1d3..000000000
 -	by "*key", then after getting a new key, call the des_set_key() 
 -	routine when needed.
 -
--	No meaningfull value is returned.  Void is not used for compatibility
+-	No meaningful value is returned.  Void is not used for compatibility
 -	with other compilers.
 -
 -
@@ -1689,10 +1694,10 @@ index 19c03c1d3..000000000
 -string length desired.
 diff --git a/src/lib/crypto/builtin/des/f_aead.c b/src/lib/crypto/builtin/des/f_aead.c
 deleted file mode 100644
-index 71b8dff4d..000000000
+index f887735820..0000000000
 --- a/src/lib/crypto/builtin/des/f_aead.c
 +++ /dev/null
-@@ -1,173 +0,0 @@
+@@ -1,177 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/*
 - * Copyright (C) 2008 by the Massachusetts Institute of Technology.
@@ -1721,6 +1726,8 @@ index 71b8dff4d..000000000
 -#include "des_int.h"
 -#include "f_tables.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -const mit_des_cblock mit_des_zeroblock /* = all zero */;
 -
 -void
@@ -1866,9 +1873,11 @@ index 71b8dff4d..000000000
 -    DES_DO_DECRYPT_1 (*left, *right, kp);
 -}
 -#endif
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/f_cbc.c b/src/lib/crypto/builtin/des/f_cbc.c
 deleted file mode 100644
-index 84d5382f2..000000000
+index 84d5382f22..0000000000
 --- a/src/lib/crypto/builtin/des/f_cbc.c
 +++ /dev/null
 @@ -1,256 +0,0 @@
@@ -2130,10 +2139,10 @@ index 84d5382f2..000000000
 -}
 diff --git a/src/lib/crypto/builtin/des/f_cksum.c b/src/lib/crypto/builtin/des/f_cksum.c
 deleted file mode 100644
-index cb482b009..000000000
+index 615a947f4a..0000000000
 --- a/src/lib/crypto/builtin/des/f_cksum.c
 +++ /dev/null
-@@ -1,136 +0,0 @@
+@@ -1,141 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/f_cksum.c */
 -/*
@@ -2165,9 +2174,12 @@ index cb482b009..000000000
 -/*
 - * des_cbc_cksum.c - compute an 8 byte checksum using DES in CBC mode
 - */
+-#include "crypto_int.h"
 -#include "des_int.h"
 -#include "f_tables.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -/*
 - * This routine performs DES cipher-block-chaining checksum operation,
 - * a.k.a.  Message Authentication Code.  It ALWAYS encrypts from input
@@ -2270,12 +2282,14 @@ index cb482b009..000000000
 -     */
 -    return right & 0xFFFFFFFFUL;
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/f_parity.c b/src/lib/crypto/builtin/des/f_parity.c
 deleted file mode 100644
-index 460b5061b..000000000
+index a658878f6f..0000000000
 --- a/src/lib/crypto/builtin/des/f_parity.c
 +++ /dev/null
-@@ -1,56 +0,0 @@
+@@ -1,64 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/*
 - * These routines check and fix parity of encryption keys for the DES
@@ -2287,9 +2301,11 @@ index 460b5061b..000000000
 - * Mark Eichin -- Cygnus Support
 - */
 -
--
+-#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES_KEY_PARITY
+-
 -/*
 - * des_fixup_key_parity: Forces odd parity per byte; parity is bits
 - *                       8,16,...64 in des order, implies 0, 8, 16, ...
@@ -2312,6 +2328,10 @@ index 460b5061b..000000000
 -    return;
 -}
 -
+-#endif /* K5_BUILTIN_DES_KEY_PARITY */
+-
+-#ifdef K5_BUILTIN_DES
+-
 -/*
 - * des_check_key_parity: returns true iff key has the correct des parity.
 - *                       See des_fix_key_parity for the definition of
@@ -2332,12 +2352,14 @@ index 460b5061b..000000000
 -
 -    return(1);
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/f_sched.c b/src/lib/crypto/builtin/des/f_sched.c
 deleted file mode 100644
-index 666a510fb..000000000
+index bbc88a1c8d..0000000000
 --- a/src/lib/crypto/builtin/des/f_sched.c
 +++ /dev/null
-@@ -1,359 +0,0 @@
+@@ -1,363 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/f_sched.c */
 -/*
@@ -2369,9 +2391,11 @@ index 666a510fb..000000000
 -/*
 - * des_make_sched.c - permute a DES key, returning the resulting key schedule
 - */
--#include "k5-int.h"
+-#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -/*
 - * Permuted choice 1 tables.  These are used to extract bits
 - * from the left and right parts of the key to form Ci and Di.
@@ -2697,12 +2721,14 @@ index 666a510fb..000000000
 -    }
 -    return (0);
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/f_tables.c b/src/lib/crypto/builtin/des/f_tables.c
 deleted file mode 100644
-index 6308cb0d5..000000000
+index e50ab1fc60..0000000000
 --- a/src/lib/crypto/builtin/des/f_tables.c
 +++ /dev/null
-@@ -1,370 +0,0 @@
+@@ -1,375 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/f_tables.c */
 -/*
@@ -2739,9 +2765,12 @@ index 6308cb0d5..000000000
 - * Include the header file so something will complain if the
 - * declarations get out of sync
 - */
+-#include "crypto_int.h"
 -#include "des_int.h"
 -#include "f_tables.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -/*
 - * These tables may be declared const if you want.  Many compilers
 - * don't support this, though.
@@ -3073,9 +3102,11 @@ index 6308cb0d5..000000000
 -        0x40000000, 0x40080010, 0x40084010, 0x00084000
 -    },
 -};
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/f_tables.h b/src/lib/crypto/builtin/des/f_tables.h
 deleted file mode 100644
-index fc91b566c..000000000
+index fc91b566cf..0000000000
 --- a/src/lib/crypto/builtin/des/f_tables.h
 +++ /dev/null
 @@ -1,285 +0,0 @@
@@ -3366,10 +3397,10 @@ index fc91b566c..000000000
 -#endif  /* __DES_TABLES_H__ */
 diff --git a/src/lib/crypto/builtin/des/key_sched.c b/src/lib/crypto/builtin/des/key_sched.c
 deleted file mode 100644
-index 87f02b6a9..000000000
+index d6dedd93c6..0000000000
 --- a/src/lib/crypto/builtin/des/key_sched.c
 +++ /dev/null
-@@ -1,62 +0,0 @@
+@@ -1,66 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/key_sched.c */
 -/*
@@ -3415,9 +3446,11 @@ index 87f02b6a9..000000000
 - * Originally written 6/85 by Steve Miller, MIT Project Athena.
 - */
 -
--#include "k5-int.h"
+-#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -int
 -mit_des_key_sched(mit_des_cblock k, mit_des_key_schedule schedule)
 -{
@@ -3432,9 +3465,11 @@ index 87f02b6a9..000000000
 -    /* if key was good, return 0 */
 -    return 0;
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/des/keytest.data b/src/lib/crypto/builtin/des/keytest.data
 deleted file mode 100644
-index 7ff34eedc..000000000
+index 7ff34eedcf..0000000000
 --- a/src/lib/crypto/builtin/des/keytest.data
 +++ /dev/null
 @@ -1,171 +0,0 @@
@@ -3611,7 +3646,7 @@ index 7ff34eedc..000000000
 -1C587F1C13924FEF 305532286D6F295A 63FAC0D034D9F793
 diff --git a/src/lib/crypto/builtin/des/t_verify.c b/src/lib/crypto/builtin/des/t_verify.c
 deleted file mode 100644
-index f4332f5c0..000000000
+index 4a19933cad..0000000000
 --- a/src/lib/crypto/builtin/des/t_verify.c
 +++ /dev/null
 @@ -1,395 +0,0 @@
@@ -3942,7 +3977,7 @@ index f4332f5c0..000000000
 -        printf("%02x ",cipher_text[j]);
 -    printf("\n\n");
 -    if ( memcmp((char *)cipher_text, (char *)checksum, 8) ) {
--        printf("verify: error in CBC cheksum\n");
+-        printf("verify: error in CBC checksum\n");
 -        exit(-1);
 -    }
 -    else
@@ -4012,10 +4047,10 @@ index f4332f5c0..000000000
 -}
 diff --git a/src/lib/crypto/builtin/des/weak_key.c b/src/lib/crypto/builtin/des/weak_key.c
 deleted file mode 100644
-index eb41b267d..000000000
+index f8304a3638..0000000000
 --- a/src/lib/crypto/builtin/des/weak_key.c
 +++ /dev/null
-@@ -1,86 +0,0 @@
+@@ -1,90 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/builtin/des/weak_key.c */
 -/*
@@ -4051,9 +4086,11 @@ index eb41b267d..000000000
 - * Originally written 8/85 by Steve Miller, MIT Project Athena.
 - */
 -
--#include "k5-int.h"
+-#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -/*
 - * The following are the weak DES keys:
 - */
@@ -4102,20 +4139,21 @@ index eb41b267d..000000000
 -
 -    return 0;
 -}
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/builtin/enc_provider/Makefile.in b/src/lib/crypto/builtin/enc_provider/Makefile.in
-index 3459e1d0e..af6276b96 100644
+index 6ad7cbd4e0..655966b255 100644
 --- a/src/lib/crypto/builtin/enc_provider/Makefile.in
 +++ b/src/lib/crypto/builtin/enc_provider/Makefile.in
-@@ -1,7 +1,6 @@
+@@ -1,6 +1,6 @@
  mydir=lib$(S)crypto$(S)builtin$(S)enc_provider
  BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
--LOCALINCLUDES = -I$(srcdir)/../des 	\
--		-I$(srcdir)/../aes 	\
-+LOCALINCLUDES = -I$(srcdir)/../aes 	\
- 		-I$(srcdir)/../camellia \
- 		-I$(srcdir)/../../krb 	\
- 		-I$(srcdir)/..
-@@ -11,19 +10,16 @@ LOCALINCLUDES = -I$(srcdir)/../des 	\
+-LOCALINCLUDES = -I$(srcdir)/../des -I$(srcdir)/../aes -I$(srcdir)/../camellia \
++LOCALINCLUDES = -I$(srcdir)/../aes -I$(srcdir)/../camellia \
+ 		-I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS)
+ 
+ ##DOS##BUILDTOP = ..\..\..\..
+@@ -8,19 +8,16 @@ LOCALINCLUDES = -I$(srcdir)/../des -I$(srcdir)/../aes -I$(srcdir)/../camellia \
  ##DOS##OBJFILE = ..\..\$(OUTPRE)enc_provider.lst
  
  STLIBOBJS= \
@@ -4136,18 +4174,17 @@ index 3459e1d0e..af6276b96 100644
  	$(srcdir)/camellia.c	\
  	$(srcdir)/rc4.c
 diff --git a/src/lib/crypto/builtin/enc_provider/deps b/src/lib/crypto/builtin/enc_provider/deps
-index 7a3324c44..c1201cc1a 100644
+index a3414a38ec..dc29d9fce8 100644
 --- a/src/lib/crypto/builtin/enc_provider/deps
 +++ b/src/lib/crypto/builtin/enc_provider/deps
-@@ -1,18 +1,6 @@
+@@ -1,17 +1,6 @@
  #
  # Generated makefile dependencies follow.
  #
 -des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
 -  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
--  $(srcdir)/../aes/aes.h $(srcdir)/../crypto_mod.h $(srcdir)/../des/des_int.h \
--  $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
+-  $(srcdir)/../des/des_int.h $(top_srcdir)/include/k5-buf.h \
 -  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
 -  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
 -  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -4160,10 +4197,10 @@ index 7a3324c44..c1201cc1a 100644
    $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
 diff --git a/src/lib/crypto/builtin/enc_provider/des3.c b/src/lib/crypto/builtin/enc_provider/des3.c
 deleted file mode 100644
-index 9b8244223..000000000
+index c2634d5e10..0000000000
 --- a/src/lib/crypto/builtin/enc_provider/des3.c
 +++ /dev/null
-@@ -1,105 +0,0 @@
+@@ -1,109 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/*
 - * Copyright (C) 1998 by the FundsXpress, INC.
@@ -4194,6 +4231,8 @@ index 9b8244223..000000000
 -#include "crypto_int.h"
 -#include "des_int.h"
 -
+-#ifdef K5_BUILTIN_DES
+-
 -static krb5_error_code
 -validate_and_schedule(krb5_key key, const krb5_data *ivec,
 -                      const krb5_crypto_iov *data, size_t num_data,
@@ -4269,8 +4308,10 @@ index 9b8244223..000000000
 -    krb5int_des_init_state,
 -    krb5int_default_free_state
 -};
+-
+-#endif /* K5_BUILTIN_DES */
 diff --git a/src/lib/crypto/crypto_tests/t_cf2.expected b/src/lib/crypto/crypto_tests/t_cf2.expected
-index f8251a16c..bc6aa50c8 100644
+index f8251a16cb..bc6aa50c84 100644
 --- a/src/lib/crypto/crypto_tests/t_cf2.expected
 +++ b/src/lib/crypto/crypto_tests/t_cf2.expected
 @@ -1,6 +1,5 @@
@@ -4281,7 +4322,7 @@ index f8251a16c..bc6aa50c8 100644
  edd02a39d2dbde31611c16e610be062c
  67f6ea530aea85a37dcbb23349ea52dcc61ca8493ff557252327fd8304341584
 diff --git a/src/lib/crypto/crypto_tests/t_cf2.in b/src/lib/crypto/crypto_tests/t_cf2.in
-index 73e2f8fbc..c4d23b506 100644
+index 73e2f8fbc9..c4d23b506b 100644
 --- a/src/lib/crypto/crypto_tests/t_cf2.in
 +++ b/src/lib/crypto/crypto_tests/t_cf2.in
 @@ -8,11 +8,6 @@ key1
@@ -4297,7 +4338,7 @@ index 73e2f8fbc..c4d23b506 100644
  key1
  key2
 diff --git a/src/lib/crypto/crypto_tests/t_cksums.c b/src/lib/crypto/crypto_tests/t_cksums.c
-index 4da14ea43..84408fb68 100644
+index 557340ec5e..9f9a177ef0 100644
 --- a/src/lib/crypto/crypto_tests/t_cksums.c
 +++ b/src/lib/crypto/crypto_tests/t_cksums.c
 @@ -59,16 +59,6 @@ struct test {
@@ -4318,7 +4359,7 @@ index 4da14ea43..84408fb68 100644
          { KV5M_DATA, 37, "eight nine ten eleven twelve thirteen" },
          CKSUMTYPE_HMAC_SHA1_96_AES128, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 3,
 diff --git a/src/lib/crypto/crypto_tests/t_decrypt.c b/src/lib/crypto/crypto_tests/t_decrypt.c
-index a40a85500..716f2c337 100644
+index a40a855007..716f2c337a 100644
 --- a/src/lib/crypto/crypto_tests/t_decrypt.c
 +++ b/src/lib/crypto/crypto_tests/t_decrypt.c
 @@ -39,62 +39,6 @@ struct test {
@@ -4393,7 +4434,7 @@ index a40a85500..716f2c337 100644
      ENCTYPE_ARCFOUR_HMAC_EXP,
      ENCTYPE_AES128_CTS_HMAC_SHA1_96,
 diff --git a/src/lib/crypto/crypto_tests/t_derive.c b/src/lib/crypto/crypto_tests/t_derive.c
-index afbf7477f..93ce30da2 100644
+index afbf7477f6..93ce30da20 100644
 --- a/src/lib/crypto/crypto_tests/t_derive.c
 +++ b/src/lib/crypto/crypto_tests/t_derive.c
 @@ -38,41 +38,6 @@ struct test {
@@ -4447,7 +4488,7 @@ index afbf7477f..93ce30da2 100644
      case ENCTYPE_AES256_CTS_HMAC_SHA1_96:    return &krb5int_enc_aes256;
      case ENCTYPE_CAMELLIA128_CTS_CMAC:       return &krb5int_enc_camellia128;
 diff --git a/src/lib/crypto/crypto_tests/t_encrypt.c b/src/lib/crypto/crypto_tests/t_encrypt.c
-index bd9b94691..290a72e1e 100644
+index bd9b94691c..290a72e1e0 100644
 --- a/src/lib/crypto/crypto_tests/t_encrypt.c
 +++ b/src/lib/crypto/crypto_tests/t_encrypt.c
 @@ -37,7 +37,6 @@
@@ -4459,7 +4500,7 @@ index bd9b94691..290a72e1e 100644
      ENCTYPE_ARCFOUR_HMAC_EXP,
      ENCTYPE_AES256_CTS_HMAC_SHA1_96,
 diff --git a/src/lib/crypto/crypto_tests/t_short.c b/src/lib/crypto/crypto_tests/t_short.c
-index d4c2b97df..4466b7115 100644
+index d4c2b97dfd..4466b71158 100644
 --- a/src/lib/crypto/crypto_tests/t_short.c
 +++ b/src/lib/crypto/crypto_tests/t_short.c
 @@ -34,7 +34,6 @@
@@ -4471,7 +4512,7 @@ index d4c2b97df..4466b7115 100644
      ENCTYPE_ARCFOUR_HMAC_EXP,
      ENCTYPE_AES256_CTS_HMAC_SHA1_96,
 diff --git a/src/lib/crypto/crypto_tests/t_str2key.c b/src/lib/crypto/crypto_tests/t_str2key.c
-index cdb1acc6d..ef4c4a7d3 100644
+index cdb1acc6d0..ef4c4a7d3b 100644
 --- a/src/lib/crypto/crypto_tests/t_str2key.c
 +++ b/src/lib/crypto/crypto_tests/t_str2key.c
 @@ -35,58 +35,6 @@ struct test {
@@ -4533,11 +4574,33 @@ index cdb1acc6d..ef4c4a7d3 100644
      /* Test vectors from RFC 3962 appendix B. */
      {
          ENCTYPE_AES128_CTS_HMAC_SHA1_96,
+diff --git a/src/lib/crypto/crypto_tests/vectors.c b/src/lib/crypto/crypto_tests/vectors.c
+index bcf5c9106f..eb107dbcd2 100644
+--- a/src/lib/crypto/crypto_tests/vectors.c
++++ b/src/lib/crypto/crypto_tests/vectors.c
+@@ -190,8 +190,6 @@ test_s2k (krb5_enctype enctype)
+     }
+ }
+ 
+-static void test_des3_s2k () { test_s2k (ENCTYPE_DES3_CBC_SHA1); }
+-
+ static void
+ keyToData (krb5_keyblock *k, krb5_data *d)
+ {
+@@ -208,8 +206,6 @@ void check_error (int r, int line) {
+ }
+ #define CHECK check_error(r, __LINE__)
+ 
+-extern struct krb5_enc_provider krb5int_enc_des3;
+-struct krb5_enc_provider *enc = &krb5int_enc_des3;
+ extern struct krb5_enc_provider krb5int_enc_aes128, krb5int_enc_aes256;
+ 
+ void DK (krb5_keyblock *out, krb5_keyblock *in, const krb5_data *usage) {
 diff --git a/src/lib/crypto/krb/Makefile.in b/src/lib/crypto/krb/Makefile.in
-index 536bacb6e..b587f7e19 100644
+index cb2e40a3a5..f66698bd53 100644
 --- a/src/lib/crypto/krb/Makefile.in
 +++ b/src/lib/crypto/krb/Makefile.in
-@@ -52,7 +52,6 @@ STLIBOBJS=\
+@@ -47,7 +47,6 @@ STLIBOBJS=\
  	prf.o			\
  	prf_aes2.o		\
  	prf_cmac.o		\
@@ -4545,7 +4608,7 @@ index 536bacb6e..b587f7e19 100644
  	prf_dk.o		\
  	prf_rc4.o		\
  	prng.o			\
-@@ -113,7 +112,6 @@ OBJS=\
+@@ -103,7 +102,6 @@ OBJS=\
  	$(OUTPRE)prf.$(OBJEXT)			\
  	$(OUTPRE)prf_aes2.$(OBJEXT)		\
  	$(OUTPRE)prf_cmac.$(OBJEXT)		\
@@ -4553,7 +4616,7 @@ index 536bacb6e..b587f7e19 100644
  	$(OUTPRE)prf_dk.$(OBJEXT)		\
  	$(OUTPRE)prf_rc4.$(OBJEXT)		\
  	$(OUTPRE)prng.$(OBJEXT)			\
-@@ -174,7 +172,6 @@ SRCS=\
+@@ -159,7 +157,6 @@ SRCS=\
  	$(srcdir)/prf.c			\
  	$(srcdir)/prf_aes2.c		\
  	$(srcdir)/prf_cmac.c		\
@@ -4562,10 +4625,10 @@ index 536bacb6e..b587f7e19 100644
  	$(srcdir)/prf_rc4.c		\
  	$(srcdir)/prng.c 		\
 diff --git a/src/lib/crypto/krb/cksumtypes.c b/src/lib/crypto/krb/cksumtypes.c
-index ecc2e08c9..f5fbe8a2a 100644
+index f7ba322f24..25a3ffd2d2 100644
 --- a/src/lib/crypto/krb/cksumtypes.c
 +++ b/src/lib/crypto/krb/cksumtypes.c
-@@ -46,12 +46,6 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list[] = {
+@@ -52,12 +52,6 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list[] = {
        krb5int_unkeyed_checksum, NULL,
        20, 20, CKSUM_UNKEYED },
  
@@ -4579,21 +4642,19 @@ index ecc2e08c9..f5fbe8a2a 100644
        "hmac-md5-rc4", { "hmac-md5-enc", "hmac-md5-earcfour" },
        "Microsoft HMAC MD5",
 diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h
-index b18d5e2e3..1b4324d71 100644
+index 3629616d96..1ee4b30e02 100644
 --- a/src/lib/crypto/krb/crypto_int.h
 +++ b/src/lib/crypto/krb/crypto_int.h
-@@ -276,10 +276,6 @@ krb5_error_code krb5int_aes2_string_to_key(const struct krb5_keytypes *enc,
+@@ -332,8 +332,6 @@ krb5_error_code krb5int_aes2_string_to_key(const struct krb5_keytypes *enc,
  /* Random to key */
  krb5_error_code k5_rand2key_direct(const krb5_data *randombits,
                                     krb5_keyblock *keyblock);
--krb5_error_code k5_rand2key_des(const krb5_data *randombits,
--                                krb5_keyblock *keyblock);
 -krb5_error_code k5_rand2key_des3(const krb5_data *randombits,
 -                                 krb5_keyblock *keyblock);
  
  /* Pseudo-random function */
  krb5_error_code krb5int_des_prf(const struct krb5_keytypes *ktp,
-@@ -384,11 +380,6 @@ krb5_keyusage krb5int_arcfour_translate_usage(krb5_keyusage usage);
+@@ -411,11 +409,6 @@ krb5_keyusage krb5int_arcfour_translate_usage(krb5_keyusage usage);
  /* Ensure library initialization has occurred. */
  int krb5int_crypto_init(void);
  
@@ -4605,7 +4666,7 @@ index b18d5e2e3..1b4324d71 100644
  /* Default state cleanup handler (used by module enc providers). */
  void krb5int_default_free_state(krb5_data *state);
  
-@@ -441,7 +432,6 @@ void k5_iov_cursor_put(struct iov_cursor *cursor, unsigned char *block);
+@@ -468,7 +461,6 @@ void k5_iov_cursor_put(struct iov_cursor *cursor, unsigned char *block);
  /* Modules must implement the k5_sha256() function prototyped in k5-int.h. */
  
  /* Modules must implement the following enc_providers and hash_providers: */
@@ -4613,21 +4674,18 @@ index b18d5e2e3..1b4324d71 100644
  extern const struct krb5_enc_provider krb5int_enc_arcfour;
  extern const struct krb5_enc_provider krb5int_enc_aes128;
  extern const struct krb5_enc_provider krb5int_enc_aes256;
-@@ -458,12 +448,6 @@ extern const struct krb5_hash_provider krb5int_hash_sha384;
+@@ -485,9 +477,6 @@ extern const struct krb5_hash_provider krb5int_hash_sha384;
  
  /* Modules must implement the following functions. */
  
 -/* Set the parity bits to the correct values in keybits. */
 -void k5_des_fixup_key_parity(unsigned char *keybits);
--
--/* Return true if keybits is a weak or semi-weak DES key. */
--krb5_boolean k5_des_is_weak_key(unsigned char *keybits);
 -
  /* Compute an HMAC using the provided hash function, key, and data, storing the
   * result into output (caller-allocated). */
  krb5_error_code krb5int_hmac(const struct krb5_hash_provider *hash,
 diff --git a/src/lib/crypto/krb/default_state.c b/src/lib/crypto/krb/default_state.c
-index 0757c8b02..f89dc7902 100644
+index 0757c8b02c..f89dc79023 100644
 --- a/src/lib/crypto/krb/default_state.c
 +++ b/src/lib/crypto/krb/default_state.c
 @@ -32,16 +32,6 @@
@@ -4648,7 +4706,7 @@ index 0757c8b02..f89dc7902 100644
  krb5int_default_free_state(krb5_data *state)
  {
 diff --git a/src/lib/crypto/krb/enctype_util.c b/src/lib/crypto/krb/enctype_util.c
-index 1542d4062..a0037912a 100644
+index 1542d40629..a0037912a7 100644
 --- a/src/lib/crypto/krb/enctype_util.c
 +++ b/src/lib/crypto/krb/enctype_util.c
 @@ -45,6 +45,9 @@ struct {
@@ -4662,7 +4720,7 @@ index 1542d4062..a0037912a 100644
  };
  
 diff --git a/src/lib/crypto/krb/etypes.c b/src/lib/crypto/krb/etypes.c
-index fc278783b..7635393a4 100644
+index fc278783b9..7635393a41 100644
 --- a/src/lib/crypto/krb/etypes.c
 +++ b/src/lib/crypto/krb/etypes.c
 @@ -35,27 +35,6 @@
@@ -4695,7 +4753,7 @@ index fc278783b..7635393a4 100644
      { ENCTYPE_ARCFOUR_HMAC,
 diff --git a/src/lib/crypto/krb/prf_des.c b/src/lib/crypto/krb/prf_des.c
 deleted file mode 100644
-index 7a2d719c5..000000000
+index 7a2d719c5f..0000000000
 --- a/src/lib/crypto/krb/prf_des.c
 +++ /dev/null
 @@ -1,47 +0,0 @@
@@ -4747,10 +4805,10 @@ index 7a2d719c5..000000000
 -    return ktp->enc->encrypt(key, NULL, &iov, 1);
 -}
 diff --git a/src/lib/crypto/krb/random_to_key.c b/src/lib/crypto/krb/random_to_key.c
-index 157462526..863090beb 100644
+index 9394385aa0..863090beb2 100644
 --- a/src/lib/crypto/krb/random_to_key.c
 +++ b/src/lib/crypto/krb/random_to_key.c
-@@ -71,48 +71,3 @@ k5_rand2key_direct(const krb5_data *randombits, krb5_keyblock *keyblock)
+@@ -71,31 +71,3 @@ k5_rand2key_direct(const krb5_data *randombits, krb5_keyblock *keyblock)
      memcpy(keyblock->contents, randombits->data, randombits->length);
      return 0;
  }
@@ -4764,23 +4822,6 @@ index 157462526..863090beb 100644
 -}
 -
 -krb5_error_code
--k5_rand2key_des(const krb5_data *randombits, krb5_keyblock *keyblock)
--{
--    if (randombits->length != 7)
--        return(KRB5_CRYPTO_INTERNAL);
--
--    keyblock->magic = KV5M_KEYBLOCK;
--
--    /* Take the seven bytes, move them around into the top 7 bits of the
--     * 8 key bytes, then compute the parity bits. */
--    memcpy(keyblock->contents, randombits->data, randombits->length);
--    eighth_byte(keyblock->contents);
--    k5_des_fixup_key_parity(keyblock->contents);
--
--    return 0;
--}
--
--krb5_error_code
 -k5_rand2key_des3(const krb5_data *randombits, krb5_keyblock *keyblock)
 -{
 -    int i;
@@ -4800,7 +4841,7 @@ index 157462526..863090beb 100644
 -    return 0;
 -}
 diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports
-index 451d5e035..9db181381 100644
+index 052f4d4b51..d8ffa63304 100644
 --- a/src/lib/crypto/libk5crypto.exports
 +++ b/src/lib/crypto/libk5crypto.exports
 @@ -86,7 +86,6 @@ krb5_k_verify_checksum
@@ -4809,55 +4850,38 @@ index 451d5e035..9db181381 100644
  krb5int_aes_decrypt
 -krb5int_enc_des3
  krb5int_arcfour_gsscrypt
- krb5int_camellia_cbc_mac
+ krb5int_camellia_encrypt
  krb5int_cmac_checksum
 diff --git a/src/lib/crypto/openssl/Makefile.in b/src/lib/crypto/openssl/Makefile.in
-index aa434b168..234fc0e76 100644
+index cf11f6847b..8e4cdb8bbf 100644
 --- a/src/lib/crypto/openssl/Makefile.in
 +++ b/src/lib/crypto/openssl/Makefile.in
 @@ -1,6 +1,6 @@
  mydir=lib$(S)crypto$(S)openssl
  BUILDTOP=$(REL)..$(S)..$(S)..
--SUBDIRS=camellia des aes md4 md5  sha1 sha2 enc_provider hash_provider
-+SUBDIRS=camellia aes md4 md5  sha1 sha2 enc_provider hash_provider
- LOCALINCLUDES = -I$(srcdir)/../krb -I$(srcdir)
+-SUBDIRS=des enc_provider hash_provider
++SUBDIRS=enc_provider hash_provider
+ LOCALINCLUDES=-I$(srcdir)/../krb $(CRYPTO_IMPL_CFLAGS)
  
  STLIBOBJS=\
-@@ -24,14 +24,14 @@ SRCS=\
- 	$(srcdir)/sha256.c	\
- 	$(srcdir)/stubs.c
- 
--STOBJLISTS= des/OBJS.ST md4/OBJS.ST 	\
-+STOBJLISTS= md4/OBJS.ST 		\
- 	md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST 	\
- 	enc_provider/OBJS.ST 		\
- 	hash_provider/OBJS.ST 		\
- 	aes/OBJS.ST 			\
- 	OBJS.ST
+@@ -24,7 +24,7 @@ SRCS=\
+ 	$(srcdir)/pbkdf2.c	\
+ 	$(srcdir)/sha256.c
  
 -SUBDIROBJLISTS= des/OBJS.ST md4/OBJS.ST 	\
 +SUBDIROBJLISTS= md4/OBJS.ST 		\
  		md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST 	\
  		enc_provider/OBJS.ST 		\
  		hash_provider/OBJS.ST 		\
-@@ -42,7 +42,7 @@ includes: depend
- 
- depend: $(SRCS)
- 
--clean-unix:: clean-libobjs
-+clean-unix:: clean-libobjsn
- 
- @lib_frag@
- @libobj_frag@
 diff --git a/src/lib/crypto/openssl/des/Makefile.in b/src/lib/crypto/openssl/des/Makefile.in
 deleted file mode 100644
-index 4392fb8ea..000000000
+index a6cece1dd1..0000000000
 --- a/src/lib/crypto/openssl/des/Makefile.in
 +++ /dev/null
 @@ -1,20 +0,0 @@
 -mydir=lib$(S)crypto$(S)openssl$(S)des
 -BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
--LOCALINCLUDES = -I$(srcdir)/../../krb -I$(srcdir)/..
+-LOCALINCLUDES = -I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS)
 -
 -STLIBOBJS= des_keys.o
 -
@@ -4877,31 +4901,30 @@ index 4392fb8ea..000000000
 -
 diff --git a/src/lib/crypto/openssl/des/deps b/src/lib/crypto/openssl/des/deps
 deleted file mode 100644
-index 21b904f89..000000000
+index 723c268082..0000000000
 --- a/src/lib/crypto/openssl/des/deps
 +++ /dev/null
-@@ -1,15 +0,0 @@
+@@ -1,14 +0,0 @@
 -#
 -# Generated makefile dependencies follow.
 -#
 -des_keys.so des_keys.po $(OUTPRE)des_keys.$(OBJEXT): \
 -  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
 -  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../crypto_mod.h \
--  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  des_keys.c
+-  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
+-  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+-  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+-  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+-  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
+-  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+-  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
+-  $(top_srcdir)/include/socket-utils.h des_keys.c
 diff --git a/src/lib/crypto/openssl/des/des_keys.c b/src/lib/crypto/openssl/des/des_keys.c
 deleted file mode 100644
-index 51d9db216..000000000
+index 83f1cbf22a..0000000000
 --- a/src/lib/crypto/openssl/des/des_keys.c
 +++ /dev/null
-@@ -1,40 +0,0 @@
+@@ -1,39 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/openssl/des/des_keys.c - Key functions used by Kerberos code */
 -/*
@@ -4929,6 +4952,9 @@ index 51d9db216..000000000
 - */
 -
 -#include "crypto_int.h"
+-
+-#ifdef K5_OPENSSL_DES_KEY_PARITY
+-
 -#include <openssl/des.h>
 -
 -void
@@ -4937,17 +4963,13 @@ index 51d9db216..000000000
 -    DES_set_odd_parity((DES_cblock *)keybits);
 -}
 -
--krb5_boolean
--k5_des_is_weak_key(unsigned char *keybits)
--{
--    return DES_is_weak_key((DES_cblock *)keybits);
--}
+-#endif
 diff --git a/src/lib/crypto/openssl/enc_provider/Makefile.in b/src/lib/crypto/openssl/enc_provider/Makefile.in
-index a9069d22d..2b32c3ac4 100644
+index 26827cfed5..f0d37c1213 100644
 --- a/src/lib/crypto/openssl/enc_provider/Makefile.in
 +++ b/src/lib/crypto/openssl/enc_provider/Makefile.in
 @@ -3,19 +3,16 @@ BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
- LOCALINCLUDES = -I$(srcdir)/../../krb -I$(srcdir)/..
+ LOCALINCLUDES = -I$(srcdir)/../../krb $(CRYPTO_IMPL_CFLAGS)
  
  STLIBOBJS= \
 -	des3.o 	\
@@ -4967,7 +4989,7 @@ index a9069d22d..2b32c3ac4 100644
  	$(srcdir)/camellia.c 	\
  	$(srcdir)/rc4.c
 diff --git a/src/lib/crypto/openssl/enc_provider/deps b/src/lib/crypto/openssl/enc_provider/deps
-index 1c28cc842..91ba48234 100644
+index 1c87a526d0..a502990a0c 100644
 --- a/src/lib/crypto/openssl/enc_provider/deps
 +++ b/src/lib/crypto/openssl/enc_provider/deps
 @@ -1,17 +1,6 @@
@@ -4977,23 +4999,23 @@ index 1c28cc842..91ba48234 100644
 -des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
 -  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
 -  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
--  $(srcdir)/../crypto_mod.h $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
--  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
--  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
--  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
--  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h des3.c
+-  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
+-  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
+-  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
+-  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
+-  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
+-  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
+-  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+-  des3.c
  aes.so aes.po $(OUTPRE)aes.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
    $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
    $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
 diff --git a/src/lib/crypto/openssl/enc_provider/des3.c b/src/lib/crypto/openssl/enc_provider/des3.c
 deleted file mode 100644
-index 1c439c2cd..000000000
+index 90fcf9acb5..0000000000
 --- a/src/lib/crypto/openssl/enc_provider/des3.c
 +++ /dev/null
-@@ -1,184 +0,0 @@
+@@ -1,188 +0,0 @@
 -/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 -/* lib/crypto/openssl/enc_provider/des3.c */
 -/*
@@ -5046,8 +5068,10 @@ index 1c439c2cd..000000000
 - */
 -
 -#include "crypto_int.h"
--#include <openssl/evp.h>
 -
+-#ifdef K5_OPENSSL_DES
+-
+-#include <openssl/evp.h>
 -
 -#define DES3_BLOCK_SIZE 8
 -#define DES3_KEY_SIZE 24
@@ -5178,11 +5202,26 @@ index 1c439c2cd..000000000
 -    krb5int_des_init_state,
 -    krb5int_default_free_state
 -};
+-
+-#endif /* K5_OPENSSL_DES */
+diff --git a/src/lib/crypto/openssl/kdf.c b/src/lib/crypto/openssl/kdf.c
+index 41e845eae0..5a43c3d9eb 100644
+--- a/src/lib/crypto/openssl/kdf.c
++++ b/src/lib/crypto/openssl/kdf.c
+@@ -60,8 +60,6 @@ enc_name(const struct krb5_enc_provider *enc)
+         return "AES-128-CBC";
+     if (enc == &krb5int_enc_aes256)
+         return "AES-256-CBC";
+-    if (enc == &krb5int_enc_des3)
+-        return "DES-EDE3-CBC";
+     return NULL;
+ }
+ 
 diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
-index 439ae6aeb..d8e0f93a1 100644
+index b35e11bfb6..d7c2ad321e 100644
 --- a/src/lib/gssapi/krb5/accept_sec_context.c
 +++ b/src/lib/gssapi/krb5/accept_sec_context.c
-@@ -1011,7 +1011,6 @@ kg_accept_krb5(minor_status, context_handle,
+@@ -1026,7 +1026,6 @@ kg_accept_krb5(minor_status, context_handle,
              }
  
              switch (negotiated_etype) {
@@ -5191,7 +5230,7 @@ index 439ae6aeb..d8e0f93a1 100644
              case ENCTYPE_ARCFOUR_HMAC_EXP:
                  /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer"
 diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h
-index 2647434ba..1cdd23cc8 100644
+index 7364607198..5aeb69aebc 100644
 --- a/src/lib/gssapi/krb5/gssapiP_krb5.h
 +++ b/src/lib/gssapi/krb5/gssapiP_krb5.h
 @@ -125,14 +125,14 @@ enum sgn_alg {
@@ -5221,10 +5260,10 @@ index 2647434ba..1cdd23cc8 100644
  };
  
 diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c
-index d1cdce486..7f7146a0a 100644
+index 99275be53a..0e5d10b115 100644
 --- a/src/lib/gssapi/krb5/k5seal.c
 +++ b/src/lib/gssapi/krb5/k5seal.c
-@@ -136,19 +136,12 @@ make_seal_token_v1 (krb5_context context,
+@@ -142,19 +142,12 @@ make_seal_token_v1 (krb5_context context,
  
      /* pad the plaintext, encrypt if needed, and stick it in the token */
  
@@ -5250,7 +5289,7 @@ index d1cdce486..7f7146a0a 100644
  
      code = krb5_c_checksum_length(context, md5cksum.checksum_type, &sumlen);
      if (code) {
-@@ -196,20 +189,8 @@ make_seal_token_v1 (krb5_context context,
+@@ -203,20 +196,8 @@ make_seal_token_v1 (krb5_context context,
          gssalloc_free(t);
          return(code);
      }
@@ -5262,22 +5301,22 @@ index d1cdce486..7f7146a0a 100644
 -         */
 -        if (md5cksum.length != cksum_size)
 -            abort ();
--        memcpy (ptr+14, md5cksum.contents, md5cksum.length);
+-        memcpy(checksum, md5cksum.contents, md5cksum.length);
 -        break;
 -    case SGN_ALG_HMAC_MD5:
--        memcpy (ptr+14, md5cksum.contents, cksum_size);
+-        memcpy(checksum, md5cksum.contents, cksum_size);
 -        break;
 -    }
 +
-+    memcpy (ptr+14, md5cksum.contents, cksum_size);
++    memcpy(checksum, md5cksum.contents, cksum_size);
  
      krb5_free_checksum_contents(context, &md5cksum);
  
 diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c
-index 9bb2ee109..9147bb2c7 100644
+index 7bf7609a48..d5e12cb436 100644
 --- a/src/lib/gssapi/krb5/k5sealiov.c
 +++ b/src/lib/gssapi/krb5/k5sealiov.c
-@@ -144,18 +144,11 @@ make_seal_token_v1_iov(krb5_context context,
+@@ -147,18 +147,11 @@ make_seal_token_v1_iov(krb5_context context,
      /* pad the plaintext, encrypt if needed, and stick it in the token */
  
      /* initialize the checksum */
@@ -5301,25 +5340,25 @@ index 9bb2ee109..9147bb2c7 100644
  
      code = krb5_c_checksum_length(context, md5cksum.checksum_type, &k5_trailerlen);
      if (code != 0)
-@@ -177,15 +170,7 @@ make_seal_token_v1_iov(krb5_context context,
+@@ -182,15 +175,7 @@ make_seal_token_v1_iov(krb5_context context,
      if (code != 0)
          goto cleanup;
  
 -    switch (ctx->signalg) {
 -    case SGN_ALG_HMAC_SHA1_DES3_KD:
 -        assert(md5cksum.length == ctx->cksum_size);
--        memcpy(ptr + 14, md5cksum.contents, md5cksum.length);
+-        memcpy(checksum, md5cksum.contents, md5cksum.length);
 -        break;
 -    case SGN_ALG_HMAC_MD5:
--        memcpy(ptr + 14, md5cksum.contents, ctx->cksum_size);
+-        memcpy(checksum, md5cksum.contents, ctx->cksum_size);
 -        break;
 -    }
-+    memcpy(ptr + 14, md5cksum.contents, ctx->cksum_size);
++    memcpy(checksum, md5cksum.contents, ctx->cksum_size);
  
      /* create the seq_num */
      code = kg_make_seq_num(context, ctx->seq, ctx->initiate ? 0 : 0xFF,
 diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c
-index 9b183bc33..f0cc4a680 100644
+index 9b183bc337..f0cc4a6809 100644
 --- a/src/lib/gssapi/krb5/k5unseal.c
 +++ b/src/lib/gssapi/krb5/k5unseal.c
 @@ -131,28 +131,21 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
@@ -5452,10 +5491,10 @@ index 9b183bc33..f0cc4a680 100644
      if (sealalg != 0xffff)
          xfree(plain);
 diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c
-index 85a9574f3..3ce2a90ce 100644
+index 21b501731e..6a6585d9af 100644
 --- a/src/lib/gssapi/krb5/k5unsealiov.c
 +++ b/src/lib/gssapi/krb5/k5unsealiov.c
-@@ -102,28 +102,21 @@ kg_unseal_v1_iov(krb5_context context,
+@@ -103,28 +103,21 @@ kg_unseal_v1_iov(krb5_context context,
      }
  
      if ((ctx->sealalg == SEAL_ALG_NONE && signalg > 1) ||
@@ -5489,7 +5528,7 @@ index 85a9574f3..3ce2a90ce 100644
      /* get the token parameters */
      code = kg_get_seq_num(context, ctx->seq, ptr + 14, ptr + 6, &direction,
                            &seqnum);
-@@ -181,16 +174,10 @@ kg_unseal_v1_iov(krb5_context context,
+@@ -182,16 +175,10 @@ kg_unseal_v1_iov(krb5_context context,
  
      /* initialize the checksum */
  
@@ -5509,7 +5548,7 @@ index 85a9574f3..3ce2a90ce 100644
  
      code = krb5_c_checksum_length(context, md5cksum.checksum_type, &sumlen);
      if (code != 0) {
-@@ -209,18 +196,13 @@ kg_unseal_v1_iov(krb5_context context,
+@@ -210,18 +197,13 @@ kg_unseal_v1_iov(krb5_context context,
          goto cleanup;
      }
  
@@ -5531,7 +5570,7 @@ index 85a9574f3..3ce2a90ce 100644
          code = 0;
          retval = GSS_S_BAD_SIG;
 diff --git a/src/lib/gssapi/krb5/util_crypt.c b/src/lib/gssapi/krb5/util_crypt.c
-index 80954aff7..f7d3e92c4 100644
+index 84f1949887..32150f5e34 100644
 --- a/src/lib/gssapi/krb5/util_crypt.c
 +++ b/src/lib/gssapi/krb5/util_crypt.c
 @@ -97,17 +97,6 @@ kg_setup_keys(krb5_context context, krb5_gss_ctx_id_rec *ctx, krb5_key subkey,
@@ -5552,57 +5591,8 @@ index 80954aff7..f7d3e92c4 100644
      case ENCTYPE_ARCFOUR_HMAC:
      case ENCTYPE_ARCFOUR_HMAC_EXP:
          /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" enctype,
-diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-index 740425c69..6b45f5f72 100644
---- a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-+++ b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-@@ -53,10 +53,10 @@ proc test200 {} {
-     }
- 
-     # XXX Perhaps I should actually check the key type returned.
--    if {$num_keys == 5} {
-+    if {$num_keys == 4} {
- 	pass "$test"
-     } else {
--	fail "$test: $num_keys keys, should be 5"
-+	fail "$test: $num_keys keys, should be 4"
-     }
-     if { ! [cmd {kadm5_destroy $server_handle}]} {
- 	perror "$test: unexpected failure in destroy"
-diff --git a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-index 3ea1ba29b..d2c6d1afa 100644
---- a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-+++ b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-@@ -143,8 +143,8 @@ proc test101_102 {rpc} {
-     }
- 
-     set failed 0
--    if {$num_keys != 5} {
--	fail "$test: num_keys $num_keys should be 5"
-+    if {$num_keys != 4} {
-+	fail "$test: num_keys $num_keys should be 4"
- 	set failed 1
-     }
-     for {set i 0} {$i < $num_keys} {incr i} {
-diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
-index 2925c1c43..2f76c8b43 100644
---- a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
-+++ b/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
-@@ -46,10 +46,10 @@ proc test100 {} {
-     }
- 
-     # XXX Perhaps I should actually check the key type returned.
--    if {$num_keys == 5} {
-+    if {$num_keys == 4} {
- 	pass "$test"
-     } else {
--	fail "$test: $num_keys keys, should be 5"
-+	fail "$test: $num_keys keys, should be 4"
-     }
-     if { ! [cmd {kadm5_destroy $server_handle}]} {
- 	perror "$test: unexpected failure in destroy"
 diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
-index b597dda54..ed52987a0 100644
+index 87b486c53f..2b5abcd817 100644
 --- a/src/lib/krb5/krb/init_ctx.c
 +++ b/src/lib/krb5/krb/init_ctx.c
 @@ -59,7 +59,6 @@
@@ -5613,7 +5603,7 @@ index b597dda54..ed52987a0 100644
      ENCTYPE_ARCFOUR_HMAC,
      ENCTYPE_CAMELLIA128_CTS_CMAC, ENCTYPE_CAMELLIA256_CTS_CMAC,
      0
-@@ -478,8 +477,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey,
+@@ -450,8 +449,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey,
              /* Set all enctypes in the default list. */
              for (i = 0; default_list[i]; i++)
                  mod_list(default_list[i], sel, weak, &list);
@@ -5623,10 +5613,10 @@ index b597dda54..ed52987a0 100644
              mod_list(ENCTYPE_AES256_CTS_HMAC_SHA1_96, sel, weak, &list);
              mod_list(ENCTYPE_AES128_CTS_HMAC_SHA1_96, sel, weak, &list);
 diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c
-index d8015c64a..005cfd468 100644
+index 44d113e7c5..9662785783 100644
 --- a/src/lib/krb5/krb/s4u_creds.c
 +++ b/src/lib/krb5/krb/s4u_creds.c
-@@ -341,8 +341,6 @@ verify_s4u2self_reply(krb5_context context,
+@@ -288,8 +288,6 @@ verify_s4u2self_reply(krb5_context context,
      assert(req_s4u_user != NULL);
  
      switch (subkey->enctype) {
@@ -5635,21 +5625,8 @@ index d8015c64a..005cfd468 100644
      case ENCTYPE_ARCFOUR_HMAC:
      case ENCTYPE_ARCFOUR_HMAC_EXP :
          not_newer = TRUE;
-diff --git a/src/lib/krb5/krb/t_copy_context.c b/src/lib/krb5/krb/t_copy_context.c
-index 22be2198b..d489b78f9 100644
---- a/src/lib/krb5/krb/t_copy_context.c
-+++ b/src/lib/krb5/krb/t_copy_context.c
-@@ -114,7 +114,7 @@ main(int argc, char **argv)
- {
-     krb5_context ctx, ctx2;
-     krb5_plugin_initvt_fn *mods;
--    const krb5_enctype etypes1[] = { ENCTYPE_DES3_CBC_SHA1, 0 };
-+    const krb5_enctype etypes1[] = { ENCTYPE_AES128_CTS_HMAC_SHA256_128, 0 };
-     const krb5_enctype etypes2[] = { ENCTYPE_AES128_CTS_HMAC_SHA1_96,
-                                      ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 };
-     krb5_prompt_type ptypes[] = { KRB5_PROMPT_TYPE_PASSWORD };
 diff --git a/src/lib/krb5/krb/t_etypes.c b/src/lib/krb5/krb/t_etypes.c
-index f609e938a..248ffea90 100644
+index 90c9f626c6..935aca12f5 100644
 --- a/src/lib/krb5/krb/t_etypes.c
 +++ b/src/lib/krb5/krb/t_etypes.c
 @@ -50,17 +50,6 @@ static struct {
@@ -5721,7 +5698,7 @@ index f609e938a..248ffea90 100644
      { NULL,
        { ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 },
 diff --git a/src/lib/krb5/os/t_trace.c b/src/lib/krb5/os/t_trace.c
-index 10ba8d0ac..24064ffcf 100644
+index 10ba8d0ac7..24064ffcfd 100644
 --- a/src/lib/krb5/os/t_trace.c
 +++ b/src/lib/krb5/os/t_trace.c
 @@ -65,8 +65,8 @@ main (int argc, char *argv[])
@@ -5736,7 +5713,7 @@ index 10ba8d0ac..24064ffcf 100644
      krb5_keytab keytab;
      krb5_creds creds;
 diff --git a/src/lib/krb5/os/t_trace.ref b/src/lib/krb5/os/t_trace.ref
-index 044a66999..98fb14f3f 100644
+index 044a66999e..98fb14f3f7 100644
 --- a/src/lib/krb5/os/t_trace.ref
 +++ b/src/lib/krb5/os/t_trace.ref
 @@ -41,7 +41,7 @@ int, krb5_principal type: ?
@@ -5749,7 +5726,7 @@ index 044a66999..98fb14f3f 100644
  krb5_ccache, display type:name: FILE:/path/to/ccache
  krb5_keytab, display name: FILE:/etc/krb5.keytab
 diff --git a/src/plugins/preauth/pkinit/pkcs11.h b/src/plugins/preauth/pkinit/pkcs11.h
-index 28ded4a89..47f4727bd 100644
+index e3d2846315..586661bb7e 100644
 --- a/src/plugins/preauth/pkinit/pkcs11.h
 +++ b/src/plugins/preauth/pkinit/pkcs11.h
 @@ -339,9 +339,9 @@ typedef unsigned long ck_key_type_t;
@@ -5765,99 +5742,29 @@ index 28ded4a89..47f4727bd 100644
  #define CKK_CAST		(0x16)
  #define CKK_CAST3		(0x17)
  #define CKK_CAST128		(0x18)
-diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
-index 1a642139a..2f0431991 100644
---- a/src/plugins/preauth/pkinit/pkinit_clnt.c
-+++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
-@@ -212,14 +212,6 @@ pkinit_as_req_create(krb5_context context,
-     auth_pack.clientPublicValue = &info;
-     auth_pack.supportedKDFs = (krb5_data **)supported_kdf_alg_ids;
- 
--    /* add List of CMS algorithms */
--    retval = create_krb5_supportedCMSTypes(context, plgctx->cryptoctx,
--                                           reqctx->cryptoctx,
--                                           reqctx->idctx, &cmstypes);
--    auth_pack.supportedCMSTypes = cmstypes;
--    if (retval)
--        goto cleanup;
--
-     switch(protocol) {
-     case DH_PROTOCOL:
-         TRACE_PKINIT_CLIENT_REQ_DH(context);
 diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
-index 8064a07d0..a291889b0 100644
+index e22798f668..9fa315d7a0 100644
 --- a/src/plugins/preauth/pkinit/pkinit_crypto.h
 +++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
-@@ -380,18 +380,6 @@ krb5_error_code server_process_dh
- 	unsigned int *server_key_len_out);		/* OUT
- 		    receives length of DH secret key */
- 
--/*
-- * this functions takes in crypto specific representation of
-- * supportedCMSTypes and creates a list of
-- * krb5_algorithm_identifier
-- */
--krb5_error_code create_krb5_supportedCMSTypes
+@@ -370,11 +370,11 @@ krb5_error_code server_process_dh
+  * krb5_algorithm_identifier
+  */
+ krb5_error_code create_krb5_supportedCMSTypes
 -	(krb5_context context,				/* IN */
 -	pkinit_plg_crypto_context plg_cryptoctx,	/* IN */
 -	pkinit_req_crypto_context req_cryptoctx,	/* IN */
 -	pkinit_identity_crypto_context id_cryptoctx,	/* IN */
 -	krb5_algorithm_identifier ***supportedCMSTypes); /* OUT */
--
++       (krb5_context context,                          /* IN */
++       pkinit_plg_crypto_context plg_cryptoctx,        /* IN */
++       pkinit_req_crypto_context req_cryptoctx,        /* IN */
++       pkinit_identity_crypto_context id_cryptoctx,    /* IN */
++       krb5_algorithm_identifier ***supportedCMSTypes); /* OUT */
+ 
  /*
   * this functions takes in crypto specific representation of
-  * trustedCertifiers and creates a list of
-diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-index 8c7fd0cca..52976895b 100644
---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-@@ -5487,44 +5487,6 @@ cleanup:
-     return retval;
- }
- 
--krb5_error_code
--create_krb5_supportedCMSTypes(krb5_context context,
--                              pkinit_plg_crypto_context plg_cryptoctx,
--                              pkinit_req_crypto_context req_cryptoctx,
--                              pkinit_identity_crypto_context id_cryptoctx,
--                              krb5_algorithm_identifier ***oids)
--{
--
--    krb5_error_code retval = ENOMEM;
--    krb5_algorithm_identifier **loids = NULL;
--    krb5_data des3oid = {0, 8, "\x2A\x86\x48\x86\xF7\x0D\x03\x07" };
--
--    *oids = NULL;
--    loids = malloc(2 * sizeof(krb5_algorithm_identifier *));
--    if (loids == NULL)
--        goto cleanup;
--    loids[1] = NULL;
--    loids[0] = malloc(sizeof(krb5_algorithm_identifier));
--    if (loids[0] == NULL) {
--        free(loids);
--        goto cleanup;
--    }
--    retval = pkinit_copy_krb5_data(&loids[0]->algorithm, &des3oid);
--    if (retval) {
--        free(loids[0]);
--        free(loids);
--        goto cleanup;
--    }
--    loids[0]->parameters.length = 0;
--    loids[0]->parameters.data = NULL;
--
--    *oids = loids;
--    retval = 0;
--cleanup:
--
--    return retval;
--}
--
- krb5_error_code
- create_krb5_trustedCertifiers(krb5_context context,
-                               pkinit_plg_crypto_context plg_cryptoctx,
 diff --git a/src/plugins/preauth/pkinit/pkinit_kdf_test.c b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
-index 7acbd0d28..cd998a29a 100644
+index 7f38e84910..99c93ac128 100644
 --- a/src/plugins/preauth/pkinit/pkinit_kdf_test.c
 +++ b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
 @@ -49,7 +49,6 @@ char eighteen_bs[9];
@@ -5868,14 +5775,13 @@ index 7acbd0d28..cd998a29a 100644
  const krb5_data lha_data = DATA_FROM_STRING("lha");
  
  krb5_octet key1_hex[] =
-@@ -185,36 +184,6 @@ main(int argc, char **argv)
+@@ -187,35 +186,6 @@ main(int argc, char **argv)
          goto cleanup;
      }
  
 -    /* TEST 3: SHA-512/DES3 */
 -    /* set up algorithm id */
--    alg_id.algorithm.data = (char *)krb5_pkinit_sha512_oid;
--    alg_id.algorithm.length = krb5_pkinit_sha512_oid_len;
+-    alg_id.algorithm = sha512_id;
 -
 -    enctype = enctype_des3;
 -
@@ -5885,7 +5791,7 @@ index 7acbd0d28..cd998a29a 100644
 -                                              u_principal, v_principal,
 -                                              enctype, &as_req, &pk_as_rep,
 -                                              &key_block))) {
--        printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d",
+-        printf("ERROR in pkinit_kdf_test: kdf call failed, retval = %d\n",
 -               retval);
 -        goto cleanup;
 -    }
@@ -5906,7 +5812,7 @@ index 7acbd0d28..cd998a29a 100644
      /* release all allocated resources, whether good or bad return */
      free(secret.data);
 diff --git a/src/plugins/preauth/spake/t_vectors.c b/src/plugins/preauth/spake/t_vectors.c
-index 2279202d3..96b0307d7 100644
+index 2279202d3a..96b0307d78 100644
 --- a/src/plugins/preauth/spake/t_vectors.c
 +++ b/src/plugins/preauth/spake/t_vectors.c
 @@ -56,31 +56,6 @@ struct test {
@@ -5941,158 +5847,8 @@ index 2279202d3..96b0307d7 100644
      { ENCTYPE_ARCFOUR_HMAC, SPAKE_GROUP_EDWARDS25519,
        /* initial key, w, x, y, T, S, K */
        "8846F7EAEE8FB117AD06BDD830B7586C",
-diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp
-index e8adee234..30a2c0967 100644
---- a/src/tests/dejagnu/config/default.exp
-+++ b/src/tests/dejagnu/config/default.exp
-@@ -15,8 +15,6 @@ set timeout 100
- set stty_init {erase \^h kill \^u}
- set env(TERM) dumb
- 
--set des3_krbtgt 0
--
- if { [string length $VALGRIND] } {
-     rename spawn valgrind_aux_spawn
-     proc spawn { args } {
-@@ -105,17 +103,9 @@ if { $PRIOCNTL_HACK } {
- # particularly with regards to encryption types.
- 
- set passes {
--    {
--	des3
--	mode=udp
--	des3_krbtgt=1
--	{supported_enctypes=des3-cbc-sha1:normal}
--	{dummy=[verbose -log "DES3 TGT, DES3 enctype"]}
--    }
-     {
- 	aes-only
- 	mode=udp
--	des3_krbtgt=0
- 	{supported_enctypes=aes256-cts-hmac-sha1-96:normal}
- 	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96}
- 	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96}
-@@ -130,7 +120,6 @@ set passes {
-     {
- 	aes-sha2-only
- 	mode=udp
--	des3_krbtgt=0
- 	{supported_enctypes=aes256-sha2:normal}
- 	{permitted_enctypes(kdc)=aes256-sha2}
- 	{permitted_enctypes(replica)=aes256-sha2}
-@@ -154,7 +143,6 @@ set passes {
-     {
- 	camellia-only
- 	mode=udp
--	des3_krbtgt=0
- 	{supported_enctypes=camellia256-cts:normal}
- 	{permitted_enctypes(kdc)=camellia256-cts}
- 	{permitted_enctypes(replica)=camellia256-cts}
-@@ -175,32 +163,9 @@ set passes {
- 	{master_key_type=camellia256-cts}
- 	{dummy=[verbose -log "Camellia-256 enctype"]}
-     }
--    {
--	aes-des3
--	mode=udp
--	des3_krbtgt=0
--	{supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal}
--	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{master_key_type=aes256-cts-hmac-sha1-96}
--	{dummy=[verbose -log "AES + DES3 + DES enctypes"]}
--    }
--    {
--	aes-des3tgt
--	mode=udp
--	des3_krbtgt=1
--	{supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal}
--	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
--	{master_key_type=aes256-cts-hmac-sha1-96}
--	{dummy=[verbose -log "AES enctypes, DES3 TGT"]}
--    }
-     {
- 	all-enctypes
- 	mode=udp
--	des3_krbtgt=0
- 	{allow_weak_crypto(kdc)=false}
- 	{allow_weak_crypto(replica)=false}
- 	{allow_weak_crypto(client)=false}
-@@ -947,7 +912,6 @@ proc setup_kerberos_db { standalone } {
-     global REALMNAME KDB5_UTIL KADMIN_LOCAL KEY
-     global tmppwd hostname
-     global spawn_id
--    global des3_krbtgt
-     global multipass_name last_passname_db
- 
-     set failall 0
-@@ -1144,48 +1108,6 @@ proc setup_kerberos_db { standalone } {
- 	}
-     }
- 
--    if $des3_krbtgt {
--	# Set the TGT key to DES3.
--	set test "kadmin.local TGT to DES3"
--	set body {
--	    if $failall {
--		break
--	    }
--	    spawn $KADMIN_LOCAL -r $REALMNAME -e des3-cbc-sha1:normal
--	    verbose "starting $test"
--	    expect_after $def_exp_after
--
--	    expect "kadmin.local: "
--	    send "cpw -randkey krbtgt/$REALMNAME@$REALMNAME\r"
--	    # It echos...
--	    expect "cpw -randkey krbtgt/$REALMNAME@$REALMNAME\r"
--	    expect {
--		"Key for \"krbtgt/$REALMNAME@$REALMNAME\" randomized." { }
--	    }
--	    expect "kadmin.local: "
--	    send "quit\r"
--	    expect eof
--	    catch expect_after
--	    if ![check_exit_status kadmin_local] {
--		break
--	    }
--	}
--	set ret [catch $body]
--	catch "expect eof"
--	catch expect_after
--	if $ret {
--	    set failall 1
--	    if $standalone {
--		fail $test
--	    } else {
--		delete_db
--	    }
--	} else {
--	    if $standalone {
--		pass $test
--	    }
--	}
--    }
-     envstack_pop
- 
-     # create the admin database lock file
-diff --git a/src/tests/dejagnu/krb-standalone/kprop.exp b/src/tests/dejagnu/krb-standalone/kprop.exp
-index f71ee8638..8c08cf42f 100644
---- a/src/tests/dejagnu/krb-standalone/kprop.exp
-+++ b/src/tests/dejagnu/krb-standalone/kprop.exp
-@@ -54,7 +54,7 @@ proc doit { } {
-     global REALMNAME KEY
-     global KADMIN_LOCAL KTUTIL KDB5_UTIL KPROPLOG KPROP kpropd_spawn_id
-     global hostname tmppwd spawn_id timeout
--    global KRBIV supported_enctypes portbase mode ulog des3_krbtgt
-+    global KRBIV supported_enctypes portbase mode ulog
- 
-     # Delete any db, ulog files
-     delete_db
 diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
-index ca3d32d21..96d0e7330 100755
+index 7494d7fcdb..2f95d89967 100755
 --- a/src/tests/gssapi/t_enctypes.py
 +++ b/src/tests/gssapi/t_enctypes.py
 @@ -1,24 +1,17 @@
@@ -6118,14 +5874,14 @@ index ca3d32d21..96d0e7330 100755
  
  # These tests make assumptions about the default enctype lists, so set
  # them explicitly rather than relying on the library defaults.
--enctypes='aes des3 rc4'
 -supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal'
-+enctypes='aes rc4'
+-conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4'},
 +supp='aes256-cts:normal aes128-cts:normal rc4-hmac:normal'
- conf = {'libdefaults': {
-         'default_tgs_enctypes': enctypes,
-         'default_tkt_enctypes': enctypes,
-@@ -91,19 +84,12 @@ test('both aes128', 'aes128-cts', 'aes128-cts',
++conf = {'libdefaults': {'permitted_enctypes': 'aes rc4'},
+         'realms': {'$realm': {'supported_enctypes': supp}}}
+ realm = K5Realm(krb5_conf=conf)
+ shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save'))
+@@ -87,19 +80,12 @@ test('both aes128', 'aes128-cts', 'aes128-cts',
  test_err('acc aes128', None, 'aes128-cts',
           'Encryption type aes256-cts-hmac-sha1-96 not permitted')
  
@@ -6146,7 +5902,7 @@ index ca3d32d21..96d0e7330 100755
  # subkey.
  test('upgrade noargs', None, None,
       tktenc=aes256, tktsession=d_rc4,
-@@ -119,13 +105,6 @@ test('upgrade init aes128+rc4', 'aes128-cts rc4', None,
+@@ -115,13 +101,6 @@ test('upgrade init aes128+rc4', 'aes128-cts rc4', None,
       tktenc=aes256, tktsession=d_rc4,
       proto='cfx', isubkey=rc4, asubkey=aes128)
  
@@ -6161,10 +5917,10 @@ index ca3d32d21..96d0e7330 100755
  # because the ticket session key and initiator subkey are
  # non-permitted.  (This is unfortunate if the acceptor's restriction
 diff --git a/src/tests/gssapi/t_invalid.c b/src/tests/gssapi/t_invalid.c
-index 9876a11e6..fb8fe5511 100644
+index 882e163634..8192935099 100644
 --- a/src/tests/gssapi/t_invalid.c
 +++ b/src/tests/gssapi/t_invalid.c
-@@ -84,18 +84,6 @@ struct test {
+@@ -94,18 +94,6 @@ struct test {
      size_t toklen;
      const char *token;
  } tests[] = {
@@ -6184,7 +5940,7 @@ index 9876a11e6..fb8fe5511 100644
          ENCTYPE_ARCFOUR_HMAC, ENCTYPE_ARCFOUR_HMAC,
          SEAL_ALG_MICROSOFT_RC4, SGN_ALG_HMAC_MD5, 8,
 diff --git a/src/tests/gssapi/t_pcontok.c b/src/tests/gssapi/t_pcontok.c
-index 7368f752f..bf22bd3da 100644
+index 7368f752f0..bf22bd3da1 100644
 --- a/src/tests/gssapi/t_pcontok.c
 +++ b/src/tests/gssapi/t_pcontok.c
 @@ -43,7 +43,6 @@
@@ -6219,7 +5975,7 @@ index 7368f752f..bf22bd3da 100644
      tlen = 20 + mech_krb5.length + cksize;
      token = malloc(tlen);
 diff --git a/src/tests/gssapi/t_prf.c b/src/tests/gssapi/t_prf.c
-index f71774cdc..d1857c433 100644
+index f71774cdc9..d1857c433f 100644
 --- a/src/tests/gssapi/t_prf.c
 +++ b/src/tests/gssapi/t_prf.c
 @@ -41,13 +41,6 @@ static struct {
@@ -6237,10 +5993,10 @@ index f71774cdc..d1857c433 100644
        "3BB3AE288C12B3B9D06B208A4151B3B6",
        "9AEA11A3BCF3C53F1F91F5A0BA2132E2501ADF5F3C28"
 diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py
-index d98974b36..84153d9cf 100644
+index bde1c36844..8fcd30db51 100644
 --- a/src/tests/t_authdata.py
 +++ b/src/tests/t_authdata.py
-@@ -172,7 +172,7 @@ realm.run([kvno, 'restricted'])
+@@ -179,7 +179,7 @@ realm.run([kvno, 'restricted'])
  # preferred krbtgt enctype changes.
  mark('#8139 regression test')
  realm.kinit(realm.user_princ, password('user'), ['-f'])
@@ -6250,18 +6006,21 @@ index d98974b36..84153d9cf 100644
  realm.run(['./forward'])
  realm.run([kvno, realm.host_princ])
 diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
-index 2a052fc17..ace0edc3c 100644
+index c982508d8b..a6f538b66d 100644
 --- a/src/tests/t_etype_info.py
 +++ b/src/tests/t_etype_info.py
-@@ -1,6 +1,6 @@
+@@ -1,8 +1,7 @@
  from k5test import *
  
 -supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac'
+-conf = {'libdefaults': {'allow_weak_crypto': 'true'},
+-        'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
 +supported_enctypes = 'aes128-cts rc4-hmac'
- conf = {'libdefaults': {'allow_weak_crypto': 'true'},
-         'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
++conf = {'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
  realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf)
-@@ -24,9 +24,9 @@ def test_etinfo(princ, enctypes, expected_lines):
+ 
+ realm.run([kadminl, 'addprinc', '-pw', 'pw', '+requires_preauth',
+@@ -26,9 +25,9 @@ def test_etinfo(princ, enctypes, expected_lines):
  # With no newer enctypes in the request, PA-ETYPE-INFO2,
  # PA-ETYPE-INFO, and PA-PW-SALT appear in the AS-REP, each listing one
  # key for the most preferred matching enctype.
@@ -6274,7 +6033,7 @@ index 2a052fc17..ace0edc3c 100644
               'asrep pw_salt KRBTEST.COMuser'])
  
  # With a newer enctype in the request (even if it is not the most
-@@ -37,9 +37,9 @@ test_etinfo('user', 'rc4 aes256-cts',
+@@ -39,9 +38,9 @@ test_etinfo('user', 'rc4 aes256-cts',
  
  # In preauth-required errors, PA-PW-SALT does not appear, but the same
  # etype-info2 values are expected.
@@ -6287,7 +6046,7 @@ index 2a052fc17..ace0edc3c 100644
  test_etinfo('preauthuser', 'rc4 aes256-cts',
              ['error etype_info2 rc4-hmac KRBTEST.COMpreauthuser'])
  
-@@ -48,8 +48,8 @@ test_etinfo('preauthuser', 'rc4 aes256-cts',
+@@ -50,8 +49,8 @@ test_etinfo('preauthuser', 'rc4 aes256-cts',
  # (to allow for preauth mechs which don't depend on long-term keys).
  # An AS-REP cannot be generated without preauth as there is no reply
  # key.
@@ -6299,7 +6058,7 @@ index 2a052fc17..ace0edc3c 100644
  # Verify that etype-info2 is included in a MORE_PREAUTH_DATA_REQUIRED
  # error if the client does optimistic preauth.
 diff --git a/src/tests/t_keyrollover.py b/src/tests/t_keyrollover.py
-index 2c825a692..f29e0d550 100755
+index e9840dfae8..583c2fa27e 100755
 --- a/src/tests/t_keyrollover.py
 +++ b/src/tests/t_keyrollover.py
 @@ -37,9 +37,9 @@ realm.run([klist, '-e'], expected_msg=msg)
@@ -6327,7 +6086,7 @@ index 2c825a692..f29e0d550 100755
  
  realm.stop()
 diff --git a/src/tests/t_mkey.py b/src/tests/t_mkey.py
-index 99273c907..f84041ca4 100755
+index 32f4070bcb..da0ed1831e 100755
 --- a/src/tests/t_mkey.py
 +++ b/src/tests/t_mkey.py
 @@ -7,7 +7,6 @@ import struct
@@ -6380,7 +6139,7 @@ index 99273c907..f84041ca4 100755
  # master key fetch does not segfault.
  mark('#8395 regression test')
 diff --git a/src/tests/t_salt.py b/src/tests/t_salt.py
-index 65084bbf3..55ca89745 100755
+index 65084bbf35..55ca897459 100755
 --- a/src/tests/t_salt.py
 +++ b/src/tests/t_salt.py
 @@ -16,13 +16,12 @@ def test_salt(realm, e1, salt, e2):
@@ -6400,28 +6159,25 @@ index 65084bbf3..55ca89745 100755
  # Test using different salt types in a principal's key list.
  # Parameters from one key in the list must not leak over to later ones.
 diff --git a/src/util/k5test.py b/src/util/k5test.py
-index da2782e15..feb6df7a0 100644
+index 2a86c5cdfc..d823653aa0 100644
 --- a/src/util/k5test.py
 +++ b/src/util/k5test.py
-@@ -1246,16 +1246,6 @@ _passes = [
+@@ -1338,13 +1338,6 @@ _passes = [
      # No special settings; exercises AES256.
      ('default', None, None, None),
  
 -    # Exercise the DES3 enctype.
 -    ('des3', None,
--     {'libdefaults': {
--                'default_tgs_enctypes': 'des3',
--                'default_tkt_enctypes': 'des3',
--                'permitted_enctypes': 'des3'}},
+-     {'libdefaults': {'permitted_enctypes': 'des3'}},
 -     {'realms': {'$realm': {
 -                    'supported_enctypes': 'des3-cbc-sha1:normal',
 -                    'master_key_type': 'des3-cbc-sha1'}}}),
 -
      # Exercise the arcfour enctype.
      ('arcfour', None,
-      {'libdefaults': {
+      {'libdefaults': {'permitted_enctypes': 'rc4'}},
 diff --git a/src/windows/leash/htmlhelp/html/Encryption_Types.htm b/src/windows/leash/htmlhelp/html/Encryption_Types.htm
-index 1aebdd0b4..c38eefd2b 100644
+index 1aebdd0b4a..c38eefd2bd 100644
 --- a/src/windows/leash/htmlhelp/html/Encryption_Types.htm
 +++ b/src/windows/leash/htmlhelp/html/Encryption_Types.htm
 @@ -79,19 +79,6 @@ will have an entry in the Encryption type column. <br>
@@ -6444,3 +6200,6 @@ index 1aebdd0b4..c38eefd2b 100644
  <th id="th2"> aes </th>
       <td>The AES Advanced Encryption Standard
  family, like 3DES, is a symmetric block cipher and was designed
+-- 
+2.45.1
+
diff --git a/krb5-1.17post5-FIPS-with-PRNG-and-RADIUS-without-SPA.patch b/0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
similarity index 76%
rename from krb5-1.17post5-FIPS-with-PRNG-and-RADIUS-without-SPA.patch
rename to 0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
index 29c8f67..989b501 100644
--- a/krb5-1.17post5-FIPS-with-PRNG-and-RADIUS-without-SPA.patch
+++ b/0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
@@ -1,7 +1,7 @@
-From ca3c0fc3fd80b3a9953da47f64beb8b24bd46f08 Mon Sep 17 00:00:00 2001
+From 7b6453903c248a761d3ceb538dfacebbf3d3a9ff Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Fri, 9 Nov 2018 15:12:21 -0500
-Subject: [PATCH] krb5-1.17post5 FIPS with PRNG and RADIUS without SPAKE
+Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4
 
 NB: Use openssl's PRNG in FIPS mode and taint within krad.
 
@@ -15,41 +15,69 @@ This will slow down some calls slightly (FIPS_mode() takes multiple
 locks), but not for any ciphers we care about - which is to say that
 AES is fine.  Shame about SPAKE though.
 
-post5 removes SPAKE entirely.
+post6 restores MD4 (and therefore keygen-only RC4).
+
+post7 restores MD5 and adds radius_md5_fips_override.
+
+post8 silences a static analyzer warning.
+
+Last-updated: krb5-1.20
 ---
- src/lib/crypto/krb/prng.c                     | 11 ++++-
+ doc/admin/conf_files/krb5_conf.rst            |  6 +++
+ src/lib/crypto/krb/prng.c                     | 15 +++++-
  .../crypto/openssl/enc_provider/camellia.c    |  6 +++
  src/lib/crypto/openssl/enc_provider/rc4.c     | 13 +++++-
- .../crypto/openssl/hash_provider/hash_evp.c   |  4 ++
+ .../crypto/openssl/hash_provider/hash_evp.c   | 12 +++++
  src/lib/crypto/openssl/hmac.c                 |  6 ++-
- src/lib/krad/attr.c                           | 45 ++++++++++++++-----
- src/lib/krad/attrset.c                        |  5 ++-
- src/lib/krad/internal.h                       | 13 +++++-
- src/lib/krad/packet.c                         | 22 ++++-----
- src/lib/krad/remote.c                         | 10 ++++-
+ src/lib/krad/attr.c                           | 46 ++++++++++++++-----
+ src/lib/krad/attrset.c                        |  5 +-
+ src/lib/krad/internal.h                       | 28 ++++++++++-
+ src/lib/krad/packet.c                         | 22 +++++----
+ src/lib/krad/remote.c                         | 10 +++-
  src/lib/krad/t_attr.c                         |  3 +-
  src/lib/krad/t_attrset.c                      |  4 +-
  src/plugins/preauth/spake/spake_client.c      |  6 +++
  src/plugins/preauth/spake/spake_kdc.c         |  6 +++
- 14 files changed, 121 insertions(+), 33 deletions(-)
+ 15 files changed, 155 insertions(+), 33 deletions(-)
 
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index f22d5db11b..a33711d918 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -330,6 +330,12 @@ The libdefaults section may contain any of the following relations:
+     qualification of shortnames, set this relation to the empty string
+     with ``qualify_shortname = ""``.  (New in release 1.18.)
+ 
++**radius_md5_fips_override**
++    Downstream-only option to enable use of MD5 in RADIUS
++    communication (libkrad).  This allows for local (or protected
++    tunnel) communication with a RADIUS server that doesn't use krad
++    (e.g., freeradius) while in FIPS mode.
++
+ **rdns**
+     If this flag is true, reverse name lookup will be used in addition
+     to forward name lookup to canonicalizing hostnames for use in
 diff --git a/src/lib/crypto/krb/prng.c b/src/lib/crypto/krb/prng.c
-index cb9ca9b98..f0e9984ca 100644
+index d6b79e2dea..9e80a03d21 100644
 --- a/src/lib/crypto/krb/prng.c
 +++ b/src/lib/crypto/krb/prng.c
-@@ -26,6 +26,8 @@
+@@ -26,6 +26,12 @@
  
  #include "crypto_int.h"
  
 +#include <openssl/rand.h>
++
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#include <openssl/crypto.h>
++#endif
 +
  krb5_error_code KRB5_CALLCONV
  krb5_c_random_seed(krb5_context context, krb5_data *data)
  {
-@@ -99,9 +101,16 @@ krb5_boolean
- k5_get_os_entropy(unsigned char *buf, size_t len, int strong)
+@@ -96,9 +102,16 @@ cleanup:
+ static krb5_boolean
+ get_os_entropy(unsigned char *buf, size_t len)
  {
-     const char *device;
 -#if defined(__linux__) && defined(SYS_getrandom)
      int r;
  
@@ -65,10 +93,10 @@ index cb9ca9b98..f0e9984ca 100644
          /*
           * Pull from the /dev/urandom pool, but require it to have been seeded.
 diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c
-index 2da691329..f79679a0b 100644
+index 01920e6ce1..d9f327add6 100644
 --- a/src/lib/crypto/openssl/enc_provider/camellia.c
 +++ b/src/lib/crypto/openssl/enc_provider/camellia.c
-@@ -304,6 +304,9 @@ krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data,
+@@ -387,6 +387,9 @@ krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data,
      unsigned char blockY[CAMELLIA_BLOCK_SIZE], blockB[CAMELLIA_BLOCK_SIZE];
      struct iov_cursor cursor;
  
@@ -78,7 +106,7 @@ index 2da691329..f79679a0b 100644
      if (output->length < CAMELLIA_BLOCK_SIZE)
          return KRB5_BAD_MSIZE;
  
-@@ -331,6 +334,9 @@ static krb5_error_code
+@@ -418,6 +421,9 @@ static krb5_error_code
  krb5int_camellia_init_state (const krb5_keyblock *key, krb5_keyusage usage,
                               krb5_data *state)
  {
@@ -89,10 +117,10 @@ index 2da691329..f79679a0b 100644
      state->data = (void *) malloc(16);
      if (state->data == NULL)
 diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c
-index a65d57b7a..6ccaca94a 100644
+index 448d563348..ce63cb5f1b 100644
 --- a/src/lib/crypto/openssl/enc_provider/rc4.c
 +++ b/src/lib/crypto/openssl/enc_provider/rc4.c
-@@ -66,6 +66,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
+@@ -69,6 +69,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
      EVP_CIPHER_CTX *ctx = NULL;
      struct arcfour_state *arcstate;
  
@@ -102,7 +130,7 @@ index a65d57b7a..6ccaca94a 100644
      arcstate = (state != NULL) ? (void *)state->data : NULL;
      if (arcstate != NULL) {
          ctx = arcstate->ctx;
-@@ -113,7 +116,12 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
+@@ -116,7 +119,12 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
  static void
  k5_arcfour_free_state(krb5_data *state)
  {
@@ -116,7 +144,7 @@ index a65d57b7a..6ccaca94a 100644
  
      EVP_CIPHER_CTX_free(arcstate->ctx);
      free(arcstate);
-@@ -125,6 +133,9 @@ k5_arcfour_init_state(const krb5_keyblock *key,
+@@ -128,6 +136,9 @@ k5_arcfour_init_state(const krb5_keyblock *key,
  {
      struct arcfour_state *arcstate;
  
@@ -127,56 +155,64 @@ index a65d57b7a..6ccaca94a 100644
       * The cipher state here is a saved pointer to a struct arcfour_state
       * object, rather than a flat byte array as in most enc providers.  The
 diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c
-index 957ed8d9c..8c1fd7f59 100644
+index f2fbffdb29..11659908bb 100644
 --- a/src/lib/crypto/openssl/hash_provider/hash_evp.c
 +++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c
-@@ -64,12 +64,16 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
+@@ -60,6 +60,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
+     if (ctx == NULL)
+         return ENOMEM;
+ 
++    if (type == EVP_md4() || type == EVP_md5()) {
++        /* See comments below in hash_md4() and hash_md5(). */
++        EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
++    }
++
+     ok = EVP_DigestInit_ex(ctx, type, NULL);
+     for (i = 0; i < num_data; i++) {
+         if (!SIGN_IOV(&data[i]))
+@@ -78,6 +83,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
  static krb5_error_code
  hash_md4(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
  {
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
++    /*
++     * MD4 is needed in FIPS mode to perform key generation for RC4 keys used
++     * by IPA.  These keys are only used along a (separately) secured channel
++     * for legacy reasons when performing trusts to Active Directory.
++     */
      return hash_evp(EVP_md4(), data, num_data, output);
  }
  
+@@ -90,6 +100,8 @@ const struct krb5_hash_provider krb5int_hash_md4 = {
  static krb5_error_code
  hash_md5(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
  {
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
++    /* MD5 is needed in FIPS mode for communication with RADIUS servers.  This
++     * is gated in libkrad by libdefaults->radius_md5_fips_override. */
      return hash_evp(EVP_md5(), data, num_data, output);
  }
  
 diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c
-index 7dc59dcc0..769a50c00 100644
+index bf12b8d6a0..f21e268f7f 100644
 --- a/src/lib/crypto/openssl/hmac.c
 +++ b/src/lib/crypto/openssl/hmac.c
-@@ -103,7 +103,11 @@ map_digest(const struct krb5_hash_provider *hash)
+@@ -111,7 +111,11 @@ map_digest(const struct krb5_hash_provider *hash)
          return EVP_sha256();
-     else if (!strncmp(hash->hash_name, "SHA-384",7))
+     else if (hash == &krb5int_hash_sha384)
          return EVP_sha384();
--    else if (!strncmp(hash->hash_name, "MD5", 3))
+-    else if (hash == &krb5int_hash_md5)
 +
 +    if (FIPS_mode())
 +        return NULL;
 +
-+    if (!strncmp(hash->hash_name, "MD5", 3))
++    if (hash == &krb5int_hash_md5)
          return EVP_md5();
-     else if (!strncmp(hash->hash_name, "MD4", 3))
+     else if (hash == &krb5int_hash_md4)
          return EVP_md4();
 diff --git a/src/lib/krad/attr.c b/src/lib/krad/attr.c
-index 9c13d9d75..275327e67 100644
+index 9c13d9d755..42d354a3b5 100644
 --- a/src/lib/krad/attr.c
 +++ b/src/lib/krad/attr.c
-@@ -30,6 +30,7 @@
- #include <k5-int.h>
- #include "internal.h"
- 
-+#include <openssl/crypto.h>
- #include <string.h>
- 
- /* RFC 2865 */
-@@ -38,7 +39,8 @@
+@@ -38,7 +38,8 @@
  typedef krb5_error_code
  (*attribute_transform_fn)(krb5_context ctx, const char *secret,
                            const unsigned char *auth, const krb5_data *in,
@@ -186,7 +222,7 @@ index 9c13d9d75..275327e67 100644
  
  typedef struct {
      const char *name;
-@@ -51,12 +53,14 @@ typedef struct {
+@@ -51,12 +52,14 @@ typedef struct {
  static krb5_error_code
  user_password_encode(krb5_context ctx, const char *secret,
                       const unsigned char *auth, const krb5_data *in,
@@ -203,7 +239,7 @@ index 9c13d9d75..275327e67 100644
  
  static const attribute_record attributes[UCHAR_MAX] = {
      {"User-Name", 1, MAX_ATTRSIZE, NULL, NULL},
-@@ -128,7 +132,8 @@ static const attribute_record attributes[UCHAR_MAX] = {
+@@ -128,7 +131,8 @@ static const attribute_record attributes[UCHAR_MAX] = {
  static krb5_error_code
  user_password_encode(krb5_context ctx, const char *secret,
                       const unsigned char *auth, const krb5_data *in,
@@ -213,20 +249,21 @@ index 9c13d9d75..275327e67 100644
  {
      const unsigned char *indx;
      krb5_error_code retval;
-@@ -154,8 +159,14 @@ user_password_encode(krb5_context ctx, const char *secret,
+@@ -154,8 +158,15 @@ user_password_encode(krb5_context ctx, const char *secret,
      for (blck = 0, indx = auth; blck * BLOCKSIZE < len; blck++) {
          memcpy(tmp.data + seclen, indx, BLOCKSIZE);
  
 -        retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &tmp,
 -                                      &sum);
-+        if (FIPS_mode()) {
++        if (kr_use_fips(ctx)) {
 +            /* Skip encryption here.  Taint so that we won't pass it out of
 +             * the machine by accident. */
 +            *is_fips = TRUE;
 +            sum.contents = calloc(1, BLOCKSIZE);
-+        } else
++        } else {
 +            retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &tmp,
 +                                          &sum);
++        }
          if (retval != 0) {
              zap(tmp.data, tmp.length);
              zap(outbuf, len);
@@ -240,24 +277,25 @@ index 9c13d9d75..275327e67 100644
  {
      const unsigned char *indx;
      krb5_error_code retval;
-@@ -204,8 +216,14 @@ user_password_decode(krb5_context ctx, const char *secret,
+@@ -204,8 +216,15 @@ user_password_decode(krb5_context ctx, const char *secret,
      for (blck = 0, indx = auth; blck * BLOCKSIZE < in->length; blck++) {
          memcpy(tmp.data + seclen, indx, BLOCKSIZE);
  
 -        retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0,
 -                                      &tmp, &sum);
-+        if (FIPS_mode()) {
++        if (kr_use_fips(ctx)) {
 +            /* Skip encryption here.  Taint so that we won't pass it out of
 +             * the machine by accident. */
 +            *is_fips = TRUE;
 +            sum.contents = calloc(1, BLOCKSIZE);
-+        } else
++        } else {
 +            retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0,
 +                                          &tmp, &sum);
++        }
          if (retval != 0) {
              zap(tmp.data, tmp.length);
              zap(outbuf, in->length);
-@@ -248,7 +266,7 @@ krb5_error_code
+@@ -248,7 +267,7 @@ krb5_error_code
  kr_attr_encode(krb5_context ctx, const char *secret,
                 const unsigned char *auth, krad_attr type,
                 const krb5_data *in, unsigned char outbuf[MAX_ATTRSIZE],
@@ -266,7 +304,7 @@ index 9c13d9d75..275327e67 100644
  {
      krb5_error_code retval;
  
-@@ -265,7 +283,8 @@ kr_attr_encode(krb5_context ctx, const char *secret,
+@@ -265,7 +284,8 @@ kr_attr_encode(krb5_context ctx, const char *secret,
          return 0;
      }
  
@@ -276,7 +314,7 @@ index 9c13d9d75..275327e67 100644
  }
  
  krb5_error_code
-@@ -274,6 +293,7 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
+@@ -274,6 +294,7 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
                 unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen)
  {
      krb5_error_code retval;
@@ -284,7 +322,7 @@ index 9c13d9d75..275327e67 100644
  
      retval = kr_attr_valid(type, in);
      if (retval != 0)
-@@ -288,7 +308,8 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
+@@ -288,7 +309,8 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
          return 0;
      }
  
@@ -295,7 +333,7 @@ index 9c13d9d75..275327e67 100644
  
  krad_attr
 diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c
-index 03c613716..d89982a13 100644
+index f309f1581c..6ec031e320 100644
 --- a/src/lib/krad/attrset.c
 +++ b/src/lib/krad/attrset.c
 @@ -167,7 +167,8 @@ krad_attrset_copy(const krad_attrset *set, krad_attrset **copy)
@@ -318,10 +356,19 @@ index 03c613716..d89982a13 100644
              return retval;
  
 diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h
-index 996a89372..a53ce31ce 100644
+index 7619563fc5..e123763954 100644
 --- a/src/lib/krad/internal.h
 +++ b/src/lib/krad/internal.h
-@@ -49,6 +49,13 @@
+@@ -39,6 +39,8 @@
+ #include <sys/socket.h>
+ #include <netdb.h>
+ 
++#include <openssl/crypto.h>
++
+ #ifndef UCHAR_MAX
+ #define UCHAR_MAX 255
+ #endif
+@@ -49,6 +51,13 @@
  
  typedef struct krad_remote_st krad_remote;
  
@@ -335,7 +382,7 @@ index 996a89372..a53ce31ce 100644
  /* Validate constraints of an attribute. */
  krb5_error_code
  kr_attr_valid(krad_attr type, const krb5_data *data);
-@@ -57,7 +64,8 @@ kr_attr_valid(krad_attr type, const krb5_data *data);
+@@ -57,7 +66,8 @@ kr_attr_valid(krad_attr type, const krb5_data *data);
  krb5_error_code
  kr_attr_encode(krb5_context ctx, const char *secret, const unsigned char *auth,
                 krad_attr type, const krb5_data *in,
@@ -345,7 +392,7 @@ index 996a89372..a53ce31ce 100644
  
  /* Decode an attribute. */
  krb5_error_code
-@@ -69,7 +77,8 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
+@@ -69,7 +79,8 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
  krb5_error_code
  kr_attrset_encode(const krad_attrset *set, const char *secret,
                    const unsigned char *auth,
@@ -355,19 +402,29 @@ index 996a89372..a53ce31ce 100644
  
  /* Decode attributes from a buffer. */
  krb5_error_code
+@@ -156,4 +167,17 @@ gai_error_code(int err)
+     }
+ }
+ 
++static inline krb5_boolean
++kr_use_fips(krb5_context ctx)
++{
++    int val = 0;
++
++    if (!FIPS_mode())
++        return 0;
++
++    (void)profile_get_boolean(ctx->profile, "libdefaults",
++                              "radius_md5_fips_override", NULL, 0, &val);
++    return !val;
++}
++
+ #endif /* INTERNAL_H_ */
 diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c
-index c597174b6..794ac84c4 100644
+index c597174b65..fc2d248001 100644
 --- a/src/lib/krad/packet.c
 +++ b/src/lib/krad/packet.c
-@@ -32,6 +32,7 @@
- #include <string.h>
- 
- #include <arpa/inet.h>
-+#include <openssl/crypto.h>
- 
- typedef unsigned char uchar;
- 
-@@ -53,12 +54,6 @@ typedef unsigned char uchar;
+@@ -53,12 +53,6 @@ typedef unsigned char uchar;
  #define pkt_auth(p) ((uchar *)offset(&(p)->pkt, OFFSET_AUTH))
  #define pkt_attr(p) ((unsigned char *)offset(&(p)->pkt, OFFSET_ATTR))
  
@@ -380,19 +437,20 @@ index c597174b6..794ac84c4 100644
  typedef struct {
      uchar x[(UCHAR_MAX + 1) / 8];
  } idmap;
-@@ -187,8 +182,13 @@ auth_generate_response(krb5_context ctx, const char *secret,
+@@ -187,8 +181,14 @@ auth_generate_response(krb5_context ctx, const char *secret,
      memcpy(data.data + response->pkt.length, secret, strlen(secret));
  
      /* Hash it. */
 -    retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &data,
 -                                  &hash);
-+    if (FIPS_mode()) {
++    if (kr_use_fips(ctx)) {
 +        /* This checksum does very little security-wise anyway, so don't
 +         * taint. */
 +        hash.contents = calloc(1, AUTH_FIELD_SIZE);
-+    } else
++    } else {
 +        retval = krb5_c_make_checksum(ctx, CKSUMTYPE_RSA_MD5, NULL, 0, &data,
 +                                      &hash);
++    }
      free(data.data);
      if (retval != 0)
          return retval;
@@ -424,7 +482,7 @@ index c597174b6..794ac84c4 100644
  }
  
 diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
-index 437f7e91a..0f90443ce 100644
+index 06ae751bc8..929f1cef67 100644
 --- a/src/lib/krad/remote.c
 +++ b/src/lib/krad/remote.c
 @@ -263,7 +263,7 @@ on_io_write(krad_remote *rr)
@@ -445,7 +503,7 @@ index 437f7e91a..0f90443ce 100644
                  request_finish(r, 0, rsp);
                  break;
              }
-@@ -455,6 +455,12 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs,
+@@ -460,6 +460,12 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs,
                                       (krad_packet_iter_cb)iterator, &r, &tmp);
      if (retval != 0)
          goto error;
@@ -459,7 +517,7 @@ index 437f7e91a..0f90443ce 100644
      K5_TAILQ_FOREACH(r, &rr->list, list) {
          if (r->request == tmp) {
 diff --git a/src/lib/krad/t_attr.c b/src/lib/krad/t_attr.c
-index eb2a780c8..4d285ad9d 100644
+index eb2a780c89..4d285ad9de 100644
 --- a/src/lib/krad/t_attr.c
 +++ b/src/lib/krad/t_attr.c
 @@ -50,6 +50,7 @@ main()
@@ -480,7 +538,7 @@ index eb2a780c8..4d285ad9d 100644
      insist(len == sizeof(encoded));
      insist(memcmp(outbuf, encoded, len) == 0);
 diff --git a/src/lib/krad/t_attrset.c b/src/lib/krad/t_attrset.c
-index 7928335ca..0f9576253 100644
+index 7928335ca4..0f95762534 100644
 --- a/src/lib/krad/t_attrset.c
 +++ b/src/lib/krad/t_attrset.c
 @@ -49,6 +49,7 @@ main()
@@ -502,7 +560,7 @@ index 7928335ca..0f9576253 100644
  
      /* Manually encode User-Name. */
 diff --git a/src/plugins/preauth/spake/spake_client.c b/src/plugins/preauth/spake/spake_client.c
-index 00734a13b..a3ce22b70 100644
+index 00734a13b5..a3ce22b70f 100644
 --- a/src/plugins/preauth/spake/spake_client.c
 +++ b/src/plugins/preauth/spake/spake_client.c
 @@ -38,6 +38,8 @@
@@ -526,7 +584,7 @@ index 00734a13b..a3ce22b70 100644
      vt->name = "spake";
      vt->pa_type_list = pa_types;
 diff --git a/src/plugins/preauth/spake/spake_kdc.c b/src/plugins/preauth/spake/spake_kdc.c
-index 59e88409e..1b3e569e9 100644
+index 1a772d450f..232e78bc05 100644
 --- a/src/plugins/preauth/spake/spake_kdc.c
 +++ b/src/plugins/preauth/spake/spake_kdc.c
 @@ -41,6 +41,8 @@
@@ -538,7 +596,7 @@ index 59e88409e..1b3e569e9 100644
  /*
   * The SPAKE kdcpreauth module uses a secure cookie containing the following
   * concatenated fields (all integer fields are big-endian):
-@@ -578,6 +580,10 @@ kdcpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver,
+@@ -551,6 +553,10 @@ kdcpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver,
  
      if (maj_ver != 1)
          return KRB5_PLUGIN_VER_NOTSUPP;
@@ -549,3 +607,6 @@ index 59e88409e..1b3e569e9 100644
      vt = (krb5_kdcpreauth_vtable)vtable;
      vt->name = "spake";
      vt->pa_type_list = pa_types;
+-- 
+2.45.1
+
diff --git a/0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch b/0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch
new file mode 100644
index 0000000..b339700
--- /dev/null
+++ b/0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch
@@ -0,0 +1,82 @@
+From 707fa7bd2be6327343dc8fc5c20dc77645524518 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 5 May 2022 17:15:12 +0200
+Subject: [PATCH] [downstream] Allow krad UDP/TCP localhost connection
+ with FIPS
+
+libkrad allows to establish connections only to UNIX socket in FIPS
+mode, because MD5 digest is not considered safe enough to be used for
+network communication. However, FreeRadius requires connection on TCP or
+UDP ports.
+
+This commit allows TCP or UDP connections in FIPS mode if destination is
+localhost.
+
+Resolves: rhbz#2082189
+---
+ src/lib/krad/remote.c | 35 +++++++++++++++++++++++++++++++++--
+ 1 file changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
+index 929f1cef67..063f17a613 100644
+--- a/src/lib/krad/remote.c
++++ b/src/lib/krad/remote.c
+@@ -33,6 +33,7 @@
+ 
+ #include <string.h>
+ #include <unistd.h>
++#include <stdbool.h>
+ 
+ #include <sys/un.h>
+ 
+@@ -74,6 +75,35 @@ on_io(verto_ctx *ctx, verto_ev *ev);
+ static void
+ on_timeout(verto_ctx *ctx, verto_ev *ev);
+ 
++static in_addr_t get_in_addr(struct addrinfo *info)
++{ return ((struct sockaddr_in *)(info->ai_addr))->sin_addr.s_addr; }
++
++static struct in6_addr *get_in6_addr(struct addrinfo *info)
++{ return &(((struct sockaddr_in6 *)(info->ai_addr))->sin6_addr); }
++
++static bool is_inet_localhost(struct addrinfo *info)
++{
++    struct addrinfo *p;
++
++    for (p = info; p; p = p->ai_next) {
++        switch (p->ai_family) {
++            case AF_INET:
++                if (IN_LOOPBACKNET != (get_in_addr(p) & IN_CLASSA_NET
++                                                      >> IN_CLASSA_NSHIFT))
++                    return false;
++                break;
++            case AF_INET6:
++                if (!IN6_IS_ADDR_LOOPBACK(get_in6_addr(p)))
++                    return false;
++                break;
++            default:
++                return false;
++        }
++    }
++
++    return true;
++}
++
+ /* Iterate over the set of outstanding packets. */
+ static const krad_packet *
+ iterator(request **out)
+@@ -460,8 +490,9 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs,
+                                      (krad_packet_iter_cb)iterator, &r, &tmp);
+     if (retval != 0)
+         goto error;
+-    else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL &&
+-        rr->info->ai_family != AF_UNIX) {
++    else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL
++                          && rr->info->ai_family != AF_UNIX
++                          && !is_inet_localhost(rr->info)) {
+         /* This would expose cleartext passwords, so abort. */
+         retval = ESOCKTNOSUPPORT;
+         goto error;
+-- 
+2.45.1
+
diff --git a/0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch b/0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch
new file mode 100644
index 0000000..ceb9595
--- /dev/null
+++ b/0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch
@@ -0,0 +1,41 @@
+From 1da88bea558348be2974470774aa688f8be634c0 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Wed, 7 Dec 2022 13:22:42 +0100
+Subject: [PATCH] [downstream] Make tests compatible with
+ sssd_krb5_locator_plugin.so
+
+The sssd_krb5_locator_plugin.so plugin provided by sssd-client conflicts
+with the upstream test t_discover_uri.py. The test has to be modified in
+order to avoid false positive.
+---
+ src/lib/krb5/os/t_discover_uri.py | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/krb5/os/t_discover_uri.py b/src/lib/krb5/os/t_discover_uri.py
+index 87bac17929..26bc95a8dc 100644
+--- a/src/lib/krb5/os/t_discover_uri.py
++++ b/src/lib/krb5/os/t_discover_uri.py
+@@ -1,3 +1,4 @@
++from os.path import exists
+ from k5test import *
+ 
+ entries = ('URI _kerberos.TEST krb5srv::kkdcp:https://kdc1 1 1\n',
+@@ -37,8 +38,14 @@ realm.env['RESOLV_WRAPPER_HOSTS'] = hosts_filename
+ out = realm.run(['./t_locate_kdc', 'TEST'], env=realm.env)
+ l = out.splitlines()
+ 
++if (exists('/usr/lib/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so')
++    or exists('/usr/lib64/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so')):
++    line_range = range(6, 14)
++else:
++    line_range = range(4, 12)
++
+ j = 0
+-for i in range(4, 12):
++for i in line_range:
+     if l[i].strip() != expected[j]:
+         fail('URI answers do not match')
+     j += 1
+-- 
+2.45.1
+
diff --git a/0009-downstream-Include-missing-OpenSSL-FIPS-header.patch b/0009-downstream-Include-missing-OpenSSL-FIPS-header.patch
new file mode 100644
index 0000000..ef6f825
--- /dev/null
+++ b/0009-downstream-Include-missing-OpenSSL-FIPS-header.patch
@@ -0,0 +1,120 @@
+From 775ed8588cc21385fb16a4cec4a861f0d578ce04 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 5 Jan 2023 20:06:47 +0100
+Subject: [PATCH] [downstream] Include missing OpenSSL FIPS header
+
+The inclusion of openssl/fips.h, which provides the declaration of
+FIPS_mode(), was removed from openssl/crypto.h. As a consequence, this
+header file has to be included explicitly in krb5 code.
+---
+ src/lib/crypto/krb/prng.c                      | 4 +++-
+ src/lib/crypto/openssl/enc_provider/camellia.c | 1 +
+ src/lib/crypto/openssl/enc_provider/rc4.c      | 4 ++++
+ src/lib/crypto/openssl/hmac.c                  | 1 +
+ src/lib/krad/internal.h                        | 4 ++++
+ src/plugins/preauth/spake/spake_client.c       | 4 ++++
+ src/plugins/preauth/spake/spake_kdc.c          | 4 ++++
+ 7 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/crypto/krb/prng.c b/src/lib/crypto/krb/prng.c
+index 9e80a03d21..ae37c77518 100644
+--- a/src/lib/crypto/krb/prng.c
++++ b/src/lib/crypto/krb/prng.c
+@@ -28,7 +28,9 @@
+ 
+ #include <openssl/rand.h>
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#include <openssl/fips.h>
++#else
+ #include <openssl/crypto.h>
+ #endif
+ 
+diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c
+index d9f327add6..3dd3b0624f 100644
+--- a/src/lib/crypto/openssl/enc_provider/camellia.c
++++ b/src/lib/crypto/openssl/enc_provider/camellia.c
+@@ -32,6 +32,7 @@
+ #include <openssl/camellia.h>
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ #include <openssl/core_names.h>
++#include <openssl/fips.h>
+ #else
+ #include <openssl/modes.h>
+ #endif
+diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c
+index ce63cb5f1b..6a83f10d27 100644
+--- a/src/lib/crypto/openssl/enc_provider/rc4.c
++++ b/src/lib/crypto/openssl/enc_provider/rc4.c
+@@ -38,6 +38,10 @@
+ 
+ #include <openssl/evp.h>
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#include <openssl/fips.h>
++#endif
++
+ /*
+  * The loopback field is a pointer to the structure.  If the application copies
+  * the state (not a valid operation, but one which happens to works with some
+diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c
+index f21e268f7f..25a419d73a 100644
+--- a/src/lib/crypto/openssl/hmac.c
++++ b/src/lib/crypto/openssl/hmac.c
+@@ -59,6 +59,7 @@
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ #include <openssl/params.h>
+ #include <openssl/core_names.h>
++#include <openssl/fips.h>
+ #else
+ #include <openssl/hmac.h>
+ #endif
+diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h
+index e123763954..a17b6f39b1 100644
+--- a/src/lib/krad/internal.h
++++ b/src/lib/krad/internal.h
+@@ -41,6 +41,10 @@
+ 
+ #include <openssl/crypto.h>
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#include <openssl/fips.h>
++#endif
++
+ #ifndef UCHAR_MAX
+ #define UCHAR_MAX 255
+ #endif
+diff --git a/src/plugins/preauth/spake/spake_client.c b/src/plugins/preauth/spake/spake_client.c
+index a3ce22b70f..13c699071f 100644
+--- a/src/plugins/preauth/spake/spake_client.c
++++ b/src/plugins/preauth/spake/spake_client.c
+@@ -40,6 +40,10 @@
+ 
+ #include <openssl/crypto.h>
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#include <openssl/fips.h>
++#endif
++
+ typedef struct reqstate_st {
+     krb5_pa_spake *msg;         /* set in prep_questions, used in process */
+     krb5_keyblock *initial_key;
+diff --git a/src/plugins/preauth/spake/spake_kdc.c b/src/plugins/preauth/spake/spake_kdc.c
+index 232e78bc05..3394f8a58e 100644
+--- a/src/plugins/preauth/spake/spake_kdc.c
++++ b/src/plugins/preauth/spake/spake_kdc.c
+@@ -43,6 +43,10 @@
+ 
+ #include <openssl/crypto.h>
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++#include <openssl/fips.h>
++#endif
++
+ /*
+  * The SPAKE kdcpreauth module uses a secure cookie containing the following
+  * concatenated fields (all integer fields are big-endian):
+-- 
+2.45.1
+
diff --git a/0010-downstream-Do-not-set-root-as-ksu-file-owner.patch b/0010-downstream-Do-not-set-root-as-ksu-file-owner.patch
new file mode 100644
index 0000000..bd4ab77
--- /dev/null
+++ b/0010-downstream-Do-not-set-root-as-ksu-file-owner.patch
@@ -0,0 +1,31 @@
+From 4fd20741afcf76085ea62eb015cd589bb9392a7b Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Mon, 9 Jan 2023 22:39:52 +0100
+Subject: [PATCH] [downstream] Do not set root as ksu file owner
+
+Upstream Makefile uses the install command to set root as owner of the
+ksu executable file. However, this is no longer supported on latest
+versions of the Mock build environment.
+
+In case of ksu, the owner, group, and mode are already set using %attr()
+in the specfile.
+---
+ src/config/pre.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/config/pre.in b/src/config/pre.in
+index 7eaa2f351c..e9ae71471e 100644
+--- a/src/config/pre.in
++++ b/src/config/pre.in
+@@ -185,7 +185,7 @@ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP)
+ INSTALL_SCRIPT=@INSTALL_PROGRAM@
+ INSTALL_DATA=@INSTALL_DATA@
+ INSTALL_SHLIB=@INSTALL_SHLIB@
+-INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
++INSTALL_SETUID=$(INSTALL)
+ ## This is needed because autoconf will sometimes define @exec_prefix@ to be
+ ## ${prefix}.
+ prefix=@prefix@
+-- 
+2.45.1
+
diff --git a/0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch b/0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch
new file mode 100644
index 0000000..5e45141
--- /dev/null
+++ b/0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch
@@ -0,0 +1,165 @@
+From 16f90c007036789d8d9343e8a0cbabfd21853b5a Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 19 Jan 2023 19:22:27 +0100
+Subject: [PATCH] [downstream] Allow KRB5KDF, MD5, and MD4 in FIPS mode
+
+OpenSSL's restrictions to use KRB5KDF, MD5, and MD4 in FIPS mode are
+bypassed in case AES SHA-1 HMAC or RC4 encryption types are allowed by
+the crypto policy.
+---
+ .../crypto/openssl/hash_provider/hash_evp.c   | 97 +++++++++++++++++--
+ src/lib/crypto/openssl/kdf.c                  |  2 +-
+ 2 files changed, 89 insertions(+), 10 deletions(-)
+
+diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c
+index 11659908bb..eb2e693e9f 100644
+--- a/src/lib/crypto/openssl/hash_provider/hash_evp.c
++++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c
+@@ -44,6 +44,49 @@
+ #define EVP_MD_CTX_free EVP_MD_CTX_destroy
+ #endif
+ 
++#include <openssl/provider.h>
++#include <openssl/fips.h>
++#include <threads.h>
++
++typedef struct ossl_lib_md_context {
++    OSSL_LIB_CTX *libctx;
++    OSSL_PROVIDER *default_provider;
++    OSSL_PROVIDER *legacy_provider;
++} ossl_md_context_t;
++
++static thread_local ossl_md_context_t *ossl_md_ctx = NULL;
++
++static krb5_error_code
++init_ossl_md_ctx(ossl_md_context_t *ctx, const char *algo)
++{
++    ctx->libctx = OSSL_LIB_CTX_new();
++    if (!ctx->libctx)
++        return KRB5_CRYPTO_INTERNAL;
++
++    /* Load both legacy and default provider as both may be needed. */
++    ctx->default_provider = OSSL_PROVIDER_load(ctx->libctx, "default");
++    ctx->legacy_provider = OSSL_PROVIDER_load(ctx->libctx, "legacy");
++
++    if (!(ctx->default_provider && ctx->legacy_provider))
++        return KRB5_CRYPTO_INTERNAL;
++
++    return 0;
++}
++
++static void
++deinit_ossl_ctx(ossl_md_context_t *ctx)
++{
++    if (ctx->legacy_provider)
++        OSSL_PROVIDER_unload(ctx->legacy_provider);
++
++    if (ctx->default_provider)
++        OSSL_PROVIDER_unload(ctx->default_provider);
++
++    if (ctx->libctx)
++        OSSL_LIB_CTX_free(ctx->libctx);
++}
++
++
+ static krb5_error_code
+ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
+          krb5_data *output)
+@@ -60,11 +103,6 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
+     if (ctx == NULL)
+         return ENOMEM;
+ 
+-    if (type == EVP_md4() || type == EVP_md5()) {
+-        /* See comments below in hash_md4() and hash_md5(). */
+-        EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+-    }
+-
+     ok = EVP_DigestInit_ex(ctx, type, NULL);
+     for (i = 0; i < num_data; i++) {
+         if (!SIGN_IOV(&data[i]))
+@@ -77,6 +115,43 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
+     return ok ? 0 : KRB5_CRYPTO_INTERNAL;
+ }
+ 
++static krb5_error_code
++hash_legacy_evp(const char *algo, const krb5_crypto_iov *data, size_t num_data,
++                krb5_data *output)
++{
++    krb5_error_code err;
++    EVP_MD *md = NULL;
++
++    if (!ossl_md_ctx) {
++        ossl_md_ctx = malloc(sizeof(ossl_md_context_t));
++        if (!ossl_md_ctx) {
++            err = ENOMEM;
++            goto end;
++        }
++
++        err = init_ossl_md_ctx(ossl_md_ctx, algo);
++        if (err) {
++            deinit_ossl_ctx(ossl_md_ctx);
++            free(ossl_md_ctx);
++            ossl_md_ctx = NULL;
++            goto end;
++        }
++    }
++
++    md = EVP_MD_fetch(ossl_md_ctx->libctx, algo, NULL);
++    if (!md) {
++        err = KRB5_CRYPTO_INTERNAL;
++        goto end;
++    }
++
++    err = hash_evp(md, data, num_data, output);
++
++end:
++    if (md)
++        EVP_MD_free(md);
++
++    return err;
++}
+ #endif
+ 
+ #ifdef K5_OPENSSL_MD4
+@@ -88,7 +163,8 @@ hash_md4(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
+      * by IPA.  These keys are only used along a (separately) secured channel
+      * for legacy reasons when performing trusts to Active Directory.
+      */
+-    return hash_evp(EVP_md4(), data, num_data, output);
++    return FIPS_mode() ? hash_legacy_evp("MD4", data, num_data, output)
++                       : hash_evp(EVP_md4(), data, num_data, output);
+ }
+ 
+ const struct krb5_hash_provider krb5int_hash_md4 = {
+@@ -100,9 +176,12 @@ const struct krb5_hash_provider krb5int_hash_md4 = {
+ static krb5_error_code
+ hash_md5(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
+ {
+-    /* MD5 is needed in FIPS mode for communication with RADIUS servers.  This
+-     * is gated in libkrad by libdefaults->radius_md5_fips_override. */
+-    return hash_evp(EVP_md5(), data, num_data, output);
++    /*
++     * MD5 is needed in FIPS mode for communication with RADIUS servers.  This
++     * is gated in libkrad by libdefaults->radius_md5_fips_override.
++     */
++    return FIPS_mode() ? hash_legacy_evp("MD5", data, num_data, output)
++                       : hash_evp(EVP_md5(), data, num_data, output);
+ }
+ 
+ const struct krb5_hash_provider krb5int_hash_md5 = {
+diff --git a/src/lib/crypto/openssl/kdf.c b/src/lib/crypto/openssl/kdf.c
+index 5a43c3d9eb..8528ddc4a9 100644
+--- a/src/lib/crypto/openssl/kdf.c
++++ b/src/lib/crypto/openssl/kdf.c
+@@ -198,7 +198,7 @@ k5_derive_random_rfc3961(const struct krb5_enc_provider *enc, krb5_key key,
+         goto done;
+     }
+ 
+-    kdf = EVP_KDF_fetch(NULL, "KRB5KDF", NULL);
++    kdf = EVP_KDF_fetch(NULL, "KRB5KDF", "-fips");
+     if (kdf == NULL) {
+         ret = KRB5_CRYPTO_INTERNAL;
+         goto done;
+-- 
+2.45.1
+
diff --git a/0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch b/0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch
new file mode 100644
index 0000000..57b4a76
--- /dev/null
+++ b/0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch
@@ -0,0 +1,280 @@
+From 23b58199db429603802e338db530677b61561335 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Wed, 15 Mar 2023 15:56:34 +0100
+Subject: [PATCH] [downstream] Allow to set PAC ticket signature as
+ optional
+
+MS-PAC states that "The ticket signature SHOULD be included in tickets
+that are not encrypted to the krbtgt account". However, the
+implementation of krb5_kdc_verify_ticket() will require the ticket
+signature to be present in case the target of the request is a service
+principal.
+
+In gradual upgrade environments, it results in S4U2Proxy requests
+against a 1.20 KDC using a service ticket generated by an older version
+KDC to fail.
+
+This commit adds a krb5_kdc_verify_ticket_ext() function with an extra
+switch parameter to tolerate the absence of ticket signature in this
+scenario. If the ticket signature is present, it has to be valid,
+regardless of this parameter.
+
+This parameter is set based on the "optional_pac_tkt_chksum" string
+attribute of the TGT KDB entry.
+---
+ doc/admin/admin_commands/kadmin_local.rst |  6 ++++
+ doc/appdev/refs/api/index.rst             |  1 +
+ src/include/kdb.h                         |  1 +
+ src/include/krb5/krb5.hin                 | 40 +++++++++++++++++++++++
+ src/kdc/kdc_util.c                        | 32 ++++++++++++++----
+ src/lib/krb5/krb/pac.c                    | 31 +++++++++++++++---
+ src/lib/krb5/libkrb5.exports              |  1 +
+ src/man/kadmin.man                        |  6 ++++
+ 8 files changed, 108 insertions(+), 10 deletions(-)
+
+diff --git a/doc/admin/admin_commands/kadmin_local.rst b/doc/admin/admin_commands/kadmin_local.rst
+index 2435b3c361..58ac79549f 100644
+--- a/doc/admin/admin_commands/kadmin_local.rst
++++ b/doc/admin/admin_commands/kadmin_local.rst
+@@ -658,6 +658,12 @@ KDC:
+     Directory realm when using aes-sha2 keys on the local krbtgt
+     entry.
+ 
++**optional_pac_tkt_chksum**
++    Boolean value defining the behavior of the KDC in case an expected
++    ticket checksum signed with one of this principal keys is not
++    present in the PAC. This is typically the case for TGS or
++    cross-realm TGS principals when processing S4U2Proxy requests.
++
+ This command requires the **modify** privilege.
+ 
+ Alias: **setstr**
+diff --git a/doc/appdev/refs/api/index.rst b/doc/appdev/refs/api/index.rst
+index d12be47c3c..9b95ebd0f9 100644
+--- a/doc/appdev/refs/api/index.rst
++++ b/doc/appdev/refs/api/index.rst
+@@ -225,6 +225,7 @@ Rarely used public interfaces
+    krb5_is_referral_realm.rst
+    krb5_kdc_sign_ticket.rst
+    krb5_kdc_verify_ticket.rst
++   krb5_kdc_verify_ticket_ext.rst
+    krb5_kt_add_entry.rst
+    krb5_kt_end_seq_get.rst
+    krb5_kt_get_entry.rst
+diff --git a/src/include/kdb.h b/src/include/kdb.h
+index 745b24f351..6075349e5e 100644
+--- a/src/include/kdb.h
++++ b/src/include/kdb.h
+@@ -136,6 +136,7 @@
+ #define KRB5_KDB_SK_PAC_PRIVSVR_ENCTYPE         "pac_privsvr_enctype"
+ #define KRB5_KDB_SK_SESSION_ENCTYPES            "session_enctypes"
+ #define KRB5_KDB_SK_REQUIRE_AUTH                "require_auth"
++#define KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM     "optional_pac_tkt_chksum"
+ 
+ #if !defined(_WIN32)
+ 
+diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
+index c5a625db8f..2d9b64dc85 100644
+--- a/src/include/krb5/krb5.hin
++++ b/src/include/krb5/krb5.hin
+@@ -8329,6 +8329,46 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+                        const krb5_keyblock *server,
+                        const krb5_keyblock *privsvr, krb5_pac *pac_out);
+ 
++/**
++ * Verify a PAC, possibly including ticket signature
++ *
++ * @param [in] context              Library context
++ * @param [in] enc_tkt              Ticket enc-part, possibly containing a PAC
++ * @param [in] server_princ         Canonicalized name of ticket server
++ * @param [in] server               Key to validate server checksum (or NULL)
++ * @param [in] privsvr              Key to validate KDC checksum (or NULL)
++ * @paran [in] optional_tkt_chksum  Whether to require a ticket checksum
++ * @param [out] pac_out             Verified PAC (NULL if no PAC included)
++ *
++ * This function is an extension of krb5_kdc_verify_ticket(), adding the @a
++ * optional_tkt_chksum parameter allowing to tolerate the absence of the PAC
++ * ticket signature.
++ *
++ * If a PAC is present in @a enc_tkt, verify its signatures.  If @a privsvr is
++ * not NULL and @a server_princ is not a krbtgt or kadmin/changepw service and
++ * @a optional_tkt_chksum is FALSE, require a ticket signature over @a enc_tkt
++ * in addition to the KDC signature. Place the verified PAC in @a pac_out.  If
++ * an invalid PAC signature is found, return an error matching the Windows KDC
++ * protocol code for that condition as closely as possible.
++ *
++ * If no PAC is present in @a enc_tkt, set @a pac_out to NULL and return
++ * successfully.
++ *
++ * @note This function does not validate the PAC_CLIENT_INFO buffer.  If a
++ * specific value is expected, the caller can make a separate call to
++ * krb5_pac_verify_ext() with a principal but no keys.
++ *
++ * @retval 0 Success; otherwise - Kerberos error codes
++ */
++krb5_error_code KRB5_CALLCONV
++krb5_kdc_verify_ticket_ext(krb5_context context,
++                           const krb5_enc_tkt_part *enc_tkt,
++                           krb5_const_principal server_princ,
++                           const krb5_keyblock *server,
++                           const krb5_keyblock *privsvr,
++                           krb5_boolean optional_tkt_chksum,
++                           krb5_pac *pac_out);
++
+ /** @deprecated Use krb5_kdc_sign_ticket() instead. */
+ krb5_error_code KRB5_CALLCONV
+ krb5_pac_sign(krb5_context context, krb5_pac pac, krb5_timestamp authtime,
+diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
+index fe4e48209a..93415ba862 100644
+--- a/src/kdc/kdc_util.c
++++ b/src/kdc/kdc_util.c
+@@ -560,16 +560,36 @@ cleanup:
+ static krb5_error_code
+ try_verify_pac(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+                krb5_db_entry *server, krb5_keyblock *server_key,
+-               const krb5_keyblock *tgt_key, krb5_pac *pac_out)
++               krb5_db_entry *tgt, const krb5_keyblock *tgt_key,
++               krb5_pac *pac_out)
+ {
+     krb5_error_code ret;
++    krb5_boolean optional_tkt_chksum;
++    char *str = NULL;
+     krb5_keyblock *privsvr_key;
+ 
+     ret = pac_privsvr_key(context, server, tgt_key, &privsvr_key);
+     if (ret)
+         return ret;
+-    ret = krb5_kdc_verify_ticket(context, enc_tkt, server->princ, server_key,
+-                                 privsvr_key, pac_out);
++
++    /* Check if the absence of ticket signature is tolerated for this realm */
++    ret = krb5_dbe_get_string(context, tgt,
++                              KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM, &str);
++    /* TODO: should be using _krb5_conf_boolean(), but os-proto.h is not
++     * available here.
++     */
++    optional_tkt_chksum = !ret && str && (strncasecmp(str, "true", 4) == 0
++                                       || strncasecmp(str, "t",    1) == 0
++                                       || strncasecmp(str, "yes",  3) == 0
++                                       || strncasecmp(str, "y",    1) == 0
++                                       || strncasecmp(str, "1",    1) == 0
++                                       || strncasecmp(str, "on",   2) == 0);
++
++    krb5_dbe_free_string(context, str);
++
++    ret = krb5_kdc_verify_ticket_ext(context, enc_tkt, server->princ,
++                                     server_key, privsvr_key,
++                                     optional_tkt_chksum, pac_out);
+     krb5_free_keyblock(context, privsvr_key);
+     return ret;
+ }
+@@ -599,7 +619,7 @@ get_verified_pac(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+                                       server_key, NULL, pac_out);
+     }
+ 
+-    ret = try_verify_pac(context, enc_tkt, server, server_key, tgt_key,
++    ret = try_verify_pac(context, enc_tkt, server, server_key, tgt, tgt_key,
+                          pac_out);
+     if (ret != KRB5KRB_AP_ERR_MODIFIED && ret != KRB5_BAD_ENCTYPE)
+         return ret;
+@@ -613,8 +633,8 @@ get_verified_pac(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+         ret = krb5_dbe_decrypt_key_data(context, NULL, kd, &old_key, NULL);
+         if (ret)
+             return ret;
+-        ret = try_verify_pac(context, enc_tkt, server, server_key, &old_key,
+-                             pac_out);
++        ret = try_verify_pac(context, enc_tkt, server, server_key, tgt,
++                             &old_key, pac_out);
+         krb5_free_keyblock_contents(context, &old_key);
+         if (!ret)
+             return 0;
+diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c
+index 5d1fdf1ba0..0c0e2ada68 100644
+--- a/src/lib/krb5/krb/pac.c
++++ b/src/lib/krb5/krb/pac.c
+@@ -594,6 +594,19 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+                        krb5_const_principal server_princ,
+                        const krb5_keyblock *server,
+                        const krb5_keyblock *privsvr, krb5_pac *pac_out)
++{
++    return krb5_kdc_verify_ticket_ext(context, enc_tkt, server_princ, server,
++                                      privsvr, FALSE, pac_out);
++}
++
++krb5_error_code KRB5_CALLCONV
++krb5_kdc_verify_ticket_ext(krb5_context context,
++                           const krb5_enc_tkt_part *enc_tkt,
++                           krb5_const_principal server_princ,
++                           const krb5_keyblock *server,
++                           const krb5_keyblock *privsvr,
++                           krb5_boolean optional_tkt_chksum,
++                           krb5_pac *pac_out)
+ {
+     krb5_error_code ret;
+     krb5_pac pac = NULL;
+@@ -602,7 +615,7 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+     krb5_authdata *orig, **ifrel = NULL, **recoded_ifrel = NULL;
+     uint8_t z = 0;
+     krb5_authdata zpac = { KV5M_AUTHDATA, KRB5_AUTHDATA_WIN2K_PAC, 1, &z };
+-    krb5_boolean is_service_tkt;
++    krb5_boolean is_service_tkt, has_tkt_chksum = FALSE;
+     size_t i, j;
+ 
+     *pac_out = NULL;
+@@ -667,11 +680,21 @@ krb5_kdc_verify_ticket(krb5_context context, const krb5_enc_tkt_part *enc_tkt,
+ 
+         ret = verify_checksum(context, pac, KRB5_PAC_TICKET_CHECKSUM, privsvr,
+                               KRB5_KEYUSAGE_APP_DATA_CKSUM, recoded_tkt);
+-        if (ret)
+-            goto cleanup;
++        if (ret) {
++            if (!optional_tkt_chksum)
++                goto cleanup;
++            else if (ret != ENOENT)
++                goto cleanup;
++            /* Otherwise ticket signature is absent but optional. Proceed... */
++        } else {
++            has_tkt_chksum = TRUE;
++        }
+     }
++    /* Else, we make the assumption the ticket signature is absent in case this
++     * is not a service ticket.
++     */
+ 
+-    ret = verify_pac_checksums(context, pac, is_service_tkt, server, privsvr);
++    ret = verify_pac_checksums(context, pac, has_tkt_chksum, server, privsvr);
+     if (ret)
+         goto cleanup;
+ 
+diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports
+index 4c50e935a2..d4b0455c8c 100644
+--- a/src/lib/krb5/libkrb5.exports
++++ b/src/lib/krb5/libkrb5.exports
+@@ -463,6 +463,7 @@ krb5_is_thread_safe
+ krb5_kdc_rep_decrypt_proc
+ krb5_kdc_sign_ticket
+ krb5_kdc_verify_ticket
++krb5_kdc_verify_ticket_ext
+ krb5_kt_add_entry
+ krb5_kt_client_default
+ krb5_kt_close
+diff --git a/src/man/kadmin.man b/src/man/kadmin.man
+index 8413e70ccd..f68eb0569d 100644
+--- a/src/man/kadmin.man
++++ b/src/man/kadmin.man
+@@ -724,6 +724,12 @@ encryption type.  It may be necessary to set this value to
+ "aes256\-sha1" on the cross\-realm krbtgt entry for an Active
+ Directory realm when using aes\-sha2 keys on the local krbtgt
+ entry.
++.TP
++\fBoptional_pac_tkt_chksum\fP
++Boolean value defining the behavior of the KDC in case an expected ticket
++checksum signed with one of this principal keys is not present in the PAC. This
++is typically the case for TGS or cross-realm TGS principals when processing
++S4U2Proxy requests.
+ .UNINDENT
+ .sp
+ This command requires the \fBmodify\fP privilege.
+-- 
+2.45.1
+
diff --git a/0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch b/0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch
new file mode 100644
index 0000000..68a2a6d
--- /dev/null
+++ b/0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch
@@ -0,0 +1,47 @@
+From 31b9debcf2cbd558f8f315fefb69fc8206b115b4 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Tue, 23 May 2023 12:19:54 +0200
+Subject: [PATCH] [downstream] Make PKINIT CMS SHA-1 signature
+ verification available in FIPS mode
+
+We recommend using the SHA1 crypto-module in order to allow the
+verification of SHA-1 signature for CMS messages. However, this module
+does not work in FIPS mode, because the SHA-1 algorithm is absent from
+the OpenSSL FIPS provider.
+
+This commit enables the signature verification process to fetch the
+algorithm from a non-FIPS OpenSSL provider.
+
+Support for SHA-1 CMS signature is still required, especially in order
+to interoperate with Active Directory. At least it is until elliptic
+curve cryptography is implemented for PKINIT in MIT krb5.
+---
+ src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index cb9c79626c..17dd18e37d 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -1844,8 +1844,17 @@ cms_signeddata_verify(krb5_context context,
+     if (oid == NULL)
+         goto cleanup;
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++    /* Do not use FIPS provider (even in FIPS mode) because it keeps from
++     * allowing SHA-1 signature verification using the SHA1 crypto-module
++     */
++    cms = CMS_ContentInfo_new_ex(NULL, "-fips");
++    if (!cms)
++        goto cleanup;
++#endif
++
+     /* decode received CMS message */
+-    if ((cms = d2i_CMS_ContentInfo(NULL, &p, (int)signed_data_len)) == NULL) {
++    if (!d2i_CMS_ContentInfo(&cms, &p, (int)signed_data_len)) {
+         retval = oerr(context, 0, _("Failed to decode CMS message"));
+         goto cleanup;
+     }
+-- 
+2.45.1
+
diff --git a/0014-Enable-PKINIT-if-at-least-one-group-is-available.patch b/0014-Enable-PKINIT-if-at-least-one-group-is-available.patch
new file mode 100644
index 0000000..30646aa
--- /dev/null
+++ b/0014-Enable-PKINIT-if-at-least-one-group-is-available.patch
@@ -0,0 +1,218 @@
+From c24c9faf859ddc04910a6bc591d8ddb2ada93e80 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 30 May 2023 01:21:48 -0400
+Subject: [PATCH] Enable PKINIT if at least one group is available
+
+OpenSSL may no longer allow decoding of non-well-known Diffie-Hellman
+group parameters as EVP_PKEY objects in FIPS mode.  However, OpenSSL
+does not know about MODP group 2 (1024-bit), which is considered as a
+custom group.  As a consequence, the PKINIT kdcpreauth module fails to
+load in FIPS mode.
+
+Allow initialization of PKINIT plugin if at least one of the MODP
+well-known group parameters successfully decodes.
+
+[ghudson@mit.edu: minor commit message and code edits]
+
+ticket: 9096 (new)
+(cherry picked from commit 509d8db922e9ad6f108883838473b6178f89874a)
+---
+ src/plugins/preauth/pkinit/pkinit_clnt.c      |  2 +-
+ src/plugins/preauth/pkinit/pkinit_crypto.h    |  3 +-
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 76 +++++++++++--------
+ src/plugins/preauth/pkinit/pkinit_srv.c       |  2 +-
+ src/plugins/preauth/pkinit/pkinit_trace.h     |  3 +
+ 5 files changed, 51 insertions(+), 35 deletions(-)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
+index 725d5bc438..ea9ba454df 100644
+--- a/src/plugins/preauth/pkinit/pkinit_clnt.c
++++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
+@@ -1378,7 +1378,7 @@ pkinit_client_plugin_init(krb5_context context,
+     if (retval)
+         goto errout;
+ 
+-    retval = pkinit_init_plg_crypto(&ctx->cryptoctx);
++    retval = pkinit_init_plg_crypto(context, &ctx->cryptoctx);
+     if (retval)
+         goto errout;
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
+index 9fa315d7a0..8bdbea8e95 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto.h
++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
+@@ -103,7 +103,8 @@ typedef struct _pkinit_cert_matching_data {
+ /*
+  * Functions to initialize and cleanup crypto contexts
+  */
+-krb5_error_code pkinit_init_plg_crypto(pkinit_plg_crypto_context *);
++krb5_error_code pkinit_init_plg_crypto(krb5_context,
++				       pkinit_plg_crypto_context *);
+ void pkinit_fini_plg_crypto(pkinit_plg_crypto_context);
+ 
+ krb5_error_code pkinit_init_req_crypto(pkinit_req_crypto_context *);
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 17dd18e37d..8cdc40bfb4 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -47,7 +47,8 @@
+ static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context );
+ static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context );
+ 
+-static krb5_error_code pkinit_init_dh_params(pkinit_plg_crypto_context );
++static krb5_error_code pkinit_init_dh_params(krb5_context,
++                                             pkinit_plg_crypto_context);
+ static void pkinit_fini_dh_params(pkinit_plg_crypto_context );
+ 
+ static krb5_error_code pkinit_init_certs(pkinit_identity_crypto_context ctx);
+@@ -951,7 +952,8 @@ oerr_cert(krb5_context context, krb5_error_code code, X509_STORE_CTX *certctx,
+ }
+ 
+ krb5_error_code
+-pkinit_init_plg_crypto(pkinit_plg_crypto_context *cryptoctx)
++pkinit_init_plg_crypto(krb5_context context,
++                       pkinit_plg_crypto_context *cryptoctx)
+ {
+     krb5_error_code retval = ENOMEM;
+     pkinit_plg_crypto_context ctx = NULL;
+@@ -969,7 +971,7 @@ pkinit_init_plg_crypto(pkinit_plg_crypto_context *cryptoctx)
+     if (retval)
+         goto out;
+ 
+-    retval = pkinit_init_dh_params(ctx);
++    retval = pkinit_init_dh_params(context, ctx);
+     if (retval)
+         goto out;
+ 
+@@ -1278,30 +1280,36 @@ pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ctx)
+     ASN1_OBJECT_free(ctx->id_kp_serverAuth);
+ }
+ 
+-static krb5_error_code
+-pkinit_init_dh_params(pkinit_plg_crypto_context plgctx)
++static int
++try_import_group(krb5_context context, const krb5_data *params,
++                 const char *name, EVP_PKEY **pkey_out)
+ {
+-    krb5_error_code retval = ENOMEM;
+-
+-    plgctx->dh_1024 = decode_dh_params(&oakley_1024);
+-    if (plgctx->dh_1024 == NULL)
+-        goto cleanup;
+-
+-    plgctx->dh_2048 = decode_dh_params(&oakley_2048);
+-    if (plgctx->dh_2048 == NULL)
+-        goto cleanup;
++    *pkey_out = decode_dh_params(params);
++    if (*pkey_out == NULL)
++        TRACE_PKINIT_DH_GROUP_UNAVAILABLE(context, name);
++    return (*pkey_out != NULL) ? 1 : 0;
++}
+ 
+-    plgctx->dh_4096 = decode_dh_params(&oakley_4096);
+-    if (plgctx->dh_4096 == NULL)
+-        goto cleanup;
++static krb5_error_code
++pkinit_init_dh_params(krb5_context context, pkinit_plg_crypto_context plgctx)
++{
++    int n = 0;
+ 
+-    retval = 0;
++    n += try_import_group(context, &oakley_1024, "MODP 2 (1024-bit)",
++                          &plgctx->dh_1024);
++    n += try_import_group(context, &oakley_2048, "MODP 14 (2048-bit)",
++                          &plgctx->dh_2048);
++    n += try_import_group(context, &oakley_4096, "MODP 16 (4096-bit)",
++                          &plgctx->dh_4096);
+ 
+-cleanup:
+-    if (retval)
++    if (n == 0) {
+         pkinit_fini_dh_params(plgctx);
++        k5_setmsg(context, ENOMEM,
++                  _("PKINIT cannot initialize any key exchange groups"));
++        return ENOMEM;
++    }
+ 
+-    return retval;
++    return 0;
+ }
+ 
+ static void
+@@ -2912,11 +2920,11 @@ client_create_dh(krb5_context context,
+ 
+     if (cryptoctx->received_params != NULL)
+         params = cryptoctx->received_params;
+-    else if (dh_size == 1024)
++    else if (plg_cryptoctx->dh_1024 != NULL && dh_size == 1024)
+         params = plg_cryptoctx->dh_1024;
+-    else if (dh_size == 2048)
++    else if (plg_cryptoctx->dh_2048 != NULL && dh_size == 2048)
+         params = plg_cryptoctx->dh_2048;
+-    else if (dh_size == 4096)
++    else if (plg_cryptoctx->dh_4096 != NULL && dh_size == 4096)
+         params = plg_cryptoctx->dh_4096;
+     else
+         goto cleanup;
+@@ -3212,19 +3220,23 @@ pkinit_create_td_dh_parameters(krb5_context context,
+     krb5_algorithm_identifier alg_4096 = { dh_oid, oakley_4096 };
+     krb5_algorithm_identifier *alglist[4];
+ 
+-    if (opts->dh_min_bits > 4096) {
+-        ret = KRB5KRB_ERR_GENERIC;
+-        goto cleanup;
+-    }
+-
+     i = 0;
+-    if (opts->dh_min_bits <= 2048)
++    if (plg_cryptoctx->dh_2048 != NULL && opts->dh_min_bits <= 2048)
+         alglist[i++] = &alg_2048;
+-    alglist[i++] = &alg_4096;
+-    if (opts->dh_min_bits <= 1024)
++    if (plg_cryptoctx->dh_4096 != NULL && opts->dh_min_bits <= 4096)
++        alglist[i++] = &alg_4096;
++    if (plg_cryptoctx->dh_1024 != NULL && opts->dh_min_bits <= 1024)
+         alglist[i++] = &alg_1024;
+     alglist[i] = NULL;
+ 
++    if (i == 0) {
++        ret = KRB5KRB_ERR_GENERIC;
++        k5_setmsg(context, ret,
++                  _("OpenSSL has no supported key exchange groups for "
++                    "pkinit_dh_min_bits=%d"), opts->dh_min_bits);
++        goto cleanup;
++    }
++
+     ret = k5int_encode_krb5_td_dh_parameters(alglist, &der_alglist);
+     if (ret)
+         goto cleanup;
+diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
+index 1b3bf6d4d0..768a4e559f 100644
+--- a/src/plugins/preauth/pkinit/pkinit_srv.c
++++ b/src/plugins/preauth/pkinit/pkinit_srv.c
+@@ -1222,7 +1222,7 @@ pkinit_server_plugin_init_realm(krb5_context context, const char *realmname,
+         goto errout;
+     plgctx->realmname_len = strlen(plgctx->realmname);
+ 
+-    retval = pkinit_init_plg_crypto(&plgctx->cryptoctx);
++    retval = pkinit_init_plg_crypto(context, &plgctx->cryptoctx);
+     if (retval)
+         goto errout;
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h
+index 259e95c6c2..5ee39c085c 100644
+--- a/src/plugins/preauth/pkinit/pkinit_trace.h
++++ b/src/plugins/preauth/pkinit/pkinit_trace.h
+@@ -90,6 +90,9 @@
+ #define TRACE_PKINIT_CLIENT_TRYAGAIN(c)                                 \
+     TRACE(c, "PKINIT client trying again with KDC-provided parameters")
+ 
++#define TRACE_PKINIT_DH_GROUP_UNAVAILABLE(c, name)                      \
++    TRACE(c, "PKINIT key exchange group {str} unsupported", name)
++
+ #define TRACE_PKINIT_OPENSSL_ERROR(c, msg)              \
+     TRACE(c, "PKINIT OpenSSL error: {str}", msg)
+ 
+-- 
+2.45.1
+
diff --git a/0015-Replace-ssl.wrap_socket-for-tests.patch b/0015-Replace-ssl.wrap_socket-for-tests.patch
new file mode 100644
index 0000000..34cef96
--- /dev/null
+++ b/0015-Replace-ssl.wrap_socket-for-tests.patch
@@ -0,0 +1,64 @@
+From e92365b510a2407eaceaec90836f5c713403d75f Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Wed, 19 Jul 2023 13:43:17 +0200
+Subject: [PATCH] Replace ssl.wrap_socket() for tests
+
+The ssl.wrap_socket() function was deprecated in Python 3.7 and is
+removed in Python 3.12.  The ssl.SSLContext.wrap_socket() method
+replaces it.
+
+Bump the required Python version for tests to 3.4 for
+ssl.create_default_context().
+
+[ghudson@mit.edu: changed minimum Python version]
+
+(cherry picked from commit 0ceab6c363e65fb21d3312a663f2b9b569ecc415)
+---
+ src/configure.ac             | 9 ++++-----
+ src/util/wsgiref-kdcproxy.py | 4 +++-
+ 2 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/src/configure.ac b/src/configure.ac
+index 2561e917a2..487f393146 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -1157,10 +1157,9 @@ AC_SUBST(PKINIT)
+ # for lib/apputils
+ AC_REPLACE_FUNCS(daemon)
+ 
+-# For Python tests.  Python version 3.2.4 is required as prior
+-# versions do not accept string input to subprocess.Popen.communicate
+-# when universal_newlines is set.
+-PYTHON_MINVERSION=3.2.4
++# For Python tests.  Python version 3.4 is required for
++# ssl.create_default_context().
++PYTHON_MINVERSION=3.4
+ AC_SUBST(PYTHON_MINVERSION)
+ AC_CHECK_PROG(PYTHON,python3,python3)
+ if test x"$PYTHON" = x; then
+@@ -1168,7 +1167,7 @@ if test x"$PYTHON" = x; then
+ fi
+ HAVE_PYTHON=no
+ if test x"$PYTHON" != x; then
+-	wantver="(sys.hexversion >= 0x30204F0)"
++	wantver="(sys.hexversion >= 0x30400F0)"
+ 	if "$PYTHON" -c "import sys; sys.exit(not $wantver and 1 or 0)"; then
+ 		HAVE_PYTHON=yes
+ 	fi
+diff --git a/src/util/wsgiref-kdcproxy.py b/src/util/wsgiref-kdcproxy.py
+index 58759696b6..d1d10d733c 100755
+--- a/src/util/wsgiref-kdcproxy.py
++++ b/src/util/wsgiref-kdcproxy.py
+@@ -14,6 +14,8 @@ else:
+     pem = '*'
+ 
+ server = make_server('localhost', port, kdcproxy.Application())
+-server.socket = ssl.wrap_socket(server.socket, certfile=pem, server_side=True)
++sslctx = ssl.create_default_context(purpose=ssl.Purpose.CLIENT_AUTH)
++sslctx.load_cert_chain(certfile=pem)
++server.socket = sslctx.wrap_socket(server.socket, server_side=True)
+ os.write(sys.stdout.fileno(), b'proxy server ready\n')
+ server.serve_forever()
+-- 
+2.45.1
+
diff --git a/0016-Eliminate-old-style-function-declarations.patch b/0016-Eliminate-old-style-function-declarations.patch
new file mode 100644
index 0000000..2b07a72
--- /dev/null
+++ b/0016-Eliminate-old-style-function-declarations.patch
@@ -0,0 +1,10685 @@
+From 1ad0abf12b212d19ac7b3903deeaf7fff4e2c3cf Mon Sep 17 00:00:00 2001
+From: Ken Hornstein <kenh@cmf.nrl.navy.mil>
+Date: Fri, 9 Jun 2023 23:53:53 -0400
+Subject: [PATCH] Eliminate old-style function declarations
+
+The C2x standard removes support for non-prototype function
+declarations, and clang 15 issues warnings for them
+(https://reviews.llvm.org/D122895).  Add -Werror=strict-prototypes to
+the build and fix all of the non-prototype declarations and
+definitions.
+
+For RPC code, try to be consistent with libtirpc and recent *BSD
+versions of rpcgen.  This includes casting each time a concrete
+function is used as an xdrproc_t value, since each XDR per-type
+function accepts a different object pointer type.  A few invocations
+of xdrproc_t values pass a third argument with value LASTUNSIGNED,
+even though XDR per-type functions accept only two parameters.
+libtirpc has removed these third arguments; do so here as well.
+
+[ghudson@mit.edu: added -Werror=strict-prototypes and fixed
+declarations it breaks under gcc and clang; added xdrproc_t changes;
+rewrote commit message; style changes]
+
+(cherry picked from commit 4b9d7f7c107f01a61600fddcd8cde3812d0366a2)
+---
+ src/aclocal.m4                                |   2 +-
+ src/appl/gss-sample/gss-client.c              |  29 +---
+ src/appl/gss-sample/gss-misc.c                |  26 +--
+ src/appl/gss-sample/gss-server.c              |   2 +-
+ src/appl/user_user/server.c                   |   5 +-
+ src/clients/kdestroy/kdestroy.c               |   2 +-
+ src/clients/kinit/kinit.c                     |   4 +-
+ src/clients/klist/klist.c                     |   2 +-
+ src/clients/ksu/authorization.c               |  95 ++++------
+ src/clients/ksu/ccache.c                      | 108 ++++--------
+ src/clients/ksu/heuristic.c                   |  94 ++++------
+ src/clients/ksu/krb_auth_su.c                 |  49 ++----
+ src/clients/ksu/main.c                        |  40 ++---
+ src/clients/kvno/kvno.c                       |   2 +-
+ src/include/gssrpc/auth_gssapi.h              |  10 +-
+ src/include/gssrpc/xdr.h                      |   3 +-
+ src/include/k5-int.h                          |   2 +-
+ src/include/k5-plugin.h                       |   2 +-
+ src/include/net-server.h                      |   6 +-
+ src/kadmin/cli/getdate.y                      |   3 -
+ src/kadmin/cli/kadmin.c                       |   6 +-
+ src/kadmin/cli/keytab.c                       |   4 +-
+ src/kadmin/dbutil/kdb5_create.c               |  16 +-
+ src/kadmin/dbutil/kdb5_destroy.c              |   4 +-
+ src/kadmin/dbutil/kdb5_stash.c                |   4 +-
+ src/kadmin/dbutil/kdb5_util.c                 |  24 +--
+ src/kadmin/dbutil/ovload.c                    |  14 +-
+ src/kadmin/dbutil/strtok.c                    |   4 +-
+ src/kadmin/ktutil/ktutil.c                    |  45 ++---
+ src/kadmin/ktutil/ktutil_funcs.c              |  37 ++--
+ src/kadmin/server/ipropd_svc.c                |  24 +--
+ src/kadmin/server/kadm_rpc_svc.c              | 162 +++++++++---------
+ src/kadmin/server/ovsec_kadmd.c               |   4 +-
+ src/kdc/t_ndr.c                               |   2 +-
+ src/kdc/t_replay.c                            |   6 +-
+ src/kprop/kpropd.c                            |   2 +-
+ src/kprop/kproplog.c                          |   4 +-
+ src/lib/apputils/net-server.c                 |   7 +-
+ src/lib/crypto/builtin/aes/aes-gen.c          |  18 +-
+ .../crypto/builtin/camellia/camellia-gen.c    |  18 +-
+ src/lib/crypto/builtin/sha1/t_shs.c           |   7 +-
+ src/lib/crypto/builtin/sha1/t_shs3.c          |   7 +-
+ src/lib/crypto/crypto_tests/aes-test.c        |   8 +-
+ src/lib/crypto/crypto_tests/camellia-test.c   |   8 +-
+ src/lib/crypto/crypto_tests/t_cf2.c           |   4 +-
+ src/lib/crypto/crypto_tests/t_cts.c           |   2 +-
+ src/lib/crypto/crypto_tests/t_encrypt.c       |   2 +-
+ src/lib/crypto/crypto_tests/t_fork.c          |   2 +-
+ src/lib/crypto/crypto_tests/t_hmac.c          |   3 +-
+ src/lib/crypto/crypto_tests/t_mddriver.c      |  25 ++-
+ src/lib/crypto/crypto_tests/t_nfold.c         |  16 +-
+ src/lib/crypto/crypto_tests/t_prf.c           |   2 +-
+ src/lib/crypto/crypto_tests/t_sha2.c          |   2 +-
+ src/lib/gssapi/generic/t_seqstate.c           |   2 +-
+ src/lib/gssapi/krb5/accept_sec_context.c      |  76 +++-----
+ src/lib/gssapi/krb5/compare_name.c            |   7 +-
+ src/lib/gssapi/krb5/context_time.c            |   6 +-
+ src/lib/gssapi/krb5/delete_sec_context.c      |   7 +-
+ src/lib/gssapi/krb5/disp_name.c               |   9 +-
+ src/lib/gssapi/krb5/disp_status.c             |  11 +-
+ src/lib/gssapi/krb5/export_sec_context.c      |   7 +-
+ src/lib/gssapi/krb5/gssapi_krb5.c             |   4 +-
+ src/lib/gssapi/krb5/import_name.c             |   8 +-
+ src/lib/gssapi/krb5/import_sec_context.c      |  10 +-
+ src/lib/gssapi/krb5/indicate_mechs.c          |   4 +-
+ src/lib/gssapi/krb5/init_sec_context.c        |  55 ++----
+ src/lib/gssapi/krb5/inq_context.c             |  17 +-
+ src/lib/gssapi/krb5/inq_cred.c                |  26 +--
+ src/lib/gssapi/krb5/inq_names.c               |   6 +-
+ src/lib/gssapi/krb5/k5seal.c                  |  38 ++--
+ src/lib/gssapi/krb5/k5unseal.c                |  51 ++----
+ src/lib/gssapi/krb5/process_context_token.c   |   8 +-
+ src/lib/gssapi/krb5/rel_cred.c                |   4 +-
+ src/lib/gssapi/krb5/rel_name.c                |   4 +-
+ src/lib/gssapi/krb5/rel_oid.c                 |   8 +-
+ src/lib/gssapi/krb5/ser_sctx.c                |  16 +-
+ src/lib/gssapi/krb5/util_cksum.c              |   6 +-
+ src/lib/gssapi/krb5/util_seed.c               |   5 +-
+ src/lib/gssapi/krb5/util_seqnum.c             |  19 +-
+ src/lib/gssapi/krb5/val_cred.c                |   4 +-
+ src/lib/gssapi/krb5/wrap_size_limit.c         |  11 +-
+ .../gssapi/mechglue/g_accept_sec_context.c    |  31 +---
+ src/lib/gssapi/mechglue/g_acquire_cred.c      |  95 +++-------
+ .../gssapi/mechglue/g_acquire_cred_with_pw.c  |  56 ++----
+ src/lib/gssapi/mechglue/g_canon_name.c        |  10 +-
+ src/lib/gssapi/mechglue/g_compare_name.c      |  12 +-
+ src/lib/gssapi/mechglue/g_context_time.c      |  10 +-
+ .../gssapi/mechglue/g_delete_sec_context.c    |  10 +-
+ src/lib/gssapi/mechglue/g_dsp_name.c          |  12 +-
+ src/lib/gssapi/mechglue/g_dsp_status.c        |  22 +--
+ src/lib/gssapi/mechglue/g_dup_name.c          |   8 +-
+ src/lib/gssapi/mechglue/g_exp_sec_context.c   |  10 +-
+ src/lib/gssapi/mechglue/g_export_name.c       |   8 +-
+ src/lib/gssapi/mechglue/g_glue.c              |  75 +++-----
+ src/lib/gssapi/mechglue/g_imp_name.c          |  18 +-
+ src/lib/gssapi/mechglue/g_imp_sec_context.c   |  11 +-
+ src/lib/gssapi/mechglue/g_init_sec_context.c  |  37 +---
+ src/lib/gssapi/mechglue/g_initialize.c        |  22 +--
+ src/lib/gssapi/mechglue/g_inq_cred.c          |  31 +---
+ src/lib/gssapi/mechglue/g_inq_names.c         |   8 +-
+ src/lib/gssapi/mechglue/g_mechname.c          |  14 +-
+ src/lib/gssapi/mechglue/g_oid_ops.c           |  27 +--
+ src/lib/gssapi/mechglue/g_process_context.c   |  10 +-
+ src/lib/gssapi/mechglue/g_rel_buffer.c        |   6 +-
+ src/lib/gssapi/mechglue/g_rel_cred.c          |   7 +-
+ src/lib/gssapi/mechglue/g_rel_name.c          |   7 +-
+ src/lib/gssapi/mechglue/g_rel_oid_set.c       |   6 +-
+ src/lib/gssapi/mechglue/g_sign.c              |  29 +---
+ src/lib/gssapi/mechglue/g_store_cred.c        |  48 ++----
+ src/lib/gssapi/mechglue/g_unseal.c            |  35 +---
+ src/lib/gssapi/mechglue/g_unwrap_aead.c       |  19 +-
+ src/lib/gssapi/mechglue/g_unwrap_iov.c        |  15 +-
+ src/lib/gssapi/mechglue/g_verify.c            |  30 +---
+ src/lib/gssapi/mechglue/g_wrap_aead.c         |  39 ++---
+ src/lib/gssapi/mechglue/g_wrap_iov.c          |  43 +----
+ src/lib/kadm5/clnt/client_rpc.c               |   1 +
+ src/lib/kadm5/kadm_rpc.h                      |  45 -----
+ src/lib/kadm5/kadm_rpc_xdr.c                  |  37 ++--
+ src/lib/kadm5/misc_free.c                     |   5 +-
+ src/lib/kadm5/srv/adb_xdr.c                   |   6 +-
+ src/lib/kadm5/srv/svr_principal.c             |  12 +-
+ src/lib/kadm5/str_conv.c                      |  18 +-
+ src/lib/kadm5/t_kadm5.c                       |  22 +--
+ src/lib/kdb/kdb5.c                            |   8 +-
+ src/lib/kdb/kdb_cpw.c                         |  32 +---
+ src/lib/kdb/keytab.c                          |  19 +-
+ src/lib/kdb/t_stringattr.c                    |   2 +-
+ src/lib/krad/packet.c                         |   2 +-
+ src/lib/krad/t_attr.c                         |   2 +-
+ src/lib/krad/t_attrset.c                      |   2 +-
+ src/lib/krad/t_code.c                         |   2 +-
+ src/lib/krb5/ccache/cc_keyring.c              |   2 +-
+ src/lib/krb5/krb/plugin.c                     |   2 +-
+ src/lib/krb5/krb/t_authdata.c                 |   2 +-
+ src/lib/krb5/krb/t_response_items.c           |   2 +-
+ src/lib/krb5/krb/t_ser.c                      |   8 +-
+ src/lib/krb5/krb/t_sname_match.c              |   2 +-
+ src/lib/krb5/krb/t_valid_times.c              |   2 +-
+ src/lib/krb5/rcache/t_memrcache.c             |   2 +-
+ src/lib/rpc/auth_gss.c                        |   4 +-
+ src/lib/rpc/auth_gssapi.c                     |  14 +-
+ src/lib/rpc/auth_gssapi_misc.c                |   4 +-
+ src/lib/rpc/authunix_prot.c                   |   3 +-
+ src/lib/rpc/clnt_perror.c                     |   1 -
+ src/lib/rpc/clnt_raw.c                        |   2 +-
+ src/lib/rpc/dyn.c                             |  85 ++++-----
+ src/lib/rpc/pmap_clnt.c                       |   9 +-
+ src/lib/rpc/pmap_getmaps.c                    |   5 +-
+ src/lib/rpc/pmap_getport.c                    |   6 +-
+ src/lib/rpc/pmap_prot2.c                      |   3 +-
+ src/lib/rpc/pmap_rmt.c                        |  10 +-
+ src/lib/rpc/rpc_prot.c                        |   4 +-
+ src/lib/rpc/svc.c                             |   4 +-
+ src/lib/rpc/svc_auth_gss.c                    |  10 +-
+ src/lib/rpc/svc_auth_gssapi.c                 |  28 +--
+ src/lib/rpc/svc_simple.c                      |   4 +-
+ src/lib/rpc/unit-test/client.c                |  18 +-
+ src/lib/rpc/unit-test/rpc_test_clnt.c         |   4 +-
+ src/lib/rpc/unit-test/rpc_test_svc.c          |  16 +-
+ src/lib/rpc/unit-test/server.c                |   2 +-
+ src/lib/rpc/xdr.c                             |   4 +-
+ src/lib/rpc/xdr_array.c                       |   4 +-
+ src/lib/rpc/xdr_rec.c                         |  13 +-
+ src/lib/rpc/xdr_reference.c                   |   4 +-
+ src/lib/rpc/xdr_sizeof.c                      |  29 +---
+ src/plugins/kdb/db2/db2_exp.c                 |   4 +-
+ src/plugins/kdb/db2/libdb2/btree/bt_close.c   |  10 +-
+ src/plugins/kdb/db2/libdb2/btree/bt_conv.c    |  13 +-
+ src/plugins/kdb/db2/libdb2/btree/bt_delete.c  |  34 +---
+ src/plugins/kdb/db2/libdb2/btree/bt_get.c     |   6 +-
+ src/plugins/kdb/db2/libdb2/btree/bt_open.c    |  12 +-
+ .../kdb/db2/libdb2/btree/bt_overflow.c        |  16 +-
+ src/plugins/kdb/db2/libdb2/btree/bt_page.c    |   8 +-
+ src/plugins/kdb/db2/libdb2/btree/bt_put.c     |  11 +-
+ src/plugins/kdb/db2/libdb2/btree/bt_search.c  |  17 +-
+ src/plugins/kdb/db2/libdb2/btree/bt_seq.c     |  27 +--
+ src/plugins/kdb/db2/libdb2/btree/bt_split.c   |  42 +----
+ src/plugins/kdb/db2/libdb2/btree/bt_utils.c   |  18 +-
+ src/plugins/kdb/db2/libdb2/db/db.c            |  26 ++-
+ src/plugins/kdb/db2/libdb2/hash/dbm.c         |  50 ++----
+ src/plugins/kdb/db2/libdb2/hash/hash.c        |  94 +++-------
+ src/plugins/kdb/db2/libdb2/hash/hash_bigkey.c |  35 +---
+ src/plugins/kdb/db2/libdb2/hash/hash_func.c   |  16 +-
+ src/plugins/kdb/db2/libdb2/hash/hash_log2.c   |   3 +-
+ src/plugins/kdb/db2/libdb2/hash/hash_page.c   | 121 ++++---------
+ src/plugins/kdb/db2/libdb2/hash/hsearch.c     |   9 +-
+ src/plugins/kdb/db2/libdb2/mpool/mpool.c      |  54 ++----
+ src/plugins/kdb/db2/libdb2/recno/rec_close.c  |   7 +-
+ src/plugins/kdb/db2/libdb2/recno/rec_delete.c |  14 +-
+ src/plugins/kdb/db2/libdb2/recno/rec_get.c    |  22 +--
+ src/plugins/kdb/db2/libdb2/recno/rec_open.c   |   9 +-
+ src/plugins/kdb/db2/libdb2/recno/rec_put.c    |  12 +-
+ src/plugins/kdb/db2/libdb2/recno/rec_search.c |   5 +-
+ src/plugins/kdb/db2/libdb2/recno/rec_seq.c    |   5 +-
+ src/plugins/kdb/db2/libdb2/recno/rec_utils.c  |   6 +-
+ src/plugins/kdb/db2/libdb2/test/dbtest.c      |  59 ++-----
+ src/plugins/kdb/db2/pol_xdr.c                 |   2 +-
+ .../kdb/ldap/ldap_util/kdb5_ldap_util.c       |   4 +-
+ src/plugins/kdb/lmdb/kdb_lmdb.c               |   4 +-
+ src/plugins/kdb/test/kdb_test.c               |   4 +-
+ .../preauth/pkinit/pkinit_crypto_openssl.c    |   4 +-
+ src/plugins/preauth/spake/t_vectors.c         |   2 +-
+ src/tests/asn.1/krb5_decode_test.c            |   5 +-
+ src/tests/asn.1/krb5_encode_test.c            |  13 +-
+ src/tests/asn.1/t_trval.c                     |  14 +-
+ src/tests/asn.1/trval.c                       |  73 +++-----
+ src/tests/conccache.c                         |   4 +-
+ src/tests/create/kdb5_mkdums.c                |  16 +-
+ src/tests/forward.c                           |   2 +-
+ src/tests/gss-threads/gss-client.c            |   4 +-
+ src/tests/gss-threads/gss-server.c            |   2 +-
+ src/tests/gssapi/reload.c                     |   2 +-
+ src/tests/gssapi/t_add_cred.c                 |   2 +-
+ src/tests/gssapi/t_enctypes.c                 |   2 +-
+ src/tests/gssapi/t_invalid.c                  |   2 +-
+ src/tests/gssapi/t_oid.c                      |   2 +-
+ src/tests/gssapi/t_spnego.c                   |   2 +-
+ src/tests/hammer/kdc5_hammer.c                |  36 ++--
+ src/tests/kdbtest.c                           |   2 +-
+ src/tests/misc/test_getpw.c                   |   2 +-
+ src/tests/plugorder.c                         |   2 +-
+ src/tests/shlib/t_loader.c                    |   2 +-
+ src/tests/softpkcs11/main.c                   |   2 +-
+ src/tests/t_inetd.c                           |   7 +-
+ src/tests/test1.c                             |   4 +-
+ src/tests/verify/kdb5_verify.c                |  17 +-
+ src/util/et/error_message.c                   |   2 +-
+ src/util/et/test_et.c                         |   3 +-
+ src/util/profile/prof_init.c                  |   2 +-
+ src/util/profile/t_profile.c                  |  22 +--
+ src/util/profile/test_load.c                  |   2 +-
+ src/util/profile/test_parse.c                 |   5 +-
+ src/util/profile/test_profile.c               |  10 +-
+ src/util/profile/test_vtable.c                |   3 +-
+ src/util/ss/error.c                           |  13 +-
+ src/util/ss/execute_cmd.c                     |  23 +--
+ src/util/ss/help.c                            | 115 ++++++-------
+ src/util/ss/invocation.c                      |  13 +-
+ src/util/ss/list_rqs.c                        |  11 +-
+ src/util/ss/listen.c                          |  32 ++--
+ src/util/ss/pager.c                           |  10 +-
+ src/util/ss/parse.c                           |   6 +-
+ src/util/ss/prompt.c                          |   7 +-
+ src/util/ss/request_tbl.c                     |  11 +-
+ src/util/ss/requests.c                        |   2 +-
+ src/util/ss/ss.h                              |   1 -
+ src/util/ss/ss_internal.h                     |   3 +-
+ src/util/support/plugins.c                    |  10 +-
+ src/util/support/t_hashtab.c                  |   6 +-
+ src/util/support/t_hex.c                      |   3 +-
+ src/util/support/t_json.c                     |   2 +-
+ src/util/support/t_k5buf.c                    |  16 +-
+ src/util/support/t_unal.c                     |   3 +-
+ 253 files changed, 1379 insertions(+), 2717 deletions(-)
+
+diff --git a/src/aclocal.m4 b/src/aclocal.m4
+index 3331970930..040d5bdd0c 100644
+--- a/src/aclocal.m4
++++ b/src/aclocal.m4
+@@ -546,7 +546,7 @@ if test "$GCC" = yes ; then
+     TRY_WARN_CC_FLAG(-Wno-format-zero-length)
+     # Other flags here may not be supported on some versions of
+     # gcc that people want to use.
+-    for flag in overflow strict-overflow missing-format-attribute missing-prototypes return-type missing-braces parentheses switch unused-function unused-label unused-variable unused-value unknown-pragmas sign-compare newline-eof error=uninitialized no-maybe-uninitialized error=pointer-arith error=int-conversion error=incompatible-pointer-types error=discarded-qualifiers error=implicit-int ; do
++    for flag in overflow strict-overflow missing-format-attribute missing-prototypes return-type missing-braces parentheses switch unused-function unused-label unused-variable unused-value unknown-pragmas sign-compare newline-eof error=uninitialized no-maybe-uninitialized error=pointer-arith error=int-conversion error=incompatible-pointer-types error=discarded-qualifiers error=implicit-int error=strict-prototypes; do
+       TRY_WARN_CC_FLAG(-W$flag)
+     done
+     #  old-style-definition? generates many, many warnings
+diff --git a/src/appl/gss-sample/gss-client.c b/src/appl/gss-sample/gss-client.c
+index 6e2aa33690..0722ae196f 100644
+--- a/src/appl/gss-sample/gss-client.c
++++ b/src/appl/gss-sample/gss-client.c
+@@ -75,7 +75,7 @@ static gss_OID_desc gss_spnego_mechanism_oid_desc =
+ {6, (void *)"\x2b\x06\x01\x05\x05\x02"};
+ 
+ static void
+-usage()
++usage(void)
+ {
+     fprintf(stderr, "Usage: gss-client [-port port] [-mech mechanism] "
+             "[-spnego] [-d]\n");
+@@ -359,9 +359,7 @@ client_establish_context(int s, char *service_name, OM_uint32 gss_flags,
+ }
+ 
+ static void
+-read_file(file_name, in_buf)
+-    char   *file_name;
+-    gss_buffer_t in_buf;
++read_file(char *file_name, gss_buffer_t in_buf)
+ {
+     int     fd, count;
+     struct stat stat_buf;
+@@ -431,21 +429,10 @@ read_file(file_name, in_buf)
+  * verifies it with gss_verify.  -1 is returned if any step fails,
+  * otherwise 0 is returned.  */
+ static int
+-call_server(host, port, oid, service_name, gss_flags, auth_flag,
+-            wrap_flag, encrypt_flag, mic_flag, v1_format, msg, use_file,
+-            mcount, username, password)
+-    char   *host;
+-    u_short port;
+-    gss_OID oid;
+-    char   *service_name;
+-    OM_uint32 gss_flags;
+-    int     auth_flag, wrap_flag, encrypt_flag, mic_flag;
+-    int     v1_format;
+-    char   *msg;
+-    int     use_file;
+-    int     mcount;
+-    char    *username;
+-    char    *password;
++call_server(char *host, u_short port, gss_OID oid, char *service_name,
++            OM_uint32 gss_flags, int auth_flag, int wrap_flag,
++            int encrypt_flag, int mic_flag, int v1_format, char *msg,
++            int use_file, int mcount, char *username, char *password)
+ {
+     gss_ctx_id_t context = GSS_C_NO_CONTEXT;
+     gss_buffer_desc in_buf, out_buf;
+@@ -774,9 +761,7 @@ worker_bee(void *unused)
+ }
+ 
+ int
+-main(argc, argv)
+-    int     argc;
+-    char  **argv;
++main(int argc, char **argv)
+ {
+     int     i;
+ 
+diff --git a/src/appl/gss-sample/gss-misc.c b/src/appl/gss-sample/gss-misc.c
+index 1d051edf1e..7eb4c7971d 100644
+--- a/src/appl/gss-sample/gss-misc.c
++++ b/src/appl/gss-sample/gss-misc.c
+@@ -157,10 +157,7 @@ read_all(int fildes, void *data, unsigned int nbyte)
+  * if an error occurs or if it could not write all the data.
+  */
+ int
+-send_token(s, flags, tok)
+-    int     s;
+-    int     flags;
+-    gss_buffer_t tok;
++send_token(int s, int flags, gss_buffer_t tok)
+ {
+     int     ret;
+     unsigned char char_flags = (unsigned char) flags;
+@@ -230,10 +227,7 @@ send_token(s, flags, tok)
+  * and -1 if an error occurs or if it could not read all the data.
+  */
+ int
+-recv_token(s, flags, tok)
+-    int     s;
+-    int    *flags;
+-    gss_buffer_t tok;
++recv_token(int s, int *flags, gss_buffer_t tok)
+ {
+     int     ret;
+     unsigned char char_flags;
+@@ -303,10 +297,7 @@ recv_token(s, flags, tok)
+ }
+ 
+ static void
+-display_status_1(m, code, type)
+-    char   *m;
+-    OM_uint32 code;
+-    int     type;
++display_status_1(char *m, OM_uint32 code, int type)
+ {
+     OM_uint32 min_stat;
+     gss_buffer_desc msg;
+@@ -344,10 +335,7 @@ display_status_1(m, code, type)
+  * followed by a newline.
+  */
+ void
+-display_status(msg, maj_stat, min_stat)
+-    char   *msg;
+-    OM_uint32 maj_stat;
+-    OM_uint32 min_stat;
++display_status(char *msg, OM_uint32 maj_stat, OM_uint32 min_stat)
+ {
+     display_status_1(msg, maj_stat, GSS_C_GSS_CODE);
+     display_status_1(msg, min_stat, GSS_C_MECH_CODE);
+@@ -370,8 +358,7 @@ display_status(msg, maj_stat, min_stat)
+  */
+ 
+ void
+-display_ctx_flags(flags)
+-    OM_uint32 flags;
++display_ctx_flags(OM_uint32 flags)
+ {
+     if (flags & GSS_C_DELEG_FLAG)
+         fprintf(display_file, "context flag: GSS_C_DELEG_FLAG\n");
+@@ -388,8 +375,7 @@ display_ctx_flags(flags)
+ }
+ 
+ void
+-print_token(tok)
+-    gss_buffer_t tok;
++print_token(gss_buffer_t tok)
+ {
+     unsigned int   i;
+     unsigned char *p = tok->value;
+diff --git a/src/appl/gss-sample/gss-server.c b/src/appl/gss-sample/gss-server.c
+index 9b6ce9ffb3..0e9c857e56 100644
+--- a/src/appl/gss-sample/gss-server.c
++++ b/src/appl/gss-sample/gss-server.c
+@@ -73,7 +73,7 @@ static OM_uint32
+ showLocalIdentity(OM_uint32 *minor, gss_name_t name);
+ 
+ static void
+-usage()
++usage(void)
+ {
+     fprintf(stderr, "Usage: gss-server [-port port] [-verbose] [-once]");
+ #ifdef _WIN32
+diff --git a/src/appl/user_user/server.c b/src/appl/user_user/server.c
+index f2b5b614e3..afb3d2bcba 100644
+--- a/src/appl/user_user/server.c
++++ b/src/appl/user_user/server.c
+@@ -39,9 +39,8 @@
+ 
+ /* fd 0 is a tcp socket used to talk to the client */
+ 
+-int main(argc, argv)
+-    int argc;
+-    char *argv[];
++int
++main(int argc, char *argv[])
+ {
+     krb5_data pname_data, tkt_data;
+     int sock = 0;
+diff --git a/src/clients/kdestroy/kdestroy.c b/src/clients/kdestroy/kdestroy.c
+index 774b729fdb..48f672a1e8 100644
+--- a/src/clients/kdestroy/kdestroy.c
++++ b/src/clients/kdestroy/kdestroy.c
+@@ -47,7 +47,7 @@ char *progname;
+ 
+ 
+ static void
+-usage()
++usage(void)
+ {
+     fprintf(stderr, _("Usage: %s [-A] [-q] [-c cache_name] [-p princ_name]\n"),
+             progname);
+diff --git a/src/clients/kinit/kinit.c b/src/clients/kinit/kinit.c
+index f4c7b2b842..7a33ffae59 100644
+--- a/src/clients/kinit/kinit.c
++++ b/src/clients/kinit/kinit.c
+@@ -45,7 +45,7 @@
+ #ifdef HAVE_PWD_H
+ #include <pwd.h>
+ static char *
+-get_name_from_os()
++get_name_from_os(void)
+ {
+     struct passwd *pw;
+ 
+@@ -137,7 +137,7 @@ const char *shopts = "r:fpFPn54aAVl:s:c:kit:T:RS:vX:CEI:";
+ #define USAGE_BREAK "\n\t"
+ 
+ static void
+-usage()
++usage(void)
+ {
+     fprintf(stderr,
+             _("Usage: %s [-V] [-l lifetime] [-s start_time] "
+diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c
+index dcdc5a2d59..c797b1698f 100644
+--- a/src/clients/klist/klist.c
++++ b/src/clients/klist/klist.c
+@@ -80,7 +80,7 @@ static void fillit(FILE *, unsigned int, int);
+ #define KEYTAB 2
+ 
+ static void
+-usage()
++usage(void)
+ {
+     fprintf(stderr, _("Usage: %s [-e] [-V] [[-c] [-l] [-A] [-d] [-f] [-s] "
+                       "[-a [-n]]] [-k [-i] [-t] [-K]] [-C] [name]\n"),
+diff --git a/src/clients/ksu/authorization.c b/src/clients/ksu/authorization.c
+index fb9d5d0942..17a8a8f2f0 100644
+--- a/src/clients/ksu/authorization.c
++++ b/src/clients/ksu/authorization.c
+@@ -30,9 +30,8 @@
+ 
+ static void auth_cleanup (FILE *, FILE *, char *);
+ 
+-krb5_boolean fowner(fp, uid)
+-    FILE *fp;
+-    uid_t uid;
++krb5_boolean
++fowner(FILE *fp, uid_t uid)
+ {
+     struct stat sbuf;
+ 
+@@ -59,16 +58,10 @@ krb5_boolean fowner(fp, uid)
+  *
+  */
+ 
+-krb5_error_code krb5_authorization(context, principal, luser,
+-                                   cmd, ok, out_fcmd)
+-/* IN */
+-    krb5_context context;
+-    krb5_principal principal;
+-    const char *luser;
+-    char *cmd;
+-    /* OUT */
+-    krb5_boolean *ok;
+-    char **out_fcmd;
++krb5_error_code
++krb5_authorization(krb5_context context, krb5_principal principal,
++                   const char *luser, char *cmd, krb5_boolean *ok,
++                   char **out_fcmd)
+ {
+     struct passwd *pwd;
+     char *princname;
+@@ -178,10 +171,8 @@ any tokens after the principal name  FALSE is returned.
+ 
+ ***********************************************************/
+ 
+-krb5_error_code k5login_lookup (fp, princname, found)
+-    FILE *fp;
+-    char *princname;
+-    krb5_boolean *found;
++krb5_error_code
++k5login_lookup(FILE *fp, char *princname, krb5_boolean *found)
+ {
+ 
+     krb5_error_code retval;
+@@ -240,12 +231,9 @@ if princname is found{
+ 
+ 
+ ***********************************************************/
+-krb5_error_code k5users_lookup (fp, princname, cmd, found, out_fcmd)
+-    FILE *fp;
+-    char *princname;
+-    char *cmd;
+-    krb5_boolean *found;
+-    char **out_fcmd;
++krb5_error_code
++k5users_lookup(FILE *fp, char *princname, char *cmd,
++               krb5_boolean *found, char **out_fcmd)
+ {
+     krb5_error_code retval;
+     char * line;
+@@ -328,10 +316,8 @@ resolves it into a full path name.
+ 
+ ************************************************/
+ 
+-krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err)
+-    char *fcmd;
+-    char ***out_fcmd;
+-    char **out_err;
++krb5_boolean
++fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err)
+ {
+     char * err;
+     char ** tmp_fcmd;
+@@ -407,8 +393,8 @@ cmd_single - checks if cmd consists of a path
+ 
+ ********************************************/
+ 
+-krb5_boolean cmd_single(cmd)
+-    char * cmd;
++krb5_boolean
++cmd_single(char *cmd)
+ {
+ 
+     if ( ( strrchr( cmd, '/')) ==  NULL){
+@@ -423,9 +409,8 @@ cmd_arr_cmp_postfix - compares a command with the postfix
+          of fcmd
+ ********************************************/
+ 
+-int cmd_arr_cmp_postfix(fcmd_arr, cmd)
+-    char **fcmd_arr;
+-    char *cmd;
++int
++cmd_arr_cmp_postfix(char **fcmd_arr, char *cmd)
+ {
+     char  * temp_fcmd;
+     char *ptr;
+@@ -457,9 +442,8 @@ cmd_arr_cmp - checks if cmd matches any
+ 
+ **********************************************/
+ 
+-int cmd_arr_cmp (fcmd_arr, cmd)
+-    char **fcmd_arr;
+-    char *cmd;
++int
++cmd_arr_cmp(char **fcmd_arr, char *cmd)
+ {
+     int result =1;
+     int i = 0;
+@@ -475,10 +459,8 @@ int cmd_arr_cmp (fcmd_arr, cmd)
+ }
+ 
+ 
+-krb5_boolean find_first_cmd_that_exists(fcmd_arr, cmd_out, err_out)
+-    char **fcmd_arr;
+-    char **cmd_out;
+-    char **err_out;
++krb5_boolean
++find_first_cmd_that_exists(char **fcmd_arr, char **cmd_out, char **err_out)
+ {
+     struct stat st_temp;
+     int i = 0;
+@@ -517,12 +499,9 @@ returns 1 if there is an error, 0 if no error.
+ 
+ ***************************************************************/
+ 
+-int match_commands (fcmd, cmd, match, cmd_out, err_out)
+-    char *fcmd;
+-    char *cmd;
+-    krb5_boolean *match;
+-    char **cmd_out;
+-    char **err_out;
++int
++match_commands(char *fcmd, char *cmd, krb5_boolean *match,
++               char **cmd_out, char **err_out)
+ {
+     char ** fcmd_arr;
+     char * err;
+@@ -566,11 +545,8 @@ int match_commands (fcmd, cmd, match, cmd_out, err_out)
+               is set to null if eof.
+ *********************************************************/
+ 
+-krb5_error_code get_line (fp, out_line)
+-/* IN */
+-    FILE *fp;
+-    /* OUT */
+-    char **out_line;
++krb5_error_code
++get_line(FILE *fp, char **out_line)
+ {
+     char * line, *r, *newline , *line_ptr;
+     int chunk_count = 1;
+@@ -615,9 +591,8 @@ will be returned as part of the first token.
+ Note: this routine reuses the space pointed to by line
+ ******************************************************/
+ 
+-char *  get_first_token (line, lnext)
+-    char *line;
+-    char **lnext;
++char *
++get_first_token(char *line, char **lnext)
+ {
+ 
+     char * lptr, * out_ptr;
+@@ -651,8 +626,8 @@ Note: that this function modifies the stream
+       lnext to the next tocken.
+ **********************************************************/
+ 
+-char *  get_next_token (lnext)
+-    char **lnext;
++char *
++get_next_token (char **lnext)
+ {
+     char * lptr, * out_ptr;
+ 
+@@ -677,10 +652,8 @@ char *  get_next_token (lnext)
+     return out_ptr;
+ }
+ 
+-static void auth_cleanup(users_fp, login_fp, princname)
+-    FILE *users_fp;
+-    FILE *login_fp;
+-    char *princname;
++static void
++auth_cleanup(FILE *users_fp, FILE *login_fp, char *princname)
+ {
+ 
+     free (princname);
+@@ -690,8 +663,8 @@ static void auth_cleanup(users_fp, login_fp, princname)
+         fclose(login_fp);
+ }
+ 
+-void init_auth_names(pw_dir)
+-    char *pw_dir;
++void
++init_auth_names(char *pw_dir)
+ {
+     const char *sep;
+     int r1, r2;
+diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c
+index cbb9aa2b85..cca9ce2dfc 100644
+--- a/src/clients/ksu/ccache.c
++++ b/src/clients/ksu/ccache.c
+@@ -40,24 +40,18 @@ copies the default cache into the secondary cache,
+ 
+ ************************************************************************/
+ 
+-void show_credential();
++void show_credential(krb5_context, krb5_creds *, krb5_ccache);
+ 
+ /* modifies only the cc_other, the algorithm may look a bit funny,
+    but I had to do it this way, since remove function did not come
+    with k5 beta 3 release.
+ */
+ 
+-krb5_error_code krb5_ccache_copy(context, cc_def, target_principal, cc_target,
+-                                 restrict_creds, primary_principal, stored)
+-/* IN */
+-    krb5_context context;
+-    krb5_ccache cc_def;
+-    krb5_principal target_principal;
+-    krb5_ccache cc_target;
+-    krb5_boolean restrict_creds;
+-    krb5_principal primary_principal;
+-    /* OUT */
+-    krb5_boolean *stored;
++krb5_error_code
++krb5_ccache_copy(krb5_context context, krb5_ccache cc_def,
++                 krb5_principal target_principal, krb5_ccache cc_target,
++                 krb5_boolean restrict_creds, krb5_principal primary_principal,
++                 krb5_boolean *stored)
+ {
+     int i=0;
+     krb5_error_code retval=0;
+@@ -105,11 +99,9 @@ krb5_error_code krb5_ccache_copy(context, cc_def, target_principal, cc_target,
+ }
+ 
+ 
+-krb5_error_code krb5_store_all_creds(context, cc, creds_def, creds_other)
+-    krb5_context context;
+-    krb5_ccache cc;
+-    krb5_creds **creds_def;
+-    krb5_creds **creds_other;
++krb5_error_code
++krb5_store_all_creds(krb5_context context, krb5_ccache cc,
++                     krb5_creds **creds_def, krb5_creds **creds_other)
+ {
+ 
+     int i = 0;
+@@ -173,10 +165,8 @@ krb5_error_code krb5_store_all_creds(context, cc, creds_def, creds_other)
+     return 0;
+ }
+ 
+-krb5_boolean compare_creds(context, cred1, cred2)
+-    krb5_context context;
+-    krb5_creds *cred1;
+-    krb5_creds *cred2;
++krb5_boolean
++compare_creds(krb5_context context, krb5_creds *cred1, krb5_creds *cred2)
+ {
+     krb5_boolean retval;
+ 
+@@ -188,13 +178,9 @@ krb5_boolean compare_creds(context, cred1, cred2)
+     return retval;
+ }
+ 
+-
+-
+-
+-krb5_error_code krb5_get_nonexp_tkts(context, cc, creds_array)
+-    krb5_context context;
+-    krb5_ccache cc;
+-    krb5_creds ***creds_array;
++krb5_error_code
++krb5_get_nonexp_tkts(krb5_context context, krb5_ccache cc,
++                     krb5_creds ***creds_array)
+ {
+ 
+     krb5_creds creds, temp_tktq, temp_tkt;
+@@ -262,10 +248,8 @@ krb5_error_code krb5_get_nonexp_tkts(context, cc, creds_array)
+ 
+ }
+ 
+-
+-krb5_error_code krb5_check_exp(context, tkt_time)
+-    krb5_context context;
+-    krb5_ticket_times tkt_time;
++krb5_error_code
++krb5_check_exp(krb5_context context, krb5_ticket_times tkt_time)
+ {
+     krb5_error_code retval =0;
+     krb5_timestamp currenttime;
+@@ -290,9 +274,8 @@ krb5_error_code krb5_check_exp(context, tkt_time)
+     return 0;
+ }
+ 
+-
+-char *flags_string(cred)
+-    krb5_creds *cred;
++char *
++flags_string(krb5_creds *cred)
+ {
+     static char buf[32];
+     int i = 0;
+@@ -323,7 +306,8 @@ char *flags_string(cred)
+     return(buf);
+ }
+ 
+-void printtime(krb5_timestamp ts)
++void
++printtime(krb5_timestamp ts)
+ {
+     char fmtbuf[18], fill = ' ';
+ 
+@@ -333,9 +317,7 @@ void printtime(krb5_timestamp ts)
+ 
+ 
+ krb5_error_code
+-krb5_get_login_princ(luser, princ_list)
+-    const char *luser;
+-    char ***princ_list;
++krb5_get_login_princ(const char *luser, char ***princ_list)
+ {
+     struct stat sbuf;
+     struct passwd *pwd;
+@@ -420,13 +402,8 @@ krb5_get_login_princ(luser, princ_list)
+     return 0;
+ }
+ 
+-
+-
+ void
+-show_credential(context, cred, cc)
+-    krb5_context context;
+-    krb5_creds *cred;
+-    krb5_ccache cc;
++show_credential(krb5_context context, krb5_creds *cred, krb5_ccache cc)
+ {
+     krb5_error_code retval;
+     char *name, *sname, *flags;
+@@ -519,11 +496,9 @@ gen_sym(krb5_context context, char **sym_out)
+     return 0;
+ }
+ 
+-krb5_error_code krb5_ccache_overwrite(context, ccs, cct, primary_principal)
+-    krb5_context context;
+-    krb5_ccache ccs;
+-    krb5_ccache cct;
+-    krb5_principal primary_principal;
++krb5_error_code
++krb5_ccache_overwrite(krb5_context context, krb5_ccache ccs, krb5_ccache cct,
++                      krb5_principal primary_principal)
+ {
+     krb5_error_code retval=0;
+     krb5_principal temp_principal;
+@@ -560,14 +535,10 @@ krb5_error_code krb5_ccache_overwrite(context, ccs, cct, primary_principal)
+     return retval;
+ }
+ 
+-krb5_error_code krb5_store_some_creds(context, cc, creds_def, creds_other, prst,
+-                                      stored)
+-    krb5_context context;
+-    krb5_ccache cc;
+-    krb5_creds **creds_def;
+-    krb5_creds **creds_other;
+-    krb5_principal prst;
+-    krb5_boolean *stored;
++krb5_error_code
++krb5_store_some_creds(krb5_context context, krb5_ccache cc,
++                      krb5_creds **creds_def, krb5_creds **creds_other,
++                      krb5_principal prst, krb5_boolean *stored)
+ {
+ 
+     int i = 0;
+@@ -610,10 +581,8 @@ krb5_error_code krb5_store_some_creds(context, cc, creds_def, creds_other, prst,
+     return 0;
+ }
+ 
+-krb5_error_code krb5_ccache_filter (context, cc, prst)
+-    krb5_context context;
+-    krb5_ccache cc;
+-    krb5_principal prst;
++krb5_error_code
++krb5_ccache_filter(krb5_context context, krb5_ccache cc, krb5_principal prst)
+ {
+ 
+     int i=0;
+@@ -657,10 +626,9 @@ krb5_error_code krb5_ccache_filter (context, cc, prst)
+     return 0;
+ }
+ 
+-krb5_boolean  krb5_find_princ_in_cred_list (context, creds_list, princ)
+-    krb5_context context;
+-    krb5_creds **creds_list;
+-    krb5_principal princ;
++krb5_boolean
++krb5_find_princ_in_cred_list(krb5_context context, krb5_creds **creds_list,
++                             krb5_principal princ)
+ {
+ 
+     int i = 0;
+@@ -682,11 +650,9 @@ krb5_boolean  krb5_find_princ_in_cred_list (context, creds_list, princ)
+     return temp_stored;
+ }
+ 
+-krb5_error_code  krb5_find_princ_in_cache (context, cc, princ, found)
+-    krb5_context context;
+-    krb5_ccache cc;
+-    krb5_principal princ;
+-    krb5_boolean *found;
++krb5_error_code
++krb5_find_princ_in_cache(krb5_context context, krb5_ccache cc,
++                         krb5_principal princ, krb5_boolean *found)
+ {
+     krb5_error_code retval;
+     krb5_creds ** creds_list = NULL;
+diff --git a/src/clients/ksu/heuristic.c b/src/clients/ksu/heuristic.c
+index 4f7280f4cb..e906de8ef0 100644
+--- a/src/clients/ksu/heuristic.c
++++ b/src/clients/ksu/heuristic.c
+@@ -41,9 +41,8 @@ get_all_princ_from_file - retrieves all principal names
+ static void close_time (int, FILE *, int, FILE *);
+ static krb5_boolean find_str_in_list (char **, char *);
+ 
+-krb5_error_code get_all_princ_from_file (fp, plist)
+-    FILE *fp;
+-    char ***plist;
++krb5_error_code
++get_all_princ_from_file(FILE *fp, char ***plist)
+ {
+ 
+     krb5_error_code retval;
+@@ -92,10 +91,8 @@ list_union - combines list1 and list2 into combined_list.
+              or used by combined_list.
+ **************************************************************/
+ 
+-krb5_error_code list_union(list1, list2, combined_list)
+-    char **list1;
+-    char **list2;
+-    char ***combined_list;
++krb5_error_code
++list_union(char **list1, char **list2, char ***combined_list)
+ {
+ 
+     unsigned int c1 =0, c2 = 0, i=0, j=0;
+@@ -141,11 +138,7 @@ krb5_error_code list_union(list1, list2, combined_list)
+ }
+ 
+ krb5_error_code
+-filter(fp, cmd, k5users_list, k5users_filt_list)
+-    FILE *fp;
+-    char *cmd;
+-    char **k5users_list;
+-    char ***k5users_filt_list;
++filter(FILE *fp, char *cmd, char **k5users_list, char ***k5users_filt_list)
+ {
+ 
+     krb5_error_code retval =0;
+@@ -195,10 +188,7 @@ filter(fp, cmd, k5users_list, k5users_filt_list)
+ }
+ 
+ krb5_error_code
+-get_authorized_princ_names(luser, cmd, princ_list)
+-    const char *luser;
+-    char *cmd;
+-    char ***princ_list;
++get_authorized_princ_names(const char *luser, char *cmd, char ***princ_list)
+ {
+ 
+     struct passwd *pwd;
+@@ -272,11 +262,8 @@ get_authorized_princ_names(luser, cmd, princ_list)
+     return 0;
+ }
+ 
+-static void close_time(k5users_flag, users_fp, k5login_flag, login_fp)
+-    int k5users_flag;
+-    FILE *users_fp;
+-    int k5login_flag;
+-    FILE *login_fp;
++static void
++close_time(int k5users_flag, FILE *users_fp, int k5login_flag, FILE *login_fp)
+ {
+ 
+     if (!k5users_flag) fclose(users_fp);
+@@ -284,9 +271,8 @@ static void close_time(k5users_flag, users_fp, k5login_flag, login_fp)
+ 
+ }
+ 
+-static krb5_boolean find_str_in_list(list , elm)
+-    char **list;
+-    char *elm;
++static krb5_boolean
++find_str_in_list(char **list, char *elm)
+ {
+ 
+     int i=0;
+@@ -313,12 +299,9 @@ A principal is picked that has the best chance of getting in.
+ 
+ **********************************************************************/
+ 
+-
+-krb5_error_code get_closest_principal(context, plist, client, found)
+-    krb5_context context;
+-    char **plist;
+-    krb5_principal *client;
+-    krb5_boolean *found;
++krb5_error_code
++get_closest_principal(krb5_context context, char **plist,
++                      krb5_principal *client, krb5_boolean *found)
+ {
+     krb5_error_code retval =0;
+     krb5_principal temp_client, best_client = NULL;
+@@ -385,12 +368,9 @@ find_either_ticket checks to see whether there is a ticket for the
+    end server or tgt, if neither is there the return FALSE,
+ *****************************************************************/
+ 
+-krb5_error_code find_either_ticket (context, cc, client, end_server, found)
+-    krb5_context context;
+-    krb5_ccache cc;
+-    krb5_principal client;
+-    krb5_principal end_server;
+-    krb5_boolean *found;
++krb5_error_code
++find_either_ticket(krb5_context context, krb5_ccache cc, krb5_principal client,
++                   krb5_principal end_server, krb5_boolean *found)
+ {
+ 
+     krb5_principal kdc_server;
+@@ -424,13 +404,9 @@ krb5_error_code find_either_ticket (context, cc, client, end_server, found)
+     return 0;
+ }
+ 
+-
+-krb5_error_code find_ticket (context, cc, client, server, found)
+-    krb5_context context;
+-    krb5_ccache cc;
+-    krb5_principal client;
+-    krb5_principal server;
+-    krb5_boolean *found;
++krb5_error_code
++find_ticket(krb5_context context, krb5_ccache cc, krb5_principal client,
++            krb5_principal server, krb5_boolean *found)
+ {
+ 
+     krb5_creds tgt, tgtq;
+@@ -470,13 +446,9 @@ krb5_error_code find_ticket (context, cc, client, server, found)
+     return 0;
+ }
+ 
+-
+-
+-krb5_error_code find_princ_in_list (context, princ, plist, found)
+-    krb5_context context;
+-    krb5_principal princ;
+-    char **plist;
+-    krb5_boolean *found;
++krb5_error_code
++find_princ_in_list(krb5_context context, krb5_principal princ, char **plist,
++                   krb5_boolean *found)
+ {
+ 
+     int i=0;
+@@ -516,21 +488,13 @@ path_out gets set to ...
+ 
+ ***********************************************************************/
+ 
+-krb5_error_code get_best_princ_for_target(context, source_uid, target_uid,
+-                                          source_user, target_user,
+-                                          cc_source, options, cmd,
+-                                          hostname, client, path_out)
+-    krb5_context context;
+-    uid_t source_uid;
+-    uid_t target_uid;
+-    char *source_user;
+-    char *target_user;
+-    krb5_ccache cc_source;
+-    krb5_get_init_creds_opt *options;
+-    char *cmd;
+-    char *hostname;
+-    krb5_principal *client;
+-    int *path_out;
++krb5_error_code
++get_best_princ_for_target(krb5_context context, uid_t source_uid,
++                          uid_t target_uid, char *source_user,
++                          char *target_user, krb5_ccache cc_source,
++                          krb5_get_init_creds_opt *options, char *cmd,
++                          char *hostname, krb5_principal *client,
++                          int *path_out)
+ {
+ 
+     princ_info princ_trials[10];
+diff --git a/src/clients/ksu/krb_auth_su.c b/src/clients/ksu/krb_auth_su.c
+index fb848dcab1..db10251f95 100644
+--- a/src/clients/ksu/krb_auth_su.c
++++ b/src/clients/ksu/krb_auth_su.c
+@@ -29,18 +29,13 @@
+ #include "ksu.h"
+ 
+ 
+-void plain_dump_principal ();
+-
+-krb5_boolean krb5_auth_check(context, client_pname, hostname, options,
+-                             target_user, cc, path_passwd, target_uid)
+-    krb5_context context;
+-    krb5_principal client_pname;
+-    char *hostname;
+-    krb5_get_init_creds_opt *options;
+-    char *target_user;
+-    uid_t target_uid;
+-    krb5_ccache cc;
+-    int *path_passwd;
++void plain_dump_principal(krb5_context, krb5_principal);
++
++krb5_boolean
++krb5_auth_check(krb5_context context, krb5_principal client_pname,
++                char *hostname, krb5_get_init_creds_opt *options,
++                char *target_user, krb5_ccache cc, int *path_passwd,
++                uid_t target_uid)
+ {
+     krb5_principal client;
+     krb5_verify_init_creds_opt vfy_opts;
+@@ -137,13 +132,10 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options,
+     return (TRUE);
+ }
+ 
+-krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password,
+-                                    creds_out)
+-    krb5_context context;
+-    krb5_principal client;
+-    krb5_get_init_creds_opt *options;
+-    krb5_boolean *zero_password;
+-    krb5_creds *creds_out;
++krb5_boolean
++ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client,
++                       krb5_get_init_creds_opt *options,
++                       krb5_boolean *zero_password, krb5_creds *creds_out)
+ {
+     krb5_error_code code;
+     krb5_creds creds;
+@@ -212,11 +204,8 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password,
+     return (TRUE);
+ }
+ 
+-
+-void dump_principal (context, str, p)
+-    krb5_context context;
+-    char *str;
+-    krb5_principal p;
++void
++dump_principal(krb5_context context, char *str, krb5_principal p)
+ {
+     char * stname;
+     krb5_error_code retval;
+@@ -228,9 +217,8 @@ void dump_principal (context, str, p)
+     fprintf(stderr, " %s: %s\n", str, stname);
+ }
+ 
+-void plain_dump_principal (context, p)
+-    krb5_context context;
+-    krb5_principal p;
++void
++plain_dump_principal (krb5_context context, krb5_principal p)
+ {
+     char * stname;
+     krb5_error_code retval;
+@@ -251,11 +239,8 @@ A principal is picked that has the best chance of getting in.
+ 
+ **********************************************************************/
+ 
+-
+-krb5_error_code get_best_principal(context, plist, client)
+-    krb5_context context;
+-    char **plist;
+-    krb5_principal *client;
++krb5_error_code
++get_best_principal(krb5_context context, char **plist, krb5_principal *client)
+ {
+     krb5_error_code retval =0;
+     krb5_principal temp_client, best_client = NULL;
+diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
+index 931f054041..2a351662c8 100644
+--- a/src/clients/ksu/main.c
++++ b/src/clients/ksu/main.c
+@@ -70,7 +70,9 @@ static krb5_error_code resolve_target_cache(krb5_context ksu_context,
+ /* insure the proper specification of target user as well as catching
+    ill specified arguments to commands */
+ 
+-void usage (){
++void
++usage(void)
++{
+     fprintf(stderr,
+             _("Usage: %s [target user] [-n principal] [-c source cachename] "
+               "[-k] [-r time] [-p|-P] [-f|-F] [-l lifetime] [-zZ] [-q] "
+@@ -86,9 +88,7 @@ void usage (){
+ static uid_t source_uid, target_uid;
+ 
+ int
+-main (argc, argv)
+-    int argc;
+-    char ** argv;
++main(int argc, char ** argv)
+ {
+     int hp =0;
+     int some_rest_copy = 0;
+@@ -120,7 +120,6 @@ main (argc, argv)
+     char ** params;
+     int keep_target_cache = 0;
+     int child_pid, child_pgrp, ret_pid;
+-    extern char * getpass(), *crypt();
+     int pargc;
+     char ** pargv;
+     krb5_boolean stored = FALSE, cc_reused = FALSE, given_princ = FALSE;
+@@ -1049,11 +1048,10 @@ cleanup:
+ 
+ #ifdef HAVE_GETUSERSHELL
+ 
+-int standard_shell(sh)
+-    char *sh;
++int
++standard_shell(char *sh)
+ {
+     char *cp;
+-    char *getusershell();
+ 
+     while ((cp = getusershell()) != NULL)
+         if (!strcmp(cp, sh))
+@@ -1063,7 +1061,8 @@ int standard_shell(sh)
+ 
+ #endif /* HAVE_GETUSERSHELL */
+ 
+-static char * ontty()
++static char *
++ontty(void)
+ {
+     char *p;
+     static char buf[MAXPATHLEN + 5];
+@@ -1080,10 +1079,8 @@ static char * ontty()
+     return (buf);
+ }
+ 
+-
+-static int set_env_var(name, value)
+-    char *name;
+-    char *value;
++static int
++set_env_var(char *name, char *value)
+ {
+     char * env_var_buf;
+ 
+@@ -1092,9 +1089,8 @@ static int set_env_var(name, value)
+ 
+ }
+ 
+-static void sweep_up(context, cc)
+-    krb5_context context;
+-    krb5_ccache cc;
++static void
++sweep_up(krb5_context context, krb5_ccache cc)
+ {
+     krb5_error_code retval;
+ 
+@@ -1122,11 +1118,7 @@ get_params is to be called for the -a option or -e option to
+ *****************************************************************/
+ 
+ krb5_error_code
+-get_params(optindex, pargc, pargv, params)
+-    int *optindex;
+-    int pargc;
+-    char **pargv;
+-    char ***params;
++get_params(int *optindex, int pargc, char **pargv, char ***params)
+ {
+ 
+     int i,j;
+@@ -1159,10 +1151,8 @@ void print_status(const char *fmt, ...)
+ }
+ 
+ krb5_error_code
+-ksu_tgtname(context, server, client, tgtprinc)
+-    krb5_context context;
+-    const krb5_data *server, *client;
+-    krb5_principal *tgtprinc;
++ksu_tgtname(krb5_context context, const krb5_data *server,
++            const krb5_data *client, krb5_principal *tgtprinc)
+ {
+     return krb5_build_principal_ext(context, tgtprinc, client->length, client->data,
+                                     KRB5_TGS_NAME_SIZE, KRB5_TGS_NAME,
+diff --git a/src/clients/kvno/kvno.c b/src/clients/kvno/kvno.c
+index 03f72f596d..ac77a7d524 100644
+--- a/src/clients/kvno/kvno.c
++++ b/src/clients/kvno/kvno.c
+@@ -39,7 +39,7 @@ static char *prog;
+ static int quiet = 0;
+ 
+ static void
+-xusage()
++xusage(void)
+ {
+     fprintf(stderr, _("usage: %s [-c ccache] [-e etype] [-k keytab] [-q] "
+                       "[-u | -S sname]\n"
+diff --git a/src/include/gssrpc/auth_gssapi.h b/src/include/gssrpc/auth_gssapi.h
+index 9d94853228..63436a698a 100644
+--- a/src/include/gssrpc/auth_gssapi.h
++++ b/src/include/gssrpc/auth_gssapi.h
+@@ -82,14 +82,12 @@ bool_t xdr_authgssapi_init_res(XDR *, auth_gssapi_init_res *);
+ 
+ bool_t auth_gssapi_wrap_data
+ (OM_uint32 *major, OM_uint32 *minor,
+-	   gss_ctx_id_t context, uint32_t seq_num, XDR
+-	   *out_xdrs, bool_t (*xdr_func)(), caddr_t
+-	   xdr_ptr);
++	   gss_ctx_id_t context, uint32_t seq_num,
++	   XDR *out_xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr);
+ bool_t auth_gssapi_unwrap_data
+ (OM_uint32 *major, OM_uint32 *minor,
+-	   gss_ctx_id_t context, uint32_t seq_num, XDR
+-	   *in_xdrs, bool_t (*xdr_func)(), caddr_t
+-	   xdr_ptr);
++	   gss_ctx_id_t context, uint32_t seq_num,
++	   XDR *in_xdrs, xdrproc_t xdr_func, caddr_t xdr_ptr);
+ 
+ AUTH *auth_gssapi_create
+ (CLIENT *clnt,
+diff --git a/src/include/gssrpc/xdr.h b/src/include/gssrpc/xdr.h
+index da9e173782..4e5c29bdc2 100644
+--- a/src/include/gssrpc/xdr.h
++++ b/src/include/gssrpc/xdr.h
+@@ -102,7 +102,6 @@ enum xdr_op {
+  *
+  * XXX can't actually prototype it, because some take three args!!!
+  */
+-typedef	bool_t (*xdrproc_t)();
+ 
+ /*
+  * The XDR handle.
+@@ -143,6 +142,8 @@ typedef struct XDR {
+ 	int		x_handy;	/* extra private word */
+ } XDR;
+ 
++typedef	bool_t (*xdrproc_t)(XDR *, void *);
++
+ /*
+  * Operations defined on a XDR handle
+  *
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index 768110e5ef..b3e07945c1 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -2236,7 +2236,7 @@ make_data(void *data, unsigned int len)
+ }
+ 
+ static inline krb5_data
+-empty_data()
++empty_data(void)
+ {
+     return make_data(NULL, 0);
+ }
+diff --git a/src/include/k5-plugin.h b/src/include/k5-plugin.h
+index 90809e168e..5c5af586c5 100644
+--- a/src/include/k5-plugin.h
++++ b/src/include/k5-plugin.h
+@@ -97,7 +97,7 @@ krb5int_get_plugin_data (struct plugin_file_handle *, const char *, void **,
+ 
+ long KRB5_CALLCONV
+ krb5int_get_plugin_func (struct plugin_file_handle *, const char *,
+-                         void (**)(), struct errinfo *);
++                         void (**)(void), struct errinfo *);
+ 
+ 
+ long KRB5_CALLCONV
+diff --git a/src/include/net-server.h b/src/include/net-server.h
+index a30749d851..29b235eeb8 100644
+--- a/src/include/net-server.h
++++ b/src/include/net-server.h
+@@ -30,6 +30,7 @@
+ #define NET_SERVER_H
+ 
+ #include <verto.h>
++#include <gssrpc/rpc.h>
+ 
+ /* The delimiter characters supported by the addresses string. */
+ #define ADDRESSES_DELIM ",; "
+@@ -64,13 +65,14 @@ krb5_error_code loop_add_udp_address(int default_port, const char *addresses);
+ krb5_error_code loop_add_tcp_address(int default_port, const char *addresses);
+ krb5_error_code loop_add_rpc_service(int default_port, const char *addresses,
+                                      u_long prognum, u_long versnum,
+-                                     void (*dispatchfn)());
++                                     void (*dispatchfn)(struct svc_req *,
++                                                        SVCXPRT *));
+ 
+ krb5_error_code loop_setup_network(verto_ctx *ctx, void *handle,
+                                    const char *progname,
+                                    int tcp_listen_backlog);
+ krb5_error_code loop_setup_signals(verto_ctx *ctx, void *handle,
+-                                   void (*reset)());
++                                   void (*reset)(void *));
+ void loop_free(verto_ctx *ctx);
+ 
+ /* to be supplied by the server application */
+diff --git a/src/kadmin/cli/getdate.y b/src/kadmin/cli/getdate.y
+index d14cf963c5..3d69f0b8a4 100644
+--- a/src/kadmin/cli/getdate.y
++++ b/src/kadmin/cli/getdate.y
+@@ -100,9 +100,6 @@ struct my_timeb {
+ #define bcopy(from, to, len) memcpy ((to), (from), (len))
+ #endif
+ 
+-extern struct tm	*gmtime();
+-extern struct tm	*localtime();
+-
+ #define yyparse getdate_yyparse
+ #define yylex getdate_yylex
+ #define yyerror getdate_yyerror
+diff --git a/src/kadmin/cli/kadmin.c b/src/kadmin/cli/kadmin.c
+index f3ea6fae17..23b64b0f58 100644
+--- a/src/kadmin/cli/kadmin.c
++++ b/src/kadmin/cli/kadmin.c
+@@ -98,7 +98,7 @@ error(const char *fmt, ...)
+ }
+ 
+ static void
+-usage()
++usage(void)
+ {
+     error(_("Usage: %s [-r realm] [-p principal] [-q query] "
+             "[clnt|local args]\n"
+@@ -1130,7 +1130,7 @@ kadmin_parse_princ_args(int argc, char *argv[], kadm5_principal_ent_t oprinc,
+ }
+ 
+ static void
+-kadmin_addprinc_usage()
++kadmin_addprinc_usage(void)
+ {
+     error(_("usage: add_principal [options] principal\n"));
+     error(_("\toptions are:\n"));
+@@ -1154,7 +1154,7 @@ kadmin_addprinc_usage()
+ }
+ 
+ static void
+-kadmin_modprinc_usage()
++kadmin_modprinc_usage(void)
+ {
+     error(_("usage: modify_principal [options] principal\n"));
+     error(_("\toptions are:\n"));
+diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c
+index b0c8378b40..26f340af31 100644
+--- a/src/kadmin/cli/keytab.c
++++ b/src/kadmin/cli/keytab.c
+@@ -50,14 +50,14 @@ static int quiet;
+ static int norandkey;
+ 
+ static void
+-add_usage()
++add_usage(void)
+ {
+     fprintf(stderr, _("Usage: ktadd [-k[eytab] keytab] [-q] [-e keysaltlist] "
+                       "[-norandkey] [principal | -glob princ-exp] [...]\n"));
+ }
+ 
+ static void
+-rem_usage()
++rem_usage(void)
+ {
+     fprintf(stderr, _("Usage: ktremove [-k[eytab] keytab] [-q] principal "
+                       "[kvno|\"all\"|\"old\"]\n"));
+diff --git a/src/kadmin/dbutil/kdb5_create.c b/src/kadmin/dbutil/kdb5_create.c
+index 038a0b2190..9178fca6da 100644
+--- a/src/kadmin/dbutil/kdb5_create.c
++++ b/src/kadmin/dbutil/kdb5_create.c
+@@ -139,9 +139,8 @@ extern int exit_status;
+ extern kadm5_config_params global_params;
+ extern krb5_context util_context;
+ 
+-void kdb5_create(argc, argv)
+-    int argc;
+-    char *argv[];
++void
++kdb5_create(int argc, char *argv[])
+ {
+     int optchar;
+ 
+@@ -337,9 +336,7 @@ void kdb5_create(argc, argv)
+ }
+ 
+ static krb5_error_code
+-tgt_keysalt_iterate(ksent, ptr)
+-    krb5_key_salt_tuple *ksent;
+-    krb5_pointer        ptr;
++tgt_keysalt_iterate(krb5_key_salt_tuple *ksent, krb5_pointer ptr)
+ {
+     krb5_context        context;
+     krb5_error_code     kret;
+@@ -378,11 +375,8 @@ tgt_keysalt_iterate(ksent, ptr)
+ }
+ 
+ static krb5_error_code
+-add_principal(context, princ, op, pblock)
+-    krb5_context context;
+-    krb5_principal princ;
+-    enum ap_op op;
+-    struct realm_info *pblock;
++add_principal(krb5_context context, krb5_principal princ, enum ap_op op,
++              struct realm_info *pblock)
+ {
+     krb5_error_code       retval;
+     krb5_db_entry         *entry = NULL;
+diff --git a/src/kadmin/dbutil/kdb5_destroy.c b/src/kadmin/dbutil/kdb5_destroy.c
+index fffce74296..556cf0b6bb 100644
+--- a/src/kadmin/dbutil/kdb5_destroy.c
++++ b/src/kadmin/dbutil/kdb5_destroy.c
+@@ -39,9 +39,7 @@ char *yes = "yes\n";                    /* \n to compare against result of
+                                            fgets */
+ 
+ void
+-kdb5_destroy(argc, argv)
+-    int argc;
+-    char *argv[];
++kdb5_destroy(int argc, char *argv[])
+ {
+     extern int optind;
+     int optchar;
+diff --git a/src/kadmin/dbutil/kdb5_stash.c b/src/kadmin/dbutil/kdb5_stash.c
+index e05944f290..eaba6cd353 100644
+--- a/src/kadmin/dbutil/kdb5_stash.c
++++ b/src/kadmin/dbutil/kdb5_stash.c
+@@ -63,9 +63,7 @@ extern int exit_status;
+ extern int close_policy_db;
+ 
+ void
+-kdb5_stash(argc, argv)
+-    int argc;
+-    char *argv[];
++kdb5_stash(int argc, char *argv[])
+ {
+     extern char *optarg;
+     extern int optind;
+diff --git a/src/kadmin/dbutil/kdb5_util.c b/src/kadmin/dbutil/kdb5_util.c
+index 19a59250ee..55d529fa4c 100644
+--- a/src/kadmin/dbutil/kdb5_util.c
++++ b/src/kadmin/dbutil/kdb5_util.c
+@@ -143,8 +143,8 @@ struct _cmd_table {
+     {NULL, NULL, 0},
+ };
+ 
+-static struct _cmd_table *cmd_lookup(name)
+-    char *name;
++static struct _cmd_table *
++cmd_lookup(char *name)
+ {
+     struct _cmd_table *cmd = cmd_table;
+     while (cmd->name) {
+@@ -162,8 +162,9 @@ static struct _cmd_table *cmd_lookup(name)
+ char **db5util_db_args = NULL;
+ int    db5util_db_args_size = 0;
+ 
+-static void extended_com_err_fn (const char *myprog, errcode_t code,
+-                                 const char *fmt, va_list args)
++static void
++extended_com_err_fn(const char *myprog, errcode_t code, const char *fmt,
++                    va_list args)
+ {
+     const char *emsg;
+     if (code) {
+@@ -177,7 +178,8 @@ static void extended_com_err_fn (const char *myprog, errcode_t code,
+     fprintf (stderr, "\n");
+ }
+ 
+-int add_db_arg(char *arg)
++int
++add_db_arg(char *arg)
+ {
+     char **temp;
+     db5util_db_args_size++;
+@@ -191,9 +193,8 @@ int add_db_arg(char *arg)
+     return 1;
+ }
+ 
+-int main(argc, argv)
+-    int argc;
+-    char *argv[];
++int
++main(int argc, char *argv[])
+ {
+     struct _cmd_table *cmd = NULL;
+     char *koptarg, **cmd_argv;
+@@ -365,7 +366,8 @@ int main(argc, argv)
+  * cannot be fetched (the master key stash file may not exist when the
+  * program is run).
+  */
+-static int open_db_and_mkey()
++static int
++open_db_and_mkey()
+ {
+     krb5_error_code retval;
+     krb5_data scratch, pwd, seed;
+@@ -508,9 +510,7 @@ quit()
+ }
+ 
+ static void
+-add_random_key(argc, argv)
+-    int argc;
+-    char **argv;
++add_random_key(int argc, char **argv)
+ {
+     krb5_error_code ret;
+     krb5_principal princ;
+diff --git a/src/kadmin/dbutil/ovload.c b/src/kadmin/dbutil/ovload.c
+index 15a5ab3005..b2e6c00eac 100644
+--- a/src/kadmin/dbutil/ovload.c
++++ b/src/kadmin/dbutil/ovload.c
+@@ -11,9 +11,8 @@
+ 
+ #define LINESIZE        32768 /* XXX */
+ 
+-static int parse_pw_hist_ent(current, hist)
+-    char *current;
+-    osa_pw_hist_ent *hist;
++static int
++parse_pw_hist_ent(char *current, osa_pw_hist_ent *hist)
+ {
+     int tmp, i, j, ret;
+     char *cp;
+@@ -90,12 +89,9 @@ done:
+  *      [modifies]
+  *
+  */
+-int process_ov_principal(kcontext, fname, filep, verbose, linenop)
+-    krb5_context        kcontext;
+-    const char          *fname;
+-    FILE                *filep;
+-    krb5_boolean        verbose;
+-    int                 *linenop;
++int
++process_ov_principal(krb5_context kcontext, const char *fname, FILE *filep,
++                     krb5_boolean verbose, int *linenop)
+ {
+     XDR                     xdrs;
+     osa_princ_ent_t         rec;
+diff --git a/src/kadmin/dbutil/strtok.c b/src/kadmin/dbutil/strtok.c
+index dee466aea1..93f3e85a51 100644
+--- a/src/kadmin/dbutil/strtok.c
++++ b/src/kadmin/dbutil/strtok.c
+@@ -50,9 +50,7 @@
+  */
+ 
+ char *
+-nstrtok(s, delim)
+-    char *s;
+-    const char *delim;
++nstrtok(char *s, const char *delim)
+ {
+     const char *spanp;
+     int c, sc;
+diff --git a/src/kadmin/ktutil/ktutil.c b/src/kadmin/ktutil/ktutil.c
+index 92d7023a4f..87a69ca145 100644
+--- a/src/kadmin/ktutil/ktutil.c
++++ b/src/kadmin/ktutil/ktutil.c
+@@ -39,9 +39,8 @@ extern ss_request_table ktutil_cmds;
+ krb5_context kcontext;
+ krb5_kt_list ktlist = NULL;
+ 
+-int main(argc, argv)
+-    int argc;
+-    char *argv[];
++int
++main(int argc, char *argv[])
+ {
+     krb5_error_code retval;
+     int sci_idx;
+@@ -63,9 +62,8 @@ int main(argc, argv)
+     exit(0);
+ }
+ 
+-void ktutil_clear_list(argc, argv)
+-    int argc;
+-    char *argv[];
++void
++ktutil_clear_list(int argc, char *argv[])
+ {
+     krb5_error_code retval;
+ 
+@@ -79,9 +77,8 @@ void ktutil_clear_list(argc, argv)
+     ktlist = NULL;
+ }
+ 
+-void ktutil_read_v5(argc, argv)
+-    int argc;
+-    char *argv[];
++void
++ktutil_read_v5(int argc, char *argv[])
+ {
+     krb5_error_code retval;
+ 
+@@ -94,17 +91,15 @@ void ktutil_read_v5(argc, argv)
+         com_err(argv[0], retval, _("while reading keytab \"%s\""), argv[1]);
+ }
+ 
+-void ktutil_read_v4(argc, argv)
+-    int argc;
+-    char *argv[];
++void
++ktutil_read_v4(int argc, char *argv[])
+ {
+     fprintf(stderr, _("%s: reading srvtabs is no longer supported\n"),
+             argv[0]);
+ }
+ 
+-void ktutil_write_v5(argc, argv)
+-    int argc;
+-    char *argv[];
++void
++ktutil_write_v5(int argc, char *argv[])
+ {
+     krb5_error_code retval;
+ 
+@@ -117,17 +112,15 @@ void ktutil_write_v5(argc, argv)
+         com_err(argv[0], retval, _("while writing keytab \"%s\""), argv[1]);
+ }
+ 
+-void ktutil_write_v4(argc, argv)
+-    int argc;
+-    char *argv[];
++void
++ktutil_write_v4(int argc, char *argv[])
+ {
+     fprintf(stderr, _("%s: writing srvtabs is no longer supported\n"),
+             argv[0]);
+ }
+ 
+-void ktutil_add_entry(argc, argv)
+-    int argc;
+-    char *argv[];
++void
++ktutil_add_entry(int argc, char *argv[])
+ {
+     krb5_error_code retval;
+     char *princ = NULL;
+@@ -183,9 +176,8 @@ void ktutil_add_entry(argc, argv)
+         com_err(argv[0], retval, _("while adding new entry"));
+ }
+ 
+-void ktutil_delete_entry(argc, argv)
+-    int argc;
+-    char *argv[];
++void
++ktutil_delete_entry(int argc, char *argv[])
+ {
+     krb5_error_code retval;
+ 
+@@ -198,9 +190,8 @@ void ktutil_delete_entry(argc, argv)
+         com_err(argv[0], retval, _("while deleting entry %d"), atoi(argv[1]));
+ }
+ 
+-void ktutil_list(argc, argv)
+-    int argc;
+-    char *argv[];
++void
++ktutil_list(int argc, char *argv[])
+ {
+     krb5_error_code retval;
+     krb5_kt_list lp;
+diff --git a/src/kadmin/ktutil/ktutil_funcs.c b/src/kadmin/ktutil/ktutil_funcs.c
+index 56bed1bbcc..e489b5b57a 100644
+--- a/src/kadmin/ktutil/ktutil_funcs.c
++++ b/src/kadmin/ktutil/ktutil_funcs.c
+@@ -37,9 +37,8 @@
+ /*
+  * Free a kt_list
+  */
+-krb5_error_code ktutil_free_kt_list(context, list)
+-    krb5_context context;
+-    krb5_kt_list list;
++krb5_error_code
++ktutil_free_kt_list(krb5_context context, krb5_kt_list list)
+ {
+     krb5_kt_list lp, prev;
+     krb5_error_code retval = 0;
+@@ -60,10 +59,8 @@ krb5_error_code ktutil_free_kt_list(context, list)
+  * Delete a numbered entry in a kt_list.  Takes a pointer to a kt_list
+  * in case head gets deleted.
+  */
+-krb5_error_code ktutil_delete(context, list, idx)
+-    krb5_context context;
+-    krb5_kt_list *list;
+-    int idx;
++krb5_error_code
++ktutil_delete(krb5_context context, krb5_kt_list *list, int idx)
+ {
+     krb5_kt_list lp, prev;
+     int i;
+@@ -138,16 +135,10 @@ get_etype_info(krb5_context context, krb5_principal princ, int fetch,
+  * password or key.  If the keytab list is NULL, allocate a new
+  * one first.
+  */
+-krb5_error_code ktutil_add(context, list, princ_str, fetch, kvno,
+-                           enctype_str, use_pass, salt_str)
+-    krb5_context context;
+-    krb5_kt_list *list;
+-    char *princ_str;
+-    int fetch;
+-    krb5_kvno kvno;
+-    char *enctype_str;
+-    int use_pass;
+-    char *salt_str;
++krb5_error_code
++ktutil_add(krb5_context context, krb5_kt_list *list, char *princ_str,
++           int fetch, krb5_kvno kvno, char *enctype_str, int use_pass,
++           char *salt_str)
+ {
+     krb5_keytab_entry *entry = NULL;
+     krb5_kt_list lp, *last;
+@@ -269,10 +260,8 @@ cleanup:
+  * Read in a keytab and append it to list.  If list starts as NULL,
+  * allocate a new one if necessary.
+  */
+-krb5_error_code ktutil_read_keytab(context, name, list)
+-    krb5_context context;
+-    char *name;
+-    krb5_kt_list *list;
++krb5_error_code
++ktutil_read_keytab(krb5_context context, char *name, krb5_kt_list *list)
+ {
+     krb5_kt_list lp = NULL, tail = NULL, back = NULL;
+     krb5_keytab kt;
+@@ -344,10 +333,8 @@ close_kt:
+ /*
+  * Takes a kt_list and writes it to the named keytab.
+  */
+-krb5_error_code ktutil_write_keytab(context, list, name)
+-    krb5_context context;
+-    krb5_kt_list list;
+-    char *name;
++krb5_error_code
++ktutil_write_keytab(krb5_context context, krb5_kt_list list, char *name)
+ {
+     krb5_kt_list lp;
+     krb5_keytab kt;
+diff --git a/src/kadmin/server/ipropd_svc.c b/src/kadmin/server/ipropd_svc.c
+index 56e9b90b20..e5dd233e81 100644
+--- a/src/kadmin/server/ipropd_svc.c
++++ b/src/kadmin/server/ipropd_svc.c
+@@ -535,8 +535,8 @@ krb5_iprop_prog_1(struct svc_req *rqstp,
+ 	kdb_last_t iprop_get_updates_1_arg;
+     } argument;
+     void *result;
+-    bool_t (*_xdr_argument)(), (*_xdr_result)();
+-    void *(*local)(/* union XXX *, struct svc_req * */);
++    xdrproc_t _xdr_argument, _xdr_result;
++    void *(*local)(char *, struct svc_req *);
+     char *whoami = "krb5_iprop_prog_1";
+ 
+     if (!check_iprop_rpcsec_auth(rqstp)) {
+@@ -555,21 +555,21 @@ krb5_iprop_prog_1(struct svc_req *rqstp,
+ 	return;
+ 
+     case IPROP_GET_UPDATES:
+-	_xdr_argument = xdr_kdb_last_t;
+-	_xdr_result = xdr_kdb_incr_result_t;
+-	local = (void *(*)()) iprop_get_updates_1_svc;
++	_xdr_argument = (xdrproc_t)xdr_kdb_last_t;
++	_xdr_result = (xdrproc_t)xdr_kdb_incr_result_t;
++	local = (void *(*)(char *, struct svc_req *))iprop_get_updates_1_svc;
+ 	break;
+ 
+     case IPROP_FULL_RESYNC:
+-	_xdr_argument = xdr_void;
+-	_xdr_result = xdr_kdb_fullresync_result_t;
+-	local = (void *(*)()) iprop_full_resync_1_svc;
++	_xdr_argument = (xdrproc_t)xdr_void;
++	_xdr_result = (xdrproc_t)xdr_kdb_fullresync_result_t;
++	local = (void *(*)(char *, struct svc_req *))iprop_full_resync_1_svc;
+ 	break;
+ 
+     case IPROP_FULL_RESYNC_EXT:
+-	_xdr_argument = xdr_u_int32;
+-	_xdr_result = xdr_kdb_fullresync_result_t;
+-	local = (void *(*)()) iprop_full_resync_ext_1_svc;
++	_xdr_argument = (xdrproc_t)xdr_u_int32;
++	_xdr_result = (xdrproc_t)xdr_kdb_fullresync_result_t;
++	local = (void *(*)(char *, struct svc_req *))iprop_full_resync_ext_1_svc;
+ 	break;
+ 
+     default:
+@@ -587,7 +587,7 @@ krb5_iprop_prog_1(struct svc_req *rqstp,
+ 	svcerr_decode(transp);
+ 	return;
+     }
+-    result = (*local)(&argument, rqstp);
++    result = (*local)((char *)&argument, rqstp);
+ 
+     if (_xdr_result && result != NULL &&
+ 	!svc_sendreply(transp, _xdr_result, result)) {
+diff --git a/src/kadmin/server/kadm_rpc_svc.c b/src/kadmin/server/kadm_rpc_svc.c
+index 8371fa76ca..f0e43d9aea 100644
+--- a/src/kadmin/server/kadm_rpc_svc.c
++++ b/src/kadmin/server/kadm_rpc_svc.c
+@@ -9,6 +9,7 @@
+ #include <gssapi/gssapi_krb5.h> /* for gss_nt_krb5_name */
+ #include <syslog.h>
+ #include <kadm5/kadm_rpc.h>
++#include <kadm5/admin_xdr.h>
+ #include <krb5.h>
+ #include <kadm5/admin.h>
+ #include <adm_proto.h>
+@@ -36,9 +37,8 @@ static int check_rpcsec_auth(struct svc_req *);
+  * Modifies:
+  */
+ 
+-void kadm_1(rqstp, transp)
+-   struct svc_req *rqstp;
+-   SVCXPRT *transp;
++void
++kadm_1(struct svc_req *rqstp, SVCXPRT *transp)
+ {
+      union {
+ 	  cprinc_arg create_principal_2_arg;
+@@ -73,8 +73,8 @@ void kadm_1(rqstp, transp)
+ 	  getpkeys_ret get_principal_keys_ret;
+      } result;
+      bool_t retval;
+-     bool_t (*xdr_argument)(), (*xdr_result)();
+-     bool_t (*local)();
++     xdrproc_t xdr_argument, xdr_result;
++     bool_t (*local)(char *, void *, struct svc_req *);
+ 
+      if (rqstp->rq_cred.oa_flavor != AUTH_GSSAPI &&
+ 	 !check_rpcsec_auth(rqstp)) {
+@@ -92,153 +92,153 @@ void kadm_1(rqstp, transp)
+ 	  return;
+ 
+      case CREATE_PRINCIPAL:
+-	  xdr_argument = xdr_cprinc_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) create_principal_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_cprinc_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))create_principal_2_svc;
+ 	  break;
+ 
+      case DELETE_PRINCIPAL:
+-	  xdr_argument = xdr_dprinc_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) delete_principal_2_svc;
++          xdr_argument = (xdrproc_t)xdr_dprinc_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))delete_principal_2_svc;
+ 	  break;
+ 
+      case MODIFY_PRINCIPAL:
+-	  xdr_argument = xdr_mprinc_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) modify_principal_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_mprinc_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))modify_principal_2_svc;
+ 	  break;
+ 
+      case RENAME_PRINCIPAL:
+-	  xdr_argument = xdr_rprinc_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) rename_principal_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_rprinc_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))rename_principal_2_svc;
+ 	  break;
+ 
+      case GET_PRINCIPAL:
+-	  xdr_argument = xdr_gprinc_arg;
+-	  xdr_result = xdr_gprinc_ret;
+-	  local = (bool_t (*)()) get_principal_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_gprinc_arg;
++	  xdr_result = (xdrproc_t)xdr_gprinc_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))get_principal_2_svc;
+ 	  break;
+ 
+      case GET_PRINCS:
+-	  xdr_argument = xdr_gprincs_arg;
+-	  xdr_result = xdr_gprincs_ret;
+-	  local = (bool_t (*)()) get_princs_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_gprincs_arg;
++	  xdr_result = (xdrproc_t)xdr_gprincs_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))get_princs_2_svc;
+ 	  break;
+ 
+      case CHPASS_PRINCIPAL:
+-	  xdr_argument = xdr_chpass_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) chpass_principal_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_chpass_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))chpass_principal_2_svc;
+ 	  break;
+ 
+      case SETKEY_PRINCIPAL:
+-	  xdr_argument = xdr_setkey_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) setkey_principal_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_setkey_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))setkey_principal_2_svc;
+ 	  break;
+ 
+      case CHRAND_PRINCIPAL:
+-	  xdr_argument = xdr_chrand_arg;
+-	  xdr_result = xdr_chrand_ret;
+-	  local = (bool_t (*)()) chrand_principal_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_chrand_arg;
++	  xdr_result = (xdrproc_t)xdr_chrand_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))chrand_principal_2_svc;
+ 	  break;
+ 
+      case CREATE_POLICY:
+-	  xdr_argument = xdr_cpol_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) create_policy_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_cpol_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))create_policy_2_svc;
+ 	  break;
+ 
+      case DELETE_POLICY:
+-	  xdr_argument = xdr_dpol_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) delete_policy_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_dpol_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))delete_policy_2_svc;
+ 	  break;
+ 
+      case MODIFY_POLICY:
+-	  xdr_argument = xdr_mpol_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) modify_policy_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_mpol_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))modify_policy_2_svc;
+ 	  break;
+ 
+      case GET_POLICY:
+-	  xdr_argument = xdr_gpol_arg;
+-	  xdr_result = xdr_gpol_ret;
+-	  local = (bool_t (*)()) get_policy_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_gpol_arg;
++	  xdr_result = (xdrproc_t)xdr_gpol_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))get_policy_2_svc;
+ 	  break;
+ 
+      case GET_POLS:
+-	  xdr_argument = xdr_gpols_arg;
+-	  xdr_result = xdr_gpols_ret;
+-	  local = (bool_t (*)()) get_pols_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_gpols_arg;
++	  xdr_result = (xdrproc_t)xdr_gpols_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))get_pols_2_svc;
+ 	  break;
+ 
+      case GET_PRIVS:
+-	  xdr_argument = xdr_u_int32;
+-	  xdr_result = xdr_getprivs_ret;
+-	  local = (bool_t (*)()) get_privs_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_u_int32;
++	  xdr_result = (xdrproc_t)xdr_getprivs_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))get_privs_2_svc;
+ 	  break;
+ 
+      case INIT:
+-	  xdr_argument = xdr_u_int32;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) init_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_u_int32;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))init_2_svc;
+ 	  break;
+ 
+      case CREATE_PRINCIPAL3:
+-	  xdr_argument = xdr_cprinc3_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) create_principal3_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_cprinc3_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))create_principal3_2_svc;
+ 	  break;
+ 
+      case CHPASS_PRINCIPAL3:
+-	  xdr_argument = xdr_chpass3_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) chpass_principal3_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_chpass3_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))chpass_principal3_2_svc;
+ 	  break;
+ 
+      case CHRAND_PRINCIPAL3:
+-	  xdr_argument = xdr_chrand3_arg;
+-	  xdr_result = xdr_chrand_ret;
+-	  local = (bool_t (*)()) chrand_principal3_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_chrand3_arg;
++	  xdr_result = (xdrproc_t)xdr_chrand_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))chrand_principal3_2_svc;
+ 	  break;
+ 
+      case SETKEY_PRINCIPAL3:
+-	  xdr_argument = xdr_setkey3_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) setkey_principal3_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_setkey3_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))setkey_principal3_2_svc;
+ 	  break;
+ 
+      case PURGEKEYS:
+-	  xdr_argument = xdr_purgekeys_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) purgekeys_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_purgekeys_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))purgekeys_2_svc;
+ 	  break;
+ 
+      case GET_STRINGS:
+-	  xdr_argument = xdr_gstrings_arg;
+-	  xdr_result = xdr_gstrings_ret;
+-	  local = (bool_t (*)()) get_strings_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_gstrings_arg;
++	  xdr_result = (xdrproc_t)xdr_gstrings_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))get_strings_2_svc;
+ 	  break;
+ 
+      case SET_STRING:
+-	  xdr_argument = xdr_sstring_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) set_string_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_sstring_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))set_string_2_svc;
+ 	  break;
+ 
+      case SETKEY_PRINCIPAL4:
+-	  xdr_argument = xdr_setkey4_arg;
+-	  xdr_result = xdr_generic_ret;
+-	  local = (bool_t (*)()) setkey_principal4_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_setkey4_arg;
++	  xdr_result = (xdrproc_t)xdr_generic_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))setkey_principal4_2_svc;
+ 	  break;
+ 
+      case EXTRACT_KEYS:
+-	  xdr_argument = xdr_getpkeys_arg;
+-	  xdr_result = xdr_getpkeys_ret;
+-	  local = (bool_t (*)()) get_principal_keys_2_svc;
++	  xdr_argument = (xdrproc_t)xdr_getpkeys_arg;
++	  xdr_result = (xdrproc_t)xdr_getpkeys_ret;
++	  local = (bool_t (*)(char *, void *, struct svc_req *))get_principal_keys_2_svc;
+ 	  break;
+ 
+      default:
+@@ -253,7 +253,7 @@ void kadm_1(rqstp, transp)
+ 	  return;
+      }
+      memset(&result, 0, sizeof(result));
+-     retval = (*local)(&argument, &result, rqstp);
++     retval = (*local)((char *)&argument, &result, rqstp);
+      if (retval && !svc_sendreply(transp, xdr_result, (void *)&result)) {
+ 	  krb5_klog_syslog(LOG_ERR, "WARNING! Unable to send function results, "
+ 		 "continuing.");
+diff --git a/src/kadmin/server/ovsec_kadmd.c b/src/kadmin/server/ovsec_kadmd.c
+index b29a0f5b63..a9508af120 100644
+--- a/src/kadmin/server/ovsec_kadmd.c
++++ b/src/kadmin/server/ovsec_kadmd.c
+@@ -77,7 +77,7 @@ static krb5_context context;
+ static char *progname;
+ 
+ static void
+-usage()
++usage(void)
+ {
+     fprintf(stderr, _("Usage: kadmind [-x db_args]* [-r realm] [-m] [-nofork] "
+                       "[-port port-number]\n"
+@@ -173,7 +173,7 @@ setup_loop(kadm5_config_params *params, int proponly, verto_ctx **ctx_out)
+ 
+ /* Point GSSAPI at the KDB keytab so we don't need an actual file keytab. */
+ static krb5_error_code
+-setup_kdb_keytab()
++setup_kdb_keytab(void)
+ {
+     krb5_error_code ret;
+ 
+diff --git a/src/kdc/t_ndr.c b/src/kdc/t_ndr.c
+index a3ac661bd0..c2a2414313 100644
+--- a/src/kdc/t_ndr.c
++++ b/src/kdc/t_ndr.c
+@@ -173,7 +173,7 @@ test_dec_enc(uint8_t *blob, size_t len, char *name, int fail)
+ #define RUN_TEST_FAIL(blob) test_dec_enc(blob, sizeof(blob), #blob, 1)
+ 
+ int
+-main()
++main(void)
+ {
+     printf("Running NDR tests...\n");
+ 
+diff --git a/src/kdc/t_replay.c b/src/kdc/t_replay.c
+index 57aad886cd..c9c9d65946 100644
+--- a/src/kdc/t_replay.c
++++ b/src/kdc/t_replay.c
+@@ -570,7 +570,8 @@ test_kdc_insert_lookaside_cache_expire(void **state)
+     assert_int_equal(total_size, e2_size);
+ }
+ 
+-int main()
++int
++main(void)
+ {
+     int ret;
+ 
+@@ -611,7 +612,8 @@ int main()
+ 
+ #else /* NOCACHE */
+ 
+-int main()
++int
++main(void)
+ {
+     return 0;
+ }
+diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c
+index cb9785aaeb..f883ae2df8 100644
+--- a/src/kprop/kpropd.c
++++ b/src/kprop/kpropd.c
+@@ -165,7 +165,7 @@ static kadm5_ret_t kadm5_get_kiprop_host_srv_name(krb5_context context,
+                                                   char **host_service_name);
+ 
+ static void
+-usage()
++usage(void)
+ {
+     fprintf(stderr,
+             _("\nUsage: %s [-r realm] [-s keytab] [-d] [-D] [-S]\n"
+diff --git a/src/kprop/kproplog.c b/src/kprop/kproplog.c
+index 06af2a1d60..1f10aa6dc7 100644
+--- a/src/kprop/kproplog.c
++++ b/src/kprop/kproplog.c
+@@ -24,7 +24,7 @@
+ static char *progname;
+ 
+ static void
+-usage()
++usage(void)
+ {
+     fprintf(stderr, _("\nUsage: %s [-h] [-v] [-v] [-e num]\n\t%s -R\n\n"),
+             progname, progname);
+@@ -393,7 +393,7 @@ print_update(kdb_hlog_t *ulog, uint32_t entry, uint32_t ulogentries,
+                 print_attr(&upd.kdb_update.kdbe_t_val[j], verbose > 1 ? 1 : 0);
+         }
+ 
+-        xdr_free(xdr_kdb_incr_update_t, (char *)&upd);
++        xdr_free((xdrproc_t)xdr_kdb_incr_update_t, (char *)&upd);
+         free(dbprinc);
+     }
+ }
+diff --git a/src/lib/apputils/net-server.c b/src/lib/apputils/net-server.c
+index 1bdc7932b6..75372d8940 100644
+--- a/src/lib/apputils/net-server.c
++++ b/src/lib/apputils/net-server.c
+@@ -203,7 +203,7 @@ struct connection {
+ struct rpc_svc_data {
+     u_long prognum;
+     u_long versnum;
+-    void (*dispatch)();
++    void (*dispatch)(struct svc_req *, SVCXPRT *);
+ };
+ 
+ struct bind_address {
+@@ -255,7 +255,7 @@ free_sighup_context(verto_ctx *ctx, verto_ev *ev)
+ }
+ 
+ krb5_error_code
+-loop_setup_signals(verto_ctx *ctx, void *handle, void (*reset)())
++loop_setup_signals(verto_ctx *ctx, void *handle, void (*reset)(void *))
+ {
+     struct sighup_context *sc;
+     verto_ev *ev;
+@@ -434,7 +434,8 @@ loop_add_tcp_address(int default_port, const char *addresses)
+ 
+ krb5_error_code
+ loop_add_rpc_service(int default_port, const char *addresses, u_long prognum,
+-                     u_long versnum, void (*dispatchfn)())
++                     u_long versnum,
++                     void (*dispatchfn)(struct svc_req *, SVCXPRT *))
+ {
+     struct rpc_svc_data svc;
+ 
+diff --git a/src/lib/crypto/builtin/aes/aes-gen.c b/src/lib/crypto/builtin/aes/aes-gen.c
+index b528d3796d..4d7a16ee9a 100644
+--- a/src/lib/crypto/builtin/aes/aes-gen.c
++++ b/src/lib/crypto/builtin/aes/aes-gen.c
+@@ -54,7 +54,8 @@ uint8_t test_case[NTESTS][4 * B] = {
+ aes_encrypt_ctx ctx;
+ aes_decrypt_ctx dctx;
+ 
+-static void init ()
++static void
++init (void)
+ {
+     AES_RETURN r;
+ 
+@@ -71,7 +72,8 @@ static void hexdump(const unsigned char *ptr, size_t len)
+ 	printf ("%s%02X", (i % 16 == 0) ? "\n    " : " ", ptr[i]);
+ }
+ 
+-static void fips_test ()
++static void
++fips_test (void)
+ {
+     static const unsigned char fipskey[16] = {
+ 	0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+@@ -254,7 +256,8 @@ cts_dec (unsigned char *out, unsigned char *in, unsigned char *iv,
+     memcpy(out+B, pn, len-B);
+ }
+ 
+-static void ecb_test ()
++static void
++ecb_test (void)
+ {
+     unsigned int testno;
+     uint8_t output[4 * B], tmp[4 * B];
+@@ -285,7 +288,8 @@ static void ecb_test ()
+ 
+ unsigned char ivec[16] = { 0 };
+ 
+-static void cbc_test ()
++static void
++cbc_test (void)
+ {
+     unsigned int testno;
+     uint8_t output[4 * B], tmp[4 * B];
+@@ -314,7 +318,8 @@ static void cbc_test ()
+     printf ("\n");
+ }
+ 
+-static void cts_test ()
++static void
++cts_test (void)
+ {
+     unsigned int testno;
+     uint8_t output[4 * B], tmp[4 * B];
+@@ -339,7 +344,8 @@ static void cts_test ()
+     printf ("\n");
+ }
+ 
+-int main ()
++int
++main (void)
+ {
+     init ();
+     fips_test ();
+diff --git a/src/lib/crypto/builtin/camellia/camellia-gen.c b/src/lib/crypto/builtin/camellia/camellia-gen.c
+index 23b69c1741..6eca0e0525 100644
+--- a/src/lib/crypto/builtin/camellia/camellia-gen.c
++++ b/src/lib/crypto/builtin/camellia/camellia-gen.c
+@@ -19,7 +19,8 @@ struct {
+ } test_case[NTESTS];
+ camellia_ctx ctx, dctx;
+ 
+-static void init ()
++static void
++init (void)
+ {
+     size_t i, j;
+     cam_rval r;
+@@ -46,7 +47,8 @@ static void hexdump(const unsigned char *ptr, size_t len)
+ 	printf ("%s%02X", (i % 16 == 0) ? "\n    " : " ", ptr[i]);
+ }
+ 
+-static void fips_test ()
++static void
++fips_test (void)
+ {
+     static const unsigned char fipskey[16] = {
+ 	0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
+@@ -234,7 +236,8 @@ cts_dec (unsigned char *out, unsigned char *in, unsigned char *iv,
+     memcpy(out+B, pn, len-B);
+ }
+ 
+-static void ecb_test ()
++static void
++ecb_test (void)
+ {
+     size_t testno;
+     unsigned char tmp[4*B];
+@@ -265,7 +268,8 @@ static void ecb_test ()
+ 
+ unsigned char ivec[16] = { 0 };
+ 
+-static void cbc_test ()
++static void
++cbc_test (void)
+ {
+     size_t testno;
+     unsigned char tmp[4*B];
+@@ -294,7 +298,8 @@ static void cbc_test ()
+     printf ("\n");
+ }
+ 
+-static void cts_test ()
++static void
++cts_test (void)
+ {
+     size_t testno;
+     unsigned char tmp[4*B];
+@@ -319,7 +324,8 @@ static void cts_test ()
+     printf ("\n");
+ }
+ 
+-int main ()
++int
++main (void)
+ {
+     init ();
+     fips_test ();
+diff --git a/src/lib/crypto/builtin/sha1/t_shs.c b/src/lib/crypto/builtin/sha1/t_shs.c
+index c1d18f5571..a668cb0c06 100644
+--- a/src/lib/crypto/builtin/sha1/t_shs.c
++++ b/src/lib/crypto/builtin/sha1/t_shs.c
+@@ -29,9 +29,8 @@ static SHS_LONG shsTestResults[][ 5 ] = {
+ };
+ #endif /* NEW_SHS */
+ 
+-static int compareSHSresults(shsInfo, shsTestLevel)
+-    SHS_INFO *shsInfo;
+-    int shsTestLevel;
++static int
++compareSHSresults(SHS_INFO *shsInfo, int shsTestLevel)
+ {
+     int i, fail = 0;
+ 
+@@ -55,7 +54,7 @@ static int compareSHSresults(shsInfo, shsTestLevel)
+ }
+ 
+ int
+-main()
++main(int argc, char *argv[])
+ {
+     SHS_INFO shsInfo;
+     unsigned int i;
+diff --git a/src/lib/crypto/builtin/sha1/t_shs3.c b/src/lib/crypto/builtin/sha1/t_shs3.c
+index 7aa0bbdee3..87caf7fa37 100644
+--- a/src/lib/crypto/builtin/sha1/t_shs3.c
++++ b/src/lib/crypto/builtin/sha1/t_shs3.c
+@@ -55,9 +55,7 @@ int mode;
+ int Dflag;
+ 
+ int
+-main(argc,argv)
+-    int argc;
+-    char **argv;
++main(int argc, char **argv)
+ {
+     char *argp;
+ 
+@@ -131,8 +129,7 @@ static void process(void)
+ 
+ #ifndef shsDigest
+ static unsigned char *
+-shsDigest(si)
+-    SHS_INFO *si;
++shsDigest(SHS_INFO *si)
+ {
+     longReverse(si->digest, SHS_DIGESTSIZE);
+     return (unsigned char*) si->digest;
+diff --git a/src/lib/crypto/crypto_tests/aes-test.c b/src/lib/crypto/crypto_tests/aes-test.c
+index a7382a48ad..d26f711b8d 100644
+--- a/src/lib/crypto/crypto_tests/aes-test.c
++++ b/src/lib/crypto/crypto_tests/aes-test.c
+@@ -37,14 +37,14 @@ static char plain[16], cipher[16], zero[16];
+ 
+ static krb5_keyblock enc_key;
+ static krb5_data ivec;
+-static void init()
++static void init(void)
+ {
+     enc_key.contents = (krb5_octet *)key;
+     enc_key.length = 16;
+     ivec.data = zero;
+     ivec.length = 16;
+ }
+-static void enc()
++static void enc(void)
+ {
+     krb5_key k;
+     krb5_crypto_iov iov;
+@@ -93,7 +93,7 @@ static void vk_test_1(int len, krb5_enctype etype)
+     }
+     printf("\n==========\n");
+ }
+-static void vk_test()
++static void vk_test(void)
+ {
+     vk_test_1(16, ENCTYPE_AES128_CTS_HMAC_SHA1_96);
+     vk_test_1(32, ENCTYPE_AES256_CTS_HMAC_SHA1_96);
+@@ -119,7 +119,7 @@ static void vt_test_1(int len, krb5_enctype etype)
+     }
+     printf("\n==========\n");
+ }
+-static void vt_test()
++static void vt_test(void)
+ {
+     vt_test_1(16, ENCTYPE_AES128_CTS_HMAC_SHA1_96);
+     vt_test_1(32, ENCTYPE_AES256_CTS_HMAC_SHA1_96);
+diff --git a/src/lib/crypto/crypto_tests/camellia-test.c b/src/lib/crypto/crypto_tests/camellia-test.c
+index 23d14667e1..ca6579f7d1 100644
+--- a/src/lib/crypto/crypto_tests/camellia-test.c
++++ b/src/lib/crypto/crypto_tests/camellia-test.c
+@@ -35,14 +35,14 @@ static char plain[16], cipher[16], zero[16];
+ 
+ static krb5_keyblock enc_key;
+ static krb5_data ivec;
+-static void init()
++static void init(void)
+ {
+     enc_key.contents = (unsigned char *)key;
+     enc_key.length = 16;
+     ivec.data = zero;
+     ivec.length = 16;
+ }
+-static void enc()
++static void enc(void)
+ {
+     krb5_key k;
+     krb5_crypto_iov iov;
+@@ -91,7 +91,7 @@ static void vk_test_1(int len)
+     }
+     printf("\n==========\n");
+ }
+-static void vk_test()
++static void vk_test(void)
+ {
+     vk_test_1(16);
+     vk_test_1(32);
+@@ -117,7 +117,7 @@ static void vt_test_1(int len, krb5_enctype etype)
+     }
+     printf("\n==========\n");
+ }
+-static void vt_test()
++static void vt_test(void)
+ {
+     vt_test_1(16, ENCTYPE_CAMELLIA128_CTS_CMAC);
+     vt_test_1(32, ENCTYPE_CAMELLIA256_CTS_CMAC);
+diff --git a/src/lib/crypto/crypto_tests/t_cf2.c b/src/lib/crypto/crypto_tests/t_cf2.c
+index 67c9dcdee2..4c894ad09c 100644
+--- a/src/lib/crypto/crypto_tests/t_cf2.c
++++ b/src/lib/crypto/crypto_tests/t_cf2.c
+@@ -46,7 +46,9 @@
+ #include <stdio.h>
+ #include <string.h>
+ 
+-int main () {
++int
++main(void)
++{
+     krb5_error_code ret;
+     char pepper1[1025], pepper2[1025];
+     krb5_keyblock *k1 = NULL, *k2 = NULL, *out = NULL;
+diff --git a/src/lib/crypto/crypto_tests/t_cts.c b/src/lib/crypto/crypto_tests/t_cts.c
+index fe505169f3..f8a5a534b2 100644
+--- a/src/lib/crypto/crypto_tests/t_cts.c
++++ b/src/lib/crypto/crypto_tests/t_cts.c
+@@ -77,7 +77,7 @@ static void printk(const char *descr, krb5_keyblock *k) {
+     printd(descr, &d);
+ }
+ 
+-static void test_cts()
++static void test_cts(void)
+ {
+     static const char input[4*16] =
+         "I would like the General Gau's Chicken, please, and wonton soup.";
+diff --git a/src/lib/crypto/crypto_tests/t_encrypt.c b/src/lib/crypto/crypto_tests/t_encrypt.c
+index 290a72e1e0..83bc98a2f1 100644
+--- a/src/lib/crypto/crypto_tests/t_encrypt.c
++++ b/src/lib/crypto/crypto_tests/t_encrypt.c
+@@ -87,7 +87,7 @@ display(const char *msg, const krb5_data *d)
+ }
+ 
+ int
+-main ()
++main(void)
+ {
+     krb5_context context = 0;
+     krb5_data  in, in2, out, out2, check, check2, state, signdata;
+diff --git a/src/lib/crypto/crypto_tests/t_fork.c b/src/lib/crypto/crypto_tests/t_fork.c
+index 428fc8a6a1..8be7474227 100644
+--- a/src/lib/crypto/crypto_tests/t_fork.c
++++ b/src/lib/crypto/crypto_tests/t_fork.c
+@@ -55,7 +55,7 @@ prepare_enc_data(krb5_key key, size_t in_len, krb5_enc_data *enc_data)
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     krb5_keyblock kb_aes, kb_rc4;
+     krb5_key key_aes, key_rc4;
+diff --git a/src/lib/crypto/crypto_tests/t_hmac.c b/src/lib/crypto/crypto_tests/t_hmac.c
+index da359cb494..e40136bff0 100644
+--- a/src/lib/crypto/crypto_tests/t_hmac.c
++++ b/src/lib/crypto/crypto_tests/t_hmac.c
+@@ -122,7 +122,8 @@ static krb5_error_code hmac1(const struct krb5_hash_provider *h,
+     return err;
+ }
+ 
+-static void test_hmac()
++static void
++test_hmac(void)
+ {
+     krb5_keyblock key;
+     krb5_data in, out;
+diff --git a/src/lib/crypto/crypto_tests/t_mddriver.c b/src/lib/crypto/crypto_tests/t_mddriver.c
+index ad65d03156..035f825bbc 100644
+--- a/src/lib/crypto/crypto_tests/t_mddriver.c
++++ b/src/lib/crypto/crypto_tests/t_mddriver.c
+@@ -111,9 +111,8 @@ struct md_test_entry md_test_suite[] = {
+    -t       - runs time trial
+    -x       - runs test script
+ */
+-int main (argc, argv)
+-    int argc;
+-    char *argv[];
++int
++main(int argc, char *argv[])
+ {
+     int i;
+ 
+@@ -128,10 +127,8 @@ int main (argc, argv)
+     return (0);
+ }
+ 
+-static void MDHash (bytes, len, count, out)
+-    char *bytes;
+-    size_t len, count;
+-    unsigned char *out;
++static void
++MDHash(char *bytes, size_t len, size_t count, unsigned char *out)
+ {
+     krb5_crypto_iov *iov;
+     krb5_data outdata = make_data (out, MDProvider.hashsize);
+@@ -150,8 +147,8 @@ static void MDHash (bytes, len, count, out)
+ 
+ /* Digests a string and prints the result.
+  */
+-static void MDString (string)
+-    char *string;
++static void
++MDString(char *string)
+ {
+     unsigned char digest[16];
+ 
+@@ -164,7 +161,8 @@ static void MDString (string)
+ /* Measures the time to digest TEST_BLOCK_COUNT TEST_BLOCK_LEN-byte
+    blocks.
+ */
+-static void MDTimeTrial ()
++static void
++MDTimeTrial(void)
+ {
+     time_t endTime, startTime;
+     unsigned char block[TEST_BLOCK_LEN], digest[16];
+@@ -197,7 +195,8 @@ static void MDTimeTrial ()
+ 
+ /* Digests a reference suite of strings and prints the results.
+  */
+-static void MDTestSuite ()
++static void
++MDTestSuite(void)
+ {
+ #ifdef HAVE_TEST_SUITE
+     struct md_test_entry *entry;
+@@ -246,8 +245,8 @@ static void MDTestSuite ()
+ 
+ /* Prints a message digest in hexadecimal.
+  */
+-static void MDPrint (digest)
+-    unsigned char digest[16];
++static void
++MDPrint(unsigned char digest[16])
+ {
+     unsigned int i;
+ 
+diff --git a/src/lib/crypto/crypto_tests/t_nfold.c b/src/lib/crypto/crypto_tests/t_nfold.c
+index b94353c221..a741b61e0c 100644
+--- a/src/lib/crypto/crypto_tests/t_nfold.c
++++ b/src/lib/crypto/crypto_tests/t_nfold.c
+@@ -33,17 +33,20 @@
+ 
+ #define ASIZE(ARRAY) (sizeof(ARRAY)/sizeof(ARRAY[0]))
+ 
+-static void printhex (size_t len, const unsigned char *p)
++static void
++printhex(size_t len, const unsigned char *p)
+ {
+     while (len--)
+         printf ("%02x", 0xff & *p++);
+ }
+ 
+-static void printstringhex (const unsigned char *p) {
++static void
++printstringhex(const unsigned char *p) {
+     printhex (strlen ((const char *) p), p);
+ }
+ 
+-static void rfc_tests ()
++static void
++rfc_tests(void)
+ {
+     unsigned i;
+     struct {
+@@ -92,7 +95,8 @@ static void rfc_tests ()
+     }
+ }
+ 
+-static void fold_kerberos(unsigned int nbytes)
++static void
++fold_kerberos(unsigned int nbytes)
+ {
+     unsigned char cipher_text[300];
+     unsigned int j;
+@@ -125,9 +129,7 @@ unsigned char nfold_192[4][24] = {
+ };
+ 
+ int
+-main(argc, argv)
+-    int argc;
+-    char *argv[];
++main(int argc, char *argv[])
+ {
+     unsigned char cipher_text[64];
+     unsigned int i, j;
+diff --git a/src/lib/crypto/crypto_tests/t_prf.c b/src/lib/crypto/crypto_tests/t_prf.c
+index d9877bd1f7..6fa0afb183 100644
+--- a/src/lib/crypto/crypto_tests/t_prf.c
++++ b/src/lib/crypto/crypto_tests/t_prf.c
+@@ -116,7 +116,7 @@ struct test {
+ };
+ 
+ int
+-main()
++main(void)
+ {
+     krb5_error_code ret;
+     krb5_data output;
+diff --git a/src/lib/crypto/crypto_tests/t_sha2.c b/src/lib/crypto/crypto_tests/t_sha2.c
+index e6fa584982..776c4e964f 100644
+--- a/src/lib/crypto/crypto_tests/t_sha2.c
++++ b/src/lib/crypto/crypto_tests/t_sha2.c
+@@ -137,7 +137,7 @@ hash_test(const struct krb5_hash_provider *hash, struct test *tests)
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     hash_test(&krb5int_hash_sha256, sha256_tests);
+     hash_test(&krb5int_hash_sha384, sha384_tests);
+diff --git a/src/lib/gssapi/generic/t_seqstate.c b/src/lib/gssapi/generic/t_seqstate.c
+index 8f44fcf3ed..4df1ed6b9c 100644
+--- a/src/lib/gssapi/generic/t_seqstate.c
++++ b/src/lib/gssapi/generic/t_seqstate.c
+@@ -164,7 +164,7 @@ struct test {
+ };
+ 
+ int
+-main()
++main(void)
+ {
+     size_t i, j;
+     enum width w;
+diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
+index d7c2ad321e..90a9ad2d9d 100644
+--- a/src/lib/gssapi/krb5/accept_sec_context.c
++++ b/src/lib/gssapi/krb5/accept_sec_context.c
+@@ -160,11 +160,8 @@ create_constrained_deleg_creds(OM_uint32 *minor_status,
+ 
+ /* Decode, decrypt and store the forwarded creds in the local ccache. */
+ static krb5_error_code
+-rd_and_store_for_creds(context, auth_context, inbuf, out_cred)
+-    krb5_context context;
+-    krb5_auth_context auth_context;
+-    krb5_data *inbuf;
+-    krb5_gss_cred_id_t *out_cred;
++rd_and_store_for_creds(krb5_context context, krb5_auth_context auth_context,
++                       krb5_data *inbuf, krb5_gss_cred_id_t *out_cred)
+ {
+     krb5_creds ** creds = NULL;
+     krb5_error_code retval;
+@@ -286,20 +283,12 @@ cleanup:
+  * Performs third leg of DCE authentication
+  */
+ static OM_uint32
+-kg_accept_dce(minor_status, context_handle, verifier_cred_handle,
+-              input_token, input_chan_bindings, src_name, mech_type,
+-              output_token, ret_flags, time_rec, delegated_cred_handle)
+-    OM_uint32 *minor_status;
+-    gss_ctx_id_t *context_handle;
+-    gss_cred_id_t verifier_cred_handle;
+-    gss_buffer_t input_token;
+-    gss_channel_bindings_t input_chan_bindings;
+-    gss_name_t *src_name;
+-    gss_OID *mech_type;
+-    gss_buffer_t output_token;
+-    OM_uint32 *ret_flags;
+-    OM_uint32 *time_rec;
+-    gss_cred_id_t *delegated_cred_handle;
++kg_accept_dce(OM_uint32 *minor_status, gss_ctx_id_t *context_handle,
++              gss_cred_id_t verifier_cred_handle, gss_buffer_t input_token,
++              gss_channel_bindings_t input_chan_bindings, gss_name_t *src_name,
++              gss_OID *mech_type, gss_buffer_t output_token,
++              OM_uint32 *ret_flags, OM_uint32 *time_rec,
++              gss_cred_id_t *delegated_cred_handle)
+ {
+     krb5_error_code code;
+     krb5_gss_ctx_id_rec *ctx = 0;
+@@ -637,23 +626,13 @@ fail:
+ }
+ 
+ static OM_uint32
+-kg_accept_krb5(minor_status, context_handle,
+-               verifier_cred_handle, input_token,
+-               input_chan_bindings, src_name, mech_type,
+-               output_token, ret_flags, time_rec,
+-               delegated_cred_handle, exts)
+-    OM_uint32 *minor_status;
+-    gss_ctx_id_t *context_handle;
+-    gss_cred_id_t verifier_cred_handle;
+-    gss_buffer_t input_token;
+-    gss_channel_bindings_t input_chan_bindings;
+-    gss_name_t *src_name;
+-    gss_OID *mech_type;
+-    gss_buffer_t output_token;
+-    OM_uint32 *ret_flags;
+-    OM_uint32 *time_rec;
+-    gss_cred_id_t *delegated_cred_handle;
+-    krb5_gss_ctx_ext_t exts;
++kg_accept_krb5(OM_uint32 *minor_status, gss_ctx_id_t *context_handle,
++               gss_cred_id_t verifier_cred_handle, gss_buffer_t input_token,
++               gss_channel_bindings_t input_chan_bindings,
++               gss_name_t *src_name, gss_OID *mech_type,
++               gss_buffer_t output_token, OM_uint32 *ret_flags,
++               OM_uint32 *time_rec, gss_cred_id_t *delegated_cred_handle,
++               krb5_gss_ctx_ext_t exts)
+ {
+     krb5_context context;
+     unsigned char *ptr;
+@@ -1309,22 +1288,15 @@ krb5_gss_accept_sec_context_ext(
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_accept_sec_context(minor_status, context_handle,
+-                            verifier_cred_handle, input_token,
+-                            input_chan_bindings, src_name, mech_type,
+-                            output_token, ret_flags, time_rec,
+-                            delegated_cred_handle)
+-    OM_uint32 *minor_status;
+-    gss_ctx_id_t *context_handle;
+-    gss_cred_id_t verifier_cred_handle;
+-    gss_buffer_t input_token;
+-    gss_channel_bindings_t input_chan_bindings;
+-    gss_name_t *src_name;
+-    gss_OID *mech_type;
+-    gss_buffer_t output_token;
+-    OM_uint32 *ret_flags;
+-    OM_uint32 *time_rec;
+-    gss_cred_id_t *delegated_cred_handle;
++krb5_gss_accept_sec_context(OM_uint32 *minor_status,
++                            gss_ctx_id_t *context_handle,
++                            gss_cred_id_t verifier_cred_handle,
++                            gss_buffer_t input_token,
++                            gss_channel_bindings_t input_chan_bindings,
++                            gss_name_t *src_name, gss_OID *mech_type,
++                            gss_buffer_t output_token, OM_uint32 *ret_flags,
++                            OM_uint32 *time_rec,
++                            gss_cred_id_t *delegated_cred_handle)
+ {
+     krb5_gss_ctx_ext_rec exts;
+ 
+diff --git a/src/lib/gssapi/krb5/compare_name.c b/src/lib/gssapi/krb5/compare_name.c
+index 3f3788d2bf..3aa5a0d79f 100644
+--- a/src/lib/gssapi/krb5/compare_name.c
++++ b/src/lib/gssapi/krb5/compare_name.c
+@@ -28,11 +28,8 @@
+ #include "gssapiP_krb5.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_compare_name(minor_status, name1, name2, name_equal)
+-    OM_uint32 *minor_status;
+-    gss_name_t name1;
+-    gss_name_t name2;
+-    int *name_equal;
++krb5_gss_compare_name(OM_uint32 *minor_status, gss_name_t name1,
++                      gss_name_t name2, int *name_equal)
+ {
+     krb5_context context;
+     krb5_error_code code;
+diff --git a/src/lib/gssapi/krb5/context_time.c b/src/lib/gssapi/krb5/context_time.c
+index 226de05f51..0ab885deca 100644
+--- a/src/lib/gssapi/krb5/context_time.c
++++ b/src/lib/gssapi/krb5/context_time.c
+@@ -28,10 +28,8 @@
+  */
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_context_time(minor_status, context_handle, time_rec)
+-    OM_uint32 *minor_status;
+-    gss_ctx_id_t context_handle;
+-    OM_uint32 *time_rec;
++krb5_gss_context_time(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                      OM_uint32 *time_rec)
+ {
+     krb5_error_code code;
+     krb5_gss_ctx_id_rec *ctx;
+diff --git a/src/lib/gssapi/krb5/delete_sec_context.c b/src/lib/gssapi/krb5/delete_sec_context.c
+index 4b9dfae0d5..92e84b79c5 100644
+--- a/src/lib/gssapi/krb5/delete_sec_context.c
++++ b/src/lib/gssapi/krb5/delete_sec_context.c
+@@ -28,10 +28,9 @@
+  */
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_delete_sec_context(minor_status, context_handle, output_token)
+-    OM_uint32 *minor_status;
+-    gss_ctx_id_t *context_handle;
+-    gss_buffer_t output_token;
++krb5_gss_delete_sec_context(OM_uint32 *minor_status,
++                            gss_ctx_id_t *context_handle,
++                            gss_buffer_t output_token)
+ {
+     krb5_context context;
+     krb5_gss_ctx_id_rec *ctx;
+diff --git a/src/lib/gssapi/krb5/disp_name.c b/src/lib/gssapi/krb5/disp_name.c
+index b097bf0e21..75fef01238 100644
+--- a/src/lib/gssapi/krb5/disp_name.c
++++ b/src/lib/gssapi/krb5/disp_name.c
+@@ -24,12 +24,9 @@
+ #include "gssapiP_krb5.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_display_name(minor_status, input_name, output_name_buffer,
+-                      output_name_type)
+-    OM_uint32 *minor_status;
+-    gss_name_t input_name;
+-    gss_buffer_t output_name_buffer;
+-    gss_OID *output_name_type;
++krb5_gss_display_name(OM_uint32 *minor_status, gss_name_t input_name,
++                      gss_buffer_t output_name_buffer,
++                      gss_OID *output_name_type)
+ {
+     krb5_context context;
+     krb5_error_code code;
+diff --git a/src/lib/gssapi/krb5/disp_status.c b/src/lib/gssapi/krb5/disp_status.c
+index 6ff62a9d84..71000b7a45 100644
+--- a/src/lib/gssapi/krb5/disp_status.c
++++ b/src/lib/gssapi/krb5/disp_status.c
+@@ -154,14 +154,9 @@ void krb5_gss_delete_error_info(void *p)
+ /**/
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_display_status(minor_status, status_value, status_type,
+-                        mech_type, message_context, status_string)
+-    OM_uint32 *minor_status;
+-    OM_uint32 status_value;
+-    int status_type;
+-    gss_OID mech_type;
+-    OM_uint32 *message_context;
+-    gss_buffer_t status_string;
++krb5_gss_display_status(OM_uint32 *minor_status, OM_uint32 status_value,
++                        int status_type, gss_OID mech_type,
++                        OM_uint32 *message_context, gss_buffer_t status_string)
+ {
+     status_string->length = 0;
+     status_string->value = NULL;
+diff --git a/src/lib/gssapi/krb5/export_sec_context.c b/src/lib/gssapi/krb5/export_sec_context.c
+index 44e50080ab..9730e0597f 100644
+--- a/src/lib/gssapi/krb5/export_sec_context.c
++++ b/src/lib/gssapi/krb5/export_sec_context.c
+@@ -27,10 +27,9 @@
+ #include "gssapiP_krb5.h"
+ #ifndef LEAN_CLIENT
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_export_sec_context(minor_status, context_handle, interprocess_token)
+-    OM_uint32           *minor_status;
+-    gss_ctx_id_t        *context_handle;
+-    gss_buffer_t        interprocess_token;
++krb5_gss_export_sec_context(OM_uint32 *minor_status,
++                            gss_ctx_id_t *context_handle,
++                            gss_buffer_t interprocess_token)
+ {
+     krb5_context        context = NULL;
+     krb5_error_code     kret;
+diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c
+index 1e62b07cde..370b7d152a 100644
+--- a/src/lib/gssapi/krb5/gssapi_krb5.c
++++ b/src/lib/gssapi/krb5/gssapi_krb5.c
+@@ -197,9 +197,7 @@ g_set kg_vdb = G_SET_INIT;
+  * so handling the expiration/invalidation condition here isn't needed.
+  */
+ OM_uint32
+-kg_get_defcred(minor_status, cred)
+-    OM_uint32 *minor_status;
+-    gss_cred_id_t *cred;
++kg_get_defcred(OM_uint32 *minor_status, gss_cred_id_t *cred)
+ {
+     OM_uint32 major;
+ 
+diff --git a/src/lib/gssapi/krb5/import_name.c b/src/lib/gssapi/krb5/import_name.c
+index f64635a202..cc6883b5fe 100644
+--- a/src/lib/gssapi/krb5/import_name.c
++++ b/src/lib/gssapi/krb5/import_name.c
+@@ -120,12 +120,8 @@ parse_hostbased(const char *str, size_t len,
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_import_name(minor_status, input_name_buffer,
+-                     input_name_type, output_name)
+-    OM_uint32 *minor_status;
+-    gss_buffer_t input_name_buffer;
+-    gss_OID input_name_type;
+-    gss_name_t *output_name;
++krb5_gss_import_name(OM_uint32 *minor_status, gss_buffer_t input_name_buffer,
++                     gss_OID input_name_type, gss_name_t *output_name)
+ {
+     krb5_context context;
+     krb5_principal princ = NULL;
+diff --git a/src/lib/gssapi/krb5/import_sec_context.c b/src/lib/gssapi/krb5/import_sec_context.c
+index 7d26f4df87..e39c036b80 100644
+--- a/src/lib/gssapi/krb5/import_sec_context.c
++++ b/src/lib/gssapi/krb5/import_sec_context.c
+@@ -32,8 +32,7 @@
+  * Fix up the OID of the mechanism so that uses the static version of
+  * the OID if possible.
+  */
+-gss_OID krb5_gss_convert_static_mech_oid(oid)
+-    gss_OID    oid;
++gss_OID krb5_gss_convert_static_mech_oid(gss_OID oid)
+ {
+     const gss_OID_desc      *p;
+     OM_uint32               minor_status;
+@@ -49,10 +48,9 @@ gss_OID krb5_gss_convert_static_mech_oid(oid)
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_import_sec_context(minor_status, interprocess_token, context_handle)
+-    OM_uint32           *minor_status;
+-    gss_buffer_t        interprocess_token;
+-    gss_ctx_id_t        *context_handle;
++krb5_gss_import_sec_context(OM_uint32 *minor_status,
++                            gss_buffer_t interprocess_token,
++                            gss_ctx_id_t *context_handle)
+ {
+     krb5_context        context;
+     krb5_error_code     kret = 0;
+diff --git a/src/lib/gssapi/krb5/indicate_mechs.c b/src/lib/gssapi/krb5/indicate_mechs.c
+index 45538cb779..49d55e6217 100644
+--- a/src/lib/gssapi/krb5/indicate_mechs.c
++++ b/src/lib/gssapi/krb5/indicate_mechs.c
+@@ -29,9 +29,7 @@
+ #include "mglueP.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_indicate_mechs(minor_status, mech_set)
+-    OM_uint32 *minor_status;
+-    gss_OID_set *mech_set;
++krb5_gss_indicate_mechs(OM_uint32 *minor_status, gss_OID_set *mech_set)
+ {
+     return generic_gss_copy_oid_set(minor_status, kg_all_mechs, mech_set);
+ }
+diff --git a/src/lib/gssapi/krb5/init_sec_context.c b/src/lib/gssapi/krb5/init_sec_context.c
+index 5748b8434c..0397fe1dfd 100644
+--- a/src/lib/gssapi/krb5/init_sec_context.c
++++ b/src/lib/gssapi/krb5/init_sec_context.c
+@@ -117,14 +117,10 @@ int krb5_gss_dbg_client_expcreds = 0;
+  * Common code which fetches the correct krb5 credentials from the
+  * ccache.
+  */
+-static krb5_error_code get_credentials(context, cred, server, now,
+-                                       endtime, out_creds)
+-    krb5_context context;
+-    krb5_gss_cred_id_t cred;
+-    krb5_gss_name_t server;
+-    krb5_timestamp now;
+-    krb5_timestamp endtime;
+-    krb5_creds **out_creds;
++static krb5_error_code
++get_credentials(krb5_context context, krb5_gss_cred_id_t cred,
++                krb5_gss_name_t server, krb5_timestamp now,
++                krb5_timestamp endtime, krb5_creds **out_creds)
+ {
+     krb5_error_code     code;
+     krb5_creds          in_creds, evidence_creds, mcreds, *result_creds = NULL;
+@@ -365,17 +361,11 @@ cleanup:
+ }
+ 
+ static krb5_error_code
+-make_ap_req_v1(context, ctx, cred, k_cred, ad_context,
+-               chan_bindings, mech_type, token, exts)
+-    krb5_context context;
+-    krb5_gss_ctx_id_rec *ctx;
+-    krb5_gss_cred_id_t cred;
+-    krb5_creds *k_cred;
+-    krb5_authdata_context ad_context;
+-    gss_channel_bindings_t chan_bindings;
+-    gss_OID mech_type;
+-    gss_buffer_t token;
+-    krb5_gss_ctx_ext_t exts;
++make_ap_req_v1(krb5_context context, krb5_gss_ctx_id_rec *ctx,
++               krb5_gss_cred_id_t cred, krb5_creds *k_cred,
++               krb5_authdata_context ad_context,
++               gss_channel_bindings_t chan_bindings, gss_OID mech_type,
++               gss_buffer_t token, krb5_gss_ctx_ext_t exts)
+ {
+     krb5_flags mk_req_flags = 0;
+     krb5_error_code code;
+@@ -1048,24 +1038,15 @@ krb5int_gss_use_kdc_context(OM_uint32 *minor_status,
+ #endif
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_init_sec_context(minor_status, claimant_cred_handle,
+-                          context_handle, target_name, mech_type,
+-                          req_flags, time_req, input_chan_bindings,
+-                          input_token, actual_mech_type, output_token,
+-                          ret_flags, time_rec)
+-    OM_uint32 *minor_status;
+-    gss_cred_id_t claimant_cred_handle;
+-    gss_ctx_id_t *context_handle;
+-    gss_name_t target_name;
+-    gss_OID mech_type;
+-    OM_uint32 req_flags;
+-    OM_uint32 time_req;
+-    gss_channel_bindings_t input_chan_bindings;
+-    gss_buffer_t input_token;
+-    gss_OID *actual_mech_type;
+-    gss_buffer_t output_token;
+-    OM_uint32 *ret_flags;
+-    OM_uint32 *time_rec;
++krb5_gss_init_sec_context(OM_uint32 *minor_status,
++                          gss_cred_id_t claimant_cred_handle,
++                          gss_ctx_id_t *context_handle,
++                          gss_name_t target_name, gss_OID mech_type,
++                          OM_uint32 req_flags, OM_uint32 time_req,
++                          gss_channel_bindings_t input_chan_bindings,
++                          gss_buffer_t input_token, gss_OID *actual_mech_type,
++                          gss_buffer_t output_token, OM_uint32 *ret_flags,
++                          OM_uint32 *time_rec)
+ {
+     krb5_gss_ctx_ext_rec exts;
+ 
+diff --git a/src/lib/gssapi/krb5/inq_context.c b/src/lib/gssapi/krb5/inq_context.c
+index 97678e3ec5..f8229f9750 100644
+--- a/src/lib/gssapi/krb5/inq_context.c
++++ b/src/lib/gssapi/krb5/inq_context.c
+@@ -78,18 +78,11 @@
+ #include "gssapiP_krb5.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_inquire_context(minor_status, context_handle, initiator_name,
+-                         acceptor_name, lifetime_rec, mech_type, ret_flags,
+-                         locally_initiated, opened)
+-    OM_uint32 *minor_status;
+-    gss_ctx_id_t context_handle;
+-    gss_name_t *initiator_name;
+-    gss_name_t *acceptor_name;
+-    OM_uint32 *lifetime_rec;
+-    gss_OID *mech_type;
+-    OM_uint32 *ret_flags;
+-    int *locally_initiated;
+-    int *opened;
++krb5_gss_inquire_context(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                         gss_name_t *initiator_name, gss_name_t *acceptor_name,
++                         OM_uint32 *lifetime_rec, gss_OID *mech_type,
++                         OM_uint32 *ret_flags, int *locally_initiated,
++                         int *opened)
+ {
+     krb5_context context;
+     krb5_error_code code;
+diff --git a/src/lib/gssapi/krb5/inq_cred.c b/src/lib/gssapi/krb5/inq_cred.c
+index 0e675959a3..e968f8ad32 100644
+--- a/src/lib/gssapi/krb5/inq_cred.c
++++ b/src/lib/gssapi/krb5/inq_cred.c
+@@ -73,14 +73,9 @@
+ #include "gssapiP_krb5.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
+-                      cred_usage, mechanisms)
+-    OM_uint32 *minor_status;
+-    gss_cred_id_t cred_handle;
+-    gss_name_t *name;
+-    OM_uint32 *lifetime_ret;
+-    gss_cred_usage_t *cred_usage;
+-    gss_OID_set *mechanisms;
++krb5_gss_inquire_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
++                      gss_name_t *name, OM_uint32 *lifetime_ret,
++                      gss_cred_usage_t *cred_usage, gss_OID_set *mechanisms)
+ {
+     krb5_context context;
+     gss_cred_id_t defcred = GSS_C_NO_CREDENTIAL;
+@@ -209,16 +204,11 @@ cleanup:
+ 
+ /* V2 interface */
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_inquire_cred_by_mech(minor_status, cred_handle,
+-                              mech_type, name, initiator_lifetime,
+-                              acceptor_lifetime, cred_usage)
+-    OM_uint32           *minor_status;
+-    gss_cred_id_t       cred_handle;
+-    gss_OID             mech_type;
+-    gss_name_t          *name;
+-    OM_uint32           *initiator_lifetime;
+-    OM_uint32           *acceptor_lifetime;
+-    gss_cred_usage_t *cred_usage;
++krb5_gss_inquire_cred_by_mech(OM_uint32 *minor_status,
++                              gss_cred_id_t cred_handle, gss_OID mech_type,
++                              gss_name_t *name, OM_uint32 *initiator_lifetime,
++                              OM_uint32 *acceptor_lifetime,
++                              gss_cred_usage_t *cred_usage)
+ {
+     krb5_gss_cred_id_t  cred;
+     OM_uint32           lifetime;
+diff --git a/src/lib/gssapi/krb5/inq_names.c b/src/lib/gssapi/krb5/inq_names.c
+index b326adbb5f..4a3709be4b 100644
+--- a/src/lib/gssapi/krb5/inq_names.c
++++ b/src/lib/gssapi/krb5/inq_names.c
+@@ -27,10 +27,8 @@
+ #include "gssapiP_krb5.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_inquire_names_for_mech(minor_status, mechanism, name_types)
+-    OM_uint32   *minor_status;
+-    gss_OID     mechanism;
+-    gss_OID_set *name_types;
++krb5_gss_inquire_names_for_mech(OM_uint32 *minor_status, gss_OID mechanism,
++                                gss_OID_set *name_types)
+ {
+     OM_uint32   major, minor;
+ 
+diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c
+index 0e5d10b115..1148f6929b 100644
+--- a/src/lib/gssapi/krb5/k5seal.c
++++ b/src/lib/gssapi/krb5/k5seal.c
+@@ -271,16 +271,10 @@ make_seal_token_v1 (krb5_context context,
+    and do not encode the ENC_TYPE, MSG_LENGTH, or MSG_TEXT fields */
+ 
+ OM_uint32
+-kg_seal(minor_status, context_handle, conf_req_flag, qop_req,
+-        input_message_buffer, conf_state, output_message_buffer, toktype)
+-    OM_uint32 *minor_status;
+-    gss_ctx_id_t context_handle;
+-    int conf_req_flag;
+-    gss_qop_t qop_req;
+-    gss_buffer_t input_message_buffer;
+-    int *conf_state;
+-    gss_buffer_t output_message_buffer;
+-    int toktype;
++kg_seal(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++        int conf_req_flag, gss_qop_t qop_req,
++        gss_buffer_t input_message_buffer, int *conf_state,
++        gss_buffer_t output_message_buffer, int toktype)
+ {
+     krb5_gss_ctx_id_rec *ctx;
+     krb5_error_code code;
+@@ -342,16 +336,10 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req,
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_wrap(minor_status, context_handle, conf_req_flag,
+-              qop_req, input_message_buffer, conf_state,
+-              output_message_buffer)
+-    OM_uint32           *minor_status;
+-    gss_ctx_id_t        context_handle;
+-    int                 conf_req_flag;
+-    gss_qop_t           qop_req;
+-    gss_buffer_t        input_message_buffer;
+-    int                 *conf_state;
+-    gss_buffer_t        output_message_buffer;
++krb5_gss_wrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++              int conf_req_flag, gss_qop_t qop_req,
++              gss_buffer_t input_message_buffer, int *conf_state,
++              gss_buffer_t output_message_buffer)
+ {
+     return(kg_seal(minor_status, context_handle, conf_req_flag,
+                    qop_req, input_message_buffer, conf_state,
+@@ -359,13 +347,9 @@ krb5_gss_wrap(minor_status, context_handle, conf_req_flag,
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_get_mic(minor_status, context_handle, qop_req,
+-                 message_buffer, message_token)
+-    OM_uint32           *minor_status;
+-    gss_ctx_id_t        context_handle;
+-    gss_qop_t           qop_req;
+-    gss_buffer_t        message_buffer;
+-    gss_buffer_t        message_token;
++krb5_gss_get_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                 gss_qop_t qop_req, gss_buffer_t message_buffer,
++                 gss_buffer_t message_token)
+ {
+     return(kg_seal(minor_status, context_handle, 0,
+                    qop_req, message_buffer, NULL,
+diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c
+index f0cc4a6809..e246365804 100644
+--- a/src/lib/gssapi/krb5/k5unseal.c
++++ b/src/lib/gssapi/krb5/k5unseal.c
+@@ -58,17 +58,10 @@
+    conf_state is only valid if SEAL. */
+ 
+ static OM_uint32
+-kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
+-             conf_state, qop_state, toktype)
+-    krb5_context context;
+-    OM_uint32 *minor_status;
+-    krb5_gss_ctx_id_rec *ctx;
+-    unsigned char *ptr;
+-    int bodysize;
+-    gss_buffer_t message_buffer;
+-    int *conf_state;
+-    gss_qop_t *qop_state;
+-    int toktype;
++kg_unseal_v1(krb5_context context, OM_uint32 *minor_status,
++             krb5_gss_ctx_id_rec *ctx, unsigned char *ptr, int bodysize,
++             gss_buffer_t message_buffer, int *conf_state,
++             gss_qop_t *qop_state, int toktype)
+ {
+     krb5_error_code code;
+     int conflen = 0;
+@@ -342,15 +335,9 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
+    conf_state is only valid if SEAL. */
+ 
+ OM_uint32
+-kg_unseal(minor_status, context_handle, input_token_buffer,
+-          message_buffer, conf_state, qop_state, toktype)
+-    OM_uint32 *minor_status;
+-    gss_ctx_id_t context_handle;
+-    gss_buffer_t input_token_buffer;
+-    gss_buffer_t message_buffer;
+-    int *conf_state;
+-    gss_qop_t *qop_state;
+-    int toktype;
++kg_unseal(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++          gss_buffer_t input_token_buffer, gss_buffer_t message_buffer,
++          int *conf_state, gss_qop_t *qop_state, int toktype)
+ {
+     krb5_gss_ctx_id_rec *ctx;
+     unsigned char *ptr;
+@@ -421,15 +408,10 @@ kg_unseal(minor_status, context_handle, input_token_buffer,
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_unwrap(minor_status, context_handle,
+-                input_message_buffer, output_message_buffer,
+-                conf_state, qop_state)
+-    OM_uint32           *minor_status;
+-    gss_ctx_id_t        context_handle;
+-    gss_buffer_t        input_message_buffer;
+-    gss_buffer_t        output_message_buffer;
+-    int                 *conf_state;
+-    gss_qop_t           *qop_state;
++krb5_gss_unwrap(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                gss_buffer_t input_message_buffer,
++                gss_buffer_t output_message_buffer, int *conf_state,
++                gss_qop_t *qop_state)
+ {
+     OM_uint32           rstat;
+ 
+@@ -440,14 +422,9 @@ krb5_gss_unwrap(minor_status, context_handle,
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_verify_mic(minor_status, context_handle,
+-                    message_buffer, token_buffer,
+-                    qop_state)
+-    OM_uint32           *minor_status;
+-    gss_ctx_id_t        context_handle;
+-    gss_buffer_t        message_buffer;
+-    gss_buffer_t        token_buffer;
+-    gss_qop_t           *qop_state;
++krb5_gss_verify_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                    gss_buffer_t message_buffer, gss_buffer_t token_buffer,
++                    gss_qop_t *qop_state)
+ {
+     OM_uint32           rstat;
+ 
+diff --git a/src/lib/gssapi/krb5/process_context_token.c b/src/lib/gssapi/krb5/process_context_token.c
+index a672f48c85..67805fba78 100644
+--- a/src/lib/gssapi/krb5/process_context_token.c
++++ b/src/lib/gssapi/krb5/process_context_token.c
+@@ -28,11 +28,9 @@
+  */
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_process_context_token(minor_status, context_handle,
+-                               token_buffer)
+-    OM_uint32 *minor_status;
+-    gss_ctx_id_t context_handle;
+-    gss_buffer_t token_buffer;
++krb5_gss_process_context_token(OM_uint32 *minor_status,
++                               gss_ctx_id_t context_handle,
++                               gss_buffer_t token_buffer)
+ {
+     krb5_gss_ctx_id_rec *ctx;
+     OM_uint32 majerr;
+diff --git a/src/lib/gssapi/krb5/rel_cred.c b/src/lib/gssapi/krb5/rel_cred.c
+index 0da6c1b950..9e04e2fa81 100644
+--- a/src/lib/gssapi/krb5/rel_cred.c
++++ b/src/lib/gssapi/krb5/rel_cred.c
+@@ -24,9 +24,7 @@
+ #include "gssapiP_krb5.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_release_cred(minor_status, cred_handle)
+-    OM_uint32 *minor_status;
+-    gss_cred_id_t *cred_handle;
++krb5_gss_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle)
+ {
+     krb5_context context;
+     krb5_gss_cred_id_t cred;
+diff --git a/src/lib/gssapi/krb5/rel_name.c b/src/lib/gssapi/krb5/rel_name.c
+index 3dabe32f33..558bb6dbc5 100644
+--- a/src/lib/gssapi/krb5/rel_name.c
++++ b/src/lib/gssapi/krb5/rel_name.c
+@@ -24,9 +24,7 @@
+ #include "gssapiP_krb5.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_release_name(minor_status, input_name)
+-    OM_uint32 *minor_status;
+-    gss_name_t *input_name;
++krb5_gss_release_name(OM_uint32 *minor_status, gss_name_t *input_name)
+ {
+     krb5_context context;
+     krb5_error_code code;
+diff --git a/src/lib/gssapi/krb5/rel_oid.c b/src/lib/gssapi/krb5/rel_oid.c
+index 739efe4680..900c4105f9 100644
+--- a/src/lib/gssapi/krb5/rel_oid.c
++++ b/src/lib/gssapi/krb5/rel_oid.c
+@@ -27,9 +27,7 @@
+ #include "gssapiP_krb5.h"
+ 
+ OM_uint32
+-krb5_gss_release_oid(minor_status, oid)
+-    OM_uint32   *minor_status;
+-    gss_OID     *oid;
++krb5_gss_release_oid(OM_uint32 *minor_status, gss_OID *oid)
+ {
+     /*
+      * The V2 API says the following!
+@@ -52,9 +50,7 @@ krb5_gss_release_oid(minor_status, oid)
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_internal_release_oid(minor_status, oid)
+-    OM_uint32   *minor_status;
+-    gss_OID     *oid;
++krb5_gss_internal_release_oid(OM_uint32 *minor_status, gss_OID *oid)
+ {
+     /*
+      * This function only knows how to release internal OIDs. It will
+diff --git a/src/lib/gssapi/krb5/ser_sctx.c b/src/lib/gssapi/krb5/ser_sctx.c
+index 9e2d32e98d..1129b6a1aa 100644
+--- a/src/lib/gssapi/krb5/ser_sctx.c
++++ b/src/lib/gssapi/krb5/ser_sctx.c
+@@ -137,10 +137,8 @@ kg_oid_size(gss_OID oid, size_t *sizep)
+ }
+ 
+ static krb5_error_code
+-kg_seqstate_externalize(arg, buffer, lenremain)
+-    g_seqnum_state      arg;
+-    krb5_octet          **buffer;
+-    size_t              *lenremain;
++kg_seqstate_externalize(g_seqnum_state arg, krb5_octet **buffer,
++                        size_t *lenremain)
+ {
+     krb5_error_code err;
+     err = krb5_ser_pack_int32(KV5M_GSS_QUEUE, buffer, lenremain);
+@@ -152,10 +150,8 @@ kg_seqstate_externalize(arg, buffer, lenremain)
+ }
+ 
+ static krb5_error_code
+-kg_seqstate_internalize(argp, buffer, lenremain)
+-    g_seqnum_state      *argp;
+-    krb5_octet          **buffer;
+-    size_t              *lenremain;
++kg_seqstate_internalize(g_seqnum_state *argp, krb5_octet **buffer,
++                        size_t *lenremain)
+ {
+     krb5_int32 ibuf;
+     krb5_octet         *bp;
+@@ -193,9 +189,7 @@ kg_seqstate_internalize(argp, buffer, lenremain)
+ }
+ 
+ static krb5_error_code
+-kg_seqstate_size(arg, sizep)
+-    g_seqnum_state      arg;
+-    size_t              *sizep;
++kg_seqstate_size(g_seqnum_state arg, size_t *sizep)
+ {
+     krb5_error_code kret;
+     size_t required;
+diff --git a/src/lib/gssapi/krb5/util_cksum.c b/src/lib/gssapi/krb5/util_cksum.c
+index 5b87956393..5f7694f5e6 100644
+--- a/src/lib/gssapi/krb5/util_cksum.c
++++ b/src/lib/gssapi/krb5/util_cksum.c
+@@ -28,10 +28,8 @@
+ 
+ /* Checksumming the channel bindings always uses plain MD5.  */
+ krb5_error_code
+-kg_checksum_channel_bindings(context, cb, cksum)
+-    krb5_context context;
+-    gss_channel_bindings_t cb;
+-    krb5_checksum *cksum;
++kg_checksum_channel_bindings(krb5_context context, gss_channel_bindings_t cb,
++                             krb5_checksum *cksum)
+ {
+     struct k5buf buf;
+     size_t sumlen;
+diff --git a/src/lib/gssapi/krb5/util_seed.c b/src/lib/gssapi/krb5/util_seed.c
+index 6e1c9ac8ae..685736314c 100644
+--- a/src/lib/gssapi/krb5/util_seed.c
++++ b/src/lib/gssapi/krb5/util_seed.c
+@@ -29,10 +29,7 @@
+ static const unsigned char zeros[16] = {0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0};
+ 
+ krb5_error_code
+-kg_make_seed(context, key, seed)
+-    krb5_context context;
+-    krb5_key key;
+-    unsigned char *seed;
++kg_make_seed(krb5_context context, krb5_key key, unsigned char *seed)
+ {
+     krb5_error_code code;
+     krb5_key rkey = NULL;
+diff --git a/src/lib/gssapi/krb5/util_seqnum.c b/src/lib/gssapi/krb5/util_seqnum.c
+index bef631da9d..a5a4d5cf80 100644
+--- a/src/lib/gssapi/krb5/util_seqnum.c
++++ b/src/lib/gssapi/krb5/util_seqnum.c
+@@ -30,13 +30,8 @@
+  */
+ 
+ krb5_error_code
+-kg_make_seq_num(context, key, direction, seqnum, cksum, buf)
+-    krb5_context context;
+-    krb5_key key;
+-    int direction;
+-    krb5_ui_4 seqnum;
+-    unsigned char *cksum;
+-    unsigned char *buf;
++kg_make_seq_num(krb5_context context, krb5_key key, int direction,
++                krb5_ui_4 seqnum, unsigned char *cksum, unsigned char *buf)
+ {
+     unsigned char plain[8];
+ 
+@@ -59,13 +54,9 @@ kg_make_seq_num(context, key, direction, seqnum, cksum, buf)
+     return(kg_encrypt(context, key, KG_USAGE_SEQ, cksum, plain, buf, 8));
+ }
+ 
+-krb5_error_code kg_get_seq_num(context, key, cksum, buf, direction, seqnum)
+-    krb5_context context;
+-    krb5_key key;
+-    unsigned char *cksum;
+-    unsigned char *buf;
+-    int *direction;
+-    krb5_ui_4 *seqnum;
++krb5_error_code
++kg_get_seq_num(krb5_context context, krb5_key key, unsigned char *cksum,
++               unsigned char *buf, int *direction, krb5_ui_4 *seqnum)
+ {
+     krb5_error_code code;
+     unsigned char plain[8];
+diff --git a/src/lib/gssapi/krb5/val_cred.c b/src/lib/gssapi/krb5/val_cred.c
+index cb1cb9393a..83e7634106 100644
+--- a/src/lib/gssapi/krb5/val_cred.c
++++ b/src/lib/gssapi/krb5/val_cred.c
+@@ -57,9 +57,7 @@ krb5_gss_validate_cred_1(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
+ }
+ 
+ OM_uint32
+-krb5_gss_validate_cred(minor_status, cred_handle)
+-    OM_uint32 *minor_status;
+-    gss_cred_id_t cred_handle;
++krb5_gss_validate_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle)
+ {
+     krb5_context context;
+     krb5_error_code code;
+diff --git a/src/lib/gssapi/krb5/wrap_size_limit.c b/src/lib/gssapi/krb5/wrap_size_limit.c
+index 7959f424ec..8ea6ce1ad3 100644
+--- a/src/lib/gssapi/krb5/wrap_size_limit.c
++++ b/src/lib/gssapi/krb5/wrap_size_limit.c
+@@ -74,14 +74,9 @@
+ 
+ /* V2 interface */
+ OM_uint32 KRB5_CALLCONV
+-krb5_gss_wrap_size_limit(minor_status, context_handle, conf_req_flag,
+-                         qop_req, req_output_size, max_input_size)
+-    OM_uint32           *minor_status;
+-    gss_ctx_id_t        context_handle;
+-    int                 conf_req_flag;
+-    gss_qop_t           qop_req;
+-    OM_uint32           req_output_size;
+-    OM_uint32           *max_input_size;
++krb5_gss_wrap_size_limit(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++                         int conf_req_flag, gss_qop_t qop_req,
++                         OM_uint32 req_output_size, OM_uint32 *max_input_size)
+ {
+     krb5_gss_ctx_id_rec *ctx;
+     OM_uint32           data_size, conflen;
+diff --git a/src/lib/gssapi/mechglue/g_accept_sec_context.c b/src/lib/gssapi/mechglue/g_accept_sec_context.c
+index 4f2a66e26a..e4eff1f52c 100644
+--- a/src/lib/gssapi/mechglue/g_accept_sec_context.c
++++ b/src/lib/gssapi/mechglue/g_accept_sec_context.c
+@@ -128,30 +128,13 @@ allow_mech_by_default(gss_OID mech)
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_accept_sec_context (minor_status,
+-                        context_handle,
+-                        verifier_cred_handle,
+-                        input_token_buffer,
+-                        input_chan_bindings,
+-                        src_name,
+-                        mech_type,
+-                        output_token,
+-                        ret_flags,
+-                        time_rec,
+-                        d_cred)
+-
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t *		context_handle;
+-gss_cred_id_t		verifier_cred_handle;
+-gss_buffer_t		input_token_buffer;
+-gss_channel_bindings_t	input_chan_bindings;
+-gss_name_t *		src_name;
+-gss_OID *		mech_type;
+-gss_buffer_t		output_token;
+-OM_uint32 *		ret_flags;
+-OM_uint32 *		time_rec;
+-gss_cred_id_t *		d_cred;
+-
++gss_accept_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle,
++		       gss_cred_id_t verifier_cred_handle,
++		       gss_buffer_t input_token_buffer,
++		       gss_channel_bindings_t input_chan_bindings,
++		       gss_name_t *src_name, gss_OID *mech_type,
++		       gss_buffer_t output_token, OM_uint32 *ret_flags,
++		       OM_uint32 *time_rec, gss_cred_id_t *d_cred)
+ {
+     OM_uint32		status, temp_status, temp_minor_status;
+     OM_uint32		temp_ret_flags = 0;
+diff --git a/src/lib/gssapi/mechglue/g_acquire_cred.c b/src/lib/gssapi/mechglue/g_acquire_cred.c
+index c885f56279..2fc9c5c786 100644
+--- a/src/lib/gssapi/mechglue/g_acquire_cred.c
++++ b/src/lib/gssapi/mechglue/g_acquire_cred.c
+@@ -85,24 +85,10 @@ val_acq_cred_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_acquire_cred(minor_status,
+-                 desired_name,
+-                 time_req,
+-                 desired_mechs,
+-		 cred_usage,
+-                 output_cred_handle,
+-                 actual_mechs,
+-                 time_rec)
+-
+-OM_uint32 *		minor_status;
+-gss_name_t		desired_name;
+-OM_uint32		time_req;
+-gss_OID_set		desired_mechs;
+-int			cred_usage;
+-gss_cred_id_t *		output_cred_handle;
+-gss_OID_set *		actual_mechs;
+-OM_uint32 *		time_rec;
+-
++gss_acquire_cred(OM_uint32 *minor_status, gss_name_t desired_name,
++		 OM_uint32 time_req, gss_OID_set desired_mechs,
++		 int cred_usage, gss_cred_id_t *output_cred_handle,
++		 gss_OID_set *actual_mechs, OM_uint32 *time_rec)
+ {
+     return gss_acquire_cred_from(minor_status, desired_name, time_req,
+ 				 desired_mechs, cred_usage, NULL,
+@@ -110,26 +96,11 @@ OM_uint32 *		time_rec;
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_acquire_cred_from(minor_status,
+-		      desired_name,
+-		      time_req,
+-		      desired_mechs,
+-		      cred_usage,
+-		      cred_store,
+-		      output_cred_handle,
+-		      actual_mechs,
+-		      time_rec)
+-
+-OM_uint32 *			minor_status;
+-gss_name_t			desired_name;
+-OM_uint32			time_req;
+-gss_OID_set			desired_mechs;
+-int				cred_usage;
+-gss_const_key_value_set_t	cred_store;
+-gss_cred_id_t *			output_cred_handle;
+-gss_OID_set *			actual_mechs;
+-OM_uint32 *			time_rec;
+-
++gss_acquire_cred_from(OM_uint32 * minor_status, gss_name_t desired_name,
++		      OM_uint32 time_req, gss_OID_set desired_mechs,
++		      int cred_usage, gss_const_key_value_set_t cred_store,
++		      gss_cred_id_t *output_cred_handle,
++		      gss_OID_set *actual_mechs, OM_uint32 *time_rec)
+ {
+     OM_uint32 major = GSS_S_FAILURE, tmpMinor;
+     OM_uint32 first_major = GSS_S_COMPLETE, first_minor = 0;
+@@ -397,22 +368,12 @@ error:
+ 
+ /* V2 KRB5_CALLCONV */
+ OM_uint32 KRB5_CALLCONV
+-gss_add_cred(minor_status, input_cred_handle,
+-		  desired_name, desired_mech, cred_usage,
+-		  initiator_time_req, acceptor_time_req,
+-		  output_cred_handle, actual_mechs,
+-		  initiator_time_rec, acceptor_time_rec)
+-    OM_uint32		*minor_status;
+-    gss_cred_id_t	input_cred_handle;
+-    gss_name_t		desired_name;
+-    gss_OID		desired_mech;
+-    gss_cred_usage_t	cred_usage;
+-    OM_uint32		initiator_time_req;
+-    OM_uint32		acceptor_time_req;
+-    gss_cred_id_t	*output_cred_handle;
+-    gss_OID_set		*actual_mechs;
+-    OM_uint32		*initiator_time_rec;
+-    OM_uint32		*acceptor_time_rec;
++gss_add_cred(OM_uint32 *minor_status, gss_cred_id_t input_cred_handle,
++	     gss_name_t desired_name, gss_OID desired_mech,
++	     gss_cred_usage_t cred_usage, OM_uint32 initiator_time_req,
++	     OM_uint32 acceptor_time_req, gss_cred_id_t *output_cred_handle,
++	     gss_OID_set *actual_mechs, OM_uint32 *initiator_time_rec,
++	     OM_uint32 *acceptor_time_rec)
+ {
+     return gss_add_cred_from(minor_status, input_cred_handle, desired_name,
+ 			     desired_mech, cred_usage, initiator_time_req,
+@@ -422,25 +383,13 @@ gss_add_cred(minor_status, input_cred_handle,
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_add_cred_from(minor_status, input_cred_handle,
+-		  desired_name, desired_mech,
+-		  cred_usage,
+-		  initiator_time_req, acceptor_time_req,
+-		  cred_store,
+-		  output_cred_handle, actual_mechs,
+-		  initiator_time_rec, acceptor_time_rec)
+-    OM_uint32		*minor_status;
+-    gss_cred_id_t	input_cred_handle;
+-    gss_name_t		desired_name;
+-    gss_OID		desired_mech;
+-    gss_cred_usage_t	cred_usage;
+-    OM_uint32		initiator_time_req;
+-    OM_uint32		acceptor_time_req;
+-    gss_const_key_value_set_t  cred_store;
+-    gss_cred_id_t	*output_cred_handle;
+-    gss_OID_set		*actual_mechs;
+-    OM_uint32		*initiator_time_rec;
+-    OM_uint32		*acceptor_time_rec;
++gss_add_cred_from(OM_uint32 *minor_status, gss_cred_id_t input_cred_handle,
++		  gss_name_t desired_name, gss_OID desired_mech,
++		  gss_cred_usage_t cred_usage, OM_uint32 initiator_time_req,
++		  OM_uint32 acceptor_time_req,
++		  gss_const_key_value_set_t cred_store,
++		  gss_cred_id_t *output_cred_handle, gss_OID_set *actual_mechs,
++		  OM_uint32 *initiator_time_rec, OM_uint32 *acceptor_time_rec)
+ {
+     OM_uint32		status, temp_minor_status;
+     OM_uint32		time_req, time_rec = 0, *time_recp = NULL;
+diff --git a/src/lib/gssapi/mechglue/g_acquire_cred_with_pw.c b/src/lib/gssapi/mechglue/g_acquire_cred_with_pw.c
+index cc34acc2bf..86abf984dc 100644
+--- a/src/lib/gssapi/mechglue/g_acquire_cred_with_pw.c
++++ b/src/lib/gssapi/mechglue/g_acquire_cred_with_pw.c
+@@ -98,26 +98,12 @@ val_acq_cred_pw_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_acquire_cred_with_password(
+-    minor_status,
+-    desired_name,
+-    password,
+-    time_req,
+-    desired_mechs,
+-    cred_usage,
+-    output_cred_handle,
+-    actual_mechs,
+-    time_rec)
+-
+-OM_uint32 *		minor_status;
+-const gss_name_t	desired_name;
+-const gss_buffer_t	password;
+-OM_uint32		time_req;
+-const gss_OID_set	desired_mechs;
+-int			cred_usage;
+-gss_cred_id_t *		output_cred_handle;
+-gss_OID_set *		actual_mechs;
+-OM_uint32 *		time_rec;
++gss_acquire_cred_with_password(OM_uint32 *minor_status,
++			       const gss_name_t desired_name,
++			       const gss_buffer_t password, OM_uint32 time_req,
++			       const gss_OID_set desired_mechs, int cred_usage,
++			       gss_cred_id_t *output_cred_handle,
++			       gss_OID_set *actual_mechs, OM_uint32 *time_rec)
+ {
+     OM_uint32 major = GSS_S_FAILURE;
+     OM_uint32 initTimeOut, acceptTimeOut, outTime = GSS_C_INDEFINITE;
+@@ -306,23 +292,19 @@ val_add_cred_pw_args(
+ 
+ /* V2 KRB5_CALLCONV */
+ OM_uint32 KRB5_CALLCONV
+-gss_add_cred_with_password(minor_status, input_cred_handle,
+-		  desired_name, desired_mech, password, cred_usage,
+-		  initiator_time_req, acceptor_time_req,
+-		  output_cred_handle, actual_mechs,
+-		  initiator_time_rec, acceptor_time_rec)
+-    OM_uint32		*minor_status;
+-    const gss_cred_id_t	input_cred_handle;
+-    const gss_name_t	desired_name;
+-    const gss_OID	desired_mech;
+-    const gss_buffer_t	password;
+-    gss_cred_usage_t	cred_usage;
+-    OM_uint32		initiator_time_req;
+-    OM_uint32		acceptor_time_req;
+-    gss_cred_id_t	*output_cred_handle;
+-    gss_OID_set		*actual_mechs;
+-    OM_uint32		*initiator_time_rec;
+-    OM_uint32		*acceptor_time_rec;
++gss_add_cred_with_password(
++    OM_uint32 *minor_status,
++    const gss_cred_id_t input_cred_handle,
++    const gss_name_t desired_name,
++    const gss_OID desired_mech,
++    const gss_buffer_t password,
++    gss_cred_usage_t cred_usage,
++    OM_uint32 initiator_time_req,
++    OM_uint32 acceptor_time_req,
++    gss_cred_id_t *output_cred_handle,
++    gss_OID_set *actual_mechs,
++    OM_uint32 *initiator_time_rec,
++    OM_uint32 *acceptor_time_rec)
+ {
+     OM_uint32		status, temp_minor_status;
+     OM_uint32		time_req, time_rec;
+diff --git a/src/lib/gssapi/mechglue/g_canon_name.c b/src/lib/gssapi/mechglue/g_canon_name.c
+index 61f657f91f..c5214db80a 100644
+--- a/src/lib/gssapi/mechglue/g_canon_name.c
++++ b/src/lib/gssapi/mechglue/g_canon_name.c
+@@ -54,14 +54,8 @@ val_canon_name_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_canonicalize_name(minor_status,
+-				input_name,
+-				mech_type,
+-				output_name)
+-OM_uint32 *minor_status;
+-const gss_name_t input_name;
+-const gss_OID mech_type;
+-gss_name_t *output_name;
++gss_canonicalize_name(OM_uint32 *minor_status, const gss_name_t input_name,
++		      const gss_OID mech_type, gss_name_t *output_name)
+ {
+ 	gss_union_name_t in_union, out_union = NULL, dest_union = NULL;
+ 	OM_uint32 major_status = GSS_S_FAILURE, tmpmin;
+diff --git a/src/lib/gssapi/mechglue/g_compare_name.c b/src/lib/gssapi/mechglue/g_compare_name.c
+index af2e76bbda..74a9529a35 100644
+--- a/src/lib/gssapi/mechglue/g_compare_name.c
++++ b/src/lib/gssapi/mechglue/g_compare_name.c
+@@ -59,16 +59,8 @@ val_comp_name_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_compare_name (minor_status,
+-                  name1,
+-                  name2,
+-                  name_equal)
+-
+-OM_uint32 *		minor_status;
+-gss_name_t		name1;
+-gss_name_t		name2;
+-int *			name_equal;
+-
++gss_compare_name(OM_uint32 * minor_status, gss_name_t name1, gss_name_t name2,
++		 int * name_equal)
+ {
+     OM_uint32		major_status, temp_minor;
+     gss_union_name_t	union_name1, union_name2;
+diff --git a/src/lib/gssapi/mechglue/g_context_time.c b/src/lib/gssapi/mechglue/g_context_time.c
+index c947e7646c..b11b32d6bb 100644
+--- a/src/lib/gssapi/mechglue/g_context_time.c
++++ b/src/lib/gssapi/mechglue/g_context_time.c
+@@ -29,14 +29,8 @@
+ #include "mglueP.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_context_time (minor_status,
+-                  context_handle,
+-                  time_rec)
+-
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-OM_uint32 *		time_rec;
+-
++gss_context_time(OM_uint32 * minor_status, gss_ctx_id_t context_handle,
++		 OM_uint32 * time_rec)
+ {
+     OM_uint32		status;
+     gss_union_ctx_id_t	ctx;
+diff --git a/src/lib/gssapi/mechglue/g_delete_sec_context.c b/src/lib/gssapi/mechglue/g_delete_sec_context.c
+index 574ff02944..dc86cce3d3 100644
+--- a/src/lib/gssapi/mechglue/g_delete_sec_context.c
++++ b/src/lib/gssapi/mechglue/g_delete_sec_context.c
+@@ -62,14 +62,8 @@ val_del_sec_ctx_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_delete_sec_context (minor_status,
+-                        context_handle,
+-                        output_token)
+-
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t *		context_handle;
+-gss_buffer_t		output_token;
+-
++gss_delete_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle,
++		       gss_buffer_t output_token)
+ {
+     OM_uint32		status;
+     gss_union_ctx_id_t	ctx;
+diff --git a/src/lib/gssapi/mechglue/g_dsp_name.c b/src/lib/gssapi/mechglue/g_dsp_name.c
+index 21867c814e..fae64f712e 100644
+--- a/src/lib/gssapi/mechglue/g_dsp_name.c
++++ b/src/lib/gssapi/mechglue/g_dsp_name.c
+@@ -70,16 +70,8 @@ val_dsp_name_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_display_name (minor_status,
+-                  input_name,
+-                  output_name_buffer,
+-                  output_name_type)
+-
+-OM_uint32 *		minor_status;
+-gss_name_t		input_name;
+-gss_buffer_t		output_name_buffer;
+-gss_OID *		output_name_type;
+-
++gss_display_name(OM_uint32 *minor_status, gss_name_t input_name,
++		 gss_buffer_t output_name_buffer, gss_OID *output_name_type)
+ {
+     OM_uint32		major_status;
+     gss_union_name_t	union_name;
+diff --git a/src/lib/gssapi/mechglue/g_dsp_status.c b/src/lib/gssapi/mechglue/g_dsp_status.c
+index 70e8492636..14a7a8200c 100644
+--- a/src/lib/gssapi/mechglue/g_dsp_status.c
++++ b/src/lib/gssapi/mechglue/g_dsp_status.c
+@@ -36,20 +36,9 @@
+ static OM_uint32 displayMajor(OM_uint32, OM_uint32 *, gss_buffer_t);
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_display_status (minor_status,
+-                    status_value,
+-                    status_type,
+-                    req_mech_type,
+-                    message_context,
+-                    status_string)
+-
+-OM_uint32 *		minor_status;
+-OM_uint32		status_value;
+-int			status_type;
+-gss_OID			req_mech_type;
+-OM_uint32 *		message_context;
+-gss_buffer_t		status_string;
+-
++gss_display_status(OM_uint32 *minor_status, OM_uint32 status_value,
++		   int status_type, gss_OID req_mech_type,
++		   OM_uint32 *message_context, gss_buffer_t status_string)
+ {
+     gss_OID		mech_type = (gss_OID) req_mech_type;
+     gss_mechanism	mech;
+@@ -147,10 +136,7 @@ gss_buffer_t		status_string;
+  *	>= 2 - the supplementary error code bit shifted by 1
+  */
+ static OM_uint32
+-displayMajor(status, msgCtxt, outStr)
+-OM_uint32 status;
+-OM_uint32 *msgCtxt;
+-gss_buffer_t outStr;
++displayMajor(OM_uint32 status, OM_uint32 *msgCtxt, gss_buffer_t outStr)
+ {
+ 	OM_uint32 oneVal, mask = 0x1, currErr;
+ 	char *errStr = NULL;
+diff --git a/src/lib/gssapi/mechglue/g_dup_name.c b/src/lib/gssapi/mechglue/g_dup_name.c
+index ff01db27dc..bf6eb602ea 100644
+--- a/src/lib/gssapi/mechglue/g_dup_name.c
++++ b/src/lib/gssapi/mechglue/g_dup_name.c
+@@ -51,12 +51,8 @@ val_dup_name_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_duplicate_name(minor_status,
+-		src_name,
+-		dest_name)
+-OM_uint32 *minor_status;
+-const gss_name_t src_name;
+-gss_name_t *dest_name;
++gss_duplicate_name(OM_uint32 *minor_status, const gss_name_t src_name,
++		   gss_name_t *dest_name)
+ {
+ 		gss_union_name_t src_union, dest_union;
+ 		OM_uint32 major_status = GSS_S_FAILURE;
+diff --git a/src/lib/gssapi/mechglue/g_exp_sec_context.c b/src/lib/gssapi/mechglue/g_exp_sec_context.c
+index a04afe3d1e..68a3267cf0 100644
+--- a/src/lib/gssapi/mechglue/g_exp_sec_context.c
++++ b/src/lib/gssapi/mechglue/g_exp_sec_context.c
+@@ -68,14 +68,8 @@ val_exp_sec_ctx_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_export_sec_context(minor_status,
+-                       context_handle,
+-                       interprocess_token)
+-
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t *		context_handle;
+-gss_buffer_t		interprocess_token;
+-
++gss_export_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle,
++		       gss_buffer_t interprocess_token)
+ {
+     OM_uint32		status;
+     OM_uint32 		length;
+diff --git a/src/lib/gssapi/mechglue/g_export_name.c b/src/lib/gssapi/mechglue/g_export_name.c
+index c845f8caf7..2e0611d2d5 100644
+--- a/src/lib/gssapi/mechglue/g_export_name.c
++++ b/src/lib/gssapi/mechglue/g_export_name.c
+@@ -20,12 +20,8 @@
+ #include <errno.h>
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_export_name(minor_status,
+-			input_name,
+-			exported_name)
+-OM_uint32 *		minor_status;
+-const gss_name_t	input_name;
+-gss_buffer_t		exported_name;
++gss_export_name(OM_uint32 *minor_status, const gss_name_t input_name,
++		gss_buffer_t exported_name)
+ {
+ 	gss_union_name_t		union_name;
+ 
+diff --git a/src/lib/gssapi/mechglue/g_glue.c b/src/lib/gssapi/mechglue/g_glue.c
+index 176fbe63eb..47f499307a 100644
+--- a/src/lib/gssapi/mechglue/g_glue.c
++++ b/src/lib/gssapi/mechglue/g_glue.c
+@@ -75,9 +75,8 @@ static gss_OID_desc gss_krb5_mechanism_oid_desc =
+ 
+ #define NTLMSSP_SIGNATURE "NTLMSSP"
+ 
+-OM_uint32 gssint_get_mech_type(OID, token)
+-    gss_OID		OID;
+-    gss_buffer_t	token;
++OM_uint32
++gssint_get_mech_type(gss_OID OID, gss_buffer_t token)
+ {
+     /* Check for interoperability exceptions */
+     if (token->length >= sizeof(NTLMSSP_SIGNATURE) &&
+@@ -163,12 +162,10 @@ import_internal_attributes(OM_uint32 *minor,
+  *  Internal routines to get and release an internal mechanism name
+  */
+ 
+-OM_uint32 gssint_import_internal_name (minor_status, mech_type, union_name,
+-				internal_name)
+-OM_uint32	*minor_status;
+-gss_OID		mech_type;
+-gss_union_name_t	union_name;
+-gss_name_t	*internal_name;
++OM_uint32
++gssint_import_internal_name(OM_uint32 *minor_status, gss_OID mech_type,
++			    gss_union_name_t union_name,
++			    gss_name_t *internal_name)
+ {
+     OM_uint32		status, tmpMinor;
+     gss_mechanism	mech;
+@@ -220,12 +217,10 @@ gss_name_t	*internal_name;
+     return (status);
+ }
+ 
+-OM_uint32 gssint_export_internal_name(minor_status, mech_type,
+-				     internal_name, name_buf)
+-    OM_uint32		*minor_status;
+-    const gss_OID		mech_type;
+-    const gss_name_t	internal_name;
+-    gss_buffer_t		name_buf;
++OM_uint32
++gssint_export_internal_name(OM_uint32 *minor_status, const gss_OID mech_type,
++			    const gss_name_t internal_name,
++			    gss_buffer_t name_buf)
+ {
+     OM_uint32 status;
+     gss_mechanism mech;
+@@ -307,13 +302,10 @@ OM_uint32 gssint_export_internal_name(minor_status, mech_type,
+     return (GSS_S_COMPLETE);
+ } /*  gssint_export_internal_name */
+ 
+-OM_uint32 gssint_display_internal_name (minor_status, mech_type, internal_name,
+-				 external_name, name_type)
+-OM_uint32	*minor_status;
+-gss_OID		mech_type;
+-gss_name_t	internal_name;
+-gss_buffer_t	external_name;
+-gss_OID		*name_type;
++OM_uint32
++gssint_display_internal_name(OM_uint32 *minor_status, gss_OID mech_type,
++			     gss_name_t internal_name,
++			     gss_buffer_t external_name, gss_OID *name_type)
+ {
+     OM_uint32		status;
+     gss_mechanism	mech;
+@@ -337,10 +329,9 @@ gss_OID		*name_type;
+     return (GSS_S_BAD_MECH);
+ }
+ 
+-OM_uint32 gssint_release_internal_name (minor_status, mech_type, internal_name)
+-OM_uint32	*minor_status;
+-gss_OID		mech_type;
+-gss_name_t	*internal_name;
++OM_uint32
++gssint_release_internal_name(OM_uint32 *minor_status, gss_OID mech_type,
++			     gss_name_t *internal_name)
+ {
+     OM_uint32		status;
+     gss_mechanism	mech;
+@@ -362,14 +353,10 @@ gss_name_t	*internal_name;
+     return (GSS_S_BAD_MECH);
+ }
+ 
+-OM_uint32 gssint_delete_internal_sec_context (minor_status,
+-					      mech_type,
+-					      internal_ctx,
+-					      output_token)
+-OM_uint32	*minor_status;
+-gss_OID		mech_type;
+-gss_ctx_id_t	*internal_ctx;
+-gss_buffer_t	output_token;
++OM_uint32
++gssint_delete_internal_sec_context(OM_uint32 *minor_status, gss_OID mech_type,
++				   gss_ctx_id_t *internal_ctx,
++				   gss_buffer_t output_token)
+ {
+     OM_uint32		status;
+     gss_mechanism	mech;
+@@ -394,12 +381,10 @@ gss_buffer_t	output_token;
+  * name.  Note that internal_name should be considered "consumed" by
+  * this call, whether or not we return an error.
+  */
+-OM_uint32 gssint_convert_name_to_union_name(minor_status, mech,
+-					   internal_name, external_name)
+-    OM_uint32 *minor_status;
+-    gss_mechanism	mech;
+-    gss_name_t	internal_name;
+-    gss_name_t	*external_name;
++OM_uint32
++gssint_convert_name_to_union_name(OM_uint32 *minor_status, gss_mechanism mech,
++				  gss_name_t internal_name,
++				  gss_name_t *external_name)
+ {
+     OM_uint32 major_status,tmp;
+     gss_union_name_t union_name;
+@@ -473,9 +458,7 @@ allocation_failure:
+  * external union credential.
+  */
+ gss_cred_id_t
+-gssint_get_mechanism_cred(union_cred, mech_type)
+-    gss_union_cred_t	union_cred;
+-    gss_OID		mech_type;
++gssint_get_mechanism_cred(gss_union_cred_t union_cred, gss_OID mech_type)
+ {
+     int		i;
+ 
+@@ -494,10 +477,8 @@ gssint_get_mechanism_cred(union_cred, mech_type)
+  * Both space for the structure and the data is allocated.
+  */
+ OM_uint32
+-gssint_create_copy_buffer(srcBuf, destBuf, addNullChar)
+-    const gss_buffer_t	srcBuf;
+-    gss_buffer_t 		*destBuf;
+-    int			addNullChar;
++gssint_create_copy_buffer(const gss_buffer_t srcBuf, gss_buffer_t *destBuf,
++			  int addNullChar)
+ {
+     gss_buffer_t aBuf;
+     unsigned int len;
+diff --git a/src/lib/gssapi/mechglue/g_imp_name.c b/src/lib/gssapi/mechglue/g_imp_name.c
+index a805078a81..65fa6c0fb3 100644
+--- a/src/lib/gssapi/mechglue/g_imp_name.c
++++ b/src/lib/gssapi/mechglue/g_imp_name.c
+@@ -81,16 +81,8 @@ val_imp_name_args(
+ static gss_buffer_desc emptyNameBuffer;
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_import_name(minor_status,
+-                input_name_buffer,
+-                input_name_type,
+-                output_name)
+-
+-OM_uint32 *		minor_status;
+-gss_buffer_t		input_name_buffer;
+-gss_OID			input_name_type;
+-gss_name_t *		output_name;
+-
++gss_import_name(OM_uint32 * minor_status, gss_buffer_t input_name_buffer,
++		gss_OID input_name_type, gss_name_t * output_name)
+ {
+     gss_union_name_t	union_name;
+     OM_uint32		tmp, major_status = GSS_S_FAILURE;
+@@ -183,10 +175,8 @@ allocation_failure:
+ }
+ 
+ static OM_uint32
+-importExportName(minor, unionName, inputNameType)
+-    OM_uint32 *minor;
+-    gss_union_name_t unionName;
+-    gss_OID inputNameType;
++importExportName(OM_uint32 *minor, gss_union_name_t unionName,
++		 gss_OID inputNameType)
+ {
+     gss_OID_desc mechOid;
+     gss_buffer_desc expName;
+diff --git a/src/lib/gssapi/mechglue/g_imp_sec_context.c b/src/lib/gssapi/mechglue/g_imp_sec_context.c
+index 6315201a5f..55a3136df1 100644
+--- a/src/lib/gssapi/mechglue/g_imp_sec_context.c
++++ b/src/lib/gssapi/mechglue/g_imp_sec_context.c
+@@ -69,14 +69,9 @@ val_imp_sec_ctx_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_import_sec_context(minor_status,
+-                       interprocess_token,
+-                       context_handle)
+-
+-OM_uint32 *		minor_status;
+-gss_buffer_t		interprocess_token;
+-gss_ctx_id_t *		context_handle;
+-
++gss_import_sec_context(OM_uint32 *minor_status,
++		       gss_buffer_t interprocess_token,
++		       gss_ctx_id_t *context_handle)
+ {
+     OM_uint32		length = 0;
+     OM_uint32		status;
+diff --git a/src/lib/gssapi/mechglue/g_init_sec_context.c b/src/lib/gssapi/mechglue/g_init_sec_context.c
+index a58074c007..d639a8de3b 100644
+--- a/src/lib/gssapi/mechglue/g_init_sec_context.c
++++ b/src/lib/gssapi/mechglue/g_init_sec_context.c
+@@ -88,34 +88,15 @@ val_init_sec_ctx_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_init_sec_context (minor_status,
+-                      claimant_cred_handle,
+-                      context_handle,
+-                      target_name,
+-                      req_mech_type,
+-                      req_flags,
+-                      time_req,
+-                      input_chan_bindings,
+-                      input_token,
+-                      actual_mech_type,
+-                      output_token,
+-                      ret_flags,
+-                      time_rec)
+-
+-OM_uint32 *		minor_status;
+-gss_cred_id_t		claimant_cred_handle;
+-gss_ctx_id_t *		context_handle;
+-gss_name_t		target_name;
+-gss_OID			req_mech_type;
+-OM_uint32		req_flags;
+-OM_uint32		time_req;
+-gss_channel_bindings_t	input_chan_bindings;
+-gss_buffer_t		input_token;
+-gss_OID *		actual_mech_type;
+-gss_buffer_t		output_token;
+-OM_uint32 *		ret_flags;
+-OM_uint32 *		time_rec;
+-
++gss_init_sec_context(OM_uint32 *minor_status,
++		     gss_cred_id_t claimant_cred_handle,
++		     gss_ctx_id_t *context_handle, gss_name_t target_name,
++		     gss_OID req_mech_type, OM_uint32 req_flags,
++		     OM_uint32 time_req,
++		     gss_channel_bindings_t input_chan_bindings,
++		     gss_buffer_t input_token, gss_OID *actual_mech_type,
++		     gss_buffer_t output_token, OM_uint32 *ret_flags,
++		     OM_uint32 *time_rec)
+ {
+     OM_uint32		status, temp_minor_status;
+     gss_union_name_t	union_name;
+diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c
+index 22f6c615c1..7e36c4a0d0 100644
+--- a/src/lib/gssapi/mechglue/g_initialize.c
++++ b/src/lib/gssapi/mechglue/g_initialize.c
+@@ -169,9 +169,7 @@ gssint_mechglue_initialize_library(void)
+  * This routine requires direct access to the mechList.
+  */
+ OM_uint32 KRB5_CALLCONV
+-gss_release_oid(minor_status, oid)
+-OM_uint32 *minor_status;
+-gss_OID *oid;
++gss_release_oid(OM_uint32 *minor_status, gss_OID *oid)
+ {
+ 	OM_uint32 major;
+ 	gss_mech_info aMech;
+@@ -267,9 +265,7 @@ prune_deprecated(gss_OID_set mech_set)
+  * a mech oid set, and only update it once the file has changed.
+  */
+ OM_uint32 KRB5_CALLCONV
+-gss_indicate_mechs(minorStatus, mechSet_out)
+-OM_uint32 *minorStatus;
+-gss_OID_set *mechSet_out;
++gss_indicate_mechs(OM_uint32 *minorStatus, gss_OID_set *mechSet_out)
+ {
+ 	OM_uint32 status;
+ 
+@@ -417,8 +413,7 @@ build_mechSet(void)
+  * caller is responsible for freeing the memory
+  */
+ char *
+-gssint_get_modOptions(oid)
+-const gss_OID oid;
++gssint_get_modOptions(const gss_OID oid)
+ {
+ 	gss_mech_info aMech;
+ 	char *modOptions = NULL;
+@@ -479,7 +474,7 @@ load_if_changed(const char *pathname, time_t last, time_t *highest)
+ /* Try to load any config files which have changed since the last call.  Config
+  * files are MECH_CONF and any files matching MECH_CONF_PATTERN. */
+ static void
+-loadConfigFiles()
++loadConfigFiles(void)
+ {
+ 	glob_t globbuf;
+ 	time_t highest = (time_t)-1, now;
+@@ -679,7 +674,8 @@ gssint_register_mechinfo(gss_mech_info template)
+ 		memset(&errinfo, 0, sizeof(errinfo)); \
+ 		if (krb5int_get_plugin_func(_dl, \
+ 					    #_symbol, \
+-					    (void (**)())&(_mech)->_symbol, \
++					    (void (**)(void)) \
++					    &(_mech)->_symbol, \
+ 					    &errinfo) || errinfo.code) {  \
+ 			(_mech)->_symbol = NULL; \
+ 			k5_clear_error(&errinfo); \
+@@ -801,7 +797,7 @@ build_dynamicMech(void *dl, const gss_OID mech_type)
+ 		memset(&errinfo, 0, sizeof(errinfo));			\
+ 		if (krb5int_get_plugin_func(_dl,			\
+ 					    "gssi" #_nsym,		\
+-					    (void (**)())&(_mech)->_psym \
++					    (void (**)(void))&(_mech)->_psym \
+ 					    ## _nsym,			\
+ 					    &errinfo) || errinfo.code) { \
+ 			(_mech)->_psym ## _nsym = NULL;			\
+@@ -948,7 +944,7 @@ loadInterMech(gss_mech_info minfo)
+ 	}
+ 
+ 	if (krb5int_get_plugin_func(dl, MECH_INTERPOSER_SYM,
+-				    (void (**)())&isym, &errinfo) != 0)
++				    (void (**)(void))&isym, &errinfo) != 0)
+ 		goto cleanup;
+ 
+ 	/* Get a list of mechs to interpose. */
+@@ -1184,7 +1180,7 @@ gssint_get_mechanism(gss_const_OID oid)
+ 		return ((gss_mechanism)NULL);
+ 	}
+ 
+-	if (krb5int_get_plugin_func(dl, MECH_SYM, (void (**)())&sym,
++	if (krb5int_get_plugin_func(dl, MECH_SYM, (void (**)(void))&sym,
+ 				    &errinfo) == 0) {
+ 		/* Call the symbol to get the mechanism table */
+ 		aMech->mech = (*sym)(aMech->mech_type);
+diff --git a/src/lib/gssapi/mechglue/g_inq_cred.c b/src/lib/gssapi/mechglue/g_inq_cred.c
+index 4ed7774f1a..0aa9acc889 100644
+--- a/src/lib/gssapi/mechglue/g_inq_cred.c
++++ b/src/lib/gssapi/mechglue/g_inq_cred.c
+@@ -35,20 +35,9 @@
+ #include <time.h>
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_inquire_cred(minor_status,
+-                 cred_handle,
+-                 name,
+-                 lifetime,
+-		 cred_usage,
+-                 mechanisms)
+-
+-OM_uint32 *		minor_status;
+-gss_cred_id_t 		cred_handle;
+-gss_name_t *		name;
+-OM_uint32 *		lifetime;
+-int *			cred_usage;
+-gss_OID_set *		mechanisms;
+-
++gss_inquire_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
++		 gss_name_t *name, OM_uint32 *lifetime, int *cred_usage,
++		 gss_OID_set *mechanisms)
+ {
+     OM_uint32		status, temp_minor_status;
+     gss_union_cred_t	union_cred;
+@@ -159,15 +148,11 @@ error:
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_inquire_cred_by_mech(minor_status, cred_handle, mech_type, name,
+-			 initiator_lifetime, acceptor_lifetime, cred_usage)
+-    OM_uint32		*minor_status;
+-    gss_cred_id_t	cred_handle;
+-    gss_OID		mech_type;
+-    gss_name_t		*name;
+-    OM_uint32		*initiator_lifetime;
+-    OM_uint32		*acceptor_lifetime;
+-    gss_cred_usage_t *cred_usage;
++gss_inquire_cred_by_mech(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
++			 gss_OID mech_type, gss_name_t *name,
++			 OM_uint32 *initiator_lifetime,
++			 OM_uint32 *acceptor_lifetime,
++			 gss_cred_usage_t *cred_usage)
+ {
+     gss_union_cred_t	union_cred;
+     gss_cred_id_t	mech_cred;
+diff --git a/src/lib/gssapi/mechglue/g_inq_names.c b/src/lib/gssapi/mechglue/g_inq_names.c
+index d22af8bcf9..066c00c042 100644
+--- a/src/lib/gssapi/mechglue/g_inq_names.c
++++ b/src/lib/gssapi/mechglue/g_inq_names.c
+@@ -32,12 +32,8 @@
+ 
+ /* Last argument new for V2 */
+ OM_uint32 KRB5_CALLCONV
+-gss_inquire_names_for_mech(minor_status, mechanism, name_types)
+-
+-OM_uint32 *	minor_status;
+-gss_OID 	mechanism;
+-gss_OID_set *	name_types;
+-
++gss_inquire_names_for_mech(OM_uint32 *minor_status, gss_OID mechanism,
++			   gss_OID_set *name_types)
+ {
+     OM_uint32		status;
+     gss_OID		selected_mech = GSS_C_NO_OID, public_mech;
+diff --git a/src/lib/gssapi/mechglue/g_mechname.c b/src/lib/gssapi/mechglue/g_mechname.c
+index cfb0a0d2af..5664fa157e 100644
+--- a/src/lib/gssapi/mechglue/g_mechname.c
++++ b/src/lib/gssapi/mechglue/g_mechname.c
+@@ -20,8 +20,8 @@ static gss_mech_spec_name name_list = NULL;
+ /*
+  * generic searching helper function.
+  */
+-static gss_mech_spec_name search_mech_spec(name_type)
+-    gss_OID name_type;
++static gss_mech_spec_name
++search_mech_spec(gss_OID name_type)
+ {
+     gss_mech_spec_name p;
+ 
+@@ -36,8 +36,8 @@ static gss_mech_spec_name search_mech_spec(name_type)
+  * Given a name_type, if it is specific to a mechanism, return the
+  * mechanism OID.  Otherwise, return NULL.
+  */
+-gss_OID gss_find_mechanism_from_name_type(name_type)
+-    gss_OID name_type;
++gss_OID
++gss_find_mechanism_from_name_type(gss_OID name_type)
+ {
+     gss_mech_spec_name p;
+ 
+@@ -54,10 +54,8 @@ gss_OID gss_find_mechanism_from_name_type(name_type)
+  * Otherwise, enter the pair into the registry.
+  */
+ OM_uint32
+-gss_add_mech_name_type(minor_status, name_type, mech)
+-    OM_uint32	*minor_status;
+-    gss_OID	name_type;
+-    gss_OID	mech;
++gss_add_mech_name_type(OM_uint32 *minor_status, gss_OID name_type,
++		       gss_OID mech)
+ {
+     OM_uint32	major_status, tmp;
+     gss_mech_spec_name p;
+diff --git a/src/lib/gssapi/mechglue/g_oid_ops.c b/src/lib/gssapi/mechglue/g_oid_ops.c
+index 1d7970c5dd..f29fb3b33e 100644
+--- a/src/lib/gssapi/mechglue/g_oid_ops.c
++++ b/src/lib/gssapi/mechglue/g_oid_ops.c
+@@ -33,9 +33,7 @@
+  */
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_create_empty_oid_set(minor_status, oid_set)
+-    OM_uint32	*minor_status;
+-    gss_OID_set	*oid_set;
++gss_create_empty_oid_set(OM_uint32 *minor_status, gss_OID_set *oid_set)
+ {
+     OM_uint32 status;
+     status = generic_gss_create_empty_oid_set(minor_status, oid_set);
+@@ -45,10 +43,8 @@ gss_create_empty_oid_set(minor_status, oid_set)
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_add_oid_set_member(minor_status, member_oid, oid_set)
+-    OM_uint32	*minor_status;
+-    gss_OID	member_oid;
+-    gss_OID_set	*oid_set;
++gss_add_oid_set_member(OM_uint32 *minor_status, gss_OID member_oid,
++		       gss_OID_set *oid_set)
+ {
+     OM_uint32 status;
+     status = generic_gss_add_oid_set_member(minor_status, member_oid, oid_set);
+@@ -58,20 +54,14 @@ gss_add_oid_set_member(minor_status, member_oid, oid_set)
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_test_oid_set_member(minor_status, member, set, present)
+-    OM_uint32	*minor_status;
+-    gss_OID	member;
+-    gss_OID_set	set;
+-    int		*present;
++gss_test_oid_set_member(OM_uint32 *minor_status, gss_OID member,
++			gss_OID_set set, int *present)
+ {
+     return generic_gss_test_oid_set_member(minor_status, member, set, present);
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_oid_to_str(minor_status, oid, oid_str)
+-    OM_uint32		*minor_status;
+-    gss_OID		oid;
+-    gss_buffer_t	oid_str;
++gss_oid_to_str(OM_uint32 *minor_status, gss_OID oid, gss_buffer_t oid_str)
+ {
+     OM_uint32 status = generic_gss_oid_to_str(minor_status, oid, oid_str);
+     if (status != GSS_S_COMPLETE)
+@@ -80,10 +70,7 @@ gss_oid_to_str(minor_status, oid, oid_str)
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_str_to_oid(minor_status, oid_str, oid)
+-    OM_uint32		*minor_status;
+-    gss_buffer_t	oid_str;
+-    gss_OID		*oid;
++gss_str_to_oid(OM_uint32 *minor_status, gss_buffer_t oid_str, gss_OID *oid)
+ {
+     OM_uint32 status = generic_gss_str_to_oid(minor_status, oid_str, oid);
+     if (status != GSS_S_COMPLETE)
+diff --git a/src/lib/gssapi/mechglue/g_process_context.c b/src/lib/gssapi/mechglue/g_process_context.c
+index 3968b5d9c6..2b3f6c704d 100644
+--- a/src/lib/gssapi/mechglue/g_process_context.c
++++ b/src/lib/gssapi/mechglue/g_process_context.c
+@@ -29,14 +29,8 @@
+ #include "mglueP.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_process_context_token (minor_status,
+-                           context_handle,
+-                           token_buffer)
+-
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-gss_buffer_t		token_buffer;
+-
++gss_process_context_token(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++			  gss_buffer_t token_buffer)
+ {
+     OM_uint32		status;
+     gss_union_ctx_id_t	ctx;
+diff --git a/src/lib/gssapi/mechglue/g_rel_buffer.c b/src/lib/gssapi/mechglue/g_rel_buffer.c
+index 8c3328acc5..60117bdb56 100644
+--- a/src/lib/gssapi/mechglue/g_rel_buffer.c
++++ b/src/lib/gssapi/mechglue/g_rel_buffer.c
+@@ -33,11 +33,7 @@
+ #endif
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_release_buffer (minor_status,
+-		    buffer)
+-
+-OM_uint32 *		minor_status;
+-gss_buffer_t		buffer;
++gss_release_buffer(OM_uint32 *minor_status, gss_buffer_t buffer)
+ {
+     if (minor_status)
+ 	*minor_status = 0;
+diff --git a/src/lib/gssapi/mechglue/g_rel_cred.c b/src/lib/gssapi/mechglue/g_rel_cred.c
+index ccdee05a56..ee3d1d71e3 100644
+--- a/src/lib/gssapi/mechglue/g_rel_cred.c
++++ b/src/lib/gssapi/mechglue/g_rel_cred.c
+@@ -31,12 +31,7 @@
+ #endif
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_release_cred(minor_status,
+-                 cred_handle)
+-
+-OM_uint32 *		minor_status;
+-gss_cred_id_t *		cred_handle;
+-
++gss_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle)
+ {
+     OM_uint32		status, temp_status;
+     int			j;
+diff --git a/src/lib/gssapi/mechglue/g_rel_name.c b/src/lib/gssapi/mechglue/g_rel_name.c
+index e008692383..d490f9f290 100644
+--- a/src/lib/gssapi/mechglue/g_rel_name.c
++++ b/src/lib/gssapi/mechglue/g_rel_name.c
+@@ -34,12 +34,7 @@
+ #include <string.h>
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_release_name (minor_status,
+-		  input_name)
+-
+-OM_uint32 *		minor_status;
+-gss_name_t *		input_name;
+-
++gss_release_name(OM_uint32 *minor_status, gss_name_t *input_name)
+ {
+     gss_union_name_t	union_name;
+ 
+diff --git a/src/lib/gssapi/mechglue/g_rel_oid_set.c b/src/lib/gssapi/mechglue/g_rel_oid_set.c
+index fa008d6bb9..9151dd2e71 100644
+--- a/src/lib/gssapi/mechglue/g_rel_oid_set.c
++++ b/src/lib/gssapi/mechglue/g_rel_oid_set.c
+@@ -33,11 +33,7 @@
+ #endif
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_release_oid_set (minor_status,
+-		     set)
+-
+-OM_uint32 *		minor_status;
+-gss_OID_set *		set;
++gss_release_oid_set(OM_uint32 *minor_status, gss_OID_set *set)
+ {
+     return generic_gss_release_oid_set(minor_status, set);
+ }
+diff --git a/src/lib/gssapi/mechglue/g_sign.c b/src/lib/gssapi/mechglue/g_sign.c
+index 03fbd8c01f..c9af1da570 100644
+--- a/src/lib/gssapi/mechglue/g_sign.c
++++ b/src/lib/gssapi/mechglue/g_sign.c
+@@ -66,18 +66,9 @@ val_get_mic_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_get_mic (minor_status,
+-	     context_handle,
+-	     qop_req,
+-	     message_buffer,
+-	     msg_token)
+-
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-gss_qop_t		qop_req;
+-gss_buffer_t		message_buffer;
+-gss_buffer_t		msg_token;
+-
++gss_get_mic(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++	    gss_qop_t qop_req, gss_buffer_t message_buffer,
++	    gss_buffer_t msg_token)
+ {
+     OM_uint32		status;
+     gss_union_ctx_id_t	ctx;
+@@ -118,18 +109,8 @@ gss_buffer_t		msg_token;
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_sign (minor_status,
+-          context_handle,
+-          qop_req,
+-          message_buffer,
+-          msg_token)
+-
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-int			qop_req;
+-gss_buffer_t		message_buffer;
+-gss_buffer_t		msg_token;
+-
++gss_sign(OM_uint32 *minor_status, gss_ctx_id_t context_handle, int qop_req,
++	 gss_buffer_t message_buffer, gss_buffer_t msg_token)
+ {
+ 	return (gss_get_mic(minor_status, context_handle, (gss_qop_t) qop_req,
+ 			    message_buffer, msg_token));
+diff --git a/src/lib/gssapi/mechglue/g_store_cred.c b/src/lib/gssapi/mechglue/g_store_cred.c
+index c2b6ddf3c0..231b3e81a0 100644
+--- a/src/lib/gssapi/mechglue/g_store_cred.c
++++ b/src/lib/gssapi/mechglue/g_store_cred.c
+@@ -93,24 +93,10 @@ val_store_cred_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_store_cred(minor_status,
+-	       input_cred_handle,
+-	       cred_usage,
+-	       desired_mech,
+-	       overwrite_cred,
+-	       default_cred,
+-	       elements_stored,
+-	       cred_usage_stored)
+-
+-OM_uint32		*minor_status;
+-gss_cred_id_t	         input_cred_handle;
+-gss_cred_usage_t	 cred_usage;
+-const gss_OID		 desired_mech;
+-OM_uint32		 overwrite_cred;
+-OM_uint32		 default_cred;
+-gss_OID_set		*elements_stored;
+-gss_cred_usage_t	*cred_usage_stored;
+-
++gss_store_cred(OM_uint32 *minor_status, gss_cred_id_t input_cred_handle,
++	       gss_cred_usage_t cred_usage, const gss_OID desired_mech,
++	       OM_uint32 overwrite_cred, OM_uint32 default_cred,
++	       gss_OID_set *elements_stored, gss_cred_usage_t *cred_usage_stored)
+ {
+ 	return gss_store_cred_into(minor_status, input_cred_handle, cred_usage,
+ 				   desired_mech, overwrite_cred, default_cred,
+@@ -119,26 +105,12 @@ gss_cred_usage_t	*cred_usage_stored;
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_store_cred_into(minor_status,
+-		    input_cred_handle,
+-		    cred_usage,
+-		    desired_mech,
+-		    overwrite_cred,
+-		    default_cred,
+-		    cred_store,
+-		    elements_stored,
+-		    cred_usage_stored)
+-
+-OM_uint32			 *minor_status;
+-gss_cred_id_t			 input_cred_handle;
+-gss_cred_usage_t		 cred_usage;
+-gss_OID				 desired_mech;
+-OM_uint32			 overwrite_cred;
+-OM_uint32			 default_cred;
+-gss_const_key_value_set_t	 cred_store;
+-gss_OID_set			 *elements_stored;
+-gss_cred_usage_t		 *cred_usage_stored;
+-
++gss_store_cred_into(OM_uint32 *minor_status, gss_cred_id_t input_cred_handle,
++		    gss_cred_usage_t cred_usage, gss_OID desired_mech,
++		    OM_uint32 overwrite_cred, OM_uint32 default_cred,
++		    gss_const_key_value_set_t cred_store,
++		    gss_OID_set *elements_stored,
++		    gss_cred_usage_t *cred_usage_stored)
+ {
+ 	OM_uint32		major_status = GSS_S_FAILURE;
+ 	gss_union_cred_t	union_cred;
+diff --git a/src/lib/gssapi/mechglue/g_unseal.c b/src/lib/gssapi/mechglue/g_unseal.c
+index c208635b67..2be3745d1f 100644
+--- a/src/lib/gssapi/mechglue/g_unseal.c
++++ b/src/lib/gssapi/mechglue/g_unseal.c
+@@ -29,20 +29,10 @@
+ #include "mglueP.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_unwrap (minor_status,
+-            context_handle,
+-            input_message_buffer,
+-            output_message_buffer,
+-            conf_state,
+-            qop_state)
+-
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-gss_buffer_t		input_message_buffer;
+-gss_buffer_t		output_message_buffer;
+-int *			conf_state;
+-gss_qop_t *		qop_state;
+-
++gss_unwrap(OM_uint32 * minor_status, gss_ctx_id_t context_handle,
++	   gss_buffer_t input_message_buffer,
++	   gss_buffer_t output_message_buffer,
++	   int *conf_state, gss_qop_t *qop_state)
+ {
+ /* EXPORT DELETE START */
+     OM_uint32		status;
+@@ -111,20 +101,9 @@ gss_qop_t *		qop_state;
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_unseal (minor_status,
+-            context_handle,
+-            input_message_buffer,
+-            output_message_buffer,
+-            conf_state,
+-            qop_state)
+-
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-gss_buffer_t		input_message_buffer;
+-gss_buffer_t		output_message_buffer;
+-int *			conf_state;
+-int *			qop_state;
+-
++gss_unseal(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++	   gss_buffer_t input_message_buffer,
++	   gss_buffer_t output_message_buffer, int *conf_state, int *qop_state)
+ {
+     return (gss_unwrap(minor_status, context_handle,
+ 		       input_message_buffer,
+diff --git a/src/lib/gssapi/mechglue/g_unwrap_aead.c b/src/lib/gssapi/mechglue/g_unwrap_aead.c
+index 0682bd8998..5c9ff30031 100644
+--- a/src/lib/gssapi/mechglue/g_unwrap_aead.c
++++ b/src/lib/gssapi/mechglue/g_unwrap_aead.c
+@@ -154,20 +154,11 @@ gssint_unwrap_aead (gss_mechanism mech,
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_unwrap_aead (minor_status,
+-                 context_handle,
+-		 input_message_buffer,
+-		 input_assoc_buffer,
+-		 output_payload_buffer,
+-                 conf_state,
+-                 qop_state)
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-gss_buffer_t		input_message_buffer;
+-gss_buffer_t		input_assoc_buffer;
+-gss_buffer_t		output_payload_buffer;
+-int 			*conf_state;
+-gss_qop_t		*qop_state;
++gss_unwrap_aead(OM_uint32 * minor_status, gss_ctx_id_t context_handle,
++		gss_buffer_t input_message_buffer,
++		gss_buffer_t input_assoc_buffer,
++		gss_buffer_t output_payload_buffer,
++		int *conf_state, gss_qop_t *qop_state)
+ {
+ 
+     OM_uint32		status;
+diff --git a/src/lib/gssapi/mechglue/g_unwrap_iov.c b/src/lib/gssapi/mechglue/g_unwrap_iov.c
+index 599be2c7b2..bf9c3bcc33 100644
+--- a/src/lib/gssapi/mechglue/g_unwrap_iov.c
++++ b/src/lib/gssapi/mechglue/g_unwrap_iov.c
+@@ -59,18 +59,9 @@ val_unwrap_iov_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_unwrap_iov (minor_status,
+-                context_handle,
+-                conf_state,
+-                qop_state,
+-                iov,
+-                iov_count)
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-int *			conf_state;
+-gss_qop_t		*qop_state;
+-gss_iov_buffer_desc  *	iov;
+-int			iov_count;
++gss_unwrap_iov(OM_uint32 * minor_status, gss_ctx_id_t context_handle,
++	       int *conf_state, gss_qop_t *qop_state,
++	       gss_iov_buffer_desc *iov, int iov_count)
+ {
+  /* EXPORT DELETE START */
+ 
+diff --git a/src/lib/gssapi/mechglue/g_verify.c b/src/lib/gssapi/mechglue/g_verify.c
+index 8996fce8d5..86ade66877 100644
+--- a/src/lib/gssapi/mechglue/g_verify.c
++++ b/src/lib/gssapi/mechglue/g_verify.c
+@@ -29,18 +29,9 @@
+ #include "mglueP.h"
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_verify_mic (minor_status,
+-		context_handle,
+-		message_buffer,
+-		token_buffer,
+-		qop_state)
+-
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-gss_buffer_t		message_buffer;
+-gss_buffer_t		token_buffer;
+-gss_qop_t *		qop_state;
+-
++gss_verify_mic(OM_uint32 * minor_status, gss_ctx_id_t context_handle,
++	       gss_buffer_t message_buffer, gss_buffer_t token_buffer,
++	       gss_qop_t *qop_state)
+ {
+     OM_uint32		status;
+     gss_union_ctx_id_t	ctx;
+@@ -89,18 +80,9 @@ gss_qop_t *		qop_state;
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_verify (minor_status,
+-            context_handle,
+-            message_buffer,
+-            token_buffer,
+-            qop_state)
+-
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-gss_buffer_t		message_buffer;
+-gss_buffer_t		token_buffer;
+-int *			qop_state;
+-
++gss_verify(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++	   gss_buffer_t message_buffer, gss_buffer_t token_buffer,
++	   int *qop_state)
+ {
+ 	return (gss_verify_mic(minor_status, context_handle,
+ 			       message_buffer, token_buffer,
+diff --git a/src/lib/gssapi/mechglue/g_wrap_aead.c b/src/lib/gssapi/mechglue/g_wrap_aead.c
+index 7fe3b7b35b..5a6570f7f9 100644
+--- a/src/lib/gssapi/mechglue/g_wrap_aead.c
++++ b/src/lib/gssapi/mechglue/g_wrap_aead.c
+@@ -177,15 +177,11 @@ gssint_wrap_aead_iov_shim(gss_mechanism mech,
+ }
+ 
+ OM_uint32
+-gssint_wrap_aead (gss_mechanism mech,
+-		  OM_uint32 *minor_status,
+-		  gss_union_ctx_id_t ctx,
+-		  int conf_req_flag,
+-		  gss_qop_t qop_req,
+-		  gss_buffer_t input_assoc_buffer,
+-		  gss_buffer_t input_payload_buffer,
+-		  int *conf_state,
+-		  gss_buffer_t output_message_buffer)
++gssint_wrap_aead(gss_mechanism mech, OM_uint32 *minor_status,
++		 gss_union_ctx_id_t ctx, int conf_req_flag, gss_qop_t qop_req,
++		 gss_buffer_t input_assoc_buffer,
++		 gss_buffer_t input_payload_buffer,
++		 int *conf_state, gss_buffer_t output_message_buffer)
+ {
+  /* EXPORT DELETE START */
+     OM_uint32		status;
+@@ -223,22 +219,15 @@ gssint_wrap_aead (gss_mechanism mech,
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_wrap_aead (minor_status,
+-               context_handle,
+-               conf_req_flag,
+-               qop_req,
+-	       input_assoc_buffer,
+-	       input_payload_buffer,
+-               conf_state,
+-               output_message_buffer)
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-int			conf_req_flag;
+-gss_qop_t		qop_req;
+-gss_buffer_t		input_assoc_buffer;
+-gss_buffer_t		input_payload_buffer;
+-int *			conf_state;
+-gss_buffer_t		output_message_buffer;
++gss_wrap_aead (
++    OM_uint32 * minor_status,
++    gss_ctx_id_t context_handle,
++    int conf_req_flag,
++    gss_qop_t qop_req,
++    gss_buffer_t input_assoc_buffer,
++    gss_buffer_t input_payload_buffer,
++    int * conf_state,
++    gss_buffer_t output_message_buffer)
+ {
+     OM_uint32		status;
+     gss_mechanism	mech;
+diff --git a/src/lib/gssapi/mechglue/g_wrap_iov.c b/src/lib/gssapi/mechglue/g_wrap_iov.c
+index 14447c4ee1..aaf3a9308e 100644
+--- a/src/lib/gssapi/mechglue/g_wrap_iov.c
++++ b/src/lib/gssapi/mechglue/g_wrap_iov.c
+@@ -60,20 +60,9 @@ val_wrap_iov_args(
+ 
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_wrap_iov (minor_status,
+-              context_handle,
+-              conf_req_flag,
+-              qop_req,
+-              conf_state,
+-              iov,
+-              iov_count)
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-int			conf_req_flag;
+-gss_qop_t		qop_req;
+-int *			conf_state;
+-gss_iov_buffer_desc  *	iov;
+-int			iov_count;
++gss_wrap_iov(OM_uint32 * minor_status, gss_ctx_id_t context_handle,
++	     int conf_req_flag, gss_qop_t qop_req, int *conf_state,
++	     gss_iov_buffer_desc *iov, int iov_count)
+ {
+  /* EXPORT DELETE START */
+ 
+@@ -120,20 +109,10 @@ int			iov_count;
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_wrap_iov_length (minor_status,
+-                     context_handle,
+-                     conf_req_flag,
+-                     qop_req,
+-                     conf_state,
+-                     iov,
+-                     iov_count)
+-OM_uint32 *		minor_status;
+-gss_ctx_id_t		context_handle;
+-int			conf_req_flag;
+-gss_qop_t		qop_req;
+-int *			conf_state;
+-gss_iov_buffer_desc  *	iov;
+-int			iov_count;
++gss_wrap_iov_length(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
++		    int conf_req_flag, gss_qop_t qop_req,
++		    int *conf_state, gss_iov_buffer_desc *iov,
++		    int iov_count)
+ {
+  /* EXPORT DELETE START */
+ 
+@@ -239,12 +218,8 @@ gss_get_mic_iov_length(OM_uint32 *minor_status, gss_ctx_id_t context_handle,
+ }
+ 
+ OM_uint32 KRB5_CALLCONV
+-gss_release_iov_buffer (minor_status,
+-			iov,
+-			iov_count)
+-OM_uint32 *		minor_status;
+-gss_iov_buffer_desc *	iov;
+-int			iov_count;
++gss_release_iov_buffer(OM_uint32 * minor_status, gss_iov_buffer_desc *iov,
++		       int iov_count)
+ {
+     OM_uint32		status = GSS_S_COMPLETE;
+     int			i;
+diff --git a/src/lib/kadm5/clnt/client_rpc.c b/src/lib/kadm5/clnt/client_rpc.c
+index d84d158b46..c8d844e4c7 100644
+--- a/src/lib/kadm5/clnt/client_rpc.c
++++ b/src/lib/kadm5/clnt/client_rpc.c
+@@ -1,6 +1,7 @@
+ /* -*- mode: c; c-file-style: "bsd"; indent-tabs-mode: t -*- */
+ #include <gssrpc/rpc.h>
+ #include <kadm5/kadm_rpc.h>
++#include <kadm5/admin_xdr.h>
+ #include <krb5.h>
+ #include <kadm5/admin.h>
+ #include <string.h>  /* for memset prototype */
+diff --git a/src/lib/kadm5/kadm_rpc.h b/src/lib/kadm5/kadm_rpc.h
+index 5099c6c145..9efe49a373 100644
+--- a/src/lib/kadm5/kadm_rpc.h
++++ b/src/lib/kadm5/kadm_rpc.h
+@@ -360,49 +360,4 @@ extern enum clnt_stat get_principal_keys_2(getpkeys_arg *, getpkeys_ret *,
+ 					   CLIENT *);
+ extern  bool_t get_principal_keys_2_svc(getpkeys_arg *, getpkeys_ret *,
+ 					struct svc_req *);
+-
+-extern bool_t xdr_cprinc_arg ();
+-extern bool_t xdr_cprinc3_arg ();
+-extern bool_t xdr_generic_ret ();
+-extern bool_t xdr_dprinc_arg ();
+-extern bool_t xdr_mprinc_arg ();
+-extern bool_t xdr_rprinc_arg ();
+-extern bool_t xdr_gprincs_arg ();
+-extern bool_t xdr_gprincs_ret ();
+-extern bool_t xdr_chpass_arg ();
+-extern bool_t xdr_chpass3_arg ();
+-extern bool_t xdr_setkey_arg ();
+-extern bool_t xdr_setkey3_arg ();
+-extern bool_t xdr_setkey4_arg ();
+-extern bool_t xdr_chrand_arg ();
+-extern bool_t xdr_chrand3_arg ();
+-extern bool_t xdr_chrand_ret ();
+-extern bool_t xdr_gprinc_arg ();
+-extern bool_t xdr_gprinc_ret ();
+-extern bool_t xdr_kadm5_ret_t ();
+-extern bool_t xdr_kadm5_principal_ent_rec ();
+-extern bool_t xdr_kadm5_policy_ent_rec ();
+-extern bool_t	xdr_krb5_keyblock ();
+-extern bool_t	xdr_krb5_principal ();
+-extern bool_t	xdr_krb5_enctype ();
+-extern bool_t	xdr_krb5_octet ();
+-extern bool_t	xdr_krb5_int32 ();
+-extern bool_t	xdr_u_int32 ();
+-extern bool_t xdr_cpol_arg ();
+-extern bool_t xdr_dpol_arg ();
+-extern bool_t xdr_mpol_arg ();
+-extern bool_t xdr_gpol_arg ();
+-extern bool_t xdr_gpol_ret ();
+-extern bool_t xdr_gpols_arg ();
+-extern bool_t xdr_gpols_ret ();
+-extern bool_t xdr_getprivs_ret ();
+-extern bool_t xdr_purgekeys_arg ();
+-extern bool_t xdr_gstrings_arg ();
+-extern bool_t xdr_gstrings_ret ();
+-extern bool_t xdr_sstring_arg ();
+-extern bool_t xdr_krb5_string_attr ();
+-extern bool_t xdr_kadm5_key_data ();
+-extern bool_t xdr_getpkeys_arg ();
+-extern bool_t xdr_getpkeys_ret ();
+-
+ #endif /* __KADM_RPC_H__ */
+diff --git a/src/lib/kadm5/kadm_rpc_xdr.c b/src/lib/kadm5/kadm_rpc_xdr.c
+index 287cae750f..5e052dd90c 100644
+--- a/src/lib/kadm5/kadm_rpc_xdr.c
++++ b/src/lib/kadm5/kadm_rpc_xdr.c
+@@ -408,7 +408,7 @@ _xdr_kadm5_principal_ent_rec(XDR *xdrs, kadm5_principal_ent_rec *objp,
+ 		return (FALSE);
+ 	}
+ 	if (!xdr_nulltype(xdrs, (void **) &objp->mod_name,
+-			  xdr_krb5_principal)) {
++			  (xdrproc_t)xdr_krb5_principal)) {
+ 		return (FALSE);
+ 	}
+ 	if (!xdr_krb5_timestamp(xdrs, &objp->mod_date)) {
+@@ -451,12 +451,13 @@ _xdr_kadm5_principal_ent_rec(XDR *xdrs, kadm5_principal_ent_rec *objp,
+ 		return (FALSE);
+ 	}
+ 	if (!xdr_nulltype(xdrs, (void **) &objp->tl_data,
+-			  xdr_krb5_tl_data)) {
++			  (xdrproc_t)xdr_krb5_tl_data)) {
+ 		return FALSE;
+ 	}
+ 	n = objp->n_key_data;
+ 	r = xdr_array(xdrs, (caddr_t *) &objp->key_data, &n, objp->n_key_data,
+-		      sizeof(krb5_key_data), xdr_krb5_key_data_nocontents);
++		      sizeof(krb5_key_data),
++		      (xdrproc_t)xdr_krb5_key_data_nocontents);
+ 	objp->n_key_data = n;
+ 	if (!r) {
+ 		return (FALSE);
+@@ -528,7 +529,7 @@ _xdr_kadm5_policy_ent_rec(XDR *xdrs, kadm5_policy_ent_rec *objp, int vers)
+ 			return (FALSE);
+ 		}
+ 		if (!xdr_nulltype(xdrs, (void **) &objp->tl_data,
+-				  xdr_krb5_tl_data)) {
++				  (xdrproc_t)xdr_krb5_tl_data)) {
+ 			return FALSE;
+ 		}
+ 	}
+@@ -576,7 +577,7 @@ xdr_cprinc3_arg(XDR *xdrs, cprinc3_arg *objp)
+ 	if (!xdr_array(xdrs, (caddr_t *)&objp->ks_tuple,
+ 		       (unsigned int *)&objp->n_ks_tuple, ~0,
+ 		       sizeof(krb5_key_salt_tuple),
+-		       xdr_krb5_key_salt_tuple)) {
++		       (xdrproc_t)xdr_krb5_key_salt_tuple)) {
+ 		return (FALSE);
+ 	}
+ 	if (!xdr_nullstring(xdrs, &objp->passwd)) {
+@@ -668,7 +669,7 @@ xdr_gprincs_ret(XDR *xdrs, gprincs_ret *objp)
+ 	  }
+ 	  if (!xdr_array(xdrs, (caddr_t *) &objp->princs,
+ 			 (unsigned int *) &objp->count, ~0,
+-			 sizeof(char *), xdr_nullstring)) {
++			 sizeof(char *), (xdrproc_t)xdr_nullstring)) {
+ 	       return (FALSE);
+ 	  }
+      }
+@@ -706,7 +707,7 @@ xdr_chpass3_arg(XDR *xdrs, chpass3_arg *objp)
+ 	if (!xdr_array(xdrs, (caddr_t *)&objp->ks_tuple,
+ 		       (unsigned int*)&objp->n_ks_tuple, ~0,
+ 		       sizeof(krb5_key_salt_tuple),
+-		       xdr_krb5_key_salt_tuple)) {
++		       (xdrproc_t)xdr_krb5_key_salt_tuple)) {
+ 		return (FALSE);
+ 	}
+ 	if (!xdr_nullstring(xdrs, &objp->pass)) {
+@@ -726,7 +727,7 @@ xdr_setkey_arg(XDR *xdrs, setkey_arg *objp)
+ 	}
+ 	if (!xdr_array(xdrs, (caddr_t *) &objp->keyblocks,
+ 		       (unsigned int *) &objp->n_keys, ~0,
+-		       sizeof(krb5_keyblock), xdr_krb5_keyblock)) {
++		       sizeof(krb5_keyblock), (xdrproc_t)xdr_krb5_keyblock)) {
+ 		return (FALSE);
+ 	}
+ 	return (TRUE);
+@@ -746,12 +747,13 @@ xdr_setkey3_arg(XDR *xdrs, setkey3_arg *objp)
+ 	}
+ 	if (!xdr_array(xdrs, (caddr_t *) &objp->ks_tuple,
+ 		       (unsigned int *) &objp->n_ks_tuple, ~0,
+-		       sizeof(krb5_key_salt_tuple), xdr_krb5_key_salt_tuple)) {
++		       sizeof(krb5_key_salt_tuple),
++		       (xdrproc_t)xdr_krb5_key_salt_tuple)) {
+ 		return (FALSE);
+ 	}
+ 	if (!xdr_array(xdrs, (caddr_t *) &objp->keyblocks,
+ 		       (unsigned int *) &objp->n_keys, ~0,
+-		       sizeof(krb5_keyblock), xdr_krb5_keyblock)) {
++		       sizeof(krb5_keyblock), (xdrproc_t)xdr_krb5_keyblock)) {
+ 		return (FALSE);
+ 	}
+ 	return (TRUE);
+@@ -771,7 +773,8 @@ xdr_setkey4_arg(XDR *xdrs, setkey4_arg *objp)
+ 	}
+ 	if (!xdr_array(xdrs, (caddr_t *) &objp->key_data,
+ 		       (unsigned int *) &objp->n_key_data, ~0,
+-		       sizeof(kadm5_key_data), xdr_kadm5_key_data)) {
++		       sizeof(kadm5_key_data),
++		       (xdrproc_t)xdr_kadm5_key_data)) {
+ 		return FALSE;
+ 	}
+ 	return TRUE;
+@@ -804,7 +807,7 @@ xdr_chrand3_arg(XDR *xdrs, chrand3_arg *objp)
+ 	if (!xdr_array(xdrs, (caddr_t *)&objp->ks_tuple,
+ 		       (unsigned int*)&objp->n_ks_tuple, ~0,
+ 		       sizeof(krb5_key_salt_tuple),
+-		       xdr_krb5_key_salt_tuple)) {
++		       (xdrproc_t)xdr_krb5_key_salt_tuple)) {
+ 		return (FALSE);
+ 	}
+ 	return (TRUE);
+@@ -822,7 +825,8 @@ xdr_chrand_ret(XDR *xdrs, chrand_ret *objp)
+ 	if (objp->code == KADM5_OK) {
+ 		if (!xdr_array(xdrs, (char **)&objp->keys,
+ 			       (unsigned int *)&objp->n_keys, ~0,
+-			       sizeof(krb5_keyblock), xdr_krb5_keyblock))
++			       sizeof(krb5_keyblock),
++			       (xdrproc_t)xdr_krb5_keyblock))
+ 			return FALSE;
+ 	}
+ 
+@@ -965,7 +969,7 @@ xdr_gpols_ret(XDR *xdrs, gpols_ret *objp)
+ 	  }
+ 	  if (!xdr_array(xdrs, (caddr_t *) &objp->pols,
+ 			 (unsigned int *) &objp->count, ~0,
+-			 sizeof(char *), xdr_nullstring)) {
++			 sizeof(char *), (xdrproc_t)xdr_nullstring)) {
+ 	       return (FALSE);
+ 	  }
+      }
+@@ -1030,7 +1034,7 @@ xdr_gstrings_ret(XDR *xdrs, gstrings_ret *objp)
+ 		if (!xdr_array(xdrs, (caddr_t *) &objp->strings,
+ 			       (unsigned int *) &objp->count, ~0,
+ 			       sizeof(krb5_string_attr),
+-			       xdr_krb5_string_attr)) {
++			       (xdrproc_t)xdr_krb5_string_attr)) {
+ 			return (FALSE);
+ 		}
+ 	}
+@@ -1198,7 +1202,8 @@ xdr_getpkeys_ret(XDR *xdrs, getpkeys_ret *objp)
+ 	if (objp->code == KADM5_OK) {
+ 		if (!xdr_array(xdrs, (caddr_t *) &objp->key_data,
+ 			       (unsigned int *) &objp->n_key_data, ~0,
+-			       sizeof(kadm5_key_data), xdr_kadm5_key_data)) {
++			       sizeof(kadm5_key_data),
++			       (xdrproc_t)xdr_kadm5_key_data)) {
+ 		    return FALSE;
+ 		}
+ 	}
+diff --git a/src/lib/kadm5/misc_free.c b/src/lib/kadm5/misc_free.c
+index 74d23760fb..9ac47bb87f 100644
+--- a/src/lib/kadm5/misc_free.c
++++ b/src/lib/kadm5/misc_free.c
+@@ -41,9 +41,8 @@ kadm5_free_name_list(void *server_handle, char **names, int count)
+ }
+ 
+ /* XXX this ought to be in libkrb5.a, but isn't */
+-kadm5_ret_t krb5_free_key_data_contents(context, key)
+-    krb5_context context;
+-    krb5_key_data *key;
++kadm5_ret_t
++krb5_free_key_data_contents(krb5_context context, krb5_key_data *key)
+ {
+     int i, idx;
+ 
+diff --git a/src/lib/kadm5/srv/adb_xdr.c b/src/lib/kadm5/srv/adb_xdr.c
+index fc732971d2..b6ffdb8c7a 100644
+--- a/src/lib/kadm5/srv/adb_xdr.c
++++ b/src/lib/kadm5/srv/adb_xdr.c
+@@ -53,8 +53,7 @@ xdr_osa_pw_hist_ent(XDR *xdrs, osa_pw_hist_ent *objp)
+ {
+     if (!xdr_array(xdrs, (caddr_t *) &objp->key_data,
+ 		   (u_int *) &objp->n_key_data, ~0,
+-		   sizeof(krb5_key_data),
+-		   xdr_krb5_key_data))
++		   sizeof(krb5_key_data), (xdrproc_t)xdr_krb5_key_data))
+ 	return (FALSE);
+     return (TRUE);
+ }
+@@ -88,8 +87,7 @@ xdr_osa_princ_ent_rec(XDR *xdrs, osa_princ_ent_t objp)
+ 	return (FALSE);
+     if (!xdr_array(xdrs, (caddr_t *) &objp->old_keys,
+ 		   (unsigned int *) &objp->old_key_len, ~0,
+-		   sizeof(osa_pw_hist_ent),
+-		   xdr_osa_pw_hist_ent))
++		   sizeof(osa_pw_hist_ent), (xdrproc_t)xdr_osa_pw_hist_ent))
+ 	return (FALSE);
+     return (TRUE);
+ }
+diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
+index 8c3ad3a691..d5bb0b167d 100644
+--- a/src/lib/kadm5/srv/svr_principal.c
++++ b/src/lib/kadm5/srv/svr_principal.c
+@@ -30,9 +30,9 @@ static int decrypt_key_data(krb5_context context,
+ /*
+  * XXX Functions that ought to be in libkrb5.a, but aren't.
+  */
+-kadm5_ret_t krb5_copy_key_data_contents(context, from, to)
+-    krb5_context context;
+-    krb5_key_data *from, *to;
++kadm5_ret_t
++krb5_copy_key_data_contents(krb5_context context, krb5_key_data *from,
++                            krb5_key_data *to)
+ {
+     int i, idx;
+ 
+@@ -75,10 +75,8 @@ static krb5_tl_data *dup_tl_data(krb5_tl_data *tl)
+ }
+ 
+ /* This is in lib/kdb/kdb_cpw.c, but is static */
+-static void cleanup_key_data(context, count, data)
+-    krb5_context   context;
+-    int                    count;
+-    krb5_key_data        * data;
++static void
++cleanup_key_data(krb5_context context, int count, krb5_key_data *data)
+ {
+     int i;
+ 
+diff --git a/src/lib/kadm5/str_conv.c b/src/lib/kadm5/str_conv.c
+index 7982956062..f2fae832eb 100644
+--- a/src/lib/kadm5/str_conv.c
++++ b/src/lib/kadm5/str_conv.c
+@@ -267,11 +267,8 @@ cleanup:
+  *      Salttype may be negative to indicate a search for only a enctype.
+  */
+ krb5_boolean
+-krb5_keysalt_is_present(ksaltlist, nksalts, enctype, salttype)
+-    krb5_key_salt_tuple *ksaltlist;
+-    krb5_int32          nksalts;
+-    krb5_enctype        enctype;
+-    krb5_int32          salttype;
++krb5_keysalt_is_present(krb5_key_salt_tuple *ksaltlist, krb5_int32 nksalts,
++                        krb5_enctype enctype, krb5_int32 salttype)
+ {
+     krb5_boolean        foundit;
+     int                 i;
+@@ -375,12 +372,11 @@ cleanup:
+  * If ignoresalt set, then salttype is ignored.
+  */
+ krb5_error_code
+-krb5_keysalt_iterate(ksaltlist, nksalt, ignoresalt, iterator, arg)
+-    krb5_key_salt_tuple *ksaltlist;
+-    krb5_int32          nksalt;
+-    krb5_boolean        ignoresalt;
+-    krb5_error_code     (*iterator) (krb5_key_salt_tuple *, krb5_pointer);
+-    krb5_pointer        arg;
++krb5_keysalt_iterate(krb5_key_salt_tuple *ksaltlist, krb5_int32 nksalt,
++                     krb5_boolean ignoresalt,
++                     krb5_error_code (*iterator)(krb5_key_salt_tuple *,
++                                                 void *),
++                     void *arg)
+ {
+     int                 i;
+     krb5_error_code     kret;
+diff --git a/src/lib/kadm5/t_kadm5.c b/src/lib/kadm5/t_kadm5.c
+index 153147ffbf..b3ab1004f3 100644
+--- a/src/lib/kadm5/t_kadm5.c
++++ b/src/lib/kadm5/t_kadm5.c
+@@ -276,7 +276,7 @@ cpw_test_succeed(char *user, krb5_principal princ, char *pass)
+ }
+ 
+ static void
+-test_chpass()
++test_chpass(void)
+ {
+     krb5_principal princ = parse_princ("chpass-test");
+     krb5_principal hist_princ = parse_princ("kadmin/history");
+@@ -334,7 +334,7 @@ cpol_test_compare(char *user, kadm5_policy_ent_t ent, uint32_t mask)
+ }
+ 
+ static void
+-test_create_policy()
++test_create_policy(void)
+ {
+     void *handle;
+     kadm5_policy_ent_rec ent;
+@@ -440,7 +440,7 @@ cprinc_test_compare(char *user, kadm5_principal_ent_t ent, uint32_t mask,
+ }
+ 
+ static void
+-test_create_principal()
++test_create_principal(void)
+ {
+     void *handle;
+     kadm5_principal_ent_rec ent;
+@@ -535,7 +535,7 @@ dpol_test_succeed(char *user, char *name)
+ }
+ 
+ static void
+-test_delete_policy()
++test_delete_policy(void)
+ {
+     krb5_principal princ = parse_princ("delete-policy-test-princ");
+ 
+@@ -587,7 +587,7 @@ dprinc_test_succeed(char *user, krb5_principal princ)
+ }
+ 
+ static void
+-test_delete_principal()
++test_delete_principal(void)
+ {
+     krb5_principal princ = parse_princ("delete-principal-test");
+ 
+@@ -638,7 +638,7 @@ gpol_test_fail(char *user, char *name, krb5_error_code code)
+ }
+ 
+ static void
+-test_get_policy()
++test_get_policy(void)
+ {
+     /* Fails with unknown policy. */
+     dpol_test_fail("admin", "unknown-policy", KADM5_UNK_POLICY);
+@@ -684,7 +684,7 @@ gprinc_test_fail(char *user, krb5_principal princ, krb5_error_code code)
+ }
+ 
+ static void
+-test_get_principal()
++test_get_principal(void)
+ {
+     void *handle;
+     kadm5_principal_ent_rec ent;
+@@ -743,7 +743,7 @@ test_get_principal()
+ }
+ 
+ static void
+-test_init_destroy()
++test_init_destroy(void)
+ {
+     krb5_context ctx;
+     kadm5_ret_t ret;
+@@ -1019,7 +1019,7 @@ mpol_test_compare(void *handle, kadm5_policy_ent_t ent, uint32_t mask)
+ }
+ 
+ static void
+-test_modify_policy()
++test_modify_policy(void)
+ {
+     kadm5_policy_ent_rec ent;
+ 
+@@ -1109,7 +1109,7 @@ mprinc_test_compare(char *user, kadm5_principal_ent_t ent, uint32_t mask)
+ }
+ 
+ static void
+-test_modify_principal()
++test_modify_principal(void)
+ {
+     void *handle;
+     krb5_principal princ = parse_princ("modify-principal-test");
+@@ -1233,7 +1233,7 @@ rnd_test_succeed(char *user, krb5_principal princ)
+ }
+ 
+ static void
+-test_randkey()
++test_randkey(void)
+ {
+     void *handle;
+     krb5_principal princ = parse_princ("randkey-principal-test");
+diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c
+index 415ae64e22..0837f567cc 100644
+--- a/src/lib/kdb/kdb5.c
++++ b/src/lib/kdb/kdb5.c
+@@ -75,13 +75,13 @@ free_mkey_list(krb5_context context, krb5_keylist_node *mkey_list)
+ }
+ 
+ int
+-kdb_init_lock_list()
++kdb_init_lock_list(void)
+ {
+     return k5_mutex_finish_init(&db_lock);
+ }
+ 
+ static int
+-kdb_lock_list()
++kdb_lock_list(void)
+ {
+     int err;
+     err = CALL_INIT_FUNCTION (kdb_init_lock_list);
+@@ -92,14 +92,14 @@ kdb_lock_list()
+ }
+ 
+ void
+-kdb_fini_lock_list()
++kdb_fini_lock_list(void)
+ {
+     if (INITIALIZER_RAN(kdb_init_lock_list))
+         k5_mutex_destroy(&db_lock);
+ }
+ 
+ static void
+-kdb_unlock_list()
++kdb_unlock_list(void)
+ {
+     k5_mutex_unlock(&db_lock);
+ }
+diff --git a/src/lib/kdb/kdb_cpw.c b/src/lib/kdb/kdb_cpw.c
+index 450860f470..c33c7cf8d0 100644
+--- a/src/lib/kdb/kdb_cpw.c
++++ b/src/lib/kdb/kdb_cpw.c
+@@ -57,10 +57,7 @@
+ enum save { DISCARD_ALL, KEEP_LAST_KVNO, KEEP_ALL };
+ 
+ int
+-krb5_db_get_key_data_kvno(context, count, data)
+-    krb5_context          context;
+-    int                   count;
+-    krb5_key_data       * data;
++krb5_db_get_key_data_kvno(krb5_context context, int count, krb5_key_data *data)
+ {
+     int i, kvno;
+     /* Find last key version number */
+@@ -73,10 +70,7 @@ krb5_db_get_key_data_kvno(context, count, data)
+ }
+ 
+ static void
+-cleanup_key_data(context, count, data)
+-    krb5_context          context;
+-    int                   count;
+-    krb5_key_data       * data;
++cleanup_key_data(krb5_context context, int count, krb5_key_data *data)
+ {
+     int i;
+ 
+@@ -149,13 +143,9 @@ preserve_old_keys(krb5_context context, krb5_keyblock *mkey,
+ }
+ 
+ static krb5_error_code
+-add_key_rnd(context, master_key, ks_tuple, ks_tuple_count, db_entry, kvno)
+-    krb5_context          context;
+-    krb5_keyblock       * master_key;
+-    krb5_key_salt_tuple * ks_tuple;
+-    int                   ks_tuple_count;
+-    krb5_db_entry       * db_entry;
+-    int                   kvno;
++add_key_rnd(krb5_context context, krb5_keyblock *master_key,
++            krb5_key_salt_tuple *ks_tuple, int ks_tuple_count,
++            krb5_db_entry *db_entry, int kvno)
+ {
+     krb5_keyblock         key;
+     int                   i, j;
+@@ -246,15 +236,9 @@ make_random_salt(krb5_context context, krb5_keysalt *salt_out)
+  * If passwd is NULL the assumes that the caller wants a random password.
+  */
+ static krb5_error_code
+-add_key_pwd(context, master_key, ks_tuple, ks_tuple_count, passwd,
+-            db_entry, kvno)
+-    krb5_context          context;
+-    krb5_keyblock       * master_key;
+-    krb5_key_salt_tuple * ks_tuple;
+-    int                   ks_tuple_count;
+-    const char          * passwd;
+-    krb5_db_entry       * db_entry;
+-    int                   kvno;
++add_key_pwd(krb5_context context, krb5_keyblock *master_key,
++            krb5_key_salt_tuple *ks_tuple, int ks_tuple_count,
++            const char *passwd, krb5_db_entry *db_entry, int kvno)
+ {
+     krb5_error_code       retval;
+     krb5_keysalt          key_salt;
+diff --git a/src/lib/kdb/keytab.c b/src/lib/kdb/keytab.c
+index a623e001ec..346cf962e8 100644
+--- a/src/lib/kdb/keytab.c
++++ b/src/lib/kdb/keytab.c
+@@ -71,10 +71,7 @@ krb5_db_register_keytab(krb5_context context)
+ }
+ 
+ krb5_error_code
+-krb5_ktkdb_resolve(context, name, id)
+-    krb5_context          context;
+-    const char          * name;
+-    krb5_keytab         * id;
++krb5_ktkdb_resolve(krb5_context context, const char *name, krb5_keytab *id)
+ {
+     if ((*id = (krb5_keytab) malloc(sizeof(**id))) == NULL)
+         return(ENOMEM);
+@@ -84,9 +81,7 @@ krb5_ktkdb_resolve(context, name, id)
+ }
+ 
+ krb5_error_code
+-krb5_ktkdb_close(context, kt)
+-    krb5_context context;
+-    krb5_keytab kt;
++krb5_ktkdb_close(krb5_context context, krb5_keytab kt)
+ {
+     /*
+      * This routine is responsible for freeing all memory allocated
+@@ -119,13 +114,9 @@ krb5_ktkdb_set_context(krb5_context ctx)
+ }
+ 
+ krb5_error_code
+-krb5_ktkdb_get_entry(in_context, id, principal, kvno, enctype, entry)
+-    krb5_context          in_context;
+-    krb5_keytab           id;
+-    krb5_const_principal  principal;
+-    krb5_kvno             kvno;
+-    krb5_enctype          enctype;
+-    krb5_keytab_entry   * entry;
++krb5_ktkdb_get_entry(krb5_context in_context, krb5_keytab id,
++                     krb5_const_principal principal, krb5_kvno kvno,
++                     krb5_enctype enctype, krb5_keytab_entry *entry)
+ {
+     krb5_context          context;
+     krb5_error_code       kerror = 0;
+diff --git a/src/lib/kdb/t_stringattr.c b/src/lib/kdb/t_stringattr.c
+index 11740368ea..2c643018b5 100644
+--- a/src/lib/kdb/t_stringattr.c
++++ b/src/lib/kdb/t_stringattr.c
+@@ -38,7 +38,7 @@
+  */
+ 
+ int
+-main()
++main(void)
+ {
+     krb5_db_entry *ent;
+     krb5_context context;
+diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c
+index fc2d248001..c5446b890c 100644
+--- a/src/lib/krad/packet.c
++++ b/src/lib/krad/packet.c
+@@ -200,7 +200,7 @@ auth_generate_response(krb5_context ctx, const char *secret,
+ 
+ /* Create a new packet. */
+ static krad_packet *
+-packet_new()
++packet_new(void)
+ {
+     krad_packet *pkt;
+ 
+diff --git a/src/lib/krad/t_attr.c b/src/lib/krad/t_attr.c
+index 4d285ad9de..d5dd99a174 100644
+--- a/src/lib/krad/t_attr.c
++++ b/src/lib/krad/t_attr.c
+@@ -40,7 +40,7 @@ const static unsigned char auth[] = {
+ };
+ 
+ int
+-main()
++main(void)
+ {
+     unsigned char outbuf[MAX_ATTRSETSIZE];
+     const char *decoded = "accept";
+diff --git a/src/lib/krad/t_attrset.c b/src/lib/krad/t_attrset.c
+index 0f95762534..4cdb8b7d8e 100644
+--- a/src/lib/krad/t_attrset.c
++++ b/src/lib/krad/t_attrset.c
+@@ -40,7 +40,7 @@ const static unsigned char encpass[] = {
+ };
+ 
+ int
+-main()
++main(void)
+ {
+     unsigned char buffer[KRAD_PACKET_SIZE_MAX], encoded[MAX_ATTRSETSIZE];
+     const char *username = "testUser", *password = "accept";
+diff --git a/src/lib/krad/t_code.c b/src/lib/krad/t_code.c
+index b245a7efc0..6cd522af55 100644
+--- a/src/lib/krad/t_code.c
++++ b/src/lib/krad/t_code.c
+@@ -30,7 +30,7 @@
+ #include "t_test.h"
+ 
+ int
+-main()
++main(void)
+ {
+     const char *tmp;
+ 
+diff --git a/src/lib/krb5/ccache/cc_keyring.c b/src/lib/krb5/ccache/cc_keyring.c
+index 1dadeef64f..ab3cda6fef 100644
+--- a/src/lib/krb5/ccache/cc_keyring.c
++++ b/src/lib/krb5/ccache/cc_keyring.c
+@@ -314,7 +314,7 @@ get_persistent_real(uid_t uid)
+  * for the session anchor.
+  */
+ static key_serial_t
+-session_write_anchor()
++session_write_anchor(void)
+ {
+     key_serial_t s, u;
+ 
+diff --git a/src/lib/krb5/krb/plugin.c b/src/lib/krb5/krb/plugin.c
+index 3bb7a38d44..1286e9e383 100644
+--- a/src/lib/krb5/krb/plugin.c
++++ b/src/lib/krb5/krb/plugin.c
+@@ -355,7 +355,7 @@ load_if_needed(krb5_context context, struct plugin_mapping *map,
+     krb5_error_code ret;
+     char *symname = NULL;
+     struct plugin_file_handle *handle = NULL;
+-    void (*initvt_fn)();
++    void (*initvt_fn)(void);
+ 
+     if (map->module != NULL || map->dyn_path == NULL)
+         return;
+diff --git a/src/lib/krb5/krb/t_authdata.c b/src/lib/krb5/krb/t_authdata.c
+index dd834b9b0c..44f4a1cbd6 100644
+--- a/src/lib/krb5/krb/t_authdata.c
++++ b/src/lib/krb5/krb/t_authdata.c
+@@ -74,7 +74,7 @@ static void compare_authdata(const krb5_authdata *adc1, krb5_authdata *adc2) {
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     krb5_context context;
+     krb5_authdata **results;
+diff --git a/src/lib/krb5/krb/t_response_items.c b/src/lib/krb5/krb/t_response_items.c
+index 0deb9292a1..a6b02ca055 100644
+--- a/src/lib/krb5/krb/t_response_items.c
++++ b/src/lib/krb5/krb/t_response_items.c
+@@ -61,7 +61,7 @@ nstrcmp(const char *a, const char *b)
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     k5_response_items *ri;
+ 
+diff --git a/src/lib/krb5/krb/t_ser.c b/src/lib/krb5/krb/t_ser.c
+index d6746b74bd..9780c2e564 100644
+--- a/src/lib/krb5/krb/t_ser.c
++++ b/src/lib/krb5/krb/t_ser.c
+@@ -195,7 +195,7 @@ ser_checksum(krb5_checksum *cksum)
+ }
+ 
+ static void
+-ser_context_test()
++ser_context_test(void)
+ {
+     krb5_context context;
+     profile_t sprofile;
+@@ -216,7 +216,7 @@ ser_context_test()
+ }
+ 
+ static void
+-ser_acontext_test()
++ser_acontext_test(void)
+ {
+     krb5_auth_context   actx;
+     krb5_address        local_address;
+@@ -306,7 +306,7 @@ ser_acontext_test()
+ }
+ 
+ static void
+-ser_princ_test()
++ser_princ_test(void)
+ {
+     krb5_principal      princ;
+     char                pname[1024];
+@@ -320,7 +320,7 @@ ser_princ_test()
+ }
+ 
+ static void
+-ser_cksum_test()
++ser_cksum_test(void)
+ {
+     krb5_checksum       checksum;
+     krb5_octet          ckdata[24];
+diff --git a/src/lib/krb5/krb/t_sname_match.c b/src/lib/krb5/krb/t_sname_match.c
+index 021b720d65..ee5623c158 100644
+--- a/src/lib/krb5/krb/t_sname_match.c
++++ b/src/lib/krb5/krb/t_sname_match.c
+@@ -80,7 +80,7 @@ struct test {
+ };
+ 
+ int
+-main()
++main(void)
+ {
+     size_t i;
+     struct test *t;
+diff --git a/src/lib/krb5/krb/t_valid_times.c b/src/lib/krb5/krb/t_valid_times.c
+index e4b5f1bce4..1a8036e811 100644
+--- a/src/lib/krb5/krb/t_valid_times.c
++++ b/src/lib/krb5/krb/t_valid_times.c
+@@ -36,7 +36,7 @@
+ #define BOUNDARY (uint32_t)INT32_MIN
+ 
+ int
+-main()
++main(void)
+ {
+     krb5_error_code ret;
+     krb5_context context;
+diff --git a/src/lib/krb5/rcache/t_memrcache.c b/src/lib/krb5/rcache/t_memrcache.c
+index 6f212b0ecd..665da75ea5 100644
+--- a/src/lib/krb5/rcache/t_memrcache.c
++++ b/src/lib/krb5/rcache/t_memrcache.c
+@@ -33,7 +33,7 @@
+ #include "memrcache.c"
+ 
+ int
+-main()
++main(void)
+ {
+     krb5_error_code ret;
+     krb5_context context;
+diff --git a/src/lib/rpc/auth_gss.c b/src/lib/rpc/auth_gss.c
+index 319bc759b1..f61322d82b 100644
+--- a/src/lib/rpc/auth_gss.c
++++ b/src/lib/rpc/auth_gss.c
+@@ -445,9 +445,9 @@ authgss_refresh(AUTH *auth, struct rpc_msg *msg)
+ 			memset(&gr, 0, sizeof(gr));
+ 
+ 			call_stat = clnt_call(gd->clnt, NULLPROC,
+-					      xdr_rpc_gss_init_args,
++					      (xdrproc_t)xdr_rpc_gss_init_args,
+ 					      &send_token,
+-					      xdr_rpc_gss_init_res,
++					      (xdrproc_t)xdr_rpc_gss_init_res,
+ 					      (caddr_t)&gr, AUTH_TIMEOUT);
+ 
+ 			gss_release_buffer(&min_stat, &send_token);
+diff --git a/src/lib/rpc/auth_gssapi.c b/src/lib/rpc/auth_gssapi.c
+index 8ab7ab5ba7..b5e03b9641 100644
+--- a/src/lib/rpc/auth_gssapi.c
++++ b/src/lib/rpc/auth_gssapi.c
+@@ -283,11 +283,11 @@ next_token:
+ 
+ 	  PRINTF(("gssapi_create: calling GSSAPI_INIT (%d)\n", init_func));
+ 
+-	  xdr_free(xdr_authgssapi_init_res, &call_res);
++	  xdr_free((xdrproc_t)xdr_authgssapi_init_res, &call_res);
+ 	  memset(&call_res, 0, sizeof(call_res));
+ 	  callstat = clnt_call(clnt, init_func,
+-			       xdr_authgssapi_init_arg, &call_arg,
+-			       xdr_authgssapi_init_res, &call_res,
++			       (xdrproc_t)xdr_authgssapi_init_arg, &call_arg,
++			       (xdrproc_t)xdr_authgssapi_init_res, &call_res,
+ 			       timeout);
+ 	  gss_release_buffer(minor_stat, &call_arg.token);
+ 
+@@ -436,7 +436,7 @@ next_token:
+      /* don't assume the caller will want to change clnt->cl_auth */
+      clnt->cl_auth = save_auth;
+ 
+-     xdr_free(xdr_authgssapi_init_res, &call_res);
++     xdr_free((xdrproc_t)xdr_authgssapi_init_res, &call_res);
+      return auth;
+ 
+      /******************************************************************/
+@@ -458,7 +458,7 @@ cleanup:
+      if (rpc_createerr.cf_stat == 0)
+ 	  rpc_createerr.cf_stat = RPC_AUTHERROR;
+ 
+-     xdr_free(xdr_authgssapi_init_res, &call_res);
++     xdr_free((xdrproc_t)xdr_authgssapi_init_res, &call_res);
+      return auth;
+ }
+ 
+@@ -760,7 +760,7 @@ skip_call:
+ static bool_t auth_gssapi_wrap(
+      AUTH *auth,
+      XDR *out_xdrs,
+-     bool_t (*xdr_func)(),
++     xdrproc_t xdr_func,
+      caddr_t xdr_ptr)
+ {
+      OM_uint32 gssstat, minor_stat;
+@@ -791,7 +791,7 @@ static bool_t auth_gssapi_wrap(
+ static bool_t auth_gssapi_unwrap(
+      AUTH *auth,
+      XDR *in_xdrs,
+-     bool_t (*xdr_func)(),
++     xdrproc_t xdr_func,
+      caddr_t xdr_ptr)
+ {
+      OM_uint32 gssstat, minor_stat;
+diff --git a/src/lib/rpc/auth_gssapi_misc.c b/src/lib/rpc/auth_gssapi_misc.c
+index a60eb7f7cb..57fc1fb39f 100644
+--- a/src/lib/rpc/auth_gssapi_misc.c
++++ b/src/lib/rpc/auth_gssapi_misc.c
+@@ -199,7 +199,7 @@ bool_t auth_gssapi_wrap_data(
+      gss_ctx_id_t context,
+      uint32_t seq_num,
+      XDR *out_xdrs,
+-     bool_t (*xdr_func)(),
++     xdrproc_t xdr_func,
+      caddr_t xdr_ptr)
+ {
+      gss_buffer_desc in_buf, out_buf;
+@@ -267,7 +267,7 @@ bool_t auth_gssapi_unwrap_data(
+      gss_ctx_id_t context,
+      uint32_t seq_num,
+      XDR *in_xdrs,
+-     bool_t (*xdr_func)(),
++     xdrproc_t xdr_func,
+      caddr_t xdr_ptr)
+ {
+      gss_buffer_desc in_buf, out_buf;
+diff --git a/src/lib/rpc/authunix_prot.c b/src/lib/rpc/authunix_prot.c
+index 512d5a51b7..92276c3ad4 100644
+--- a/src/lib/rpc/authunix_prot.c
++++ b/src/lib/rpc/authunix_prot.c
+@@ -58,7 +58,8 @@ xdr_authunix_parms(XDR *xdrs, struct authunix_parms *p)
+ 	    && xdr_int(xdrs, &(p->aup_uid))
+ 	    && xdr_int(xdrs, &(p->aup_gid))
+ 	    && xdr_array(xdrs, (caddr_t *)&(p->aup_gids),
+-		    &(p->aup_len), NGRPS, sizeof(int), xdr_int) ) {
++			 &(p->aup_len), NGRPS, sizeof(int),
++			 (xdrproc_t)xdr_int)) {
+ 		return (TRUE);
+ 	}
+ 	return (FALSE);
+diff --git a/src/lib/rpc/clnt_perror.c b/src/lib/rpc/clnt_perror.c
+index fcc3657464..912b267867 100644
+--- a/src/lib/rpc/clnt_perror.c
++++ b/src/lib/rpc/clnt_perror.c
+@@ -76,7 +76,6 @@ char *
+ clnt_sperror(CLIENT *rpch, char *s)
+ {
+ 	struct rpc_err e;
+-	void clnt_perrno();
+ 	char *err;
+ 	char *bufstart = get_buf();
+ 	char *str = bufstart;
+diff --git a/src/lib/rpc/clnt_raw.c b/src/lib/rpc/clnt_raw.c
+index dcbb5cf23d..7e62a5c776 100644
+--- a/src/lib/rpc/clnt_raw.c
++++ b/src/lib/rpc/clnt_raw.c
+@@ -80,7 +80,7 @@ static struct clnt_ops client_ops = {
+ 	clntraw_control
+ };
+ 
+-void	svc_getreq();
++void	svc_getreq(int);
+ 
+ /*
+  * Create a client handle for memory based rpc.
+diff --git a/src/lib/rpc/dyn.c b/src/lib/rpc/dyn.c
+index bce1fd2a7d..a505f34817 100644
+--- a/src/lib/rpc/dyn.c
++++ b/src/lib/rpc/dyn.c
+@@ -30,10 +30,8 @@
+ /*
+  * Made obsolete by DynInsert, now just a convenience function.
+  */
+-int DynAppend(obj, els, num)
+-   DynObjectP obj;
+-   DynPtr els;
+-   int num;
++int
++DynAppend(DynObjectP obj, DynPtr els, int num)
+ {
+      return DynInsert(obj, DynSize(obj), els, num);
+ }
+@@ -52,8 +50,8 @@ int DynAppend(obj, els, num)
+ 
+ static int default_increment = DEFAULT_INC;
+ 
+-DynObjectP DynCreate(el_size, inc)
+-   int	el_size, inc;
++DynObjectP
++DynCreate(int el_size, int inc)
+ {
+      DynObjectP obj;
+ 
+@@ -77,8 +75,8 @@ DynObjectP DynCreate(el_size, inc)
+      return obj;
+ }
+ 
+-DynObjectP DynCopy(obj)
+-   DynObjectP obj;
++DynObjectP
++DynCopy(DynObjectP obj)
+ {
+      DynObjectP obj1;
+ 
+@@ -104,8 +102,8 @@ DynObjectP DynCopy(obj)
+      return obj1;
+ }
+ 
+-int DynDestroy(obj)
+-     /*@only@*/DynObjectP obj;
++int
++DynDestroy(/*@only@*/DynObjectP obj)
+ {
+      if (obj->paranoid) {
+ 	  if (obj->debug)
+@@ -118,8 +116,8 @@ int DynDestroy(obj)
+      return DYN_OK;
+ }
+ 
+-int DynRelease(obj)
+-   DynObjectP obj;
++int
++DynRelease(DynObjectP obj)
+ {
+      if (obj->debug)
+ 	  fprintf(stderr, "dyn: release: freeing object structure.\n");
+@@ -134,9 +132,8 @@ int DynRelease(obj)
+  * contains the source code for the function DynDebug().
+  */
+ 
+-int DynDebug(obj, state)
+-   DynObjectP obj;
+-   int state;
++int
++DynDebug(DynObjectP obj, int state)
+ {
+      obj->debug = state;
+ 
+@@ -155,9 +152,8 @@ int DynDebug(obj, state)
+  * Checkers!  Get away from that "hard disk erase" button!
+  *    (Stupid dog.  He almost did it to me again ...)
+  */
+-int DynDelete(obj, idx)
+-   DynObjectP obj;
+-   int idx;
++int
++DynDelete(DynObjectP obj, int idx)
+ {
+      if (idx < 0) {
+ 	  if (obj->debug)
+@@ -219,9 +215,8 @@ int DynDelete(obj, idx)
+  * contains the source code for the function DynInitZero().
+  */
+ 
+-int DynInitzero(obj, state)
+-   DynObjectP obj;
+-   int state;
++int
++DynInitzero(DynObjectP obj, int state)
+ {
+      obj->initzero = state;
+ 
+@@ -237,10 +232,8 @@ int DynInitzero(obj, state)
+  * contains the source code for the function DynInsert().
+  */
+ 
+-int DynInsert(obj, idx, els_in, num)
+-   DynObjectP obj;
+-   void *els_in;
+-   int idx, num;
++int
++DynInsert(DynObjectP obj, int idx, void *els_in, int num)
+ {
+      DynPtr els = (DynPtr) els_in;
+      int ret;
+@@ -290,9 +283,8 @@ int DynInsert(obj, idx, els_in, num)
+  * contains the source code for the function DynDebug().
+  */
+ 
+-int DynParanoid(obj, state)
+-   DynObjectP obj;
+-   int state;
++int
++DynParanoid(DynObjectP obj, int state)
+ {
+      obj->paranoid = state;
+ 
+@@ -308,8 +300,8 @@ int DynParanoid(obj, state)
+  * contains the source code for the functions DynGet() and DynAdd().
+  */
+ 
+-DynPtr DynArray(obj)
+-   DynObjectP obj;
++DynPtr
++DynArray(DynObjectP obj)
+ {
+      if (obj->debug)
+ 	  fprintf(stderr, "dyn: array: returning array pointer %p.\n",
+@@ -318,9 +310,8 @@ DynPtr DynArray(obj)
+      return obj->array;
+ }
+ 
+-DynPtr DynGet(obj, num)
+-   DynObjectP obj;
+-   int num;
++DynPtr
++DynGet(DynObjectP obj, int num)
+ {
+      if (num < 0) {
+ 	  if (obj->debug)
+@@ -342,9 +333,7 @@ DynPtr DynGet(obj, num)
+      return (DynPtr) obj->array + obj->el_size*num;
+ }
+ 
+-int DynAdd(obj, el)
+-   DynObjectP obj;
+-   void *el;
++int DynAdd(DynObjectP obj, void *el)
+ {
+      int	ret;
+ 
+@@ -364,10 +353,8 @@ int DynAdd(obj, el)
+  * obj->num_el) will not be updated properly and many other functions
+  * in the library will lose.  Have a nice day.
+  */
+-int DynPut(obj, el_in, idx)
+-   DynObjectP obj;
+-   void *el_in;
+-   int idx;
++int
++DynPut(DynObjectP obj, void *el_in, int idx)
+ {
+      DynPtr el = (DynPtr) el_in;
+      int ret;
+@@ -397,9 +384,8 @@ int DynPut(obj, el_in, idx)
+ /*
+  * Resize the array so that element req exists.
+  */
+-int _DynResize(obj, req)
+-   DynObjectP obj;
+-   int req;
++int
++_DynResize(DynObjectP obj, int req)
+ {
+      int size;
+ 
+@@ -430,9 +416,8 @@ int _DynResize(obj, req)
+  * Ideally, this function should not be called from outside the
+  * library.  However, nothing will break if it is.
+  */
+-int _DynRealloc(obj, num_incs)
+-   DynObjectP obj;
+-   int num_incs;
++int
++_DynRealloc(DynObjectP obj, int num_incs)
+ {
+      DynPtr temp;
+      int new_size_in_bytes;
+@@ -475,8 +460,8 @@ int _DynRealloc(obj, num_incs)
+  * contains the source code for the function DynSize().
+  */
+ 
+-int DynSize(obj)
+-   DynObjectP obj;
++int
++DynSize(DynObjectP obj)
+ {
+      if (obj->debug)
+ 	  fprintf(stderr, "dyn: size: returning size %d.\n", obj->num_el);
+@@ -484,8 +469,8 @@ int DynSize(obj)
+      return obj->num_el;
+ }
+ 
+-int DynCapacity(obj)
+-   DynObjectP obj;
++int
++DynCapacity(DynObjectP obj)
+ {
+      if (obj->debug)
+ 	  fprintf(stderr, "dyn: capacity: returning cap of %d.\n", obj->size);
+diff --git a/src/lib/rpc/pmap_clnt.c b/src/lib/rpc/pmap_clnt.c
+index 952a251453..5c3bba3528 100644
+--- a/src/lib/rpc/pmap_clnt.c
++++ b/src/lib/rpc/pmap_clnt.c
+@@ -54,8 +54,6 @@ static char sccsid[] = "@(#)pmap_clnt.c 1.37 87/08/11 Copyr 1984 Sun Micro";
+ static struct timeval timeout = { 5, 0 };
+ static struct timeval tottimeout = { 60, 0 };
+ 
+-void clnt_perror();
+-
+ /*
+  * Set a mapping between program,version and port.
+  * Calls the pmap service remotely to do the mapping.
+@@ -128,7 +126,8 @@ pmap_set(
+ 	    }
+ 	}
+ #endif
+-	if (CLNT_CALL(client, PMAPPROC_SET, xdr_pmap, &parms, xdr_bool, &rslt,
++	if (CLNT_CALL(client, PMAPPROC_SET, (xdrproc_t)xdr_pmap, &parms,
++		      (xdrproc_t)xdr_bool, &rslt,
+ 	    tottimeout) != RPC_SUCCESS) {
+ 		clnt_perror(client, "Cannot register service");
+ 		return (FALSE);
+@@ -161,8 +160,8 @@ pmap_unset(
+ 	parms.pm_prog = program;
+ 	parms.pm_vers = version;
+ 	parms.pm_port = parms.pm_prot = 0;
+-	CLNT_CALL(client, PMAPPROC_UNSET, xdr_pmap, &parms, xdr_bool, &rslt,
+-	    tottimeout);
++	CLNT_CALL(client, PMAPPROC_UNSET, (xdrproc_t)xdr_pmap, &parms,
++		  (xdrproc_t)xdr_bool, &rslt, tottimeout);
+ 	CLNT_DESTROY(client);
+ 	(void)close(sock);
+ 	return (rslt);
+diff --git a/src/lib/rpc/pmap_getmaps.c b/src/lib/rpc/pmap_getmaps.c
+index b8a9cecf7e..a9c4c52906 100644
+--- a/src/lib/rpc/pmap_getmaps.c
++++ b/src/lib/rpc/pmap_getmaps.c
+@@ -77,8 +77,9 @@ pmap_getmaps(struct sockaddr_in *address)
+ 	client = clnttcp_create(address, PMAPPROG,
+ 	    PMAPVERS, &sock, 50, 500);
+ 	if (client != (CLIENT *)NULL) {
+-		if (CLNT_CALL(client, PMAPPROC_DUMP, xdr_void, NULL, xdr_pmaplist,
+-		    &head, minutetimeout) != RPC_SUCCESS) {
++		if (CLNT_CALL(client, PMAPPROC_DUMP, xdr_void, NULL,
++			      (xdrproc_t)xdr_pmaplist, &head,
++			      minutetimeout) != RPC_SUCCESS) {
+ 			clnt_perror(client, "pmap_getmaps rpc problem");
+ 		}
+ 		CLNT_DESTROY(client);
+diff --git a/src/lib/rpc/pmap_getport.c b/src/lib/rpc/pmap_getport.c
+index 66635a1034..2d0792b698 100644
+--- a/src/lib/rpc/pmap_getport.c
++++ b/src/lib/rpc/pmap_getport.c
+@@ -79,8 +79,10 @@ pmap_getport(
+ 		parms.pm_vers = version;
+ 		parms.pm_prot = protocol;
+ 		parms.pm_port = 0;  /* not needed or used */
+-		if (CLNT_CALL(client, PMAPPROC_GETPORT, xdr_pmap, &parms,
+-		    xdr_u_short, &port, tottimeout) != RPC_SUCCESS){
++		if (CLNT_CALL(client, PMAPPROC_GETPORT,
++			      (xdrproc_t)xdr_pmap, &parms,
++			      (xdrproc_t)xdr_u_short, &port,
++			      tottimeout) != RPC_SUCCESS){
+ 			rpc_createerr.cf_stat = RPC_PMAPFAILURE;
+ 			clnt_geterr(client, &rpc_createerr.cf_error);
+ 		} else if (port == 0) {
+diff --git a/src/lib/rpc/pmap_prot2.c b/src/lib/rpc/pmap_prot2.c
+index aeccac6637..3c0c612bec 100644
+--- a/src/lib/rpc/pmap_prot2.c
++++ b/src/lib/rpc/pmap_prot2.c
+@@ -109,7 +109,8 @@ xdr_pmaplist(XDR *xdrs, struct pmaplist **rp)
+ 		if (freeing)
+ 			next = &((*rp)->pml_next);
+ 		if (! xdr_reference(xdrs, (caddr_t *)rp,
+-		    (u_int)sizeof(struct pmaplist), xdr_pmap))
++				    (u_int)sizeof(struct pmaplist),
++				    (xdrproc_t)xdr_pmap))
+ 			return (FALSE);
+ 		rp = (freeing) ? next : &((*rp)->pml_next);
+ 	}
+diff --git a/src/lib/rpc/pmap_rmt.c b/src/lib/rpc/pmap_rmt.c
+index 8c7e30c21a..434e4eea65 100644
+--- a/src/lib/rpc/pmap_rmt.c
++++ b/src/lib/rpc/pmap_rmt.c
+@@ -105,8 +105,9 @@ pmap_rmtcall(
+ 		r.port_ptr = port_ptr;
+ 		r.results_ptr = resp;
+ 		r.xdr_results = xdrres;
+-		stat = CLNT_CALL(client, PMAPPROC_CALLIT, xdr_rmtcall_args, &a,
+-		    xdr_rmtcallres, &r, tout);
++		stat = CLNT_CALL(client, PMAPPROC_CALLIT,
++				 (xdrproc_t)xdr_rmtcall_args, &a,
++				 (xdrproc_t)xdr_rmtcallres, &r, tout);
+ 		CLNT_DESTROY(client);
+ 	} else {
+ 		stat = RPC_FAILED;
+@@ -161,7 +162,8 @@ xdr_rmtcallres(
+ 
+ 	port_ptr = (caddr_t)(void *)crp->port_ptr;
+ 	if (xdr_reference(xdrs, &port_ptr, sizeof (uint32_t),
+-	    xdr_u_int32) && xdr_u_int32(xdrs, &crp->resultslen)) {
++			  (xdrproc_t)xdr_u_int32) &&
++	    xdr_u_int32(xdrs, &crp->resultslen)) {
+ 		crp->port_ptr = (uint32_t *)(void *)port_ptr;
+ 		return ((*(crp->xdr_results))(xdrs, crp->results_ptr));
+ 	}
+@@ -343,7 +345,7 @@ clnt_broadcast(
+ 	recv_again:
+ 		msg.acpted_rply.ar_verf = gssrpc__null_auth;
+ 		msg.acpted_rply.ar_results.where = (caddr_t)&r;
+-                msg.acpted_rply.ar_results.proc = xdr_rmtcallres;
++		msg.acpted_rply.ar_results.proc = (xdrproc_t)xdr_rmtcallres;
+ 		readfds = mask;
+ 		t2 = t;
+ 		switch (select(gssrpc__rpc_dtablesize(), &readfds, (fd_set *)NULL,
+diff --git a/src/lib/rpc/rpc_prot.c b/src/lib/rpc/rpc_prot.c
+index 9b82e12c34..296968b946 100644
+--- a/src/lib/rpc/rpc_prot.c
++++ b/src/lib/rpc/rpc_prot.c
+@@ -132,8 +132,8 @@ xdr_rejected_reply(XDR *xdrs, struct rejected_reply *rr)
+ }
+ 
+ static struct xdr_discrim reply_dscrm[3] = {
+-	{ (int)MSG_ACCEPTED, xdr_accepted_reply },
+-	{ (int)MSG_DENIED, xdr_rejected_reply },
++	{ (int)MSG_ACCEPTED, (xdrproc_t)xdr_accepted_reply },
++	{ (int)MSG_DENIED, (xdrproc_t)xdr_rejected_reply },
+ 	{ __dontcare__, NULL_xdrproc_t } };
+ 
+ /*
+diff --git a/src/lib/rpc/svc.c b/src/lib/rpc/svc.c
+index cfbc7aad4d..0bcf04e8d4 100644
+--- a/src/lib/rpc/svc.c
++++ b/src/lib/rpc/svc.c
+@@ -80,7 +80,7 @@ static struct svc_callout {
+ 	struct svc_callout *sc_next;
+ 	rpcprog_t		    sc_prog;
+ 	rpcprog_t		    sc_vers;
+-	void		    (*sc_dispatch)();
++	void		    (*sc_dispatch)(struct svc_req *, SVCXPRT *);
+ } *svc_head;
+ 
+ static struct svc_callout *svc_find(rpcprog_t, rpcvers_t,
+@@ -162,7 +162,7 @@ svc_register(
+ 	SVCXPRT *xprt,
+ 	rpcprog_t prog,
+ 	rpcvers_t vers,
+-	void (*dispatch)(),
++	void (*dispatch)(struct svc_req *, SVCXPRT *),
+ 	int protocol)
+ {
+ 	struct svc_callout *prev;
+diff --git a/src/lib/rpc/svc_auth_gss.c b/src/lib/rpc/svc_auth_gss.c
+index aba7694807..98d601c8ab 100644
+--- a/src/lib/rpc/svc_auth_gss.c
++++ b/src/lib/rpc/svc_auth_gss.c
+@@ -193,7 +193,7 @@ svcauth_gss_accept_sec_context(struct svc_req *rqst,
+ 	/* Deserialize arguments. */
+ 	memset(&recv_tok, 0, sizeof(recv_tok));
+ 
+-	if (!svc_getargs(rqst->rq_xprt, xdr_rpc_gss_init_args,
++	if (!svc_getargs(rqst->rq_xprt, (xdrproc_t)xdr_rpc_gss_init_args,
+ 			 (caddr_t)&recv_tok))
+ 		return (FALSE);
+ 
+@@ -209,7 +209,8 @@ svcauth_gss_accept_sec_context(struct svc_req *rqst,
+ 					      NULL,
+ 					      NULL);
+ 
+-	svc_freeargs(rqst->rq_xprt, xdr_rpc_gss_init_args, (caddr_t)&recv_tok);
++	svc_freeargs(rqst->rq_xprt, (xdrproc_t)xdr_rpc_gss_init_args,
++		     (caddr_t)&recv_tok);
+ 
+ 	log_status("accept_sec_context", gr->gr_major, gr->gr_minor);
+ 	if (gr->gr_major != GSS_S_COMPLETE &&
+@@ -495,7 +496,8 @@ gssrpc__svcauth_gss(struct svc_req *rqst, struct rpc_msg *msg,
+ 		}
+ 		*no_dispatch = TRUE;
+ 
+-		call_stat = svc_sendreply(rqst->rq_xprt, xdr_rpc_gss_init_res,
++		call_stat = svc_sendreply(rqst->rq_xprt,
++					  (xdrproc_t)xdr_rpc_gss_init_res,
+ 					  (caddr_t)&gr);
+ 
+ 		gss_release_buffer(&min_stat, &gr.gr_token);
+@@ -544,7 +546,7 @@ gssrpc__svcauth_gss(struct svc_req *rqst, struct rpc_msg *msg,
+ 	}
+ 	retstat = AUTH_OK;
+ freegc:
+-	xdr_free(xdr_rpc_gss_cred, gc);
++	xdr_free((xdrproc_t)xdr_rpc_gss_cred, gc);
+ 	log_debug("returning %d from svcauth_gss()", retstat);
+ 	return (retstat);
+ }
+diff --git a/src/lib/rpc/svc_auth_gssapi.c b/src/lib/rpc/svc_auth_gssapi.c
+index b7ffee4515..267c1545bd 100644
+--- a/src/lib/rpc/svc_auth_gssapi.c
++++ b/src/lib/rpc/svc_auth_gssapi.c
+@@ -201,7 +201,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
+      if (! xdr_authgssapi_creds(&xdrs, &creds)) {
+ 	  PRINTF(("svcauth_gssapi: failed decoding creds\n"));
+ 	  LOG_MISCERR("protocol error in client credentials");
+-	  xdr_free(xdr_authgssapi_creds, &creds);
++	  xdr_free((xdrproc_t)xdr_authgssapi_creds, &creds);
+ 	  XDR_DESTROY(&xdrs);
+ 	  ret = AUTH_BADCRED;
+ 	  goto error;
+@@ -223,7 +223,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
+ 	  if (creds.auth_msg && rqst->rq_proc == AUTH_GSSAPI_EXIT) {
+ 	       PRINTF(("svcauth_gssapi: GSSAPI_EXIT, cleaning up\n"));
+ 	       svc_sendreply(rqst->rq_xprt, xdr_void, NULL);
+-	       xdr_free(xdr_authgssapi_creds, &creds);
++	       xdr_free((xdrproc_t)xdr_authgssapi_creds, &creds);
+ 	       cleanup();
+ 	       exit(0);
+ 	  }
+@@ -306,7 +306,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
+ 
+ 	  /* call is for us, deserialize arguments */
+ 	  memset(&call_arg, 0, sizeof(call_arg));
+-	  if (! svc_getargs(rqst->rq_xprt, xdr_authgssapi_init_arg,
++	  if (! svc_getargs(rqst->rq_xprt, (xdrproc_t)xdr_authgssapi_init_arg,
+ 			    &call_arg)) {
+ 	       PRINTF(("svcauth_gssapi: cannot decode args\n"));
+ 	       LOG_MISCERR("protocol error in procedure arguments");
+@@ -446,7 +446,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
+ 	  minor_stat = call_res.gss_minor;
+ 
+ 	  /* done with call args */
+-	  xdr_free(xdr_authgssapi_init_arg, &call_arg);
++	  xdr_free((xdrproc_t)xdr_authgssapi_init_arg, &call_arg);
+ 
+ 	  PRINTF(("svcauth_gssapi: accept_sec_context returned %#x %#x\n",
+ 		  call_res.gss_major, call_res.gss_minor));
+@@ -459,7 +459,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
+ 	       badauth(call_res.gss_major, call_res.gss_minor, rqst->rq_xprt);
+ 
+ 	       gss_release_buffer(&minor_stat, &output_token);
+-	       svc_sendreply(rqst->rq_xprt, xdr_authgssapi_init_res,
++	       svc_sendreply(rqst->rq_xprt, (xdrproc_t)xdr_authgssapi_init_res,
+ 			     (caddr_t) &call_res);
+ 	       *no_dispatch = TRUE;
+ 	       ret = AUTH_OK;
+@@ -492,7 +492,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
+ 	  }
+ 
+ 	  PRINTF(("svcauth_gssapi: sending reply\n"));
+-	  svc_sendreply(rqst->rq_xprt, xdr_authgssapi_init_res,
++	  svc_sendreply(rqst->rq_xprt, (xdrproc_t)xdr_authgssapi_init_res,
+ 			(caddr_t) &call_res);
+ 	  *no_dispatch = TRUE;
+ 
+@@ -583,11 +583,13 @@ enum auth_stat gssrpc__svcauth_gssapi(
+ 	       case AUTH_GSSAPI_MSG:
+ 		    PRINTF(("svcauth_gssapi: GSSAPI_MSG, getting args\n"));
+ 		    memset(&call_arg, 0, sizeof(call_arg));
+-		    if (! svc_getargs(rqst->rq_xprt, xdr_authgssapi_init_arg,
++		    if (! svc_getargs(rqst->rq_xprt,
++				      (xdrproc_t)xdr_authgssapi_init_arg,
+ 				      &call_arg)) {
+ 			 PRINTF(("svcauth_gssapi: cannot decode args\n"));
+ 			 LOG_MISCERR("protocol error in call arguments");
+-			 xdr_free(xdr_authgssapi_init_arg, &call_arg);
++			 xdr_free((xdrproc_t)xdr_authgssapi_init_arg,
++				  &call_arg);
+ 			 ret = AUTH_BADCRED;
+ 			 goto error;
+ 		    }
+@@ -598,7 +600,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
+ 							&call_arg.token);
+ 
+ 		    /* done with call args */
+-		    xdr_free(xdr_authgssapi_init_arg, &call_arg);
++		    xdr_free((xdrproc_t)xdr_authgssapi_init_arg, &call_arg);
+ 
+ 		    if (gssstat != GSS_S_COMPLETE) {
+ 			 AUTH_GSSAPI_DISPLAY_STATUS(("processing token",
+@@ -641,7 +643,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
+      if (creds.client_handle.length != 0) {
+ 	  PRINTF(("svcauth_gssapi: freeing client_handle len %d\n",
+ 		  (int) creds.client_handle.length));
+-	  xdr_free(xdr_authgssapi_creds, &creds);
++	  xdr_free((xdrproc_t)xdr_authgssapi_creds, &creds);
+      }
+ 
+      PRINTF(("\n"));
+@@ -651,7 +653,7 @@ error:
+      if (creds.client_handle.length != 0) {
+ 	  PRINTF(("svcauth_gssapi: freeing client_handle len %d\n",
+ 		  (int) creds.client_handle.length));
+-	  xdr_free(xdr_authgssapi_creds, &creds);
++	  xdr_free((xdrproc_t)xdr_authgssapi_creds, &creds);
+      }
+ 
+      PRINTF(("\n"));
+@@ -1079,7 +1081,7 @@ void svcauth_gssapi_set_log_miscerr_func(
+ static bool_t svc_auth_gssapi_wrap(
+      SVCAUTH *auth,
+      XDR *out_xdrs,
+-     bool_t (*xdr_func)(),
++     xdrproc_t xdr_func,
+      caddr_t xdr_ptr)
+ {
+      OM_uint32 gssstat, minor_stat;
+@@ -1102,7 +1104,7 @@ static bool_t svc_auth_gssapi_wrap(
+ static bool_t svc_auth_gssapi_unwrap(
+      SVCAUTH *auth,
+      XDR *in_xdrs,
+-     bool_t (*xdr_func)(),
++     xdrproc_t xdr_func,
+      caddr_t xdr_ptr)
+ {
+      svc_auth_gssapi_data *client_data = SVCAUTH_PRIVATE(auth);
+diff --git a/src/lib/rpc/svc_simple.c b/src/lib/rpc/svc_simple.c
+index 315275f5fd..aa6c0a63d0 100644
+--- a/src/lib/rpc/svc_simple.c
++++ b/src/lib/rpc/svc_simple.c
+@@ -48,7 +48,7 @@ static char sccsid[] = "@(#)svc_simple.c 1.18 87/08/11 Copyr 1984 Sun Micro";
+ #include <netdb.h>
+ 
+ static struct proglst {
+-	char *(*p_progname)();
++	char *(*p_progname)(void *);
+ 	int  p_prognum;
+ 	int  p_procnum;
+ 	xdrproc_t p_inproc, p_outproc;
+@@ -62,7 +62,7 @@ registerrpc(
+ 	rpcprog_t prognum,
+ 	rpcvers_t versnum,
+ 	rpcproc_t procnum,
+-	char *(*progname)(),
++	char *(*progname)(void *),
+ 	xdrproc_t inproc,
+ 	xdrproc_t outproc)
+ {
+diff --git a/src/lib/rpc/unit-test/client.c b/src/lib/rpc/unit-test/client.c
+index c9a812bc5a..9b907bcdc6 100644
+--- a/src/lib/rpc/unit-test/client.c
++++ b/src/lib/rpc/unit-test/client.c
+@@ -42,7 +42,7 @@ char *whoami;
+ #ifdef __GNUC__
+ __attribute__((noreturn))
+ #endif
+-static void usage()
++static void usage(void)
+ {
+      fprintf(stderr, "usage: %s {-t|-u} [-a] [-s num] [-m num] host service [count]\n",
+ 	     whoami);
+@@ -50,9 +50,7 @@ static void usage()
+ }
+ 
+ int
+-main(argc, argv)
+-   int argc;
+-   char **argv;
++main(int argc, char **argv)
+ {
+      char        *host, *port, *target, *echo_arg, **echo_resp, buf[BIG_BUF];
+      CLIENT      *clnt;
+@@ -172,7 +170,7 @@ main(argc, argv)
+ 	      strcmp(echo_arg, (*echo_resp) + 6) != 0)
+ 	       fprintf(stderr, "RPC_TEST_ECHO call %d response wrong: "
+ 		       "arg = %s, resp = %s\n", i, echo_arg, *echo_resp);
+-	  gssrpc_xdr_free(xdr_wrapstring, echo_resp);
++	  gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp);
+      }
+ 
+      /*
+@@ -194,7 +192,7 @@ main(argc, argv)
+ 	       clnt_perror(clnt, whoami);
+      } else {
+ 	  fprintf(stderr, "bad seq didn't cause failure\n");
+-	  gssrpc_xdr_free(xdr_wrapstring, echo_resp);
++	  gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp);
+      }
+ 
+      AUTH_PRIVATE(clnt->cl_auth)->seq_num -= 3;
+@@ -207,7 +205,7 @@ main(argc, argv)
+      if (echo_resp == NULL)
+ 	  clnt_perror(clnt, "Sequence number improperly reset");
+      else
+-	  gssrpc_xdr_free(xdr_wrapstring, echo_resp);
++	  gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp);
+ 
+      /*
+       * Now simulate a lost server response, and see if
+@@ -219,7 +217,7 @@ main(argc, argv)
+      if (echo_resp == NULL)
+ 	  clnt_perror(clnt, "Auto-resynchronization failed");
+      else
+-	  gssrpc_xdr_free(xdr_wrapstring, echo_resp);
++	  gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp);
+ 
+      /*
+       * Now make sure auto-resyncrhonization actually worked
+@@ -229,7 +227,7 @@ main(argc, argv)
+      if (echo_resp == NULL)
+ 	  clnt_perror(clnt, "Auto-resynchronization did not work");
+      else
+-	  gssrpc_xdr_free(xdr_wrapstring, echo_resp);
++	  gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp);
+ 
+      if (! auth_once) {
+ 	  tmp_auth = clnt->cl_auth;
+@@ -259,7 +257,7 @@ main(argc, argv)
+ 		   strcmp(echo_arg, (*echo_resp) + 6) != 0)
+ 		    fprintf(stderr,
+ 			    "RPC_TEST_LENGTHS call %d response wrong\n", i);
+-	       gssrpc_xdr_free(xdr_wrapstring, echo_resp);
++	       gssrpc_xdr_free((xdrproc_t)xdr_wrapstring, echo_resp);
+ 	  }
+ 
+ 	  /* cycle from 1 to 255 */
+diff --git a/src/lib/rpc/unit-test/rpc_test_clnt.c b/src/lib/rpc/unit-test/rpc_test_clnt.c
+index 4e4a18a720..b9141672b1 100644
+--- a/src/lib/rpc/unit-test/rpc_test_clnt.c
++++ b/src/lib/rpc/unit-test/rpc_test_clnt.c
+@@ -5,9 +5,7 @@
+ static struct timeval TIMEOUT = { 25, 0 };
+ 
+ char **
+-rpc_test_echo_1(argp, clnt)
+-	char **argp;
+-	CLIENT *clnt;
++rpc_test_echo_1(char **argp, CLIENT *clnt)
+ {
+ 	static char *clnt_res;
+ 
+diff --git a/src/lib/rpc/unit-test/rpc_test_svc.c b/src/lib/rpc/unit-test/rpc_test_svc.c
+index c54c0813db..3aa7674c51 100644
+--- a/src/lib/rpc/unit-test/rpc_test_svc.c
++++ b/src/lib/rpc/unit-test/rpc_test_svc.c
+@@ -14,16 +14,14 @@ static int _rpcsvcstate = _IDLE;	/* Set when a request is serviced */
+ static int _rpcsvccount = 0;		/* Number of requests being serviced */
+ 
+ void
+-rpc_test_prog_1_svc(rqstp, transp)
+-	struct svc_req *rqstp;
+-	SVCXPRT *transp;
++rpc_test_prog_1_svc(struct svc_req *rqstp, SVCXPRT *transp)
+ {
+ 	union {
+ 		char *rpc_test_echo_1_arg;
+ 	} argument;
+ 	char *result;
+-	bool_t (*xdr_argument)(), (*xdr_result)();
+-	char *(*local)();
++	xdrproc_t xdr_argument, xdr_result;
++	char *(*local)(char *, struct svc_req *);
+ 
+ 	_rpcsvccount++;
+ 	switch (rqstp->rq_proc) {
+@@ -35,9 +33,9 @@ rpc_test_prog_1_svc(rqstp, transp)
+ 		return;
+ 
+ 	case RPC_TEST_ECHO:
+-		xdr_argument = xdr_wrapstring;
+-		xdr_result = xdr_wrapstring;
+-		local = (char *(*)()) rpc_test_echo_1_svc;
++		xdr_argument = (xdrproc_t)xdr_wrapstring;
++		xdr_result = (xdrproc_t)xdr_wrapstring;
++		local = (char *(*)(char *, struct svc_req *)) rpc_test_echo_1_svc;
+ 		break;
+ 
+ 	default:
+@@ -53,7 +51,7 @@ rpc_test_prog_1_svc(rqstp, transp)
+ 		_rpcsvcstate = _SERVED;
+ 		return;
+ 	}
+-	result = (*local)(&argument, rqstp);
++	result = (*local)((char *)&argument, rqstp);
+ 	if (result != NULL && !svc_sendreply(transp, xdr_result, result)) {
+ 		svcerr_systemerr(transp);
+ 	}
+diff --git a/src/lib/rpc/unit-test/server.c b/src/lib/rpc/unit-test/server.c
+index c3bbcbf8cf..4400b969f6 100644
+--- a/src/lib/rpc/unit-test/server.c
++++ b/src/lib/rpc/unit-test/server.c
+@@ -40,7 +40,7 @@ static void rpc_test_badverf(gss_name_t client, gss_name_t server,
+ #define SERVICE_NAME "host"
+ #endif
+ 
+-static void usage()
++static void usage(void)
+ {
+      fprintf(stderr, "Usage: server {-t|-u} [svc-debug] [misc-debug]\n");
+      exit(1);
+diff --git a/src/lib/rpc/xdr.c b/src/lib/rpc/xdr.c
+index 24c3de4bd9..49c31b3d1b 100644
+--- a/src/lib/rpc/xdr.c
++++ b/src/lib/rpc/xdr.c
+@@ -579,14 +579,14 @@ xdr_union(
+ 	 */
+ 	for (; choices->proc != NULL_xdrproc_t; choices++) {
+ 		if (choices->value == dscm)
+-			return ((*(choices->proc))(xdrs, unp, LASTUNSIGNED));
++			return choices->proc(xdrs, unp);
+ 	}
+ 
+ 	/*
+ 	 * no match - execute the default xdr routine if there is one
+ 	 */
+ 	return ((dfault == NULL_xdrproc_t) ? FALSE :
+-	    (*dfault)(xdrs, unp, LASTUNSIGNED));
++	    (*dfault)(xdrs, unp));
+ }
+ 
+ 
+diff --git a/src/lib/rpc/xdr_array.c b/src/lib/rpc/xdr_array.c
+index aeaa7f2bb0..3507d53aef 100644
+--- a/src/lib/rpc/xdr_array.c
++++ b/src/lib/rpc/xdr_array.c
+@@ -113,7 +113,7 @@ xdr_array(
+ 	 * now we xdr each element of array
+ 	 */
+ 	for (i = 0; (i < c) && stat; i++) {
+-		stat = (*elproc)(xdrs, target, LASTUNSIGNED);
++		stat = (*elproc)(xdrs, target);
+ 		target += elsize;
+ 	}
+ 
+@@ -150,7 +150,7 @@ xdr_vector(
+ 
+ 	elptr = basep;
+ 	for (i = 0; i < nelem; i++) {
+-		if (! (*xdr_elem)(xdrs, elptr, LASTUNSIGNED)) {
++		if (! (*xdr_elem)(xdrs, elptr)) {
+ 			return(FALSE);
+ 		}
+ 		elptr += elemsize;
+diff --git a/src/lib/rpc/xdr_rec.c b/src/lib/rpc/xdr_rec.c
+index 1f6a7762fd..185254018a 100644
+--- a/src/lib/rpc/xdr_rec.c
++++ b/src/lib/rpc/xdr_rec.c
+@@ -99,7 +99,7 @@ typedef struct rec_strm {
+ 	/*
+ 	 * out-goung bits
+ 	 */
+-	int (*writeit)();
++	int (*writeit)(caddr_t, caddr_t, int);
+ 	caddr_t out_base;	/* output buffer (points to frag header) */
+ 	caddr_t out_finger;	/* next output position */
+ 	caddr_t out_boundry;	/* data cannot up to this address */
+@@ -108,7 +108,7 @@ typedef struct rec_strm {
+ 	/*
+ 	 * in-coming bits
+ 	 */
+-	int (*readit)();
++	int (*readit)(caddr_t, caddr_t, int);
+ 	uint32_t in_size;	/* fixed size of the input buffer */
+ 	caddr_t in_base;
+ 	caddr_t in_finger;	/* location of next byte to be had */
+@@ -140,8 +140,10 @@ xdrrec_create(
+ 	u_int sendsize,
+ 	u_int recvsize,
+ 	caddr_t tcp_handle,
+-	int (*readit)(), /* like read, but pass it a tcp_handle, not sock */
+-	int (*writeit)() /* like write, but pass it a tcp_handle, not sock */
++	/* like read, but pass it a tcp_handle, not sock */
++	int (*readit)(caddr_t, caddr_t, int),
++	 /* like write, but pass it a tcp_handle, not sock */
++	int (*writeit)(caddr_t, caddr_t, int)
+ 	)
+ {
+ 	RECSTREAM *rstrm = mem_alloc(sizeof(RECSTREAM));
+@@ -528,8 +530,7 @@ get_input_bytes(RECSTREAM *rstrm, caddr_t addr, int len)
+ }
+ 
+ static bool_t  /* next four bytes of input stream are treated as a header */
+-set_input_fragment(rstrm)
+-	RECSTREAM *rstrm;
++set_input_fragment(RECSTREAM *rstrm)
+ {
+ 	uint32_t header;
+ 
+diff --git a/src/lib/rpc/xdr_reference.c b/src/lib/rpc/xdr_reference.c
+index eff279dadf..f3d4b7dfb8 100644
+--- a/src/lib/rpc/xdr_reference.c
++++ b/src/lib/rpc/xdr_reference.c
+@@ -47,8 +47,6 @@ static char sccsid[] = "@(#)xdr_reference.c 1.11 87/08/11 SMI";
+ #include <gssrpc/types.h>
+ #include <gssrpc/xdr.h>
+ 
+-#define LASTUNSIGNED	((u_int)0-1)
+-
+ /*
+  * XDR an indirect pointer
+  * xdr_reference is for recursively translating a structure that is
+@@ -88,7 +86,7 @@ xdr_reference(
+ 			break;
+ 	}
+ 
+-	stat = (*proc)(xdrs, loc, LASTUNSIGNED);
++	stat = (*proc)(xdrs, loc);
+ 
+ 	if (xdrs->x_op == XDR_FREE) {
+ 		mem_free(loc, size);
+diff --git a/src/lib/rpc/xdr_sizeof.c b/src/lib/rpc/xdr_sizeof.c
+index 5b77fa6ac0..0c460e7cdb 100644
+--- a/src/lib/rpc/xdr_sizeof.c
++++ b/src/lib/rpc/xdr_sizeof.c
+@@ -43,9 +43,7 @@
+ 
+ /* ARGSUSED */
+ static bool_t
+-x_putlong(xdrs, longp)
+-	XDR *xdrs;
+-	long *longp;
++x_putlong(XDR *xdrs, long *longp)
+ {
+ 	xdrs->x_handy += BYTES_PER_XDR_UNIT;
+ 	return (TRUE);
+@@ -53,10 +51,7 @@ x_putlong(xdrs, longp)
+ 
+ /* ARGSUSED */
+ static bool_t
+-x_putbytes(xdrs, bp, len)
+-	XDR *xdrs;
+-	char  *bp;
+-	int len;
++x_putbytes(XDR *xdrs, char *bp, u_int len)
+ {
+ 	xdrs->x_handy += len;
+ 
+@@ -64,26 +59,21 @@ x_putbytes(xdrs, bp, len)
+ }
+ 
+ static u_int
+-x_getpostn(xdrs)
+-	XDR *xdrs;
++x_getpostn(XDR *xdrs)
+ {
+ 	return (xdrs->x_handy);
+ }
+ 
+ /* ARGSUSED */
+ static bool_t
+-x_setpostn(xdrs, pos)
+-	XDR *xdrs;
+-	u_int pos;
++x_setpostn(XDR *xdrs, u_int pos)
+ {
+ 	/* This is not allowed */
+ 	return (FALSE);
+ }
+ 
+ static rpc_inline_t *
+-x_inline(xdrs, len)
+-	XDR *xdrs;
+-	int len;
++x_inline(XDR *xdrs, int len)
+ {
+ 	if (len == 0) {
+ 		return (NULL);
+@@ -110,15 +100,14 @@ x_inline(xdrs, len)
+ }
+ 
+ static int
+-harmless()
++harmless(void)
+ {
+ 	/* Always return FALSE/NULL, as the case may be */
+ 	return (0);
+ }
+ 
+ static void
+-x_destroy(xdrs)
+-	XDR *xdrs;
++x_destroy(XDR *xdrs)
+ {
+ 	xdrs->x_handy = 0;
+ 	xdrs->x_private = NULL;
+@@ -130,9 +119,7 @@ x_destroy(xdrs)
+ }
+ 
+ unsigned long
+-xdr_sizeof(func, data)
+-	xdrproc_t func;
+-	void *data;
++xdr_sizeof(xdrproc_t func, void *data)
+ {
+ 	XDR x;
+ 	struct xdr_ops ops;
+diff --git a/src/plugins/kdb/db2/db2_exp.c b/src/plugins/kdb/db2/db2_exp.c
+index 7cf8aa4d99..9b75f34a11 100644
+--- a/src/plugins/kdb/db2/db2_exp.c
++++ b/src/plugins/kdb/db2/db2_exp.c
+@@ -68,7 +68,7 @@ k5_mutex_t *krb5_db2_mutex;
+         return result;                                  \
+     }                                                   \
+     /* hack: decl to allow a following ";" */           \
+-    static TYPE wrap_##NAME ()
++    static TYPE wrap_##NAME ARGLIST
+ 
+ /* Two special cases: void (can't assign result), and krb5_error_code
+    (return error from locking code).  */
+@@ -81,7 +81,7 @@ k5_mutex_t *krb5_db2_mutex;
+         k5_mutex_unlock (krb5_db2_mutex);               \
+     }                                                   \
+     /* hack: decl to allow a following ";" */           \
+-    static void wrap_##NAME ()
++    static void wrap_##NAME ARGLIST
+ 
+ #define WRAP_K(NAME,ARGLIST,ARGNAMES)                   \
+     WRAP(NAME,krb5_error_code,ARGLIST,ARGNAMES)
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_close.c b/src/plugins/kdb/db2/libdb2/btree/bt_close.c
+index 11be134113..f12d74ba32 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_close.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_close.c
+@@ -61,8 +61,7 @@ static int bt_meta __P((BTREE *));
+  *	RET_ERROR, RET_SUCCESS
+  */
+ int
+-__bt_close(dbp)
+-	DB *dbp;
++__bt_close(DB *dbp)
+ {
+ 	BTREE *t;
+ 	int fd;
+@@ -116,9 +115,7 @@ __bt_close(dbp)
+  *	RET_SUCCESS, RET_ERROR.
+  */
+ int
+-__bt_sync(dbp, flags)
+-	const DB *dbp;
+-	u_int flags;
++__bt_sync(const DB *dbp, u_int flags)
+ {
+ 	BTREE *t;
+ 	int status;
+@@ -160,8 +157,7 @@ __bt_sync(dbp, flags)
+  *	RET_ERROR, RET_SUCCESS
+  */
+ static int
+-bt_meta(t)
+-	BTREE *t;
++bt_meta(BTREE *t)
+ {
+ 	BTMETA m;
+ 	void *p;
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_conv.c b/src/plugins/kdb/db2/libdb2/btree/bt_conv.c
+index c0644ed713..99c4af56c0 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_conv.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_conv.c
+@@ -59,10 +59,7 @@ static void mswap __P((PAGE *));
+  *	h:	page to convert
+  */
+ void
+-__bt_pgin(t, pg, pp)
+-	void *t;
+-	db_pgno_t pg;
+-	void *pp;
++__bt_pgin(void *t, db_pgno_t pg, void *pp)
+ {
+ 	PAGE *h;
+ 	indx_t i, top;
+@@ -128,10 +125,7 @@ __bt_pgin(t, pg, pp)
+ }
+ 
+ void
+-__bt_pgout(t, pg, pp)
+-	void *t;
+-	db_pgno_t pg;
+-	void *pp;
++__bt_pgout(void *t, db_pgno_t pg, void *pp)
+ {
+ 	PAGE *h;
+ 	indx_t i, top;
+@@ -203,8 +197,7 @@ __bt_pgout(t, pg, pp)
+  *	p:	page to convert
+  */
+ static void
+-mswap(pg)
+-	PAGE *pg;
++mswap(PAGE *pg)
+ {
+ 	char *p;
+ 
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_delete.c b/src/plugins/kdb/db2/libdb2/btree/bt_delete.c
+index 28cc24d15a..f8dd59e85a 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_delete.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_delete.c
+@@ -59,10 +59,7 @@ static int __bt_stkacq __P((BTREE *, PAGE **, CURSOR *));
+  * Return RET_SPECIAL if the key is not found.
+  */
+ int
+-__bt_delete(dbp, key, flags)
+-	const DB *dbp;
+-	const DBT *key;
+-	u_int flags;
++__bt_delete(const DB *dbp, const DBT *key, u_int flags)
+ {
+ 	BTREE *t;
+ 	CURSOR *c;
+@@ -140,10 +137,7 @@ __bt_delete(dbp, key, flags)
+  *	0 on success, 1 on failure
+  */
+ static int
+-__bt_stkacq(t, hp, c)
+-	BTREE *t;
+-	PAGE **hp;
+-	CURSOR *c;
++__bt_stkacq(BTREE *t, PAGE **hp, CURSOR *c)
+ {
+ 	BINTERNAL *bi;
+ 	EPG *e;
+@@ -288,9 +282,7 @@ ret:	mpool_put(t->bt_mp, h, 0);
+  *	RET_ERROR, RET_SUCCESS and RET_SPECIAL if the key not found.
+  */
+ static int
+-__bt_bdelete(t, key)
+-	BTREE *t;
+-	const DBT *key;
++__bt_bdelete(BTREE *t, const DBT *key)
+ {
+ 	EPG *e;
+ 	PAGE *h;
+@@ -375,9 +367,7 @@ loop:	if ((e = __bt_search(t, key, &exact)) == NULL)
+  *	mpool_put's the page
+  */
+ static int
+-__bt_pdelete(t, h)
+-	BTREE *t;
+-	PAGE *h;
++__bt_pdelete(BTREE *t, PAGE *h)
+ {
+ 	BINTERNAL *bi;
+ 	PAGE *pg;
+@@ -471,11 +461,7 @@ __bt_pdelete(t, h)
+  *	RET_SUCCESS, RET_ERROR.
+  */
+ int
+-__bt_dleaf(t, key, h, idx)
+-	BTREE *t;
+-	const DBT *key;
+-	PAGE *h;
+-	u_int idx;
++__bt_dleaf(BTREE *t, const DBT *key, PAGE *h, u_int idx)
+ {
+ 	BLEAF *bl;
+ 	indx_t cnt, *ip, offset;
+@@ -536,11 +522,7 @@ __bt_dleaf(t, key, h, idx)
+  *	RET_SUCCESS, RET_ERROR.
+  */
+ static int
+-__bt_curdel(t, key, h, idx)
+-	BTREE *t;
+-	const DBT *key;
+-	PAGE *h;
+-	u_int idx;
++__bt_curdel(BTREE *t, const DBT *key, PAGE *h, u_int idx)
+ {
+ 	CURSOR *c;
+ 	EPG e;
+@@ -635,9 +617,7 @@ dup2:				c->pg.pgno = e.page->pgno;
+  *	h:	page to be deleted
+  */
+ int
+-__bt_relink(t, h)
+-	BTREE *t;
+-	PAGE *h;
++__bt_relink(BTREE *t, PAGE *h)
+ {
+ 	PAGE *pg;
+ 
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_get.c b/src/plugins/kdb/db2/libdb2/btree/bt_get.c
+index b6318211a1..012a341b25 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_get.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_get.c
+@@ -60,11 +60,7 @@ static char sccsid[] = "@(#)bt_get.c	8.6 (Berkeley) 7/20/94";
+  *	RET_ERROR, RET_SUCCESS and RET_SPECIAL if the key not found.
+  */
+ int
+-__bt_get(dbp, key, data, flags)
+-	const DB *dbp;
+-	const DBT *key;
+-	DBT *data;
+-	u_int flags;
++__bt_get(const DB *dbp, const DBT *key, DBT *data, u_int flags)
+ {
+ 	BTREE *t;
+ 	EPG *e;
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_open.c b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
+index d5809a5a93..a2910422eb 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_open.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
+@@ -90,10 +90,8 @@ static int tmp __P((void));
+  *
+  */
+ DB *
+-__bt_open(fname, flags, mode, openinfo, dflags)
+-	const char *fname;
+-	int flags, mode, dflags;
+-	const BTREEINFO *openinfo;
++__bt_open(const char *fname, int flags, int mode, const BTREEINFO *openinfo,
++	  int dflags)
+ {
+ 	struct stat sb;
+ 	BTMETA m;
+@@ -353,8 +351,7 @@ err:	if (t) {
+  *	RET_ERROR, RET_SUCCESS
+  */
+ static int
+-nroot(t)
+-	BTREE *t;
++nroot(BTREE *t)
+ {
+ 	PAGE *meta, *root;
+ 	db_pgno_t npg;
+@@ -459,8 +456,7 @@ byteorder()
+ }
+ 
+ int
+-__bt_fd(dbp)
+-        const DB *dbp;
++__bt_fd(const DB *dbp)
+ {
+ 	BTREE *t;
+ 
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_overflow.c b/src/plugins/kdb/db2/libdb2/btree/bt_overflow.c
+index 8b1f597912..8301b5d19d 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_overflow.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_overflow.c
+@@ -77,12 +77,7 @@ static char sccsid[] = "@(#)bt_overflow.c	8.5 (Berkeley) 7/16/94";
+  *	RET_ERROR, RET_SUCCESS
+  */
+ int
+-__ovfl_get(t, p, ssz, buf, bufsz)
+-	BTREE *t;
+-	void *p;
+-	size_t *ssz;
+-	void **buf;
+-	size_t *bufsz;
++__ovfl_get(BTREE *t, void *p, size_t *ssz, void **buf, size_t *bufsz)
+ {
+ 	PAGE *h;
+ 	db_pgno_t pg;
+@@ -136,10 +131,7 @@ __ovfl_get(t, p, ssz, buf, bufsz)
+  *	RET_ERROR, RET_SUCCESS
+  */
+ int
+-__ovfl_put(t, dbt, pg)
+-	BTREE *t;
+-	const DBT *dbt;
+-	db_pgno_t *pg;
++__ovfl_put(BTREE *t, const DBT *dbt, db_pgno_t *pg)
+ {
+ 	PAGE *h, *last;
+ 	void *p;
+@@ -190,9 +182,7 @@ __ovfl_put(t, dbt, pg)
+  *	RET_ERROR, RET_SUCCESS
+  */
+ int
+-__ovfl_delete(t, p)
+-	BTREE *t;
+-	void *p;
++__ovfl_delete(BTREE *t, void *p)
+ {
+ 	PAGE *h;
+ 	db_pgno_t pg;
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_page.c b/src/plugins/kdb/db2/libdb2/btree/bt_page.c
+index 3663cf7f93..38aa39acfb 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_page.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_page.c
+@@ -57,9 +57,7 @@ static char sccsid[] = "@(#)bt_page.c	8.4 (Berkeley) 11/2/95";
+  *	mpool_put's the page.
+  */
+ int
+-__bt_free(t, h)
+-	BTREE *t;
+-	PAGE *h;
++__bt_free(BTREE *t, PAGE *h)
+ {
+ 	/* Insert the page at the head of the free list. */
+ 	h->prevpg = P_INVALID;
+@@ -83,9 +81,7 @@ __bt_free(t, h)
+  *	Pointer to a page, NULL on error.
+  */
+ PAGE *
+-__bt_new(t, npg)
+-	BTREE *t;
+-	db_pgno_t *npg;
++__bt_new(BTREE *t, db_pgno_t *npg)
+ {
+ 	PAGE *h;
+ 
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_put.c b/src/plugins/kdb/db2/libdb2/btree/bt_put.c
+index 7d6592841a..1303c0baef 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_put.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_put.c
+@@ -64,11 +64,7 @@ static EPG *bt_fast __P((BTREE *, const DBT *, const DBT *, int *));
+  *	tree and R_NOOVERWRITE specified.
+  */
+ int
+-__bt_put(dbp, key, data, flags)
+-	const DB *dbp;
+-	DBT *key;
+-	const DBT *data;
+-	u_int flags;
++__bt_put(const DB *dbp, DBT *key, const DBT *data, u_int flags)
+ {
+ 	BTREE *t;
+ 	DBT tkey, tdata;
+@@ -272,10 +268,7 @@ u_long bt_cache_hit, bt_cache_miss;
+  * 	EPG for new record or NULL if not found.
+  */
+ static EPG *
+-bt_fast(t, key, data, exactp)
+-	BTREE *t;
+-	const DBT *key, *data;
+-	int *exactp;
++bt_fast(BTREE *t, const DBT *key, const DBT *data, int *exactp)
+ {
+ 	PAGE *h;
+ 	u_int32_t nbytes;
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_search.c b/src/plugins/kdb/db2/libdb2/btree/bt_search.c
+index c633d14dc6..ed512ccb65 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_search.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_search.c
+@@ -63,10 +63,7 @@ static int __bt_sprev __P((BTREE *, PAGE *, const DBT *, int *));
+  *	the bt_cur field of the tree.  A pointer to the field is returned.
+  */
+ EPG *
+-__bt_search(t, key, exactp)
+-	BTREE *t;
+-	const DBT *key;
+-	int *exactp;
++__bt_search(BTREE *t, const DBT *key, int *exactp)
+ {
+ 	PAGE *h;
+ 	indx_t base, idx, lim;
+@@ -148,11 +145,7 @@ next:		BT_PUSH(t, h->pgno, idx);
+  *	If an exact match found.
+  */
+ static int
+-__bt_snext(t, h, key, exactp)
+-	BTREE *t;
+-	PAGE *h;
+-	const DBT *key;
+-	int *exactp;
++__bt_snext(BTREE *t, PAGE *h, const DBT *key, int *exactp)
+ {
+ 	BINTERNAL *bi;
+ 	EPG e;
+@@ -228,11 +221,7 @@ __bt_snext(t, h, key, exactp)
+  *	If an exact match found.
+  */
+ static int
+-__bt_sprev(t, h, key, exactp)
+-	BTREE *t;
+-	PAGE *h;
+-	const DBT *key;
+-	int *exactp;
++__bt_sprev(BTREE *t, PAGE *h, const DBT *key, int *exactp)
+ {
+ 	BINTERNAL *bi;
+ 	EPG e;
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_seq.c b/src/plugins/kdb/db2/libdb2/btree/bt_seq.c
+index 2c8c2de96c..97db44abc8 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_seq.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_seq.c
+@@ -102,10 +102,7 @@ static int bt_rseq_prev(BTREE *, EPG *);
+  *	RET_ERROR, RET_SUCCESS or RET_SPECIAL if there's no next key.
+  */
+ int
+-__bt_seq(dbp, key, data, flags)
+-	const DB *dbp;
+-	DBT *key, *data;
+-	u_int flags;
++__bt_seq(const DB *dbp, DBT *key, DBT *data, u_int flags)
+ {
+ 	BTREE *t;
+ 	EPG e;
+@@ -179,11 +176,7 @@ __bt_seq(dbp, key, data, flags)
+  *	RET_ERROR, RET_SUCCESS or RET_SPECIAL if there's no next key.
+  */
+ static int
+-__bt_seqset(t, ep, key, flags)
+-	BTREE *t;
+-	EPG *ep;
+-	DBT *key;
+-	int flags;
++__bt_seqset(BTREE *t, EPG *ep, DBT *key, int flags)
+ {
+ 	PAGE *h;
+ 	db_pgno_t pg;
+@@ -273,10 +266,7 @@ __bt_seqset(t, ep, key, flags)
+  *	RET_ERROR, RET_SUCCESS or RET_SPECIAL if there's no next key.
+  */
+ static int
+-__bt_seqadv(t, ep, flags)
+-	BTREE *t;
+-	EPG *ep;
+-	int flags;
++__bt_seqadv(BTREE *t, EPG *ep, int flags)
+ {
+ 	CURSOR *c;
+ 	PAGE *h;
+@@ -495,11 +485,7 @@ bt_rseq_prev(BTREE *t, EPG *ep)
+  *	or RET_SPECIAL if no such key exists.
+  */
+ static int
+-__bt_first(t, key, erval, exactp)
+-	BTREE *t;
+-	const DBT *key;
+-	EPG *erval;
+-	int *exactp;
++__bt_first(BTREE *t, const DBT *key, EPG *erval, int *exactp)
+ {
+ 	PAGE *h, *hprev;
+ 	EPG *ep, save;
+@@ -596,10 +582,7 @@ __bt_first(t, key, erval, exactp)
+  *  index:	page index
+  */
+ void
+-__bt_setcur(t, pgno, idx)
+-	BTREE *t;
+-	db_pgno_t pgno;
+-	u_int idx;
++__bt_setcur(BTREE *t, db_pgno_t pgno, u_int idx)
+ {
+ 	/* Lose any already deleted key. */
+ 	if (t->bt_cursor.key.data != NULL) {
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_split.c b/src/plugins/kdb/db2/libdb2/btree/bt_split.c
+index c7e4e72a90..8901bd64be 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_split.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_split.c
+@@ -79,13 +79,8 @@ u_long	bt_rootsplit, bt_split, bt_sortsplit, bt_pfxsaved;
+  *	RET_ERROR, RET_SUCCESS
+  */
+ int
+-__bt_split(t, sp, key, data, flags, ilen, argskip)
+-	BTREE *t;
+-	PAGE *sp;
+-	const DBT *key, *data;
+-	int flags;
+-	size_t ilen;
+-	u_int32_t argskip;
++__bt_split(BTREE *t, PAGE *sp, const DBT *key, const DBT *data, int flags,
++	   size_t ilen, u_int32_t argskip)
+ {
+ 	BINTERNAL *bi = NULL;
+ 	BLEAF *bl = NULL, *tbl;
+@@ -345,11 +340,7 @@ err2:	mpool_put(t->bt_mp, l, 0);
+  *	Pointer to page in which to insert or NULL on error.
+  */
+ static PAGE *
+-bt_page(t, h, lp, rp, skip, ilen)
+-	BTREE *t;
+-	PAGE *h, **lp, **rp;
+-	indx_t *skip;
+-	size_t ilen;
++bt_page(BTREE *t, PAGE *h, PAGE **lp, PAGE **rp, indx_t *skip, size_t ilen)
+ {
+ 	PAGE *l, *r, *tp;
+ 	db_pgno_t npg;
+@@ -450,11 +441,7 @@ bt_page(t, h, lp, rp, skip, ilen)
+  *	Pointer to page in which to insert or NULL on error.
+  */
+ static PAGE *
+-bt_root(t, h, lp, rp, skip, ilen)
+-	BTREE *t;
+-	PAGE *h, **lp, **rp;
+-	indx_t *skip;
+-	size_t ilen;
++bt_root(BTREE *t, PAGE *h, PAGE **lp, PAGE **rp, indx_t *skip, size_t ilen)
+ {
+ 	PAGE *l, *r, *tp;
+ 	db_pgno_t lnpg, rnpg;
+@@ -497,9 +484,7 @@ bt_root(t, h, lp, rp, skip, ilen)
+  *	RET_ERROR, RET_SUCCESS
+  */
+ static int
+-bt_rroot(t, h, l, r)
+-	BTREE *t;
+-	PAGE *h, *l, *r;
++bt_rroot(BTREE *t, PAGE *h, PAGE *l, PAGE *r)
+ {
+ 	char *dest;
+ 
+@@ -537,9 +522,7 @@ bt_rroot(t, h, l, r)
+  *	RET_ERROR, RET_SUCCESS
+  */
+ static int
+-bt_broot(t, h, l, r)
+-	BTREE *t;
+-	PAGE *h, *l, *r;
++bt_broot(BTREE *t, PAGE *h, PAGE *l, PAGE *r)
+ {
+ 	BINTERNAL *bi;
+ 	BLEAF *bl;
+@@ -617,11 +600,7 @@ bt_broot(t, h, l, r)
+  *	Pointer to page in which to insert.
+  */
+ static PAGE *
+-bt_psplit(t, h, l, r, pskip, ilen)
+-	BTREE *t;
+-	PAGE *h, *l, *r;
+-	indx_t *pskip;
+-	size_t ilen;
++bt_psplit(BTREE *t, PAGE *h, PAGE *l, PAGE *r, indx_t *pskip, size_t ilen)
+ {
+ 	BINTERNAL *bi;
+ 	BLEAF *bl;
+@@ -796,9 +775,7 @@ bt_psplit(t, h, l, r, pskip, ilen)
+  *	RET_SUCCESS, RET_ERROR.
+  */
+ static int
+-bt_preserve(t, pg)
+-	BTREE *t;
+-	db_pgno_t pg;
++bt_preserve(BTREE *t, db_pgno_t pg)
+ {
+ 	PAGE *h;
+ 
+@@ -824,8 +801,7 @@ bt_preserve(t, pg)
+  * all the way back to bt_split/bt_rroot and it's not very clean.
+  */
+ static recno_t
+-rec_total(h)
+-	PAGE *h;
++rec_total(PAGE *h)
+ {
+ 	recno_t recs;
+ 	indx_t nxt, top;
+diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_utils.c b/src/plugins/kdb/db2/libdb2/btree/bt_utils.c
+index be2f24f219..13d1f2c84f 100644
+--- a/src/plugins/kdb/db2/libdb2/btree/bt_utils.c
++++ b/src/plugins/kdb/db2/libdb2/btree/bt_utils.c
+@@ -64,11 +64,8 @@ static char sccsid[] = "@(#)bt_utils.c	8.8 (Berkeley) 7/20/94";
+  *	RET_SUCCESS, RET_ERROR.
+  */
+ int
+-__bt_ret(t, e, key, rkey, data, rdata, copy)
+-	BTREE *t;
+-	EPG *e;
+-	DBT *key, *rkey, *data, *rdata;
+-	int copy;
++__bt_ret(BTREE *t, EPG *e, DBT *key, DBT *rkey, DBT *data, DBT *rdata,
++	 int copy)
+ {
+ 	BLEAF *bl;
+ 	void *p;
+@@ -150,10 +147,7 @@ dataonly:
+  *	> 0 if k1 is > record
+  */
+ int
+-__bt_cmp(t, k1, e)
+-	BTREE *t;
+-	const DBT *k1;
+-	EPG *e;
++__bt_cmp(BTREE *t, const DBT *k1, EPG *e)
+ {
+ 	BINTERNAL *bi;
+ 	BLEAF *bl;
+@@ -213,8 +207,7 @@ __bt_cmp(t, k1, e)
+  *	> 0 if a is > b
+  */
+ int
+-__bt_defcmp(a, b)
+-	const DBT *a, *b;
++__bt_defcmp(const DBT *a, const DBT *b)
+ {
+ 	size_t len;
+ 	u_char *p1, *p2;
+@@ -243,8 +236,7 @@ __bt_defcmp(a, b)
+  *	Number of bytes needed to distinguish b from a.
+  */
+ size_t
+-__bt_defpfx(a, b)
+-	const DBT *a, *b;
++__bt_defpfx(const DBT *a, const DBT *b)
+ {
+ 	u_char *p1, *p2;
+ 	size_t cnt, len;
+diff --git a/src/plugins/kdb/db2/libdb2/db/db.c b/src/plugins/kdb/db2/libdb2/db/db.c
+index fba7795342..f85484f077 100644
+--- a/src/plugins/kdb/db2/libdb2/db/db.c
++++ b/src/plugins/kdb/db2/libdb2/db/db.c
+@@ -45,11 +45,8 @@ static char sccsid[] = "@(#)db.c	8.4 (Berkeley) 2/21/94";
+ #include "db-int.h"
+ 
+ DB *
+-kdb2_dbopen(fname, flags, mode, type, openinfo)
+-	const char *fname;
+-	int flags, mode;
+-	DBTYPE type;
+-	const void *openinfo;
++kdb2_dbopen(const char *fname, int flags, int mode, DBTYPE type,
++	    const void *openinfo)
+ {
+ 
+ #define	DB_FLAGS	(DB_LOCK | DB_SHMEM | DB_TXN)
+@@ -74,7 +71,7 @@ kdb2_dbopen(fname, flags, mode, type, openinfo)
+ }
+ 
+ static int
+-__dberr()
++__dberr(void)
+ {
+ 	return (RET_ERROR);
+ }
+@@ -86,14 +83,15 @@ __dberr()
+  *	dbp:	pointer to the DB structure.
+  */
+ void
+-__dbpanic(dbp)
+-	DB *dbp;
++__dbpanic(DB *dbp)
+ {
+ 	/* The only thing that can succeed is a close. */
+-	dbp->del = (int (*)())__dberr;
+-	dbp->fd = (int (*)())__dberr;
+-	dbp->get = (int (*)())__dberr;
+-	dbp->put = (int (*)())__dberr;
+-	dbp->seq = (int (*)())__dberr;
+-	dbp->sync = (int (*)())__dberr;
++	dbp->del = (int (*)(const struct __db *, const DBT *, u_int))__dberr;
++	dbp->fd = (int (*)(const struct __db *))__dberr;
++	dbp->get = (int (*)(const struct __db *, const DBT *, DBT *,
++			    u_int))__dberr;
++	dbp->put = (int (*)(const struct __db *, DBT *, const DBT *,
++			    u_int))__dberr;
++	dbp->seq = (int (*)(const struct __db *, DBT *, DBT *, u_int))__dberr;
++	dbp->sync = (int (*)(const struct __db *, u_int))__dberr;
+ }
+diff --git a/src/plugins/kdb/db2/libdb2/hash/dbm.c b/src/plugins/kdb/db2/libdb2/hash/dbm.c
+index 4878cbc0b6..2dca256dc3 100644
+--- a/src/plugins/kdb/db2/libdb2/hash/dbm.c
++++ b/src/plugins/kdb/db2/libdb2/hash/dbm.c
+@@ -69,8 +69,7 @@ static DBM *__cur_db;
+ static void no_open_db __P((void));
+ 
+ int
+-kdb2_dbminit(file)
+-	char *file;
++kdb2_dbminit(char *file)
+ {
+ 	if (__cur_db != NULL)
+ 		(void)kdb2_dbm_close(__cur_db);
+@@ -82,8 +81,7 @@ kdb2_dbminit(file)
+ }
+ 
+ datum
+-kdb2_fetch(key)
+-	datum key;
++kdb2_fetch(datum key)
+ {
+ 	datum item;
+ 
+@@ -111,8 +109,7 @@ kdb2_firstkey()
+ }
+ 
+ datum
+-kdb2_nextkey(key)
+-	datum key;
++kdb2_nextkey(datum key)
+ {
+ 	datum item;
+ 
+@@ -126,8 +123,7 @@ kdb2_nextkey(key)
+ }
+ 
+ int
+-kdb2_delete(key)
+-	datum key;
++kdb2_delete(datum key)
+ {
+ 	if (__cur_db == NULL) {
+ 		no_open_db();
+@@ -137,8 +133,7 @@ kdb2_delete(key)
+ }
+ 
+ int
+-kdb2_store(key, dat)
+-	datum key, dat;
++kdb2_store(datum key, datum dat)
+ {
+ 	if (__cur_db == NULL) {
+ 		no_open_db();
+@@ -159,9 +154,7 @@ no_open_db()
+  *	 NULL on failure
+  */
+ DBM *
+-kdb2_dbm_open(file, flags, mode)
+-	const char *file;
+-	int flags, mode;
++kdb2_dbm_open(const char *file, int flags, int mode)
+ {
+ 	HASHINFO info;
+ 	char path[MAXPATHLEN];
+@@ -183,8 +176,7 @@ kdb2_dbm_open(file, flags, mode)
+  *	Nothing.
+  */
+ void
+-kdb2_dbm_close(db)
+-	DBM *db;
++kdb2_dbm_close(DBM *db)
+ {
+ 	(void)(db->close)(db);
+ }
+@@ -195,9 +187,7 @@ kdb2_dbm_close(db)
+  *	NULL on failure
+  */
+ datum
+-kdb2_dbm_fetch(db, key)
+-	DBM *db;
+-	datum key;
++kdb2_dbm_fetch(DBM *db, datum key)
+ {
+ 	datum retval;
+ 	int status;
+@@ -226,8 +216,7 @@ kdb2_dbm_fetch(db, key)
+  *	NULL on failure
+  */
+ datum
+-kdb2_dbm_firstkey(db)
+-	DBM *db;
++kdb2_dbm_firstkey(DBM *db)
+ {
+ 	int status;
+ 	datum retkey;
+@@ -254,8 +243,7 @@ kdb2_dbm_firstkey(db)
+  *	NULL on failure
+  */
+ datum
+-kdb2_dbm_nextkey(db)
+-	DBM *db;
++kdb2_dbm_nextkey(DBM *db)
+ {
+ 	int status;
+ 	datum retkey;
+@@ -282,9 +270,7 @@ kdb2_dbm_nextkey(db)
+  *	<0 failure
+  */
+ int
+-kdb2_dbm_delete(db, key)
+-	DBM *db;
+-	datum key;
++kdb2_dbm_delete(DBM *db, datum key)
+ {
+ 	int status;
+ 
+@@ -310,10 +296,7 @@ kdb2_dbm_delete(db, key)
+  *	 1 if DBM_INSERT and entry exists
+  */
+ int
+-kdb2_dbm_store(db, key, content, flags)
+-	DBM *db;
+-	datum key, content;
+-	int flags;
++kdb2_dbm_store(DBM *db, datum key, datum content, int flags)
+ {
+ #ifdef NEED_COPY
+ 	DBT k, c;
+@@ -331,8 +314,7 @@ kdb2_dbm_store(db, key, content, flags)
+ }
+ 
+ int
+-kdb2_dbm_error(db)
+-	DBM *db;
++kdb2_dbm_error(DBM *db)
+ {
+ 	HTAB *hp;
+ 
+@@ -341,8 +323,7 @@ kdb2_dbm_error(db)
+ }
+ 
+ int
+-kdb2_dbm_clearerr(db)
+-	DBM *db;
++kdb2_dbm_clearerr(DBM *db)
+ {
+ 	HTAB *hp;
+ 
+@@ -352,8 +333,7 @@ kdb2_dbm_clearerr(db)
+ }
+ 
+ int
+-kdb2_dbm_dirfno(db)
+-	DBM *db;
++kdb2_dbm_dirfno(DBM *db)
+ {
+ 	return(((HTAB *)db->internal)->fp);
+ }
+diff --git a/src/plugins/kdb/db2/libdb2/hash/hash.c b/src/plugins/kdb/db2/libdb2/hash/hash.c
+index 686a960c96..9528b62538 100644
+--- a/src/plugins/kdb/db2/libdb2/hash/hash.c
++++ b/src/plugins/kdb/db2/libdb2/hash/hash.c
+@@ -95,10 +95,8 @@ u_int32_t hash_accesses, hash_collisions, hash_expansions, hash_overflows,
+ /* OPEN/CLOSE */
+ 
+ extern DB *
+-__kdb2_hash_open(file, flags, mode, info, dflags)
+-	const char *file;
+-	int flags, mode, dflags;
+-	const HASHINFO *info;	/* Special directives for create */
++__kdb2_hash_open(const char *file, int flags, int mode, const HASHINFO *info,
++		 int dflags)
+ {
+ 	struct stat statbuf;
+ 	DB *dbp;
+@@ -261,8 +259,7 @@ error0:
+ }
+ 
+ static int32_t
+-hash_close(dbp)
+-	DB *dbp;
++hash_close(DB *dbp)
+ {
+ 	HTAB *hashp;
+ 	int32_t retval;
+@@ -277,8 +274,7 @@ hash_close(dbp)
+ }
+ 
+ static int32_t
+-hash_fd(dbp)
+-	const DB *dbp;
++hash_fd(const DB *dbp)
+ {
+ 	HTAB *hashp;
+ 
+@@ -295,10 +291,7 @@ hash_fd(dbp)
+ 
+ /************************** LOCAL CREATION ROUTINES **********************/
+ static HTAB *
+-init_hash(hashp, file, info)
+-	HTAB *hashp;
+-	const char *file;
+-	const HASHINFO *info;
++init_hash(HTAB *hashp, const char *file, const HASHINFO *info)
+ {
+ 	struct stat statbuf;
+ 
+@@ -350,9 +343,7 @@ init_hash(hashp, file, info)
+  * Returns 0 on No Error
+  */
+ static int32_t
+-init_htab(hashp, nelem)
+-	HTAB *hashp;
+-	int32_t nelem;
++init_htab(HTAB *hashp, int32_t nelem)
+ {
+ 	int32_t l2, nbuckets;
+ 
+@@ -404,9 +395,7 @@ init_htab(hashp, nelem)
+  * Functions to get/put hash header.  We access the file directly.
+  */
+ static u_int32_t
+-hget_header(hashp, page_size)
+-	HTAB *hashp;
+-	u_int32_t page_size;
++hget_header(HTAB *hashp, u_int32_t page_size)
+ {
+ 	u_int32_t num_copied;
+ 	u_int8_t *hdr_dest;
+@@ -432,8 +421,7 @@ hget_header(hashp, page_size)
+ }
+ 
+ static void
+-hput_header(hashp)
+-	HTAB *hashp;
++hput_header(HTAB *hashp)
+ {
+ 	HASHHDR *whdrp;
+ #if DB_BYTE_ORDER == DB_LITTLE_ENDIAN
+@@ -463,8 +451,7 @@ hput_header(hashp)
+  * structure, freeing all allocated space.
+  */
+ static int32_t
+-hdestroy(hashp)
+-	HTAB *hashp;
++hdestroy(HTAB *hashp)
+ {
+ 	int32_t save_errno;
+ 
+@@ -550,9 +537,7 @@ hdestroy(hashp)
+  *	-1 ERROR
+  */
+ static int32_t
+-hash_sync(dbp, flags)
+-	const DB *dbp;
+-	u_int32_t flags;
++hash_sync(const DB *dbp, u_int32_t flags)
+ {
+ 	HTAB *hashp;
+ 
+@@ -571,8 +556,7 @@ hash_sync(dbp, flags)
+  *	-1 indicates that errno should be set
+  */
+ static int32_t
+-flush_meta(hashp)
+-	HTAB *hashp;
++flush_meta(HTAB *hashp)
+ {
+ 	int32_t i;
+ 
+@@ -608,11 +592,7 @@ flush_meta(hashp)
+ /* *** make sure this is true! */
+ 
+ static int32_t
+-hash_get(dbp, key, data, flag)
+-	const DB *dbp;
+-	const DBT *key;
+-	DBT *data;
+-	u_int32_t flag;
++hash_get(const DB *dbp, const DBT *key, DBT *data, u_int32_t flag)
+ {
+ 	HTAB *hashp;
+ 
+@@ -625,11 +605,7 @@ hash_get(dbp, key, data, flag)
+ }
+ 
+ static int32_t
+-hash_put(dbp, key, data, flag)
+-	const DB *dbp;
+-	DBT *key;
+-	const DBT *data;
+-	u_int32_t flag;
++hash_put(const DB *dbp, DBT *key, const DBT *data, u_int32_t flag)
+ {
+ 	HTAB *hashp;
+ 
+@@ -647,10 +623,7 @@ hash_put(dbp, key, data, flag)
+ }
+ 
+ static int32_t
+-hash_delete(dbp, key, flag)
+-	const DB *dbp;
+-	const DBT *key;
+-	u_int32_t flag;		/* Ignored */
++hash_delete(const DB *dbp, const DBT *key, u_int32_t flag)
+ {
+ 	HTAB *hashp;
+ 
+@@ -671,11 +644,7 @@ hash_delete(dbp, key, flag)
+  * Assume that hashp has been set in wrapper routine.
+  */
+ static int32_t
+-hash_access(hashp, action, key, val)
+-	HTAB *hashp;
+-	ACTION action;
+-	const DBT *key;
+-	DBT *val;
++hash_access(HTAB *hashp, ACTION action, const DBT *key, DBT *val)
+ {
+ 	DBT page_key, page_val;
+ 	CURSOR cursor;
+@@ -792,8 +761,7 @@ found:	__get_item_done(hashp, &cursor);
+ 
+ /* ****************** CURSORS ********************************** */
+ CURSOR *
+-__cursor_creat(dbp)
+-	const DB *dbp;
++__cursor_creat(const DB *dbp)
+ {
+ 	CURSOR *new_curs;
+ 	HTAB *hashp;
+@@ -824,11 +792,7 @@ __cursor_creat(dbp)
+ }
+ 
+ static int32_t
+-cursor_get(dbp, cursorp, key, val, flags)
+-	const DB *dbp;
+-	CURSOR *cursorp;
+-	DBT *key, *val;
+-	u_int32_t flags;
++cursor_get(const DB *dbp, CURSOR *cursorp, DBT *key, DBT *val, u_int32_t flags)
+ {
+ 	HTAB *hashp;
+ 	ITEM_INFO item_info;
+@@ -897,10 +861,7 @@ cursor_get(dbp, cursorp, key, val, flags)
+ }
+ 
+ static int32_t
+-cursor_delete(dbp, cursor, flags)
+-	const DB *dbp;
+-	CURSOR *cursor;
+-	u_int32_t flags;
++cursor_delete(const DB *dbp, CURSOR *cursor, u_int32_t flags)
+ {
+ 	/* XXX this is empirically determined, so it might not be completely
+ 	   correct, but it seems to work.  At the very least it fixes
+@@ -913,10 +874,7 @@ cursor_delete(dbp, cursor, flags)
+ }
+ 
+ static int32_t
+-hash_seq(dbp, key, val, flag)
+-	const DB *dbp;
+-	DBT *key, *val;
+-	u_int32_t flag;
++hash_seq(const DB *dbp, DBT *key, DBT *val, u_int32_t flag)
+ {
+ 	HTAB *hashp;
+ 
+@@ -940,8 +898,7 @@ hash_seq(dbp, key, val, flag)
+  *	-1 ==> Error
+  */
+ int32_t
+-__expand_table(hashp)
+-	HTAB *hashp;
++__expand_table(HTAB *hashp)
+ {
+ 	u_int32_t old_bucket, new_bucket;
+ 	int32_t spare_ndx;
+@@ -980,10 +937,7 @@ __expand_table(hashp)
+ }
+ 
+ u_int32_t
+-__call_hash(hashp, k, len)
+-	HTAB *hashp;
+-	int8_t *k;
+-	int32_t len;
++__call_hash(HTAB *hashp, int8_t *k, int32_t len)
+ {
+ 	u_int32_t n, bucket;
+ 
+@@ -999,8 +953,7 @@ __call_hash(hashp, k, len)
+  * Hashp->hdr needs to be byteswapped.
+  */
+ static void
+-swap_header_copy(srcp, destp)
+-	HASHHDR *srcp, *destp;
++swap_header_copy(HASHHDR *srcp, HASHHDR *destp)
+ {
+ 	int32_t i;
+ 
+@@ -1025,8 +978,7 @@ swap_header_copy(srcp, destp)
+ }
+ 
+ static void
+-swap_header(hashp)
+-	HTAB *hashp;
++swap_header(HTAB *hashp)
+ {
+ 	HASHHDR *hdrp;
+ 	int32_t i;
+diff --git a/src/plugins/kdb/db2/libdb2/hash/hash_bigkey.c b/src/plugins/kdb/db2/libdb2/hash/hash_bigkey.c
+index 4b95278f53..6befb7a57e 100644
+--- a/src/plugins/kdb/db2/libdb2/hash/hash_bigkey.c
++++ b/src/plugins/kdb/db2/libdb2/hash/hash_bigkey.c
+@@ -83,10 +83,7 @@ static int32_t collect_data __P((HTAB *, PAGE16 *, int32_t));
+  *	-1 ==> ERROR
+  */
+ int32_t
+-__big_insert(hashp, pagep, key, val)
+-	HTAB *hashp;
+-	PAGE16 *pagep;
+-	const DBT *key, *val;
++__big_insert(HTAB *hashp, PAGE16 *pagep, const DBT *key, const DBT *val)
+ {
+ 	size_t  key_size, val_size;
+ 	indx_t  key_move_bytes, val_move_bytes;
+@@ -185,11 +182,7 @@ __big_delete(hashp, pagep, ndx)
+  *	-1 error
+  */
+ int32_t
+-__find_bigpair(hashp, cursorp, key, size)
+-	HTAB *hashp;
+-	CURSOR *cursorp;
+-	int8_t *key;
+-	int32_t size;
++__find_bigpair(HTAB *hashp, CURSOR *cursorp, int8_t *key, int32_t size)
+ {
+ 	PAGE16 *pagep, *hold_pagep;
+ 	db_pgno_t  next_pgno;
+@@ -257,11 +250,7 @@ __find_bigpair(hashp, cursorp, key, size)
+  * Fill in the key and data for this big pair.
+  */
+ int32_t
+-__big_keydata(hashp, pagep, key, val, ndx)
+-	HTAB *hashp;
+-	PAGE16 *pagep;
+-	DBT *key, *val;
+-	int32_t ndx;
++__big_keydata(HTAB *hashp, PAGE16 *pagep, DBT *key, DBT *val, int32_t ndx)
+ {
+ 	ITEM_INFO ii;
+ 	PAGE16 *key_pagep;
+@@ -315,11 +304,8 @@ __get_bigkey(hashp, pagep, ndx, key)
+  * Return the big key and data indicated in item_info.
+  */
+ int32_t
+-__big_return(hashp, item_info, val, on_bigkey_page)
+-	HTAB *hashp;
+-	ITEM_INFO *item_info;
+-	DBT *val;
+-	int32_t on_bigkey_page;
++__big_return(HTAB *hashp, ITEM_INFO *item_info, DBT *val,
++	     int32_t on_bigkey_page)
+ {
+ 	PAGE16 *pagep;
+ 	db_pgno_t next_pgno;
+@@ -366,11 +352,7 @@ __big_return(hashp, item_info, val, on_bigkey_page)
+  * Return total length of data; -1 if error.
+  */
+ static int32_t
+-collect_key(hashp, pagep, len, last_page)
+-	HTAB *hashp;
+-	PAGE16 *pagep;
+-	int32_t len;
+-	db_pgno_t *last_page;
++collect_key(HTAB *hashp, PAGE16 *pagep, int32_t len, db_pgno_t *last_page)
+ {
+ 	PAGE16 *next_pagep;
+ 	int32_t totlen, retval;
+@@ -434,10 +416,7 @@ collect_key(hashp, pagep, len, last_page)
+  * Return total length of data; -1 if error.
+  */
+ static int32_t
+-collect_data(hashp, pagep, len)
+-	HTAB *hashp;
+-	PAGE16 *pagep;
+-	int32_t len;
++collect_data(HTAB *hashp, PAGE16 *pagep, int32_t len)
+ {
+ 	PAGE16 *next_pagep;
+ 	int32_t totlen, retval;
+diff --git a/src/plugins/kdb/db2/libdb2/hash/hash_func.c b/src/plugins/kdb/db2/libdb2/hash/hash_func.c
+index 1dee694608..f169be685e 100644
+--- a/src/plugins/kdb/db2/libdb2/hash/hash_func.c
++++ b/src/plugins/kdb/db2/libdb2/hash/hash_func.c
+@@ -66,9 +66,7 @@ u_int32_t (*__default_hash) __P((const void *, size_t)) = hash4;
+ 
+ #if 0
+ static u_int32_t
+-hash1(key, len)
+-	const void *key;
+-	size_t len;
++hash1(const void *key, size_t len)
+ {
+ 	u_int32_t h;
+ 	u_int8_t *k;
+@@ -88,9 +86,7 @@ hash1(key, len)
+ #define dcharhash(h, c)	((h) = 0x63c63cd9*(h) + 0x9c39c33d + (c))
+ 
+ static u_int32_t
+-hash2(key, len)
+-	const void *key;
+-	size_t len;
++hash2(const void *key, size_t len)
+ {
+ 	u_int32_t h;
+ 	u_int8_t *e, c, *k;
+@@ -116,9 +112,7 @@ hash2(key, len)
+  * Ozan Yigit's original sdbm hash.
+  */
+ static u_int32_t
+-hash3(key, len)
+-	const void *key;
+-	size_t len;
++hash3(const void *key, size_t len)
+ {
+ 	u_int32_t n, loop;
+ 	u_int8_t *k;
+@@ -159,9 +153,7 @@ hash3(key, len)
+ 
+ /* Chris Torek's hash function. */
+ static u_int32_t
+-hash4(key, len)
+-	const void *key;
+-	size_t len;
++hash4(const void *key, size_t len)
+ {
+ 	u_int32_t h, loop;
+ 	const u_int8_t *k;
+diff --git a/src/plugins/kdb/db2/libdb2/hash/hash_log2.c b/src/plugins/kdb/db2/libdb2/hash/hash_log2.c
+index 8c710e5d21..7fdfd854d2 100644
+--- a/src/plugins/kdb/db2/libdb2/hash/hash_log2.c
++++ b/src/plugins/kdb/db2/libdb2/hash/hash_log2.c
+@@ -44,8 +44,7 @@ static char sccsid[] = "@(#)hash_log2.c	8.4 (Berkeley) 11/7/95";
+ #include "extern.h"
+ 
+ u_int32_t
+-__kdb2_log2(num)
+-	u_int32_t num;
++__kdb2_log2(u_int32_t num)
+ {
+ 	u_int32_t i, limit;
+ 
+diff --git a/src/plugins/kdb/db2/libdb2/hash/hash_page.c b/src/plugins/kdb/db2/libdb2/hash/hash_page.c
+index 0da357108a..dba29e0cb5 100644
+--- a/src/plugins/kdb/db2/libdb2/hash/hash_page.c
++++ b/src/plugins/kdb/db2/libdb2/hash/hash_page.c
+@@ -84,11 +84,8 @@ static void	 account_page(HTAB *, db_pgno_t, int);
+ #endif
+ 
+ u_int32_t
+-__get_item(hashp, cursorp, key, val, item_info)
+-	HTAB *hashp;
+-	CURSOR *cursorp;
+-	DBT *key, *val;
+-	ITEM_INFO *item_info;
++__get_item(HTAB *hashp, CURSOR *cursorp, DBT *key, DBT *val,
++	   ITEM_INFO *item_info)
+ {
+ 	db_pgno_t next_pgno;
+ 	int32_t i;
+@@ -159,9 +156,7 @@ __get_item(hashp, cursorp, key, val, item_info)
+ }
+ 
+ u_int32_t
+-__get_item_reset(hashp, cursorp)
+-	HTAB *hashp;
+-	CURSOR *cursorp;
++__get_item_reset(HTAB *hashp, CURSOR *cursorp)
+ {
+ 	if (cursorp->pagep)
+ 		__put_page(hashp, cursorp->pagep, A_RAW, 0);
+@@ -174,9 +169,7 @@ __get_item_reset(hashp, cursorp)
+ }
+ 
+ u_int32_t
+-__get_item_done(hashp, cursorp)
+-	HTAB *hashp;
+-	CURSOR *cursorp;
++__get_item_done(HTAB *hashp, CURSOR *cursorp)
+ {
+ 	if (cursorp->pagep)
+ 		__put_page(hashp, cursorp->pagep, A_RAW, 0);
+@@ -190,11 +183,8 @@ __get_item_done(hashp, cursorp)
+ }
+ 
+ u_int32_t
+-__get_item_first(hashp, cursorp, key, val, item_info)
+-	HTAB *hashp;
+-	CURSOR *cursorp;
+-	DBT *key, *val;
+-	ITEM_INFO *item_info;
++__get_item_first(HTAB *hashp, CURSOR *cursorp, DBT *key, DBT *val,
++		 ITEM_INFO *item_info)
+ {
+ 	__get_item_reset(hashp, cursorp);
+ 	cursorp->bucket = 0;
+@@ -206,11 +196,8 @@ __get_item_first(hashp, cursorp, key, val, item_info)
+  * just returns the page number and index of the bigkey pointer pair.
+  */
+ u_int32_t
+-__get_item_next(hashp, cursorp, key, val, item_info)
+-	HTAB *hashp;
+-	CURSOR *cursorp;
+-	DBT *key, *val;
+-	ITEM_INFO *item_info;
++__get_item_next(HTAB *hashp, CURSOR *cursorp, DBT *key, DBT *val,
++		ITEM_INFO *item_info)
+ {
+ 	int status;
+ 
+@@ -224,9 +211,7 @@ __get_item_next(hashp, cursorp, key, val, item_info)
+  * Put a non-big pair on a page.
+  */
+ static void
+-putpair(p, key, val)
+-	PAGE8 *p;
+-	const DBT *key, *val;
++putpair(PAGE8 *p, const DBT *key, const DBT *val)
+ {
+ 	u_int16_t *pagep, n, off;
+ 
+@@ -275,10 +260,7 @@ prev_realkey(pagep, n)
+  *      -1 error
+  */
+ extern int32_t
+-__delpair(hashp, cursorp, item_info)
+-	HTAB *hashp;
+-	CURSOR *cursorp;
+-	ITEM_INFO *item_info;
++__delpair(HTAB *hashp, CURSOR *cursorp, ITEM_INFO *item_info)
+ {
+ 	PAGE16 *pagep;
+ 	indx_t ndx;
+@@ -412,9 +394,7 @@ __delpair(hashp, cursorp, item_info)
+ }
+ 
+ extern int32_t
+-__split_page(hashp, obucket, nbucket)
+-	HTAB *hashp;
+-	u_int32_t obucket, nbucket;
++__split_page(HTAB *hashp, u_int32_t obucket, u_int32_t nbucket)
+ {
+ 	DBT key, val;
+ 	ITEM_INFO old_ii, new_ii;
+@@ -661,9 +641,7 @@ add_bigptr(hashp, item_info, big_pgno)
+  *      NULL on error
+  */
+ extern PAGE16 *
+-__add_ovflpage(hashp, pagep)
+-	HTAB *hashp;
+-	PAGE16 *pagep;
++__add_ovflpage(HTAB *hashp, PAGE16 *pagep)
+ {
+ 	PAGE16 *new_pagep;
+ 	u_int16_t ovfl_num;
+@@ -768,10 +746,7 @@ page_init(hashp, pagep, pgno, type)
+ }
+ 
+ int32_t
+-__new_page(hashp, addr, addr_type)
+-	HTAB *hashp;
+-	u_int32_t addr;
+-	int32_t addr_type;
++__new_page(HTAB *hashp, u_int32_t addr, int32_t addr_type)
+ {
+ 	db_pgno_t paddr;
+ 	PAGE16 *pagep;
+@@ -804,10 +779,7 @@ __new_page(hashp, addr, addr_type)
+ }
+ 
+ int32_t
+-__delete_page(hashp, pagep, page_type)
+-	HTAB *hashp;
+-	PAGE16 *pagep;
+-	int32_t page_type;
++__delete_page(HTAB *hashp, PAGE16 *pagep, int32_t page_type)
+ {
+ 	if (page_type == A_OVFL)
+ 		__free_ovflpage(hashp, pagep);
+@@ -815,9 +787,7 @@ __delete_page(hashp, pagep, page_type)
+ }
+ 
+ static u_int8_t
+-is_bitmap_pgno(hashp, pgno)
+-	HTAB *hashp;
+-	db_pgno_t pgno;
++is_bitmap_pgno(HTAB *hashp, db_pgno_t pgno)
+ {
+ 	int32_t i;
+ 
+@@ -828,10 +798,7 @@ is_bitmap_pgno(hashp, pgno)
+ }
+ 
+ void
+-__pgin_routine(pg_cookie, pgno, page)
+-	void *pg_cookie;
+-	db_pgno_t pgno;
+-	void *page;
++__pgin_routine(void *pg_cookie, db_pgno_t pgno, void *page)
+ {
+ 	HTAB *hashp;
+ 	PAGE16 *pagep;
+@@ -868,10 +835,7 @@ __pgin_routine(pg_cookie, pgno, page)
+ }
+ 
+ void
+-__pgout_routine(pg_cookie, pgno, page)
+-	void *pg_cookie;
+-	db_pgno_t pgno;
+-	void *page;
++__pgout_routine(void *pg_cookie, db_pgno_t pgno, void *page)
+ {
+ 	HTAB *hashp;
+ 	PAGE16 *pagep;
+@@ -905,10 +869,7 @@ __pgout_routine(pg_cookie, pgno, page)
+  *      -1 ==>failure
+  */
+ extern int32_t
+-__put_page(hashp, pagep, addr_type, is_dirty)
+-	HTAB *hashp;
+-	PAGE16 *pagep;
+-	int32_t addr_type, is_dirty;
++__put_page(HTAB *hashp, PAGE16 *pagep, int32_t addr_type, int32_t is_dirty)
+ {
+ #if DEBUG_SLOW
+ 	account_page(hashp,
+@@ -924,10 +885,7 @@ __put_page(hashp, pagep, addr_type, is_dirty)
+  *      -1 indicates FAILURE
+  */
+ extern PAGE16 *
+-__get_page(hashp, addr, addr_type)
+-	HTAB *hashp;
+-	u_int32_t addr;
+-	int32_t addr_type;
++__get_page(HTAB *hashp, u_int32_t addr, int32_t addr_type)
+ {
+ 	PAGE16 *pagep;
+ 	db_pgno_t paddr;
+@@ -958,8 +916,7 @@ __get_page(hashp, addr, addr_type)
+ }
+ 
+ static void
+-swap_page_header_in(pagep)
+-	PAGE16 *pagep;
++swap_page_header_in(PAGE16 *pagep)
+ {
+ 	u_int32_t i;
+ 
+@@ -977,8 +934,7 @@ swap_page_header_in(pagep)
+ }
+ 
+ static void
+-swap_page_header_out(pagep)
+-	PAGE16 *pagep;
++swap_page_header_out(PAGE16 *pagep)
+ {
+ 	u_int32_t i;
+ 
+@@ -1001,9 +957,7 @@ swap_page_header_out(pagep)
+  * once they are read in.
+  */
+ extern int32_t
+-__ibitmap(hashp, pnum, nbits, ndx)
+-	HTAB *hashp;
+-	int32_t pnum, nbits, ndx;
++__ibitmap(HTAB *hashp, int32_t pnum, int32_t nbits, int32_t ndx)
+ {
+ 	u_int32_t *ip;
+ 	int32_t clearbytes, clearints;
+@@ -1027,8 +981,7 @@ __ibitmap(hashp, pnum, nbits, ndx)
+ }
+ 
+ static u_int32_t
+-first_free(map)
+-	u_int32_t map;
++first_free(u_int32_t map)
+ {
+ 	u_int32_t i, mask;
+ 
+@@ -1044,8 +997,7 @@ first_free(map)
+  * returns 0 on error
+  */
+ static u_int16_t
+-overflow_page(hashp)
+-	HTAB *hashp;
++overflow_page(HTAB *hashp)
+ {
+ 	u_int32_t *freep;
+ 	u_int32_t bit, first_page, free_bit, free_page, i, in_use_bits, j;
+@@ -1206,9 +1158,7 @@ found:
+ 
+ #ifdef DEBUG
+ int
+-bucket_to_page(hashp, n)
+-	HTAB *hashp;
+-	int n;
++bucket_to_page(HTAB *hashp, int n)
+ {
+ 	int ret_val;
+ 
+@@ -1219,9 +1169,7 @@ bucket_to_page(hashp, n)
+ }
+ 
+ int32_t
+-oaddr_to_page(hashp, n)
+-	HTAB *hashp;
+-	int n;
++oaddr_to_page(HTAB *hashp, int n)
+ {
+ 	int ret_val, temp;
+ 
+@@ -1234,9 +1182,7 @@ oaddr_to_page(hashp, n)
+ #endif /* DEBUG */
+ 
+ static indx_t
+-page_to_oaddr(hashp, pgno)
+-	HTAB *hashp;
+-	db_pgno_t pgno;
++page_to_oaddr(HTAB *hashp, db_pgno_t pgno)
+ {
+ 	int32_t sp, ret_val;
+ 
+@@ -1268,9 +1214,7 @@ page_to_oaddr(hashp, pgno)
+  * Mark this overflow page as free.
+  */
+ extern void
+-__free_ovflpage(hashp, pagep)
+-	HTAB *hashp;
+-	PAGE16 *pagep;
++__free_ovflpage(HTAB *hashp, PAGE16 *pagep)
+ {
+ 	u_int32_t *freep;
+ 	u_int32_t bit_address, free_page, free_bit;
+@@ -1307,9 +1251,7 @@ __free_ovflpage(hashp, pagep)
+ }
+ 
+ static u_int32_t *
+-fetch_bitmap(hashp, ndx)
+-	HTAB *hashp;
+-	int32_t ndx;
++fetch_bitmap(HTAB *hashp, int32_t ndx)
+ {
+ 	if (ndx >= hashp->nmaps)
+ 		return (NULL);
+@@ -1322,10 +1264,7 @@ fetch_bitmap(hashp, ndx)
+ 
+ #ifdef DEBUG_SLOW
+ static void
+-account_page(hashp, pgno, inout)
+-	HTAB *hashp;
+-	db_pgno_t pgno;
+-	int inout;
++account_page(HTAB *hashp, db_pgno_t pgno, int inout)
+ {
+ 	static struct {
+ 		db_pgno_t pgno;
+diff --git a/src/plugins/kdb/db2/libdb2/hash/hsearch.c b/src/plugins/kdb/db2/libdb2/hash/hsearch.c
+index 02ff7ef843..ffcdfcf294 100644
+--- a/src/plugins/kdb/db2/libdb2/hash/hsearch.c
++++ b/src/plugins/kdb/db2/libdb2/hash/hsearch.c
+@@ -50,8 +50,7 @@ static DB *dbp = NULL;
+ static ENTRY retval;
+ 
+ extern int
+-hcreate(nel)
+-	u_int nel;
++hcreate(u_int nel)
+ {
+ 	HASHINFO info;
+ 
+@@ -66,9 +65,7 @@ hcreate(nel)
+ }
+ 
+ extern ENTRY *
+-hsearch(item, action)
+-	ENTRY item;
+-	ACTION action;
++hsearch(ENTRY item, ACTION action)
+ {
+ 	DBT key, val;
+ 	int status;
+@@ -98,7 +95,7 @@ hsearch(item, action)
+ }
+ 
+ extern void
+-hdestroy()
++hdestroy(void)
+ {
+ 	if (dbp) {
+ 		(void)(dbp->close)(dbp);
+diff --git a/src/plugins/kdb/db2/libdb2/mpool/mpool.c b/src/plugins/kdb/db2/libdb2/mpool/mpool.c
+index 0fcfd4ac2b..028fb180ca 100644
+--- a/src/plugins/kdb/db2/libdb2/mpool/mpool.c
++++ b/src/plugins/kdb/db2/libdb2/mpool/mpool.c
+@@ -56,10 +56,7 @@ static int  mpool_write __P((MPOOL *, BKT *));
+  *	Initialize a memory pool.
+  */
+ MPOOL *
+-mpool_open(key, fd, pagesize, maxcache)
+-	void *key;
+-	int fd;
+-	db_pgno_t pagesize, maxcache;
++mpool_open(void *key, int fd, db_pgno_t pagesize, db_pgno_t maxcache)
+ {
+ 	struct stat sb;
+ 	MPOOL *mp;
+@@ -96,11 +93,8 @@ mpool_open(key, fd, pagesize, maxcache)
+  *	Initialize input/output filters.
+  */
+ void
+-mpool_filter(mp, pgin, pgout, pgcookie)
+-	MPOOL *mp;
+-	void (*pgin) __P((void *, db_pgno_t, void *));
+-	void (*pgout) __P((void *, db_pgno_t, void *));
+-	void *pgcookie;
++mpool_filter(MPOOL *mp, void (*pgin) __P((void *, db_pgno_t, void *)),
++	     void (*pgout) __P((void *, db_pgno_t, void *)), void *pgcookie)
+ {
+ 	mp->pgin = pgin;
+ 	mp->pgout = pgout;
+@@ -112,10 +106,7 @@ mpool_filter(mp, pgin, pgout, pgcookie)
+  *	Get a new page of memory.
+  */
+ void *
+-mpool_new(mp, pgnoaddr, flags)
+-	MPOOL *mp;
+-	db_pgno_t *pgnoaddr;
+-	u_int flags;
++mpool_new(MPOOL *mp, db_pgno_t *pgnoaddr, u_int flags)
+ {
+ 	struct _hqh *head;
+ 	BKT *bp;
+@@ -149,9 +140,7 @@ mpool_new(mp, pgnoaddr, flags)
+ }
+ 
+ int
+-mpool_delete(mp, page)
+-	MPOOL *mp;
+-	void *page;
++mpool_delete(MPOOL *mp, void *page)
+ {
+ 	struct _hqh *head;
+ 	BKT *bp;
+@@ -180,10 +169,7 @@ mpool_delete(mp, page)
+  *	Get a page.
+  */
+ void *
+-mpool_get(mp, pgno, flags)
+-	MPOOL *mp;
+-	db_pgno_t pgno;
+-	u_int flags;				/* XXX not used? */
++mpool_get(MPOOL *mp, db_pgno_t pgno, u_int flags)
+ {
+ 	struct _hqh *head;
+ 	BKT *bp;
+@@ -278,10 +264,7 @@ mpool_get(mp, pgno, flags)
+  *	Return a page.
+  */
+ int
+-mpool_put(mp, page, flags)
+-	MPOOL *mp;
+-	void *page;
+-	u_int flags;
++mpool_put(MPOOL *mp, void *page, u_int flags)
+ {
+ 	BKT *bp;
+ 
+@@ -307,8 +290,7 @@ mpool_put(mp, page, flags)
+  *	Close the buffer pool.
+  */
+ int
+-mpool_close(mp)
+-	MPOOL *mp;
++mpool_close(MPOOL *mp)
+ {
+ 	BKT *bp;
+ 
+@@ -328,8 +310,7 @@ mpool_close(mp)
+  *	Sync the pool to disk.
+  */
+ int
+-mpool_sync(mp)
+-	MPOOL *mp;
++mpool_sync(MPOOL *mp)
+ {
+ 	BKT *bp;
+ 
+@@ -348,8 +329,7 @@ mpool_sync(mp)
+  *	Get a page from the cache (or create one).
+  */
+ static BKT *
+-mpool_bkt(mp)
+-	MPOOL *mp;
++mpool_bkt(MPOOL *mp)
+ {
+ 	struct _hqh *head;
+ 	BKT *bp;
+@@ -407,9 +387,7 @@ new:	if ((bp = (BKT *)malloc(sizeof(BKT) + mp->pagesize)) == NULL)
+  *	Write a page to disk.
+  */
+ static int
+-mpool_write(mp, bp)
+-	MPOOL *mp;
+-	BKT *bp;
++mpool_write(MPOOL *mp, BKT *bp)
+ {
+ 	off_t off;
+ 
+@@ -451,9 +429,7 @@ mpool_write(mp, bp)
+  *	Lookup a page in the cache.
+  */
+ static BKT *
+-mpool_look(mp, pgno)
+-	MPOOL *mp;
+-	db_pgno_t pgno;
++mpool_look(MPOOL *mp, db_pgno_t pgno)
+ {
+ 	struct _hqh *head;
+ 	BKT *bp;
+@@ -478,8 +454,7 @@ mpool_look(mp, pgno)
+  *	Print out cache statistics.
+  */
+ void
+-mpool_stat(mp)
+-	MPOOL *mp;
++mpool_stat(MPOOL *mp)
+ {
+ 	BKT *bp;
+ 	int cnt;
+@@ -520,8 +495,7 @@ mpool_stat(mp)
+ }
+ #else
+ void
+-mpool_stat(mp)
+-	MPOOL *mp;
++mpool_stat(MPOOL *mp)
+ {
+ }
+ #endif
+diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_close.c b/src/plugins/kdb/db2/libdb2/recno/rec_close.c
+index 4ef4dd1bae..b858e5c909 100644
+--- a/src/plugins/kdb/db2/libdb2/recno/rec_close.c
++++ b/src/plugins/kdb/db2/libdb2/recno/rec_close.c
+@@ -59,8 +59,7 @@ static char sccsid[] = "@(#)rec_close.c	8.9 (Berkeley) 11/18/94";
+  *	RET_ERROR, RET_SUCCESS
+  */
+ int
+-__rec_close(dbp)
+-	DB *dbp;
++__rec_close(DB *dbp)
+ {
+ 	BTREE *t;
+ 	int status;
+@@ -108,9 +107,7 @@ __rec_close(dbp)
+  *	RET_SUCCESS, RET_ERROR.
+  */
+ int
+-__rec_sync(dbp, flags)
+-	const DB *dbp;
+-	u_int flags;
++__rec_sync(const DB *dbp, u_int flags)
+ {
+ 	struct iovec iov[2];
+ 	BTREE *t;
+diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_delete.c b/src/plugins/kdb/db2/libdb2/recno/rec_delete.c
+index b69c9ad742..7e574df28e 100644
+--- a/src/plugins/kdb/db2/libdb2/recno/rec_delete.c
++++ b/src/plugins/kdb/db2/libdb2/recno/rec_delete.c
+@@ -61,10 +61,7 @@ static int rec_rdelete __P((BTREE *, recno_t));
+  *	RET_ERROR, RET_SUCCESS and RET_SPECIAL if the key not found.
+  */
+ int
+-__rec_delete(dbp, key, flags)
+-	const DB *dbp;
+-	const DBT *key;
+-	u_int flags;
++__rec_delete(const DB *dbp, const DBT *key, u_int flags)
+ {
+ 	BTREE *t;
+ 	recno_t nrec;
+@@ -117,9 +114,7 @@ einval:		errno = EINVAL;
+  *	RET_ERROR, RET_SUCCESS and RET_SPECIAL if the key not found.
+  */
+ static int
+-rec_rdelete(t, nrec)
+-	BTREE *t;
+-	recno_t nrec;
++rec_rdelete(BTREE *t, recno_t nrec)
+ {
+ 	EPG *e;
+ 	PAGE *h;
+@@ -151,10 +146,7 @@ rec_rdelete(t, nrec)
+  *	RET_SUCCESS, RET_ERROR.
+  */
+ int
+-__rec_dleaf(t, h, idx)
+-	BTREE *t;
+-	PAGE *h;
+-	u_int32_t idx;
++__rec_dleaf(BTREE *t, PAGE *h, u_int32_t idx)
+ {
+ 	RLEAF *rl;
+ 	indx_t *ip, cnt, offset;
+diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_get.c b/src/plugins/kdb/db2/libdb2/recno/rec_get.c
+index 230b2d4f54..c89cb556fc 100644
+--- a/src/plugins/kdb/db2/libdb2/recno/rec_get.c
++++ b/src/plugins/kdb/db2/libdb2/recno/rec_get.c
+@@ -60,11 +60,7 @@ static char sccsid[] = "@(#)rec_get.c	8.9 (Berkeley) 8/18/94";
+  *	RET_ERROR, RET_SUCCESS and RET_SPECIAL if the key not found.
+  */
+ int
+-__rec_get(dbp, key, data, flags)
+-	const DB *dbp;
+-	const DBT *key;
+-	DBT *data;
+-	u_int flags;
++__rec_get(const DB *dbp, const DBT *key, DBT *data, u_int flags)
+ {
+ 	BTREE *t;
+ 	EPG *e;
+@@ -119,9 +115,7 @@ __rec_get(dbp, key, data, flags)
+  *	RET_ERROR, RET_SUCCESS
+  */
+ int
+-__rec_fpipe(t, top)
+-	BTREE *t;
+-	recno_t top;
++__rec_fpipe(BTREE *t, recno_t top)
+ {
+ 	DBT data;
+ 	recno_t nrec;
+@@ -175,9 +169,7 @@ __rec_fpipe(t, top)
+  *	RET_ERROR, RET_SUCCESS
+  */
+ int
+-__rec_vpipe(t, top)
+-	BTREE *t;
+-	recno_t top;
++__rec_vpipe(BTREE *t, recno_t top)
+ {
+ 	DBT data;
+ 	recno_t nrec;
+@@ -232,9 +224,7 @@ __rec_vpipe(t, top)
+  *	RET_ERROR, RET_SUCCESS
+  */
+ int
+-__rec_fmap(t, top)
+-	BTREE *t;
+-	recno_t top;
++__rec_fmap(BTREE *t, recno_t top)
+ {
+ 	DBT data;
+ 	recno_t nrec;
+@@ -282,9 +272,7 @@ __rec_fmap(t, top)
+  *	RET_ERROR, RET_SUCCESS
+  */
+ int
+-__rec_vmap(t, top)
+-	BTREE *t;
+-	recno_t top;
++__rec_vmap(BTREE *t, recno_t top)
+ {
+ 	DBT data;
+ 	u_char *sp, *ep;
+diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_open.c b/src/plugins/kdb/db2/libdb2/recno/rec_open.c
+index b0daa7c021..de3fc3f4d0 100644
+--- a/src/plugins/kdb/db2/libdb2/recno/rec_open.c
++++ b/src/plugins/kdb/db2/libdb2/recno/rec_open.c
+@@ -56,10 +56,8 @@ static char sccsid[] = "@(#)rec_open.c	8.12 (Berkeley) 11/18/94";
+ #include "recno.h"
+ 
+ DB *
+-__rec_open(fname, flags, mode, openinfo, dflags)
+-	const char *fname;
+-	int flags, mode, dflags;
+-	const RECNOINFO *openinfo;
++__rec_open(const char *fname, int flags, int mode, const RECNOINFO *openinfo,
++	   int dflags)
+ {
+ 	BTREE *t;
+ 	BTREEINFO btopeninfo;
+@@ -228,8 +226,7 @@ err:	sverrno = errno;
+ }
+ 
+ int
+-__rec_fd(dbp)
+-	const DB *dbp;
++__rec_fd(const DB *dbp)
+ {
+ 	BTREE *t;
+ 
+diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_put.c b/src/plugins/kdb/db2/libdb2/recno/rec_put.c
+index c53c9578e5..8456f1dbf6 100644
+--- a/src/plugins/kdb/db2/libdb2/recno/rec_put.c
++++ b/src/plugins/kdb/db2/libdb2/recno/rec_put.c
+@@ -59,11 +59,7 @@ static char sccsid[] = "@(#)rec_put.c	8.7 (Berkeley) 8/18/94";
+  *	already in the tree and R_NOOVERWRITE specified.
+  */
+ int
+-__rec_put(dbp, key, data, flags)
+-	const DB *dbp;
+-	DBT *key;
+-	const DBT *data;
+-	u_int flags;
++__rec_put(const DB *dbp, DBT *key, const DBT *data, u_int flags)
+ {
+ 	BTREE *t;
+ 	DBT fdata, tdata;
+@@ -187,11 +183,7 @@ einval:		errno = EINVAL;
+  *	RET_ERROR, RET_SUCCESS
+  */
+ int
+-__rec_iput(t, nrec, data, flags)
+-	BTREE *t;
+-	recno_t nrec;
+-	const DBT *data;
+-	u_int flags;
++__rec_iput(BTREE *t, recno_t nrec, const DBT *data, u_int flags)
+ {
+ 	DBT tdata;
+ 	EPG *e;
+diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_search.c b/src/plugins/kdb/db2/libdb2/recno/rec_search.c
+index 244d79f36d..55e5ba879b 100644
+--- a/src/plugins/kdb/db2/libdb2/recno/rec_search.c
++++ b/src/plugins/kdb/db2/libdb2/recno/rec_search.c
+@@ -61,10 +61,7 @@ static char sccsid[] = "@(#)rec_search.c	8.4 (Berkeley) 7/14/94";
+  *	the bt_cur field of the tree.  A pointer to the field is returned.
+  */
+ EPG *
+-__rec_search(t, recno, op)
+-	BTREE *t;
+-	recno_t recno;
+-	enum SRCHOP op;
++__rec_search(BTREE *t, recno_t recno, enum SRCHOP op)
+ {
+ 	indx_t idx;
+ 	PAGE *h;
+diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_seq.c b/src/plugins/kdb/db2/libdb2/recno/rec_seq.c
+index 8af1378c34..cf48ea24d7 100644
+--- a/src/plugins/kdb/db2/libdb2/recno/rec_seq.c
++++ b/src/plugins/kdb/db2/libdb2/recno/rec_seq.c
+@@ -58,10 +58,7 @@ static char sccsid[] = "@(#)rec_seq.c	8.3 (Berkeley) 7/14/94";
+  *	RET_ERROR, RET_SUCCESS or RET_SPECIAL if there's no next key.
+  */
+ int
+-__rec_seq(dbp, key, data, flags)
+-	const DB *dbp;
+-	DBT *key, *data;
+-	u_int flags;
++__rec_seq(const DB *dbp, DBT *key, DBT *data, u_int flags)
+ {
+ 	BTREE *t;
+ 	EPG *e;
+diff --git a/src/plugins/kdb/db2/libdb2/recno/rec_utils.c b/src/plugins/kdb/db2/libdb2/recno/rec_utils.c
+index f757a724f5..2eaa39b4a3 100644
+--- a/src/plugins/kdb/db2/libdb2/recno/rec_utils.c
++++ b/src/plugins/kdb/db2/libdb2/recno/rec_utils.c
+@@ -59,11 +59,7 @@ static char sccsid[] = "@(#)rec_utils.c	8.6 (Berkeley) 7/16/94";
+  *	RET_SUCCESS, RET_ERROR.
+  */
+ int
+-__rec_ret(t, e, nrec, key, data)
+-	BTREE *t;
+-	EPG *e;
+-	recno_t nrec;
+-	DBT *key, *data;
++__rec_ret(BTREE *t, EPG *e, recno_t nrec, DBT *key, DBT *data)
+ {
+ 	RLEAF *rl;
+ 	void *p;
+diff --git a/src/plugins/kdb/db2/libdb2/test/dbtest.c b/src/plugins/kdb/db2/libdb2/test/dbtest.c
+index 5d76b1ddf9..04bf34b90d 100644
+--- a/src/plugins/kdb/db2/libdb2/test/dbtest.c
++++ b/src/plugins/kdb/db2/libdb2/test/dbtest.c
+@@ -121,9 +121,7 @@ DB *XXdbp;				/* Global for gdb. */
+ u_long XXlineno;			/* Fast breakpoint for gdb. */
+ 
+ int
+-main(argc, argv)
+-	int argc;
+-	char *argv[];
++main(int argc, char *argv[])
+ {
+ 	extern int optind;
+ 	extern char *optarg;
+@@ -380,8 +378,7 @@ lkey:			switch (command) {
+ #define	NOOVERWRITE	"put failed, would overwrite key\n"
+ 
+ void
+-compare(db1, db2)
+-	DBT *db1, *db2;
++compare(DBT *db1, DBT *db2)
+ {
+ 	size_t len;
+ 	u_char *p1, *p2;
+@@ -402,9 +399,7 @@ compare(db1, db2)
+ }
+ 
+ void
+-get(dbp, kp)
+-	DB *dbp;
+-	DBT *kp;
++get(DB *dbp, DBT *kp)
+ {
+ 	DBT data;
+ 
+@@ -437,9 +432,7 @@ get(dbp, kp)
+ }
+ 
+ void
+-getdata(dbp, kp, dp)
+-	DB *dbp;
+-	DBT *kp, *dp;
++getdata(DB *dbp, DBT *kp, DBT *dp)
+ {
+ 	switch (dbp->get(dbp, kp, dp, flags)) {
+ 	case 0:
+@@ -454,9 +447,7 @@ getdata(dbp, kp, dp)
+ }
+ 
+ void
+-put(dbp, kp, dp)
+-	DB *dbp;
+-	DBT *kp, *dp;
++put(DB *dbp, DBT *kp, DBT *dp)
+ {
+ 	switch (dbp->put(dbp, kp, dp, flags)) {
+ 	case 0:
+@@ -473,9 +464,7 @@ put(dbp, kp, dp)
+ }
+ 
+ void
+-rem(dbp, kp)
+-	DB *dbp;
+-	DBT *kp;
++rem(DB *dbp, DBT *kp)
+ {
+ 	switch (dbp->del(dbp, kp, flags)) {
+ 	case 0:
+@@ -502,8 +491,7 @@ rem(dbp, kp)
+ }
+ 
+ void
+-synk(dbp)
+-	DB *dbp;
++synk(DB *dbp)
+ {
+ 	switch (dbp->sync(dbp, flags)) {
+ 	case 0:
+@@ -515,9 +503,7 @@ synk(dbp)
+ }
+ 
+ void
+-seq(dbp, kp)
+-	DB *dbp;
+-	DBT *kp;
++seq(DB *dbp, DBT *kp)
+ {
+ 	DBT data;
+ 
+@@ -551,10 +537,7 @@ seq(dbp, kp)
+ }
+ 
+ void
+-dump(dbp, rev, recurse)
+-	DB *dbp;
+-	int rev;
+-	int recurse;
++dump(DB *dbp, int rev, int recurse)
+ {
+ 	DBT key, data;
+ 	int lflags, nflags;
+@@ -588,8 +571,7 @@ done:	return;
+ }
+ 
+ void
+-unlinkpg(dbp)
+-	DB *dbp;
++unlinkpg(DB *dbp)
+ {
+ 	BTREE *t = dbp->internal;
+ 	PAGE *h = NULL;
+@@ -623,8 +605,7 @@ cleanup:
+ }
+ 
+ u_int
+-setflags(s)
+-	char *s;
++setflags(char *s)
+ {
+ 	char *p;
+ 
+@@ -648,8 +629,7 @@ setflags(s)
+ }
+ 
+ char *
+-sflags(lflags)
+-	int lflags;
++sflags(int lflags)
+ {
+ 	switch (lflags) {
+ 	case R_CURSOR:		return ("R_CURSOR");
+@@ -667,8 +647,7 @@ sflags(lflags)
+ }
+ 
+ DBTYPE
+-dbtype(s)
+-	char *s;
++dbtype(char *s)
+ {
+ 	if (!strcmp(s, "btree"))
+ 		return (DB_BTREE);
+@@ -681,9 +660,7 @@ dbtype(s)
+ }
+ 
+ void *
+-setinfo(db_type, s)
+-	DBTYPE db_type;
+-	char *s;
++setinfo(DBTYPE db_type, char *s)
+ {
+ 	static BTREEINFO ib;
+ 	static HASHINFO ih;
+@@ -777,9 +754,7 @@ setinfo(db_type, s)
+ }
+ 
+ void *
+-rfile(name, lenp)
+-	char *name;
+-	size_t *lenp;
++rfile(char *name, size_t *lenp)
+ {
+ 	struct stat sb;
+ 	void *p;
+@@ -806,9 +781,7 @@ rfile(name, lenp)
+ }
+ 
+ void *
+-xmalloc(text, len)
+-	char *text;
+-	size_t len;
++xmalloc(char *text, size_t len)
+ {
+ 	void *p;
+ 
+diff --git a/src/plugins/kdb/db2/pol_xdr.c b/src/plugins/kdb/db2/pol_xdr.c
+index e8576337c8..448d4b0f51 100644
+--- a/src/plugins/kdb/db2/pol_xdr.c
++++ b/src/plugins/kdb/db2/pol_xdr.c
+@@ -82,7 +82,7 @@ xdr_osa_policy_ent_rec(XDR *xdrs, osa_policy_ent_t objp)
+         if (!xdr_short(xdrs, &objp->n_tl_data))
+             return (FALSE);
+         if (!xdr_nulltype(xdrs, (void **) &objp->tl_data,
+-                          xdr_krb5_tl_data))
++			  (xdrproc_t)xdr_krb5_tl_data))
+             return FALSE;
+     }
+     return (TRUE);
+diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c
+index 0b56ba86a7..7ddea923a3 100644
+--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c
++++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c
+@@ -186,8 +186,8 @@ static struct _cmd_table {
+  * The function cmd_lookup returns the structure matching the
+  * command name and returns NULL if nothing matches.
+  */
+-static struct _cmd_table *cmd_lookup(name)
+-    char *name;
++static struct _cmd_table *
++cmd_lookup(const char *name)
+ {
+     int i;
+ 
+diff --git a/src/plugins/kdb/lmdb/kdb_lmdb.c b/src/plugins/kdb/lmdb/kdb_lmdb.c
+index bd288e2236..dbab7967c6 100644
+--- a/src/plugins/kdb/lmdb/kdb_lmdb.c
++++ b/src/plugins/kdb/lmdb/kdb_lmdb.c
+@@ -468,13 +468,13 @@ error:
+ }
+ 
+ static krb5_error_code
+-klmdb_lib_init()
++klmdb_lib_init(void)
+ {
+     return 0;
+ }
+ 
+ static krb5_error_code
+-klmdb_lib_cleanup()
++klmdb_lib_cleanup(void)
+ {
+     return 0;
+ }
+diff --git a/src/plugins/kdb/test/kdb_test.c b/src/plugins/kdb/test/kdb_test.c
+index f4d4380d5b..8d14091f38 100644
+--- a/src/plugins/kdb/test/kdb_test.c
++++ b/src/plugins/kdb/test/kdb_test.c
+@@ -312,13 +312,13 @@ make_strings(char **stringattrs, krb5_db_entry *ent)
+ }
+ 
+ static krb5_error_code
+-test_init()
++test_init(void)
+ {
+     return 0;
+ }
+ 
+ static krb5_error_code
+-test_cleanup()
++test_cleanup(void)
+ {
+     return 0;
+ }
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 8cdc40bfb4..f5aade34cc 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -3471,7 +3471,7 @@ load_pkcs11_module(krb5_context context, const char *modname,
+     CK_RV (*getflist)(CK_FUNCTION_LIST_PTR_PTR);
+     struct errinfo einfo = EMPTY_ERRINFO;
+     const char *errmsg = NULL;
+-    void (*sym)();
++    void (*sym)(void);
+     long err;
+     CK_RV rv;
+ 
+@@ -3490,7 +3490,7 @@ load_pkcs11_module(krb5_context context, const char *modname,
+         goto error;
+     }
+ 
+-    getflist = (CK_RV (*)())sym;
++    getflist = (CK_RV (*)(CK_FUNCTION_LIST_PTR_PTR))sym;
+     rv = (*getflist)(p11p);
+     if (rv != CKR_OK) {
+         TRACE_PKINIT_PKCS11_GETFLIST_FAILED(context, pkcs11err(rv));
+diff --git a/src/plugins/preauth/spake/t_vectors.c b/src/plugins/preauth/spake/t_vectors.c
+index 96b0307d78..ecffd3d7ee 100644
+--- a/src/plugins/preauth/spake/t_vectors.c
++++ b/src/plugins/preauth/spake/t_vectors.c
+@@ -439,7 +439,7 @@ run_test(const struct test *t)
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     size_t i;
+ 
+diff --git a/src/tests/asn.1/krb5_decode_test.c b/src/tests/asn.1/krb5_decode_test.c
+index 926aa94706..2fa6dce8eb 100644
+--- a/src/tests/asn.1/krb5_decode_test.c
++++ b/src/tests/asn.1/krb5_decode_test.c
+@@ -54,9 +54,8 @@ static void ktest_free_reply_key_pack(krb5_context context,
+ static void ktest_free_kkdcp_message(krb5_context context,
+                                      krb5_kkdcp_message *val);
+ 
+-int main(argc, argv)
+-    int argc;
+-    char **argv;
++int
++main(int argc, char **argv)
+ {
+     krb5_data code;
+     krb5_error_code retval;
+diff --git a/src/tests/asn.1/krb5_encode_test.c b/src/tests/asn.1/krb5_encode_test.c
+index 26c064e67d..f4e754b1cc 100644
+--- a/src/tests/asn.1/krb5_encode_test.c
++++ b/src/tests/asn.1/krb5_encode_test.c
+@@ -37,7 +37,7 @@ krb5_context test_context;
+ int error_count = 0;
+ int do_trval = 0;
+ int first_trval = 1;
+-int trval2();
++int trval2(FILE *, unsigned char *, int, int, int *);
+ 
+ static void
+ encoder_print_results(krb5_data *code, char *typestring, char *description)
+@@ -51,7 +51,7 @@ encoder_print_results(krb5_data *code, char *typestring, char *description)
+         else
+             printf("\n");
+         printf("encode_krb5_%s%s:\n", typestring, description);
+-        r = trval2(stdout, code->data, code->length, 0, &rlen);
++        r = trval2(stdout, (uint8_t *)code->data, code->length, 0, &rlen);
+         printf("\n");
+         if (rlen < 0 || (unsigned int) rlen != code->length) {
+             printf("Error: length mismatch: was %d, parsed %d\n",
+@@ -72,9 +72,8 @@ encoder_print_results(krb5_data *code, char *typestring, char *description)
+     ktest_destroy_data(&code);
+ }
+ 
+-static void PRS(argc, argv)
+-    int argc;
+-    char        **argv;
++static void
++PRS(int argc, char **argv)
+ {
+     extern char *optarg;
+     int optchar;
+@@ -107,9 +106,7 @@ static void PRS(argc, argv)
+ }
+ 
+ int
+-main(argc, argv)
+-    int argc;
+-    char        **argv;
++main(int argc, char **argv)
+ {
+     krb5_data *code;
+     krb5_error_code retval;
+diff --git a/src/tests/asn.1/t_trval.c b/src/tests/asn.1/t_trval.c
+index 57d8253880..009ed5bb9e 100644
+--- a/src/tests/asn.1/t_trval.c
++++ b/src/tests/asn.1/t_trval.c
+@@ -36,7 +36,8 @@
+    -DSTANDALONE code.  */
+ #include "trval.c"
+ 
+-static void usage()
++static void
++usage(void)
+ {
+     fprintf(stderr, "Usage: trval [--types] [--krb5] [--krb5decode] [--hex] [-notypebytes] [file]\n");
+     exit(1);
+@@ -46,10 +47,8 @@ static void usage()
+  * Returns true if the option was selected.  Allow "-option" and
+  * "--option" syntax, since we used to accept only "-option"
+  */
+-static
+-int check_option(word, option)
+-    char *word;
+-    char *option;
++static int
++check_option(char *word, char *option)
+ {
+     if (word[0] != '-')
+         return 0;
+@@ -60,9 +59,8 @@ int check_option(word, option)
+     return 1;
+ }
+ 
+-int main(argc, argv)
+-    int argc;
+-    char **argv;
++int
++main(int argc, char **argv)
+ {
+     int optflg = 1;
+     FILE *fp;
+diff --git a/src/tests/asn.1/trval.c b/src/tests/asn.1/trval.c
+index c14bcdeb69..e0e58cc19e 100644
+--- a/src/tests/asn.1/trval.c
++++ b/src/tests/asn.1/trval.c
+@@ -120,7 +120,8 @@ int trval2 (FILE *, unsigned char *, int, int, int *);
+ 
+ /****************************************************************************/
+ 
+-static int convert_nibble(int ch)
++static int
++convert_nibble(int ch)
+ {
+     if (isdigit(ch))
+         return (ch - '0');
+@@ -131,9 +132,8 @@ static int convert_nibble(int ch)
+     return -1;
+ }
+ 
+-int trval(fin, fout)
+-    FILE        *fin;
+-    FILE        *fout;
++int
++trval(FILE *fin, FILE *fout)
+ {
+     unsigned char *p;
+     unsigned int maxlen;
+@@ -169,12 +169,8 @@ int trval(fin, fout)
+     return(r);
+ }
+ 
+-int trval2(fp, enc, len, lev, rlen)
+-    FILE *fp;
+-    unsigned char *enc;
+-    int len;
+-    int lev;
+-    int *rlen;
++int
++trval2(FILE *fp, unsigned char *enc, int len, int lev, int *rlen)
+ {
+     int l, eid, elen, xlen, r, rlen2 = 0;
+     int rlen_ext = 0;
+@@ -248,10 +244,8 @@ context_restart:
+     return(r);
+ }
+ 
+-int decode_len(fp, enc, len)
+-    FILE *fp;
+-    unsigned char *enc;
+-    int len;
++int
++decode_len(FILE *fp, unsigned char *enc, int len)
+ {
+     int rlen;
+     int i;
+@@ -270,12 +264,8 @@ int decode_len(fp, enc, len)
+ /*
+  * This is the printing function for bit strings
+  */
+-int do_prim_bitstring(fp, tag, enc, len, lev)
+-    FILE *fp;
+-    int tag;
+-    unsigned char *enc;
+-    int len;
+-    int lev;
++int
++do_prim_bitstring(FILE *fp, int tag, unsigned char *enc, int len, int lev)
+ {
+     int i;
+     long        num = 0;
+@@ -297,12 +287,8 @@ int do_prim_bitstring(fp, tag, enc, len, lev)
+ /*
+  * This is the printing function for integers
+  */
+-int do_prim_int(fp, tag, enc, len, lev)
+-    FILE *fp;
+-    int tag;
+-    unsigned char *enc;
+-    int len;
+-    int lev;
++int
++do_prim_int(FILE *fp, int tag, unsigned char *enc, int len, int lev)
+ {
+     int i;
+     long        num = 0;
+@@ -327,12 +313,8 @@ int do_prim_int(fp, tag, enc, len, lev)
+  * This is the printing function which we use if it's a string or
+  * other other type which is best printed as a string
+  */
+-int do_prim_string(fp, tag, enc, len, lev)
+-    FILE *fp;
+-    int tag;
+-    unsigned char *enc;
+-    int len;
+-    int lev;
++int
++do_prim_string(FILE *fp, int tag, unsigned char *enc, int len, int lev)
+ {
+     int i;
+ 
+@@ -349,12 +331,8 @@ int do_prim_string(fp, tag, enc, len, lev)
+     return 1;
+ }
+ 
+-int do_prim(fp, tag, enc, len, lev)
+-    FILE *fp;
+-    int tag;
+-    unsigned char *enc;
+-    int len;
+-    int lev;
++int
++do_prim(FILE *fp, int tag, unsigned char *enc, int len, int lev)
+ {
+     int n;
+     int i;
+@@ -396,12 +374,8 @@ int do_prim(fp, tag, enc, len, lev)
+     return(OK);
+ }
+ 
+-int do_cons(fp, enc, len, lev, rlen)
+-    FILE *fp;
+-    unsigned char *enc;
+-    int len;
+-    int lev;
+-    int *rlen;
++int
++do_cons(FILE *fp, unsigned char *enc, int len, int lev, int *rlen)
+ {
+     int n;
+     int r = 0;
+@@ -430,9 +404,8 @@ struct typestring_table {
+     int new_appl;
+ };
+ 
+-static char *lookup_typestring(table, key1, key2)
+-    struct typestring_table *table;
+-    int key1, key2;
++static char *
++lookup_typestring(struct typestring_table *table, int key1, int key2)
+ {
+     struct typestring_table *ent;
+ 
+@@ -700,10 +673,8 @@ struct typestring_table krb5_fields[] = {
+ };
+ #endif
+ 
+-void print_tag_type(fp, eid, lev)
+-    FILE *fp;
+-    int     eid;
+-    int     lev;
++void
++print_tag_type(FILE *fp, int eid, int lev)
+ {
+     int tag = eid & ID_TAG;
+     int do_space = 1;
+diff --git a/src/tests/conccache.c b/src/tests/conccache.c
+index 7b0ca6300c..9fe5305761 100644
+--- a/src/tests/conccache.c
++++ b/src/tests/conccache.c
+@@ -110,7 +110,7 @@ refresh_cache(krb5_context context)
+ }
+ 
+ static pid_t
+-spawn_cred_subprocess()
++spawn_cred_subprocess(void)
+ {
+     krb5_context context;
+     pid_t pid;
+@@ -133,7 +133,7 @@ spawn_cred_subprocess()
+ }
+ 
+ static pid_t
+-spawn_refresh_subprocess()
++spawn_refresh_subprocess(void)
+ {
+     krb5_context context;
+     pid_t pid;
+diff --git a/src/tests/create/kdb5_mkdums.c b/src/tests/create/kdb5_mkdums.c
+index 7c0666601c..61ca9f67a2 100644
+--- a/src/tests/create/kdb5_mkdums.c
++++ b/src/tests/create/kdb5_mkdums.c
+@@ -56,9 +56,7 @@ struct mblock {
+ int set_dbname_help (char *, char *);
+ 
+ static void
+-usage(who, status)
+-    char *who;
+-    int status;
++usage(char *who, int status)
+ {
+     fprintf(stderr,
+             "usage: %s -p prefix -n num_to_create [-d dbpathname] [-r realmname]\n",
+@@ -83,9 +81,7 @@ static krb5_boolean manual_mkey = FALSE;
+ void add_princ (krb5_context, char *);
+ 
+ int
+-main(argc, argv)
+-    int argc;
+-    char *argv[];
++main(int argc, char *argv[])
+ {
+     extern char *optarg;
+     int optchar, i, n;
+@@ -209,9 +205,7 @@ main(argc, argv)
+ }
+ 
+ void
+-add_princ(context, str_newprinc)
+-    krb5_context          context;
+-    char                * str_newprinc;
++add_princ(krb5_context context, char *str_newprinc)
+ {
+     krb5_error_code       retval;
+     krb5_principal        newprinc;
+@@ -317,9 +311,7 @@ error: /* Do cleanup of newentry regardless of error */
+ }
+ 
+ int
+-set_dbname_help(pname, dbname)
+-    char *pname;
+-    char *dbname;
++set_dbname_help(char *pname, char *dbname)
+ {
+     krb5_error_code retval;
+     krb5_data pwd, scratch;
+diff --git a/src/tests/forward.c b/src/tests/forward.c
+index 7327cc9e62..90f359a586 100644
+--- a/src/tests/forward.c
++++ b/src/tests/forward.c
+@@ -51,7 +51,7 @@ check(krb5_error_code code)
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     krb5_ccache cc;
+     krb5_creds mcred, tgt, *fcred;
+diff --git a/src/tests/gss-threads/gss-client.c b/src/tests/gss-threads/gss-client.c
+index c0cf25ddaa..8c006c2915 100644
+--- a/src/tests/gss-threads/gss-client.c
++++ b/src/tests/gss-threads/gss-client.c
+@@ -68,7 +68,7 @@
+ static int verbose = 1;
+ 
+ static void
+-usage()
++usage(void)
+ {
+     fprintf(stderr, "Usage: gss-client [-port port] [-mech mechanism] [-d]\n");
+     fprintf(stderr, "       [-seq] [-noreplay] [-nomutual]");
+@@ -134,7 +134,7 @@ get_server_info(char *host, u_short port)
+  * displayed and -1 is returned.
+  */
+ static int
+-connect_to_server()
++connect_to_server(void)
+ {
+     int s;
+ 
+diff --git a/src/tests/gss-threads/gss-server.c b/src/tests/gss-threads/gss-server.c
+index a9f980edb2..e0a37738e4 100644
+--- a/src/tests/gss-threads/gss-server.c
++++ b/src/tests/gss-threads/gss-server.c
+@@ -74,7 +74,7 @@
+ #endif
+ 
+ static void
+-usage()
++usage(void)
+ {
+     fprintf(stderr, "Usage: gss-server [-port port] [-verbose] [-once]");
+ #ifdef _WIN32
+diff --git a/src/tests/gssapi/reload.c b/src/tests/gssapi/reload.c
+index 4fe3565406..00bda32330 100644
+--- a/src/tests/gssapi/reload.c
++++ b/src/tests/gssapi/reload.c
+@@ -64,7 +64,7 @@ load_gssapi(void)
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     void *support;
+ 
+diff --git a/src/tests/gssapi/t_add_cred.c b/src/tests/gssapi/t_add_cred.c
+index 68b37e3ed9..7ab52d6449 100644
+--- a/src/tests/gssapi/t_add_cred.c
++++ b/src/tests/gssapi/t_add_cred.c
+@@ -43,7 +43,7 @@
+ #include "common.h"
+ 
+ int
+-main()
++main(void)
+ {
+     OM_uint32 minor, major;
+     gss_cred_id_t cred1, cred2;
+diff --git a/src/tests/gssapi/t_enctypes.c b/src/tests/gssapi/t_enctypes.c
+index 3fd31e2f8c..3325db7696 100644
+--- a/src/tests/gssapi/t_enctypes.c
++++ b/src/tests/gssapi/t_enctypes.c
+@@ -47,7 +47,7 @@
+  */
+ 
+ static void
+-usage()
++usage(void)
+ {
+     errout("Usage: t_enctypes [-i initenctypes] [-a accenctypes] "
+            "targetname");
+diff --git a/src/tests/gssapi/t_invalid.c b/src/tests/gssapi/t_invalid.c
+index 8192935099..a052b8ab6e 100644
+--- a/src/tests/gssapi/t_invalid.c
++++ b/src/tests/gssapi/t_invalid.c
+@@ -547,7 +547,7 @@ try_accept(void *value, size_t len)
+ 
+ /* Accept contexts using superficially valid but truncated encapsulations. */
+ static void
+-test_short_encapsulation()
++test_short_encapsulation(void)
+ {
+     /* Include just the initial application tag, to see if we overrun reading
+      * the sequence length. */
+diff --git a/src/tests/gssapi/t_oid.c b/src/tests/gssapi/t_oid.c
+index 1c9d394167..64253133d2 100644
+--- a/src/tests/gssapi/t_oid.c
++++ b/src/tests/gssapi/t_oid.c
+@@ -129,7 +129,7 @@ oid_equal(gss_OID o1, gss_OID o2)
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     size_t i;
+     OM_uint32 major, minor;
+diff --git a/src/tests/gssapi/t_spnego.c b/src/tests/gssapi/t_spnego.c
+index 2483228b1b..4091739f83 100644
+--- a/src/tests/gssapi/t_spnego.c
++++ b/src/tests/gssapi/t_spnego.c
+@@ -195,7 +195,7 @@ test_mskrb_oid(gss_name_t tname, gss_cred_id_t acred)
+ /* Check that we return a compatibility NegTokenInit2 message containing
+  * NegHints for an empty initiator token. */
+ static void
+-test_neghints()
++test_neghints(void)
+ {
+     OM_uint32 major, minor;
+     gss_buffer_desc itok = GSS_C_EMPTY_BUFFER, atok;
+diff --git a/src/tests/hammer/kdc5_hammer.c b/src/tests/hammer/kdc5_hammer.c
+index 8220fd97bd..76ef527ccf 100644
+--- a/src/tests/hammer/kdc5_hammer.c
++++ b/src/tests/hammer/kdc5_hammer.c
+@@ -68,9 +68,7 @@ int get_tgt
+ 		   krb5_ccache);
+ 
+ static void
+-usage(who, status)
+-char *who;
+-int status;
++usage(char *who, int status)
+ {
+     fprintf(stderr,
+ 	    "usage: %s -p prefix -n num_to_check [-c cachename] [-r realmname]\n",
+@@ -100,9 +98,7 @@ struct h_timer tgs_req_times = { 0.0, 1000000.0, -1.0, 0 };
+ 				     tstart_time.tv_usec))/1000000.0)))
+ 
+ int
+-main(argc, argv)
+-    int argc;
+-    char **argv;
++main(int argc, char **argv)
+ {
+     krb5_ccache ccache = NULL;
+     char *cache_name = NULL;		/* -f option */
+@@ -271,11 +267,8 @@ main(argc, argv)
+ 
+ 
+ static krb5_error_code
+-get_server_key(context, server, enctype, key)
+-    krb5_context context;
+-    krb5_principal server;
+-    krb5_enctype enctype;
+-    krb5_keyblock ** key;
++get_server_key(krb5_context context, krb5_principal server,
++	       krb5_enctype enctype, krb5_keyblock **key)
+ {
+     krb5_error_code retval;
+     krb5_encrypt_block eblock;
+@@ -311,15 +304,10 @@ cleanup_salt:
+     return retval;
+ }
+ 
+-int verify_cs_pair(context, p_client_str, p_client, service, hostname,
+-		   p_num, c_depth, s_depth, ccache)
+-    krb5_context context;
+-    char *p_client_str;
+-    krb5_principal p_client;
+-    char * service;
+-    char * hostname;
+-    int p_num, c_depth, s_depth;
+-    krb5_ccache ccache;
++int
++verify_cs_pair(krb5_context context, char *p_client_str,
++	       krb5_principal p_client, char *service, char *hostname,
++	       int p_num, int c_depth, int s_depth, krb5_ccache ccache)
+ {
+     krb5_error_code 	  retval;
+     krb5_creds 	 	  creds;
+@@ -433,11 +421,9 @@ cleanup:
+     return retval;
+ }
+ 
+-int get_tgt (context, p_client_str, p_client, ccache)
+-    krb5_context context;
+-    char *p_client_str;
+-    krb5_principal *p_client;
+-    krb5_ccache ccache;
++int
++get_tgt(krb5_context context, char *p_client_str, krb5_principal *p_client,
++	krb5_ccache ccache)
+ {
+     long lifetime = KRB5_DEFAULT_LIFE;	/* -l option */
+     krb5_error_code code;
+diff --git a/src/tests/kdbtest.c b/src/tests/kdbtest.c
+index 3f61f3e83b..6459c3390f 100644
+--- a/src/tests/kdbtest.c
++++ b/src/tests/kdbtest.c
+@@ -271,7 +271,7 @@ iter_pol_handler(void *data, osa_policy_ent_t pol)
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     krb5_db_entry *ent;
+     osa_policy_ent_t pol;
+diff --git a/src/tests/misc/test_getpw.c b/src/tests/misc/test_getpw.c
+index 6031e15035..59ff5d3a5d 100644
+--- a/src/tests/misc/test_getpw.c
++++ b/src/tests/misc/test_getpw.c
+@@ -32,7 +32,7 @@
+ #include <unistd.h>
+ #include <sys/types.h>
+ 
+-int main()
++int main(void)
+ {
+     uid_t my_uid;
+     struct passwd *pwd, pwx;
+diff --git a/src/tests/plugorder.c b/src/tests/plugorder.c
+index e1245e4765..a2b7e34eea 100644
+--- a/src/tests/plugorder.c
++++ b/src/tests/plugorder.c
+@@ -77,7 +77,7 @@ blt3(krb5_context context, int maj_ver, int min_ver, krb5_plugin_vtable vtable)
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     krb5_plugin_initvt_fn *modules = NULL, *mod;
+     struct krb5_pwqual_vtable_st vt;
+diff --git a/src/tests/shlib/t_loader.c b/src/tests/shlib/t_loader.c
+index 29481a7be2..203f023f69 100644
+--- a/src/tests/shlib/t_loader.c
++++ b/src/tests/shlib/t_loader.c
+@@ -180,7 +180,7 @@ static void do_close(void *libhandle)
+ 
+ #endif
+ 
+-int main()
++int main(void)
+ {
+     void *celib, *k5lib, *gsslib, *celib2;
+ 
+diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c
+index 82b05ff0da..908f926405 100644
+--- a/src/tests/softpkcs11/main.c
++++ b/src/tests/softpkcs11/main.c
+@@ -860,7 +860,7 @@ func_not_supported(void)
+ }
+ 
+ static char *
+-get_rcfilename()
++get_rcfilename(void)
+ {
+     struct passwd *pw;
+     const char *home = NULL;
+diff --git a/src/tests/t_inetd.c b/src/tests/t_inetd.c
+index d22cf31ffa..3790467c7b 100644
+--- a/src/tests/t_inetd.c
++++ b/src/tests/t_inetd.c
+@@ -59,16 +59,15 @@
+ 
+ char *progname;
+ 
+-static void usage()
++static void
++usage(void)
+ {
+     fprintf(stderr, "%s: port program argv0 argv1 ...\n", progname);
+     exit(1);
+ }
+ 
+ int
+-main(argc, argv)
+-    int argc;
+-    char **argv;
++main(int argc, char **argv)
+ {
+     unsigned short port;
+     char *path;
+diff --git a/src/tests/test1.c b/src/tests/test1.c
+index aed656ebe3..b213a349bf 100644
+--- a/src/tests/test1.c
++++ b/src/tests/test1.c
+@@ -31,7 +31,7 @@ unsigned char key_two[8] = { 0xea, 0x89, 0x57, 0x76, 0x5b, 0xcd, 0x0d, 0x34 };
+ 
+ extern void dump_data();
+ 
+-tkt_test_1()
++tkt_test_1(void)
+ {
+     krb5_data *data;
+     krb5_ticket tk_in, *tk_out;
+@@ -185,7 +185,7 @@ tkt_test_1()
+ 
+ 
+ 
+-main()
++main(void)
+ {
+     krb5_init_ets();
+     tkt_test_1();
+diff --git a/src/tests/verify/kdb5_verify.c b/src/tests/verify/kdb5_verify.c
+index 3b152baed6..d53e92ad45 100644
+--- a/src/tests/verify/kdb5_verify.c
++++ b/src/tests/verify/kdb5_verify.c
+@@ -50,9 +50,7 @@ struct mblock {
+ int set_dbname_help (krb5_context, char *, char *);
+ 
+ static void
+-usage(who, status)
+-    char *who;
+-    int status;
++usage(char *who, int status)
+ {
+     fprintf(stderr,
+             "usage: %s -p prefix -n num_to_check [-d dbpathname] [-r realmname]\n",
+@@ -78,9 +76,7 @@ static krb5_boolean manual_mkey = FALSE;
+ int check_princ (krb5_context, char *);
+ 
+ int
+-main(argc, argv)
+-    int argc;
+-    char *argv[];
++main(int argc, char *argv[])
+ {
+     extern char *optarg;
+     int optchar, i, n;
+@@ -221,9 +217,7 @@ main(argc, argv)
+ }
+ 
+ int
+-check_princ(context, str_princ)
+-    krb5_context context;
+-    char * str_princ;
++check_princ(krb5_context context, char *str_princ)
+ {
+     krb5_error_code retval;
+     krb5_db_entry *kdbe = NULL;
+@@ -343,10 +337,7 @@ out:
+ }
+ 
+ int
+-set_dbname_help(context, pname, dbname)
+-    krb5_context context;
+-    char *pname;
+-    char *dbname;
++set_dbname_help(krb5_context context, char *pname, char *dbname)
+ {
+     krb5_error_code retval;
+     krb5_data pwd, scratch;
+diff --git a/src/util/et/error_message.c b/src/util/et/error_message.c
+index 7dc02a34ea..13ad3af6a2 100644
+--- a/src/util/et/error_message.c
++++ b/src/util/et/error_message.c
+@@ -82,7 +82,7 @@ void com_err_terminate(void)
+ #endif
+ 
+ static char *
+-get_thread_buffer ()
++get_thread_buffer(void)
+ {
+     char *cp;
+     cp = k5_getspecific(K5_KEY_COM_ERR);
+diff --git a/src/util/et/test_et.c b/src/util/et/test_et.c
+index 9faf10f460..2002e5ff46 100644
+--- a/src/util/et/test_et.c
++++ b/src/util/et/test_et.c
+@@ -17,7 +17,8 @@ extern const char *error_table_name (errcode_t);
+ extern int sys_nerr;
+ #endif
+ 
+-int main()
++int
++main(void)
+ {
+     printf("Before initiating error table:\n\n");
+ #ifndef EXPORT_LIST
+diff --git a/src/util/profile/prof_init.c b/src/util/profile/prof_init.c
+index cc92248f42..077c852e49 100644
+--- a/src/util/profile/prof_init.c
++++ b/src/util/profile/prof_init.c
+@@ -103,7 +103,7 @@ init_load_module(const char *modspec, profile_t *ret_profile)
+     struct errinfo einfo = { 0 };
+     prf_lib_handle_t lib_handle = NULL;
+     struct plugin_file_handle *plhandle = NULL;
+-    void *cbdata = NULL, (*fptr)();
++    void *cbdata = NULL, (*fptr)(void);
+     int have_lock = 0, have_cbdata = 0;
+     struct profile_vtable vtable = { 1 };  /* Set minor_ver to 1, rest null. */
+     errcode_t err;
+diff --git a/src/util/profile/t_profile.c b/src/util/profile/t_profile.c
+index b0e715ba02..bffd115618 100644
+--- a/src/util/profile/t_profile.c
++++ b/src/util/profile/t_profile.c
+@@ -72,7 +72,7 @@ write_file(const char *name, int nlines, ...)
+ /* Regression test for #2685 (profile iterator breaks when modifications
+  * made) */
+ static void
+-test_iterate()
++test_iterate(void)
+ {
+     profile_t p;
+     void *iter;
+@@ -129,7 +129,7 @@ test_iterate()
+  * global shared profiles list.
+  */
+ static void
+-test_shared()
++test_shared(void)
+ {
+     profile_t a, b;
+     struct utimbuf times;
+@@ -164,7 +164,7 @@ test_shared()
+ /* Regression test for #2950 (profile_clear_relation not reflected within
+  * handle where deletion is performed) */
+ static void
+-test_clear()
++test_clear(void)
+ {
+     profile_t p;
+     const char *names[] = { "test section 1", "quux", NULL };
+@@ -183,7 +183,7 @@ test_clear()
+ }
+ 
+ static void
+-test_include()
++test_include(void)
+ {
+     profile_t p;
+     const char *names[] = { "test section 1", "bar", NULL };
+@@ -237,7 +237,7 @@ test_include()
+ 
+ /* Test syntactic independence of included profile files. */
+ static void
+-test_independence()
++test_independence(void)
+ {
+     profile_t p;
+     const char *names1[] = { "sec1", "var", "a", NULL };
+@@ -264,7 +264,7 @@ test_independence()
+ 
+ /* Regression test for #7971 (deleted sections should not be iterable) */
+ static void
+-test_delete_section()
++test_delete_section(void)
+ {
+     profile_t p;
+     const char *sect[] = { "test section 1", NULL };
+@@ -290,7 +290,7 @@ test_delete_section()
+ /* Regression test for #7971 (profile_clear_relation() error with deleted node
+  * at end of value set) */
+ static void
+-test_delete_clear_relation()
++test_delete_clear_relation(void)
+ {
+     profile_t p;
+     const char *names[] = { "test section 1", "testkey", NULL };
+@@ -305,7 +305,7 @@ test_delete_clear_relation()
+ 
+ /* Test that order of relations is preserved if some relations are deleted. */
+ static void
+-test_delete_ordering()
++test_delete_ordering(void)
+ {
+     profile_t p;
+     const char *names[] = { "test section 1", "testkey", NULL };
+@@ -329,7 +329,7 @@ test_delete_ordering()
+ /* Regression test for #8431 (profile_flush_to_file erroneously changes flag
+  * state on source object) */
+ static void
+-test_flush_to_file()
++test_flush_to_file(void)
+ {
+     profile_t p;
+ 
+@@ -349,7 +349,7 @@ test_flush_to_file()
+ /* Regression test for #7863 (multiply-specified subsections should
+  * be merged) */
+ static void
+-test_merge_subsections()
++test_merge_subsections(void)
+ {
+     profile_t p;
+     const char *n1[] = { "test section 2", "child_section2", "child", NULL };
+@@ -374,7 +374,7 @@ test_merge_subsections()
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     test_iterate();
+     test_shared();
+diff --git a/src/util/profile/test_load.c b/src/util/profile/test_load.c
+index cb870eff93..fe2d1e3e72 100644
+--- a/src/util/profile/test_load.c
++++ b/src/util/profile/test_load.c
+@@ -29,7 +29,7 @@
+ #include "prof_int.h"
+ 
+ int
+-main()
++main(void)
+ {
+     profile_t pr, pr2;
+     const char *files[] = { "./modtest.conf", NULL };
+diff --git a/src/util/profile/test_parse.c b/src/util/profile/test_parse.c
+index 9f2631e949..0532254e8c 100644
+--- a/src/util/profile/test_parse.c
++++ b/src/util/profile/test_parse.c
+@@ -11,9 +11,8 @@
+ 
+ void dump_profile (struct profile_node *root, int level);
+ 
+-int main(argc, argv)
+-    int     argc;
+-    char    **argv;
++int
++main(int argc, char **argv)
+ {
+     struct profile_node *root;
+     unsigned long retval;
+diff --git a/src/util/profile/test_profile.c b/src/util/profile/test_profile.c
+index 6f6fcc7ac5..31b1063951 100644
+--- a/src/util/profile/test_profile.c
++++ b/src/util/profile/test_profile.c
+@@ -19,8 +19,8 @@ const char *program_name = "test_profile";
+ #define PRINT_VALUE     1
+ #define PRINT_VALUES    2
+ 
+-static void do_batchmode(profile)
+-    profile_t       profile;
++static void
++do_batchmode(profile_t profile)
+ {
+     errcode_t       retval;
+     int             argc, ret;
+@@ -108,10 +108,8 @@ static void do_batchmode(profile)
+ 
+ }
+ 
+-
+-int main(argc, argv)
+-    int         argc;
+-    char        **argv;
++int
++main(int argc, char **argv)
+ {
+     profile_t   profile;
+     long        retval;
+diff --git a/src/util/profile/test_vtable.c b/src/util/profile/test_vtable.c
+index 9a0b2278a7..a7b6f54ae9 100644
+--- a/src/util/profile/test_vtable.c
++++ b/src/util/profile/test_vtable.c
+@@ -232,7 +232,8 @@ struct profile_vtable full_vtable = {
+     full_flush
+ };
+ 
+-int main()
++int
++main(void)
+ {
+     profile_t profile;
+     char **values, *str, *name, *value;
+diff --git a/src/util/ss/error.c b/src/util/ss/error.c
+index b5768a62b7..e5cd1b2d12 100644
+--- a/src/util/ss/error.c
++++ b/src/util/ss/error.c
+@@ -33,8 +33,8 @@
+ #include "com_err.h"
+ #include "copyright.h"
+ 
+-char * ss_name(sci_idx)
+-    int sci_idx;
++char *
++ss_name(int sci_idx)
+ {
+     ss_data *infop;
+ 
+@@ -50,7 +50,8 @@ char * ss_name(sci_idx)
+     }
+ }
+ 
+-void ss_error (int sci_idx, long code, const char * fmt, ...)
++void
++ss_error(int sci_idx, long code, const char *fmt, ...)
+ {
+     char *whoami;
+     va_list pvar;
+@@ -61,10 +62,8 @@ void ss_error (int sci_idx, long code, const char * fmt, ...)
+     va_end(pvar);
+ }
+ 
+-void ss_perror (sci_idx, code, msg) /* for compatibility */
+-    int sci_idx;
+-    long code;
+-    char const *msg;
++void
++ss_perror(int sci_idx, long code, char const *msg) /* for compatibility */
+ {
+     ss_error (sci_idx, code, "%s", msg);
+ }
+diff --git a/src/util/ss/execute_cmd.c b/src/util/ss/execute_cmd.c
+index c06ee56547..065c24148b 100644
+--- a/src/util/ss/execute_cmd.c
++++ b/src/util/ss/execute_cmd.c
+@@ -52,11 +52,9 @@
+  * Notes:
+  */
+ 
+-static int check_request_table (rqtbl, argc, argv, sci_idx)
+-    ss_request_table *rqtbl;
+-    int argc;
+-    char *argv[];
+-    int sci_idx;
++static int
++check_request_table(ss_request_table *rqtbl, int argc, char *argv[],
++                    int sci_idx)
+ {
+     ss_request_entry *request;
+     ss_data *info;
+@@ -101,10 +99,8 @@ static int check_request_table (rqtbl, argc, argv, sci_idx)
+  * Notes:
+  */
+ 
+-static int really_execute_command (sci_idx, argc, argv)
+-    int sci_idx;
+-    int argc;
+-    char **argv[];
++static int
++really_execute_command(int sci_idx, int argc, char **argv[])
+ {
+     ss_request_table **rqtbl;
+     ss_data *info;
+@@ -135,9 +131,7 @@ static int really_execute_command (sci_idx, argc, argv)
+  */
+ 
+ int
+-ss_execute_command(sci_idx, argv)
+-    int sci_idx;
+-    char *argv[];
++ss_execute_command(int sci_idx, char *argv[])
+ {
+     unsigned int i, argc;
+     char **argp;
+@@ -172,9 +166,8 @@ ss_execute_command(sci_idx, argv)
+  * Notes:
+  */
+ 
+-int ss_execute_line (sci_idx, line_ptr)
+-    int sci_idx;
+-    char *line_ptr;
++int
++ss_execute_line(int sci_idx, char *line_ptr)
+ {
+     char **argv;
+     int argc, ret;
+diff --git a/src/util/ss/help.c b/src/util/ss/help.c
+index 6d333c9710..747fde5351 100644
+--- a/src/util/ss/help.c
++++ b/src/util/ss/help.c
+@@ -15,11 +15,8 @@
+ #include "copyright.h"
+ 
+ 
+-void ss_help (argc, argv, sci_idx, info_ptr)
+-    int argc;
+-    char const * const *argv;
+-    int sci_idx;
+-    pointer info_ptr;
++void
++ss_help(int argc, char const * const *argv, int sci_idx, pointer info_ptr)
+ {
+     char buffer[MAXPATHLEN];
+     char const *request_name;
+@@ -81,15 +78,11 @@ got_it:
+         ss_page_stdin();
+     default:
+         (void) close(fd); /* what can we do if it fails? */
+-#ifdef WAIT_USES_INT
+-        while (wait((int *)NULL) != child) {
+-#else
+-            while (wait((union wait *)NULL) != child) {
+-#endif
+-                /* do nothing if wrong pid */
+-            };
+-        }
++        while (wait(NULL) != child) {
++            /* do nothing if wrong pid */
++        };
+     }
++}
+ 
+ #ifndef USE_DIRENT_H
+ #include <sys/dir.h>
+@@ -97,60 +90,56 @@ got_it:
+ #include <dirent.h>
+ #endif
+ 
+-    void ss_add_info_dir(sci_idx, info_dir, code_ptr)
+-        int sci_idx;
+-    char *info_dir;
+-    int *code_ptr;
+-    {
+-        ss_data *info;
+-        DIR *d;
+-        int n_dirs;
+-        char **dirs;
++void
++ss_add_info_dir(int sci_idx, char *info_dir, int *code_ptr)
++{
++    ss_data *info;
++    DIR *d;
++    int n_dirs;
++    char **dirs;
+ 
+-        info = ss_info(sci_idx);
+-        if ((info_dir == NULL) || (*info_dir == '\0')) {
+-            *code_ptr = SS_ET_NO_INFO_DIR;
+-            return;
+-        }
+-        if ((d = opendir(info_dir)) == (DIR *)NULL) {
+-            *code_ptr = errno;
+-            return;
+-        }
+-        closedir(d);
+-        dirs = info->info_dirs;
+-        for (n_dirs = 0; dirs[n_dirs] != (char *)NULL; n_dirs++)
+-            ;               /* get number of non-NULL dir entries */
+-        dirs = (char **)realloc((char *)dirs,
+-                                (unsigned)(n_dirs + 2)*sizeof(char *));
+-        if (dirs == (char **)NULL) {
+-            info->info_dirs = (char **)NULL;
+-            *code_ptr = errno;
+-            return;
+-        }
+-        info->info_dirs = dirs;
+-        dirs[n_dirs + 1] = (char *)NULL;
+-        dirs[n_dirs] = strdup(info_dir);
+-        *code_ptr = 0;
++    info = ss_info(sci_idx);
++    if ((info_dir == NULL) || (*info_dir == '\0')) {
++        *code_ptr = SS_ET_NO_INFO_DIR;
++        return;
++    }
++    if ((d = opendir(info_dir)) == (DIR *)NULL) {
++        *code_ptr = errno;
++        return;
+     }
++    closedir(d);
++    dirs = info->info_dirs;
++    for (n_dirs = 0; dirs[n_dirs] != (char *)NULL; n_dirs++)
++        ;               /* get number of non-NULL dir entries */
++    dirs = (char **)realloc((char *)dirs,
++                            (unsigned)(n_dirs + 2)*sizeof(char *));
++    if (dirs == (char **)NULL) {
++        info->info_dirs = (char **)NULL;
++        *code_ptr = errno;
++        return;
++    }
++    info->info_dirs = dirs;
++    dirs[n_dirs + 1] = (char *)NULL;
++    dirs[n_dirs] = strdup(info_dir);
++    *code_ptr = 0;
++}
+ 
+-    void ss_delete_info_dir(sci_idx, info_dir, code_ptr)
+-        int sci_idx;
+-    char *info_dir;
+-    int *code_ptr;
+-    {
+-        char **i_d;
+-        char **info_dirs;
++void
++ss_delete_info_dir(int sci_idx, char *info_dir, int *code_ptr)
++{
++    char **i_d;
++    char **info_dirs;
+ 
+-        info_dirs = ss_info(sci_idx)->info_dirs;
+-        for (i_d = info_dirs; *i_d; i_d++) {
+-            if (!strcmp(*i_d, info_dir)) {
+-                while (*i_d) {
+-                    *i_d = *(i_d+1);
+-                    i_d++;
+-                }
+-                *code_ptr = 0;
+-                return;
++    info_dirs = ss_info(sci_idx)->info_dirs;
++    for (i_d = info_dirs; *i_d; i_d++) {
++        if (!strcmp(*i_d, info_dir)) {
++            while (*i_d) {
++                *i_d = *(i_d+1);
++                i_d++;
+             }
++            *code_ptr = 0;
++            return;
+         }
+-        *code_ptr = SS_ET_NO_INFO_DIR;
+     }
++    *code_ptr = SS_ET_NO_INFO_DIR;
++}
+diff --git a/src/util/ss/invocation.c b/src/util/ss/invocation.c
+index 378bc3e927..7736c957d4 100644
+--- a/src/util/ss/invocation.c
++++ b/src/util/ss/invocation.c
+@@ -36,12 +36,10 @@
+    _ss_table[sci_idx], make sure you change the allocation routine to
+    not assume there are no null pointers in the middle of the
+    array.  */
+-int ss_create_invocation(subsystem_name, version_string, info_ptr,
+-                         request_table_ptr, code_ptr)
+-    char *subsystem_name, *version_string;
+-    char *info_ptr;
+-    ss_request_table *request_table_ptr;
+-    int *code_ptr;
++int
++ss_create_invocation(char *subsystem_name, char *version_string,
++                     char *info_ptr, ss_request_table *request_table_ptr,
++                     int *code_ptr)
+ {
+     int sci_idx;
+     ss_data *new_table;
+@@ -115,8 +113,7 @@ int ss_create_invocation(subsystem_name, version_string, info_ptr,
+ }
+ 
+ void
+-ss_delete_invocation(sci_idx)
+-    int sci_idx;
++ss_delete_invocation(int sci_idx)
+ {
+     ss_data *t;
+     int ignored_code;
+diff --git a/src/util/ss/list_rqs.c b/src/util/ss/list_rqs.c
+index c0882bf908..8376e21be8 100644
+--- a/src/util/ss/list_rqs.c
++++ b/src/util/ss/list_rqs.c
+@@ -21,15 +21,8 @@ static char const twentyfive_spaces[26] =
+ static char const NL[2] = "\n";
+ 
+ void
+-ss_list_requests(argc, argv, sci_idx, info_ptr)
+-    int argc;
+-    const char * const *argv;
+-    int sci_idx;
+-#ifdef __STDC__
+-    void *info_ptr;
+-#else
+-    char *info_ptr;
+-#endif
++ss_list_requests(int argc, const char * const *argv, int sci_idx,
++                 void *info_ptr)
+ {
+     ss_request_entry *entry;
+     char const *const *name;
+diff --git a/src/util/ss/listen.c b/src/util/ss/listen.c
+index fe18475447..79f258fbc4 100644
+--- a/src/util/ss/listen.c
++++ b/src/util/ss/listen.c
+@@ -28,7 +28,8 @@ static jmp_buf listen_jmpb;
+ 
+ #ifdef NO_READLINE
+ /* Dumb replacement for readline when we don't have support for a real one. */
+-static char *readline(const char *prompt)
++static char *
++readline(const char *prompt)
+ {
+     struct termios termbuf;
+     char input[BUFSIZ];
+@@ -49,20 +50,21 @@ static char *readline(const char *prompt)
+ }
+ 
+ /* No-op replacement for add_history() when we have no readline support. */
+-static void add_history(const char *line)
++static void
++add_history(const char *line)
+ {
+ }
+ #endif
+ 
+-static void listen_int_handler(signo)
+-    int signo;
++static void
++listen_int_handler(int signo)
+ {
+     putc('\n', stdout);
+     longjmp(listen_jmpb, 1);
+ }
+ 
+-int ss_listen (sci_idx)
+-    int sci_idx;
++int
++ss_listen(int sci_idx)
+ {
+     char *cp;
+     ss_data *info;
+@@ -83,12 +85,12 @@ int ss_listen (sci_idx)
+     info->abort = 0;
+ 
+ #ifdef POSIX_SIGNALS
+-    csig.sa_handler = (void (*)())0;
++    csig.sa_handler = (void (*)(int))0;
+     sigemptyset(&nmask);
+     sigaddset(&nmask, SIGINT);
+     sigprocmask(SIG_BLOCK, &nmask, &omask);
+ #else
+-    sig_cont = (void (*)())0;
++    sig_cont = (void (*)(int))0;
+     mask = sigblock(sigmask(SIGINT));
+ #endif
+ 
+@@ -115,7 +117,7 @@ int ss_listen (sci_idx)
+         nsig.sa_handler = listen_int_handler;   /* fgets is not signal-safe */
+         osig = csig;
+         sigaction(SIGCONT, &nsig, &csig);
+-        if ((void (*)())csig.sa_handler==(void (*)())listen_int_handler)
++        if ((void (*)(int))csig.sa_handler==(void (*)(int))listen_int_handler)
+             csig = osig;
+ #else
+         old_sig_cont = sig_cont;
+@@ -166,20 +168,16 @@ egress:
+     return code;
+ }
+ 
+-void ss_abort_subsystem(sci_idx, code)
+-    int sci_idx;
+-    int code;
++void
++ss_abort_subsystem(int sci_idx, int code)
+ {
+     ss_info(sci_idx)->abort = 1;
+     ss_info(sci_idx)->exit_status = code;
+ 
+ }
+ 
+-void ss_quit(argc, argv, sci_idx, infop)
+-    int argc;
+-    char const * const *argv;
+-    int sci_idx;
+-    pointer infop;
++void
++ss_quit(int argc, char const * const *argv, int sci_idx, pointer infop)
+ {
+     ss_abort_subsystem(sci_idx, 0);
+ }
+diff --git a/src/util/ss/pager.c b/src/util/ss/pager.c
+index 3e47ed3993..255c721ad1 100644
+--- a/src/util/ss/pager.c
++++ b/src/util/ss/pager.c
+@@ -10,13 +10,13 @@
+ #include "copyright.h"
+ #include <errno.h>
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <sys/types.h>
+ #include <sys/file.h>
+ #include <signal.h>
+ 
+ static char MORE[] = "more";
+ extern char *_ss_pager_name;
+-extern char *getenv();
+ 
+ /*
+  * this needs a *lot* of work....
+@@ -25,10 +25,10 @@ extern char *getenv();
+  * handle SIGINT sensibly
+  * allow finer control -- put-page-break-here
+  */
+-void ss_page_stdin();
++void ss_page_stdin(void);
+ 
+ #ifndef NO_FORK
+-int ss_pager_create()
++int ss_pager_create(void)
+ {
+     int filedes[2];
+ 
+@@ -56,7 +56,7 @@ int ss_pager_create()
+     }
+ }
+ #else /* don't fork */
+-int ss_pager_create()
++int ss_pager_create(void)
+ {
+     int fd;
+     fd = open("/dev/tty", O_WRONLY, 0);
+@@ -66,7 +66,7 @@ int ss_pager_create()
+ }
+ #endif
+ 
+-void ss_page_stdin()
++void ss_page_stdin(void)
+ {
+     int i;
+ #ifdef POSIX_SIGNALS
+diff --git a/src/util/ss/parse.c b/src/util/ss/parse.c
+index 78a831bf36..6fb031cdcd 100644
+--- a/src/util/ss/parse.c
++++ b/src/util/ss/parse.c
+@@ -53,10 +53,8 @@ enum parse_mode { WHITESPACE, TOKEN, QUOTED_STRING };
+ #define NEW_ARGV(old,n) (char **)realloc((char *)old,                   \
+                                          (unsigned)(n+2)*sizeof(char*))
+ 
+-char **ss_parse (sci_idx, line_ptr, argc_ptr)
+-    int sci_idx;
+-    char *line_ptr;
+-    int *argc_ptr;
++char **
++ss_parse(int sci_idx, char *line_ptr, int *argc_ptr)
+ {
+     char **argv, *cp;
+     char **newargv;
+diff --git a/src/util/ss/prompt.c b/src/util/ss/prompt.c
+index 5aa2ad6140..48e57d6702 100644
+--- a/src/util/ss/prompt.c
++++ b/src/util/ss/prompt.c
+@@ -11,16 +11,13 @@
+ #include "ss_internal.h"
+ 
+ void
+-ss_set_prompt(sci_idx, new_prompt)
+-    int sci_idx;
+-    char *new_prompt;
++ss_set_prompt(int sci_idx, char *new_prompt)
+ {
+     ss_info(sci_idx)->prompt = new_prompt;
+ }
+ 
+ char *
+-ss_get_prompt(sci_idx)
+-    int sci_idx;
++ss_get_prompt(int sci_idx)
+ {
+     return(ss_info(sci_idx)->prompt);
+ }
+diff --git a/src/util/ss/request_tbl.c b/src/util/ss/request_tbl.c
+index 03cde1b7d0..fc4461bb00 100644
+--- a/src/util/ss/request_tbl.c
++++ b/src/util/ss/request_tbl.c
+@@ -11,11 +11,7 @@
+ #define ssrt ss_request_table   /* for some readable code... */
+ 
+ void
+-ss_add_request_table(sci_idx, rqtbl_ptr, position, code_ptr)
+-    int sci_idx;
+-    ssrt *rqtbl_ptr;
+-    int position;           /* 1 -> becomes second... */
+-    int *code_ptr;
++ss_add_request_table(int sci_idx, ssrt *rqtbl_ptr, int position, int *code_ptr)
+ {
+     ss_data *info;
+     int i, size;
+@@ -44,10 +40,7 @@ ss_add_request_table(sci_idx, rqtbl_ptr, position, code_ptr)
+ }
+ 
+ void
+-ss_delete_request_table(sci_idx, rqtbl_ptr, code_ptr)
+-    int sci_idx;
+-    ssrt *rqtbl_ptr;
+-    int *code_ptr;
++ss_delete_request_table(int sci_idx, ssrt *rqtbl_ptr, int *code_ptr)
+ {
+     ss_data *info;
+     ssrt **rt1, **rt2;
+diff --git a/src/util/ss/requests.c b/src/util/ss/requests.c
+index aa6752fa11..651f2201d2 100644
+--- a/src/util/ss/requests.c
++++ b/src/util/ss/requests.c
+@@ -9,7 +9,7 @@
+ #include <stdio.h>
+ #include "ss_internal.h"
+ 
+-#define DECLARE(name)   void name(argc,argv,sci_idx,info_ptr)int argc,sci_idx;const char * const *argv; pointer info_ptr;
++#define DECLARE(name)   void name(int argc, const char *const *argv, int sci_idx, pointer info_ptr)
+ 
+ /*
+  * ss_self_identify -- assigned by default to the "." request
+diff --git a/src/util/ss/ss.h b/src/util/ss/ss.h
+index 38d8974e3c..faac0d97c1 100644
+--- a/src/util/ss/ss.h
++++ b/src/util/ss/ss.h
+@@ -48,7 +48,6 @@ typedef struct _ss_rp_options { /* DEFAULT VALUES */
+ void ss_help __SS_PROTO;
+ void ss_list_requests __SS_PROTO;
+ void ss_quit __SS_PROTO;
+-char *ss_current_request();
+ char *ss_name(int);
+ void ss_error (int, long, char const *, ...)
+ #if !defined(__cplusplus) && (__GNUC__ > 2)
+diff --git a/src/util/ss/ss_internal.h b/src/util/ss/ss_internal.h
+index 1f5ddfff91..cdd88af218 100644
+--- a/src/util/ss/ss_internal.h
++++ b/src/util/ss/ss_internal.h
+@@ -84,8 +84,7 @@ typedef struct _ss_data {       /* init values */
+ #define ss_info(sci_idx)        (_ss_table[sci_idx])
+ #define ss_current_request(sci_idx,code_ptr)            \
+     (*code_ptr=0,ss_info(sci_idx)->current_request)
+-void ss_unknown_function();
+-void ss_delete_info_dir();
++void ss_delete_info_dir(int, char *, int *);
+ char **ss_parse (int, char *, int *);
+ ss_abbrev_info *ss_abbrev_initialize (char *, int *);
+ void ss_page_stdin (void);
+diff --git a/src/util/support/plugins.c b/src/util/support/plugins.c
+index 0850565687..253b118dcb 100644
+--- a/src/util/support/plugins.c
++++ b/src/util/support/plugins.c
+@@ -240,13 +240,13 @@ krb5int_get_plugin_data(struct plugin_file_handle *h, const char *csymname,
+ 
+ long KRB5_CALLCONV
+ krb5int_get_plugin_func(struct plugin_file_handle *h, const char *csymname,
+-                        void (**sym_out)(), struct errinfo *ep)
++                        void (**sym_out)(void), struct errinfo *ep)
+ {
+     void *dptr = NULL;
+     long ret = get_sym(h, csymname, &dptr, ep);
+ 
+     if (!ret)
+-        *sym_out = (void (*)())dptr;
++        *sym_out = (void (*)(void))dptr;
+     return ret;
+ }
+ 
+@@ -552,7 +552,7 @@ krb5int_get_plugin_dir_func (struct plugin_dir_handle *dirhandle,
+                              struct errinfo *ep)
+ {
+     long err = 0;
+-    void (**p)() = NULL;
++    void (**p)(void) = NULL;
+     size_t count = 0;
+ 
+     /* XXX Do we need to add a leading "_" to the symbol name on any
+@@ -569,10 +569,10 @@ krb5int_get_plugin_dir_func (struct plugin_dir_handle *dirhandle,
+         int i = 0;
+ 
+         for (i = 0; !err && (dirhandle->files[i] != NULL); i++) {
+-            void (*sym)() = NULL;
++            void (*sym)(void) = NULL;
+ 
+             if (krb5int_get_plugin_func (dirhandle->files[i], symname, &sym, ep) == 0) {
+-                void (**newp)() = NULL;
++                void (**newp)(void) = NULL;
+ 
+                 count++;
+                 newp = realloc (p, ((count + 1) * sizeof (*p))); /* +1 for NULL */
+diff --git a/src/util/support/t_hashtab.c b/src/util/support/t_hashtab.c
+index f51abc4f19..d90d5d9d02 100644
+--- a/src/util/support/t_hashtab.c
++++ b/src/util/support/t_hashtab.c
+@@ -104,7 +104,7 @@ const uint64_t vectors[64] = {
+ };
+ 
+ static void
+-test_siphash()
++test_siphash(void)
+ {
+     uint8_t seq[64];
+     uint64_t k0, k1, hval;
+@@ -122,7 +122,7 @@ test_siphash()
+ }
+ 
+ static void
+-test_hashtab()
++test_hashtab(void)
+ {
+     int st;
+     struct k5_hashtab *ht;
+@@ -168,7 +168,7 @@ test_hashtab()
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     test_siphash();
+     test_hashtab();
+diff --git a/src/util/support/t_hex.c b/src/util/support/t_hex.c
+index a586a1bc89..40e6aa2327 100644
+--- a/src/util/support/t_hex.c
++++ b/src/util/support/t_hex.c
+@@ -137,7 +137,8 @@ struct {
+     { "F8F9FAFBFCFDFEFF", "\xF8\xF9\xFA\xFB\xFC\xFD\xFE\xFF", 8, 1 },
+ };
+ 
+-int main()
++int
++main(void)
+ {
+     size_t i;
+     char *hex;
+diff --git a/src/util/support/t_json.c b/src/util/support/t_json.c
+index 1f229247b4..bacca6f8da 100644
+--- a/src/util/support/t_json.c
++++ b/src/util/support/t_json.c
+@@ -86,7 +86,7 @@ check(int pred, const char *str)
+ }
+ 
+ static void
+-test_array()
++test_array(void)
+ {
+     k5_json_string v1;
+     k5_json_number v2;
+diff --git a/src/util/support/t_k5buf.c b/src/util/support/t_k5buf.c
+index 734b2720c0..18e7e9b7be 100644
+--- a/src/util/support/t_k5buf.c
++++ b/src/util/support/t_k5buf.c
+@@ -54,7 +54,7 @@ check_buf(struct k5buf *buf, const char *name)
+ }
+ 
+ static void
+-test_basic()
++test_basic(void)
+ {
+     struct k5buf buf;
+     char storage[1024];
+@@ -76,7 +76,7 @@ test_basic()
+ }
+ 
+ static void
+-test_realloc()
++test_realloc(void)
+ {
+     struct k5buf buf;
+     char data[1024];
+@@ -132,7 +132,7 @@ test_realloc()
+ }
+ 
+ static void
+-test_overflow()
++test_overflow(void)
+ {
+     struct k5buf buf;
+     char storage[10];
+@@ -153,7 +153,7 @@ test_overflow()
+ }
+ 
+ static void
+-test_error()
++test_error(void)
+ {
+     struct k5buf buf;
+     char storage[1];
+@@ -173,7 +173,7 @@ test_error()
+ }
+ 
+ static void
+-test_truncate()
++test_truncate(void)
+ {
+     struct k5buf buf;
+ 
+@@ -188,7 +188,7 @@ test_truncate()
+ }
+ 
+ static void
+-test_binary()
++test_binary(void)
+ {
+     struct k5buf buf;
+     char data[] = { 'a', 0, 'b' }, *s;
+@@ -205,7 +205,7 @@ test_binary()
+ }
+ 
+ static void
+-test_fmt()
++test_fmt(void)
+ {
+     struct k5buf buf;
+     char storage[10], data[1024];
+@@ -246,7 +246,7 @@ test_fmt()
+ }
+ 
+ int
+-main()
++main(void)
+ {
+     test_basic();
+     test_realloc();
+diff --git a/src/util/support/t_unal.c b/src/util/support/t_unal.c
+index f67cd31edf..6d097f0f83 100644
+--- a/src/util/support/t_unal.c
++++ b/src/util/support/t_unal.c
+@@ -2,7 +2,8 @@
+ #undef NDEBUG
+ #include "k5-platform.h"
+ 
+-int main ()
++int
++main(void)
+ {
+     /* Test some low-level assumptions the Kerberos code depends
+        on.  */
+-- 
+2.45.1
+
diff --git a/0017-Fix-two-unlikely-memory-leaks.patch b/0017-Fix-two-unlikely-memory-leaks.patch
new file mode 100644
index 0000000..09fedb7
--- /dev/null
+++ b/0017-Fix-two-unlikely-memory-leaks.patch
@@ -0,0 +1,206 @@
+From ee66c1feedb57ce06ce51aaa823f9a61f564c58e Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 5 Mar 2024 19:53:07 -0500
+Subject: [PATCH] Fix two unlikely memory leaks
+
+In gss_krb5int_make_seal_token_v3(), one of the bounds checks (which
+could probably never be triggered) leaks plain.data.  Fix this leak
+and use current practices for cleanup throughout the function.
+
+In xmt_rmtcallres() (unused within the tree and likely elsewhere),
+store port_ptr into crp->port_ptr as soon as it is allocated;
+otherwise it could leak if the subsequent xdr_u_int32() operation
+fails.
+
+(cherry picked from commit c5f9c816107f70139de11b38aa02db2f1774ee0d)
+---
+ src/lib/gssapi/krb5/k5sealv3.c | 56 +++++++++++++++-------------------
+ src/lib/rpc/pmap_rmt.c         | 10 +++---
+ 2 files changed, 29 insertions(+), 37 deletions(-)
+
+diff --git a/src/lib/gssapi/krb5/k5sealv3.c b/src/lib/gssapi/krb5/k5sealv3.c
+index 1fcbdfbb87..d3210c1107 100644
+--- a/src/lib/gssapi/krb5/k5sealv3.c
++++ b/src/lib/gssapi/krb5/k5sealv3.c
+@@ -65,7 +65,7 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+                                 int conf_req_flag, int toktype)
+ {
+     size_t bufsize = 16;
+-    unsigned char *outbuf = 0;
++    unsigned char *outbuf = NULL;
+     krb5_error_code err;
+     int key_usage;
+     unsigned char acceptor_flag;
+@@ -75,9 +75,13 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+ #endif
+     size_t ec;
+     unsigned short tok_id;
+-    krb5_checksum sum;
++    krb5_checksum sum = { 0 };
+     krb5_key key;
+     krb5_cksumtype cksumtype;
++    krb5_data plain = empty_data();
++
++    token->value = NULL;
++    token->length = 0;
+ 
+     acceptor_flag = ctx->initiate ? 0 : FLAG_SENDER_IS_ACCEPTOR;
+     key_usage = (toktype == KG_TOK_WRAP_MSG
+@@ -107,14 +111,15 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+ #endif
+ 
+     if (toktype == KG_TOK_WRAP_MSG && conf_req_flag) {
+-        krb5_data plain;
+         krb5_enc_data cipher;
+         size_t ec_max;
+         size_t encrypt_size;
+ 
+         /* 300: Adds some slop.  */
+-        if (SIZE_MAX - 300 < message->length)
+-            return ENOMEM;
++        if (SIZE_MAX - 300 < message->length) {
++            err = ENOMEM;
++            goto cleanup;
++        }
+         ec_max = SIZE_MAX - message->length - 300;
+         if (ec_max > 0xffff)
+             ec_max = 0xffff;
+@@ -126,20 +131,20 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+ #endif
+         err = alloc_data(&plain, message->length + 16 + ec);
+         if (err)
+-            return err;
++            goto cleanup;
+ 
+         /* Get size of ciphertext.  */
+         encrypt_size = krb5_encrypt_size(plain.length, key->keyblock.enctype);
+         if (encrypt_size > SIZE_MAX / 2) {
+             err = ENOMEM;
+-            goto error;
++            goto cleanup;
+         }
+         bufsize = 16 + encrypt_size;
+         /* Allocate space for header plus encrypted data.  */
+         outbuf = gssalloc_malloc(bufsize);
+         if (outbuf == NULL) {
+-            free(plain.data);
+-            return ENOMEM;
++            err = ENOMEM;
++            goto cleanup;
+         }
+ 
+         /* TOK_ID */
+@@ -164,11 +169,8 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+         cipher.ciphertext.length = bufsize - 16;
+         cipher.enctype = key->keyblock.enctype;
+         err = krb5_k_encrypt(context, key, key_usage, 0, &plain, &cipher);
+-        zap(plain.data, plain.length);
+-        free(plain.data);
+-        plain.data = 0;
+         if (err)
+-            goto error;
++            goto cleanup;
+ 
+         /* Now that we know we're returning a valid token....  */
+         ctx->seq_send++;
+@@ -181,7 +183,6 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+         /* If the rotate fails, don't worry about it.  */
+ #endif
+     } else if (toktype == KG_TOK_WRAP_MSG && !conf_req_flag) {
+-        krb5_data plain;
+         size_t cksumsize;
+ 
+         /* Here, message is the application-supplied data; message2 is
+@@ -193,21 +194,19 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+     wrap_with_checksum:
+         err = alloc_data(&plain, message->length + 16);
+         if (err)
+-            return err;
++            goto cleanup;
+ 
+         err = krb5_c_checksum_length(context, cksumtype, &cksumsize);
+         if (err)
+-            goto error;
++            goto cleanup;
+ 
+         assert(cksumsize <= 0xffff);
+ 
+         bufsize = 16 + message2->length + cksumsize;
+         outbuf = gssalloc_malloc(bufsize);
+         if (outbuf == NULL) {
+-            free(plain.data);
+-            plain.data = 0;
+             err = ENOMEM;
+-            goto error;
++            goto cleanup;
+         }
+ 
+         /* TOK_ID */
+@@ -239,23 +238,15 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+         if (message2->length)
+             memcpy(outbuf + 16, message2->value, message2->length);
+ 
+-        sum.contents = outbuf + 16 + message2->length;
+-        sum.length = cksumsize;
+-
+         err = krb5_k_make_checksum(context, cksumtype, key,
+                                    key_usage, &plain, &sum);
+-        zap(plain.data, plain.length);
+-        free(plain.data);
+-        plain.data = 0;
+         if (err) {
+             zap(outbuf,bufsize);
+-            goto error;
++            goto cleanup;
+         }
+         if (sum.length != cksumsize)
+             abort();
+         memcpy(outbuf + 16 + message2->length, sum.contents, cksumsize);
+-        krb5_free_checksum_contents(context, &sum);
+-        sum.contents = 0;
+         /* Now that we know we're actually generating the token...  */
+         ctx->seq_send++;
+ 
+@@ -285,12 +276,13 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
+ 
+     token->value = outbuf;
+     token->length = bufsize;
+-    return 0;
++    outbuf = NULL;
++    err = 0;
+ 
+-error:
++cleanup:
++    krb5_free_checksum_contents(context, &sum);
++    zapfree(plain.data, plain.length);
+     gssalloc_free(outbuf);
+-    token->value = NULL;
+-    token->length = 0;
+     return err;
+ }
+ 
+diff --git a/src/lib/rpc/pmap_rmt.c b/src/lib/rpc/pmap_rmt.c
+index 434e4eea65..f55ca46c60 100644
+--- a/src/lib/rpc/pmap_rmt.c
++++ b/src/lib/rpc/pmap_rmt.c
+@@ -161,12 +161,12 @@ xdr_rmtcallres(
+ 	caddr_t port_ptr;
+ 
+ 	port_ptr = (caddr_t)(void *)crp->port_ptr;
+-	if (xdr_reference(xdrs, &port_ptr, sizeof (uint32_t),
+-			  (xdrproc_t)xdr_u_int32) &&
+-	    xdr_u_int32(xdrs, &crp->resultslen)) {
+-		crp->port_ptr = (uint32_t *)(void *)port_ptr;
++	if (!xdr_reference(xdrs, &port_ptr, sizeof (uint32_t),
++			   (xdrproc_t)xdr_u_int32))
++		return (FALSE);
++	crp->port_ptr = (uint32_t *)(void *)port_ptr;
++	if (xdr_u_int32(xdrs, &crp->resultslen))
+ 		return ((*(crp->xdr_results))(xdrs, crp->results_ptr));
+-	}
+ 	return (FALSE);
+ }
+ 
+-- 
+2.45.1
+
diff --git a/0018-Fix-unimportant-memory-leaks.patch b/0018-Fix-unimportant-memory-leaks.patch
new file mode 100644
index 0000000..0697f06
--- /dev/null
+++ b/0018-Fix-unimportant-memory-leaks.patch
@@ -0,0 +1,2316 @@
+From c8d8cab52172a934bdad1041448b43bc15acf441 Mon Sep 17 00:00:00 2001
+From: Steve Grubb <sgrubb@redhat.com>
+Date: Thu, 13 Jul 2023 16:22:30 -0400
+Subject: [PATCH] Fix unimportant memory leaks
+
+Eliminate memory leaks detected through static analysis and manual
+review.  These leaks are unlikely to happen repeatedly in long-running
+processes.
+
+[jrische@redhat.com: fixed many additional leaks]
+[ghudson@mit.edu: fixed additional leaks; edited for style; removed
+some unused ksu functions; rewrote commit message]
+
+(cherry picked from commit 6c5471176f5266564fbc8a7e02f03b4b042202f8)
+---
+ src/appl/gss-sample/gss-client.c              | 367 ++++++++----------
+ src/appl/gss-sample/gss-server.c              |   3 +-
+ src/clients/klist/klist.c                     |  59 +--
+ src/clients/ksu/authorization.c               | 134 +++----
+ src/clients/ksu/ccache.c                      | 283 +++++---------
+ src/clients/ksu/heuristic.c                   | 128 +++---
+ src/clients/ksu/krb_auth_su.c                 | 134 ++-----
+ src/clients/ksu/ksu.h                         |   6 -
+ src/clients/ksu/main.c                        |   3 +-
+ src/kadmin/cli/keytab.c                       |   6 +-
+ src/kadmin/ktutil/ktutil.c                    |   1 +
+ src/kprop/kpropd.c                            |  21 +-
+ src/lib/gssapi/krb5/export_cred.c             |   4 +-
+ src/lib/gssapi/krb5/val_cred.c                |   6 +-
+ src/lib/kadm5/srv/server_kdb.c                |   7 +-
+ src/lib/krb5/ccache/cc_kcm.c                  |   4 +
+ src/lib/krb5/ccache/ccfns.c                   |  12 +-
+ src/lib/krb5/keytab/kt_file.c                 |   3 +-
+ src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c |   8 +-
+ 19 files changed, 517 insertions(+), 672 deletions(-)
+
+diff --git a/src/appl/gss-sample/gss-client.c b/src/appl/gss-sample/gss-client.c
+index 0722ae196f..2cfcfc6cc5 100644
+--- a/src/appl/gss-sample/gss-client.c
++++ b/src/appl/gss-sample/gss-client.c
+@@ -182,180 +182,148 @@ client_establish_context(int s, char *service_name, OM_uint32 gss_flags,
+                          char *username, char *password,
+                          gss_ctx_id_t *gss_context, OM_uint32 *ret_flags)
+ {
+-    if (auth_flag) {
+-        gss_buffer_desc send_tok, recv_tok, *token_ptr;
+-        gss_name_t target_name;
+-        OM_uint32 maj_stat, min_stat, init_sec_min_stat;
+-        int token_flags;
+-        gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
+-        gss_name_t gss_username = GSS_C_NO_NAME;
+-        gss_OID_set_desc mechs, *mechsp = GSS_C_NO_OID_SET;
+-
+-        if (spnego) {
+-            mechs.elements = &gss_spnego_mechanism_oid_desc;
+-            mechs.count = 1;
+-            mechsp = &mechs;
+-        } else if (oid != GSS_C_NO_OID) {
+-            mechs.elements = oid;
+-            mechs.count = 1;
+-            mechsp = &mechs;
+-        } else {
+-            mechs.elements = NULL;
+-            mechs.count = 0;
+-        }
++    int result = -1, st;
++    gss_buffer_desc send_tok, recv_tok, pwbuf, *token_ptr;
++    gss_name_t target_name = GSS_C_NO_NAME, gss_username = GSS_C_NO_NAME;
++    OM_uint32 maj_stat, min_stat, init_sec_min_stat;
++    int token_flags;
++    gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
++    gss_OID_set_desc mechs, neg_mechs, *mechsp = GSS_C_NO_OID_SET;
++
++    if (!auth_flag)
++        return send_token(s, TOKEN_NOOP, empty_token);
++
++    if (spnego) {
++        mechs.elements = &gss_spnego_mechanism_oid_desc;
++        mechs.count = 1;
++        mechsp = &mechs;
++    } else if (oid != GSS_C_NO_OID) {
++        mechs.elements = oid;
++        mechs.count = 1;
++        mechsp = &mechs;
++    } else {
++        mechs.elements = NULL;
++        mechs.count = 0;
++    }
+ 
+-        if (username != NULL) {
+-            send_tok.value = username;
+-            send_tok.length = strlen(username);
++    if (username != NULL) {
++        send_tok.value = username;
++        send_tok.length = strlen(username);
+ 
+-            maj_stat = gss_import_name(&min_stat, &send_tok,
+-                                       (gss_OID) gss_nt_user_name,
+-                                       &gss_username);
+-            if (maj_stat != GSS_S_COMPLETE) {
+-                display_status("parsing client name", maj_stat, min_stat);
+-                return -1;
+-            }
+-        }
+-
+-        if (password != NULL) {
+-            gss_buffer_desc pwbuf;
+-
+-            pwbuf.value = password;
+-            pwbuf.length = strlen(password);
+-
+-            maj_stat = gss_acquire_cred_with_password(&min_stat,
+-                                                      gss_username,
+-                                                      &pwbuf, 0,
+-                                                      mechsp, GSS_C_INITIATE,
+-                                                      &cred, NULL, NULL);
+-        } else if (gss_username != GSS_C_NO_NAME) {
+-            maj_stat = gss_acquire_cred(&min_stat,
+-                                        gss_username, 0,
+-                                        mechsp, GSS_C_INITIATE,
+-                                        &cred, NULL, NULL);
+-        } else
+-            maj_stat = GSS_S_COMPLETE;
++        maj_stat = gss_import_name(&min_stat, &send_tok,
++                                   (gss_OID) gss_nt_user_name, &gss_username);
+         if (maj_stat != GSS_S_COMPLETE) {
+-            display_status("acquiring creds", maj_stat, min_stat);
+-            gss_release_name(&min_stat, &gss_username);
+-            return -1;
++            display_status("parsing client name", maj_stat, min_stat);
++            goto cleanup;
+         }
+-        if (spnego && oid != GSS_C_NO_OID) {
+-            gss_OID_set_desc neg_mechs;
+-
+-            neg_mechs.elements = oid;
+-            neg_mechs.count = 1;
++    }
+ 
+-            maj_stat = gss_set_neg_mechs(&min_stat, cred, &neg_mechs);
+-            if (maj_stat != GSS_S_COMPLETE) {
+-                display_status("setting neg mechs", maj_stat, min_stat);
+-                gss_release_name(&min_stat, &gss_username);
+-                gss_release_cred(&min_stat, &cred);
+-                return -1;
+-            }
+-        }
+-        gss_release_name(&min_stat, &gss_username);
+-
+-        /*
+-         * Import the name into target_name.  Use send_tok to save
+-         * local variable space.
+-         */
+-        send_tok.value = service_name;
+-        send_tok.length = strlen(service_name);
+-        maj_stat = gss_import_name(&min_stat, &send_tok,
+-                                   (gss_OID) gss_nt_service_name,
+-                                   &target_name);
++    if (password != NULL) {
++        pwbuf.value = password;
++        pwbuf.length = strlen(password);
++
++        maj_stat = gss_acquire_cred_with_password(&min_stat, gss_username,
++                                                  &pwbuf, 0, mechsp,
++                                                  GSS_C_INITIATE, &cred, NULL,
++                                                  NULL);
++    } else if (gss_username != GSS_C_NO_NAME) {
++        maj_stat = gss_acquire_cred(&min_stat, gss_username, 0, mechsp,
++                                    GSS_C_INITIATE, &cred, NULL, NULL);
++    } else {
++        maj_stat = GSS_S_COMPLETE;
++    }
++    if (maj_stat != GSS_S_COMPLETE) {
++        display_status("acquiring creds", maj_stat, min_stat);
++        goto cleanup;
++    }
++    if (spnego && oid != GSS_C_NO_OID) {
++        neg_mechs.elements = oid;
++        neg_mechs.count = 1;
++        maj_stat = gss_set_neg_mechs(&min_stat, cred, &neg_mechs);
+         if (maj_stat != GSS_S_COMPLETE) {
+-            display_status("parsing name", maj_stat, min_stat);
+-            return -1;
++            display_status("setting neg mechs", maj_stat, min_stat);
++            goto cleanup;
+         }
++    }
+ 
+-        if (!v1_format) {
+-            if (send_token(s, TOKEN_NOOP | TOKEN_CONTEXT_NEXT, empty_token) <
+-                0) {
+-                (void) gss_release_name(&min_stat, &target_name);
+-                return -1;
+-            }
+-        }
++    /* Import the name into target_name.  Use send_tok to save local variable
++     * space. */
++    send_tok.value = service_name;
++    send_tok.length = strlen(service_name);
++    maj_stat = gss_import_name(&min_stat, &send_tok,
++                               (gss_OID) gss_nt_service_name, &target_name);
++    if (maj_stat != GSS_S_COMPLETE) {
++        display_status("parsing name", maj_stat, min_stat);
++        goto cleanup;
++    }
+ 
+-        /*
+-         * Perform the context-establishement loop.
+-         *
+-         * On each pass through the loop, token_ptr points to the token
+-         * to send to the server (or GSS_C_NO_BUFFER on the first pass).
+-         * Every generated token is stored in send_tok which is then
+-         * transmitted to the server; every received token is stored in
+-         * recv_tok, which token_ptr is then set to, to be processed by
+-         * the next call to gss_init_sec_context.
+-         *
+-         * GSS-API guarantees that send_tok's length will be non-zero
+-         * if and only if the server is expecting another token from us,
+-         * and that gss_init_sec_context returns GSS_S_CONTINUE_NEEDED if
+-         * and only if the server has another token to send us.
+-         */
+-
+-        token_ptr = GSS_C_NO_BUFFER;
+-        *gss_context = GSS_C_NO_CONTEXT;
+-
+-        do {
+-            maj_stat = gss_init_sec_context(&init_sec_min_stat,
+-                                            cred, gss_context,
+-                                            target_name, mechs.elements,
+-                                            gss_flags, 0,
+-                                            NULL, /* channel bindings */
+-                                            token_ptr, NULL, /* mech type */
+-                                            &send_tok, ret_flags,
+-                                            NULL);  /* time_rec */
+-
+-            if (token_ptr != GSS_C_NO_BUFFER)
+-                free(recv_tok.value);
+-
+-            if (send_tok.length != 0) {
+-                if (verbose)
+-                    printf("Sending init_sec_context token (size=%d)...",
+-                           (int) send_tok.length);
+-                if (send_token(s, v1_format ? 0 : TOKEN_CONTEXT, &send_tok) <
+-                    0) {
+-                    (void) gss_release_buffer(&min_stat, &send_tok);
+-                    (void) gss_release_name(&min_stat, &target_name);
+-                    return -1;
+-                }
++    if (!v1_format) {
++        if (send_token(s, TOKEN_NOOP | TOKEN_CONTEXT_NEXT, empty_token) < 0)
++            goto cleanup;
++    }
++
++    /*
++     * Perform the context-establishment loop.
++     *
++     * On each pass through the loop, token_ptr points to the token to send to
++     * the server (or GSS_C_NO_BUFFER on the first pass).  Every generated
++     * token is stored in send_tok which is then transmitted to the server;
++     * every received token is stored in recv_tok, which token_ptr is then set
++     * to, to be processed by the next call to gss_init_sec_context.
++     *
++     * GSS-API guarantees that send_tok's length will be non-zero if and only
++     * if the server is expecting another token from us, and that
++     * gss_init_sec_context returns GSS_S_CONTINUE_NEEDED if and only if the
++     * server has another token to send us.
++     */
++
++    token_ptr = GSS_C_NO_BUFFER;
++    *gss_context = GSS_C_NO_CONTEXT;
++
++    do {
++        maj_stat = gss_init_sec_context(&init_sec_min_stat, cred, gss_context,
++                                        target_name, mechs.elements, gss_flags,
++                                        0, NULL, token_ptr, NULL, &send_tok,
++                                        ret_flags, NULL);
++
++        if (token_ptr != GSS_C_NO_BUFFER)
++            free(recv_tok.value);
++
++        if (send_tok.length > 0) {
++            if (verbose) {
++                printf("Sending init_sec_context token (size=%d)...",
++                       (int) send_tok.length);
+             }
++            st = send_token(s, v1_format ? 0 : TOKEN_CONTEXT, &send_tok);
+             (void) gss_release_buffer(&min_stat, &send_tok);
++            if (st < 0)
++                goto cleanup;
++        }
+ 
+-            if (maj_stat != GSS_S_COMPLETE
+-                && maj_stat != GSS_S_CONTINUE_NEEDED) {
+-                display_status("initializing context", maj_stat,
+-                               init_sec_min_stat);
+-                (void) gss_release_name(&min_stat, &target_name);
+-                (void) gss_release_cred(&min_stat, &cred);
+-                if (*gss_context != GSS_C_NO_CONTEXT)
+-                    gss_delete_sec_context(&min_stat, gss_context,
+-                                           GSS_C_NO_BUFFER);
+-                return -1;
+-            }
++        if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
++            display_status("initializing context", maj_stat,
++                           init_sec_min_stat);
++            goto cleanup;
++        }
+ 
+-            if (maj_stat == GSS_S_CONTINUE_NEEDED) {
+-                if (verbose)
+-                    printf("continue needed...");
+-                if (recv_token(s, &token_flags, &recv_tok) < 0) {
+-                    (void) gss_release_name(&min_stat, &target_name);
+-                    return -1;
+-                }
+-                token_ptr = &recv_tok;
+-            }
++        if (maj_stat == GSS_S_CONTINUE_NEEDED) {
+             if (verbose)
+-                printf("\n");
+-        } while (maj_stat == GSS_S_CONTINUE_NEEDED);
++                printf("continue needed...");
++            if (recv_token(s, &token_flags, &recv_tok) < 0)
++                goto cleanup;
++            token_ptr = &recv_tok;
++        }
++        if (verbose)
++            printf("\n");
++    } while (maj_stat == GSS_S_CONTINUE_NEEDED);
+ 
+-        (void) gss_release_cred(&min_stat, &cred);
+-        (void) gss_release_name(&min_stat, &target_name);
+-    } else {
+-        if (send_token(s, TOKEN_NOOP, empty_token) < 0)
+-            return -1;
+-    }
++    result = 0;
+ 
+-    return 0;
++cleanup:
++    (void) gss_release_name(&min_stat, &gss_username);
++    (void) gss_release_cred(&min_stat, &cred);
++    (void) gss_release_name(&min_stat, &target_name);
++    return result;
+ }
+ 
+ static void
+@@ -436,11 +404,11 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name,
+ {
+     gss_ctx_id_t context = GSS_C_NO_CONTEXT;
+     gss_buffer_desc in_buf, out_buf;
+-    int     s, state;
++    int     s = -1, result = -1, state;
+     OM_uint32 ret_flags;
+     OM_uint32 maj_stat, min_stat;
+-    gss_name_t src_name, targ_name;
+-    gss_buffer_desc sname, tname;
++    gss_name_t src_name = GSS_C_NO_NAME, targ_name = GSS_C_NO_NAME;
++    gss_buffer_desc sname = GSS_C_EMPTY_BUFFER, tname = GSS_C_EMPTY_BUFFER;
+     OM_uint32 lifetime;
+     gss_OID mechanism, name_type;
+     int     is_local;
+@@ -454,14 +422,13 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name,
+ 
+     /* Open connection */
+     if ((s = connect_to_server(host, port)) < 0)
+-        return -1;
++        goto cleanup;
+ 
+     /* Establish context */
+     if (client_establish_context(s, service_name, gss_flags, auth_flag,
+                                  v1_format, oid, username, password,
+                                  &context, &ret_flags) < 0) {
+-        (void) closesocket(s);
+-        return -1;
++        goto cleanup;
+     }
+ 
+     if (auth_flag && verbose) {
+@@ -475,19 +442,19 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name,
+                                        &is_local, &is_open);
+         if (maj_stat != GSS_S_COMPLETE) {
+             display_status("inquiring context", maj_stat, min_stat);
+-            return -1;
++            goto cleanup;
+         }
+ 
+         maj_stat = gss_display_name(&min_stat, src_name, &sname, &name_type);
+         if (maj_stat != GSS_S_COMPLETE) {
+             display_status("displaying source name", maj_stat, min_stat);
+-            return -1;
++            goto cleanup;
+         }
+         maj_stat = gss_display_name(&min_stat, targ_name, &tname,
+                                     (gss_OID *) NULL);
+         if (maj_stat != GSS_S_COMPLETE) {
+             display_status("displaying target name", maj_stat, min_stat);
+-            return -1;
++            goto cleanup;
+         }
+         printf("\"%.*s\" to \"%.*s\", lifetime %d, flags %x, %s, %s\n",
+                (int) sname.length, (char *) sname.value,
+@@ -496,15 +463,10 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name,
+                (is_local) ? "locally initiated" : "remotely initiated",
+                (is_open) ? "open" : "closed");
+ 
+-        (void) gss_release_name(&min_stat, &src_name);
+-        (void) gss_release_name(&min_stat, &targ_name);
+-        (void) gss_release_buffer(&min_stat, &sname);
+-        (void) gss_release_buffer(&min_stat, &tname);
+-
+         maj_stat = gss_oid_to_str(&min_stat, name_type, &oid_name);
+         if (maj_stat != GSS_S_COMPLETE) {
+             display_status("converting oid->string", maj_stat, min_stat);
+-            return -1;
++            goto cleanup;
+         }
+         printf("Name type of source name is %.*s.\n",
+                (int) oid_name.length, (char *) oid_name.value);
+@@ -515,13 +477,13 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name,
+                                               mechanism, &mech_names);
+         if (maj_stat != GSS_S_COMPLETE) {
+             display_status("inquiring mech names", maj_stat, min_stat);
+-            return -1;
++            goto cleanup;
+         }
+ 
+         maj_stat = gss_oid_to_str(&min_stat, mechanism, &oid_name);
+         if (maj_stat != GSS_S_COMPLETE) {
+             display_status("converting oid->string", maj_stat, min_stat);
+-            return -1;
++            goto cleanup;
+         }
+         printf("Mechanism %.*s supports %d names\n",
+                (int) oid_name.length, (char *) oid_name.value,
+@@ -533,7 +495,7 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name,
+                                       &mech_names->elements[i], &oid_name);
+             if (maj_stat != GSS_S_COMPLETE) {
+                 display_status("converting oid->string", maj_stat, min_stat);
+-                return -1;
++                goto cleanup;
+             }
+             printf("  %d: %.*s\n", (int) i,
+                    (int) oid_name.length, (char *) oid_name.value);
+@@ -558,10 +520,7 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name,
+                          &in_buf, &state, &out_buf);
+             if (maj_stat != GSS_S_COMPLETE) {
+                 display_status("wrapping message", maj_stat, min_stat);
+-                (void) closesocket(s);
+-                (void) gss_delete_sec_context(&min_stat, &context,
+-                                              GSS_C_NO_BUFFER);
+-                return -1;
++                goto cleanup;
+             } else if (encrypt_flag && !state) {
+                 fprintf(stderr, "Warning!  Message not encrypted.\n");
+             }
+@@ -575,22 +534,15 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name,
+                               (wrap_flag ? TOKEN_WRAPPED : 0) |
+                               (encrypt_flag ? TOKEN_ENCRYPTED : 0) |
+                               (mic_flag ? TOKEN_SEND_MIC : 0))),
+-                       &out_buf) < 0) {
+-            (void) closesocket(s);
+-            (void) gss_delete_sec_context(&min_stat, &context,
+-                                          GSS_C_NO_BUFFER);
+-            return -1;
+-        }
++                       &out_buf) < 0)
++            goto cleanup;
++
+         if (out_buf.value != in_buf.value)
+             (void) gss_release_buffer(&min_stat, &out_buf);
+ 
+         /* Read signature block into out_buf */
+-        if (recv_token(s, &token_flags, &out_buf) < 0) {
+-            (void) closesocket(s);
+-            (void) gss_delete_sec_context(&min_stat, &context,
+-                                          GSS_C_NO_BUFFER);
+-            return -1;
+-        }
++        if (recv_token(s, &token_flags, &out_buf) < 0)
++            goto cleanup;
+ 
+         if (mic_flag) {
+             /* Verify signature block */
+@@ -598,10 +550,7 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name,
+                                       &out_buf, &qop_state);
+             if (maj_stat != GSS_S_COMPLETE) {
+                 display_status("verifying signature", maj_stat, min_stat);
+-                (void) closesocket(s);
+-                (void) gss_delete_sec_context(&min_stat, &context,
+-                                              GSS_C_NO_BUFFER);
+-                return -1;
++                goto cleanup;
+             }
+ 
+             if (verbose)
+@@ -621,23 +570,17 @@ call_server(char *host, u_short port, gss_OID oid, char *service_name,
+     if (!v1_format)
+         (void) send_token(s, TOKEN_NOOP, empty_token);
+ 
+-    if (auth_flag) {
+-        /* Delete context */
+-        maj_stat = gss_delete_sec_context(&min_stat, &context, &out_buf);
+-        if (maj_stat != GSS_S_COMPLETE) {
+-            display_status("deleting context", maj_stat, min_stat);
+-            (void) closesocket(s);
+-            (void) gss_delete_sec_context(&min_stat, &context,
+-                                          GSS_C_NO_BUFFER);
+-            return -1;
+-        }
+-
+-        (void) gss_release_buffer(&min_stat, &out_buf);
+-    }
+-
+-    (void) closesocket(s);
++    result = 0;
+ 
+-    return 0;
++cleanup:
++    (void) gss_release_name(&min_stat, &src_name);
++    (void) gss_release_name(&min_stat, &targ_name);
++    (void) gss_release_buffer(&min_stat, &sname);
++    (void) gss_release_buffer(&min_stat, &tname);
++    (void) gss_delete_sec_context(&min_stat, &context, GSS_C_NO_BUFFER);
++    if (s >= 0)
++        (void) closesocket(s);
++    return result;
+ }
+ 
+ static void
+diff --git a/src/appl/gss-sample/gss-server.c b/src/appl/gss-sample/gss-server.c
+index 0e9c857e56..4ba864d9fb 100644
+--- a/src/appl/gss-sample/gss-server.c
++++ b/src/appl/gss-sample/gss-server.c
+@@ -138,13 +138,12 @@ server_acquire_creds(char *service_name, gss_OID mech,
+     }
+     maj_stat = gss_acquire_cred(&min_stat, server_name, 0, mechs, GSS_C_ACCEPT,
+                                 server_creds, NULL, NULL);
++    (void) gss_release_name(&min_stat, &server_name);
+     if (maj_stat != GSS_S_COMPLETE) {
+         display_status("acquiring credentials", maj_stat, min_stat);
+         return -1;
+     }
+ 
+-    (void) gss_release_name(&min_stat, &server_name);
+-
+     return 0;
+ }
+ 
+diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c
+index c797b1698f..b5ae96a843 100644
+--- a/src/clients/klist/klist.c
++++ b/src/clients/klist/klist.c
+@@ -469,20 +469,21 @@ do_ccache()
+ static int
+ show_ccache(krb5_ccache cache)
+ {
+-    krb5_cc_cursor cur;
++    krb5_cc_cursor cur = NULL;
+     krb5_creds creds;
+-    krb5_principal princ;
++    krb5_principal princ = NULL;
+     krb5_error_code ret;
++    int status = 1;
+ 
+     ret = krb5_cc_get_principal(context, cache, &princ);
+     if (ret) {
+         com_err(progname, ret, "");
+-        return 1;
++        goto cleanup;
+     }
+     ret = krb5_unparse_name(context, princ, &defname);
+     if (ret) {
+         com_err(progname, ret, _("while unparsing principal name"));
+-        return 1;
++        goto cleanup;
+     }
+ 
+     printf(_("Ticket cache: %s:%s\nDefault principal: %s\n\n"),
+@@ -498,27 +499,33 @@ show_ccache(krb5_ccache cache)
+     ret = krb5_cc_start_seq_get(context, cache, &cur);
+     if (ret) {
+         com_err(progname, ret, _("while starting to retrieve tickets"));
+-        return 1;
++        goto cleanup;
+     }
+     while ((ret = krb5_cc_next_cred(context, cache, &cur, &creds)) == 0) {
+         if (show_config || !krb5_is_config_principal(context, creds.server))
+             show_credential(&creds);
+         krb5_free_cred_contents(context, &creds);
+     }
+-    krb5_free_principal(context, princ);
+-    krb5_free_unparsed_name(context, defname);
+-    defname = NULL;
+     if (ret == KRB5_CC_END) {
+         ret = krb5_cc_end_seq_get(context, cache, &cur);
++        cur = NULL;
+         if (ret) {
+             com_err(progname, ret, _("while finishing ticket retrieval"));
+-            return 1;
++            goto cleanup;
+         }
+-        return 0;
+     } else {
+         com_err(progname, ret, _("while retrieving a ticket"));
+-        return 1;
++        goto cleanup;
+     }
++
++    status = 0;
++
++cleanup:
++    if (cur != NULL)
++        (void)krb5_cc_end_seq_get(context, cache, &cur);
++    krb5_free_principal(context, princ);
++    krb5_free_unparsed_name(context, defname);
++    return status;
+ }
+ 
+ /* Return 0 if cache is accessible, present, and unexpired; return 1 if not. */
+@@ -526,15 +533,18 @@ static int
+ check_ccache(krb5_ccache cache)
+ {
+     krb5_error_code ret;
+-    krb5_cc_cursor cur;
++    krb5_cc_cursor cur = NULL;
+     krb5_creds creds;
+-    krb5_principal princ;
+-    krb5_boolean found_tgt, found_current_tgt, found_current_cred;
++    krb5_principal princ = NULL;
++    krb5_boolean found_tgt = FALSE, found_current_tgt = FALSE;
++    krb5_boolean found_current_cred = FALSE;
+ 
+-    if (krb5_cc_get_principal(context, cache, &princ) != 0)
+-        return 1;
+-    if (krb5_cc_start_seq_get(context, cache, &cur) != 0)
+-        return 1;
++    ret = krb5_cc_get_principal(context, cache, &princ);
++    if (ret)
++        goto cleanup;
++    ret = krb5_cc_start_seq_get(context, cache, &cur);
++    if (ret)
++        goto cleanup;
+     found_tgt = found_current_tgt = found_current_cred = FALSE;
+     while ((ret = krb5_cc_next_cred(context, cache, &cur, &creds)) == 0) {
+         if (is_local_tgt(creds.server, &princ->realm)) {
+@@ -547,12 +557,17 @@ check_ccache(krb5_ccache cache)
+         }
+         krb5_free_cred_contents(context, &creds);
+     }
+-    krb5_free_principal(context, princ);
+     if (ret != KRB5_CC_END)
+-        return 1;
+-    if (krb5_cc_end_seq_get(context, cache, &cur) != 0)
+-        return 1;
++        goto cleanup;
++    ret = krb5_cc_end_seq_get(context, cache, &cur);
++    cur = NULL;
+ 
++cleanup:
++    if (cur != NULL)
++        (void)krb5_cc_end_seq_get(context, cache, &cur);
++    krb5_free_principal(context, princ);
++    if (ret)
++        return 1;
+     /* If the cache contains at least one local TGT, require that it be
+      * current.  Otherwise accept any current cred. */
+     if (found_tgt)
+diff --git a/src/clients/ksu/authorization.c b/src/clients/ksu/authorization.c
+index 17a8a8f2f0..1f2650c2ab 100644
+--- a/src/clients/ksu/authorization.c
++++ b/src/clients/ksu/authorization.c
+@@ -28,7 +28,17 @@
+ 
+ #include "ksu.h"
+ 
+-static void auth_cleanup (FILE *, FILE *, char *);
++static void
++free_fcmd_list(char **list)
++{
++    size_t i;
++
++    if (list == NULL)
++        return;
++    for (i = 0; i < MAX_CMD && list[i] != NULL; i++)
++        free(list[i]);
++    free(list);
++}
+ 
+ krb5_boolean
+ fowner(FILE *fp, uid_t uid)
+@@ -52,10 +62,10 @@ fowner(FILE *fp, uid_t uid)
+ 
+ /*
+  * Given a Kerberos principal "principal", and a local username "luser",
+- * determine whether user is authorized to login according to the
+- * authorization files ~luser/.k5login" and ~luser/.k5users.  Returns TRUE
+- * if authorized, FALSE if not authorized.
+- *
++ * determine whether user is authorized to login according to the authorization
++ * files ~luser/.k5login" and ~luser/.k5users.  Set *ok to TRUE if authorized,
++ * FALSE if not authorized.  Return 0 if the authorization check succeeded
++ * (regardless of its result), non-zero if it encountered an error.
+  */
+ 
+ krb5_error_code
+@@ -64,7 +74,7 @@ krb5_authorization(krb5_context context, krb5_principal principal,
+                    char **out_fcmd)
+ {
+     struct passwd *pwd;
+-    char *princname;
++    char *princname = NULL;
+     int k5login_flag =0;
+     int k5users_flag =0;
+     krb5_boolean retbool =FALSE;
+@@ -76,7 +86,7 @@ krb5_authorization(krb5_context context, krb5_principal principal,
+ 
+     /* no account => no access */
+     if ((pwd = getpwnam(luser)) == NULL)
+-        return 0;
++        goto cleanup;
+ 
+     retval = krb5_unparse_name(context, principal, &princname);
+     if (retval)
+@@ -93,22 +103,19 @@ krb5_authorization(krb5_context context, krb5_principal principal,
+ 
+     /* k5login and k5users must be owned by target user or root */
+     if (!k5login_flag){
+-        if ((login_fp = fopen(k5login_path, "r")) == NULL)
+-            return 0;
+-        if ( fowner(login_fp, pwd->pw_uid) == FALSE) {
+-            fclose(login_fp);
+-            return 0;
+-        }
++        login_fp = fopen(k5login_path, "r");
++        if (login_fp == NULL)
++            goto cleanup;
++        if (fowner(login_fp, pwd->pw_uid) == FALSE)
++            goto cleanup;
+     }
+ 
+     if (!k5users_flag){
+-        if ((users_fp = fopen(k5users_path, "r")) == NULL) {
+-            return 0;
+-        }
+-        if ( fowner(users_fp, pwd->pw_uid) == FALSE){
+-            fclose(users_fp);
+-            return 0;
+-        }
++        users_fp = fopen(k5users_path, "r");
++        if (users_fp == NULL)
++            goto cleanup;
++        if (fowner(users_fp, pwd->pw_uid) == FALSE)
++            goto cleanup;
+     }
+ 
+     if (auth_debug){
+@@ -127,10 +134,8 @@ krb5_authorization(krb5_context context, krb5_principal principal,
+                     princname);
+ 
+         retval = k5login_lookup(login_fp,  princname, &retbool);
+-        if (retval) {
+-            auth_cleanup(users_fp, login_fp, princname);
+-            return retval;
+-        }
++        if (retval)
++            goto cleanup;
+         if (retbool) {
+             if (cmd)
+                 *out_fcmd = xstrdup(cmd);
+@@ -140,10 +145,8 @@ krb5_authorization(krb5_context context, krb5_principal principal,
+     if ((!k5users_flag) && (retbool == FALSE) ){
+         retval = k5users_lookup (users_fp, princname,
+                                  cmd, &retbool, out_fcmd);
+-        if(retval) {
+-            auth_cleanup(users_fp, login_fp, princname);
+-            return retval;
+-        }
++        if (retval)
++            goto cleanup;
+     }
+ 
+     if (k5login_flag && k5users_flag){
+@@ -159,8 +162,14 @@ krb5_authorization(krb5_context context, krb5_principal principal,
+     }
+ 
+     *ok =retbool;
+-    auth_cleanup(users_fp, login_fp, princname);
+-    return 0;
++
++cleanup:
++    if (users_fp != NULL)
++        fclose(users_fp);
++    if (login_fp != NULL)
++        fclose(login_fp);
++    free(princname);
++    return retval;
+ }
+ 
+ /***********************************************************
+@@ -320,10 +329,11 @@ krb5_boolean
+ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err)
+ {
+     char * err;
+-    char ** tmp_fcmd;
++    char ** tmp_fcmd = NULL;
+     char * path_ptr, *path;
+     char * lp, * tc;
+     int i=0;
++    krb5_boolean ok = FALSE;
+ 
+     tmp_fcmd = (char **) xcalloc (MAX_CMD, sizeof(char *));
+ 
+@@ -331,7 +341,7 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err)
+         tmp_fcmd[0] = xstrdup(fcmd);
+         tmp_fcmd[1] = NULL;
+         *out_fcmd = tmp_fcmd;
+-        return TRUE;
++        tmp_fcmd = NULL;
+     }else{
+         /* must be either full path or just the cmd name */
+         if (strchr(fcmd, '/')){
+@@ -339,7 +349,7 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err)
+                              "either full path or just the cmd name\n"),
+                      fcmd, KRB5_USERS_NAME);
+             *out_err = err;
+-            return FALSE;
++            goto cleanup;
+         }
+ 
+ #ifndef CMD_PATH
+@@ -347,7 +357,7 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err)
+                          "the cmd name, CMD_PATH must be defined \n"),
+                  fcmd, KRB5_USERS_NAME, fcmd);
+         *out_err = err;
+-        return FALSE;
++        goto cleanup;
+ #else
+ 
+         path = xstrdup (CMD_PATH);
+@@ -361,7 +371,7 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err)
+             asprintf(&err, _("Error: bad entry - %s in %s file, CMD_PATH "
+                              "contains no paths \n"), fcmd, KRB5_USERS_NAME);
+             *out_err = err;
+-            return FALSE;
++            goto cleanup;
+         }
+ 
+         i=0;
+@@ -370,7 +380,7 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err)
+                 asprintf(&err, _("Error: bad path %s in CMD_PATH for %s must "
+                                  "start with '/' \n"), tc, KRB5_USERS_NAME );
+                 *out_err = err;
+-                return FALSE;
++                goto cleanup;
+             }
+ 
+             tmp_fcmd[i] = xasprintf("%s/%s", tc, fcmd);
+@@ -381,10 +391,15 @@ fcmd_resolve(char *fcmd, char ***out_fcmd, char **out_err)
+ 
+         tmp_fcmd[i] = NULL;
+         *out_fcmd = tmp_fcmd;
+-        return TRUE;
+-
++        tmp_fcmd = NULL;
+ #endif /* CMD_PATH */
+     }
++
++    ok = TRUE;
++
++cleanup:
++    free_fcmd_list(tmp_fcmd);
++    return ok;
+ }
+ 
+ /********************************************
+@@ -503,41 +518,42 @@ int
+ match_commands(char *fcmd, char *cmd, krb5_boolean *match,
+                char **cmd_out, char **err_out)
+ {
+-    char ** fcmd_arr;
++    char ** fcmd_arr = NULL;
+     char * err;
+     char * cmd_temp;
++    int result = 1;
+ 
+     if(fcmd_resolve(fcmd, &fcmd_arr, &err )== FALSE ){
+         *err_out = err;
+-        return 1;
++        goto cleanup;
+     }
+ 
+     if (cmd_single( cmd ) == TRUE){
+         if (!cmd_arr_cmp_postfix(fcmd_arr, cmd)){ /* found */
+-
+-            if(find_first_cmd_that_exists( fcmd_arr,&cmd_temp,&err)== TRUE){
+-                *match = TRUE;
+-                *cmd_out = cmd_temp;
+-                return 0;
+-            }else{
++            if (!find_first_cmd_that_exists(fcmd_arr, &cmd_temp, &err)) {
+                 *err_out = err;
+-                return 1;
++                goto cleanup;
+             }
+-        }else{
++
++            *match = TRUE;
++            *cmd_out = cmd_temp;
++        } else {
+             *match = FALSE;
+-            return 0;
+         }
+     }else{
+         if (!cmd_arr_cmp(fcmd_arr, cmd)){  /* found */
+             *match = TRUE;
+             *cmd_out = xstrdup(cmd);
+-            return 0;
+         } else{
+             *match = FALSE;
+-            return 0;
+         }
+     }
+ 
++    result = 0;
++
++cleanup:
++    free_fcmd_list(fcmd_arr);
++    return result;
+ }
+ 
+ /*********************************************************
+@@ -563,10 +579,7 @@ get_line(FILE *fp, char **out_line)
+         }
+         else {
+             chunk_count ++;
+-            if(!( line = (char *) realloc( line,
+-                                           chunk_count * sizeof(char) * BUFSIZ))){
+-                return  ENOMEM;
+-            }
++            line = xrealloc(line, chunk_count * BUFSIZ);
+ 
+             line_ptr = line + (BUFSIZ -1) *( chunk_count -1) ;
+         }
+@@ -652,17 +665,6 @@ get_next_token (char **lnext)
+     return out_ptr;
+ }
+ 
+-static void
+-auth_cleanup(FILE *users_fp, FILE *login_fp, char *princname)
+-{
+-
+-    free (princname);
+-    if (users_fp)
+-        fclose(users_fp);
+-    if (login_fp)
+-        fclose(login_fp);
+-}
+-
+ void
+ init_auth_names(char *pw_dir)
+ {
+diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c
+index cca9ce2dfc..76cb1d6aa4 100644
+--- a/src/clients/ksu/ccache.c
++++ b/src/clients/ksu/ccache.c
+@@ -40,6 +40,18 @@ copies the default cache into the secondary cache,
+ 
+ ************************************************************************/
+ 
++static void
++free_creds_list(krb5_context context, krb5_creds **list)
++{
++    size_t i;
++
++    if (list == NULL)
++        return;
++    for (i = 0; list[i]; i++)
++        krb5_free_creds(context, list[i]);
++    free(list);
++}
++
+ void show_credential(krb5_context, krb5_creds *, krb5_ccache);
+ 
+ /* modifies only the cc_other, the algorithm may look a bit funny,
+@@ -53,20 +65,19 @@ krb5_ccache_copy(krb5_context context, krb5_ccache cc_def,
+                  krb5_boolean restrict_creds, krb5_principal primary_principal,
+                  krb5_boolean *stored)
+ {
+-    int i=0;
+     krb5_error_code retval=0;
+     krb5_creds ** cc_def_creds_arr = NULL;
+     krb5_creds ** cc_other_creds_arr = NULL;
+ 
+     if (ks_ccache_is_initialized(context, cc_def)) {
+-        if((retval = krb5_get_nonexp_tkts(context,cc_def,&cc_def_creds_arr))){
+-            return retval;
+-        }
++        retval = krb5_get_nonexp_tkts(context, cc_def, &cc_def_creds_arr);
++        if (retval)
++            goto cleanup;
+     }
+ 
+     retval = krb5_cc_initialize(context, cc_target, target_principal);
+     if (retval)
+-        return retval;
++        goto cleanup;
+ 
+     if (restrict_creds) {
+         retval = krb5_store_some_creds(context, cc_target, cc_def_creds_arr,
+@@ -79,22 +90,9 @@ krb5_ccache_copy(krb5_context context, krb5_ccache cc_def,
+                                       cc_other_creds_arr);
+     }
+ 
+-    if (cc_def_creds_arr){
+-        while (cc_def_creds_arr[i]){
+-            krb5_free_creds(context, cc_def_creds_arr[i]);
+-            i++;
+-        }
+-    }
+-
+-    i=0;
+-
+-    if(cc_other_creds_arr){
+-        while (cc_other_creds_arr[i]){
+-            krb5_free_creds(context, cc_other_creds_arr[i]);
+-            i++;
+-        }
+-    }
+-
++cleanup:
++    free_creds_list(context, cc_def_creds_arr);
++    free_creds_list(context, cc_other_creds_arr);
+     return retval;
+ }
+ 
+@@ -184,32 +182,29 @@ krb5_get_nonexp_tkts(krb5_context context, krb5_ccache cc,
+ {
+ 
+     krb5_creds creds, temp_tktq, temp_tkt;
+-    krb5_creds **temp_creds;
++    krb5_creds **temp_creds = NULL;
+     krb5_error_code retval=0;
+     krb5_cc_cursor cur;
+     int count = 0;
+     int chunk_count = 1;
+ 
+-    if ( ! ( temp_creds = (krb5_creds **) malloc( CHUNK * sizeof(krb5_creds *)))){
+-        return ENOMEM;
+-    }
+-
+-
++    temp_creds = xcalloc(CHUNK, sizeof(*temp_creds));
+     memset(&temp_tktq, 0, sizeof(temp_tktq));
+     memset(&temp_tkt, 0, sizeof(temp_tkt));
+     memset(&creds, 0, sizeof(creds));
+ 
+     /* initialize the cursor */
+-    if ((retval = krb5_cc_start_seq_get(context, cc, &cur))) {
+-        return retval;
+-    }
++    retval = krb5_cc_start_seq_get(context, cc, &cur);
++    if (retval)
++        goto cleanup;
+ 
+     while (!(retval = krb5_cc_next_cred(context, cc, &cur, &creds))){
+ 
+         if (!krb5_is_config_principal(context, creds.server) &&
+             (retval = krb5_check_exp(context, creds.times))){
++            krb5_free_cred_contents(context, &creds);
+             if (retval != KRB5KRB_AP_ERR_TKT_EXPIRED){
+-                return retval;
++                goto cleanup;
+             }
+             if (auth_debug){
+                 fprintf(stderr,"krb5_ccache_copy: CREDS EXPIRED:\n");
+@@ -219,19 +214,19 @@ krb5_get_nonexp_tkts(krb5_context context, krb5_ccache cc,
+             }
+         }
+         else {   /* these credentials didn't expire */
+-
+-            if ((retval = krb5_copy_creds(context, &creds,
+-                                          &temp_creds[count]))){
+-                return retval;
+-            }
++            retval = krb5_copy_creds(context, &creds, &temp_creds[count]);
++            krb5_free_cred_contents(context, &creds);
++            temp_creds[count+1] = NULL;
++            if (retval)
++                goto cleanup;
+             count ++;
+ 
+             if (count == (chunk_count * CHUNK -1)){
+                 chunk_count ++;
+-                if (!(temp_creds = (krb5_creds **) realloc(temp_creds,
+-                                                           chunk_count * CHUNK * sizeof(krb5_creds *)))){
+-                    return ENOMEM;
+-                }
++
++                temp_creds = xrealloc(temp_creds,
++                                      chunk_count * CHUNK *
++                                      sizeof(*temp_creds));
+             }
+         }
+ 
+@@ -239,13 +234,15 @@ krb5_get_nonexp_tkts(krb5_context context, krb5_ccache cc,
+ 
+     temp_creds[count] = NULL;
+     *creds_array   = temp_creds;
++    temp_creds = NULL;
+ 
+     if (retval == KRB5_CC_END) {
+         retval = krb5_cc_end_seq_get(context, cc, &cur);
+     }
+ 
++cleanup:
++    free_creds_list(context, temp_creds);
+     return retval;
+-
+ }
+ 
+ krb5_error_code
+@@ -315,122 +312,33 @@ printtime(krb5_timestamp ts)
+         printf("%s", fmtbuf);
+ }
+ 
+-
+-krb5_error_code
+-krb5_get_login_princ(const char *luser, char ***princ_list)
+-{
+-    struct stat sbuf;
+-    struct passwd *pwd;
+-    char pbuf[MAXPATHLEN];
+-    FILE *fp;
+-    char * linebuf;
+-    char *newline;
+-    int gobble, result;
+-    char ** buf_out;
+-    struct stat st_temp;
+-    int count = 0, chunk_count = 1;
+-
+-    /* no account => no access */
+-
+-    if ((pwd = getpwnam(luser)) == NULL) {
+-        return 0;
+-    }
+-    result = snprintf(pbuf, sizeof(pbuf), "%s/.k5login", pwd->pw_dir);
+-    if (SNPRINTF_OVERFLOW(result, sizeof(pbuf))) {
+-        fprintf(stderr, _("home directory path for %s too long\n"), luser);
+-        exit (1);
+-    }
+-
+-    if (stat(pbuf, &st_temp)) {  /* not accessible */
+-        return 0;
+-    }
+-
+-
+-    /* open ~/.k5login */
+-    if ((fp = fopen(pbuf, "r")) == NULL) {
+-        return 0;
+-    }
+-    /*
+-     * For security reasons, the .k5login file must be owned either by
+-     * the user himself, or by root.  Otherwise, don't grant access.
+-     */
+-    if (fstat(fileno(fp), &sbuf)) {
+-        fclose(fp);
+-        return 0;
+-    }
+-    if ((sbuf.st_uid != pwd->pw_uid) && sbuf.st_uid) {
+-        fclose(fp);
+-        return 0;
+-    }
+-
+-    /* check each line */
+-
+-
+-    if( !(linebuf = (char *) calloc (BUFSIZ, sizeof(char)))) return ENOMEM;
+-
+-    if (!(buf_out = (char **) malloc( CHUNK * sizeof(char *)))) return ENOMEM;
+-
+-    while ( fgets(linebuf, BUFSIZ, fp) != NULL) {
+-        /* null-terminate the input string */
+-        linebuf[BUFSIZ-1] = '\0';
+-        newline = NULL;
+-        /* nuke the newline if it exists */
+-        if ((newline = strchr(linebuf, '\n')))
+-            *newline = '\0';
+-
+-        buf_out[count] = linebuf;
+-        count ++;
+-
+-        if (count == (chunk_count * CHUNK -1)){
+-            chunk_count ++;
+-            if (!(buf_out = (char **) realloc(buf_out,
+-                                              chunk_count * CHUNK * sizeof(char *)))){
+-                return ENOMEM;
+-            }
+-        }
+-
+-        /* clean up the rest of the line if necessary */
+-        if (!newline)
+-            while (((gobble = getc(fp)) != EOF) && gobble != '\n');
+-
+-        if( !(linebuf = (char *) calloc (BUFSIZ, sizeof(char)))) return ENOMEM;
+-    }
+-
+-    buf_out[count] = NULL;
+-    *princ_list = buf_out;
+-    fclose(fp);
+-    return 0;
+-}
+-
+ void
+ show_credential(krb5_context context, krb5_creds *cred, krb5_ccache cc)
+ {
+     krb5_error_code retval;
+-    char *name, *sname, *flags;
++    char *name = NULL, *sname = NULL, *defname = NULL, *flags;
+     int first = 1;
+-    krb5_principal princ;
+-    char * defname;
++    krb5_principal princ = NULL;
+     int show_flags =1;
+ 
+     retval = krb5_unparse_name(context, cred->client, &name);
+     if (retval) {
+         com_err(prog_name, retval, _("while unparsing client name"));
+-        return;
++        goto cleanup;
+     }
+     retval = krb5_unparse_name(context, cred->server, &sname);
+     if (retval) {
+         com_err(prog_name, retval, _("while unparsing server name"));
+-        free(name);
+-        return;
++        goto cleanup;
+     }
+ 
+     if ((retval = krb5_cc_get_principal(context, cc, &princ))) {
+         com_err(prog_name, retval, _("while retrieving principal name"));
+-        return;
++        goto cleanup;
+     }
+     if ((retval = krb5_unparse_name(context, princ, &defname))) {
+         com_err(prog_name, retval, _("while unparsing principal name"));
+-        return;
++        goto cleanup;
+     }
+ 
+     if (!cred->times.starttime)
+@@ -468,8 +376,12 @@ show_credential(krb5_context context, krb5_creds *cred, krb5_ccache cc)
+         }
+     }
+     putchar('\n');
++
++cleanup:
+     free(name);
+     free(sname);
++    free(defname);
++    krb5_free_principal(context, princ);
+ }
+ 
+ /* Create a random string suitable for a filename extension. */
+@@ -501,37 +413,26 @@ krb5_ccache_overwrite(krb5_context context, krb5_ccache ccs, krb5_ccache cct,
+                       krb5_principal primary_principal)
+ {
+     krb5_error_code retval=0;
+-    krb5_principal temp_principal;
++    krb5_principal defprinc = NULL, princ;
+     krb5_creds ** ccs_creds_arr = NULL;
+-    int i=0;
+ 
+     if (ks_ccache_is_initialized(context, ccs)) {
+-        if ((retval = krb5_get_nonexp_tkts(context,  ccs, &ccs_creds_arr))){
+-            return retval;
+-        }
++        retval = krb5_get_nonexp_tkts(context,  ccs, &ccs_creds_arr);
++        if (retval)
++            goto cleanup;
+     }
+ 
+-    if (ks_ccache_is_initialized(context, cct)) {
+-        if ((retval = krb5_cc_get_principal(context, cct, &temp_principal))){
+-            return retval;
+-        }
+-    }else{
+-        temp_principal = primary_principal;
+-    }
+-
+-    if ((retval = krb5_cc_initialize(context, cct, temp_principal))){
+-        return retval;
+-    }
++    retval = krb5_cc_get_principal(context, cct, &defprinc);
++    princ = (retval == 0) ? defprinc : primary_principal;
++    retval = krb5_cc_initialize(context, cct, princ);
++    if (retval)
++        goto cleanup;
+ 
+     retval = krb5_store_all_creds(context, cct, ccs_creds_arr, NULL);
+ 
+-    if (ccs_creds_arr){
+-        while (ccs_creds_arr[i]){
+-            krb5_free_creds(context, ccs_creds_arr[i]);
+-            i++;
+-        }
+-    }
+-
++cleanup:
++    free_creds_list(context, ccs_creds_arr);
++    krb5_free_principal(context, defprinc);
+     return retval;
+ }
+ 
+@@ -585,45 +486,40 @@ krb5_error_code
+ krb5_ccache_filter(krb5_context context, krb5_ccache cc, krb5_principal prst)
+ {
+ 
+-    int i=0;
+     krb5_error_code retval=0;
+-    krb5_principal temp_principal;
++    krb5_principal temp_principal = NULL;
+     krb5_creds ** cc_creds_arr = NULL;
+     const char * cc_name;
+     krb5_boolean stored;
+ 
+-    cc_name = krb5_cc_get_name(context, cc);
++    if (!ks_ccache_is_initialized(context, cc))
++        return 0;
+ 
+-    if (ks_ccache_is_initialized(context, cc)) {
+-        if (auth_debug) {
+-            fprintf(stderr,"putting cache %s through a filter for -z option\n",                     cc_name);
+-        }
++    if (auth_debug) {
++        cc_name = krb5_cc_get_name(context, cc);
++        fprintf(stderr, "putting cache %s through a filter for -z option\n",
++                cc_name);
++    }
+ 
+-        if ((retval = krb5_get_nonexp_tkts(context, cc, &cc_creds_arr))){
+-            return retval;
+-        }
++    retval = krb5_get_nonexp_tkts(context, cc, &cc_creds_arr);
++    if (retval)
++        goto cleanup;
+ 
+-        if ((retval = krb5_cc_get_principal(context, cc, &temp_principal))){
+-            return retval;
+-        }
++    retval = krb5_cc_get_principal(context, cc, &temp_principal);
++    if (retval)
++        goto cleanup;
+ 
+-        if ((retval = krb5_cc_initialize(context, cc, temp_principal))){
+-            return retval;
+-        }
++    retval = krb5_cc_initialize(context, cc, temp_principal);
++    if (retval)
++        goto cleanup;
+ 
+-        if ((retval = krb5_store_some_creds(context, cc, cc_creds_arr,
+-                                            NULL, prst, &stored))){
+-            return retval;
+-        }
++    retval = krb5_store_some_creds(context, cc, cc_creds_arr, NULL, prst,
++                                   &stored);
+ 
+-        if (cc_creds_arr){
+-            while (cc_creds_arr[i]){
+-                krb5_free_creds(context, cc_creds_arr[i]);
+-                i++;
+-            }
+-        }
+-    }
+-    return 0;
++cleanup:
++    free_creds_list(context, cc_creds_arr);
++    krb5_free_principal(context, temp_principal);
++    return retval;
+ }
+ 
+ krb5_boolean
+@@ -654,17 +550,20 @@ krb5_error_code
+ krb5_find_princ_in_cache(krb5_context context, krb5_ccache cc,
+                          krb5_principal princ, krb5_boolean *found)
+ {
+-    krb5_error_code retval;
++    krb5_error_code retval = 0;
+     krb5_creds ** creds_list = NULL;
+ 
+     if (ks_ccache_is_initialized(context, cc)) {
+-        if ((retval = krb5_get_nonexp_tkts(context, cc, &creds_list))){
+-            return retval;
+-        }
++        retval = krb5_get_nonexp_tkts(context, cc, &creds_list);
++        if (retval)
++            goto cleanup;
+     }
+ 
+     *found = krb5_find_princ_in_cred_list(context, creds_list, princ);
+-    return 0;
++
++cleanup:
++    free_creds_list(context, creds_list);
++    return retval;
+ }
+ 
+ krb5_boolean
+diff --git a/src/clients/ksu/heuristic.c b/src/clients/ksu/heuristic.c
+index e906de8ef0..6ed94eb887 100644
+--- a/src/clients/ksu/heuristic.c
++++ b/src/clients/ksu/heuristic.c
+@@ -149,28 +149,31 @@ filter(FILE *fp, char *cmd, char **k5users_list, char ***k5users_filt_list)
+ 
+     *k5users_filt_list = NULL;
+ 
+-    if (! k5users_list){
++    if (k5users_list == NULL)
+         return 0;
+-    }
+ 
+     while(k5users_list[i]){
++        free(out_cmd);
++        out_cmd = NULL;
+ 
+         retval= k5users_lookup(fp, k5users_list[i], cmd, &found, &out_cmd);
+         if (retval)
+-            return retval;
++            goto cleanup;
+ 
+         if (found == FALSE){
+             free (k5users_list[i]);
+             k5users_list[i] = NULL;
+-            if (out_cmd) gb_err = out_cmd;
++            if (out_cmd) {
++                gb_err = out_cmd;
++                out_cmd = NULL;
++            }
+         } else
+             found_count ++;
+ 
+         i++;
+     }
+ 
+-    if (! (temp_filt_list = (char **) calloc(found_count +1, sizeof (char*))))
+-        return ENOMEM;
++    temp_filt_list = xcalloc(found_count + 1, sizeof(*temp_filt_list));
+ 
+     for(j= 0, k=0; j < i; j++ ) {
+         if (k5users_list[j]){
+@@ -184,7 +187,10 @@ filter(FILE *fp, char *cmd, char **k5users_list, char ***k5users_filt_list)
+     free (k5users_list);
+ 
+     *k5users_filt_list = temp_filt_list;
+-    return 0;
++
++cleanup:
++    free(out_cmd);
++    return retval;
+ }
+ 
+ krb5_error_code
+@@ -318,7 +324,7 @@ get_closest_principal(krb5_context context, char **plist,
+ 
+         retval = krb5_parse_name(context, plist[i], &temp_client);
+         if (retval)
+-            return retval;
++            goto cleanup;
+ 
+         pnelem = krb5_princ_size(context, temp_client);
+ 
+@@ -346,6 +352,7 @@ get_closest_principal(krb5_context context, char **plist,
+                 if(best_client){
+                     if(krb5_princ_size(context, best_client) >
+                        krb5_princ_size(context, temp_client)){
++                        krb5_free_principal(context, best_client);
+                         best_client = temp_client;
+                     }
+                 }else
+@@ -358,9 +365,12 @@ get_closest_principal(krb5_context context, char **plist,
+     if (best_client) {
+         *found = TRUE;
+         *client = best_client;
++        best_client = NULL;
+     }
+ 
+-    return 0;
++cleanup:
++    krb5_free_principal(context, best_client);
++    return retval;
+ }
+ 
+ /****************************************************************
+@@ -471,6 +481,7 @@ find_princ_in_list(krb5_context context, krb5_principal princ, char **plist,
+         i++;
+     }
+ 
++    free(princname);
+     return 0;
+ 
+ }
+@@ -498,11 +509,9 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid,
+ {
+ 
+     princ_info princ_trials[10];
+-    krb5_principal cc_def_princ = NULL;
+-    krb5_principal temp_client;
+-    krb5_principal target_client;
+-    krb5_principal source_client;
+-    krb5_principal end_server;
++    krb5_principal cc_def_princ = NULL, temp_client = NULL;
++    krb5_principal target_client = NULL, source_client = NULL;
++    krb5_principal end_server = NULL;
+     krb5_error_code retval;
+     char ** aplist =NULL;
+     krb5_boolean found = FALSE;
+@@ -519,54 +528,59 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid,
+     if (ks_ccache_is_initialized(context, cc_source)) {
+         retval = krb5_cc_get_principal(context, cc_source, &cc_def_princ);
+         if (retval)
+-            return retval;
++            goto cleanup;
+     }
+ 
+     retval=krb5_parse_name(context, target_user, &target_client);
+     if (retval)
+-        return retval;
++        goto cleanup;
+ 
+     retval=krb5_parse_name(context, source_user, &source_client);
+     if (retval)
+-        return retval;
++        goto cleanup;
+ 
+-    if (source_uid == 0){
+-        if (target_uid != 0)
+-            *client = target_client; /* this will be used to restrict
+-                                        the cache copty */
+-        else {
+-            if(cc_def_princ)
+-                *client = cc_def_princ;
+-            else
+-                *client = target_client;
++    if (source_uid == 0) {
++        if (target_uid != 0) {
++            /* This will be used to restrict the cache copy. */
++            *client = target_client;
++            target_client = NULL;
++        } else if (cc_def_princ != NULL) {
++            *client = cc_def_princ;
++            cc_def_princ = NULL;
++        } else {
++            *client = target_client;
++            target_client = NULL;
+         }
+-
+         if (auth_debug)
+             printf(" GET_best_princ_for_target: via source_uid == 0\n");
+-
+-        return 0;
++        goto cleanup;
+     }
+ 
+     /* from here on, the code is for source_uid !=  0 */
+ 
+     if (source_uid && (source_uid == target_uid)){
+-        if(cc_def_princ)
++        if (cc_def_princ != NULL) {
+             *client = cc_def_princ;
+-        else
++            cc_def_princ = NULL;
++        } else {
+             *client = target_client;
++            target_client = NULL;
++        }
+         if (auth_debug)
+             printf("GET_best_princ_for_target: via source_uid == target_uid\n");
+-        return 0;
++        goto cleanup;
+     }
+ 
+     /* Become root, then target for looking at .k5login.*/
+     if (krb5_seteuid(0) || krb5_seteuid(target_uid) ) {
+-        return errno;
++        retval = errno;
++        goto cleanup;
+     }
+ 
+     /* if .k5users and .k5login do not exist */
+     if (stat(k5login_path, &tb) && stat(k5users_path, &tb) ){
+         *client = target_client;
++        target_client = NULL;
+ 
+         if (cmd)
+             *path_out = NOT_AUTHORIZED;
+@@ -574,26 +588,25 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid,
+         if (auth_debug)
+             printf(" GET_best_princ_for_target: via no auth files path\n");
+ 
+-        return 0;
++        goto cleanup;
+     }else{
+         retval = get_authorized_princ_names(target_user, cmd, &aplist);
+         if (retval)
+-            return retval;
++            goto cleanup;
+ 
+         /* .k5users or .k5login exist, but no authorization */
+         if ((!aplist) || (!aplist[0])) {
+             *path_out = NOT_AUTHORIZED;
+             if (auth_debug)
+                 printf("GET_best_princ_for_target: via empty auth files path\n");
+-            return 0;
++            goto cleanup;
+         }
+     }
+ 
+     retval = krb5_sname_to_principal(context, hostname, NULL,
+                                      KRB5_NT_SRV_HST, &end_server);
+     if (retval)
+-        return retval;
+-
++        goto cleanup;
+ 
+     /* first see if default principal of the source cache
+      * can get us in, then the target_user@realm, then the
+@@ -616,7 +629,7 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid,
+             retval= find_princ_in_list(context, princ_trials[i].p, aplist,
+                                        &found);
+             if (retval)
+-                return retval;
++                goto cleanup;
+ 
+             if (found == TRUE){
+                 princ_trials[i].found = TRUE;
+@@ -625,12 +638,13 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid,
+                                              princ_trials[i].p,
+                                              end_server, &found);
+                 if (retval)
+-                    return retval;
++                    goto cleanup;
+                 if (found == TRUE){
+-                    *client = princ_trials[i].p;
++                    retval = krb5_copy_principal(context, princ_trials[i].p,
++                                                 client);
+                     if (auth_debug)
+                         printf("GET_best_princ_for_target: via ticket file, choice #%d\n", i);
+-                    return 0;
++                    goto cleanup;
+                 }
+             }
+         }
+@@ -643,21 +657,23 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid,
+     while (aplist[i]){
+         retval = krb5_parse_name(context, aplist[i], &temp_client);
+         if (retval)
+-            return retval;
++            goto cleanup;
+ 
+         retval = find_either_ticket (context, cc_source, temp_client,
+                                      end_server, &found);
+         if (retval)
+-            return retval;
++            goto cleanup;
+ 
+         if (found == TRUE){
+             if (auth_debug)
+                 printf("GET_best_princ_for_target: via ticket file, choice: any ok ticket \n" );
+             *client = temp_client;
+-            return 0;
++            temp_client = NULL;
++            goto cleanup;
+         }
+ 
+         krb5_free_principal(context, temp_client);
++        temp_client = NULL;
+ 
+         i++;
+     }
+@@ -668,11 +684,11 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid,
+ 
+     for (i=0; i < count; i ++){
+         if (princ_trials[i].found == TRUE){
+-            *client = princ_trials[i].p;
++            retval = krb5_copy_principal(context, princ_trials[i].p, client);
+ 
+             if (auth_debug)
+                 printf("GET_best_princ_for_target: via prompt passwd list choice #%d \n",i);
+-            return  0;
++            goto cleanup;
+         }
+     }
+ 
+@@ -682,7 +698,7 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid,
+             retval=krb5_copy_principal(context, princ_trials[i].p,
+                                        &temp_client);
+             if(retval)
+-                return retval;
++                goto cleanup;
+ 
+             /* get the client name that is the closest
+                to the three princ in trials */
+@@ -690,15 +706,15 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid,
+             retval=get_closest_principal(context, aplist, &temp_client,
+                                          &found);
+             if(retval)
+-                return retval;
++                goto cleanup;
+ 
+             if (found == TRUE){
+                 *client = temp_client;
++                temp_client = NULL;
+                 if (auth_debug)
+                     printf("GET_best_princ_for_target: via prompt passwd list choice: approximation of princ in trials # %d \n",i);
+-                return 0;
++                goto cleanup;
+             }
+-            krb5_free_principal(context, temp_client);
+         }
+     }
+ 
+@@ -709,5 +725,13 @@ get_best_princ_for_target(krb5_context context, uid_t source_uid,
+         printf( "GET_best_princ_for_target: out of luck, can't get appropriate default principal\n");
+ 
+     *path_out = NOT_AUTHORIZED;
+-    return 0;
++    retval = 0;
++
++cleanup:
++    krb5_free_principal(context, cc_def_princ);
++    krb5_free_principal(context, target_client);
++    krb5_free_principal(context, source_client);
++    krb5_free_principal(context, temp_client);
++    krb5_free_principal(context, end_server);
++    return retval;
+ }
+diff --git a/src/clients/ksu/krb_auth_su.c b/src/clients/ksu/krb_auth_su.c
+index db10251f95..68cfe6b0ed 100644
+--- a/src/clients/ksu/krb_auth_su.c
++++ b/src/clients/ksu/krb_auth_su.c
+@@ -37,33 +37,31 @@ krb5_auth_check(krb5_context context, krb5_principal client_pname,
+                 char *target_user, krb5_ccache cc, int *path_passwd,
+                 uid_t target_uid)
+ {
+-    krb5_principal client;
++    krb5_principal client = NULL;
+     krb5_verify_init_creds_opt vfy_opts;
+-    krb5_creds tgt, tgtq;
++    krb5_creds tgt = { 0 }, tgtq = { 0 };
+     krb5_error_code retval =0;
+     int got_it = 0;
+     krb5_boolean zero_password;
++    krb5_boolean ok = FALSE;
+ 
+     *path_passwd = 0;
+-    memset(&tgtq, 0, sizeof(tgtq));
+-    memset(&tgt, 0, sizeof(tgt));
+ 
+     if ((retval= krb5_copy_principal(context,  client_pname, &client))){
+         com_err(prog_name, retval, _("while copying client principal"));
+-        return (FALSE) ;
++        goto cleanup;
+     }
+ 
+     if ((retval= krb5_copy_principal(context,  client, &tgtq.client))){
+         com_err(prog_name, retval, _("while copying client principal"));
+-        return (FALSE) ;
++        goto cleanup;
+     }
+ 
+     if ((retval = ksu_tgtname(context,  krb5_princ_realm(context, client),
+                               krb5_princ_realm(context, client),
+                               &tgtq.server))){
+         com_err(prog_name, retval, _("while creating tgt for local realm"));
+-        krb5_free_principal(context, client);
+-        return (FALSE) ;
++        goto cleanup;
+     }
+ 
+     if (auth_debug){ dump_principal(context, "local tgt principal name", tgtq.server ); }
+@@ -77,7 +75,7 @@ krb5_auth_check(krb5_context context, krb5_principal client_pname,
+         if ((retval != KRB5_CC_NOTFOUND) &&
+             (retval != KRB5KRB_AP_ERR_TKT_EXPIRED)){
+             com_err(prog_name, retval, _("while retrieving creds from cache"));
+-            return (FALSE) ;
++            goto cleanup;
+         }
+     } else{
+         got_it = 1;
+@@ -88,7 +86,7 @@ krb5_auth_check(krb5_context context, krb5_principal client_pname,
+ #ifdef GET_TGT_VIA_PASSWD
+         if (krb5_seteuid(0)||krb5_seteuid(target_uid)) {
+             com_err("ksu", errno, _("while switching to target uid"));
+-            return FALSE;
++            goto cleanup;
+         }
+ 
+ 
+@@ -102,19 +100,19 @@ krb5_auth_check(krb5_context context, krb5_principal client_pname,
+                                    &tgt) == FALSE) {
+             krb5_seteuid(0);
+ 
+-            return FALSE;
++            goto cleanup;
+         }
+         *path_passwd = 1;
+         if (krb5_seteuid(0)) {
+             com_err("ksu", errno, _("while reclaiming root uid"));
+-            return FALSE;
++            goto cleanup;
+         }
+ 
+ #else
+         plain_dump_principal (context, client);
+         fprintf(stderr,
+                 _("does not have any appropriate tickets in the cache.\n"));
+-        return FALSE;
++        goto cleanup;
+ 
+ #endif /* GET_TGT_VIA_PASSWD */
+ 
+@@ -126,10 +124,16 @@ krb5_auth_check(krb5_context context, krb5_principal client_pname,
+                                     &vfy_opts);
+     if (retval) {
+         com_err(prog_name, retval, _("while verifying ticket for server"));
+-        return (FALSE);
++        goto cleanup;
+     }
+ 
+-    return (TRUE);
++    ok = TRUE;
++
++cleanup:
++    krb5_free_principal(context, client);
++    krb5_free_cred_contents(context, &tgt);
++    krb5_free_cred_contents(context, &tgtq);
++    return ok;
+ }
+ 
+ krb5_boolean
+@@ -137,11 +141,12 @@ ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client,
+                        krb5_get_init_creds_opt *options,
+                        krb5_boolean *zero_password, krb5_creds *creds_out)
+ {
++    krb5_boolean ok = FALSE;
+     krb5_error_code code;
+-    krb5_creds creds;
++    krb5_creds creds = { 0 };
+     krb5_timestamp now;
+     unsigned int pwsize;
+-    char password[255], *client_name, prompt[255];
++    char password[255], prompt[255], *client_name = NULL;
+     int result;
+ 
+     *zero_password = FALSE;
+@@ -150,14 +155,14 @@ ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client,
+ 
+     if ((code = krb5_unparse_name(context, client, &client_name))) {
+         com_err (prog_name, code, _("when unparsing name"));
+-        return (FALSE);
++        goto cleanup;
+     }
+ 
+     memset(&creds, 0, sizeof(creds));
+ 
+     if ((code = krb5_timeofday(context, &now))) {
+         com_err(prog_name, code, _("while getting time of day"));
+-        return (FALSE);
++        goto cleanup;
+     }
+ 
+     result = snprintf(prompt, sizeof(prompt), _("Kerberos password for %s: "),
+@@ -166,7 +171,7 @@ ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client,
+         fprintf(stderr,
+                 _("principal name %s too long for internal buffer space\n"),
+                 client_name);
+-        return FALSE;
++        goto cleanup;
+     }
+ 
+     pwsize = sizeof(password);
+@@ -175,13 +180,13 @@ ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client,
+     if (code ) {
+         com_err(prog_name, code, _("while reading password for '%s'\n"),
+                 client_name);
+-        return (FALSE);
++        goto cleanup;
+     }
+ 
+     if ( pwsize == 0) {
+         fprintf(stderr, _("No password given\n"));
+         *zero_password = TRUE;
+-        return (FALSE);
++        goto cleanup;
+     }
+ 
+     code = krb5_get_init_creds_password(context, &creds, client, password,
+@@ -195,13 +200,19 @@ ksu_get_tgt_via_passwd(krb5_context context, krb5_principal client,
+             fprintf(stderr, _("%s: Password incorrect\n"), prog_name);
+         else
+             com_err(prog_name, code, _("while getting initial credentials"));
+-        return (FALSE);
++        goto cleanup;
+     }
+-    if (creds_out != NULL)
++    if (creds_out != NULL) {
+         *creds_out = creds;
+-    else
+-        krb5_free_cred_contents(context, &creds);
+-    return (TRUE);
++        memset(&creds, 0, sizeof(creds));
++    }
++
++    ok = TRUE;
++
++cleanup:
++    krb5_free_cred_contents(context, &creds);
++    free(client_name);
++    return ok;
+ }
+ 
+ void
+@@ -213,8 +224,10 @@ dump_principal(krb5_context context, char *str, krb5_principal p)
+     if ((retval = krb5_unparse_name(context, p, &stname))) {
+         fprintf(stderr, _(" %s while unparsing name\n"),
+                 error_message(retval));
++        return;
+     }
+     fprintf(stderr, " %s: %s\n", str, stname);
++    free(stname);
+ }
+ 
+ void
+@@ -226,71 +239,8 @@ plain_dump_principal (krb5_context context, krb5_principal p)
+     if ((retval = krb5_unparse_name(context, p, &stname))) {
+         fprintf(stderr, _(" %s while unparsing name\n"),
+                 error_message(retval));
++        return;
+     }
+     fprintf(stderr, "%s ", stname);
+-}
+-
+-
+-/**********************************************************************
+-returns the principal that is closest to client. plist contains
+-a principal list obtained from .k5login and parhaps .k5users file.
+-This routine gets called before getting the password for a tgt.
+-A principal is picked that has the best chance of getting in.
+-
+-**********************************************************************/
+-
+-krb5_error_code
+-get_best_principal(krb5_context context, char **plist, krb5_principal *client)
+-{
+-    krb5_error_code retval =0;
+-    krb5_principal temp_client, best_client = NULL;
+-
+-    int i = 0, nelem;
+-
+-    if (! plist ) return 0;
+-
+-    nelem = krb5_princ_size(context, *client);
+-
+-    while(plist[i]){
+-
+-        if ((retval = krb5_parse_name(context, plist[i], &temp_client))){
+-            return retval;
+-        }
+-
+-        if (data_eq(*krb5_princ_realm(context, *client),
+-                    *krb5_princ_realm(context, temp_client))) {
+-
+-            if (nelem &&
+-                krb5_princ_size(context, *client) > 0 &&
+-                krb5_princ_size(context, temp_client) > 0) {
+-                krb5_data *p1 =
+-                    krb5_princ_component(context, *client, 0);
+-                krb5_data *p2 =
+-                    krb5_princ_component(context, temp_client, 0);
+-
+-                if (data_eq(*p1, *p2)) {
+-
+-                    if (auth_debug){
+-                        fprintf(stderr,
+-                                "get_best_principal: compare with %s\n",
+-                                plist[i]);
+-                    }
+-
+-                    if(best_client){
+-                        if(krb5_princ_size(context, best_client) >
+-                           krb5_princ_size(context, temp_client)){
+-                            best_client = temp_client;
+-                        }
+-                    }else{
+-                        best_client = temp_client;
+-                    }
+-                }
+-            }
+-
+-        }
+-        i++;
+-    }
+-
+-    if (best_client) *client = best_client;
+-    return 0;
++    free(stname);
+ }
+diff --git a/src/clients/ksu/ksu.h b/src/clients/ksu/ksu.h
+index 66fb4bcc6a..32ce11cb85 100644
+--- a/src/clients/ksu/ksu.h
++++ b/src/clients/ksu/ksu.h
+@@ -92,9 +92,6 @@ extern void plain_dump_principal
+ extern krb5_error_code krb5_parse_lifetime
+ (char *, long *);
+ 
+-extern krb5_error_code get_best_principal
+-(krb5_context, char **, krb5_principal *);
+-
+ /* ccache.c */
+ extern krb5_error_code krb5_ccache_copy
+ (krb5_context, krb5_ccache, krb5_principal, krb5_ccache,
+@@ -117,9 +114,6 @@ extern krb5_error_code krb5_check_exp
+ 
+ extern char *flags_string (krb5_creds *);
+ 
+-extern krb5_error_code krb5_get_login_princ
+-(const char *, char ***);
+-
+ extern void show_credential
+ (krb5_context, krb5_creds *, krb5_ccache);
+ 
+diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
+index 2a351662c8..77703a6a2b 100644
+--- a/src/clients/ksu/main.c
++++ b/src/clients/ksu/main.c
+@@ -1002,7 +1002,7 @@ resolve_target_cache(krb5_context context, krb5_principal princ,
+             if (retval) {
+                 com_err(prog_name, retval,
+                         _("while generating part of the target ccache name"));
+-                return retval;
++                goto cleanup;
+             }
+             if (asprintf(&ccname, "%s.%s", target, sym) < 0) {
+                 retval = ENOMEM;
+@@ -1014,6 +1014,7 @@ resolve_target_cache(krb5_context context, krb5_principal princ,
+             free(sym);
+         } while (ks_ccache_name_is_initialized(context, ccname));
+         retval = krb5_cc_resolve(context, ccname, &ccache);
++        free(ccname);
+     } else {
+         /* Look for a cache in the collection that we can reuse. */
+         retval = krb5_cc_cache_match(context, princ, &ccache);
+diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c
+index 26f340af31..976c8969e8 100644
+--- a/src/kadmin/cli/keytab.c
++++ b/src/kadmin/cli/keytab.c
+@@ -363,7 +363,7 @@ remove_principal(char *keytab_str, krb5_keytab keytab,
+ {
+     krb5_principal princ = NULL;
+     krb5_keytab_entry entry;
+-    krb5_kt_cursor cursor;
++    krb5_kt_cursor cursor = NULL;
+     enum { UNDEF, SPEC, HIGH, ALL, OLD } mode;
+     int code, did_something;
+     krb5_kvno kvno;
+@@ -443,6 +443,7 @@ remove_principal(char *keytab_str, krb5_keytab keytab,
+                         _("while temporarily ending keytab scan"));
+                 goto cleanup;
+             }
++            cursor = NULL;
+             code = krb5_kt_remove_entry(context, keytab, &entry);
+             if (code != 0) {
+                 com_err(whoami, code, _("while deleting entry from keytab"));
+@@ -471,6 +472,7 @@ remove_principal(char *keytab_str, krb5_keytab keytab,
+         com_err(whoami, code, _("while ending keytab scan"));
+         goto cleanup;
+     }
++    cursor = NULL;
+ 
+     /*
+      * If !did_someting then mode must be OLD or we would have
+@@ -483,6 +485,8 @@ remove_principal(char *keytab_str, krb5_keytab keytab,
+     }
+ 
+ cleanup:
++    if (cursor != NULL)
++        (void)krb5_kt_end_seq_get(context, keytab, &cursor);
+     krb5_free_principal(context, princ);
+ }
+ 
+diff --git a/src/kadmin/ktutil/ktutil.c b/src/kadmin/ktutil/ktutil.c
+index 87a69ca145..a1c17d154d 100644
+--- a/src/kadmin/ktutil/ktutil.c
++++ b/src/kadmin/ktutil/ktutil.c
+@@ -254,6 +254,7 @@ ktutil_list(int argc, char *argv[])
+                                                buf, sizeof(buf)))) {
+                 com_err(argv[0], retval,
+                         _("While converting enctype to string"));
++                free(pname);
+                 return;
+             }
+             printf(" (%s) ", buf);
+diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c
+index f883ae2df8..9a4826e441 100644
+--- a/src/kprop/kpropd.c
++++ b/src/kprop/kpropd.c
+@@ -1300,19 +1300,20 @@ static krb5_boolean
+ authorized_principal(krb5_context context, krb5_principal p,
+                      krb5_enctype auth_etype)
+ {
+-    char *name, *ptr, buf[1024];
++    krb5_boolean ok = FALSE;
++    char *name = NULL, *ptr, buf[1024];
+     krb5_error_code retval;
+-    FILE *acl_file;
++    FILE *acl_file = NULL;
+     int end;
+     krb5_enctype acl_etype;
+ 
+     retval = krb5_unparse_name(context, p, &name);
+     if (retval)
+-        return FALSE;
++        goto cleanup;
+ 
+     acl_file = fopen(acl_file_name, "r");
+     if (acl_file == NULL)
+-        return FALSE;
++        goto cleanup;
+ 
+     while (!feof(acl_file)) {
+         if (!fgets(buf, sizeof(buf), acl_file))
+@@ -1342,14 +1343,16 @@ authorized_principal(krb5_context context, krb5_principal p,
+                  (acl_etype != auth_etype)))
+                 continue;
+ 
+-            free(name);
+-            fclose(acl_file);
+-            return TRUE;
++            ok = TRUE;
++            goto cleanup;
+         }
+     }
++
++cleanup:
+     free(name);
+-    fclose(acl_file);
+-    return FALSE;
++    if (acl_file != NULL)
++        fclose(acl_file);
++    return ok;
+ }
+ 
+ static void
+diff --git a/src/lib/gssapi/krb5/export_cred.c b/src/lib/gssapi/krb5/export_cred.c
+index 96a408c237..bf5cede54a 100644
+--- a/src/lib/gssapi/krb5/export_cred.c
++++ b/src/lib/gssapi/krb5/export_cred.c
+@@ -447,8 +447,10 @@ krb5_gss_export_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
+ 
+     /* Validate and lock cred_handle. */
+     status = krb5_gss_validate_cred_1(minor_status, cred_handle, context);
+-    if (status != GSS_S_COMPLETE)
++    if (status != GSS_S_COMPLETE) {
++        krb5_free_context(context);
+         return status;
++    }
+     cred = (krb5_gss_cred_id_t)cred_handle;
+ 
+     if (json_kgcred(context, cred, &jcred))
+diff --git a/src/lib/gssapi/krb5/val_cred.c b/src/lib/gssapi/krb5/val_cred.c
+index 83e7634106..d4b070f8c0 100644
+--- a/src/lib/gssapi/krb5/val_cred.c
++++ b/src/lib/gssapi/krb5/val_cred.c
+@@ -35,6 +35,7 @@ krb5_gss_validate_cred_1(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
+     krb5_gss_cred_id_t cred;
+     krb5_error_code code;
+     krb5_principal princ;
++    krb5_boolean same;
+ 
+     cred = (krb5_gss_cred_id_t) cred_handle;
+     k5_mutex_lock(&cred->lock);
+@@ -45,12 +46,13 @@ krb5_gss_validate_cred_1(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
+             *minor_status = code;
+             return(GSS_S_DEFECTIVE_CREDENTIAL);
+         }
+-        if (!krb5_principal_compare(context, princ, cred->name->princ)) {
++        same = krb5_principal_compare(context, princ, cred->name->princ);
++        (void)krb5_free_principal(context, princ);
++        if (!same) {
+             k5_mutex_unlock(&cred->lock);
+             *minor_status = KG_CCACHE_NOMATCH;
+             return(GSS_S_DEFECTIVE_CREDENTIAL);
+         }
+-        (void)krb5_free_principal(context, princ);
+     }
+     *minor_status = 0;
+     return GSS_S_COMPLETE;
+diff --git a/src/lib/kadm5/srv/server_kdb.c b/src/lib/kadm5/srv/server_kdb.c
+index 2ec80a0f2b..4efcaf9941 100644
+--- a/src/lib/kadm5/srv/server_kdb.c
++++ b/src/lib/kadm5/srv/server_kdb.c
+@@ -67,11 +67,10 @@ krb5_error_code kdb_init_master(kadm5_server_handle_t handle,
+     if (ret)
+         goto done;
+ 
+-    if ((ret = krb5_db_fetch_mkey_list(handle->context, master_princ,
+-                                       &master_keyblock))) {
++    ret = krb5_db_fetch_mkey_list(handle->context, master_princ,
++                                  &master_keyblock);
++    if (ret)
+         krb5_db_fini(handle->context);
+-        return (ret);
+-    }
+ 
+ done:
+     if (r == NULL)
+diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
+index c93e7c78e5..1f917d49bb 100644
+--- a/src/lib/krb5/ccache/cc_kcm.c
++++ b/src/lib/krb5/ccache/cc_kcm.c
+@@ -992,10 +992,14 @@ kcm_start_seq_get(krb5_context context, krb5_ccache cache,
+     if (cursor == NULL)
+         goto cleanup;
+     cursor->uuids = uuids;
++    uuids = NULL;
+     cursor->creds = creds;
++    creds = NULL;
+     *cursor_out = (krb5_cc_cursor)cursor;
+ 
+ cleanup:
++    free_cred_list(creds);
++    free_uuid_list(uuids);
+     kcmreq_free(&req);
+     return ret;
+ }
+diff --git a/src/lib/krb5/ccache/ccfns.c b/src/lib/krb5/ccache/ccfns.c
+index e0eb39a612..9b755f0e36 100644
+--- a/src/lib/krb5/ccache/ccfns.c
++++ b/src/lib/krb5/ccache/ccfns.c
+@@ -198,18 +198,18 @@ k5_build_conf_principals(krb5_context context, krb5_ccache id,
+     if (principal) {
+         ret = krb5_unparse_name(context, principal, &pname);
+         if (ret)
+-            return ret;
++            goto cleanup;
+     }
+ 
+     ret = krb5_build_principal(context, &cred->server,
+                                sizeof(conf_realm) - 1, conf_realm,
+                                conf_name, name, pname, (char *)NULL);
+-    krb5_free_unparsed_name(context, pname);
+-    if (ret) {
+-        krb5_free_principal(context, client);
+-        return ret;
+-    }
++    if (ret)
++        goto cleanup;
+     ret = krb5_copy_principal(context, client, &cred->client);
++
++cleanup:
++    krb5_free_unparsed_name(context, pname);
+     krb5_free_principal(context, client);
+     return ret;
+ }
+diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c
+index f3ea28c8ec..8fd1505115 100644
+--- a/src/lib/krb5/keytab/kt_file.c
++++ b/src/lib/krb5/keytab/kt_file.c
+@@ -456,15 +456,16 @@ krb5_ktfile_start_seq_get(krb5_context context, krb5_keytab id, krb5_kt_cursor *
+         return ENOMEM;
+     }
+     *fileoff = KTSTARTOFF(id);
+-    *cursorp = (krb5_kt_cursor)fileoff;
+     KTITERS(id)++;
+     if (KTITERS(id) == 0) {
+         /* Wrapped?!  */
+         KTITERS(id)--;
+         KTUNLOCK(id);
++        free(fileoff);
+         k5_setmsg(context, KRB5_KT_IOERR, "Too many keytab iterators active");
+         return KRB5_KT_IOERR;   /* XXX */
+     }
++    *cursorp = (krb5_kt_cursor)fileoff;
+     KTUNLOCK(id);
+ 
+     return 0;
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
+index 753929b06d..f7fad27867 100644
+--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
+@@ -271,16 +271,18 @@ krb5_ldap_delete_realm (krb5_context context, char *lrealm)
+         for (ent = ldap_first_entry (ld, result); ent != NULL;
+              ent = ldap_next_entry (ld, ent)) {
+             if ((values = ldap_get_values(ld, ent, "krbPrincipalName")) != NULL) {
+-                for (i = 0; values[i] != NULL; ++i) {
++                for (i = 0; values[i] != NULL && !st; ++i) {
+                     krb5_parse_name(context, values[i], &principal);
+                     if (principal_in_realm_2(principal, lrealm) == 0) {
+                         st=krb5_ldap_delete_principal(context, principal);
+-                        if (st && st != KRB5_KDB_NOENTRY)
+-                            goto cleanup;
++                        if (st == KRB5_KDB_NOENTRY)
++                            st = 0;
+                     }
+                     krb5_free_principal(context, principal);
+                 }
+                 ldap_value_free(values);
++                if (st)
++                    goto cleanup;
+             }
+         }
+     }
+-- 
+2.45.1
+
diff --git a/0019-Remove-klist-s-defname-global-variable.patch b/0019-Remove-klist-s-defname-global-variable.patch
new file mode 100644
index 0000000..1cf7d80
--- /dev/null
+++ b/0019-Remove-klist-s-defname-global-variable.patch
@@ -0,0 +1,71 @@
+From 05bb6d9c729a3c6a4ba35270368bc0f6e1875ad0 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Mon, 8 Jan 2024 16:52:27 +0100
+Subject: [PATCH] Remove klist's defname global variable
+
+Addition of a "cleanup" section in kinit's show_ccache() function as
+part of commit 6c5471176f5266564fbc8a7e02f03b4b042202f8 introduced a
+double-free bug, because defname is a global variable.  After the
+first call, successive calls may take place with a dangling pointer in
+defname, which will be freed if krb5_cc_get_principal() fails.
+
+Convert "defname" to a local variable initialized at the beginning of
+show_ccache().
+
+[ghudson@mit.edu: edited commit message]
+
+(cherry picked from commit 5b00197227231943bd2305328c8260dd0b0dbcf0)
+---
+ src/clients/klist/klist.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c
+index b5ae96a843..b5808e5c93 100644
+--- a/src/clients/klist/klist.c
++++ b/src/clients/klist/klist.c
+@@ -53,7 +53,6 @@ int show_flags = 0, show_time = 0, status_only = 0, show_keys = 0;
+ int show_etype = 0, show_addresses = 0, no_resolve = 0, print_version = 0;
+ int show_adtype = 0, show_all = 0, list_all = 0, use_client_keytab = 0;
+ int show_config = 0;
+-char *defname;
+ char *progname;
+ krb5_timestamp now;
+ unsigned int timestamp_width;
+@@ -62,7 +61,7 @@ krb5_context context;
+ 
+ static krb5_boolean is_local_tgt(krb5_principal princ, krb5_data *realm);
+ static char *etype_string(krb5_enctype );
+-static void show_credential(krb5_creds *);
++static void show_credential(krb5_creds *, const char *);
+ 
+ static void list_all_ccaches(void);
+ static int list_ccache(krb5_ccache);
+@@ -473,6 +472,7 @@ show_ccache(krb5_ccache cache)
+     krb5_creds creds;
+     krb5_principal princ = NULL;
+     krb5_error_code ret;
++    char *defname = NULL;
+     int status = 1;
+ 
+     ret = krb5_cc_get_principal(context, cache, &princ);
+@@ -503,7 +503,7 @@ show_ccache(krb5_ccache cache)
+     }
+     while ((ret = krb5_cc_next_cred(context, cache, &cur, &creds)) == 0) {
+         if (show_config || !krb5_is_config_principal(context, creds.server))
+-            show_credential(&creds);
++            show_credential(&creds, defname);
+         krb5_free_cred_contents(context, &creds);
+     }
+     if (ret == KRB5_CC_END) {
+@@ -676,7 +676,7 @@ print_config_data(int col, krb5_data *data)
+ }
+ 
+ static void
+-show_credential(krb5_creds *cred)
++show_credential(krb5_creds *cred, const char *defname)
+ {
+     krb5_error_code ret;
+     krb5_ticket *tkt = NULL;
+-- 
+2.45.1
+
diff --git a/0020-End-connection-on-KDC_ERR_SVC_UNAVAILABLE.patch b/0020-End-connection-on-KDC_ERR_SVC_UNAVAILABLE.patch
new file mode 100644
index 0000000..1674fd6
--- /dev/null
+++ b/0020-End-connection-on-KDC_ERR_SVC_UNAVAILABLE.patch
@@ -0,0 +1,34 @@
+From d7bcca2a215de880f4419afc450a96a747d48560 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 27 Oct 2023 00:44:53 -0400
+Subject: [PATCH] End connection on KDC_ERR_SVC_UNAVAILABLE
+
+In sendto_kdc.c:service_fds(), if a message handler indicates that a
+message should be discarded, kill the connection so we don't continue
+waiting on it for more data.
+
+ticket: 7899
+(cherry picked from commit ca80f64c786341d5871ae1de18142e62af64f7b9)
+---
+ src/lib/krb5/os/sendto_kdc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
+index 0f4bf23a95..262edf09b4 100644
+--- a/src/lib/krb5/os/sendto_kdc.c
++++ b/src/lib/krb5/os/sendto_kdc.c
+@@ -1440,7 +1440,10 @@ service_fds(krb5_context context, struct select_state *selstate,
+                 if (msg_handler != NULL) {
+                     krb5_data reply = make_data(state->in.buf, state->in.pos);
+ 
+-                    stop = (msg_handler(context, &reply, msg_handler_data) != 0);
++                    if (!msg_handler(context, &reply, msg_handler_data)) {
++                        kill_conn(context, state, selstate);
++                        stop = 0;
++                    }
+                 }
+ 
+                 if (stop) {
+-- 
+2.46.0
+
diff --git a/0021-Add-request_timeout-configuration-parameter.patch b/0021-Add-request_timeout-configuration-parameter.patch
new file mode 100644
index 0000000..5b84513
--- /dev/null
+++ b/0021-Add-request_timeout-configuration-parameter.patch
@@ -0,0 +1,226 @@
+From a07b3ae29fd972c40e30b95f6bcc8fb3ed4d9991 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Thu, 26 Oct 2023 14:20:34 -0400
+Subject: [PATCH] Add request_timeout configuration parameter
+
+Add a parameter to limit the total amount of time taken for a KDC or
+password change request.
+
+ticket: 9106 (new)
+(cherry picked from commit 802318cda963456b3ed7856c836e89da891483be)
+---
+ doc/admin/conf_files/krb5_conf.rst |  9 ++++++
+ src/include/k5-int.h               |  2 ++
+ src/lib/krb5/krb/init_ctx.c        | 14 +++++++-
+ src/lib/krb5/os/sendto_kdc.c       | 51 ++++++++++++++++++++----------
+ 4 files changed, 58 insertions(+), 18 deletions(-)
+
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index a33711d918..65fb592d98 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -356,6 +356,15 @@ The libdefaults section may contain any of the following relations:
+     (:ref:`duration` string.)  Sets the default renewable lifetime
+     for initial ticket requests.  The default value is 0.
+ 
++**request_timeout**
++    (:ref:`duration` string.)  Sets the maximum total time for KDC or
++    password change requests.  This timeout does not affect the
++    intervals between requests, so setting a low timeout may result in
++    fewer requests being attempted and/or some servers not being
++    contacted.  A value of 0 indicates no specific maximum, in which
++    case requests will time out if no server responds after several
++    tries.  The default value is 0.  (New in release 1.22.)
++
+ **spake_preauth_groups**
+     A whitespace or comma-separated list of words which specifies the
+     groups allowed for SPAKE preauthentication.  The possible values
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index b3e07945c1..69d6a6f569 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -296,6 +296,7 @@ typedef unsigned char   u_char;
+ #define KRB5_CONF_SPAKE_PREAUTH_INDICATOR      "spake_preauth_indicator"
+ #define KRB5_CONF_SPAKE_PREAUTH_KDC_CHALLENGE  "spake_preauth_kdc_challenge"
+ #define KRB5_CONF_SPAKE_PREAUTH_GROUPS         "spake_preauth_groups"
++#define KRB5_CONF_REQUEST_TIMEOUT              "request_timeout"
+ #define KRB5_CONF_TICKET_LIFETIME              "ticket_lifetime"
+ #define KRB5_CONF_UDP_PREFERENCE_LIMIT         "udp_preference_limit"
+ #define KRB5_CONF_UNLOCKITER                   "unlockiter"
+@@ -1200,6 +1201,7 @@ struct _krb5_context {
+     kdb5_dal_handle *dal_handle;
+     /* allowable clock skew */
+     krb5_deltat     clockskew;
++    krb5_deltat     req_timeout;
+     krb5_flags      kdc_default_options;
+     krb5_flags      library_options;
+     krb5_boolean    profile_secure;
+diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
+index 2b5abcd817..582a2945ff 100644
+--- a/src/lib/krb5/krb/init_ctx.c
++++ b/src/lib/krb5/krb/init_ctx.c
+@@ -157,7 +157,7 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+     krb5_context ctx = 0;
+     krb5_error_code retval;
+     int tmp;
+-    char *plugin_dir = NULL;
++    char *plugin_dir = NULL, *timeout_str = NULL;
+ 
+     /* Verify some assumptions.  If the assumptions hold and the
+        compiler is optimizing, this should result in no code being
+@@ -240,6 +240,17 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+     get_integer(ctx, KRB5_CONF_CLOCKSKEW, DEFAULT_CLOCKSKEW, &tmp);
+     ctx->clockskew = tmp;
+ 
++    retval = profile_get_string(ctx->profile, KRB5_CONF_LIBDEFAULTS,
++                                KRB5_CONF_REQUEST_TIMEOUT, NULL, NULL,
++                                &timeout_str);
++    if (retval)
++        goto cleanup;
++    if (timeout_str != NULL) {
++        retval = krb5_string_to_deltat(timeout_str, &ctx->req_timeout);
++        if (retval)
++            goto cleanup;
++    }
++
+     get_integer(ctx, KRB5_CONF_KDC_DEFAULT_OPTIONS, KDC_OPT_RENEWABLE_OK,
+                 &tmp);
+     ctx->kdc_default_options = tmp;
+@@ -281,6 +292,7 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+ 
+ cleanup:
+     profile_release_string(plugin_dir);
++    profile_release_string(timeout_str);
+     krb5_free_context(ctx);
+     return retval;
+ }
+diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
+index 262edf09b4..98247a1089 100644
+--- a/src/lib/krb5/os/sendto_kdc.c
++++ b/src/lib/krb5/os/sendto_kdc.c
+@@ -1395,34 +1395,41 @@ get_endtime(time_ms endtime, struct conn_state *conns)
+ 
+ static krb5_boolean
+ service_fds(krb5_context context, struct select_state *selstate,
+-            time_ms interval, struct conn_state *conns,
++            time_ms interval, time_ms timeout, struct conn_state *conns,
+             struct select_state *seltemp, const krb5_data *realm,
+             int (*msg_handler)(krb5_context, const krb5_data *, void *),
+             void *msg_handler_data, struct conn_state **winner_out)
+ {
+     int e, selret = 0;
+-    time_ms endtime;
++    time_ms curtime, interval_end, endtime;
+     struct conn_state *state;
+ 
+     *winner_out = NULL;
+ 
+-    e = get_curtime_ms(&endtime);
++    e = get_curtime_ms(&curtime);
+     if (e)
+         return TRUE;
+-    endtime += interval;
++    interval_end = curtime + interval;
+ 
+     e = 0;
+     while (selstate->nfds > 0) {
+-        e = cm_select_or_poll(selstate, get_endtime(endtime, conns),
+-                              seltemp, &selret);
++        endtime = get_endtime(interval_end, conns);
++        /* Don't wait longer than the whole request should last. */
++        if (timeout && endtime > timeout)
++            endtime = timeout;
++        e = cm_select_or_poll(selstate, endtime, seltemp, &selret);
+         if (e == EINTR)
+             continue;
+         if (e != 0)
+             break;
+ 
+-        if (selret == 0)
+-            /* Timeout, return to caller.  */
++        if (selret == 0) {
++            /* We timed out.  Stop if we hit the overall request timeout. */
++            if (timeout && (get_curtime_ms(&curtime) || curtime >= timeout))
++                return TRUE;
++            /* Otherwise return to the caller to send the next request. */
+             return FALSE;
++        }
+ 
+         /* Got something on a socket, process it.  */
+         for (state = conns; state != NULL; state = state->next) {
+@@ -1495,7 +1502,7 @@ k5_sendto(krb5_context context, const krb5_data *message,
+           void *msg_handler_data)
+ {
+     int pass;
+-    time_ms delay;
++    time_ms delay, timeout = 0;
+     krb5_error_code retval;
+     struct conn_state *conns = NULL, *state, **tailptr, *next, *winner;
+     size_t s;
+@@ -1505,6 +1512,13 @@ k5_sendto(krb5_context context, const krb5_data *message,
+ 
+     *reply = empty_data();
+ 
++    if (context->req_timeout) {
++        retval = get_curtime_ms(&timeout);
++        if (retval)
++            return retval;
++        timeout += 1000 * context->req_timeout;
++    }
++
+     /* One for use here, listing all our fds in use, and one for
+      * temporary use in service_fds, for the fds of interest.  */
+     sel_state = malloc(2 * sizeof(*sel_state));
+@@ -1532,8 +1546,9 @@ k5_sendto(krb5_context context, const krb5_data *message,
+             if (maybe_send(context, state, message, sel_state, realm,
+                            callback_info))
+                 continue;
+-            done = service_fds(context, sel_state, 1000, conns, seltemp,
+-                               realm, msg_handler, msg_handler_data, &winner);
++            done = service_fds(context, sel_state, 1000, timeout, conns,
++                               seltemp, realm, msg_handler, msg_handler_data,
++                               &winner);
+         }
+     }
+ 
+@@ -1545,13 +1560,13 @@ k5_sendto(krb5_context context, const krb5_data *message,
+         if (maybe_send(context, state, message, sel_state, realm,
+                        callback_info))
+             continue;
+-        done = service_fds(context, sel_state, 1000, conns, seltemp,
++        done = service_fds(context, sel_state, 1000, timeout, conns, seltemp,
+                            realm, msg_handler, msg_handler_data, &winner);
+     }
+ 
+     /* Wait for two seconds at the end of the first pass. */
+     if (!done) {
+-        done = service_fds(context, sel_state, 2000, conns, seltemp,
++        done = service_fds(context, sel_state, 2000, timeout, conns, seltemp,
+                            realm, msg_handler, msg_handler_data, &winner);
+     }
+ 
+@@ -1562,15 +1577,17 @@ k5_sendto(krb5_context context, const krb5_data *message,
+             if (maybe_send(context, state, message, sel_state, realm,
+                            callback_info))
+                 continue;
+-            done = service_fds(context, sel_state, 1000, conns, seltemp,
+-                               realm, msg_handler, msg_handler_data, &winner);
++            done = service_fds(context, sel_state, 1000, timeout, conns,
++                               seltemp, realm, msg_handler, msg_handler_data,
++                               &winner);
+             if (sel_state->nfds == 0)
+                 break;
+         }
+         /* Wait for the delay backoff at the end of this pass. */
+         if (!done) {
+-            done = service_fds(context, sel_state, delay, conns, seltemp,
+-                               realm, msg_handler, msg_handler_data, &winner);
++            done = service_fds(context, sel_state, delay, timeout, conns,
++                               seltemp, realm, msg_handler, msg_handler_data,
++                               &winner);
+         }
+         if (sel_state->nfds == 0)
+             break;
+-- 
+2.46.0
+
diff --git a/0022-Wait-indefinitely-on-KDC-TCP-connections.patch b/0022-Wait-indefinitely-on-KDC-TCP-connections.patch
new file mode 100644
index 0000000..26b884b
--- /dev/null
+++ b/0022-Wait-indefinitely-on-KDC-TCP-connections.patch
@@ -0,0 +1,138 @@
+From 1da153d97d7fb30a44fca35f9b71b8f4ed5385b9 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Thu, 26 Oct 2023 16:26:42 -0400
+Subject: [PATCH] Wait indefinitely on KDC TCP connections
+
+When making a KDC or password change request, wait indefinitely
+(limited only by request_timeout if set) once a KDC has accepted a TCP
+connection.
+
+ticket: 9105 (new)
+(cherry picked from commit 6436a3808061da787a43c6810f5f0370cdfb6e36)
+---
+ doc/admin/conf_files/krb5_conf.rst |  2 +-
+ src/lib/krb5/os/sendto_kdc.c       | 50 ++++++++++++++++--------------
+ 2 files changed, 27 insertions(+), 25 deletions(-)
+
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index 65fb592d98..b7284c47df 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -357,7 +357,7 @@ The libdefaults section may contain any of the following relations:
+     for initial ticket requests.  The default value is 0.
+ 
+ **request_timeout**
+-    (:ref:`duration` string.)  Sets the maximum total time for KDC or
++    (:ref:`duration` string.)  Sets the maximum total time for KDC and
+     password change requests.  This timeout does not affect the
+     intervals between requests, so setting a low timeout may result in
+     fewer requests being attempted and/or some servers not being
+diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
+index 98247a1089..924f5b2d26 100644
+--- a/src/lib/krb5/os/sendto_kdc.c
++++ b/src/lib/krb5/os/sendto_kdc.c
+@@ -134,7 +134,6 @@ struct conn_state {
+     krb5_data callback_buffer;
+     size_t server_index;
+     struct conn_state *next;
+-    time_ms endtime;
+     krb5_boolean defer;
+     struct {
+         const char *uri_path;
+@@ -344,15 +343,19 @@ cm_select_or_poll(const struct select_state *in, time_ms endtime,
+                   struct select_state *out, int *sret)
+ {
+ #ifndef USE_POLL
+-    struct timeval tv;
++    struct timeval tv, *tvp;
+ #endif
+     krb5_error_code retval;
+     time_ms curtime, interval;
+ 
+-    retval = get_curtime_ms(&curtime);
+-    if (retval != 0)
+-        return retval;
+-    interval = (curtime < endtime) ? endtime - curtime : 0;
++    if (endtime != 0) {
++        retval = get_curtime_ms(&curtime);
++        if (retval != 0)
++            return retval;
++        interval = (curtime < endtime) ? endtime - curtime : 0;
++    } else {
++        interval = -1;
++    }
+ 
+     /* We don't need a separate copy of the selstate for poll, but use one for
+      * consistency with how we use select. */
+@@ -361,9 +364,14 @@ cm_select_or_poll(const struct select_state *in, time_ms endtime,
+ #ifdef USE_POLL
+     *sret = poll(out->fds, out->nfds, interval);
+ #else
+-    tv.tv_sec = interval / 1000;
+-    tv.tv_usec = interval % 1000 * 1000;
+-    *sret = select(out->max, &out->rfds, &out->wfds, &out->xfds, &tv);
++    if (interval != -1) {
++        tv.tv_sec = interval / 1000;
++        tv.tv_usec = interval % 1000 * 1000;
++        tvp = &tv;
++    } else {
++        tvp = NULL;
++    }
++    *sret = select(out->max, &out->rfds, &out->wfds, &out->xfds, tvp);
+ #endif
+ 
+     return (*sret < 0) ? SOCKET_ERRNO : 0;
+@@ -1099,11 +1107,6 @@ service_tcp_connect(krb5_context context, const krb5_data *realm,
+     }
+ 
+     conn->state = WRITING;
+-
+-    /* Record this connection's timeout for service_fds. */
+-    if (get_curtime_ms(&conn->endtime) == 0)
+-        conn->endtime += 10000;
+-
+     return conn->service_write(context, realm, conn, selstate);
+ }
+ 
+@@ -1378,19 +1381,18 @@ kill_conn:
+     return FALSE;
+ }
+ 
+-/* Return the maximum of endtime and the endtime fields of all currently active
+- * TCP connections. */
+-static time_ms
+-get_endtime(time_ms endtime, struct conn_state *conns)
++/* Return true if conns contains any states with connected TCP sockets. */
++static krb5_boolean
++any_tcp_connections(struct conn_state *conns)
+ {
+     struct conn_state *state;
+ 
+     for (state = conns; state != NULL; state = state->next) {
+-        if ((state->state == READING || state->state == WRITING) &&
+-            state->endtime > endtime)
+-            endtime = state->endtime;
++        if (state->addr.transport != UDP &&
++            (state->state == READING || state->state == WRITING))
++            return TRUE;
+     }
+-    return endtime;
++    return FALSE;
+ }
+ 
+ static krb5_boolean
+@@ -1413,9 +1415,9 @@ service_fds(krb5_context context, struct select_state *selstate,
+ 
+     e = 0;
+     while (selstate->nfds > 0) {
+-        endtime = get_endtime(interval_end, conns);
++        endtime = any_tcp_connections(conns) ? 0 : interval_end;
+         /* Don't wait longer than the whole request should last. */
+-        if (timeout && endtime > timeout)
++        if (timeout && (!endtime || endtime > timeout))
+             endtime = timeout;
+         e = cm_select_or_poll(selstate, endtime, seltemp, &selret);
+         if (e == EINTR)
+-- 
+2.46.0
+
diff --git a/0023-Remove-PKINIT-RSA-support.patch b/0023-Remove-PKINIT-RSA-support.patch
new file mode 100644
index 0000000..7672f02
--- /dev/null
+++ b/0023-Remove-PKINIT-RSA-support.patch
@@ -0,0 +1,1297 @@
+From 4f008362334dc2d66d67453448061e19feda889d Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Sun, 26 Nov 2023 17:42:34 -0500
+Subject: [PATCH] Remove PKINIT RSA support
+
+RSA mode is no longer needed for interoperability.  Reduce the attack
+surface of clients and KDCs by removing support for it.
+
+ticket: 9108 (new)
+(cherry picked from commit 401f584526e501b68e7516c17d8e467883f8f210)
+---
+ doc/user/user_commands/kinit.rst              |   4 -
+ src/plugins/preauth/pkinit/pkinit.h           |   2 -
+ src/plugins/preauth/pkinit/pkinit_clnt.c      | 235 +++-----
+ src/plugins/preauth/pkinit/pkinit_crypto.h    |  39 --
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 504 ------------------
+ src/plugins/preauth/pkinit/pkinit_lib.c       |   2 -
+ src/plugins/preauth/pkinit/pkinit_srv.c       | 208 +++-----
+ src/plugins/preauth/pkinit/pkinit_trace.h     |   9 -
+ src/tests/t_pkinit.py                         |   7 -
+ src/windows/leash/htmlhelp/html/KINIT.htm     |   3 -
+ 10 files changed, 131 insertions(+), 882 deletions(-)
+
+diff --git a/doc/user/user_commands/kinit.rst b/doc/user/user_commands/kinit.rst
+index 5b105e35a5..d947e83cc6 100644
+--- a/doc/user/user_commands/kinit.rst
++++ b/doc/user/user_commands/kinit.rst
+@@ -193,10 +193,6 @@ OPTIONS
+     **X509_anchors**\ =\ *value*
+         specify where to find trusted X509 anchor information
+ 
+-    **flag_RSA_PROTOCOL**\ [**=yes**]
+-        specify use of RSA, rather than the default Diffie-Hellman
+-        protocol
+-
+     **disable_freshness**\ [**=yes**]
+         disable sending freshness tokens (for testing purposes only)
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
+index 66f92d8f03..5ab0f4bc28 100644
+--- a/src/plugins/preauth/pkinit/pkinit.h
++++ b/src/plugins/preauth/pkinit/pkinit.h
+@@ -146,7 +146,6 @@ typedef struct _pkinit_plg_opts {
+     int require_eku;	    /* require EKU checking (default is true) */
+     int accept_secondary_eku;/* accept secondary EKU (default is false) */
+     int allow_upn;	    /* allow UPN-SAN instead of pkinit-SAN */
+-    int dh_or_rsa;	    /* selects DH or RSA based pkinit */
+     int require_crl_checking; /* require CRL for a CA (default is false) */
+     int require_freshness;  /* require freshness token (default is false) */
+     int disable_freshness;  /* disable freshness token on client for testing */
+@@ -160,7 +159,6 @@ typedef struct _pkinit_req_opts {
+     int require_eku;
+     int accept_secondary_eku;
+     int allow_upn;
+-    int dh_or_rsa;
+     int require_crl_checking;
+     int dh_size;	    /* initial request DH modulus size (default=1024) */
+     int require_hostname_match;
+diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
+index ea9ba454df..54e7537600 100644
+--- a/src/plugins/preauth/pkinit/pkinit_clnt.c
++++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
+@@ -191,7 +191,6 @@ pkinit_as_req_create(krb5_context context,
+     krb5_auth_pack auth_pack;
+     krb5_pa_pk_as_req *req = NULL;
+     krb5_algorithm_identifier **cmstypes = NULL;
+-    int protocol = reqctx->opts->dh_or_rsa;
+ 
+     pkiDebug("pkinit_as_req_create pa_type = %d\n", reqctx->pa_type);
+ 
+@@ -214,29 +213,14 @@ pkinit_as_req_create(krb5_context context,
+     if (retval)
+         goto cleanup;
+ 
+-    switch(protocol) {
+-    case DH_PROTOCOL:
+-        TRACE_PKINIT_CLIENT_REQ_DH(context);
+-        pkiDebug("as_req: DH key transport algorithm\n");
++    TRACE_PKINIT_CLIENT_REQ_DH(context);
+ 
+-        /* create client-side DH keys */
+-        retval = client_create_dh(context, plgctx->cryptoctx,
+-                                  reqctx->cryptoctx, reqctx->idctx,
+-                                  reqctx->opts->dh_size, &spki);
+-        auth_pack.clientPublicValue = spki;
+-        if (retval != 0) {
+-            pkiDebug("failed to create dh parameters\n");
+-            goto cleanup;
+-        }
+-        break;
+-    case RSA_PROTOCOL:
+-        TRACE_PKINIT_CLIENT_REQ_RSA(context);
+-        pkiDebug("as_req: RSA key transport algorithm\n");
+-        break;
+-    default:
+-        pkiDebug("as_req: unknown key transport protocol %d\n",
+-                 protocol);
+-        retval = -1;
++    /* create client-side DH keys */
++    retval = client_create_dh(context, plgctx->cryptoctx, reqctx->cryptoctx,
++                              reqctx->idctx, reqctx->opts->dh_size, &spki);
++    auth_pack.clientPublicValue = spki;
++    if (retval != 0) {
++        pkiDebug("failed to create dh parameters\n");
+         goto cleanup;
+     }
+ 
+@@ -553,49 +537,34 @@ pkinit_as_rep_parse(krb5_context context,
+         return retval;
+     }
+ 
+-    switch(kdc_reply->choice) {
+-    case choice_pa_pk_as_rep_dhInfo:
+-        pkiDebug("as_rep: DH key transport algorithm\n");
++    if (kdc_reply->choice != choice_pa_pk_as_rep_dhInfo) {
++        pkiDebug("unknown as_rep type %d\n", kdc_reply->choice);
++        retval = KRB5KDC_ERR_PREAUTH_FAILED;
++        goto cleanup;
++    }
++
+ #ifdef DEBUG_ASN1
+-        print_buffer_bin(kdc_reply->u.dh_Info.dhSignedData.data,
+-                         kdc_reply->u.dh_Info.dhSignedData.length, "/tmp/client_kdc_signeddata");
++    print_buffer_bin(kdc_reply->u.dh_Info.dhSignedData.data,
++                     kdc_reply->u.dh_Info.dhSignedData.length,
++                     "/tmp/client_kdc_signeddata");
+ #endif
+-        if ((retval = cms_signeddata_verify(context, plgctx->cryptoctx,
+-                                            reqctx->cryptoctx, reqctx->idctx, CMS_SIGN_SERVER,
+-                                            reqctx->opts->require_crl_checking,
+-                                            (unsigned char *)
+-                                            kdc_reply->u.dh_Info.dhSignedData.data,
+-                                            kdc_reply->u.dh_Info.dhSignedData.length,
+-                                            (unsigned char **)&dh_data.data,
+-                                            &dh_data.length,
+-                                            NULL, NULL, NULL)) != 0) {
+-            pkiDebug("failed to verify pkcs7 signed data\n");
+-            TRACE_PKINIT_CLIENT_REP_DH_FAIL(context);
+-            goto cleanup;
+-        }
+-        TRACE_PKINIT_CLIENT_REP_DH(context);
+-        break;
+-    case choice_pa_pk_as_rep_encKeyPack:
+-        pkiDebug("as_rep: RSA key transport algorithm\n");
+-        if ((retval = cms_envelopeddata_verify(context, plgctx->cryptoctx,
+-                                               reqctx->cryptoctx, reqctx->idctx, pa_type,
+-                                               reqctx->opts->require_crl_checking,
+-                                               (unsigned char *)
+-                                               kdc_reply->u.encKeyPack.data,
+-                                               kdc_reply->u.encKeyPack.length,
+-                                               (unsigned char **)&dh_data.data,
+-                                               &dh_data.length)) != 0) {
+-            pkiDebug("failed to verify pkcs7 enveloped data\n");
+-            TRACE_PKINIT_CLIENT_REP_RSA_FAIL(context);
+-            goto cleanup;
+-        }
+-        TRACE_PKINIT_CLIENT_REP_RSA(context);
+-        break;
+-    default:
+-        pkiDebug("unknown as_rep type %d\n", kdc_reply->choice);
+-        retval = -1;
++    retval = cms_signeddata_verify(context, plgctx->cryptoctx,
++                                   reqctx->cryptoctx, reqctx->idctx,
++                                   CMS_SIGN_SERVER,
++                                   reqctx->opts->require_crl_checking,
++                                   (unsigned char *)
++                                   kdc_reply->u.dh_Info.dhSignedData.data,
++                                   kdc_reply->u.dh_Info.dhSignedData.length,
++                                   (unsigned char **)&dh_data.data,
++                                   &dh_data.length,
++                                   NULL, NULL, NULL);
++    if (retval) {
++        pkiDebug("failed to verify pkcs7 signed data\n");
++        TRACE_PKINIT_CLIENT_REP_DH_FAIL(context);
+         goto cleanup;
+     }
++    TRACE_PKINIT_CLIENT_REP_DH(context);
++
+     retval = krb5_build_principal_ext(context, &kdc_princ,
+                                       request->server->realm.length,
+                                       request->server->realm.data,
+@@ -632,116 +601,54 @@ pkinit_as_rep_parse(krb5_context context,
+ 
+     OCTETDATA_TO_KRB5DATA(&dh_data, &k5data);
+ 
+-    switch(kdc_reply->choice) {
+-    case choice_pa_pk_as_rep_dhInfo:
+ #ifdef DEBUG_ASN1
+-        print_buffer_bin(dh_data.data, dh_data.length,
+-                         "/tmp/client_dh_key");
++    print_buffer_bin(dh_data.data, dh_data.length, "/tmp/client_dh_key");
+ #endif
+-        if ((retval = k5int_decode_krb5_kdc_dh_key_info(&k5data,
+-                                                        &kdc_dh)) != 0) {
+-            pkiDebug("failed to decode kdc_dh_key_info\n");
+-            goto cleanup;
+-        }
+-
+-        /* client after KDC reply */
+-        if ((retval = client_process_dh(context, plgctx->cryptoctx,
+-                                        reqctx->cryptoctx, reqctx->idctx,
+-                                        (unsigned char *)
+-                                        kdc_dh->subjectPublicKey.data,
+-                                        kdc_dh->subjectPublicKey.length,
+-                                        &client_key, &client_key_len)) != 0) {
+-            pkiDebug("failed to process dh params\n");
+-            goto cleanup;
+-        }
+-
+-        /* If we have a KDF algorithm ID, call the algorithm agility KDF... */
+-        if (kdc_reply->u.dh_Info.kdfID) {
+-            secret.length = client_key_len;
+-            secret.data = (char *)client_key;
+-
+-            retval = pkinit_alg_agility_kdf(context, &secret,
+-                                            kdc_reply->u.dh_Info.kdfID,
+-                                            request->client, request->server,
+-                                            etype, encoded_request,
+-                                            (krb5_data *)as_rep, key_block);
+-
+-            if (retval) {
+-                pkiDebug("failed to create key pkinit_alg_agility_kdf %s\n",
+-                         error_message(retval));
+-                goto cleanup;
+-            }
+-            TRACE_PKINIT_CLIENT_KDF_ALG(context, kdc_reply->u.dh_Info.kdfID,
+-                                        key_block);
++    retval = k5int_decode_krb5_kdc_dh_key_info(&k5data, &kdc_dh);
++    if (retval) {
++        pkiDebug("failed to decode kdc_dh_key_info\n");
++        goto cleanup;
++    }
+ 
+-            /* ...otherwise, use the older octetstring2key function. */
+-        } else {
++    /* client after KDC reply */
++    retval = client_process_dh(context, plgctx->cryptoctx, reqctx->cryptoctx,
++                               reqctx->idctx,
++                               (unsigned char *)kdc_dh->subjectPublicKey.data,
++                               kdc_dh->subjectPublicKey.length, &client_key,
++                               &client_key_len);
++    if (retval) {
++        pkiDebug("failed to process dh params\n");
++        goto cleanup;
++    }
+ 
+-            retval = pkinit_octetstring2key(context, etype, client_key,
+-                                            client_key_len, key_block);
+-            if (retval) {
+-                pkiDebug("failed to create key pkinit_octetstring2key %s\n",
+-                         error_message(retval));
+-                goto cleanup;
+-            }
+-            TRACE_PKINIT_CLIENT_KDF_OS2K(context, key_block);
+-        }
++    /* If we have a KDF algorithm ID, call the algorithm agility KDF. */
++    if (kdc_reply->u.dh_Info.kdfID) {
++        secret.length = client_key_len;
++        secret.data = (char *)client_key;
+ 
+-        break;
+-    case choice_pa_pk_as_rep_encKeyPack:
+-#ifdef DEBUG_ASN1
+-        print_buffer_bin(dh_data.data, dh_data.length,
+-                         "/tmp/client_key_pack");
+-#endif
+-        retval = k5int_decode_krb5_reply_key_pack(&k5data, &key_pack);
++        retval = pkinit_alg_agility_kdf(context, &secret,
++                                        kdc_reply->u.dh_Info.kdfID,
++                                        request->client, request->server,
++                                        etype, encoded_request,
++                                        (krb5_data *)as_rep, key_block);
+         if (retval) {
+-            pkiDebug("failed to decode reply_key_pack\n");
++            pkiDebug("failed to create key pkinit_alg_agility_kdf %s\n",
++                     error_message(retval));
+             goto cleanup;
+         }
+-        retval = krb5_c_make_checksum(context,
+-                                      key_pack->asChecksum.checksum_type,
+-                                      &key_pack->replyKey,
+-                                      KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM,
+-                                      encoded_request, &cksum);
++        TRACE_PKINIT_CLIENT_KDF_ALG(context, kdc_reply->u.dh_Info.kdfID,
++                                    key_block);
++
++    } else {
++        /* Otherwise, use the older octetstring2key function. */
++        retval = pkinit_octetstring2key(context, etype, client_key,
++                                        client_key_len, key_block);
+         if (retval) {
+-            pkiDebug("failed to make a checksum\n");
++            pkiDebug("failed to create key pkinit_octetstring2key %s\n",
++                     error_message(retval));
+             goto cleanup;
+         }
+-
+-        if ((cksum.length != key_pack->asChecksum.length) ||
+-            k5_bcmp(cksum.contents, key_pack->asChecksum.contents,
+-                    cksum.length) != 0) {
+-            TRACE_PKINIT_CLIENT_REP_CHECKSUM_FAIL(context, &cksum,
+-                                                  &key_pack->asChecksum);
+-            pkiDebug("failed to match the checksums\n");
+-#ifdef DEBUG_CKSUM
+-            pkiDebug("calculating checksum on buf size (%d)\n",
+-                     encoded_request->length);
+-            print_buffer(encoded_request->data, encoded_request->length);
+-            pkiDebug("encrypting key (%d)\n", key_pack->replyKey.length);
+-            print_buffer(key_pack->replyKey.contents,
+-                         key_pack->replyKey.length);
+-            pkiDebug("received checksum type=%d size=%d ",
+-                     key_pack->asChecksum.checksum_type,
+-                     key_pack->asChecksum.length);
+-            print_buffer(key_pack->asChecksum.contents,
+-                         key_pack->asChecksum.length);
+-            pkiDebug("expected checksum type=%d size=%d ",
+-                     cksum.checksum_type, cksum.length);
+-            print_buffer(cksum.contents, cksum.length);
+-#endif
+-            goto cleanup;
+-        } else
+-            pkiDebug("checksums match\n");
+-
+-        krb5_copy_keyblock_contents(context, &key_pack->replyKey,
+-                                    key_block);
+-        TRACE_PKINIT_CLIENT_REP_RSA_KEY(context, key_block, &cksum);
+-
+-        break;
+-    default:
+-        pkiDebug("unknown as_rep type %d\n", kdc_reply->choice);
+-        goto cleanup;
++        TRACE_PKINIT_CLIENT_KDF_OS2K(context, key_block);
+     }
+ 
+     retval = 0;
+@@ -1286,7 +1193,6 @@ pkinit_client_req_init(krb5_context context,
+ 
+     reqctx->opts->require_eku = plgctx->opts->require_eku;
+     reqctx->opts->accept_secondary_eku = plgctx->opts->accept_secondary_eku;
+-    reqctx->opts->dh_or_rsa = plgctx->opts->dh_or_rsa;
+     reqctx->opts->allow_upn = plgctx->opts->allow_upn;
+     reqctx->opts->require_crl_checking = plgctx->opts->require_crl_checking;
+     reqctx->opts->disable_freshness = plgctx->opts->disable_freshness;
+@@ -1457,11 +1363,6 @@ handle_gic_opt(krb5_context context,
+         retval = add_string_to_array(context, &plgctx->idopts->anchors, value);
+         if (retval)
+             return retval;
+-    } else if (strcmp(attr, "flag_RSA_PROTOCOL") == 0) {
+-        if (strcmp(value, "yes") == 0) {
+-            pkiDebug("Setting flag to use RSA_PROTOCOL\n");
+-            plgctx->opts->dh_or_rsa = RSA_PROTOCOL;
+-        }
+     } else if (strcmp(attr, "disable_freshness") == 0) {
+         if (strcmp(value, "yes") == 0)
+             plgctx->opts->disable_freshness = 1;
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
+index 8bdbea8e95..04199b45a4 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto.h
++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
+@@ -181,45 +181,6 @@ krb5_error_code cms_signeddata_verify
+ 	int *is_signed);                                /* OUT
+ 		    receives whether message is signed */
+ 
+-/*
+- * this function creates a CMS message where eContentType is EnvelopedData
+- */
+-krb5_error_code cms_envelopeddata_create
+-	(krb5_context context,				/* IN */
+-	pkinit_plg_crypto_context plg_cryptoctx,	/* IN */
+-	pkinit_req_crypto_context req_cryptoctx,	/* IN */
+-	pkinit_identity_crypto_context id_cryptoctx,	/* IN */
+-	krb5_preauthtype pa_type,			/* IN */
+-	unsigned char *key_pack,			/* IN
+-		    contains DER encoded ReplyKeyPack */
+-	unsigned int key_pack_len,			/* IN
+-		    contains length of key_pack */
+-	unsigned char **envel_data,			/* OUT
+-		    receives DER encoded encKeyPack */
+-	unsigned int *envel_data_len);			/* OUT
+-		    receives length of envel_data */
+-
+-/*
+- * this function creates a CMS message where eContentType is EnvelopedData
+- */
+-krb5_error_code cms_envelopeddata_verify
+-	(krb5_context context,				/* IN */
+-	pkinit_plg_crypto_context plg_cryptoctx,	/* IN */
+-	pkinit_req_crypto_context req_cryptoctx,	/* IN */
+-	pkinit_identity_crypto_context id_cryptoctx,	/* IN */
+-	krb5_preauthtype pa_type,			/* IN */
+-	int require_crl_checking,			/* IN
+-		    specifies whether CRL checking should be
+-		    strictly enforced */
+-	unsigned char *envel_data,			/* IN
+-		    contains DER encoded encKeyPack */
+-	unsigned int envel_data_len,			/* IN
+-		    contains length of envel_data */
+-	unsigned char **signed_data,			/* OUT
+-		    receives ReplyKeyPack */
+-	unsigned int *signed_data_len);			/* OUT
+-		    receives length of signed_data */
+-
+ /*
+  * This function retrieves the signer's identity, in a form that could
+  * be passed back in to a future invocation of this module as a candidate
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index f5aade34cc..26fa9184b3 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -66,26 +66,14 @@ static krb5_error_code create_signature
+ (unsigned char **, unsigned int *, unsigned char *, unsigned int,
+  EVP_PKEY *pkey);
+ 
+-static krb5_error_code pkinit_decode_data
+-(krb5_context context, pkinit_identity_crypto_context cryptoctx,
+- const uint8_t *data, unsigned int data_len, uint8_t **decoded,
+- unsigned int *decoded_len);
+-
+ #ifdef DEBUG_DH
+ static void print_dh(DH *, char *);
+ static void print_pubkey(BIGNUM *, char *);
+ #endif
+ 
+-static int prepare_enc_data
+-(const uint8_t *indata, int indata_len, uint8_t **outdata, int *outdata_len);
+-
+ static int openssl_callback (int, X509_STORE_CTX *);
+ static int openssl_callback_ignore_crls (int, X509_STORE_CTX *);
+ 
+-static int pkcs7_decrypt
+-(krb5_context context, pkinit_identity_crypto_context id_cryptoctx, PKCS7 *p7,
+- unsigned char **data_out, unsigned int *len_out);
+-
+ static ASN1_OBJECT * pkinit_pkcs7type2oid
+ (pkinit_plg_crypto_context plg_cryptoctx, int pkcs7_type);
+ 
+@@ -115,20 +103,12 @@ static krb5_error_code pkinit_sign_data_pkcs11
+ (krb5_context context, pkinit_identity_crypto_context id_cryptoctx,
+  unsigned char *data, unsigned int data_len,
+  unsigned char **sig, unsigned int *sig_len);
+-static krb5_error_code pkinit_decode_data_pkcs11
+-(krb5_context context, pkinit_identity_crypto_context id_cryptoctx,
+- const uint8_t *data, unsigned int data_len, uint8_t **decoded_data,
+- unsigned int *decoded_data_len);
+ #endif  /* WITHOUT_PKCS11 */
+ 
+ static krb5_error_code pkinit_sign_data_fs
+ (krb5_context context, pkinit_identity_crypto_context id_cryptoctx,
+  unsigned char *data, unsigned int data_len,
+  unsigned char **sig, unsigned int *sig_len);
+-static krb5_error_code pkinit_decode_data_fs
+-(krb5_context context, pkinit_identity_crypto_context id_cryptoctx,
+- const uint8_t *data, unsigned int data_len, uint8_t **decoded_data,
+- unsigned int *decoded_data_len);
+ 
+ static krb5_error_code
+ create_krb5_invalidCertificates(krb5_context context,
+@@ -140,10 +120,6 @@ create_krb5_invalidCertificates(krb5_context context,
+ static krb5_error_code
+ create_identifiers_from_stack(STACK_OF(X509) *sk,
+                               krb5_external_principal_identifier *** ids);
+-static int
+-wrap_signeddata(unsigned char *data, unsigned int data_len,
+-                unsigned char **out, unsigned int *out_len);
+-
+ static const char *
+ pkcs11err(int err);
+ 
+@@ -2177,177 +2153,6 @@ cleanup:
+     return retval;
+ }
+ 
+-krb5_error_code
+-cms_envelopeddata_create(krb5_context context,
+-                         pkinit_plg_crypto_context plgctx,
+-                         pkinit_req_crypto_context reqctx,
+-                         pkinit_identity_crypto_context idctx,
+-                         krb5_preauthtype pa_type,
+-                         unsigned char *key_pack,
+-                         unsigned int key_pack_len,
+-                         unsigned char **out,
+-                         unsigned int *out_len)
+-{
+-
+-    krb5_error_code retval = ENOMEM;
+-    PKCS7 *p7 = NULL;
+-    BIO *in = NULL;
+-    unsigned char *p = NULL, *signed_data = NULL, *enc_data = NULL;
+-    int signed_data_len = 0, enc_data_len = 0, flags = PKCS7_BINARY;
+-    STACK_OF(X509) *encerts = NULL;
+-    const EVP_CIPHER *cipher = NULL;
+-
+-    retval = cms_signeddata_create(context, plgctx, reqctx, idctx,
+-                                   CMS_ENVEL_SERVER, key_pack, key_pack_len,
+-                                   &signed_data,
+-                                   (unsigned int *)&signed_data_len);
+-    if (retval) {
+-        pkiDebug("failed to create pkcs7 signed data\n");
+-        goto cleanup;
+-    }
+-
+-    /* check we have client's certificate */
+-    if (reqctx->received_cert == NULL) {
+-        retval = KRB5KDC_ERR_PREAUTH_FAILED;
+-        goto cleanup;
+-    }
+-    encerts = sk_X509_new_null();
+-    sk_X509_push(encerts, reqctx->received_cert);
+-
+-    cipher = EVP_des_ede3_cbc();
+-    in = BIO_new(BIO_s_mem());
+-    prepare_enc_data(signed_data, signed_data_len, &enc_data,
+-                     &enc_data_len);
+-    retval = BIO_write(in, enc_data, enc_data_len);
+-    if (retval != enc_data_len) {
+-        pkiDebug("BIO_write only wrote %d\n", retval);
+-        goto cleanup;
+-    }
+-
+-    p7 = PKCS7_encrypt(encerts, in, cipher, flags);
+-    if (p7 == NULL) {
+-        retval = oerr(context, 0, _("Failed to encrypt PKCS7 object"));
+-        goto cleanup;
+-    }
+-    p7->d.enveloped->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_signed);
+-
+-    *out_len = i2d_PKCS7(p7, NULL);
+-    if (!*out_len || (p = *out = malloc(*out_len)) == NULL) {
+-        retval = ENOMEM;
+-        goto cleanup;
+-    }
+-    retval = i2d_PKCS7(p7, &p);
+-    if (!retval) {
+-        retval = oerr(context, 0, _("Failed to DER encode PKCS7"));
+-        goto cleanup;
+-    }
+-    retval = 0;
+-
+-#ifdef DEBUG_ASN1
+-    print_buffer_bin(*out, *out_len, "/tmp/kdc_enveloped_data");
+-#endif
+-
+-cleanup:
+-    if (p7 != NULL)
+-        PKCS7_free(p7);
+-    if (in != NULL)
+-        BIO_free(in);
+-    free(signed_data);
+-    free(enc_data);
+-    if (encerts != NULL)
+-        sk_X509_free(encerts);
+-
+-    return retval;
+-}
+-
+-krb5_error_code
+-cms_envelopeddata_verify(krb5_context context,
+-                         pkinit_plg_crypto_context plg_cryptoctx,
+-                         pkinit_req_crypto_context req_cryptoctx,
+-                         pkinit_identity_crypto_context id_cryptoctx,
+-                         krb5_preauthtype pa_type,
+-                         int require_crl_checking,
+-                         unsigned char *enveloped_data,
+-                         unsigned int enveloped_data_len,
+-                         unsigned char **data,
+-                         unsigned int *data_len)
+-{
+-    krb5_error_code retval = KRB5KDC_ERR_PREAUTH_FAILED;
+-    PKCS7 *p7 = NULL;
+-    const unsigned char *p = enveloped_data;
+-    unsigned int tmp_buf_len = 0, tmp_buf2_len = 0, vfy_buf_len = 0;
+-    unsigned char *tmp_buf = NULL, *tmp_buf2 = NULL, *vfy_buf = NULL;
+-
+-#ifdef DEBUG_ASN1
+-    print_buffer_bin(enveloped_data, enveloped_data_len,
+-                     "/tmp/client_envelopeddata");
+-#endif
+-    /* decode received PKCS7 message */
+-    if ((p7 = d2i_PKCS7(NULL, &p, (int)enveloped_data_len)) == NULL) {
+-        retval = oerr(context, 0, _("Failed to decode PKCS7"));
+-        goto cleanup;
+-    }
+-
+-    /* verify that the received message is PKCS7 EnvelopedData message */
+-    if (OBJ_obj2nid(p7->type) != NID_pkcs7_enveloped ||
+-        p7->d.enveloped == NULL ||
+-        p7->d.enveloped->enc_data->enc_data == NULL) {
+-        pkiDebug("Expected id-enveloped PKCS7 msg (received type = %d)\n",
+-                 OBJ_obj2nid(p7->type));
+-        krb5_set_error_message(context, retval, "wrong oid\n");
+-        goto cleanup;
+-    }
+-
+-    /* decrypt received PKCS7 message */
+-    if (pkcs7_decrypt(context, id_cryptoctx, p7, &tmp_buf, &tmp_buf_len)) {
+-        pkiDebug("PKCS7 decryption successful\n");
+-    } else {
+-        retval = oerr(context, 0, _("Failed to decrypt PKCS7 message"));
+-        goto cleanup;
+-    }
+-
+-#ifdef DEBUG_ASN1
+-    print_buffer_bin(tmp_buf, tmp_buf_len, "/tmp/client_enc_keypack");
+-#endif
+-    /* verify PKCS7 SignedData message */
+-    /* Wrap the signed data to make decoding easier in the verify routine. */
+-    retval = wrap_signeddata(tmp_buf, tmp_buf_len, &tmp_buf2, &tmp_buf2_len);
+-    if (retval) {
+-        pkiDebug("failed to encode signeddata\n");
+-        goto cleanup;
+-    }
+-    vfy_buf = tmp_buf2;
+-    vfy_buf_len = tmp_buf2_len;
+-
+-#ifdef DEBUG_ASN1
+-    print_buffer_bin(vfy_buf, vfy_buf_len, "/tmp/client_enc_keypack2");
+-#endif
+-
+-    retval = cms_signeddata_verify(context, plg_cryptoctx, req_cryptoctx,
+-                                   id_cryptoctx, CMS_ENVEL_SERVER,
+-                                   require_crl_checking,
+-                                   vfy_buf, vfy_buf_len,
+-                                   data, data_len, NULL, NULL, NULL);
+-
+-    if (!retval)
+-        pkiDebug("PKCS7 Verification Success\n");
+-    else {
+-        pkiDebug("PKCS7 Verification Failure\n");
+-        goto cleanup;
+-    }
+-
+-    retval = 0;
+-
+-cleanup:
+-
+-    if (p7 != NULL)
+-        PKCS7_free(p7);
+-    free(tmp_buf);
+-    free(tmp_buf2);
+-
+-    return retval;
+-}
+-
+ static krb5_error_code
+ crypto_retrieve_X509_sans(krb5_context context,
+                           pkinit_plg_crypto_context plgctx,
+@@ -3398,70 +3203,6 @@ pkinit_pkcs7type2oid(pkinit_plg_crypto_context cryptoctx, int pkcs7_type)
+ 
+ }
+ 
+-static int
+-wrap_signeddata(unsigned char *data, unsigned int data_len,
+-                unsigned char **out, unsigned int *out_len)
+-{
+-
+-    unsigned int orig_len = 0, oid_len = 0, tot_len = 0;
+-    ASN1_OBJECT *oid = NULL;
+-    unsigned char *p = NULL;
+-
+-    /* Get length to wrap the original data with SEQUENCE tag */
+-    tot_len = orig_len = ASN1_object_size(1, (int)data_len, V_ASN1_SEQUENCE);
+-
+-    /* Add the signedData OID and adjust lengths */
+-    oid = OBJ_nid2obj(NID_pkcs7_signed);
+-    oid_len = i2d_ASN1_OBJECT(oid, NULL);
+-
+-    tot_len = ASN1_object_size(1, (int)(orig_len+oid_len), V_ASN1_SEQUENCE);
+-
+-    p = *out = malloc(tot_len);
+-    if (p == NULL) return -1;
+-
+-    ASN1_put_object(&p, 1, (int)(orig_len+oid_len),
+-                    V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
+-
+-    i2d_ASN1_OBJECT(oid, &p);
+-
+-    ASN1_put_object(&p, 1, (int)data_len, 0, V_ASN1_CONTEXT_SPECIFIC);
+-    memcpy(p, data, data_len);
+-
+-    *out_len = tot_len;
+-
+-    return 0;
+-}
+-
+-static int
+-prepare_enc_data(const uint8_t *indata, int indata_len, uint8_t **outdata,
+-                 int *outdata_len)
+-{
+-    int tag, class;
+-    long tlen, slen;
+-    const uint8_t *p = indata, *oldp;
+-
+-    if (ASN1_get_object(&p, &slen, &tag, &class, indata_len) & 0x80)
+-        return EINVAL;
+-    if (tag != V_ASN1_SEQUENCE)
+-        return EINVAL;
+-
+-    oldp = p;
+-    if (ASN1_get_object(&p, &tlen, &tag, &class, slen) & 0x80)
+-        return EINVAL;
+-    p += tlen;
+-    slen -= (p - oldp);
+-
+-    if (ASN1_get_object(&p, &tlen, &tag, &class, slen) & 0x80)
+-        return EINVAL;
+-
+-    *outdata = malloc(tlen);
+-    if (*outdata == NULL)
+-        return ENOMEM;
+-    memcpy(*outdata, p, tlen);
+-    *outdata_len = tlen;
+-    return 0;
+-}
+-
+ #ifndef WITHOUT_PKCS11
+ static struct plugin_file_handle *
+ load_pkcs11_module(krb5_context context, const char *modname,
+@@ -3780,169 +3521,6 @@ pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx,
+ }
+ #endif
+ 
+-static krb5_error_code
+-pkinit_decode_data_fs(krb5_context context,
+-                      pkinit_identity_crypto_context id_cryptoctx,
+-                      const uint8_t *data, unsigned int data_len,
+-                      uint8_t **decoded_data, unsigned int *decoded_data_len)
+-{
+-    X509 *cert = sk_X509_value(id_cryptoctx->my_certs,
+-                               id_cryptoctx->cert_index);
+-    EVP_PKEY *pkey = id_cryptoctx->my_key;
+-    EVP_PKEY_CTX *ctx = NULL;
+-    uint8_t *buf = NULL;
+-    size_t buf_len = 0;
+-    int ok;
+-
+-    *decoded_data = NULL;
+-    *decoded_data_len = 0;
+-
+-    if (cert != NULL && !X509_check_private_key(cert, pkey)) {
+-        pkiDebug("private key does not match certificate\n");
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
+-    }
+-
+-    ctx = EVP_PKEY_CTX_new(pkey, NULL);
+-    if (ctx == NULL)
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
+-
+-    ok = EVP_PKEY_decrypt_init(ctx);
+-    if (!ok)
+-        goto cleanup;
+-
+-    /* Get the length of the eventual output. */
+-    ok = EVP_PKEY_decrypt(ctx, NULL, &buf_len, data, data_len);
+-    if (!ok) {
+-        pkiDebug("unable to decrypt received data\n");
+-        goto cleanup;
+-    }
+-
+-    buf = malloc(buf_len);
+-    if (buf == NULL) {
+-        ok = 0;
+-        goto cleanup;
+-    }
+-
+-    ok = EVP_PKEY_decrypt(ctx, buf, &buf_len, data, data_len);
+-    if (!ok) {
+-        pkiDebug("unable to decrypt received data\n");
+-        goto cleanup;
+-    }
+-
+-    *decoded_data = buf;
+-    *decoded_data_len = buf_len;
+-    buf = NULL;
+-cleanup:
+-    zapfree(buf, buf_len);
+-    EVP_PKEY_CTX_free(ctx);
+-    return ok ? 0 : KRB5KDC_ERR_PREAUTH_FAILED;
+-}
+-
+-#ifndef WITHOUT_PKCS11
+-/*
+- * When using the ActivCard Linux pkcs11 library (v2.0.1), the decrypt function
+- * fails.  By inserting an extra function call, which serves nothing but to
+- * change the stack, we were able to work around the issue.  If the ActivCard
+- * library is fixed in the future, this function can be inlined back into the
+- * caller.
+- */
+-static CK_RV
+-pkinit_C_Decrypt(pkinit_identity_crypto_context id_cryptoctx,
+-                 CK_BYTE_PTR pEncryptedData,
+-                 CK_ULONG  ulEncryptedDataLen,
+-                 CK_BYTE_PTR pData,
+-                 CK_ULONG_PTR pulDataLen)
+-{
+-    CK_RV rv = CKR_OK;
+-
+-    rv = id_cryptoctx->p11->C_Decrypt(id_cryptoctx->session, pEncryptedData,
+-                                      ulEncryptedDataLen, pData, pulDataLen);
+-    if (rv == CKR_OK) {
+-        pkiDebug("pData %p *pulDataLen %d\n", (void *) pData,
+-                 (int) *pulDataLen);
+-    }
+-    return rv;
+-}
+-
+-static krb5_error_code
+-pkinit_decode_data_pkcs11(krb5_context context,
+-                          pkinit_identity_crypto_context id_cryptoctx,
+-                          const uint8_t *data, unsigned int data_len,
+-                          uint8_t **decoded_data,
+-                          unsigned int *decoded_data_len)
+-{
+-    CK_OBJECT_HANDLE obj;
+-    CK_ULONG len;
+-    CK_MECHANISM mech;
+-    uint8_t *cp;
+-    int r;
+-
+-    *decoded_data = NULL;
+-    *decoded_data_len = 0;
+-
+-    if (pkinit_open_session(context, id_cryptoctx)) {
+-        pkiDebug("can't open pkcs11 session\n");
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
+-    }
+-
+-    pkinit_find_private_key(id_cryptoctx, CKA_DECRYPT, &obj);
+-
+-    mech.mechanism = CKM_RSA_PKCS;
+-    mech.pParameter = NULL;
+-    mech.ulParameterLen = 0;
+-
+-    if ((r = id_cryptoctx->p11->C_DecryptInit(id_cryptoctx->session, &mech,
+-                                              obj)) != CKR_OK) {
+-        pkiDebug("C_DecryptInit: 0x%x\n", (int) r);
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
+-    }
+-    pkiDebug("data_len = %d\n", data_len);
+-    cp = malloc((size_t) data_len);
+-    if (cp == NULL)
+-        return ENOMEM;
+-    len = data_len;
+-    pkiDebug("session %p edata %p edata_len %d data %p datalen @%p %d\n",
+-             (void *) id_cryptoctx->session, (void *) data, (int) data_len,
+-             (void *) cp, (void *) &len, (int) len);
+-    r = pkinit_C_Decrypt(id_cryptoctx, (CK_BYTE_PTR) data, (CK_ULONG) data_len,
+-                         cp, &len);
+-    if (r != CKR_OK) {
+-        pkiDebug("C_Decrypt: %s\n", pkcs11err(r));
+-        if (r == CKR_BUFFER_TOO_SMALL)
+-            pkiDebug("decrypt %d needs %d\n", (int) data_len, (int) len);
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
+-    }
+-    pkiDebug("decrypt %d -> %d\n", (int) data_len, (int) len);
+-    *decoded_data_len = len;
+-    *decoded_data = cp;
+-
+-    return 0;
+-}
+-#endif
+-
+-krb5_error_code
+-pkinit_decode_data(krb5_context context,
+-                   pkinit_identity_crypto_context id_cryptoctx,
+-                   const uint8_t *data, unsigned int data_len,
+-                   uint8_t **decoded_data, unsigned int *decoded_data_len)
+-{
+-    krb5_error_code retval = KRB5KDC_ERR_PREAUTH_FAILED;
+-
+-    *decoded_data = NULL;
+-    *decoded_data_len = 0;
+-
+-    if (id_cryptoctx->pkcs11_method != 1)
+-        retval = pkinit_decode_data_fs(context, id_cryptoctx, data, data_len,
+-                                       decoded_data, decoded_data_len);
+-#ifndef WITHOUT_PKCS11
+-    else
+-        retval = pkinit_decode_data_pkcs11(context, id_cryptoctx, data,
+-                                           data_len, decoded_data, decoded_data_len);
+-#endif
+-
+-    return retval;
+-}
+-
+ static krb5_error_code
+ pkinit_sign_data_fs(krb5_context context,
+                     pkinit_identity_crypto_context id_cryptoctx,
+@@ -5617,88 +5195,6 @@ cleanup:
+     return retval;
+ }
+ 
+-/* Originally based on OpenSSL's PKCS7_dataDecode(), now modified to remove the
+- * use of BIO objects and to fit the PKINIT internal interfaces. */
+-static int
+-pkcs7_decrypt(krb5_context context,
+-              pkinit_identity_crypto_context id_cryptoctx, PKCS7 *p7,
+-              unsigned char **data_out, unsigned int *len_out)
+-{
+-    krb5_error_code ret;
+-    int ok = 0, plaintext_len = 0, final_len;
+-    unsigned int keylen = 0, eklen = 0, blocksize;
+-    unsigned char *ek = NULL, *tkey = NULL, *plaintext = NULL, *use_key;
+-    ASN1_OCTET_STRING *data_body = p7->d.enveloped->enc_data->enc_data;
+-    const EVP_CIPHER *evp_cipher;
+-    EVP_CIPHER_CTX *evp_ctx = NULL;
+-    X509_ALGOR *enc_alg = p7->d.enveloped->enc_data->algorithm;
+-    STACK_OF(PKCS7_RECIP_INFO) *rsk = p7->d.enveloped->recipientinfo;
+-    PKCS7_RECIP_INFO *ri = NULL;
+-
+-    *data_out = NULL;
+-    *len_out = 0;
+-
+-    p7->state = PKCS7_S_HEADER;
+-
+-    /* RFC 4556 section 3.2.3.2 requires that there be exactly one
+-     * recipientInfo. */
+-    if (sk_PKCS7_RECIP_INFO_num(rsk) != 1) {
+-        pkiDebug("invalid number of EnvelopedData RecipientInfos\n");
+-        return 0;
+-    }
+-    ri = sk_PKCS7_RECIP_INFO_value(rsk, 0);
+-
+-    evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
+-    if (evp_cipher == NULL)
+-        goto cleanup;
+-    keylen = EVP_CIPHER_key_length(evp_cipher);
+-    blocksize = EVP_CIPHER_block_size(evp_cipher);
+-
+-    evp_ctx = EVP_CIPHER_CTX_new();
+-    if (evp_ctx == NULL)
+-        goto cleanup;
+-    if (!EVP_DecryptInit(evp_ctx, evp_cipher, NULL, NULL) ||
+-        EVP_CIPHER_asn1_to_param(evp_ctx, enc_alg->parameter) <= 0)
+-        goto cleanup;
+-
+-    /* Generate a random symmetric key to avoid exposing timing data if RSA
+-     * decryption fails the padding check. */
+-    tkey = malloc(keylen);
+-    if (tkey == NULL || !EVP_CIPHER_CTX_rand_key(evp_ctx, tkey))
+-        goto cleanup;
+-
+-    /* Decrypt the secret key with the private key. */
+-    ret = pkinit_decode_data(context, id_cryptoctx,
+-                             ASN1_STRING_get0_data(ri->enc_key),
+-                             ASN1_STRING_length(ri->enc_key), &ek, &eklen);
+-    use_key = (ret || eklen != keylen) ? tkey : ek;
+-
+-    /* Allocate a plaintext buffer and decrypt data_body into it. */
+-    plaintext = malloc(data_body->length + blocksize);
+-    if (plaintext == NULL)
+-        goto cleanup;
+-    if (!EVP_DecryptInit(evp_ctx, NULL, use_key, NULL))
+-        goto cleanup;
+-    if (!EVP_DecryptUpdate(evp_ctx, plaintext, &plaintext_len,
+-                           data_body->data, data_body->length))
+-        goto cleanup;
+-    if (!EVP_DecryptFinal(evp_ctx, plaintext + plaintext_len, &final_len))
+-        goto cleanup;
+-    plaintext_len += final_len;
+-
+-    *len_out = plaintext_len;
+-    *data_out = plaintext;
+-    plaintext = NULL;
+-    ok = 1;
+-
+-cleanup:
+-    EVP_CIPHER_CTX_free(evp_ctx);
+-    zapfree(plaintext, plaintext_len);
+-    zapfree(ek, eklen);
+-    zapfree(tkey, keylen);
+-    return ok;
+-}
+-
+ #ifdef DEBUG_DH
+ static void
+ print_dh(DH * dh, char *msg)
+diff --git a/src/plugins/preauth/pkinit/pkinit_lib.c b/src/plugins/preauth/pkinit/pkinit_lib.c
+index 4c3d46bf5a..19db695a4d 100644
+--- a/src/plugins/preauth/pkinit/pkinit_lib.c
++++ b/src/plugins/preauth/pkinit/pkinit_lib.c
+@@ -50,7 +50,6 @@ pkinit_init_req_opts(pkinit_req_opts **reqopts)
+     opts->require_eku = 1;
+     opts->accept_secondary_eku = 0;
+     opts->allow_upn = 0;
+-    opts->dh_or_rsa = DH_PROTOCOL;
+     opts->require_crl_checking = 0;
+     opts->dh_size = PKINIT_DEFAULT_DH_MIN_BITS;
+ 
+@@ -79,7 +78,6 @@ pkinit_init_plg_opts(pkinit_plg_opts **plgopts)
+ 
+     opts->require_eku = 1;
+     opts->accept_secondary_eku = 0;
+-    opts->dh_or_rsa = DH_PROTOCOL;
+     opts->allow_upn = 0;
+     opts->require_crl_checking = 0;
+     opts->require_freshness = 0;
+diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
+index 768a4e559f..aab21f951c 100644
+--- a/src/plugins/preauth/pkinit/pkinit_srv.c
++++ b/src/plugins/preauth/pkinit/pkinit_srv.c
+@@ -821,132 +821,55 @@ pkinit_server_return_padata(krb5_context context,
+         retval = ENOMEM;
+         goto cleanup;
+     }
+-    /* let's assume it's RSA. we'll reset it to DH if needed */
+-    rep->choice = choice_pa_pk_as_rep_encKeyPack;
+ 
+-    if (reqctx->rcv_auth_pack != NULL &&
+-        reqctx->rcv_auth_pack->clientPublicValue.length > 0) {
+-        rep->choice = choice_pa_pk_as_rep_dhInfo;
+-
+-        pkiDebug("received DH key delivery AS REQ\n");
+-        retval = server_process_dh(context, plgctx->cryptoctx,
+-                                   reqctx->cryptoctx, plgctx->idctx,
+-                                   &dh_pubkey, &dh_pubkey_len,
+-                                   &server_key, &server_key_len);
+-        if (retval) {
+-            pkiDebug("failed to process/create dh parameters\n");
+-            goto cleanup;
+-        }
+-
+-        /*
+-         * This is DH, so don't generate the key until after we
+-         * encode the reply, because the encoded reply is needed
+-         * to generate the key in some cases.
+-         */
+-
+-        dhkey_info.subjectPublicKey.length = dh_pubkey_len;
+-        dhkey_info.subjectPublicKey.data = (char *)dh_pubkey;
+-        dhkey_info.nonce = request->nonce;
+-        dhkey_info.dhKeyExpiration = 0;
+-
+-        retval = k5int_encode_krb5_kdc_dh_key_info(&dhkey_info,
+-                                                   &encoded_dhkey_info);
+-        if (retval) {
+-            pkiDebug("encode_krb5_kdc_dh_key_info failed\n");
+-            goto cleanup;
+-        }
+-#ifdef DEBUG_ASN1
+-        print_buffer_bin((unsigned char *)encoded_dhkey_info->data,
+-                         encoded_dhkey_info->length,
+-                         "/tmp/kdc_dh_key_info");
+-#endif
+-
+-        retval = cms_signeddata_create(context, plgctx->cryptoctx,
+-                                       reqctx->cryptoctx, plgctx->idctx,
+-                                       CMS_SIGN_SERVER,
+-                                       (unsigned char *)
+-                                       encoded_dhkey_info->data,
+-                                       encoded_dhkey_info->length,
+-                                       (unsigned char **)
+-                                       &rep->u.dh_Info.dhSignedData.data,
+-                                       &rep->u.dh_Info.dhSignedData.length);
+-        if (retval) {
+-            pkiDebug("failed to create pkcs7 signed data\n");
+-            goto cleanup;
+-        }
+-
+-    } else {
+-        pkiDebug("received RSA key delivery AS REQ\n");
+-
+-        init_krb5_reply_key_pack(&key_pack);
+-        if (key_pack == NULL) {
+-            retval = ENOMEM;
+-            goto cleanup;
+-        }
++    if (reqctx->rcv_auth_pack == NULL ||
++        reqctx->rcv_auth_pack->clientPublicValue.length == 0) {
++        retval = KRB5KDC_ERR_PREAUTH_FAILED;
++        k5_setmsg(context, retval, _("Unsupported PKINIT RSA request"));
++        goto cleanup;
++    }
+ 
+-        retval = krb5_c_make_random_key(context, enctype, &key_pack->replyKey);
+-        if (retval) {
+-            pkiDebug("unable to make a session key\n");
+-            goto cleanup;
+-        }
++    rep->choice = choice_pa_pk_as_rep_dhInfo;
+ 
+-        retval = krb5_c_make_checksum(context, 0, &key_pack->replyKey,
+-                                      KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM,
+-                                      req_pkt, &key_pack->asChecksum);
+-        if (retval) {
+-            pkiDebug("unable to calculate AS REQ checksum\n");
+-            goto cleanup;
+-        }
+-#ifdef DEBUG_CKSUM
+-        pkiDebug("calculating checksum on buf size = %d\n", req_pkt->length);
+-        print_buffer(req_pkt->data, req_pkt->length);
+-        pkiDebug("checksum size = %d\n", key_pack->asChecksum.length);
+-        print_buffer(key_pack->asChecksum.contents,
+-                     key_pack->asChecksum.length);
+-        pkiDebug("encrypting key (%d)\n", key_pack->replyKey.length);
+-        print_buffer(key_pack->replyKey.contents, key_pack->replyKey.length);
+-#endif
++    retval = server_process_dh(context, plgctx->cryptoctx, reqctx->cryptoctx,
++                               plgctx->idctx, &dh_pubkey, &dh_pubkey_len,
++                               &server_key, &server_key_len);
++    if (retval) {
++        pkiDebug("failed to process/create dh parameters\n");
++        goto cleanup;
++    }
+ 
+-        retval = k5int_encode_krb5_reply_key_pack(key_pack,
+-                                                  &encoded_key_pack);
+-        if (retval) {
+-            pkiDebug("failed to encode reply_key_pack\n");
+-            goto cleanup;
+-        }
++    dhkey_info.subjectPublicKey.length = dh_pubkey_len;
++    dhkey_info.subjectPublicKey.data = (char *)dh_pubkey;
++    dhkey_info.nonce = request->nonce;
++    dhkey_info.dhKeyExpiration = 0;
+ 
+-        rep->choice = choice_pa_pk_as_rep_encKeyPack;
+-        retval = cms_envelopeddata_create(context, plgctx->cryptoctx,
+-                                          reqctx->cryptoctx, plgctx->idctx,
+-                                          padata->pa_type,
+-                                          (unsigned char *)
+-                                          encoded_key_pack->data,
+-                                          encoded_key_pack->length,
+-                                          (unsigned char **)
+-                                          &rep->u.encKeyPack.data,
+-                                          &rep->u.encKeyPack.length);
+-        if (retval) {
+-            pkiDebug("failed to create pkcs7 enveloped data: %s\n",
+-                     error_message(retval));
+-            goto cleanup;
+-        }
++    retval = k5int_encode_krb5_kdc_dh_key_info(&dhkey_info,
++                                               &encoded_dhkey_info);
++    if (retval) {
++        pkiDebug("encode_krb5_kdc_dh_key_info failed\n");
++        goto cleanup;
++    }
+ #ifdef DEBUG_ASN1
+-        print_buffer_bin((unsigned char *)encoded_key_pack->data,
+-                         encoded_key_pack->length,
+-                         "/tmp/kdc_key_pack");
+-        print_buffer_bin(rep->u.encKeyPack.data, rep->u.encKeyPack.length,
+-                         "/tmp/kdc_enc_key_pack");
++    print_buffer_bin((unsigned char *)encoded_dhkey_info->data,
++                     encoded_dhkey_info->length, "/tmp/kdc_dh_key_info");
+ #endif
+ 
+-        retval = cb->replace_reply_key(context, rock, &key_pack->replyKey,
+-                                       FALSE);
+-        if (retval)
+-            goto cleanup;
++    retval = cms_signeddata_create(context, plgctx->cryptoctx,
++                                   reqctx->cryptoctx, plgctx->idctx,
++                                   CMS_SIGN_SERVER,
++                                   (unsigned char *)encoded_dhkey_info->data,
++                                   encoded_dhkey_info->length,
++                                   (unsigned char **)
++                                   &rep->u.dh_Info.dhSignedData.data,
++                                   &rep->u.dh_Info.dhSignedData.length);
++    if (retval) {
++        pkiDebug("failed to create pkcs7 signed data\n");
++        goto cleanup;
+     }
+ 
+-    if (rep->choice == choice_pa_pk_as_rep_dhInfo &&
+-        ((reqctx->rcv_auth_pack != NULL &&
+-          reqctx->rcv_auth_pack->supportedKDFs != NULL))) {
+-
++    if (reqctx->rcv_auth_pack != NULL &&
++        reqctx->rcv_auth_pack->supportedKDFs != NULL) {
+         /* If using the alg-agility KDF, put the algorithm in the reply
+          * before encoding it.
+          */
+@@ -973,41 +896,36 @@ pkinit_server_return_padata(krb5_context context,
+                          "/tmp/kdc_as_rep");
+ #endif
+ 
+-    /* If this is DH, we haven't computed the key yet, so do it now. */
+-    if (rep->choice == choice_pa_pk_as_rep_dhInfo) {
+-
+-        /* If mutually supported KDFs were found, use the algorithm agility
+-         * KDF. */
+-        if (rep->u.dh_Info.kdfID) {
+-            secret.data = (char *)server_key;
+-            secret.length = server_key_len;
++    /* If mutually supported KDFs were found, use the algorithm agility KDF. */
++    if (rep->u.dh_Info.kdfID) {
++        secret.data = (char *)server_key;
++        secret.length = server_key_len;
+ 
+-            retval = pkinit_alg_agility_kdf(context, &secret,
+-                                            rep->u.dh_Info.kdfID,
+-                                            request->client, request->server,
+-                                            enctype, req_pkt, out_data,
+-                                            &reply_key);
+-            if (retval) {
+-                pkiDebug("pkinit_alg_agility_kdf failed: %s\n",
+-                         error_message(retval));
+-                goto cleanup;
+-            }
++        retval = pkinit_alg_agility_kdf(context, &secret, rep->u.dh_Info.kdfID,
++                                        request->client, request->server,
++                                        enctype, req_pkt, out_data,
++                                        &reply_key);
++        if (retval) {
++            pkiDebug("pkinit_alg_agility_kdf failed: %s\n",
++                     error_message(retval));
++            goto cleanup;
++        }
+ 
+-            /* Otherwise, use the older octetstring2key() function */
+-        } else {
+-            retval = pkinit_octetstring2key(context, enctype, server_key,
++        /* Otherwise, use the older octetstring2key() function */
++    } else {
++        retval = pkinit_octetstring2key(context, enctype, server_key,
+                                             server_key_len, &reply_key);
+-            if (retval) {
+-                pkiDebug("pkinit_octetstring2key failed: %s\n",
+-                         error_message(retval));
+-                goto cleanup;
+-            }
+-        }
+-        retval = cb->replace_reply_key(context, rock, &reply_key, FALSE);
+-        if (retval)
++        if (retval) {
++            pkiDebug("pkinit_octetstring2key failed: %s\n",
++                     error_message(retval));
+             goto cleanup;
++        }
+     }
+ 
++    retval = cb->replace_reply_key(context, rock, &reply_key, FALSE);
++    if (retval)
++        goto cleanup;
++
+     *send_pa = malloc(sizeof(krb5_pa_data));
+     if (*send_pa == NULL) {
+         retval = ENOMEM;
+diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h
+index 5ee39c085c..d385759145 100644
+--- a/src/plugins/preauth/pkinit/pkinit_trace.h
++++ b/src/plugins/preauth/pkinit/pkinit_trace.h
+@@ -58,19 +58,10 @@
+     TRACE(c, "PKINIT client verified DH reply")
+ #define TRACE_PKINIT_CLIENT_REP_DH_FAIL(c)              \
+     TRACE(c, "PKINIT client could not verify DH reply")
+-#define TRACE_PKINIT_CLIENT_REP_RSA(c)                  \
+-    TRACE(c, "PKINIT client verified RSA reply")
+-#define TRACE_PKINIT_CLIENT_REP_RSA_KEY(c, keyblock, cksum)             \
+-    TRACE(c, "PKINIT client retrieved reply key {keyblock} from RSA "   \
+-          "reply (checksum {cksum})", keyblock, cksum)
+-#define TRACE_PKINIT_CLIENT_REP_RSA_FAIL(c)                     \
+-    TRACE(c, "PKINIT client could not verify RSA reply")
+ #define TRACE_PKINIT_CLIENT_REQ_CHECKSUM(c, cksum)                      \
+     TRACE(c, "PKINIT client computed kdc-req-body checksum {cksum}", cksum)
+ #define TRACE_PKINIT_CLIENT_REQ_DH(c)                           \
+     TRACE(c, "PKINIT client making DH request")
+-#define TRACE_PKINIT_CLIENT_REQ_RSA(c)                  \
+-    TRACE(c, "PKINIT client making RSA request")
+ #define TRACE_PKINIT_CLIENT_SAN_CONFIG_DNSNAME(c, host)                 \
+     TRACE(c, "PKINIT client config accepts KDC dNSName SAN {str}", host)
+ #define TRACE_PKINIT_CLIENT_SAN_MATCH_DNSNAME(c, host)                  \
+diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
+index ec2356ea22..62e6c426d3 100755
+--- a/src/tests/t_pkinit.py
++++ b/src/tests/t_pkinit.py
+@@ -179,13 +179,6 @@ id_conf = {'realms': {'$realm': {'pkinit_identities': [file_identity + 'X',
+ id_env = realm.special_env('idconf', False, krb5_conf=id_conf)
+ realm.kinit(realm.user_princ, expected_trace=msgs, env=id_env)
+ 
+-# Try again using RSA instead of DH.
+-mark('FILE identity, no password, RSA')
+-realm.pkinit(realm.user_princ, flags=['-X', 'flag_RSA_PROTOCOL=yes'],
+-             expected_trace=('PKINIT client making RSA request',
+-                             'PKINIT client verified RSA reply'))
+-realm.klist(realm.user_princ)
+-
+ # Test a DH parameter renegotiation by temporarily setting a 4096-bit
+ # minimum on the KDC.  (Preauth type 16 is PKINIT PA_PK_AS_REQ;
+ # 109 is PKINIT TD_DH_PARAMETERS; 133 is FAST PA-FX-COOKIE.)
+diff --git a/src/windows/leash/htmlhelp/html/KINIT.htm b/src/windows/leash/htmlhelp/html/KINIT.htm
+index eeee211a6e..46cb4a3ad8 100644
+--- a/src/windows/leash/htmlhelp/html/KINIT.htm
++++ b/src/windows/leash/htmlhelp/html/KINIT.htm
+@@ -146,9 +146,6 @@ default credentials cache may vary between systems. If the <b>KRB5CCNAME</b>  en
+   <th id="th2"> <span class="command"> <b>-S</b> <i>service</i><b>_</b><i>name</i></span></th>
+ <td> specify  an  alternate  service name to use when getting initial
+               tickets.</td></tr>
+- <tr>
+-  <th id="th2"> <span class="command"> <b>flag_RSA_PROTOCOL</b>[=yes] </span></th>
+-<td> specify use of RSA, rather than the default Diffie-Hellman protocol. </td></tr>
+ </tbody></table>
+ 
+ <h2>ENVIRONMENT</h2>
+-- 
+2.46.0
+
diff --git a/0024-Fix-various-issues-detected-by-static-analysis.patch b/0024-Fix-various-issues-detected-by-static-analysis.patch
new file mode 100644
index 0000000..ebab90b
--- /dev/null
+++ b/0024-Fix-various-issues-detected-by-static-analysis.patch
@@ -0,0 +1,265 @@
+From 3999883b9745bfd7065d41ff05b19e56bcb2e791 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Fri, 6 Sep 2024 17:18:11 +0200
+Subject: [PATCH] Fix various issues detected by static analysis
+
+In klists's show_credential(), ensure that the column counter doesn't
+decrease if printf() fails.
+
+In process_k5beta7_princ(), bounds-check the e_length field.
+
+In ndr_enc_delegation_info(), initialize b so it is always valid for
+the cleanup handler.
+
+In krb5_dbe_def_decrypt_key_data(), change the flow control so ret is
+always set by the end of the function.  Return KRB5_KDB_INVALIDKEYSIZE
+if there isn't enough data in the first key_data_contents field or if
+the serialized key length is invalid.
+
+In svcauth_gss_validate(), expand rpchdr to accomodate the header plus
+MAX_AUTH_BYTES.
+
+In svcudp_reply(), change slen to unsigned to match the return type of
+XDR_GETPOS() and eliminate an unnecessary check for slen >= 0.
+
+In krb5int_pthread_loaded()(), remove pthread_equal() from the weak
+symbol checks.  It is implemented as an inline function in some glibc
+versions, which makes the comparison "&pthread_equal == 0" always
+false.
+
+[ghudson@mit.edu: further modified krb5_dbe_def_decrypt_key_data() for
+clarity; added detail to commit message]
+
+(cherry picked from commit a96541981ee34c8642ddeb6101b98e883e41c6e5)
+---
+ src/clients/klist/klist.c  | 12 ++++-----
+ src/kadmin/dbutil/dump.c   |  5 ++++
+ src/kdc/ndr.c              |  2 +-
+ src/lib/kdb/decrypt_key.c  | 54 ++++++++++++++++++++------------------
+ src/lib/rpc/svc_auth_gss.c |  5 +++-
+ src/lib/rpc/svc_udp.c      | 13 ++++-----
+ src/util/support/threads.c |  2 --
+ 7 files changed, 51 insertions(+), 42 deletions(-)
+
+diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c
+index b5808e5c93..ba9539fd23 100644
+--- a/src/clients/klist/klist.c
++++ b/src/clients/klist/klist.c
+@@ -681,7 +681,7 @@ show_credential(krb5_creds *cred, const char *defname)
+     krb5_error_code ret;
+     krb5_ticket *tkt = NULL;
+     char *name = NULL, *sname = NULL, *tktsname, *flags;
+-    int extra_field = 0, ccol = 0, i;
++    int extra_field = 0, ccol = 0, i, r;
+     krb5_boolean is_config = krb5_is_config_principal(context, cred->server);
+ 
+     ret = krb5_unparse_name(context, cred->client, &name);
+@@ -711,11 +711,11 @@ show_credential(krb5_creds *cred, const char *defname)
+         fputs("config: ", stdout);
+         ccol = 8;
+         for (i = 1; i < cred->server->length; i++) {
+-            ccol += printf("%s%.*s%s",
+-                           i > 1 ? "(" : "",
+-                           (int)cred->server->data[i].length,
+-                           cred->server->data[i].data,
+-                           i > 1 ? ")" : "");
++            r = printf("%s%.*s%s", i > 1 ? "(" : "",
++                       (int)cred->server->data[i].length,
++                       cred->server->data[i].data, i > 1 ? ")" : "");
++            if (r >= 0)
++                ccol += r;
+         }
+         fputs(" = ", stdout);
+         ccol += 3;
+diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c
+index 4d6cc0bdf9..feb053d834 100644
+--- a/src/kadmin/dbutil/dump.c
++++ b/src/kadmin/dbutil/dump.c
+@@ -704,6 +704,11 @@ process_k5beta7_princ(krb5_context context, const char *fname, FILE *filep,
+ 
+     dbentry->len = u1;
+     dbentry->n_key_data = u4;
++
++    if (u5 > UINT16_MAX) {
++        load_err(fname, *linenop, _("invalid principal extra data size"));
++        goto fail;
++    }
+     dbentry->e_length = u5;
+ 
+     if (kp != NULL) {
+diff --git a/src/kdc/ndr.c b/src/kdc/ndr.c
+index d438408ee2..38be9fe42a 100644
+--- a/src/kdc/ndr.c
++++ b/src/kdc/ndr.c
+@@ -242,7 +242,7 @@ ndr_enc_delegation_info(struct pac_s4u_delegation_info *in, krb5_data *out)
+ {
+     krb5_error_code ret;
+     size_t i;
+-    struct k5buf b;
++    struct k5buf b = EMPTY_K5BUF;
+     struct encoded_wchars pt_encoded = { 0 }, *tss_encoded = NULL;
+     uint32_t pointer = 0;
+ 
+diff --git a/src/lib/kdb/decrypt_key.c b/src/lib/kdb/decrypt_key.c
+index 82bbed6312..21aa3742b1 100644
+--- a/src/lib/kdb/decrypt_key.c
++++ b/src/lib/kdb/decrypt_key.c
+@@ -60,7 +60,7 @@ krb5_dbe_def_decrypt_key_data(krb5_context context, const krb5_keyblock *mkey,
+                               krb5_keyblock *dbkey_out,
+                               krb5_keysalt *keysalt_out)
+ {
+-    krb5_error_code ret;
++    krb5_error_code ret = KRB5_CRYPTO_INTERNAL;
+     int16_t keylen;
+     krb5_enc_data cipher;
+     krb5_data plain = empty_data();
+@@ -74,36 +74,38 @@ krb5_dbe_def_decrypt_key_data(krb5_context context, const krb5_keyblock *mkey,
+     if (mkey == NULL)
+         return KRB5_KDB_BADSTORED_MKEY;
+ 
+-    if (kd->key_data_contents[0] != NULL && kd->key_data_length[0] >= 2) {
+-        keylen = load_16_le(kd->key_data_contents[0]);
+-        if (keylen < 0)
+-            return EINVAL;
+-        cipher.enctype = ENCTYPE_UNKNOWN;
+-        cipher.ciphertext = make_data(kd->key_data_contents[0] + 2,
+-                                      kd->key_data_length[0] - 2);
+-        ret = alloc_data(&plain, kd->key_data_length[0] - 2);
+-        if (ret)
+-            goto cleanup;
++    if (kd->key_data_contents[0] == NULL || kd->key_data_length[0] < 2)
++        return KRB5_KDB_INVALIDKEYSIZE;
+ 
+-        ret = krb5_c_decrypt(context, mkey, 0, 0, &cipher, &plain);
+-        if (ret)
+-            goto cleanup;
++    keylen = load_16_le(kd->key_data_contents[0]);
++    if (keylen < 0)
++        return KRB5_KDB_INVALIDKEYSIZE;
+ 
+-        /* Make sure the plaintext has at least as many bytes as the true ke
+-         * length (it may have more due to padding). */
+-        if ((unsigned int)keylen > plain.length) {
+-            ret = KRB5_CRYPTO_INTERNAL;
+-            if (ret)
+-                goto cleanup;
+-        }
++    cipher.enctype = ENCTYPE_UNKNOWN;
++    cipher.ciphertext = make_data(kd->key_data_contents[0] + 2,
++                                  kd->key_data_length[0] - 2);
++    ret = alloc_data(&plain, kd->key_data_length[0] - 2);
++    if (ret)
++        goto cleanup;
+ 
+-        kb.magic = KV5M_KEYBLOCK;
+-        kb.enctype = kd->key_data_type[0];
+-        kb.length = keylen;
+-        kb.contents = (uint8_t *)plain.data;
+-        plain = empty_data();
++    ret = krb5_c_decrypt(context, mkey, 0, 0, &cipher, &plain);
++    if (ret)
++        goto cleanup;
++
++    /* Make sure the plaintext has at least as many bytes as the true key
++     * length (it may have more due to padding). */
++    if ((unsigned int)keylen > plain.length) {
++        ret = KRB5_CRYPTO_INTERNAL;
++        if (ret)
++            goto cleanup;
+     }
+ 
++    kb.magic = KV5M_KEYBLOCK;
++    kb.enctype = kd->key_data_type[0];
++    kb.length = keylen;
++    kb.contents = (uint8_t *)plain.data;
++    plain = empty_data();
++
+     /* Decode salt data. */
+     if (keysalt_out != NULL) {
+         if (kd->key_data_ver == 2) {
+diff --git a/src/lib/rpc/svc_auth_gss.c b/src/lib/rpc/svc_auth_gss.c
+index 98d601c8ab..4f1d2911b0 100644
+--- a/src/lib/rpc/svc_auth_gss.c
++++ b/src/lib/rpc/svc_auth_gss.c
+@@ -297,7 +297,7 @@ svcauth_gss_validate(struct svc_req *rqst, struct svc_rpc_gss_data *gd, struct r
+ 	struct opaque_auth	*oa;
+ 	gss_buffer_desc		 rpcbuf, checksum;
+ 	OM_uint32		 maj_stat, min_stat, qop_state;
+-	u_char			 rpchdr[128];
++	u_char			 rpchdr[32 + MAX_AUTH_BYTES];
+ 	int32_t			*buf;
+ 
+ 	log_debug("in svcauth_gss_validate()");
+@@ -315,6 +315,8 @@ svcauth_gss_validate(struct svc_req *rqst, struct svc_rpc_gss_data *gd, struct r
+ 		return (FALSE);
+ 
+ 	buf = (int32_t *)(void *)rpchdr;
++
++	/* Write the 32 first bytes of the header. */
+ 	IXDR_PUT_LONG(buf, msg->rm_xid);
+ 	IXDR_PUT_ENUM(buf, msg->rm_direction);
+ 	IXDR_PUT_LONG(buf, msg->rm_call.cb_rpcvers);
+@@ -323,6 +325,7 @@ svcauth_gss_validate(struct svc_req *rqst, struct svc_rpc_gss_data *gd, struct r
+ 	IXDR_PUT_LONG(buf, msg->rm_call.cb_proc);
+ 	IXDR_PUT_ENUM(buf, oa->oa_flavor);
+ 	IXDR_PUT_LONG(buf, oa->oa_length);
++
+ 	if (oa->oa_length) {
+ 		memcpy((caddr_t)buf, oa->oa_base, oa->oa_length);
+ 		buf += RNDUP(oa->oa_length) / sizeof(int32_t);
+diff --git a/src/lib/rpc/svc_udp.c b/src/lib/rpc/svc_udp.c
+index 8ecbdf2b33..3aff277eb7 100644
+--- a/src/lib/rpc/svc_udp.c
++++ b/src/lib/rpc/svc_udp.c
+@@ -248,8 +248,9 @@ static bool_t svcudp_reply(
+ {
+      struct svcudp_data *su = su_data(xprt);
+      XDR *xdrs = &su->su_xdrs;
+-     int slen;
++     u_int slen;
+      bool_t stat = FALSE;
++     ssize_t r;
+ 
+      xdrproc_t xdr_results = NULL;
+      caddr_t xdr_location = 0;
+@@ -272,12 +273,12 @@ static bool_t svcudp_reply(
+      if (xdr_replymsg(xdrs, msg) &&
+ 	 (!has_args ||
+ 	  (SVCAUTH_WRAP(xprt->xp_auth, xdrs, xdr_results, xdr_location)))) {
+-	  slen = (int)XDR_GETPOS(xdrs);
+-	  if (sendto(xprt->xp_sock, rpc_buffer(xprt), slen, 0,
+-		     (struct sockaddr *)&(xprt->xp_raddr), xprt->xp_addrlen)
+-	      == slen) {
++	  slen = XDR_GETPOS(xdrs);
++	  r = sendto(xprt->xp_sock, rpc_buffer(xprt), slen, 0,
++		     (struct sockaddr *)&(xprt->xp_raddr), xprt->xp_addrlen);
++	  if (r >= 0 && (u_int)r == slen) {
+ 	       stat = TRUE;
+-	       if (su->su_cache && slen >= 0) {
++	       if (su->su_cache) {
+ 		    cache_set(xprt, (uint32_t) slen);
+ 	       }
+ 	  }
+diff --git a/src/util/support/threads.c b/src/util/support/threads.c
+index be7e4c2e3f..4ded805b79 100644
+--- a/src/util/support/threads.c
++++ b/src/util/support/threads.c
+@@ -118,7 +118,6 @@ struct tsd_block {
+ # pragma weak pthread_mutex_destroy
+ # pragma weak pthread_mutex_init
+ # pragma weak pthread_self
+-# pragma weak pthread_equal
+ # pragma weak pthread_getspecific
+ # pragma weak pthread_setspecific
+ # pragma weak pthread_key_create
+@@ -151,7 +150,6 @@ int krb5int_pthread_loaded (void)
+         || &pthread_mutex_destroy == 0
+         || &pthread_mutex_init == 0
+         || &pthread_self == 0
+-        || &pthread_equal == 0
+         /* Any program that's really multithreaded will have to be
+            able to create threads.  */
+         || &pthread_create == 0
+-- 
+2.46.0
+
diff --git a/0025-Generate-and-verify-message-MACs-in-libkrad.patch b/0025-Generate-and-verify-message-MACs-in-libkrad.patch
new file mode 100644
index 0000000..58c9352
--- /dev/null
+++ b/0025-Generate-and-verify-message-MACs-in-libkrad.patch
@@ -0,0 +1,629 @@
+From ea02fd7bb79861b8e36517c7c95af821a16657c4 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 22 Aug 2024 17:15:50 +0200
+Subject: [PATCH] Generate and verify message MACs in libkrad
+
+Implement some of the measures specified in
+draft-ietf-radext-deprecating-radius-03 for mitigating the BlastRADIUS
+attack (CVE-2024-3596):
+
+* Include a Message-Authenticator MAC as the first attribute when
+  generating a packet of type Access-Request, Access-Reject,
+  Access-Accept, or Access-Challenge (sections 5.2.1 and 5.2.4), if
+  the secret is non-empty.  (An empty secret indicates the use of Unix
+  domain socket transport.)
+
+* Validate the Message-Authenticator MAC in received packets, if
+  present.
+
+FreeRADIUS enforces Message-Authenticator as of versions 3.2.5 and
+3.0.27.  libkrad must generate Message-Authenticator attributes in
+order to remain compatible with these implementations.
+
+[ghudson@mit.edu: adjusted style and naming; simplified some
+functions; edited commit message]
+
+ticket: 9142 (new)
+tags: pullup
+target_version: 1.21-next
+
+(cherry picked from commit 871125fea8ce0370a972bf65f7d1de63f619b06c)
+---
+ src/include/k5-int.h                   |   5 +
+ src/lib/crypto/krb/checksum_hmac_md5.c |  28 ++++
+ src/lib/crypto/libk5crypto.exports     |   1 +
+ src/lib/krad/attr.c                    |  17 ++
+ src/lib/krad/attrset.c                 |  59 +++++--
+ src/lib/krad/internal.h                |   7 +-
+ src/lib/krad/packet.c                  | 206 +++++++++++++++++++++++--
+ src/lib/krad/t_attrset.c               |   2 +-
+ src/lib/krad/t_daemon.py               |   3 +-
+ src/lib/krad/t_packet.c                |  11 ++
+ src/tests/t_otp.py                     |   3 +
+ 11 files changed, 311 insertions(+), 31 deletions(-)
+
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index 69d6a6f569..b7789a2dd8 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -2403,4 +2403,9 @@ krb5_boolean
+ k5_sname_compare(krb5_context context, krb5_const_principal sname,
+                  krb5_const_principal princ);
+ 
++/* Generate an HMAC-MD5 keyed checksum as specified by RFC 2104. */
++krb5_error_code
++k5_hmac_md5(const krb5_data *key, const krb5_crypto_iov *data, size_t num_data,
++            krb5_data *output);
++
+ #endif /* _KRB5_INT_H */
+diff --git a/src/lib/crypto/krb/checksum_hmac_md5.c b/src/lib/crypto/krb/checksum_hmac_md5.c
+index ec024f3966..a809388549 100644
+--- a/src/lib/crypto/krb/checksum_hmac_md5.c
++++ b/src/lib/crypto/krb/checksum_hmac_md5.c
+@@ -92,3 +92,31 @@ cleanup:
+     free(hash_iov);
+     return ret;
+ }
++
++krb5_error_code
++k5_hmac_md5(const krb5_data *key, const krb5_crypto_iov *data, size_t num_data,
++            krb5_data *output)
++{
++    krb5_error_code ret;
++    const struct krb5_hash_provider *hash = &krb5int_hash_md5;
++    krb5_keyblock keyblock = { 0 };
++    krb5_data hashed_key;
++    uint8_t hkeybuf[16];
++    krb5_crypto_iov iov;
++
++    /* Hash the key if it is longer than the block size. */
++    if (key->length > hash->blocksize) {
++        hashed_key = make_data(hkeybuf, sizeof(hkeybuf));
++        iov.flags = KRB5_CRYPTO_TYPE_DATA;
++        iov.data = *key;
++        ret = hash->hash(&iov, 1, &hashed_key);
++        if (ret)
++            return ret;
++        key = &hashed_key;
++    }
++
++    keyblock.magic = KV5M_KEYBLOCK;
++    keyblock.length = key->length;
++    keyblock.contents = (uint8_t *)key->data;
++    return krb5int_hmac_keyblock(hash, &keyblock, data, num_data, output);
++}
+diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports
+index d8ffa63304..00e0ce1812 100644
+--- a/src/lib/crypto/libk5crypto.exports
++++ b/src/lib/crypto/libk5crypto.exports
+@@ -102,3 +102,4 @@ krb5_c_prfplus
+ krb5_c_derive_prfplus
+ k5_enctype_to_ssf
+ krb5int_c_deprecated_enctype
++k5_hmac_md5
+diff --git a/src/lib/krad/attr.c b/src/lib/krad/attr.c
+index 42d354a3b5..65ed1d35e7 100644
+--- a/src/lib/krad/attr.c
++++ b/src/lib/krad/attr.c
+@@ -125,6 +125,23 @@ static const attribute_record attributes[UCHAR_MAX] = {
+     {"NAS-Port-Type", 4, 4, NULL, NULL},
+     {"Port-Limit", 4, 4, NULL, NULL},
+     {"Login-LAT-Port", 1, MAX_ATTRSIZE, NULL, NULL},
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for tunnelling */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */
++    {NULL, 0, 0, NULL, NULL}, /* Reserved for Apple Remote Access Protocol */
++    {NULL, 0, 0, NULL, NULL}, /* Password-Retry */
++    {NULL, 0, 0, NULL, NULL}, /* Prompt */
++    {NULL, 0, 0, NULL, NULL}, /* Connect-Info */
++    {NULL, 0, 0, NULL, NULL}, /* Configuration-Token */
++    {NULL, 0, 0, NULL, NULL}, /* EAP-Message */
++    {"Message-Authenticator", MD5_DIGEST_SIZE, MD5_DIGEST_SIZE, NULL, NULL},
+ };
+ 
+ /* Encode User-Password attribute. */
+diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c
+index 6ec031e320..e5457ebfd7 100644
+--- a/src/lib/krad/attrset.c
++++ b/src/lib/krad/attrset.c
+@@ -164,15 +164,44 @@ krad_attrset_copy(const krad_attrset *set, krad_attrset **copy)
+     return 0;
+ }
+ 
++/* Place an encoded attributes into outbuf at position *i.  Increment *i by the
++ * length of the encoding. */
++static krb5_error_code
++append_attr(krb5_context ctx, const char *secret,
++            const uint8_t *auth, krad_attr type, const krb5_data *data,
++            uint8_t outbuf[MAX_ATTRSETSIZE], size_t *i, krb5_boolean *is_fips)
++{
++    uint8_t buffer[MAX_ATTRSIZE];
++    size_t attrlen;
++    krb5_error_code retval;
++
++    retval = kr_attr_encode(ctx, secret, auth, type, data, buffer, &attrlen,
++                            is_fips);
++    if (retval)
++        return retval;
++
++    if (attrlen > MAX_ATTRSETSIZE - *i - 2)
++        return EMSGSIZE;
++
++    outbuf[(*i)++] = type;
++    outbuf[(*i)++] = attrlen + 2;
++    memcpy(outbuf + *i, buffer, attrlen);
++    *i += attrlen;
++
++    return 0;
++}
++
+ krb5_error_code
+ kr_attrset_encode(const krad_attrset *set, const char *secret,
+-                  const unsigned char *auth,
++                  const uint8_t *auth, krb5_boolean add_msgauth,
+                   unsigned char outbuf[MAX_ATTRSETSIZE], size_t *outlen,
+                   krb5_boolean *is_fips)
+ {
+-    unsigned char buffer[MAX_ATTRSIZE];
+     krb5_error_code retval;
+-    size_t i = 0, attrlen;
++    krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator");
++    const uint8_t zeroes[MD5_DIGEST_SIZE] = { 0 };
++    krb5_data zerodata;
++    size_t i = 0;
+     attr *a;
+ 
+     if (set == NULL) {
+@@ -180,19 +209,21 @@ kr_attrset_encode(const krad_attrset *set, const char *secret,
+         return 0;
+     }
+ 
+-    K5_TAILQ_FOREACH(a, &set->list, list) {
+-        retval = kr_attr_encode(set->ctx, secret, auth, a->type, &a->attr,
+-                                buffer, &attrlen, is_fips);
+-        if (retval != 0)
++    if (add_msgauth) {
++        /* Encode Message-Authenticator as the first attribute, per
++         * draft-ietf-radext-deprecating-radius-03 section 5.2. */
++        zerodata = make_data((uint8_t *)zeroes, MD5_DIGEST_SIZE);
++        retval = append_attr(set->ctx, secret, auth, msgauth_type, &zerodata,
++                             outbuf, &i, is_fips);
++        if (retval)
+             return retval;
++    }
+ 
+-        if (i + attrlen + 2 > MAX_ATTRSETSIZE)
+-            return EMSGSIZE;
+-
+-        outbuf[i++] = a->type;
+-        outbuf[i++] = attrlen + 2;
+-        memcpy(&outbuf[i], buffer, attrlen);
+-        i += attrlen;
++    K5_TAILQ_FOREACH(a, &set->list, list) {
++        retval = append_attr(set->ctx, secret, auth, a->type, &a->attr,
++                             outbuf, &i, is_fips);
++        if (retval)
++            return retval;
+     }
+ 
+     *outlen = i;
+diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h
+index a17b6f39b1..ca66f3ec68 100644
+--- a/src/lib/krad/internal.h
++++ b/src/lib/krad/internal.h
+@@ -49,6 +49,8 @@
+ #define UCHAR_MAX 255
+ #endif
+ 
++#define MD5_DIGEST_SIZE 16
++
+ /* RFC 2865 */
+ #define MAX_ATTRSIZE (UCHAR_MAX - 2)
+ #define MAX_ATTRSETSIZE (KRAD_PACKET_SIZE_MAX - 20)
+@@ -79,10 +81,11 @@ kr_attr_decode(krb5_context ctx, const char *secret, const unsigned char *auth,
+                krad_attr type, const krb5_data *in,
+                unsigned char outbuf[MAX_ATTRSIZE], size_t *outlen);
+ 
+-/* Encode the attributes into the buffer. */
++/* Encode set into outbuf.  If add_msgauth is true, include a zeroed
++ * Message-Authenticator as the first attribute. */
+ krb5_error_code
+ kr_attrset_encode(const krad_attrset *set, const char *secret,
+-                  const unsigned char *auth,
++                  const uint8_t *auth, krb5_boolean add_msgauth,
+                   unsigned char outbuf[MAX_ATTRSETSIZE], size_t *outlen,
+                   krb5_boolean *is_fips);
+ 
+diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c
+index c5446b890c..3c1a4d507e 100644
+--- a/src/lib/krad/packet.c
++++ b/src/lib/krad/packet.c
+@@ -36,6 +36,7 @@
+ typedef unsigned char uchar;
+ 
+ /* RFC 2865 */
++#define MSGAUTH_SIZE (2 + MD5_DIGEST_SIZE)
+ #define OFFSET_CODE 0
+ #define OFFSET_ID 1
+ #define OFFSET_LENGTH 2
+@@ -222,6 +223,106 @@ packet_set_attrset(krb5_context ctx, const char *secret, krad_packet *pkt)
+     return kr_attrset_decode(ctx, &tmp, secret, pkt_auth(pkt), &pkt->attrset);
+ }
+ 
++/* Determine if a packet requires a Message-Authenticator attribute. */
++static inline krb5_boolean
++requires_msgauth(const char *secret, krad_code code)
++{
++    /* If no secret is provided, assume that the transport is a UNIX socket.
++     * Message-Authenticator is required only on UDP and TCP connections. */
++    if (*secret == '\0')
++        return FALSE;
++
++    /*
++     * Per draft-ietf-radext-deprecating-radius-03 sections 5.2.1 and 5.2.4,
++     * Message-Authenticator is required in Access-Request packets and all
++     * potential responses when UDP or TCP transport is used.
++     */
++    return code == krad_code_name2num("Access-Request") ||
++        code == krad_code_name2num("Access-Reject") ||
++        code == krad_code_name2num("Access-Accept") ||
++        code == krad_code_name2num("Access-Challenge");
++}
++
++/* Check if the packet has a Message-Authenticator attribute. */
++static inline krb5_boolean
++has_pkt_msgauth(const krad_packet *pkt)
++{
++    krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator");
++
++    return krad_attrset_get(pkt->attrset, msgauth_type, 0) != NULL;
++}
++
++/* Return the beginning of the Message-Authenticator attribute in pkt, or NULL
++ * if no such attribute is present. */
++static const uint8_t *
++lookup_msgauth_addr(const krad_packet *pkt)
++{
++    krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator");
++    size_t i;
++    uint8_t *p;
++
++    i = OFFSET_ATTR;
++    while (i + 2 < pkt->pkt.length) {
++        p = (uint8_t *)offset(&pkt->pkt, i);
++        if (msgauth_type == *p)
++            return p;
++        i += p[1];
++    }
++
++    return NULL;
++}
++
++/*
++ * Calculate the message authenticator MAC for pkt as specified in RFC 2869
++ * section 5.14, placing the result in mac_out.  Use the provided authenticator
++ * auth, which may be from pkt or from a corresponding request.
++ */
++static krb5_error_code
++calculate_mac(const char *secret, const krad_packet *pkt,
++              const uint8_t auth[AUTH_FIELD_SIZE],
++              uint8_t mac_out[MD5_DIGEST_SIZE])
++{
++    uint8_t zeroed_msgauth[MSGAUTH_SIZE];
++    krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator");
++    const uint8_t *msgauth_attr, *msgauth_end, *pkt_end;
++    krb5_crypto_iov input[5];
++    krb5_data ksecr, mac;
++
++    msgauth_attr = lookup_msgauth_addr(pkt);
++    if (msgauth_attr == NULL)
++        return EINVAL;
++    msgauth_end = msgauth_attr + MSGAUTH_SIZE;
++    pkt_end = (const uint8_t *)pkt->pkt.data + pkt->pkt.length;
++
++    /* Read code, id, and length from the packet. */
++    input[0].flags = KRB5_CRYPTO_TYPE_DATA;
++    input[0].data = make_data(pkt->pkt.data, OFFSET_AUTH);
++
++    /* Read the provided authenticator. */
++    input[1].flags = KRB5_CRYPTO_TYPE_DATA;
++    input[1].data = make_data((uint8_t *)auth, AUTH_FIELD_SIZE);
++
++    /* Read any attributes before Message-Authenticator. */
++    input[2].flags = KRB5_CRYPTO_TYPE_DATA;
++    input[2].data = make_data(pkt_attr(pkt), msgauth_attr - pkt_attr(pkt));
++
++    /* Read Message-Authenticator with the data bytes all set to zero, per RFC
++     * 2869 section 5.14. */
++    zeroed_msgauth[0] = msgauth_type;
++    zeroed_msgauth[1] = MSGAUTH_SIZE;
++    memset(zeroed_msgauth + 2, 0, MD5_DIGEST_SIZE);
++    input[3].flags = KRB5_CRYPTO_TYPE_DATA;
++    input[3].data = make_data(zeroed_msgauth, MSGAUTH_SIZE);
++
++    /* Read any attributes after Message-Authenticator. */
++    input[4].flags = KRB5_CRYPTO_TYPE_DATA;
++    input[4].data = make_data((uint8_t *)msgauth_end, pkt_end - msgauth_end);
++
++    mac = make_data(mac_out, MD5_DIGEST_SIZE);
++    ksecr = string2data((char *)secret);
++    return k5_hmac_md5(&ksecr, input, 5, &mac);
++}
++
+ ssize_t
+ krad_packet_bytes_needed(const krb5_data *buffer)
+ {
+@@ -255,6 +356,7 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code,
+     krad_packet *pkt;
+     uchar id;
+     size_t attrset_len;
++    krb5_boolean msgauth_required;
+ 
+     pkt = packet_new();
+     if (pkt == NULL) {
+@@ -274,9 +376,13 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code,
+     if (retval != 0)
+         goto error;
+ 
++    /* Determine if Message-Authenticator is required. */
++    msgauth_required = (*secret != '\0' &&
++                        code == krad_code_name2num("Access-Request"));
++
+     /* Encode the attributes. */
+-    retval = kr_attrset_encode(set, secret, pkt_auth(pkt), pkt_attr(pkt),
+-                               &attrset_len, &pkt->is_fips);
++    retval = kr_attrset_encode(set, secret, pkt_auth(pkt), msgauth_required,
++                               pkt_attr(pkt), &attrset_len, &pkt->is_fips);
+     if (retval != 0)
+         goto error;
+ 
+@@ -285,6 +391,13 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code,
+     pkt_code_set(pkt, code);
+     pkt_len_set(pkt, pkt->pkt.length);
+ 
++    if (msgauth_required) {
++        /* Calculate and set the Message-Authenticator MAC. */
++        retval = calculate_mac(secret, pkt, pkt_auth(pkt), pkt_attr(pkt) + 2);
++        if (retval != 0)
++            goto error;
++    }
++
+     /* Copy the attrset for future use. */
+     retval = packet_set_attrset(ctx, secret, pkt);
+     if (retval != 0)
+@@ -307,14 +420,19 @@ krad_packet_new_response(krb5_context ctx, const char *secret, krad_code code,
+     krb5_error_code retval;
+     krad_packet *pkt;
+     size_t attrset_len;
++    krb5_boolean msgauth_required;
+ 
+     pkt = packet_new();
+     if (pkt == NULL)
+         return ENOMEM;
+ 
++    /* Determine if Message-Authenticator is required. */
++    msgauth_required = requires_msgauth(secret, code);
++
+     /* Encode the attributes. */
+-    retval = kr_attrset_encode(set, secret, pkt_auth(request), pkt_attr(pkt),
+-                               &attrset_len, &pkt->is_fips);
++    retval = kr_attrset_encode(set, secret, pkt_auth(request),
++                               msgauth_required, pkt_attr(pkt), &attrset_len,
++                               &pkt->is_fips);
+     if (retval != 0)
+         goto error;
+ 
+@@ -330,6 +448,18 @@ krad_packet_new_response(krb5_context ctx, const char *secret, krad_code code,
+     if (retval != 0)
+         goto error;
+ 
++    if (msgauth_required) {
++        /*
++         * Calculate and replace the Message-Authenticator MAC.  Per RFC 2869
++         * section 5.14, use the authenticator from the request, not from the
++         * response.
++         */
++        retval = calculate_mac(secret, pkt, pkt_auth(request),
++                               pkt_attr(pkt) + 2);
++        if (retval != 0)
++            goto error;
++    }
++
+     /* Copy the attrset for future use. */
+     retval = packet_set_attrset(ctx, secret, pkt);
+     if (retval != 0)
+@@ -343,6 +473,34 @@ error:
+     return retval;
+ }
+ 
++/* Verify the Message-Authenticator value in pkt, using the provided
++ * authenticator (which may be from pkt or from a corresponding request). */
++static krb5_error_code
++verify_msgauth(const char *secret, const krad_packet *pkt,
++               const uint8_t auth[AUTH_FIELD_SIZE])
++{
++    uint8_t mac[MD5_DIGEST_SIZE];
++    krad_attr msgauth_type = krad_attr_name2num("Message-Authenticator");
++    const krb5_data *msgauth;
++    krb5_error_code retval;
++
++    msgauth = krad_packet_get_attr(pkt, msgauth_type, 0);
++    if (msgauth == NULL)
++        return ENODATA;
++
++    retval = calculate_mac(secret, pkt, auth, mac);
++    if (retval)
++        return retval;
++
++    if (msgauth->length != MD5_DIGEST_SIZE)
++        return EMSGSIZE;
++
++    if (k5_bcmp(mac, msgauth->data, MD5_DIGEST_SIZE) != 0)
++        return EBADMSG;
++
++    return 0;
++}
++
+ /* Decode a packet. */
+ static krb5_error_code
+ decode_packet(krb5_context ctx, const char *secret, const krb5_data *buffer,
+@@ -394,21 +552,35 @@ krad_packet_decode_request(krb5_context ctx, const char *secret,
+                            krad_packet **reqpkt)
+ {
+     const krad_packet *tmp = NULL;
++    krad_packet *req;
+     krb5_error_code retval;
+ 
+-    retval = decode_packet(ctx, secret, buffer, reqpkt);
+-    if (cb != NULL && retval == 0) {
++    retval = decode_packet(ctx, secret, buffer, &req);
++    if (retval)
++        return retval;
++
++    /* Verify Message-Authenticator if present. */
++    if (has_pkt_msgauth(req)) {
++        retval = verify_msgauth(secret, req, pkt_auth(req));
++        if (retval) {
++            krad_packet_free(req);
++            return retval;
++        }
++    }
++
++    if (cb != NULL) {
+         for (tmp = (*cb)(data, FALSE); tmp != NULL; tmp = (*cb)(data, FALSE)) {
+             if (pkt_id_get(*reqpkt) == pkt_id_get(tmp))
+                 break;
+         }
+-    }
+ 
+-    if (cb != NULL && (retval != 0 || tmp != NULL))
+-        (*cb)(data, TRUE);
++        if (tmp != NULL)
++            (*cb)(data, TRUE);
++    }
+ 
++    *reqpkt = req;
+     *duppkt = tmp;
+-    return retval;
++    return 0;
+ }
+ 
+ krb5_error_code
+@@ -435,9 +607,17 @@ krad_packet_decode_response(krb5_context ctx, const char *secret,
+                 break;
+             }
+ 
+-            /* If the authenticator matches, then the response is valid. */
+-            if (memcmp(pkt_auth(*rsppkt), auth, sizeof(auth)) == 0)
+-                break;
++            /* Verify the response authenticator. */
++            if (k5_bcmp(pkt_auth(*rsppkt), auth, sizeof(auth)) != 0)
++                continue;
++
++            /* Verify Message-Authenticator if present. */
++            if (has_pkt_msgauth(*rsppkt)) {
++                if (verify_msgauth(secret, *rsppkt, pkt_auth(tmp)) != 0)
++                    continue;
++            }
++
++            break;
+         }
+     }
+ 
+diff --git a/src/lib/krad/t_attrset.c b/src/lib/krad/t_attrset.c
+index 4cdb8b7d8e..f9c66509bd 100644
+--- a/src/lib/krad/t_attrset.c
++++ b/src/lib/krad/t_attrset.c
+@@ -63,7 +63,7 @@ main(void)
+     noerror(krad_attrset_add(set, krad_attr_name2num("User-Password"), &tmp));
+ 
+     /* Encode attrset. */
+-    noerror(kr_attrset_encode(set, "foo", auth, buffer, &encode_len,
++    noerror(kr_attrset_encode(set, "foo", auth, FALSE, buffer, &encode_len,
+                               &is_fips));
+     krad_attrset_free(set);
+ 
+diff --git a/src/lib/krad/t_daemon.py b/src/lib/krad/t_daemon.py
+index 4a3de079c7..647d4894eb 100755
+--- a/src/lib/krad/t_daemon.py
++++ b/src/lib/krad/t_daemon.py
+@@ -40,6 +40,7 @@ DICTIONARY = """
+ ATTRIBUTE\tUser-Name\t1\tstring
+ ATTRIBUTE\tUser-Password\t2\toctets
+ ATTRIBUTE\tNAS-Identifier\t32\tstring
++ATTRIBUTE\tMessage-Authenticator\t80\toctets
+ """
+ 
+ class TestServer(server.Server):
+@@ -52,7 +53,7 @@ class TestServer(server.Server):
+             if key == "User-Password":
+                 passwd = [pkt.PwDecrypt(x) for x in pkt[key]]
+ 
+-        reply = self.CreateReplyPacket(pkt)
++        reply = self.CreateReplyPacket(pkt, message_authenticator=True)
+         if passwd == ['accept']:
+             reply.code = packet.AccessAccept
+         else:
+diff --git a/src/lib/krad/t_packet.c b/src/lib/krad/t_packet.c
+index c22489144f..104b6507a2 100644
+--- a/src/lib/krad/t_packet.c
++++ b/src/lib/krad/t_packet.c
+@@ -172,6 +172,9 @@ main(int argc, const char **argv)
+     krb5_data username, password;
+     krb5_boolean auth = FALSE;
+     krb5_context ctx;
++    const krad_packet *dupreq;
++    const krb5_data *encpkt;
++    krad_packet *decreq;
+ 
+     username = string2data("testUser");
+ 
+@@ -184,9 +187,17 @@ main(int argc, const char **argv)
+ 
+     password = string2data("accept");
+     noerror(make_packet(ctx, &username, &password, &packets[ACCEPT_PACKET]));
++    encpkt = krad_packet_encode(packets[ACCEPT_PACKET]);
++    noerror(krad_packet_decode_request(ctx, "foo", encpkt, NULL, NULL,
++                                       &dupreq, &decreq));
++    krad_packet_free(decreq);
+ 
+     password = string2data("reject");
+     noerror(make_packet(ctx, &username, &password, &packets[REJECT_PACKET]));
++    encpkt = krad_packet_encode(packets[REJECT_PACKET]);
++    noerror(krad_packet_decode_request(ctx, "foo", encpkt, NULL, NULL,
++                                       &dupreq, &decreq));
++    krad_packet_free(decreq);
+ 
+     memset(&hints, 0, sizeof(hints));
+     hints.ai_family = AF_INET;
+diff --git a/src/tests/t_otp.py b/src/tests/t_otp.py
+index c3b820a411..dd5cdc5c26 100755
+--- a/src/tests/t_otp.py
++++ b/src/tests/t_otp.py
+@@ -49,6 +49,7 @@ ATTRIBUTE    User-Name    1    string
+ ATTRIBUTE    User-Password   2    octets
+ ATTRIBUTE    Service-Type    6    integer
+ ATTRIBUTE    NAS-Identifier  32    string
++ATTRIBUTE    Message-Authenticator 80 octets
+ '''
+ 
+ class RadiusDaemon(Process):
+@@ -97,6 +98,8 @@ class RadiusDaemon(Process):
+             reply.code = packet.AccessReject
+             replyq['reply'] = False
+ 
++        reply.add_message_authenticator()
++
+         outq.put(replyq)
+         if addr is None:
+             sock.send(reply.ReplyPacket())
+-- 
+2.46.0
+
diff --git a/0026-PKINIT-ECDH-support.patch b/0026-PKINIT-ECDH-support.patch
new file mode 100644
index 0000000..14c86be
--- /dev/null
+++ b/0026-PKINIT-ECDH-support.patch
@@ -0,0 +1,1027 @@
+From 5af8bb21de29e3b9a0d5b2001fab71ea102f7990 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 12 May 2023 15:38:46 -0400
+Subject: [PATCH] PKINIT ECDH support
+
+Add support for elliptic curve key exchange to PKINIT (RFC 5349
+section 4).  Extend pkinit_dh_min_bits to allow the string values
+"P-256", "P-384", and "P-521", using rough finite-field strength
+equivalents to rank them relative to the Oakley Diffie-Hellman groups.
+
+When processing TD-DH-PARAMETERS on the client, only accept the three
+Oakley groups or the three supported elliptic curve groups.
+Previously we accepted any Diffie-Hellman parameters that passed
+EVP_PKEY_param_check()/DH_check() and had equal or better bit strength
+to the original proposal.
+
+ticket: 9095 (new)
+(cherry picked from commit 0f870b1bcad960fd5319a3f97aafd7f4a289e2fb)
+---
+ doc/admin/conf_files/kdc_conf.rst             |   7 +-
+ doc/admin/conf_files/krb5_conf.rst            |   7 +-
+ src/plugins/preauth/pkinit/pkinit.h           |   6 +-
+ src/plugins/preauth/pkinit/pkinit_clnt.c      |  17 +-
+ src/plugins/preauth/pkinit/pkinit_constants.c |  27 +
+ src/plugins/preauth/pkinit/pkinit_crypto.h    |   7 +
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 470 ++++++++++++------
+ .../preauth/pkinit/pkinit_crypto_openssl.h    |   4 +-
+ src/plugins/preauth/pkinit/pkinit_lib.c       |   3 -
+ src/plugins/preauth/pkinit/pkinit_srv.c       |  17 +-
+ src/plugins/preauth/pkinit/pkinit_trace.h     |  11 +
+ src/tests/t_pkinit.py                         |  12 +
+ 12 files changed, 405 insertions(+), 183 deletions(-)
+
+diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst
+index 846c58ed82..fb0593f281 100644
+--- a/doc/admin/conf_files/kdc_conf.rst
++++ b/doc/admin/conf_files/kdc_conf.rst
+@@ -768,8 +768,11 @@ For information about the syntax of some of these options, see
+     be specified multiple times.
+ 
+ **pkinit_dh_min_bits**
+-    Specifies the minimum number of bits the KDC is willing to accept
+-    for a client's Diffie-Hellman key.  The default is 2048.
++    Specifies the minimum strength of Diffie-Hellman group the KDC is
++    willing to accept for key exchange.  Valid values in order of
++    increasing strength are 1024, 2048, P-256, 4096, P-384, and P-521.
++    The default is 2048.  (P-256, P-384, and P-521 are new in release
++    1.22.)
+ 
+ **pkinit_allow_upn**
+     Specifies that the KDC is willing to accept client certificates
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index b7284c47df..dca52e1426 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -1131,9 +1131,10 @@ PKINIT krb5.conf options
+         option is not recommended.
+ 
+ **pkinit_dh_min_bits**
+-    Specifies the size of the Diffie-Hellman key the client will
+-    attempt to use.  The acceptable values are 1024, 2048, and 4096.
+-    The default is 2048.
++    Specifies the group of the Diffie-Hellman key the client will
++    attempt to use.  The acceptable values are 1024, 2048, P-256,
++    4096, P-384, and P-521.  The default is 2048.  (P-256, P-384, and
++    P-521 are new in release 1.22.)
+ 
+ **pkinit_identities**
+     Specifies the location(s) to be used to find the user's X.509
+diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
+index 5ab0f4bc28..7ba7155bb4 100644
+--- a/src/plugins/preauth/pkinit/pkinit.h
++++ b/src/plugins/preauth/pkinit/pkinit.h
+@@ -59,6 +59,10 @@
+ 
+ #define PKINIT_DEFAULT_DH_MIN_BITS  2048
+ #define PKINIT_DH_MIN_CONFIG_BITS   1024
++/* Rough finite-field bit strength equivalents for the elliptic curve groups */
++#define PKINIT_DH_P256_BITS         3072
++#define PKINIT_DH_P384_BITS         7680
++#define PKINIT_DH_P521_BITS         15360
+ 
+ #define KRB5_CONF_KDCDEFAULTS                   "kdcdefaults"
+ #define KRB5_CONF_LIBDEFAULTS                   "libdefaults"
+@@ -101,8 +105,6 @@ static inline void pkiDebug (const char *fmt, ...) { }
+ #define OCTETDATA_TO_KRB5DATA(octd, k5d) \
+     (k5d)->length = (octd)->length; (k5d)->data = (char *)(octd)->data;
+ 
+-extern const krb5_data dh_oid;
+-
+ /*
+  * notes about crypto contexts:
+  *
+diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
+index 54e7537600..b08022a214 100644
+--- a/src/plugins/preauth/pkinit/pkinit_clnt.c
++++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
+@@ -681,7 +681,7 @@ pkinit_client_profile(krb5_context context,
+                       const krb5_data *realm)
+ {
+     const char *configured_identity;
+-    char *eku_string = NULL;
++    char *eku_string = NULL, *minbits = NULL;
+ 
+     pkiDebug("pkinit_client_profile %p %p %p %p\n",
+              context, plgctx, reqctx, realm);
+@@ -690,17 +690,10 @@ pkinit_client_profile(krb5_context context,
+                               KRB5_CONF_PKINIT_REQUIRE_CRL_CHECKING,
+                               reqctx->opts->require_crl_checking,
+                               &reqctx->opts->require_crl_checking);
+-    pkinit_libdefault_integer(context, realm,
+-                              KRB5_CONF_PKINIT_DH_MIN_BITS,
+-                              reqctx->opts->dh_size,
+-                              &reqctx->opts->dh_size);
+-    if (reqctx->opts->dh_size != 1024 && reqctx->opts->dh_size != 2048
+-        && reqctx->opts->dh_size != 4096) {
+-        pkiDebug("%s: invalid value (%d) for pkinit_dh_min_bits, "
+-                 "using default value (%d) instead\n", __FUNCTION__,
+-                 reqctx->opts->dh_size, PKINIT_DEFAULT_DH_MIN_BITS);
+-        reqctx->opts->dh_size = PKINIT_DEFAULT_DH_MIN_BITS;
+-    }
++    pkinit_libdefault_string(context, realm, KRB5_CONF_PKINIT_DH_MIN_BITS,
++                             &minbits);
++    reqctx->opts->dh_size = parse_dh_min_bits(context, minbits);
++    free(minbits);
+     pkinit_libdefault_string(context, realm,
+                              KRB5_CONF_PKINIT_EKU_CHECKING,
+                              &eku_string);
+diff --git a/src/plugins/preauth/pkinit/pkinit_constants.c b/src/plugins/preauth/pkinit/pkinit_constants.c
+index 1da482e0b4..10f8688ec2 100644
+--- a/src/plugins/preauth/pkinit/pkinit_constants.c
++++ b/src/plugins/preauth/pkinit/pkinit_constants.c
+@@ -320,6 +320,33 @@ static const uint8_t o4096[] = {
+     0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+ };
+ 
++/* Named curve prime256v1 (1.2.840.10045.3.1.7) as parameters for RFC 3279
++ * section 2.3.5 id-ecPublicKey */
++static const uint8_t p256[] = {
++    0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07
++};
++
++/* Named curve secp384r1 (1.3.132.0.34, from RFC 5480 section 2.1.1.1) as
++ * parameters for RFC 3279 section 2.3.5 id-ecPublicKey */
++static const uint8_t p384[] = {
++    0x06, 0x05, 0x2B, 0x81, 0x04, 0x00, 0x22
++};
++
++/* Named curve secp521r1 (1.3.132.0.35, from RFC 5480 section 2.1.1.1) as
++ * parameters for RFC 3279 section 2.3.5 id-ecPublicKey */
++static const uint8_t p521[] = {
++    0x06, 0x05, 0x2B, 0x81, 0x04, 0x00, 0x23
++};
++
+ const krb5_data oakley_1024 = { KV5M_DATA, sizeof(o1024), (char *)o1024 };
+ const krb5_data oakley_2048 = { KV5M_DATA, sizeof(o2048), (char *)o2048 };
+ const krb5_data oakley_4096 = { KV5M_DATA, sizeof(o4096), (char *)o4096 };
++const krb5_data ec_p256 = { KV5M_DATA, sizeof(p256), (char *)p256 };
++const krb5_data ec_p384 = { KV5M_DATA, sizeof(p384), (char *)p384 };
++const krb5_data ec_p521 = { KV5M_DATA, sizeof(p521), (char *)p521 };
++
++/* RFC 3279 section 2.3.3 dhpublicnumber (1.2.840.10046.2.1) */
++const krb5_data dh_oid = { 0, 7, "\x2A\x86\x48\xce\x3e\x02\x01" };
++
++/* RFC 3279 section 2.3.5 id-ecPublicKey (1.2.840.10045.2.1) */
++const krb5_data ec_oid = { 0, 7, "\x2A\x86\x48\xCE\x3D\x02\x01" };
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
+index 04199b45a4..fd876e4850 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto.h
++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
+@@ -568,6 +568,11 @@ extern const krb5_data sha512_id;
+ extern const krb5_data oakley_1024;
+ extern const krb5_data oakley_2048;
+ extern const krb5_data oakley_4096;
++extern const krb5_data ec_p256;
++extern const krb5_data ec_p384;
++extern const krb5_data ec_p521;
++extern const krb5_data dh_oid;
++extern const krb5_data ec_oid;
+ 
+ /**
+  * An ordered set of OIDs, stored as krb5_data, of KDF algorithms
+@@ -590,4 +595,6 @@ crypto_req_cert_matching_data(krb5_context context,
+ 			      pkinit_req_crypto_context reqctx,
+ 			      pkinit_cert_matching_data **md_out);
+ 
++int parse_dh_min_bits(krb5_context context, const char *str);
++
+ #endif	/* _PKINIT_CRYPTO_H */
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 26fa9184b3..f6d494bd11 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -181,6 +181,15 @@ compat_get0_DH(const EVP_PKEY *pkey)
+ 
+ }
+ 
++#define EVP_PKEY_get0_EC_KEY compat_get0_EC
++static EC_KEY *
++compat_get0_EC(const EVP_PKEY *pkey)
++{
++    if (pkey->type != EVP_PKEY_EC)
++        return NULL;
++    return pkey->pkey.ec;
++}
++
+ /* Return true if the cert c includes a key usage which doesn't include u.
+  * Define using direct member access for pre-1.1. */
+ #define ku_reject(c, u)                                                 \
+@@ -260,37 +269,11 @@ decode_bn_der(const uint8_t *der, size_t len)
+     return bn;
+ }
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+-static int
+-params_valid(EVP_PKEY *params)
+-{
+-    EVP_PKEY_CTX *ctx;
+-    int result;
+-
+-    ctx = EVP_PKEY_CTX_new(params, NULL);
+-    if (ctx == NULL)
+-        return 0;
+-    result = EVP_PKEY_param_check(ctx);
+-    EVP_PKEY_CTX_free(ctx);
+-    return result == 1;
+-}
+-#else
+-static int
+-params_valid(EVP_PKEY *params)
+-{
+-    DH *dh;
+-    int codes;
+-
+-    dh = EVP_PKEY_get0_DH(params);
+-    return (dh == NULL) ? 0 : (DH_check(dh, &codes) && codes == 0);
+-}
+-#endif
+-
+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ 
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ static EVP_PKEY *
+-decode_dh_params(const krb5_data *params_der)
++decode_params(const krb5_data *params_der, const char *type)
+ {
+     EVP_PKEY *pkey = NULL;
+     const uint8_t *inptr = (uint8_t *)params_der->data;
+@@ -298,7 +281,7 @@ decode_dh_params(const krb5_data *params_der)
+     OSSL_DECODER_CTX *dctx;
+     int ok;
+ 
+-    dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", "type-specific", "DHX",
++    dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "DER", "type-specific", type,
+                                          EVP_PKEY_KEY_PARAMETERS, NULL, NULL);
+     if (dctx == NULL)
+         return NULL;
+@@ -307,7 +290,15 @@ decode_dh_params(const krb5_data *params_der)
+     OSSL_DECODER_CTX_free(dctx);
+     return ok ? pkey : NULL;
+ }
++
++static EVP_PKEY *
++decode_dh_params(const krb5_data *params_der)
++{
++    return decode_params(params_der, "DHX");
++}
++
+ #else
++
+ static EVP_PKEY *
+ decode_dh_params(const krb5_data *params_der)
+ {
+@@ -320,6 +311,7 @@ decode_dh_params(const krb5_data *params_der)
+     DH_free(dh);
+     return pkey;
+ }
++
+ #endif
+ 
+ static krb5_error_code
+@@ -520,6 +512,39 @@ cleanup:
+ 
+ #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++
++static EVP_PKEY *
++decode_ec_params(const krb5_data *params_der)
++{
++    return decode_params(params_der, "EC");
++}
++
++#else /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++
++static EVP_PKEY *
++decode_ec_params(const krb5_data *params_der)
++{
++    const uint8_t *p = (uint8_t *)params_der->data;
++    EC_KEY *eckey;
++    EVP_PKEY *pkey;
++
++    eckey = d2i_ECParameters(NULL, &p, params_der->length);
++    if (eckey == NULL)
++        return NULL;
++    pkey = EVP_PKEY_new();
++    if (pkey != NULL) {
++        if (!EVP_PKEY_set1_EC_KEY(pkey, eckey)) {
++            EVP_PKEY_free(pkey);
++            pkey = NULL;
++        }
++    }
++    EC_KEY_free(eckey);
++    return pkey;
++}
++
++#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
++
+ /* Attempt to specify padded Diffie-Hellman result derivation.  Don't error out
+  * if this fails since we also detect short results and adjust them. */
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+@@ -551,7 +576,8 @@ dh_result(EVP_PKEY *pkey, EVP_PKEY *peer,
+     EVP_PKEY_CTX *derive_ctx = NULL;
+     int ok = 0;
+     uint8_t *buf = NULL;
+-    size_t len, dh_size = EVP_PKEY_get_size(pkey);
++    size_t len, result_size;
++    krb5_boolean ecc = (EVP_PKEY_id(pkey) == EVP_PKEY_EC);
+ 
+     *result_out = NULL;
+     *len_out = 0;
+@@ -561,24 +587,39 @@ dh_result(EVP_PKEY *pkey, EVP_PKEY *peer,
+         goto cleanup;
+     if (EVP_PKEY_derive_init(derive_ctx) <= 0)
+         goto cleanup;
+-    set_padded_derivation(derive_ctx);
++    if (!ecc)
++        set_padded_derivation(derive_ctx);
+     if (EVP_PKEY_derive_set_peer(derive_ctx, peer) <= 0)
+         goto cleanup;
+ 
+-    buf = malloc(dh_size);
++    if (ecc) {
++        if (EVP_PKEY_derive(derive_ctx, NULL, &result_size) <= 0)
++            goto cleanup;
++    } else {
++        /*
++         * For finite-field Diffie-Hellman we must ensure that the result
++         * matches the key size (normally through padded derivation, but that
++         * isn't supported by OpenSSL 1.0 so we must check).
++         */
++        result_size = EVP_PKEY_get_size(pkey);
++    }
++    buf = malloc(result_size);
+     if (buf == NULL)
+         goto cleanup;
+-    len = dh_size;
++    len = result_size;
+     if (EVP_PKEY_derive(derive_ctx, buf, &len) <= 0)
+         goto cleanup;
+-    if (len < dh_size) {        /* only possible without padded derivation */
+-        memmove(buf + (dh_size - len), buf, len);
+-        memset(buf, 0, dh_size - len);
++
++    /* If we couldn't specify padded derivation for finite-field DH we may need
++     * to fix up the result by right-shifting it within the buffer. */
++    if (len < result_size) {
++        memmove(buf + (result_size - len), buf, len);
++        memset(buf, 0, result_size - len);
+     }
+ 
+     ok = 1;
+     *result_out = buf;
+-    *len_out = dh_size;
++    *len_out = result_size;
+     buf = NULL;
+ 
+ cleanup:
+@@ -592,13 +633,21 @@ static int
+ dh_pubkey_der(EVP_PKEY *pkey, uint8_t **pubkey_out, unsigned int *len_out)
+ {
+     BIGNUM *pubkey_bn = NULL;
+-    int len, ok;
+-    uint8_t *buf;
+-
+-    if (!EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pubkey_bn))
+-        return 0;
+-    ok = encode_bn_der(pubkey_bn, &buf, &len);
+-    BN_free(pubkey_bn);
++    int len, ok = 0;
++    uint8_t *buf, *outptr;
++
++    if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
++        len = i2d_PublicKey(pkey, NULL);
++        if (len > 0 && (outptr = buf = malloc(len)) != NULL) {
++            (void)i2d_PublicKey(pkey, &outptr);
++            ok = 1;
++        }
++    } else {
++        if (!EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pubkey_bn))
++            return 0;
++        ok = encode_bn_der(pubkey_bn, &buf, &len);
++        BN_free(pubkey_bn);
++    }
+     if (ok) {
+         *pubkey_out = buf;
+         *len_out = len;
+@@ -610,19 +659,33 @@ static int
+ dh_pubkey_der(EVP_PKEY *pkey, uint8_t **pubkey_out, unsigned int *len_out)
+ {
+     const DH *dh;
++    EC_KEY *eckey;              /* can be const when OpenSSL 1.0 dropped */
+     const BIGNUM *pubkey_bn;
+-    uint8_t *buf;
++    uint8_t *buf, *outptr;
+     int len;
+ 
+     dh = EVP_PKEY_get0_DH(pkey);
+-    if (dh == NULL)
+-        return 0;
+-    DH_get0_key(dh, &pubkey_bn, NULL);
+-    if (!encode_bn_der(pubkey_bn, &buf, &len))
+-        return 0;
+-    *pubkey_out = buf;
+-    *len_out = len;
+-    return 1;
++    if (dh != NULL) {
++        DH_get0_key(dh, &pubkey_bn, NULL);
++        if (!encode_bn_der(pubkey_bn, &buf, &len))
++            return 0;
++        *pubkey_out = buf;
++        *len_out = len;
++        return 1;
++    }
++
++    eckey = EVP_PKEY_get0_EC_KEY(pkey);
++    if (eckey != NULL) {
++        len = i2o_ECPublicKey(eckey, NULL);
++        if (len > 0 && (outptr = buf = malloc(len)) != NULL) {
++            (void)i2o_ECPublicKey(eckey, &outptr);
++            *pubkey_out = buf;
++            *len_out = len;
++            return 1;
++        }
++    }
++
++    return 0;
+ }
+ #endif
+ 
+@@ -686,17 +749,23 @@ compose_dh_pkey(EVP_PKEY *params, const uint8_t *pubkey_der, size_t der_len)
+     if (pkey == NULL)
+         goto cleanup;
+ 
+-    pubkey_bn = decode_bn_der(pubkey_der, der_len);
+-    if (pubkey_bn == NULL)
+-        goto cleanup;
+-    binlen = EVP_PKEY_get_size(pkey);
+-    pubkey_bin = malloc(binlen);
+-    if (pubkey_bin == NULL)
+-        goto cleanup;
+-    if (BN_bn2binpad(pubkey_bn, pubkey_bin, binlen) != binlen)
+-        goto cleanup;
+-    if (EVP_PKEY_set1_encoded_public_key(pkey, pubkey_bin, binlen) != 1)
+-        goto cleanup;
++    if (EVP_PKEY_id(params) == EVP_PKEY_EC) {
++        if (d2i_PublicKey(EVP_PKEY_id(params), &pkey, &pubkey_der,
++                          der_len) == NULL)
++            goto cleanup;
++    } else {
++        pubkey_bn = decode_bn_der(pubkey_der, der_len);
++        if (pubkey_bn == NULL)
++            goto cleanup;
++        binlen = EVP_PKEY_get_size(pkey);
++        pubkey_bin = malloc(binlen);
++        if (pubkey_bin == NULL)
++            goto cleanup;
++        if (BN_bn2binpad(pubkey_bn, pubkey_bin, binlen) != binlen)
++            goto cleanup;
++        if (EVP_PKEY_set1_encoded_public_key(pkey, pubkey_bin, binlen) != 1)
++            goto cleanup;
++    }
+ 
+     pkey_ret = pkey;
+     pkey = NULL;
+@@ -741,29 +810,60 @@ static EVP_PKEY *
+ compose_dh_pkey(EVP_PKEY *params, const uint8_t *pubkey_der, size_t der_len)
+ {
+     DH *dhparams, *dh = NULL;
+-    EVP_PKEY *pkey = NULL;
++    EVP_PKEY *pkey = NULL, *pkey_ret = NULL;
+     BIGNUM *pubkey_bn = NULL;
++    EC_KEY *params_eckey, *eckey = NULL;
++    const EC_GROUP *group;
++
++    if (EVP_PKEY_id(params) == EVP_PKEY_EC) {
++        /* We would like to use EVP_PKEY_copy_parameters() and d2i_PublicKey(),
++         * but the latter is broken in OpenSSL 1.1.0-1.1.1a for EC keys. */
++        params_eckey = EVP_PKEY_get0_EC_KEY(params);
++        if (params_eckey == NULL)
++            goto cleanup;
++        group = EC_KEY_get0_group(params_eckey);
++        eckey = EC_KEY_new();
++        if (eckey == NULL)
++            goto cleanup;
++        if (!EC_KEY_set_group(eckey, group))
++            goto cleanup;
++        if (o2i_ECPublicKey(&eckey, &pubkey_der, der_len) == NULL)
++            goto cleanup;
++        pkey = EVP_PKEY_new();
++        if (pkey == NULL)
++            return NULL;
++        if (!EVP_PKEY_assign(pkey, EVP_PKEY_EC, eckey)) {
++            EVP_PKEY_free(pkey);
++            return NULL;
++        }
++        eckey = NULL;
++    } else {
++        pubkey_bn = decode_bn_der(pubkey_der, der_len);
++        if (pubkey_bn == NULL)
++            goto cleanup;
+ 
+-    pubkey_bn = decode_bn_der(pubkey_der, der_len);
+-    if (pubkey_bn == NULL)
+-        goto cleanup;
++        dhparams = EVP_PKEY_get0_DH(params);
++        if (dhparams == NULL)
++            goto cleanup;
++        dh = dup_dh_params(dhparams);
++        if (dh == NULL)
++            goto cleanup;
++        if (!DH_set0_key(dh, pubkey_bn, NULL))
++            goto cleanup;
++        pubkey_bn = NULL;
+ 
+-    dhparams = EVP_PKEY_get0_DH(params);
+-    if (dhparams == NULL)
+-        goto cleanup;
+-    dh = dup_dh_params(dhparams);
+-    if (dh == NULL)
+-        goto cleanup;
+-    if (!DH_set0_key(dh, pubkey_bn, NULL))
+-        goto cleanup;
+-    pubkey_bn = NULL;
++        pkey = dh_to_pkey(&dh);
++    }
+ 
+-    pkey = dh_to_pkey(&dh);
++    pkey_ret = pkey;
++    pkey = NULL;
+ 
+ cleanup:
+     BN_free(pubkey_bn);
+     DH_free(dh);
+-    return pkey;
++    EC_KEY_free(eckey);
++    EVP_PKEY_free(pkey);
++    return pkey_ret;
+ }
+ 
+ #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+@@ -1032,7 +1132,6 @@ pkinit_init_req_crypto(pkinit_req_crypto_context *cryptoctx)
+     memset(ctx, 0, sizeof(*ctx));
+ 
+     ctx->client_pkey = NULL;
+-    ctx->received_params = NULL;
+     ctx->received_cert = NULL;
+ 
+     *cryptoctx = ctx;
+@@ -1054,7 +1153,6 @@ pkinit_fini_req_crypto(pkinit_req_crypto_context req_cryptoctx)
+ 
+     pkiDebug("%s: freeing ctx at %p\n", __FUNCTION__, req_cryptoctx);
+     EVP_PKEY_free(req_cryptoctx->client_pkey);
+-    EVP_PKEY_free(req_cryptoctx->received_params);
+     X509_free(req_cryptoctx->received_cert);
+ 
+     free(req_cryptoctx);
+@@ -1258,9 +1356,9 @@ pkinit_fini_pkinit_oids(pkinit_plg_crypto_context ctx)
+ 
+ static int
+ try_import_group(krb5_context context, const krb5_data *params,
+-                 const char *name, EVP_PKEY **pkey_out)
++                 const char *name, krb5_boolean ec, EVP_PKEY **pkey_out)
+ {
+-    *pkey_out = decode_dh_params(params);
++    *pkey_out = ec ? decode_ec_params(params) : decode_dh_params(params);
+     if (*pkey_out == NULL)
+         TRACE_PKINIT_DH_GROUP_UNAVAILABLE(context, name);
+     return (*pkey_out != NULL) ? 1 : 0;
+@@ -1271,12 +1369,15 @@ pkinit_init_dh_params(krb5_context context, pkinit_plg_crypto_context plgctx)
+ {
+     int n = 0;
+ 
+-    n += try_import_group(context, &oakley_1024, "MODP 2 (1024-bit)",
++    n += try_import_group(context, &oakley_1024, "MODP 2 (1024-bit)", FALSE,
+                           &plgctx->dh_1024);
+-    n += try_import_group(context, &oakley_2048, "MODP 14 (2048-bit)",
++    n += try_import_group(context, &oakley_2048, "MODP 14 (2048-bit)", FALSE,
+                           &plgctx->dh_2048);
+-    n += try_import_group(context, &oakley_4096, "MODP 16 (4096-bit)",
++    n += try_import_group(context, &oakley_4096, "MODP 16 (4096-bit)", FALSE,
+                           &plgctx->dh_4096);
++    n += try_import_group(context, &ec_p256, "P-256", TRUE, &plgctx->ec_p256);
++    n += try_import_group(context, &ec_p384, "P-384", TRUE, &plgctx->ec_p384);
++    n += try_import_group(context, &ec_p521, "P-521", TRUE, &plgctx->ec_p521);
+ 
+     if (n == 0) {
+         pkinit_fini_dh_params(plgctx);
+@@ -1294,7 +1395,11 @@ pkinit_fini_dh_params(pkinit_plg_crypto_context plgctx)
+     EVP_PKEY_free(plgctx->dh_1024);
+     EVP_PKEY_free(plgctx->dh_2048);
+     EVP_PKEY_free(plgctx->dh_4096);
++    EVP_PKEY_free(plgctx->ec_p256);
++    EVP_PKEY_free(plgctx->ec_p384);
++    EVP_PKEY_free(plgctx->ec_p521);
+     plgctx->dh_1024 = plgctx->dh_2048 = plgctx->dh_4096 = NULL;
++    plgctx->ec_p256 = plgctx->ec_p384 = plgctx->ec_p521 = NULL;
+ }
+ 
+ static krb5_error_code
+@@ -2711,6 +2816,62 @@ cleanup:
+     return ret;
+ }
+ 
++/* Return the equivalent finite-field bit strength of pkey if it matches a
++ * well-known group, or -1 if it doesn't. */
++static int
++check_dh_wellknown(pkinit_plg_crypto_context cryptoctx, EVP_PKEY *pkey)
++{
++    int nbits = EVP_PKEY_get_bits(pkey);
++
++    if (nbits == 1024 && EVP_PKEY_parameters_eq(cryptoctx->dh_1024, pkey) == 1)
++        return nbits;
++    if (nbits == 2048 && EVP_PKEY_parameters_eq(cryptoctx->dh_2048, pkey) == 1)
++        return nbits;
++    if (nbits == 4096 && EVP_PKEY_parameters_eq(cryptoctx->dh_4096, pkey) == 1)
++        return nbits;
++    if (nbits == 256 && EVP_PKEY_parameters_eq(cryptoctx->ec_p256, pkey) == 1)
++        return PKINIT_DH_P256_BITS;
++    if (nbits == 384 && EVP_PKEY_parameters_eq(cryptoctx->ec_p384, pkey) == 1)
++        return PKINIT_DH_P384_BITS;
++    if (nbits == 521 && EVP_PKEY_parameters_eq(cryptoctx->ec_p521, pkey) == 1)
++        return PKINIT_DH_P521_BITS;
++    return -1;
++}
++
++/* Return a short description of the Diffie-Hellman group with the given
++ * finite-field group size equivalent. */
++static const char *
++group_desc(int dh_bits)
++{
++    switch (dh_bits) {
++    case PKINIT_DH_P256_BITS: return "P-256";
++    case PKINIT_DH_P384_BITS: return "P-384";
++    case PKINIT_DH_P521_BITS: return "P-521";
++    case 1024: return "1024-bit DH";
++    case 2048: return "2048-bit DH";
++    case 4096: return "4096-bit DH";
++    }
++    return "(unknown)";
++}
++
++static EVP_PKEY *
++choose_dh_group(pkinit_plg_crypto_context plg_cryptoctx, int dh_size)
++{
++    if (dh_size == 1024)
++        return plg_cryptoctx->dh_1024;
++    if (dh_size == 2048)
++        return plg_cryptoctx->dh_2048;
++    if (dh_size == 4096)
++        return plg_cryptoctx->dh_4096;
++    if (dh_size == PKINIT_DH_P256_BITS)
++        return plg_cryptoctx->ec_p256;
++    if (dh_size == PKINIT_DH_P384_BITS)
++        return plg_cryptoctx->ec_p384;
++    if (dh_size == PKINIT_DH_P521_BITS)
++        return plg_cryptoctx->ec_p521;
++    return NULL;
++}
++
+ krb5_error_code
+ client_create_dh(krb5_context context,
+                  pkinit_plg_crypto_context plg_cryptoctx,
+@@ -2723,16 +2884,10 @@ client_create_dh(krb5_context context,
+ 
+     *spki_out = empty_data();
+ 
+-    if (cryptoctx->received_params != NULL)
+-        params = cryptoctx->received_params;
+-    else if (plg_cryptoctx->dh_1024 != NULL && dh_size == 1024)
+-        params = plg_cryptoctx->dh_1024;
+-    else if (plg_cryptoctx->dh_2048 != NULL && dh_size == 2048)
+-        params = plg_cryptoctx->dh_2048;
+-    else if (plg_cryptoctx->dh_4096 != NULL && dh_size == 4096)
+-        params = plg_cryptoctx->dh_4096;
+-    else
++    params = choose_dh_group(plg_cryptoctx, dh_size);
++    if (params == NULL)
+         goto cleanup;
++    TRACE_PKINIT_DH_PROPOSING_GROUP(context, group_desc(dh_size));
+ 
+     pkey = generate_dh_pkey(params);
+     if (pkey == NULL)
+@@ -2772,8 +2927,11 @@ client_process_dh(krb5_context context,
+     server_pkey = compose_dh_pkey(cryptoctx->client_pkey,
+                                   subjectPublicKey_data,
+                                   subjectPublicKey_length);
+-    if (server_pkey == NULL)
++    if (server_pkey == NULL) {
++        retval = KRB5_PREAUTH_FAILED;
++        k5_setmsg(context, retval, _("Cannot compose PKINIT KDC public key"));
+         goto cleanup;
++    }
+ 
+     if (!dh_result(cryptoctx->client_pkey, server_pkey,
+                    &client_key, &client_key_len))
+@@ -2797,20 +2955,6 @@ cleanup:
+     return retval;
+ }
+ 
+-/* Return 1 if dh is a permitted well-known group, otherwise return 0. */
+-static int
+-check_dh_wellknown(pkinit_plg_crypto_context cryptoctx, EVP_PKEY *pkey,
+-                   int nbits)
+-{
+-    if (nbits == 1024)
+-        return EVP_PKEY_parameters_eq(cryptoctx->dh_1024, pkey) == 1;
+-    else if (nbits == 2048)
+-        return EVP_PKEY_parameters_eq(cryptoctx->dh_2048, pkey) == 1;
+-    else if (nbits == 4096)
+-        return EVP_PKEY_parameters_eq(cryptoctx->dh_4096, pkey) == 1;
+-    return 0;
+-}
+-
+ krb5_error_code
+ server_check_dh(krb5_context context,
+                 pkinit_plg_crypto_context cryptoctx,
+@@ -2820,7 +2964,7 @@ server_check_dh(krb5_context context,
+                 int minbits)
+ {
+     EVP_PKEY *client_pkey = NULL;
+-    int dh_prime_bits;
++    int dh_bits;
+     krb5_error_code retval = KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED;
+ 
+     client_pkey = decode_spki(client_spki);
+@@ -2829,16 +2973,15 @@ server_check_dh(krb5_context context,
+         goto cleanup;
+     }
+ 
+-    /* KDC SHOULD check to see if the key parameters satisfy its policy */
+-    dh_prime_bits = EVP_PKEY_get_bits(client_pkey);
+-    if (minbits && dh_prime_bits < minbits) {
+-        pkiDebug("client sent dh params with %d bits, we require %d\n",
+-                 dh_prime_bits, minbits);
++    dh_bits = check_dh_wellknown(cryptoctx, client_pkey);
++    if (dh_bits == -1 || dh_bits < minbits) {
++        TRACE_PKINIT_DH_REJECTING_GROUP(context, group_desc(dh_bits),
++                                        group_desc(minbits));
+         goto cleanup;
+     }
++    TRACE_PKINIT_DH_RECEIVED_GROUP(context, group_desc(dh_bits));
+ 
+-    if (check_dh_wellknown(cryptoctx, client_pkey, dh_prime_bits))
+-        retval = 0;
++    retval = 0;
+ 
+ cleanup:
+     if (retval == 0)
+@@ -3023,9 +3166,20 @@ pkinit_create_td_dh_parameters(krb5_context context,
+     krb5_algorithm_identifier alg_1024 = { dh_oid, oakley_1024 };
+     krb5_algorithm_identifier alg_2048 = { dh_oid, oakley_2048 };
+     krb5_algorithm_identifier alg_4096 = { dh_oid, oakley_4096 };
+-    krb5_algorithm_identifier *alglist[4];
++    krb5_algorithm_identifier alg_p256 = { ec_oid, ec_p256 };
++    krb5_algorithm_identifier alg_p384 = { ec_oid, ec_p384 };
++    krb5_algorithm_identifier alg_p521 = { ec_oid, ec_p521 };
++    krb5_algorithm_identifier *alglist[7];
+ 
+     i = 0;
++    if (plg_cryptoctx->ec_p256 != NULL &&
++        opts->dh_min_bits <= PKINIT_DH_P256_BITS)
++        alglist[i++] = &alg_p256;
++    if (plg_cryptoctx->ec_p384 != NULL &&
++        opts->dh_min_bits <= PKINIT_DH_P384_BITS)
++        alglist[i++] = &alg_p384;
++    if (plg_cryptoctx->ec_p521 != NULL)
++        alglist[i++] = &alg_p521;
+     if (plg_cryptoctx->dh_2048 != NULL && opts->dh_min_bits <= 2048)
+         alglist[i++] = &alg_2048;
+     if (plg_cryptoctx->dh_4096 != NULL && opts->dh_min_bits <= 4096)
+@@ -3110,13 +3264,10 @@ pkinit_process_td_dh_params(krb5_context context,
+ {
+     krb5_error_code retval = KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED;
+     EVP_PKEY *params = NULL;
+-    int i, dh_prime_bits, old_dh_size;
++    int i, dh_bits, old_dh_size;
+ 
+     pkiDebug("dh parameters\n");
+ 
+-    EVP_PKEY_free(req_cryptoctx->received_params);
+-    req_cryptoctx->received_params = NULL;
+-
+     old_dh_size = *new_dh_size;
+ 
+     for (i = 0; algId[i] != NULL; i++) {
+@@ -3124,36 +3275,22 @@ pkinit_process_td_dh_params(krb5_context context,
+         EVP_PKEY_free(params);
+         params = NULL;
+ 
+-        /* Skip any parameters for algorithms other than DH. */
+-        if (algId[i]->algorithm.length != dh_oid.length ||
+-            memcmp(algId[i]->algorithm.data, dh_oid.data, dh_oid.length))
+-            continue;
+-
+-        params = decode_dh_params(&algId[i]->parameters);
++        if (data_eq(algId[i]->algorithm, dh_oid))
++            params = decode_dh_params(&algId[i]->parameters);
++        else if (data_eq(algId[i]->algorithm, ec_oid))
++            params = decode_ec_params(&algId[i]->parameters);
+         if (params == NULL)
+             continue;
+-        dh_prime_bits = EVP_PKEY_get_bits(params);
+-        /* Skip any parameters shorter than the previous size. */
+-        if (dh_prime_bits < old_dh_size)
+-            continue;
+-        pkiDebug("client sent %d DH bits server prefers %d DH bits\n",
+-                 *new_dh_size, dh_prime_bits);
+ 
+-        /* If this is one of our well-known groups, just save the new size; we
+-         * will use our own copy of the parameters. */
+-        if (check_dh_wellknown(cryptoctx, params, dh_prime_bits)) {
+-            *new_dh_size = dh_prime_bits;
+-            retval = 0;
+-            goto cleanup;
+-        }
++        dh_bits = check_dh_wellknown(cryptoctx, params);
++        /* Skip any parameters shorter than the previous size or unknown. */
++        if (dh_bits == -1 || dh_bits < old_dh_size)
++            continue;
++        TRACE_PKINIT_DH_NEGOTIATED_GROUP(context, group_desc(dh_bits));
+ 
+-        /* If the parameters aren't well-known but check out, save them. */
+-        if (params_valid(params)) {
+-            req_cryptoctx->received_params = params;
+-            params = NULL;
+-            retval = 0;
+-            goto cleanup;
+-        }
++        *new_dh_size = dh_bits;
++        retval = 0;
++        goto cleanup;
+     }
+ 
+ cleanup:
+@@ -5329,3 +5466,40 @@ crypto_req_cert_matching_data(krb5_context context,
+     return get_matching_data(context, plgctx, reqctx, reqctx->received_cert,
+                              md_out);
+ }
++
++/*
++ * Historically, the strength of PKINIT key exchange has been determined by the
++ * pkinit_dh_min_bits variable, which gives a finite field size.  With the
++ * addition of ECDH support, we allow the string values P-256, P-384, and P-521
++ * for this config variable, represented with the rough equivalent bit
++ * strengths for finite fields.
++ */
++int
++parse_dh_min_bits(krb5_context context, const char *str)
++{
++    char *endptr;
++    long n;
++
++    if (str == NULL)
++        return PKINIT_DEFAULT_DH_MIN_BITS;
++
++    n = strtol(str, &endptr, 0);
++    if (endptr == str) {
++        if (strcasecmp(str, "P-256") == 0)
++            return PKINIT_DH_P256_BITS;
++        else if (strcasecmp(str, "P-384") == 0)
++            return PKINIT_DH_P384_BITS;
++        else if (strcasecmp(str, "P-521") == 0)
++            return PKINIT_DH_P521_BITS;
++    } else {
++        if (n == 1024)
++            return 1024;
++        else if (n > 1024 && n <= 2048)
++            return 2048;
++        else if (n > 2048 && n <= 4096)
++            return 4096;
++    }
++
++    TRACE_PKINIT_DH_INVALID_MIN_BITS(context, str);
++    return PKINIT_DEFAULT_DH_MIN_BITS;
++}
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
+index c807f044ac..b7a3358800 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
+@@ -99,6 +99,9 @@ struct _pkinit_plg_crypto_context {
+     EVP_PKEY *dh_1024;
+     EVP_PKEY *dh_2048;
+     EVP_PKEY *dh_4096;
++    EVP_PKEY *ec_p256;
++    EVP_PKEY *ec_p384;
++    EVP_PKEY *ec_p521;
+     ASN1_OBJECT *id_pkinit_authData;
+     ASN1_OBJECT *id_pkinit_DHKeyData;
+     ASN1_OBJECT *id_pkinit_rkeyData;
+@@ -113,7 +116,6 @@ struct _pkinit_plg_crypto_context {
+ struct _pkinit_req_crypto_context {
+     X509 *received_cert;
+     EVP_PKEY *client_pkey;
+-    EVP_PKEY *received_params;
+ };
+ 
+ #endif	/* _PKINIT_CRYPTO_OPENSSL_H */
+diff --git a/src/plugins/preauth/pkinit/pkinit_lib.c b/src/plugins/preauth/pkinit/pkinit_lib.c
+index 19db695a4d..25965eb5d2 100644
+--- a/src/plugins/preauth/pkinit/pkinit_lib.c
++++ b/src/plugins/preauth/pkinit/pkinit_lib.c
+@@ -33,9 +33,6 @@
+ 
+ #define FAKECERT
+ 
+-const krb5_data dh_oid = { 0, 7, "\x2A\x86\x48\xce\x3e\x02\x01" };
+-
+-
+ krb5_error_code
+ pkinit_init_req_opts(pkinit_req_opts **reqopts)
+ {
+diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
+index aab21f951c..e22bcb195b 100644
+--- a/src/plugins/preauth/pkinit/pkinit_srv.c
++++ b/src/plugins/preauth/pkinit/pkinit_srv.c
+@@ -988,7 +988,7 @@ static krb5_error_code
+ pkinit_init_kdc_profile(krb5_context context, pkinit_kdc_context plgctx)
+ {
+     krb5_error_code retval;
+-    char *eku_string = NULL, *ocsp_check = NULL;
++    char *eku_string = NULL, *ocsp_check = NULL, *minbits = NULL;
+ 
+     pkiDebug("%s: entered for realm %s\n", __FUNCTION__, plgctx->realmname);
+     retval = pkinit_kdcdefault_string(context, plgctx->realmname,
+@@ -1033,17 +1033,10 @@ pkinit_init_kdc_profile(krb5_context context, pkinit_kdc_context plgctx)
+         goto errout;
+     }
+ 
+-    pkinit_kdcdefault_integer(context, plgctx->realmname,
+-                              KRB5_CONF_PKINIT_DH_MIN_BITS,
+-                              PKINIT_DEFAULT_DH_MIN_BITS,
+-                              &plgctx->opts->dh_min_bits);
+-    if (plgctx->opts->dh_min_bits < PKINIT_DH_MIN_CONFIG_BITS) {
+-        pkiDebug("%s: invalid value (%d < %d) for pkinit_dh_min_bits, "
+-                 "using default value (%d) instead\n", __FUNCTION__,
+-                 plgctx->opts->dh_min_bits, PKINIT_DH_MIN_CONFIG_BITS,
+-                 PKINIT_DEFAULT_DH_MIN_BITS);
+-        plgctx->opts->dh_min_bits = PKINIT_DEFAULT_DH_MIN_BITS;
+-    }
++    pkinit_kdcdefault_string(context, plgctx->realmname,
++                             KRB5_CONF_PKINIT_DH_MIN_BITS, &minbits);
++    plgctx->opts->dh_min_bits = parse_dh_min_bits(context, minbits);
++    free(minbits);
+ 
+     pkinit_kdcdefault_boolean(context, plgctx->realmname,
+                               KRB5_CONF_PKINIT_ALLOW_UPN,
+diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h
+index d385759145..1c1ceb5a41 100644
+--- a/src/plugins/preauth/pkinit/pkinit_trace.h
++++ b/src/plugins/preauth/pkinit/pkinit_trace.h
+@@ -83,6 +83,17 @@
+ 
+ #define TRACE_PKINIT_DH_GROUP_UNAVAILABLE(c, name)                      \
+     TRACE(c, "PKINIT key exchange group {str} unsupported", name)
++#define TRACE_PKINIT_DH_INVALID_MIN_BITS(c, str)                        \
++    TRACE(c, "Invalid pkinit_dh_min_bits value {str}, using default", str)
++#define TRACE_PKINIT_DH_NEGOTIATED_GROUP(c, desc)                       \
++    TRACE(c, "PKINIT accepting KDC key exchange group preference {str}", desc)
++#define TRACE_PKINIT_DH_PROPOSING_GROUP(c, desc)                \
++    TRACE(c, "PKINIT using {str} key exchange group", desc)
++#define TRACE_PKINIT_DH_RECEIVED_GROUP(c, desc)                         \
++    TRACE(c, "PKINIT received {str} key from client for key exchange", desc)
++#define TRACE_PKINIT_DH_REJECTING_GROUP(c, desc, mindesc)               \
++    TRACE(c, "PKINIT client key has group {str}, need at least {str}",  \
++          desc, mindesc)
+ 
+ #define TRACE_PKINIT_OPENSSL_ERROR(c, msg)              \
+     TRACE(c, "PKINIT OpenSSL error: {str}", msg)
+diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
+index 62e6c426d3..f8f2debc1b 100755
+--- a/src/tests/t_pkinit.py
++++ b/src/tests/t_pkinit.py
+@@ -172,6 +172,15 @@ realm.pkinit(realm.user_princ, expected_trace=msgs)
+ realm.klist(realm.user_princ)
+ realm.run([kvno, realm.host_princ])
+ 
++# Test each Diffie-Hellman group except 1024-bit (which doesn't work
++# in OpenSSL 3.0) and the default 2048-bit group.
++for g in ('4096', 'P-256', 'P-384', 'P-521'):
++    mark('Diffie-Hellman group ' + g)
++    group_conf = {'realms': {'$realm': {'pkinit_dh_min_bits': g}}}
++    group_env = realm.special_env(g, True, krb5_conf=group_conf)
++    realm.pkinit(realm.user_princ, expected_trace=('PKINIT using ' + g,),
++                 env=group_env)
++
+ # Try using multiple configured pkinit_identities, to make sure we
+ # fall back to the second one when the first one cannot be read.
+ id_conf = {'realms': {'$realm': {'pkinit_identities': [file_identity + 'X',
+@@ -190,11 +199,14 @@ realm.start_kdc(env=minbits_env)
+ msgs = ('Sending unauthenticated request',
+         '/Additional pre-authentication required',
+         'Preauthenticating using KDC method data',
++        'PKINIT using 2048-bit DH key exchange group',
+         'Preauth module pkinit (16) (real) returned: 0/Success',
+         ' preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16)',
+         '/Key parameters not accepted',
+         'Preauth tryagain input types (16): 109, PA-FX-COOKIE (133)',
++        'PKINIT accepting KDC key exchange group preference P-384',
+         'trying again with KDC-provided parameters',
++        'PKINIT using P-384 key exchange group',
+         'Preauth module pkinit (16) tryagain returned: 0/Success',
+         ' preauth for next request: PA-PK-AS-REQ (16), PA-FX-COOKIE (133)')
+ realm.pkinit(realm.user_princ, expected_trace=msgs)
+-- 
+2.47.1
+
diff --git a/0027-Add-ecdsa-with-sha512-256-to-supportedCMSTypes.patch b/0027-Add-ecdsa-with-sha512-256-to-supportedCMSTypes.patch
new file mode 100644
index 0000000..140a2e5
--- /dev/null
+++ b/0027-Add-ecdsa-with-sha512-256-to-supportedCMSTypes.patch
@@ -0,0 +1,78 @@
+From 43d10f1580c033fe706470e7588c720ac7854918 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Wed, 21 Jun 2023 18:27:11 +0200
+Subject: [PATCH] Add ecdsa-with-sha512/256 to supportedCMSTypes
+
+Elliptic curve certificates are already supported for PKINIT
+pre-authentication, but their associated signature types aren't
+advertized.  Add ecdsa-with-sha512 and ecdsa-with-sha256 OIDs to the
+supportedCMSTypes list sent by the client.
+
+[ghudson@mit.edu: edited commit message]
+
+ticket: 9100 (new)
+(cherry picked from commit 9913e5c92c4e5cb76d6ae58386f744766d2e6454)
+---
+ src/plugins/preauth/pkinit/pkinit_constants.c | 38 +++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_constants.c b/src/plugins/preauth/pkinit/pkinit_constants.c
+index 10f8688ec2..905e90d29c 100644
+--- a/src/plugins/preauth/pkinit/pkinit_constants.c
++++ b/src/plugins/preauth/pkinit/pkinit_constants.c
+@@ -64,14 +64,52 @@ static char sha512WithRSAEncr_oid[9] = {
+     0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0d
+ };
+ 
++/* RFC 3279 ecdsa-with-SHA1: iso(1) member-body(2) us(840) ansi-X9-62(10045)
++ * signatures(4) 1 */
++static char ecdsaWithSha1_oid[] = {
++    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x01
++};
++
++/* RFC 5758 ecdsa-with-SHA256: iso(1) member-body(2) us(840) ansi-X9-62(10045)
++ * signatures(4) ecdsa-with-SHA2(3) 2 */
++static char ecdsaWithSha256_oid[] = {
++    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02
++};
++
++/* RFC 5758 ecdsa-with-SHA384: iso(1) member-body(2) us(840) ansi-X9-62(10045)
++ * signatures(4) ecdsa-with-SHA2(3) 3 */
++static char ecdsaWithSha384_oid[] = {
++    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x03
++};
++
++/* RFC 5758 ecdsa-with-SHA512: iso(1) member-body(2) us(840) ansi-X9-62(10045)
++ * signatures(4) ecdsa-with-SHA2(3) 4 */
++static char ecdsaWithSha512_oid[] = {
++    0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x04
++};
++
+ const krb5_data sha256WithRSAEncr_id = {
+     KV5M_DATA, sizeof(sha256WithRSAEncr_oid), sha256WithRSAEncr_oid
+ };
+ const krb5_data sha512WithRSAEncr_id = {
+     KV5M_DATA, sizeof(sha512WithRSAEncr_oid), sha512WithRSAEncr_oid
+ };
++const krb5_data ecdsaWithSha1_id = {
++    KV5M_DATA, sizeof(ecdsaWithSha1_oid), ecdsaWithSha1_oid
++};
++const krb5_data ecdsaWithSha256_id = {
++    KV5M_DATA, sizeof(ecdsaWithSha256_oid), ecdsaWithSha256_oid
++};
++const krb5_data ecdsaWithSha384_id = {
++    KV5M_DATA, sizeof(ecdsaWithSha384_oid), ecdsaWithSha384_oid
++};
++const krb5_data ecdsaWithSha512_id = {
++    KV5M_DATA, sizeof(ecdsaWithSha512_oid), ecdsaWithSha512_oid
++};
+ 
+ krb5_data const * const supported_cms_algs[] = {
++    &ecdsaWithSha512_id,
++    &ecdsaWithSha256_id,
+     &sha512WithRSAEncr_id,
+     &sha256WithRSAEncr_id,
+     NULL
+-- 
+2.47.1
+
diff --git a/0028-Get-rid-of-pkinit_crypto_openssl.h.patch b/0028-Get-rid-of-pkinit_crypto_openssl.h.patch
new file mode 100644
index 0000000..993e823
--- /dev/null
+++ b/0028-Get-rid-of-pkinit_crypto_openssl.h.patch
@@ -0,0 +1,264 @@
+From fba4cbf0bc50569b8ea6d1e1c3303eaab84935e1 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Sun, 30 Jul 2023 01:07:38 -0400
+Subject: [PATCH] Get rid of pkinit_crypto_openssl.h
+
+Fold pkinit_crypto_openssl.h into the one source file where it was
+used.  Also clean up the include of <arpa/inet.h>, as htonl() is no
+longer used after commit 1c87ce6c44a9de0824580a2d72a8a202237e01f4.
+
+(cherry picked from commit b3352945fb8836f8b4095e0b8aad04b54aca3152)
+---
+ src/plugins/preauth/pkinit/deps               |   2 +-
+ .../preauth/pkinit/pkinit_crypto_openssl.c    |  85 +++++++++++-
+ .../preauth/pkinit/pkinit_crypto_openssl.h    | 121 ------------------
+ 3 files changed, 83 insertions(+), 125 deletions(-)
+ delete mode 100644 src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
+
+diff --git a/src/plugins/preauth/pkinit/deps b/src/plugins/preauth/pkinit/deps
+index 58320aa801..b6f4476fe8 100644
+--- a/src/plugins/preauth/pkinit/deps
++++ b/src/plugins/preauth/pkinit/deps
+@@ -112,4 +112,4 @@ pkinit_crypto_openssl.so pkinit_crypto_openssl.po $(OUTPRE)pkinit_crypto_openssl
+   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \
+   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+   pkcs11.h pkinit.h pkinit_accessor.h pkinit_crypto.h \
+-  pkinit_crypto_openssl.c pkinit_crypto_openssl.h pkinit_trace.h
++  pkinit_crypto_openssl.c pkinit_trace.h
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index f6d494bd11..ae8599d5a2 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -30,20 +30,99 @@
+  */
+ 
+ #include "k5-int.h"
+-#include "pkinit_crypto_openssl.h"
+ #include "k5-buf.h"
+ #include "k5-err.h"
+ #include "k5-hex.h"
+-#include <unistd.h>
++#include "pkinit.h"
+ #include <dirent.h>
+-#include <arpa/inet.h>
+ 
++#include <openssl/bn.h>
++#include <openssl/dh.h>
++#include <openssl/x509.h>
++#include <openssl/pkcs7.h>
++#include <openssl/pkcs12.h>
++#include <openssl/obj_mac.h>
++#include <openssl/x509v3.h>
++#include <openssl/err.h>
++#include <openssl/evp.h>
++#include <openssl/sha.h>
++#include <openssl/asn1.h>
++#include <openssl/pem.h>
++#include <openssl/asn1t.h>
++#include <openssl/cms.h>
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ #include <openssl/core_names.h>
+ #include <openssl/kdf.h>
++#include <openssl/decoder.h>
+ #include <openssl/params.h>
+ #endif
+ 
++#define DN_BUF_LEN  256
++#define MAX_CREDS_ALLOWED 20
++
++struct _pkinit_cred_info {
++    char *name;
++    X509 *cert;
++    EVP_PKEY *key;
++#ifndef WITHOUT_PKCS11
++    CK_BYTE_PTR cert_id;
++    int cert_id_len;
++#endif
++};
++typedef struct _pkinit_cred_info *pkinit_cred_info;
++
++struct _pkinit_identity_crypto_context {
++    pkinit_cred_info creds[MAX_CREDS_ALLOWED+1];
++    STACK_OF(X509) *my_certs;   /* available user certs */
++    char *identity;             /* identity name for user cert */
++    int cert_index;             /* cert to use out of available certs*/
++    EVP_PKEY *my_key;           /* available user keys if in filesystem */
++    STACK_OF(X509) *trustedCAs; /* available trusted ca certs */
++    STACK_OF(X509) *intermediateCAs;   /* available intermediate ca certs */
++    STACK_OF(X509_CRL) *revoked;    /* available crls */
++    int pkcs11_method;
++    krb5_prompter_fct prompter;
++    void *prompter_data;
++#ifndef WITHOUT_PKCS11
++    char *p11_module_name;
++    CK_SLOT_ID slotid;
++    char *token_label;
++    char *cert_label;
++    /* These are crypto-specific. */
++    struct plugin_file_handle *p11_module;
++    CK_SESSION_HANDLE session;
++    CK_FUNCTION_LIST_PTR p11;
++    uint8_t *cert_id;
++    size_t cert_id_len;
++    CK_MECHANISM_TYPE mech;
++#endif
++    krb5_boolean defer_id_prompt;
++    pkinit_deferred_id *deferred_ids;
++};
++
++struct _pkinit_plg_crypto_context {
++    EVP_PKEY *dh_1024;
++    EVP_PKEY *dh_2048;
++    EVP_PKEY *dh_4096;
++    EVP_PKEY *ec_p256;
++    EVP_PKEY *ec_p384;
++    EVP_PKEY *ec_p521;
++    ASN1_OBJECT *id_pkinit_authData;
++    ASN1_OBJECT *id_pkinit_DHKeyData;
++    ASN1_OBJECT *id_pkinit_rkeyData;
++    ASN1_OBJECT *id_pkinit_san;
++    ASN1_OBJECT *id_ms_san_upn;
++    ASN1_OBJECT *id_pkinit_KPClientAuth;
++    ASN1_OBJECT *id_pkinit_KPKdc;
++    ASN1_OBJECT *id_ms_kp_sc_logon;
++    ASN1_OBJECT *id_kp_serverAuth;
++};
++
++struct _pkinit_req_crypto_context {
++    X509 *received_cert;
++    EVP_PKEY *client_pkey;
++};
++
+ static krb5_error_code pkinit_init_pkinit_oids(pkinit_plg_crypto_context );
+ static void pkinit_fini_pkinit_oids(pkinit_plg_crypto_context );
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
+deleted file mode 100644
+index b7a3358800..0000000000
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
++++ /dev/null
+@@ -1,121 +0,0 @@
+-/*
+- * COPYRIGHT (C) 2006,2007
+- * THE REGENTS OF THE UNIVERSITY OF MICHIGAN
+- * ALL RIGHTS RESERVED
+- *
+- * Permission is granted to use, copy, create derivative works
+- * and redistribute this software and such derivative works
+- * for any purpose, so long as the name of The University of
+- * Michigan is not used in any advertising or publicity
+- * pertaining to the use of distribution of this software
+- * without specific, written prior authorization.  If the
+- * above copyright notice or any other identification of the
+- * University of Michigan is included in any copy of any
+- * portion of this software, then the disclaimer below must
+- * also be included.
+- *
+- * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION
+- * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY
+- * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF
+- * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING
+- * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF
+- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
+- * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE
+- * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR
+- * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING
+- * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN
+- * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF
+- * SUCH DAMAGES.
+- */
+-
+-#ifndef _PKINIT_CRYPTO_OPENSSL_H
+-#define _PKINIT_CRYPTO_OPENSSL_H
+-
+-#include "pkinit.h"
+-
+-#include <openssl/bn.h>
+-#include <openssl/dh.h>
+-#include <openssl/x509.h>
+-#include <openssl/pkcs7.h>
+-#include <openssl/pkcs12.h>
+-#include <openssl/obj_mac.h>
+-#include <openssl/x509v3.h>
+-#include <openssl/err.h>
+-#include <openssl/evp.h>
+-#include <openssl/sha.h>
+-#include <openssl/asn1.h>
+-#include <openssl/pem.h>
+-#include <openssl/asn1t.h>
+-#include <openssl/cms.h>
+-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+-#include <openssl/core_names.h>
+-#include <openssl/decoder.h>
+-#endif
+-
+-#define DN_BUF_LEN  256
+-#define MAX_CREDS_ALLOWED 20
+-
+-struct _pkinit_cred_info {
+-    char *name;
+-    X509 *cert;
+-    EVP_PKEY *key;
+-#ifndef WITHOUT_PKCS11
+-    CK_BYTE_PTR cert_id;
+-    int cert_id_len;
+-#endif
+-};
+-typedef struct _pkinit_cred_info * pkinit_cred_info;
+-
+-struct _pkinit_identity_crypto_context {
+-    pkinit_cred_info creds[MAX_CREDS_ALLOWED+1];
+-    STACK_OF(X509) *my_certs;   /* available user certs */
+-    char *identity;             /* identity name for user cert */
+-    int cert_index;             /* cert to use out of available certs*/
+-    EVP_PKEY *my_key;           /* available user keys if in filesystem */
+-    STACK_OF(X509) *trustedCAs; /* available trusted ca certs */
+-    STACK_OF(X509) *intermediateCAs;   /* available intermediate ca certs */
+-    STACK_OF(X509_CRL) *revoked;    /* available crls */
+-    int pkcs11_method;
+-    krb5_prompter_fct prompter;
+-    void *prompter_data;
+-#ifndef WITHOUT_PKCS11
+-    char *p11_module_name;
+-    CK_SLOT_ID slotid;
+-    char *token_label;
+-    char *cert_label;
+-    /* These are crypto-specific */
+-    struct plugin_file_handle *p11_module;
+-    CK_SESSION_HANDLE session;
+-    CK_FUNCTION_LIST_PTR p11;
+-    uint8_t *cert_id;
+-    size_t cert_id_len;
+-    CK_MECHANISM_TYPE mech;
+-#endif
+-    krb5_boolean defer_id_prompt;
+-    pkinit_deferred_id *deferred_ids;
+-};
+-
+-struct _pkinit_plg_crypto_context {
+-    EVP_PKEY *dh_1024;
+-    EVP_PKEY *dh_2048;
+-    EVP_PKEY *dh_4096;
+-    EVP_PKEY *ec_p256;
+-    EVP_PKEY *ec_p384;
+-    EVP_PKEY *ec_p521;
+-    ASN1_OBJECT *id_pkinit_authData;
+-    ASN1_OBJECT *id_pkinit_DHKeyData;
+-    ASN1_OBJECT *id_pkinit_rkeyData;
+-    ASN1_OBJECT *id_pkinit_san;
+-    ASN1_OBJECT *id_ms_san_upn;
+-    ASN1_OBJECT *id_pkinit_KPClientAuth;
+-    ASN1_OBJECT *id_pkinit_KPKdc;
+-    ASN1_OBJECT *id_ms_kp_sc_logon;
+-    ASN1_OBJECT *id_kp_serverAuth;
+-};
+-
+-struct _pkinit_req_crypto_context {
+-    X509 *received_cert;
+-    EVP_PKEY *client_pkey;
+-};
+-
+-#endif	/* _PKINIT_CRYPTO_OPENSSL_H */
+-- 
+2.47.1
+
diff --git a/0029-Use-SoftHSMv2-for-PKCS11-PKINIT-tests.patch b/0029-Use-SoftHSMv2-for-PKCS11-PKINIT-tests.patch
new file mode 100644
index 0000000..a328431
--- /dev/null
+++ b/0029-Use-SoftHSMv2-for-PKCS11-PKINIT-tests.patch
@@ -0,0 +1,157 @@
+From 1b01057df4c2223fbf92be44f1e764207208ef03 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Mon, 26 Feb 2024 19:03:38 -0500
+Subject: [PATCH] Use SoftHSMv2 for PKCS11 PKINIT tests
+
+Instead of softpkcs11, use SoftHSMv2 to mock the PKCS11 token for
+PKINIT tests.  Use pkcs11-tool from OpenSC to initialize the token and
+import a certificate and key.  SoftHSM does not support PIN-less
+tokens (see https://github.com/opendnssec/SoftHSMv2/issues/480) so
+remove that test for now.
+
+(cherry picked from commit 8ab61608236883fdc5c2d43f4bd1ff2094401d19)
+---
+ .github/workflows/build.yml |  2 +-
+ src/tests/t_pkinit.py       | 82 ++++++++++++++++++++-----------------
+ 2 files changed, 45 insertions(+), 39 deletions(-)
+
+diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
+index 68a4788adb..d7ae86b150 100644
+--- a/.github/workflows/build.yml
++++ b/.github/workflows/build.yml
+@@ -33,7 +33,7 @@ jobs:
+               if: startsWith(matrix.os, 'ubuntu')
+               run: |
+                 sudo apt-get update -qq
+-                sudo apt-get install -y bison gettext keyutils ldap-utils libcmocka-dev libldap2-dev libkeyutils-dev libsasl2-dev libssl-dev python3-kdcproxy python3-pip slapd tcsh
++                sudo apt-get install -y bison gettext keyutils ldap-utils libcmocka-dev libldap2-dev libkeyutils-dev libsasl2-dev libssl-dev python3-kdcproxy python3-pip slapd tcsh softhsm2 opensc
+                 pip3 install pyrad
+             - name: Build
+               env:
+diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
+index f8f2debc1b..4435746429 100755
+--- a/src/tests/t_pkinit.py
++++ b/src/tests/t_pkinit.py
+@@ -1,11 +1,10 @@
+ from k5test import *
++import re
+ 
+ # Skip this test if pkinit wasn't built.
+ if not pkinit_enabled:
+     skip_rest('PKINIT tests', 'PKINIT module not built')
+ 
+-soft_pkcs11 = os.path.join(buildtop, 'tests', 'softpkcs11', 'softpkcs11.so')
+-
+ # Construct a krb5.conf fragment configuring pkinit.
+ user_pem = os.path.join(pkinit_certs, 'user.pem')
+ privkey_pem = os.path.join(pkinit_certs, 'privkey.pem')
+@@ -55,9 +54,6 @@ p12_upn2_identity = 'PKCS12:%s' % user_upn2_p12
+ p12_upn3_identity = 'PKCS12:%s' % user_upn3_p12
+ p12_generic_identity = 'PKCS12:%s' % generic_p12
+ p12_enc_identity = 'PKCS12:%s' % user_enc_p12
+-p11_identity = 'PKCS11:' + soft_pkcs11
+-p11_token_identity = ('PKCS11:module_name=' + soft_pkcs11 +
+-                      ':slotid=1:token=SoftToken (token)')
+ 
+ # Start a realm with the test kdb module for the following UPN SAN tests.
+ realm = K5Realm(kdc_conf=alias_kdc_conf, create_kdb=False, pkinit=True)
+@@ -389,53 +385,63 @@ realm.klist(realm.user_princ)
+ realm.kinit(realm.user_princ, flags=['-X', 'X509_user_identity=,'],
+             expected_code=1, expected_msg='Preauthentication failed while')
+ 
+-softpkcs11rc = os.path.join(os.getcwd(), 'testdir', 'soft-pkcs11.rc')
+-realm.env['SOFTPKCS11RC'] = softpkcs11rc
++softhsm2 = '/usr/lib/softhsm/libsofthsm2.so'
++if not os.path.exists(softhsm2):
++    skip_rest('PKCS11 tests', 'SoftHSMv2 required')
++pkcs11_tool = which('pkcs11-tool')
++if not pkcs11_tool:
++    skip_rest('PKCS11 tests', 'pkcs11-tool from OpenSC required')
++tool_cmd = [pkcs11_tool, '--module', softhsm2]
++
++# Prepare a SoftHSM token.
++softhsm2_conf = os.path.join(realm.testdir, 'softhsm2.conf')
++softhsm2_tokens = os.path.join(realm.testdir, 'tokens')
++os.mkdir(softhsm2_tokens)
++realm.env['SOFTHSM2_CONF'] = softhsm2_conf
++with open(softhsm2_conf, 'w') as f:
++    f.write('directories.tokendir = %s\n' % softhsm2_tokens)
++realm.run(tool_cmd + ['--init-token', '--label', 'user',
++                      '--so-pin', 'sopin', '--init-pin', '--pin', 'userpin'])
++realm.run(tool_cmd + ['-w', user_pem, '-y', 'cert'])
++realm.run(tool_cmd + ['-w', privkey_pem, '-y', 'privkey',
++                      '-l', '--pin', 'userpin'])
++
++# Extract the slot ID generated by SoftHSM.
++out = realm.run(tool_cmd + ['-L'])
++m = re.search(r'slot ID 0x([0-9a-f]+)\n', out)
++if not m:
++    fail('could not extract slot ID from SoftHSM token')
++slot_id = int(m.group(1), 16)
++
++p11_attr = 'X509_user_identity=PKCS11:' + softhsm2
++p11_token_identity = ('PKCS11:module_name=%s:slotid=%d:token=user' %
++                      (softhsm2, slot_id))
+ 
+-# PKINIT with PKCS11: identity, with no need for a PIN.
+-mark('PKCS11 identity, no PIN')
+-conf = open(softpkcs11rc, 'w')
+-conf.write("%s\t%s\t%s\t%s\n" % ('user', 'user token', user_pem, privkey_pem))
+-conf.close()
+-# Expect to succeed without having to supply any more information.
+-realm.kinit(realm.user_princ,
+-            flags=['-X', 'X509_user_identity=%s' % p11_identity])
++mark('PKCS11 identity, with PIN (prompter)')
++realm.kinit(realm.user_princ, flags=['-X', p11_attr], password='userpin')
+ realm.klist(realm.user_princ)
+ realm.run([kvno, realm.host_princ])
+ 
+-# PKINIT with PKCS11: identity, with a PIN supplied by the prompter.
+-mark('PKCS11 identity, with PIN (prompter)')
+-os.remove(softpkcs11rc)
+-conf = open(softpkcs11rc, 'w')
+-conf.write("%s\t%s\t%s\t%s\n" % ('user', 'user token', user_pem,
+-                                 privkey_enc_pem))
+-conf.close()
+-# Expect failure if the responder does nothing, and there's no prompter
++mark('PKCS11 identity, unavailable PIN')
+ realm.run(['./responder', '-x', 'pkinit={"%s": 0}' % p11_token_identity,
+-           '-X', 'X509_user_identity=%s' % p11_identity, realm.user_princ],
+-          expected_code=2)
+-realm.kinit(realm.user_princ,
+-            flags=['-X', 'X509_user_identity=%s' % p11_identity],
+-            password='encrypted')
+-realm.klist(realm.user_princ)
+-realm.run([kvno, realm.host_princ])
++           '-X', p11_attr, realm.user_princ], expected_code=2)
+ 
+-# Supply the wrong PIN.
+ mark('PKCS11 identity, wrong PIN')
+ expected_trace = ('PKINIT client has no configured identity; giving up',)
+ realm.kinit(realm.user_princ,
+-            flags=['-X', 'X509_user_identity=%s' % p11_identity],
++            flags=['-X', p11_attr],
+             password='wrong', expected_code=1, expected_trace=expected_trace)
+ 
+ # PKINIT with PKCS11: identity, with a PIN supplied by the responder.
+-# Supply the response in raw form.
++# Supply the response in raw form.  Expect the PIN_COUNT_LOW flag (1)
++# to be set due to the previous test.
+ mark('PKCS11 identity, with PIN (responder)')
+-realm.run(['./responder', '-x', 'pkinit={"%s": 0}' % p11_token_identity,
+-           '-r', 'pkinit={"%s": "encrypted"}' % p11_token_identity,
+-           '-X', 'X509_user_identity=%s' % p11_identity, realm.user_princ])
++realm.run(['./responder', '-x', 'pkinit={"%s": 1}' % p11_token_identity,
++           '-r', 'pkinit={"%s": "userpin"}' % p11_token_identity,
++           '-X', p11_attr, realm.user_princ])
+ # Supply the response through the convenience API.
+-realm.run(['./responder', '-X', 'X509_user_identity=%s' % p11_identity,
+-           '-p', '%s=%s' % (p11_token_identity, 'encrypted'),
++realm.run(['./responder', '-X', p11_attr,
++           '-p', '%s=%s' % (p11_token_identity, 'userpin'),
+            realm.user_princ])
+ realm.klist(realm.user_princ)
+ realm.run([kvno, realm.host_princ])
+-- 
+2.47.1
+
diff --git a/0030-Simplify-PKINIT-cert-representation.patch b/0030-Simplify-PKINIT-cert-representation.patch
new file mode 100644
index 0000000..1bd8d64
--- /dev/null
+++ b/0030-Simplify-PKINIT-cert-representation.patch
@@ -0,0 +1,202 @@
+From b0315d30f066c4241fcecc33dd9e4d1c7c28b9d8 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 9 Feb 2024 17:32:40 -0500
+Subject: [PATCH] Simplify PKINIT cert representation
+
+In the _pkinit_identity_crypto_context structure, the my_certs field
+is a stack which only ever contains one cert and is only ever used to
+retrieve that one cert.  The cert_index field is always 0.  Replace
+these fields with a my_cert field pointing directly to the X509
+certificate.
+
+Simplify crypto_cert_select_default() by making it call
+crypto_cert_select() with index 0 after verifying the certificate
+count.
+
+(cherry picked from commit f95dfb7908456f9563cee66706216a21df8d791f)
+---
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 74 +++++--------------
+ 1 file changed, 20 insertions(+), 54 deletions(-)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index ae8599d5a2..da59cb1e02 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -73,10 +73,9 @@ typedef struct _pkinit_cred_info *pkinit_cred_info;
+ 
+ struct _pkinit_identity_crypto_context {
+     pkinit_cred_info creds[MAX_CREDS_ALLOWED+1];
+-    STACK_OF(X509) *my_certs;   /* available user certs */
++    X509 *my_cert;              /* selected user or KDC cert */
+     char *identity;             /* identity name for user cert */
+-    int cert_index;             /* cert to use out of available certs*/
+-    EVP_PKEY *my_key;           /* available user keys if in filesystem */
++    EVP_PKEY *my_key;           /* selected cert key if in filesystem */
+     STACK_OF(X509) *trustedCAs; /* available trusted ca certs */
+     STACK_OF(X509) *intermediateCAs;   /* available intermediate ca certs */
+     STACK_OF(X509_CRL) *revoked;    /* available crls */
+@@ -1489,8 +1488,7 @@ pkinit_init_certs(pkinit_identity_crypto_context ctx)
+ 
+     for (i = 0; i < MAX_CREDS_ALLOWED; i++)
+         ctx->creds[i] = NULL;
+-    ctx->my_certs = NULL;
+-    ctx->cert_index = 0;
++    ctx->my_cert = NULL;
+     ctx->my_key = NULL;
+     ctx->trustedCAs = NULL;
+     ctx->intermediateCAs = NULL;
+@@ -1506,8 +1504,8 @@ pkinit_fini_certs(pkinit_identity_crypto_context ctx)
+     if (ctx == NULL)
+         return;
+ 
+-    if (ctx->my_certs != NULL)
+-        sk_X509_pop_free(ctx->my_certs, X509_free);
++    if (ctx->my_cert != NULL)
++        X509_free(ctx->my_cert);
+ 
+     if (ctx->my_key != NULL)
+         EVP_PKEY_free(ctx->my_key);
+@@ -1696,7 +1694,6 @@ cms_signeddata_create(krb5_context context,
+     ASN1_OCTET_STRING *digest = NULL;
+     unsigned int alg_len = 0, digest_len = 0;
+     unsigned char *y = NULL;
+-    X509 *cert = NULL;
+     ASN1_OBJECT *oid = NULL, *oid_copy;
+ 
+     /* Start creating PKCS7 data. */
+@@ -1715,7 +1712,7 @@ cms_signeddata_create(krb5_context context,
+     if (oid == NULL)
+         goto cleanup;
+ 
+-    if (id_cryptoctx->my_certs != NULL) {
++    if (id_cryptoctx->my_cert != NULL) {
+         X509_STORE *certstore = NULL;
+         X509_STORE_CTX *certctx;
+         STACK_OF(X509) *certstack = NULL;
+@@ -1726,8 +1723,6 @@ cms_signeddata_create(krb5_context context,
+         if ((cert_stack = sk_X509_new_null()) == NULL)
+             goto cleanup;
+ 
+-        cert = sk_X509_value(id_cryptoctx->my_certs, id_cryptoctx->cert_index);
+-
+         certstore = X509_STORE_new();
+         if (certstore == NULL)
+             goto cleanup;
+@@ -1736,7 +1731,7 @@ cms_signeddata_create(krb5_context context,
+         certctx = X509_STORE_CTX_new();
+         if (certctx == NULL)
+             goto cleanup;
+-        X509_STORE_CTX_init(certctx, certstore, cert,
++        X509_STORE_CTX_init(certctx, certstore, id_cryptoctx->my_cert,
+                             id_cryptoctx->intermediateCAs);
+         X509_STORE_CTX_trusted_stack(certctx, id_cryptoctx->trustedCAs);
+         if (!X509_verify_cert(certctx)) {
+@@ -1764,13 +1759,13 @@ cms_signeddata_create(krb5_context context,
+         if (!ASN1_INTEGER_set(p7si->version, 1))
+             goto cleanup;
+         if (!X509_NAME_set(&p7si->issuer_and_serial->issuer,
+-                           X509_get_issuer_name(cert)))
++                           X509_get_issuer_name(id_cryptoctx->my_cert)))
+             goto cleanup;
+         /* because ASN1_INTEGER_set is used to set a 'long' we will do
+          * things the ugly way. */
+         ASN1_INTEGER_free(p7si->issuer_and_serial->serial);
+         if (!(p7si->issuer_and_serial->serial =
+-              ASN1_INTEGER_dup(X509_get_serialNumber(cert))))
++              ASN1_INTEGER_dup(X509_get_serialNumber(id_cryptoctx->my_cert))))
+             goto cleanup;
+ 
+         /* will not fill-out EVP_PKEY because it's on the smartcard */
+@@ -3311,7 +3306,7 @@ pkinit_check_kdc_pkid(krb5_context context,
+     PKCS7_ISSUER_AND_SERIAL *is = NULL;
+     const unsigned char *p = pdid_buf;
+     int status = 1;
+-    X509 *kdc_cert = sk_X509_value(id_cryptoctx->my_certs, id_cryptoctx->cert_index);
++    X509 *kdc_cert = id_cryptoctx->my_cert;
+ 
+     *valid_kdcPkId = 0;
+     pkiDebug("found kdcPkId in AS REQ\n");
+@@ -4783,7 +4778,8 @@ cleanup:
+ }
+ 
+ /*
+- * Set the certificate in idctx->creds[cred_index] as the selected certificate.
++ * Set the certificate in idctx->creds[cred_index] as the selected certificate,
++ * stealing pointers from it.
+  */
+ krb5_error_code
+ crypto_cert_select(krb5_context context, pkinit_identity_crypto_context idctx,
+@@ -4795,20 +4791,17 @@ crypto_cert_select(krb5_context context, pkinit_identity_crypto_context idctx,
+         return ENOENT;
+ 
+     ci = idctx->creds[cred_index];
+-    /* copy the selected cert into our id_cryptoctx */
+-    if (idctx->my_certs != NULL)
+-        sk_X509_pop_free(idctx->my_certs, X509_free);
+-    idctx->my_certs = sk_X509_new_null();
+-    sk_X509_push(idctx->my_certs, ci->cert);
+-    free(idctx->identity);
++
++    idctx->my_cert = ci->cert;
++    ci->cert = NULL;
++
+     /* hang on to the selected credential name */
++    free(idctx->identity);
+     if (ci->name != NULL)
+         idctx->identity = strdup(ci->name);
+     else
+         idctx->identity = NULL;
+ 
+-    ci->cert = NULL;       /* Don't free it twice */
+-    idctx->cert_index = 0;
+     if (idctx->pkcs11_method != 1) {
+         idctx->my_key = ci->key;
+         ci->key = NULL;    /* Don't free it twice */
+@@ -4837,41 +4830,14 @@ crypto_cert_select_default(krb5_context context,
+ 
+     retval = crypto_cert_get_count(id_cryptoctx, &cert_count);
+     if (retval)
+-        goto errout;
++        return retval;
+ 
+     if (cert_count != 1) {
+         TRACE_PKINIT_NO_DEFAULT_CERT(context, cert_count);
+-        retval = EINVAL;
+-        goto errout;
+-    }
+-    /* copy the selected cert into our id_cryptoctx */
+-    if (id_cryptoctx->my_certs != NULL) {
+-        sk_X509_pop_free(id_cryptoctx->my_certs, X509_free);
++        return EINVAL;
+     }
+-    id_cryptoctx->my_certs = sk_X509_new_null();
+-    sk_X509_push(id_cryptoctx->my_certs, id_cryptoctx->creds[0]->cert);
+-    id_cryptoctx->creds[0]->cert = NULL;        /* Don't free it twice */
+-    id_cryptoctx->cert_index = 0;
+-    /* hang on to the selected credential name */
+-    if (id_cryptoctx->creds[0]->name != NULL)
+-        id_cryptoctx->identity = strdup(id_cryptoctx->creds[0]->name);
+-    else
+-        id_cryptoctx->identity = NULL;
+ 
+-    if (id_cryptoctx->pkcs11_method != 1) {
+-        id_cryptoctx->my_key = id_cryptoctx->creds[0]->key;
+-        id_cryptoctx->creds[0]->key = NULL;     /* Don't free it twice */
+-    }
+-#ifndef WITHOUT_PKCS11
+-    else {
+-        id_cryptoctx->cert_id = id_cryptoctx->creds[0]->cert_id;
+-        id_cryptoctx->creds[0]->cert_id = NULL; /* Don't free it twice */
+-        id_cryptoctx->cert_id_len = id_cryptoctx->creds[0]->cert_id_len;
+-    }
+-#endif
+-    retval = 0;
+-errout:
+-    return retval;
++    return crypto_cert_select(context, id_cryptoctx, 0);
+ }
+ 
+ 
+-- 
+2.47.1
+
diff --git a/0031-Support-PKCS11-EC-client-certs-in-PKINIT.patch b/0031-Support-PKCS11-EC-client-certs-in-PKINIT.patch
new file mode 100644
index 0000000..920a6a8
--- /dev/null
+++ b/0031-Support-PKCS11-EC-client-certs-in-PKINIT.patch
@@ -0,0 +1,1768 @@
+From e7172ce0283b06f5208237535a086424d71d846b Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Wed, 21 Feb 2024 15:29:02 -0500
+Subject: [PATCH] Support PKCS11 EC client certs in PKINIT
+
+Move the digest computation and DigestInfo encoding from
+cms_signeddata_create() to pkinit_sign_data_pkcs11(), and
+conditionalize the DigestInfo encoding on the key type.  Use CKM_ECDSA
+instead of CKM_RSA_PKCS for EC keys, and convert the resulting
+signature from the PKS11 encoding to the ASN.1 encoding required by
+CMS.
+
+Regenerate the test certificates with an additional EC client cert.
+Add test cases for EC client certs with and without PKCS11.
+
+ticket: 9112 (new)
+(cherry picked from commit f745c9a9bd6c0c73b944182173f1ac305d03dc3a)
+---
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 319 +++++++++++-------
+ src/tests/pkinit-certs/ca.pem                 |  32 +-
+ src/tests/pkinit-certs/eckey.pem              |   5 +
+ src/tests/pkinit-certs/ecuser.pem             |  24 ++
+ src/tests/pkinit-certs/generic.p12            | Bin 2469 -> 2560 bytes
+ src/tests/pkinit-certs/generic.pem            |  38 +--
+ src/tests/pkinit-certs/kdc.pem                |  32 +-
+ src/tests/pkinit-certs/make-certs.sh          |  11 +-
+ src/tests/pkinit-certs/privkey-enc.pem        |  60 ++--
+ src/tests/pkinit-certs/privkey.pem            |  55 +--
+ src/tests/pkinit-certs/user-enc.p12           | Bin 2829 -> 2920 bytes
+ src/tests/pkinit-certs/user-upn.p12           | Bin 2821 -> 2912 bytes
+ src/tests/pkinit-certs/user-upn.pem           |  32 +-
+ src/tests/pkinit-certs/user-upn2.p12          | Bin 2805 -> 2896 bytes
+ src/tests/pkinit-certs/user-upn2.pem          |  34 +-
+ src/tests/pkinit-certs/user-upn3.p12          | Bin 2821 -> 2912 bytes
+ src/tests/pkinit-certs/user-upn3.pem          |  32 +-
+ src/tests/pkinit-certs/user.p12               | Bin 2829 -> 2920 bytes
+ src/tests/pkinit-certs/user.pem               |  30 +-
+ src/tests/t_pkinit.py                         |  20 ++
+ 20 files changed, 437 insertions(+), 287 deletions(-)
+ create mode 100644 src/tests/pkinit-certs/eckey.pem
+ create mode 100644 src/tests/pkinit-certs/ecuser.pem
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index da59cb1e02..4accfc2664 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -93,7 +93,6 @@ struct _pkinit_identity_crypto_context {
+     CK_FUNCTION_LIST_PTR p11;
+     uint8_t *cert_id;
+     size_t cert_id_len;
+-    CK_MECHANISM_TYPE mech;
+ #endif
+     krb5_boolean defer_id_prompt;
+     pkinit_deferred_id *deferred_ids;
+@@ -283,7 +282,6 @@ compat_get0_EC(const EVP_PKEY *pkey)
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L
+ /* OpenSSL 3.0 changes several preferred function names. */
+ #define EVP_PKEY_parameters_eq EVP_PKEY_cmp_parameters
+-#define EVP_MD_CTX_get0_md EVP_MD_CTX_md
+ #define EVP_PKEY_get_size EVP_PKEY_size
+ #define EVP_PKEY_get_bits EVP_PKEY_bits
+ 
+@@ -1683,17 +1681,12 @@ cms_signeddata_create(krb5_context context,
+     STACK_OF(X509) * cert_stack = NULL;
+     ASN1_OCTET_STRING *digest_attr = NULL;
+     EVP_MD_CTX *ctx;
+-    const EVP_MD *md_tmp = NULL;
+-    unsigned char md_data[EVP_MAX_MD_SIZE], md_data2[EVP_MAX_MD_SIZE];
+-    unsigned char *digestInfo_buf = NULL, *abuf = NULL;
+-    unsigned int md_len, md_len2, alen, digestInfo_len;
++    unsigned char md_data[EVP_MAX_MD_SIZE], *abuf = NULL;
++    unsigned int md_len, alen;
+     STACK_OF(X509_ATTRIBUTE) * sk;
+     unsigned char *sig = NULL;
+     unsigned int sig_len = 0;
+     X509_ALGOR *alg = NULL;
+-    ASN1_OCTET_STRING *digest = NULL;
+-    unsigned int alg_len = 0, digest_len = 0;
+-    unsigned char *y = NULL;
+     ASN1_OBJECT *oid = NULL, *oid_copy;
+ 
+     /* Start creating PKCS7 data. */
+@@ -1795,7 +1788,6 @@ cms_signeddata_create(krb5_context context,
+             goto cleanup;
+         EVP_DigestInit_ex(ctx, EVP_sha256(), NULL);
+         EVP_DigestUpdate(ctx, data, data_len);
+-        md_tmp = EVP_MD_CTX_get0_md(ctx);
+         EVP_DigestFinal_ex(ctx, md_data, &md_len);
+         EVP_MD_CTX_free(ctx);
+ 
+@@ -1820,63 +1812,8 @@ cms_signeddata_create(krb5_context context,
+         if (abuf == NULL)
+             goto cleanup2;
+ 
+-#ifndef WITHOUT_PKCS11
+-        /*
+-         * Some tokens can only do RSAEncryption without a hash.  To compute
+-         * sha256WithRSAEncryption, encode the algorithm ID for the hash
+-         * function and the hash value into an ASN.1 value of type DigestInfo:
+-         * DigestInfo ::= SEQUENCE {
+-         *   digestAlgorithm  AlgorithmIdentifier,
+-         *   digest  OCTET STRING
+-         * }
+-         */
+-        if (id_cryptoctx->pkcs11_method == 1 &&
+-            id_cryptoctx->mech == CKM_RSA_PKCS) {
+-            pkiDebug("mech = CKM_RSA_PKCS\n");
+-            ctx = EVP_MD_CTX_new();
+-            if (ctx == NULL)
+-                goto cleanup;
+-            EVP_DigestInit_ex(ctx, md_tmp, NULL);
+-            EVP_DigestUpdate(ctx, abuf, alen);
+-            EVP_DigestFinal_ex(ctx, md_data2, &md_len2);
+-            EVP_MD_CTX_free(ctx);
+-
+-            alg = X509_ALGOR_new();
+-            if (alg == NULL)
+-                goto cleanup2;
+-            X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha256), V_ASN1_NULL, NULL);
+-            alg_len = i2d_X509_ALGOR(alg, NULL);
+-
+-            digest = ASN1_OCTET_STRING_new();
+-            if (digest == NULL)
+-                goto cleanup2;
+-            ASN1_OCTET_STRING_set(digest, md_data2, (int)md_len2);
+-            digest_len = i2d_ASN1_OCTET_STRING(digest, NULL);
+-
+-            digestInfo_len = ASN1_object_size(1, (int)(alg_len + digest_len),
+-                                              V_ASN1_SEQUENCE);
+-            y = digestInfo_buf = malloc(digestInfo_len);
+-            if (digestInfo_buf == NULL)
+-                goto cleanup2;
+-            ASN1_put_object(&y, 1, (int)(alg_len + digest_len), V_ASN1_SEQUENCE,
+-                            V_ASN1_UNIVERSAL);
+-            i2d_X509_ALGOR(alg, &y);
+-            i2d_ASN1_OCTET_STRING(digest, &y);
+-#ifdef DEBUG_SIG
+-            pkiDebug("signing buffer\n");
+-            print_buffer(digestInfo_buf, digestInfo_len);
+-            print_buffer_bin(digestInfo_buf, digestInfo_len, "/tmp/pkcs7_tosign");
+-#endif
+-            retval = pkinit_sign_data(context, id_cryptoctx, digestInfo_buf,
+-                                      digestInfo_len, &sig, &sig_len);
+-        } else
+-#endif
+-        {
+-            pkiDebug("mech = %s\n",
+-                     id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA256_RSA_PKCS" : "FS");
+-            retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen,
+-                                      &sig, &sig_len);
+-        }
++        retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen,
++                                  &sig, &sig_len);
+ #ifdef DEBUG_SIG
+         print_buffer(sig, sig_len);
+ #endif
+@@ -1930,14 +1867,6 @@ cms_signeddata_create(krb5_context context,
+ 
+ cleanup2:
+     if (p7si) {
+-#ifndef WITHOUT_PKCS11
+-        if (id_cryptoctx->pkcs11_method == 1 &&
+-            id_cryptoctx->mech == CKM_RSA_PKCS) {
+-            free(digestInfo_buf);
+-            if (digest != NULL)
+-                ASN1_OCTET_STRING_free(digest);
+-        }
+-#endif
+         if (alg != NULL)
+             X509_ALGOR_free(alg);
+     }
+@@ -3657,8 +3586,7 @@ cleanup:
+  * Look for a key that's:
+  * 1. private
+  * 2. capable of the specified operation (usually signing or decrypting)
+- * 3. RSA (this may be wrong but it's all we can do for now)
+- * 4. matches the id of the cert we chose
++ * 3. matches the id of the cert we chose
+  *
+  * You must call pkinit_get_certs before calling pkinit_find_private_key
+  * (that's because we need the ID of the private key)
+@@ -3678,7 +3606,6 @@ pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx,
+     CK_OBJECT_CLASS cls;
+     CK_ATTRIBUTE attrs[4];
+     CK_ULONG count;
+-    CK_KEY_TYPE keytype;
+     unsigned int nattrs = 0;
+     int r;
+ #ifdef PKINIT_USE_KEY_USAGE
+@@ -3705,12 +3632,6 @@ pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx,
+     nattrs++;
+ #endif
+ 
+-    keytype = CKK_RSA;
+-    attrs[nattrs].type = CKA_KEY_TYPE;
+-    attrs[nattrs].pValue = &keytype;
+-    attrs[nattrs].ulValueLen = sizeof keytype;
+-    nattrs++;
+-
+     attrs[nattrs].type = CKA_ID;
+     attrs[nattrs].pValue = id_cryptoctx->cert_id;
+     attrs[nattrs].ulValueLen = id_cryptoctx->cert_id_len;
+@@ -3749,6 +3670,116 @@ pkinit_sign_data_fs(krb5_context context,
+ }
+ 
+ #ifndef WITHOUT_PKCS11
++/*
++ * DER-encode a DigestInfo sequence containing the algorithm md and the digest
++ * mdbytes.
++ *
++ * DigestInfo ::= SEQUENCE {
++ *   digestAlgorithm  AlgorithmIdentifier,
++ *   digest  OCTET STRING
++ * }
++ */
++static krb5_error_code
++encode_digestinfo(krb5_context context, const EVP_MD *md,
++                  const uint8_t *mdbytes, size_t mdlen,
++                  uint8_t **encoding_out, size_t *len_out)
++{
++    krb5_boolean ok = FALSE;
++    X509_ALGOR *alg = NULL;
++    ASN1_OCTET_STRING *digest = NULL;
++    uint8_t *buf, *p;
++    int alg_len, digest_len, len;
++
++    *encoding_out = NULL;
++    *len_out = 0;
++
++    alg = X509_ALGOR_new();
++    if (alg == NULL ||
++        !X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_MD_nid(md)), V_ASN1_NULL, NULL))
++        goto cleanup;
++    alg_len = i2d_X509_ALGOR(alg, NULL);
++    if (alg_len < 0)
++        goto cleanup;
++
++    digest = ASN1_OCTET_STRING_new();
++    if (digest == NULL || !ASN1_OCTET_STRING_set(digest, mdbytes, mdlen))
++        goto cleanup;
++    digest_len = i2d_ASN1_OCTET_STRING(digest, NULL);
++    if (digest_len < 0)
++        goto cleanup;
++
++    len = ASN1_object_size(1, alg_len + digest_len, V_ASN1_SEQUENCE);
++    p = buf = malloc(len);
++    if (buf == NULL)
++        goto cleanup;
++    ASN1_put_object(&p, 1, alg_len + digest_len, V_ASN1_SEQUENCE,
++                    V_ASN1_UNIVERSAL);
++    i2d_X509_ALGOR(alg, &p);
++    i2d_ASN1_OCTET_STRING(digest, &p);
++
++    *encoding_out = buf;
++    *len_out = len;
++    ok = TRUE;
++
++cleanup:
++    X509_ALGOR_free(alg);
++    ASN1_OCTET_STRING_free(digest);
++    if (!ok)
++        return oerr(context, 0, _("Failed to DER encode DigestInfo"));
++    return 0;
++}
++
++/* Extract the r and s values from a PKCS11 ECDSA signature and re-encode them
++ * in the DER representation of an ECDSA-Sig-Value for use in CMS. */
++static krb5_error_code
++convert_pkcs11_ecdsa_sig(krb5_context context,
++                         const uint8_t *p11sig, unsigned int p11siglen,
++                         uint8_t **sig_out, unsigned int *sig_len_out)
++{
++    krb5_boolean ok = FALSE;
++    BIGNUM *r = NULL, *s = NULL;
++    ECDSA_SIG *sig = NULL;
++    int len;
++    uint8_t *p;
++
++    *sig_out = NULL;
++    *sig_len_out = 0;
++
++    if (p11siglen % 2 != 0)
++        return EINVAL;
++
++    /* Extract the r and s values from the PKCS11 signature. */
++    r = BN_bin2bn(p11sig, p11siglen / 2, NULL);
++    s = BN_bin2bn(p11sig + p11siglen / 2, p11siglen / 2, NULL);
++    if (r == NULL || s == NULL)
++        goto cleanup;
++
++    /* Create an ECDSA-Sig-Value object and transfer ownership of r and s. */
++    sig = ECDSA_SIG_new();
++    if (sig == NULL || !ECDSA_SIG_set0(sig, r, s))
++        goto cleanup;
++    r = s = NULL;
++
++    /* DER-encode the ECDSA-Sig-Value object. */
++    len = i2d_ECDSA_SIG(sig, NULL);
++    if (len < 0)
++        goto cleanup;
++    p = *sig_out = malloc(len);
++    if (*sig_out == NULL)
++        goto cleanup;
++    *sig_len_out = len;
++    i2d_ECDSA_SIG(sig, &p);
++    ok = TRUE;
++
++cleanup:
++    BN_free(r);
++    BN_free(s);
++    ECDSA_SIG_free(sig);
++    if (!ok)
++        return oerr(context, 0, _("Failed to convert PKCS11 ECDSA signature"));
++    return 0;
++}
++
+ static krb5_error_code
+ pkinit_sign_data_pkcs11(krb5_context context,
+                         pkinit_identity_crypto_context id_cryptoctx,
+@@ -3757,27 +3788,88 @@ pkinit_sign_data_pkcs11(krb5_context context,
+                         unsigned char **sig,
+                         unsigned int *sig_len)
+ {
++    krb5_error_code ret;
+     CK_OBJECT_HANDLE obj;
+     CK_ULONG len;
+     CK_MECHANISM mech;
+-    unsigned char *cp;
++    CK_SESSION_HANDLE session;
++    CK_FUNCTION_LIST_PTR p11;
++    CK_ATTRIBUTE attr;
++    CK_KEY_TYPE keytype;
++    EVP_MD_CTX *ctx;
++    const EVP_MD *md = EVP_sha256();
++    unsigned int mdlen;
++    uint8_t mdbuf[EVP_MAX_MD_SIZE], *dinfo = NULL, *sigbuf = NULL, *input;
++    size_t dinfo_len, input_len;
+     int r;
+ 
++    *sig = NULL;
++    *sig_len = 0;
++
+     if (pkinit_open_session(context, id_cryptoctx)) {
+         pkiDebug("can't open pkcs11 session\n");
+         return KRB5KDC_ERR_PREAUTH_FAILED;
+     }
++    p11 = id_cryptoctx->p11;
++    session = id_cryptoctx->session;
+ 
+-    pkinit_find_private_key(id_cryptoctx, CKA_SIGN, &obj);
++    ret = pkinit_find_private_key(id_cryptoctx, CKA_SIGN, &obj);
++    if (ret)
++        return ret;
++
++    attr.type = CKA_KEY_TYPE;
++    attr.pValue = &keytype;
++    attr.ulValueLen = sizeof(keytype);
++    r = p11->C_GetAttributeValue(session, obj, &attr, 1);
++    if (r) {
++        pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(r));
++        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        goto cleanup;
++    }
++
++    /*
++     * We would ideally use CKM_SHA256_RSA_PKCS and CKM_ECDSA_SHA256, but
++     * historically many cards seem to be confused about whether they are
++     * capable of mechanisms or not.  To be safe we compute the digest
++     * ourselves and use CKM_RSA_PKCS and CKM_ECDSA.
++     */
++    ctx = EVP_MD_CTX_new();
++    if (ctx == NULL) {
++        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        goto cleanup;
++    }
++    EVP_DigestInit_ex(ctx, EVP_sha256(), NULL);
++    EVP_DigestUpdate(ctx, data, data_len);
++    EVP_DigestFinal_ex(ctx, mdbuf, &mdlen);
++    EVP_MD_CTX_free(ctx);
+ 
+-    mech.mechanism = id_cryptoctx->mech;
++    if (keytype == CKK_RSA) {
++        /* For RSA we must also encode the digest in a DigestInfo sequence. */
++        mech.mechanism = CKM_RSA_PKCS;
++        ret = encode_digestinfo(context, md, mdbuf, mdlen, &dinfo, &dinfo_len);
++        if (ret)
++            goto cleanup;
++        input = dinfo;
++        input_len = dinfo_len;
++    } else if (keytype == CKK_EC) {
++        mech.mechanism = CKM_ECDSA;
++        input = mdbuf;
++        input_len = mdlen;
++    } else {
++        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        k5_setmsg(context, ret,
++                  _("PKCS11 certificate has unsupported key type %lu"),
++                  keytype);
++        goto cleanup;
++    }
+     mech.pParameter = NULL;
+     mech.ulParameterLen = 0;
+ 
+-    if ((r = id_cryptoctx->p11->C_SignInit(id_cryptoctx->session, &mech,
+-                                           obj)) != CKR_OK) {
++    r = p11->C_SignInit(session, &mech, obj);
++    if (r != CKR_OK) {
+         pkiDebug("C_SignInit: %s\n", pkcs11err(r));
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
++        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        goto cleanup;
+     }
+ 
+     /*
+@@ -3785,28 +3877,38 @@ pkinit_sign_data_pkcs11(krb5_context context,
+      * get that. So guess, and if it's too small, re-malloc.
+      */
+     len = PK_SIGLEN_GUESS;
+-    cp = malloc((size_t) len);
+-    if (cp == NULL)
+-        return ENOMEM;
++    sigbuf = k5alloc(len, &ret);
++    if (sigbuf == NULL)
++        goto cleanup;
+ 
+-    r = id_cryptoctx->p11->C_Sign(id_cryptoctx->session, data,
+-                                  (CK_ULONG) data_len, cp, &len);
++    r = p11->C_Sign(session, input, input_len, sigbuf, &len);
+     if (r == CKR_BUFFER_TOO_SMALL || (r == CKR_OK && len >= PK_SIGLEN_GUESS)) {
+-        free(cp);
++        free(sigbuf);
+         pkiDebug("C_Sign realloc %d\n", (int) len);
+-        cp = malloc((size_t) len);
+-        r = id_cryptoctx->p11->C_Sign(id_cryptoctx->session, data,
+-                                      (CK_ULONG) data_len, cp, &len);
++        sigbuf = k5alloc(len, &ret);
++        if (sigbuf == NULL)
++            goto cleanup;
++        r = p11->C_Sign(session, input, input_len, sigbuf, &len);
+     }
+     if (r != CKR_OK) {
+         pkiDebug("C_Sign: %s\n", pkcs11err(r));
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
++        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        goto cleanup;
+     }
+-    pkiDebug("sign %d -> %d\n", (int) data_len, (int) len);
+-    *sig_len = len;
+-    *sig = cp;
+ 
+-    return 0;
++    if (keytype == CKK_EC) {
++        /* PKCS11 ECDSA signatures must be re-encoded for CMS. */
++        ret = convert_pkcs11_ecdsa_sig(context, sigbuf, len, sig, sig_len);
++    } else {
++        *sig_len = len;
++        *sig = sigbuf;
++        sigbuf = NULL;
++    }
++
++cleanup:
++    free(dinfo);
++    free(sigbuf);
++    return ret;
+ }
+ #endif
+ 
+@@ -4388,15 +4490,6 @@ pkinit_get_certs_pkcs11(krb5_context context,
+         return 0;
+     }
+ 
+-    /*
+-     * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but
+-     * historically many cards seem to be confused about whether they are
+-     * capable of mechanisms or not. The safe thing seems to be to ignore the
+-     * mechanism list, always use CKM_RSA_PKCS and calculate the sha256 digest
+-     * ourselves.
+-     */
+-    id_cryptoctx->mech = CKM_RSA_PKCS;
+-
+     cls = CKO_CERTIFICATE;
+     attrs[0].type = CKA_CLASS;
+     attrs[0].pValue = &cls;
+diff --git a/src/tests/pkinit-certs/ca.pem b/src/tests/pkinit-certs/ca.pem
+index 63d31c1f5f..6c782bcde5 100644
+--- a/src/tests/pkinit-certs/ca.pem
++++ b/src/tests/pkinit-certs/ca.pem
+@@ -3,27 +3,27 @@ MIIE5TCCA82gAwIBAgIBATANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+ FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+ A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+ dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+-b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMFoXDTMyMDkyMDIxMTEzMFowgacxCzAJ
++b3RoZXJ3aXNlMB4XDTI0MDIxNTA0NTkwN1oXDTM1MDEyODA0NTkwN1owgacxCzAJ
+ BgNVBAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNldHRzMRIwEAYDVQQHDAlDYW1i
+ cmlkZ2UxDDAKBgNVBAoMA01JVDEpMCcGA1UECwwgSW5zZWN1cmUgUEtJTklUIEtl
+ cmJlcm9zIHRlc3QgQ0ExMzAxBgNVBAMMKnBraW5pdCB0ZXN0IHN1aXRlIENBOyBk
+ byBub3QgdXNlIG90aGVyd2lzZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+-ggEBAM+lV5iaVats0yBFN4FBe6bovloNe3d0F9qMuhKqlECv6cFra75gSGmHJz6t
+-GTK8zITU7sni429azTZC9IQnUt/2lW8dWzpZD1T5Vt1DYvYFqVzjhNfzeEDK88ig
+-ENfzaX/cY2P76arJr0cewGaauzaux8heYW1CjBxWmk6kWq4aD+5jggchvBeOGEE2
+-NkV3MPbXut8fu+3NzuuIG7Z0ilwQv+KUvQ8QQb9VCwdsDh/ERsQ4loC9P4jtuWCJ
+-ikIE78GxDcOMoC1ftJtW/mBCS2iCHipXrp2BDDJMyHxZjHpl0VoDR7koWGtD3sos
+-EwUkXVvWIuKs432h2dXQ+u8HaBsCAwEAAaOCARgwggEUMB0GA1UdDgQWBBT0F6X7
+-1QRftDiSeNSY3bks3nK0IzCB1AYDVR0jBIHMMIHJgBT0F6X71QRftDiSeNSY3bks
+-3nK0I6GBraSBqjCBpzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0
++ggEBAJv9Sbc2QSbHWnZjk55JfeOdPGUsmKOcT/N7C0/0mOQq4tUCmha7ntpBoIJd
++UBDhMQayG3QHruQX7aogtOx8hoLoLUaNKgxzEZ0OLbDRMc2M+vTDpBROITGI1KPv
++QtthlS4ocqKvqBCze66N9LufzAju61CyKdB3pCykPrgDVVScfsZ1t2zCbK0SF2cf
++ZAdIyCLoGLeQ95/NL3SIx0CX9gU47AVmBkSQ+LExJRhbUSIg+puKbqJ0XVILR1B2
++ezgik2ObFND0hsRUS4v8pKnIDz0HXR2AneTESY+atjbzzelGA2zH86p4tLg0PanQ
++4x4+gpkQhzSr5Cmi3QX4XahSrmUCAwEAAaOCARgwggEUMB0GA1UdDgQWBBSSP/pz
++leX5zVcZ9hpI5GG2eQ+pqjCB1AYDVR0jBIHMMIHJgBSSP/pzleX5zVcZ9hpI5GG2
++eQ+pqqGBraSBqjCBpzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0
+ dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoGA1UECgwDTUlUMSkwJwYDVQQLDCBJ
+ bnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVzdCBDQTEzMDEGA1UEAwwqcGtpbml0
+ IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ugb3RoZXJ3aXNlggEBMAsGA1UdDwQE
+-AwIB/jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBT2FJVPS+U
+-0MXa1HUOETuUPrVff7VeIvyAPm9IgX1zNbCvktCc4d7ErNB3P5ng8aZz4MKqwzuX
+-HVhUxbF7JKfyUI41lcixPG+k+U9mzBJaozWT+K1OhdUF//mGPxaxe5jyUhDiQArD
+-/6vulX0/B+1iuIa1sCfoeelzqQcYHqhZdWn6bBdcDWNARHIXWs5zPeKA975+d5TW
+-rofE7T8nNQJvcZoVjCSfcYXhP82D/0sA+wPCt3fgbBZdvJ89xwvIlzBtiwC++Zbe
+-37Rt5av0+ykpR7nmh2jyG+ItzE73nYKdBrUI5J6JLSbUcQTw4jeXHwDULUHZ6fXg
+-TBEM2v1VW4Df
++AwIB/jAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAfx04Uqh0D
++myOR1PSqEEbMWJxZXYoESnjjH4Co4doceVBTuKix/2lplD4wcvA7aMXpmkvGfP38
++dPrN1jvGd4bi/djTuxab9qB7rOeswAt+NyVHReUmuIMwgcW1UD7HXErg4EsOMjGD
++2XGhJYxGnwdURmnFwoO3yLLwo5K+C4rqPm3PbnI3W0sCA+IXepQTxuXK3dSplMMm
++0Pejw3es2s3oI9WaD2JRXvFuylw4UWYX+cyFRb+wN55Gh0rPVdxDhKCkbWNt/gTi
++/DbC+5pyQXkmy07OEGrmh4+5ae9hwejr9AukF2IZJB+oFP4i1mt9xyAOXImnWOzB
++SdHD08WHl5Gq
+ -----END CERTIFICATE-----
+diff --git a/src/tests/pkinit-certs/eckey.pem b/src/tests/pkinit-certs/eckey.pem
+new file mode 100644
+index 0000000000..14c2efd2ac
+--- /dev/null
++++ b/src/tests/pkinit-certs/eckey.pem
+@@ -0,0 +1,5 @@
++-----BEGIN PRIVATE KEY-----
++MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgSB3T7ihe3JUeIKZI
++PCDqATKN/dNugQsaC5AKiBPC6ymhRANCAAQy0E88e1CX16/2wL2T+nE0pmlb7wBM
++0hOh6m3m2uDbVsAIRJfhEjHWsT2ODCoBvGDV6vBeIOUjE/Ro9EwnYBW5
++-----END PRIVATE KEY-----
+diff --git a/src/tests/pkinit-certs/ecuser.pem b/src/tests/pkinit-certs/ecuser.pem
+new file mode 100644
+index 0000000000..585e53d8c5
+--- /dev/null
++++ b/src/tests/pkinit-certs/ecuser.pem
+@@ -0,0 +1,24 @@
++-----BEGIN CERTIFICATE-----
++MIIECDCCAvCgAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
++FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
++A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
++dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
++b3RoZXJ3aXNlMB4XDTI0MDIxNTA0NTkwN1oXDTM1MDEyODA0NTkwN1owSjELMAkG
++A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
++U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
++MtBPPHtQl9ev9sC9k/pxNKZpW+8ATNIToept5trg21bACESX4RIx1rE9jgwqAbxg
++1erwXiDlIxP0aPRMJ2AVuaOCAWQwggFgMB0GA1UdDgQWBBR5MaRx7ub5YBwsS0CF
++Li18nsl49zCB1AYDVR0jBIHMMIHJgBSSP/pzleX5zVcZ9hpI5GG2eQ+pqqGBraSB
++qjCBpzELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNV
++BAcMCUNhbWJyaWRnZTEMMAoGA1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQ
++S0lOSVQgS2VyYmVyb3MgdGVzdCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3Vp
++dGUgQ0E7IGRvIG5vdCB1c2Ugb3RoZXJ3aXNlggEBMAsGA1UdDwQEAwID6DAMBgNV
++HRMBAf8EAjAAMDkGA1UdEQQyMDCgLgYGKwYBBQICoCQwIqANGwtLUkJURVNULkNP
++TaERMA+gAwIBAaEIMAYbBHVzZXIwEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG
++9w0BAQsFAAOCAQEAfwlONLYPo0BNN2NyQZM3wkoldvFqidcoZiYALOcBcmllMP7H
++XQ/+en4TmbKR0RUJN6AjR9yEo92fHAYOB2L7AzR8AkOiRLjp/Pdg5kUHFTdKenTK
++DvpeiJELz9chk/vaMv1T9qvOwH2bVAyS8GrUc5n0ui5F61PrquLAmm+dpKyHDY60
++DdFaebS2gYsmy4bBv0mgcMZ+ZXnzXYmLNtdVQ3SgVGO7M8eyCqPbe/o0Lw4Gz+l0
++xgpFkptdlEogsOaJBzjrgWyBnWw6MkyyLiSY+iOxFpBGkwCxi1gtQwbcp4gMwaxc
++p5+JPM/JBfglBX1lpRhhxL8EGQvpryN9MT530w==
++-----END CERTIFICATE-----
+diff --git a/src/tests/pkinit-certs/generic.p12 b/src/tests/pkinit-certs/generic.p12
+index 35c27415bcb07c479990133882655bce3fe3bd72..55a248137ca7b82654252808422e97337ed95a6a 100644
+GIT binary patch
+delta 2529
+zcmV<72_E*P6Mz&VFoFsE0s#Xsf(fz)2`Yw2hW8Bt2LYgh38Msp37;^637e53JAbV+
+z<eLpXK_LPH2mpYB1IPt%iV8Q7E0I-}`D$o<?klte7Wjf!6nC7D!3|8@4Z8`k9)PO2
+z$l>63K|{jPm6S=lRhUG)C?|)hzs!}J6Z>esz%vM91VoEu)Pmv^_jw4QQ*{P;%zdH=
+z8s3InWP5X2dL3JP%_r_AH_wr3!haB>cU&;sQHeY0h(*0{Urg+^g7yVKn`IE0+Y~a<
+z<+xCb5BfX!dU%zZc~;wYZFOctxMS?Ch*eD^8-zy8#7*(m&=G8Yhq%X1&fk&#wqvO`
+z<a3xT(gizFXiC1WNw(0eY~lhG&qEJvG>_dV6f%Lq>$}y?fWJ0eZbaT_3xCB5v<1XX
+zhesXP-h3le9uU$XQav@c@^ng6qjNOuTgo57tfg;nGUhmeDh5PY6l0w(`tmfVgVRd9
+zI*Dp$(4kaUY$_|u8*tJ)z~Krm!cf$))c$ks%D6w-z)!1oA_bqAdZA}A1PNl78+^by
+zVRwaGflgdSeO1RqxQGi;-G4bE0H%>kz6g9{O9DNB5M5tLz%C?ula24llm<KP{jwP0
+z)Sgr^plscXWDlk9d|RGGYZOujcwQ@AJy}z{lwkD5dN!y=^YN?(I#CCwlT45q)5i>}
+zuabL^!h`a+uPu%ySk>~=QyaYKaBuM-cq;N~+Yx$45s+L!{%M=B-hZOqUNh4<T!iF*
+z`%?>Z-0?vO-hD#{!>=(UZ$|e*T(Ppu?Da=)T;Z(vy(zB2AS5Op(0bOE%ijXo4T48j
+zaWpTAg-^G1r}2Wp1*k*bZcWwf`iU-QS;py!e2L#5(1)IJP}}evf+~Y&;L^{uM-p#P
+z$CG)Ic1TsdW7ZAj_<zbSp{$nxQ6w{JWfmy%2ofpK70HLCdP9f8G};GRr*qOd9OUX$
+zTCax~>9OvHhVSGr5Tr)o_wWooY?lqp0j8d)wxI&i!7%mWDC=nXromP*=gpE(B1cq6
+z@&j;>({0S<2hI|cciYPo@g%a*p@w1QGgUypb46QUs!RVP9)D=_dWE&lLg-u?xw~PV
+z8h$a6Har0<@wSwfG;mYk()2u9489&2LgL1C(X*xX1j1|82eY!A`42Tp_64UG7SgBu
+z%wrY}ctA8@Orn<bCM$71W|=~s9uU74hc2L(XsYP|`h;``)>_s)L0sRiOYhfl{V{IX
+zM*Nb94b`ZcV1L~qp38AGXFWP*5hp^{z@{c)LZAu9VXKJ{o5DhRdf!Y&dE}=hwC#io
+zYZtdIiA~U5r(Up^;hSx%T>+Jy<}L55P1hamg|^{b1f$(AuO#g5sY1S!!RH0q+MJHB
+z4KRWQga!#JhDe6@4FLxMpn?T;1cC)|FoFebFoFeX27e1GhDe6@4FL=a0Ro_c1u-y!
+z1uZaF1_>&LNQU<f0R;^(N-!w~2`Yw2hW8Bt1q?781PIvb<@awST7Uuq2mmk)1_&yK
+zNQU<f0tp2GFdYU7V1`HmWdj5ODg+Q>z5YzW6GvH2i8WJEF=@#Jf&|c95Qocq9uI_J
+zuEKYIs(<f%N1T177XU0V*s07M&RQ=vS0B}$reFDd03;ZPqmZY)#|`A@k2u7DJ1FU_
+zCQ1N=!88mq84xFRSBs{|ihI-er`uLb;?{;uSh!|y!^?aHqG>pnOmNhS39%39z*|>!
+zQn!$n2&<*PQxpN5z%hjmlZIh7OhJBIERDLutbco%u}C>L6m-jbjU`E0z4N4hv7qv}
+z^<lFFBR2$l96BrkSjjgx3iq7V9V%3HTGMlO8fx6bd-SSD{W@RC;_;8{THyvHAx1Tv
+z91(Z+ttLT?$Ilad7j!8mC}h#%8II46r`<Vk{{xs%@CRGk&0uempW?gLnRRLjB>8gz
+zK!5#Z(o{x~w1P9(r4Li1M%kTWTj4<uwD7pk3vB*Y)BZEYIc?M_YA&{?nTN#VM@k{x
+zF|CXtC*@D%HUhXaP*{go8l$WBPzV?zBh`<;4?Cp91YR2z^&xAjDOfwuA_)}0J-B|2
+z2jj?Jz1CnC2s8pOuaQ*iN&(|p>^9LM>3^D&+%>&>Wli9sfvq8guK6okCa1xutOKr6
+ze5ic%+9n`|zI{F%*l8Fr;ljDGAvLV0jf_)^F#+Z_s_@|PN(w%P!=LYJK87-dtKya2
+z-ou2tBdt^%>*Aqa4Oz$fR`pK-Kt1~8U({s7fQm9sgMRC|HbAW@!MkNsf<n<#a({*_
+zGsl<Sy=@9wWibHpBk(d@1TN~%veYd2;h~5C9LcXsdct@q+7Lu_8+bpvzLEMEd&oo&
+z3)OC4eZ#&Hr$zT~GThxF&G+^Vm?Z05`*T@;4B%Ay^xW7FJ7cbK(HIh*@%lacdZ>z<
+zs3^xE3`}tjOvaZ`mTy27G6T*&3x76}mvTS&uHM)V*><Tjevw_ZB!emgvpS%Ezz9>8
+zLvM!WSi)FK>L5EKYmVS=wl>j?$b4-)uQ5|+rMxsUIRUb~2(_i}gtCLG(Lj^DK^6HR
+z9|Bvq^{Tc`3RDQ#EExyBL%EMeJ0A)4WmSkOXqfGF$5-3gA<;I^%nD!<^?!uBBky_h
+zDtHZ3Hq?a{K8#>eqP`A1yryjk_q9*A{X2bwX11sbz$$Y)U2w$6y=G^r0u5K6r-Qq$
+zh<kirXZ_+fdDpND;6oCWl|X6IhD%@X>mU#{eAbmCy5=l7y`BIj6sdNhVHC%_79bPl
+ziqj1XqSWmBQHa9luW4F^7k`C(;)-1%xig{k$ZRTikT+J#^4~y14n$+@8>ZlRhjX@X
+zGv{`|4XV@GM}bVDI$XXh4edI-nqiEw2@N*ip5xg23vTl~U@sV*_`HJxr#5B4$dV6v
+zj=|^1mfn3wd(>scr_%*luv9D=!6_Jf0%mi@W8$z1!<aX^Q=IZL>3`<@lUmc73wTM|
+ztMxU2wp4lXT+wF?cD6j|rz=JhmfCBD<A3FdmoDA#c}S{%BA3|RmpCUNUDBiCToZGR
+zp0oXZxy$4wk|4YZUIoZ14i9~`Yl!4>Al-Ij#Q0W%F$P)3fwn}<2+d$G9GIQzMh!YN
+zAmjmBVsnk6AgHmakbkjQY;aSX$`ujO5N8damZY7qviDEls~HZTCkILT#rJxJnsB*n
+zR>-H**-OEFgmF#KsXF__e;4CL7kK-*wNi<+Exq~-VcGD9%`qh~BL)d7hDe6@4FL%i
+zF%|?A!W!(19gkH}sK#VEJUUJdl+OXWFhMXeFbxI?V1`HmWi|r@0s#d81RywUr<O3v
+rUh(j1BB>7PU4+J&7;H`yIZWU8rteK!mx%-j>llc3<F@HH0s;sC$t9a|
+
+delta 2437
+zcmV;033~Q`6r~d)FoFr80s#Xsf(d5^2`Yw2hW8Bt2LYgh30MSz2~;qG2~d$DJAV~E
+zshs5PmWu)c2mpYB1IXvCTFy<(!A}P2?C_GrZ7&?M$38}6R<ZsiNZK4k;%3qlYW{C!
+zheqNlHGy(xi!bxM{pu1Qvd_`ruJYvQKV7B3Et$ZMeWTwbUNa!eC_Mt+p6JRlpCzZ;
+zJlk{WV8No&{x?u67)@@Ax6I4s_<zDBK<a6<9q|JLzS|2Te7C8*X?|5MQ^rjsSVTo2
+zyZbvzTC5~>nny_xmpD&=el8<hE1;skAKrc=&B!?tRnLSVuK&f<2)Mrls|C*v`V&V9
+z;Qm@$BNj%Q-`ri=%&Zdcv$O(ED>0aE%9m{fV68_AYFzhm@kKP%T=aiATz>)K7usww
+z(0*{b68eczuAI2a3uHsb3Zn_F)9~g+LCvtun(x>N9_kuVVuYlA^cxgA()Q^}p{@VX
+z(<h<^7%{^a$hTIARW=JhLO8NvfJK&EtIo~<PWkh4jGx3DHwLJ-53pU7kw5h}+t=&1
+zCfC<+M`ys7PlWrQ5<bVRS${?7{$JoC=c3I@eFSH=<cTwkUQgd+k~qb1O>pQJ#h!L#
+zvT%~2SR2lMq2|uvwt-65uo+g%PdM+yCR*0d3<~^2SWHuSkyu|U{2*phDUa6z^!f#K
+z&e!gf!i)wC0}3Cr;t4QJ>qXxqtd29tYZ!QSIJXcb1=)#Zz@NztpMM)iLM4FN{(b4O
+z7;Y8sDSuKgUUFZq^5D#5vcVSW7Jv7Yd(aBQZLxL`TMK);Odg}Pn?i_&$%=^rbRuT)
+z1@-3i4P15rwSp}Q52aT>>NISAeYnh|qF(@TkGZY4j&#|GeCZ}Hv|Wo|3Ildq{En?`
+z33W*|;8`HbhQf?M^M5j}nDMonW~5ihFn!pqa@$I}d3&;S<v}pFrB#1j&MA>f_zYJf
+zK3966V3l`s?KpMq7Xkws7rQ0uNx?O)nr5OZ&sjxPS8n6V!bbhl+S`tADP6n()KD|d
+z-4;CP6oPK*x2YwH4h?UM!7FQ+S?s;2-TRK1t94vz+%<~h=YKH5b;L89yyIr-R20Xh
+zS{BJAi-^$up9m8hh*-25HX~YLbxrHdA82beU_`X^W`y^J_2X$56A1j~=kc`==Z_+T
+zu7n}%#;**bdW+$vg-Mi7)lR@16R`>eP+7#cXM{AT8(O1C6<8Jjm?oO_Dk+uOv3t&g
+zP!zO+$`Utaxql8|%C$?vj}~CsWJnUybmONs+6V!t>=}LX3`Ea~#O_UYaY4adZ=6kJ
+zWazr~1Ui&-TH9eCh?b{xL&MfNVV`KjC{9Nh#fgY%F57NeV`~Z=1e&f>y{fZPK8Y+&
+z12BRGIR*(ThDe6@4FLxMpn?S|1cC)7FoFdlFoFdh27e1GhDe6@4FL=a0Ro_c1m-Y;
+z1mZ9p1_~;MNQU<f0So~HFb)I=bJ+c+ptRD20s;sC1cC&>xYm$0NS^prVcA%SO0uwo
+zHTQ=?Wn+3w3*FrDC(OA-<LkQjQul;b;&~?fK+1-+cYMKuQrA8NHMP>xz1k4gg0%e7
+zE|<Q|?SG%=Ce#pZFi3gw(DsP6a?pdfM#ar#U7dRMJfk=*65LPEI^A*bYR$sX3)(24
+z;l%ZZl4E>q{bGT1^9c;Po6)t2QAoislaez~##_3so3$~8c|6ThDA<wM;;I05!NRYa
+zT0xTJxJivb^4XS~Gehr8;1gt-83yViw6sc>LVuQ_`csrzZi7niVJ9&B&mxm=-<O_D
+zOWHeGb%U@V8S^l<&921j!8>_q))60k=1>ymZmg$D41NgWqT6$()f5qclF-{owN-!(
+zDNM-9lt=)MEIj|1m8It)GAoJ%qaW@RZQc!WT>eKQb<cj6hl<Ew+_^2Zy+q4|0K{RL
+z1Ap;ZBC{}y4eE$*70h>xMSU<nFOexT*uag%9YKk#j-ulwXEOK-v_IdKUH4F4A!r+l
+zn5>wCCXnn=J7dW==)=q%_QmbS-PsoBVmQ8#q>Z^57uw%&$COK#CU_J%s^HpCp-Pso
+zsVG6ZqD#N95LV4&Mw?3o*)hrMz~EOMuzxqgdGzSOzDoDF?Pkop!&U7s;C7a9@Bi+r
+z<q9eAdtpo`g>p!&vTiAsBFWBiz9fh!LHbIQHHOQPIy8weJzOs7nB3foOb*z7OelAz
+zF$EsP@)6NmCAs=uFa;EVKna5xx0wGC#1`kHKO_2-y{6nHp9b*qZx8n~sZv2}KYy=9
+z;~-}X`6hf1FeQEp+V1&}(%k_e+XYC3sTNhk<2T!iAyy{PA(IYE9GAHj(LQE#V91#~
+zMpN1OiY)j(O~~5A3sooGn~qp$_FCm)P6?T^VJIP^FO{K4O+egG1sF_F)0>`OQOio4
+zjE6GDi!3W7g|OZ^<sIvh5QW9|aer8s2t0laIp%o}u*)=yIY2Qeab{8`k{97flkYWS
+z$tU`zeO0R&{IGzSD^iH_>z;M7OTLGbU+pY!hzrsCEIoUkENh3X5HhDb9>|ytO0Stc
+z@^I;i)OpS<Vpfge<}WK-b}mSC2Sz7rWBm3lsMa1W?C6MhO&)G-=r=rJ<bTmsqY`@A
+z6n@P1<JTa$q3&<M1OJ`YOevnTZGX*e=~b-t6wj{$j8x{0)1p~K-#wfglI;vuaZm7%
+z?sWU^3>|&hTxBQ&rT4S3nmdg~fDy@qjnF^LgIQbKcXMGfqm}?RX#B>Gf;lzxO}jM-
+z^t@NcdY7+{Q-)q4=Ko$b^?&x{b!znTkhh!0ERCBt;t0ez_1?u1D*pnqDZ~gg>wdj_
+zDezCIv8*1y!-2=uWr$XJ4OSw>q5$^1c@yM?IK-sh^c19jqpxi*kgsE^^W-y_Nejad
+zd3khp1|E-OCe?G*$q+&?|L(>VjwhpmXG}Pxk5vO(Qyn{y81;~`)PL~7xU*N-!)((Q
+zs!t34$4XA5po!lQq66@%NADy&c}(Eg2(@_lQp3?MRq!|?PO=AXq;qSylg+*;=831x
+zV?Dd^3!*hvgv4ud@Ta2hPE24|C@l*$Kh8kG4%2x!jBss%!yz?NiaKJR*V?l>TPY!I
+zH_XRAWAxGcTje&~Pg*f0Fe3&DDuzgg_YDCF6)_eB6wv3{Iz-K-_+dQJ5g?!#l~?ug
+zDljoHAutIB1uG5%0vZJX1QbP$4lejcX32OA_0p;gH()NMq7(!OS_-~il6^%c0s;sC
+Dy-<?g
+
+diff --git a/src/tests/pkinit-certs/generic.pem b/src/tests/pkinit-certs/generic.pem
+index 55ebb3dbff..dde7f31a70 100644
+--- a/src/tests/pkinit-certs/generic.pem
++++ b/src/tests/pkinit-certs/generic.pem
+@@ -1,21 +1,21 @@
+ -----BEGIN CERTIFICATE-----
+-MIIDazCCAlOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+-FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+-A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+-dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+-b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMVoXDTMyMDkyMDIxMTEzMVowSjELMAkG
+-A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+-U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+-CgKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtrvmBIaYcn
+-Pq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE1/N4QMrz
+-yKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOCByG8F44Y
+-QTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiWgL0/iO25
+-YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNHuShYa0Pe
+-yiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCS
+-OTfZununxFDxuThhIFDWEZ9p2qSqTrxKtKx4CDvdckz4kaKybiNZTW7Dlh6IwWta
+-60eq98WrMHXYlSaN87r95lU0ug2RFJh4uLdq3a5NM/daIIjO0Bo86oC+8EBM961Q
+-mCMe7dn9ngFK92msdqO+wfpAfvhSpBPtAjQovigirheiEoER/ov9t9/3mRi5OTkY
+-8YfKT/z6XJrnOUIB3AgCdGyzSRvWLqLrbh7iAFVrm6Pq6D2nNr+mE9r5u7uFl3r8
+-QeDgp0Unwd1ISWTHZlrP4bq29w7y2O+/2KV04Og8z+4zoGD4nRinuJBUdNqwAXVz
+-dz6pXFWgLRD+9ddI5jB0
++MIIDZjCCAk4CAQgwDQYJKoZIhvcNAQELBQAwgacxCzAJBgNVBAYTAlVTMRYwFAYD
++VQQIDA1NYXNzYWNodXNldHRzMRIwEAYDVQQHDAlDYW1icmlkZ2UxDDAKBgNVBAoM
++A01JVDEpMCcGA1UECwwgSW5zZWN1cmUgUEtJTklUIEtlcmJlcm9zIHRlc3QgQ0Ex
++MzAxBgNVBAMMKnBraW5pdCB0ZXN0IHN1aXRlIENBOyBkbyBub3QgdXNlIG90aGVy
++d2lzZTAeFw0yNDAyMTUwNDU5MDdaFw0zNTAxMjgwNDU5MDdaMEoxCzAJBgNVBAYT
++AlVTMRYwFAYDVQQIDA1NYXNzYWNodXNldHRzMRQwEgYDVQQKDAtLUkJURVNULkNP
++TTENMAsGA1UEAwwEdXNlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
++AJv9Sbc2QSbHWnZjk55JfeOdPGUsmKOcT/N7C0/0mOQq4tUCmha7ntpBoIJdUBDh
++MQayG3QHruQX7aogtOx8hoLoLUaNKgxzEZ0OLbDRMc2M+vTDpBROITGI1KPvQtth
++lS4ocqKvqBCze66N9LufzAju61CyKdB3pCykPrgDVVScfsZ1t2zCbK0SF2cfZAdI
++yCLoGLeQ95/NL3SIx0CX9gU47AVmBkSQ+LExJRhbUSIg+puKbqJ0XVILR1B2ezgi
++k2ObFND0hsRUS4v8pKnIDz0HXR2AneTESY+atjbzzelGA2zH86p4tLg0PanQ4x4+
++gpkQhzSr5Cmi3QX4XahSrmUCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAau8fw4h1
++hp4/gp7l+AXvq+9E/a2y2Np+H8BmlRIg8ZLyKjRR6iPjcUwFWUteSSBsFzcc+/5V
++/Qs9gAW4nRIb9zY/sPO3KMAjJGKaP3u8xWkrfVZzaqPkfOWa5RDkh9AtvpN/fVLH
++dC+hC1xlXtjJ/YugJD6OA66sxdyTjR/v++0mqaTQyTI29HqtTc9LUcpbC1OYzxS3
++8vlZZgieRU0UlBvpsR0AqCaTZPgcrIvJ0EVIk6XzgOWJAptAe3tFEVrHtZJAQG04
++TI7NN/zw17O9Sn8NVEB4RSw6CFZeEVBBfCZL99HveEd8WPU0zgYceuVl/UCpQFNi
++Av6/+n+/6KwHXg==
+ -----END CERTIFICATE-----
+diff --git a/src/tests/pkinit-certs/kdc.pem b/src/tests/pkinit-certs/kdc.pem
+index e46afc177f..4f7785854c 100644
+--- a/src/tests/pkinit-certs/kdc.pem
++++ b/src/tests/pkinit-certs/kdc.pem
+@@ -3,27 +3,27 @@ MIIE4TCCA8mgAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+ FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+ A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+ dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+-b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMFoXDTMyMDkyMDIxMTEzMFowSTELMAkG
++b3RoZXJ3aXNlMB4XDTI0MDIxNTA0NTkwN1oXDTM1MDEyODA0NTkwN1owSTELMAkG
+ A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+ U1QuQ09NMQwwCgYDVQQDDANLREMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+-AoIBAQDPpVeYmlWrbNMgRTeBQXum6L5aDXt3dBfajLoSqpRAr+nBa2u+YEhphyc+
+-rRkyvMyE1O7J4uNvWs02QvSEJ1Lf9pVvHVs6WQ9U+VbdQ2L2Balc44TX83hAyvPI
+-oBDX82l/3GNj++mqya9HHsBmmrs2rsfIXmFtQowcVppOpFquGg/uY4IHIbwXjhhB
+-NjZFdzD217rfH7vtzc7riBu2dIpcEL/ilL0PEEG/VQsHbA4fxEbEOJaAvT+I7blg
+-iYpCBO/BsQ3DjKAtX7SbVv5gQktogh4qV66dgQwyTMh8WYx6ZdFaA0e5KFhrQ97K
+-LBMFJF1b1iLirON9odnV0PrvB2gbAgMBAAGjggFzMIIBbzAdBgNVHQ4EFgQU9Bel
+-+9UEX7Q4knjUmN25LN5ytCMwgdQGA1UdIwSBzDCByYAU9Bel+9UEX7Q4knjUmN25
+-LN5ytCOhga2kgaowgacxCzAJBgNVBAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNl
++AoIBAQCb/Um3NkEmx1p2Y5OeSX3jnTxlLJijnE/zewtP9JjkKuLVApoWu57aQaCC
++XVAQ4TEGsht0B67kF+2qILTsfIaC6C1GjSoMcxGdDi2w0THNjPr0w6QUTiExiNSj
++70LbYZUuKHKir6gQs3uujfS7n8wI7utQsinQd6QspD64A1VUnH7GdbdswmytEhdn
++H2QHSMgi6Bi3kPefzS90iMdAl/YFOOwFZgZEkPixMSUYW1EiIPqbim6idF1SC0dQ
++dns4IpNjmxTQ9IbEVEuL/KSpyA89B10dgJ3kxEmPmrY2883pRgNsx/OqeLS4ND2p
++0OMePoKZEIc0q+Qpot0F+F2oUq5lAgMBAAGjggFzMIIBbzAdBgNVHQ4EFgQUkj/6
++c5Xl+c1XGfYaSORhtnkPqaowgdQGA1UdIwSBzDCByYAUkj/6c5Xl+c1XGfYaSORh
++tnkPqaqhga2kgaowgacxCzAJBgNVBAYTAlVTMRYwFAYDVQQIDA1NYXNzYWNodXNl
+ dHRzMRIwEAYDVQQHDAlDYW1icmlkZ2UxDDAKBgNVBAoMA01JVDEpMCcGA1UECwwg
+ SW5zZWN1cmUgUEtJTklUIEtlcmJlcm9zIHRlc3QgQ0ExMzAxBgNVBAMMKnBraW5p
+ dCB0ZXN0IHN1aXRlIENBOyBkbyBub3QgdXNlIG90aGVyd2lzZYIBATALBgNVHQ8E
+ BAMCA+gwDAYDVR0TAQH/BAIwADBIBgNVHREEQTA/oD0GBisGAQUCAqAzMDGgDRsL
+ S1JCVEVTVC5DT02hIDAeoAMCAQKhFzAVGwZrcmJ0Z3QbC0tSQlRFU1QuQ09NMBIG
+-A1UdJQQLMAkGBysGAQUCAwUwDQYJKoZIhvcNAQELBQADggEBAJZd7v5ZOMs8Y3ht
+-Kmtql8rKs0Jee73gVHYw3LXxJfHjIiNGdexxuWJ6Hy9gFnfwSco+15HP3MxMBkau
+-TKo3i1+Kwf+lc7gIZ0g/CEnYOx2smHGd9yGudWypunYLjGWfH/2M8/Wu1gZDTxQ1
+-pNMQZ2pPLL/C6c6vYpVQJ5cA0RSh/SC5IbOESUpZaFFMYxF5TNz+28/lDr/rN41O
+-miklos6cH5EkJyI0WUqJMk04HHjREl/9RTak8mo/eaqjUMTAOyweSwpaYRCddBOo
+-y1ix9yH0fSBib1+WQ3MAHZHgbgVnu7V2GnB6qMNqRLHoGa03x+5Q1X0QuKxP6iYo
+-9tiGt3k=
++A1UdJQQLMAkGBysGAQUCAwUwDQYJKoZIhvcNAQELBQADggEBAHGR7TUjyGt7IbqD
++MW/MfOkLtvpv1f3MhbRSmYDweGKejh2xQIONC/BlaBA2RWmhJIYTdc8wPRlcC76D
++2HLhBmGyOSy+ZTX/txGhtXm+xzNuhLF95VKDd2Z+06CMe1CptH1fvnf5YaZsUgv4
++nXmRN2i4WWrVHoWsAFCcEM6PqT9j/2485DbjtmoS7nVNvO0UKJs2vGgZYuxgYQsl
++S387YJnSbC3/VjTHGBh+R7oRZ0cBvpviWyp5Xak0kNcWAUSu3Oa1FRYDz6Cw/r7/
++wrTWxMA9W3Ygzeh+JFpYZkj5BNrwFem8UxrM/g2ZvXVS81dKGfA5spEZ/cEsAkU1
++8mWgcJY=
+ -----END CERTIFICATE-----
+diff --git a/src/tests/pkinit-certs/make-certs.sh b/src/tests/pkinit-certs/make-certs.sh
+index 5284f42599..9fb3e41412 100755
+--- a/src/tests/pkinit-certs/make-certs.sh
++++ b/src/tests/pkinit-certs/make-certs.sh
+@@ -116,17 +116,21 @@ extendedKeyUsage = $CLIENT_EKU_LIST
+ [exts_none]
+ EOF
+ 
+-# Generate a private key.
++# Generate an RSA private key and a password-protected PEM file for it..
+ openssl genrsa $KEYSIZE > privkey.pem
+ openssl rsa -in privkey.pem -out privkey-enc.pem -des3 -passout pass:encrypted
+ 
++# Generate an EC private key.
++openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 > eckey.pem
++
+ # Generate a "CA" certificate.
+ SUBJECT=ca openssl req -config openssl.cnf -new -x509 -extensions exts_ca \
+     -set_serial 1 -days $DAYS -key privkey.pem -out ca.pem
+ 
+ serial=2
+ gen_cert() {
+-    SUBJECT=$1 openssl req -config openssl.cnf -new -key privkey.pem -out csr
++    keyfile=${4-privkey.pem}
++    SUBJECT=$1 openssl req -config openssl.cnf -new -key $keyfile -out csr
+     SUBJECT=$1 openssl x509 -extfile openssl.cnf -extensions $2 \
+            -set_serial $serial -days $DAYS -req -CA ca.pem -CAkey privkey.pem \
+            -in csr -out $3
+@@ -152,6 +156,9 @@ gen_cert user exts_client user.pem
+ gen_pkcs12 user.pem user.p12
+ gen_pkcs12 user.pem user-enc.p12 encrypted
+ 
++# Generate an EC client certificate.
++gen_cert user exts_client ecuser.pem eckey.pem
++
+ # Generate a client certificate and PKCS#12 bundle with a UPN SAN.
+ gen_cert user exts_upn_client user-upn.pem
+ gen_pkcs12 user-upn.pem user-upn.p12
+diff --git a/src/tests/pkinit-certs/privkey-enc.pem b/src/tests/pkinit-certs/privkey-enc.pem
+index 29d2f3d38c..fd36246ed4 100644
+--- a/src/tests/pkinit-certs/privkey-enc.pem
++++ b/src/tests/pkinit-certs/privkey-enc.pem
+@@ -1,30 +1,30 @@
+------BEGIN RSA PRIVATE KEY-----
+-Proc-Type: 4,ENCRYPTED
+-DEK-Info: DES-EDE3-CBC,5FFF1E71BFFB65E3
+-
+-p89x5YEL+Mb6IPZXEkkr0KC4Wj+JtgE3VKdTT0wEcRD74QVv+dbbZt62WgmpJtId
+-ph0Ial2z5Mws8L/aTkPdW2H/bEroApLu4TfUV+w67KcWgrc8gOg73d6gEObqx8li
+-qGbs7FC1cI1WfDfnNOnCbD66e5+bTI8fDuchaieNRqzROd9RHhmlBHgylTmf55us
+-laGuwLq2cZk/+Xz0M8PPx07uauGkAK0fyfifn/JR3PsGsE9s334osVQMjbjyT0VE
+-rm8HGm3PvZHHDUnkOh7AGKyEtsIa5fJAULUjugp2lQJqOigC4HVn8a33xfLI0F1+
+-2nH9MZ+Ap1rtI1cJX8CDn/Ij9oFt01scLxynYekYej11zFiR6qHC0sspxu0Yi8l0
+-puBPXCI0GzyF9I53ukjGeibTtssz5yw1r+2oVasR4bvfXczPjqTQCBsPSUayNNhw
+-RgT7k4QTY2OlrK/5XdILBzBlsvfndXgGOwEDw4YE7PMzMmz69vPMK7CfedUqtuXq
+-bGBks58tzeOa4NSfVDOuFLI+LMkoYWMSjPGD/I0trX41xCU+O6PZOnDyt5ZWl1Tm
+-klJpsB7rUcwsP8d4w4QGhyyV6Mo2MTlnTILr4CwwvmDMBch3yzwbfKdeywsFQh0S
+-NMrG3aYNO7csRRTD6aGvYcBCbavWq7Ujsb/fV7SOIS26f4VEqewvOFlFEXm66zaz
+-GJ0IcjtNHYNIIIW4690djxPqlGgbIZTblBSBlT+iOW5HrhXvrLeMmwAPxInU5dK+
+-ypk2MGc4SzemkDi8H9jDW3dwbgcvVD9wn0glhVLQKWvP6F73UUdVEXMCZ+960xnR
+-gxeEwDdIpzXNadWdON1kRbqI2KesRY/XQErGHDOvf2gNSM9V2gPz+5humvcu3mXY
+-r4537On4+IdzetEVtI7D0slgojs+jN8waigpkLFB5RVl8PnzblMuWOkHNA86rrp+
+-h6wNqv9kHLgPjpAyB1l/7w4VqXLXeC4PdaGc2fcpdNWOncUnHROmDmYvdTocqhIF
+-bAsEFV7QZoTgDB7J6vLsmbtfawtHMSb81V/wTJWRrtY/gJCrkJXR2pTYAZlPX6vK
+-aK7K2NuhJFMnrQD+kxsrloSEyfsZmHtk0mAVXJw4wSxlH3eGQ+Jphb/M2wtsnWV1
+-w0fehxL2Vd5SyBBctAGhUirhRngbOO/E8IioymrziQ88vJZs2DxvbuNG4WKTuTwj
+-CIggXohCNKdqrwL2HAynm2FVEWhbKrQwe4kjZc64WjccR4cy9vv+dxFfrKl+vZ1o
+-Wvb0WXND7fiSBrPo7OfaYM5HjrcvIRP1AtMuArhuQYVARmawUG0l7dFLN97Rh9M+
+-Ud9vBIfQYlubnTGVVm/5xrUh2isQbp2vrZLfMrUNXMQm0vSxKgGkAxqNUuklJC06
+-LvCtEWMYXiBmB1zP4khwCHmHB+/E1gHBAutCzhpPu86ayEtNHBHIFkqKvZSg/UuZ
+-+ygDdTJV00I2neIdeQcyG+vPg6huIDIHpG5u6eQn5sLqVkhr+apeNcskMWpdkpFS
+-Lo62KUZDR3yB83ne63c3IGex0hWhVojJOAxykpGp6OD9uFn6Xn7x2Q==
+------END RSA PRIVATE KEY-----
++-----BEGIN ENCRYPTED PRIVATE KEY-----
++MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIBw7aG13XYxwCAggA
++MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECPWyEPoKz4WhBIIEyKHdx+pkDxax
++dCCUZHsJ54boZxh+7f7xmO9Rjm+6+3cE+WCjPsiGHPUDtOXLxWwcrG0RAmA1GmrE
++yZbclwEMF8LcWQ3EUDMCJXBs7CEtA4XDH+EW1KsZwP+cA53ZFFikGj3sW6Ix5GLi
++Df311Eumhp3GABU57siNn+tMZJAorInth5lXBJFQoE3KJbBrSN9iQKZTOpgr4G3B
++G+qzBwrUKnZrGIp42t8op4VkB8sA6xoHh/huJB5pNygt9OZUQ+xdxvNQq+5/kJ2I
++mP/JRPSuN4GtnNA4fBB6tPv8t0L8hActkWlQ1rSJwWnWge3t4r5/3FBcAbl+zq3k
++t8A0LWgjsiQRmlKRN7GrzorOUKFv+7YAq6rc1Ek79qitUgEiFkwZZySt5+yPstMW
++vpaq2V0yDHf5Ds9uXffprhSAjnfXdT4NTg5eMeH65OEedUpVVzHauoGfFkDGaq8L
++8XgWPZPaz6GQFpU5SGk8FZn0OLLJHnHQDYo+ViL2XSuuqY8Jd7fmpzqVoHOU8k9Q
++/ONKW+E6uvkpNH6NbknceA/ip1bcdfwA/uRBckXjCc5uR0oB18M4UQPuKlcGev39
++mcdlvzQJxl2EWbB8ULazzuzOVfCAEwKc96qOkDAY94CB69f/KhBOd2QqHzdxrQ+3
+++K+YduhbfP49Vxaq4NIklS/kSSv4GEBHzEwtFxX4oqN4Er+UkBSB423nvlkSLd1g
++tR4M30lJyzmHtOEpSOZYLakviz36ZOCV/DsxrfziNG/0RB/mPLm/B5L+StqjJrTY
++Pjo3QHKb+6ShhTi+jZ8tqXa68+TZO3Q7eTgqrcn8mq9jfama0KQF/13kmUsrFXTS
++wk/nbSP10z+MhO68z7o3j+Q0Co/cXkQke4slvc3DqLNvpQdDMPLKQVxtkPBq5czr
++dbk5K2GYFLNWO5Tv2RgBGomznoAGSolz5ozIqxffVHAK4NGfhihgLO/6GujDANVz
++EX/2/IacRg0L0x7//O/GHomiFvWYnDbHhRNicERe/ji1TCxJ5glqntFjOXDumwi6
++f+mQWNWlQWtKq0IOnlHrBB+vqykAj+e+FROqJjuNI6hu4CNnrBK3Hf+NY+rXdn7l
++iCTD3ojdufqo0JDZe8dXea+B7Zu7WNAxnpW8D018DJxR2hoBvT4Po1CBaHLfxAkT
++ZGeXMjp1vZ348xBSppFpIpYjFRQBeBgSezzA66o3YIcDeHu2bTzg73DiUXNgV3RG
++OyJHmsOmN9Gax/Cx4z6/Ff7seisXpIMRU9TDrRCFKAcPHXAl3R4L6guK0I5OGwz3
++GSMxsx3PGitj0x+1ynW/Tf+EJQD33ognc+kuQfNL0XW2tNJoibZIs1WgdbDwD9RD
++X7rbb9GfSJlQUnBFG/EKU7SGmFZUVMz7we8vckZ1PfeIKfH7OWrZ2i1WxIF2WO1K
++BX4TXp0KKt+aCwf1GInQ/6aYgh5g8W2iKuz2HJeZIN+ohciNmpOynsFmHGXdbvnO
++Kw+msZEQb5AvhXf4ToiSwZLSwq3qAILN8fOQQ9ta1DjJuUtITpe6ys9xhlnriUkm
++KrY50GkimLdD6XszC2uNulAuh3o0nZplqxC9IOLh+uasEU/+xqtwTaaYBljTpH2C
++8FPAEFFUVy6lsngJEQvdjw==
++-----END ENCRYPTED PRIVATE KEY-----
+diff --git a/src/tests/pkinit-certs/privkey.pem b/src/tests/pkinit-certs/privkey.pem
+index 007b6275df..2a25dc19cf 100644
+--- a/src/tests/pkinit-certs/privkey.pem
++++ b/src/tests/pkinit-certs/privkey.pem
+@@ -1,27 +1,28 @@
+------BEGIN RSA PRIVATE KEY-----
+-MIIEoAIBAAKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtr
+-vmBIaYcnPq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE
+-1/N4QMrzyKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOC
+-ByG8F44YQTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiW
+-gL0/iO25YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNH
+-uShYa0PeyiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABAoIBAEpnKYMR0h6xyNjo
+-VGIpT6BYB1UHPbVo0N9Ly6TCoIqpPe5DioDVyTye5A4OQlgu1G3ISqPme6478ApA
+-ZZMw7/42QgdlknnOzbKaAWkZK02Sa8RP9hrXL8CvuDisOjzXCHd7RdXevzSmPfsS
+-5sgdK3YFnKqMPwbCcKf61CHXvHJjWGuTIHIRh8P7gJelA4ahO0kYQ8aRXv3ldquO
+-ukSI5gyk9CN+aAHqt25kEmt9oOgk+8kfKpnk+5gkOCY2YOFDDckD7nL1VIIrDxwG
+-SmU598qjVwycDairWUY8uSuPCOLgbvDM9N8cERDMsyNQL63GE8ZZyHZsJ3Pbwdfs
+-JVHh5ekCgYEA/CwhaT9D0WQ49GQdeI7aqazHEYDmqPdE2/qbmr67tPMZzX8AAk9j
+-r4aMT+oIdtIMPdoQNNcBP6NYZLlAoMbLoAzHmWJnF5/YWLnS2Wg9OuXUOBn3jk1l
+-SWelJfAKGeBld5fpSLTdHjRAwJrNCX+mc0IZIiEw2IvGUPgKGX08bX8CgYEA0swx
+-xCDgvfoaKueInw/rUIcKxrSxK3pDhaR01Dg2pwSo7Vj9W01zf33qe+mjma6+U2SB
+-fk+/O2VXDuEOmVDLwvp6PkmUeRE5PyH7urTMEjy5ELNGiZd9zHoG/zJnRgPwTjuW
+-yguvjVGJwI1IvmODuA7Xc7iHFlvGNuxXZjPkS2UCgYA0nFxoIdvbTsaXLl/7rAow
+-xixOGY+GBvil0HYwZcSxrtpeRjXRRZDtqOuTLKeRaqdFLD6fV5AaH9EsSn4STQdk
+-n+XwuVf61M2FTVeRJi9IH3UUM06zsLAGDYqmDJt+5JMmzVnNYnaTe6FazbEjXy9x
+-8oNd3IDdXOQGNomc4cT+rwKBgBbABOr25Wp7cJGK1XrdO/c/69DQNYLMujbVLeqt
+-enCCFz0uaoGNFVcAHutqpsZyToYvha49KxVc9Y1cirfPOX58i+7nAAgk7Lm8kC9x
+-Tcj2Fr8PqiA1YlVMIi8uoGi1Ch1XXwnFQxgMYcKPPPeXQ+L8bxJFKwcltnm8/h3A
+-ofXlAn9AW6fYZLSzOfNQTMnuukhuAtZcEW9NlJHbej305zK89J66S8wroQs5iOla
+-5GG+S4YaZh5sVGw+mnS+FCw7cQCUk40kXwX3yTrxlX1qGSCFCQnFdJow+5NVg4D+
+-dzDKzniH71OZZFxTqiiz76XxiaW/rS1uOfP/WSVR9NBLpV5n
+------END RSA PRIVATE KEY-----
++-----BEGIN PRIVATE KEY-----
++MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCb/Um3NkEmx1p2
++Y5OeSX3jnTxlLJijnE/zewtP9JjkKuLVApoWu57aQaCCXVAQ4TEGsht0B67kF+2q
++ILTsfIaC6C1GjSoMcxGdDi2w0THNjPr0w6QUTiExiNSj70LbYZUuKHKir6gQs3uu
++jfS7n8wI7utQsinQd6QspD64A1VUnH7GdbdswmytEhdnH2QHSMgi6Bi3kPefzS90
++iMdAl/YFOOwFZgZEkPixMSUYW1EiIPqbim6idF1SC0dQdns4IpNjmxTQ9IbEVEuL
++/KSpyA89B10dgJ3kxEmPmrY2883pRgNsx/OqeLS4ND2p0OMePoKZEIc0q+Qpot0F
+++F2oUq5lAgMBAAECggEADwzB9vY6FPa46KE01dm7VqGN+SjzVR24rQIbFkzAD4t/
++tRN6MGVLrz0TsmA0YFyJsV6vvWMcYY9Zc8eSDRr6k1i5PYxTGT5k3aVHjT6xsmY+
++tCzIANmE5FWSRnrIFYh1ry1h2gZejbXzYeT6TrvdIKOEepWl6SIR6eiy0Ggp7G7C
++SjlpT96ZtdE2RnlvcxcACtwhe3vPbkLmTCOEqeZ6LHCHIHiK4KdJgJ08OjU7Kgsr
+++vmnwTJsH5s0b5IIznfWajO4JNOpqjzFDjDctGYBwp5xF4zu3u4bKe9aleM0q/jl
++ZkibxLsFAh3Xkh89nxr3E6oBLm0F8r8M7PK5wpMShQKBgQDAipf6T6XUY+ugkKw+
++301LyoAch6WV9oT6uOJsAttmcUpUr6NXhRT3OM4oqyYsAc5JW2wbz+n6lED3j6Ez
++QEKSIFrYpjrYr9D7hqvISI9JT0PhVSPXECfifEyIR9xmLvV9WQq7NRCJMi26X9ab
++Grqpw1HNlPA/rdcc/dY0p25DlwKBgQDPZqxSnwnTa6X+r0UdR8l6kc9VuESotpbE
++0ziF222bpXmZ2GKiEU1buFORHih/e3yDvKvq+p2apyUKnEEVQg/TL8/Jzya7fEOI
++lTXcNQ/f78ef+nwEAxdRVQkWXFWHvvKUHm1rGCIY7zeOLnQ9JjBQkgG8zhUamAP1
++owLBBTstYwKBgQC+yNX9Du0HvpbdfF1g0025OwekvXiDV0m/UnHxiwcxxDJeJceZ
++0mHK8nu9apGha4ynvbIrAOMdC8gwRh76NMOCHhNGt7h5vAU9Jt2S0OtCPgvJ/N5N
++nVGYJ4iCRYqLqh5QvWlXxSYEfDc5hPuWp26tBsBJEDrbLnuH27JkbD9jMwKBgQCM
++f1VFMw+I9WehvEHpr/PA4H2/5/A7ClXgR+YGZ7s8sUBLA9btSyNIevnBWNi+Y3za
++ETm1GMkjNw9UvL0qFXJ68eylHXtzjp6BK/MslZWHcfudWCYi4aUuJ5jcWPhn2Oaj
++iGk/Hz4Z/hN4cee0dOZN7lrW+BQ7y7cC88at00lfWQKBgQC7YeW02aUPw9jMJh1x
++lDfBh+E5sdRwRQIvh3BuyTd+m/LI+3b9RSy+LIL2KFJucwKm9zR9fy33tHF2S5En
++Q+inhyXfOEygal5Rzxe3Pfx+pGZbzr6IXkhquHtjuFBwJJCrSeR66V2xDmzJfCj4
++TY+CzwOJ/EltH4ZjPwEmE0S7+w==
++-----END PRIVATE KEY-----
+diff --git a/src/tests/pkinit-certs/user-enc.p12 b/src/tests/pkinit-certs/user-enc.p12
+index 1cc3aa3da67160fd9298b9e2d624a80c5225245b..69780bf82d1452d5dcac91e5be550f5eee876583 100644
+GIT binary patch
+delta 2892
+zcmV-S3$yf%7U&itFoFwY0s#Xsf(sf32`Yw2hW8Bt2LYgh3kw8-3kNWQ3j>iNJAYJI
+zdvzN7hNA)k2mpYB1u&JU7+xCwe0Kqqz8d_+6eNN5bCxnq;S}(P;s|YSOhpyniUDCM
+z$(1g#xF>v`h_!Z%^c0Yt!ew3_&P4(J0{#(<etH>9L7ePjfyd?bB;_QXFR7CVbnjKE
+zff_LH>L^0?(6j~#3lev>bjhWkNPqvbKN_||)xXx>C4@AfTFlZU&lEHPKi4d4nj{f+
+zP!qS+8ibCntvC-FbX2Bh1;e5rJ^2HAbUA`MID37ixE)(i7Ff}3>6U!A7&UF;M}TrV
+zs}FygKNP+*;c1FU9mKlF^p}|GEw>3l&8?f;h5;kVci=EJL){2P?KXfBQh!XdFp%kd
+z*Ocb%wx_0U2R5IZ6yZz5d98E>a-~6_Nzx7S^X30+Efi5p^xb?~9+l&zoMeqIyzty9
+zzsz@?=R*_{cx2I*TK8_AuFLy??NA&|dO~=b>}Z8gy-$;V6$A;>=0#FrJ9Jh^u8)2W
+zt?+r<V+wu-wnBmreY0eyPk-vN@Qx;9=@VxI@lWe;Aoeib<)H;5DG=s0euJL+Vhp2;
+z>I1Fh%@eL0#j)BLG)A3wR#E)w3fN%6wZm#@DhR=+YxKGK(9yT*!=-Ns++Ssg0N3T2
+zKq%m4iv@P~LQo^`Mo(vF<$H-+DTiQc__AMQ#@XpYeg-&|lK+0f`+xn?YDUnk!*m-S
+z;3?iZQ;n6bCF)Qt5(ITP`w+u&Ly;u}uQ1cMO&(bc!cfKO(a7W1_to~F^2+x*NgW)a
+zRgZ@G)H!U6`FfcAt1chDfZQqj=#<ngKv9*^d*hnNKev2_Dk2IL4dQwM8%_Sep^kyz
+zY<{^!sbs>Y%;epbIDezJsIK-L+yD*p{<_X+yO+c(edMB^wL)S(YO~>7lcBt24a8iz
+z>BqxgH5kvEzcWp$^y<Ik{vm(^^18n|IHb(t?HW|}Dz0Qr&qg=>>%zfu0v_^AWYG<q
+z+bRNxYQA)<?ZfRHol7Hb<w_k+1xrMgW^F=dxFa3R$8$rHFMrnTr1R+da)w3M^=}T1
+zyOqTh$!Gk+1uM=bLyA{ZM!c}?NVW<T1z#<vN9#&g*R7PrI_dtIb2(i@?|02z$wLhr
+z_A$@;fpNRPkbF>6ydYCMdBu*~jpcY$>CJvKJs_U)yy}@2<g90$!n6+9{=1tpTLCIk
+z!Aov~rOf^k$bV9Lh6PNGC7^0KGVU6{+BPy<yUx^GG?im&JW8@&e@;-l(~F@%Z?*#&
+z3-=#+Y1z1+`!sHuwk$3P@J#v7h8!?O)psh)h`K5?-VMWSzp4~Hct~FSU&`9Qi1>d4
+zseJR~7;BP{vz-tmn*ed*fv=l$4IYo;0VNXLW0o&Q!hbzT8q!Cnf0=w_#lXRiI)uQh
+zV%mHI&J^p_;AT_-H)BKz?DO2vN05+sYJzW4{Ma%7L9plT_fE45Nv3yqwF;+zhVQTO
+zpOQc^lLD9bh12?4t8>L1*vVNL%HEQGQ^g7Iqzw08Z-Z}ai+*rY33XP<cCi&JG9KT)
+z7pc$oAb;f2io=^>O~LIe+^&!Lx#pTd1JNYDu^}<Ot6`90<aW6HG+cMw5cL8R)_Oc3
+z<HT#1aTl~dRQg?UpoXy%c;(g~VPjPk;*7WTk!d9P7(}X$a!xB1o_fMOy;5aP&n)W`
+ziU@4aC?o=dZT7~<oeIz<WF;smX<-9N7q=b#$A5mR<mpGzlmz#fpT=EM!aj0>EZyH0
+z$TBU>AwxbT4nFscHMfohn3#mbtq1>m!CLz7(PkxiHtbu7bgqiuh(zg{?jAs}eZzI%
+zFoFey1_>&LNQU<f0S5t~f(3O1f(3Cff(30bf(2;?3o3?4hW8Bt3<?1Ppn?T4FoFdw
+zFn?DD2`Yw2hW8Bt1r0DtFewHJDuzgg_YDCB3@{u72$k)hX{67MkOBe-05A*&2r7n1
+zhW8Bu2?YQ!9R>+thDZTr0|Wso1Q7OWhVDa0j>1F2`SnsQsFehQ1kfy2Q!4<v1-<52
+zsQ)^m6J`Y4)G);M%p!(nL1cF?tvr$_&3~eFybh+j^dK%K)Ss!=kU}Dh#>pK76IBl`
+z;zFNdALdBbb<1BjS7BgZ(Uvwb_x)%e2gv`eSYyFYtolD-;4XL1$)~RR)=d7Pt9XT2
+z;H%o^nkJ=d$#!Bj@GdAIKg$I2neN|tFeWg{;Q5)7zZpSn;T1olS+KVY_lBjjwSTe)
+zb)VtP1PSkBMrT6Ioku_4UD?1eYXo!w@)n$E=yr0DHeN_iT)WQ6>M^o-i+u>O9PoIg
+zAGit!#=pHqe(^&@p}lf=ph>TGzR7daU+;xp<eRRK(MoBkuke*SThow~)IQJm%Pdbt
+z@T;pCHltXk2ox$_PVekrkgKxH^?zQoiiI!`C;~kR9-L%szRd?QD%qcs9_D0Qnju|f
+zg7}ENOp`kAo^_8;IU4x$vDV_T-qu!Rvg=W&ttV|aIZ1x6HSG-&kZ^m`)S=jhAHNfX
+z&LQATQ4?qt?VFt9{Cje!G6_>%fM56%$^@8^LiN>2W8{#gG*mrwrQTCXiGT6C0P}9P
+zs|HR1en}U7kxre1`Zf~z=zusxmp&0{@$79lWY4|Pg;*&g_Oe+p8NJOzK_L!6qxHN1
+z?Wo5%?qF-5mPXn6j1@^xU2U4-hu3KNU$R*4M1)ga?HW~OZ>B1>f>cal_H>l{EfY<U
+zi2SD9opqb0(UAF4Wwl0t-+$5_!a0^!$jV4a%2qgocrdWJBi;#W9jGt3jT16Fm%H2J
+z{TiklIgd5KE!$M&pUdvIx+zix8{Z`?3_(QRU^>i(x*>vJWha%>%~F<{Y3;G~g=5W0
+zNP;AzGh~ceJN%XEcgTUHj%>^4C#ZxH?6p$Mqsj%0UB(oLJ@l>MUVqg|)dT=|$YBt(
+zu2-yM-d8h1I*-*B1twRw?8)`M&%5?ZL)4|XXI)mEAX@=CT2zIQ?xLXZbZ=q$w|RNc
+zZ>3Z*V+x9d8*W<~L~B*X-R_HY{J-_qK&HaBE?`9LaGp#ZD$Om(@(Ey?#+yaX<RTF{
+zYDUpBP-cZ(7S9OUzJJrZDA#O5De-@z5_n=No&X=59FkrNI-mi$G5R(tmfkEK)~(=a
+z@V#>4a>b#%;z-;9V$w~Zhztczb-lw^6M1A3tw?M@RWNlUS#ne~ROieMk?E65E{^AK
+z7h#?hzu<-)YhJC=Yew$y%NLL*@kQxtPEqNegvafKM+CXxV1H3%kxZd0Z?KMjenWP2
+zDEQZC;eP=48N|TQyell~0OIZYWa1A0K=#U@plX6Lw4tVn=FBwtcl==!VhSZ>7a#GL
+zeLF|Y>4kb43XBgD=c(8lo0cmG5qOT1mNt)#aYl&g8eo(_C@x%x=Z0?)2V4r^U|~%j
+zwef5hK?t&1Cx5gs-#K!O$Fo6@oZR^_4{Us<zaz+0;<qGCcS{I^BfZa+<au3XYfj>I
+z_6exMhy7&>jRUy#zp9Kzw!Qn~s3Tj;OJ%7vk6=QC$ObT%xXiHLaQjioZwiaA<0ClW
+zwggOa)Wf1n<?N=Gkju*DxEqrH^ZHvu@4kV5P>mF08GoHj59|z3`)c&@iDicIM+kgJ
+zRISnBfo4M)P>kfKHzfzj!^f^60#?=KX|!FK2seV>)(=(-F(oh~1_>&LNQU<f0SOf`
+z76cSL%Ns8SY|*L*)~J|09VYrg#ub4uK`=2e4F(BdhDZTr0|WvA1povfAjpr#ert_-
+qvC0|KI3e63dyLWK@o}dvl<LW4m(<rc`UD73ZQ*{cf)PIg0tf)cL~wHe
+
+delta 2800
+zcmV<M3J>+@7L67nFoFvS0s#Xsf(p+D2`Yw2hW8Bt2LYgh3cv({3cN6a3b>IXJAYaW
+zkCdOgiwFV&2mpYB1u!3O<&^}aGBO*zs#A~w5-^3s&_cc&jq;YL57~y$hvIsVoE;K_
+z@z;j^#4S|l0+R+;ItHJprmPBs9a_CK@fJSNtw`GPWz{liz<J!1ehSY>2|+I@@I=qN
+zd*k07Kk-OlQ37X@O=rz$K8j9)sDGPk-J>07oO@p^2gA5p`z<R!9#~pZ1RFJL8vqdD
+z)1wIgXj0*l&_pbC$NaG6L1>!5za|7wrxe^F4OVF>Xh1Hq{RgYQb-)_;_0(RzORrqP
+zH-6>9rCa#pY~43l3lM}D^Of?GJR5SgvoXe*9$n}6%d~(8ikvS`(#B<(zkf$~%Lonm
+zNfw1+O)XYi?faC|BPm2d9_|?t7S{=Ai6*tpKfHTW$n&0tGKGpq#c70A92fv&u=zpl
+zndE=f^VVig+2W8a6z{qV5}E0L^?@yQ(w=_afPb8CzW<$heOh7oL&Bp!JVA(4`j!s%
+zx?fmOzd<+D;8wY*a3Q5ymw&$?>x3h&8^CM`GvEb?bI<46b@_<m2l)Pr45eI#%dA;M
+zz!o(or!@Tn3XWc+@kR!8OJK_iy|JnOg9G34f@+_yJo{z0A*Y{6!1n6CwqXl=M5D6d
+zIy=L(*VGxbMJ)KcRY%+*q?6(f!U%EJ3x~QUu`_yU)Z?EV0+cg<#(xfYa2G9afoFDR
+zxw9bYmTlc&PQ8G0(YQadEJ261nLR%b^&zAsV-XP|3q&`v@7xLflCi+!ncc|RTi73K
+zuH1!v&}DTI<=o6oP#J`cKkE=T&@Y4%R5u-=(z8C+vHQgW;ZG!Jl>&FrCy5mUzL7?O
+z75ZMcP~PA0fwL>T(tjNAt}i#t^{zcGAz$K1>g*LjbfwlZDxSI=f3@WTNBRvsniHoJ
+zrf`Aw?(*vKOp;T9&*{>E?K{SpwH17yQf5N|SCfKDNiq!E!Kg0z0xGTa87-U-d{!(c
+zOck-NH6ki*cGdv_BJYIDt1zG2GRSfp(v|3ukshay-y5XaAb(9oViC?Tq3k5i`Feri
+zttHdosBb8hps5^^GXj>(m2-YD;2H7o=p>1+rtl&MShE!M2?ed!cM9FV+zrx08{dcg
+z$P_4=1NVpARU=pkQzG@(0n8E$!qClc>?KM@^_=a-tr@90VCRgJK0TybnLc+Qssc&Z
+zXfn=HIBPvYFn<LXwl{}WXTBHvZ(1IJm2=Tx-*V&Ln;>0)M_`f4e;hA?uo%xSz0OeW
+zNFM_sq}piLP@uBVmRVni#!=stFR|Ks&x8Q}?A;OK`2ejw&Tj(Xhx_g=L!>2WVRs-z
+zGh6W&y&1fnPPNbM)lHyo;rWG^)bHE>E<DPztjEZmFn@trPVOC_K%z+$c*I7>{|PL^
+zqx$n%KM`zvAgWp^r!U~!wxypufmE8|);fuwpKp5XXz~8Je^dV<O^K0B`}v+UL^1NJ
+zsWg6AYq`WFIYm0s5JFSjdLh%ubE86KD9*XRrYXL@X)y;nh(OQ))7C*wMc_iLP4PyI
+zSV+{NeSb_oqr}A`gddd2%!O}u6lf0wv9qV@QsWS^1NEoTt0OT;pTlNPjy34!vqxJT
+zgxtwuc^`tAX=9yNtaiP|_92hyH;8B-$jNTVsek7pmE$68FM<=;nho~F=m_Ge|MWd5
+zsj?u<CvrHtmiv`W8@LYnN*b7ETC##%bYQm(e}AG&G^j;PIPAc_%}$a+j3D}~R>JD=
+zOMjqU-55=b#50HSV6Y3_+?CRuZf!2M)0P$P%bi%ACPtPF;+gqmM41S)bV{HH*6?l7
+zFoFd+1_>&LNQU<f0S5t~f(0rBf(0fpf(0Tlf(0H13o3?4hW8Bt3<?1Ppn?SEFoFc)
+zFn=5d3Mz(3hW8Bt3;_c$4g?6&=gE6qs{eZe0tf&Ef&{=dK-!Oe7<3snaGs)~4odWq
+zqtt7JVYy`^KLOy?8nBo}1B-nG$J5@jkyA_0j=-{cW1Fuyn_*p%j%W9fiAL*2&3Zz7
+zgBLaGySs_I7fcbR$awyRft5yupoYeR8h;F=@qK%z2Wy;((y7*{q{`3Avh-bIyn3qQ
+zm;(i}O;W`<OpgCY<_|vDj@Nj4FobyM)XH4X4TT7FF%6Z|M&~=hkRu};C8@K3UkGiY
+z6VUiP5+^|Dq5@UWTBk~E>?#%Ea+EPCb^EOHXH_=gdD)Xp+~Q2LY<dGM19NS9g@3qy
+z1RJ_xdwYxcllaTk+oV|nlLSd;#BI|#+~_u5ERIolN*w8@)87P<VxsHSsVa@ISF<#c
+zvMYx>2kYjfS}$1nj95o?56!tflz0;}d?$ieK^6&}s%L3Jl^~}=VgTY4GhW%*_#a|;
+zj@K33^y<y6?aJsE?QPOt=xu2(*nd2gjpz&%dK^{%Bf4(WK4E6bras%(RQ1M;*YTNW
+zaZeN)w-g-n@d{^WF`f2+U$TO+J9|)q;+b|1bYso<YpzkFicc&4D|#x1bOW6K3l>1^
+z<Tit&G^v;XJrXDM74zG#EmYfFh^)e+AcJ7Pm2?!|u7y%#8I0TM;6R(gBYy-VQ_`DB
+zHZ?aqgMTbmk<4gL82cG4a&ZL4fGH=KRyhU>K#A=G{dRZu_!rdMFb6QVMS(Ip`>W|<
+z4z!ekC+@j>Qjlx8(qW-9zHdj|;^B76#Ng{%EWjRq(IuJ6<)&awN4K+UwwNJ;UgX}E
+zcaJ_73k>u#l9eP;Li?1Szkl)Oo#2|EAHYvAy25&G%=FCq2i{a!yl36`>q*b8T+*;s
+zGejdSSpV~R13c(;mCzMMN6iU9ob!=eBh3r+awrj_y=yEp3JoOQx6Z$xK1o|4KRZDM
+zQBnXVwZ>=c$&42g?R^ZF45)g&{)y-{_@gyo?dqxX9ErtT{JxI*8-G*_P}pLrW-1E$
+zHaN5nvDs*jbx_bgcL_D@$4QnDKIv6ws`(`gn9V-+tiyc<cs>OjA@wP5X_WY$OELGX
+z5KUX5YQ@_olJG;^oZ2yRmCnEb1D`a+vxyqG-vy~yGiouy808|&S{<NS;wE7uzHR-J
+z`P7(Uh-6_09AwTpwSOahZdwq=4=C=ja!3eMEInJZ6EV96n5inU$0hq>7?MV?BdI~5
+z$r$t9jm4bXD^b)>rkVn3#X)v{8>DuBwKbv=IxjOWC+r+8lMwH&{W6*4g#n;<AG>A;
+zO4M7AXKtNumgi-Bj**jJ?fCr5H|=aBrlV9HN^WPkhM=+(yMNVi^GonVr&qU7AC9>b
+z49|BZN0T}tH2DM}@daN982O;;XiJbw%m1(>&0zStXTCHiqL~wKB?P27Kz?h){H&yT
+z0a6!f5zd}BisU?Bf9`(d956SlCT>3gvm?yLE<M&zQnc~-4<?YScrT1~;H4ncanYDd
+zhLiHS;2<{;D1W6>EgOHleI(q&4=!s~U)JFb`+L~}IiD*+*g0&iUOsbSGYgzb>NdTp
+zqqUpm?qjji{*LRy^gF1p#_?VHi4*L7pt_M9egYpb2L19^P%~?_Q6MTIso>1niUlBz
+z<PQ#y2Dc5=BM)Z5F(oh~1_>&LNQU<f0SOf`76cT=L`9(EsQ>XqJJ21=NG&!mOU3kJ
+zFflM8FbM_)D-Ht!8U+9Z6sQzP_9i;N@>ZIW53D_<h1>e+>;wo&%Za_$K5C!>0tf)<
+Cv^tIe
+
+diff --git a/src/tests/pkinit-certs/user-upn.p12 b/src/tests/pkinit-certs/user-upn.p12
+index bf47384a8a654fa77d9d9161c801292292ccf4ab..e91cc8a0c04869d6cf9d66f5b1b051e9f3f6ac58 100644
+GIT binary patch
+delta 2884
+zcmV-K3%m4%7T^{lFoFwQ0s#Xsf(sG`2`Yw2hW8Bt2LYgh3j+j#3jZ*I3j2{FJAXS!
+z*@zwch1miE2mpYB1t^994w-1MgeIP0Shaj_WdPD*<`ao4RB4%B;<L_U5J0ERoT_ec
+za!&`=yJ<obqC_)Et`+A7I#Z9tNpSoG49+@MGe#3%s_-uy{Y0a4NKV?|o|z_B6PqA+
+z4T-q&l^op;D)by;0e^YC@<YD-;(v{{P7F*td<A;(>1!qUi4&p(CDJ;S)D+_sG5VV~
+zQ$)uegg-)nY>J@=`X=55yd*|FF1h2T?_^$o;jzHLsjhabCH_1ucm<4^|1)>iEPp)l
+zr`fWM_jd&6^poG?mz%Xq#a40WKPFn(tA{`_dWfKHg0-O<52jv5Q93&va(_@T3CUj<
+z0WY&G7%<~VqQ@)3_!$**I?b)=vizO@^WQRD>b+MudQ}{)4vvgomus3Di-i09fLtc+
+z-@6;hAFAv$JCwV0#Qwkzw4gup&uc9{IQXP*mmZ3|aHIBk1EhHL{5PG-IM}|iqFq*#
+zTzie!)o?eYrcWJV8pynY)qg1cN-hb-i$7d|Xg&|At@X!`uGqu$VvXYj(63TzYiT*e
+zzW?uzBT%#jm7P0PLD3XAQq9F4uLwUsBh?d!2y?u4^5CNAf!qRUU$VQVyK#iF_TP~B
+z#onH-o7tzcO6Q^v7GcM`(gz_*e5VOL8@m5}KSnn=rP`yTs7AlY-G5#76XN2TW%<;|
+zGoyMDsL9-cF4Xpe-W5T+Uth$S-ql98cUnVq>Fu!0m}q&99V|Vo@OB-Jqh;JGF3lTl
+zvmeBJsI*#7V2pY%RTS&g!XUO!Vv>U!_Gxc&XQxd)6Vl|xvPV*NZcZ|!>8=+@_J^zd
+z9wjwHLS)!-9u#h@0DrRg5ix4vy>8NYpgnyo-c>t$;4lh^dK4cFHi5Db5SD*&_r}nE
+zb@WLfb~v1}6lu6hAY|QXKAGFH_e#O)?iYYb%+{9Gb~n3Lw910jG8+H1C+Si~eJNkt
+zy{Cn@nO?tKx*Jc2CypM;3C5Z)4>l}6nPzpM+EoUGx1|H;+JBOrINg(y!@Qtu+=tKH
+zmuO}7joP%Ttf`54n~u$-R@L^0b?dmZ8^S3-NKF-!Xh*$WxmaR*5M;R&u#Fl$H2hD{
+zwIM{B+CWT%(V?I^>Xtm<H|44jq8m@muR4ZZf)&!JtG#!yUmnYOl~5AU*pkCZXr*pY
+zcm|ip$pa}aLVpLqas1j8oZMczvwY8TVlxRfhMY<v&9(wg2=o}uXeGK{nGlF<e*$ZO
+z=@WmV@xtJ$MOIc|=M84tq}Kak5CR~9u9-4KTJWF4WpINir{T;8cDioD2-=Whg3uo0
+zS++hjWZ0=9_imeWvL56X_NUN6H~>qmeR>KDCIFN<A%8ffJ+SSz_Zo%u-(JCMlPE;P
+zZiuOt`)KY0Sre)4rX4!-hiYLTR`5pcLy39_WKeG%cryQP93X%>HWpyaa|`t$5m}*g
+zK>&|Ey{Z|rxBD#9Abq+Up(9cq2#O?&<zP+4XT#UV)^yBQIo0kk3=DZ@1kc47@|xh4
+z2k-1p%YXZ;W)Q(G2DKQjpC7UBg%jbPQy3m`So<yhGb~c-AJdSZ-SlH+O>gp~B8mu@
+zAhNB4+O5c#8OB5Wub0v^<EVCj#ik0THtD4Qe#V27NbV>LYpy+YvD>1~DmyCA^7g%D
+zFAAxaq1oCJ*#e;kqPUvQB?{$)UCWtFos<i9=6}p;LTmx8jh@Jah&`q*GHv_(y@SpL
+zTT&t&)Ure3#jx>&tE6ngi`#J(zz5BT3#jp;8k^KwF}Mx&M%q=hNf(NuFoFey1_>&L
+zNQU<f0S5t~f(3O1f(3Cff(30bf(2;?3o3?4hW8Bt3<?1Ppn?T4FoFdwFjoc%Duzgg
+z_kRrm1r0DtFewHJDuzgg_YDCB3@{u72-vC7Ai~I(V*&yQ05A*&2r7n1hW8Bu2?YQ!
+z9R>+thDZTr0|Wso1Q5U)0W`6LNiYv(7JIIJGrI(W1klCz!q3{|#X5KUyo}{Ke$8*4
+z&z8gsBnxa}BkX@Nu7*?GShxRsy(nf4M1NX$7U7f*_v;_v8QmAi1RA=90>Q6mk>K0H
+z#oV_k5pRI;GVQ3j<_i&6FF@?OiYbr0)nN~B0s-eZp5E>oV_kZd6{)+kM5N6N?Ld3H
+z)wfb0M94{)uRKzoHZUlqQQ{`<fpb7YG9-i_j70sW%E72M$v<>;zEjVeTbOk-Mt}G&
+z!k=6|Mjv480NzyfPdJIgH0@|a0zl$H><vLIlG0q~^KKJ>5Af0Dne8-zz4}2lHd!s3
+zxSf>)2GJi2L?K|q`h_O#om>P@(Vb=sW3vWx9xU|<wd2K<AwtVt#N_)wJvytTY;Izr
+zHmCq;Y2j`osmr@nN|{pul$qCUIDb89{{+Fq0~3p&2V(rx?0qWKyH;x_jmak>H8mxx
+z6`(10w19d!;Gs`p2)_<o|4pX6qTlA@HDl~52KaCtc}#9GIT>6Hl$RK`TEV!p)VPK!
+zaxWY{)O03zer|)d_jRj(krvwkkSyN(Nh-WRmF#Qp>Jy!6>^RCj-Npj)j(_z>y@QU-
+z@ZL#n!*Zsb&e&}8Rg@SJl5p|B7l(u1YJ(<UTa`_0da*t+R8qtg+4-2aIUrD`24~1;
+z&1#D?R%d5ZFR1;&NDxK}#>3tl-#D_t_yL08PNf15V2}X)#%GD2*o9PK3%fNCJ*_+=
+z%xwkK;lE=s`le+~$?pnn34dok-|t4dj=d{~HrZq*Li94h5LRg+?=$WT*{8sh(pWO;
+zx4S(^BW~+)O`Mt*c>{9;je)afv!lqC@}XAxj=mGhXt4NR2R;a7!SOWb$nSJCjeA_^
+z8`)x3k+zM~B(Pl+i3OFdw$_7b0uOA@8<-%=1$m2$wl7Ili8G<kbbnD2WT;Dpe*&XS
+z-OCc*0@ZYH{A|)5eDaN#m}wtGk8W*$&_Sy!tr{a?pfGih)Ko#gfef{uPJV8oYOGRf
+zM?h9e6lAVPM^C*a!u+M)D!c(pYMj+}i}097lcFg1nqa&LD8W~e?b(hFTJptkEt7v&
+zkm2|QU{Y({rwE=<o`3&doqY<(-MD)r66C<bt4)B;xr8)j33Wb&dFOB`KPbQl-Pi0m
+zM(3=%<irOFe2Fck`uUrt&ybehG)uv*ii_JarycTq?Ae+E=iryPOri)_^k<@Fi7X}@
+zK`OC@*{{wm(@JDydF1?7{vep;(94T?8A^(L)N$|qztT$*R(}!RkUWDNV<`-!T3J$j
+zUq#LAYZa33eTjcVpCRkK#EIUs1J6o!4f;O_MvUt8pTh`okhx4Tk1{j=P1>~0T{II*
+z)Mkvjg@<s8o7fqj*}&su#~`<DZ)Ok>Tuz5BIgMk9$ViI62{JqE>~?qz!0*3CZk477
+zouHyH@yBwvdw;FKYYH>yE~}|^QYs(;?8`w5)-WxH@SgoCFK<STdj}Lv6V+pF|B`Z<
+z5?t1VE~bj4XMj-JUI|w>DpSStZV*Oll+`gp<r4y;*;i!u)xoS`{JMW{p4*C^2Bj`D
+zeqM$&do{xSQK(hvDEVev!0&RC0r9;lzciQ|{U{f4oPR_6N8~4b8?lrXcE@<N=qoWb
+z-7462hBI8Q%lAt<$|~&{+o&9)do)Di4wbdKF(oh~1_>&LNQU<f0SOf`76cS?M=g#v
+zjJlE|lG!%}B{8krGU%)@K`=2e4F(BdhDZTr0|WvA1povf*(Tf#z@Uh)XWbN&5_h`5
+ig)=D^#u<@mI4Do1^rU5qBm@XcPZ|kX8BGrY0tf(JWK==`
+
+delta 2792
+zcmV<E3K#X@7KIifFoFvK0s#Xsf(pk52`Yw2hW8Bt2LYgh3b+J<3bZhS3b2tPJAeI2
+zXvsfvbx;BV2mpYB1t><5RG#b4BEJ^04G$AzyQk*SVS?I1uWrC}u~MGWb!KEd3HOLs
+z1vIdCmj9fXy&snurXzgb$5TcD!>K45?spJD`)LcPDS6?a;V`RNpkjf`EoBh??RTlK
+zh#hCXlH;295z7xk!RW`#2Q)Ldjem0>WbPylh7u9DMA``T!d19RnS;bk#uauLlP^WH
+zKr2J}sUw8JM}#iNO|VH<?#^LHcy5b(n=s$}hnK-PZiqD`B+RAoC84U4xT^?t8Gz&>
+zR4xW^b$*AM-mS+(-PO-kX_m@{K<)}Cx}IT^la`VVIVrkTV5%o6Ay#2R8Gm&i@n79z
+zMbt?rY=qLv@A2$}MWsJj7#)`LB6Fc>iB5mgaDRksov6|o?YhvA=5QPUwqt8gPxXm@
+zR_v)ai(Uik*bb`DQSA(I#xt|$#v~V3ot*8sDww1rNSiodn=fVmod!NYECS3>?B`l4
+zC9_gt>z615h!;`Y)47ErO@DLZp?MNZ_5Ff_svYCM@Z87f#e9llSG=s7vqkKA{x@24
+zAVHwi<bmTZ_R!?6VfPoc4=A^9Kvc))U6wyo^U*}k_TI1;w4cAGei&~-$LMA%V<pm=
+zTN}i1x!0KKY>9Lk{D(6=eEA%KS{p?QMBW;vLeF4d(a+;9T5J>N-hUruMt&Th(NZX;
+zg;H3BzJdyILh*xPTJA$FnWa>4#A|v2o(ajRc^g2K@{+AKE$`~-#P(nh!v**PJe7C3
+z5_&Y5eczza5Qm@ocj@WYs%2J6H1Isdq_%)2l)_`knW#8;tT=){0p6u<A}*TkT#Va4
+zlF8Mbh3%{Qvo2;*gMV)EmvCRX##p`cFYDHbmyX+H*{cCJwm+_U>FqfI#J^T298IsQ
+z>I$oO)gY?L%QiQOULxj$9;TxW2Y=Wjja17-rN}yw#1v{vNuhG1XVYTnq3NV0hn?>i
+zO}u9T7vs~SBvUb<YW!iy!b0c_dQ0oPkdDm<9|~&L#K89lJb!?1syip+fM?Mp?L4%^
+z|E`tD(uClz{{F!Ozz*fsSn-&cR{Z!kA5<u>7|BD&zbC>M(@O_=3VZdYIA-K57Xq{W
+zgEb$eyZnkRT?lF3gg`Yn;`GqP_vCc{mR^{i!AHxKO^qcyAr#HKLym1G=Weg&=3^|K
+z>rS<<m3BE|8h`N*9*^xvUcr^EuWRysA6(ht4kvWA@`cCPJDl@TY_)~Al}}(#9}SmG
+z)eyAI^^zCMw?#pQ>d`@~O{(9z`ZiTM?@dR*2yj!7Q3+<X*pbmG#WK912D3S_Ilr@y
+zmG@=Qol>L9Y=oJz<V7v)4uXP!S}19=qp(-LN;D_egMUtZis(H9^3NE>%W-V7M76z?
+z?R_NTw?*Y%k(hWGe-P+8Xyu18Tkzz-&8A65YgT>Eu^NU)aO;dKf+zvIh^!8ssUq`v
+zG>S>q@Zu)SaYQJydZt+TmR>5$RB*L2L)*Iql1J@C5{SP9k06@-k=3HjQN5y=Z!6>M
+z#MH3t|9_5JmWH8lzjUZp;8L7rnh;$az|w6Ql{t|{YprFA_j_1tr^r=ZC0<gj?M&<5
+zQIo=-WUiIy14{)*_PyH;Xqzzf(dS_aJE&Bhd>*U&Vlo(SJ1cWrAPSUH^wc|vrE)kR
+z?cXa(1TcEN!ANk0%zj|K^A`j$w&^r-JHUqN9e==jAPlP4|2}*i-^~N4H&WVuhuT%A
+z4NMZ<wjP<r(OmCxiEPR~+TGVfy`8}*Js9N1a3NK;&~wIwT0etyHUiLyFoFd+1_>&L
+zNQU<f0S5t~f(0rBf(0fpf(0Tlf(0H13o3?4hW8Bt3<?1Ppn?SEFoFc)FdPO7Duzgg
+z_kRrm3;_c$4g?4){%%$>wUr|R0tf&Ef&{?f0joUStwUh9&a46T=}L4X(YEZ)q{^&|
+zq_O=fhFO=twxQ)i)ictPugP1)@GE?0LfiE&BG71HBSVhv4uLQHv@U5l-RAD{8y8ew
+z$5lp>NU4?E)-f#wzD?C0;y)WCTktzeYkxwzZ6!-?eFHm^IZqD~<*I#5Nm>zFieKX4
+zO`ivDk`gO$>PnSjZ?5Mm(X-u4F30DqM2^|IdlXJ&GbBH20*}-6w#G^`AzC{)_^YHP
+zYZO5Hp=lJ6h_}SZDxfLEq+N}72EF?itd)kRNzkGDZ$6hI%(z6HFW0v0u%S(N#D6-K
+z^~oTy%zj-t7kvAJc2uses017pyZX<;A%Boo`8qmbTi-;1Y+P^ZT$r@+d$}-C_11}k
+zfrtB;5(a*fFE1)5s&uvNSj+0tb8mv+xa%9e2KE^w+Ijx)k2w}!L7tY$fzGi}k&=h<
+zHNO?Z#O9U!sJ_o|ao5U3273fijemRY*`f^vpTa)i2!~LXZU(As)(9D_7Y)|eqjCXJ
+zH8YOtem%7=RzGk|{=Hx6<)X^22cHo>GlVeqnJ4Cx@&=xW$QMPWQH|mS>K3e?{2A4V
+zo*wZS(hJ~<K$e-GVJIZ<B(Sn>bzc-m{j=qs!VdsL@a`-J2_N-Q!cSRq)_?OXZ9Cq+
+z&Ips&2Y!=<xv=h)CyGy6!X#1`Z<q|*zfqgwRt^JgwqV<?;bmt~VHch*X(#&y@w^`G
+z6BiifaLk-kah_3>ahQ?`+ayi9Cs0&Erow>HN1Zgtzvp0=9+&N9_eJYxc1dE89j*Yn
+z)|1D*i0XXN?4up^9FyflGJn%K275);(YWZ@?;KEO!*;z)*ooRISbfMiBQXq+%Ya5T
+zJ}?c3Bl?+2vj^j|HI<phOSsX*=`7)wNNsn-wD=p*inCiMVTsKRNWa42yYE&4xHbhu
+zwKLP?*o$x1wfw6c2RHYH?3Fb~`qgaQ!}!=#ooPP?g|i%d9kI7}GJlDz0|4T#oQrH_
+zOul_A?Ut&He=GnIkt7c(EO%p$uSo>{X2Bd}oimixhfqwh;U8G+h2>f0Q?OZ|!sc5U
+zk@CXsqV9GQB7#ZXO#_4Tn4C|v7<mCT4>d;I#TrGIYR-@TSyxZGTI(6;mbh7%m!`Oh
+zp?ib=*@9t{)p*Q@-+$p6e&>}M9yyg&uxh)h!YB_Wx&J(J9Zt>v*YcD7#86EfZ)P}{
+zCieiXHI$g@Tc?Mr?S&DO7lTDtTLZvS1~(hg>zX6ltsNC&M3bF!r(|O1P}3^VN`zT{
+zj0dB54PR&b<-8RtzF0iRs-tOYOm)n?zi-6OiEbwohaba|vVTXOL+zixO!r@D#@Cex
+zyX_Fl^JboqR&${ijvoYRRO~gCD7Uux+4z?Z4iEO6kyED0K!0J(j;{pWhDVT)5y02p
+z(W*ESKWz=@q+Gl;1SZiKkK*Ha*_1VSL(vd1!nf6TIjp87EpQ5&e%;PYJq4CDW2$Zw
+zs|Uo6aqZ?yK!19mroKn~4oT|Yj&p^PpwjvlPv)oF(oKp%i`YpnX`Xl;*rBO(B|=NC
+zcggoj46fA+7bww@VI%k0<<oC>Cb<dWFSaC0A;^D3DOdVvvatv(<pQgZk1^5vmU6P)
+zpmd2WF(oh~1_>&LNQU<f0SOf`76cS+b%)75c-)cnQav+Cs%|)niRIAGFflM8FbM_)
+uD-Ht!8U+9Z6cq)lQ&S+vLMX?rsW}cLIZhIuCIkq;C9&FW{m^s*0tf(Q%TUAs
+
+diff --git a/src/tests/pkinit-certs/user-upn.pem b/src/tests/pkinit-certs/user-upn.pem
+index 14a11831d7..7dcd716cbb 100644
+--- a/src/tests/pkinit-certs/user-upn.pem
++++ b/src/tests/pkinit-certs/user-upn.pem
+@@ -1,28 +1,28 @@
+ -----BEGIN CERTIFICATE-----
+-MIIExTCCA62gAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
++MIIExTCCA62gAwIBAgIBBTANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+ FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+ A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+ dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+-b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMVoXDTMyMDkyMDIxMTEzMVowSjELMAkG
++b3RoZXJ3aXNlMB4XDTI0MDIxNTA0NTkwN1oXDTM1MDEyODA0NTkwN1owSjELMAkG
+ A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+ U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+-CgKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtrvmBIaYcn
+-Pq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE1/N4QMrz
+-yKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOCByG8F44Y
+-QTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiWgL0/iO25
+-YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNHuShYa0Pe
+-yiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABo4IBVjCCAVIwHQYDVR0OBBYEFPQX
+-pfvVBF+0OJJ41JjduSzecrQjMIHUBgNVHSMEgcwwgcmAFPQXpfvVBF+0OJJ41Jjd
+-uSzecrQjoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
++CgKCAQEAm/1JtzZBJsdadmOTnkl94508ZSyYo5xP83sLT/SY5Cri1QKaFrue2kGg
++gl1QEOExBrIbdAeu5BftqiC07HyGgugtRo0qDHMRnQ4tsNExzYz69MOkFE4hMYjU
++o+9C22GVLihyoq+oELN7ro30u5/MCO7rULIp0HekLKQ+uANVVJx+xnW3bMJsrRIX
++Zx9kB0jIIugYt5D3n80vdIjHQJf2BTjsBWYGRJD4sTElGFtRIiD6m4puonRdUgtH
++UHZ7OCKTY5sU0PSGxFRLi/ykqcgPPQddHYCd5MRJj5q2NvPN6UYDbMfzqni0uDQ9
++qdDjHj6CmRCHNKvkKaLdBfhdqFKuZQIDAQABo4IBVjCCAVIwHQYDVR0OBBYEFJI/
+++nOV5fnNVxn2GkjkYbZ5D6mqMIHUBgNVHSMEgcwwgcmAFJI/+nOV5fnNVxn2Gkjk
++YbZ5D6mqoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
+ ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
+ IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
+ aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
+ BAQDAgPoMAwGA1UdEwEB/wQCMAAwKwYDVR0RBCQwIqAgBgorBgEEAYI3FAIDoBIM
+ EHVzZXJAa3JidGVzdC5jb20wEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG9w0B
+-AQsFAAOCAQEAYTW8tzURX2s8vuDawXEJt2as5q2MnvhUmG0YPIvK4n2fODkMW/I9
+-XENFhK8wwQJNdzvBUwXUXzEGjFcGPs672ZVzykRb7sAfGlNu1f15z0KrjyUj82oz
+-/gWoLwdYwZnO8jqtKjGtnLi2MeWjVCoiUW5ypUGwtEdcyZUG0PeRUrdrZu5cm+iZ
+-1B1exR4lepR1iSAPYTNhp5VF6T8BSLf2BO2IKTgFnF4Xx1vyZZTsY10mruZ8S1ZR
+-XiajBVdHkN1BpWWyFKt1BCt0dpRx9W7CihC3Ln9fBCsY8QA969EjRhszG2i09Xxw
+-0M6/UgIQRU6hy7QTlcmehDKY0zvVJ2/RLw==
++AQsFAAOCAQEAbe5/xDlFplE/h6BSqXSftjyiPgRlmPPkuTwiKHfmHYHv+KXHBDFY
++wuGDu4Tdh/qisskXJGoKYfRsOox6AW3ZTcklkjvVw0V73nPo+98USWYTzKq7NriF
++rJ9skYALu/Yv6q8iEoziOyDG55LppWne5KH0Of5ctikZVthxDnjm/saSR1lNa+8A
++gB6x9uid73qw+seg1/DoOdb+uHGnKBeSUrJC9vtdfodYdeatNFDDNoxqjGPajDNT
++TGI2ace2yZAgD/ic1MzI/s2eTHfzzO+puJIPzLScdy80RYMeILQs9g+x5NhOUuMz
++YMVFE0PAQLshVggtJ9l8fmHmrrJXP9BAWw==
+ -----END CERTIFICATE-----
+diff --git a/src/tests/pkinit-certs/user-upn2.p12 b/src/tests/pkinit-certs/user-upn2.p12
+index 69ca648aab9f1c5ffe34387459d45eb45bb04922..e29ff5412baae7789086283866a5c44bf2419ea3 100644
+GIT binary patch
+delta 2868
+zcmV-43(NHN70?zUFoFwA0s#Xsf(rr$2`Yw2hW8Bt2LYgh3iAYl3hyw23hR*~JAXN}
+zv)@C`|Azts2mpYB1sKm5FE99S3CJ?GZ7q&#p(W5pK0GRZk{WEvpMe~$gEqHJc~+uC
+zF+^`j013Tqb$ISyEK%E+TB|Bp7CI&uh;Fgpf%@mNNgFmv(tez+00y2Z)-V4TA<ys=
+z`dv$#J)$-+K5T-ag3cIi<Tg#Tu74rh4$Tmxy{RTg-}ATBopcR^@VZ~c)Yq$Wd?|8n
+zAgs0Ru}@~hj?1#j=nXQ>ZgIobWQ|@8X)gWKEkQls>5bGm<JD426e;Cd(&j?n5;#Qk
+zrk@vU2F+F^dF}03Hx0S;&VaC~N`polG!Sz^>j`vYHd#Y+?jX9h9+CF}@qc4jy(~E9
+zpC_weF&>28nIZ!*fA{&swafGQ*5rKdRYOSQdo8_GT-n@a>i2Yojm{FE2EOp-w)#9^
+z+aT%9DN95w(w!}IyA{L&Xyz6qPM(ESsd9zoJPs6@lICqC2}?Z4=_`B}1$DpDXlR6Z
+zSTB419!46STDltqpl^sfG=FbYlwneSTp_q?8}f)xbZ9{O9-Wb>tHawa_MLqYC|2J(
+zX)OGzDQLN~OEm}F`&j#osd(ZVMA*NvLxKFU0)G;xk^mpU!-s%mf}lN)*%Ltli!tr9
+zE2P3!^=Y1X$0i=iokHU795Xm8+ZSG3jrI$D6OR#Gi_?zXobn~Dh<^rWm1JEZEg?$5
+z2jamsVE$12jr9St4^>^4sZxh>LgApOHi}EckX77*F=0pDc-U~>y%iu+NFU#)8Rix%
+zj&nnj7M?bw8Alfcj!W)BJm(gb?6>s(XYaUQ_e0D;+psl*K~&|egZI(KmpbQq0wwT9
+zu+AcxvTNZN-+??(+J80aN;}ltl455DT(q0J%D+wlDj+y7L=8bgAq=WQ>L{sB0*YzN
+z^+)0y0b6gxGG?EN6$SD>CA-H2V0K*v!X1fNu4(}Oi)O+bk6x#Iq!&*=9o00PU5=iV
+z9MlzT!gs<O|0G$V+!}x?Q3@gH7l-1IJBLM#pUHZ=6x;aAJb#b*n)|?ReF5Q#OPZbz
+zhZwQxsBmO;KF$1pycbEZhBQ^~3NG&{a03_<kk7o2KpmT&m`fk|BI=*g^m$O&RS~Dd
+zrdHvR?R2kAXMh7}r*`?2Ok1DN%dvIJ5P*REL&||NEg_I&f3a)cDh9G=15;j-rSwMy
+zMfqEJZ@P;iHGju0jD-{008Atdd$4Tubc_X9^a^F9TSd!olKd-UsM8Ugtg;W9c_B6n
+zp&D;lZDHTFow&48O>3Lwxzi2AqC_9Br94g*UekyjX?7ZvMchRD&Y$WAyF$_0r*Rfw
+zziFU*CGJps%QP4;8Fg?z(0J};G!9N(iOJ`lZqJ1!R)6#f9>qS&!Y@bPO-Ok?W#xQW
+zfQA(`0ap?-cEq|o^9&yEt}k?4XkTLsZ#KZVcj^jx#{>xi(zUS;nlI2x9N{&<`LL++
+zcAEvFpE{Y%E#pxg!Od}^K)d-hGcmHExdQLw*v@q5`nes|RvFM|#ilZYbPU4$p^@y}
+z&z#I@bANa=I5gyY{59I)|8d1yw6UzTq9rOIjx8o9I;El`(POGpLu=+>{f#2MwaY_3
+z7^25e>dIDS{ZBt#ai!_n5yXH~^tOBhr_@$CKi44oqzJAHl}~@&t0VqulbPSEcBF;k
+z>2$wH5qqPbKawRqB4j9ttg?JOiH+o9>s|1qzke!$9d*3<Zn#6?h)=0TlU&j>;%M7g
+z29-{jz*kZ+Kcq{SjLN;n4Ber1K4yDXYzWr+FoFey1_>&LNQU<f0S5t~f(3O1f(3Cf
+zf(30bf(2;?3o3?4hW8Bt3<?1Ppn?T4FoFdwFjoc%Duzgg_YDCB4KPYDDFz8DhDe6@
+z4SxXz3@{u72=&k4)C*sWX95BU05A*&2r7n1hW8Bu2?YQ!9R>+thDZTr0|Wso1Q6z?
+zUxJolb~{rn@ALfyA$A0U1kj)Bvt1ZK@Ci6CVTSS$(6{2;mb9_6ogc%2c%FRB0Na)r
+z*%_E<-(<riBCaVc{u#|RCC%%+Gt!08sec;p!pOoa=(-Q>3CfoWq-JeM2LC3qAF09L
+zg{J|A1^Xaq=e<sM$B{g!>pb>O)~!z=%%-`<y6U6{)kS{VJtAHqKryUfQNUktL<5@Z
+zFqo?-`@*#0OB+b~+QK%o<EcP5YJc!m<T`NSk&fDEp4kUmiA+8*jlTwyEaCn3$A7p)
+zq%o$2#uS>yOXl3%PjAvF)FBpL%PQ8wTn<)p=DR)-dB<J~y$LVpUCxcCH35G(wT=J)
+zqG=n>_0il)sdbjsGpBc)#n@$o$#SnZI(Vvx(l2?*rJ%SpcdNjjQlrd=@Beh+$_|6F
+z8@Tz~KUJ!eZqW~?AV$XyLUVIO%YSv(JkC{tT#X%aYc-b9(YI*AI#<KirOg118fc>|
+z@MwIoBm5eV<Kf?<>k#W`oKz6qodHvmIS>8*z%=9UmJ|M-{*v1k`kwThPN|G=ssmY6
+zdlK$V$NK_C^k`Q0!lno85{Vus_qos^`Lp0zfxv(h17en6C*u(a08qe@1AkqVn0)b}
+z_Xt97qce$VS@%W<r7xc^*aPV4`3-!1hszF8)Bs90Uk&Ny0wD6eVPFK&j+;TIhl{F^
+ziJW`&v%*=_1x!{22IH1JYy)m2w0rFDHN}&mIoetHRJT{1RZds9f__Kp-C#rTW4Sqb
+zTNkbxsmu9JSeoQLm-K+>K!5l~<&G+JOPggXM5_*(NH(7lp8{Jpo+{LndeBBFeK|Qn
+z9UGVTdha8uxo_%X9MFciV&krC4;DpRftzbyI!nYxd{sPcCixi!0qFJckW+X*!~7dN
+z#qLCJS{#C^lb%_p>cE3Gff5>B7@+UaH2G|x!e5o5P%R%B6vqemlYj0D+)w-FeI>(*
+z0Z%64=+!6EARd(`dHMu&ZEii^ztJXgr@}do_>hq1`p{HS5F~=?zcN*LufsI<wTu*&
+zKx8%#DG4um-Y~;H^=S9eA@#4w(>udMT_~!-%1k2Z3CDO0m;OS8?o*&w56(0V%Y*=|
+z&6KdgoIuBBWarFK(|-&5b6I2rue5K;BNY@TV|7>-A62B=7|2=;u_KME9kfRGO7R!8
+zk!=M>VYHe3w$voveBEaD`6q1-Cq1zx1)QL{#hAICUqkOdQrii@<%vvEX91z>D9Io3
+z3%c+cI9lYE^hh^AiBrSmRh~J=uQ6BwGHyUW)6{>GMKCjH$A4cY;o4ZsWe1;L-{B`)
+zTrX5nB)#PSQGLx(y_o<iP`$)ITC2863xI|}Ox3WL5D*t~$QMyE4o3^|v*{s%bcS&z
+zwPZFtRxDwO4efS$U5^{yMnEt<NRRs@C1iUV%of0MV<^!2C>sNPd*Bwj48Brqm=*ep
+z7?tQkxb##(<A34NE=Me>ZQ^)93Wc5!#dewm80kEjmklRcG6?}+<?U#hj-_@{RHk5X
+zC-Ds;w>1z!$p^Jk2Oe_JMX8L;k`RGGFE7$_Hv%ZKPxRiZAvez?hfXPXwNwRuE|3@d
+zdj-&lv42j6S5hNDUC;L)_JH0QA@L78%wofg%ep^s#(#TzP%4Z8>ZGBHIXyyhuf+Yi
+zM3xX3mKikVT7r?YF(oh~1_>&LNQU<f0SOf`76cT){n{KF??v1$)!`?L`7h_-s&P>;
+zK`=2e4F(BdhDZTr0|WvA1povfY+(!i_~~rbp^C#yt5i7iN(PLf-J39FdDrAamk=e%
+S1PFt)bqU_LN^6M%0tf&&^grJK
+
+delta 2776
+zcmV;}3Mci@7WEY(FoFv40s#Xsf(o|=2`Yw2hW8Bt2LYgh3aA8v3ZyWC3ZRi9JAWcz
+zf~^6<D9i!^2mpYB1sMDodj3HjylxKOoIx(X)1vYQKP#0MI?mvod<%a5G4uDE_y0@U
+zAqOi}4d$$W8E6aQZ-~SC&{rB10B4^~O=x~hwkA+E8W()U&Fl4bKmM(E)xnTYs*?{V
+zYiyj6i?G_Gzj}qz3dQ2kmj>)AbAJ<VTRDNHM?+4S2hh;vr{_pQ(jzJc6sQ~~X$q4q
+z@Q$+6%KPgeBpxJd+4$~s<%!r!O?*kX=xLbu-)zl@>`;A0$m*A;RX;&9P-0dy)<6ic
+zG=h9$G2!QdbYEt*c?gO$3`@bOmrgFTNbozB-NlAbC*A{yONXB%C_apWVt=m9^0h7*
+z*?3em;(mZ;7{UgE*^=bjWp>G~J#?Y+fR&bKO<P24MmVqR+6)Pkfh_QA$zY4CC|2Qd
+zxp7&LWcN0UTg|x^1hmP{Wr~{%AIRwgxFRBLUWEol33yQFpl}_^3ubE~Ez?AM#<04_
+zWo_mLT{cVJ%FZq}(TPh`KY#oAIWQdIYtP1)cdg;A5!J?8<rD{{2ti6psvxMuMY`-J
+zJLZ>al3mkO%VC^-Ez^Tk8yxwt7m@$;k^;0mt_~ybp!1<G;#mT>yQU@#i`pO1MtTs{
+zHabcX7Ry$2vhmv`Raz3Nzo_aqaaVrklIl$iB97R)5GILb_*Bm3(tkzSOZ)b5IhLV7
+z18HncR{#Q20j`Stv^2^zY5kap#QcGe)b@%+qc}wgP6{)5*#!`fl6PU3Upn+Y_>xI?
+zfsjk#HF2&lV3}zfBU)o)!zbAoc4>XEe{teOdJ`-fdj_FqS(o2cJn=r>OJ5eFGs^UA
+zapCv&3$#-VW8S6m_kSVO^*h@>eY1IxY_S>As<^a_01O26Sx}H}kyWj$Cxaw<tFBBz
+z%0Ns0+hPihN2xUy8K{)05@Qga*bhn1UvII(jukS#xQ%~UvIOY+N@(B-#gT(=*-Id;
+z;f$f<9<CH^o6A6hU(}4LZ9c;&ow^Di3AhQMLlhM$3OF#!3xB&4QXeeP=IYpKk#IJA
+zAhv0UQkecv_eZ^@<gLVLUG#S`3%+eX)js+h(_^Bhq0Unq&f{M=PQz6|J|(pq^?S&x
+z5ghFdpqit=c{-gDZaHFaA71$rz<R2nOb9p2GS@%-&@-(tJJ<WM+nhU%{xhP|6^B?n
+zoAew&!k_!v{eKMX49R7e+k4sc*sX5BzVj0sWk`|~e117&!42uz{ZQ>Scc*|AAAe{9
+zE+JcamabwG8GPkvRP>l1i1{nU9ta}Wl71H(N-t0As?rI_ioj9#*!5o~ENbw6tO5hG
+z$96!&YHs%wueZBZZw~*KH!_B$eD!={Sx&YtHN9{DcYo_^N`ke0kAu4+P79utHa89c
+z)AD9LSXCcQk>ILDAq!Cfu$AR&MFu_<Q==mYd@PUy6XyfL16C-InLG*4xTNHA0Ik|m
+z1ctldAUwWe6}1H@9xnn<?ui1o1Zf^a?X33}<)LZO<)|ReI3{g(<~wMhM55*4VpF^F
+zB=jwi{eR$~9eGeG-6z-bcM(J-TJPp>)?2$ppSyA%@PB`#*g44cDw0%9-HQGd1v3Py
+z!ce6Hu^TKIN5~#rt1B%m&$NZYd9MrmQl4b$k2uObMpm28DcZrrFKb0Ttm4Z2?`Q(F
+zY^;>9Q8MHLYey(85vpj4+l32cdPWo+D)#OH>VIitq~FY;9jCJ6a<5avCVO;E08r5D
+zSG1l{Im&na{@&BN_g=`GVh&oM-8}MDDtLe6FoFd+1_>&LNQU<f0S5t~f(0rBf(0fp
+zf(0Tlf(0H13o3?4hW8Bt3<?1Ppn?SEFoFc)FdPO7Duzgg_YDCI0Ru1&1PJ~szxYR<
+z(|->F0tf&Ef&{<-evNXlq#YlqN^2`ojQQ9HmKs6}GRF+G2Q)*HSg$iMnU<^r9LrFn
+zxi_;d5j$8#-aZkrIi>3j7q|(a0XUem=tm>Nb}nNxMG>I*-+F&f%b8U(1IS|gXKI0z
+zFqNT6(Uj?AS^2AJmXzFr2W;!B{>^Vx&VLDIh>r(e)E6P<!w0SYw>|2-iR>d>%7cst
+z)|fk0e>A-5)~Ixb{jf)u9d~a@$;Ue2b^hwuq!?WlOW8*!jho)y!_O^q<UVj~f~HV6
+zog(FKnkYpFoF|fQhnefJt=MYlA)_0Gw)u%{nt00Uw4ImFmvxYW0eex>*bU7c_<yqf
+zgU>&t<0|Hy@G1@YR$7(n^F&19)$qXKz?Bqhq@W8l>{Q&u<#ZCP82KH)Zf>7(T?yuy
+zXGoA2<9<3(Utt;Q&~`^Cg8(aT@!^O2o{iyARMlt@BwEh=#p{5sNEwe>u@1xM!xTPf
+z{cjB@R6p(a@P3Tzkch>oX42R~BYzdsH}hF&%B1a4xaXUzQeob>0h-;WoL>f`C=2-_
+z+?HS_8A~=i`NAu?^bO3bj5;Q9@Gq7~^Ezf+@(rSg07VgwuECIbZu9FRm7ybGqUAL?
+zR7yl-`Mf>i#7>75pi=AqG=Igf3~}5q2<2ovXnup<p_VAebJHm7KE+s->woF<{75Ez
+zcV`RFb)ap&F4!IxgZ}Me7&#1xPecHIT$;Q6FA-BMHlMvro#iGlRxRNtMA?I}Nif~s
+z4xB9LTy+J=1(d(NNEkKNHx!^IF!m3CTL_mzG|Lm+qD#hqIO$qkUa<6w>vOZJ&Ak)9
+zN9Gi+Vr<uCK&p^(&^yehh=2U_@m(&UbpIQ?SO)9Xc;%<W;_PsztINY`W?t%llmZTC
+zquALH1bx>#_!jC`(#_W~`|?DPU%e!rq@$nOpuW~Fb(C(B{$pmqr(1<fNbeNy_S<HS
+zfXN*kMucnKF}lx=G%~FtR^?%+rID9Um$O_-<*pliDnSG;GVv|~zJF8EFH-;sm9sZj
+z!Uq<jw8_dS1b5Y-r&E~Y^YTPMVWUMI`!1jVC*;qI&8x{eOBygp=>4Jj*1voMah#X2
+zmbl}dO-0R!J+{rgTo_kufNZGxL%bD_65DP2ItQG>BBz|#;LGers8fS6-vgfP3riv2
+zIZ5_@26Y$`o!RCwn1Axwp*XLPl>P=SHk2ynIw={bF+x}_sPmTws$a&G)P=(L9xEf;
+zLPH|=&mn<~cDxN6=Po497XG1E?JW*UhV{X1RCR1iD1=jyWv0E3aE>pobEv=0<_32+
+zfoWJj=tC~)VmD*yV*N{+a=kfqsTn~yI}%5e#(gjwrk&Dk34dHu2g3JU_0P{wwL5KT
+zZ@2G(NB2WIg(L2M;cy}50ifkZ_}n54Y{8^Ua&N;Qj_?d(r3t?4b6YK*80jMHh03Qu
+zi&_K*!^0bGY=gwLu&4S_qj}z*{LmQ_iVGA~-#u+1D@-*0F=c?J48^)^MHR#YRH$6}
+zb>a!@^}Ar-RDX?L8!uaR;urhhC76Vioep{Xi+w@7ilod#-zzV7IhLo*t)6x^n*!>%
+z1_9G$)o=iRWiOWc!_9H_>^;Ksn0YIJakz9$%BFxPdh@PzCrU2PF(oh~1_>&LNQU<f
+z0SOf`76cSSbTi+QXbhs`Z!*V?s%i9Q)2+lXF)$%82`vT%D-Ht!8U+9Z6rJ3?9Vaxi
+emy~v{H@UIThGtFrh6D&{*p$#w0DTw&0tf))A1##t
+
+diff --git a/src/tests/pkinit-certs/user-upn2.pem b/src/tests/pkinit-certs/user-upn2.pem
+index baef41a5ac..b2d8c1dd81 100644
+--- a/src/tests/pkinit-certs/user-upn2.pem
++++ b/src/tests/pkinit-certs/user-upn2.pem
+@@ -1,28 +1,28 @@
+ -----BEGIN CERTIFICATE-----
+-MIIEuTCCA6GgAwIBAgIBBTANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
++MIIEuTCCA6GgAwIBAgIBBjANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+ FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+ A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+ dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+-b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMVoXDTMyMDkyMDIxMTEzMVowSjELMAkG
++b3RoZXJ3aXNlMB4XDTI0MDIxNTA0NTkwN1oXDTM1MDEyODA0NTkwN1owSjELMAkG
+ A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+ U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+-CgKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtrvmBIaYcn
+-Pq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE1/N4QMrz
+-yKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOCByG8F44Y
+-QTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiWgL0/iO25
+-YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNHuShYa0Pe
+-yiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABo4IBSjCCAUYwHQYDVR0OBBYEFPQX
+-pfvVBF+0OJJ41JjduSzecrQjMIHUBgNVHSMEgcwwgcmAFPQXpfvVBF+0OJJ41Jjd
+-uSzecrQjoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
++CgKCAQEAm/1JtzZBJsdadmOTnkl94508ZSyYo5xP83sLT/SY5Cri1QKaFrue2kGg
++gl1QEOExBrIbdAeu5BftqiC07HyGgugtRo0qDHMRnQ4tsNExzYz69MOkFE4hMYjU
++o+9C22GVLihyoq+oELN7ro30u5/MCO7rULIp0HekLKQ+uANVVJx+xnW3bMJsrRIX
++Zx9kB0jIIugYt5D3n80vdIjHQJf2BTjsBWYGRJD4sTElGFtRIiD6m4puonRdUgtH
++UHZ7OCKTY5sU0PSGxFRLi/ykqcgPPQddHYCd5MRJj5q2NvPN6UYDbMfzqni0uDQ9
++qdDjHj6CmRCHNKvkKaLdBfhdqFKuZQIDAQABo4IBSjCCAUYwHQYDVR0OBBYEFJI/
+++nOV5fnNVxn2GkjkYbZ5D6mqMIHUBgNVHSMEgcwwgcmAFJI/+nOV5fnNVxn2Gkjk
++YbZ5D6mqoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
+ ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
+ IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
+ aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
+ BAQDAgPoMAwGA1UdEwEB/wQCMAAwHwYDVR0RBBgwFqAUBgorBgEEAYI3FAIDoAYM
+-BHVzZXIwEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG9w0BAQsFAAOCAQEAAsGC
+-LvikD/nW3eOym4f/uuKBscOGSByP9/HoP8QwvnLYU00i5n+zXSTQctotHIifsRc4
+-xHLO8xemJp7rm0h/27C1Wo5AVxJ0cmnDKQf8Ast+QXsz9ZeaeKLa5D8sDOfnZXJB
+-aMTb8ChjyZz+KLjXV0VbaVkY95mfqsOoJQcl9wHhNdDOygnSucvA5Svlrbo2rlKt
+-75OJZJJWrZxuaBuuSYNpCKyyg61t69hPoDKDQZ8QJZHGugWqQ2swYe9dZpUYy5xV
+-CGTLCAk9ZOn8hTCC6xbNaJFjflIjcjpwabw0r986/9GeAF6KqSNbMXKaY4LLuk/8
+-5FH9S8/3F56ZCNxbZQ==
++BHVzZXIwEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG9w0BAQsFAAOCAQEAFN2R
++gVMM5HNoXuwBPcpNsP5AVSoQRTAv6UUxAjTPLGH5mE6LGW8/JxM0R5x0PdVyU3u7
++zq4qa10XdGJpSt94cD6m7R61Sw6ru9PBtHmB0oUfkWRa2+SJpjmcwyc86W0XRBhr
++OhD0QGOnF1hGyTYzPViGxRZFVMiqXsWuAJ4i6uTyyPeeN+UuehQ3SsVEA1csrKMy
++dNT7FKQBvUTBnSZ9rxphGBrw/NZQyG74KxG5W3Nsnq89VK6+ESJcsUOT55WrHRwE
++CwKoeX+otyj8ptOwKaaje0DZnSXTXqEag4G4PgH4ovd+ehad0JaE4jtQTm+Vy15W
++cwHSMGSA+Kq1Hsqhhw==
+ -----END CERTIFICATE-----
+diff --git a/src/tests/pkinit-certs/user-upn3.p12 b/src/tests/pkinit-certs/user-upn3.p12
+index 9aabc3a897b48600e25bd7513579b258bc1d46ed..93a30422bde5576dd03b9b04cb4686b470ba4292 100644
+GIT binary patch
+delta 2884
+zcmV-K3%m4%7T^{lFoFwQ0s#Xsf(sG`2`Yw2hW8Bt2LYgh3j+j#3jZ*I3j2{FJAduA
+zDnqkos{8^12mpYB1t=BVzC~9MA%D@drQNw$b(d{B1fZOVs9xYew1s#ISC0(X6M>gB
+z!rN`BrcJ^Ohe`m!y#xb>NQ{#(`z%T5F!2#O*G>G~9Y1B$tAF^=D7^!~(#BjZx-F{G
+z^x3%g?|7?Hkd{-0YH5t*Rdo2X?|+3mcuxvN;&S>5_1eT(qT(x52zq^KY|HMES@+&E
+zp!Oqh18~73Vp*Jp3(0&@a@|uNWKk>z{D%AcItdZY^Q#tZFXI%q0IEm0FKXhy*5b$9
+z+GasSZ7Fl=*a3g~>TXLBMNrC1VdF*^x+r|ZH_Gzcqm)*qrnyv-YX?aX*MDZ~tFG0`
+z^Ke2l!1Q9x;ujYQwbTgiZxgrgH`#P(qDO`2T*ft8T4RjoRc83{mS8JoxEB~7#0gjx
+z+tive>B*VgSOs(>1U%w4T=s!cQ1y~?fv+v$>AJGg8w`s<(0GUVEe>-f_*GXPbEwZJ
+z@TMDrtzx^BDv>4R!-4YvFn`WcgvasTcH1OTNqcoV8kt$B82tUtpRiX$PQ)wkp5{t}
+z)?p3fYtv6h{E7BP@YDq^^hGRwEr+;3?2}{(tSvt7&zZ^>#H`F!949k<-xpr{{;9zp
+zDtV?e)Ry1e!i7Jg&*k>7dmwW#q#n;eOt8Mx%Rd2aKpl4~ym)!RCx2F~-z|>d?Q54S
+zbh=;Es8wX9H~AcxB!gd`Yv{dKYv3SYZtJFuhy-=%I~N%?7_12a2`8#qO9;)}q}s|?
+z6Yq8WI{r_8M%lK?@{uRJ*8bV(rwV?^+S5(8s<q|(u=W)i7#Ji;nW@=c#v|c^L08nz
+zb9J>az4Wa{@(sx!?tewL#bxkvN$jInMZ<~N077QsX0f*s0n@MRO0ggV)O{+MYL52|
+zD_Qu^Iq=$v;`lIbEE}^!yO4Pu2NTKNpCM~vyDd#ZW{_f=T68I`1G!n9V|6E;0xWK$
+zMVJJi5@$HHpOZKnrm+wnGJ%P0|5h5YAJ}NwwC8lGJ&%vDG=GT=<j0kA!b5uMG<wH6
+zq80{}@FpkW%dBL_*yaDQ_?=a?;AHed_#cRLJ5|*vPYg8;yk7z3{p-W~xyJ=&@q$GX
+zJ1E#6CA}&ClB3XwY|;PxXxjP4UyK$X-gQ4~hm_p}4r+*lOu`i?u+0;7`mw0C#2uYc
+z<pr*qWm3|6QhzFrCENv98Rah!VXY205$+qV{AqFPy`cIv8VJs5?|!Q>v(9PE(Uw7P
+z0!+ZeJmezUaISwf0TkR2jcE8>$`w#S7f_v0R974kk%QiJp8inpuCXe~j&U$j#DPM;
+zvba{UI+?eG*q-}vzr1$h?MM(Ib<qQ@t>!)FpJS;+BY&HpTa%DiJgy~x$CJp7`XQi8
+z*lml!5T65{Op0>wuHAP*c>)PwVIyE2gb)~?eZWlbJ!p2-RLHg)RE>m|lR|}Q{=U%0
+zo}D~Q!ZtM}jTp-co<U__KRlX4ohb4}$wOZdn^F=BhjXZl#=GCOifU~vLS1)`r6yOg
+z+*C_~9e)bS_Z|HFOC!rdw%BVpyora7>>k#HE^0ZnM*G{j*Xs{zpJAwD_6*z5T?7Wi
+zypIqyqWoQX1?O<$<GXqYkP|^i91I0~;Fi$xs=f-pUAL2dQX9zr^(R$tzh3NWVtsWW
+zaQkmdB-%r?MC;=nrsD`1VUwppaj@zZ%%k#)k$*PnWMQ=`jujA9fNYe;IRK|eTl(72
+zIxqr%VlR_O@a^%emKTu>Oww!WKN@+P0NUjRx;gnk&KISm<5rUiP7k`UFoFey1_>&L
+zNQU<f0S5t~f(3O1f(3Cff(30bf(2;?3o3?4hW8Bt3<?1Ppn?T4FoFdwFjoc%Duzgg
+z_kRrm1r0DtFewHJDuzgg_YDCB3@{u72(le_b~zw}{sICB05A*&2r7n1hW8Bu2?YQ!
+z9R>+thDZTr0|Wso1P~jF*+0)PkEs!3QR2j6R$>H#1kglS1&YtSg;OpOm6~N<GLtEd
+zMW?VF9-4V-i-w~(CK1$j+A+YVi$XmPD1RdTYDjvZ#97a=|2K?_iysrrz{lFQ3L|)7
+zP(Is^iIC4k^VosskP%eZRbZ?^zMYJNmTekqzIgnBAp-(z-KCD&w=K1$cMw7o(XPw3
+zJ#&aqa&jHv4r2-r3uJ5_g|ZGeaJD=x5G%#*A5Mdnu<}KWd-bI}`<KxC#3j{31AlLO
+zXa2voVG@KbMN;bdW)MbGFJQA#es@<)WtK`xC({o08DiA+;GhY1iz4i*7&Y6fXwc^s
+zY2>rtV4vPWlld2Ews(yNbZ<xM5%r1#&IC$KeGImA&XFCUwU^@2_VPV|k^@guzky^2
+zFU9qOOB|x5&T#<2D7aM%MTl6oL4SRiI~USyX~jOJ<Zy1+efcvFk0n2EU;z?5z+)kK
+zrkpX0tmbeiKpl)CIBAtr_CD5K&dC;guEA@K$(Acf^nV6CnEgyPI#^VSUUxyymii{;
+z51PsDotc}Tp-wx+Wx#u=OmVG!NHH3E-9<7VrDz^mg~uw68zb9uGe~=rO@D)#M-}LA
+zGXHCOLZD5ojdv@}(Eepdzl}bf`ZKHTD5j>xe(4nR+$T))-e8N?d$b$9^!ypWdooRD
+z6pI1Qs15?;T?5@i>UJA=nyNu0m?ps+lm98_Zo0A+t+e}RpX+!f>G3{Hg^u6fo4LT1
+z4Y{a#T+mMYnY#W{qU{X@B!6T|m%Isc9UEo8>zV^Z9L9?17w>9Ujg30PUkpbf5*il)
+z&|Zg>8MV)WoRDJd#ewUABq5SACj~6S38u#ULT-rG&N*DdJ@Hn+EX<9U)cEl5v2mVi
+zmqUCjZU-u2d&A^l<elDN29_w$R)KxX4vgY%eYbETrt8e``3Au^pMMID>!nNL>Tjtf
+zJkzy;9b{e}lVX%pscpa}CD|T&4_lG8*YS?dpSkncWepv2e&;2HS{*4*!|BT*m2A?f
+zyjVW1HUQ(_M3rpp5R3I>q#~s-)|9FwJ%rOTwxl2FMp&4tsCFbTVXO2tVoG)vz`fmN
+z)R<$E#pT35KAYbTw|@bc<QpqplPG$^JqV_BjwpU%XphvAk?~pd!sK4IrFzcZM=Vox
+zmE`o52$E{)Q++@&;(eKil9?7Wmd$hK(Rwf%*5XjJHEQuzihq7f3zOR~Lu!NIK9}ls
+zWW`W%%dn*_%2j{|oH)M*(Kvb9BHY0vFTx{4Od$^djDv9*iGS{c*77Dd6zXxuclH0%
+z7h<`tC^-53eR<DELGj-n>x$u3h{1odhts-|_3YJ4Ayla(y0OOI4`C7W%+BMtMu9DR
+zLN@8T_7`usWF{4ezK+d|fuB@k4tw^8R!x#XZ^&}mz29aP_raW@!^P-{vLMa|@PF|S
+zhs(}tr|&S{zJE{7YU?ak8o<!8=}82kvr!u({u*_R?>Nr`=W`fgsS4~&^0h#~(VJRT
+zNzH~lq@$yZ<Qa4v*Sh_=>(W^@?`c_n0MVf0+f4^>KZJcWBRpBJ1NoZM-&i&-9Xoe!
+zmv9ed<U*QU`>P|3x)fnY^m)?k@H>w04+$h`_@j98wtxMb_Y2{QVtv2Vhjf7qLrz^P
+zzfCU6R%@{mG9Yn6kX(&PQbCcl4jzWK;LKYtF(oh~1_>&LNQU<f0SOf`76cSql)L>g
+zWkVjqlI}v+>hWZNZUj*<K`=2e4F(BdhDZTr0|WvA1povfLm8syc_F<3ka!`b3`tdD
+i)2#3$p&40-cg^1tk8$>Kq67$ty|isR%^-9F0tf)%!(&YV
+
+delta 2792
+zcmV<E3K#X@7KIifFoFvK0s#Xsf(pk52`Yw2hW8Bt2LYgh3b+J<3bZhS3b2tPJAZf9
+zI=UuMTHFEx2mpYB1t=3txK!FOZvGINz!^t~^pShD-<Eqzi`e#g5K#q@!I4NI3qaG2
+z*qD=hc1{@;%M2?2EVndQsh5U2FU2y>_>MN{htcbO{qC=J&uM?~NGanbgE-J*^bff<
+zUL85U4k$LojjclJ{^#hk69ix0P=6p3{W=cW@;J}jXSEPY*K)tO<RY~btdV5Mp0mEi
+zd-BTF-exYG?Tc)i@%b4z-?T+5qBB$NXunnu7W!j)gY~GHuT^v~OQJhguRE#>5KXO=
+zDp34gOZf$JI>T(od;fQLTl{d}D?LMSYm|boNM<?~$LJ`%{=d#9I|(Jj@_#=LD<y_~
+zPG(YC4aeuj$}4&S8Ms)oAIi-Y$FwNY*~e8x?gX>-&DpOI*gNxdhZ}bdPsP-V3jIx6
+zS#YC|Y%#Qcz2<ygbGI-oR&uHuuIoTtgDWYC{r;wfp<^gdgozK3aw-!>$cGZXgSwA(
+zp^gh0BF&;oP;t5r`vDq}MSpv(oTT?XWo$BF3HTfG#Cm-G$X#COyar;r`l_yWRsuyp
+zjrLZxM$<L0lY0-2|JicpodEhW-KIA(I*oC@?3bTiPH<*_SJa>trJR(FC|;&F1_fvv
+zlT~jFp~Eovc#$rZ%#NJT+P;E<dxrqN4lUeDZ@Qu@BLHFc*DM}4%YW9#>f80Oaf9R{
+zOpW_P@)6@t2VYKWW}3x8$#CYa;%anc&G^~Ur2V-rd#L>n7J)~*jORUD0N#m1LiDFl
+zB&?Q*64N(fqjrGx*oF|qZ|R<>da*~kLSkj=XRG<@r3LG9Z`*3FTNX%lmC5B4T~(J>
+zFv-n}iKXB3?7ZeYuYc&9GS74XBxDCRdBBF|yIE$fUxbe0K(Obu;3tumH)59PWVH*+
+zz+FmMZ^+~l+V!l1r0ZO}N2<6B_PMH&?VYqs=-<hSIPDKQ?7~$?6Iu4+B+^H7(}Q~{
+zt;xxa>LS%mX1X@sp)x{beSD;A)~7{YY~TU-k$-{C;hMVpNq;mVqC$gb{2Xtz#6@FT
+z{VWSY?mme#0Q8+1Z2R$5&R0^uNckWNtn&l62raaz_Rv@fJ}H`<mZK@33>6N<Gz5T8
+z5o!$^TOKwIEV_!?rBCl2B57S!w&DtV@@T=n&(;yfV7HPHv>6&t$-qmQZi<VqWQ&4i
+zU%vLxsY^{qY=5$tN%ovTxH&bfW$Js*hdi3y&p)tR!WjC*)|Ds<_<NGx+?`gs=dx&X
+zPAQ8HZtYf<v<GLcOMnbMo%C?{+YCtCznX5u+sCadPaAGVt+vhmleJqNWYE>`0V~WS
+z!noU8xPAZ|(OodN!Y_ylW^%s>!I$n`^*O|{`Nql$VSjtzYgo;WtVGwfOGr;9?$|xB
+zcs%xxE&&}izyxcgm)2gfVyWCAT`*z4tvURt&T~Yv;4D~@cMQ$sbGeT!7+;p0p5QBw
+zMU{9IVf{eaHyT}&Q{kmv1!msC>y;CP;=8GdD!=>6MDu6%gpdLzN`zEs=jdV7SuMgm
+zSef9I4u8xGa&@P0{hVpaizD*w9ysr@;s~)?UPY$$=xMStm%-8_cVQq(W*E)bMfTx~
+ztiPTUhk1JJr{K03M<MKdz$Z-NM0`c}jkS!E*rjZ6hyZgL;))|jj$a3W!v7P<{&XdS
+za1RpAGt7afGNo?`XZ|&sUB3vWe9T$^=c4qEr+>HZ?_uNADjS{qhZS>Plq2pIDcZSe
+zpdVNTFx+6=J0GuhMj`dM%6hP<l<u!iusF_Bdbx<=ACp;@Y`s8x$D&CzFoFd+1_>&L
+zNQU<f0S5t~f(0rBf(0fpf(0Tlf(0H13o3?4hW8Bt3<?1Ppn?SEFoFc)FdPO7Duzgg
+z_kRrm3;_c$4g?7K%`T3l<@I6$0tf&Ef&{>r;S>kF`=lUV`cN+L-;%3g5Ai66u6H%n
+zyfg~`$Gs>R{QVz)tROl(k}JU-jqD62a~NzC212U{n)$nAgsnGjoPsM7R6NMA=VGH`
+z1j%@$TqOIpqreVYF{_P#Ld?sZIQVS;Qh)J`TkyOxjU_HwSFW=@1+yU&O+4(~e1pZW
+zdrC+`8zsTaGDfQt#7I&Pa#$O{DyBOl>_Jl1(9c*lL@BH;OO#5bXtm5nX3C~*Pn69s
+z(^4r6qXFwhf*ZDy)ZtW;)ENRkjc|#NpZ6iL<woUVtHh&|R?8g_qU5m-MkNYTet$(#
+zyJ!4TWt&hjHjmf%`BsYr73?qnuue8m>J2cnU$Z46(*w{@+^tC{nR=N4%9T-0{S0Vv
+zuITX0>W_bbsp#~8>rIdGj%n76kYuf?>yX)bEPeHczbHA2m#H;(n|w!Q4IVX6sU98{
+zOlrpj6Q_77iXS2=oFm3wmI_q=!GG|ZxMyJfm@W36)BqdDmFEysiCoWFs0h{Aeqqmk
+z8T93$tHeqtTnPI#ZNj;&P@qq&2+!E8(q%k0HF{#(jwR}m)3Lz()!)7BPi*u-*p#b3
+zrLNe1(4tB%&d^e8d{#t$ImMt?Vq-)VFbRK@T_Yiahm~7)-B&pd8gxPtU4O8w+P>aQ
+zP9X72&~lV9$Qpdl3;-#jyHYb%NM)NxL<bMhDMv%<wE4YutMjd%1W2hj`&XnAwJ8EC
+z*Agtv+loQIAh}><$lo(9#%8c!mweqK8`i&|Ky0)}^G8PW(W%*6#;qkrM4%*TGa!?K
+zU|cE2f76znLD#xzxyn;rmw)6%EH1ek2QS*J((#_RgTyYO#?@-CqoKDk8tM{t+BZ0R
+zg9e9H38hKach1c+6Xf9Da}2?$V5Rk*R98)aLVp2^8bXx7{A@Q2pHfZvEV%u|jMOGg
+z|5PWJ_$G1qmwVcOOVwerb<|Tx^TT^v%SaCo(O%3gTXbk?e!y16>VF;94g#dwH|PI-
+z&D1MMKVRu0{ryL$acyjbc`LtxcnT{VX0HU%g2@&XrH+ZW=-~P<pXDDe7JrPgw6)Mw
+zL68)m{RjfF?Tf2z7A{H+4d=U_y<XWLtalg9u+mwq72ZFFuJ_mu?ec1LlwlG<8~rER
+zcfn0S*cHAy8#iSU{eQ)swmP0(GgZjkY3S<li1kWcpx{dTu^UhU60?jCk_~3ugA1M{
+zPtaKDYH1~KB?jPDbrDBZt`FKM_*9D)kmSq$^Kc`Xg`XFY+J(Ua+`QY%x$2F8RJ%F?
+zd2?E|L^=KVN@V<v6=CRo;2@0XDY2W6LlNx@eh2eU%8n)_Xn#*49_%2NEFw7iei(x9
+z!-j441`ti6SA&WV`GV9+k*=c-<fuV!7f{)$mRgRj-F421B`EEbqo4*aE{bxUex6`M
+z6pJlov0XmMh$ToDRQne77!tmuWn3Yk<10lX8pTX>-Jc7{3rh)|t*!EFi!P9*YBAtW
+zbu`)yVVz9dAb+fy*IJEkVq7w={{*u3gh?3@!<u+^AmxIeZFVKT;=*CHnNqiJXxxR@
+zK;GVvS>K+(YG^T3vjiU}7w=Z08`s6Gaw5p<uny@|Zyi$#Hy4lH@z#IQJda-vcya@^
+zI;-6KF(oh~1_>&LNQU<f0SOf`76cS9@g^tl=&liDBR#MNfw;BX$Xi4$FflM8FbM_)
+uD-Ht!8U+9Z6v!4MIfn!wLYbfw(;^ds(gM9-V+07Ul!P?WIu(in0tf(rB|=XC
+
+diff --git a/src/tests/pkinit-certs/user-upn3.pem b/src/tests/pkinit-certs/user-upn3.pem
+index 000d567d87..618f005267 100644
+--- a/src/tests/pkinit-certs/user-upn3.pem
++++ b/src/tests/pkinit-certs/user-upn3.pem
+@@ -1,28 +1,28 @@
+ -----BEGIN CERTIFICATE-----
+-MIIExTCCA62gAwIBAgIBBjANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
++MIIExTCCA62gAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+ FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+ A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+ dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+-b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMVoXDTMyMDkyMDIxMTEzMVowSjELMAkG
++b3RoZXJ3aXNlMB4XDTI0MDIxNTA0NTkwN1oXDTM1MDEyODA0NTkwN1owSjELMAkG
+ A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+ U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+-CgKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtrvmBIaYcn
+-Pq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE1/N4QMrz
+-yKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOCByG8F44Y
+-QTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiWgL0/iO25
+-YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNHuShYa0Pe
+-yiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABo4IBVjCCAVIwHQYDVR0OBBYEFPQX
+-pfvVBF+0OJJ41JjduSzecrQjMIHUBgNVHSMEgcwwgcmAFPQXpfvVBF+0OJJ41Jjd
+-uSzecrQjoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
++CgKCAQEAm/1JtzZBJsdadmOTnkl94508ZSyYo5xP83sLT/SY5Cri1QKaFrue2kGg
++gl1QEOExBrIbdAeu5BftqiC07HyGgugtRo0qDHMRnQ4tsNExzYz69MOkFE4hMYjU
++o+9C22GVLihyoq+oELN7ro30u5/MCO7rULIp0HekLKQ+uANVVJx+xnW3bMJsrRIX
++Zx9kB0jIIugYt5D3n80vdIjHQJf2BTjsBWYGRJD4sTElGFtRIiD6m4puonRdUgtH
++UHZ7OCKTY5sU0PSGxFRLi/ykqcgPPQddHYCd5MRJj5q2NvPN6UYDbMfzqni0uDQ9
++qdDjHj6CmRCHNKvkKaLdBfhdqFKuZQIDAQABo4IBVjCCAVIwHQYDVR0OBBYEFJI/
+++nOV5fnNVxn2GkjkYbZ5D6mqMIHUBgNVHSMEgcwwgcmAFJI/+nOV5fnNVxn2Gkjk
++YbZ5D6mqoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
+ ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
+ IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
+ aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
+ BAQDAgPoMAwGA1UdEwEB/wQCMAAwKwYDVR0RBCQwIqAgBgorBgEEAYI3FAIDoBIM
+ EHVzZXJAS1JCVEVTVC5DT00wEgYDVR0lBAswCQYHKwYBBQIDBDANBgkqhkiG9w0B
+-AQsFAAOCAQEApwXjFJ86RLM4MzbScqk0JGqm+jzaFZ6h5oyt0rlaxdhOl7kqOmIE
+-sLhXtvZm75roA+UULZHumB6xg3Y0p7cc6VBAYYycWoNkhWXZMdQ8Q33vMos5cwLY
+-kXjl4oTDK53goh8IlriRMV7Tv/QpJ8wh+7iqQn3lak0Tv51JexYGwp5sJREYm8q5
+-rr3ChlgH7SWF8mhbu2EEiipm0whEqA4tlNKGBsTQBslnm8sK0VfVDcmLOGbMNjRs
+-r+Hkd8yVvhIJ9M+WAp/OeF2vUzPBJtAfIaJBxcZmKtNI5Jk8cK/vScJZboa0qAAz
+-2Y1uC9rP830mpOe0juhV2mMPron0hi1HaA==
++AQsFAAOCAQEASLN4+MiZUQwBzQ3ezt1B8Zx8jHL7a16s1H5v1J2Dwne/pM/risjg
++ZAlv65IlKEp2E6cqcmCPajlZ967vJr1qC+OSV2AZuL8HZlg+ISacoII9T97X9/UJ
++AJfOWBN6y0DQ7s6OLSunf0+mAw+LKmFoIQeO5+DvU4chEYkcs6NbbAos/He1Wgq/
++RTz9J3EhGuoDVgqq/avrTsgW9HyrHsG+Y/6n4cX2lq+VV7h8fG91hC073Rz9QMFY
++q/pBqFqIE/FrgA4YbpOrSx6m+eOyFSAWTLtmlJmROiNYo4ZuGmBtrDntet+YK75A
++8Rsfbapjn4SKJzgJseVgUbEEMOFcugQBfQ==
+ -----END CERTIFICATE-----
+diff --git a/src/tests/pkinit-certs/user.p12 b/src/tests/pkinit-certs/user.p12
+index e5520110248530c55338c80fd44414eaa262c4a8..0f854cae6f033d0630e8f49ad14e11f330c0ad6b 100644
+GIT binary patch
+delta 2892
+zcmY+^XEfW50>^P7i4fG53N5i(Gig<+?Lnz6wQE*r&6Z2;KdIR$HEXY^tyJwjg4on9
+zMJuYqtgX~N&$;(J_uQAi7vJB@&r8m4oG3IN?nn)yLF3`vP&&~_t;i!r5G^PV4~K*C
+za9T7TPLqI=2dt3wb<B!a5Y*H#s!%)x4HbuGtuhvMOCzXu@BiE?e=uf4CPZD(e=!wq
+zr4c7R^V^>?!M|9Ta8@$m(?5~;_Tn(<8A}joBO+BcSlahN)>Sb`>t<Pm1zL7h-b=jf
+z9H&*w!M){6)I@jPyco1%sk1>=)-(^SR2L)<H%Ey9s^={!$g-uS&%%pR0ZFw6z5b&)
+z^7y%K3kM8{HM0KXmgVN$rXTRTojNF~UMNOva@$egRhz<GWfi1i)))U(*<8ANm_;sx
+zY<$z{$h0k-V5zRTQ2aj1UM9=<OeUTRdk;E+>txY=xAE~PHoHBCf4M{bH>2S9jw`4h
+zp*y-jx&|=Tq_=vX$0AY-B-pr{O3}~!a^QKw^rZP3r!8E~<4%RzRnXkH>9XmKSZbP{
+zaaJ*AU$QA*L~%RS_EQGj1G`WJ7DmgunlvxDG={jJ?-epJse!y@ZR4+bx9Q?#sdYwy
+z(7k9q)PNjgxszN|6iPwU<V3Az+|Q%FiAM@3S@aCrCDE0>knCR*%y^Qb?DE%DYvjQ3
+z;KupDH-(s?Jv+im0i-zOqS_h7X4{%q6B3|6&!@UWm^wW2r4xF|mkdEx<wiDgRg7^<
+zR=7al&dYr5^}_QLIkN(Fyy$~%_dZbKw!O7hWyJFxKhXt7?FjdaYJcx5Ib$Un2j2v8
+z%5%2`t-gMuy!%db-A&$qt<!@eXY4yEGs&LX$Z=@KgM_g`DpF&Uc4aUbh^CeUv9d_j
+zN@$tnmTWEq>n4~66{`CzT4_Ik**^1`!x}fTzV|8m{TK6!0MWB(ZeY4tK0dLjcMvPD
+z8=e*&*4XH*4v{Q1h2g%3Fjv;yT>}EoVd?9-HI&GSk%Pt~SySOzU&y5j-YW|H(ymTw
+z1G_2NB0UR=mJj{oPOpv^O!d8MXu(!8&w(wML`8o+#dIfwKC>RJ9>RAeghupBEai$e
+zDAKej36GGn{2TIG%!~-Q_PI^YR3oQST)AK%A#{^(z(2e>rf&a3&by;mOTa8+PRRHa
+z-^wA_U+>r+QFr5+>p5s|pY~>EwSm#>qOt)Nqf@6CP_M$KA*G}bcej!gwJ3*zQPO)Q
+zcE!oFOtiDpne0?jxphVJByH8c!ib0&g7|*$$1HXsrD_TF<y%3uzG~s$9=skXBue=$
+zC<$y5nR-%KMXc5?_1xZd0M1`=nYy@~qYVm78#ARF35kDd7YuUq6Qcx&1+EleUT>zB
+zrG_#(dx(zjH@7`{%)6&?2CWGV#oyFiC}F9*)?V`SkA$n6*urPvef#ZVsuY@aE~mwi
+zfLZVOxpYs34^{3ih{Iwt3J%MBwsDN@US3n{4IdSbxOu_vBq_M10eI@=J1FX`4=u}h
+z7b!WZmn^TKx7NOwvR(EQJ?-AwVb|>(+HxQ(@}fss)htL6&IySIxFV|d4-b9Yvz_(c
+zePf1g3;EKwCW`Pgu}r&Nwiw5>4p0$1R|F@Ad*9EUAwqU`H_$DzHS;+yy>Dy~SPv!$
+zmkq}>$Zz^V(#udwpnHpk)p-ziT_zvT@iwpeM(IX2<l=1<Nl2{mx&JFt*dS3jrT;PY
+zFthLdWaIhhL!MMpVXR5CS?Ne&5VEW#2Zn7-al7}9@*6}_siUmwh)zf-f5I%sB)f75
+zZb+MS1Z?$<8lQK8Re1Te!IPvW8knK@{wg<eV;$}Chb<NuDr789lR?tV)Iy@;N!1PX
+zvq<w?`_g~O!-F4HH47X{6-O<zjr`&!&L|<ma$E^Z0CiWyZuaSGyXU+KB!OQB+2GnL
+zbw5V^Lo^-|{(sOye870fQ#2mpj>bbCL*f55n1LQdori~D(0GUh8Zi4OfiR-)p|AgM
+zGN5_DFy>1zgV-~<sK0qeGeBYg`JkqQP@#FDbas(iARG-CBnoDhTHtDZ`M&ygm*J}p
+zcv|ol7!Mxj%Z9Q0gjbE|MP)nJo8UAhZfhN0?H%bok%_bGTwAb%s{8@ilH5&b73*8%
+zn?~vO)!7y7Lj*?UZ5qZ?)nyNAjb3oz?2PGlw&}HOvO1`1Wwac=eYU`sxEQghC@ZE*
+z1w@#ajEoSL1j0HX8}<}`+fc*1nxY1sElLmO6ZMsC__iS7_dQ(`M$XS2esWS}oKa}n
+zIh;@lg-$!--KngXYomds8?&A#I~9ShhEw*n5wUp{ewUsh=l#s8O<YP=+cvxnx0!Z9
+zLmYwFY}9A?<yDw6R;$PQyr<{qYf(2@VguTzBR`XmCp(%xUcha-Q@k8GqS!C#!(Qnq
+z$2F}~K9C?Y|9&7Pz%$O*uatAoeT^D*q>8AVb3azHBo_up_yK-RX|#8f(whe3lu~8=
+z>Rlx#>}5YmM<S$f;e6dLTk#=#J$c>^rEltM^1$Xx)9`wo{qb10o*m>Xy`;bHRtlM}
+zZ;NN)^q}BNTvndhQ?@$yS|;Tr^u4BaFvdS%HZ>EM%wHSflx2KCj%7vqE=Pto+rN*9
+z21WA>{xOJ{T7d8o7MV7X>L|Ta>(!)@?25=6nd{r1Bn1O;w^^R6q@iNUl@~<5k`Grt
+zt4cy_*okVY%WdtrNQM1KuBWpb4Qesv1*;K^T|9@TnSs3eA(Cz^54=Z((46M|;%oLh
+zsGs_@Lgj^K@yCR&!=s>ti(hn0WJ!%oQvB59o(Pc&NTW!ES)k-IY(7i~q|CgZoa^hR
+zQpq1!Sdc(15I4h>i5jn(4Ky68x6iUWOuL_jt-H+BCnoZ@!V6GiN0MNg=y}@`g*u-V
+zC)cuzj#&nkk&<;b>Wyz$fnuR;6uI%S@#E=E`^qe-8I#gnaKxnOFO0(}fzq(wH~hi+
+zdekEzl#@Io`zB#+ajLT>%~{Ny&d-aFH~-)&gKw0$UWsSsw6{_YrsbR_+(F>MMOwP2
+zv?S-H0J1o)Pna!}jc7d%4wbSOX;bOs>ThE@)4%djgrNvZ>mhajjy`1?f&q|iuLRhg
+zehh18kl}yP!G|X@Gm`KYlGDk1(~HZc=c<6J@dww{aY6Qrty97R-B72@4@2yDEvsVN
+zO4TxnDDsD0ykJu8oaM>2W3)f`ZQz-jz(%KYh03WnD*OU=$~!l(X{Fk9?CXlr$jMxw
+z&4YBg{$w3lr2MG!+jmk%$X#1C8hxEuGbq80I?zu!86*YbN3dx1@2fmAim6hvO+bIU
+z#eRn3Ab^rg46S~M7s6vR<;i88WSP<^qe8v(HjtYp^i7<5*IA5%6fE#3@S1XdAl86m
+zcpPdhk!Is}%eVyhaMQ}v|MGKVO_?U$M<;JZw1H8T)I+1KkgCQz*|>4xv5+eESa~~w
+zV(ssuMzr>CN1hjN$@^xrtY35-fSQH~hi%0jk0IU8K<iJ=j!cLNX^M5_WlGc%n$Xc9
+zcFY$hpd7(i;qS>N60+SAoZC8d-GF!Wx7^TelGeO~Jnmk|pA+8J`#v2b8;L#Ri&lNt
+zFZi?Wu)s7TQiBF!^rGT_I1$NYEv&1L-zUwHU&}h&7dNZD3|-tI&0n9m0L_9i2rN6l
+zDRGS|<JPCQxn{O@t)567-*;8_xT%bVwhZH5tRL*E|1f&`cxu}u_IZo-b~rGM5kd?6
+zBPAUNh7-)LFocwXx=obP&XlAn@(Q1-_Hl%vRnZtU<3CPPgCJC3zPt5x&N$lsbg5RJ
+ntLFUE%6Dz;6jaHQOxyz(FBBk_lLKJb5UI2r^Vyl|Z*~6-`|w^%
+
+delta 2800
+zcmV<M3J>+@7L67nFoFvS0s#Xsf(p+D2`Yw2hW8Bt2LYgh3cv({3cN6a3b>IXJAc~$
+z04;L?h2;VQ2mpYB1u#k{e>HFuQb-0@)w8+8*DP{D$KG=;=xRl2uvKUP-SRRE%$NKP
+z_D;2NCAhd^?|QhcbJ5E7c`-26TMzdlG-H?6^IBeoE0#e|QM2rw&&DIM3C+3&2a0ll
+zpPL`9ji3aw?(A~Q_bH5QAB`Hf<A2kh#Q6kWS>T~I=G`cK>^k-~8=RAs!fh8npjTx1
+zio`$Z>ZF=$DSVbD4xi;!NC!?`eIqF<HO_^vw$W1cC%-d}4qkh{VE@0KSIVK7b?JTT
+zq-RRUs;gsXhg6l9mL=uhMes&x2tEw<m^@#u`j8PeMKq6|w`i=T^yfz%AAicj>D35=
+zQc<VpQ`VnLg+g_VM)Cmrnf^!Yv5L{a3WRi*zEf?6^=})hnn7ACMASEjS~Se1n7qt<
+zOgiZJYKzi`R-bhVt$?~$BP+8on`rvT1uUM3gi{>_8A~;(#IIWCvOKf`P&2)Js($WT
+z1z-??Ow@SVupz2ChgP2^Y=0o#*~e?*$0TAcDcl<G_XeQ>j?IADVt8o^gntLJZBu=o
+zlRp{i%IZDaPfUE-$LP%)Ua~T(Bdt0G=DGbexi&hghHP;^^f<}zRlnJ3GgV60GtOPk
+zcib>&Ab~e+Z6==732Fcs!<-3gh>(3UIWk_h>u`vv-;vJv<B0+QL4S5)9R$cj+w{^_
+zO*tVWU)aZpkN8|jJG~#J?D{&(6rMHFD&OvA&2Wz5pq^>M|KhjTN9G*@n5_xbZnmMK
+zlqp0G!V<X?fv_ES2bY>*18sL0-95F*8PQnOybN@p#c%kb*&^aa55JSKbSAd@qO=Ht
+z422<UXz~4$`-S^Gtbf$flLsG_ECz?!qldH?4Ne5$aO&-tg4ZqVY1i0OaLxWLVG{>L
+zEQT%EbQpx1<?JaH8`ziq<`WMK6D23sNVrd_V)JAI9-u=?x+SfR{?RAMk>)#*Gv)47
+z!L`_0ZJB+>X&W4?m4Xpk&GUR45OCpS-Ac@br?bG$K5WOH27l@cvz6M|^4ikdCcj~?
+z@A&ePKz3o=>_;pjNUjLI{a*i~A2Cm`&wy=Wnk}HZ!)%{@qd4Cdgv0<!v7Fp(g?ef!
+z*v^GpdJ@x9(F{%#S4`1dh-vGR8TE|#G}0d$8~NyOCt8>g1#?}yCqq93|4$^$^+_&k
+zJa~z}zH{53ynke+y3lMnjQq2xp0Aelu-HmWXLFfn2Zo%7n87xsG^uG}b2CZ*u1s9Z
+zdy6l*(2{|l#uH(Fg~MQyrygWvH^>pmCkM|1n_(Oa%d6l_c*y)EJe|rcT48Q$4-q9{
+zd;$`4t5f-+&fM5}8vs44&d`E*VzZ!Kx~GhFv9KFoMt^WQmMpIlho1dt%_BO(+`2Lp
+zatNwfJ+p4vZMjP*m8(};v7%^J>Z;rDPy{%kK4LhfuLy_D30LYt***zyVP-NnNeD<@
+zGY~g=yXsBrn_X=!tmk!)LM6?HS%;t(HMJ%Q_8-enJgcrn_sO6=M%6GmrD<R&rHySM
+zyFwJ9w|{x{Q?F^`5tqnGoK0lGp`$AxK4Y3vwL!F-?(OYJg%@tw<#dfe8DU84Oy0jA
+z>CuouDW~1p-LREA&0BHSeEKQnj3ME3_){Ru4kMWs9nx6eJ4`1vHrOoBO6WNZGR{?^
+zEfRoM=%swpDejYTaEFI0cJp^Ht@L%c+@lQy^nXs75zrK4$%sP!y)m<*xW9H%@<Ogb
+zC2^|mE<uQkFld?mPDpo2xt#a*MK|8AE=rDVj}pK|<3_Ffwj3p#o&X`3;NZ>fLjRzS
+zFoFd+1_>&LNQU<f0S5t~f(0rBf(0fpf(0Tlf(0H13o3?4hW8Bt3<?1Ppn?SEFoFc)
+zFn=5d3Mz(3hW8Bt3;_c$4g?6%Tk1xTiUJ)10tf&Ef&{>eJ7Gnm8p68cPkyaMp;ydm
+z;5`lZ-8TBOTClg<PYxV`BO%f&+dEvMl0#$)@5Cr;=QE@M*NtG)9E!|x8`cAxg&%-v
+zfePOOjdeqgjMHONN;KHA=qrt=lx=G^N`Ge58}MK0n>{8b2gEfR$AC$(l*<$HmjXkv
+zk2XU*+fTwXqcsMYaZ3q-p;<f}MP~X<D;Eir>PK((Pr<aG&fFFm94*g>SVUOgD!_f+
+zxEwhbf?;sTV<seOV5mIkylyR?*G0KgX0a+q>9;{2qj=e+thV<s50qa!Oi?_WNPj5p
+z*~)2#V_FjvS%FyoNBPpK$_gFCZ_}9~`PNLGq-TGGVD(eUGTI_d$tQzI;~iMVBmoJ0
+zA;XN^Y^^`viz`p50^CQx)SY5!Dvg_i2*r%1^OKmN0rQ*9{>m4&q+rqRZvI3E$OX<G
+z?9oF+GP@B&!lR1#!mj2S*LFT~i+?XSTRyu1Z?0}$dK=0PkU>DELB<0qt8X4|WJgR&
+zA;mly>0fgus?*HuYZkDa8&PzLYY`{)VN|6AD5DVz9hPB0H|cXeKd~iK$$60*1@6KW
+z6781`Wt^~gq(V@LHV`!^8UF^$=qzP9Z~St~brXD2cffcLQ)%SW+3k{*m46rbsM@(z
+zVmdvB5fH3}m=m^<CJb&xVynQM=D6;wvPlWhHlBt%pZP)L1Vp#J4sk{)`TZ?Oj%g~&
+zi3EE>afNN7hu#6Tv465|&pl|0QVo8cOgDzsf96G6OAIc1>JH)_kiJ%CKS4>>XVItK
+z0df&%Ir0A#%dzm{a-{xL-+y}K1k-jf%0*=Wi*tj00J0}10?%6)ypUZJ9ksJA^uCwA
+zU5oo_<nP<(sK-n^!au0J>6hE*n7H%zwo}j{S>kk<DKaR0M2{r`>C#VGo5P%uaH-y;
+z9xeJ!zLp4E-us08h0F``IjL9Q%D-E<6S*Z@f^7;~n+PU-j1vc-W`Anul8%C=xSb5u
+z7r0>5j^Of_V(=`5Jkb~jw{)rQzSz?lmA1B5fIF^AldA0&srn(q6$tx(<>kN35n4cE
+z?Y`#QJY`_$YGKyHz0lTxyY@^*MkI>@K_P<$huaWnmtRl$s=QCNW>Q)%O~1<vI-B0r
+znnG8;aJ;bf%Odr3t$!AVRGa|mdh2#tw4H>b7x8OZa>s!LI}xafM<eM_nwKqqqyQLj
+z`1Qx@C$dIuzBgLyGw+T2S0~>3IiiEeV1X6v0v^m&_bRB7S;B9{kMdqBpB#o;WHIcK
+zXZti{8yqh{hTB(4Q&s{4ZNd91F&>cQH%{n1i;7|BuXezD%73<t|N6a?-kNtNkI(Ws
+z&I+>Buu9D%H$?>u=EQI*3@^(1e84N*6QZYbr+~cRYKueVXW#rd?}8~s6XVg0MS^}l
+z>j!&zJjkZ0C0Bijh>6a2w@ocN@A@brXHXZn+AJ3kASY`zaQm-BZ>L{LVlV^$8R&lo
+z$7k~Gs8nAN#(&H;;d!1sK~d<KC9YPUgFYTCu{D9rH<0o@89~{}RWd!dLNxtx_I!5m
+z6I(i@<;K6lvm3TLP^2a!1oe~Ghsz?Q`4TSakLr){Z`~DVKX5KPxjwgWlOlh-m5$$x
+zyo=6Eb?HWFHB*j`F(oh~1_>&LNQU<f0SOf`76cT=L`9(EsQ>XqJJ21=NG&!mOU3kJ
+zFflM8FbM_)D-Ht!8U+9Z6sSLOY_+{}*ZArxG2W!WZkmtKW&{Xzdz-Lrn>2+20tf&?
+Cp*q$8
+
+diff --git a/src/tests/pkinit-certs/user.pem b/src/tests/pkinit-certs/user.pem
+index 182ea599ac..7493de52c1 100644
+--- a/src/tests/pkinit-certs/user.pem
++++ b/src/tests/pkinit-certs/user.pem
+@@ -3,26 +3,26 @@ MIIE0zCCA7ugAwIBAgIBAzANBgkqhkiG9w0BAQsFADCBpzELMAkGA1UEBhMCVVMx
+ FjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcMCUNhbWJyaWRnZTEMMAoG
+ A1UECgwDTUlUMSkwJwYDVQQLDCBJbnNlY3VyZSBQS0lOSVQgS2VyYmVyb3MgdGVz
+ dCBDQTEzMDEGA1UEAwwqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug
+-b3RoZXJ3aXNlMB4XDTIxMTAwODIxMTEzMFoXDTMyMDkyMDIxMTEzMFowSjELMAkG
++b3RoZXJ3aXNlMB4XDTI0MDIxNTA0NTkwN1oXDTM1MDEyODA0NTkwN1owSjELMAkG
+ A1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMxFDASBgNVBAoMC0tSQlRF
+ U1QuQ09NMQ0wCwYDVQQDDAR1c2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+-CgKCAQEAz6VXmJpVq2zTIEU3gUF7pui+Wg17d3QX2oy6EqqUQK/pwWtrvmBIaYcn
+-Pq0ZMrzMhNTuyeLjb1rNNkL0hCdS3/aVbx1bOlkPVPlW3UNi9gWpXOOE1/N4QMrz
+-yKAQ1/Npf9xjY/vpqsmvRx7AZpq7Nq7HyF5hbUKMHFaaTqRarhoP7mOCByG8F44Y
+-QTY2RXcw9te63x+77c3O64gbtnSKXBC/4pS9DxBBv1ULB2wOH8RGxDiWgL0/iO25
+-YImKQgTvwbENw4ygLV+0m1b+YEJLaIIeKleunYEMMkzIfFmMemXRWgNHuShYa0Pe
+-yiwTBSRdW9Yi4qzjfaHZ1dD67wdoGwIDAQABo4IBZDCCAWAwHQYDVR0OBBYEFPQX
+-pfvVBF+0OJJ41JjduSzecrQjMIHUBgNVHSMEgcwwgcmAFPQXpfvVBF+0OJJ41Jjd
+-uSzecrQjoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
++CgKCAQEAm/1JtzZBJsdadmOTnkl94508ZSyYo5xP83sLT/SY5Cri1QKaFrue2kGg
++gl1QEOExBrIbdAeu5BftqiC07HyGgugtRo0qDHMRnQ4tsNExzYz69MOkFE4hMYjU
++o+9C22GVLihyoq+oELN7ro30u5/MCO7rULIp0HekLKQ+uANVVJx+xnW3bMJsrRIX
++Zx9kB0jIIugYt5D3n80vdIjHQJf2BTjsBWYGRJD4sTElGFtRIiD6m4puonRdUgtH
++UHZ7OCKTY5sU0PSGxFRLi/ykqcgPPQddHYCd5MRJj5q2NvPN6UYDbMfzqni0uDQ9
++qdDjHj6CmRCHNKvkKaLdBfhdqFKuZQIDAQABo4IBZDCCAWAwHQYDVR0OBBYEFJI/
+++nOV5fnNVxn2GkjkYbZ5D6mqMIHUBgNVHSMEgcwwgcmAFJI/+nOV5fnNVxn2Gkjk
++YbZ5D6mqoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECAwNTWFzc2FjaHVz
+ ZXR0czESMBAGA1UEBwwJQ2FtYnJpZGdlMQwwCgYDVQQKDANNSVQxKTAnBgNVBAsM
+ IEluc2VjdXJlIFBLSU5JVCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQDDCpwa2lu
+ aXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCAQEwCwYDVR0P
+ BAQDAgPoMAwGA1UdEwEB/wQCMAAwOQYDVR0RBDIwMKAuBgYrBgEFAgKgJDAioA0b
+ C0tSQlRFU1QuQ09NoREwD6ADAgEBoQgwBhsEdXNlcjASBgNVHSUECzAJBgcrBgEF
+-AgMEMA0GCSqGSIb3DQEBCwUAA4IBAQAOBeCDK6Eg6Cu8TZ7xeAw2AbTpaW04nNSV
+-Fmm0aIskMgLl2a5KEmalG7rnArRXv5IZVYFjJ6X0MzjOx+BgaGUCvN8jz1fuO3Hp
+-iGhxPDzKjFMWJeY/z5bQRueSI6RCC8DzH8iPdlPUQ8ZhnukhY1Vt47wqraf197uT
+-0XP21qQr1uRY+ZcLSBKZuKe9ZP3ijh57MOLvYDdAFxVp77JLznpk+oU18ujAtYgZ
+-7naIGYtSQRkIi970jk82hSpc9B/KN8UcDuo+DQHWPQaDf39s30qoxooZBoue5ipp
+-LQHuVaX5Hoi83cWbsVluce/JsW8GfbuC8+8CosAmzJly183f8++9
++AgMEMA0GCSqGSIb3DQEBCwUAA4IBAQBRWsxPb9miF9xf8rEIfVko0qBy8doEJsPE
++IVD9Jz/Ml/TBZRLbi1b94l15Fto/Z6XKf8jrnBs4krf6tU2D5PUZXZYZ6tr/2kkY
++IpmoOkEoQX8gtcZfaq2OJzsKHnAJT159EVydyYahHU66i4aNvho74oAafrVTyk8B
++PHCHFs0MUct8DoNwrbnfH0cjqEdVOmjjvBN0yA+RxOa543XnQqkSmCuIJKoD6pUa
++07rE372iERgIjDnzCogiEo9cCBBqDfgsbr0ah1QbWJTJvnsFuxT43tBNurRjNPoX
++Jj6xAzhQLCuvqtKtWlAUOHut18YbVGXVT+3tm7+C6iA44JvMl9m1
+ -----END CERTIFICATE-----
+diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
+index 4435746429..91d4630a0a 100755
+--- a/src/tests/t_pkinit.py
++++ b/src/tests/t_pkinit.py
+@@ -7,8 +7,10 @@ if not pkinit_enabled:
+ 
+ # Construct a krb5.conf fragment configuring pkinit.
+ user_pem = os.path.join(pkinit_certs, 'user.pem')
++ecuser_pem = os.path.join(pkinit_certs, 'ecuser.pem')
+ privkey_pem = os.path.join(pkinit_certs, 'privkey.pem')
+ privkey_enc_pem = os.path.join(pkinit_certs, 'privkey-enc.pem')
++privkey_ec_pem = os.path.join(pkinit_certs, 'eckey.pem')
+ user_p12 = os.path.join(pkinit_certs, 'user.p12')
+ user_enc_p12 = os.path.join(pkinit_certs, 'user-enc.p12')
+ user_upn_p12 = os.path.join(pkinit_certs, 'user-upn.p12')
+@@ -42,6 +44,7 @@ alias_kdc_conf = {'realms': {'$realm': {
+ 
+ file_identity = 'FILE:%s,%s' % (user_pem, privkey_pem)
+ file_enc_identity = 'FILE:%s,%s' % (user_pem, privkey_enc_pem)
++ec_identity = 'FILE:%s,%s' % (ecuser_pem, privkey_ec_pem)
+ dir_identity = 'DIR:%s' % path
+ dir_enc_identity = 'DIR:%s' % path_enc
+ dir_file_identity = 'FILE:%s,%s' % (os.path.join(path, 'user.crt'),
+@@ -177,6 +180,11 @@ for g in ('4096', 'P-256', 'P-384', 'P-521'):
+     realm.pkinit(realm.user_princ, expected_trace=('PKINIT using ' + g,),
+                  env=group_env)
+ 
++# Test with an EC client cert.
++mark('EC client cert')
++realm.kinit(realm.user_princ,
++            flags=['-X', 'X509_user_identity=%s' % ec_identity])
++
+ # Try using multiple configured pkinit_identities, to make sure we
+ # fall back to the second one when the first one cannot be read.
+ id_conf = {'realms': {'$realm': {'pkinit_identities': [file_identity + 'X',
+@@ -446,4 +454,16 @@ realm.run(['./responder', '-X', p11_attr,
+ realm.klist(realm.user_princ)
+ realm.run([kvno, realm.host_princ])
+ 
++mark('PKCS11 identity, EC client cert')
++shutil.rmtree(softhsm2_tokens)
++os.mkdir(softhsm2_tokens)
++realm.run(tool_cmd + ['--init-token', '--label', 'user',
++                      '--so-pin', 'sopin', '--init-pin', '--pin', 'userpin'])
++realm.run(tool_cmd + ['-w', ecuser_pem, '-y', 'cert'])
++realm.run(tool_cmd + ['-w', privkey_ec_pem, '-y', 'privkey',
++                      '-l', '--pin', 'userpin'])
++realm.kinit(realm.user_princ, flags=['-X', p11_attr], password='userpin')
++realm.klist(realm.user_princ)
++realm.run([kvno, realm.host_princ])
++
+ success('PKINIT tests')
+-- 
+2.47.1
+
diff --git a/0032-Improve-PKCS11-error-reporting-in-PKINIT.patch b/0032-Improve-PKCS11-error-reporting-in-PKINIT.patch
new file mode 100644
index 0000000..b529921
--- /dev/null
+++ b/0032-Improve-PKCS11-error-reporting-in-PKINIT.patch
@@ -0,0 +1,599 @@
+From e43c05e7b0b93401dd68fc3ec3186c3a455b04ea Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 23 Feb 2024 13:51:26 -0500
+Subject: [PATCH] Improve PKCS11 error reporting in PKINIT
+
+Create a helper p11err() to set extended error message for failed
+PKCS11 operations, and use it instead of pkiDebug() and pkcs11error().
+
+ticket: 9113 (new)
+(cherry picked from commit 98afb314d13939cbee19c69885dcb655db8460da)
+---
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 262 ++++++++++--------
+ src/plugins/preauth/pkinit/pkinit_trace.h     |   9 -
+ 2 files changed, 142 insertions(+), 129 deletions(-)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 4accfc2664..402bf1b9b3 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -161,9 +161,11 @@ static krb5_error_code pkinit_create_sequence_of_principal_identifiers
+  int type, krb5_pa_data ***e_data_out);
+ 
+ #ifndef WITHOUT_PKCS11
+-static krb5_error_code pkinit_find_private_key
+-(pkinit_identity_crypto_context, CK_ATTRIBUTE_TYPE usage,
+- CK_OBJECT_HANDLE *objp);
++static krb5_error_code
++pkinit_find_private_key(krb5_context context,
++                        pkinit_identity_crypto_context id_cryptoctx,
++                        CK_ATTRIBUTE_TYPE usage,
++                        CK_OBJECT_HANDLE *objp);
+ static krb5_error_code pkinit_login
+ (krb5_context context, pkinit_identity_crypto_context id_cryptoctx,
+  CK_TOKEN_INFO *tip, const char *password);
+@@ -180,6 +182,8 @@ static krb5_error_code pkinit_sign_data_pkcs11
+ (krb5_context context, pkinit_identity_crypto_context id_cryptoctx,
+  unsigned char *data, unsigned int data_len,
+  unsigned char **sig, unsigned int *sig_len);
++
++static krb5_error_code p11err(krb5_context context, CK_RV rv, const char *op);
+ #endif  /* WITHOUT_PKCS11 */
+ 
+ static krb5_error_code pkinit_sign_data_fs
+@@ -197,9 +201,6 @@ create_krb5_invalidCertificates(krb5_context context,
+ static krb5_error_code
+ create_identifiers_from_stack(STACK_OF(X509) *sk,
+                               krb5_external_principal_identifier *** ids);
+-static const char *
+-pkcs11err(int err);
+-
+ 
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 
+@@ -944,8 +945,9 @@ cleanup:
+ 
+ #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ 
++#ifndef WITHOUT_PKC11
+ static struct pkcs11_errstrings {
+-    short code;
++    CK_RV code;
+     char *text;
+ } pkcs11_errstrings[] = {
+     { 0x0,      "ok" },
+@@ -1035,6 +1037,7 @@ static struct pkcs11_errstrings {
+     { 0x200,    "function rejected" },
+     { -1,       NULL }
+ };
++#endif
+ 
+ MAKE_INIT_FUNCTION(pkinit_openssl_init);
+ 
+@@ -1563,6 +1566,8 @@ pkinit_fini_pkcs11(pkinit_identity_crypto_context ctx)
+     free(ctx->token_label);
+     free(ctx->cert_id);
+     free(ctx->cert_label);
++    ctx->p11_module_name = ctx->token_label = ctx->cert_label = NULL;
++    ctx->cert_id = NULL;
+ #endif
+ }
+ 
+@@ -3344,48 +3349,53 @@ pkinit_pkcs7type2oid(pkinit_plg_crypto_context cryptoctx, int pkcs7_type)
+ }
+ 
+ #ifndef WITHOUT_PKCS11
+-static struct plugin_file_handle *
++static krb5_error_code
+ load_pkcs11_module(krb5_context context, const char *modname,
+-                   CK_FUNCTION_LIST_PTR_PTR p11p)
++                   struct plugin_file_handle **handle_out,
++                   CK_FUNCTION_LIST_PTR_PTR p11_out)
+ {
+     struct plugin_file_handle *handle = NULL;
+-    CK_RV (*getflist)(CK_FUNCTION_LIST_PTR_PTR);
++    CK_RV rv, (*getflist)(CK_FUNCTION_LIST_PTR_PTR);
+     struct errinfo einfo = EMPTY_ERRINFO;
+-    const char *errmsg = NULL;
++    const char *errmsg = NULL, *failure;
+     void (*sym)(void);
+     long err;
+-    CK_RV rv;
+ 
+     TRACE_PKINIT_PKCS11_OPEN(context, modname);
+     err = krb5int_open_plugin(modname, &handle, &einfo);
+     if (err) {
+-        errmsg = k5_get_error(&einfo, err);
+-        TRACE_PKINIT_PKCS11_OPEN_FAILED(context, errmsg);
++        failure = _("Cannot load PKCS11 module");
+         goto error;
+     }
+ 
+     err = krb5int_get_plugin_func(handle, "C_GetFunctionList", &sym, &einfo);
+     if (err) {
+-        errmsg = k5_get_error(&einfo, err);
+-        TRACE_PKINIT_PKCS11_GETSYM_FAILED(context, errmsg);
++        failure = _("Cannot find C_GetFunctionList in PKCS11 module");
+         goto error;
+     }
+ 
+     getflist = (CK_RV (*)(CK_FUNCTION_LIST_PTR_PTR))sym;
+-    rv = (*getflist)(p11p);
++    rv = (*getflist)(p11_out);
+     if (rv != CKR_OK) {
+-        TRACE_PKINIT_PKCS11_GETFLIST_FAILED(context, pkcs11err(rv));
++        failure = _("Cannot retrieve function list in PKCS11 module");
+         goto error;
+     }
+ 
+-    return handle;
++    *handle_out = handle;
++    return 0;
+ 
+ error:
+-    k5_free_error(&einfo, errmsg);
++    if (err) {
++        errmsg = k5_get_error(&einfo, err);
++        k5_setmsg(context, err, _("%s: %s"), failure, errmsg);
++    } else {
++        err = KRB5KDC_ERR_PREAUTH_FAILED;
++        k5_setmsg(context, err, "%s", failure);
++    }
+     k5_clear_error(&einfo);
+     if (handle != NULL)
+         krb5int_close_plugin(handle);
+-    return NULL;
++    return err;
+ }
+ 
+ static krb5_error_code
+@@ -3393,12 +3403,13 @@ pkinit_login(krb5_context context,
+              pkinit_identity_crypto_context id_cryptoctx,
+              CK_TOKEN_INFO *tip, const char *password)
+ {
++    krb5_error_code ret = 0;
++    CK_RV rv;
+     krb5_data rdat;
+     char *prompt;
+     const char *warning;
+     krb5_prompt kprompt;
+     krb5_prompt_type prompt_type;
+-    int r = 0;
+ 
+     if (tip->flags & CKF_PROTECTED_AUTHENTICATION_PATH) {
+         rdat.data = NULL;
+@@ -3407,7 +3418,7 @@ pkinit_login(krb5_context context,
+         rdat.data = strdup(password);
+         rdat.length = strlen(password);
+     } else if (id_cryptoctx->prompter == NULL) {
+-        r = KRB5_LIBOS_CANTREADPWD;
++        ret = KRB5_LIBOS_CANTREADPWD;
+         rdat.data = NULL;
+     } else {
+         if (tip->flags & CKF_USER_PIN_LOCKED)
+@@ -3431,31 +3442,28 @@ pkinit_login(krb5_context context,
+ 
+         /* PROMPTER_INVOCATION */
+         k5int_set_prompt_types(context, &prompt_type);
+-        r = (*id_cryptoctx->prompter)(context, id_cryptoctx->prompter_data,
+-                                      NULL, NULL, 1, &kprompt);
++        ret = (*id_cryptoctx->prompter)(context, id_cryptoctx->prompter_data,
++                                        NULL, NULL, 1, &kprompt);
+         k5int_set_prompt_types(context, 0);
+         free(prompt);
+     }
+ 
+-    if (r == 0) {
+-        r = id_cryptoctx->p11->C_Login(id_cryptoctx->session, CKU_USER,
+-                                       (u_char *) rdat.data, rdat.length);
+-
+-        if (r != CKR_OK) {
+-            TRACE_PKINIT_PKCS11_LOGIN_FAILED(context, pkcs11err(r));
+-            r = KRB5KDC_ERR_PREAUTH_FAILED;
+-        }
++    if (!ret) {
++        rv = id_cryptoctx->p11->C_Login(id_cryptoctx->session, CKU_USER,
++                                        (uint8_t *)rdat.data, rdat.length);
++        if (rv != CKR_OK)
++            ret = p11err(context, rv, "C_Login");
+     }
+     free(rdat.data);
+ 
+-    return r;
++    return ret;
+ }
+ 
+ static krb5_error_code
+ pkinit_open_session(krb5_context context,
+                     pkinit_identity_crypto_context cctx)
+ {
+-    CK_ULONG i, pret;
++    CK_ULONG i, rv;
+     unsigned char *cp;
+     size_t label_len;
+     CK_ULONG count = 0;
+@@ -3469,30 +3477,35 @@ pkinit_open_session(krb5_context context,
+         return 0; /* session already open */
+ 
+     /* Load module */
+-    cctx->p11_module = load_pkcs11_module(context, cctx->p11_module_name,
+-                                          &cctx->p11);
+-    if (cctx->p11_module == NULL)
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
++    ret = load_pkcs11_module(context, cctx->p11_module_name, &cctx->p11_module,
++                             &cctx->p11);
++    if (ret)
++        goto cleanup;
+ 
+     /* Init */
+-    pret = cctx->p11->C_Initialize(NULL);
+-    if (pret != CKR_OK) {
+-        pkiDebug("C_Initialize: %s\n", pkcs11err(pret));
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = cctx->p11->C_Initialize(NULL);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_Initialize");
++        goto cleanup;
+     }
+ 
+     /* Get the list of available slots */
+-    if (cctx->p11->C_GetSlotList(TRUE, NULL, &count) != CKR_OK)
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = cctx->p11->C_GetSlotList(TRUE, NULL, &count);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_GetSlotList");
++        goto cleanup;
++    }
+     if (count == 0) {
+         TRACE_PKINIT_PKCS11_NO_TOKEN(context);
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
++        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        goto cleanup;
+     }
+-    slotlist = calloc(count, sizeof(CK_SLOT_ID));
++    slotlist = k5calloc(count, sizeof(CK_SLOT_ID), &ret);
+     if (slotlist == NULL)
+-        return ENOMEM;
+-    if (cctx->p11->C_GetSlotList(TRUE, slotlist, &count) != CKR_OK) {
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        goto cleanup;
++    rv = cctx->p11->C_GetSlotList(TRUE, slotlist, &count);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_GetSlotList");
+         goto cleanup;
+     }
+ 
+@@ -3503,19 +3516,17 @@ pkinit_open_session(krb5_context context,
+             continue;
+ 
+         /* Open session */
+-        pret = cctx->p11->C_OpenSession(slotlist[i], CKF_SERIAL_SESSION,
+-                                        NULL, NULL, &cctx->session);
+-        if (pret != CKR_OK) {
+-            pkiDebug("C_OpenSession: %s\n", pkcs11err(pret));
+-            ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        rv = cctx->p11->C_OpenSession(slotlist[i], CKF_SERIAL_SESSION,
++                                      NULL, NULL, &cctx->session);
++        if (rv != CKR_OK) {
++            ret = p11err(context, rv, "C_OpenSession");
+             goto cleanup;
+         }
+ 
+         /* Get token info */
+-        pret = cctx->p11->C_GetTokenInfo(slotlist[i], &tinfo);
+-        if (pret != CKR_OK) {
+-            pkiDebug("C_GetTokenInfo: %s\n", pkcs11err(pret));
+-            ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        rv = cctx->p11->C_GetTokenInfo(slotlist[i], &tinfo);
++        if (rv != CKR_OK) {
++            ret = p11err(context, rv, "C_GetTokenInfo");
+             goto cleanup;
+         }
+ 
+@@ -3577,6 +3588,10 @@ pkinit_open_session(krb5_context context,
+ 
+     ret = 0;
+ cleanup:
++    /* On error, finalize the PKCS11 fields to ensure that we don't mistakenly
++     * short-circuit with success on the next call. */
++    if (ret)
++        pkinit_fini_pkcs11(cctx);
+     free(slotlist);
+     free(p11name);
+     return ret;
+@@ -3598,16 +3613,17 @@ cleanup:
+  * If there are more than one, we just take the first one.
+  */
+ 
+-krb5_error_code
+-pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx,
++static krb5_error_code
++pkinit_find_private_key(krb5_context context,
++                        pkinit_identity_crypto_context id_cryptoctx,
+                         CK_ATTRIBUTE_TYPE usage,
+                         CK_OBJECT_HANDLE *objp)
+ {
+     CK_OBJECT_CLASS cls;
+     CK_ATTRIBUTE attrs[4];
+     CK_ULONG count;
++    CK_RV rv;
+     unsigned int nattrs = 0;
+-    int r;
+ #ifdef PKINIT_USE_KEY_USAGE
+     CK_BBOOL true_false;
+ #endif
+@@ -3637,18 +3653,21 @@ pkinit_find_private_key(pkinit_identity_crypto_context id_cryptoctx,
+     attrs[nattrs].ulValueLen = id_cryptoctx->cert_id_len;
+     nattrs++;
+ 
+-    r = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs, nattrs);
+-    if (r != CKR_OK) {
+-        pkiDebug("krb5_pkinit_sign_data: C_FindObjectsInit: %s\n",
+-                 pkcs11err(r));
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
+-    }
++    rv = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs,
++                                              nattrs);
++    if (rv != CKR_OK)
++        return p11err(context, rv, _("C_FindObjectsInit"));
+ 
+-    r = id_cryptoctx->p11->C_FindObjects(id_cryptoctx->session, objp, 1, &count);
++    rv = id_cryptoctx->p11->C_FindObjects(id_cryptoctx->session, objp, 1,
++                                          &count);
+     id_cryptoctx->p11->C_FindObjectsFinal(id_cryptoctx->session);
+-    pkiDebug("found %d private keys (%s)\n", (int)count, pkcs11err(r));
+-    if (r != CKR_OK || count < 1)
++    if (rv != CKR_OK)
++        return p11err(context, rv, _("C_FindObjects"));
++    if (count < 1) {
++        k5_setmsg(context, KRB5KDC_ERR_PREAUTH_FAILED,
++                  _("Found no private keys in PKCS11 token"));
+         return KRB5KDC_ERR_PREAUTH_FAILED;
++    }
+     return 0;
+ }
+ #endif
+@@ -3796,34 +3815,32 @@ pkinit_sign_data_pkcs11(krb5_context context,
+     CK_FUNCTION_LIST_PTR p11;
+     CK_ATTRIBUTE attr;
+     CK_KEY_TYPE keytype;
++    CK_RV rv;
+     EVP_MD_CTX *ctx;
+     const EVP_MD *md = EVP_sha256();
+     unsigned int mdlen;
+     uint8_t mdbuf[EVP_MAX_MD_SIZE], *dinfo = NULL, *sigbuf = NULL, *input;
+     size_t dinfo_len, input_len;
+-    int r;
+ 
+     *sig = NULL;
+     *sig_len = 0;
+ 
+-    if (pkinit_open_session(context, id_cryptoctx)) {
+-        pkiDebug("can't open pkcs11 session\n");
+-        return KRB5KDC_ERR_PREAUTH_FAILED;
+-    }
++    ret = pkinit_open_session(context, id_cryptoctx);
++    if (ret)
++        return ret;
+     p11 = id_cryptoctx->p11;
+     session = id_cryptoctx->session;
+ 
+-    ret = pkinit_find_private_key(id_cryptoctx, CKA_SIGN, &obj);
++    ret = pkinit_find_private_key(context, id_cryptoctx, CKA_SIGN, &obj);
+     if (ret)
+         return ret;
+ 
+     attr.type = CKA_KEY_TYPE;
+     attr.pValue = &keytype;
+     attr.ulValueLen = sizeof(keytype);
+-    r = p11->C_GetAttributeValue(session, obj, &attr, 1);
+-    if (r) {
+-        pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(r));
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = p11->C_GetAttributeValue(session, obj, &attr, 1);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_GetAttributeValue");
+         goto cleanup;
+     }
+ 
+@@ -3865,10 +3882,9 @@ pkinit_sign_data_pkcs11(krb5_context context,
+     mech.pParameter = NULL;
+     mech.ulParameterLen = 0;
+ 
+-    r = p11->C_SignInit(session, &mech, obj);
+-    if (r != CKR_OK) {
+-        pkiDebug("C_SignInit: %s\n", pkcs11err(r));
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = p11->C_SignInit(session, &mech, obj);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_SignInit");
+         goto cleanup;
+     }
+ 
+@@ -3881,18 +3897,17 @@ pkinit_sign_data_pkcs11(krb5_context context,
+     if (sigbuf == NULL)
+         goto cleanup;
+ 
+-    r = p11->C_Sign(session, input, input_len, sigbuf, &len);
+-    if (r == CKR_BUFFER_TOO_SMALL || (r == CKR_OK && len >= PK_SIGLEN_GUESS)) {
++    rv = p11->C_Sign(session, input, input_len, sigbuf, &len);
++    if (rv == CKR_BUFFER_TOO_SMALL ||
++        (rv == CKR_OK && len >= PK_SIGLEN_GUESS)) {
+         free(sigbuf);
+-        pkiDebug("C_Sign realloc %d\n", (int) len);
+         sigbuf = k5alloc(len, &ret);
+         if (sigbuf == NULL)
+             goto cleanup;
+-        r = p11->C_Sign(session, input, input_len, sigbuf, &len);
++        rv = p11->C_Sign(session, input, input_len, sigbuf, &len);
+     }
+-    if (r != CKR_OK) {
+-        pkiDebug("C_Sign: %s\n", pkcs11err(r));
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_Sign");
+         goto cleanup;
+     }
+ 
+@@ -4348,13 +4363,14 @@ reassemble_pkcs11_name(pkinit_identity_opts *idopts)
+ }
+ 
+ static krb5_error_code
+-load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session,
+-              pkinit_identity_opts *idopts, pkinit_cred_info *cred_out)
++load_one_cert(krb5_context context, CK_FUNCTION_LIST_PTR p11,
++              CK_SESSION_HANDLE session, pkinit_identity_opts *idopts,
++              pkinit_cred_info *cred_out)
+ {
+     krb5_error_code ret;
+     CK_ATTRIBUTE attrs[2];
+     CK_BYTE_PTR cert = NULL, cert_id = NULL;
+-    CK_RV pret;
++    CK_RV rv;
+     const unsigned char *cp;
+     CK_OBJECT_HANDLE obj;
+     CK_ULONG count;
+@@ -4364,8 +4380,8 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session,
+     *cred_out = NULL;
+ 
+     /* Look for X.509 cert. */
+-    pret = p11->C_FindObjects(session, &obj, 1, &count);
+-    if (pret != CKR_OK || count <= 0)
++    rv = p11->C_FindObjects(session, &obj, 1, &count);
++    if (rv != CKR_OK || count <= 0)
+         return 0;
+ 
+     /* Get cert and id len. */
+@@ -4375,10 +4391,9 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session,
+     attrs[1].type = CKA_ID;
+     attrs[1].pValue = NULL;
+     attrs[1].ulValueLen = 0;
+-    pret = p11->C_GetAttributeValue(session, obj, attrs, 2);
+-    if (pret != CKR_OK && pret != CKR_BUFFER_TOO_SMALL) {
+-        pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(pret));
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = p11->C_GetAttributeValue(session, obj, attrs, 2);
++    if (rv != CKR_OK && rv != CKR_BUFFER_TOO_SMALL) {
++        ret = p11err(context, rv, "C_GetAttributeValue");
+         goto cleanup;
+     }
+ 
+@@ -4393,10 +4408,9 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session,
+     attrs[0].pValue = cert;
+     attrs[1].type = CKA_ID;
+     attrs[1].pValue = cert_id;
+-    pret = p11->C_GetAttributeValue(session, obj, attrs, 2);
+-    if (pret != CKR_OK) {
+-        pkiDebug("C_GetAttributeValue: %s\n", pkcs11err(pret));
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++    rv = p11->C_GetAttributeValue(session, obj, attrs, 2);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_GetAttributeValue");
+         goto cleanup;
+     }
+ 
+@@ -4406,7 +4420,8 @@ load_one_cert(CK_FUNCTION_LIST_PTR p11, CK_SESSION_HANDLE session,
+     cp = (unsigned char *)cert;
+     x = d2i_X509(NULL, &cp, (int)attrs[0].ulValueLen);
+     if (x == NULL) {
+-        ret = KRB5KDC_ERR_PREAUTH_FAILED;
++        ret = oerr(context, 0,
++                   _("Failed to decode X509 certificate from PKCS11 token"));
+         goto cleanup;
+     }
+ 
+@@ -4444,7 +4459,7 @@ pkinit_get_certs_pkcs11(krb5_context context,
+     int i;
+     unsigned int nattrs;
+     krb5_error_code ret;
+-    CK_RV pret;
++    CK_RV rv;
+ 
+     /* Copy stuff from idopts -> id_cryptoctx */
+     if (idopts->p11_module_name != NULL) {
+@@ -4516,16 +4531,16 @@ pkinit_get_certs_pkcs11(krb5_context context,
+         nattrs++;
+     }
+ 
+-    pret = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs,
+-                                                nattrs);
+-    if (pret != CKR_OK) {
+-        pkiDebug("C_FindObjectsInit: %s\n", pkcs11err(pret));
++    rv = id_cryptoctx->p11->C_FindObjectsInit(id_cryptoctx->session, attrs,
++                                              nattrs);
++    if (rv != CKR_OK) {
++        ret = p11err(context, rv, "C_FindObjectsInit");
+         return KRB5KDC_ERR_PREAUTH_FAILED;
+     }
+ 
+     for (i = 0; i < MAX_CREDS_ALLOWED; i++) {
+-        ret = load_one_cert(id_cryptoctx->p11, id_cryptoctx->session, idopts,
+-                            &id_cryptoctx->creds[i]);
++        ret = load_one_cert(context, id_cryptoctx->p11, id_cryptoctx->session,
++                            idopts, &id_cryptoctx->creds[i]);
+         if (ret)
+             return ret;
+         if (id_cryptoctx->creds[i] == NULL)
+@@ -5510,19 +5525,26 @@ print_pubkey(BIGNUM * key, char *msg)
+ }
+ #endif
+ 
+-static const char *
+-pkcs11err(int err)
++#ifndef WITHOUT_PKCS11
++static krb5_error_code
++p11err(krb5_context context, CK_RV rv, const char *op)
+ {
++    krb5_error_code code = KRB5KDC_ERR_PREAUTH_FAILED;
+     int i;
++    const char *msg;
+ 
+-    for (i = 0; pkcs11_errstrings[i].text != NULL; i++)
+-        if (pkcs11_errstrings[i].code == err)
++    for (i = 0; pkcs11_errstrings[i].text != NULL; i++) {
++        if (pkcs11_errstrings[i].code == rv)
+             break;
+-    if (pkcs11_errstrings[i].text != NULL)
+-        return (pkcs11_errstrings[i].text);
++    }
++    msg = pkcs11_errstrings[i].text;
++    if (msg == NULL)
++        msg = "unknown PKCS11 error";
+ 
+-    return "unknown PKCS11 error";
++    krb5_set_error_message(context, code, _("PKCS11 error (%s): %s"), op, msg);
++    return code;
+ }
++#endif
+ 
+ /*
+  * Add an item to the pkinit_identity_crypto_context's list of deferred
+diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h
+index 1c1ceb5a41..1faa6816d7 100644
+--- a/src/plugins/preauth/pkinit/pkinit_trace.h
++++ b/src/plugins/preauth/pkinit/pkinit_trace.h
+@@ -98,21 +98,12 @@
+ #define TRACE_PKINIT_OPENSSL_ERROR(c, msg)              \
+     TRACE(c, "PKINIT OpenSSL error: {str}", msg)
+ 
+-#define TRACE_PKINIT_PKCS11_GETFLIST_FAILED(c, errstr)                  \
+-    TRACE(c, "PKINIT PKCS11 C_GetFunctionList failed: {str}", errstr)
+-#define TRACE_PKINIT_PKCS11_GETSYM_FAILED(c, errstr)                    \
+-    TRACE(c, "PKINIT unable to find PKCS11 plugin symbol "              \
+-          "C_GetFunctionList: {str}", errstr)
+-#define TRACE_PKINIT_PKCS11_LOGIN_FAILED(c, errstr)             \
+-    TRACE(c, "PKINIT PKCS11 C_Login failed: {str}", errstr)
+ #define TRACE_PKINIT_PKCS11_NO_MATCH_TOKEN(c)                   \
+     TRACE(c, "PKINIT PKCS#11 module has no matching tokens")
+ #define TRACE_PKINIT_PKCS11_NO_TOKEN(c)                                 \
+     TRACE(c, "PKINIT PKCS#11 module shows no slots with tokens")
+ #define TRACE_PKINIT_PKCS11_OPEN(c, name)                       \
+     TRACE(c, "PKINIT opening PKCS#11 module \"{str}\"", name)
+-#define TRACE_PKINIT_PKCS11_OPEN_FAILED(c, errstr)                      \
+-    TRACE(c, "PKINIT PKCS#11 module open failed: {str}", errstr)
+ #define TRACE_PKINIT_PKCS11_SLOT(c, slot, len, label)            \
+     TRACE(c, "PKINIT PKCS#11 slotid {int} token {lenstr}",       \
+           slot, len, label)
+-- 
+2.47.1
+
diff --git a/0033-Set-missing-mask-flags-for-kdb5_util-operations.patch b/0033-Set-missing-mask-flags-for-kdb5_util-operations.patch
new file mode 100644
index 0000000..71b30d1
--- /dev/null
+++ b/0033-Set-missing-mask-flags-for-kdb5_util-operations.patch
@@ -0,0 +1,61 @@
+From 946f7dba8cea3d2ed0e68c5e7594cbd7e1364609 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 1 Aug 2024 10:56:07 +0200
+Subject: [PATCH] Set missing mask flags for kdb5_util operations
+
+Set KADM5_TL_DATA for the use_mkey and update_princ_encryption
+commands.  (Commit c877f13c8985d820583b0d7ac1bb4c5dc36e677e did this
+for the add_new_mkey and purge_mkeys commands.)  Set appropriate flags
+for the add_random_key command.
+
+[ghudson@mit.edu: combined two commits; pruned out proposed mask flag
+additions for values represented within key data or tl-data (like
+KADM5_MKVNO), as those flags are currently only used in the kadm5
+protocol, not to communicate with the KDB module]
+
+ticket: 9158 (new)
+(cherry picked from commit 4ed7da378940198cf4415f86d4eb013de6ac6455)
+---
+ src/kadmin/dbutil/kdb5_mkey.c | 4 +++-
+ src/kadmin/dbutil/kdb5_util.c | 3 +++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/kadmin/dbutil/kdb5_mkey.c b/src/kadmin/dbutil/kdb5_mkey.c
+index aceb0a9b80..ac5c51d05e 100644
+--- a/src/kadmin/dbutil/kdb5_mkey.c
++++ b/src/kadmin/dbutil/kdb5_mkey.c
+@@ -525,6 +525,8 @@ kdb5_use_mkey(int argc, char *argv[])
+         goto cleanup_return;
+     }
+ 
++    master_entry->mask |= KADM5_TL_DATA;
++
+     if ((retval = krb5_db_put_principal(util_context, master_entry))) {
+         com_err(progname, retval,
+                 _("while adding master key entry to the database"));
+@@ -814,7 +816,7 @@ update_princ_encryption_1(void *cb, krb5_db_entry *ent)
+         goto fail;
+     }
+ 
+-    ent->mask |= KADM5_KEY_DATA;
++    ent->mask |= KADM5_KEY_DATA | KADM5_TL_DATA;
+ 
+     if ((retval = krb5_db_put_principal(util_context, ent))) {
+         com_err(progname, retval, _("while updating principal '%s' key data "
+diff --git a/src/kadmin/dbutil/kdb5_util.c b/src/kadmin/dbutil/kdb5_util.c
+index 55d529fa4c..afc817891b 100644
+--- a/src/kadmin/dbutil/kdb5_util.c
++++ b/src/kadmin/dbutil/kdb5_util.c
+@@ -600,6 +600,9 @@ add_random_key(int argc, char **argv)
+         exit_status++;
+         return;
+     }
++
++    dbent->mask |= KADM5_ATTRIBUTES | KADM5_KEY_DATA | KADM5_TL_DATA;
++
+     ret = krb5_db_put_principal(util_context, dbent);
+     krb5_db_free_principal(util_context, dbent);
+     if (ret) {
+-- 
+2.47.1
+
diff --git a/0034-Prevent-overflow-when-calculating-ulog-block-size.patch b/0034-Prevent-overflow-when-calculating-ulog-block-size.patch
new file mode 100644
index 0000000..d288951
--- /dev/null
+++ b/0034-Prevent-overflow-when-calculating-ulog-block-size.patch
@@ -0,0 +1,64 @@
+From 9b669dd42b28e7900f5ccac2816204e7d04ea23c Mon Sep 17 00:00:00 2001
+From: Zoltan Borbely <Zoltan.Borbely@morganstanley.com>
+Date: Tue, 28 Jan 2025 16:39:25 -0500
+Subject: [PATCH] Prevent overflow when calculating ulog block size
+
+In kdb_log.c:resize(), log an error and fail if the update size is
+larger than the largest possible block size (2^16-1).
+
+CVE-2025-24528:
+
+In MIT krb5 release 1.7 and later with incremental propagation
+enabled, an authenticated attacker can cause kadmind to write beyond
+the end of the mapped region for the iprop log file, likely causing a
+process crash.
+
+[ghudson@mit.edu: edited commit message and added CVE description]
+
+ticket: 9159 (new)
+tags: pullup
+target_version: 1.21-next
+
+(cherry picked from commit 78ceba024b64d49612375be4a12d1c066b0bfbd0)
+---
+ src/lib/kdb/kdb_log.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/kdb/kdb_log.c b/src/lib/kdb/kdb_log.c
+index e9b95fce59..c805ebd988 100644
+--- a/src/lib/kdb/kdb_log.c
++++ b/src/lib/kdb/kdb_log.c
+@@ -183,7 +183,7 @@ extend_file_to(int fd, unsigned int new_size)
+  */
+ static krb5_error_code
+ resize(kdb_hlog_t *ulog, uint32_t ulogentries, int ulogfd,
+-       unsigned int recsize)
++       unsigned int recsize, const kdb_incr_update_t *upd)
+ {
+     unsigned int new_block, new_size;
+ 
+@@ -195,6 +195,12 @@ resize(kdb_hlog_t *ulog, uint32_t ulogentries, int ulogfd,
+     new_block *= ULOG_BLOCK;
+     new_size += ulogentries * new_block;
+ 
++    if (new_block > UINT16_MAX) {
++        syslog(LOG_ERR, _("ulog overflow caused by principal %.*s"),
++               upd->kdb_princ_name.utf8str_t_len,
++               upd->kdb_princ_name.utf8str_t_val);
++        return KRB5_LOG_ERROR;
++    }
+     if (new_size > MAXLOGLEN)
+         return KRB5_LOG_ERROR;
+ 
+@@ -291,7 +297,7 @@ store_update(kdb_log_context *log_ctx, kdb_incr_update_t *upd)
+     recsize = sizeof(kdb_ent_header_t) + upd_size;
+ 
+     if (recsize > ulog->kdb_block) {
+-        retval = resize(ulog, ulogentries, log_ctx->ulogfd, recsize);
++        retval = resize(ulog, ulogentries, log_ctx->ulogfd, recsize, upd);
+         if (retval)
+             return retval;
+     }
+-- 
+2.48.1
+
diff --git a/0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch b/0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch
new file mode 100644
index 0000000..4c2ba40
--- /dev/null
+++ b/0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch
@@ -0,0 +1,327 @@
+From c617915958a5cb05463713adcf03b6a0e0512ac3 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 16 Dec 2022 18:31:07 -0500
+Subject: [PATCH] Don't issue session keys with deprecated enctypes
+
+A paper by Tom Tervoort noted that rc4-hmac pre-hashes the input for
+its checksum and GSS operations before applying HMAC, and is therefore
+potentially vulnerable to hash collision attacks if a protocol
+contains a restricted signing oracle.
+
+In light of these potential attacks, begin the functional deprecation
+of DES3 and RC4 by disallowing their use as session key enctypes by
+default.  Add the variables allow_des3 and allow_rc4 in case
+negotiability of these enctypes for session keys needs to be turned
+back on, with the expectation that in future releases the enctypes
+will be more comprehensively deprecated.
+
+ticket: 9081
+(cherry picked from commit 1b57a4d134bbd0e7c52d5885a92eccc815726463)
+---
+ doc/admin/conf_files/krb5_conf.rst | 12 ++++++++++++
+ doc/admin/enctypes.rst             | 23 +++++++++++++++++++---
+ src/include/k5-int.h               |  4 ++++
+ src/kdc/kdc_util.c                 | 10 ++++++++++
+ src/lib/krb5/krb/get_in_tkt.c      | 31 +++++++++++++++++++-----------
+ src/lib/krb5/krb/init_ctx.c        | 10 ++++++++++
+ src/tests/gssapi/t_enctypes.py     |  5 +++--
+ src/tests/t_etype_info.py          |  5 +++--
+ src/tests/t_sesskeynego.py         | 28 +++++++++++++++++++++++++--
+ src/util/k5test.py                 |  9 ++++++++-
+ 10 files changed, 116 insertions(+), 21 deletions(-)
+
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index dca52e1426..d51fd3ce7e 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -95,6 +95,18 @@ Additionally, krb5.conf may include any of the relations described in
+ 
+ The libdefaults section may contain any of the following relations:
+ 
++**allow_des3**
++    Permit the KDC to issue tickets with des3-cbc-sha1 session keys.
++    In future releases, this flag will allow des3-cbc-sha1 to be used
++    at all.  The default value for this tag is false.  (Added in
++    release 1.21.)
++
++**allow_rc4**
++    Permit the KDC to issue tickets with arcfour-hmac session keys.
++    In future releases, this flag will allow arcfour-hmac to be used
++    at all.  The default value for this tag is false.  (Added in
++    release 1.21.)
++
+ **allow_weak_crypto**
+     If this flag is set to false, then weak encryption types (as noted
+     in :ref:`Encryption_types` in :ref:`kdc.conf(5)`) will be filtered
+diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
+index c4d5499d3b..2b4ed7da0b 100644
+--- a/doc/admin/enctypes.rst
++++ b/doc/admin/enctypes.rst
+@@ -48,12 +48,15 @@ Session key selection
+ The KDC chooses the session key enctype by taking the intersection of
+ its **permitted_enctypes** list, the list of long-term keys for the
+ most recent kvno of the service, and the client's requested list of
+-enctypes.
++enctypes.  Starting in krb5-1.21, all services are assumed to support
++aes256-cts-hmac-sha1-96; also, des3-cbc-sha1 and arcfour-hmac session
++keys will not be issued by default.
+ 
+ Starting in krb5-1.11, it is possible to set a string attribute on a
+ service principal to control what session key enctypes the KDC may
+-issue for service tickets for that principal.  See :ref:`set_string`
+-in :ref:`kadmin(1)` for details.
++issue for service tickets for that principal, overriding the service's
++long-term keys and the assumption of aes256-cts-hmac-sha1-96 support.
++See :ref:`set_string` in :ref:`kadmin(1)` for details.
+ 
+ 
+ Choosing enctypes for a service
+@@ -87,6 +90,20 @@ affect how enctypes are chosen.
+     acceptable risk for your environment and the weak enctypes are
+     required for backward compatibility.
+ 
++**allow_des3**
++    was added in release 1.21 and defaults to *false*.  Unless this
++    flag is set to *true*, the KDC will not issue tickets with
++    des3-cbc-sha1 session keys.  In a future release, this flag will
++    control whether des3-cbc-sha1 is permitted in similar fashion to
++    weak enctypes.
++
++**allow_rc4**
++    was added in release 1.21 and defaults to *false*.  Unless this
++    flag is set to *true*, the KDC will not issue tickets with
++    arcfour-hmac session keys.  In a future release, this flag will
++    control whether arcfour-hmac is permitted in similar fashion to
++    weak enctypes.
++
+ **permitted_enctypes**
+     controls the set of enctypes that a service will permit for
+     session keys and for ticket and authenticator encryption.  The KDC
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index b7789a2dd8..d0a263aa7d 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -181,6 +181,8 @@ typedef unsigned char   u_char;
+  * matches the variable name.  Keep these alphabetized. */
+ #define KRB5_CONF_ACL_FILE                     "acl_file"
+ #define KRB5_CONF_ADMIN_SERVER                 "admin_server"
++#define KRB5_CONF_ALLOW_DES3                   "allow_des3"
++#define KRB5_CONF_ALLOW_RC4                    "allow_rc4"
+ #define KRB5_CONF_ALLOW_WEAK_CRYPTO            "allow_weak_crypto"
+ #define KRB5_CONF_AUTH_TO_LOCAL                "auth_to_local"
+ #define KRB5_CONF_AUTH_TO_LOCAL_NAMES          "auth_to_local_names"
+@@ -1241,6 +1243,8 @@ struct _krb5_context {
+     struct _kdb_log_context *kdblog_context;
+ 
+     krb5_boolean allow_weak_crypto;
++    krb5_boolean allow_des3;
++    krb5_boolean allow_rc4;
+     krb5_boolean ignore_acceptor_hostname;
+     krb5_boolean enforce_ok_as_delegate;
+     enum dns_canonhost dns_canonicalize_hostname;
+diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
+index 93415ba862..c7b6e4090d 100644
+--- a/src/kdc/kdc_util.c
++++ b/src/kdc/kdc_util.c
+@@ -1108,6 +1108,16 @@ select_session_keytype(krb5_context context, krb5_db_entry *server,
+         if (!krb5_is_permitted_enctype(context, ktype[i]))
+             continue;
+ 
++        /*
++         * Prevent these deprecated enctypes from being used as session keys
++         * unless they are explicitly allowed.  In the future they will be more
++         * comprehensively disabled and eventually removed.
++         */
++        if (ktype[i] == ENCTYPE_DES3_CBC_SHA1 && !context->allow_des3)
++            continue;
++        if (ktype[i] == ENCTYPE_ARCFOUR_HMAC && !context->allow_rc4)
++            continue;
++
+         if (dbentry_supports_enctype(context, server, ktype[i]))
+             return ktype[i];
+     }
+diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
+index 1b420a3ac2..ea089f0fcc 100644
+--- a/src/lib/krb5/krb/get_in_tkt.c
++++ b/src/lib/krb5/krb/get_in_tkt.c
+@@ -1582,22 +1582,31 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options,
+     (*prompter)(context, data, 0, banner, 0, 0);
+ }
+ 
+-/* Display a warning via the prompter if des3-cbc-sha1 was used for either the
+- * reply key or the session key. */
++/* Display a warning via the prompter if a deprecated enctype was used for
++ * either the reply key or the session key. */
+ static void
+-warn_des3(krb5_context context, krb5_init_creds_context ctx,
+-          krb5_enctype as_key_enctype)
++warn_deprecated(krb5_context context, krb5_init_creds_context ctx,
++                krb5_enctype as_key_enctype)
+ {
+-    const char *banner;
++    krb5_enctype etype;
++    char encbuf[128], banner[256];
+ 
+-    if (as_key_enctype != ENCTYPE_DES3_CBC_SHA1 &&
+-        ctx->cred.keyblock.enctype != ENCTYPE_DES3_CBC_SHA1)
+-        return;
+     if (ctx->prompter == NULL)
+         return;
+ 
+-    banner = _("Warning: encryption type des3-cbc-sha1 used for "
+-               "authentication is weak and will be disabled");
++    if (krb5int_c_deprecated_enctype(as_key_enctype))
++        etype = as_key_enctype;
++    else if (krb5int_c_deprecated_enctype(ctx->cred.keyblock.enctype))
++        etype = ctx->cred.keyblock.enctype;
++    else
++        return;
++
++    if (krb5_enctype_to_name(etype, FALSE, encbuf, sizeof(encbuf)) != 0)
++        return;
++    snprintf(banner, sizeof(banner),
++             _("Warning: encryption type %s used for authentication is "
++               "deprecated and will be disabled"), encbuf);
++
+     /* PROMPTER_INVOCATION */
+     (*ctx->prompter)(context, ctx->prompter_data, NULL, banner, 0, NULL);
+ }
+@@ -1848,7 +1857,7 @@ init_creds_step_reply(krb5_context context,
+     ctx->complete = TRUE;
+     warn_pw_expiry(context, ctx->opt, ctx->prompter, ctx->prompter_data,
+                    ctx->in_tkt_service, ctx->reply);
+-    warn_des3(context, ctx, encrypting_key.enctype);
++    warn_deprecated(context, ctx, encrypting_key.enctype);
+ 
+ cleanup:
+     krb5_free_pa_data(context, kdc_padata);
+diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
+index 582a2945ff..a32f8dbf03 100644
+--- a/src/lib/krb5/krb/init_ctx.c
++++ b/src/lib/krb5/krb/init_ctx.c
+@@ -220,6 +220,16 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+         goto cleanup;
+     ctx->allow_weak_crypto = tmp;
+ 
++    retval = get_boolean(ctx, KRB5_CONF_ALLOW_DES3, 0, &tmp);
++    if (retval)
++        goto cleanup;
++    ctx->allow_des3 = tmp;
++
++    retval = get_boolean(ctx, KRB5_CONF_ALLOW_RC4, 0, &tmp);
++    if (retval)
++        goto cleanup;
++    ctx->allow_rc4 = tmp;
++
+     retval = get_boolean(ctx, KRB5_CONF_IGNORE_ACCEPTOR_HOSTNAME, 0, &tmp);
+     if (retval)
+         goto cleanup;
+diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
+index 2f95d89967..e6bde47afc 100755
+--- a/src/tests/gssapi/t_enctypes.py
++++ b/src/tests/gssapi/t_enctypes.py
+@@ -10,8 +10,9 @@ d_rc4 = 'DEPRECATED:arcfour-hmac'
+ 
+ # These tests make assumptions about the default enctype lists, so set
+ # them explicitly rather than relying on the library defaults.
+-supp='aes256-cts:normal aes128-cts:normal rc4-hmac:normal'
+-conf = {'libdefaults': {'permitted_enctypes': 'aes rc4'},
++supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal'
++conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4',
++                        'allow_des3': 'true', 'allow_rc4': 'true'},
+         'realms': {'$realm': {'supported_enctypes': supp}}}
+ realm = K5Realm(krb5_conf=conf)
+ shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save'))
+diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
+index a6f538b66d..75d9621dd6 100644
+--- a/src/tests/t_etype_info.py
++++ b/src/tests/t_etype_info.py
+@@ -1,7 +1,8 @@
+ from k5test import *
+ 
+-supported_enctypes = 'aes128-cts rc4-hmac'
+-conf = {'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
++supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac'
++conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'},
++        'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
+ realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf)
+ 
+ realm.run([kadminl, 'addprinc', '-pw', 'pw', '+requires_preauth',
+diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py
+index 9024aee838..5a213617b5 100755
+--- a/src/tests/t_sesskeynego.py
++++ b/src/tests/t_sesskeynego.py
+@@ -25,6 +25,8 @@ conf3 = {'libdefaults': {
+         'default_tkt_enctypes': 'aes128-cts',
+         'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}}
+ conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}}
++conf5 = {'libdefaults': {'allow_rc4': 'true'}}
++conf6 = {'libdefaults': {'allow_des3': 'true'}}
+ # Test with client request and session_enctypes preferring aes128, but
+ # aes256 long-term key.
+ realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False)
+@@ -54,10 +56,12 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes',
+            'aes128-cts,aes256-cts'])
+ test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96')
+ 
+-# 3b: Negotiate rc4-hmac session key when principal only has aes256 long-term.
++# 3b: Skip RC4 (as the KDC does not allow it for session keys by
++# default) and negotiate aes128-cts session key, with only an aes256
++# long-term service key.
+ realm.run([kadminl, 'setstr', 'server', 'session_enctypes',
+            'rc4-hmac,aes128-cts,aes256-cts'])
+-test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
++test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96')
+ realm.stop()
+ 
+ # 4: Check that permitted_enctypes is a default for session key enctypes.
+@@ -67,4 +71,24 @@ realm.run([kvno, 'user'],
+           expected_trace=('etypes requested in TGS request: aes256-cts',))
+ realm.stop()
+ 
++# 5: allow_rc4 permits negotiation of rc4-hmac session key.
++realm = K5Realm(krb5_conf=conf5, create_host=False, get_creds=False)
++realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
++realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac'])
++test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
++realm.stop()
++
++# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key.
++realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False)
++realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
++realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1'])
++test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96')
++realm.stop()
++
++# 7: default config negotiates aes256-sha1 session key for RC4-only service.
++realm = K5Realm(create_host=False, get_creds=False)
++realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server'])
++test_kvno(realm, 'aes256-cts-hmac-sha1-96', 'DEPRECATED:arcfour-hmac')
++realm.stop()
++
+ success('sesskeynego')
+diff --git a/src/util/k5test.py b/src/util/k5test.py
+index d823653aa0..8e5f5ba8e9 100644
+--- a/src/util/k5test.py
++++ b/src/util/k5test.py
+@@ -1338,9 +1338,16 @@ _passes = [
+     # No special settings; exercises AES256.
+     ('default', None, None, None),
+ 
++    # Exercise the DES3 enctype.
++    ('des3', None,
++     {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}},
++     {'realms': {'$realm': {
++                    'supported_enctypes': 'des3-cbc-sha1:normal',
++                    'master_key_type': 'des3-cbc-sha1'}}}),
++
+     # Exercise the arcfour enctype.
+     ('arcfour', None,
+-     {'libdefaults': {'permitted_enctypes': 'rc4'}},
++     {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}},
+      {'realms': {'$realm': {
+                     'supported_enctypes': 'arcfour-hmac:normal',
+                     'master_key_type': 'arcfour-hmac'}}}),
+-- 
+2.49.0
+
diff --git a/0036-downstream-Remove-3des-support-cumulative-1.patch b/0036-downstream-Remove-3des-support-cumulative-1.patch
new file mode 100644
index 0000000..4911619
--- /dev/null
+++ b/0036-downstream-Remove-3des-support-cumulative-1.patch
@@ -0,0 +1,260 @@
+From b0993b57dbe584f9308cc7773b930efe76e19ba3 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Fri, 4 Apr 2025 15:08:36 +0200
+Subject: [PATCH] [downstream] Remove 3des support (cumulative 1)
+
+Remove mentions for the triple-DES encryption type which were added
+since the previous downstream patch.
+---
+ README                             | 15 +++++++--------
+ doc/admin/conf_files/krb5_conf.rst |  6 ------
+ doc/admin/enctypes.rst             | 11 ++---------
+ doc/mitK5features.rst              |  5 ++---
+ src/include/k5-int.h               |  2 --
+ src/kdc/kdc_util.c                 |  2 --
+ src/lib/krb5/krb/init_ctx.c        |  5 -----
+ src/man/krb5.conf.man              |  6 ------
+ src/tests/gssapi/t_enctypes.py     |  5 ++---
+ src/tests/t_etype_info.py          |  4 ++--
+ src/tests/t_sesskeynego.py         |  8 --------
+ src/util/k5test.py                 |  7 -------
+ 12 files changed, 15 insertions(+), 61 deletions(-)
+
+diff --git a/README b/README
+index 6d6f7f16e3..9341bd3dd8 100644
+--- a/README
++++ b/README
+@@ -81,11 +81,11 @@ Triple-DES and RC4 transitions
+ ------------------------------
+ 
+ Beginning with the krb5-1.21 release, the KDC will not issue tickets
+-with triple-DES or RC4 session keys unless explicitly configured using
+-the new allow_des3 and allow_rc4 variables in [libdefaults].  To
+-facilitate the negotiation of session keys, the KDC will assume that
+-all services can handle aes256-sha1 session keys unless the service
+-principal has a session_enctypes string attribute.
++with RC4 session keys unless explicitly configured using the new
++allow_rc4 variable in [libdefaults].  To facilitate the negotiation of
++session keys, the KDC will assume that all services can handle
++aes256-sha1 session keys unless the service principal has a
++session_enctypes string attribute.
+ 
+ Beginning with the krb5-1.19 release, a warning will be issued if
+ initial credentials are acquired using the des3-cbc-sha1 encryption
+@@ -164,9 +164,8 @@ Developer experience:
+ 
+ Protocol evolution:
+ 
+-* The KDC will no longer issue tickets with RC4 or triple-DES session
+-  keys unless explicitly configured with the new allow_rc4 or
+-  allow_des3 variables respectively.
++* The KDC will no longer issue tickets with RC4 session keys unless
++  explicitly configured with the new allow_rc4 variable.
+ 
+ * The KDC will assume that all services can handle aes256-sha1 session
+   keys unless the service principal has a session_enctypes string
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index d51fd3ce7e..d20dcf18e3 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -95,12 +95,6 @@ Additionally, krb5.conf may include any of the relations described in
+ 
+ The libdefaults section may contain any of the following relations:
+ 
+-**allow_des3**
+-    Permit the KDC to issue tickets with des3-cbc-sha1 session keys.
+-    In future releases, this flag will allow des3-cbc-sha1 to be used
+-    at all.  The default value for this tag is false.  (Added in
+-    release 1.21.)
+-
+ **allow_rc4**
+     Permit the KDC to issue tickets with arcfour-hmac session keys.
+     In future releases, this flag will allow arcfour-hmac to be used
+diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
+index 2b4ed7da0b..6ce4638d5e 100644
+--- a/doc/admin/enctypes.rst
++++ b/doc/admin/enctypes.rst
+@@ -49,8 +49,8 @@ The KDC chooses the session key enctype by taking the intersection of
+ its **permitted_enctypes** list, the list of long-term keys for the
+ most recent kvno of the service, and the client's requested list of
+ enctypes.  Starting in krb5-1.21, all services are assumed to support
+-aes256-cts-hmac-sha1-96; also, des3-cbc-sha1 and arcfour-hmac session
+-keys will not be issued by default.
++aes256-cts-hmac-sha1-96; also, arcfour-hmac session keys will not be
++issued by default.
+ 
+ Starting in krb5-1.11, it is possible to set a string attribute on a
+ service principal to control what session key enctypes the KDC may
+@@ -90,13 +90,6 @@ affect how enctypes are chosen.
+     acceptable risk for your environment and the weak enctypes are
+     required for backward compatibility.
+ 
+-**allow_des3**
+-    was added in release 1.21 and defaults to *false*.  Unless this
+-    flag is set to *true*, the KDC will not issue tickets with
+-    des3-cbc-sha1 session keys.  In a future release, this flag will
+-    control whether des3-cbc-sha1 is permitted in similar fashion to
+-    weak enctypes.
+-
+ **allow_rc4**
+     was added in release 1.21 and defaults to *false*.  Unless this
+     flag is set to *true*, the KDC will not issue tickets with
+diff --git a/doc/mitK5features.rst b/doc/mitK5features.rst
+index cad0855724..64d746b0af 100644
+--- a/doc/mitK5features.rst
++++ b/doc/mitK5features.rst
+@@ -659,9 +659,8 @@ Release 1.21
+ 
+ * Protocol evolution:
+ 
+-  - The KDC will no longer issue tickets with RC4 or triple-DES
+-    session keys unless explicitly configured with the new allow_rc4
+-    or allow_des3 variables respectively.
++  - The KDC will no longer issue tickets with RC4 session keys unless
++    explicitly configured with the new allow_rc4 variable.
+ 
+   - The KDC will assume that all services can handle aes256-sha1
+     session keys unless the service principal has a session_enctypes
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index d0a263aa7d..82a763298d 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -181,7 +181,6 @@ typedef unsigned char   u_char;
+  * matches the variable name.  Keep these alphabetized. */
+ #define KRB5_CONF_ACL_FILE                     "acl_file"
+ #define KRB5_CONF_ADMIN_SERVER                 "admin_server"
+-#define KRB5_CONF_ALLOW_DES3                   "allow_des3"
+ #define KRB5_CONF_ALLOW_RC4                    "allow_rc4"
+ #define KRB5_CONF_ALLOW_WEAK_CRYPTO            "allow_weak_crypto"
+ #define KRB5_CONF_AUTH_TO_LOCAL                "auth_to_local"
+@@ -1243,7 +1242,6 @@ struct _krb5_context {
+     struct _kdb_log_context *kdblog_context;
+ 
+     krb5_boolean allow_weak_crypto;
+-    krb5_boolean allow_des3;
+     krb5_boolean allow_rc4;
+     krb5_boolean ignore_acceptor_hostname;
+     krb5_boolean enforce_ok_as_delegate;
+diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
+index c7b6e4090d..bafcf5f728 100644
+--- a/src/kdc/kdc_util.c
++++ b/src/kdc/kdc_util.c
+@@ -1113,8 +1113,6 @@ select_session_keytype(krb5_context context, krb5_db_entry *server,
+          * unless they are explicitly allowed.  In the future they will be more
+          * comprehensively disabled and eventually removed.
+          */
+-        if (ktype[i] == ENCTYPE_DES3_CBC_SHA1 && !context->allow_des3)
+-            continue;
+         if (ktype[i] == ENCTYPE_ARCFOUR_HMAC && !context->allow_rc4)
+             continue;
+ 
+diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
+index a32f8dbf03..82aba64c5e 100644
+--- a/src/lib/krb5/krb/init_ctx.c
++++ b/src/lib/krb5/krb/init_ctx.c
+@@ -220,11 +220,6 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
+         goto cleanup;
+     ctx->allow_weak_crypto = tmp;
+ 
+-    retval = get_boolean(ctx, KRB5_CONF_ALLOW_DES3, 0, &tmp);
+-    if (retval)
+-        goto cleanup;
+-    ctx->allow_des3 = tmp;
+-
+     retval = get_boolean(ctx, KRB5_CONF_ALLOW_RC4, 0, &tmp);
+     if (retval)
+         goto cleanup;
+diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
+index 6c0e9aff8c..4b53988712 100644
+--- a/src/man/krb5.conf.man
++++ b/src/man/krb5.conf.man
+@@ -178,12 +178,6 @@ kdc.conf(5), but it is not a recommended practice.
+ The libdefaults section may contain any of the following relations:
+ .INDENT 0.0
+ .TP
+-\fBallow_des3\fP
+-Permit the KDC to issue tickets with des3\-cbc\-sha1 session keys.
+-In future releases, this flag will allow des3\-cbc\-sha1 to be used
+-at all.  The default value for this tag is false.  (Added in
+-release 1.21.)
+-.TP
+ \fBallow_rc4\fP
+ Permit the KDC to issue tickets with arcfour\-hmac session keys.
+ In future releases, this flag will allow arcfour\-hmac to be used
+diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
+index e6bde47afc..1bb8c40b6b 100755
+--- a/src/tests/gssapi/t_enctypes.py
++++ b/src/tests/gssapi/t_enctypes.py
+@@ -10,9 +10,8 @@ d_rc4 = 'DEPRECATED:arcfour-hmac'
+ 
+ # These tests make assumptions about the default enctype lists, so set
+ # them explicitly rather than relying on the library defaults.
+-supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal'
+-conf = {'libdefaults': {'permitted_enctypes': 'aes des3 rc4',
+-                        'allow_des3': 'true', 'allow_rc4': 'true'},
++supp='aes256-cts:normal aes128-cts:normal rc4-hmac:normal'
++conf = {'libdefaults': {'permitted_enctypes': 'aes rc4', 'allow_rc4': 'true'},
+         'realms': {'$realm': {'supported_enctypes': supp}}}
+ realm = K5Realm(krb5_conf=conf)
+ shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save'))
+diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
+index 75d9621dd6..e82ff7ff07 100644
+--- a/src/tests/t_etype_info.py
++++ b/src/tests/t_etype_info.py
+@@ -1,7 +1,7 @@
+ from k5test import *
+ 
+-supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac'
+-conf = {'libdefaults': {'allow_des3': 'true', 'allow_rc4': 'true'},
++supported_enctypes = 'aes128-cts rc4-hmac'
++conf = {'libdefaults': {'allow_rc4': 'true'},
+         'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
+ realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf)
+ 
+diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py
+index 5a213617b5..c7dba0ff5b 100755
+--- a/src/tests/t_sesskeynego.py
++++ b/src/tests/t_sesskeynego.py
+@@ -26,7 +26,6 @@ conf3 = {'libdefaults': {
+         'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}}
+ conf4 = {'libdefaults': {'permitted_enctypes': 'aes256-cts'}}
+ conf5 = {'libdefaults': {'allow_rc4': 'true'}}
+-conf6 = {'libdefaults': {'allow_des3': 'true'}}
+ # Test with client request and session_enctypes preferring aes128, but
+ # aes256 long-term key.
+ realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False)
+@@ -78,13 +77,6 @@ realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'rc4-hmac'])
+ test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
+ realm.stop()
+ 
+-# 6: allow_des3 permits negotiation of des3-cbc-sha1 session key.
+-realm = K5Realm(krb5_conf=conf6, create_host=False, get_creds=False)
+-realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
+-realm.run([kadminl, 'setstr', 'server', 'session_enctypes', 'des3-cbc-sha1'])
+-test_kvno(realm, 'DEPRECATED:des3-cbc-sha1', 'aes256-cts-hmac-sha1-96')
+-realm.stop()
+-
+ # 7: default config negotiates aes256-sha1 session key for RC4-only service.
+ realm = K5Realm(create_host=False, get_creds=False)
+ realm.run([kadminl, 'addprinc', '-randkey', '-e', 'rc4-hmac', 'server'])
+diff --git a/src/util/k5test.py b/src/util/k5test.py
+index 8e5f5ba8e9..b953827018 100644
+--- a/src/util/k5test.py
++++ b/src/util/k5test.py
+@@ -1338,13 +1338,6 @@ _passes = [
+     # No special settings; exercises AES256.
+     ('default', None, None, None),
+ 
+-    # Exercise the DES3 enctype.
+-    ('des3', None,
+-     {'libdefaults': {'permitted_enctypes': 'des3 aes256-sha1'}},
+-     {'realms': {'$realm': {
+-                    'supported_enctypes': 'des3-cbc-sha1:normal',
+-                    'master_key_type': 'des3-cbc-sha1'}}}),
+-
+     # Exercise the arcfour enctype.
+     ('arcfour', None,
+      {'libdefaults': {'permitted_enctypes': 'rc4 aes256-sha1'}},
+-- 
+2.49.0
+
diff --git a/0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch b/0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch
new file mode 100644
index 0000000..2d9a6cc
--- /dev/null
+++ b/0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch
@@ -0,0 +1,692 @@
+From 9d03713af124c2096d071ba36893018da8d71655 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Tue, 14 Jan 2025 13:31:11 +0100
+Subject: [PATCH] Add PKINIT paChecksum2 from MS-PKCA v20230920
+
+In 2023, Microsoft updated MS-PKCA to add the optional paChecksum2
+element in the PKAuthenticator sequence.  This checksum accepts SHA-1,
+SHA-256, SHA-384, and SHA-512 digests.
+
+In Windows Server 2025, this checksum becomes mandatory when using
+PKINIT with FFDH (but strangely not with ECDH if SHA-1 is configured as
+allowed).
+
+[ghudson@mit.edu: refactored crypto interfaces to reduce complexity of
+calling code]
+
+ticket: 9166 (new)
+(cherry picked from commit 310793ba63782af5ffa3a95d20e41f8f03ca7e00)
+---
+ src/include/k5-int-pkinit.h                   |  25 ++--
+ src/lib/krb5/asn.1/asn1_k_encode.c            |  18 ++-
+ src/plugins/preauth/pkinit/pkinit.h           |   1 +
+ src/plugins/preauth/pkinit/pkinit_clnt.c      |  41 +++----
+ src/plugins/preauth/pkinit/pkinit_constants.c |  42 +++++--
+ src/plugins/preauth/pkinit/pkinit_crypto.h    |  24 +++-
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 116 +++++++++++++++++-
+ src/plugins/preauth/pkinit/pkinit_kdf_test.c  |   4 +-
+ src/plugins/preauth/pkinit/pkinit_lib.c       |  16 ++-
+ src/plugins/preauth/pkinit/pkinit_srv.c       |  38 ++----
+ src/plugins/preauth/pkinit/pkinit_trace.h     |   5 +-
+ src/tests/asn.1/krb5_decode_test.c            |   2 +-
+ src/tests/asn.1/ktest.c                       |   7 +-
+ src/tests/asn.1/ktest_equal.c                 |   2 +-
+ src/tests/asn.1/pkinit_encode.out             |   2 +-
+ src/tests/asn.1/pkinit_trval.out              |   2 +-
+ 16 files changed, 250 insertions(+), 95 deletions(-)
+
+diff --git a/src/include/k5-int-pkinit.h b/src/include/k5-int-pkinit.h
+index 915904e518..cf6b1f99c5 100644
+--- a/src/include/k5-int-pkinit.h
++++ b/src/include/k5-int-pkinit.h
+@@ -36,21 +36,28 @@
+  * pkinit structures
+  */
+ 
+-/* PKAuthenticator */
+-typedef struct _krb5_pk_authenticator {
+-    krb5_int32      cusec;  /* (0..999999) */
+-    krb5_timestamp  ctime;
+-    krb5_int32      nonce;  /* (0..4294967295) */
+-    krb5_checksum   paChecksum;
+-    krb5_data      *freshnessToken;
+-} krb5_pk_authenticator;
+-
+ /* AlgorithmIdentifier */
+ typedef struct _krb5_algorithm_identifier {
+     krb5_data algorithm;      /* OID */
+     krb5_data parameters; /* Optional */
+ } krb5_algorithm_identifier;
+ 
++/* PAChecksum2 */
++typedef struct _krb5_pachecksum2 {
++    krb5_data checksum;
++    krb5_algorithm_identifier algorithmIdentifier;
++} krb5_pachecksum2;
++
++/* PKAuthenticator */
++typedef struct _krb5_pk_authenticator {
++    krb5_int32        cusec;  /* (0..999999) */
++    krb5_timestamp    ctime;
++    krb5_int32        nonce;  /* (0..4294967295) */
++    krb5_data         paChecksum;
++    krb5_data        *freshnessToken; /* Optional */
++    krb5_pachecksum2 *paChecksum2; /* Optional */
++} krb5_pk_authenticator;
++
+ /** AuthPack from RFC 4556*/
+ typedef struct _krb5_auth_pack {
+     krb5_pk_authenticator       pkAuthenticator;
+diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c
+index 5378b5c23b..cf7b500837 100644
+--- a/src/lib/krb5/asn.1/asn1_k_encode.c
++++ b/src/lib/krb5/asn.1/asn1_k_encode.c
+@@ -1394,20 +1394,30 @@ DEFSEQTYPE(pkinit_supp_pub_info, krb5_pkinit_supp_pub_info,
+ MAKE_ENCODER(encode_krb5_pkinit_supp_pub_info, pkinit_supp_pub_info);
+ MAKE_ENCODER(encode_krb5_sp80056a_other_info, sp80056a_other_info);
+ 
+-/* A krb5_checksum encoded as an OCTET STRING, for PKAuthenticator. */
+-DEFCOUNTEDTYPE(ostring_checksum, krb5_checksum, contents, length, octetstring);
++DEFFIELD(pachecksum2_0, krb5_pachecksum2, checksum, 0, ostring_data);
++DEFFIELD(pachecksum2_1, krb5_pachecksum2, algorithmIdentifier, 1,
++         algorithm_identifier);
++static const struct atype_info *pachecksum2_fields[] = {
++    &k5_atype_pachecksum2_0, &k5_atype_pachecksum2_1
++};
++DEFSEQTYPE(pachecksum2, krb5_pachecksum2, pachecksum2_fields);
++
++DEFPTRTYPE(pachecksum2_ptr, pachecksum2);
++DEFOPTIONALZEROTYPE(opt_pachecksum2_ptr, pachecksum2_ptr);
+ 
+ DEFFIELD(pk_authenticator_0, krb5_pk_authenticator, cusec, 0, int32);
+ DEFFIELD(pk_authenticator_1, krb5_pk_authenticator, ctime, 1, kerberos_time);
+ DEFFIELD(pk_authenticator_2, krb5_pk_authenticator, nonce, 2, int32);
+ DEFFIELD(pk_authenticator_3, krb5_pk_authenticator, paChecksum, 3,
+-         ostring_checksum);
++         ostring_data);
+ DEFFIELD(pk_authenticator_4, krb5_pk_authenticator, freshnessToken, 4,
+          opt_ostring_data_ptr);
++DEFFIELD(pk_authenticator_5, krb5_pk_authenticator, paChecksum2, 5,
++         opt_pachecksum2_ptr);
+ static const struct atype_info *pk_authenticator_fields[] = {
+     &k5_atype_pk_authenticator_0, &k5_atype_pk_authenticator_1,
+     &k5_atype_pk_authenticator_2, &k5_atype_pk_authenticator_3,
+-    &k5_atype_pk_authenticator_4
++    &k5_atype_pk_authenticator_4, &k5_atype_pk_authenticator_5
+ };
+ DEFSEQTYPE(pk_authenticator, krb5_pk_authenticator, pk_authenticator_fields);
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
+index 7ba7155bb4..a1564b6df2 100644
+--- a/src/plugins/preauth/pkinit/pkinit.h
++++ b/src/plugins/preauth/pkinit/pkinit.h
+@@ -338,6 +338,7 @@ void free_krb5_external_principal_identifier(krb5_external_principal_identifier
+ void free_krb5_algorithm_identifiers(krb5_algorithm_identifier ***in);
+ void free_krb5_algorithm_identifier(krb5_algorithm_identifier *in);
+ void free_krb5_kdc_dh_key_info(krb5_kdc_dh_key_info **in);
++void free_pachecksum2(krb5_context context, krb5_pachecksum2 **in);
+ krb5_error_code pkinit_copy_krb5_data(krb5_data *dst, const krb5_data *src);
+ 
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
+index b08022a214..433f477538 100644
+--- a/src/plugins/preauth/pkinit/pkinit_clnt.c
++++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
+@@ -56,10 +56,9 @@ use_content_info(krb5_context context, pkinit_req_context req,
+ static krb5_error_code
+ pkinit_as_req_create(krb5_context context, pkinit_context plgctx,
+                      pkinit_req_context reqctx, krb5_timestamp ctsec,
+-                     krb5_int32 cusec, krb5_ui_4 nonce,
+-                     const krb5_checksum *cksum,
+-                     krb5_principal client, krb5_principal server,
+-                     krb5_data **as_req);
++                     krb5_int32 cusec, krb5_ui_4 nonce, const krb5_data *cksum,
++                     const krb5_pachecksum2 *cksum2, krb5_principal client,
++                     krb5_principal server, krb5_data **as_req);
+ 
+ static krb5_error_code
+ pkinit_as_rep_parse(krb5_context context, pkinit_context plgctx,
+@@ -89,7 +88,8 @@ pa_pkinit_gen_req(krb5_context context,
+     krb5_timestamp ctsec = 0;
+     krb5_int32 cusec = 0;
+     krb5_ui_4 nonce = 0;
+-    krb5_checksum cksum;
++    krb5_data cksum = empty_data();
++    krb5_pachecksum2 *cksum2 = NULL;
+     krb5_data *der_req = NULL;
+     krb5_pa_data **return_pa_data = NULL;
+ 
+@@ -118,15 +118,10 @@ pa_pkinit_gen_req(krb5_context context,
+         goto cleanup;
+     }
+ 
+-    retval = krb5_c_make_checksum(context, CKSUMTYPE_SHA1, NULL, 0, der_req,
+-                                  &cksum);
++    retval = crypto_generate_checksums(context, der_req, &cksum, &cksum2);
+     if (retval)
+         goto cleanup;
+-    TRACE_PKINIT_CLIENT_REQ_CHECKSUM(context, &cksum);
+-#ifdef DEBUG_CKSUM
+-    pkiDebug("calculating checksum on buf size (%d)\n", der_req->length);
+-    print_buffer(der_req->data, der_req->length);
+-#endif
++    TRACE_PKINIT_CLIENT_REQ_CHECKSUMS(context, &cksum, cksum2);
+ 
+     retval = cb->get_preauth_time(context, rock, TRUE, &ctsec, &cusec);
+     if (retval)
+@@ -140,7 +135,8 @@ pa_pkinit_gen_req(krb5_context context,
+     nonce = request->nonce;
+ 
+     retval = pkinit_as_req_create(context, plgctx, reqctx, ctsec, cusec,
+-                                  nonce, &cksum, request->client, request->server, &out_data);
++                                  nonce, &cksum, cksum2, request->client,
++                                  request->server, &out_data);
+     if (retval) {
+         pkiDebug("error %d on pkinit_as_req_create; aborting PKINIT\n",
+                  (int) retval);
+@@ -168,23 +164,19 @@ pa_pkinit_gen_req(krb5_context context,
+ 
+ cleanup:
+     krb5_free_data(context, der_req);
+-    krb5_free_checksum_contents(context, &cksum);
++    krb5_free_data_contents(context, &cksum);
++    free_pachecksum2(context, &cksum2);
+     krb5_free_data(context, out_data);
+     krb5_free_pa_data(context, return_pa_data);
+     return retval;
+ }
+ 
+ static krb5_error_code
+-pkinit_as_req_create(krb5_context context,
+-                     pkinit_context plgctx,
+-                     pkinit_req_context reqctx,
+-                     krb5_timestamp ctsec,
+-                     krb5_int32 cusec,
+-                     krb5_ui_4 nonce,
+-                     const krb5_checksum * cksum,
+-                     krb5_principal client,
+-                     krb5_principal server,
+-                     krb5_data ** as_req)
++pkinit_as_req_create(krb5_context context, pkinit_context plgctx,
++                     pkinit_req_context reqctx, krb5_timestamp ctsec,
++                     krb5_int32 cusec, krb5_ui_4 nonce, const krb5_data *cksum,
++                     const krb5_pachecksum2 *cksum2, krb5_principal client,
++                     krb5_principal server, krb5_data **as_req)
+ {
+     krb5_error_code retval = ENOMEM;
+     krb5_data spki = empty_data(), *coded_auth_pack = NULL;
+@@ -202,6 +194,7 @@ pkinit_as_req_create(krb5_context context,
+     auth_pack.pkAuthenticator.paChecksum = *cksum;
+     if (!reqctx->opts->disable_freshness)
+         auth_pack.pkAuthenticator.freshnessToken = reqctx->freshness_token;
++    auth_pack.pkAuthenticator.paChecksum2 = (krb5_pachecksum2 *)cksum2;
+     auth_pack.clientDHNonce.length = 0;
+     auth_pack.supportedKDFs = (krb5_data **)supported_kdf_alg_ids;
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_constants.c b/src/plugins/preauth/pkinit/pkinit_constants.c
+index 905e90d29c..a32b373c32 100644
+--- a/src/plugins/preauth/pkinit/pkinit_constants.c
++++ b/src/plugins/preauth/pkinit/pkinit_constants.c
+@@ -34,25 +34,49 @@
+ 
+ /* RFC 8636 id-pkinit-kdf-ah-sha1: iso(1) identified-organization(3) dod(6)
+  * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha1(1) */
+-static char sha1_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01 };
++static char kdf_sha1[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x01 };
+ /* RFC 8636 id-pkinit-kdf-ah-sha256: iso(1) identified-organization(3) dod(6)
+  * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha256(2) */
+-static char sha256_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x02 };
++static char kdf_sha256[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x02 };
+ /* RFC 8636 id-pkinit-kdf-ah-sha512: iso(1) identified-organization(3) dod(6)
+  * internet(1) security(5) kerberosv5(2) pkinit(3) kdf(6) sha512(3) */
+-static char sha512_oid[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x03 };
++static char kdf_sha512[8] = { 0x2B, 0x06, 0x01, 0x05, 0x02, 0x03, 0x06, 0x03 };
+ 
+-const krb5_data sha1_id = { KV5M_DATA, sizeof(sha1_oid), sha1_oid };
+-const krb5_data sha256_id = { KV5M_DATA, sizeof(sha256_oid), sha256_oid };
+-const krb5_data sha512_id = { KV5M_DATA, sizeof(sha512_oid), sha512_oid };
++const krb5_data kdf_sha1_id = { KV5M_DATA, sizeof(kdf_sha1), kdf_sha1 };
++const krb5_data kdf_sha256_id = { KV5M_DATA, sizeof(kdf_sha256), kdf_sha256 };
++const krb5_data kdf_sha512_id = { KV5M_DATA, sizeof(kdf_sha512), kdf_sha512 };
+ 
+ krb5_data const * const supported_kdf_alg_ids[] = {
+-    &sha256_id,
+-    &sha1_id,
+-    &sha512_id,
++    &kdf_sha256_id,
++    &kdf_sha1_id,
++    &kdf_sha512_id,
+     NULL
+ };
+ 
++/* RFC 3370 sha-1: iso(1) identified-organization(3) oiw(14) secsig(3)
++ * algorithm(2) 26 */
++static char cms_sha1[] = { 0x2b, 0x0e, 0x03, 0x02, 0x1a };
++/* RFC 5754 id-sha256: joint-iso-itu-t(2) country(16) us(840) organization(1)
++ * gov(101) csor(3) nistalgorithm(4) hashalgs(2) 1 */
++static char cms_sha256[] = {
++    0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
++};
++/* RFC 5754 id-sha384: joint-iso-itu-t(2) country(16) us(840) organization(1)
++ * gov(101) csor(3) nistalgorithm(4) hashalgs(2) 2 */
++static char cms_sha384[] = {
++    0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02
++};
++/* RFC 5754 id-sha512: joint-iso-itu-t(2) country(16) us(840) organization(1)
++ * gov(101) csor(3) nistalgorithm(4) hashalgs(2) 3 */
++static char cms_sha512[] = {
++    0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03
++};
++
++const krb5_data cms_sha1_id = { KV5M_DATA, sizeof(cms_sha1), cms_sha1 };
++const krb5_data cms_sha256_id = { KV5M_DATA, sizeof(cms_sha256), cms_sha256 };
++const krb5_data cms_sha384_id = { KV5M_DATA, sizeof(cms_sha384), cms_sha384 };
++const krb5_data cms_sha512_id = { KV5M_DATA, sizeof(cms_sha512), cms_sha512 };
++
+ /* RFC 4055 sha256WithRSAEncryption: iso(1) member-body(2) us(840)
+  * rsadsi(113549) pkcs(1) 1 11 */
+ static char sha256WithRSAEncr_oid[9] = {
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
+index fd876e4850..3b12e904b1 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto.h
++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
+@@ -562,9 +562,13 @@ pkinit_alg_agility_kdf(krb5_context context,
+                        krb5_data *pk_as_rep,
+                        krb5_keyblock *key_block);
+ 
+-extern const krb5_data sha1_id;
+-extern const krb5_data sha256_id;
+-extern const krb5_data sha512_id;
++extern const krb5_data kdf_sha1_id;
++extern const krb5_data kdf_sha256_id;
++extern const krb5_data kdf_sha512_id;
++extern const krb5_data cms_sha1_id;
++extern const krb5_data cms_sha256_id;
++extern const krb5_data cms_sha384_id;
++extern const krb5_data cms_sha512_id;
+ extern const krb5_data oakley_1024;
+ extern const krb5_data oakley_2048;
+ extern const krb5_data oakley_4096;
+@@ -597,4 +601,18 @@ crypto_req_cert_matching_data(krb5_context context,
+ 
+ int parse_dh_min_bits(krb5_context context, const char *str);
+ 
++/* Generate a SHA-1 checksum over body in *cksum1_out and a SHA-256 checksum
++ * over body in *cksum2_out with appropriate metadata. */
++krb5_error_code
++crypto_generate_checksums(krb5_context context, const krb5_data *body,
++			  krb5_data *cksum1_out,
++			  krb5_pachecksum2 **cksum2_out);
++
++/* Verify the SHA-1 checksum in cksum1 and the tagged checksum in cksum2.
++ * cksum2 may be NULL, in which case only cksum1 is verified. */
++krb5_error_code
++crypto_verify_checksums(krb5_context context, krb5_data *body,
++			const krb5_data *cksum1,
++			const krb5_pachecksum2 *cksum2);
++
+ #endif	/* _PKINIT_CRYPTO_H */
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 402bf1b9b3..429b7d202c 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -2616,11 +2616,11 @@ cleanup:
+ static const EVP_MD *
+ algid_to_md(const krb5_data *alg_id)
+ {
+-    if (data_eq(*alg_id, sha1_id))
++    if (data_eq(*alg_id, kdf_sha1_id))
+         return EVP_sha1();
+-    if (data_eq(*alg_id, sha256_id))
++    if (data_eq(*alg_id, kdf_sha256_id))
+         return EVP_sha256();
+-    if (data_eq(*alg_id, sha512_id))
++    if (data_eq(*alg_id, kdf_sha512_id))
+         return EVP_sha512();
+     return NULL;
+ }
+@@ -5663,3 +5663,113 @@ parse_dh_min_bits(krb5_context context, const char *str)
+     TRACE_PKINIT_DH_INVALID_MIN_BITS(context, str);
+     return PKINIT_DEFAULT_DH_MIN_BITS;
+ }
++
++/* Return the OpenSSL message digest type matching the given CMS OID, or NULL
++ * if it doesn't match any of the CMS OIDs we know about. */
++static const EVP_MD *
++md_from_cms_oid(const krb5_data *alg_id)
++{
++    if (data_eq(*alg_id, cms_sha1_id))
++        return EVP_sha1();
++    if (data_eq(*alg_id, cms_sha256_id))
++        return EVP_sha256();
++    if (data_eq(*alg_id, cms_sha384_id))
++        return EVP_sha384();
++    if (data_eq(*alg_id, cms_sha512_id))
++        return EVP_sha512();
++    return NULL;
++}
++
++/* Compute a message digest of the given type over body, placing the result in
++ * *digest_out in allocated storage.  Return true on success. */
++static krb5_boolean
++make_digest(const krb5_data *body, const EVP_MD *md, krb5_data *digest_out)
++{
++    krb5_error_code ret;
++    krb5_data d;
++
++    if (md == NULL)
++        return FALSE;
++    ret = alloc_data(&d, EVP_MD_size(md));
++    if (ret)
++        return FALSE;
++    if (!EVP_Digest(body->data, body->length, (uint8_t *)d.data, &d.length, md,
++                    NULL)) {
++        free(d.data);
++        return FALSE;
++    }
++    *digest_out = d;
++    return TRUE;
++}
++
++/* Return true if digest verifies for the given body and message digest
++ * type. */
++static krb5_boolean
++check_digest(const krb5_data *body, const EVP_MD *md, const krb5_data *digest)
++{
++    unsigned int digest_len;
++    uint8_t buf[EVP_MAX_MD_SIZE];
++
++    if (md == NULL)
++        return FALSE;
++    if (!EVP_Digest(body->data, body->length, buf, &digest_len, md, NULL))
++        return FALSE;
++    return (digest->length == digest_len &&
++            CRYPTO_memcmp(digest->data, buf, digest_len) == 0);
++}
++
++krb5_error_code
++crypto_generate_checksums(krb5_context context, const krb5_data *body,
++                          krb5_data *cksum1_out, krb5_pachecksum2 **cksum2_out)
++{
++    krb5_data cksum1 = empty_data();
++    krb5_pachecksum2 *cksum2 = NULL;
++    krb5_error_code ret;
++
++    if (!make_digest(body, EVP_sha1(), &cksum1))
++        goto fail;
++
++    cksum2 = k5alloc(sizeof(*cksum2), &ret);
++    if (cksum2 == NULL)
++        goto fail;
++
++    if (!make_digest(body, EVP_sha256(), &cksum2->checksum))
++        goto fail;
++
++    if (krb5int_copy_data_contents(context, &cms_sha256_id,
++                                   &cksum2->algorithmIdentifier.algorithm))
++        goto fail;
++
++    cksum2->algorithmIdentifier.parameters = empty_data();
++
++    *cksum1_out = cksum1;
++    *cksum2_out = cksum2;
++    return 0;
++
++fail:
++    krb5_free_data_contents(context, &cksum1);
++    free_pachecksum2(context, &cksum2);
++    return KRB5_CRYPTO_INTERNAL;
++}
++
++krb5_error_code
++crypto_verify_checksums(krb5_context context, krb5_data *body,
++                        const krb5_data *cksum1,
++                        const krb5_pachecksum2 *cksum2)
++{
++    const EVP_MD *md;
++
++    /* RFC 4556 doesn't say what error to return if the checksum doesn't match.
++     * Windows returns this one. */
++    if (!check_digest(body, EVP_sha1(), cksum1))
++        return KRB5KRB_AP_ERR_MODIFIED;
++
++    if (cksum2 == NULL)
++        return 0;
++
++    md = md_from_cms_oid(&cksum2->algorithmIdentifier.algorithm);
++    if (!check_digest(body, md, &cksum2->checksum))
++        return KRB5KRB_AP_ERR_MODIFIED;
++
++    return 0;
++}
+diff --git a/src/plugins/preauth/pkinit/pkinit_kdf_test.c b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
+index 99c93ac128..dd6e8d7503 100644
+--- a/src/plugins/preauth/pkinit/pkinit_kdf_test.c
++++ b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
+@@ -126,7 +126,7 @@ main(int argc, char **argv)
+ 
+     /* TEST 1:  SHA-1/AES */
+     /* set up algorithm id */
+-    alg_id.algorithm = sha1_id;
++    alg_id.algorithm = kdf_sha1_id;
+ 
+     enctype = enctype_aes;
+ 
+@@ -157,7 +157,7 @@ main(int argc, char **argv)
+ 
+     /* TEST 2: SHA-256/AES */
+     /* set up algorithm id */
+-    alg_id.algorithm = sha256_id;
++    alg_id.algorithm = kdf_sha256_id;
+ 
+     enctype = enctype_aes;
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_lib.c b/src/plugins/preauth/pkinit/pkinit_lib.c
+index 25965eb5d2..891f47fd26 100644
+--- a/src/plugins/preauth/pkinit/pkinit_lib.c
++++ b/src/plugins/preauth/pkinit/pkinit_lib.c
+@@ -29,6 +29,7 @@
+  * SUCH DAMAGES.
+  */
+ 
++#include "k5-int.h"
+ #include "pkinit.h"
+ 
+ #define FAKECERT
+@@ -119,8 +120,9 @@ free_krb5_auth_pack(krb5_auth_pack **in)
+ {
+     if ((*in) == NULL) return;
+     krb5_free_data_contents(NULL, &(*in)->clientPublicValue);
+-    free((*in)->pkAuthenticator.paChecksum.contents);
++    free((*in)->pkAuthenticator.paChecksum.data);
+     krb5_free_data(NULL, (*in)->pkAuthenticator.freshnessToken);
++    free_pachecksum2(NULL, &(*in)->pkAuthenticator.paChecksum2);
+     if ((*in)->supportedCMSTypes != NULL)
+         free_krb5_algorithm_identifiers(&((*in)->supportedCMSTypes));
+     if ((*in)->supportedKDFs) {
+@@ -196,6 +198,18 @@ free_krb5_kdc_dh_key_info(krb5_kdc_dh_key_info **in)
+     free(*in);
+ }
+ 
++void
++free_pachecksum2(krb5_context context, krb5_pachecksum2 **in)
++{
++    if (*in == NULL)
++        return;
++    krb5_free_data_contents(context, &(*in)->checksum);
++    krb5_free_data_contents(context, &(*in)->algorithmIdentifier.algorithm);
++    krb5_free_data_contents(context, &(*in)->algorithmIdentifier.parameters);
++    free(*in);
++    *in = NULL;
++}
++
+ void
+ init_krb5_pa_pk_as_req(krb5_pa_pk_as_req **in)
+ {
+diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
+index e22bcb195b..f558308483 100644
+--- a/src/plugins/preauth/pkinit/pkinit_srv.c
++++ b/src/plugins/preauth/pkinit/pkinit_srv.c
+@@ -428,11 +428,12 @@ pkinit_server_verify_padata(krb5_context context,
+     krb5_data authp_data = {0, 0, NULL}, krb5_authz = {0, 0, NULL};
+     krb5_pa_pk_as_req *reqp = NULL;
+     krb5_auth_pack *auth_pack = NULL;
++    krb5_pk_authenticator *pka;
+     pkinit_kdc_context plgctx = NULL;
+     pkinit_kdc_req_context reqctx = NULL;
+     krb5_checksum cksum = {0, 0, 0, NULL};
+     krb5_data *der_req = NULL;
+-    krb5_data k5data, *ftoken;
++    krb5_data k5data;
+     int is_signed = 1;
+     krb5_pa_data **e_data = NULL;
+     krb5_kdcpreauth_modreq modreq = NULL;
+@@ -524,8 +525,9 @@ pkinit_server_verify_padata(krb5_context context,
+         pkiDebug("failed to decode krb5_auth_pack\n");
+         goto cleanup;
+     }
++    pka = &auth_pack->pkAuthenticator;
+ 
+-    retval = krb5_check_clockskew(context, auth_pack->pkAuthenticator.ctime);
++    retval = krb5_check_clockskew(context, pka->ctime);
+     if (retval)
+         goto cleanup;
+ 
+@@ -548,36 +550,14 @@ pkinit_server_verify_padata(krb5_context context,
+         goto cleanup;
+     }
+     der_req = cb->request_body(context, rock);
+-    retval = krb5_c_make_checksum(context, CKSUMTYPE_SHA1, NULL, 0, der_req,
+-                                  &cksum);
+-    if (retval) {
+-        pkiDebug("unable to calculate AS REQ checksum\n");
+-        goto cleanup;
+-    }
+-    if (cksum.length != auth_pack->pkAuthenticator.paChecksum.length ||
+-        k5_bcmp(cksum.contents, auth_pack->pkAuthenticator.paChecksum.contents,
+-                cksum.length) != 0) {
+-        pkiDebug("failed to match the checksum\n");
+-#ifdef DEBUG_CKSUM
+-        pkiDebug("calculating checksum on buf size (%d)\n", req_pkt->length);
+-        print_buffer(req_pkt->data, req_pkt->length);
+-        pkiDebug("received checksum type=%d size=%d ",
+-                 auth_pack->pkAuthenticator.paChecksum.checksum_type,
+-                 auth_pack->pkAuthenticator.paChecksum.length);
+-        print_buffer(auth_pack->pkAuthenticator.paChecksum.contents,
+-                     auth_pack->pkAuthenticator.paChecksum.length);
+-        pkiDebug("expected checksum type=%d size=%d ",
+-                 cksum.checksum_type, cksum.length);
+-        print_buffer(cksum.contents, cksum.length);
+-#endif
+ 
+-        retval = KRB5KDC_ERR_PA_CHECKSUM_MUST_BE_INCLUDED;
++    retval = crypto_verify_checksums(context, der_req, &pka->paChecksum,
++                                     pka->paChecksum2);
++    if (retval)
+         goto cleanup;
+-    }
+ 
+-    ftoken = auth_pack->pkAuthenticator.freshnessToken;
+-    if (ftoken != NULL) {
+-        retval = cb->check_freshness_token(context, rock, ftoken);
++    if (pka->freshnessToken != NULL) {
++        retval = cb->check_freshness_token(context, rock, pka->freshnessToken);
+         if (retval)
+             goto cleanup;
+         valid_freshness_token = TRUE;
+diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h
+index 1faa6816d7..7b68d4b3b1 100644
+--- a/src/plugins/preauth/pkinit/pkinit_trace.h
++++ b/src/plugins/preauth/pkinit/pkinit_trace.h
+@@ -58,8 +58,9 @@
+     TRACE(c, "PKINIT client verified DH reply")
+ #define TRACE_PKINIT_CLIENT_REP_DH_FAIL(c)              \
+     TRACE(c, "PKINIT client could not verify DH reply")
+-#define TRACE_PKINIT_CLIENT_REQ_CHECKSUM(c, cksum)                      \
+-    TRACE(c, "PKINIT client computed kdc-req-body checksum {cksum}", cksum)
++#define TRACE_PKINIT_CLIENT_REQ_CHECKSUMS(c, ck1, ck2)                  \
++    TRACE(c, "PKINIT client computed checksums: {hexdata} {hexdata}",   \
++          ck1, &(ck2)->checksum)
+ #define TRACE_PKINIT_CLIENT_REQ_DH(c)                           \
+     TRACE(c, "PKINIT client making DH request")
+ #define TRACE_PKINIT_CLIENT_SAN_CONFIG_DNSNAME(c, host)                 \
+diff --git a/src/tests/asn.1/krb5_decode_test.c b/src/tests/asn.1/krb5_decode_test.c
+index 2fa6dce8eb..f47849abad 100644
+--- a/src/tests/asn.1/krb5_decode_test.c
++++ b/src/tests/asn.1/krb5_decode_test.c
+@@ -1174,7 +1174,7 @@ main(int argc, char **argv)
+     /* decode_krb5_auth_pack */
+     {
+         setup(krb5_auth_pack,ktest_make_sample_auth_pack);
+-        decode_run("krb5_auth_pack","","30 81 85 A0 35 30 33 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 06 04 04 31 32 33 34 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61",
++        decode_run("krb5_auth_pack","","30 81 89 A0 39 30 37 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61",
+                    acc.decode_krb5_auth_pack,
+                    ktest_equal_auth_pack,ktest_free_auth_pack);
+         ktest_empty_auth_pack(&ref);
+diff --git a/src/tests/asn.1/ktest.c b/src/tests/asn.1/ktest.c
+index d37e4fa7e6..7f54aa3184 100644
+--- a/src/tests/asn.1/ktest.c
++++ b/src/tests/asn.1/ktest.c
+@@ -700,9 +700,7 @@ ktest_make_sample_pk_authenticator(krb5_pk_authenticator *p)
+     p->cusec = SAMPLE_USEC;
+     p->ctime = SAMPLE_TIME;
+     p->nonce = SAMPLE_NONCE;
+-    ktest_make_sample_checksum(&p->paChecksum);
+-    /* We don't encode the checksum type, only the contents. */
+-    p->paChecksum.checksum_type = 0;
++    ktest_make_sample_data(&p->paChecksum);
+     p->freshnessToken = ealloc(sizeof(krb5_data));
+     ktest_make_sample_data(p->freshnessToken);
+ }
+@@ -1604,8 +1602,7 @@ ktest_empty_pa_otp_req(krb5_pa_otp_req *p)
+ static void
+ ktest_empty_pk_authenticator(krb5_pk_authenticator *p)
+ {
+-    ktest_empty_checksum(&p->paChecksum);
+-    p->paChecksum.contents = NULL;
++    ktest_empty_data(&p->paChecksum);
+     krb5_free_data(NULL, p->freshnessToken);
+     p->freshnessToken = NULL;
+ }
+diff --git a/src/tests/asn.1/ktest_equal.c b/src/tests/asn.1/ktest_equal.c
+index b48a0285d2..13786dd1e5 100644
+--- a/src/tests/asn.1/ktest_equal.c
++++ b/src/tests/asn.1/ktest_equal.c
+@@ -844,7 +844,7 @@ ktest_equal_pk_authenticator(krb5_pk_authenticator *ref,
+     p = p && scalar_equal(cusec);
+     p = p && scalar_equal(ctime);
+     p = p && scalar_equal(nonce);
+-    p = p && struct_equal(paChecksum, ktest_equal_checksum);
++    p = p && data_eq(ref->paChecksum, var->paChecksum);
+     return p;
+ }
+ 
+diff --git a/src/tests/asn.1/pkinit_encode.out b/src/tests/asn.1/pkinit_encode.out
+index 6ec7aaa36a..a764182e15 100644
+--- a/src/tests/asn.1/pkinit_encode.out
++++ b/src/tests/asn.1/pkinit_encode.out
+@@ -1,7 +1,7 @@
+ encode_krb5_pa_pk_as_req: 30 38 80 08 6B 72 62 35 64 61 74 61 A1 22 30 20 30 1E 80 08 6B 72 62 35 64 61 74 61 81 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61
+ encode_krb5_pa_pk_as_rep(dhInfo): A0 28 30 26 80 08 6B 72 62 35 64 61 74 61 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
+ encode_krb5_pa_pk_as_rep(encKeyPack): 81 08 6B 72 62 35 64 61 74 61
+-encode_krb5_auth_pack: 30 81 85 A0 35 30 33 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 06 04 04 31 32 33 34 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
++encode_krb5_auth_pack: 30 81 89 A0 39 30 37 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 08 04 06 70 76 61 6C 75 65 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
+ encode_krb5_kdc_dh_key_info: 30 25 A0 0B 03 09 00 6B 72 62 35 64 61 74 61 A1 03 02 01 2A A2 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A
+ encode_krb5_reply_key_pack: 30 26 A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
+ encode_krb5_sp80056a_other_info: 30 81 81 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A0 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A2 0A 04 08 6B 72 62 35 64 61 74 61
+diff --git a/src/tests/asn.1/pkinit_trval.out b/src/tests/asn.1/pkinit_trval.out
+index 46f4a34108..c47bd71f67 100644
+--- a/src/tests/asn.1/pkinit_trval.out
++++ b/src/tests/asn.1/pkinit_trval.out
+@@ -38,7 +38,7 @@ encode_krb5_auth_pack:
+ .  .  [0] [Integer] 123456
+ .  .  [1] [Generalized Time] "19940610060317Z"
+ .  .  [2] [Integer] 42
+-.  .  [3] [Octet String] "1234"
++.  .  [3] [Octet String] "krb5data"
+ .  .  [4] [Octet String] "krb5data"
+ .  [1] [Octet String] "pvalue"
+ .  [2] [Sequence/Sequence Of]
+-- 
+2.49.0
+
diff --git a/0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch b/0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch
new file mode 100644
index 0000000..4b49867
--- /dev/null
+++ b/0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch
@@ -0,0 +1,381 @@
+From 33afd2a6cfdf87d153170b41fbabfb92be49c422 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 10 Apr 2025 10:04:22 +0200
+Subject: [PATCH] [downstream] Do not block HMAC-MD4/5 in FIPS mode
+
+To ensure RC4 HMAC-MD5 was not used in FIPS mode, access to HMAC-MD4/5
+was not allowed in this mode. However, since we provide the
+"radius_md5_fips_override" configuration parameter to allow using RADIUS
+regardless to the FIPS restrictions, we should allow HMAC-MD5 to be used
+too in this case, because it is required for the newly supported
+Message-Authenticator attribute.
+
+A FIPS mode check is added in calculate_mac() which will fail if
+"radius_md5_fips_override" is not true. It will not affect interactions
+between krb5kdc and ipa-otpd, because the Message-Authenticator
+attribute is not generated in this case.
+---
+ src/lib/crypto/krb/crypto_int.h               |  9 +++
+ src/lib/crypto/openssl/Makefile.in            |  9 ++-
+ src/lib/crypto/openssl/common.c               | 80 +++++++++++++++++++
+ .../crypto/openssl/hash_provider/hash_evp.c   | 62 ++------------
+ src/lib/crypto/openssl/hmac.c                 | 15 ++--
+ src/lib/krad/packet.c                         | 19 +++--
+ 6 files changed, 120 insertions(+), 74 deletions(-)
+ create mode 100644 src/lib/crypto/openssl/common.c
+
+diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h
+index 1ee4b30e02..ff67b6bd35 100644
+--- a/src/lib/crypto/krb/crypto_int.h
++++ b/src/lib/crypto/krb/crypto_int.h
+@@ -36,6 +36,9 @@
+ 
+ #include <openssl/opensslv.h>
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
++
++#include <openssl/provider.h>
++
+ /*
+  * OpenSSL 3.0 relegates MD4 and RC4 to the legacy provider, which must be
+  * explicitly loaded into a library context.  Performing this loading within a
+@@ -660,4 +663,10 @@ iov_cursor_advance(struct iov_cursor *c, size_t nblocks)
+     c->out_pos += nblocks * c->block_size;
+ }
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++
++krb5_error_code k5_get_ossl_legacy_libctx(OSSL_LIB_CTX **libctx);
++
++#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
++
+ #endif /* CRYPTO_INT_H */
+diff --git a/src/lib/crypto/openssl/Makefile.in b/src/lib/crypto/openssl/Makefile.in
+index 8e4cdb8bbf..cc131000bd 100644
+--- a/src/lib/crypto/openssl/Makefile.in
++++ b/src/lib/crypto/openssl/Makefile.in
+@@ -8,21 +8,24 @@ STLIBOBJS=\
+ 	hmac.o	\
+ 	kdf.o	\
+ 	pbkdf2.o \
+-	sha256.o
++	sha256.o \
++	common.o
+ 
+ OBJS=\
+ 	$(OUTPRE)cmac.$(OBJEXT)	\
+ 	$(OUTPRE)hmac.$(OBJEXT)	\
+ 	$(OUTPRE)kdf.$(OBJEXT)	\
+ 	$(OUTPRE)pbkdf2.$(OBJEXT) \
+-	$(OUTPRE)sha256.$(OBJEXT)
++	$(OUTPRE)sha256.$(OBJEXT) \
++	$(OUTPRE)common.$(OBJEXT)
+ 
+ SRCS=\
+ 	$(srcdir)/cmac.c	\
+ 	$(srcdir)/hmac.c	\
+ 	$(srcdir)/kdf.c		\
+ 	$(srcdir)/pbkdf2.c	\
+-	$(srcdir)/sha256.c
++	$(srcdir)/sha256.c	\
++	$(srcdir)/common.c
+ 
+ SUBDIROBJLISTS= md4/OBJS.ST 		\
+ 		md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST 	\
+diff --git a/src/lib/crypto/openssl/common.c b/src/lib/crypto/openssl/common.c
+new file mode 100644
+index 0000000000..ced43fd54c
+--- /dev/null
++++ b/src/lib/crypto/openssl/common.c
+@@ -0,0 +1,80 @@
++#include "crypto_int.h"
++
++#if OPENSSL_VERSION_NUMBER >= 0x30000000L
++
++#include <openssl/provider.h>
++#include <openssl/fips.h>
++#include <threads.h>
++#include <stdbool.h>
++
++typedef struct ossl_legacy_context {
++    bool initialized;
++    OSSL_LIB_CTX *libctx;
++    OSSL_PROVIDER *default_provider;
++    OSSL_PROVIDER *legacy_provider;
++} ossl_legacy_context_t;
++
++static thread_local ossl_legacy_context_t g_ossl_legacy_ctx;
++
++static krb5_error_code
++init_ossl_legacy_ctx(ossl_legacy_context_t *ctx)
++{
++    ctx->libctx = OSSL_LIB_CTX_new();
++    if (!ctx->libctx)
++        return KRB5_CRYPTO_INTERNAL;
++
++    /* Load both legacy and default provider as both may be needed. */
++    ctx->default_provider = OSSL_PROVIDER_load(ctx->libctx, "default");
++    ctx->legacy_provider = OSSL_PROVIDER_load(ctx->libctx, "legacy");
++
++    if (!(ctx->default_provider && ctx->legacy_provider))
++        return KRB5_CRYPTO_INTERNAL;
++
++    ctx->initialized = true;
++    return 0;
++}
++
++static void
++deinit_ossl_legacy_ctx(ossl_legacy_context_t *ctx)
++{
++    if (ctx->legacy_provider)
++        OSSL_PROVIDER_unload(ctx->legacy_provider);
++
++    if (ctx->default_provider)
++        OSSL_PROVIDER_unload(ctx->default_provider);
++
++    if (ctx->libctx)
++        OSSL_LIB_CTX_free(ctx->libctx);
++
++    ctx->initialized = false;
++}
++
++krb5_error_code
++k5_get_ossl_legacy_libctx(OSSL_LIB_CTX **libctx)
++{
++    krb5_error_code err;
++
++    if (!FIPS_mode()) {
++        if (libctx)
++            *libctx = NULL;
++        err = 0;
++        goto end;
++    }
++
++    if (!g_ossl_legacy_ctx.initialized) {
++        err = init_ossl_legacy_ctx(&g_ossl_legacy_ctx);
++        if (err) {
++            deinit_ossl_legacy_ctx(&g_ossl_legacy_ctx);
++            goto end;
++        }
++    }
++
++    if (libctx)
++        *libctx = g_ossl_legacy_ctx.libctx;
++    err = 0;
++
++end:
++    return err;
++}
++
++#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
+diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c
+index eb2e693e9f..2fd5d383d6 100644
+--- a/src/lib/crypto/openssl/hash_provider/hash_evp.c
++++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c
+@@ -44,48 +44,7 @@
+ #define EVP_MD_CTX_free EVP_MD_CTX_destroy
+ #endif
+ 
+-#include <openssl/provider.h>
+ #include <openssl/fips.h>
+-#include <threads.h>
+-
+-typedef struct ossl_lib_md_context {
+-    OSSL_LIB_CTX *libctx;
+-    OSSL_PROVIDER *default_provider;
+-    OSSL_PROVIDER *legacy_provider;
+-} ossl_md_context_t;
+-
+-static thread_local ossl_md_context_t *ossl_md_ctx = NULL;
+-
+-static krb5_error_code
+-init_ossl_md_ctx(ossl_md_context_t *ctx, const char *algo)
+-{
+-    ctx->libctx = OSSL_LIB_CTX_new();
+-    if (!ctx->libctx)
+-        return KRB5_CRYPTO_INTERNAL;
+-
+-    /* Load both legacy and default provider as both may be needed. */
+-    ctx->default_provider = OSSL_PROVIDER_load(ctx->libctx, "default");
+-    ctx->legacy_provider = OSSL_PROVIDER_load(ctx->libctx, "legacy");
+-
+-    if (!(ctx->default_provider && ctx->legacy_provider))
+-        return KRB5_CRYPTO_INTERNAL;
+-
+-    return 0;
+-}
+-
+-static void
+-deinit_ossl_ctx(ossl_md_context_t *ctx)
+-{
+-    if (ctx->legacy_provider)
+-        OSSL_PROVIDER_unload(ctx->legacy_provider);
+-
+-    if (ctx->default_provider)
+-        OSSL_PROVIDER_unload(ctx->default_provider);
+-
+-    if (ctx->libctx)
+-        OSSL_LIB_CTX_free(ctx->libctx);
+-}
+-
+ 
+ static krb5_error_code
+ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
+@@ -120,25 +79,14 @@ hash_legacy_evp(const char *algo, const krb5_crypto_iov *data, size_t num_data,
+                 krb5_data *output)
+ {
+     krb5_error_code err;
++    OSSL_LIB_CTX *ossl_libctx;
+     EVP_MD *md = NULL;
+ 
+-    if (!ossl_md_ctx) {
+-        ossl_md_ctx = malloc(sizeof(ossl_md_context_t));
+-        if (!ossl_md_ctx) {
+-            err = ENOMEM;
+-            goto end;
+-        }
+-
+-        err = init_ossl_md_ctx(ossl_md_ctx, algo);
+-        if (err) {
+-            deinit_ossl_ctx(ossl_md_ctx);
+-            free(ossl_md_ctx);
+-            ossl_md_ctx = NULL;
+-            goto end;
+-        }
+-    }
++    err = k5_get_ossl_legacy_libctx(&ossl_libctx);
++    if (err)
++        goto end;
+ 
+-    md = EVP_MD_fetch(ossl_md_ctx->libctx, algo, NULL);
++    md = EVP_MD_fetch(ossl_libctx, algo, NULL);
+     if (!md) {
+         err = KRB5_CRYPTO_INTERNAL;
+         goto end;
+diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c
+index 25a419d73a..8f9e88fec9 100644
+--- a/src/lib/crypto/openssl/hmac.c
++++ b/src/lib/crypto/openssl/hmac.c
+@@ -59,7 +59,6 @@
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ #include <openssl/params.h>
+ #include <openssl/core_names.h>
+-#include <openssl/fips.h>
+ #else
+ #include <openssl/hmac.h>
+ #endif
+@@ -112,11 +111,7 @@ map_digest(const struct krb5_hash_provider *hash)
+         return EVP_sha256();
+     else if (hash == &krb5int_hash_sha384)
+         return EVP_sha384();
+-
+-    if (FIPS_mode())
+-        return NULL;
+-
+-    if (hash == &krb5int_hash_md5)
++    else if (hash == &krb5int_hash_md5)
+         return EVP_md5();
+     else if (hash == &krb5int_hash_md4)
+         return EVP_md4();
+@@ -138,13 +133,19 @@ krb5int_hmac_keyblock(const struct krb5_hash_provider *hash,
+     EVP_MAC_CTX *ctx = NULL;
+     OSSL_PARAM params[2], *p = params;
+     size_t i = 0, md_len;
++    OSSL_LIB_CTX *ossl_libctx;
++    krb5_error_code err;
+ 
+     if (md == NULL || keyblock->length > hash->blocksize)
+         return KRB5_CRYPTO_INTERNAL;
+     if (output->length < hash->hashsize)
+         return KRB5_BAD_MSIZE;
+ 
+-    mac = EVP_MAC_fetch(NULL, "HMAC", NULL);
++    err = k5_get_ossl_legacy_libctx(&ossl_libctx);
++    if (err)
++        return err;
++
++    mac = EVP_MAC_fetch(ossl_libctx, "HMAC", NULL);
+     if (mac == NULL)
+         return KRB5_CRYPTO_INTERNAL;
+ 
+diff --git a/src/lib/krad/packet.c b/src/lib/krad/packet.c
+index 3c1a4d507e..b95c99df65 100644
+--- a/src/lib/krad/packet.c
++++ b/src/lib/krad/packet.c
+@@ -278,7 +278,7 @@ lookup_msgauth_addr(const krad_packet *pkt)
+  * auth, which may be from pkt or from a corresponding request.
+  */
+ static krb5_error_code
+-calculate_mac(const char *secret, const krad_packet *pkt,
++calculate_mac(krb5_context ctx, const char *secret, const krad_packet *pkt,
+               const uint8_t auth[AUTH_FIELD_SIZE],
+               uint8_t mac_out[MD5_DIGEST_SIZE])
+ {
+@@ -288,6 +288,10 @@ calculate_mac(const char *secret, const krad_packet *pkt,
+     krb5_crypto_iov input[5];
+     krb5_data ksecr, mac;
+ 
++    /* Do not use HMAC-MD5 if not explicitly allowed */
++    if (kr_use_fips(ctx))
++        return KRB5_CRYPTO_INTERNAL;
++
+     msgauth_attr = lookup_msgauth_addr(pkt);
+     if (msgauth_attr == NULL)
+         return EINVAL;
+@@ -393,7 +397,8 @@ krad_packet_new_request(krb5_context ctx, const char *secret, krad_code code,
+ 
+     if (msgauth_required) {
+         /* Calculate and set the Message-Authenticator MAC. */
+-        retval = calculate_mac(secret, pkt, pkt_auth(pkt), pkt_attr(pkt) + 2);
++        retval = calculate_mac(ctx, secret, pkt, pkt_auth(pkt),
++                               pkt_attr(pkt) + 2);
+         if (retval != 0)
+             goto error;
+     }
+@@ -454,7 +459,7 @@ krad_packet_new_response(krb5_context ctx, const char *secret, krad_code code,
+          * section 5.14, use the authenticator from the request, not from the
+          * response.
+          */
+-        retval = calculate_mac(secret, pkt, pkt_auth(request),
++        retval = calculate_mac(ctx, secret, pkt, pkt_auth(request),
+                                pkt_attr(pkt) + 2);
+         if (retval != 0)
+             goto error;
+@@ -476,7 +481,7 @@ error:
+ /* Verify the Message-Authenticator value in pkt, using the provided
+  * authenticator (which may be from pkt or from a corresponding request). */
+ static krb5_error_code
+-verify_msgauth(const char *secret, const krad_packet *pkt,
++verify_msgauth(krb5_context ctx, const char *secret, const krad_packet *pkt,
+                const uint8_t auth[AUTH_FIELD_SIZE])
+ {
+     uint8_t mac[MD5_DIGEST_SIZE];
+@@ -488,7 +493,7 @@ verify_msgauth(const char *secret, const krad_packet *pkt,
+     if (msgauth == NULL)
+         return ENODATA;
+ 
+-    retval = calculate_mac(secret, pkt, auth, mac);
++    retval = calculate_mac(ctx, secret, pkt, auth, mac);
+     if (retval)
+         return retval;
+ 
+@@ -561,7 +566,7 @@ krad_packet_decode_request(krb5_context ctx, const char *secret,
+ 
+     /* Verify Message-Authenticator if present. */
+     if (has_pkt_msgauth(req)) {
+-        retval = verify_msgauth(secret, req, pkt_auth(req));
++        retval = verify_msgauth(ctx, secret, req, pkt_auth(req));
+         if (retval) {
+             krad_packet_free(req);
+             return retval;
+@@ -613,7 +618,7 @@ krad_packet_decode_response(krb5_context ctx, const char *secret,
+ 
+             /* Verify Message-Authenticator if present. */
+             if (has_pkt_msgauth(*rsppkt)) {
+-                if (verify_msgauth(secret, *rsppkt, pkt_auth(tmp)) != 0)
++                if (verify_msgauth(ctx, secret, *rsppkt, pkt_auth(tmp)) != 0)
+                     continue;
+             }
+ 
+-- 
+2.49.0
+
diff --git a/0039-Fix-strchr-conformance-to-C23.patch b/0039-Fix-strchr-conformance-to-C23.patch
new file mode 100644
index 0000000..ed2cfa7
--- /dev/null
+++ b/0039-Fix-strchr-conformance-to-C23.patch
@@ -0,0 +1,189 @@
+From 1761e06398e4f043e4f540f57131c37fcc53a1b9 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Wed, 10 Dec 2025 10:42:02 +0200
+Subject: [PATCH] Fix strchr() conformance to C23
+
+C23 7.28.5.1 specifies search functions such as strchr() as generic,
+returning const char * if the first argument is of type const char *.
+Fix uses of strchr() to conform to this change.
+
+[jrische@redhat.com: altered changes to avoid casts; fixed an
+additional case]
+[ghudson@mit.edu: condensed some declarations; rewrote commit message]
+
+ticket: 9191 (new)
+(cherry picked from commit 6cd8580d823585d50ee4f30efd9f7e855823a369)
+---
+ src/lib/krb5/ccache/ccbase.c                      |  4 ++--
+ src/lib/krb5/os/expand_path.c                     |  3 ++-
+ src/lib/krb5/os/locate_kdc.c                      | 15 +++++++--------
+ src/plugins/preauth/pkinit/pkinit_crypto.h        |  2 +-
+ .../preauth/pkinit/pkinit_crypto_openssl.c        |  6 +++---
+ src/plugins/preauth/pkinit/pkinit_identity.c      |  2 +-
+ src/plugins/preauth/pkinit/pkinit_matching.c      |  2 +-
+ src/tests/responder.c                             |  3 +--
+ 8 files changed, 18 insertions(+), 19 deletions(-)
+
+diff --git a/src/lib/krb5/ccache/ccbase.c b/src/lib/krb5/ccache/ccbase.c
+index 5a01320832..1aada91b5e 100644
+--- a/src/lib/krb5/ccache/ccbase.c
++++ b/src/lib/krb5/ccache/ccbase.c
+@@ -201,8 +201,8 @@ krb5_cc_register(krb5_context context, const krb5_cc_ops *ops,
+ krb5_error_code KRB5_CALLCONV
+ krb5_cc_resolve (krb5_context context, const char *name, krb5_ccache *cache)
+ {
+-    char *pfx, *cp;
+-    const char *resid;
++    char *pfx;
++    const char *cp, *resid;
+     unsigned int pfxlen;
+     krb5_error_code err;
+     const krb5_cc_ops *ops;
+diff --git a/src/lib/krb5/os/expand_path.c b/src/lib/krb5/os/expand_path.c
+index 5cbccf08c8..6569b8820b 100644
+--- a/src/lib/krb5/os/expand_path.c
++++ b/src/lib/krb5/os/expand_path.c
+@@ -454,7 +454,8 @@ k5_expand_path_tokens_extra(krb5_context context, const char *path_in,
+ {
+     krb5_error_code ret;
+     struct k5buf buf;
+-    char *tok_begin, *tok_end, *tok_val, **extra_tokens = NULL, *path;
++    const char *tok_begin, *tok_end;
++    char *tok_val, **extra_tokens = NULL, *path;
+     const char *path_left;
+     size_t nargs = 0, i;
+     va_list ap;
+diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c
+index edca5ac7eb..47e15c849f 100644
+--- a/src/lib/krb5/os/locate_kdc.c
++++ b/src/lib/krb5/os/locate_kdc.c
+@@ -188,8 +188,8 @@ oom:
+ }
+ 
+ static void
+-parse_uri_if_https(const char *host_or_uri, k5_transport *transport,
+-                   const char **host, const char **uri_path)
++parse_uri_if_https(char *host_or_uri, k5_transport *transport,
++                   char **host, const char **uri_path)
+ {
+     char *cp;
+ 
+@@ -229,8 +229,7 @@ locate_srv_conf_1(krb5_context context, const krb5_data *realm,
+                   k5_transport transport, int udpport)
+ {
+     const char *realm_srv_names[4];
+-    char **hostlist = NULL, *realmstr = NULL, *host = NULL;
+-    const char *hostspec;
++    char **hostlist = NULL, *realmstr = NULL, *host = NULL, *hostspec;
+     krb5_error_code code;
+     int i, default_port;
+ 
+@@ -535,8 +534,8 @@ prof_locate_server(krb5_context context, const krb5_data *realm,
+  * Return a NULL *host_out if there are any problems parsing the URI.
+  */
+ static void
+-parse_uri_fields(const char *uri, k5_transport *transport_out,
+-                 const char **host_out, int *primary_out)
++parse_uri_fields(char *uri, k5_transport *transport_out,
++                 char **host_out, int *primary_out)
+ 
+ {
+     k5_transport transport;
+@@ -604,8 +603,8 @@ locate_uri(krb5_context context, const krb5_data *realm,
+     krb5_error_code ret;
+     k5_transport transport, host_trans;
+     struct srv_dns_entry *answers, *entry;
+-    char *host;
+-    const char *host_field, *path;
++    char *host, *host_field;
++    const char *path;
+     int port, def_port, primary;
+ 
+     ret = k5_make_uri_query(context, realm, req_service, &answers);
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
+index 3b12e904b1..99e2394040 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto.h
++++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
+@@ -456,7 +456,7 @@ krb5_error_code crypto_load_cas_and_crls
+ 		    defines the storage type (file, directory, etc) */
+ 	int catype,					/* IN
+ 		    defines the ca type (anchor, intermediate, crls) */
+-	char *id);					/* IN
++	const char *id);				/* IN
+ 		    defines the location (filename, directory name, etc) */
+ 
+ /*
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 429b7d202c..6013080afc 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -4956,7 +4956,7 @@ load_cas_and_crls(krb5_context context,
+                   pkinit_req_crypto_context req_cryptoctx,
+                   pkinit_identity_crypto_context id_cryptoctx,
+                   int catype,
+-                  char *filename)
++                  const char *filename)
+ {
+     STACK_OF(X509_INFO) *sk = NULL;
+     STACK_OF(X509) *ca_certs = NULL;
+@@ -5114,7 +5114,7 @@ load_cas_and_crls_dir(krb5_context context,
+                       pkinit_req_crypto_context req_cryptoctx,
+                       pkinit_identity_crypto_context id_cryptoctx,
+                       int catype,
+-                      char *dirname)
++                      const char *dirname)
+ {
+     krb5_error_code retval = EINVAL;
+     DIR *d = NULL;
+@@ -5166,7 +5166,7 @@ crypto_load_cas_and_crls(krb5_context context,
+                          pkinit_identity_crypto_context id_cryptoctx,
+                          int idtype,
+                          int catype,
+-                         char *id)
++                         const char *id)
+ {
+     switch (idtype) {
+     case IDTYPE_FILE:
+diff --git a/src/plugins/preauth/pkinit/pkinit_identity.c b/src/plugins/preauth/pkinit/pkinit_identity.c
+index a5a979f279..b06d519c66 100644
+--- a/src/plugins/preauth/pkinit/pkinit_identity.c
++++ b/src/plugins/preauth/pkinit/pkinit_identity.c
+@@ -474,7 +474,7 @@ process_option_ca_crl(krb5_context context,
+                       const char *value,
+                       int catype)
+ {
+-    char *residual;
++    const char *residual;
+     unsigned int typelen;
+     int idtype;
+ 
+diff --git a/src/plugins/preauth/pkinit/pkinit_matching.c b/src/plugins/preauth/pkinit/pkinit_matching.c
+index b42485a50a..5a7f2ba3fa 100644
+--- a/src/plugins/preauth/pkinit/pkinit_matching.c
++++ b/src/plugins/preauth/pkinit/pkinit_matching.c
+@@ -263,7 +263,7 @@ parse_rule_component(krb5_context context,
+     char err_buf[128];
+     int ret;
+     struct keyword_desc *kw, *nextkw;
+-    char *nk;
++    const char *nk;
+     int found_next_kw = 0;
+     char *value = NULL;
+     size_t len;
+diff --git a/src/tests/responder.c b/src/tests/responder.c
+index 82f870ea5d..4221a20283 100644
+--- a/src/tests/responder.c
++++ b/src/tests/responder.c
+@@ -282,8 +282,7 @@ responder(krb5_context ctx, void *rawdata, krb5_responder_context rctx)
+     /* Provide a particular response for an OTP challenge. */
+     if (data->otp_answer != NULL) {
+         if (krb5_responder_otp_get_challenge(ctx, rctx, &ochl) == 0) {
+-            key = strchr(data->otp_answer, '=');
+-            if (key != NULL) {
++            if (strchr(data->otp_answer, '=') != NULL) {
+                 /* Make a copy of the answer that we can chop up. */
+                 key = strdup(data->otp_answer);
+                 if (key == NULL)
+-- 
+2.51.1
+
diff --git a/0040-automated-fast.patch b/0040-automated-fast.patch
new file mode 100644
index 0000000..5a64233
--- /dev/null
+++ b/0040-automated-fast.patch
@@ -0,0 +1,226 @@
+From 3baf9b93dc1dfe38585722c71d7268304cb4a01a Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Sun, 21 Sep 2025 11:14:51 +0300
+Subject: libkrb5: in case PKINIT is configured, attempt Anonymous
+ PKINIT for FAST
+
+If auto_fast_armor is configured for the realm or globally, optimistically
+assume that Anonymous PKINIT is supported as well and try to obtain it for
+FAST use in case no pre-made FAST channel was established by the caller.
+
+This behavior will automatically enable use of passwordless pre-authentication
+methods which rely on FAST channel presence in deployments such as FreeIPA.
+
+Notably, Microsoft Active Directory KDCs do not support Anonymous PKINIT. For
+these deployments only a machine account (host keytab) can be used to build a
+FAST channel. However, libkrb5 does not have access to /etc/krb5.keytab in a
+general case.
+
+Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
+---
+ src/lib/krb5/krb/fast.c | 118 ++++++++++++++++++++++++++++++++++++++++
+ src/lib/krb5/krb/fast.h |   2 +
+ src/man/krb5.conf.man   |  13 +++++
+ 3 files changed, 133 insertions(+)
+
+diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c
+index 62c9f0841..ee2e08189 100644
+--- a/src/lib/krb5/krb/fast.c
++++ b/src/lib/krb5/krb/fast.c
+@@ -168,6 +168,109 @@ krb5int_fast_prep_req_body(krb5_context context,
+     return retval;
+ }
+ 
++static krb5_boolean
++fast_is_pkinit_allowed(krb5_context context, krb5_data *realm)
++{
++    int value;
++    krb5_error_code retval = EINVAL;
++    char realmstr[1024];
++    const char *option = "auto_fast_armor";
++    const int def_value = FALSE;
++
++    if (realm != NULL && realm->length > sizeof(realmstr)-1)
++        return FALSE;
++
++    if (realm != NULL) {
++        strncpy(realmstr, realm->data, realm->length);
++        realmstr[realm->length] = '\0';
++
++        retval = profile_get_boolean(context->profile,
++                                     KRB5_CONF_REALMS, realmstr,
++                                     option, def_value, &value);
++    }
++
++    return retval ? FALSE : value;
++
++}
++
++static krb5_error_code
++fast_acquire_pkinit_armor(krb5_context context,
++                           struct krb5int_fast_request_state *state,
++                           krb5_get_init_creds_opt *opt, krb5_kdc_req *request)
++{
++    krb5_context ctx;
++    krb5_get_init_creds_opt *options = NULL;
++    krb5_error_code retval = 0;
++    krb5_data *target_realm = &request->server->realm;
++    krb5_creds creds;
++    krb5_principal anon_princ = NULL;
++    krb5_ccache out_cc;
++
++    /* short circuit, we are asked to perform Anonymous PKINIT already */
++    if (opt->flags & KRB5_GET_INIT_CREDS_OPT_ANONYMOUS) {
++        return EINVAL;
++    }
++
++    /* skip realms which do not allow use of automated FAST armor */
++    if (!fast_is_pkinit_allowed(context, target_realm)) {
++        return EINVAL;
++    }
++
++    retval = krb5_init_context(&ctx);
++    if (retval != 0) {
++        return retval;
++    }
++    retval = krb5_get_init_creds_opt_alloc(ctx, &options);
++    if (retval != 0) {
++        goto cleanup;
++    }
++    krb5_get_init_creds_opt_set_anonymous(options, 1);
++    retval = krb5_cc_new_unique(ctx, "MEMORY", NULL, &out_cc);
++    if (retval != 0) {
++        goto cleanup;
++    }
++
++    retval = krb5_get_init_creds_opt_set_out_ccache(ctx, options, out_cc);
++    if (retval != 0) {
++        goto cleanup;
++    }
++
++    retval = krb5_build_principal_ext(ctx, &anon_princ,
++                                      target_realm->length, target_realm->data,
++                                      strlen(KRB5_WELLKNOWN_NAMESTR),
++                                      KRB5_WELLKNOWN_NAMESTR,
++                                      strlen(KRB5_ANONYMOUS_PRINCSTR),
++                                      KRB5_ANONYMOUS_PRINCSTR, 0);
++    if (retval != 0) {
++        goto cleanup;
++    }
++
++    retval = krb5_get_init_creds_password(ctx, &creds, anon_princ, 0,
++                                          NULL /* no prompter */, NULL,
++                                          0, NULL /* service name */,
++                                          options);
++    if (retval == 0) {
++        state->fast_state_flags |= KRB5INT_FAST_OWN_ARMOR;
++        state->armor_ccache = out_cc;
++    }
++cleanup:
++    if (retval != 0 && out_cc != NULL) {
++        (void) krb5_cc_destroy(ctx, out_cc);
++    }
++    if (retval == 0) {
++        krb5_free_cred_contents(ctx, &creds);
++    }
++    if (options != NULL) {
++        krb5_get_init_creds_opt_free(ctx, options);
++    }
++    if (anon_princ != NULL) {
++        krb5_free_principal(ctx, anon_princ);
++    }
++    krb5_free_context(ctx);
++
++    return retval;
++}
++
+ krb5_error_code
+ krb5int_fast_as_armor(krb5_context context,
+                       struct krb5int_fast_request_state *state,
+@@ -178,10 +281,20 @@ krb5int_fast_as_armor(krb5_context context,
+     krb5_principal target_principal = NULL;
+     krb5_data *target_realm;
+     const char *ccname = k5_gic_opt_get_fast_ccache_name(opt);
++    char *fast_ccname = NULL;
+     krb5_flags fast_flags;
+ 
+     krb5_clear_error_message(context);
+     target_realm = &request->server->realm;
++    if (ccname == NULL) {
++        retval = fast_acquire_pkinit_armor(context, state, opt, request);
++        if (retval == 0) {
++            retval = krb5_cc_get_full_name(context, state->armor_ccache, &fast_ccname);
++            if (retval == 0 && fast_ccname != NULL)
++                ccname = fast_ccname;
++        }
++        retval = 0;
++    }
+     if (ccname != NULL) {
+         TRACE_FAST_ARMOR_CCACHE(context, ccname);
+         state->fast_state_flags |= KRB5INT_FAST_ARMOR_AVAIL;
+@@ -220,6 +333,8 @@ krb5int_fast_as_armor(krb5_context context,
+         krb5_cc_close(context, ccache);
+     if (target_principal)
+         krb5_free_principal(context, target_principal);
++    if (fast_ccname)
++        free(fast_ccname);
+     return retval;
+ }
+ 
+@@ -615,6 +730,9 @@ krb5int_fast_free_state(krb5_context context,
+     /*We are responsible for none of the store in the fast_outer_req*/
+     krb5_free_keyblock(context, state->armor_key);
+     krb5_free_fast_armor(context, state->armor);
++    if (state->fast_state_flags & KRB5INT_FAST_OWN_ARMOR) {
++        krb5_cc_destroy(context, state->armor_ccache);
++    }
+     free(state);
+ }
+ 
+diff --git a/src/lib/krb5/krb/fast.h b/src/lib/krb5/krb/fast.h
+index 7156ea203..e5fe8bd54 100644
+--- a/src/lib/krb5/krb/fast.h
++++ b/src/lib/krb5/krb/fast.h
+@@ -34,6 +34,7 @@ struct krb5int_fast_request_state {
+     krb5_kdc_req fast_outer_request;
+     krb5_keyblock *armor_key; /*non-null means fast is in use*/
+     krb5_fast_armor *armor;
++    krb5_ccache armor_ccache;
+     krb5_ui_4 fast_state_flags;
+     krb5_ui_4 fast_options;
+     krb5_int32 nonce;
+@@ -41,6 +42,7 @@ struct krb5int_fast_request_state {
+ 
+ #define KRB5INT_FAST_DO_FAST     (1l<<0)  /* Perform FAST */
+ #define KRB5INT_FAST_ARMOR_AVAIL (1l<<1)
++#define KRB5INT_FAST_OWN_ARMOR   (1l<<2)
+ 
+ krb5_error_code
+ krb5int_fast_prep_req_body(krb5_context context,
+diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
+index d4caa2bd3..ac7649647 100644
+--- a/src/man/krb5.conf.man
++++ b/src/man/krb5.conf.man
+@@ -650,6 +650,19 @@ primary KDC, in case the user\(aqs password has just been changed, and
+ the updated database has not been propagated to the replica
+ servers yet.  New in release 1.19.
+ .TP
++\fBauto_fast_armor\fP
++If this flag is true, then initial ticket request will use Anonymous
++PKINIT to protect the communication as a FAST channel in case an application
++did not provide its own FAST channel. This is useful for deployments where
++pre-authentication methods require use of the FAST channel, such as
++passwordless methods provided by FreeIPA. Microsoft Active Directory
++implementation of PKINIT does not support Anonymous PKINIT feature.
++As a result, \fIauto_fast_armor\fP defaults to false.
++.sp
++Use of \fIauto_fast_armor = true\fP requires properly configured PKINIT and
++WELLKNOWN/ANONYMOUS principal defined on the KDC side. Consult KDC documentation
++for details.
++.TP
+ \fBv4_instance_convert\fP
+ This subsection allows the administrator to configure exceptions
+ to the \fBdefault_domain\fP mapping rule.  It contains V4 instances
+-- 
+2.51.0
+
diff --git a/0041-bail-if-prompter-is-not-specified-but-required.patch b/0041-bail-if-prompter-is-not-specified-but-required.patch
new file mode 100644
index 0000000..d1a3dc7
--- /dev/null
+++ b/0041-bail-if-prompter-is-not-specified-but-required.patch
@@ -0,0 +1,40 @@
+From ff580d9cf86202d45454a6b6f53accc22cb40b62 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Sun, 19 Oct 2025 18:14:29 +0300
+Subject: [PATCH] bail if prompter is not specified but required
+
+GSSAPI gss_init_sec_context() may trigger credential re-initialization
+if the cred in ccache is expired. If automatic FAST armor is in use,
+we'd request Anonymous PKINIT and use it as an armor and this will
+enable seeing pre-authentication methods which require armor presence.
+
+OTP is one of such methods and its use requires prompter to be set,
+but GSSAPI cannot specify a prompter and thus we should fail any
+pre-auth where a prompter wasn't passed.
+
+PKINIT PKCS11 and SAM-2 preauth methods use KRB5_LIBOS_CANTREADPWD while PKINIT
+and gic_pwd.c use EIO. Use EIO here because we technically attempt to read a
+PIN rather than a password.
+
+Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
+---
+ src/lib/krb5/krb/preauth_otp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/lib/krb5/krb/preauth_otp.c b/src/lib/krb5/krb/preauth_otp.c
+index 07ffc15c2..48003da62 100644
+--- a/src/lib/krb5/krb/preauth_otp.c
++++ b/src/lib/krb5/krb/preauth_otp.c
+@@ -479,6 +479,9 @@ doprompt(krb5_context context, krb5_prompter_fct prompter, void *prompter_data,
+     krb5_error_code retval;
+     krb5_prompt_type prompt_type = KRB5_PROMPT_TYPE_PREAUTH;
+ 
++    if (prompter == NULL)
++        return EIO;
++
+     if (prompttxt == NULL || out == NULL)
+         return EINVAL;
+ 
+-- 
+2.51.0
+
diff --git a/Add-dns_canonicalize_hostname-fallback-support.patch b/Add-dns_canonicalize_hostname-fallback-support.patch
deleted file mode 100644
index caa8c58..0000000
--- a/Add-dns_canonicalize_hostname-fallback-support.patch
+++ /dev/null
@@ -1,409 +0,0 @@
-From 1723d5cf07693d8fb249956ee73ca9f4436f95da Mon Sep 17 00:00:00 2001
-From: Simo Sorce <simo@redhat.com>
-Date: Tue, 4 Dec 2018 15:22:55 -0500
-Subject: [PATCH] Add dns_canonicalize_hostname=fallback support
-
-Turn dns_canonicalize_hostname into a tristate variable, allowing the
-value "fallback" as well as the true/false booleans.  If it is set to
-fallback, delay DNS canonicalization and attempt it only in
-krb5_get_credentials() if the KDC responds that the requested server
-principal name is unknown.
-
-[ghudson@mit.edu: added TGS tests; refactored code; edited commit
-message and documentation]
-
-ticket: 8765 (new)
-(cherry picked from commit 6c20cb1c89acaa03db897182a3b28d5f8f284907)
----
- doc/admin/conf_files/krb5_conf.rst |  4 ++
- src/include/k5-int.h               |  8 ++-
- src/include/k5-trace.h             |  3 ++
- src/lib/krb5/krb/get_creds.c       | 79 ++++++++++++++++++++++++++----
- src/lib/krb5/krb/init_ctx.c        | 27 +++++++++-
- src/lib/krb5/krb/t_copy_context.c  |  2 +-
- src/lib/krb5/os/os-proto.h         |  4 ++
- src/lib/krb5/os/sn2princ.c         | 19 +++++--
- src/tests/gcred.c                  |  5 +-
- src/tests/t_sn2princ.py            | 34 ++++++++++++-
- 10 files changed, 167 insertions(+), 18 deletions(-)
-
-diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
-index 7b4389f6b..e9f7e8c59 100644
---- a/doc/admin/conf_files/krb5_conf.rst
-+++ b/doc/admin/conf_files/krb5_conf.rst
-@@ -201,6 +201,10 @@ The libdefaults section may contain any of the following relations:
-     means that short hostnames will not be canonicalized to
-     fully-qualified hostnames.  The default value is true.
- 
-+    If this option is set to ``fallback`` (new in release 1.18), DNS
-+    canonicalization will only be performed the server hostname is not
-+    found with the original name when requesting credentials.
-+
- **dns_lookup_kdc**
-     Indicate whether DNS SRV records should be used to locate the KDCs
-     and other servers for a realm, if they are not listed in the
-diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index 255cee822..1e6a739e9 100644
---- a/src/include/k5-int.h
-+++ b/src/include/k5-int.h
-@@ -1159,6 +1159,12 @@ k5_plugin_register_dyn(krb5_context context, int interface_id,
- void
- k5_plugin_free_context(krb5_context context);
- 
-+enum dns_canonhost {
-+    CANONHOST_FALSE = 0,
-+    CANONHOST_TRUE = 1,
-+    CANONHOST_FALLBACK = 2
-+};
-+
- struct _kdb5_dal_handle;        /* private, in kdb5.h */
- typedef struct _kdb5_dal_handle kdb5_dal_handle;
- struct _kdb_log_context;
-@@ -1222,7 +1228,7 @@ struct _krb5_context {
- 
-     krb5_boolean allow_weak_crypto;
-     krb5_boolean ignore_acceptor_hostname;
--    krb5_boolean dns_canonicalize_hostname;
-+    enum dns_canonhost dns_canonicalize_hostname;
- 
-     krb5_trace_callback trace_callback;
-     void *trace_callback_data;
-diff --git a/src/include/k5-trace.h b/src/include/k5-trace.h
-index 2aa379b76..f3ed6a45d 100644
---- a/src/include/k5-trace.h
-+++ b/src/include/k5-trace.h
-@@ -191,6 +191,9 @@ void krb5int_trace(krb5_context context, const char *fmt, ...);
- #define TRACE_FAST_REQUIRED(c)                                  \
-     TRACE(c, "Using FAST due to KRB5_FAST_REQUIRED flag")
- 
-+#define TRACE_GET_CREDS_FALLBACK(c, hostname)                           \
-+    TRACE(c, "Falling back to canonicalized server hostname {str}", hostname)
-+
- #define TRACE_GIC_PWD_CHANGED(c)                                \
-     TRACE(c, "Getting initial TGT with changed password")
- #define TRACE_GIC_PWD_CHANGEPW(c, tries)                                \
-diff --git a/src/lib/krb5/krb/get_creds.c b/src/lib/krb5/krb/get_creds.c
-index 69900adfa..0a04d68b9 100644
---- a/src/lib/krb5/krb/get_creds.c
-+++ b/src/lib/krb5/krb/get_creds.c
-@@ -39,6 +39,7 @@
- 
- #include "k5-int.h"
- #include "int-proto.h"
-+#include "os-proto.h"
- #include "fast.h"
- 
- /*
-@@ -1249,6 +1250,26 @@ krb5_tkt_creds_step(krb5_context context, krb5_tkt_creds_context ctx,
-         return EINVAL;
- }
- 
-+static krb5_error_code
-+try_get_creds(krb5_context context, krb5_flags options, krb5_ccache ccache,
-+              krb5_creds *in_creds, krb5_creds *creds_out)
-+{
-+    krb5_error_code code;
-+    krb5_tkt_creds_context ctx = NULL;
-+
-+    code = krb5_tkt_creds_init(context, ccache, in_creds, options, &ctx);
-+    if (code)
-+        goto cleanup;
-+    code = krb5_tkt_creds_get(context, ctx);
-+    if (code)
-+        goto cleanup;
-+    code = krb5_tkt_creds_get_creds(context, ctx, creds_out);
-+
-+cleanup:
-+    krb5_tkt_creds_free(context, ctx);
-+    return code;
-+}
-+
- krb5_error_code KRB5_CALLCONV
- krb5_get_credentials(krb5_context context, krb5_flags options,
-                      krb5_ccache ccache, krb5_creds *in_creds,
-@@ -1256,7 +1277,10 @@ krb5_get_credentials(krb5_context context, krb5_flags options,
- {
-     krb5_error_code code;
-     krb5_creds *ncreds = NULL;
--    krb5_tkt_creds_context ctx = NULL;
-+    krb5_creds canon_creds, store_creds;
-+    krb5_principal_data canon_server;
-+    krb5_data canon_components[2];
-+    char *hostname = NULL, *canon_hostname = NULL;
- 
-     *out_creds = NULL;
- 
-@@ -1265,22 +1289,59 @@ krb5_get_credentials(krb5_context context, krb5_flags options,
-     if (ncreds == NULL)
-         goto cleanup;
- 
--    /* Make and execute a krb5_tkt_creds context to get the credential. */
--    code = krb5_tkt_creds_init(context, ccache, in_creds, options, &ctx);
--    if (code != 0)
-+    code = try_get_creds(context, options, ccache, in_creds, ncreds);
-+    if (!code) {
-+        *out_creds = ncreds;
-+        return 0;
-+    }
-+
-+    /* Possibly try again with the canonicalized hostname, if the server is
-+     * host-based and we are configured for fallback canonicalization. */
-+    if (code != KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN)
-         goto cleanup;
--    code = krb5_tkt_creds_get(context, ctx);
--    if (code != 0)
-+    if (context->dns_canonicalize_hostname != CANONHOST_FALLBACK)
-         goto cleanup;
--    code = krb5_tkt_creds_get_creds(context, ctx, ncreds);
--    if (code != 0)
-+    if (in_creds->server->type != KRB5_NT_SRV_HST ||
-+        in_creds->server->length != 2)
-         goto cleanup;
- 
-+    hostname = k5memdup0(in_creds->server->data[1].data,
-+                         in_creds->server->data[1].length, &code);
-+    if (hostname == NULL)
-+        goto cleanup;
-+    code = k5_expand_hostname(context, hostname, TRUE, &canon_hostname);
-+    if (code)
-+        goto cleanup;
-+
-+    TRACE_GET_CREDS_FALLBACK(context, canon_hostname);
-+
-+    /* Make shallow copies of in_creds and its server to alter the hostname. */
-+    canon_components[0] = in_creds->server->data[0];
-+    canon_components[1] = string2data(canon_hostname);
-+    canon_server = *in_creds->server;
-+    canon_server.data = canon_components;
-+    canon_creds = *in_creds;
-+    canon_creds.server = &canon_server;
-+
-+    code = try_get_creds(context, options | KRB5_GC_NO_STORE, ccache,
-+                         &canon_creds, ncreds);
-+    if (code)
-+        goto cleanup;
-+
-+    if (!(options & KRB5_GC_NO_STORE)) {
-+        /* Store the creds under the originally requested server name.  The
-+         * ccache layer will also store them under the ticket server name. */
-+        store_creds = *ncreds;
-+        store_creds.server = in_creds->server;
-+        (void)krb5_cc_store_cred(context, ccache, &store_creds);
-+    }
-+
-     *out_creds = ncreds;
-     ncreds = NULL;
- 
- cleanup:
-+    free(hostname);
-+    free(canon_hostname);
-     krb5_free_creds(context, ncreds);
--    krb5_tkt_creds_free(context, ctx);
-     return code;
- }
-diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
-index 947e50400..d263d5cc5 100644
---- a/src/lib/krb5/krb/init_ctx.c
-+++ b/src/lib/krb5/krb/init_ctx.c
-@@ -101,6 +101,30 @@ get_boolean(krb5_context ctx, const char *name, int def_val, int *boolean_out)
-     return retval;
- }
- 
-+static krb5_error_code
-+get_tristate(krb5_context ctx, const char *name, const char *third_option,
-+             int third_option_val, int def_val, int *val_out)
-+{
-+    krb5_error_code retval;
-+    char *str;
-+    int match;
-+
-+    retval = profile_get_boolean(ctx->profile, KRB5_CONF_LIBDEFAULTS, name,
-+                                 NULL, def_val, val_out);
-+    if (retval != PROF_BAD_BOOLEAN)
-+        return retval;
-+    retval = profile_get_string(ctx->profile, KRB5_CONF_LIBDEFAULTS, name,
-+                                NULL, NULL, &str);
-+    if (retval)
-+        return retval;
-+    match = (strcasecmp(third_option, str) == 0);
-+    free(str);
-+    if (!match)
-+        return EINVAL;
-+    *val_out = third_option_val;
-+    return 0;
-+}
-+
- krb5_error_code KRB5_CALLCONV
- krb5_init_context(krb5_context *context)
- {
-@@ -213,7 +237,8 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
-         goto cleanup;
-     ctx->ignore_acceptor_hostname = tmp;
- 
--    retval = get_boolean(ctx, KRB5_CONF_DNS_CANONICALIZE_HOSTNAME, 1, &tmp);
-+    retval = get_tristate(ctx, KRB5_CONF_DNS_CANONICALIZE_HOSTNAME, "fallback",
-+                          CANONHOST_FALLBACK, 1, &tmp);
-     if (retval)
-         goto cleanup;
-     ctx->dns_canonicalize_hostname = tmp;
-diff --git a/src/lib/krb5/krb/t_copy_context.c b/src/lib/krb5/krb/t_copy_context.c
-index fa810be8a..a6e48cd25 100644
---- a/src/lib/krb5/krb/t_copy_context.c
-+++ b/src/lib/krb5/krb/t_copy_context.c
-@@ -145,7 +145,7 @@ main(int argc, char **argv)
-     ctx->udp_pref_limit = 2345;
-     ctx->use_conf_ktypes = TRUE;
-     ctx->ignore_acceptor_hostname = TRUE;
--    ctx->dns_canonicalize_hostname = FALSE;
-+    ctx->dns_canonicalize_hostname = CANONHOST_FALSE;
-     free(ctx->plugin_base_dir);
-     check((ctx->plugin_base_dir = strdup("/a/b/c/d")) != NULL);
- 
-diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h
-index 634e82d70..066d30221 100644
---- a/src/lib/krb5/os/os-proto.h
-+++ b/src/lib/krb5/os/os-proto.h
-@@ -83,6 +83,10 @@ struct sendto_callback_info {
-     void *data;
- };
- 
-+krb5_error_code k5_expand_hostname(krb5_context context, const char *host,
-+                                   krb5_boolean is_fallback,
-+                                   char **canonhost_out);
-+
- krb5_error_code k5_locate_server(krb5_context, const krb5_data *realm,
-                                  struct serverlist *serverlist,
-                                  enum locate_service_type svc,
-diff --git a/src/lib/krb5/os/sn2princ.c b/src/lib/krb5/os/sn2princ.c
-index 5932fd9b3..98d2600aa 100644
---- a/src/lib/krb5/os/sn2princ.c
-+++ b/src/lib/krb5/os/sn2princ.c
-@@ -53,19 +53,23 @@ use_reverse_dns(krb5_context context)
-     return value;
- }
- 
--krb5_error_code KRB5_CALLCONV
--krb5_expand_hostname(krb5_context context, const char *host,
--                     char **canonhost_out)
-+krb5_error_code
-+k5_expand_hostname(krb5_context context, const char *host,
-+                   krb5_boolean is_fallback, char **canonhost_out)
- {
-     struct addrinfo *ai = NULL, hint;
-     char namebuf[NI_MAXHOST], *copy, *p;
-     int err;
-     const char *canonhost;
-+    krb5_boolean use_dns;
- 
-     *canonhost_out = NULL;
- 
-     canonhost = host;
--    if (context->dns_canonicalize_hostname) {
-+    use_dns = (context->dns_canonicalize_hostname == CANONHOST_TRUE ||
-+               (is_fallback &&
-+                context->dns_canonicalize_hostname == CANONHOST_FALLBACK));
-+    if (use_dns) {
-         /* Try a forward lookup of the hostname. */
-         memset(&hint, 0, sizeof(hint));
-         hint.ai_flags = AI_CANONNAME;
-@@ -112,6 +116,13 @@ cleanup:
-     return (*canonhost_out == NULL) ? ENOMEM : 0;
- }
- 
-+krb5_error_code KRB5_CALLCONV
-+krb5_expand_hostname(krb5_context context, const char *host,
-+                     char **canonhost_out)
-+{
-+    return k5_expand_hostname(context, host, FALSE, canonhost_out);
-+}
-+
- /* If hostname appears to have a :port or :instance trailer (used in MSSQLSvc
-  * principals), return a pointer to the separator.  Otherwise return NULL. */
- static const char *
-diff --git a/src/tests/gcred.c b/src/tests/gcred.c
-index b14e4fc9a..cac524c51 100644
---- a/src/tests/gcred.c
-+++ b/src/tests/gcred.c
-@@ -66,6 +66,7 @@ main(int argc, char **argv)
-     krb5_principal client, server;
-     krb5_ccache ccache;
-     krb5_creds in_creds, *creds;
-+    krb5_ticket *ticket;
-     krb5_flags options = 0;
-     char *name;
-     int c;
-@@ -102,9 +103,11 @@ main(int argc, char **argv)
-     in_creds.client = client;
-     in_creds.server = server;
-     check(krb5_get_credentials(ctx, options, ccache, &in_creds, &creds));
--    check(krb5_unparse_name(ctx, creds->server, &name));
-+    check(krb5_decode_ticket(&creds->ticket, &ticket));
-+    check(krb5_unparse_name(ctx, ticket->server, &name));
-     printf("%s\n", name);
- 
-+    krb5_free_ticket(ctx, ticket);
-     krb5_free_unparsed_name(ctx, name);
-     krb5_free_creds(ctx, creds);
-     krb5_free_principal(ctx, client);
-diff --git a/src/tests/t_sn2princ.py b/src/tests/t_sn2princ.py
-index 1ffda51f4..fe435a2d5 100755
---- a/src/tests/t_sn2princ.py
-+++ b/src/tests/t_sn2princ.py
-@@ -7,10 +7,15 @@ conf = {'domain_realm': {'kerberos.org': 'R1',
-                          'mit.edu': 'R3'}}
- no_rdns_conf = {'libdefaults': {'rdns': 'false'}}
- no_canon_conf = {'libdefaults': {'dns_canonicalize_hostname': 'false'}}
-+fallback_canon_conf = {'libdefaults':
-+                       {'rdns': 'false',
-+                        'dns_canonicalize_hostname': 'fallback'}}
- 
--realm = K5Realm(create_kdb=False, krb5_conf=conf)
-+realm = K5Realm(realm='R1', create_host=False, krb5_conf=conf)
- no_rdns = realm.special_env('no_rdns', False, krb5_conf=no_rdns_conf)
- no_canon = realm.special_env('no_canon', False, krb5_conf=no_canon_conf)
-+fallback_canon = realm.special_env('fallback_canon', False,
-+                                   krb5_conf=fallback_canon_conf)
- 
- def testbase(host, nametype, princhost, princrealm, env=None):
-     # Run the sn2princ harness with a specified host and name type and
-@@ -37,6 +42,10 @@ def testu(host, princhost, princrealm):
-     # Test with the unknown name type.
-     testbase(host, 'unknown', princhost, princrealm)
- 
-+def testfc(host, princhost, princrealm):
-+    # Test with the host-based name type with canonicalization fallback.
-+    testbase(host, 'srv-hst', princhost, princrealm, env=fallback_canon)
-+
- # With the unknown principal type, we do not canonicalize or downcase,
- # but we do remove a trailing period and look up the realm.
- mark('unknown type')
-@@ -71,6 +80,29 @@ if offline:
- oname = 'ptr-mismatch.kerberos.org'
- fname = 'www.kerberos.org'
- 
-+# Test fallback canonicalization krb5_sname_to_principal() results
-+# (same as dns_canonicalize_hostname=false).
-+mark('dns_canonicalize_host=fallback')
-+testfc(oname, oname, 'R1')
-+
-+# Test fallback canonicalization in krb5_get_credentials().
-+oprinc = 'host/' + oname
-+fprinc = 'host/' + fname
-+shutil.copy(realm.ccache, realm.ccache + '.save')
-+realm.addprinc(fprinc)
-+# oprinc doesn't exist, so we get the canonicalized fprinc as a fallback.
-+msgs = ('Falling back to canonicalized server hostname ' + fname,)
-+realm.run(['./gcred', 'srv-hst', oprinc], env=fallback_canon,
-+          expected_msg=fprinc, expected_trace=msgs)
-+realm.addprinc(oprinc)
-+# oprinc now exists, but we still get the fprinc ticket from the cache.
-+realm.run(['./gcred', 'srv-hst', oprinc], env=fallback_canon,
-+          expected_msg=fprinc)
-+# Without the cached result, we sould get oprinc in preference to fprinc.
-+os.rename(realm.ccache + '.save', realm.ccache)
-+realm.run(['./gcred', 'srv-hst', oprinc], env=fallback_canon,
-+          expected_msg=oprinc)
-+
- # Verify forward resolution before testing for it.
- try:
-     ai = socket.getaddrinfo(oname, None, 0, 0, 0, socket.AI_CANONNAME)
diff --git a/Add-function-and-enctype-flag-for-deprecations.patch b/Add-function-and-enctype-flag-for-deprecations.patch
deleted file mode 100644
index f268fcf..0000000
--- a/Add-function-and-enctype-flag-for-deprecations.patch
+++ /dev/null
@@ -1,183 +0,0 @@
-From 5817cf4b254ab7f266d74ba30ca2a0ffa26e803e Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 15 Jan 2019 16:16:57 -0500
-Subject: [PATCH] Add function and enctype flag for deprecations
-
-krb5int_c_deprecated_enctype() checks for the ETYPE_DEPRECATED flag on
-enctypes.  All ENCTYPE_WEAK enctypes are currently deprecated; not all
-deprecated enctypes are considered weak.  Deprecations follow RFC 6649
-and RFC 8429.
-
-(cherry picked from commit 484a6e7712f9b66e782b2520f07b0883889e116f)
----
- src/include/k5-int.h               |  1 +
- src/lib/crypto/krb/crypto_int.h    |  9 ++++++++-
- src/lib/crypto/krb/enctype_util.c  |  7 +++++++
- src/lib/crypto/krb/etypes.c        | 19 ++++++++++---------
- src/lib/crypto/libk5crypto.exports |  1 +
- src/lib/krb5_32.def                |  3 +++
- 6 files changed, 30 insertions(+), 10 deletions(-)
-
-diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index 8f9329c59..255cee822 100644
---- a/src/include/k5-int.h
-+++ b/src/include/k5-int.h
-@@ -2077,6 +2077,7 @@ krb5_get_tgs_ktypes(krb5_context, krb5_const_principal, krb5_enctype **);
- krb5_boolean krb5_is_permitted_enctype(krb5_context, krb5_enctype);
- 
- krb5_boolean KRB5_CALLCONV krb5int_c_weak_enctype(krb5_enctype);
-+krb5_boolean KRB5_CALLCONV krb5int_c_deprecated_enctype(krb5_enctype);
- krb5_error_code k5_enctype_to_ssf(krb5_enctype enctype, unsigned int *ssf_out);
- 
- krb5_error_code krb5_kdc_rep_decrypt_proc(krb5_context, const krb5_keyblock *,
-diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h
-index e5099291e..6c1c77cac 100644
---- a/src/lib/crypto/krb/crypto_int.h
-+++ b/src/lib/crypto/krb/crypto_int.h
-@@ -114,7 +114,14 @@ struct krb5_keytypes {
-     unsigned int ssf;
- };
- 
--#define ETYPE_WEAK 1
-+/*
-+ * "Weak" means the enctype is believed to be vulnerable to practical attacks,
-+ * and will be disabled unless allow_weak_crypto is set to true.  "Deprecated"
-+ * means the enctype has been deprecated by the IETF, and affects display and
-+ * logging.
-+ */
-+#define ETYPE_WEAK (1 << 0)
-+#define ETYPE_DEPRECATED (1 << 1)
- 
- extern const struct krb5_keytypes krb5int_enctypes_list[];
- extern const int krb5int_enctypes_length;
-diff --git a/src/lib/crypto/krb/enctype_util.c b/src/lib/crypto/krb/enctype_util.c
-index b1b40e7ec..e394f4e19 100644
---- a/src/lib/crypto/krb/enctype_util.c
-+++ b/src/lib/crypto/krb/enctype_util.c
-@@ -51,6 +51,13 @@ krb5int_c_weak_enctype(krb5_enctype etype)
-     return (ktp != NULL && (ktp->flags & ETYPE_WEAK) != 0);
- }
- 
-+krb5_boolean KRB5_CALLCONV
-+krb5int_c_deprecated_enctype(krb5_enctype etype)
-+{
-+    const struct krb5_keytypes *ktp = find_enctype(etype);
-+    return ktp != NULL && (ktp->flags & ETYPE_DEPRECATED) != 0;
-+}
-+
- krb5_error_code KRB5_CALLCONV
- krb5_c_enctype_compare(krb5_context context, krb5_enctype e1, krb5_enctype e2,
-                        krb5_boolean *similar)
-diff --git a/src/lib/crypto/krb/etypes.c b/src/lib/crypto/krb/etypes.c
-index 53d4a5c79..8f44c37e7 100644
---- a/src/lib/crypto/krb/etypes.c
-+++ b/src/lib/crypto/krb/etypes.c
-@@ -33,6 +33,7 @@
-    that the keytypes are all near each other.  I'd rather not make
-    that assumption. */
- 
-+/* Deprecations come from RFC 6649 and RFC 8249. */
- const struct krb5_keytypes krb5int_enctypes_list[] = {
-     { ENCTYPE_DES_CBC_CRC,
-       "des-cbc-crc", { 0 }, "DES cbc mode with CRC-32",
-@@ -42,7 +43,7 @@ const struct krb5_keytypes krb5int_enctypes_list[] = {
-       krb5int_des_string_to_key, k5_rand2key_des,
-       krb5int_des_prf,
-       CKSUMTYPE_RSA_MD5_DES,
--      ETYPE_WEAK, 56 },
-+      ETYPE_WEAK | ETYPE_DEPRECATED, 56 },
-     { ENCTYPE_DES_CBC_MD4,
-       "des-cbc-md4", { 0 }, "DES cbc mode with RSA-MD4",
-       &krb5int_enc_des, &krb5int_hash_md4,
-@@ -51,7 +52,7 @@ const struct krb5_keytypes krb5int_enctypes_list[] = {
-       krb5int_des_string_to_key, k5_rand2key_des,
-       krb5int_des_prf,
-       CKSUMTYPE_RSA_MD4_DES,
--      ETYPE_WEAK, 56 },
-+      ETYPE_WEAK | ETYPE_DEPRECATED, 56 },
-     { ENCTYPE_DES_CBC_MD5,
-       "des-cbc-md5", { "des" }, "DES cbc mode with RSA-MD5",
-       &krb5int_enc_des, &krb5int_hash_md5,
-@@ -60,7 +61,7 @@ const struct krb5_keytypes krb5int_enctypes_list[] = {
-       krb5int_des_string_to_key, k5_rand2key_des,
-       krb5int_des_prf,
-       CKSUMTYPE_RSA_MD5_DES,
--      ETYPE_WEAK, 56 },
-+      ETYPE_WEAK | ETYPE_DEPRECATED, 56 },
-     { ENCTYPE_DES_CBC_RAW,
-       "des-cbc-raw", { 0 }, "DES cbc mode raw",
-       &krb5int_enc_des, NULL,
-@@ -69,7 +70,7 @@ const struct krb5_keytypes krb5int_enctypes_list[] = {
-       krb5int_des_string_to_key, k5_rand2key_des,
-       krb5int_des_prf,
-       0,
--      ETYPE_WEAK, 56 },
-+      ETYPE_WEAK | ETYPE_DEPRECATED, 56 },
-     { ENCTYPE_DES3_CBC_RAW,
-       "des3-cbc-raw", { 0 }, "Triple DES cbc mode raw",
-       &krb5int_enc_des3, NULL,
-@@ -78,7 +79,7 @@ const struct krb5_keytypes krb5int_enctypes_list[] = {
-       krb5int_dk_string_to_key, k5_rand2key_des3,
-       NULL, /*PRF*/
-       0,
--      ETYPE_WEAK, 112 },
-+      ETYPE_WEAK | ETYPE_DEPRECATED, 112 },
- 
-     { ENCTYPE_DES3_CBC_SHA1,
-       "des3-cbc-sha1", { "des3-hmac-sha1", "des3-cbc-sha1-kd" },
-@@ -89,7 +90,7 @@ const struct krb5_keytypes krb5int_enctypes_list[] = {
-       krb5int_dk_string_to_key, k5_rand2key_des3,
-       krb5int_dk_prf,
-       CKSUMTYPE_HMAC_SHA1_DES3,
--      0 /*flags*/, 112 },
-+      ETYPE_DEPRECATED, 112 },
- 
-     { ENCTYPE_DES_HMAC_SHA1,
-       "des-hmac-sha1", { 0 }, "DES with HMAC/sha1",
-@@ -99,7 +100,7 @@ const struct krb5_keytypes krb5int_enctypes_list[] = {
-       krb5int_dk_string_to_key, k5_rand2key_des,
-       NULL, /*PRF*/
-       0,
--      ETYPE_WEAK, 56 },
-+      ETYPE_WEAK | ETYPE_DEPRECATED, 56 },
- 
-     /* rc4-hmac uses a 128-bit key, but due to weaknesses in the RC4 cipher, we
-      * consider its strength degraded and assign it an SSF value of 64. */
-@@ -113,7 +114,7 @@ const struct krb5_keytypes krb5int_enctypes_list[] = {
-       krb5int_arcfour_decrypt, krb5int_arcfour_string_to_key,
-       k5_rand2key_direct, krb5int_arcfour_prf,
-       CKSUMTYPE_HMAC_MD5_ARCFOUR,
--      0 /*flags*/, 64 },
-+      ETYPE_DEPRECATED, 64 },
-     { ENCTYPE_ARCFOUR_HMAC_EXP,
-       "arcfour-hmac-exp", { "rc4-hmac-exp", "arcfour-hmac-md5-exp" },
-       "Exportable ArcFour with HMAC/md5",
-@@ -124,7 +125,7 @@ const struct krb5_keytypes krb5int_enctypes_list[] = {
-       krb5int_arcfour_decrypt, krb5int_arcfour_string_to_key,
-       k5_rand2key_direct, krb5int_arcfour_prf,
-       CKSUMTYPE_HMAC_MD5_ARCFOUR,
--      ETYPE_WEAK, 40
-+      ETYPE_WEAK | ETYPE_DEPRECATED, 40
-     },
- 
-     { ENCTYPE_AES128_CTS_HMAC_SHA1_96,
-diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports
-index 82eb5f30c..90afdf5f7 100644
---- a/src/lib/crypto/libk5crypto.exports
-+++ b/src/lib/crypto/libk5crypto.exports
-@@ -109,3 +109,4 @@ k5_allow_weak_pbkdf2iter
- krb5_c_prfplus
- krb5_c_derive_prfplus
- k5_enctype_to_ssf
-+krb5int_c_deprecated_enctype
-diff --git a/src/lib/krb5_32.def b/src/lib/krb5_32.def
-index c35022931..e6a487593 100644
---- a/src/lib/krb5_32.def
-+++ b/src/lib/krb5_32.def
-@@ -487,3 +487,6 @@ EXPORTS
- 	encode_krb5_pa_spake				@444 ; PRIVATE
- 	decode_krb5_pa_spake				@445 ; PRIVATE
- 	k5_free_pa_spake				@446 ; PRIVATE
-+
-+; new in 1.18
-+	krb5int_c_deprecated_enctype			@450 ; PRIVATE
diff --git a/Add-missing-newlines-to-deprecation-warnings.patch b/Add-missing-newlines-to-deprecation-warnings.patch
deleted file mode 100644
index 173cd61..0000000
--- a/Add-missing-newlines-to-deprecation-warnings.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 4928699bdfd051bf0d69afee0b15574c15f40a48 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Tue, 21 May 2019 12:52:26 -0400
-Subject: [PATCH] Add missing newlines to deprecation warnings
-
-Commit 8d8e68283b599e680f9fe45eff8af397e827bd6c omitted newlines in
-two warning messages sent to stderr.  Add them now.
-
-ticket: 8773
-(cherry picked from commit 274fee295d1429668b31c6ed898fc5d11a7e3589)
----
- src/kdc/main.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/src/kdc/main.c b/src/kdc/main.c
-index 04393772f..1596c1c5b 100644
---- a/src/kdc/main.c
-+++ b/src/kdc/main.c
-@@ -223,7 +223,8 @@ init_realm(kdc_realm_t * rdp, krb5_pointer aprof, char *realm,
-         if (krb5_enctype_to_name(def_enctype, FALSE, ename, sizeof(ename)))
-             ename[0] = '\0';
-         fprintf(stderr,
--                _("Requested master password enctype %s in %s is DEPRECATED!"),
-+                _("Requested master password enctype %s in %s is "
-+                  "DEPRECATED!\n"),
-                 ename, realm);
-     }
- 
-@@ -385,7 +386,7 @@ init_realm(kdc_realm_t * rdp, krb5_pointer aprof, char *realm,
-         if (krb5_enctype_to_name(rdp->realm_mkey.enctype, FALSE, ename,
-                                  sizeof(ename)))
-             ename[0] = '\0';
--        fprintf(stderr, _("Stash file %s uses DEPRECATED enctype %s!"),
-+        fprintf(stderr, _("Stash file %s uses DEPRECATED enctype %s!\n"),
-                 rdp->realm_stash, ename);
-     }
- 
diff --git a/Add-soft-pkcs11-source-code.patch b/Add-soft-pkcs11-source-code.patch
deleted file mode 100644
index 4152b5e..0000000
--- a/Add-soft-pkcs11-source-code.patch
+++ /dev/null
@@ -1,2071 +0,0 @@
-From a186597238ae40e167ce041857b5bd1f94ee2383 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Thu, 20 Jun 2019 10:45:18 -0400
-Subject: [PATCH] Add soft-pkcs11 source code
-
-soft-pkcs11 is no longer available upstream and is not generally
-packaged in distributions, making it inconvenient to use for tests.
-Import the 1.8 source code, detabified and with trailing whitespace
-removed but otherwise unmodified.
-
-(cherry picked from commit a4bc3e513a58b0d1292f3506ac3b35be8c178086)
----
- src/tests/softpkcs11/main.c | 2049 +++++++++++++++++++++++++++++++++++
- 1 file changed, 2049 insertions(+)
- create mode 100644 src/tests/softpkcs11/main.c
-
-diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c
-new file mode 100644
-index 000000000..2acec5169
---- /dev/null
-+++ b/src/tests/softpkcs11/main.c
-@@ -0,0 +1,2049 @@
-+/*
-+ * Copyright (c) 2004-2006, Stockholms universitet
-+ * (Stockholm University, Stockholm Sweden)
-+ * All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ *
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ *
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ *
-+ * 3. Neither the name of the university nor the names of its contributors
-+ *    may be used to endorse or promote products derived from this software
-+ *    without specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-+ * POSSIBILITY OF SUCH DAMAGE.
-+ */
-+
-+#include "locl.h"
-+
-+/* RCSID("$Id: main.c,v 1.24 2006/01/11 12:42:53 lha Exp $"); */
-+
-+#define OBJECT_ID_MASK          0xfff
-+#define HANDLE_OBJECT_ID(h)     ((h) & OBJECT_ID_MASK)
-+#define OBJECT_ID(obj)          HANDLE_OBJECT_ID((obj)->object_handle)
-+
-+struct st_attr {
-+    CK_ATTRIBUTE attribute;
-+    int secret;
-+};
-+
-+struct st_object {
-+    CK_OBJECT_HANDLE object_handle;
-+    struct st_attr *attrs;
-+    int num_attributes;
-+    enum {
-+        STO_T_CERTIFICATE,
-+        STO_T_PRIVATE_KEY,
-+        STO_T_PUBLIC_KEY
-+    } type;
-+    union {
-+        X509 *cert;
-+        EVP_PKEY *public_key;
-+        struct {
-+            const char *file;
-+            EVP_PKEY *key;
-+            X509 *cert;
-+        } private_key;
-+    } u;
-+};
-+
-+static struct soft_token {
-+    CK_VOID_PTR application;
-+    CK_NOTIFY notify;
-+    struct {
-+        struct st_object **objs;
-+        int num_objs;
-+    } object;
-+    struct {
-+        int hardware_slot;
-+        int app_error_fatal;
-+        int login_done;
-+    } flags;
-+    int open_sessions;
-+    struct session_state {
-+        CK_SESSION_HANDLE session_handle;
-+
-+        struct {
-+            CK_ATTRIBUTE *attributes;
-+            CK_ULONG num_attributes;
-+            int next_object;
-+        } find;
-+
-+        int encrypt_object;
-+        CK_MECHANISM_PTR encrypt_mechanism;
-+        int decrypt_object;
-+        CK_MECHANISM_PTR decrypt_mechanism;
-+        int sign_object;
-+        CK_MECHANISM_PTR sign_mechanism;
-+        int verify_object;
-+        CK_MECHANISM_PTR verify_mechanism;
-+        int digest_object;
-+    } state[10];
-+#define MAX_NUM_SESSION (sizeof(soft_token.state)/sizeof(soft_token.state[0]))
-+    FILE *logfile;
-+} soft_token;
-+
-+static void
-+application_error(const char *fmt, ...)
-+{
-+    va_list ap;
-+    va_start(ap, fmt);
-+    vprintf(fmt, ap);
-+    va_end(ap);
-+    if (soft_token.flags.app_error_fatal)
-+        abort();
-+}
-+
-+static void
-+st_logf(const char *fmt, ...)
-+{
-+    va_list ap;
-+    if (soft_token.logfile == NULL)
-+        return;
-+    va_start(ap, fmt);
-+    vfprintf(soft_token.logfile, fmt, ap);
-+    va_end(ap);
-+    fflush(soft_token.logfile);
-+}
-+
-+static void
-+snprintf_fill(char *str, size_t size, char fillchar, const char *fmt, ...)
-+{
-+    int len;
-+    va_list ap;
-+    len = vsnprintf(str, size, fmt, ap);
-+    va_end(ap);
-+    if (len < 0 || len > size)
-+        return;
-+    while(len < size)
-+        str[len++] = fillchar;
-+}
-+
-+#ifndef TEST_APP
-+#define printf error_use_st_logf
-+#endif
-+
-+#define VERIFY_SESSION_HANDLE(s, state)                 \
-+{                                                       \
-+    CK_RV ret;                                          \
-+    ret = verify_session_handle(s, state);              \
-+    if (ret != CKR_OK) {                                \
-+        /* return CKR_OK */;                            \
-+    }                                                   \
-+}
-+
-+static CK_RV
-+verify_session_handle(CK_SESSION_HANDLE hSession,
-+                      struct session_state **state)
-+{
-+    int i;
-+
-+    for (i = 0; i < MAX_NUM_SESSION; i++){
-+        if (soft_token.state[i].session_handle == hSession)
-+            break;
-+    }
-+    if (i == MAX_NUM_SESSION) {
-+        application_error("use of invalid handle: 0x%08lx\n",
-+                          (unsigned long)hSession);
-+        return CKR_SESSION_HANDLE_INVALID;
-+    }
-+    if (state)
-+        *state = &soft_token.state[i];
-+    return CKR_OK;
-+}
-+
-+static CK_RV
-+object_handle_to_object(CK_OBJECT_HANDLE handle,
-+                        struct st_object **object)
-+{
-+    int i = HANDLE_OBJECT_ID(handle);
-+
-+    *object = NULL;
-+    if (i >= soft_token.object.num_objs)
-+        return CKR_ARGUMENTS_BAD;
-+    if (soft_token.object.objs[i] == NULL)
-+        return CKR_ARGUMENTS_BAD;
-+    if (soft_token.object.objs[i]->object_handle != handle)
-+        return CKR_ARGUMENTS_BAD;
-+    *object = soft_token.object.objs[i];
-+    return CKR_OK;
-+}
-+
-+static int
-+attributes_match(const struct st_object *obj,
-+                 const CK_ATTRIBUTE *attributes,
-+                 CK_ULONG num_attributes)
-+{
-+    CK_ULONG i;
-+    int j;
-+    st_logf("attributes_match: %ld\n", (unsigned long)OBJECT_ID(obj));
-+
-+    for (i = 0; i < num_attributes; i++) {
-+        int match = 0;
-+        for (j = 0; j < obj->num_attributes; j++) {
-+            if (attributes[i].type == obj->attrs[j].attribute.type &&
-+                attributes[i].ulValueLen == obj->attrs[j].attribute.ulValueLen &&
-+                memcmp(attributes[i].pValue, obj->attrs[j].attribute.pValue,
-+                       attributes[i].ulValueLen) == 0) {
-+                match = 1;
-+                break;
-+            }
-+        }
-+        if (match == 0) {
-+            st_logf("type %d attribute have no match\n", attributes[i].type);
-+            return 0;
-+        }
-+    }
-+    st_logf("attribute matches\n");
-+    return 1;
-+}
-+
-+static void
-+print_attributes(const CK_ATTRIBUTE *attributes,
-+                 CK_ULONG num_attributes)
-+{
-+    CK_ULONG i;
-+
-+    st_logf("find objects: attrs: %lu\n", (unsigned long)num_attributes);
-+
-+    for (i = 0; i < num_attributes; i++) {
-+        st_logf("  type: ");
-+        switch (attributes[i].type) {
-+        case CKA_TOKEN: {
-+            CK_BBOOL *ck_true;
-+            if (attributes[i].ulValueLen != sizeof(CK_BBOOL)) {
-+                application_error("token attribute wrong length\n");
-+                break;
-+            }
-+            ck_true = attributes[i].pValue;
-+            st_logf("token: %s", *ck_true ? "TRUE" : "FALSE");
-+            break;
-+        }
-+        case CKA_CLASS: {
-+            CK_OBJECT_CLASS *class;
-+            if (attributes[i].ulValueLen != sizeof(CK_ULONG)) {
-+                application_error("class attribute wrong length\n");
-+                break;
-+            }
-+            class = attributes[i].pValue;
-+            st_logf("class ");
-+            switch (*class) {
-+            case CKO_CERTIFICATE:
-+                st_logf("certificate");
-+                break;
-+            case CKO_PUBLIC_KEY:
-+                st_logf("public key");
-+                break;
-+            case CKO_PRIVATE_KEY:
-+                st_logf("private key");
-+                break;
-+            case CKO_SECRET_KEY:
-+                st_logf("secret key");
-+                break;
-+            case CKO_DOMAIN_PARAMETERS:
-+                st_logf("domain parameters");
-+                break;
-+            default:
-+                st_logf("[class %lx]", (long unsigned)*class);
-+                break;
-+            }
-+            break;
-+        }
-+        case CKA_PRIVATE:
-+            st_logf("private");
-+            break;
-+        case CKA_LABEL:
-+            st_logf("label");
-+            break;
-+        case CKA_APPLICATION:
-+            st_logf("application");
-+            break;
-+        case CKA_VALUE:
-+            st_logf("value");
-+            break;
-+        case CKA_ID:
-+            st_logf("id");
-+            break;
-+        default:
-+            st_logf("[unknown 0x%08lx]", (unsigned long)attributes[i].type);
-+            break;
-+        }
-+        st_logf("\n");
-+    }
-+}
-+
-+static struct st_object *
-+add_st_object(void)
-+{
-+    struct st_object *o, **objs;
-+    int i;
-+
-+    o = malloc(sizeof(*o));
-+    if (o == NULL)
-+        return NULL;
-+    memset(o, 0, sizeof(*o));
-+    o->attrs = NULL;
-+    o->num_attributes = 0;
-+
-+    for (i = 0; i < soft_token.object.num_objs; i++) {
-+        if (soft_token.object.objs == NULL) {
-+            soft_token.object.objs[i] = o;
-+            break;
-+        }
-+    }
-+    if (i == soft_token.object.num_objs) {
-+        objs = realloc(soft_token.object.objs,
-+                       (soft_token.object.num_objs + 1) * sizeof(soft_token.object.objs[0]));
-+        if (objs == NULL) {
-+            free(o);
-+            return NULL;
-+        }
-+        soft_token.object.objs = objs;
-+        soft_token.object.objs[soft_token.object.num_objs++] = o;
-+    }
-+    soft_token.object.objs[i]->object_handle =
-+        (random() & (~OBJECT_ID_MASK)) | i;
-+
-+    return o;
-+}
-+
-+static CK_RV
-+add_object_attribute(struct st_object *o,
-+                     int secret,
-+                     CK_ATTRIBUTE_TYPE type,
-+                     CK_VOID_PTR pValue,
-+                     CK_ULONG ulValueLen)
-+{
-+    struct st_attr *a;
-+    int i;
-+
-+    i = o->num_attributes;
-+    a = realloc(o->attrs, (i + 1) * sizeof(o->attrs[0]));
-+    if (a == NULL)
-+        return CKR_DEVICE_MEMORY;
-+    o->attrs = a;
-+    o->attrs[i].secret = secret;
-+    o->attrs[i].attribute.type = type;
-+    o->attrs[i].attribute.pValue = malloc(ulValueLen);
-+    if (o->attrs[i].attribute.pValue == NULL && ulValueLen != 0)
-+        return CKR_DEVICE_MEMORY;
-+    memcpy(o->attrs[i].attribute.pValue, pValue, ulValueLen);
-+    o->attrs[i].attribute.ulValueLen = ulValueLen;
-+    o->num_attributes++;
-+
-+    return CKR_OK;
-+}
-+
-+static CK_RV
-+add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key)
-+{
-+    switch (key_type) {
-+    case CKK_RSA: {
-+        CK_BYTE *modulus = NULL;
-+        size_t modulus_len = 0;
-+        CK_ULONG modulus_bits = 0;
-+        CK_BYTE *exponent = NULL;
-+        size_t exponent_len = 0;
-+
-+        modulus_bits = BN_num_bits(key->pkey.rsa->n);
-+
-+        modulus_len = BN_num_bytes(key->pkey.rsa->n);
-+        modulus = malloc(modulus_len);
-+        BN_bn2bin(key->pkey.rsa->n, modulus);
-+
-+        exponent_len = BN_num_bytes(key->pkey.rsa->e);
-+        exponent = malloc(exponent_len);
-+        BN_bn2bin(key->pkey.rsa->e, exponent);
-+
-+        add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len);
-+        add_object_attribute(o, 0, CKA_MODULUS_BITS,
-+                             &modulus_bits, sizeof(modulus_bits));
-+        add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT,
-+                             exponent, exponent_len);
-+
-+        RSA_set_method(key->pkey.rsa, RSA_PKCS1_SSLeay());
-+
-+        free(modulus);
-+        free(exponent);
-+    }
-+    default:
-+        /* XXX */
-+        break;
-+    }
-+    return CKR_OK;
-+}
-+
-+
-+static int
-+pem_callback(char *buf, int num, int w, void *key)
-+{
-+    return -1;
-+}
-+
-+
-+static CK_RV
-+add_certificate(char *label,
-+                const char *cert_file,
-+                const char *private_key_file,
-+                char *id,
-+                int anchor)
-+{
-+    struct st_object *o = NULL;
-+    CK_BBOOL bool_true = CK_TRUE;
-+    CK_BBOOL bool_false = CK_FALSE;
-+    CK_OBJECT_CLASS c;
-+    CK_CERTIFICATE_TYPE cert_type = CKC_X_509;
-+    CK_KEY_TYPE key_type;
-+    CK_MECHANISM_TYPE mech_type;
-+    void *cert_data = NULL;
-+    size_t cert_length;
-+    void *subject_data = NULL;
-+    size_t subject_length;
-+    void *issuer_data = NULL;
-+    size_t issuer_length;
-+    void *serial_data = NULL;
-+    size_t serial_length;
-+    CK_RV ret = CKR_GENERAL_ERROR;
-+    X509 *cert;
-+    EVP_PKEY *public_key;
-+
-+    size_t id_len = strlen(id);
-+
-+    {
-+        FILE *f;
-+
-+        f = fopen(cert_file, "r");
-+        if (f == NULL) {
-+            st_logf("failed to open file %s\n", cert_file);
-+            return CKR_GENERAL_ERROR;
-+        }
-+
-+        cert = PEM_read_X509(f, NULL, NULL, NULL);
-+        fclose(f);
-+        if (cert == NULL) {
-+            st_logf("failed reading PEM cert\n");
-+            return CKR_GENERAL_ERROR;
-+        }
-+
-+        OPENSSL_ASN1_MALLOC_ENCODE(X509, cert_data, cert_length, cert, ret);
-+        if (ret)
-+            goto out;
-+
-+        OPENSSL_ASN1_MALLOC_ENCODE(X509_NAME, issuer_data, issuer_length,
-+                                   X509_get_issuer_name(cert), ret);
-+        if (ret)
-+            goto out;
-+
-+        OPENSSL_ASN1_MALLOC_ENCODE(X509_NAME, subject_data, subject_length,
-+                                   X509_get_subject_name(cert), ret);
-+        if (ret)
-+            goto out;
-+
-+        OPENSSL_ASN1_MALLOC_ENCODE(ASN1_INTEGER, serial_data, serial_length,
-+                                   X509_get_serialNumber(cert), ret);
-+        if (ret)
-+            goto out;
-+
-+    }
-+
-+    st_logf("done parsing, adding to internal structure\n");
-+
-+    o = add_st_object();
-+    if (o == NULL) {
-+        ret = CKR_DEVICE_MEMORY;
-+        goto out;
-+    }
-+    o->type = STO_T_CERTIFICATE;
-+    o->u.cert = cert;
-+    public_key = X509_get_pubkey(o->u.cert);
-+
-+    switch (EVP_PKEY_type(public_key->type)) {
-+    case EVP_PKEY_RSA:
-+        key_type = CKK_RSA;
-+        break;
-+    case EVP_PKEY_DSA:
-+        key_type = CKK_DSA;
-+        break;
-+    default:
-+        /* XXX */
-+        break;
-+    }
-+
-+    c = CKO_CERTIFICATE;
-+    add_object_attribute(o, 0, CKA_CLASS, &c, sizeof(c));
-+    add_object_attribute(o, 0, CKA_TOKEN, &bool_true, sizeof(bool_true));
-+    add_object_attribute(o, 0, CKA_PRIVATE, &bool_false, sizeof(bool_false));
-+    add_object_attribute(o, 0, CKA_MODIFIABLE, &bool_false, sizeof(bool_false));
-+    add_object_attribute(o, 0, CKA_LABEL, label, strlen(label));
-+
-+    add_object_attribute(o, 0, CKA_CERTIFICATE_TYPE, &cert_type, sizeof(cert_type));
-+    add_object_attribute(o, 0, CKA_ID, id, id_len);
-+
-+    add_object_attribute(o, 0, CKA_SUBJECT, subject_data, subject_length);
-+    add_object_attribute(o, 0, CKA_ISSUER, issuer_data, issuer_length);
-+    add_object_attribute(o, 0, CKA_SERIAL_NUMBER, serial_data, serial_length);
-+    add_object_attribute(o, 0, CKA_VALUE, cert_data, cert_length);
-+    if (anchor)
-+        add_object_attribute(o, 0, CKA_TRUSTED, &bool_true, sizeof(bool_true));
-+    else
-+        add_object_attribute(o, 0, CKA_TRUSTED, &bool_false, sizeof(bool_false));
-+
-+    st_logf("add cert ok: %lx\n", (unsigned long)OBJECT_ID(o));
-+
-+    o = add_st_object();
-+    if (o == NULL) {
-+        ret = CKR_DEVICE_MEMORY;
-+        goto out;
-+    }
-+    o->type = STO_T_PUBLIC_KEY;
-+    o->u.public_key = public_key;
-+
-+    c = CKO_PUBLIC_KEY;
-+    add_object_attribute(o, 0, CKA_CLASS, &c, sizeof(c));
-+    add_object_attribute(o, 0, CKA_TOKEN, &bool_true, sizeof(bool_true));
-+    add_object_attribute(o, 0, CKA_PRIVATE, &bool_false, sizeof(bool_false));
-+    add_object_attribute(o, 0, CKA_MODIFIABLE, &bool_false, sizeof(bool_false));
-+    add_object_attribute(o, 0, CKA_LABEL, label, strlen(label));
-+
-+    add_object_attribute(o, 0, CKA_KEY_TYPE, &key_type, sizeof(key_type));
-+    add_object_attribute(o, 0, CKA_ID, id, id_len);
-+    add_object_attribute(o, 0, CKA_START_DATE, "", 1); /* XXX */
-+    add_object_attribute(o, 0, CKA_END_DATE, "", 1); /* XXX */
-+    add_object_attribute(o, 0, CKA_DERIVE, &bool_false, sizeof(bool_false));
-+    add_object_attribute(o, 0, CKA_LOCAL, &bool_false, sizeof(bool_false));
-+    mech_type = CKM_RSA_X_509;
-+    add_object_attribute(o, 0, CKA_KEY_GEN_MECHANISM, &mech_type, sizeof(mech_type));
-+
-+    add_object_attribute(o, 0, CKA_SUBJECT, subject_data, subject_length);
-+    add_object_attribute(o, 0, CKA_ENCRYPT, &bool_true, sizeof(bool_true));
-+    add_object_attribute(o, 0, CKA_VERIFY, &bool_true, sizeof(bool_true));
-+    add_object_attribute(o, 0, CKA_VERIFY_RECOVER, &bool_false, sizeof(bool_false));
-+    add_object_attribute(o, 0, CKA_WRAP, &bool_true, sizeof(bool_true));
-+    add_object_attribute(o, 0, CKA_TRUSTED, &bool_true, sizeof(bool_true));
-+
-+    add_pubkey_info(o, key_type, public_key);
-+
-+    st_logf("add key ok: %lx\n", (unsigned long)OBJECT_ID(o));
-+
-+    if (private_key_file) {
-+        CK_FLAGS flags;
-+        FILE *f;
-+
-+        o = add_st_object();
-+        if (o == NULL) {
-+            ret = CKR_DEVICE_MEMORY;
-+            goto out;
-+        }
-+        o->type = STO_T_PRIVATE_KEY;
-+        o->u.private_key.file = strdup(private_key_file);
-+        o->u.private_key.key = NULL;
-+
-+        o->u.private_key.cert = cert;
-+
-+        c = CKO_PRIVATE_KEY;
-+        add_object_attribute(o, 0, CKA_CLASS, &c, sizeof(c));
-+        add_object_attribute(o, 0, CKA_TOKEN, &bool_true, sizeof(bool_true));
-+        add_object_attribute(o, 0, CKA_PRIVATE, &bool_true, sizeof(bool_false));
-+        add_object_attribute(o, 0, CKA_MODIFIABLE, &bool_false, sizeof(bool_false));
-+        add_object_attribute(o, 0, CKA_LABEL, label, strlen(label));
-+
-+        add_object_attribute(o, 0, CKA_KEY_TYPE, &key_type, sizeof(key_type));
-+        add_object_attribute(o, 0, CKA_ID, id, id_len);
-+        add_object_attribute(o, 0, CKA_START_DATE, "", 1); /* XXX */
-+        add_object_attribute(o, 0, CKA_END_DATE, "", 1); /* XXX */
-+        add_object_attribute(o, 0, CKA_DERIVE, &bool_false, sizeof(bool_false));
-+        add_object_attribute(o, 0, CKA_LOCAL, &bool_false, sizeof(bool_false));
-+        mech_type = CKM_RSA_X_509;
-+        add_object_attribute(o, 0, CKA_KEY_GEN_MECHANISM, &mech_type, sizeof(mech_type));
-+
-+        add_object_attribute(o, 0, CKA_SUBJECT, subject_data, subject_length);
-+        add_object_attribute(o, 0, CKA_SENSITIVE, &bool_true, sizeof(bool_true));
-+        add_object_attribute(o, 0, CKA_SECONDARY_AUTH, &bool_false, sizeof(bool_true));
-+        flags = 0;
-+        add_object_attribute(o, 0, CKA_AUTH_PIN_FLAGS, &flags, sizeof(flags));
-+
-+        add_object_attribute(o, 0, CKA_DECRYPT, &bool_true, sizeof(bool_true));
-+        add_object_attribute(o, 0, CKA_SIGN, &bool_true, sizeof(bool_true));
-+        add_object_attribute(o, 0, CKA_SIGN_RECOVER, &bool_false, sizeof(bool_false));
-+        add_object_attribute(o, 0, CKA_UNWRAP, &bool_true, sizeof(bool_true));
-+        add_object_attribute(o, 0, CKA_EXTRACTABLE, &bool_true, sizeof(bool_true));
-+        add_object_attribute(o, 0, CKA_NEVER_EXTRACTABLE, &bool_false, sizeof(bool_false));
-+
-+        add_pubkey_info(o, key_type, public_key);
-+
-+        f = fopen(private_key_file, "r");
-+        if (f == NULL) {
-+            st_logf("failed to open private key\n");
-+            return CKR_GENERAL_ERROR;
-+        }
-+
-+        o->u.private_key.key = PEM_read_PrivateKey(f, NULL, pem_callback, NULL);
-+        fclose(f);
-+        if (o->u.private_key.key == NULL) {
-+            st_logf("failed to read private key a startup\n");
-+            /* don't bother with this failure for now,
-+               fix it at C_Login time */;
-+        } else {
-+            /* XXX verify keytype */
-+
-+            if (key_type == CKK_RSA)
-+                RSA_set_method(o->u.private_key.key->pkey.rsa,
-+                               RSA_PKCS1_SSLeay());
-+
-+            if (X509_check_private_key(cert, o->u.private_key.key) != 1) {
-+                EVP_PKEY_free(o->u.private_key.key);
-+                o->u.private_key.key = NULL;
-+                st_logf("private key doesn't verify\n");
-+            } else {
-+                st_logf("private key usable\n");
-+                soft_token.flags.login_done = 1;
-+            }
-+        }
-+    }
-+
-+    ret = CKR_OK;
-+ out:
-+    if (ret != CKR_OK) {
-+        st_logf("something went wrong when adding cert!\n");
-+
-+        /* XXX wack o */;
-+    }
-+    free(cert_data);
-+    free(serial_data);
-+    free(issuer_data);
-+    free(subject_data);
-+
-+    return ret;
-+}
-+
-+static void
-+find_object_final(struct session_state *state)
-+{
-+    if (state->find.attributes) {
-+        CK_ULONG i;
-+
-+        for (i = 0; i < state->find.num_attributes; i++) {
-+            if (state->find.attributes[i].pValue)
-+                free(state->find.attributes[i].pValue);
-+        }
-+        free(state->find.attributes);
-+        state->find.attributes = NULL;
-+        state->find.num_attributes = 0;
-+        state->find.next_object = -1;
-+    }
-+}
-+
-+static void
-+reset_crypto_state(struct session_state *state)
-+{
-+    state->encrypt_object = -1;
-+    if (state->encrypt_mechanism)
-+        free(state->encrypt_mechanism);
-+    state->encrypt_mechanism = NULL_PTR;
-+    state->decrypt_object = -1;
-+    if (state->decrypt_mechanism)
-+        free(state->decrypt_mechanism);
-+    state->decrypt_mechanism = NULL_PTR;
-+    state->sign_object = -1;
-+    if (state->sign_mechanism)
-+        free(state->sign_mechanism);
-+    state->sign_mechanism = NULL_PTR;
-+    state->verify_object = -1;
-+    if (state->verify_mechanism)
-+        free(state->verify_mechanism);
-+    state->verify_mechanism = NULL_PTR;
-+    state->digest_object = -1;
-+}
-+
-+static void
-+close_session(struct session_state *state)
-+{
-+    if (state->find.attributes) {
-+        application_error("application didn't do C_FindObjectsFinal\n");
-+        find_object_final(state);
-+    }
-+
-+    state->session_handle = CK_INVALID_HANDLE;
-+    soft_token.application = NULL_PTR;
-+    soft_token.notify = NULL_PTR;
-+    reset_crypto_state(state);
-+}
-+
-+static const char *
-+has_session(void)
-+{
-+    return soft_token.open_sessions > 0 ? "yes" : "no";
-+}
-+
-+static void
-+read_conf_file(const char *fn)
-+{
-+    char buf[1024], *cert, *key, *id, *label, *s, *p;
-+    int anchor;
-+    FILE *f;
-+
-+    f = fopen(fn, "r");
-+    if (f == NULL) {
-+        st_logf("can't open configuration file %s\n", fn);
-+        return;
-+    }
-+
-+    while(fgets(buf, sizeof(buf), f) != NULL) {
-+        buf[strcspn(buf, "\n")] = '\0';
-+
-+        anchor = 0;
-+
-+        st_logf("line: %s\n", buf);
-+
-+        p = buf;
-+        while (isspace(*p))
-+            p++;
-+        if (*p == '#')
-+            continue;
-+        while (isspace(*p))
-+            p++;
-+
-+        s = NULL;
-+        id = strtok_r(p, "\t", &s);
-+        if (id == NULL)
-+            continue;
-+        label = strtok_r(NULL, "\t", &s);
-+        if (label == NULL)
-+            continue;
-+        cert = strtok_r(NULL, "\t", &s);
-+        if (cert == NULL)
-+            continue;
-+        key = strtok_r(NULL, "\t", &s);
-+
-+        /* XXX */
-+        if (strcmp(id, "anchor") == 0) {
-+            id = "\x00\x00";
-+            anchor = 1;
-+        }
-+
-+        st_logf("adding: %s\n", label);
-+
-+        add_certificate(label, cert, key, id, anchor);
-+    }
-+}
-+
-+static CK_RV
-+func_not_supported(void)
-+{
-+    st_logf("function not supported\n");
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+CK_RV
-+C_Initialize(CK_VOID_PTR a)
-+{
-+    CK_C_INITIALIZE_ARGS_PTR args = a;
-+    st_logf("Initialize\n");
-+    int i;
-+
-+    OpenSSL_add_all_algorithms();
-+    ERR_load_crypto_strings();
-+
-+    srandom(getpid() ^ time(NULL));
-+
-+    for (i = 0; i < MAX_NUM_SESSION; i++) {
-+        soft_token.state[i].session_handle = CK_INVALID_HANDLE;
-+        soft_token.state[i].find.attributes = NULL;
-+        soft_token.state[i].find.num_attributes = 0;
-+        soft_token.state[i].find.next_object = -1;
-+        reset_crypto_state(&soft_token.state[i]);
-+    }
-+
-+    soft_token.flags.hardware_slot = 1;
-+    soft_token.flags.app_error_fatal = 0;
-+    soft_token.flags.login_done = 0;
-+
-+    soft_token.object.objs = NULL;
-+    soft_token.object.num_objs = 0;
-+
-+    soft_token.logfile = NULL;
-+#if 0
-+    soft_token.logfile = stdout;
-+#endif
-+#if 0
-+    soft_token.logfile = fopen("/tmp/log-pkcs11.txt", "a");
-+#endif
-+
-+    if (a != NULL_PTR) {
-+        st_logf("\tCreateMutex:\t%p\n", args->CreateMutex);
-+        st_logf("\tDestroyMutext\t%p\n", args->DestroyMutex);
-+        st_logf("\tLockMutext\t%p\n", args->LockMutex);
-+        st_logf("\tUnlockMutext\t%p\n", args->UnlockMutex);
-+        st_logf("\tFlags\t%04x\n", (unsigned int)args->flags);
-+    }
-+
-+    {
-+        char *fn = NULL, *home = NULL;
-+
-+        if (getuid() == geteuid()) {
-+            fn = getenv("SOFTPKCS11RC");
-+            if (fn)
-+                fn = strdup(fn);
-+            home = getenv("HOME");
-+        }
-+        if (fn == NULL && home == NULL) {
-+            struct passwd *pw = getpwuid(getuid());
-+            if(pw != NULL)
-+                home = pw->pw_dir;
-+        }
-+        if (fn == NULL) {
-+            if (home)
-+                asprintf(&fn, "%s/.soft-token.rc", home);
-+            else
-+                fn = strdup("/etc/soft-token.rc");
-+        }
-+
-+        read_conf_file(fn);
-+        free(fn);
-+    }
-+
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_Finalize(CK_VOID_PTR args)
-+{
-+    int i;
-+
-+    st_logf("Finalize\n");
-+
-+    for (i = 0; i < MAX_NUM_SESSION; i++) {
-+        if (soft_token.state[i].session_handle != CK_INVALID_HANDLE) {
-+            application_error("application finalized without "
-+                              "closing session\n");
-+            close_session(&soft_token.state[i]);
-+        }
-+    }
-+
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_GetInfo(CK_INFO_PTR args)
-+{
-+    st_logf("GetInfo\n");
-+
-+    memset(args, 17, sizeof(*args));
-+    args->cryptokiVersion.major = 2;
-+    args->cryptokiVersion.minor = 10;
-+    snprintf_fill((char *)args->manufacturerID,
-+                  sizeof(args->manufacturerID),
-+                  ' ',
-+                  "SoftToken");
-+    snprintf_fill((char *)args->libraryDescription,
-+                  sizeof(args->libraryDescription), ' ',
-+                  "SoftToken");
-+    args->libraryVersion.major = 1;
-+    args->libraryVersion.minor = 8;
-+
-+    return CKR_OK;
-+}
-+
-+extern CK_FUNCTION_LIST funcs;
-+
-+CK_RV
-+C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList)
-+{
-+    *ppFunctionList = &funcs;
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_GetSlotList(CK_BBOOL tokenPresent,
-+              CK_SLOT_ID_PTR pSlotList,
-+              CK_ULONG_PTR   pulCount)
-+{
-+    st_logf("GetSlotList: %s\n",
-+            tokenPresent ? "tokenPresent" : "token not Present");
-+    if (pSlotList)
-+        pSlotList[0] = 1;
-+    *pulCount = 1;
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_GetSlotInfo(CK_SLOT_ID slotID,
-+              CK_SLOT_INFO_PTR pInfo)
-+{
-+    st_logf("GetSlotInfo: slot: %d : %s\n", (int)slotID, has_session());
-+
-+    memset(pInfo, 18, sizeof(*pInfo));
-+
-+    if (slotID != 1)
-+        return CKR_ARGUMENTS_BAD;
-+
-+    snprintf_fill((char *)pInfo->slotDescription,
-+                  sizeof(pInfo->slotDescription),
-+                  ' ',
-+                  "SoftToken (slot)");
-+    snprintf_fill((char *)pInfo->manufacturerID,
-+                  sizeof(pInfo->manufacturerID),
-+                  ' ',
-+                  "SoftToken (slot)");
-+    pInfo->flags = CKF_TOKEN_PRESENT;
-+    if (soft_token.flags.hardware_slot)
-+        pInfo->flags |= CKF_HW_SLOT;
-+    pInfo->hardwareVersion.major = 1;
-+    pInfo->hardwareVersion.minor = 0;
-+    pInfo->firmwareVersion.major = 1;
-+    pInfo->firmwareVersion.minor = 0;
-+
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_GetTokenInfo(CK_SLOT_ID slotID,
-+               CK_TOKEN_INFO_PTR pInfo)
-+{
-+    st_logf("GetTokenInfo: %s\n", has_session());
-+
-+    memset(pInfo, 19, sizeof(*pInfo));
-+
-+    snprintf_fill((char *)pInfo->label,
-+                  sizeof(pInfo->label),
-+                  ' ',
-+                  "SoftToken (token)");
-+    snprintf_fill((char *)pInfo->manufacturerID,
-+                  sizeof(pInfo->manufacturerID),
-+                  ' ',
-+                  "SoftToken (token)");
-+    snprintf_fill((char *)pInfo->model,
-+                  sizeof(pInfo->model),
-+                  ' ',
-+                  "SoftToken (token)");
-+    snprintf_fill((char *)pInfo->serialNumber,
-+                  sizeof(pInfo->serialNumber),
-+                  ' ',
-+                  "4711");
-+    pInfo->flags =
-+        CKF_TOKEN_INITIALIZED |
-+        CKF_USER_PIN_INITIALIZED;
-+
-+    if (soft_token.flags.login_done == 0)
-+        pInfo->flags |= CKF_LOGIN_REQUIRED;
-+
-+    /* CFK_RNG |
-+       CKF_RESTORE_KEY_NOT_NEEDED |
-+    */
-+    pInfo->ulMaxSessionCount = MAX_NUM_SESSION;
-+    pInfo->ulSessionCount = soft_token.open_sessions;
-+    pInfo->ulMaxRwSessionCount = MAX_NUM_SESSION;
-+    pInfo->ulRwSessionCount = soft_token.open_sessions;
-+    pInfo->ulMaxPinLen = 1024;
-+    pInfo->ulMinPinLen = 0;
-+    pInfo->ulTotalPublicMemory = 4711;
-+    pInfo->ulFreePublicMemory = 4712;
-+    pInfo->ulTotalPrivateMemory = 4713;
-+    pInfo->ulFreePrivateMemory = 4714;
-+    pInfo->hardwareVersion.major = 2;
-+    pInfo->hardwareVersion.minor = 0;
-+    pInfo->firmwareVersion.major = 2;
-+    pInfo->firmwareVersion.minor = 0;
-+
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_GetMechanismList(CK_SLOT_ID slotID,
-+                   CK_MECHANISM_TYPE_PTR pMechanismList,
-+                   CK_ULONG_PTR pulCount)
-+{
-+    st_logf("GetMechanismList\n");
-+
-+    *pulCount = 2;
-+    if (pMechanismList == NULL_PTR)
-+        return CKR_OK;
-+    pMechanismList[0] = CKM_RSA_X_509;
-+    pMechanismList[1] = CKM_RSA_PKCS;
-+
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_GetMechanismInfo(CK_SLOT_ID slotID,
-+                   CK_MECHANISM_TYPE type,
-+                   CK_MECHANISM_INFO_PTR pInfo)
-+{
-+    st_logf("GetMechanismInfo: slot %d type: %d\n",
-+            (int)slotID, (int)type);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+CK_RV
-+C_InitToken(CK_SLOT_ID slotID,
-+            CK_UTF8CHAR_PTR pPin,
-+            CK_ULONG ulPinLen,
-+            CK_UTF8CHAR_PTR pLabel)
-+{
-+    st_logf("InitToken: slot %d\n", (int)slotID);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+CK_RV
-+C_OpenSession(CK_SLOT_ID slotID,
-+              CK_FLAGS flags,
-+              CK_VOID_PTR pApplication,
-+              CK_NOTIFY Notify,
-+              CK_SESSION_HANDLE_PTR phSession)
-+{
-+    int i;
-+
-+    st_logf("OpenSession: slot: %d\n", (int)slotID);
-+
-+    if (soft_token.open_sessions == MAX_NUM_SESSION)
-+        return CKR_SESSION_COUNT;
-+
-+    soft_token.application = pApplication;
-+    soft_token.notify = Notify;
-+
-+    for (i = 0; i < MAX_NUM_SESSION; i++)
-+        if (soft_token.state[i].session_handle == CK_INVALID_HANDLE)
-+            break;
-+    if (i == MAX_NUM_SESSION)
-+        abort();
-+
-+    soft_token.open_sessions++;
-+
-+    soft_token.state[i].session_handle =
-+        (CK_SESSION_HANDLE)(random() & 0xfffff);
-+    *phSession = soft_token.state[i].session_handle;
-+
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_CloseSession(CK_SESSION_HANDLE hSession)
-+{
-+    struct session_state *state;
-+    st_logf("CloseSession\n");
-+
-+    if (verify_session_handle(hSession, &state) != CKR_OK)
-+        application_error("closed session not open");
-+    else
-+        close_session(state);
-+
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_CloseAllSessions(CK_SLOT_ID slotID)
-+{
-+    int i;
-+
-+    st_logf("CloseAllSessions\n");
-+
-+    for (i = 0; i < MAX_NUM_SESSION; i++)
-+        if (soft_token.state[i].session_handle != CK_INVALID_HANDLE)
-+            close_session(&soft_token.state[i]);
-+
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_GetSessionInfo(CK_SESSION_HANDLE hSession,
-+                 CK_SESSION_INFO_PTR pInfo)
-+{
-+    st_logf("GetSessionInfo\n");
-+
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+
-+    memset(pInfo, 20, sizeof(*pInfo));
-+
-+    pInfo->slotID = 1;
-+    if (soft_token.flags.login_done)
-+        pInfo->state = CKS_RO_USER_FUNCTIONS;
-+    else
-+        pInfo->state = CKS_RO_PUBLIC_SESSION;
-+    pInfo->flags = CKF_SERIAL_SESSION;
-+    pInfo->ulDeviceError = 0;
-+
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_Login(CK_SESSION_HANDLE hSession,
-+        CK_USER_TYPE userType,
-+        CK_UTF8CHAR_PTR pPin,
-+        CK_ULONG ulPinLen)
-+{
-+    char *pin = NULL;
-+    int i;
-+
-+    st_logf("Login\n");
-+
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+
-+    if (pPin != NULL_PTR) {
-+        asprintf(&pin, "%.*s", (int)ulPinLen, pPin);
-+        st_logf("type: %d password: %s\n", (int)userType, pin);
-+    }
-+
-+    for (i = 0; i < soft_token.object.num_objs; i++) {
-+        struct st_object *o = soft_token.object.objs[i];
-+        FILE *f;
-+
-+        if (o->type != STO_T_PRIVATE_KEY)
-+            continue;
-+
-+        if (o->u.private_key.key)
-+            continue;
-+
-+        f = fopen(o->u.private_key.file, "r");
-+        if (f == NULL) {
-+            st_logf("can't open private file: %s\n", o->u.private_key.file);
-+            continue;
-+        }
-+
-+        o->u.private_key.key = PEM_read_PrivateKey(f, NULL, NULL, pin);
-+        fclose(f);
-+        if (o->u.private_key.key == NULL) {
-+            st_logf("failed to read key: %s error: %s\n",
-+                    o->u.private_key.file,
-+                    ERR_error_string(ERR_get_error(), NULL));
-+            /* just ignore failure */;
-+            continue;
-+        }
-+
-+        /* XXX check keytype */
-+        RSA_set_method(o->u.private_key.key->pkey.rsa, RSA_PKCS1_SSLeay());
-+
-+        if (X509_check_private_key(o->u.private_key.cert, o->u.private_key.key) != 1) {
-+            EVP_PKEY_free(o->u.private_key.key);
-+            o->u.private_key.key = NULL;
-+            st_logf("private key %s doesn't verify\n", o->u.private_key.file);
-+            continue;
-+        }
-+
-+        soft_token.flags.login_done = 1;
-+    }
-+    free(pin);
-+
-+    return soft_token.flags.login_done ? CKR_OK : CKR_PIN_INCORRECT;
-+}
-+
-+CK_RV
-+C_Logout(CK_SESSION_HANDLE hSession)
-+{
-+    st_logf("Logout\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+CK_RV
-+C_GetObjectSize(CK_SESSION_HANDLE hSession,
-+                CK_OBJECT_HANDLE hObject,
-+                CK_ULONG_PTR pulSize)
-+{
-+    st_logf("GetObjectSize\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+CK_RV
-+C_GetAttributeValue(CK_SESSION_HANDLE hSession,
-+                    CK_OBJECT_HANDLE hObject,
-+                    CK_ATTRIBUTE_PTR pTemplate,
-+                    CK_ULONG ulCount)
-+{
-+    struct session_state *state;
-+    struct st_object *obj;
-+    CK_ULONG i;
-+    CK_RV ret;
-+    int j;
-+
-+    st_logf("GetAttributeValue: %lx\n",
-+            (unsigned long)HANDLE_OBJECT_ID(hObject));
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+
-+    if ((ret = object_handle_to_object(hObject, &obj)) != CKR_OK) {
-+        st_logf("object not found: %lx\n",
-+                (unsigned long)HANDLE_OBJECT_ID(hObject));
-+        return ret;
-+    }
-+
-+    for (i = 0; i < ulCount; i++) {
-+        st_logf("       getting 0x%08lx\n", (unsigned long)pTemplate[i].type);
-+        for (j = 0; j < obj->num_attributes; j++) {
-+            if (obj->attrs[j].secret) {
-+                pTemplate[i].ulValueLen = (CK_ULONG)-1;
-+                break;
-+            }
-+            if (pTemplate[i].type == obj->attrs[j].attribute.type) {
-+                if (pTemplate[i].pValue != NULL_PTR && obj->attrs[j].secret == 0) {
-+                    if (pTemplate[i].ulValueLen >= obj->attrs[j].attribute.ulValueLen)
-+                        memcpy(pTemplate[i].pValue, obj->attrs[j].attribute.pValue,
-+                               obj->attrs[j].attribute.ulValueLen);
-+                }
-+                pTemplate[i].ulValueLen = obj->attrs[j].attribute.ulValueLen;
-+                break;
-+            }
-+        }
-+        if (j == obj->num_attributes) {
-+            st_logf("key type: 0x%08lx not found\n", (unsigned long)pTemplate[i].type);
-+            pTemplate[i].ulValueLen = (CK_ULONG)-1;
-+        }
-+
-+    }
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_FindObjectsInit(CK_SESSION_HANDLE hSession,
-+                  CK_ATTRIBUTE_PTR pTemplate,
-+                  CK_ULONG ulCount)
-+{
-+    struct session_state *state;
-+
-+    st_logf("FindObjectsInit\n");
-+
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+
-+    if (state->find.next_object != -1) {
-+        application_error("application didn't do C_FindObjectsFinal\n");
-+        find_object_final(state);
-+    }
-+    if (ulCount) {
-+        CK_ULONG i;
-+        size_t len;
-+
-+        print_attributes(pTemplate, ulCount);
-+
-+        state->find.attributes =
-+            calloc(1, ulCount * sizeof(state->find.attributes[0]));
-+        if (state->find.attributes == NULL)
-+            return CKR_DEVICE_MEMORY;
-+        for (i = 0; i < ulCount; i++) {
-+            state->find.attributes[i].pValue =
-+                malloc(pTemplate[i].ulValueLen);
-+            if (state->find.attributes[i].pValue == NULL) {
-+                find_object_final(state);
-+                return CKR_DEVICE_MEMORY;
-+            }
-+            memcpy(state->find.attributes[i].pValue,
-+                   pTemplate[i].pValue, pTemplate[i].ulValueLen);
-+            state->find.attributes[i].type = pTemplate[i].type;
-+            state->find.attributes[i].ulValueLen = pTemplate[i].ulValueLen;
-+        }
-+        state->find.num_attributes = ulCount;
-+        state->find.next_object = 0;
-+    } else {
-+        st_logf("find all objects\n");
-+        state->find.attributes = NULL;
-+        state->find.num_attributes = 0;
-+        state->find.next_object = 0;
-+    }
-+
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_FindObjects(CK_SESSION_HANDLE hSession,
-+              CK_OBJECT_HANDLE_PTR phObject,
-+              CK_ULONG ulMaxObjectCount,
-+              CK_ULONG_PTR pulObjectCount)
-+{
-+    struct session_state *state;
-+    int i;
-+
-+    st_logf("FindObjects\n");
-+
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+
-+    if (state->find.next_object == -1) {
-+        application_error("application didn't do C_FindObjectsInit\n");
-+        return CKR_ARGUMENTS_BAD;
-+    }
-+    if (ulMaxObjectCount == 0) {
-+        application_error("application asked for 0 objects\n");
-+        return CKR_ARGUMENTS_BAD;
-+    }
-+    *pulObjectCount = 0;
-+    for (i = state->find.next_object; i < soft_token.object.num_objs; i++) {
-+        st_logf("FindObjects: %d\n", i);
-+        state->find.next_object = i + 1;
-+        if (attributes_match(soft_token.object.objs[i],
-+                             state->find.attributes,
-+                             state->find.num_attributes)) {
-+            *phObject++ = soft_token.object.objs[i]->object_handle;
-+            ulMaxObjectCount--;
-+            (*pulObjectCount)++;
-+            if (ulMaxObjectCount == 0)
-+                break;
-+        }
-+    }
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_FindObjectsFinal(CK_SESSION_HANDLE hSession)
-+{
-+    struct session_state *state;
-+
-+    st_logf("FindObjectsFinal\n");
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+    find_object_final(state);
-+    return CKR_OK;
-+}
-+
-+static CK_RV
-+commonInit(CK_ATTRIBUTE *attr_match, int attr_match_len,
-+           const CK_MECHANISM_TYPE *mechs, int mechs_len,
-+           const CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey,
-+           struct st_object **o)
-+{
-+    CK_RV ret;
-+    int i;
-+
-+    *o = NULL;
-+    if ((ret = object_handle_to_object(hKey, o)) != CKR_OK)
-+        return ret;
-+
-+    ret = attributes_match(*o, attr_match, attr_match_len);
-+    if (!ret) {
-+        application_error("called commonInit on key that doesn't "
-+                          "support required attr");
-+        return CKR_ARGUMENTS_BAD;
-+    }
-+
-+    for (i = 0; i < mechs_len; i++)
-+        if (mechs[i] == pMechanism->mechanism)
-+            break;
-+    if (i == mechs_len) {
-+        application_error("called mech (%08lx) not supported\n",
-+                          pMechanism->mechanism);
-+        return CKR_ARGUMENTS_BAD;
-+    }
-+    return CKR_OK;
-+}
-+
-+
-+static CK_RV
-+dup_mechanism(CK_MECHANISM_PTR *dup, const CK_MECHANISM_PTR pMechanism)
-+{
-+    CK_MECHANISM_PTR p;
-+
-+    p = malloc(sizeof(*p));
-+    if (p == NULL)
-+        return CKR_DEVICE_MEMORY;
-+
-+    if (*dup)
-+        free(*dup);
-+    *dup = p;
-+    memcpy(p, pMechanism, sizeof(*p));
-+
-+    return CKR_OK;
-+}
-+
-+
-+CK_RV
-+C_EncryptInit(CK_SESSION_HANDLE hSession,
-+              CK_MECHANISM_PTR pMechanism,
-+              CK_OBJECT_HANDLE hKey)
-+{
-+    struct session_state *state;
-+    CK_MECHANISM_TYPE mechs[] = { CKM_RSA_PKCS, CKM_RSA_X_509 };
-+    CK_BBOOL bool_true = CK_TRUE;
-+    CK_ATTRIBUTE attr[] = {
-+        { CKA_ENCRYPT, &bool_true, sizeof(bool_true) }
-+    };
-+    struct st_object *o;
-+    CK_RV ret;
-+
-+    st_logf("EncryptInit\n");
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+
-+    ret = commonInit(attr, sizeof(attr)/sizeof(attr[0]),
-+                     mechs, sizeof(mechs)/sizeof(mechs[0]),
-+                     pMechanism, hKey, &o);
-+    if (ret)
-+        return ret;
-+
-+    ret = dup_mechanism(&state->encrypt_mechanism, pMechanism);
-+    if (ret == CKR_OK)
-+        state->encrypt_object = OBJECT_ID(o);
-+
-+    return ret;
-+}
-+
-+CK_RV
-+C_Encrypt(CK_SESSION_HANDLE hSession,
-+          CK_BYTE_PTR pData,
-+          CK_ULONG ulDataLen,
-+          CK_BYTE_PTR pEncryptedData,
-+          CK_ULONG_PTR pulEncryptedDataLen)
-+{
-+    struct session_state *state;
-+    struct st_object *o;
-+    void *buffer = NULL;
-+    CK_RV ret;
-+    RSA *rsa;
-+    int padding, len, buffer_len, padding_len;
-+
-+    st_logf("Encrypt\n");
-+
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+
-+    if (state->encrypt_object == -1)
-+        return CKR_ARGUMENTS_BAD;
-+
-+    o = soft_token.object.objs[state->encrypt_object];
-+
-+    if (o->u.public_key == NULL) {
-+        st_logf("public key NULL\n");
-+        return CKR_ARGUMENTS_BAD;
-+    }
-+
-+    rsa = o->u.public_key->pkey.rsa;
-+
-+    if (rsa == NULL)
-+        return CKR_ARGUMENTS_BAD;
-+
-+    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
-+
-+    buffer_len = RSA_size(rsa);
-+
-+    buffer = malloc(buffer_len);
-+    if (buffer == NULL) {
-+        ret = CKR_DEVICE_MEMORY;
-+        goto out;
-+    }
-+
-+    ret = CKR_OK;
-+    switch(state->encrypt_mechanism->mechanism) {
-+    case CKM_RSA_PKCS:
-+        padding = RSA_PKCS1_PADDING;
-+        padding_len = RSA_PKCS1_PADDING_SIZE;
-+        break;
-+    case CKM_RSA_X_509:
-+        padding = RSA_NO_PADDING;
-+        padding_len = 0;
-+        break;
-+    default:
-+        ret = CKR_FUNCTION_NOT_SUPPORTED;
-+        goto out;
-+    }
-+
-+    if (buffer_len + padding_len < ulDataLen) {
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    if (pulEncryptedDataLen == NULL) {
-+        st_logf("pulEncryptedDataLen NULL\n");
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    if (pData == NULL_PTR) {
-+        st_logf("data NULL\n");
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    len = RSA_public_encrypt(ulDataLen, pData, buffer, rsa, padding);
-+    if (len <= 0) {
-+        ret = CKR_DEVICE_ERROR;
-+        goto out;
-+    }
-+    if (len > buffer_len)
-+        abort();
-+
-+    if (pEncryptedData != NULL_PTR)
-+        memcpy(pEncryptedData, buffer, len);
-+    *pulEncryptedDataLen = len;
-+
-+ out:
-+    if (buffer) {
-+        memset(buffer, 0, buffer_len);
-+        free(buffer);
-+    }
-+    return ret;
-+}
-+
-+CK_RV
-+C_EncryptUpdate(CK_SESSION_HANDLE hSession,
-+                CK_BYTE_PTR pPart,
-+                CK_ULONG ulPartLen,
-+                CK_BYTE_PTR pEncryptedPart,
-+                CK_ULONG_PTR pulEncryptedPartLen)
-+{
-+    st_logf("EncryptUpdate\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+
-+CK_RV
-+C_EncryptFinal(CK_SESSION_HANDLE hSession,
-+               CK_BYTE_PTR pLastEncryptedPart,
-+               CK_ULONG_PTR pulLastEncryptedPartLen)
-+{
-+    st_logf("EncryptFinal\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+
-+/* C_DecryptInit initializes a decryption operation. */
-+CK_RV
-+C_DecryptInit(CK_SESSION_HANDLE hSession,
-+              CK_MECHANISM_PTR pMechanism,
-+              CK_OBJECT_HANDLE hKey)
-+{
-+    struct session_state *state;
-+    CK_MECHANISM_TYPE mechs[] = { CKM_RSA_PKCS, CKM_RSA_X_509 };
-+    CK_BBOOL bool_true = CK_TRUE;
-+    CK_ATTRIBUTE attr[] = {
-+        { CKA_DECRYPT, &bool_true, sizeof(bool_true) }
-+    };
-+    struct st_object *o;
-+    CK_RV ret;
-+
-+    st_logf("DecryptInit\n");
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+
-+    ret = commonInit(attr, sizeof(attr)/sizeof(attr[0]),
-+                     mechs, sizeof(mechs)/sizeof(mechs[0]),
-+                     pMechanism, hKey, &o);
-+    if (ret)
-+        return ret;
-+
-+    ret = dup_mechanism(&state->decrypt_mechanism, pMechanism);
-+    if (ret == CKR_OK)
-+        state->decrypt_object = OBJECT_ID(o);
-+
-+    return CKR_OK;
-+}
-+
-+
-+CK_RV
-+C_Decrypt(CK_SESSION_HANDLE hSession,
-+          CK_BYTE_PTR       pEncryptedData,
-+          CK_ULONG          ulEncryptedDataLen,
-+          CK_BYTE_PTR       pData,
-+          CK_ULONG_PTR      pulDataLen)
-+{
-+    struct session_state *state;
-+    struct st_object *o;
-+    void *buffer = NULL;
-+    CK_RV ret;
-+    RSA *rsa;
-+    int padding, len, buffer_len, padding_len;
-+
-+    st_logf("Decrypt\n");
-+
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+
-+    if (state->decrypt_object == -1)
-+        return CKR_ARGUMENTS_BAD;
-+
-+    o = soft_token.object.objs[state->decrypt_object];
-+
-+    if (o->u.private_key.key == NULL) {
-+        st_logf("private key NULL\n");
-+        return CKR_ARGUMENTS_BAD;
-+    }
-+
-+    rsa = o->u.private_key.key->pkey.rsa;
-+
-+    if (rsa == NULL)
-+        return CKR_ARGUMENTS_BAD;
-+
-+    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
-+
-+    buffer_len = RSA_size(rsa);
-+
-+    buffer = malloc(buffer_len);
-+    if (buffer == NULL) {
-+        ret = CKR_DEVICE_MEMORY;
-+        goto out;
-+    }
-+
-+    ret = CKR_OK;
-+    switch(state->decrypt_mechanism->mechanism) {
-+    case CKM_RSA_PKCS:
-+        padding = RSA_PKCS1_PADDING;
-+        padding_len = RSA_PKCS1_PADDING_SIZE;
-+        break;
-+    case CKM_RSA_X_509:
-+        padding = RSA_NO_PADDING;
-+        padding_len = 0;
-+        break;
-+    default:
-+        ret = CKR_FUNCTION_NOT_SUPPORTED;
-+        goto out;
-+    }
-+
-+    if (buffer_len + padding_len < ulEncryptedDataLen) {
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    if (pulDataLen == NULL) {
-+        st_logf("pulDataLen NULL\n");
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    if (pEncryptedData == NULL_PTR) {
-+        st_logf("data NULL\n");
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    len = RSA_private_decrypt(ulEncryptedDataLen, pEncryptedData, buffer,
-+                              rsa, padding);
-+    if (len <= 0) {
-+        ret = CKR_DEVICE_ERROR;
-+        goto out;
-+    }
-+    if (len > buffer_len)
-+        abort();
-+
-+    if (pData != NULL_PTR)
-+        memcpy(pData, buffer, len);
-+    *pulDataLen = len;
-+
-+ out:
-+    if (buffer) {
-+        memset(buffer, 0, buffer_len);
-+        free(buffer);
-+    }
-+    return ret;
-+}
-+
-+
-+CK_RV
-+C_DecryptUpdate(CK_SESSION_HANDLE hSession,
-+                CK_BYTE_PTR pEncryptedPart,
-+                CK_ULONG ulEncryptedPartLen,
-+                CK_BYTE_PTR pPart,
-+                CK_ULONG_PTR pulPartLen)
-+
-+{
-+    st_logf("DecryptUpdate\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+
-+CK_RV
-+C_DecryptFinal(CK_SESSION_HANDLE hSession,
-+               CK_BYTE_PTR pLastPart,
-+               CK_ULONG_PTR pulLastPartLen)
-+{
-+    st_logf("DecryptFinal\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+CK_RV
-+C_DigestInit(CK_SESSION_HANDLE hSession,
-+             CK_MECHANISM_PTR pMechanism)
-+{
-+    st_logf("DigestInit\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+CK_RV
-+C_SignInit(CK_SESSION_HANDLE hSession,
-+           CK_MECHANISM_PTR pMechanism,
-+           CK_OBJECT_HANDLE hKey)
-+{
-+    struct session_state *state;
-+    CK_MECHANISM_TYPE mechs[] = { CKM_RSA_PKCS, CKM_RSA_X_509 };
-+    CK_BBOOL bool_true = CK_TRUE;
-+    CK_ATTRIBUTE attr[] = {
-+        { CKA_SIGN, &bool_true, sizeof(bool_true) }
-+    };
-+    struct st_object *o;
-+    CK_RV ret;
-+
-+    st_logf("SignInit\n");
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+
-+    ret = commonInit(attr, sizeof(attr)/sizeof(attr[0]),
-+                     mechs, sizeof(mechs)/sizeof(mechs[0]),
-+                     pMechanism, hKey, &o);
-+    if (ret)
-+        return ret;
-+
-+    ret = dup_mechanism(&state->sign_mechanism, pMechanism);
-+    if (ret == CKR_OK)
-+        state->sign_object = OBJECT_ID(o);
-+
-+    return CKR_OK;
-+}
-+
-+CK_RV
-+C_Sign(CK_SESSION_HANDLE hSession,
-+       CK_BYTE_PTR pData,
-+       CK_ULONG ulDataLen,
-+       CK_BYTE_PTR pSignature,
-+       CK_ULONG_PTR pulSignatureLen)
-+{
-+    struct session_state *state;
-+    struct st_object *o;
-+    void *buffer = NULL;
-+    CK_RV ret;
-+    RSA *rsa;
-+    int padding, len, buffer_len, padding_len;
-+
-+    st_logf("Sign\n");
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+
-+    if (state->sign_object == -1)
-+        return CKR_ARGUMENTS_BAD;
-+
-+    o = soft_token.object.objs[state->sign_object];
-+
-+    if (o->u.private_key.key == NULL) {
-+        st_logf("private key NULL\n");
-+        return CKR_ARGUMENTS_BAD;
-+    }
-+
-+    rsa = o->u.private_key.key->pkey.rsa;
-+
-+    if (rsa == NULL)
-+        return CKR_ARGUMENTS_BAD;
-+
-+    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
-+
-+    buffer_len = RSA_size(rsa);
-+
-+    buffer = malloc(buffer_len);
-+    if (buffer == NULL) {
-+        ret = CKR_DEVICE_MEMORY;
-+        goto out;
-+    }
-+
-+    switch(state->sign_mechanism->mechanism) {
-+    case CKM_RSA_PKCS:
-+        padding = RSA_PKCS1_PADDING;
-+        padding_len = RSA_PKCS1_PADDING_SIZE;
-+        break;
-+    case CKM_RSA_X_509:
-+        padding = RSA_NO_PADDING;
-+        padding_len = 0;
-+        break;
-+    default:
-+        ret = CKR_FUNCTION_NOT_SUPPORTED;
-+        goto out;
-+    }
-+
-+    if (buffer_len < ulDataLen + padding_len) {
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    if (pulSignatureLen == NULL) {
-+        st_logf("signature len NULL\n");
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    if (pData == NULL_PTR) {
-+        st_logf("data NULL\n");
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    len = RSA_private_encrypt(ulDataLen, pData, buffer, rsa, padding);
-+    st_logf("private encrypt done\n");
-+    if (len <= 0) {
-+        ret = CKR_DEVICE_ERROR;
-+        goto out;
-+    }
-+    if (len > buffer_len)
-+        abort();
-+
-+    if (pSignature != NULL_PTR)
-+        memcpy(pSignature, buffer, len);
-+    *pulSignatureLen = len;
-+
-+    ret = CKR_OK;
-+
-+ out:
-+    if (buffer) {
-+        memset(buffer, 0, buffer_len);
-+        free(buffer);
-+    }
-+    return ret;
-+}
-+
-+CK_RV
-+C_SignUpdate(CK_SESSION_HANDLE hSession,
-+             CK_BYTE_PTR pPart,
-+             CK_ULONG ulPartLen)
-+{
-+    st_logf("SignUpdate\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+
-+CK_RV
-+C_SignFinal(CK_SESSION_HANDLE hSession,
-+            CK_BYTE_PTR pSignature,
-+            CK_ULONG_PTR pulSignatureLen)
-+{
-+    st_logf("SignUpdate\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+CK_RV
-+C_VerifyInit(CK_SESSION_HANDLE hSession,
-+             CK_MECHANISM_PTR pMechanism,
-+             CK_OBJECT_HANDLE hKey)
-+{
-+    struct session_state *state;
-+    CK_MECHANISM_TYPE mechs[] = { CKM_RSA_PKCS, CKM_RSA_X_509 };
-+    CK_BBOOL bool_true = CK_TRUE;
-+    CK_ATTRIBUTE attr[] = {
-+        { CKA_VERIFY, &bool_true, sizeof(bool_true) }
-+    };
-+    struct st_object *o;
-+    CK_RV ret;
-+
-+    st_logf("VerifyInit\n");
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+
-+    ret = commonInit(attr, sizeof(attr)/sizeof(attr[0]),
-+                     mechs, sizeof(mechs)/sizeof(mechs[0]),
-+                     pMechanism, hKey, &o);
-+    if (ret)
-+        return ret;
-+
-+    ret = dup_mechanism(&state->verify_mechanism, pMechanism);
-+    if (ret == CKR_OK)
-+        state->verify_object = OBJECT_ID(o);
-+
-+    return ret;
-+}
-+
-+CK_RV
-+C_Verify(CK_SESSION_HANDLE hSession,
-+         CK_BYTE_PTR pData,
-+         CK_ULONG ulDataLen,
-+         CK_BYTE_PTR pSignature,
-+         CK_ULONG ulSignatureLen)
-+{
-+    struct session_state *state;
-+    struct st_object *o;
-+    void *buffer = NULL;
-+    CK_RV ret;
-+    RSA *rsa;
-+    int padding, len, buffer_len;
-+
-+    st_logf("Verify\n");
-+    VERIFY_SESSION_HANDLE(hSession, &state);
-+
-+    if (state->verify_object == -1)
-+        return CKR_ARGUMENTS_BAD;
-+
-+    o = soft_token.object.objs[state->verify_object];
-+
-+    if (o->u.public_key == NULL) {
-+        st_logf("public key NULL\n");
-+        return CKR_ARGUMENTS_BAD;
-+    }
-+
-+    rsa = o->u.public_key->pkey.rsa;
-+
-+    if (rsa == NULL)
-+        return CKR_ARGUMENTS_BAD;
-+
-+    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */
-+
-+    buffer_len = RSA_size(rsa);
-+
-+    buffer = malloc(buffer_len);
-+    if (buffer == NULL) {
-+        ret = CKR_DEVICE_MEMORY;
-+        goto out;
-+    }
-+
-+    ret = CKR_OK;
-+    switch(state->verify_mechanism->mechanism) {
-+    case CKM_RSA_PKCS:
-+        padding = RSA_PKCS1_PADDING;
-+        break;
-+    case CKM_RSA_X_509:
-+        padding = RSA_NO_PADDING;
-+        break;
-+    default:
-+        ret = CKR_FUNCTION_NOT_SUPPORTED;
-+        goto out;
-+    }
-+
-+    if (buffer_len < ulDataLen) {
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    if (pSignature == NULL) {
-+        st_logf("signature NULL\n");
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    if (pData == NULL_PTR) {
-+        st_logf("data NULL\n");
-+        ret = CKR_ARGUMENTS_BAD;
-+        goto out;
-+    }
-+
-+    len = RSA_public_decrypt(ulDataLen, pData, buffer, rsa, padding);
-+    st_logf("private encrypt done\n");
-+    if (len <= 0) {
-+        ret = CKR_DEVICE_ERROR;
-+        goto out;
-+    }
-+    if (len > buffer_len)
-+        abort();
-+
-+    if (len != ulSignatureLen) {
-+        ret = CKR_GENERAL_ERROR;
-+        goto out;
-+    }
-+
-+    if (memcmp(pSignature, buffer, len) != 0) {
-+        ret = CKR_GENERAL_ERROR;
-+        goto out;
-+    }
-+
-+ out:
-+    if (buffer) {
-+        memset(buffer, 0, buffer_len);
-+        free(buffer);
-+    }
-+    return ret;
-+}
-+
-+
-+CK_RV
-+C_VerifyUpdate(CK_SESSION_HANDLE hSession,
-+               CK_BYTE_PTR pPart,
-+               CK_ULONG ulPartLen)
-+{
-+    st_logf("VerifyUpdate\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+CK_RV
-+C_VerifyFinal(CK_SESSION_HANDLE hSession,
-+              CK_BYTE_PTR pSignature,
-+              CK_ULONG ulSignatureLen)
-+{
-+    st_logf("VerifyFinal\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+CK_RV
-+C_GenerateRandom(CK_SESSION_HANDLE hSession,
-+                 CK_BYTE_PTR RandomData,
-+                 CK_ULONG ulRandomLen)
-+{
-+    st_logf("GenerateRandom\n");
-+    VERIFY_SESSION_HANDLE(hSession, NULL);
-+    return CKR_FUNCTION_NOT_SUPPORTED;
-+}
-+
-+
-+CK_FUNCTION_LIST funcs = {
-+    { 2, 11 },
-+    C_Initialize,
-+    C_Finalize,
-+    C_GetInfo,
-+    C_GetFunctionList,
-+    C_GetSlotList,
-+    C_GetSlotInfo,
-+    C_GetTokenInfo,
-+    C_GetMechanismList,
-+    C_GetMechanismInfo,
-+    C_InitToken,
-+    (void *)func_not_supported, /* C_InitPIN */
-+    (void *)func_not_supported, /* C_SetPIN */
-+    C_OpenSession,
-+    C_CloseSession,
-+    C_CloseAllSessions,
-+    C_GetSessionInfo,
-+    (void *)func_not_supported, /* C_GetOperationState */
-+    (void *)func_not_supported, /* C_SetOperationState */
-+    C_Login,
-+    C_Logout,
-+    (void *)func_not_supported, /* C_CreateObject */
-+    (void *)func_not_supported, /* C_CopyObject */
-+    (void *)func_not_supported, /* C_DestroyObject */
-+    (void *)func_not_supported, /* C_GetObjectSize */
-+    C_GetAttributeValue,
-+    (void *)func_not_supported, /* C_SetAttributeValue */
-+    C_FindObjectsInit,
-+    C_FindObjects,
-+    C_FindObjectsFinal,
-+    C_EncryptInit,
-+    C_Encrypt,
-+    C_EncryptUpdate,
-+    C_EncryptFinal,
-+    C_DecryptInit,
-+    C_Decrypt,
-+    C_DecryptUpdate,
-+    C_DecryptFinal,
-+    C_DigestInit,
-+    (void *)func_not_supported, /* C_Digest */
-+    (void *)func_not_supported, /* C_DigestUpdate */
-+    (void *)func_not_supported, /* C_DigestKey */
-+    (void *)func_not_supported, /* C_DigestFinal */
-+    C_SignInit,
-+    C_Sign,
-+    C_SignUpdate,
-+    C_SignFinal,
-+    (void *)func_not_supported, /* C_SignRecoverInit */
-+    (void *)func_not_supported, /* C_SignRecover */
-+    C_VerifyInit,
-+    C_Verify,
-+    C_VerifyUpdate,
-+    C_VerifyFinal,
-+    (void *)func_not_supported, /* C_VerifyRecoverInit */
-+    (void *)func_not_supported, /* C_VerifyRecover */
-+    (void *)func_not_supported, /* C_DigestEncryptUpdate */
-+    (void *)func_not_supported, /* C_DecryptDigestUpdate */
-+    (void *)func_not_supported, /* C_SignEncryptUpdate */
-+    (void *)func_not_supported, /* C_DecryptVerifyUpdate */
-+    (void *)func_not_supported, /* C_GenerateKey */
-+    (void *)func_not_supported, /* C_GenerateKeyPair */
-+    (void *)func_not_supported, /* C_WrapKey */
-+    (void *)func_not_supported, /* C_UnwrapKey */
-+    (void *)func_not_supported, /* C_DeriveKey */
-+    (void *)func_not_supported, /* C_SeedRandom */
-+    C_GenerateRandom,
-+    (void *)func_not_supported, /* C_GetFunctionStatus */
-+    (void *)func_not_supported, /* C_CancelFunction */
-+    (void *)func_not_supported  /* C_WaitForSlotEvent */
-+};
diff --git a/Add-tests-for-KCM-ccache-type.patch b/Add-tests-for-KCM-ccache-type.patch
deleted file mode 100644
index 1397480..0000000
--- a/Add-tests-for-KCM-ccache-type.patch
+++ /dev/null
@@ -1,294 +0,0 @@
-From ae2475679b7b0e9381eac5d134c06cfc559d7d1b Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Thu, 22 Nov 2018 00:27:35 -0500
-Subject: [PATCH] Add tests for KCM ccache type
-
-Using a trivial Python implementation of a KCM server, run the
-t_ccache.py tests against the KCM ccache type.
-
-(cherry picked from commit f0bcb86131e385b2603ccf0f3c7d65aa3891b220)
----
- src/tests/kcmserver.py | 246 +++++++++++++++++++++++++++++++++++++++++
- src/tests/t_ccache.py  |   9 +-
- 2 files changed, 254 insertions(+), 1 deletion(-)
- create mode 100644 src/tests/kcmserver.py
-
-diff --git a/src/tests/kcmserver.py b/src/tests/kcmserver.py
-new file mode 100644
-index 000000000..57432e5a7
---- /dev/null
-+++ b/src/tests/kcmserver.py
-@@ -0,0 +1,246 @@
-+# This is a simple KCM test server, used to exercise the KCM ccache
-+# client code.  It will generally throw an uncaught exception if the
-+# client sends anything unexpected, so is unsuitable for production.
-+# (It also imposes no namespace or access constraints, and blocks
-+# while reading requests and writing responses.)
-+
-+# This code knows nothing about how to marshal and unmarshal principal
-+# names and credentials as is required in the KCM protocol; instead,
-+# it just remembers the marshalled forms and replays them to the
-+# client when asked.  This works because marshalled creds and
-+# principal names are always the last part of marshalled request
-+# arguments, and because we don't need to implement remove_cred (which
-+# would need to know how to match a cred tag against previously stored
-+# credentials).
-+
-+# The following code is useful for debugging if anything appears to be
-+# going wrong in the server, since daemon output is generally not
-+# visible in Python test scripts.
-+#
-+# import sys, traceback
-+# def ehook(etype, value, tb):
-+#     with open('/tmp/exception', 'w') as f:
-+#         traceback.print_exception(etype, value, tb, file=f)
-+# sys.excepthook = ehook
-+
-+import select
-+import socket
-+import struct
-+import sys
-+
-+caches = {}
-+cache_uuidmap = {}
-+defname = b'default'
-+next_unique = 1
-+next_uuid = 1
-+
-+class KCMOpcodes(object):
-+    GEN_NEW = 3
-+    INITIALIZE = 4
-+    DESTROY = 5
-+    STORE = 6
-+    GET_PRINCIPAL = 8
-+    GET_CRED_UUID_LIST = 9
-+    GET_CRED_BY_UUID = 10
-+    REMOVE_CRED = 11
-+    GET_CACHE_UUID_LIST = 18
-+    GET_CACHE_BY_UUID = 19
-+    GET_DEFAULT_CACHE = 20
-+    SET_DEFAULT_CACHE = 21
-+    GET_KDC_OFFSET = 22
-+    SET_KDC_OFFSET = 23
-+
-+
-+class KRB5Errors(object):
-+    KRB5_CC_END = -1765328242
-+    KRB5_CC_NOSUPP = -1765328137
-+    KRB5_FCC_NOFILE = -1765328189
-+
-+
-+def make_uuid():
-+    global next_uuid
-+    uuid = bytes(12) + struct.pack('>L', next_uuid)
-+    next_uuid = next_uuid + 1
-+    return uuid
-+
-+
-+class Cache(object):
-+    def __init__(self, name):
-+        self.name = name
-+        self.princ = None
-+        self.uuid = make_uuid()
-+        self.cred_uuids = []
-+        self.creds = {}
-+        self.time_offset = 0
-+
-+
-+def get_cache(name):
-+    if name in caches:
-+        return caches[name]
-+    cache = Cache(name)
-+    caches[name] = cache
-+    cache_uuidmap[cache.uuid] = cache
-+    return cache
-+
-+
-+def unmarshal_name(argbytes):
-+    offset = argbytes.find(b'\0')
-+    return argbytes[0:offset], argbytes[offset+1:]
-+
-+
-+def op_gen_new(argbytes):
-+    # Does not actually check for uniqueness.
-+    global next_unique
-+    name = b'unique' + str(next_unique).encode('ascii')
-+    next_unique += 1
-+    return 0, name + b'\0'
-+
-+
-+def op_initialize(argbytes):
-+    name, princ = unmarshal_name(argbytes)
-+    cache = get_cache(name)
-+    cache.princ = princ
-+    cache.cred_uuids = []
-+    cache.creds = {}
-+    cache.time_offset = 0
-+    return 0, b''
-+
-+
-+def op_destroy(argbytes):
-+    name, rest = unmarshal_name(argbytes)
-+    cache = get_cache(name)
-+    del cache_uuidmap[cache.uuid]
-+    del caches[name]
-+    return 0, b''
-+
-+
-+def op_store(argbytes):
-+    name, cred = unmarshal_name(argbytes)
-+    cache = get_cache(name)
-+    uuid = make_uuid()
-+    cache.creds[uuid] = cred
-+    cache.cred_uuids.append(uuid)
-+    return 0, b''
-+
-+
-+def op_get_principal(argbytes):
-+    name, rest = unmarshal_name(argbytes)
-+    cache = get_cache(name)
-+    if cache.princ is None:
-+        return KRB5Errors.KRB5_FCC_NOFILE, b''
-+    return 0, cache.princ + b'\0'
-+
-+
-+def op_get_cred_uuid_list(argbytes):
-+    name, rest = unmarshal_name(argbytes)
-+    cache = get_cache(name)
-+    return 0, b''.join(cache.cred_uuids)
-+
-+
-+def op_get_cred_by_uuid(argbytes):
-+    name, uuid = unmarshal_name(argbytes)
-+    cache = get_cache(name)
-+    if uuid not in cache.creds:
-+        return KRB5Errors.KRB5_CC_END, b''
-+    return 0, cache.creds[uuid]
-+
-+
-+def op_remove_cred(argbytes):
-+    return KRB5Errors.KRB5_CC_NOSUPP, b''
-+
-+
-+def op_get_cache_uuid_list(argbytes):
-+    return 0, b''.join(cache_uuidmap.keys())
-+
-+
-+def op_get_cache_by_uuid(argbytes):
-+    uuid = argbytes
-+    if uuid not in cache_uuidmap:
-+        return KRB5Errors.KRB5_CC_END, b''
-+    return 0, cache_uuidmap[uuid].name + b'\0'
-+
-+
-+def op_get_default_cache(argbytes):
-+    return 0, defname + b'\0'
-+
-+
-+def op_set_default_cache(argbytes):
-+    global defname
-+    defname, rest = unmarshal_name(argbytes)
-+    return 0, b''
-+
-+
-+def op_get_kdc_offset(argbytes):
-+    name, rest = unmarshal_name(argbytes)
-+    cache = get_cache(name)
-+    return 0, struct.pack('>l', cache.time_offset)
-+
-+
-+def op_set_kdc_offset(argbytes):
-+    name, obytes = unmarshal_name(argbytes)
-+    cache = get_cache(name)
-+    cache.time_offset, = struct.unpack('>l', obytes)
-+    return 0, b''
-+
-+
-+ophandlers = {
-+    KCMOpcodes.GEN_NEW : op_gen_new,
-+    KCMOpcodes.INITIALIZE : op_initialize,
-+    KCMOpcodes.DESTROY : op_destroy,
-+    KCMOpcodes.STORE : op_store,
-+    KCMOpcodes.GET_PRINCIPAL : op_get_principal,
-+    KCMOpcodes.GET_CRED_UUID_LIST : op_get_cred_uuid_list,
-+    KCMOpcodes.GET_CRED_BY_UUID : op_get_cred_by_uuid,
-+    KCMOpcodes.REMOVE_CRED : op_remove_cred,
-+    KCMOpcodes.GET_CACHE_UUID_LIST : op_get_cache_uuid_list,
-+    KCMOpcodes.GET_CACHE_BY_UUID : op_get_cache_by_uuid,
-+    KCMOpcodes.GET_DEFAULT_CACHE : op_get_default_cache,
-+    KCMOpcodes.SET_DEFAULT_CACHE : op_set_default_cache,
-+    KCMOpcodes.GET_KDC_OFFSET : op_get_kdc_offset,
-+    KCMOpcodes.SET_KDC_OFFSET : op_set_kdc_offset
-+}
-+
-+# Read and respond to a request from the socket s.
-+def service_request(s):
-+    lenbytes = b''
-+    while len(lenbytes) < 4:
-+        lenbytes += s.recv(4 - len(lenbytes))
-+        if lenbytes == b'':
-+                return False
-+
-+    reqlen, = struct.unpack('>L', lenbytes)
-+    req = b''
-+    while len(req) < reqlen:
-+        req += s.recv(reqlen - len(req))
-+
-+    majver, minver, op = struct.unpack('>BBH', req[:4])
-+    argbytes = req[4:]
-+    code, payload = ophandlers[op](argbytes)
-+
-+    # The KCM response is the code (4 bytes) and the response payload.
-+    # The Heimdal IPC response is the length of the KCM response (4
-+    # bytes), a status code which is essentially always 0 (4 bytes),
-+    # and the KCM response.
-+    kcm_response = struct.pack('>l', code) + payload
-+    hipc_response = struct.pack('>LL', len(kcm_response), 0) + kcm_response
-+    s.sendall(hipc_response)
-+    return True
-+
-+
-+server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-+server.bind(sys.argv[1])
-+server.listen(5)
-+select_input = [server,]
-+sys.stderr.write('starting...\n')
-+sys.stderr.flush()
-+
-+while True:
-+    iready, oready, xready = select.select(select_input, [], [])
-+    for s in iready:
-+        if s == server:
-+            client, addr = server.accept()
-+            select_input.append(client)
-+        else:
-+            if not service_request(s):
-+                select_input.remove(s)
-+                s.close()
-diff --git a/src/tests/t_ccache.py b/src/tests/t_ccache.py
-index fcf1a611e..66804afa5 100755
---- a/src/tests/t_ccache.py
-+++ b/src/tests/t_ccache.py
-@@ -22,7 +22,10 @@
- 
- from k5test import *
- 
--realm = K5Realm(create_host=False)
-+kcm_socket_path = os.path.join(os.getcwd(), 'testdir', 'kcm')
-+conf = {'libdefaults': {'kcm_socket': kcm_socket_path,
-+                        'kcm_mach_service': '-'}}
-+realm = K5Realm(create_host=False, krb5_conf=conf)
- 
- keyctl = which('keyctl')
- out = realm.run([klist, '-c', 'KEYRING:process:abcd'], expected_code=1)
-@@ -122,6 +125,10 @@ def collection_test(realm, ccname):
- 
- 
- collection_test(realm, 'DIR:' + os.path.join(realm.testdir, 'cc'))
-+kcmserver_path = os.path.join(srctop, 'tests', 'kcmserver.py')
-+realm.start_server([sys.executable, kcmserver_path, kcm_socket_path],
-+                   'starting...')
-+collection_test(realm, 'KCM:')
- if test_keyring:
-     def cleanup_keyring(anchor, name):
-         out = realm.run(['keyctl', 'list', anchor])
diff --git a/Add-zapfreedata-convenience-function.patch b/Add-zapfreedata-convenience-function.patch
deleted file mode 100644
index 4a6ce0b..0000000
--- a/Add-zapfreedata-convenience-function.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 7fb0b432d9192360ec3439a7f5c33ad8366064f1 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Thu, 14 Mar 2019 11:26:44 -0400
-Subject: [PATCH] Add zapfreedata() convenience function
-
-(cherry picked from commit abd974cf867db5a398aa87ba9b9aaa34346e12a4)
----
- src/include/k5-int.h | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index e0c557554..2bc59e636 100644
---- a/src/include/k5-int.h
-+++ b/src/include/k5-int.h
-@@ -663,6 +663,16 @@ zapfreestr(void *str)
-     }
- }
- 
-+/* Convenience function: zap and free krb5_data pointer if it is non-NULL. */
-+static inline void
-+zapfreedata(krb5_data *data)
-+{
-+    if (data != NULL) {
-+        zapfree(data->data, data->length);
-+        free(data);
-+    }
-+}
-+
- /*
-  * Combine two keys (normally used by the hardware preauth mechanism)
-  */
diff --git a/Address-some-optimized-out-memset-calls.patch b/Address-some-optimized-out-memset-calls.patch
deleted file mode 100644
index 5a5880d..0000000
--- a/Address-some-optimized-out-memset-calls.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From b54bce8e7b54c8700467fefcc74623fa50234046 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Sun, 30 Dec 2018 16:40:28 -0500
-Subject: [PATCH] Address some optimized-out memset() calls
-
-Ilja Van Sprundel reported a list of memset() calls which gcc
-optimizes out.  In krb_auth_su.c, use zap() to clear the password, and
-remove two memset() calls when there is no password to clear.  In
-iakerb.c, remove an unnecessary memset() before setting the only two
-fields of the IAKERB header structure.  In svr_principal.c, use
-krb5_free_key_keyblock_contents() instead of hand-freeing key data.
-In asn1_k_encode.c, remove an unnecessary memset() of the kdc_req_hack
-shell before returning.
-
-(cherry picked from commit 1057b0befec1f1c0e9d4da5521a58496e2dc0997)
----
- src/clients/ksu/krb_auth_su.c      |  4 +---
- src/lib/gssapi/krb5/iakerb.c       |  1 -
- src/lib/kadm5/srv/svr_principal.c  | 10 ++--------
- src/lib/krb5/asn.1/asn1_k_encode.c |  1 -
- 4 files changed, 3 insertions(+), 13 deletions(-)
-
-diff --git a/src/clients/ksu/krb_auth_su.c b/src/clients/ksu/krb_auth_su.c
-index 7af48195c..e39685fff 100644
---- a/src/clients/ksu/krb_auth_su.c
-+++ b/src/clients/ksu/krb_auth_su.c
-@@ -183,21 +183,19 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password,
-     if (code ) {
-         com_err(prog_name, code, _("while reading password for '%s'\n"),
-                 client_name);
--        memset(password, 0, sizeof(password));
-         return (FALSE);
-     }
- 
-     if ( pwsize == 0) {
-         fprintf(stderr, _("No password given\n"));
-         *zero_password = TRUE;
--        memset(password, 0, sizeof(password));
-         return (FALSE);
-     }
- 
-     code = krb5_get_init_creds_password(context, &creds, client, password,
-                                         krb5_prompter_posix, NULL, 0, NULL,
-                                         options);
--    memset(password, 0, sizeof(password));
-+    zap(password, sizeof(password));
- 
- 
-     if (code) {
-diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c
-index bb1072fe4..47c161ec9 100644
---- a/src/lib/gssapi/krb5/iakerb.c
-+++ b/src/lib/gssapi/krb5/iakerb.c
-@@ -262,7 +262,6 @@ iakerb_make_token(iakerb_ctx_id_t ctx,
-     /*
-      * Assemble the IAKERB-HEADER from the realm and cookie
-      */
--    memset(&iah, 0, sizeof(iah));
-     iah.target_realm = *realm;
-     iah.cookie = cookie;
- 
-diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
-index 21c53ece1..9ab2c5a74 100644
---- a/src/lib/kadm5/srv/svr_principal.c
-+++ b/src/lib/kadm5/srv/svr_principal.c
-@@ -2093,14 +2093,8 @@ static int decrypt_key_data(krb5_context context,
-         ret = krb5_dbe_decrypt_key_data(context, NULL, &key_data[i], &keys[i],
-                                         NULL);
-         if (ret) {
--            for (; i >= 0; i--) {
--                if (keys[i].contents) {
--                    memset (keys[i].contents, 0, keys[i].length);
--                    free( keys[i].contents );
--                }
--            }
--
--            memset(keys, 0, n_key_data*sizeof(krb5_keyblock));
-+            for (; i >= 0; i--)
-+                krb5_free_keyblock_contents(context, &keys[i]);
-             free(keys);
-             return ret;
-         }
-diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c
-index 65c84be2f..81a34bac9 100644
---- a/src/lib/krb5/asn.1/asn1_k_encode.c
-+++ b/src/lib/krb5/asn.1/asn1_k_encode.c
-@@ -528,7 +528,6 @@ decode_kdc_req_body(const taginfo *t, const uint8_t *asn1, size_t len,
-         if (ret) {
-             free_kdc_req_body(b);
-             free(h.server_realm.data);
--            memset(&h, 0, sizeof(h));
-             return ret;
-         }
-         b->server->realm = h.server_realm;
diff --git a/Avoid-alignment-warnings-in-openssl-rc4.c.patch b/Avoid-alignment-warnings-in-openssl-rc4.c.patch
deleted file mode 100644
index 7aa9e28..0000000
--- a/Avoid-alignment-warnings-in-openssl-rc4.c.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From c39a5710d0e4039a4f2bbd53ec284eb89d3b83c4 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Mon, 6 May 2019 15:14:49 -0400
-Subject: [PATCH] Avoid alignment warnings in openssl rc4.c
-
-Add a comment to k5_arcfour_init_state() explaining how we stretch the
-krb5_data cipher state contract.  Use void * casts when interpreting
-the data pointer to avoid alignment warnings.
-
-[ghudson@mit.edu: moved and expanded comment; rewrote commit message]
-
-(cherry picked from commit 1cd41d76c12fc1cea0a8bf0d6a40f34623c60d6d)
----
- src/lib/crypto/openssl/enc_provider/rc4.c | 15 ++++++++++++---
- 1 file changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c
-index 7f3c086ed..a65d57b7a 100644
---- a/src/lib/crypto/openssl/enc_provider/rc4.c
-+++ b/src/lib/crypto/openssl/enc_provider/rc4.c
-@@ -57,7 +57,7 @@ struct arcfour_state {
- 
- /* In-place IOV crypto */
- static krb5_error_code
--k5_arcfour_docrypt(krb5_key key,const krb5_data *state, krb5_crypto_iov *data,
-+k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
-                    size_t num_data)
- {
-     size_t i;
-@@ -66,7 +66,7 @@ k5_arcfour_docrypt(krb5_key key,const krb5_data *state, krb5_crypto_iov *data,
-     EVP_CIPHER_CTX *ctx = NULL;
-     struct arcfour_state *arcstate;
- 
--    arcstate = (state != NULL) ? (struct arcfour_state *) state->data : NULL;
-+    arcstate = (state != NULL) ? (void *)state->data : NULL;
-     if (arcstate != NULL) {
-         ctx = arcstate->ctx;
-         if (arcstate->loopback != arcstate)
-@@ -113,7 +113,7 @@ k5_arcfour_docrypt(krb5_key key,const krb5_data *state, krb5_crypto_iov *data,
- static void
- k5_arcfour_free_state(krb5_data *state)
- {
--    struct arcfour_state *arcstate = (struct arcfour_state *) state->data;
-+    struct arcfour_state *arcstate = (void *)state->data;
- 
-     EVP_CIPHER_CTX_free(arcstate->ctx);
-     free(arcstate);
-@@ -125,6 +125,15 @@ k5_arcfour_init_state(const krb5_keyblock *key,
- {
-     struct arcfour_state *arcstate;
- 
-+    /*
-+     * The cipher state here is a saved pointer to a struct arcfour_state
-+     * object, rather than a flat byte array as in most enc providers.  The
-+     * object includes a loopback pointer to detect if if the caller made a
-+     * copy of the krb5_data value or otherwise assumed it was a simple byte
-+     * array.  When we cast the data pointer back, we need to go through void *
-+     * to avoid increased alignment warnings.
-+     */
-+
-     /* Create a state structure with an uninitialized context. */
-     arcstate = calloc(1, sizeof(*arcstate));
-     if (arcstate == NULL)
diff --git a/Avoid-allocating-a-register-in-zap-assembly.patch b/Avoid-allocating-a-register-in-zap-assembly.patch
deleted file mode 100644
index 20d1fac..0000000
--- a/Avoid-allocating-a-register-in-zap-assembly.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 7491d9ed5c358960c6344c2581db9cafaf308f06 Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Thu, 3 Jan 2019 17:19:32 +0100
-Subject: [PATCH] Avoid allocating a register in zap() assembly
-
-See https://bugs.llvm.org/show_bug.cgi?id=15495
-
-Also add explicit_bzero() (glibc, FreeBSD) and explicit_memset()
-(NetBSD) as alternatives.
-
-[ghudson@mit.edu: added explicit_bzero() and explicit_memset()]
-
-(cherry picked from commit 7391e8b541061d0f584193b4a53365b64364b0e8)
----
- src/configure.in          | 2 +-
- src/include/k5-platform.h | 6 +++++-
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/src/configure.in b/src/configure.in
-index 93aec682e..7c309a26b 100644
---- a/src/configure.in
-+++ b/src/configure.in
-@@ -421,7 +421,7 @@ AC_PROG_LEX
- AC_C_CONST
- AC_HEADER_DIRENT
- AC_FUNC_STRERROR_R
--AC_CHECK_FUNCS(strdup setvbuf seteuid setresuid setreuid setegid setresgid setregid setsid flock fchmod chmod strptime geteuid setenv unsetenv getenv gmtime_r localtime_r bswap16 bswap64 mkstemp getusershell access getcwd srand48 srand srandom stat strchr strerror timegm)
-+AC_CHECK_FUNCS(strdup setvbuf seteuid setresuid setreuid setegid setresgid setregid setsid flock fchmod chmod strptime geteuid setenv unsetenv getenv gmtime_r localtime_r bswap16 bswap64 mkstemp getusershell access getcwd srand48 srand srandom stat strchr strerror timegm explicit_bzero explicit_memset)
- 
- AC_CHECK_FUNC(mkstemp,
- [MKSTEMP_ST_OBJ=
-diff --git a/src/include/k5-platform.h b/src/include/k5-platform.h
-index 997b655e1..1fcd68e8c 100644
---- a/src/include/k5-platform.h
-+++ b/src/include/k5-platform.h
-@@ -1023,6 +1023,10 @@ static inline void zap(void *ptr, size_t len)
-     if (len > 0)
-         memset_s(ptr, len, 0, len);
- }
-+#elif defined(HAVE_EXPLICIT_BZERO)
-+# define zap(ptr, len) explicit_bzero(ptr, len)
-+#elif defined(HAVE_EXPLICIT_MEMSET)
-+# define zap(ptr, len) explicit_memset(ptr, 0, len)
- #elif defined(__GNUC__) || defined(__clang__)
- /*
-  * Use an asm statement which declares a memory clobber to force the memset to
-@@ -1032,7 +1036,7 @@ static inline void zap(void *ptr, size_t len)
- {
-     if (len > 0)
-         memset(ptr, 0, len);
--    __asm__ __volatile__("" : : "r" (ptr) : "memory");
-+    __asm__ __volatile__("" : : "g" (ptr) : "memory");
- }
- #else
- /*
diff --git a/Check-more-errors-in-OpenSSL-crypto-backend.patch b/Check-more-errors-in-OpenSSL-crypto-backend.patch
deleted file mode 100644
index 4143944..0000000
--- a/Check-more-errors-in-OpenSSL-crypto-backend.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From 842524798c7f69edcef3f01cae7a9a6f126ed1dc Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Mon, 22 Apr 2019 14:26:42 -0400
-Subject: [PATCH] Check more errors in OpenSSL crypto backend
-
-In krb5int_hmac_keyblock() and krb5int_pbkdf2_hmac(), check for errors
-from previously unchecked OpenSSL function calls and return
-KRB5_CRYPTO_INTERNAL if they fail.
-
-HMAC_Init() is deprecated in OpenSSL 1.0 and later; as we are
-modifying the call to check for errors, call HMAC_Init_ex() instead.
-
-ticket: 8799 (new)
-(cherry picked from commit 2298e5c2ff1122bcaff715129f5b746e77c3f42a)
----
- src/lib/crypto/openssl/hmac.c   | 18 +++++++++---------
- src/lib/crypto/openssl/pbkdf2.c |  9 +++++----
- 2 files changed, 14 insertions(+), 13 deletions(-)
-
-diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c
-index b2db6ec02..7dc59dcc0 100644
---- a/src/lib/crypto/openssl/hmac.c
-+++ b/src/lib/crypto/openssl/hmac.c
-@@ -117,7 +117,7 @@ krb5int_hmac_keyblock(const struct krb5_hash_provider *hash,
-                       const krb5_crypto_iov *data, size_t num_data,
-                       krb5_data *output)
- {
--    unsigned int i = 0, md_len = 0;
-+    unsigned int i = 0, md_len = 0, ok;
-     unsigned char md[EVP_MAX_MD_SIZE];
-     HMAC_CTX *ctx;
-     size_t hashsize, blocksize;
-@@ -137,22 +137,22 @@ krb5int_hmac_keyblock(const struct krb5_hash_provider *hash,
-     if (ctx == NULL)
-         return ENOMEM;
- 
--    HMAC_Init(ctx, keyblock->contents, keyblock->length, map_digest(hash));
--    for (i = 0; i < num_data; i++) {
-+    ok = HMAC_Init_ex(ctx, keyblock->contents, keyblock->length,
-+                      map_digest(hash), NULL);
-+    for (i = 0; ok && i < num_data; i++) {
-         const krb5_crypto_iov *iov = &data[i];
- 
-         if (SIGN_IOV(iov))
--            HMAC_Update(ctx, (uint8_t *)iov->data.data, iov->data.length);
-+            ok = HMAC_Update(ctx, (uint8_t *)iov->data.data, iov->data.length);
-     }
--    HMAC_Final(ctx, md, &md_len);
--    if ( md_len <= output->length) {
-+    if (ok)
-+        ok = HMAC_Final(ctx, md, &md_len);
-+    if (ok && md_len <= output->length) {
-         output->length = md_len;
-         memcpy(output->data, md, output->length);
-     }
-     HMAC_CTX_free(ctx);
--    return 0;
--
--
-+    return ok ? 0 : KRB5_CRYPTO_INTERNAL;
- }
- 
- krb5_error_code
-diff --git a/src/lib/crypto/openssl/pbkdf2.c b/src/lib/crypto/openssl/pbkdf2.c
-index 00c2116fc..732ec6405 100644
---- a/src/lib/crypto/openssl/pbkdf2.c
-+++ b/src/lib/crypto/openssl/pbkdf2.c
-@@ -35,6 +35,7 @@ krb5int_pbkdf2_hmac(const struct krb5_hash_provider *hash,
-                     const krb5_data *pass, const krb5_data *salt)
- {
-     const EVP_MD *md = NULL;
-+    int ok;
- 
-     /* Get the message digest handle corresponding to the hash. */
-     if (hash == &krb5int_hash_sha1)
-@@ -46,8 +47,8 @@ krb5int_pbkdf2_hmac(const struct krb5_hash_provider *hash,
-     if (md == NULL)
-         return KRB5_CRYPTO_INTERNAL;
- 
--    PKCS5_PBKDF2_HMAC(pass->data, pass->length, (unsigned char *)salt->data,
--                      salt->length, count, md, out->length,
--                      (unsigned char *)out->data);
--    return 0;
-+    ok = PKCS5_PBKDF2_HMAC(pass->data, pass->length,
-+                           (unsigned char *)salt->data, salt->length, count,
-+                           md, out->length, (unsigned char *)out->data);
-+    return ok ? 0 : KRB5_CRYPTO_INTERNAL;
- }
diff --git a/Clarify-header-comment-for-krb5_cc_start_seq_get.patch b/Clarify-header-comment-for-krb5_cc_start_seq_get.patch
deleted file mode 100644
index 6bfc18f..0000000
--- a/Clarify-header-comment-for-krb5_cc_start_seq_get.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 2f50c282127bf8d4c570986c212fbc1e910fb8c5 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 2 Apr 2019 14:18:57 -0400
-Subject: [PATCH] Clarify header comment for krb5_cc_start_seq_get()
-
-Previously this comment seemed to suggest that applications needed to
-block all other access to the ccache (including by other processes)
-during iteration.
-
-(cherry picked from commit f4f51a25dd38601357e2f64b17b51eb23f45a53e)
----
- src/include/krb5/krb5.hin | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
-index 3ff86d7ff..346e796a5 100644
---- a/src/include/krb5/krb5.hin
-+++ b/src/include/krb5/krb5.hin
-@@ -2491,8 +2491,10 @@ krb5_cc_get_principal(krb5_context context, krb5_ccache cache,
-  *
-  * krb5_cc_end_seq_get() must be called to complete the retrieve operation.
-  *
-- * @note If @a cache is modified between the time of the call to this function
-- * and the time of the final krb5_cc_end_seq_get(), the results are undefined.
-+ * @note If the cache represented by @a cache is modified between the time of
-+ * the call to this function and the time of the final krb5_cc_end_seq_get(),
-+ * these changes may not be reflected in the results of krb5_cc_next_cred()
-+ * calls.
-  *
-  * @retval 0  Success; otherwise - Kerberos error codes
-  */
diff --git a/Clear-forwardable-flag-instead-of-denying-request.patch b/Clear-forwardable-flag-instead-of-denying-request.patch
deleted file mode 100644
index 05e4dbd..0000000
--- a/Clear-forwardable-flag-instead-of-denying-request.patch
+++ /dev/null
@@ -1,485 +0,0 @@
-From 6bd9bc03f2ad2aa5415d738c28180def7e17874f Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Thu, 15 Nov 2018 13:40:43 -0500
-Subject: [PATCH] Clear forwardable flag instead of denying request
-
-If the client requests a forwardable or proxiable ticket and the
-option cannot be honored by policy, issue a non-forwardable or
-non-proxiable ticket rather than denying the request.
-
-Add a test script for testing KDC request options and populate it with
-tests for the forwardable and proxiable flags.
-
-ticket: 7871
-(cherry picked from commit 08e948cce2c79a3604066fcf7a64fc527456f83d)
----
- src/kdc/do_as_req.c       |  19 ++------
- src/kdc/do_tgs_req.c      |  58 +++++-----------------
- src/kdc/kdc_util.c        |  82 ++++++++++++++++++-------------
- src/kdc/kdc_util.h        |   9 ++--
- src/kdc/tgs_policy.c      |   8 +--
- src/tests/Makefile.in     |   1 +
- src/tests/gcred.c         |  28 ++++++++---
- src/tests/t_kdcoptions.py | 100 ++++++++++++++++++++++++++++++++++++++
- 8 files changed, 190 insertions(+), 115 deletions(-)
- create mode 100644 src/tests/t_kdcoptions.py
-
-diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c
-index 588c1375a..8a96c12a9 100644
---- a/src/kdc/do_as_req.c
-+++ b/src/kdc/do_as_req.c
-@@ -192,13 +192,6 @@ finish_process_as_req(struct as_req_state *state, krb5_error_code errcode)
- 
-     au_state->stage = ENCR_REP;
- 
--    if ((errcode = validate_forwardable(state->request, *state->client,
--                                        *state->server, state->kdc_time,
--                                        &state->status))) {
--        errcode += ERROR_TABLE_BASE_krb5;
--        goto egress;
--    }
--
-     errcode = check_indicators(kdc_context, state->server,
-                                state->auth_indicators);
-     if (errcode) {
-@@ -708,12 +701,11 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt,
-     }
- 
-     /* Copy options that request the corresponding ticket flags. */
--    state->enc_tkt_reply.flags = OPTS2FLAGS(state->request->kdc_options);
-+    state->enc_tkt_reply.flags = get_ticket_flags(state->request->kdc_options,
-+                                                  state->client, state->server,
-+                                                  NULL);
-     state->enc_tkt_reply.times.authtime = state->authtime;
- 
--    setflag(state->enc_tkt_reply.flags, TKT_FLG_INITIAL);
--    setflag(state->enc_tkt_reply.flags, TKT_FLG_ENC_PA_REP);
--
-     /*
-      * It should be noted that local policy may affect the
-      * processing of any of these flags.  For example, some
-@@ -732,10 +724,9 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt,
-     state->enc_tkt_reply.transited.tr_type = KRB5_DOMAIN_X500_COMPRESS;
-     state->enc_tkt_reply.transited.tr_contents = empty_string;
- 
--    if (isflagset(state->request->kdc_options, KDC_OPT_POSTDATED)) {
--        setflag(state->enc_tkt_reply.flags, TKT_FLG_INVALID);
-+    if (isflagset(state->request->kdc_options, KDC_OPT_POSTDATED))
-         state->enc_tkt_reply.times.starttime = state->request->from;
--    } else
-+    else
-         state->enc_tkt_reply.times.starttime = state->kdc_time;
- 
-     kdc_get_ticket_endtime(kdc_active_realm,
-diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
-index 587342a6c..1da099318 100644
---- a/src/kdc/do_tgs_req.c
-+++ b/src/kdc/do_tgs_req.c
-@@ -378,15 +378,16 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
-     else
-         ticket_reply.server = request->server; /* XXX careful for realm... */
- 
--    enc_tkt_reply.flags = OPTS2FLAGS(request->kdc_options);
--    enc_tkt_reply.flags |= COPY_TKT_FLAGS(header_enc_tkt->flags);
-+    enc_tkt_reply.flags = get_ticket_flags(request->kdc_options, client,
-+                                           server, header_enc_tkt);
-     enc_tkt_reply.times.starttime = 0;
- 
--    if (isflagset(server->attributes, KRB5_KDB_OK_AS_DELEGATE))
--        setflag(enc_tkt_reply.flags, TKT_FLG_OK_AS_DELEGATE);
--
--    /* Indicate support for encrypted padata (RFC 6806). */
--    setflag(enc_tkt_reply.flags, TKT_FLG_ENC_PA_REP);
-+    /* OK_TO_AUTH_AS_DELEGATE must be set on the service requesting S4U2Self
-+     * for forwardable tickets to be issued. */
-+    if (isflagset(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION) &&
-+        !is_referral &&
-+        !isflagset(server->attributes, KRB5_KDB_OK_TO_AUTH_AS_DELEGATE))
-+        clear(enc_tkt_reply.flags, TKT_FLG_FORWARDABLE);
- 
-     /* don't use new addresses unless forwarded, see below */
- 
-@@ -401,37 +402,6 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
-      * realms may refuse to issue renewable tickets
-      */
- 
--    if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE)) {
--
--        if (isflagset(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION)) {
--            /*
--             * If S4U2Self principal is not forwardable, then mark ticket as
--             * unforwardable. This behaviour matches Windows, but it is
--             * different to the MIT AS-REQ path, which returns an error
--             * (KDC_ERR_POLICY) if forwardable tickets cannot be issued.
--             *
--             * Consider this block the S4U2Self equivalent to
--             * validate_forwardable().
--             */
--            if (client != NULL &&
--                isflagset(client->attributes, KRB5_KDB_DISALLOW_FORWARDABLE))
--                clear(enc_tkt_reply.flags, TKT_FLG_FORWARDABLE);
--            /*
--             * Forwardable flag is propagated along referral path.
--             */
--            else if (!isflagset(header_enc_tkt->flags, TKT_FLG_FORWARDABLE))
--                clear(enc_tkt_reply.flags, TKT_FLG_FORWARDABLE);
--            /*
--             * OK_TO_AUTH_AS_DELEGATE must be set on the service requesting
--             * S4U2Self in order for forwardable tickets to be returned.
--             */
--            else if (!is_referral &&
--                     !isflagset(server->attributes,
--                                KRB5_KDB_OK_TO_AUTH_AS_DELEGATE))
--                clear(enc_tkt_reply.flags, TKT_FLG_FORWARDABLE);
--        }
--    }
--
-     if (isflagset(request->kdc_options, KDC_OPT_FORWARDED) ||
-         isflagset(request->kdc_options, KDC_OPT_PROXY)) {
- 
-@@ -440,16 +410,10 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
-         enc_tkt_reply.caddrs = request->addresses;
-         reply_encpart.caddrs = request->addresses;
-     }
--    /* We don't currently handle issuing anonymous tickets based on
--     * non-anonymous ones, so just ignore the option. */
--    if (isflagset(request->kdc_options, KDC_OPT_REQUEST_ANONYMOUS) &&
--        !isflagset(header_enc_tkt->flags, TKT_FLG_ANONYMOUS))
--        clear(enc_tkt_reply.flags, TKT_FLG_ANONYMOUS);
--
--    if (isflagset(request->kdc_options, KDC_OPT_POSTDATED)) {
--        setflag(enc_tkt_reply.flags, TKT_FLG_INVALID);
-+
-+    if (isflagset(request->kdc_options, KDC_OPT_POSTDATED))
-         enc_tkt_reply.times.starttime = request->from;
--    } else
-+    else
-         enc_tkt_reply.times.starttime = kdc_time;
- 
-     if (isflagset(request->kdc_options, KDC_OPT_VALIDATE)) {
-diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
-index 96c88edc1..f2741090e 100644
---- a/src/kdc/kdc_util.c
-+++ b/src/kdc/kdc_util.c
-@@ -697,29 +697,6 @@ validate_as_request(kdc_realm_t *kdc_active_realm,
-         return(KDC_ERR_CANNOT_POSTDATE);
-     }
- 
--    /*
--     * A Windows KDC will return KDC_ERR_PREAUTH_REQUIRED instead of
--     * KDC_ERR_POLICY in the following case:
--     *
--     *   - KDC_OPT_FORWARDABLE is set in KDCOptions but local
--     *     policy has KRB5_KDB_DISALLOW_FORWARDABLE set for the
--     *     client, and;
--     *   - KRB5_KDB_REQUIRES_PRE_AUTH is set for the client but
--     *     preauthentication data is absent in the request.
--     *
--     * Hence, this check most be done after the check for preauth
--     * data, and is now performed by validate_forwardable() (the
--     * contents of which were previously below).
--     */
--
--    /* Client and server must allow proxiable tickets */
--    if (isflagset(request->kdc_options, KDC_OPT_PROXIABLE) &&
--        (isflagset(client.attributes, KRB5_KDB_DISALLOW_PROXIABLE) ||
--         isflagset(server.attributes, KRB5_KDB_DISALLOW_PROXIABLE))) {
--        *status = "PROXIABLE NOT ALLOWED";
--        return(KDC_ERR_POLICY);
--    }
--
-     /* Check to see if client is locked out */
-     if (isflagset(client.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {
-         *status = "CLIENT LOCKED OUT";
-@@ -752,19 +729,54 @@ validate_as_request(kdc_realm_t *kdc_active_realm,
-     return 0;
- }
- 
--int
--validate_forwardable(krb5_kdc_req *request, krb5_db_entry client,
--                     krb5_db_entry server, krb5_timestamp kdc_time,
--                     const char **status)
-+/*
-+ * Compute ticket flags based on the request, the client and server DB entry
-+ * (which may prohibit forwardable or proxiable tickets), and the header
-+ * ticket.  client may be NULL for a TGS request (although it may be set, such
-+ * as for an S4U2Self request).  header_enc may be NULL for an AS request.
-+ */
-+krb5_flags
-+get_ticket_flags(krb5_flags reqflags, krb5_db_entry *client,
-+                 krb5_db_entry *server, krb5_enc_tkt_part *header_enc)
- {
--    *status = NULL;
--    if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE) &&
--        (isflagset(client.attributes, KRB5_KDB_DISALLOW_FORWARDABLE) ||
--         isflagset(server.attributes, KRB5_KDB_DISALLOW_FORWARDABLE))) {
--        *status = "FORWARDABLE NOT ALLOWED";
--        return(KDC_ERR_POLICY);
--    } else
--        return 0;
-+    krb5_flags flags;
-+
-+    /* Indicate support for encrypted padata (RFC 6806), and set flags based on
-+     * request options and the header ticket. */
-+    flags = OPTS2FLAGS(reqflags) | TKT_FLG_ENC_PA_REP;
-+    if (reqflags & KDC_OPT_POSTDATED)
-+        flags |= TKT_FLG_INVALID;
-+    if (header_enc != NULL)
-+        flags |= COPY_TKT_FLAGS(header_enc->flags);
-+    if (header_enc == NULL)
-+        flags |= TKT_FLG_INITIAL;
-+
-+    /* For TGS requests, indicate if the service is marked ok-as-delegate. */
-+    if (header_enc != NULL && (server->attributes & KRB5_KDB_OK_AS_DELEGATE))
-+        flags |= TKT_FLG_OK_AS_DELEGATE;
-+
-+    /* Unset PROXIABLE if it is disallowed. */
-+    if (client != NULL && (client->attributes & KRB5_KDB_DISALLOW_PROXIABLE))
-+        flags &= ~TKT_FLG_PROXIABLE;
-+    if (server->attributes & KRB5_KDB_DISALLOW_PROXIABLE)
-+        flags &= ~TKT_FLG_PROXIABLE;
-+    if (header_enc != NULL && !(header_enc->flags & TKT_FLG_PROXIABLE))
-+        flags &= ~TKT_FLG_PROXIABLE;
-+
-+    /* Unset FORWARDABLE if it is disallowed. */
-+    if (client != NULL && (client->attributes & KRB5_KDB_DISALLOW_FORWARDABLE))
-+        flags &= ~TKT_FLG_FORWARDABLE;
-+    if (server->attributes & KRB5_KDB_DISALLOW_FORWARDABLE)
-+        flags &= ~TKT_FLG_FORWARDABLE;
-+    if (header_enc != NULL && !(header_enc->flags & TKT_FLG_FORWARDABLE))
-+        flags &= ~TKT_FLG_FORWARDABLE;
-+
-+    /* We don't currently handle issuing anonymous tickets based on
-+     * non-anonymous ones. */
-+    if (header_enc != NULL && !(header_enc->flags & TKT_FLG_ANONYMOUS))
-+        flags &= ~TKT_FLG_ANONYMOUS;
-+
-+    return flags;
- }
- 
- /* Return KRB5KDC_ERR_POLICY if indicators does not contain the required auth
-diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h
-index 25077cbf5..1314bdd58 100644
---- a/src/kdc/kdc_util.h
-+++ b/src/kdc/kdc_util.h
-@@ -85,16 +85,15 @@ validate_as_request (kdc_realm_t *, krb5_kdc_req *, krb5_db_entry,
-                      krb5_db_entry, krb5_timestamp,
-                      const char **, krb5_pa_data ***);
- 
--int
--validate_forwardable(krb5_kdc_req *, krb5_db_entry,
--                     krb5_db_entry, krb5_timestamp,
--                     const char **);
--
- int
- validate_tgs_request (kdc_realm_t *, krb5_kdc_req *, krb5_db_entry,
-                       krb5_ticket *, krb5_timestamp,
-                       const char **, krb5_pa_data ***);
- 
-+krb5_flags
-+get_ticket_flags(krb5_flags reqflags, krb5_db_entry *client,
-+                 krb5_db_entry *server, krb5_enc_tkt_part *header_enc);
-+
- krb5_error_code
- check_indicators(krb5_context context, krb5_db_entry *server,
-                  krb5_data *const *indicators);
-diff --git a/src/kdc/tgs_policy.c b/src/kdc/tgs_policy.c
-index 907fcd330..554345ba5 100644
---- a/src/kdc/tgs_policy.c
-+++ b/src/kdc/tgs_policy.c
-@@ -63,9 +63,9 @@ static check_tgs_svc_pol_fn * const svc_pol_fns[] = {
- };
- 
- static const struct tgsflagrule tgsflagrules[] = {
--    { (KDC_OPT_FORWARDED | KDC_OPT_FORWARDABLE), TKT_FLG_FORWARDABLE,
-+    { KDC_OPT_FORWARDED, TKT_FLG_FORWARDABLE,
-       "TGT NOT FORWARDABLE", KDC_ERR_BADOPTION },
--    { (KDC_OPT_PROXY | KDC_OPT_PROXIABLE), TKT_FLG_PROXIABLE,
-+    { KDC_OPT_PROXY, TKT_FLG_PROXIABLE,
-       "TGT NOT PROXIABLE", KDC_ERR_BADOPTION },
-     { (KDC_OPT_ALLOW_POSTDATE | KDC_OPT_POSTDATED), TKT_FLG_MAY_POSTDATE,
-       "TGT NOT POSTDATABLE", KDC_ERR_BADOPTION },
-@@ -98,12 +98,8 @@ check_tgs_opts(krb5_kdc_req *req, krb5_ticket *tkt, const char **status)
- }
- 
- static const struct tgsflagrule svcdenyrules[] = {
--    { KDC_OPT_FORWARDABLE, KRB5_KDB_DISALLOW_FORWARDABLE,
--      "NON-FORWARDABLE TICKET", KDC_ERR_POLICY },
-     { KDC_OPT_RENEWABLE, KRB5_KDB_DISALLOW_RENEWABLE,
-       "NON-RENEWABLE TICKET", KDC_ERR_POLICY },
--    { KDC_OPT_PROXIABLE, KRB5_KDB_DISALLOW_PROXIABLE,
--      "NON-PROXIABLE TICKET", KDC_ERR_POLICY },
-     { KDC_OPT_ALLOW_POSTDATE, KRB5_KDB_DISALLOW_POSTDATED,
-       "NON-POSTDATABLE TICKET", KDC_ERR_CANNOT_POSTDATE },
-     { KDC_OPT_ENC_TKT_IN_SKEY, KRB5_KDB_DISALLOW_DUP_SKEY,
-diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in
-index c96c5d6b7..d2a37c616 100644
---- a/src/tests/Makefile.in
-+++ b/src/tests/Makefile.in
-@@ -171,6 +171,7 @@ check-pytests: unlockiter
- 	$(RUNPYTEST) $(srcdir)/t_y2038.py $(PYTESTFLAGS)
- 	$(RUNPYTEST) $(srcdir)/t_kdcpolicy.py $(PYTESTFLAGS)
- 	$(RUNPYTEST) $(srcdir)/t_u2u.py $(PYTESTFLAGS)
-+	$(RUNPYTEST) $(srcdir)/t_kdcoptions.py $(PYTESTFLAGS)
- 
- clean:
- 	$(RM) adata etinfo forward gcred hist hooks hrealm icinterleave icred
-diff --git a/src/tests/gcred.c b/src/tests/gcred.c
-index cb0ae6af5..b14e4fc9a 100644
---- a/src/tests/gcred.c
-+++ b/src/tests/gcred.c
-@@ -66,20 +66,32 @@ main(int argc, char **argv)
-     krb5_principal client, server;
-     krb5_ccache ccache;
-     krb5_creds in_creds, *creds;
-+    krb5_flags options = 0;
-     char *name;
-+    int c;
- 
-     check(krb5_init_context(&ctx));
- 
--    /* Parse arguments. */
--    assert(argc == 3);
--    check(krb5_parse_name(ctx, argv[2], &server));
--    if (strcmp(argv[1], "unknown") == 0)
-+    while ((c = getopt(argc, argv, "f")) != -1) {
-+        switch (c) {
-+        case 'f':
-+            options |= KRB5_GC_FORWARDABLE;
-+            break;
-+        default:
-+            abort();
-+        }
-+    }
-+    argc -= optind;
-+    argv += optind;
-+    assert(argc == 2);
-+    check(krb5_parse_name(ctx, argv[1], &server));
-+    if (strcmp(argv[0], "unknown") == 0)
-         server->type = KRB5_NT_UNKNOWN;
--    else if (strcmp(argv[1], "principal") == 0)
-+    else if (strcmp(argv[0], "principal") == 0)
-         server->type = KRB5_NT_PRINCIPAL;
--    else if (strcmp(argv[1], "srv-inst") == 0)
-+    else if (strcmp(argv[0], "srv-inst") == 0)
-         server->type = KRB5_NT_SRV_INST;
--    else if (strcmp(argv[1], "srv-hst") == 0)
-+    else if (strcmp(argv[0], "srv-hst") == 0)
-         server->type = KRB5_NT_SRV_HST;
-     else
-         abort();
-@@ -89,7 +101,7 @@ main(int argc, char **argv)
-     memset(&in_creds, 0, sizeof(in_creds));
-     in_creds.client = client;
-     in_creds.server = server;
--    check(krb5_get_credentials(ctx, 0, ccache, &in_creds, &creds));
-+    check(krb5_get_credentials(ctx, options, ccache, &in_creds, &creds));
-     check(krb5_unparse_name(ctx, creds->server, &name));
-     printf("%s\n", name);
- 
-diff --git a/src/tests/t_kdcoptions.py b/src/tests/t_kdcoptions.py
-new file mode 100644
-index 000000000..7ec57508c
---- /dev/null
-+++ b/src/tests/t_kdcoptions.py
-@@ -0,0 +1,100 @@
-+from k5test import *
-+import re
-+
-+# KDC option test coverage notes:
-+#
-+# FORWARDABLE              here
-+# FORWARDED                no test
-+# PROXIABLE                here
-+# PROXY                    no test
-+# ALLOW_POSTDATE           no test
-+# POSTDATED                no test
-+# RENEWABLE                t_renew.py
-+# CNAME_IN_ADDL_TKT        gssapi/t_s4u.py
-+# CANONICALIZE             t_kdb.py and various other tests
-+# REQUEST_ANONYMOUS        t_pkinit.py
-+# DISABLE_TRANSITED_CHECK  no test
-+# RENEWABLE_OK             t_renew.py
-+# ENC_TKT_IN_SKEY          t_u2u.py
-+# RENEW                    t_renew.py
-+# VALIDATE                 no test
-+
-+# Run klist -f and return the flags on the ticket for svcprinc.
-+def get_flags(realm, svcprinc):
-+    grab_flags = False
-+    for line in realm.run([klist, '-f']).splitlines():
-+        if grab_flags:
-+            return re.findall(r'Flags: ([a-zA-Z]*)', line)[0]
-+        grab_flags = line.endswith(svcprinc)
-+
-+
-+# Get the flags on the ticket for svcprinc, and check for an expected
-+# element and an expected-absent element, either of which can be None.
-+def check_flags(realm, svcprinc, expected_flag, expected_noflag):
-+    flags = get_flags(realm, svcprinc)
-+    if expected_flag is not None and not expected_flag in flags:
-+        fail('expected flag ' + expected_flag)
-+    if expected_noflag is not None and expected_noflag in flags:
-+        fail('did not expect flag ' + expected_noflag)
-+
-+
-+# Run kinit with the given flags, and check the flags on the resulting
-+# TGT.
-+def kinit_check_flags(realm, flags, expected_flag, expected_noflag):
-+    realm.kinit(realm.user_princ, password('user'), flags)
-+    check_flags(realm, realm.krbtgt_princ, expected_flag, expected_noflag)
-+
-+
-+# Run kinit with kflags.  Then get credentials for the host principal
-+# with gflags, and check the flags on the resulting ticket.
-+def gcred_check_flags(realm, kflags, gflags, expected_flag, expected_noflag):
-+    realm.kinit(realm.user_princ, password('user'), kflags)
-+    realm.run(['./gcred'] + gflags + ['unknown', realm.host_princ])
-+    check_flags(realm, realm.host_princ, expected_flag, expected_noflag)
-+
-+
-+realm = K5Realm()
-+
-+mark('proxiable (AS)')
-+kinit_check_flags(realm, [], None, 'P')
-+kinit_check_flags(realm, ['-p'], 'P', None)
-+realm.run([kadminl, 'modprinc', '-allow_proxiable', realm.user_princ])
-+kinit_check_flags(realm, ['-p'], None, 'P')
-+realm.run([kadminl, 'modprinc', '+allow_proxiable', realm.user_princ])
-+realm.run([kadminl, 'modprinc', '-allow_proxiable', realm.krbtgt_princ])
-+kinit_check_flags(realm, ['-p'], None, 'P')
-+realm.run([kadminl, 'modprinc', '+allow_proxiable', realm.krbtgt_princ])
-+
-+mark('proxiable (TGS)')
-+gcred_check_flags(realm, [], [], None, 'P')
-+gcred_check_flags(realm, ['-p'], [], 'P', None)
-+
-+# Not tested: PROXIABLE option set with a non-proxiable TGT (because
-+# there is no krb5_get_credentials() flag to request this; would
-+# expect a non-proxiable ticket).
-+
-+# Not tested: proxiable TGT but PROXIABLE flag not set (because we
-+# internally set the PROXIABLE option when using a proxiable TGT;
-+# would expect a non-proxiable ticket).
-+
-+mark('forwardable (AS)')
-+kinit_check_flags(realm, [], None, 'F')
-+kinit_check_flags(realm, ['-f'], 'F', None)
-+realm.run([kadminl, 'modprinc', '-allow_forwardable', realm.user_princ])
-+kinit_check_flags(realm, ['-f'], None, 'F')
-+realm.run([kadminl, 'modprinc', '+allow_forwardable', realm.user_princ])
-+realm.run([kadminl, 'modprinc', '-allow_forwardable', realm.krbtgt_princ])
-+kinit_check_flags(realm, ['-f'], None, 'F')
-+realm.run([kadminl, 'modprinc', '+allow_forwardable', realm.krbtgt_princ])
-+
-+mark('forwardable (TGS)')
-+realm.kinit(realm.user_princ, password('user'))
-+gcred_check_flags(realm, [], [], None, 'F')
-+gcred_check_flags(realm, [], ['-f'], None, 'F')
-+gcred_check_flags(realm, ['-f'], [], 'F', None)
-+
-+# Not tested: forwardable TGT but FORWARDABLE flag not set (because we
-+# internally set the FORWARDABLE option when using a forwardable TGT;
-+# would expect a non-proxiable ticket).
-+
-+success('KDC option tests')
diff --git a/Display-unsupported-enctype-names.patch b/Display-unsupported-enctype-names.patch
deleted file mode 100644
index af727f7..0000000
--- a/Display-unsupported-enctype-names.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 144eea330aba65a140c0e0bf66ad3cfe06f28899 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Tue, 21 May 2019 13:34:39 -0400
-Subject: [PATCH] Display unsupported enctype names
-
-Add a table of unsupported enctype numbers to enctype_util.c and
-consult it in krb5_enctype_to_name().  Treat unsupported enctype
-numbers as deprecated in krb5int_c_deprecated_enctype().  In kadmin,
-display "UNSUPPORTED:" before invalid enctype names.
-
-ticket: 8808
-(cherry picked from commit ebbc6e8e99ee9d5d757411200a6a3173171774df)
----
- src/kadmin/cli/kadmin.c           |  4 +++-
- src/lib/crypto/krb/enctype_util.c | 22 +++++++++++++++++++++-
- 2 files changed, 24 insertions(+), 2 deletions(-)
-
-diff --git a/src/kadmin/cli/kadmin.c b/src/kadmin/cli/kadmin.c
-index fe4cb493c..b4d1aad93 100644
---- a/src/kadmin/cli/kadmin.c
-+++ b/src/kadmin/cli/kadmin.c
-@@ -1461,7 +1461,9 @@ kadmin_getprinc(int argc, char *argv[])
-                                      enctype, sizeof(enctype)))
-                 snprintf(enctype, sizeof(enctype), _("<Encryption type 0x%x>"),
-                          key_data->key_data_type[0]);
--            if (krb5int_c_deprecated_enctype(key_data->key_data_type[0]))
-+            if (!krb5_c_valid_enctype(key_data->key_data_type[0]))
-+                deprecated = "UNSUPPORTED:";
-+            else if (krb5int_c_deprecated_enctype(key_data->key_data_type[0]))
-                 deprecated = "DEPRECATED:";
-             printf("Key: vno %d, %s%s", key_data->key_data_kvno, deprecated,
-                    enctype);
-diff --git a/src/lib/crypto/krb/enctype_util.c b/src/lib/crypto/krb/enctype_util.c
-index e394f4e19..1542d4062 100644
---- a/src/lib/crypto/krb/enctype_util.c
-+++ b/src/lib/crypto/krb/enctype_util.c
-@@ -36,6 +36,18 @@
- 
- #include "crypto_int.h"
- 
-+struct {
-+    krb5_enctype etype;
-+    const char *name;
-+} unsupported_etypes[] = {
-+    { ENCTYPE_DES_CBC_CRC, "des-cbc-crc" },
-+    { ENCTYPE_DES_CBC_MD4, "des-cbc-md4" },
-+    { ENCTYPE_DES_CBC_MD5, "des-cbc-md5" },
-+    { ENCTYPE_DES_CBC_RAW, "des-cbc-raw" },
-+    { ENCTYPE_DES_HMAC_SHA1, "des-hmac-sha1" },
-+    { ENCTYPE_NULL, NULL }
-+};
-+
- krb5_boolean KRB5_CALLCONV
- krb5_c_valid_enctype(krb5_enctype etype)
- {
-@@ -55,7 +67,7 @@ krb5_boolean KRB5_CALLCONV
- krb5int_c_deprecated_enctype(krb5_enctype etype)
- {
-     const struct krb5_keytypes *ktp = find_enctype(etype);
--    return ktp != NULL && (ktp->flags & ETYPE_DEPRECATED) != 0;
-+    return ktp == NULL || (ktp->flags & ETYPE_DEPRECATED) != 0;
- }
- 
- krb5_error_code KRB5_CALLCONV
-@@ -122,6 +134,14 @@ krb5_enctype_to_name(krb5_enctype enctype, krb5_boolean shortest,
-     const char *name;
-     int i;
- 
-+    for (i = 0; unsupported_etypes[i].etype != ENCTYPE_NULL; i++) {
-+        if (enctype == unsupported_etypes[i].etype) {
-+            if (strlcpy(buffer, unsupported_etypes[i].name, buflen) >= buflen)
-+                return ENOMEM;
-+            return 0;
-+        }
-+    }
-+
-     ktp = find_enctype(enctype);
-     if (ktp == NULL)
-         return EINVAL;
diff --git a/Don-t-error-on-invalid-enctypes-in-keytab.patch b/Don-t-error-on-invalid-enctypes-in-keytab.patch
deleted file mode 100644
index cf8daea..0000000
--- a/Don-t-error-on-invalid-enctypes-in-keytab.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From 84bb2b804c69830ff2dc405b1a2bd7893291d8e6 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Wed, 10 Jul 2019 17:10:16 -0400
-Subject: [PATCH] Don't error on invalid enctypes in keytab
-
-krb5_ktfile_get_entry() used krb5_c_enctype_compare() to compare
-enctypes, in order to share keys between single-DES enctypes.  As
-key-sharing between enctypes is no longer done and single-DES support
-has been removed, use a simple equality test to match the enctype.
-This fixes a bug where krb5_kt_get_entry() would error out if the
-keytab contained any entries with invalid enctypes (include single-DES
-entries, after commit fb2dada5eb89c4cd4e39dedd6dbb7dbd5e94f8b8) even
-if a matching entry is found.
-
-[ghudson@mit.edu: rewrote commit message]
-
-ticket: 8808
-(cherry picked from commit 38be1a0a31a6104cdf8c8d72828905775f6d6636)
----
- src/lib/krb5/keytab/kt_file.c | 27 +++++----------------------
- 1 file changed, 5 insertions(+), 22 deletions(-)
-
-diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c
-index 21c80d419..df2530a45 100644
---- a/src/lib/krb5/keytab/kt_file.c
-+++ b/src/lib/krb5/keytab/kt_file.c
-@@ -289,7 +289,6 @@ krb5_ktfile_get_entry(krb5_context context, krb5_keytab id,
-     krb5_keytab_entry cur_entry, new_entry;
-     krb5_error_code kerror = 0;
-     int found_wrong_kvno = 0;
--    krb5_boolean similar;
-     int was_open;
-     char *princname;
- 
-@@ -336,27 +335,11 @@ krb5_ktfile_get_entry(krb5_context context, krb5_keytab id,
-             continue;
-         }
- 
--        /* if the enctype is not ignored and doesn't match, free new_entry
--           and continue to the next */
--
--        if (enctype != IGNORE_ENCTYPE) {
--            if ((kerror = krb5_c_enctype_compare(context, enctype,
--                                                 new_entry.key.enctype,
--                                                 &similar))) {
--                krb5_kt_free_entry(context, &new_entry);
--                break;
--            }
--
--            if (!similar) {
--                krb5_kt_free_entry(context, &new_entry);
--                continue;
--            }
--            /*
--             * Coerce the enctype of the output keyblock in case we
--             * got an inexact match on the enctype.
--             */
--            new_entry.key.enctype = enctype;
--
-+        /* If the enctype is not ignored and doesn't match, free new_entry and
-+           continue to the next. */
-+        if (enctype != IGNORE_ENCTYPE && enctype != new_entry.key.enctype) {
-+            krb5_kt_free_entry(context, &new_entry);
-+            continue;
-         }
- 
-         if (kvno == IGNORE_VNO || new_entry.vno == IGNORE_VNO) {
diff --git a/Filter-enctypes-in-gss_set_allowable_enctypes.patch b/Filter-enctypes-in-gss_set_allowable_enctypes.patch
deleted file mode 100644
index f63eba1..0000000
--- a/Filter-enctypes-in-gss_set_allowable_enctypes.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From aa3b2bb07bf48375b2391b31e68d0abf7ba5e4ea Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Tue, 16 Jul 2019 00:15:42 -0400
-Subject: [PATCH] Filter enctypes in gss_set_allowable_enctypes()
-
-Instead of erroring out when any invalid enctypes are present in the
-caller's list, filter out the invalid ones and only error if no
-enctypes remain.
-
-ticket: 8819
-(cherry picked from commit 37ab7ea128a4c2aa2dad65ab9006baded5335bc7)
----
- src/lib/gssapi/krb5/set_allowable_enctypes.c | 29 ++++++++++----------
- 1 file changed, 14 insertions(+), 15 deletions(-)
-
-diff --git a/src/lib/gssapi/krb5/set_allowable_enctypes.c b/src/lib/gssapi/krb5/set_allowable_enctypes.c
-index d9fd279ed..a74b161cb 100644
---- a/src/lib/gssapi/krb5/set_allowable_enctypes.c
-+++ b/src/lib/gssapi/krb5/set_allowable_enctypes.c
-@@ -66,7 +66,7 @@ gss_krb5int_set_allowable_enctypes(OM_uint32 *minor_status,
-                                    const gss_OID desired_oid,
-                                    const gss_buffer_t value)
- {
--    unsigned int i;
-+    unsigned int i, j;
-     krb5_enctype * new_ktypes;
-     OM_uint32 major_status;
-     krb5_gss_cred_id_t cred;
-@@ -83,14 +83,7 @@ gss_krb5int_set_allowable_enctypes(OM_uint32 *minor_status,
-     /* verify and valildate cred handle */
-     cred = (krb5_gss_cred_id_t) *cred_handle;
- 
--    if (req->ktypes) {
--        for (i = 0; i < req->num_ktypes && req->ktypes[i]; i++) {
--            if (!krb5_c_valid_enctype(req->ktypes[i])) {
--                kerr = KRB5_PROG_ETYPE_NOSUPP;
--                goto error_out;
--            }
--        }
--    } else {
-+    if (req->ktypes == NULL) {
-         k5_mutex_lock(&cred->lock);
-         if (cred->req_enctypes)
-             free(cred->req_enctypes);
-@@ -99,13 +92,19 @@ gss_krb5int_set_allowable_enctypes(OM_uint32 *minor_status,
-         return GSS_S_COMPLETE;
-     }
- 
--    /* Copy the requested ktypes into the cred structure */
--    if ((new_ktypes = (krb5_enctype *)malloc(sizeof(krb5_enctype) * (i + 1)))) {
--        memcpy(new_ktypes, req->ktypes, sizeof(krb5_enctype) * i);
--        new_ktypes[i] = 0;      /* "null-terminate" the list */
-+    /* Copy the requested enctypes into the cred structure.  Filter out the
-+     * ones we don't consider valid.  Error out if no enctypes are valid. */
-+    new_ktypes = k5calloc(req->num_ktypes + 1, sizeof(*new_ktypes), &kerr);
-+    if (new_ktypes == NULL)
-+        goto error_out;
-+    for (i = 0, j = 0; i < req->num_ktypes && req->ktypes[i]; i++) {
-+        if (krb5_c_valid_enctype(req->ktypes[i]))
-+            new_ktypes[j++] = req->ktypes[i];
-     }
--    else {
--        kerr = ENOMEM;
-+    new_ktypes[j] = 0;
-+    if (j == 0) {
-+        free(new_ktypes);
-+        kerr = KRB5_PROG_ETYPE_NOSUPP;
-         goto error_out;
-     }
-     k5_mutex_lock(&cred->lock);
diff --git a/Fix-Coverity-defects-in-soft-pkcs11-test-code.patch b/Fix-Coverity-defects-in-soft-pkcs11-test-code.patch
deleted file mode 100644
index a4324c2..0000000
--- a/Fix-Coverity-defects-in-soft-pkcs11-test-code.patch
+++ /dev/null
@@ -1,206 +0,0 @@
-From 28db01445d2807d51b5045c0a04d5e49905de504 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Sat, 20 Jul 2019 00:51:52 -0400
-Subject: [PATCH] Fix Coverity defects in soft-pkcs11 test code
-
-Nothing in the code removes objects from soft_token.object.obs, so
-simplify add_st_object() not to search for an empty slot.  Avoid using
-random() by using a counter for session handles and just the array
-slot number for object handles.  Add a helper get_rcfilename() to
-facilitate checking the result of asprintf().  Properly initialize ap
-in sprintf_fill().  Close the file handle in read_conf_file().
-
-(cherry picked from commit b4831515b2f3b6fd7d7fd4bff4558c10c710891d)
----
- src/tests/softpkcs11/main.c | 102 +++++++++++++++++++-----------------
- 1 file changed, 53 insertions(+), 49 deletions(-)
-
-diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c
-index 5255323d3..2d1448ca2 100644
---- a/src/tests/softpkcs11/main.c
-+++ b/src/tests/softpkcs11/main.c
-@@ -78,6 +78,7 @@ compat_rsa_get0_key(const RSA *rsa, const BIGNUM **n, const BIGNUM **e,
-                 (BL) = i2d_##T((S), &p);                \
-                 if ((BL) <= 0) {                        \
-                     free((B));                          \
-+                    (B) = NULL;                         \
-                     (R) = EINVAL;                       \
-                 }                                       \
-             }                                           \
-@@ -149,6 +150,7 @@ static struct soft_token {
-     } state[10];
- #define MAX_NUM_SESSION (sizeof(soft_token.state)/sizeof(soft_token.state[0]))
-     FILE *logfile;
-+    CK_SESSION_HANDLE next_session_handle;
- } soft_token;
- 
- static void
-@@ -179,6 +181,7 @@ snprintf_fill(char *str, int size, char fillchar, const char *fmt, ...)
- {
-     int len;
-     va_list ap;
-+    va_start(ap, fmt);
-     len = vsnprintf(str, size, fmt, ap);
-     va_end(ap);
-     if (len < 0 || len > size)
-@@ -344,7 +347,13 @@ static struct st_object *
- add_st_object(void)
- {
-     struct st_object *o, **objs;
--    int i;
-+
-+    objs = realloc(soft_token.object.objs,
-+                   (soft_token.object.num_objs + 1) *
-+                   sizeof(soft_token.object.objs[0]));
-+    if (objs == NULL)
-+        return NULL;
-+    soft_token.object.objs = objs;
- 
-     o = malloc(sizeof(*o));
-     if (o == NULL)
-@@ -352,26 +361,9 @@ add_st_object(void)
-     memset(o, 0, sizeof(*o));
-     o->attrs = NULL;
-     o->num_attributes = 0;
-+    o->object_handle = soft_token.object.num_objs;
- 
--    for (i = 0; i < soft_token.object.num_objs; i++) {
--        if (soft_token.object.objs == NULL) {
--            soft_token.object.objs[i] = o;
--            break;
--        }
--    }
--    if (i == soft_token.object.num_objs) {
--        objs = realloc(soft_token.object.objs,
--                       (soft_token.object.num_objs + 1) * sizeof(soft_token.object.objs[0]));
--        if (objs == NULL) {
--            free(o);
--            return NULL;
--        }
--        soft_token.object.objs = objs;
--        soft_token.object.objs[soft_token.object.num_objs++] = o;
--    }
--    soft_token.object.objs[i]->object_handle =
--        (random() & (~OBJECT_ID_MASK)) | i;
--
-+    soft_token.object.objs[soft_token.object.num_objs++] = o;
-     return o;
- }
- 
-@@ -797,6 +789,8 @@ read_conf_file(const char *fn)
- 
-         add_certificate(label, cert, key, id, anchor);
-     }
-+
-+    fclose(f);
- }
- 
- static CK_RV
-@@ -806,19 +800,47 @@ func_not_supported(void)
-     return CKR_FUNCTION_NOT_SUPPORTED;
- }
- 
-+static char *
-+get_rcfilename()
-+{
-+    struct passwd *pw;
-+    const char *home = NULL;
-+    char *fn;
-+
-+    if (getuid() == geteuid()) {
-+        fn = getenv("SOFTPKCS11RC");
-+        if (fn != NULL)
-+            return strdup(fn);
-+
-+        home = getenv("HOME");
-+    }
-+
-+    if (home == NULL) {
-+        pw = getpwuid(getuid());
-+        if (pw != NULL)
-+            home = pw->pw_dir;
-+    }
-+
-+    if (home == NULL)
-+        return strdup("/etc/soft-token.rc");
-+
-+    if (asprintf(&fn, "%s/.soft-token.rc", home) < 0)
-+        return NULL;
-+    return fn;
-+}
-+
- CK_RV
- C_Initialize(CK_VOID_PTR a)
- {
-     CK_C_INITIALIZE_ARGS_PTR args = a;
-     size_t i;
-+    char *fn;
- 
-     st_logf("Initialize\n");
- 
-     OpenSSL_add_all_algorithms();
-     ERR_load_crypto_strings();
- 
--    srandom(getpid() ^ time(NULL));
--
-     for (i = 0; i < MAX_NUM_SESSION; i++) {
-         soft_token.state[i].session_handle = CK_INVALID_HANDLE;
-         soft_token.state[i].find.attributes = NULL;
-@@ -850,31 +872,13 @@ C_Initialize(CK_VOID_PTR a)
-         st_logf("\tFlags\t%04x\n", (unsigned int)args->flags);
-     }
- 
--    {
--        char *fn = NULL, *home = NULL;
--
--        if (getuid() == geteuid()) {
--            fn = getenv("SOFTPKCS11RC");
--            if (fn)
--                fn = strdup(fn);
--            home = getenv("HOME");
--        }
--        if (fn == NULL && home == NULL) {
--            struct passwd *pw = getpwuid(getuid());
--            if(pw != NULL)
--                home = pw->pw_dir;
--        }
--        if (fn == NULL) {
--            if (home)
--                asprintf(&fn, "%s/.soft-token.rc", home);
--            else
--                fn = strdup("/etc/soft-token.rc");
--        }
--
--        read_conf_file(fn);
--        free(fn);
--    }
-+    soft_token.next_session_handle = 0;
- 
-+    fn = get_rcfilename();
-+    if (fn == NULL)
-+        return CKR_DEVICE_MEMORY;
-+    read_conf_file(fn);
-+    free(fn);
-     return CKR_OK;
- }
- 
-@@ -1082,8 +1086,7 @@ C_OpenSession(CK_SLOT_ID slotID,
- 
-     soft_token.open_sessions++;
- 
--    soft_token.state[i].session_handle =
--        (CK_SESSION_HANDLE)(random() & 0xfffff);
-+    soft_token.state[i].session_handle = soft_token.next_session_handle++;
-     *phSession = soft_token.state[i].session_handle;
- 
-     return CKR_OK;
-@@ -1152,7 +1155,8 @@ C_Login(CK_SESSION_HANDLE hSession,
-     VERIFY_SESSION_HANDLE(hSession, NULL);
- 
-     if (pPin != NULL_PTR) {
--        asprintf(&pin, "%.*s", (int)ulPinLen, pPin);
-+        if (asprintf(&pin, "%.*s", (int)ulPinLen, pPin) < 0)
-+            return CKR_DEVICE_MEMORY;
-         st_logf("type: %d password: %s\n", (int)userType, pin);
-     }
- 
diff --git a/Fix-KCM-client-time-offset-propagation.patch b/Fix-KCM-client-time-offset-propagation.patch
deleted file mode 100644
index 4071488..0000000
--- a/Fix-KCM-client-time-offset-propagation.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 7e81b8077cf2cf186dadb96b064573f7c221fbf3 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Wed, 14 Aug 2019 13:52:27 -0400
-Subject: [PATCH] Fix KCM client time offset propagation
-
-An inverted status check in get_kdc_offset() would cause querying the
-offset time from the ccache to always fail (silently) on KCM.  Fix the
-status check so that KCM can properly handle desync.
-
-ticket: 8826 (new)
-tags: pullup
-target_version: 1.17-next
-target_verison: 1.16-next
-
-(cherry picked from commit 323abb6d1ebe5469d6c2167c29aa5d696d099b90)
----
- src/lib/krb5/ccache/cc_kcm.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
-index 092ab7daf..fe93ca3dc 100644
---- a/src/lib/krb5/ccache/cc_kcm.c
-+++ b/src/lib/krb5/ccache/cc_kcm.c
-@@ -583,7 +583,7 @@ get_kdc_offset(krb5_context context, krb5_ccache cache)
-     if (cache_call(context, cache, &req, FALSE) != 0)
-         goto cleanup;
-     time_offset = k5_input_get_uint32_be(&req.reply);
--    if (!req.reply.status)
-+    if (req.reply.status)
-         goto cleanup;
-     context->os_context.time_offset = time_offset;
-     context->os_context.usec_offset = 0;
diff --git a/Fix-KDC-crash-when-logging-PKINIT-enctypes.patch b/Fix-KDC-crash-when-logging-PKINIT-enctypes.patch
deleted file mode 100644
index 947ffe2..0000000
--- a/Fix-KDC-crash-when-logging-PKINIT-enctypes.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 55353df13814c6d711a1d947dd6690b334269122 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Wed, 25 Sep 2019 12:57:56 -0400
-Subject: [PATCH] Fix KDC crash when logging PKINIT enctypes
-
-Commit a649279727490687d54becad91fde8cf7429d951 introduced a KDC crash
-bug due to transposed strlcpy() arguments.  Fix the argument order.
-
-This bug does not affect any MIT krb5 release, but affects the Fedora
-krb5 packages due to backports.  CVE-2019-14844 has been issued as a
-result.
-
-ticket: 8772
-(cherry picked from commit 275c9a1aad36a1a7b56042f1a2c21c33e7d16eaf)
----
- src/kdc/kdc_util.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
-index 23ad6c584..698f18c1c 100644
---- a/src/kdc/kdc_util.c
-+++ b/src/kdc/kdc_util.c
-@@ -1080,7 +1080,7 @@ enctype_name(krb5_enctype ktype, char *buf, size_t buflen)
-     else
-         return krb5_enctype_to_name(ktype, FALSE, buf, buflen);
- 
--    if (strlcpy(name, buf, buflen) >= buflen)
-+    if (strlcpy(buf, name, buflen) >= buflen)
-         return ENOMEM;
-     return 0;
- }
diff --git a/Fix-config-realm-change-logic-in-FILE-remove_cred.patch b/Fix-config-realm-change-logic-in-FILE-remove_cred.patch
deleted file mode 100644
index 28dfd3c..0000000
--- a/Fix-config-realm-change-logic-in-FILE-remove_cred.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 7ed0d71eb3eef640e57f3c55f8aeac636cce3110 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Tue, 16 Apr 2019 10:47:35 -0400
-Subject: [PATCH] Fix config realm change logic in FILE remove_cred
-
-Use data_eq_string() to check the server realm, and do not check if
-cred->server is NULL since it is not expected to be (and
-k5_marshal_cred() would have already crashed if it were).
-
-ticket: 8792
-(cherry picked from commit e5367fcddd53dc4db0c1fd2279e91eda3791960a)
----
- src/lib/krb5/ccache/cc_file.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/src/lib/krb5/ccache/cc_file.c b/src/lib/krb5/ccache/cc_file.c
-index 09da38fa9..a3f67766e 100644
---- a/src/lib/krb5/ccache/cc_file.c
-+++ b/src/lib/krb5/ccache/cc_file.c
-@@ -1058,8 +1058,7 @@ delete_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor,
- 
-     /* For config entries, also change the realm so that other implementations
-      * won't match them. */
--    if (cred->server != NULL && cred->server->realm.length > 0 &&
--        strcmp(cred->server->realm.data, "X-CACHECONF:") == 0)
-+    if (data_eq_string(cred->server->realm, "X-CACHECONF:"))
-         memcpy(cred->server->realm.data, "X-RMED-CONF:", 12);
- 
-     k5_marshal_cred(&overwrite, fcursor->version, cred);
diff --git a/Fix-memory-leak-in-none-replay-cache-type.patch b/Fix-memory-leak-in-none-replay-cache-type.patch
deleted file mode 100644
index 03b5f59..0000000
--- a/Fix-memory-leak-in-none-replay-cache-type.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From e215c213a068d96599a3069339bfb3e4024ef61b Mon Sep 17 00:00:00 2001
-From: Corene Casper <C.Casper@Dell.com>
-Date: Sat, 16 Feb 2019 00:49:26 -0500
-Subject: [PATCH] Fix memory leak in 'none' replay cache type
-
-Commit 0f06098e2ab419d02e89a1ca6bc9f2828f6bdb1e fixed part of a memory
-leak in the 'none' replay cache type by freeing the outer container,
-but we also need to free the mutex.
-
-[ghudson@mit.edu: wrote commit message]
-
-ticket: 8783
-tags: pullup
-target_version: 1.17-next
-target_version: 1.16-next
-
-(cherry picked from commit af2a3115cb8feb5174151b4b40223ae45aa9db17)
----
- src/lib/krb5/rcache/rc_none.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/lib/krb5/rcache/rc_none.c b/src/lib/krb5/rcache/rc_none.c
-index e30aed09f..0b2274df7 100644
---- a/src/lib/krb5/rcache/rc_none.c
-+++ b/src/lib/krb5/rcache/rc_none.c
-@@ -50,6 +50,7 @@ krb5_rc_none_noargs(krb5_context ctx, krb5_rcache rc)
- static krb5_error_code KRB5_CALLCONV
- krb5_rc_none_close(krb5_context ctx, krb5_rcache rc)
- {
-+    k5_mutex_destroy(&rc->lock);
-     free (rc);
-     return 0;
- }
diff --git a/Fix-memory-leaks-in-soft-pkcs11-code.patch b/Fix-memory-leaks-in-soft-pkcs11-code.patch
deleted file mode 100644
index 9bcb794..0000000
--- a/Fix-memory-leaks-in-soft-pkcs11-code.patch
+++ /dev/null
@@ -1,122 +0,0 @@
-From 5cc80472e7a8b0fb3002f229ffb104dccf8bd120 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Mon, 5 Aug 2019 01:53:51 -0400
-Subject: [PATCH] Fix memory leaks in soft-pkcs11 code
-
-Fix leaks detected by asan in t_pkinit.py.  Add a helper to free a
-struct st_object and free objects in C_Finalize().  Duplicate the X509
-cert in add_certificate() instead of creating aliases so it can be
-properly freed.  Start the session handle counter at 1 so that
-C_Finalize() won't confuse the first session handle with
-CK_INVALID_HANDLE (defined to 0 in pkinit.h) and will properly clean
-the session object.
-
-(cherry picked from commit 15bcaf8bcb4af25ff89820ad3bf23ad5a324e863)
----
- src/tests/softpkcs11/main.c | 44 +++++++++++++++++++++++++++++++++----
- 1 file changed, 40 insertions(+), 4 deletions(-)
-
-diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c
-index 2d1448ca2..a4c3ae78e 100644
---- a/src/tests/softpkcs11/main.c
-+++ b/src/tests/softpkcs11/main.c
-@@ -109,7 +109,7 @@ struct st_object {
-         X509 *cert;
-         EVP_PKEY *public_key;
-         struct {
--            const char *file;
-+            char *file;
-             EVP_PKEY *key;
-             X509 *cert;
-         } private_key;
-@@ -343,6 +343,26 @@ print_attributes(const CK_ATTRIBUTE *attributes,
-     }
- }
- 
-+static void
-+free_st_object(struct st_object *o)
-+{
-+    int i;
-+
-+    for (i = 0; i < o->num_attributes; i++)
-+        free(o->attrs[i].attribute.pValue);
-+    free(o->attrs);
-+    if (o->type == STO_T_CERTIFICATE) {
-+        X509_free(o->u.cert);
-+    } else if (o->type == STO_T_PRIVATE_KEY) {
-+        free(o->u.private_key.file);
-+        EVP_PKEY_free(o->u.private_key.key);
-+        X509_free(o->u.private_key.cert);
-+    } else if (o->type == STO_T_PUBLIC_KEY) {
-+        EVP_PKEY_free(o->u.public_key);
-+    }
-+    free(o);
-+}
-+
- static struct st_object *
- add_st_object(void)
- {
-@@ -518,7 +538,11 @@ add_certificate(char *label,
-         goto out;
-     }
-     o->type = STO_T_CERTIFICATE;
--    o->u.cert = cert;
-+    o->u.cert = X509_dup(cert);
-+    if (o->u.cert == NULL) {
-+        ret = CKR_DEVICE_MEMORY;
-+        goto out;
-+    }
-     public_key = X509_get_pubkey(o->u.cert);
- 
-     switch (EVP_PKEY_base_id(public_key)) {
-@@ -602,7 +626,11 @@ add_certificate(char *label,
-         o->u.private_key.file = strdup(private_key_file);
-         o->u.private_key.key = NULL;
- 
--        o->u.private_key.cert = cert;
-+        o->u.private_key.cert = X509_dup(cert);
-+        if (o->u.private_key.cert == NULL) {
-+            ret = CKR_DEVICE_MEMORY;
-+            goto out;
-+        }
- 
-         c = CKO_PRIVATE_KEY;
-         add_object_attribute(o, 0, CKA_CLASS, &c, sizeof(c));
-@@ -676,6 +704,7 @@ add_certificate(char *label,
-     free(serial_data);
-     free(issuer_data);
-     free(subject_data);
-+    X509_free(cert);
- 
-     return ret;
- }
-@@ -872,7 +901,7 @@ C_Initialize(CK_VOID_PTR a)
-         st_logf("\tFlags\t%04x\n", (unsigned int)args->flags);
-     }
- 
--    soft_token.next_session_handle = 0;
-+    soft_token.next_session_handle = 1;
- 
-     fn = get_rcfilename();
-     if (fn == NULL)
-@@ -886,6 +915,7 @@ CK_RV
- C_Finalize(CK_VOID_PTR args)
- {
-     size_t i;
-+    int j;
- 
-     st_logf("Finalize\n");
- 
-@@ -897,6 +927,12 @@ C_Finalize(CK_VOID_PTR args)
-         }
-     }
- 
-+    for (j = 0; j < soft_token.object.num_objs; j++)
-+        free_st_object(soft_token.object.objs[j]);
-+    free(soft_token.object.objs);
-+    soft_token.object.objs = NULL;
-+    soft_token.object.num_objs = 0;
-+
-     return CKR_OK;
- }
- 
diff --git a/Fix-potential-close-1-in-cc_file.c.patch b/Fix-potential-close-1-in-cc_file.c.patch
deleted file mode 100644
index 598dc72..0000000
--- a/Fix-potential-close-1-in-cc_file.c.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 013037d7c4f6073d28ea2b0bd53eca04bae170ea Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 18 Apr 2019 13:39:37 -0400
-Subject: [PATCH] Fix potential close(-1) in cc_file.c
-
-As part of error handling in d3b39a8bac6206b5ea78b0bf6a2958c1df0b0dd5,
-an error path in delete_cred() may result in close(-1).  While this
-shouldn't be a prolblem in practice (just returning EBADF), it does
-upset Coverity.
-
-ticket: 8792
-(cherry picked from commit 5ccfbaf2f0c8871d2f0ea87ad4b21cc33392ca2c)
----
- src/lib/krb5/ccache/cc_file.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/lib/krb5/ccache/cc_file.c b/src/lib/krb5/ccache/cc_file.c
-index a3f67766e..bf58c1d45 100644
---- a/src/lib/krb5/ccache/cc_file.c
-+++ b/src/lib/krb5/ccache/cc_file.c
-@@ -1122,7 +1122,8 @@ delete_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor,
-     }
- 
- cleanup:
--    close(fd);
-+    if (fd >= 0)
-+        close(fd);
-     zapfree(on_disk, expected.len);
-     k5_buf_free(&expected);
-     k5_buf_free(&overwrite);
diff --git a/Fix-some-return-code-handling-bugs.patch b/Fix-some-return-code-handling-bugs.patch
deleted file mode 100644
index 5b62208..0000000
--- a/Fix-some-return-code-handling-bugs.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From 6f0b53aea2dfcccf1efe0c1c6142eeeaf998f2bb Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 2 May 2019 14:05:38 -0400
-Subject: [PATCH] Fix some return code handling bugs
-
-Fix five cases where return codes could be set (in unlikely cases) but
-did not result in error exits.
-
-[ghudson@mit.edu: squashed commits and rewrote commit message]
-
-ticket: 8801 (new)
-tags: pullup
-target_version: 1.17-next
-target_version: 1.16-next
-
-(cherry picked from commit 7c26740f9df3c79c3f01c3a4dda4d9dabba5298d)
----
- src/kdc/fast_util.c               | 16 ++++++++--------
- src/lib/gssapi/krb5/k5unsealiov.c |  1 +
- src/lib/kadm5/clnt/client_init.c  |  3 +++
- src/tests/gssapi/t_pcontok.c      |  1 +
- 4 files changed, 13 insertions(+), 8 deletions(-)
-
-diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c
-index 6a3fc11b9..c9ba83e5e 100644
---- a/src/kdc/fast_util.c
-+++ b/src/kdc/fast_util.c
-@@ -47,9 +47,10 @@ static krb5_error_code armor_ap_request
-     if (retval == 0)
-         retval = krb5_auth_con_setflags(kdc_context,
-                                         authcontext, 0); /*disable replay cache*/
--    retval = krb5_rd_req(kdc_context, &authcontext,
--                         &armor->armor_value, NULL /*server*/,
--                         kdc_active_realm->realm_keytab,  NULL, &ticket);
-+    if (retval == 0)
-+        retval = krb5_rd_req(kdc_context, &authcontext, &armor->armor_value,
-+                             NULL /*server*/, kdc_active_realm->realm_keytab,
-+                             NULL, &ticket);
-     if (retval != 0) {
-         const char * errmsg = krb5_get_error_message(kdc_context, retval);
-         k5_setmsg(kdc_context, retval, _("%s while handling ap-request armor"),
-@@ -132,7 +133,7 @@ kdc_find_fast(krb5_kdc_req **requestptr,
- {
-     krb5_error_code retval = 0;
-     krb5_pa_data *fast_padata;
--    krb5_data scratch, *inner_body = NULL;
-+    krb5_data scratch, plaintext, *inner_body = NULL;
-     krb5_fast_req * fast_req = NULL;
-     krb5_kdc_req *request = *requestptr;
-     krb5_fast_armored_req *fast_armored_req = NULL;
-@@ -183,11 +184,10 @@ kdc_find_fast(krb5_kdc_req **requestptr,
-             }
-         }
-         if (retval == 0) {
--            krb5_data plaintext;
-             plaintext.length = fast_armored_req->enc_part.ciphertext.length;
--            plaintext.data = malloc(plaintext.length);
--            if (plaintext.data == NULL)
--                retval = ENOMEM;
-+            plaintext.data = k5alloc(plaintext.length, &retval);
-+        }
-+        if (retval == 0) {
-             retval = krb5_c_decrypt(kdc_context,
-                                     state->armor_key,
-                                     KRB5_KEYUSAGE_FAST_ENC, NULL,
-diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c
-index 8b6704274..f15d2db69 100644
---- a/src/lib/gssapi/krb5/k5unsealiov.c
-+++ b/src/lib/gssapi/krb5/k5unsealiov.c
-@@ -281,6 +281,7 @@ kg_unseal_v1_iov(krb5_context context,
-         (!ctx->initiate && direction != 0)) {
-         *minor_status = (OM_uint32)G_BAD_DIRECTION;
-         retval = GSS_S_BAD_SIG;
-+        goto cleanup;
-     }
- 
-     code = 0;
-diff --git a/src/lib/kadm5/clnt/client_init.c b/src/lib/kadm5/clnt/client_init.c
-index 6f10db018..aa08918e2 100644
---- a/src/lib/kadm5/clnt/client_init.c
-+++ b/src/lib/kadm5/clnt/client_init.c
-@@ -465,6 +465,9 @@ gic_iter(kadm5_server_handle_t handle, enum init_type init_type,
-     /* Credentials for kadmin don't need to be forwardable or proxiable. */
-     if (init_type != INIT_CREDS) {
-         code = krb5_get_init_creds_opt_alloc(ctx, &opt);
-+        if (code)
-+            goto error;
-+
-         krb5_get_init_creds_opt_set_forwardable(opt, 0);
-         krb5_get_init_creds_opt_set_proxiable(opt, 0);
-         krb5_get_init_creds_opt_set_out_ccache(ctx, opt, ccache);
-diff --git a/src/tests/gssapi/t_pcontok.c b/src/tests/gssapi/t_pcontok.c
-index b966f8129..c40ea434c 100644
---- a/src/tests/gssapi/t_pcontok.c
-+++ b/src/tests/gssapi/t_pcontok.c
-@@ -126,6 +126,7 @@ make_delete_token(gss_krb5_lucid_context_v1_t *lctx, gss_buffer_desc *out)
-         iov.flags = KRB5_CRYPTO_TYPE_DATA;
-         iov.data = make_data(cksum.contents, 16);
-         ret = krb5_k_encrypt_iov(context, seq, 0, NULL, &iov, 1);
-+        check_k5err(context, "krb5_k_encrypt_iov", ret);
-         memcpy(ptr + 8, cksum.contents + 8, 8);
-     } else {
-         memcpy(ptr + 8, cksum.contents, cksize);
diff --git a/Implement-krb5_cc_remove_cred-for-remaining-types.patch b/Implement-krb5_cc_remove_cred-for-remaining-types.patch
deleted file mode 100644
index b77a6e5..0000000
--- a/Implement-krb5_cc_remove_cred-for-remaining-types.patch
+++ /dev/null
@@ -1,599 +0,0 @@
-From ebc913ea73bfc439f293831f19db83ec83622d51 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Mon, 1 Apr 2019 14:28:48 -0400
-Subject: [PATCH] Implement krb5_cc_remove_cred for remaining types
-
-Previously, only KCM and MSLA implemented credential removal.  Add
-support for FILE (and therefore DIR), MEMORY, and KEYRING.
-
-The FILE logic is similar Heimdal's implementation, with additional
-logic for skipping removed creds during iteration.  In addition to
-setting endtime to 0 and changing the realm for config entries as
-Heimdal does, we set authtime to -1 to make deleted entries
-distinguishable from gssproxy encrypted creds and config entries.
-
-For MEMORY, leave behind empty list elements when removing a cred will
-leave behind an empty list element, in case an iterator holds a
-pointer to that element.
-
-[ghudson@mit.edu: edited commit message; made minor style and comment
-changes; fixed memory leaks detected by asan]
-
-ticket: 8792 (new)
-(cherry picked from commit d3b39a8bac6206b5ea78b0bf6a2958c1df0b0dd5)
----
- src/lib/krb5/ccache/cc_file.c    | 177 ++++++++++++++++++++++++++++---
- src/lib/krb5/ccache/cc_keyring.c |  89 +++++++++++-----
- src/lib/krb5/ccache/cc_memory.c  |  36 +++++--
- src/lib/krb5/ccache/t_cc.c       | 129 +++++++++++++++++++++-
- 4 files changed, 381 insertions(+), 50 deletions(-)
-
-diff --git a/src/lib/krb5/ccache/cc_file.c b/src/lib/krb5/ccache/cc_file.c
-index 9263a0054..09da38fa9 100644
---- a/src/lib/krb5/ccache/cc_file.c
-+++ b/src/lib/krb5/ccache/cc_file.c
-@@ -744,6 +744,14 @@ cleanup:
-     return set_errmsg_filename(context, ret, data->filename);
- }
- 
-+/* Return true if cred is a removed entry (assuming that no legitimate cred
-+ * entries will have authtime=-1 and endtime=0). */
-+static inline krb5_boolean
-+cred_removed(krb5_creds *c)
-+{
-+    return c->times.endtime == 0 && c->times.authtime == -1;
-+}
-+
- /* Get the next credential from the cache file. */
- static krb5_error_code KRB5_CALLCONV
- fcc_next_cred(krb5_context context, krb5_ccache id, krb5_cc_cursor *cursor,
-@@ -765,19 +773,30 @@ fcc_next_cred(krb5_context context, krb5_ccache id, krb5_cc_cursor *cursor,
-         goto cleanup;
-     file_locked = TRUE;
- 
--    /* Load a marshalled cred into memory. */
--    ret = get_size(context, fcursor->fp, &maxsize);
--    if (ret)
--        goto cleanup;
--    ret = load_cred(context, fcursor->fp, fcursor->version, maxsize, &buf);
--    if (ret)
--        goto cleanup;
--    ret = k5_buf_status(&buf);
--    if (ret)
--        goto cleanup;
-+    for (;;) {
-+        /* Load a marshalled cred into memory. */
-+        ret = get_size(context, fcursor->fp, &maxsize);
-+        if (ret)
-+            goto cleanup;
-+        ret = load_cred(context, fcursor->fp, fcursor->version, maxsize, &buf);
-+        if (ret)
-+            goto cleanup;
-+        ret = k5_buf_status(&buf);
-+        if (ret)
-+            goto cleanup;
- 
--    /* Unmarshal it from buf into creds. */
--    ret = k5_unmarshal_cred(buf.data, buf.len, fcursor->version, creds);
-+        /* Unmarshal it from buf into creds. */
-+        ret = k5_unmarshal_cred(buf.data, buf.len, fcursor->version, creds);
-+        if (ret)
-+            goto cleanup;
-+
-+        /* Keep going if this entry has been removed; otherwise stop. */
-+        if (!cred_removed(creds))
-+            break;
-+
-+        k5_buf_truncate(&buf, 0);
-+        krb5_free_cred_contents(context, creds);
-+    }
- 
- cleanup:
-     if (file_locked)
-@@ -1002,12 +1021,142 @@ cleanup:
-     return set_errmsg_filename(context, ret ? ret : ret2, data->filename);
- }
- 
--/* Non-functional stub for removing a cred from the cache file. */
-+/*
-+ * Overwrite cred in the ccache file with an entry that should not match any
-+ * reasonable search.  Deletion is not guaranteed.  This method is originally
-+ * from Heimdal, with the addition of setting authtime to -1.
-+ */
-+static krb5_error_code
-+delete_cred(krb5_context context, krb5_ccache cache, krb5_cc_cursor *cursor,
-+            krb5_creds *cred)
-+{
-+    krb5_error_code ret;
-+    krb5_fcc_cursor *fcursor = *cursor;
-+    fcc_data *data = cache->data;
-+    struct k5buf expected = EMPTY_K5BUF, overwrite = EMPTY_K5BUF;
-+    int fd = -1;
-+    uint8_t *on_disk = NULL;
-+    ssize_t rwret;
-+    off_t start_offset;
-+
-+    k5_buf_init_dynamic_zap(&expected);
-+    k5_buf_init_dynamic_zap(&overwrite);
-+
-+    /* Re-marshal cred to get its byte representation in the file. */
-+    k5_marshal_cred(&expected, fcursor->version, cred);
-+    ret = k5_buf_status(&expected);
-+    if (ret)
-+        goto cleanup;
-+
-+    /*
-+     * Mark the cred expired so that it will be skipped over by any future
-+     * match checks.  Heimdal only sets endtime, but we also set authtime to
-+     * distinguish from gssproxy's creds.
-+     */
-+    cred->times.endtime = 0;
-+    cred->times.authtime = -1;
-+
-+    /* For config entries, also change the realm so that other implementations
-+     * won't match them. */
-+    if (cred->server != NULL && cred->server->realm.length > 0 &&
-+        strcmp(cred->server->realm.data, "X-CACHECONF:") == 0)
-+        memcpy(cred->server->realm.data, "X-RMED-CONF:", 12);
-+
-+    k5_marshal_cred(&overwrite, fcursor->version, cred);
-+    ret = k5_buf_status(&overwrite);
-+    if (ret)
-+        goto cleanup;
-+
-+    if (expected.len != overwrite.len) {
-+        ret = KRB5_CC_FORMAT;
-+        goto cleanup;
-+    }
-+
-+    /* Get a non-O_APPEND handle to the raw file. */
-+    fd = open(data->filename, O_RDWR | O_BINARY | O_CLOEXEC);
-+    if (fd == -1) {
-+        ret = interpret_errno(context, errno);
-+        goto cleanup;
-+    }
-+
-+    start_offset = ftell(fcursor->fp);
-+    if (start_offset == -1) {
-+        ret = interpret_errno(context, errno);
-+        goto cleanup;
-+    }
-+    start_offset -= expected.len;
-+
-+    /* Read the bytes at the entry to be overwritten. */
-+    if (lseek(fd, start_offset, SEEK_SET) == -1) {
-+        ret = interpret_errno(context, errno);
-+        goto cleanup;
-+    }
-+    on_disk = k5alloc(expected.len, &ret);
-+    if (ret != 0)
-+        goto cleanup;
-+    rwret = read(fd, on_disk, expected.len);
-+    if (rwret < 0) {
-+        ret = interpret_errno(context, errno);
-+        goto cleanup;
-+    } else if ((size_t)rwret != expected.len) {
-+        ret = KRB5_CC_FORMAT;
-+        goto cleanup;
-+    }
-+
-+    /*
-+     * If the bytes have changed, either someone else removed the same cred or
-+     * the cache was reinitialized.  Either way the cred is no longer present,
-+     * so return successfully.
-+     */
-+    if (memcmp(on_disk, expected.data, expected.len) != 0)
-+        goto cleanup;
-+
-+    /* Write out the altered entry. */
-+    if (lseek(fd, start_offset, SEEK_SET) == -1) {
-+        ret = interpret_errno(context, errno);
-+        goto cleanup;
-+    }
-+    rwret = write(fd, overwrite.data, overwrite.len);
-+    if (rwret < 0) {
-+        ret = interpret_errno(context, errno);
-+        goto cleanup;
-+    }
-+
-+cleanup:
-+    close(fd);
-+    zapfree(on_disk, expected.len);
-+    k5_buf_free(&expected);
-+    k5_buf_free(&overwrite);
-+    return ret;
-+}
-+
-+/* Remove the given creds from the ccache file. */
- static krb5_error_code KRB5_CALLCONV
- fcc_remove_cred(krb5_context context, krb5_ccache cache, krb5_flags flags,
-                 krb5_creds *creds)
- {
--    return KRB5_CC_NOSUPP;
-+    krb5_error_code ret;
-+    krb5_cc_cursor cursor;
-+    krb5_creds cur;
-+
-+    ret = krb5_cc_start_seq_get(context, cache, &cursor);
-+    if (ret)
-+        return ret;
-+
-+    for (;;) {
-+        ret = krb5_cc_next_cred(context, cache, &cursor, &cur);
-+        if (ret)
-+            break;
-+
-+        if (krb5int_cc_creds_match_request(context, flags, creds, &cur))
-+            ret = delete_cred(context, cache, &cursor, &cur);
-+        krb5_free_cred_contents(context, &cur);
-+        if (ret)
-+            break;
-+    }
-+
-+    krb5_cc_end_seq_get(context, cache, &cursor);
-+    return (ret == KRB5_CC_END) ? 0 : ret;
- }
- 
- static krb5_error_code KRB5_CALLCONV
-diff --git a/src/lib/krb5/ccache/cc_keyring.c b/src/lib/krb5/ccache/cc_keyring.c
-index 8419f6ebf..98723fe2e 100644
---- a/src/lib/krb5/ccache/cc_keyring.c
-+++ b/src/lib/krb5/ccache/cc_keyring.c
-@@ -1032,40 +1032,44 @@ krcc_next_cred(krb5_context context, krb5_ccache id, krb5_cc_cursor *cursor,
- 
-     memset(creds, 0, sizeof(krb5_creds));
- 
--    /* The cursor has the entire list of keys.  (Note that we don't support
--     * remove_cred.) */
-+    /* The cursor has the entire list of keys. */
-     krcursor = *cursor;
-     if (krcursor == NULL)
-         return KRB5_CC_END;
- 
--    /* If we're pointing past the end of the keys array, there are no more. */
--    if (krcursor->currkey >= krcursor->numkeys)
--        return KRB5_CC_END;
-+    while (krcursor->currkey < krcursor->numkeys) {
-+        /* If we're pointing at the entry with the principal, or at the key
-+         * with the time offsets, skip it. */
-+        if (krcursor->keys[krcursor->currkey] == krcursor->princ_id ||
-+            krcursor->keys[krcursor->currkey] == krcursor->offsets_id) {
-+            krcursor->currkey++;
-+            continue;
-+        }
- 
--    /* If we're pointing at the entry with the principal, or at the key
--     * with the time offsets, skip it. */
--    while (krcursor->keys[krcursor->currkey] == krcursor->princ_id ||
--           krcursor->keys[krcursor->currkey] == krcursor->offsets_id) {
--        krcursor->currkey++;
--        /* Check if we have now reached the end */
--        if (krcursor->currkey >= krcursor->numkeys)
--            return KRB5_CC_END;
--    }
-+        /* Read the key; the right size buffer will be allocated and
-+         * returned. */
-+        psize = keyctl_read_alloc(krcursor->keys[krcursor->currkey],
-+                                  &payload);
-+        if (psize != -1) {
-+            krcursor->currkey++;
- 
--    /* Read the key; the right size buffer will be allocated and returned. */
--    psize = keyctl_read_alloc(krcursor->keys[krcursor->currkey], &payload);
--    if (psize == -1) {
--        DEBUG_PRINT(("Error reading key %d: %s\n",
--                     krcursor->keys[krcursor->currkey],
--                     strerror(errno)));
--        return KRB5_FCC_NOFILE;
-+            /* Unmarshal the cred using the file ccache version 4 format. */
-+            ret = k5_unmarshal_cred(payload, psize, 4, creds);
-+            free(payload);
-+            return ret;
-+        } else if (errno != ENOKEY && errno != EACCES) {
-+            DEBUG_PRINT(("Error reading key %d: %s\n",
-+                         krcursor->keys[krcursor->currkey], strerror(errno)));
-+            return KRB5_FCC_NOFILE;
-+        }
-+
-+        /* The current key was unlinked, probably by a remove_cred call; move
-+         * on to the next one. */
-+        krcursor->currkey++;
-     }
--    krcursor->currkey++;
- 
--    /* Unmarshal the credential using the file ccache version 4 format. */
--    ret = k5_unmarshal_cred(payload, psize, 4, creds);
--    free(payload);
--    return ret;
-+    /* No more keys in keyring. */
-+    return KRB5_CC_END;
- }
- 
- /* Release an iteration cursor. */
-@@ -1248,12 +1252,41 @@ krcc_retrieve(krb5_context context, krb5_ccache id,
-                                        creds);
- }
- 
--/* Non-functional stub for removing a cred from the cache keyring. */
-+/* Remove a credential from the cache keyring. */
- static krb5_error_code KRB5_CALLCONV
- krcc_remove_cred(krb5_context context, krb5_ccache cache,
-                  krb5_flags flags, krb5_creds *creds)
- {
--    return KRB5_CC_NOSUPP;
-+    krb5_error_code ret;
-+    krcc_data *data = cache->data;
-+    krb5_cc_cursor cursor;
-+    krb5_creds c;
-+    krcc_cursor krcursor;
-+    key_serial_t key;
-+    krb5_boolean match;
-+
-+    ret = krcc_start_seq_get(context, cache, &cursor);
-+    if (ret)
-+        return ret;
-+
-+    for (;;) {
-+        ret = krcc_next_cred(context, cache, &cursor, &c);
-+        if (ret)
-+            break;
-+        match = krb5int_cc_creds_match_request(context, flags, creds, &c);
-+        krb5_free_cred_contents(context, &c);
-+        if (match) {
-+            krcursor = cursor;
-+            key = krcursor->keys[krcursor->currkey - 1];
-+            if (keyctl_unlink(key, data->cache_id) == -1) {
-+                ret = errno;
-+                break;
-+            }
-+        }
-+    }
-+
-+    krcc_end_seq_get(context, cache, &cursor);
-+    return (ret == KRB5_CC_END) ? 0 : ret;
- }
- 
- /* Set flags on the cache.  (We don't care about any flags.) */
-diff --git a/src/lib/krb5/ccache/cc_memory.c b/src/lib/krb5/ccache/cc_memory.c
-index 114ef6913..edf6fcc26 100644
---- a/src/lib/krb5/ccache/cc_memory.c
-+++ b/src/lib/krb5/ccache/cc_memory.c
-@@ -405,14 +405,23 @@ krb5_mcc_next_cred(krb5_context context, krb5_ccache id,
-      */
-     k5_cc_mutex_lock(context, &d->lock);
-     if (mcursor->generation != d->generation) {
--        k5_cc_mutex_unlock(context, &d->lock);
--        return KRB5_CC_END;
-+        retval = KRB5_CC_END;
-+        goto done;
-+    }
-+
-+    /* Skip over removed creds. */
-+    while (mcursor->next_link != NULL && mcursor->next_link->creds == NULL)
-+        mcursor->next_link = mcursor->next_link->next;
-+    if (mcursor->next_link == NULL) {
-+        retval = KRB5_CC_END;
-+        goto done;
-     }
- 
-     retval = k5_copy_creds_contents(context, mcursor->next_link->creds, creds);
-     if (retval == 0)
-         mcursor->next_link = mcursor->next_link->next;
- 
-+done:
-     k5_cc_mutex_unlock(context, &d->lock);
-     return retval;
- }
-@@ -592,16 +601,31 @@ krb5_mcc_retrieve(krb5_context context, krb5_ccache id, krb5_flags whichfields,
- }
- 
- /*
-- * Non-functional stub implementation for krb5_mcc_remove
-+ * Modifies:
-+ * the memory cache
-  *
-- * Errors:
-- *    KRB5_CC_NOSUPP - not implemented
-+ * Effects:
-+ * Remove the given creds from the ccache.
-  */
- static krb5_error_code KRB5_CALLCONV
- krb5_mcc_remove_cred(krb5_context context, krb5_ccache cache, krb5_flags flags,
-                      krb5_creds *creds)
- {
--    return KRB5_CC_NOSUPP;
-+    krb5_mcc_data *data = (krb5_mcc_data *)cache->data;
-+    krb5_mcc_link *l;
-+
-+    k5_cc_mutex_lock(context, &data->lock);
-+
-+    for (l = data->link; l != NULL; l = l->next) {
-+        if (l->creds != NULL &&
-+            krb5int_cc_creds_match_request(context, flags, creds, l->creds)) {
-+            krb5_free_creds(context, l->creds);
-+            l->creds = NULL;
-+        }
-+    }
-+
-+    k5_cc_mutex_unlock(context, &data->lock);
-+    return 0;
- }
- 
- 
-diff --git a/src/lib/krb5/ccache/t_cc.c b/src/lib/krb5/ccache/t_cc.c
-index cd4569c4c..954f2f465 100644
---- a/src/lib/krb5/ccache/t_cc.c
-+++ b/src/lib/krb5/ccache/t_cc.c
-@@ -36,7 +36,7 @@
- 
- #define KRB5_OK 0
- 
--krb5_creds test_creds;
-+krb5_creds test_creds, test_creds2;
- 
- int debug=0;
- 
-@@ -144,6 +144,10 @@ init_test_cred(krb5_context context)
-     a->length = 2;
-     test_creds.authdata[1] = a;
- 
-+    memcpy(&test_creds2, &test_creds, sizeof(test_creds));
-+    kret = krb5_build_principal(context, &test_creds2.server, sizeof(REALM),
-+                                REALM, "server-comp1", "server-comp3", NULL);
-+
- cleanup:
-     if(kret) {
-         if (test_creds.client) {
-@@ -170,6 +174,7 @@ free_test_cred(krb5_context context)
-     krb5_free_principal(context, test_creds.client);
- 
-     krb5_free_principal(context, test_creds.server);
-+    krb5_free_principal(context, test_creds2.server);
- 
-     if(test_creds.authdata) {
-         krb5_free_authdata(context, test_creds.authdata);
-@@ -199,6 +204,44 @@ free_test_cred(krb5_context context)
- #define CHECK_FAIL(experr, kret, msg)           \
-     if (experr != kret) { CHECK(kret, msg);}
- 
-+static void
-+check_num_entries(krb5_context context, krb5_ccache cache, int expected,
-+                  unsigned linenum)
-+{
-+    krb5_error_code ret;
-+    krb5_cc_cursor cursor;
-+    krb5_creds creds;
-+    int count = 0;
-+
-+    ret = krb5_cc_start_seq_get(context, cache, &cursor);
-+    if (ret != 0) {
-+        com_err("", ret, "(on line %d) - krb5_cc_start_seq_get", linenum);
-+        fflush(stderr);
-+        exit(1);
-+    }
-+
-+    while (1) {
-+        ret = krb5_cc_next_cred(context, cache, &cursor, &creds);
-+        if (ret)
-+            break;
-+
-+        count++;
-+        krb5_free_cred_contents(context, &creds);
-+    }
-+    krb5_cc_end_seq_get(context, cache, &cursor);
-+    if (ret != KRB5_CC_END) {
-+        CHECK(ret, "counting entries in ccache");
-+    }
-+
-+    if (count != expected) {
-+        com_err("", KRB5_FCC_INTERNAL,
-+                "(on line %d) - count didn't match (expected %d, got %d)",
-+                linenum, expected, count);
-+        fflush(stderr);
-+        exit(1);
-+    }
-+}
-+
- static void
- cc_test(krb5_context context, const char *name, krb5_flags flags)
- {
-@@ -207,6 +250,7 @@ cc_test(krb5_context context, const char *name, krb5_flags flags)
-     krb5_error_code kret;
-     krb5_cc_cursor cursor;
-     krb5_principal tmp;
-+    krb5_flags matchflags = KRB5_TC_MATCH_IS_SKEY;
- 
-     const char *c_name;
-     char newcache[300];
-@@ -311,9 +355,90 @@ cc_test(krb5_context context, const char *name, krb5_flags flags)
-     kret = krb5_cc_destroy(context, id2);
-     CHECK(kret, "destroy id2");
- 
-+    /* ----------------------------------------------------- */
-+    /* Test credential removal */
-+    kret = krb5_cc_resolve(context, name, &id);
-+    CHECK(kret, "resolving for remove");
-+
-+    kret = krb5_cc_initialize(context, id, test_creds.client);
-+    CHECK(kret, "initialize for remove");
-+    check_num_entries(context, id, 0, __LINE__);
-+
-+    kret = krb5_cc_store_cred(context, id, &test_creds);
-+    CHECK(kret, "store for remove (first pass)");
-+    check_num_entries(context, id, 1, __LINE__); /* 1 */
-+
-+    kret = krb5_cc_remove_cred(context, id, matchflags, &test_creds);
-+    CHECK(kret, "removing credential (first pass)");
-+    check_num_entries(context, id, 0, __LINE__); /* empty */
-+
-+    kret = krb5_cc_store_cred(context, id, &test_creds);
-+    CHECK(kret, "first store for remove (second pass)");
-+    check_num_entries(context, id, 1, __LINE__); /* 1 */
-+
-+    kret = krb5_cc_store_cred(context, id, &test_creds2);
-+    CHECK(kret, "second store for remove (second pass)");
-+    check_num_entries(context, id, 2, __LINE__); /* 1, 2 */
-+
-+    kret = krb5_cc_remove_cred(context, id, matchflags, &test_creds2);
-+    CHECK(kret, "first remove (second pass)");
-+    check_num_entries(context, id, 1, __LINE__); /* 1 */
-+
-+    kret = krb5_cc_store_cred(context, id, &test_creds2);
-+    CHECK(kret, "third store for remove (second pass)");
-+    check_num_entries(context, id, 2, __LINE__); /* 1, 2 */
-+
-+    kret = krb5_cc_remove_cred(context, id, matchflags, &test_creds);
-+    CHECK(kret, "second remove (second pass)");
-+    check_num_entries(context, id, 1, __LINE__); /* 2 */
-+
-+    kret = krb5_cc_remove_cred(context, id, matchflags, &test_creds2);
-+    CHECK(kret, "third remove (second pass)");
-+    check_num_entries(context, id, 0, __LINE__); /* empty */
-+
-+    kret = krb5_cc_destroy(context, id);
-+    CHECK(kret, "destruction for remove");
-+
-+    /* Test removal with iteration. */
-+    kret = krb5_cc_resolve(context, name, &id);
-+    CHECK(kret, "resolving for remove-iter");
-+
-+    kret = krb5_cc_initialize(context, id, test_creds.client);
-+    CHECK(kret, "initialize for remove-iter");
-+
-+    kret = krb5_cc_store_cred(context, id, &test_creds);
-+    CHECK(kret, "first store for remove-iter");
-+
-+    kret = krb5_cc_store_cred(context, id, &test_creds2);
-+    CHECK(kret, "second store for remove-iter");
-+
-+    kret = krb5_cc_start_seq_get(context, id, &cursor);
-+    CHECK(kret, "start_seq_get for remove-iter");
-+
-+    kret = krb5_cc_remove_cred(context, id, matchflags, &test_creds);
-+    CHECK(kret, "remove for remove-iter");
-+
-+    while (1) {
-+        /* The removed credential may or may not be present in the cache -
-+         * either behavior is technically correct. */
-+        kret = krb5_cc_next_cred(context, id, &cursor, &creds);
-+        if (kret == KRB5_CC_END)
-+            break;
-+        CHECK(kret, "next_cred for remove-iter: %s");
-+
-+        CHECK(creds.times.endtime == 0, "no-lifetime cred");
-+
-+        krb5_free_cred_contents(context, &creds);
-+    }
-+
-+    kret = krb5_cc_end_seq_get(context, id, &cursor);
-+    CHECK(kret, "end_seq_get for remove-iter");
-+
-+    kret = krb5_cc_destroy(context, id);
-+    CHECK(kret, "destruction for remove-iter");
-+
-     free(save_type);
-     free_test_cred(context);
--
- }
- 
- /*
diff --git a/Improve-error-messages-from-kadmin-change_password.patch b/Improve-error-messages-from-kadmin-change_password.patch
deleted file mode 100644
index a656099..0000000
--- a/Improve-error-messages-from-kadmin-change_password.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From f9123277a5b4e27d5fea3dbae0889dcb527115fc Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Mon, 6 May 2019 13:13:16 -0400
-Subject: [PATCH] Improve error messages from kadmin change_password
-
-The checks for missing option arguments were dead code, because the
-loop condition requires at least two remaining arguments.  Instead
-check for at least one argument with a leading "-", and check for too
-many or too few arguments after the loop.  Add an initial message for
-unrecognized options.
-
-[ghudson@mit.edu: adjusted logic to improve mesages in more cases]
-
-(cherry picked from commit 13ba54002d362ebb09be464b4e7ec75050d1348f)
----
- src/kadmin/cli/kadmin.c | 12 ++++++++----
- 1 file changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/src/kadmin/cli/kadmin.c b/src/kadmin/cli/kadmin.c
-index cc74921bf..fe4cb493c 100644
---- a/src/kadmin/cli/kadmin.c
-+++ b/src/kadmin/cli/kadmin.c
-@@ -797,11 +797,11 @@ kadmin_cpw(int argc, char *argv[])
-     char **db_args = NULL;
-     int db_args_size = 0;
- 
--    if (argc < 2) {
-+    if (argc < 1) {
-         cpw_usage(NULL);
-         return;
-     }
--    for (argv++, argc--; argc > 1; argc--, argv++) {
-+    for (argv++, argc--; argc > 0 && **argv == '-'; argc--, argv++) {
-         if (!strcmp("-x", *argv)) {
-             argc--;
-             if (argc < 1) {
-@@ -841,12 +841,16 @@ kadmin_cpw(int argc, char *argv[])
-                 goto cleanup;
-             }
-         } else {
-+            com_err("change_password", 0, _("unrecognized option %s"), *argv);
-             cpw_usage(NULL);
-             goto cleanup;
-         }
-     }
--    if (*argv == NULL) {
--        com_err("change_password", 0, _("missing principal name"));
-+    if (argc != 1) {
-+        if (argc < 1)
-+            com_err("change_password", 0, _("missing principal name"));
-+        else
-+            com_err("change_password", 0, _("too many arguments"));
-         cpw_usage(NULL);
-         goto cleanup;
-     }
diff --git a/In-kpropd-debug-log-proper-ticket-enctype-names.patch b/In-kpropd-debug-log-proper-ticket-enctype-names.patch
deleted file mode 100644
index d7a9e67..0000000
--- a/In-kpropd-debug-log-proper-ticket-enctype-names.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 0e1c9fa82ea2a5f32a6ce937ffe9b1aef21e133e Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 15 Jan 2019 13:41:16 -0500
-Subject: [PATCH] In kpropd, debug-log proper ticket enctype names
-
-This change replaces the last call of krb5_enctype_to_string() in our
-sources with krb5_enctype_to_name(), ensuring that we log consistently
-to users using readily discoverable strings.
-
-(cherry picked from commit 30e12a2ecdf7e2a034a91626a03b5c9909e4c68d)
----
- src/kprop/kpropd.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c
-index 4cc035dc6..0c7bffa24 100644
---- a/src/kprop/kpropd.c
-+++ b/src/kprop/kpropd.c
-@@ -1279,7 +1279,8 @@ kerberos_authenticate(krb5_context context, int fd, krb5_principal *clientp,
-             exit(1);
-         }
- 
--        retval = krb5_enctype_to_string(*etype, etypebuf, sizeof(etypebuf));
-+        retval = krb5_enctype_to_name(*etype, FALSE, etypebuf,
-+                                      sizeof(etypebuf));
-         if (retval) {
-             com_err(progname, retval, _("while unparsing ticket etype"));
-             exit(1);
diff --git a/In-rd_req_dec-always-log-non-permitted-enctypes.patch b/In-rd_req_dec-always-log-non-permitted-enctypes.patch
deleted file mode 100644
index ce45dec..0000000
--- a/In-rd_req_dec-always-log-non-permitted-enctypes.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 92e46dabccaf7dfecfcb85bb87b773b734724ccb Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Mon, 14 Jan 2019 17:14:42 -0500
-Subject: [PATCH] In rd_req_dec, always log non-permitted enctypes
-
-The buffer specified in negotiate_etype() is too small for use with
-the AES enctypes when used with krb5_enctype_to_string(), so switch to
-using krb5_enctype_to_name().
-
-(cherry picked from commit bf75ebf583a51bf00005a96d17924818d19377be)
----
- src/lib/krb5/krb/rd_req_dec.c  | 5 ++---
- src/tests/gssapi/t_enctypes.py | 5 +++--
- 2 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/src/lib/krb5/krb/rd_req_dec.c b/src/lib/krb5/krb/rd_req_dec.c
-index 4cd429a11..e75192fee 100644
---- a/src/lib/krb5/krb/rd_req_dec.c
-+++ b/src/lib/krb5/krb/rd_req_dec.c
-@@ -864,9 +864,8 @@ negotiate_etype(krb5_context context,
-         if (permitted == FALSE) {
-             char enctype_name[30];
- 
--            if (krb5_enctype_to_string(desired_etypes[i],
--                                       enctype_name,
--                                       sizeof(enctype_name)) == 0)
-+            if (krb5_enctype_to_name(desired_etypes[i], FALSE, enctype_name,
-+                                     sizeof(enctype_name)) == 0)
-                 k5_setmsg(context, KRB5_NOPERM_ETYPE,
-                           _("Encryption type %s not permitted"), enctype_name);
-             return KRB5_NOPERM_ETYPE;
-diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
-index ee43ff028..5d9f80e04 100755
---- a/src/tests/gssapi/t_enctypes.py
-+++ b/src/tests/gssapi/t_enctypes.py
-@@ -85,7 +85,8 @@ test('both aes128', 'aes128-cts', 'aes128-cts',
- # If only the acceptor constrains the permitted session enctypes to
- # aes128, subkey negotiation fails because the acceptor considers the
- # aes256 session key to be non-permitted.
--test_err('acc aes128', None, 'aes128-cts', 'Encryption type not permitted')
-+test_err('acc aes128', None, 'aes128-cts',
-+         'Encryption type aes256-cts-hmac-sha1-96 not permitted')
- 
- # If the initiator constrains the permitted session enctypes to des3,
- # no acceptor subkey will be generated because we can't upgrade to a
-@@ -128,7 +129,7 @@ test('upgrade init des3+rc4', 'des3 rc4', None,
- # is only for the sake of the kernel, since we could upgrade to an
- # aes128 subkey, but it's the current semantics.)
- test_err('upgrade acc aes128', None, 'aes128-cts',
--         'Encryption type ArcFour with HMAC/md5 not permitted')
-+         'Encryption type arcfour-hmac not permitted')
- 
- # If the acceptor permits rc4 but prefers aes128, it will negotiate an
- # upgrade to aes128.
diff --git a/Initialize-life-rlife-in-kdcpolicy-interface.patch b/Initialize-life-rlife-in-kdcpolicy-interface.patch
deleted file mode 100644
index 6922f09..0000000
--- a/Initialize-life-rlife-in-kdcpolicy-interface.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From b448801a1ab19d89cc069e63f5ce5acbc9f3cd8d Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Fri, 9 Aug 2019 14:07:22 -0400
-Subject: [PATCH] Initialize life/rlife in kdcpolicy interface
-
-A value of 0 indicates that the plugin doesn't wish to modify lifetimes.
-Make this the default, rather than requiring all plugins to set these
-values themselves.
-
-ticket: 8824 (new)
-tags: pullup
-target_version: 1.17-next
-target_version: 1.16-next
-
-(cherry picked from commit d81c5870013240c04642c8e0cb994b4c49e40ddf)
----
- src/kdc/policy.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/kdc/policy.c b/src/kdc/policy.c
-index 26c16f97c..a3ff556c5 100644
---- a/src/kdc/policy.c
-+++ b/src/kdc/policy.c
-@@ -106,7 +106,7 @@ check_kdcpolicy_as(krb5_context context, const krb5_kdc_req *request,
-                    krb5_data *const *auth_indicators, krb5_timestamp kdc_time,
-                    krb5_ticket_times *times, const char **status)
- {
--    krb5_deltat life, rlife;
-+    krb5_deltat life = 0, rlife = 0;
-     krb5_error_code ret;
-     kdcpolicy_handle *hp, h;
-     char **ais = NULL;
-@@ -146,7 +146,7 @@ check_kdcpolicy_tgs(krb5_context context, const krb5_kdc_req *request,
-                     krb5_data *const *auth_indicators, krb5_timestamp kdc_time,
-                     krb5_ticket_times *times, const char **status)
- {
--    krb5_deltat life, rlife;
-+    krb5_deltat life = 0, rlife = 0;
-     krb5_error_code ret;
-     kdcpolicy_handle *hp, h;
-     char **ais = NULL;
diff --git a/Initialize-some-data-structure-magic-fields.patch b/Initialize-some-data-structure-magic-fields.patch
deleted file mode 100644
index 09f846c..0000000
--- a/Initialize-some-data-structure-magic-fields.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 0f05d25ddecba6d8dd5de5c1b2e31f45942b9a85 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 2 May 2019 13:36:38 -0400
-Subject: [PATCH] Initialize some data structure magic fields
-
-Static analyzers may complain if they see a data structure copied with
-an uninitialized field, even if the copy target won't use the field.
-Add magic field initializers in three such places.
-
-[ghudson@mit.edu: rewrote commit message]
-
-(cherry picked from commit 551e88e76e537e45f6c80eadaefeb790994f83f9)
----
- src/lib/gssapi/krb5/util_cksum.c | 1 +
- src/lib/krb5/krb/authdata.c      | 8 ++------
- 2 files changed, 3 insertions(+), 6 deletions(-)
-
-diff --git a/src/lib/gssapi/krb5/util_cksum.c b/src/lib/gssapi/krb5/util_cksum.c
-index cfd585ec7..a1770774e 100644
---- a/src/lib/gssapi/krb5/util_cksum.c
-+++ b/src/lib/gssapi/krb5/util_cksum.c
-@@ -48,6 +48,7 @@ kg_checksum_channel_bindings(context, cb, cksum)
- 
-     cksum->checksum_type = CKSUMTYPE_RSA_MD5;
-     cksum->length = sumlen;
-+    cksum->magic = KV5M_CHECKSUM;
- 
-     /* generate a buffer full of zeros if no cb specified */
- 
-diff --git a/src/lib/krb5/krb/authdata.c b/src/lib/krb5/krb/authdata.c
-index 7fbcfab68..3e7dfbe49 100644
---- a/src/lib/krb5/krb/authdata.c
-+++ b/src/lib/krb5/krb/authdata.c
-@@ -976,9 +976,7 @@ krb5_authdata_export_internal(krb5_context kcontext,
- 
-     *ptr = NULL;
- 
--    name.length = strlen(module_name);
--    name.data = (char *)module_name;
--
-+    name = make_data((char *)module_name, strlen(module_name));
-     module = k5_ad_find_module(kcontext, context, AD_USAGE_MASK, &name);
-     if (module == NULL)
-         return ENOENT;
-@@ -1005,9 +1003,7 @@ krb5_authdata_free_internal(krb5_context kcontext,
-     krb5_data name;
-     struct _krb5_authdata_context_module *module;
- 
--    name.length = strlen(module_name);
--    name.data = (char *)module_name;
--
-+    name = make_data((char *)module_name, strlen(module_name));
-     module = k5_ad_find_module(kcontext, context, AD_USAGE_MASK, &name);
-     if (module == NULL)
-         return ENOENT;
diff --git a/Make-etype-names-in-KDC-logs-human-readable.patch b/Make-etype-names-in-KDC-logs-human-readable.patch
deleted file mode 100644
index abf5c29..0000000
--- a/Make-etype-names-in-KDC-logs-human-readable.patch
+++ /dev/null
@@ -1,293 +0,0 @@
-From c955111643b4ef9a005a083d8f2aa39ec4af81ec Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 8 Jan 2019 17:42:35 -0500
-Subject: [PATCH] Make etype names in KDC logs human-readable
-
-Introduce enctype_name() as a wrapper over krb5_enctype_to_name for
-converting between registered constants and names.  Adjust signatures
-and rewrite ktypes2str() and rep_etypes2str() to operate on dynamic
-buffers.
-
-ticket: 8772 (new)
-(cherry picked from commit a649279727490687d54becad91fde8cf7429d951)
----
- src/kdc/kdc_log.c  |  42 +++++++--------
- src/kdc/kdc_util.c | 125 +++++++++++++++++++++++----------------------
- src/kdc/kdc_util.h |   6 +--
- 3 files changed, 87 insertions(+), 86 deletions(-)
-
-diff --git a/src/kdc/kdc_log.c b/src/kdc/kdc_log.c
-index 4eec50373..b160ba21a 100644
---- a/src/kdc/kdc_log.c
-+++ b/src/kdc/kdc_log.c
-@@ -65,7 +65,7 @@ log_as_req(krb5_context context,
- {
-     const char *fromstring = 0;
-     char fromstringbuf[70];
--    char ktypestr[128];
-+    char *ktypestr = NULL;
-     const char *cname2 = cname ? cname : "<unknown client>";
-     const char *sname2 = sname ? sname : "<unknown server>";
- 
-@@ -74,26 +74,29 @@ log_as_req(krb5_context context,
-                            fromstringbuf, sizeof(fromstringbuf));
-     if (!fromstring)
-         fromstring = "<unknown>";
--    ktypes2str(ktypestr, sizeof(ktypestr),
--               request->nktypes, request->ktype);
-+
-+    ktypestr = ktypes2str(request->ktype, request->nktypes);
- 
-     if (status == NULL) {
-         /* success */
--        char rep_etypestr[128];
--        rep_etypes2str(rep_etypestr, sizeof(rep_etypestr), reply);
-+        char *rep_etypestr = rep_etypes2str(reply);
-         krb5_klog_syslog(LOG_INFO, _("AS_REQ (%s) %s: ISSUE: authtime %u, %s, "
-                                      "%s for %s"),
--                         ktypestr, fromstring, (unsigned int)authtime,
--                         rep_etypestr, cname2, sname2);
-+                         ktypestr ? ktypestr : "", fromstring,
-+                         (unsigned int)authtime,
-+                         rep_etypestr ? rep_etypestr : "", cname2, sname2);
-+        free(rep_etypestr);
-     } else {
-         /* fail */
-         krb5_klog_syslog(LOG_INFO, _("AS_REQ (%s) %s: %s: %s for %s%s%s"),
--                         ktypestr, fromstring, status,
--                         cname2, sname2, emsg ? ", " : "", emsg ? emsg : "");
-+                         ktypestr ? ktypestr : "", fromstring, status, cname2,
-+                         sname2, emsg ? ", " : "", emsg ? emsg : "");
-     }
-     krb5_db_audit_as_req(context, request,
-                          local_addr->address, remote_addr->address,
-                          client, server, authtime, errcode);
-+
-+    free(ktypestr);
- }
- 
- /*
-@@ -122,10 +125,9 @@ log_tgs_req(krb5_context ctx, const krb5_fulladdr *from,
-             unsigned int c_flags,
-             const char *status, krb5_error_code errcode, const char *emsg)
- {
--    char ktypestr[128];
-+    char *ktypestr = NULL, *rep_etypestr = NULL;
-     const char *fromstring = 0;
-     char fromstringbuf[70];
--    char rep_etypestr[128];
-     char *cname = NULL, *sname = NULL, *altcname = NULL;
-     char *logcname = NULL, *logsname = NULL, *logaltcname = NULL;
- 
-@@ -134,11 +136,6 @@ log_tgs_req(krb5_context ctx, const krb5_fulladdr *from,
-                            fromstringbuf, sizeof(fromstringbuf));
-     if (!fromstring)
-         fromstring = "<unknown>";
--    ktypes2str(ktypestr, sizeof(ktypestr), request->nktypes, request->ktype);
--    if (!errcode)
--        rep_etypes2str(rep_etypestr, sizeof(rep_etypestr), reply);
--    else
--        rep_etypestr[0] = 0;
- 
-     unparse_and_limit(ctx, cprinc, &cname);
-     logcname = (cname != NULL) ? cname : "<unknown client>";
-@@ -151,10 +148,14 @@ log_tgs_req(krb5_context ctx, const krb5_fulladdr *from,
-        name (useful), and doesn't log ktypestr (probably not
-        important).  */
-     if (errcode != KRB5KDC_ERR_SERVER_NOMATCH) {
-+        ktypestr = ktypes2str(request->ktype, request->nktypes);
-+        rep_etypestr = rep_etypes2str(reply);
-         krb5_klog_syslog(LOG_INFO, _("TGS_REQ (%s) %s: %s: authtime %u, %s%s "
-                                      "%s for %s%s%s"),
--                         ktypestr, fromstring, status, (unsigned int)authtime,
--                         rep_etypestr, !errcode ? "," : "", logcname, logsname,
-+                         ktypestr ? ktypestr : "", fromstring, status,
-+                         (unsigned int)authtime,
-+                         rep_etypestr ? rep_etypestr : "",
-+                         !errcode ? "," : "", logcname, logsname,
-                          errcode ? ", " : "", errcode ? emsg : "");
-         if (isflagset(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION))
-             krb5_klog_syslog(LOG_INFO,
-@@ -171,9 +172,8 @@ log_tgs_req(krb5_context ctx, const krb5_fulladdr *from,
-                          fromstring, status, (unsigned int)authtime,
-                          logcname, logsname, logaltcname);
- 
--    /* OpenSolaris: audit_krb5kdc_tgs_req(...)  or
--       audit_krb5kdc_tgs_req_2ndtktmm(...) */
--
-+    free(rep_etypestr);
-+    free(ktypestr);
-     krb5_free_unparsed_name(ctx, cname);
-     krb5_free_unparsed_name(ctx, sname);
-     krb5_free_unparsed_name(ctx, altcname);
-diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
-index 0155c28c6..f5c581c82 100644
---- a/src/kdc/kdc_util.c
-+++ b/src/kdc/kdc_util.c
-@@ -1043,84 +1043,87 @@ void limit_string(char *name)
-     return;
- }
- 
--/*
-- * L10_2 = log10(2**x), rounded up; log10(2) ~= 0.301.
-- */
--#define L10_2(x) ((int)(((x * 301) + 999) / 1000))
-+/* Wrapper of krb5_enctype_to_name() to include the PKINIT types. */
-+static krb5_error_code
-+enctype_name(krb5_enctype ktype, char *buf, size_t buflen)
-+{
-+    char *name;
-+
-+    if (buflen == 0)
-+        return EINVAL;
-+    *buf = '\0'; /* ensure these are always valid C-strings */
-+
-+    /* rfc4556 recommends that clients wishing to indicate support for these
-+     * pkinit algorithms include them in the etype field of the AS-REQ. */
-+    if (ktype == ENCTYPE_DSA_SHA1_CMS)
-+        name = "id-dsa-with-sha1-CmsOID";
-+    else if (ktype == ENCTYPE_MD5_RSA_CMS)
-+        name = "md5WithRSAEncryption-CmsOID";
-+    else if (ktype == ENCTYPE_SHA1_RSA_CMS)
-+        name = "sha-1WithRSAEncryption-CmsOID";
-+    else if (ktype == ENCTYPE_RC2_CBC_ENV)
-+        name = "rc2-cbc-EnvOID";
-+    else if (ktype == ENCTYPE_RSA_ENV)
-+        name = "rsaEncryption-EnvOID";
-+    else if (ktype == ENCTYPE_RSA_ES_OAEP_ENV)
-+        name = "id-RSAES-OAEP-EnvOID";
-+    else if (ktype == ENCTYPE_DES3_CBC_ENV)
-+        name = "des-ede3-cbc-EnvOID";
-+    else
-+        return krb5_enctype_to_name(ktype, FALSE, buf, buflen);
- 
--/*
-- * Max length of sprintf("%ld") for an int of type T; includes leading
-- * minus sign and terminating NUL.
-- */
--#define D_LEN(t) (L10_2(sizeof(t) * CHAR_BIT) + 2)
-+    if (strlcpy(name, buf, buflen) >= buflen)
-+        return ENOMEM;
-+    return 0;
-+}
- 
--void
--ktypes2str(char *s, size_t len, int nktypes, krb5_enctype *ktype)
-+char *
-+ktypes2str(krb5_enctype *ktype, int nktypes)
- {
-+    struct k5buf buf;
-     int i;
--    char stmp[D_LEN(krb5_enctype) + 1];
--    char *p;
-+    char name[64];
- 
--    if (nktypes < 0
--        || len < (sizeof(" etypes {...}") + D_LEN(int))) {
--        *s = '\0';
--        return;
--    }
-+    if (nktypes < 0)
-+        return NULL;
- 
--    snprintf(s, len, "%d etypes {", nktypes);
-+    k5_buf_init_dynamic(&buf);
-+    k5_buf_add_fmt(&buf, "%d etypes {", nktypes);
-     for (i = 0; i < nktypes; i++) {
--        snprintf(stmp, sizeof(stmp), "%s%ld", i ? " " : "", (long)ktype[i]);
--        if (strlen(s) + strlen(stmp) + sizeof("}") > len)
--            break;
--        strlcat(s, stmp, len);
-+        enctype_name(ktype[i], name, sizeof(name));
-+        k5_buf_add_fmt(&buf, "%s%s(%ld)", i ? ", " : "", name, (long)ktype[i]);
-     }
--    if (i < nktypes) {
--        /*
--         * We broke out of the loop. Try to truncate the list.
--         */
--        p = s + strlen(s);
--        while (p - s + sizeof("...}") > len) {
--            while (p > s && *p != ' ' && *p != '{')
--                *p-- = '\0';
--            if (p > s && *p == ' ') {
--                *p-- = '\0';
--                continue;
--            }
--        }
--        strlcat(s, "...", len);
--    }
--    strlcat(s, "}", len);
--    return;
-+    k5_buf_add(&buf, "}");
-+    return buf.data;
- }
- 
--void
--rep_etypes2str(char *s, size_t len, krb5_kdc_rep *rep)
-+char *
-+rep_etypes2str(krb5_kdc_rep *rep)
- {
--    char stmp[sizeof("ses=") + D_LEN(krb5_enctype)];
--
--    if (len < (3 * D_LEN(krb5_enctype)
--               + sizeof("etypes {rep= tkt= ses=}"))) {
--        *s = '\0';
--        return;
--    }
-+    struct k5buf buf;
-+    char name[64];
-+    krb5_enctype etype;
- 
--    snprintf(s, len, "etypes {rep=%ld", (long)rep->enc_part.enctype);
-+    k5_buf_init_dynamic(&buf);
-+    k5_buf_add(&buf, "etypes {rep=");
-+    enctype_name(rep->enc_part.enctype, name, sizeof(name));
-+    k5_buf_add_fmt(&buf, "%s(%ld)", name, (long)rep->enc_part.enctype);
- 
-     if (rep->ticket != NULL) {
--        snprintf(stmp, sizeof(stmp),
--                 " tkt=%ld", (long)rep->ticket->enc_part.enctype);
--        strlcat(s, stmp, len);
-+        etype = rep->ticket->enc_part.enctype;
-+        enctype_name(etype, name, sizeof(name));
-+        k5_buf_add_fmt(&buf, ", tkt=%s(%ld)", name, (long)etype);
-     }
- 
--    if (rep->ticket != NULL
--        && rep->ticket->enc_part2 != NULL
--        && rep->ticket->enc_part2->session != NULL) {
--        snprintf(stmp, sizeof(stmp), " ses=%ld",
--                 (long)rep->ticket->enc_part2->session->enctype);
--        strlcat(s, stmp, len);
-+    if (rep->ticket != NULL && rep->ticket->enc_part2 != NULL &&
-+        rep->ticket->enc_part2->session != NULL) {
-+        etype = rep->ticket->enc_part2->session->enctype;
-+        enctype_name(etype, name, sizeof(name));
-+        k5_buf_add_fmt(&buf, ", ses=%s(%ld)", name, (long)etype);
-     }
--    strlcat(s, "}", len);
--    return;
-+
-+    k5_buf_add(&buf, "}");
-+    return buf.data;
- }
- 
- static krb5_error_code
-diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h
-index 6ec645fc3..25077cbf5 100644
---- a/src/kdc/kdc_util.h
-+++ b/src/kdc/kdc_util.h
-@@ -110,11 +110,9 @@ select_session_keytype (kdc_realm_t *kdc_active_realm,
- 
- void limit_string (char *name);
- 
--void
--ktypes2str(char *s, size_t len, int nktypes, krb5_enctype *ktype);
-+char *ktypes2str(krb5_enctype *ktype, int nktypes);
- 
--void
--rep_etypes2str(char *s, size_t len, krb5_kdc_rep *rep);
-+char *rep_etypes2str(krb5_kdc_rep *rep);
- 
- /* authind.c */
- krb5_boolean
diff --git a/Mark-deprecated-enctypes-when-used.patch b/Mark-deprecated-enctypes-when-used.patch
deleted file mode 100644
index a5f93ca..0000000
--- a/Mark-deprecated-enctypes-when-used.patch
+++ /dev/null
@@ -1,250 +0,0 @@
-From 945c21ddafbedfe57dfbf9ca3e7b0185cb4b7175 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 10 Jan 2019 16:34:54 -0500
-Subject: [PATCH] Mark deprecated enctypes when used
-
-Preface ETYPE_DEPRECATED enctypes with "DEPRECATED:" in klist output,
-KDC logs, and kadmin interactions.  Also complain in krb5kdc when the
-stash file has a deprecated enctype or a deprecated enctype is
-requested with -k.
-
-ticket: 8773 (new)
-(cherry picked from commit 8d8e68283b599e680f9fe45eff8af397e827bd6c)
----
- src/clients/klist/klist.c      | 14 ++++++++++----
- src/kadmin/cli/kadmin.c        |  6 +++++-
- src/kdc/kdc_util.c             |  9 +++++++++
- src/kdc/main.c                 | 19 +++++++++++++++++++
- src/tests/gssapi/t_enctypes.py | 15 +++++++++------
- src/tests/t_keyrollover.py     |  8 +++++---
- src/tests/t_sesskeynego.py     |  4 ++--
- 7 files changed, 59 insertions(+), 16 deletions(-)
-
-diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c
-index 70adb54e8..8c307151a 100644
---- a/src/clients/klist/klist.c
-+++ b/src/clients/klist/klist.c
-@@ -571,11 +571,17 @@ static char *
- etype_string(krb5_enctype enctype)
- {
-     static char buf[100];
--    krb5_error_code ret;
-+    char *bp = buf;
-+    size_t deplen, buflen = sizeof(buf);
- 
--    ret = krb5_enctype_to_name(enctype, FALSE, buf, sizeof(buf));
--    if (ret)
--        snprintf(buf, sizeof(buf), "etype %d", enctype);
-+    if (krb5int_c_deprecated_enctype(enctype)) {
-+        deplen = strlcpy(bp, "DEPRECATED:", buflen);
-+        buflen -= deplen;
-+        bp += deplen;
-+    }
-+
-+    if (krb5_enctype_to_name(enctype, FALSE, bp, buflen))
-+        snprintf(bp, buflen, "etype %d", enctype);
-     return buf;
- }
- 
-diff --git a/src/kadmin/cli/kadmin.c b/src/kadmin/cli/kadmin.c
-index ed581ee79..cc74921bf 100644
---- a/src/kadmin/cli/kadmin.c
-+++ b/src/kadmin/cli/kadmin.c
-@@ -1451,12 +1451,16 @@ kadmin_getprinc(int argc, char *argv[])
-         for (i = 0; i < dprinc.n_key_data; i++) {
-             krb5_key_data *key_data = &dprinc.key_data[i];
-             char enctype[BUFSIZ], salttype[BUFSIZ];
-+            char *deprecated = "";
- 
-             if (krb5_enctype_to_name(key_data->key_data_type[0], FALSE,
-                                      enctype, sizeof(enctype)))
-                 snprintf(enctype, sizeof(enctype), _("<Encryption type 0x%x>"),
-                          key_data->key_data_type[0]);
--            printf("Key: vno %d, %s", key_data->key_data_kvno, enctype);
-+            if (krb5int_c_deprecated_enctype(key_data->key_data_type[0]))
-+                deprecated = "DEPRECATED:";
-+            printf("Key: vno %d, %s%s", key_data->key_data_kvno, deprecated,
-+                   enctype);
-             if (key_data->key_data_ver > 1 &&
-                 key_data->key_data_type[1] != KRB5_KDB_SALTTYPE_NORMAL) {
-                 if (krb5_salttype_to_string(key_data->key_data_type[1],
-diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
-index f5c581c82..96c88edc1 100644
---- a/src/kdc/kdc_util.c
-+++ b/src/kdc/kdc_util.c
-@@ -1048,11 +1048,20 @@ static krb5_error_code
- enctype_name(krb5_enctype ktype, char *buf, size_t buflen)
- {
-     char *name;
-+    size_t len;
- 
-     if (buflen == 0)
-         return EINVAL;
-     *buf = '\0'; /* ensure these are always valid C-strings */
- 
-+    if (krb5int_c_deprecated_enctype(ktype)) {
-+        len = strlcpy(buf, "DEPRECATED:", buflen);
-+        if (len >= buflen)
-+            return ENOMEM;
-+        buflen -= len;
-+        buf += len;
-+    }
-+
-     /* rfc4556 recommends that clients wishing to indicate support for these
-      * pkinit algorithms include them in the etype field of the AS-REQ. */
-     if (ktype == ENCTYPE_DSA_SHA1_CMS)
-diff --git a/src/kdc/main.c b/src/kdc/main.c
-index 663fd6303..60092a0df 100644
---- a/src/kdc/main.c
-+++ b/src/kdc/main.c
-@@ -210,12 +210,23 @@ init_realm(kdc_realm_t * rdp, krb5_pointer aprof, char *realm,
-     char                *svalue = NULL;
-     const char          *hierarchy[4];
-     krb5_kvno       mkvno = IGNORE_VNO;
-+    char ename[32];
- 
-     memset(rdp, 0, sizeof(kdc_realm_t));
-     if (!realm) {
-         kret = EINVAL;
-         goto whoops;
-     }
-+
-+    if (def_enctype != ENCTYPE_UNKNOWN &&
-+        krb5int_c_deprecated_enctype(def_enctype)) {
-+        if (krb5_enctype_to_name(def_enctype, FALSE, ename, sizeof(ename)))
-+            ename[0] = '\0';
-+        fprintf(stderr,
-+                _("Requested master password enctype %s in %s is DEPRECATED!"),
-+                ename, realm);
-+    }
-+
-     hierarchy[0] = KRB5_CONF_REALMS;
-     hierarchy[1] = realm;
-     hierarchy[3] = NULL;
-@@ -370,6 +381,14 @@ init_realm(kdc_realm_t * rdp, krb5_pointer aprof, char *realm,
-         goto whoops;
-     }
- 
-+    if (krb5int_c_deprecated_enctype(rdp->realm_mkey.enctype)) {
-+        if (krb5_enctype_to_name(rdp->realm_mkey.enctype, FALSE, ename,
-+                                 sizeof(ename)))
-+            ename[0] = '\0';
-+        fprintf(stderr, _("Stash file %s uses DEPRECATED enctype %s!"),
-+                rdp->realm_stash, ename);
-+    }
-+
-     if ((kret = krb5_db_fetch_mkey_list(rdp->realm_context, rdp->realm_mprinc,
-                                         &rdp->realm_mkey))) {
-         kdc_err(rdp->realm_context, kret,
-diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py
-index 5d9f80e04..ca3d32d21 100755
---- a/src/tests/gssapi/t_enctypes.py
-+++ b/src/tests/gssapi/t_enctypes.py
-@@ -9,8 +9,11 @@ from k5test import *
- aes256 = 'aes256-cts-hmac-sha1-96'
- aes128 = 'aes128-cts-hmac-sha1-96'
- des3 = 'des3-cbc-sha1'
-+d_des3 = 'DEPRECATED:des3-cbc-sha1'
- des3raw = 'des3-cbc-raw'
-+d_des3raw = 'DEPRECATED:des3-cbc-raw'
- rc4 = 'arcfour-hmac'
-+d_rc4 = 'DEPRECATED:arcfour-hmac'
- 
- # These tests make assumptions about the default enctype lists, so set
- # them explicitly rather than relying on the library defaults.
-@@ -92,7 +95,7 @@ test_err('acc aes128', None, 'aes128-cts',
- # no acceptor subkey will be generated because we can't upgrade to a
- # CFX enctype.
- test('init des3', 'des3', None,
--     tktenc=aes256, tktsession=des3,
-+     tktenc=aes256, tktsession=d_des3,
-      proto='rfc1964', isubkey=des3raw, asubkey=None)
- 
- # Force the ticket session key to be rc4, so we can test some subkey
-@@ -103,7 +106,7 @@ realm.run([kadminl, 'setstr', realm.host_princ, 'session_enctypes', 'rc4'])
- # [aes256 aes128 des3] and the acceptor should upgrade to an aes256
- # subkey.
- test('upgrade noargs', None, None,
--     tktenc=aes256, tktsession=rc4,
-+     tktenc=aes256, tktsession=d_rc4,
-      proto='cfx', isubkey=rc4, asubkey=aes256)
- 
- # If the initiator won't permit rc4 as a session key, it won't be able
-@@ -113,14 +116,14 @@ test_err('upgrade init aes', 'aes', None, 'no support for encryption type')
- # If the initiator permits rc4 but prefers aes128, it will send an
- # upgrade list of [aes128] and the acceptor will upgrade to aes128.
- test('upgrade init aes128+rc4', 'aes128-cts rc4', None,
--     tktenc=aes256, tktsession=rc4,
-+     tktenc=aes256, tktsession=d_rc4,
-      proto='cfx', isubkey=rc4, asubkey=aes128)
- 
- # If the initiator permits rc4 but prefers des3, it will send an
- # upgrade list of [des3], but the acceptor won't generate a subkey
- # because des3 isn't a CFX enctype.
- test('upgrade init des3+rc4', 'des3 rc4', None,
--     tktenc=aes256, tktsession=rc4,
-+     tktenc=aes256, tktsession=d_rc4,
-      proto='rfc1964', isubkey=rc4, asubkey=None)
- 
- # If the acceptor permits only aes128, subkey negotiation will fail
-@@ -134,14 +137,14 @@ test_err('upgrade acc aes128', None, 'aes128-cts',
- # If the acceptor permits rc4 but prefers aes128, it will negotiate an
- # upgrade to aes128.
- test('upgrade acc aes128 rc4', None, 'aes128-cts rc4',
--     tktenc=aes256, tktsession=rc4,
-+     tktenc=aes256, tktsession=d_rc4,
-      proto='cfx', isubkey=rc4, asubkey=aes128)
- 
- # In this test, the initiator and acceptor each prefer an AES enctype
- # to rc4, but they can't agree on which one, so no subkey is
- # generated.
- test('upgrade mismatch', 'aes128-cts rc4', 'aes256-cts rc4',
--     tktenc=aes256, tktsession=rc4,
-+     tktenc=aes256, tktsession=d_rc4,
-      proto='rfc1964', isubkey=rc4, asubkey=None)
- 
- success('gss_krb5_set_allowable_enctypes tests')
-diff --git a/src/tests/t_keyrollover.py b/src/tests/t_keyrollover.py
-index 7c8d828f0..4af6804f2 100755
---- a/src/tests/t_keyrollover.py
-+++ b/src/tests/t_keyrollover.py
-@@ -22,8 +22,9 @@ realm.run([kvno, princ1])
- realm.run([kadminl, 'purgekeys', realm.krbtgt_princ])
- # Make sure an old TGT fails after purging old TGS key.
- realm.run([kvno, princ2], expected_code=1)
--msg = 'krbtgt/%s@%s\n\tEtype (skey, tkt): des-cbc-crc, des-cbc-crc' % \
--    (realm.realm, realm.realm)
-+ddes = "DEPRECATED:des-cbc-crc"
-+msg = 'krbtgt/%s@%s\n\tEtype (skey, tkt): %s, %s' % \
-+    (realm.realm, realm.realm, ddes, ddes)
- realm.run([klist, '-e'], expected_msg=msg)
- 
- # Check that new key actually works.
-@@ -48,7 +49,8 @@ realm.run([kadminl, 'cpw', '-randkey', '-keepold', '-e', 'aes256-cts',
-            realm.krbtgt_princ])
- realm.run([kadminl, 'modprinc', '-kvno', '1', realm.krbtgt_princ])
- out = realm.run([kadminl, 'getprinc', realm.krbtgt_princ])
--if 'vno 1, aes256' not in out or 'vno 1, des3' not in out:
-+if 'vno 1, aes256-cts' not in out or \
-+   'vno 1, DEPRECATED:des3-cbc-sha1' not in out:
-     fail('keyrollover: setup for TGS enctype test failed')
- # Now present the DES3 ticket to the KDC and make sure it's rejected.
- realm.run([kvno, realm.host_princ], expected_code=1)
-diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py
-index 448092387..da02f224a 100755
---- a/src/tests/t_sesskeynego.py
-+++ b/src/tests/t_sesskeynego.py
-@@ -62,11 +62,11 @@ test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96')
- # 3b: Negotiate rc4-hmac session key when principal only has aes256 long-term.
- realm.run([kadminl, 'setstr', 'server', 'session_enctypes',
-            'rc4-hmac,aes128-cts,aes256-cts'])
--test_kvno(realm, 'arcfour-hmac', 'aes256-cts-hmac-sha1-96')
-+test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
- 
- # 3c: Test des-cbc-crc default assumption.
- realm.run([kadminl, 'delstr', 'server', 'session_enctypes'])
--test_kvno(realm, 'des-cbc-crc', 'aes256-cts-hmac-sha1-96')
-+test_kvno(realm, 'DEPRECATED:des-cbc-crc', 'aes256-cts-hmac-sha1-96')
- realm.stop()
- 
- # Last go: test that we can disable the des-cbc-crc assumption
diff --git a/Mark-the-doc-kadm5-tex-files-as-historic.patch b/Mark-the-doc-kadm5-tex-files-as-historic.patch
deleted file mode 100644
index 1956a98..0000000
--- a/Mark-the-doc-kadm5-tex-files-as-historic.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From b68ee166602b787c5acabe3d1b4780e527d672a7 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 11 Apr 2019 18:33:04 -0400
-Subject: [PATCH] Mark the doc/kadm5 tex files as historic
-
-Remove rcsid.sty and the uses of the \rcsId macro as git does not
-perform the keyword expansion necessary to make it work.  Add comments
-indicating the historic status of the kadm5 documentation.
-
-[ghudson@mit.edu: fix the tex files instead of marking them as
-non-building]
-
-(cherry picked from commit e6047bdd6dec0d104417f9a1318bbafe022b81c1)
----
- doc/kadm5/adb-unit-test.tex     | 7 ++++---
- doc/kadm5/api-funcspec.tex      | 9 +++++----
- doc/kadm5/api-server-design.tex | 9 +++++----
- doc/kadm5/api-unit-test.tex     | 7 ++++---
- doc/kadm5/rcsid.sty             | 5 -----
- 5 files changed, 18 insertions(+), 19 deletions(-)
- delete mode 100644 doc/kadm5/rcsid.sty
-
-diff --git a/doc/kadm5/adb-unit-test.tex b/doc/kadm5/adb-unit-test.tex
-index d401342df..987af1a5e 100644
---- a/doc/kadm5/adb-unit-test.tex
-+++ b/doc/kadm5/adb-unit-test.tex
-@@ -1,6 +1,7 @@
--\documentstyle[times,fullpage,rcsid]{article}
-+% This document is included for historical purposes only, and does not
-+% apply to krb5 today.
- 
--\rcs$Id$
-+\documentstyle[times,fullpage]{article}
- 
- %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
- %% Make _ actually generate an _, and allow line-breaking after it.
-@@ -39,7 +40,7 @@
- %\newcommand{\Priority}[1]{}
- 
- \title{OpenV*Secure Admin Database API\\
--Unit Test Description\footnote{\rcsId}}
-+Unit Test Description}
- \author{Jonathan I. Kamens}
- 
- \begin{document}
-diff --git a/doc/kadm5/api-funcspec.tex b/doc/kadm5/api-funcspec.tex
-index c13090a51..76d2bb5d0 100644
---- a/doc/kadm5/api-funcspec.tex
-+++ b/doc/kadm5/api-funcspec.tex
-@@ -1,4 +1,7 @@
--\documentstyle[12pt,fullpage,rcsid]{article}
-+% This document is included for historical purposes only, and does not
-+% apply to krb5 today.
-+
-+\documentstyle[12pt,fullpage]{article}
- 
- %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
- %% Make _ actually generate an _, and allow line-breaking after it.
-@@ -7,15 +10,13 @@
- \def_{\underscore\penalty75\relax}
- %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
- 
--\rcs$Id$
--
- \setlength{\parskip}{.7\baselineskip}
- \setlength{\parindent}{0pt}
- 
- \def\v#1{\verb+#1+}
- 
- \title{Kerberos Administration System \\
--        KADM5 API Functional Specifications\thanks{\rcsId}}
-+        KADM5 API Functional Specifications}
- \author{Barry Jaspan}
- 
- \begin{document}
-diff --git a/doc/kadm5/api-server-design.tex b/doc/kadm5/api-server-design.tex
-index 228e83113..94e05b877 100644
---- a/doc/kadm5/api-server-design.tex
-+++ b/doc/kadm5/api-server-design.tex
-@@ -1,4 +1,7 @@
--\documentstyle[12pt,fullpage,rcsid]{article}
-+% This document is included for historical purposes only, and does not
-+% apply to krb5 today.
-+
-+\documentstyle[12pt,fullpage]{article}
- 
- %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
- %% Make _ actually generate an _, and allow line-breaking after it.
-@@ -7,15 +10,13 @@
- \def_{\underscore\penalty75\relax}
- %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
- 
--\rcs$Id$
--
- \setlength{\parskip}{.7\baselineskip}
- \setlength{\parindent}{0pt}
- 
- \def\v#1{\verb+#1+}
- \def\k#1{K$_#1$}
- 
--\title{KADM5 Library and Server \\ Implementation Design\thanks{\rcsId}}
-+\title{KADM5 Library and Server \\ Implementation Design}
- \author{Barry Jaspan}
- 
- \begin{document}
-diff --git a/doc/kadm5/api-unit-test.tex b/doc/kadm5/api-unit-test.tex
-index 3e0eb503e..bfd6280bb 100644
---- a/doc/kadm5/api-unit-test.tex
-+++ b/doc/kadm5/api-unit-test.tex
-@@ -1,6 +1,7 @@
--\documentstyle[times,fullpage,rcsid]{article}
-+% This document is included for historical purposes only, and does not
-+% apply to krb5 today.
- 
--\rcs$Id$
-+\documentstyle[times,fullpage]{article}
- 
- %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
- %% Make _ actually generate an _, and allow line-breaking after it.
-@@ -41,7 +42,7 @@
- %\newcommand{\Priority}[1]{}
- 
- \title{KADM5 Admin API\\
--Unit Test Description\footnote{\rcsId}}
-+Unit Test Description}
- \author{Jonathan I. Kamens}
- 
- \begin{document}
-diff --git a/doc/kadm5/rcsid.sty b/doc/kadm5/rcsid.sty
-deleted file mode 100644
-index 3ad7826ff..000000000
---- a/doc/kadm5/rcsid.sty
-+++ /dev/null
-@@ -1,5 +0,0 @@
--\def\rcs$#1: #2${\expandafter\def\csname rcs#1\endcsname{#2}}
--
--% example usage:
--% \rcs$Version$
--% Version \rcsVersion
diff --git a/Modernize-example-enctypes-in-documentation.patch b/Modernize-example-enctypes-in-documentation.patch
deleted file mode 100644
index a94494e..0000000
--- a/Modernize-example-enctypes-in-documentation.patch
+++ /dev/null
@@ -1,231 +0,0 @@
-From eb4fb8cb24e6cac194acc2c507b334658fc5431d Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 11 Apr 2019 18:25:41 -0400
-Subject: [PATCH] Modernize example enctypes in documentation
-
-ticket: 8805 (new)
-(cherry picked from commit ccb4a3e4b35fa9ea63af0e98a42eba4aadb099e2)
----
- doc/admin/admin_commands/kadmin_local.rst     |  8 ++++----
- doc/admin/admin_commands/kdb5_util.rst        | 10 +++++-----
- doc/admin/database.rst                        |  2 +-
- doc/admin/install_appl_srv.rst                | 19 +++++++------------
- doc/admin/install_kdc.rst                     |  2 +-
- src/man/kadmin.man                            | 10 +++++-----
- src/man/kdb5_util.man                         | 10 +++++-----
- .../kdb/ldap/libkdb_ldap/kerberos.ldif        |  4 ++--
- .../kdb/ldap/libkdb_ldap/kerberos.schema      |  4 ++--
- 9 files changed, 32 insertions(+), 37 deletions(-)
-
-diff --git a/doc/admin/admin_commands/kadmin_local.rst b/doc/admin/admin_commands/kadmin_local.rst
-index 150da1fad..71aa894f6 100644
---- a/doc/admin/admin_commands/kadmin_local.rst
-+++ b/doc/admin/admin_commands/kadmin_local.rst
-@@ -569,16 +569,16 @@ Examples::
-     Principal: tlyu/admin@BLEEP.COM
-     Expiration date: [never]
-     Last password change: Mon Aug 12 14:16:47 EDT 1996
--    Password expiration date: [none]
-+    Password expiration date: [never]
-     Maximum ticket life: 0 days 10:00:00
-     Maximum renewable life: 7 days 00:00:00
-     Last modified: Mon Aug 12 14:16:47 EDT 1996 (bjaspan/admin@BLEEP.COM)
-     Last successful authentication: [never]
-     Last failed authentication: [never]
-     Failed password attempts: 0
--    Number of keys: 2
--    Key: vno 1, des-cbc-crc
--    Key: vno 1, des-cbc-crc:v4
-+    Number of keys: 1
-+    Key: vno 1, aes256-cts-hmac-sha384-192
-+    MKey: vno 1
-     Attributes:
-     Policy: [none]
- 
-diff --git a/doc/admin/admin_commands/kdb5_util.rst b/doc/admin/admin_commands/kdb5_util.rst
-index 7dd54f797..444c58bcd 100644
---- a/doc/admin/admin_commands/kdb5_util.rst
-+++ b/doc/admin/admin_commands/kdb5_util.rst
-@@ -476,17 +476,17 @@ Examples::
-     $ kdb5_util tabdump -o keyinfo.txt keyinfo
-     $ cat keyinfo.txt
-     name	keyindex	kvno	enctype	salttype	salt
-+    K/M@EXAMPLE.COM	0	1	aes256-cts-hmac-sha384-192	normal	-1
-     foo@EXAMPLE.COM	0	1	aes128-cts-hmac-sha1-96	normal	-1
-     bar@EXAMPLE.COM	0	1	aes128-cts-hmac-sha1-96	normal	-1
--    bar@EXAMPLE.COM	1	1	des-cbc-crc	normal	-1
-     $ sqlite3
-     sqlite> .mode tabs
-     sqlite> .import keyinfo.txt keyinfo
--    sqlite> select * from keyinfo where enctype like 'des-cbc-%';
--    bar@EXAMPLE.COM	1	1	des-cbc-crc	normal	-1
-+    sqlite> select * from keyinfo where enctype like 'aes256-%';
-+    K/M@EXAMPLE.COM	1	1	aes256-cts-hmac-sha384-192	normal	-1
-     sqlite> .quit
--    $ awk -F'\t' '$4 ~ /des-cbc-/ { print }' keyinfo.txt
--    bar@EXAMPLE.COM	1	1	des-cbc-crc	normal	-1
-+    $ awk -F'\t' '$4 ~ /aes256-/ { print }' keyinfo.txt
-+    K/M@EXAMPLE.COM	1	1	aes256-cts-hmac-sha384-192	normal	-1
- 
- 
- ENVIRONMENT
-diff --git a/doc/admin/database.rst b/doc/admin/database.rst
-index 113a680a6..0eb5ccde7 100644
---- a/doc/admin/database.rst
-+++ b/doc/admin/database.rst
-@@ -483,7 +483,7 @@ availability.  To roll over the master key, follow these steps:
- 
-     $ kdb5_util list_mkeys
-     Master keys for Principal: K/M@KRBTEST.COM
--    KVNO: 1, Enctype: des-cbc-crc, Active on: Wed Dec 31 19:00:00 EST 1969 *
-+    KVNO: 1, Enctype: aes256-cts-hmac-sha384-192, Active on: Thu Jan 01 00:00:00 UTC 1970 *
- 
- #. On the master KDC, run ``kdb5_util use_mkey 1`` to ensure that a
-    master key activation list is present in the database.  This step
-diff --git a/doc/admin/install_appl_srv.rst b/doc/admin/install_appl_srv.rst
-index 6bae7248f..6b2d8e471 100644
---- a/doc/admin/install_appl_srv.rst
-+++ b/doc/admin/install_appl_srv.rst
-@@ -44,18 +44,13 @@ pop, the administrator ``joeadmin`` would issue the command (on
- ``trillium.mit.edu``)::
- 
-     trillium% kadmin
--    kadmin5: ktadd host/trillium.mit.edu ftp/trillium.mit.edu
--        pop/trillium.mit.edu
--    kadmin: Entry for principal host/trillium.mit.edu@ATHENA.MIT.EDU with
--        kvno 3, encryption type DES-CBC-CRC added to keytab
--        FILE:/etc/krb5.keytab.
--    kadmin: Entry for principal ftp/trillium.mit.edu@ATHENA.MIT.EDU with
--        kvno 3, encryption type DES-CBC-CRC added to keytab
--        FILE:/etc/krb5.keytab.
--    kadmin: Entry for principal pop/trillium.mit.edu@ATHENA.MIT.EDU with
--        kvno 3, encryption type DES-CBC-CRC added to keytab
--        FILE:/etc/krb5.keytab.
--    kadmin5: quit
-+    Authenticating as principal root/admin@ATHENA.MIT.EDU with password.
-+    Password for root/admin@ATHENA.MIT.EDU:
-+    kadmin: ktadd host/trillium.mit.edu ftp/trillium.mit.edu pop/trillium.mit.edu
-+    Entry for principal host/trillium.mit.edu@ATHENA.MIT.EDU with kvno 3, encryption type aes256-cts-hmac-sha384-192 added to keytab FILE:/etc/krb5.keytab.
-+    kadmin: Entry for principal ftp/trillium.mit.edu@ATHENA.MIT.EDU with kvno 3, encryption type aes256-cts-hmac-sha384-192 added to keytab FILE:/etc/krb5.keytab.
-+    kadmin: Entry for principal pop/trillium.mit.edu@ATHENA.MIT.EDU with kvno 3, encryption type aes256-cts-hmac-sha384-192 added to keytab FILE:/etc/krb5.keytab.
-+    kadmin: quit
-     trillium%
- 
- If you generate the keytab file on another host, you need to get a
-diff --git a/doc/admin/install_kdc.rst b/doc/admin/install_kdc.rst
-index 5d1e70ede..3bec59f96 100644
---- a/doc/admin/install_kdc.rst
-+++ b/doc/admin/install_kdc.rst
-@@ -340,7 +340,7 @@ To extract a keytab directly on a replica KDC called
-     Entry for principal host/kerberos-1.mit.edu with kvno 2, encryption
-         type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
-     Entry for principal host/kerberos-1.mit.edu with kvno 2, encryption
--        type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab.
-+        type aes256-cts-hmac-sha384-192 added to keytab FILE:/etc/krb5.keytab.
-     Entry for principal host/kerberos-1.mit.edu with kvno 2, encryption
-         type arcfour-hmac added to keytab FILE:/etc/krb5.keytab.
- 
-diff --git a/src/man/kadmin.man b/src/man/kadmin.man
-index 849677258..44859a378 100644
---- a/src/man/kadmin.man
-+++ b/src/man/kadmin.man
-@@ -1,6 +1,6 @@
- .\" Man page generated from reStructuredText.
- .
--.TH "KADMIN" "1" " " "1.17" "MIT Kerberos"
-+.TH "KADMIN" "1" " " "1.18" "MIT Kerberos"
- .SH NAME
- kadmin \- Kerberos V5 database administration program
- .
-@@ -610,16 +610,16 @@ kadmin: getprinc tlyu/admin
- Principal: tlyu/admin@BLEEP.COM
- Expiration date: [never]
- Last password change: Mon Aug 12 14:16:47 EDT 1996
--Password expiration date: [none]
-+Password expiration date: [never]
- Maximum ticket life: 0 days 10:00:00
- Maximum renewable life: 7 days 00:00:00
- Last modified: Mon Aug 12 14:16:47 EDT 1996 (bjaspan/admin@BLEEP.COM)
- Last successful authentication: [never]
- Last failed authentication: [never]
- Failed password attempts: 0
--Number of keys: 2
--Key: vno 1, des\-cbc\-crc
--Key: vno 1, des\-cbc\-crc:v4
-+Number of keys: 1
-+Key: vno 1, aes256\-cts\-hmac\-sha384\-192
-+MKey: vno 1
- Attributes:
- Policy: [none]
- 
-diff --git a/src/man/kdb5_util.man b/src/man/kdb5_util.man
-index 9a36ef0df..46772a236 100644
---- a/src/man/kdb5_util.man
-+++ b/src/man/kdb5_util.man
-@@ -529,17 +529,17 @@ Examples:
- $ kdb5_util tabdump \-o keyinfo.txt keyinfo
- $ cat keyinfo.txt
- name        keyindex        kvno    enctype salttype        salt
-+K/M@EXAMPLE.COM     0       1       aes256\-cts\-hmac\-sha384\-192      normal  \-1
- foo@EXAMPLE.COM     0       1       aes128\-cts\-hmac\-sha1\-96 normal  \-1
- bar@EXAMPLE.COM     0       1       aes128\-cts\-hmac\-sha1\-96 normal  \-1
--bar@EXAMPLE.COM     1       1       des\-cbc\-crc     normal  \-1
- $ sqlite3
- sqlite> .mode tabs
- sqlite> .import keyinfo.txt keyinfo
--sqlite> select * from keyinfo where enctype like \(aqdes\-cbc\-%\(aq;
--bar@EXAMPLE.COM     1       1       des\-cbc\-crc     normal  \-1
-+sqlite> select * from keyinfo where enctype like \(aqaes256\-%\(aq;
-+K/M@EXAMPLE.COM     1       1       aes256\-cts\-hmac\-sha384\-192      normal  \-1
- sqlite> .quit
--$ awk \-F\(aq\et\(aq \(aq$4 ~ /des\-cbc\-/ { print }\(aq keyinfo.txt
--bar@EXAMPLE.COM     1       1       des\-cbc\-crc     normal  \-1
-+$ awk \-F\(aq\et\(aq \(aq$4 ~ /aes256\-/ { print }\(aq keyinfo.txt
-+K/M@EXAMPLE.COM     1       1       aes256\-cts\-hmac\-sha384\-192      normal  \-1
- .ft P
- .fi
- .UNINDENT
-diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif b/src/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif
-index 13db48609..4224f0850 100644
---- a/src/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif
-+++ b/src/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif
-@@ -512,7 +512,7 @@ attributetypes: ( 2.16.840.1.113719.1.301.4.41.1
- 
- ##### Holds the default encryption/salt type combinations of principals for
- ##### the Realm. Stores in the form of key:salt strings.
--##### Example: des-cbc-crc:normal
-+##### Example: aes256-cts-hmac-sha384-192:normal
- 
- dn: cn=schema
- changetype: modify
-@@ -533,7 +533,7 @@ attributetypes: ( 2.16.840.1.113719.1.301.4.42.1
- ##### ONLYREALM       
- ##### SPECIAL         
- ##### AFS3            
--##### Example: des-cbc-crc:normal
-+##### Example: aes256-cts-hmac-sha384-192:normal
- #####
- ##### This attribute obsoletes the krbSupportedEncTypes and krbSupportedSaltTypes
- ##### attributes.
-diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema b/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema
-index 52036a178..171f66927 100644
---- a/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema
-+++ b/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema
-@@ -410,7 +410,7 @@ attributetype ( 2.16.840.1.113719.1.301.4.41.1
- ##### Holds the default encryption/salt type combinations of principals for
- ##### the Realm. Stores in the form of key:salt strings. This will be
- ##### subset of the supported encryption/salt types.
--##### Example: des-cbc-crc:normal
-+##### Example: aes256-cts-hmac-sha384-192:normal
- 
- attributetype ( 2.16.840.1.113719.1.301.4.42.1
-                 NAME 'krbDefaultEncSaltTypes'
-@@ -428,7 +428,7 @@ attributetype ( 2.16.840.1.113719.1.301.4.42.1
- ##### ONLYREALM       
- ##### SPECIAL         
- ##### AFS3            
--##### Example: des-cbc-crc:normal
-+##### Example: aes256-cts-hmac-sha384-192:normal
- 
- attributetype ( 2.16.840.1.113719.1.301.4.43.1
-                 NAME 'krbSupportedEncSaltTypes'
diff --git a/Modernize-exit-path-in-gss_krb5int_copy_ccache.patch b/Modernize-exit-path-in-gss_krb5int_copy_ccache.patch
deleted file mode 100644
index 83c6526..0000000
--- a/Modernize-exit-path-in-gss_krb5int_copy_ccache.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From b3ccfda0de6a9dd1248d9b15f31819421e36848e Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 2 May 2019 14:32:33 -0400
-Subject: [PATCH] Modernize exit path in gss_krb5int_copy_ccache()
-
-Move to a single lock / single unlock paradigm, and eliminate some
-dead code in the old error handling.
-
-(cherry picked from commit 1b89e3d8e949f52901bce74c9afc7a1a64099520)
----
- src/lib/gssapi/krb5/copy_ccache.c | 31 ++++++++++++-------------------
- 1 file changed, 12 insertions(+), 19 deletions(-)
-
-diff --git a/src/lib/gssapi/krb5/copy_ccache.c b/src/lib/gssapi/krb5/copy_ccache.c
-index 027ed4847..2b2806e70 100644
---- a/src/lib/gssapi/krb5/copy_ccache.c
-+++ b/src/lib/gssapi/krb5/copy_ccache.c
-@@ -9,7 +9,7 @@ gss_krb5int_copy_ccache(OM_uint32 *minor_status,
- {
-     krb5_gss_cred_id_t k5creds;
-     krb5_error_code code;
--    krb5_context context;
-+    krb5_context context = NULL;
-     krb5_ccache out_ccache;
- 
-     assert(value->length == sizeof(out_ccache));
-@@ -23,30 +23,23 @@ gss_krb5int_copy_ccache(OM_uint32 *minor_status,
-     k5creds = (krb5_gss_cred_id_t) *cred_handle;
-     k5_mutex_lock(&k5creds->lock);
-     if (k5creds->usage == GSS_C_ACCEPT) {
--        k5_mutex_unlock(&k5creds->lock);
--        *minor_status = (OM_uint32) G_BAD_USAGE;
--        return(GSS_S_FAILURE);
-+        code = G_BAD_USAGE;
-+        goto cleanup;
-     }
- 
-     code = krb5_gss_init_context(&context);
--    if (code) {
--        k5_mutex_unlock(&k5creds->lock);
--        *minor_status = code;
--        return GSS_S_FAILURE;
--    }
-+    if (code)
-+        goto cleanup;
- 
-     code = krb5_cc_copy_creds(context, k5creds->ccache, out_ccache);
--    if (code) {
--        k5_mutex_unlock(&k5creds->lock);
--        *minor_status = code;
--        save_error_info(*minor_status, context);
--        krb5_free_context(context);
--        return(GSS_S_FAILURE);
--    }
-+
-+cleanup:
-     k5_mutex_unlock(&k5creds->lock);
-     *minor_status = code;
--    if (code)
--        save_error_info(*minor_status, context);
--    krb5_free_context(context);
-+    if (context != NULL) {
-+        if (code)
-+            save_error_info(*minor_status, context);
-+        krb5_free_context(context);
-+    }
-     return code ? GSS_S_FAILURE : GSS_S_COMPLETE;
- }
diff --git a/Properly-size-ifdef-in-k5_cccol_lock.patch b/Properly-size-ifdef-in-k5_cccol_lock.patch
deleted file mode 100644
index ede89ef..0000000
--- a/Properly-size-ifdef-in-k5_cccol_lock.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 4b087e84f6c399df56143eca50858c185d31633f Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 14 Feb 2019 11:50:35 -0500
-Subject: [PATCH] Properly size #ifdef in k5_cccol_lock()
-
-The cleanup code only could get executed in the USE_CCAPI_V3 case, so
-move it inside that block.  Reported by Coverity.
-
-(cherry picked from commit 444a15f9cf82b9a6c1bca3f20307f82fee91c228)
----
- src/lib/krb5/ccache/ccbase.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/lib/krb5/ccache/ccbase.c b/src/lib/krb5/ccache/ccbase.c
-index 8198f2b9b..2702bef69 100644
---- a/src/lib/krb5/ccache/ccbase.c
-+++ b/src/lib/krb5/ccache/ccbase.c
-@@ -511,7 +511,6 @@ krb5_cccol_lock(krb5_context context)
- #endif
- #ifdef USE_CCAPI_V3
-     ret = krb5_stdccv3_context_lock(context);
--#endif
-     if (ret) {
-         k5_cc_mutex_unlock(context, &krb5int_mcc_mutex);
-         k5_cc_mutex_unlock(context, &krb5int_cc_file_mutex);
-@@ -519,6 +518,7 @@ krb5_cccol_lock(krb5_context context)
-         k5_cc_mutex_unlock(context, &cccol_lock);
-         return ret;
-     }
-+#endif
-     k5_mutex_unlock(&cc_typelist_lock);
-     return ret;
- }
diff --git a/Remove-Kerberos-v4-support-vestiges-from-ccapi.patch b/Remove-Kerberos-v4-support-vestiges-from-ccapi.patch
deleted file mode 100644
index 334ecff..0000000
--- a/Remove-Kerberos-v4-support-vestiges-from-ccapi.patch
+++ /dev/null
@@ -1,1606 +0,0 @@
-From 275df1b1b846a66c966a8108ba3b4d148f68ef6f Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 4 Apr 2019 14:37:38 -0400
-Subject: [PATCH] Remove Kerberos v4 support vestiges from ccapi
-
-(cherry picked from commit 51395dc956ce9eef27c0d6843561d3d3828b03cd)
----
- src/ccapi/common/cci_cred_union.c      | 280 +------------------------
- src/ccapi/lib/ccapi_v2.c               |  34 +--
- src/ccapi/lib/win/OldCC/ccapi.h        |  20 --
- src/ccapi/server/ccs_ccache.c          |  69 +-----
- src/ccapi/test/test_ccapi_ccache.c     | 227 +++-----------------
- src/ccapi/test/test_ccapi_constants.c  |   2 -
- src/ccapi/test/test_ccapi_context.c    |   3 -
- src/ccapi/test/test_ccapi_v2.c         |  89 --------
- src/include/CredentialsCache.h         | 156 ++++----------
- src/include/CredentialsCache2.h        |  26 +--
- src/lib/krb5/ccache/ccapi/stdcc.c      |   2 -
- src/lib/krb5/ccache/ccapi/stdcc_util.c |   8 +-
- src/windows/kfwlogon/kfwlogon.h        |   2 +-
- src/windows/leashdll/leash-int.h       |   2 +-
- src/windows/lib/cacheapi.h             |  53 +----
- 15 files changed, 100 insertions(+), 873 deletions(-)
-
-diff --git a/src/ccapi/common/cci_cred_union.c b/src/ccapi/common/cci_cred_union.c
-index 4c8981610..424a93dab 100644
---- a/src/ccapi/common/cci_cred_union.c
-+++ b/src/ccapi/common/cci_cred_union.c
-@@ -25,181 +25,6 @@
- 
- #include "cci_common.h"
- 
--#ifdef TARGET_OS_MAC
--#pragma mark -
--#endif
--
--/* ------------------------------------------------------------------------ */
--
--static cc_uint32 cci_credentials_v4_release (cc_credentials_v4_t *io_v4creds)
--{
--    cc_int32 err = ccNoError;
--
--    if (!io_v4creds) { err = ccErrBadParam; }
--
--    if (!err) {
--        memset (io_v4creds, 0, sizeof (*io_v4creds));
--        free (io_v4creds);
--    }
--
--    return err;
--}
--
--/* ------------------------------------------------------------------------ */
--
--static cc_uint32 cci_credentials_v4_read (cc_credentials_v4_t **out_v4creds,
--                                          k5_ipc_stream          io_stream)
--{
--    cc_int32 err = ccNoError;
--    cc_credentials_v4_t *v4creds = NULL;
--
--    if (!io_stream  ) { err = cci_check_error (ccErrBadParam); }
--    if (!out_v4creds) { err = cci_check_error (ccErrBadParam); }
--
--    if (!err) {
--        v4creds = malloc (sizeof (*v4creds));
--        if (!v4creds) { err = cci_check_error (ccErrNoMem); }
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read_uint32 (io_stream, &v4creds->version);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read (io_stream, v4creds->principal, cc_v4_name_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read (io_stream, v4creds->principal_instance, cc_v4_instance_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read (io_stream, v4creds->service, cc_v4_name_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read (io_stream, v4creds->service_instance, cc_v4_instance_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read (io_stream, v4creds->realm, cc_v4_realm_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read (io_stream, v4creds->session_key, cc_v4_key_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read_int32 (io_stream, &v4creds->kvno);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read_int32 (io_stream, &v4creds->string_to_key_type);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read_time (io_stream, &v4creds->issue_date);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read_int32 (io_stream, &v4creds->lifetime);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read_uint32 (io_stream, &v4creds->address);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read_int32 (io_stream, &v4creds->ticket_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_read (io_stream, v4creds->ticket, cc_v4_ticket_size);
--    }
--
--    if (!err) {
--        *out_v4creds = v4creds;
--        v4creds = NULL;
--    }
--
--    free (v4creds);
--
--    return cci_check_error (err);
--}
--
--/* ------------------------------------------------------------------------ */
--
--static cc_uint32 cci_credentials_v4_write (cc_credentials_v4_t *in_v4creds,
--                                           k5_ipc_stream         io_stream)
--{
--    cc_int32 err = ccNoError;
--
--    if (!io_stream ) { err = cci_check_error (ccErrBadParam); }
--    if (!in_v4creds) { err = cci_check_error (ccErrBadParam); }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write_uint32 (io_stream, in_v4creds->version);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write (io_stream, in_v4creds->principal, cc_v4_name_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write (io_stream, in_v4creds->principal_instance, cc_v4_instance_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write (io_stream, in_v4creds->service, cc_v4_name_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write (io_stream, in_v4creds->service_instance, cc_v4_instance_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write (io_stream, in_v4creds->realm, cc_v4_realm_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write (io_stream, in_v4creds->session_key, cc_v4_key_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write_int32 (io_stream, in_v4creds->kvno);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write_int32 (io_stream, in_v4creds->string_to_key_type);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write_time (io_stream, in_v4creds->issue_date);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write_int32 (io_stream, in_v4creds->lifetime);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write_uint32 (io_stream, in_v4creds->address);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write_int32 (io_stream, in_v4creds->ticket_size);
--    }
--
--    if (!err) {
--        err = krb5int_ipc_stream_write (io_stream, in_v4creds->ticket, cc_v4_ticket_size);
--    }
--
--    return cci_check_error (err);
--}
--
--#ifdef TARGET_OS_MAC
--#pragma mark -
--#endif
--
- /* ------------------------------------------------------------------------ */
- 
- static cc_uint32 cci_cc_data_contents_release (cc_data *io_ccdata)
-@@ -600,9 +425,7 @@ cc_uint32 cci_credentials_union_release (cc_credentials_union *io_cred_union)
-     if (!io_cred_union) { err = ccErrBadParam; }
- 
-     if (!err) {
--        if (io_cred_union->version == cc_credentials_v4) {
--            cci_credentials_v4_release (io_cred_union->credentials.credentials_v4);
--        } else if (io_cred_union->version == cc_credentials_v5) {
-+        if (io_cred_union->version == cc_credentials_v5) {
-             cci_credentials_v5_release (io_cred_union->credentials.credentials_v5);
-         }
-         free (io_cred_union);
-@@ -632,11 +455,7 @@ cc_uint32 cci_credentials_union_read (cc_credentials_union **out_credentials_uni
-     }
- 
-     if (!err) {
--        if (credentials_union->version == cc_credentials_v4) {
--            err = cci_credentials_v4_read (&credentials_union->credentials.credentials_v4,
--                                           io_stream);
--
--        } else if (credentials_union->version == cc_credentials_v5) {
-+        if (credentials_union->version == cc_credentials_v5) {
-             err = cci_credentials_v5_read (&credentials_union->credentials.credentials_v5,
-                                            io_stream);
- 
-@@ -671,11 +490,7 @@ cc_uint32 cci_credentials_union_write (const cc_credentials_union *in_credential
-     }
- 
-     if (!err) {
--        if (in_credentials_union->version == cc_credentials_v4) {
--            err = cci_credentials_v4_write (in_credentials_union->credentials.credentials_v4,
--                                            io_stream);
--
--        } else if (in_credentials_union->version == cc_credentials_v5) {
-+        if (in_credentials_union->version == cc_credentials_v5) {
-             err = cci_credentials_v5_write (in_credentials_union->credentials.credentials_v5,
-                                             io_stream);
- 
-@@ -714,11 +529,7 @@ cc_uint32 cci_cred_union_release (cred_union *io_cred_union)
-     if (!io_cred_union) { err = ccErrBadParam; }
- 
-     if (!err) {
--        if (io_cred_union->cred_type == CC_CRED_V4) {
--            memset (io_cred_union->cred.pV4Cred, 0, sizeof (cc_credentials_v4_compat));
--            free (io_cred_union->cred.pV4Cred);
--
--        } else if (io_cred_union->cred_type == CC_CRED_V5) {
-+        if (io_cred_union->cred_type == CC_CRED_V5) {
-             free (io_cred_union->cred.pV5Cred->client);
-             free (io_cred_union->cred.pV5Cred->server);
-             cci_cc_data_contents_release (&io_cred_union->cred.pV5Cred->keyblock);
-@@ -829,36 +640,7 @@ cc_uint32 cci_credentials_union_to_cred_union (const cc_credentials_union  *in_c
-     }
- 
-     if (!err) {
--        if (in_credentials_union->version == cc_credentials_v4) {
--            cc_credentials_v4_compat *compat_v4creds = NULL;
--
--            compat_v4creds = malloc (sizeof (*compat_v4creds));
--            if (!compat_v4creds) { err = cci_check_error (ccErrNoMem); }
--
--            if (!err) {
--                cc_credentials_v4_t *v4creds = in_credentials_union->credentials.credentials_v4;
--
--                compat_cred_union->cred_type = CC_CRED_V4;
--                compat_cred_union->cred.pV4Cred = compat_v4creds;
--
--                compat_v4creds->kversion = v4creds->version;
--                strncpy (compat_v4creds->principal,          v4creds->principal,          KRB_NAME_SZ+1);
--                strncpy (compat_v4creds->principal_instance, v4creds->principal_instance, KRB_INSTANCE_SZ+1);
--                strncpy (compat_v4creds->service,            v4creds->service,            KRB_NAME_SZ+1);
--                strncpy (compat_v4creds->service_instance,   v4creds->service_instance,   KRB_INSTANCE_SZ+1);
--                strncpy (compat_v4creds->realm,              v4creds->realm,              KRB_REALM_SZ+1);
--                memcpy (compat_v4creds->session_key, v4creds->session_key, 8);
--                compat_v4creds->kvno       = v4creds->kvno;
--                compat_v4creds->str_to_key = v4creds->string_to_key_type;
--                compat_v4creds->issue_date = v4creds->issue_date;
--                compat_v4creds->lifetime   = v4creds->lifetime;
--                compat_v4creds->address    = v4creds->address;
--                compat_v4creds->ticket_sz  = v4creds->ticket_size;
--                memcpy (compat_v4creds->ticket, v4creds->ticket, MAX_V4_CRED_LEN);
--                compat_v4creds->oops = 0;
--            }
--
--        } else if (in_credentials_union->version == cc_credentials_v5) {
-+        if (in_credentials_union->version == cc_credentials_v5) {
-             cc_credentials_v5_t *v5creds = in_credentials_union->credentials.credentials_v5;
-             cc_credentials_v5_compat *compat_v5creds = NULL;
- 
-@@ -951,36 +733,7 @@ cc_uint32 cci_cred_union_to_credentials_union (const cred_union      *in_cred_un
-     }
- 
-     if (!err) {
--        if (in_cred_union->cred_type == CC_CRED_V4) {
--            cc_credentials_v4_compat *compat_v4creds = in_cred_union->cred.pV4Cred;
--            cc_credentials_v4_t *v4creds = NULL;
--
--            if (!err) {
--                v4creds = malloc (sizeof (*v4creds));
--                if (!v4creds) { err = cci_check_error (ccErrNoMem); }
--            }
--
--            if (!err) {
--                creds_union->version = cc_credentials_v4;
--                creds_union->credentials.credentials_v4 = v4creds;
--
--                v4creds->version = compat_v4creds->kversion;
--                strncpy (v4creds->principal,          compat_v4creds->principal,          KRB_NAME_SZ);
--                strncpy (v4creds->principal_instance, compat_v4creds->principal_instance, KRB_INSTANCE_SZ);
--                strncpy (v4creds->service,            compat_v4creds->service,            KRB_NAME_SZ);
--                strncpy (v4creds->service_instance,   compat_v4creds->service_instance,   KRB_INSTANCE_SZ);
--                strncpy (v4creds->realm,              compat_v4creds->realm,              KRB_REALM_SZ);
--                memcpy (v4creds->session_key, compat_v4creds->session_key, 8);
--                v4creds->kvno               = compat_v4creds->kvno;
--                v4creds->string_to_key_type = compat_v4creds->str_to_key;
--                v4creds->issue_date         = compat_v4creds->issue_date;
--                v4creds->lifetime           = compat_v4creds->lifetime;
--                v4creds->address            = compat_v4creds->address;
--                v4creds->ticket_size        = compat_v4creds->ticket_sz;
--                memcpy (v4creds->ticket, compat_v4creds->ticket, MAX_V4_CRED_LEN);
--            }
--
--        } else if (in_cred_union->cred_type == CC_CRED_V5) {
-+        if (in_cred_union->cred_type == CC_CRED_V5) {
-             cc_credentials_v5_compat *compat_v5creds = in_cred_union->cred.pV5Cred;
-             cc_credentials_v5_t *v5creds = NULL;
- 
-@@ -1072,26 +825,7 @@ cc_uint32 cci_cred_union_compare_to_credentials_union (const cred_union
-     if (!out_equal           ) { err = cci_check_error (ccErrBadParam); }
- 
-     if (!err) {
--        if (in_cred_union_compat->cred_type == CC_CRED_V4 &&
--            in_credentials_union->version == cc_credentials_v4) {
--            cc_credentials_v4_compat *old_creds_v4 = in_cred_union_compat->cred.pV4Cred;
--            cc_credentials_v4_t *new_creds_v4 = in_credentials_union->credentials.credentials_v4;
--
--            if (old_creds_v4 && new_creds_v4 &&
--                !strcmp (old_creds_v4->principal,
--                         new_creds_v4->principal) &&
--                !strcmp (old_creds_v4->principal_instance,
--                         new_creds_v4->principal_instance) &&
--                !strcmp (old_creds_v4->service,
--                         new_creds_v4->service) &&
--                !strcmp (old_creds_v4->service_instance,
--                         new_creds_v4->service_instance) &&
--                !strcmp (old_creds_v4->realm, new_creds_v4->realm) &&
--                (old_creds_v4->issue_date == (long) new_creds_v4->issue_date)) {
--                equal = 1;
--            }
--
--        } else if (in_cred_union_compat->cred_type == CC_CRED_V5 &&
-+        if (in_cred_union_compat->cred_type == CC_CRED_V5 &&
-                    in_credentials_union->version == cc_credentials_v5) {
-             cc_credentials_v5_compat *old_creds_v5 = in_cred_union_compat->cred.pV5Cred;
-             cc_credentials_v5_t *new_creds_v5 = in_credentials_union->credentials.credentials_v5;
-diff --git a/src/ccapi/lib/ccapi_v2.c b/src/ccapi/lib/ccapi_v2.c
-index 8a831d796..ae9b790b0 100644
---- a/src/ccapi/lib/ccapi_v2.c
-+++ b/src/ccapi/lib/ccapi_v2.c
-@@ -44,10 +44,7 @@ static cc_int32 cci_remap_version (cc_int32   in_v2_version,
-     if (!out_v3_version) { err = cci_check_error (ccErrBadParam); }
- 
-     if (!err) {
--        if (in_v2_version == CC_CRED_V4) {
--            *out_v3_version = cc_credentials_v4;
--
--        } else if (in_v2_version == CC_CRED_V5) {
-+        if (in_v2_version == CC_CRED_V5) {
-             *out_v3_version = cc_credentials_v5;
- 
-         } else {
-@@ -450,10 +447,7 @@ cc_result cc_get_cred_version (apiCB    *in_context,
-     }
- 
-     if (!err) {
--        if (compat_version == cc_credentials_v4) {
--            *out_version = CC_CRED_V4;
--
--        } else if (compat_version == cc_credentials_v5) {
-+        if (compat_version == cc_credentials_v5) {
-             *out_version = CC_CRED_V5;
- 
-         } else {
-@@ -642,10 +636,6 @@ cc_result cc_seq_fetch_NCs_next (apiCB       *in_context,
-     if (!out_ccache ) { err = cci_check_error (ccErrBadParam); }
-     if (!in_iterator) { err = cci_check_error (ccErrBadParam); }
- 
--    /* CCache iterators need to return some ccaches twice (when v3 ccache has
--     * two kinds of credentials). To do that, we return such ccaches twice
--     * v4 first, then v5. */
--
-     if (!err) {
-         err = cci_ccache_iterator_get_saved_ccache_name (iterator,
-                                                          &saved_ccache_name);
-@@ -674,25 +664,7 @@ cc_result cc_seq_fetch_NCs_next (apiCB       *in_context,
-             }
- 
-             if (!err) {
--                if (version == cc_credentials_v4_v5) {
--                    cc_string_t name = NULL;
--
--                    err = cci_ccache_set_compat_version (ccache, cc_credentials_v4);
--
--                    if (!err) {
--                        err = ccapi_ccache_get_name (ccache, &name);
--                    }
--
--                    if (!err) {
--                        err = cci_ccache_iterator_set_saved_ccache_name (iterator,
--                                                                         name->data);
--                    }
--
--                    if (name) { ccapi_string_release (name); }
--
--                } else {
--                    err = cci_ccache_set_compat_version (ccache, version);
--                }
-+                err = cci_ccache_set_compat_version (ccache, version);
-             }
-         }
-     }
-diff --git a/src/ccapi/lib/win/OldCC/ccapi.h b/src/ccapi/lib/win/OldCC/ccapi.h
-index 82512771a..4d6f3faaf 100644
---- a/src/ccapi/lib/win/OldCC/ccapi.h
-+++ b/src/ccapi/lib/win/OldCC/ccapi.h
-@@ -80,7 +80,6 @@ enum __MIDL_ccapi_0003
-     {	KRB_NAME_SZ	= 40,
- 	KRB_INSTANCE_SZ	= 40,
- 	KRB_REALM_SZ	= 40,
--	MAX_V4_CRED_LEN	= 1250
-     } ;
- typedef struct _NC_INFO
-     {
-@@ -95,24 +94,6 @@ typedef struct _NC_INFO_LIST
-     /* [size_is] */ NC_INFO *info;
-     } 	NC_INFO_LIST;
- 
--typedef struct _V4_CRED
--    {
--    CC_UCHAR kversion;
--    CC_CHAR principal[ 41 ];
--    CC_CHAR principal_instance[ 41 ];
--    CC_CHAR service[ 41 ];
--    CC_CHAR service_instance[ 41 ];
--    CC_CHAR realm[ 41 ];
--    CC_UCHAR session_key[ 8 ];
--    CC_INT32 kvno;
--    CC_INT32 str_to_key;
--    CC_INT32 issue_date;
--    CC_INT32 lifetime;
--    CC_UINT32 address;
--    CC_INT32 ticket_sz;
--    CC_UCHAR ticket[ 1250 ];
--    } 	V4_CRED;
--
- typedef struct _CC_DATA
-     {
-     CC_UINT32 type;
-@@ -145,7 +126,6 @@ typedef struct _V5_CRED
- 
- typedef /* [switch_type] */ union _CRED_PTR_UNION
-     {
--    /* [case()] */ V4_CRED *pV4Cred;
-     /* [case()] */ V5_CRED *pV5Cred;
-     } 	CRED_PTR_UNION;
- 
-diff --git a/src/ccapi/server/ccs_ccache.c b/src/ccapi/server/ccs_ccache.c
-index 65c59e4be..645380a7b 100644
---- a/src/ccapi/server/ccs_ccache.c
-+++ b/src/ccapi/server/ccs_ccache.c
-@@ -31,19 +31,16 @@ struct ccs_ccache_d {
-     ccs_lock_state_t lock_state;
-     cc_uint32 creds_version;
-     char *name;
--    char *v4_principal;
-     char *v5_principal;
-     cc_time_t last_default_time;
-     cc_time_t last_changed_time;
--    cc_uint32 kdc_time_offset_v4_valid;
--    cc_time_t kdc_time_offset_v4;
-     cc_uint32 kdc_time_offset_v5_valid;
-     cc_time_t kdc_time_offset_v5;
-     ccs_credentials_list_t credentials;
-     ccs_callback_array_t change_callbacks;
- };
- 
--struct ccs_ccache_d ccs_ccache_initializer = { NULL, NULL, 0, NULL, NULL, NULL, 0, 0, 0, 0, 0, 0, NULL, NULL };
-+struct ccs_ccache_d ccs_ccache_initializer = { NULL, NULL, 0, NULL, NULL, 0, 0, 0, 0, NULL, NULL };
- 
- /* ------------------------------------------------------------------------ */
- 
-@@ -88,11 +85,7 @@ cc_int32 ccs_ccache_new (ccs_ccache_t      *out_ccache,
-     if (!err) {
-         ccache->creds_version = in_creds_version;
- 
--        if (ccache->creds_version == cc_credentials_v4) {
--            ccache->v4_principal = strdup (in_principal);
--            if (!ccache->v4_principal) { err = cci_check_error (ccErrNoMem); }
--
--        } else if (ccache->creds_version == cc_credentials_v5) {
-+        if (ccache->creds_version == cc_credentials_v5) {
-             ccache->v5_principal = strdup (in_principal);
-             if (!ccache->v5_principal) { err = cci_check_error (ccErrNoMem); }
- 
-@@ -147,7 +140,6 @@ cc_int32 ccs_ccache_reset (ccs_ccache_t            io_ccache,
-                            const char             *in_principal)
- {
-     cc_int32 err = ccNoError;
--    char *v4_principal = NULL;
-     char *v5_principal = NULL;
-     ccs_credentials_list_t credentials = NULL;
- 
-@@ -158,11 +150,7 @@ cc_int32 ccs_ccache_reset (ccs_ccache_t            io_ccache,
-     if (!err) {
-         io_ccache->creds_version = in_creds_version;
- 
--        if (io_ccache->creds_version == cc_credentials_v4) {
--            v4_principal = strdup (in_principal);
--            if (!v4_principal) { err = cci_check_error (ccErrNoMem); }
--
--        } else if (io_ccache->creds_version == cc_credentials_v5) {
-+        if (io_ccache->creds_version == cc_credentials_v5) {
-             v5_principal = strdup (in_principal);
-             if (!v5_principal) { err = cci_check_error (ccErrNoMem); }
- 
-@@ -176,15 +164,9 @@ cc_int32 ccs_ccache_reset (ccs_ccache_t            io_ccache,
-     }
- 
-     if (!err) {
--        io_ccache->kdc_time_offset_v4 = 0;
--        io_ccache->kdc_time_offset_v4_valid = 0;
-         io_ccache->kdc_time_offset_v5 = 0;
-         io_ccache->kdc_time_offset_v5_valid = 0;
- 
--        if (io_ccache->v4_principal) { free (io_ccache->v4_principal); }
--        io_ccache->v4_principal = v4_principal;
--        v4_principal = NULL; /* take ownership */
--
-         if (io_ccache->v5_principal) { free (io_ccache->v5_principal); }
-         io_ccache->v5_principal = v5_principal;
-         v5_principal = NULL; /* take ownership */
-@@ -196,7 +178,6 @@ cc_int32 ccs_ccache_reset (ccs_ccache_t            io_ccache,
- 	err = ccs_ccache_changed (io_ccache, io_cache_collection);
-     }
- 
--    free (v4_principal);
-     free (v5_principal);
-     ccs_credentials_list_release (credentials);
- 
-@@ -250,7 +231,6 @@ cc_int32 ccs_ccache_release (ccs_ccache_t io_ccache)
-         cci_identifier_release (io_ccache->identifier);
-         ccs_lock_state_release (io_ccache->lock_state);
-         free (io_ccache->name);
--        free (io_ccache->v4_principal);
-         free (io_ccache->v5_principal);
-         ccs_credentials_list_release (io_ccache->credentials);
-         ccs_callback_array_release (io_ccache->change_callbacks);
-@@ -607,15 +587,8 @@ static cc_int32 ccs_ccache_get_principal (ccs_ccache_t           io_ccache,
-         err = krb5int_ipc_stream_read_uint32 (in_request_data, &version);
-     }
- 
--    if (!err && version == cc_credentials_v4_v5) {
--        err = cci_check_error (ccErrBadCredentialsVersion);
--    }
--
-     if (!err) {
--        if (version == cc_credentials_v4) {
--            err = krb5int_ipc_stream_write_string (io_reply_data, io_ccache->v4_principal);
--
--        } else if (version == cc_credentials_v5) {
-+        if (version == cc_credentials_v5) {
-             err = krb5int_ipc_stream_write_string (io_reply_data, io_ccache->v5_principal);
- 
-         } else {
-@@ -652,16 +625,7 @@ static cc_int32 ccs_ccache_set_principal (ccs_ccache_t           io_ccache,
- 
-     if (!err) {
-         /* reset KDC time offsets because they are per-KDC */
--        if (version == cc_credentials_v4) {
--            io_ccache->kdc_time_offset_v4 = 0;
--            io_ccache->kdc_time_offset_v4_valid = 0;
--
--            if (io_ccache->v4_principal) { free (io_ccache->v4_principal); }
--            io_ccache->v4_principal = principal;
--            principal = NULL; /* take ownership */
--
--
--        } else if (version == cc_credentials_v5) {
-+        if (version == cc_credentials_v5) {
-             io_ccache->kdc_time_offset_v5 = 0;
-             io_ccache->kdc_time_offset_v5_valid = 0;
- 
-@@ -998,14 +962,7 @@ static cc_int32 ccs_ccache_get_kdc_time_offset (ccs_ccache_t           io_ccache
-     }
- 
-     if (!err) {
--        if (cred_vers == cc_credentials_v4) {
--            if (io_ccache->kdc_time_offset_v4_valid) {
--                err = krb5int_ipc_stream_write_time (io_reply_data, io_ccache->kdc_time_offset_v4);
--            } else {
--                err = cci_check_error (ccErrTimeOffsetNotSet);
--            }
--
--        } else if (cred_vers == cc_credentials_v5) {
-+        if (cred_vers == cc_credentials_v5) {
-             if (io_ccache->kdc_time_offset_v5_valid) {
-                 err = krb5int_ipc_stream_write_time (io_reply_data, io_ccache->kdc_time_offset_v5);
-             } else {
-@@ -1040,13 +997,7 @@ static cc_int32 ccs_ccache_set_kdc_time_offset (ccs_ccache_t           io_ccache
-     }
- 
-     if (!err) {
--        if (cred_vers == cc_credentials_v4) {
--            err = krb5int_ipc_stream_read_time (in_request_data, &io_ccache->kdc_time_offset_v4);
--
--            if (!err) {
--                io_ccache->kdc_time_offset_v4_valid = 1;
--            }
--        } else if (cred_vers == cc_credentials_v5) {
-+        if (cred_vers == cc_credentials_v5) {
-             err = krb5int_ipc_stream_read_time (in_request_data, &io_ccache->kdc_time_offset_v5);
- 
-             if (!err) {
-@@ -1084,11 +1035,7 @@ static cc_int32 ccs_ccache_clear_kdc_time_offset (ccs_ccache_t           io_ccac
-     }
- 
-     if (!err) {
--        if (cred_vers == cc_credentials_v4) {
--            io_ccache->kdc_time_offset_v4 = 0;
--            io_ccache->kdc_time_offset_v4_valid = 0;
--
--        } else if (cred_vers == cc_credentials_v5) {
-+        if (cred_vers == cc_credentials_v5) {
-             io_ccache->kdc_time_offset_v5 = 0;
-             io_ccache->kdc_time_offset_v5_valid = 0;
- 
-diff --git a/src/ccapi/test/test_ccapi_ccache.c b/src/ccapi/test/test_ccapi_ccache.c
-index a0fd84af1..fe63e6710 100644
---- a/src/ccapi/test/test_ccapi_ccache.c
-+++ b/src/ccapi/test/test_ccapi_ccache.c
-@@ -303,18 +303,6 @@ int check_cc_ccache_get_credentials_version(void) {
- 		failure_count++;
- 	}
- 
--	// try it with added v4 creds
--	if (!err) {
--		err = cc_ccache_set_principal(ccache, cc_credentials_v4, "foo@BAR.ORG");
--	}
--	if (!err) {
--		check_once_cc_ccache_get_credentials_version(ccache, cc_credentials_v4_v5, ccNoError, "v5 with v4 creds added");
--	}
--	else {
--		log_error("cc_ccache_set_principal failed, can't complete test");
--		failure_count++;
--	}
--
- 	if (ccache) {
- 		cc_ccache_destroy(ccache);
- 		ccache = NULL;
-@@ -322,35 +310,6 @@ int check_cc_ccache_get_credentials_version(void) {
- 
- 	err = ccNoError;
- 
--	// try one created with v4 creds
--	if (!err) {
--		err = cc_context_create_new_ccache(context, cc_credentials_v4, "foo@BAR.ORG", &ccache);
--	}
--	if (!err) {
--		check_once_cc_ccache_get_credentials_version(ccache, cc_credentials_v4, ccNoError, "v4 creds");
--	}
--	else {
--		log_error("cc_context_create_new_ccache failed, can't complete test");
--		failure_count++;
--	}
--
--	// try it with added v5 creds
--	if (!err) {
--		err = cc_ccache_set_principal(ccache, cc_credentials_v5, "foo@BAR.ORG");
--	}
--	if (!err) {
--		check_once_cc_ccache_get_credentials_version(ccache, cc_credentials_v4_v5, ccNoError, "v4 with v5 creds added");
--	}
--	else {
--		log_error("cc_ccache_set_principal failed, can't complete test");
--		failure_count++;
--	}
--
--	if (ccache) {
--		cc_ccache_destroy(ccache);
--		ccache = NULL;
--	}
--
- 	if (context) { cc_context_release(context); }
- 
- 	#endif /* cc_ccache_get_credentials_version */
-@@ -582,31 +541,13 @@ int check_cc_ccache_get_principal(void) {
- 		log_error("cc_context_create_new_ccache failed, can't complete test");
- 		failure_count++;
- 	}
--	if (ccache) {
--		cc_ccache_release(ccache);
--		ccache = NULL;
--	}
- 
--	// try with krb4 principal
--	if (!err) {
--		err = cc_context_create_new_ccache(context, cc_credentials_v4, "foo.BAR@BAZ.ORG", &ccache);
--	}
--	if (!err) {
--		check_once_cc_ccache_get_principal(ccache, cc_credentials_v4, "foo.BAR@BAZ.ORG", ccNoError, "trying to get krb4 princ for krb4 ccache");
--	}
--	else {
--		log_error("cc_context_create_new_ccache failed, can't complete test");
--		failure_count++;
--	}
--
--	// try with bad param
--	if (!err) {
--		// cc_ccache_t doesn't have any concept of the difference between a v4 and v5 principal
--		check_once_cc_ccache_get_principal(ccache, cc_credentials_v4_v5, "foo.BAR@BAZ.ORG",
--			ccErrBadCredentialsVersion,
--			"passing cc_credentials_v4_v5 (shouldn't be allowed)");
--		check_once_cc_ccache_get_principal(ccache, cc_credentials_v5, NULL, ccErrBadParam, "passed null out param");
--	}
-+        // try with bad param
-+        if (!err) {
-+            check_once_cc_ccache_get_principal(ccache, cc_credentials_v5,
-+                                               NULL, ccErrBadParam,
-+                                               "passed null out param");
-+        }
- 
- 	if (ccache) {
- 		cc_ccache_release(ccache);
-@@ -643,99 +584,33 @@ int check_cc_ccache_set_principal(void) {
- 		err = destroy_all_ccaches(context);
- 	}
- 
--	// bad params
--	if (!err) {
--		err = cc_context_create_new_ccache(context, cc_credentials_v5, "foo@BAZ.ORG", &ccache);
--	}
--	if (!err) {
--		check_once_cc_ccache_set_principal(ccache, cc_credentials_v4_v5, "foo/BAZ@BAR.ORG", ccErrBadCredentialsVersion, "cc_credentials_v4_v5 (not allowed)");
--		check_once_cc_ccache_set_principal(ccache, cc_credentials_v5, NULL, ccErrBadParam, "NULL principal");
--	}
--	else {
--		log_error("cc_context_create_new_ccache failed, can't complete test");
--		failure_count++;
--	}
--	if (ccache) {
--		cc_ccache_destroy(ccache);
--		ccache = NULL;
--	}
--
--
--	// empty ccache
--
--		// replace v5 only ccache's principal
--		if (!err) {
--			err = cc_context_create_new_ccache(context, cc_credentials_v5, "foo@BAZ.ORG", &ccache);
--		}
--		if (!err) {
--			check_once_cc_ccache_set_principal(ccache, cc_credentials_v5, "foo/BAZ@BAR.ORG", ccNoError, "replace v5 only ccache's principal (empty ccache)");
--		}
--		else {
--			log_error("cc_context_create_new_ccache failed, can't complete test");
--			failure_count++;
--		}
--		if (ccache) {
--			cc_ccache_destroy(ccache);
--			ccache = NULL;
--		}
--
--		// add v4 principal to v5 only ccache
--		if (!err) {
--			err = cc_context_create_new_ccache(context, cc_credentials_v5, "foo@BAZ.ORG", &ccache);
--		}
--		if (!err) {
--			check_once_cc_ccache_set_principal(ccache, cc_credentials_v4, "foo.BAZ@BAR.ORG", ccNoError, "add v4 principal to v5 only ccache (empty ccache)");
--		}
--		else {
--			log_error("cc_context_create_new_ccache failed, can't complete test");
--			failure_count++;
--		}
--		if (ccache) {
--			cc_ccache_destroy(ccache);
--			ccache = NULL;
--		}
--
--		// replace v4 only ccache's principal
--		if (!err) {
--			err = cc_context_create_new_ccache(context, cc_credentials_v4, "foo@BAZ.ORG", &ccache);
--		}
--		if (!err) {
--			check_once_cc_ccache_set_principal(ccache, cc_credentials_v4, "foo.BAZ@BAR.ORG", ccNoError, "replace v4 only ccache's principal (empty ccache)");
--		}
--		else {
--			log_error("cc_context_create_new_ccache failed, can't complete test");
--			failure_count++;
--		}
--		if (ccache) {
--			cc_ccache_destroy(ccache);
--			ccache = NULL;
--		}
--
--		// add v5 principal to v4 only ccache
--		if (!err) {
--			err = cc_context_create_new_ccache(context, cc_credentials_v4, "foo@BAZ.ORG", &ccache);
--		}
--		if (!err) {
--			check_once_cc_ccache_set_principal(ccache, cc_credentials_v5, "foo/BAZ@BAR.ORG", ccNoError, "add v5 principal to v4 only ccache (empty ccache)");
--		}
--		else {
--			log_error("cc_context_create_new_ccache failed, can't complete test");
--			failure_count++;
--		}
--		if (ccache) {
--			cc_ccache_destroy(ccache);
--			ccache = NULL;
--		}
--
--	// with credentials
--
--		// replace v5 only ccache's principal
--
--		// add v4 principal to v5 only ccache
--
--		// replace v4 only ccache's principal
--
--		// add v5 principal to v4 only ccache
-+        // replace v5 only ccache's principal
-+        if (!err) {
-+            err = cc_context_create_new_ccache(context, cc_credentials_v5,
-+                                               "foo@BAZ.ORG", &ccache);
-+        }
-+        if (!err) {
-+            check_once_cc_ccache_set_principal(
-+                ccache, cc_credentials_v5, "foo/BAZ@BAR.ORG", ccNoError,
-+                "replace v5 only ccache's principal (empty ccache)");
-+        }
-+        else {
-+            log_error(
-+                "cc_context_create_new_ccache failed, can't complete test");
-+            failure_count++;
-+        }
-+
-+        // bad params
-+        if (!err) {
-+            check_once_cc_ccache_set_principal(ccache, cc_credentials_v5,
-+                                               NULL, ccErrBadParam,
-+                                               "NULL principal");
-+        }
-+
-+        if (ccache) {
-+            cc_ccache_destroy(ccache);
-+            ccache = NULL;
-+        }
- 
- 	if (context) {
- 		err = destroy_all_ccaches(context);
-@@ -847,21 +722,6 @@ int check_cc_ccache_store_credentials(void) {
- 
- 	if (&creds_union) { release_v5_creds_union(&creds_union); }
- 
--	// bad creds version
--	if (!err) {
--		err = new_v5_creds_union(&creds_union, "BAR.ORG");
--	}
--
--	if (!err) {
--		creds_union.version = cc_credentials_v4_v5;
--		check_once_cc_ccache_store_credentials(ccache, &creds_union, ccErrBadCredentialsVersion, "v4_v5 creds (invalid) into a ccache with only v5 princ");
--		creds_union.version = cc_credentials_v4;
--		check_once_cc_ccache_store_credentials(ccache, &creds_union, ccErrBadCredentialsVersion, "v4 creds into a ccache with only v5 princ");
--		creds_union.version = cc_credentials_v5;
--	}
--
--	if (&creds_union) { release_v5_creds_union(&creds_union); }
--
- 	// non-existent ccache
- 	if (ccache) {
- 		err = cc_ccache_get_name(ccache, &name);
-@@ -1809,21 +1669,10 @@ int check_cc_ccache_get_kdc_time_offset(void) {
- 		err = cc_ccache_set_kdc_time_offset(ccache, cc_credentials_v5, time_offset);
- 	}
- 	if (!err) {
--		check_once_cc_ccache_get_kdc_time_offset(ccache, cc_credentials_v5, &time_offset, ccNoError, "offset set for v5 but not v4");
--	}
--	if (!err) {
--		check_once_cc_ccache_get_kdc_time_offset(ccache, cc_credentials_v4, &time_offset, ccErrTimeOffsetNotSet, "asking for v4 offset when only v5 is set");
--	}
--	if (!err) {
--		err = cc_ccache_set_kdc_time_offset(ccache, cc_credentials_v4, time_offset);
--	}
--	if (!err) {
--		check_once_cc_ccache_get_kdc_time_offset(ccache, cc_credentials_v4, &time_offset, ccNoError, "asking for v4 offset when v4 and v5 are set");
-+		check_once_cc_ccache_get_kdc_time_offset(ccache, cc_credentials_v5, &time_offset, ccNoError, "offset set for v5");
- 	}
- 
--
- 	check_once_cc_ccache_get_kdc_time_offset(ccache, cc_credentials_v5, NULL, ccErrBadParam, "NULL time_offset out param");
--	check_once_cc_ccache_get_kdc_time_offset(ccache, cc_credentials_v4_v5, &time_offset, ccErrBadCredentialsVersion, "v4_v5 creds_vers in param (invalid)");
- 
- 	if (ccache) { cc_ccache_release(ccache); }
- 
-@@ -1900,9 +1749,6 @@ int check_cc_ccache_set_kdc_time_offset(void) {
- 	}
- 
- 	check_once_cc_ccache_set_kdc_time_offset(ccache, cc_credentials_v5, 0, ccNoError, "first time setting offset (v5)");
--	check_once_cc_ccache_set_kdc_time_offset(ccache, cc_credentials_v4, 0, ccNoError, "first time setting offset (v4)");
--
--	check_once_cc_ccache_set_kdc_time_offset(ccache, cc_credentials_v4_v5, 0, ccErrBadCredentialsVersion, "invalid creds_vers (v4_v5)");
- 
- 	if (ccache) { cc_ccache_release(ccache); }
- 
-@@ -1978,15 +1824,10 @@ int check_cc_ccache_clear_kdc_time_offset(void) {
- 	}
- 
- 	check_once_cc_ccache_clear_kdc_time_offset(ccache, cc_credentials_v5, ccNoError, "clearing an offset that was never set (v5)");
--	check_once_cc_ccache_clear_kdc_time_offset(ccache, cc_credentials_v4, ccNoError, "clearing an offset that was never set (v4)");
- 
- 	err = cc_ccache_set_kdc_time_offset(ccache, cc_credentials_v5, 0);
--	err = cc_ccache_set_kdc_time_offset(ccache, cc_credentials_v4, 0);
- 
- 	check_once_cc_ccache_clear_kdc_time_offset(ccache, cc_credentials_v5, ccNoError, "clearing v5");
--	check_once_cc_ccache_clear_kdc_time_offset(ccache, cc_credentials_v4, ccNoError, "clearing v4");
--
--	check_once_cc_ccache_clear_kdc_time_offset(ccache, cc_credentials_v4_v5, ccErrBadCredentialsVersion, "bad in param creds vers (v4_v5)");
- 
- 	if (ccache) { cc_ccache_release(ccache); }
- 
-diff --git a/src/ccapi/test/test_ccapi_constants.c b/src/ccapi/test/test_ccapi_constants.c
-index 9f2aecbc2..57377262e 100644
---- a/src/ccapi/test/test_ccapi_constants.c
-+++ b/src/ccapi/test/test_ccapi_constants.c
-@@ -46,9 +46,7 @@ int check_constants(void) {
- 
- 	/* Credentials versions */
- 
--	check_int(cc_credentials_v4,    1);
- 	check_int(cc_credentials_v5,    2);
--	check_int(cc_credentials_v4_v5, (cc_credentials_v4 | cc_credentials_v5));
- 
- 	/* Lock types */
- 
-diff --git a/src/ccapi/test/test_ccapi_context.c b/src/ccapi/test/test_ccapi_context.c
-index 09feebee5..2dc348ea0 100644
---- a/src/ccapi/test/test_ccapi_context.c
-+++ b/src/ccapi/test/test_ccapi_context.c
-@@ -583,7 +583,6 @@ int check_cc_context_create_ccache(void) {
- 
- 		// try bad parameters
- 		err = check_once_cc_context_create_ccache(context, NULL, cc_credentials_v5, "foo@BAR.ORG", &ccache, ccErrBadParam, "NULL name");                    // NULL name
--		err = check_once_cc_context_create_ccache(context, "name", cc_credentials_v4_v5, "foo@BAR.ORG", &ccache, ccErrBadCredentialsVersion, "invalid creds_vers"); // invalid creds_vers
- 		err = check_once_cc_context_create_ccache(context, "name", cc_credentials_v5, NULL, &ccache, ccErrBadParam, "NULL principal");                          // NULL principal
- 		err = check_once_cc_context_create_ccache(context, "name", cc_credentials_v5, "foo@BAR.ORG", NULL, ccErrBadParam, "NULL ccache");                    // NULL ccache
- 	}
-@@ -681,7 +680,6 @@ int check_cc_context_create_default_ccache(void) {
- 		}
- 
- 		// try bad parameters
--		err = check_once_cc_context_create_default_ccache(context, cc_credentials_v4_v5, "foo@BAR.ORG", &ccache, ccErrBadCredentialsVersion, "invalid creds_vers"); // invalid creds_vers
- 		err = check_once_cc_context_create_default_ccache(context, cc_credentials_v5, NULL, &ccache, ccErrBadParam, "NULL principal");                          // NULL principal
- 		err = check_once_cc_context_create_default_ccache(context, cc_credentials_v5, "foo@BAR.ORG", NULL, ccErrBadParam, "NULL ccache");                    // NULL ccache
- 	}
-@@ -773,7 +771,6 @@ int check_cc_context_create_new_ccache(void) {
- 		if (ccache) { cc_ccache_release(ccache); }
- 
- 		// try bad parameters
--		err = check_once_cc_context_create_new_ccache(context, 1, cc_credentials_v4_v5, "foo@BAR.ORG", &ccache, ccErrBadCredentialsVersion, "invalid creds_vers"); // invalid creds_vers
- 		err = check_once_cc_context_create_new_ccache(context, 1, cc_credentials_v5, NULL, &ccache, ccErrBadParam, "NULL principal");                          // NULL principal
- 		err = check_once_cc_context_create_new_ccache(context, 1, cc_credentials_v5, "foo@BAR.ORG", NULL, ccErrBadParam, "NULL ccache");                    // NULL ccache
- 	}
-diff --git a/src/ccapi/test/test_ccapi_v2.c b/src/ccapi/test/test_ccapi_v2.c
-index e0205ce46..c71bb45a8 100644
---- a/src/ccapi/test/test_ccapi_v2.c
-+++ b/src/ccapi/test/test_ccapi_v2.c
-@@ -45,20 +45,6 @@ static int compare_v5_creds_unions_compat(const cred_union *a, const cred_union
-                 a->cred.pV5Cred->starttime == b->cred.pV5Cred->starttime) {
-                 retval = 0;
-             }
--        } else if (a->cred_type == CC_CRED_V4) {
--            if (!strcmp (a->cred.pV4Cred->principal,
--                         b->cred.pV4Cred->principal) &&
--                !strcmp (a->cred.pV4Cred->principal_instance,
--                         b->cred.pV4Cred->principal_instance) &&
--                !strcmp (a->cred.pV4Cred->service,
--                         b->cred.pV4Cred->service) &&
--                !strcmp (a->cred.pV4Cred->service_instance,
--                         b->cred.pV4Cred->service_instance) &&
--                !strcmp (a->cred.pV4Cred->realm,
--                         b->cred.pV4Cred->realm) &&
--                a->cred.pV4Cred->issue_date == b->cred.pV4Cred->issue_date) {
--                retval = 0;
--            }
-         }
-     }
- 
-@@ -361,10 +347,6 @@ int check_cc_open(void) {
-             err = check_once_cc_open(context, name, CC_CRED_V5, &ccache, CC_NOERROR, NULL);
-         }
- 
--        // check version
--        if (!err) {
--            err = check_once_cc_open(context, name, CC_CRED_V4, &ccache, CC_ERR_CRED_VERSION, NULL);
--        }
-         // try bad parameters
-         err = check_once_cc_open(context, NULL, CC_CRED_V5, &ccache, CC_BAD_PARM, NULL);
-         err = check_once_cc_open(context, name, CC_CRED_V5, NULL, CC_BAD_PARM, NULL);
-@@ -681,17 +663,6 @@ int check_cc_get_cred_version(void) {
- 
-     err = CC_NOERROR;
- 
--    // try one created with v4 creds
--    if (!err) {
--        err = cc_create(context, name, "foo@BAR.ORG", CC_CRED_V4, 0, &ccache);
--    }
--    if (!err) {
--        check_once_cc_get_cred_version(context, ccache, CC_CRED_V4, CC_NOERROR, "v4 creds");
--    }
--    else {
--        log_error("cc_context_create_new_ccache failed, can't complete test");
--        failure_count++;
--    }
-     if (ccache) {
-         cc_destroy(context, &ccache);
-         ccache = NULL;
-@@ -840,7 +811,6 @@ int check_cc_get_principal(void) {
-     apiCB *context = NULL;
-     ccache_p *ccache = NULL;
-     char *name_v5 = "TEST_CC_GET_PRINCIPAL_V5";
--    char *name_v4 = "TEST_CC_GET_PRINCIPAL_V4";
- 
-     BEGIN_TEST("cc_get_principal");
- 
-@@ -866,18 +836,6 @@ int check_cc_get_principal(void) {
-         ccache = NULL;
-     }
- 
--    // try with krb4 principal
--    if (!err) {
--        err = cc_create(context, name_v4, "foo.BAR@BAZ.ORG", CC_CRED_V4, 0, &ccache);
--    }
--    if (!err) {
--        check_once_cc_get_principal(context, ccache, "foo.BAR@BAZ.ORG", CC_NOERROR, "trying to get krb4 princ for krb4 ccache");
--    }
--    else {
--        log_error("cc_create failed, can't complete test");
--        failure_count++;
--    }
--
-     // try with bad param
-     if (!err) {
-         check_once_cc_get_principal(context, ccache, NULL, CC_BAD_PARM, "passed null out param");
-@@ -945,7 +903,6 @@ int check_cc_set_principal(void) {
-     apiCB *context = NULL;
-     ccache_p *ccache = NULL;
-     char *name_v5 = "TEST_CC_GET_PRINCIPAL_V5";
--    char *name_v4 = "TEST_CC_GET_PRINCIPAL_V4";
- 
-     BEGIN_TEST("cc_set_principal");
- 
-@@ -972,37 +929,6 @@ int check_cc_set_principal(void) {
-         ccache = NULL;
-     }
- 
--    // empty ccache
--
--    // replace v5 ccache's principal
--    if (!err) {
--        err = cc_create(context, name_v5, "foo@BAZ.ORG", CC_CRED_V5, 0, &ccache);
--     }
--    if (!err) {
--        check_once_cc_set_principal(context, ccache, CC_CRED_V5, "foo/BAZ@BAR.ORG", CC_NOERROR, "replace v5 only ccache's principal (empty ccache)");
--        check_once_cc_set_principal(context, ccache, CC_CRED_V4, "foo.BAZ@BAR.ORG", CC_ERR_CRED_VERSION, "replace v5 principal with v4");
--    }
--    else {
--        log_error("cc_create failed, can't complete test");
--        failure_count++;
--    }
--    if (ccache) {
--        cc_destroy(context, &ccache);
--        ccache = NULL;
--    }
--
--    // replace v4 ccache's principal
--    if (!err) {
--        err = cc_create(context, name_v4, "foo@BAZ.ORG", CC_CRED_V4, 0, &ccache);
--    }
--    if (!err) {
--        check_once_cc_set_principal(context, ccache, CC_CRED_V4, "foo.BAZ@BAR.ORG", CC_NOERROR, "replace v4 only ccache's principal (empty ccache)");
--        check_once_cc_set_principal(context, ccache, CC_CRED_V5, "foo/BAZ@BAR.ORG", CC_ERR_CRED_VERSION, "replace v4 principal with v5");
--    }
--    else {
--        log_error("cc_create failed, can't complete test");
--        failure_count++;
--    }
-     if (ccache) {
-         cc_destroy(context, &ccache);
-         ccache = NULL;
-@@ -1102,21 +1028,6 @@ int check_cc_store(void) {
-         }
-     }
- 
--    // bad creds version
--    if (!err) {
--        err = new_v5_creds_union_compat(&creds_union, "BAR.ORG");
--
--        if (!err) {
--            creds_union.cred_type = CC_CRED_MAX;
--            check_once_cc_store(context, ccache, creds_union, CC_ERR_CRED_VERSION, "CC_CRED_MAX (invalid) into a ccache with only v5 princ");
--            creds_union.cred_type = CC_CRED_V4;
--            check_once_cc_store(context, ccache, creds_union, CC_ERR_CRED_VERSION, "v4 creds into a v5 ccache");
--            creds_union.cred_type = CC_CRED_V5;
--
--            release_v5_creds_union_compat(&creds_union);
--        }
--    }
--
-     // non-existent ccache
-     if (ccache) {
-         err = cc_get_name(context, ccache, &name);
-diff --git a/src/include/CredentialsCache.h b/src/include/CredentialsCache.h
-index 54f71a1a0..c18159639 100644
---- a/src/include/CredentialsCache.h
-+++ b/src/include/CredentialsCache.h
-@@ -104,19 +104,19 @@ extern "C" {
-  * \section introduction Introduction
-  *
-  * This is the specification for an API which provides Credentials Cache
-- * services for both Kerberos v5 and v4. The idea behind this API is that
-- * multiple Kerberos implementations can share a single collection of
-- * credentials caches, mediated by this API specification. On the Mac OS
-- * and Microsoft Windows platforms this will allow single-login, even when
-- * more than one Kerberos shared library is in use on a particular system.
-+ * services for Kerberos v5 (and previously v4). The idea behind this API is
-+ * that multiple Kerberos implementations can share a single collection of
-+ * credentials caches, mediated by this API specification. On the Mac OS and
-+ * Microsoft Windows platforms this will allow single-login, even when more
-+ * than one Kerberos shared library is in use on a particular system.
-  *
-  * Abstractly, a credentials cache collection contains one or more credentials
-  * caches, or ccaches. A ccache is uniquely identified by its name, which is
-  * a string internal to the API and not intended to be presented to users.
-  * The user presentable identifier of a ccache is its principal.
-  *
-- * Unlike the previous versions of the API, version 3 of the API stores both
-- * Kerberos v4 and v5 credentials in the same ccache.
-+ * Unlike the previous versions of the API, version 3 of the API could store
-+ * credentials for multiple Kerberos versions in the same ccache.
-  *
-  * At any given time, one ccache is the "default" ccache. The exact meaning
-  * of a default ccache is OS-specific; refer to implementation requirements
-@@ -305,10 +305,9 @@ enum {
- /*!
-  * Credentials versions
-  *
-- * These constants are used in several places in the API to discern
-- * between Kerberos v4 and Kerberos v5. Not all values are valid
-- * inputs and outputs for all functions; function specifications
-- * below detail the allowed values.
-+ * These constants are used in several places in the API to discern Kerberos
-+ * versions. Not all values are valid inputs and outputs for all functions;
-+ * function specifications below detail the allowed values.
-  *
-  * Kerberos version constants will always be a bit-field, and can be
-  * tested as such; for example the following test will tell you if
-@@ -317,9 +316,9 @@ enum {
-  * if ((ccacheVersion & cc_credentials_v5) != 0)
-  */
- enum cc_credential_versions {
--    cc_credentials_v4 = 1,
-+    /* cc_credentials_v4 = 1, */
-     cc_credentials_v5 = 2,
--    cc_credentials_v4_v5 = 3
-+    /* cc_credentials_v4_v5 = 3 */
- };
- 
- /*!
-@@ -353,29 +352,6 @@ enum cc_lock_modes {
-     cc_lock_block = 1
- };
- 
--/*!
-- * Sizes of fields in cc_credentials_v4_t.
-- */
--enum {
--    /* Make sure all of these are multiples of four (for alignment sanity) */
--    cc_v4_name_size     = 40,
--    cc_v4_instance_size = 40,
--    cc_v4_realm_size    = 40,
--    cc_v4_ticket_size   = 1254,
--    cc_v4_key_size      = 8
--};
--
--/*!
-- * String to key type (Kerberos v4 only)
-- */
--enum cc_string_to_key_type {
--    cc_v4_stk_afs = 0,
--    cc_v4_stk_des = 1,
--    cc_v4_stk_columbia_special = 2,
--    cc_v4_stk_krb5 = 3,
--    cc_v4_stk_unknown = 4
--};
--
- /*!@}*/
- 
- /*!
-@@ -482,15 +458,13 @@ typedef cc_ccache_iterator_d *cc_ccache_iterator_t;
-  * \defgroup cc_credentials_reference cc_credentials_t Overview
-  * @{
-  *
-- * The cc_credentials_t type is used to store a single set of
-- * credentials for either Kerberos v4 or Kerberos v5. In addition
-- * to its only function, release(), it contains a pointer to a
-- * cc_credentials_union structure. A cc_credentials_union
-+ * The cc_credentials_t type is used to store a single set of credentials for
-+ * Kerberos v5. In addition to its only function, release(), it contains a
-+ * pointer to a cc_credentials_union structure. A cc_credentials_union
-  * structure contains an integer of the enumerator type
-- * cc_credentials_version, which is either #cc_credentials_v4 or
-- * #cc_credentials_v5, and a pointer union, which contains either a
-- * cc_credentials_v4_t pointer or a cc_credentials_v5_t pointer,
-- * depending on the value in version.
-+ * cc_credentials_version, which is #cc_credentials_v5, and a pointer union,
-+ * which contains a cc_credentials_v5_t pointer, depending on the value in
-+ * version.
-  *
-  * Variables of the type cc_credentials_t are allocated by the CCAPI
-  * implementation, and should be released with their release()
-@@ -501,43 +475,6 @@ typedef cc_ccache_iterator_d *cc_ccache_iterator_t;
-  * For API functions see \ref cc_credentials_f.
-  */
- 
--/*!
-- * If a cc_credentials_t variable is used to store Kerberos v4
-- * credentials, then credentials.credentials_v4 points to a v4
-- * credentials structure.  This structure is similar to a
-- * krb4 API CREDENTIALS structure.
-- */
--struct cc_credentials_v4_t {
--    cc_uint32       version;
--    /*! A properly quoted string representation of the first component of the client principal */
--    char            principal [cc_v4_name_size];
--    /*! A properly quoted string representation of the second component of the client principal */
--    char            principal_instance [cc_v4_instance_size];
--    /*! A properly quoted string representation of the first component of the service principal */
--    char            service [cc_v4_name_size];
--    /*! A properly quoted string representation of the second component of the service principal */
--    char            service_instance [cc_v4_instance_size];
--    /*! A properly quoted string representation of the realm */
--    char            realm [cc_v4_realm_size];
--    /*! Ticket session key */
--    unsigned char   session_key [cc_v4_key_size];
--    /*! Key version number */
--    cc_int32        kvno;
--    /*! String to key type used.  See cc_string_to_key_type for valid values */
--    cc_int32        string_to_key_type;
--    /*! Time when the ticket was issued */
--    cc_time_t       issue_date;
--    /*! Ticket lifetime in 5 minute units */
--    cc_int32        lifetime;
--    /*! IPv4 address of the client the ticket was issued for */
--    cc_uint32       address;
--    /*! Ticket size (no greater than cc_v4_ticket_size) */
--    cc_int32        ticket_size;
--    /*! Ticket data */
--    unsigned char   ticket [cc_v4_ticket_size];
--};
--typedef struct cc_credentials_v4_t cc_credentials_v4_t;
--
- /*!
-  * The CCAPI data structure.  This structure is similar to a krb5_data structure.
-  * In a v5 credentials structure, cc_data structures are used
-@@ -602,8 +539,6 @@ struct cc_credentials_union {
-     cc_uint32                   version;
-     /*! The credentials. */
-     union {
--        /*! If \a version is #cc_credentials_v4, a pointer to a cc_credentials_v4_t. */
--        cc_credentials_v4_t*    credentials_v4;
-         /*! If \a version is #cc_credentials_v5, a pointer to a cc_credentials_v5_t. */
-         cc_credentials_v5_t*    credentials_v5;
-     }                           credentials;
-@@ -781,13 +716,11 @@ struct cc_context_f {
-      * \return On success, #ccNoError.  On failure, an error code representing the failure.
-      * \brief \b cc_context_create_ccache(): Create a new ccache.
-      *
--     * Create a new credentials cache. The ccache is uniquely identified by its name.
--     * The principal given is also associated with the ccache and the credentials
--     * version specified. A NULL name is not allowed (and ccErrBadName is returned
--     * if one is passed in). Only cc_credentials_v4 and cc_credentials_v5 are valid
--     * input values for cred_vers. If you want to create a new ccache that will hold
--     * both versions of credentials, call cc_context_create_ccache() with one version,
--     * and then cc_ccache_set_principal() with the other version.
-+     * Create a new credentials cache. The ccache is uniquely identified by
-+     * its name.  The principal given is also associated with the ccache and
-+     * the credentials version specified. A NULL name is not allowed (and
-+     * ccErrBadName is returned if one is passed in). Only cc_credentials_v5
-+     * can be an input value for cred_vers.
-      *
-      * If you want to create a new ccache (with a unique name), you should use
-      * cc_context_create_new_ccache() instead. If you want to create or reinitialize
-@@ -814,10 +747,9 @@ struct cc_context_f {
-      * cc_context_get_default_ccache_name()); see the description of
-      * cc_context_get_default_ccache_name() for details.
-      *
--     * The principal should be a C string containing an unparsed Kerberos principal
--     * in the format of the appropriate Kerberos version, i.e. \verbatim foo.bar/@BAZ
--     * \endverbatim for Kerberos v4 and \verbatim foo/bar/@BAZ \endverbatim
--     * for Kerberos v5.
-+     * The principal should be a C string containing an unparsed Kerberos
-+     * principal in the format of the appropriate Kerberos version,
-+     * i.e. \verbatim foo/bar/@BAZ \endverbatim for Kerberos v5.
-      */
-     cc_int32 (*create_ccache) (cc_context_t  in_context,
-                                const char   *in_name,
-@@ -1014,14 +946,11 @@ struct cc_ccache_f {
-      * \return On success, #ccNoError.  On failure, an error code representing the failure.
-      * \brief \b cc_ccache_get_credentials_version(): Get the credentials version of a ccache.
-      *
--     * cc_ccache_get_credentials_version() returns one value of the enumerated type
--     * cc_credentials_vers. The possible return values are #cc_credentials_v4
--     * (if ccache's v4 principal has been set), #cc_credentials_v5
--     * (if ccache's v5 principal has been set), or #cc_credentials_v4_v5
--     * (if both ccache's v4 and v5 principals have been set). A ccache's
--     * principal is set with one of cc_context_create_ccache(),
--     * cc_context_create_new_ccache(), cc_context_create_default_ccache(), or
--     * cc_ccache_set_principal().
-+     * cc_ccache_get_credentials_version() returns one value of the enumerated
-+     * type cc_credentials_vers. The return value is #cc_credentials_v5 (if
-+     * ccache's v5 principal has been set).  A ccache's principal is set with
-+     * one of cc_context_create_ccache(), cc_context_create_new_ccache(),
-+     * cc_context_create_default_ccache(), or cc_ccache_set_principal().
-      */
-     cc_int32 (*get_credentials_version) (cc_ccache_t  in_ccache,
-                                          cc_uint32   *out_credentials_version);
-@@ -1046,10 +975,7 @@ struct cc_ccache_f {
-      *
-      * Return the principal for the ccache that was set via cc_context_create_ccache(),
-      * cc_context_create_default_ccache(), cc_context_create_new_ccache(), or
--     * cc_ccache_set_principal(). Principals for v4 and v5 are separate, but
--     * should be kept synchronized for each ccache; they can be retrieved by
--     * passing cc_credentials_v4 or cc_credentials_v5 in cred_vers. Passing
--     * cc_credentials_v4_v5 will result in the error ccErrBadCredentialsVersion.
-+     * cc_ccache_set_principal().
-      */
-     cc_int32 (*get_principal) (cc_ccache_t  in_ccache,
-                                cc_uint32    in_credentials_version,
-@@ -1063,10 +989,7 @@ struct cc_ccache_f {
-      * \return On success, #ccNoError.  On failure, an error code representing the failure.
-      * \brief \b cc_ccache_set_principal(): Set the principal of a ccache.
-      *
--     * Set the a principal for ccache. The v4 and v5 principals can be set
--     * independently, but they should always be kept equal, up to differences in
--     * string representation between v4 and v5. Passing cc_credentials_v4_v5 in
--     * cred_vers will result in the error ccErrBadCredentialsVersion.
-+     * Set the a principal for ccache.
-      */
-     cc_int32 (*set_principal) (cc_ccache_t  io_ccache,
-                                cc_uint32    in_credentials_version,
-@@ -1083,12 +1006,13 @@ struct cc_ccache_f {
-      * See the description of the credentials types for the meaning of
-      * cc_credentials_union fields.
-      *
--     * Before credentials of a specific credential type can be stored in a ccache,
--     * the corresponding principal version has to be set. For example, before you can
--     * store Kerberos v4 credentials in a ccache, the Kerberos v4 principal has to be set
--     * either by cc_context_create_ccache(), cc_context_create_default_ccache(),
--     * cc_context_create_new_ccache(), or cc_ccache_set_principal(); likewise for
--     * Kerberos v5. Otherwise, ccErrBadCredentialsVersion is returned.
-+     * Before credentials of a specific credential type can be stored in a
-+     * ccache, the corresponding principal version has to be set.  That is,
-+     * before you can store Kerberos v5 credentials in a ccache, the Kerberos
-+     * v5 principal has to be set either by cc_context_create_ccache(),
-+     * cc_context_create_default_ccache(), cc_context_create_new_ccache(), or
-+     * cc_ccache_set_principal(); otherwise, ccErrBadCredentialsVersion is
-+     * returned.
-      */
-     cc_int32 (*store_credentials) (cc_ccache_t                 io_ccache,
-                                    const cc_credentials_union *in_credentials_union);
-diff --git a/src/include/CredentialsCache2.h b/src/include/CredentialsCache2.h
-index b3b48996d..9e5a346ac 100644
---- a/src/include/CredentialsCache2.h
-+++ b/src/include/CredentialsCache2.h
-@@ -85,36 +85,13 @@ typedef struct cc_credentials_v5_compat {
-     cc_data_compat**            authdata;
- } cc_credentials_v5_compat;
- 
--enum {
--    MAX_V4_CRED_LEN = 1250
--};
--
- enum {
-     KRB_NAME_SZ = 40,
-     KRB_INSTANCE_SZ = 40,
-     KRB_REALM_SZ = 40
- };
- 
--typedef struct cc_credentials_v4_compat {
--    unsigned char       kversion;
--    char                principal[KRB_NAME_SZ+1];
--    char                principal_instance[KRB_INSTANCE_SZ+1];
--    char                service[KRB_NAME_SZ+1];
--    char                service_instance[KRB_INSTANCE_SZ+1];
--    char                realm[KRB_REALM_SZ+1];
--    unsigned char       session_key[8];
--    cc_int32            kvno;
--    cc_int32            str_to_key;
--    long                issue_date;
--    cc_int32            lifetime;
--    cc_uint32           address;
--    cc_int32            ticket_sz;
--    unsigned char       ticket[MAX_V4_CRED_LEN];
--    unsigned long       oops;
--} cc_credentials_v4_compat;
--
- typedef union cred_ptr_union_compat {
--    cc_credentials_v4_compat* pV4Cred;
-     cc_credentials_v5_compat* pV5Cred;
- } cred_ptr_union_compat;
- 
-@@ -135,7 +112,6 @@ typedef struct infoNC infoNC;
- 
- /* Some old type names */
- 
--typedef cc_credentials_v4_compat V4Cred_type;
- typedef cc_credentials_v5_compat cc_creds;
- struct ccache_cit;
- typedef struct ccache_cit ccache_cit;
-@@ -166,7 +142,7 @@ enum {
- 
- enum {
-     CC_CRED_UNKNOWN,
--    CC_CRED_V4,
-+    /* CC_CRED_V4, */
-     CC_CRED_V5,
-     CC_CRED_MAX
- };
-diff --git a/src/lib/krb5/ccache/ccapi/stdcc.c b/src/lib/krb5/ccache/ccapi/stdcc.c
-index db69eebb4..cac61e45c 100644
---- a/src/lib/krb5/ccache/ccapi/stdcc.c
-+++ b/src/lib/krb5/ccache/ccapi/stdcc.c
-@@ -589,7 +589,6 @@ krb5_stdccv3_next_cred (krb5_context context,
-         err = stdccv3_setup (context, ccapi_data);
-     }
- 
--    /* Note: CCAPI v3 ccaches can contain both v4 and v5 creds */
-     while (!err) {
-         err = cc_credentials_iterator_next (iterator, &credentials);
- 
-@@ -836,7 +835,6 @@ krb5_stdccv3_remove (krb5_context context,
-                                                  &iterator);
-     }
- 
--    /* Note: CCAPI v3 ccaches can contain both v4 and v5 creds */
-     while (!err && !found) {
-         cc_credentials_t credentials = NULL;
- 
-diff --git a/src/lib/krb5/ccache/ccapi/stdcc_util.c b/src/lib/krb5/ccache/ccapi/stdcc_util.c
-index 62d847c18..1f2a3865c 100644
---- a/src/lib/krb5/ccache/ccapi/stdcc_util.c
-+++ b/src/lib/krb5/ccache/ccapi/stdcc_util.c
-@@ -521,9 +521,6 @@ cred_union_release (cc_credentials_union *in_cred_union)
- 
-             free (cv5);
- 
--        } else if (in_cred_union->version == cc_credentials_v4 &&
--                   in_cred_union->credentials.credentials_v4) {
--            free (in_cred_union->credentials.credentials_v4);
-         }
-         free ((cc_credentials_union *) in_cred_union);
-     }
-@@ -892,10 +889,7 @@ static void deep_free_cc_v5_creds (cc_creds* creds)
- 
- static void deep_free_cc_creds (cred_union creds)
- {
--    if (creds.cred_type == CC_CRED_V4) {
--        /* we shouldn't get this, of course */
--        free (creds.cred.pV4Cred);
--    } else if (creds.cred_type == CC_CRED_V5) {
-+    if (creds.cred_type == CC_CRED_V5) {
-         deep_free_cc_v5_creds (creds.cred.pV5Cred);
-     }
- }
-diff --git a/src/windows/kfwlogon/kfwlogon.h b/src/windows/kfwlogon/kfwlogon.h
-index b2674573e..622d5665c 100644
---- a/src/windows/kfwlogon/kfwlogon.h
-+++ b/src/windows/kfwlogon/kfwlogon.h
-@@ -94,7 +94,7 @@ typedef int cc_int32;
- 
- enum {
-     CC_CRED_VUNKNOWN = 0,       // For validation
--    CC_CRED_V4 = 1,
-+    /* CC_CRED_V4 = 1, */
-     CC_CRED_V5 = 2,
-     CC_CRED_VMAX = 3            // For validation
- };
-diff --git a/src/windows/leashdll/leash-int.h b/src/windows/leashdll/leash-int.h
-index cb40c607c..bf6f6a08d 100644
---- a/src/windows/leashdll/leash-int.h
-+++ b/src/windows/leashdll/leash-int.h
-@@ -182,7 +182,7 @@ typedef int cc_int32;
- 
- enum {
-     CC_CRED_VUNKNOWN = 0,       // For validation
--    CC_CRED_V4 = 1,
-+    /* CC_CRED_V4 = 1, */
-     CC_CRED_V5 = 2,
-     CC_CRED_VMAX = 3            // For validation
- };
-diff --git a/src/windows/lib/cacheapi.h b/src/windows/lib/cacheapi.h
-index b30857810..9aab4a098 100644
---- a/src/windows/lib/cacheapi.h
-+++ b/src/windows/lib/cacheapi.h
-@@ -126,52 +126,8 @@ typedef struct _cc_creds {
-     cc_data **  authdata;
- } cc_creds;
- 
--// begin V4 stuff
--// use an enumerated type so all callers infer the same meaning
--// these values are what krbv4win uses internally.
--#define STK_AFS	0
--#define STK_DES	1
--
--// K4 uses a MAX_KTXT_LEN of 1250 to hold a ticket
--// K95 uses 256
--// To be safe I'll use the larger number, but a factor of 5!!!
--#define MAX_V4_CRED_LEN	1250
--
--// V4 Credentials
--
--enum {
--    KRB_NAME_SZ = 40,
--    KRB_INSTANCE_SZ = 40,
--    KRB_REALM_SZ = 40
--};
--
--typedef struct cc_V4credential {
--    unsigned char  kversion;
--    char           principal[KRB_NAME_SZ + 1];
--    char           principal_instance[KRB_INSTANCE_SZ + 1];
--    char       	   service[KRB_NAME_SZ + 1];
--    char       	   service_instance[KRB_INSTANCE_SZ + 1];
--    char           realm[KRB_REALM_SZ + 1];
--    unsigned char  session_key[8];
--    cc_int32       kvno;           // k95 used BYTE skvno
--    cc_int32       str_to_key;     // k4 infers dynamically, k95 stores
--    long           issue_date;     // k95 called this issue_time
--    cc_int32       lifetime;       // k95 used LONG expiration_time
--    cc_uint32      address;        // IP Address of local host
--    cc_int32       ticket_sz;      // k95 used BYTE, k4 ktext uses int to hold up to 1250
--    unsigned char  ticket[MAX_V4_CRED_LEN];
--    unsigned long  oops;           // zero to catch runaways
--} V4Cred_type;
--
--enum {
--    CC_CRED_VUNKNOWN = 0,       // For validation
--    CC_CRED_V4 = 1,
--    CC_CRED_V5 = 2,
--    CC_CRED_VMAX = 3            // For validation
--};
- 
- typedef union cred_ptr_union_type {
--    V4Cred_type* pV4Cred;
-     cc_creds*    pV5Cred;
- } cred_ptr_union;
- 
-@@ -223,16 +179,15 @@ cc_get_change_time(
- **   create, open, close, destroy, get_principal, get_cred_version, &
- **   lock_request
- **
--** Multiple NCs are allowed within the main cache.  Each has a Name
--** and kerberos version # (V4 or V5).  Caller gets "ccache_ptr"s for
--** NCs.
-+** Multiple NCs are allowed within the main cache.  Each has a Name and
-+** kerberos version # (V5).  Caller gets "ccache_ptr"s for NCs.
- */
- CCACHE_API
- cc_create(
-     apiCB* cc_ctx,          // >  DLL's primary control structure
-     const char* name,       // >  name of cache to be [destroyed if exists, then] created
-     const char* principal,
--    cc_int32 vers,          // >  ticket version (CC_CRED_V4 or CC_CRED_V5)
-+    cc_int32 vers,          // >  ticket version (CC_CRED_V5)
-     cc_uint32 cc_flags,     // >  options
-     ccache_p** ccache_ptr   // <  NC control structure
-     );
-@@ -241,7 +196,7 @@ CCACHE_API
- cc_open(
-     apiCB* cc_ctx,          // >  DLL's primary control structure
-     const char* name,       // >  name of pre-created cache
--    cc_int32 vers,          // >  ticket version (CC_CRED_V4 or CC_CRED_V5)
-+    cc_int32 vers,          // >  ticket version (CC_CRED_V5)
-     cc_uint32 cc_flags,     // >  options
-     ccache_p** ccache_ptr   // <  NC control structure
-     );
diff --git a/Remove-PKINIT-draft-9-ASN.1-code-and-types.patch b/Remove-PKINIT-draft-9-ASN.1-code-and-types.patch
deleted file mode 100644
index ddbd8bb..0000000
--- a/Remove-PKINIT-draft-9-ASN.1-code-and-types.patch
+++ /dev/null
@@ -1,967 +0,0 @@
-From 054cd1bad9941e6936345da3e9a839c8fdbd9ba3 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Tue, 18 Jun 2019 11:40:48 -0400
-Subject: [PATCH] Remove PKINIT draft 9 ASN.1 code and types
-
-ticket: 8817
-(cherry picked from commit c82e21d8836d4cb4c6ac7047752c9f600cb1ce33)
----
- src/include/k5-int-pkinit.h        | 74 --------------------------
- src/include/k5-int.h               | 30 +----------
- src/lib/krb5/asn.1/asn1_k_encode.c | 81 ----------------------------
- src/lib/krb5/os/accessor.c         |  7 ---
- src/tests/asn.1/krb5_decode_test.c | 41 --------------
- src/tests/asn.1/krb5_encode_test.c | 40 --------------
- src/tests/asn.1/ktest.c            | 85 ------------------------------
- src/tests/asn.1/ktest.h            | 11 ----
- src/tests/asn.1/ktest_equal.c      | 51 ------------------
- src/tests/asn.1/ktest_equal.h      |  3 --
- src/tests/asn.1/pkinit_encode.out  |  5 --
- src/tests/asn.1/pkinit_trval.out   | 47 -----------------
- 12 files changed, 1 insertion(+), 474 deletions(-)
-
-diff --git a/src/include/k5-int-pkinit.h b/src/include/k5-int-pkinit.h
-index 4622a629e..c23cfd304 100644
---- a/src/include/k5-int-pkinit.h
-+++ b/src/include/k5-int-pkinit.h
-@@ -45,14 +45,6 @@ typedef struct _krb5_pk_authenticator {
-     krb5_data      *freshnessToken;
- } krb5_pk_authenticator;
- 
--/* PKAuthenticator draft9 */
--typedef struct _krb5_pk_authenticator_draft9 {
--    krb5_principal  kdcName;
--    krb5_int32      cusec;  /* (0..999999) */
--    krb5_timestamp  ctime;
--    krb5_int32      nonce;  /* (0..4294967295) */
--} krb5_pk_authenticator_draft9;
--
- /* AlgorithmIdentifier */
- typedef struct _krb5_algorithm_identifier {
-     krb5_data algorithm;      /* OID */
-@@ -74,12 +66,6 @@ typedef struct _krb5_auth_pack {
-     krb5_data                   **supportedKDFs; /* OIDs of KDFs; OPTIONAL */
- } krb5_auth_pack;
- 
--/* AuthPack draft9 */
--typedef struct _krb5_auth_pack_draft9 {
--    krb5_pk_authenticator_draft9 pkAuthenticator;
--    krb5_subject_pk_info        *clientPublicValue; /* Optional */
--} krb5_auth_pack_draft9;
--
- /* ExternalPrincipalIdentifier */
- typedef struct _krb5_external_principal_identifier {
-     krb5_data subjectName; /* Optional */
-@@ -87,14 +73,6 @@ typedef struct _krb5_external_principal_identifier {
-     krb5_data subjectKeyIdentifier; /* Optional */
- } krb5_external_principal_identifier;
- 
--/* PA-PK-AS-REQ (Draft 9 -- PA TYPE 14) */
--/* This has four fields, but we only care about the first and third for
-- * encoding, and the only about the first for decoding. */
--typedef struct _krb5_pa_pk_as_req_draft9 {
--    krb5_data signedAuthPack;
--    krb5_data kdcCert; /* Optional */
--} krb5_pa_pk_as_req_draft9;
--
- /* PA-PK-AS-REQ (rfc4556 -- PA TYPE 16) */
- typedef struct _krb5_pa_pk_as_req {
-     krb5_data signedAuthPack;
-@@ -116,37 +94,12 @@ typedef struct _krb5_kdc_dh_key_info {
-     krb5_timestamp  dhKeyExpiration; /* Optional */
- } krb5_kdc_dh_key_info;
- 
--/* KDCDHKeyInfo draft9*/
--typedef struct _krb5_kdc_dh_key_info_draft9 {
--    krb5_data       subjectPublicKey; /* BIT STRING */
--    krb5_int32      nonce;  /* (0..4294967295) */
--} krb5_kdc_dh_key_info_draft9;
--
- /* ReplyKeyPack */
- typedef struct _krb5_reply_key_pack {
-     krb5_keyblock   replyKey;
-     krb5_checksum   asChecksum;
- } krb5_reply_key_pack;
- 
--/* ReplyKeyPack */
--typedef struct _krb5_reply_key_pack_draft9 {
--    krb5_keyblock   replyKey;
--    krb5_int32      nonce;
--} krb5_reply_key_pack_draft9;
--
--/* PA-PK-AS-REP (Draft 9 -- PA TYPE 15) */
--typedef struct _krb5_pa_pk_as_rep_draft9 {
--    enum krb5_pa_pk_as_rep_draft9_selection {
--        choice_pa_pk_as_rep_draft9_UNKNOWN = -1,
--        choice_pa_pk_as_rep_draft9_dhSignedData = 0,
--        choice_pa_pk_as_rep_draft9_encKeyPack = 1
--    } choice;
--    union krb5_pa_pk_as_rep_draft9_choices {
--        krb5_data dhSignedData;
--        krb5_data encKeyPack;
--    } u;
--} krb5_pa_pk_as_rep_draft9;
--
- /* PA-PK-AS-REP (rfc4556 -- PA TYPE 17) */
- typedef struct _krb5_pa_pk_as_rep {
-     enum krb5_pa_pk_as_rep_selection {
-@@ -186,34 +139,18 @@ typedef struct _krb5_pkinit_supp_pub_info {
- krb5_error_code
- encode_krb5_pa_pk_as_req(const krb5_pa_pk_as_req *rep, krb5_data **code);
- 
--krb5_error_code
--encode_krb5_pa_pk_as_req_draft9(const krb5_pa_pk_as_req_draft9 *rep,
--                                krb5_data **code);
--
- krb5_error_code
- encode_krb5_pa_pk_as_rep(const krb5_pa_pk_as_rep *rep, krb5_data **code);
- 
--krb5_error_code
--encode_krb5_pa_pk_as_rep_draft9(const krb5_pa_pk_as_rep_draft9 *rep,
--                                krb5_data **code);
--
- krb5_error_code
- encode_krb5_auth_pack(const krb5_auth_pack *rep, krb5_data **code);
- 
--krb5_error_code
--encode_krb5_auth_pack_draft9(const krb5_auth_pack_draft9 *rep,
--                             krb5_data **code);
--
- krb5_error_code
- encode_krb5_kdc_dh_key_info(const krb5_kdc_dh_key_info *rep, krb5_data **code);
- 
- krb5_error_code
- encode_krb5_reply_key_pack(const krb5_reply_key_pack *, krb5_data **code);
- 
--krb5_error_code
--encode_krb5_reply_key_pack_draft9(const krb5_reply_key_pack_draft9 *,
--                                  krb5_data **code);
--
- krb5_error_code
- encode_krb5_td_trusted_certifiers(krb5_external_principal_identifier *const *,
-                                   krb5_data **code);
-@@ -237,19 +174,12 @@ encode_krb5_pkinit_supp_pub_info(const krb5_pkinit_supp_pub_info *,
- krb5_error_code
- decode_krb5_pa_pk_as_req(const krb5_data *, krb5_pa_pk_as_req **);
- 
--krb5_error_code
--decode_krb5_pa_pk_as_req_draft9(const krb5_data *,
--                                krb5_pa_pk_as_req_draft9 **);
--
- krb5_error_code
- decode_krb5_pa_pk_as_rep(const krb5_data *, krb5_pa_pk_as_rep **);
- 
- krb5_error_code
- decode_krb5_auth_pack(const krb5_data *, krb5_auth_pack **);
- 
--krb5_error_code
--decode_krb5_auth_pack_draft9(const krb5_data *, krb5_auth_pack_draft9 **);
--
- krb5_error_code
- decode_krb5_kdc_dh_key_info(const krb5_data *, krb5_kdc_dh_key_info **);
- 
-@@ -259,10 +189,6 @@ decode_krb5_principal_name(const krb5_data *, krb5_principal_data **);
- krb5_error_code
- decode_krb5_reply_key_pack(const krb5_data *, krb5_reply_key_pack **);
- 
--krb5_error_code
--decode_krb5_reply_key_pack_draft9(const krb5_data *,
--                                  krb5_reply_key_pack_draft9 **);
--
- krb5_error_code
- decode_krb5_td_trusted_certifiers(const krb5_data *,
-                                   krb5_external_principal_identifier ***);
-diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index 0857fd1cc..cb328785d 100644
---- a/src/include/k5-int.h
-+++ b/src/include/k5-int.h
-@@ -1836,7 +1836,7 @@ krb5int_random_string(krb5_context, char *string, unsigned int length);
- /* To keep happy libraries which are (for now) accessing internal stuff */
- 
- /* Make sure to increment by one when changing the struct */
--#define KRB5INT_ACCESS_STRUCT_VERSION 22
-+#define KRB5INT_ACCESS_STRUCT_VERSION 23
- 
- typedef struct _krb5int_access {
-     krb5_error_code (*auth_con_get_subkey_enctype)(krb5_context,
-@@ -1865,10 +1865,6 @@ typedef struct _krb5int_access {
-     krb5_error_code
-     (*encode_krb5_auth_pack)(const krb5_auth_pack *rep, krb5_data **code);
- 
--    krb5_error_code
--    (*encode_krb5_auth_pack_draft9)(const krb5_auth_pack_draft9 *rep,
--                                    krb5_data **code);
--
-     krb5_error_code
-     (*encode_krb5_kdc_dh_key_info)(const krb5_kdc_dh_key_info *rep,
-                                    krb5_data **code);
-@@ -1877,26 +1873,14 @@ typedef struct _krb5int_access {
-     (*encode_krb5_pa_pk_as_rep)(const krb5_pa_pk_as_rep *rep,
-                                 krb5_data **code);
- 
--    krb5_error_code
--    (*encode_krb5_pa_pk_as_rep_draft9)(const krb5_pa_pk_as_rep_draft9 *rep,
--                                       krb5_data **code);
--
-     krb5_error_code
-     (*encode_krb5_pa_pk_as_req)(const krb5_pa_pk_as_req *rep,
-                                 krb5_data **code);
- 
--    krb5_error_code
--    (*encode_krb5_pa_pk_as_req_draft9)(const krb5_pa_pk_as_req_draft9 *rep,
--                                       krb5_data **code);
--
-     krb5_error_code
-     (*encode_krb5_reply_key_pack)(const krb5_reply_key_pack *,
-                                   krb5_data **code);
- 
--    krb5_error_code
--    (*encode_krb5_reply_key_pack_draft9)(const krb5_reply_key_pack_draft9 *,
--                                         krb5_data **code);
--
-     krb5_error_code
-     (*encode_krb5_td_dh_parameters)(krb5_algorithm_identifier *const *,
-                                     krb5_data **code);
-@@ -1908,17 +1892,9 @@ typedef struct _krb5int_access {
-     krb5_error_code
-     (*decode_krb5_auth_pack)(const krb5_data *, krb5_auth_pack **);
- 
--    krb5_error_code
--    (*decode_krb5_auth_pack_draft9)(const krb5_data *,
--                                    krb5_auth_pack_draft9 **);
--
-     krb5_error_code
-     (*decode_krb5_pa_pk_as_req)(const krb5_data *, krb5_pa_pk_as_req **);
- 
--    krb5_error_code
--    (*decode_krb5_pa_pk_as_req_draft9)(const krb5_data *,
--                                       krb5_pa_pk_as_req_draft9 **);
--
-     krb5_error_code
-     (*decode_krb5_pa_pk_as_rep)(const krb5_data *, krb5_pa_pk_as_rep **);
- 
-@@ -1931,10 +1907,6 @@ typedef struct _krb5int_access {
-     krb5_error_code
-     (*decode_krb5_reply_key_pack)(const krb5_data *, krb5_reply_key_pack **);
- 
--    krb5_error_code
--    (*decode_krb5_reply_key_pack_draft9)(const krb5_data *,
--                                         krb5_reply_key_pack_draft9 **);
--
-     krb5_error_code
-     (*decode_krb5_td_dh_parameters)(const krb5_data *,
-                                     krb5_algorithm_identifier ***);
-diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c
-index 81a34bac9..a026ab390 100644
---- a/src/lib/krb5/asn.1/asn1_k_encode.c
-+++ b/src/lib/krb5/asn.1/asn1_k_encode.c
-@@ -1446,19 +1446,6 @@ static const struct atype_info *pk_authenticator_fields[] = {
- };
- DEFSEQTYPE(pk_authenticator, krb5_pk_authenticator, pk_authenticator_fields);
- 
--DEFFIELD(pkauth9_0, krb5_pk_authenticator_draft9, kdcName, 0, principal);
--DEFFIELD(pkauth9_1, krb5_pk_authenticator_draft9, kdcName, 1,
--         realm_of_principal);
--DEFFIELD(pkauth9_2, krb5_pk_authenticator_draft9, cusec, 2, int32);
--DEFFIELD(pkauth9_3, krb5_pk_authenticator_draft9, ctime, 3, kerberos_time);
--DEFFIELD(pkauth9_4, krb5_pk_authenticator_draft9, nonce, 4, int32);
--static const struct atype_info *pk_authenticator_draft9_fields[] = {
--    &k5_atype_pkauth9_0, &k5_atype_pkauth9_1, &k5_atype_pkauth9_2,
--    &k5_atype_pkauth9_3, &k5_atype_pkauth9_4
--};
--DEFSEQTYPE(pk_authenticator_draft9, krb5_pk_authenticator_draft9,
--           pk_authenticator_draft9_fields);
--
- DEFCOUNTEDSTRINGTYPE(s_bitstring, char *, unsigned int,
-                      k5_asn1_encode_bitstring, k5_asn1_decode_bitstring,
-                      ASN1_BITSTRING);
-@@ -1488,15 +1475,6 @@ static const struct atype_info *auth_pack_fields[] = {
- };
- DEFSEQTYPE(auth_pack, krb5_auth_pack, auth_pack_fields);
- 
--DEFFIELD(auth_pack9_0, krb5_auth_pack_draft9, pkAuthenticator, 0,
--         pk_authenticator_draft9);
--DEFFIELD(auth_pack9_1, krb5_auth_pack_draft9, clientPublicValue, 1,
--         opt_subject_pk_info_ptr);
--static const struct atype_info *auth_pack_draft9_fields[] = {
--    &k5_atype_auth_pack9_0, &k5_atype_auth_pack9_1
--};
--DEFSEQTYPE(auth_pack_draft9, krb5_auth_pack_draft9, auth_pack_draft9_fields);
--
- DEFFIELD_IMPLICIT(extprinc_0, krb5_external_principal_identifier,
-                   subjectName, 0, opt_ostring_data);
- DEFFIELD_IMPLICIT(extprinc_1, krb5_external_principal_identifier,
-@@ -1529,29 +1507,6 @@ static const struct atype_info *pa_pk_as_req_fields[] = {
- };
- DEFSEQTYPE(pa_pk_as_req, krb5_pa_pk_as_req, pa_pk_as_req_fields);
- 
--/*
-- * In draft-ietf-cat-kerberos-pk-init-09, this sequence has four fields, but we
-- * only ever use the first and third.  The fields are specified as explicitly
-- * tagged, but our historical behavior is to pretend that they are wrapped in
-- * IMPLICIT OCTET STRING (i.e., generate primitive context tags), and we don't
-- * want to change that without interop testing.
-- */
--DEFFIELD_IMPLICIT(pa_pk_as_req9_0, krb5_pa_pk_as_req_draft9, signedAuthPack, 0,
--                  ostring_data);
--DEFFIELD_IMPLICIT(pa_pk_as_req9_2, krb5_pa_pk_as_req_draft9, kdcCert, 2,
--                  opt_ostring_data);
--static const struct atype_info *pa_pk_as_req_draft9_fields[] = {
--    &k5_atype_pa_pk_as_req9_0, &k5_atype_pa_pk_as_req9_2
--};
--DEFSEQTYPE(pa_pk_as_req_draft9, krb5_pa_pk_as_req_draft9,
--           pa_pk_as_req_draft9_fields);
--/* For decoding, we only care about the first field; we can ignore the rest. */
--static const struct atype_info *pa_pk_as_req_draft9_decode_fields[] = {
--    &k5_atype_pa_pk_as_req9_0
--};
--DEFSEQTYPE(pa_pk_as_req_draft9_decode, krb5_pa_pk_as_req_draft9,
--           pa_pk_as_req_draft9_decode_fields);
--
- DEFFIELD_IMPLICIT(dh_rep_info_0, krb5_dh_rep_info, dhSignedData, 0,
-                   ostring_data);
- DEFFIELD(dh_rep_info_1, krb5_dh_rep_info, serverDHNonce, 1, opt_ostring_data);
-@@ -1577,14 +1532,6 @@ static const struct atype_info *reply_key_pack_fields[] = {
- };
- DEFSEQTYPE(reply_key_pack, krb5_reply_key_pack, reply_key_pack_fields);
- 
--DEFFIELD(key_pack9_0, krb5_reply_key_pack_draft9, replyKey, 0, encryption_key);
--DEFFIELD(key_pack9_1, krb5_reply_key_pack_draft9, nonce, 1, int32);
--static const struct atype_info *reply_key_pack_draft9_fields[] = {
--    &k5_atype_key_pack9_0, &k5_atype_key_pack9_1
--};
--DEFSEQTYPE(reply_key_pack_draft9, krb5_reply_key_pack_draft9,
--           reply_key_pack_draft9_fields);
--
- DEFCTAGGEDTYPE(pa_pk_as_rep_0, 0, dh_rep_info);
- DEFCTAGGEDTYPE_IMPLICIT(pa_pk_as_rep_1, 1, ostring_data);
- static const struct atype_info *pa_pk_as_rep_alternatives[] = {
-@@ -1595,44 +1542,16 @@ DEFCHOICETYPE(pa_pk_as_rep_choice, union krb5_pa_pk_as_rep_choices,
- DEFCOUNTEDTYPE_SIGNED(pa_pk_as_rep, krb5_pa_pk_as_rep, u, choice,
-                       pa_pk_as_rep_choice);
- 
--/*
-- * draft-ietf-cat-kerberos-pk-init-09 specifies these alternatives as
-- * explicitly tagged SignedData and EnvelopedData respectively, which means
-- * they should have constructed context tags.  However, our historical behavior
-- * is to use primitive context tags, and we don't want to change that behavior
-- * without interop testing.  We have the encodings for each alternative in a
-- * krb5_data object; pretend that they are wrapped in IMPLICIT OCTET STRING in
-- * order to wrap them in primitive [0] and [1] tags.
-- */
--DEFCTAGGEDTYPE_IMPLICIT(pa_pk_as_rep9_0, 0, ostring_data);
--DEFCTAGGEDTYPE_IMPLICIT(pa_pk_as_rep9_1, 1, ostring_data);
--static const struct atype_info *pa_pk_as_rep_draft9_alternatives[] = {
--    &k5_atype_pa_pk_as_rep9_0, &k5_atype_pa_pk_as_rep9_1
--};
--DEFCHOICETYPE(pa_pk_as_rep_draft9_choice,
--              union krb5_pa_pk_as_rep_draft9_choices,
--              enum krb5_pa_pk_as_rep_draft9_selection,
--              pa_pk_as_rep_draft9_alternatives);
--DEFCOUNTEDTYPE_SIGNED(pa_pk_as_rep_draft9, krb5_pa_pk_as_rep_draft9, u, choice,
--                      pa_pk_as_rep_draft9_choice);
--
- MAKE_ENCODER(encode_krb5_pa_pk_as_req, pa_pk_as_req);
- MAKE_DECODER(decode_krb5_pa_pk_as_req, pa_pk_as_req);
--MAKE_ENCODER(encode_krb5_pa_pk_as_req_draft9, pa_pk_as_req_draft9);
--MAKE_DECODER(decode_krb5_pa_pk_as_req_draft9, pa_pk_as_req_draft9_decode);
- MAKE_ENCODER(encode_krb5_pa_pk_as_rep, pa_pk_as_rep);
- MAKE_DECODER(decode_krb5_pa_pk_as_rep, pa_pk_as_rep);
--MAKE_ENCODER(encode_krb5_pa_pk_as_rep_draft9, pa_pk_as_rep_draft9);
- MAKE_ENCODER(encode_krb5_auth_pack, auth_pack);
- MAKE_DECODER(decode_krb5_auth_pack, auth_pack);
--MAKE_ENCODER(encode_krb5_auth_pack_draft9, auth_pack_draft9);
--MAKE_DECODER(decode_krb5_auth_pack_draft9, auth_pack_draft9);
- MAKE_ENCODER(encode_krb5_kdc_dh_key_info, kdc_dh_key_info);
- MAKE_DECODER(decode_krb5_kdc_dh_key_info, kdc_dh_key_info);
- MAKE_ENCODER(encode_krb5_reply_key_pack, reply_key_pack);
- MAKE_DECODER(decode_krb5_reply_key_pack, reply_key_pack);
--MAKE_ENCODER(encode_krb5_reply_key_pack_draft9, reply_key_pack_draft9);
--MAKE_DECODER(decode_krb5_reply_key_pack_draft9, reply_key_pack_draft9);
- MAKE_ENCODER(encode_krb5_td_trusted_certifiers,
-              seqof_external_principal_identifier);
- MAKE_DECODER(decode_krb5_td_trusted_certifiers,
-diff --git a/src/lib/krb5/os/accessor.c b/src/lib/krb5/os/accessor.c
-index d77f8c6b7..12a39a2ab 100644
---- a/src/lib/krb5/os/accessor.c
-+++ b/src/lib/krb5/os/accessor.c
-@@ -80,25 +80,18 @@ krb5int_accessor(krb5int_access *internals, krb5_int32 version)
- #define SC(FIELD, VAL)  S(FIELD, 0)
- #endif
-             SC (encode_krb5_pa_pk_as_req, encode_krb5_pa_pk_as_req),
--            SC (encode_krb5_pa_pk_as_req_draft9, encode_krb5_pa_pk_as_req_draft9),
-             SC (encode_krb5_pa_pk_as_rep, encode_krb5_pa_pk_as_rep),
--            SC (encode_krb5_pa_pk_as_rep_draft9, encode_krb5_pa_pk_as_rep_draft9),
-             SC (encode_krb5_auth_pack, encode_krb5_auth_pack),
--            SC (encode_krb5_auth_pack_draft9, encode_krb5_auth_pack_draft9),
-             SC (encode_krb5_kdc_dh_key_info, encode_krb5_kdc_dh_key_info),
-             SC (encode_krb5_reply_key_pack, encode_krb5_reply_key_pack),
--            SC (encode_krb5_reply_key_pack_draft9, encode_krb5_reply_key_pack_draft9),
-             SC (encode_krb5_td_trusted_certifiers, encode_krb5_td_trusted_certifiers),
-             SC (encode_krb5_td_dh_parameters, encode_krb5_td_dh_parameters),
-             SC (decode_krb5_pa_pk_as_req, decode_krb5_pa_pk_as_req),
--            SC (decode_krb5_pa_pk_as_req_draft9, decode_krb5_pa_pk_as_req_draft9),
-             SC (decode_krb5_pa_pk_as_rep, decode_krb5_pa_pk_as_rep),
-             SC (decode_krb5_auth_pack, decode_krb5_auth_pack),
--            SC (decode_krb5_auth_pack_draft9, decode_krb5_auth_pack_draft9),
-             SC (decode_krb5_kdc_dh_key_info, decode_krb5_kdc_dh_key_info),
-             SC (decode_krb5_principal_name, decode_krb5_principal_name),
-             SC (decode_krb5_reply_key_pack, decode_krb5_reply_key_pack),
--            SC (decode_krb5_reply_key_pack_draft9, decode_krb5_reply_key_pack_draft9),
-             SC (decode_krb5_td_trusted_certifiers, decode_krb5_td_trusted_certifiers),
-             SC (decode_krb5_td_dh_parameters, decode_krb5_td_dh_parameters),
-             SC (encode_krb5_kdc_req_body, encode_krb5_kdc_req_body),
-diff --git a/src/tests/asn.1/krb5_decode_test.c b/src/tests/asn.1/krb5_decode_test.c
-index cbd99ba63..7a116b40d 100644
---- a/src/tests/asn.1/krb5_decode_test.c
-+++ b/src/tests/asn.1/krb5_decode_test.c
-@@ -42,8 +42,6 @@ void krb5_ktest_free_enc_data(krb5_context context, krb5_enc_data *val);
- #ifndef DISABLE_PKINIT
- static int equal_principal(krb5_principal *ref, krb5_principal var);
- static void ktest_free_auth_pack(krb5_context context, krb5_auth_pack *val);
--static void ktest_free_auth_pack_draft9(krb5_context context,
--                                        krb5_auth_pack_draft9 *val);
- static void ktest_free_kdc_dh_key_info(krb5_context context,
-                                        krb5_kdc_dh_key_info *val);
- static void ktest_free_pa_pk_as_req(krb5_context context,
-@@ -52,8 +50,6 @@ static void ktest_free_pa_pk_as_rep(krb5_context context,
-                                     krb5_pa_pk_as_rep *val);
- static void ktest_free_reply_key_pack(krb5_context context,
-                                       krb5_reply_key_pack *val);
--static void ktest_free_reply_key_pack_draft9(krb5_context context,
--                                             krb5_reply_key_pack_draft9 *val);
- #endif
- static void ktest_free_kkdcp_message(krb5_context context,
-                                      krb5_kkdcp_message *val);
-@@ -1183,16 +1179,6 @@ int main(argc, argv)
-         ktest_empty_auth_pack(&ref);
-     }
- 
--    /****************************************************************/
--    /* decode_krb5_auth_pack_draft9 */
--    {
--        setup(krb5_auth_pack_draft9,ktest_make_sample_auth_pack_draft9);
--        decode_run("krb5_auth_pack_draft9","","30 75 A0 4F 30 4D A0 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A2 05 02 03 01 E2 40 A3 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A4 03 02 01 2A A1 22 30 20 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 03 09 00 6B 72 62 35 64 61 74 61",
--                   acc.decode_krb5_auth_pack_draft9,
--                   ktest_equal_auth_pack_draft9,ktest_free_auth_pack_draft9);
--        ktest_empty_auth_pack_draft9(&ref);
--    }
--
-     /****************************************************************/
-     /* decode_krb5_kdc_dh_key_info */
-     {
-@@ -1213,16 +1199,6 @@ int main(argc, argv)
-         ktest_empty_reply_key_pack(&ref);
-     }
- 
--    /****************************************************************/
--    /* decode_krb5_reply_key_pack_draft9 */
--    {
--        setup(krb5_reply_key_pack_draft9,ktest_make_sample_reply_key_pack_draft9);
--        decode_run("krb5_reply_key_pack_draft9","","30 1A A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 03 02 01 2A",
--                   acc.decode_krb5_reply_key_pack_draft9,
--                   ktest_equal_reply_key_pack_draft9,ktest_free_reply_key_pack_draft9);
--        ktest_empty_reply_key_pack_draft9(&ref);
--    }
--
-     /****************************************************************/
-     /* decode_krb5_principal_name */
-     /* We have no encoder for this type (KerberosName from RFC 4556); the
-@@ -1279,14 +1255,6 @@ ktest_free_auth_pack(krb5_context context, krb5_auth_pack *val)
-     free(val);
- }
- 
--static void
--ktest_free_auth_pack_draft9(krb5_context context, krb5_auth_pack_draft9 *val)
--{
--    if (val)
--        ktest_empty_auth_pack_draft9(val);
--    free(val);
--}
--
- static void
- ktest_free_kdc_dh_key_info(krb5_context context, krb5_kdc_dh_key_info *val)
- {
-@@ -1319,15 +1287,6 @@ ktest_free_reply_key_pack(krb5_context context, krb5_reply_key_pack *val)
-     free(val);
- }
- 
--static void
--ktest_free_reply_key_pack_draft9(krb5_context context,
--                                 krb5_reply_key_pack_draft9 *val)
--{
--    if (val)
--        ktest_empty_reply_key_pack_draft9(val);
--    free(val);
--}
--
- #endif /* not DISABLE_PKINIT */
- 
- static void
-diff --git a/src/tests/asn.1/krb5_encode_test.c b/src/tests/asn.1/krb5_encode_test.c
-index 3efbfb4c0..72c013468 100644
---- a/src/tests/asn.1/krb5_encode_test.c
-+++ b/src/tests/asn.1/krb5_encode_test.c
-@@ -798,15 +798,6 @@ main(argc, argv)
-         ktest_empty_pa_pk_as_req(&req);
-     }
-     /****************************************************************/
--    /* encode_krb5_pa_pk_as_req_draft9 */
--    {
--        krb5_pa_pk_as_req_draft9 req;
--        ktest_make_sample_pa_pk_as_req_draft9(&req);
--        encode_run(req, "pa_pk_as_req_draft9", "",
--                   acc.encode_krb5_pa_pk_as_req_draft9);
--        ktest_empty_pa_pk_as_req_draft9(&req);
--    }
--    /****************************************************************/
-     /* encode_krb5_pa_pk_as_rep */
-     {
-         krb5_pa_pk_as_rep rep;
-@@ -820,19 +811,6 @@ main(argc, argv)
-         ktest_empty_pa_pk_as_rep(&rep);
-     }
-     /****************************************************************/
--    /* encode_krb5_pa_pk_as_rep_draft9 */
--    {
--        krb5_pa_pk_as_rep_draft9 rep;
--        ktest_make_sample_pa_pk_as_rep_draft9_dhSignedData(&rep);
--        encode_run(rep, "pa_pk_as_rep_draft9", "(dhSignedData)",
--                   acc.encode_krb5_pa_pk_as_rep_draft9);
--        ktest_empty_pa_pk_as_rep_draft9(&rep);
--        ktest_make_sample_pa_pk_as_rep_draft9_encKeyPack(&rep);
--        encode_run(rep, "pa_pk_as_rep_draft9", "(encKeyPack)",
--                   acc.encode_krb5_pa_pk_as_rep_draft9);
--        ktest_empty_pa_pk_as_rep_draft9(&rep);
--    }
--    /****************************************************************/
-     /* encode_krb5_auth_pack */
-     {
-         krb5_auth_pack pack;
-@@ -841,15 +819,6 @@ main(argc, argv)
-         ktest_empty_auth_pack(&pack);
-     }
-     /****************************************************************/
--    /* encode_krb5_auth_pack_draft9_draft9 */
--    {
--        krb5_auth_pack_draft9 pack;
--        ktest_make_sample_auth_pack_draft9(&pack);
--        encode_run(pack, "auth_pack_draft9", "",
--                   acc.encode_krb5_auth_pack_draft9);
--        ktest_empty_auth_pack_draft9(&pack);
--    }
--    /****************************************************************/
-     /* encode_krb5_kdc_dh_key_info */
-     {
-         krb5_kdc_dh_key_info ki;
-@@ -866,15 +835,6 @@ main(argc, argv)
-         ktest_empty_reply_key_pack(&pack);
-     }
-     /****************************************************************/
--    /* encode_krb5_reply_key_pack_draft9 */
--    {
--        krb5_reply_key_pack_draft9 pack;
--        ktest_make_sample_reply_key_pack_draft9(&pack);
--        encode_run(pack, "reply_key_pack_draft9", "",
--                   acc.encode_krb5_reply_key_pack_draft9);
--        ktest_empty_reply_key_pack_draft9(&pack);
--    }
--    /****************************************************************/
-     /* encode_krb5_sp80056a_other_info */
-     {
-         krb5_sp80056a_other_info info;
-diff --git a/src/tests/asn.1/ktest.c b/src/tests/asn.1/ktest.c
-index 258377299..7bb698732 100644
---- a/src/tests/asn.1/ktest.c
-+++ b/src/tests/asn.1/ktest.c
-@@ -729,15 +729,6 @@ ktest_make_sample_pk_authenticator(krb5_pk_authenticator *p)
-     ktest_make_sample_data(p->freshnessToken);
- }
- 
--static void
--ktest_make_sample_pk_authenticator_draft9(krb5_pk_authenticator_draft9 *p)
--{
--    ktest_make_sample_principal(&p->kdcName);
--    p->cusec = SAMPLE_USEC;
--    p->ctime = SAMPLE_TIME;
--    p->nonce = SAMPLE_NONCE;
--}
--
- static void
- ktest_make_sample_oid(krb5_data *p)
- {
-@@ -788,13 +779,6 @@ ktest_make_sample_pa_pk_as_req(krb5_pa_pk_as_req *p)
-     ktest_make_sample_data(&p->kdcPkId);
- }
- 
--void
--ktest_make_sample_pa_pk_as_req_draft9(krb5_pa_pk_as_req_draft9 *p)
--{
--    ktest_make_sample_data(&p->signedAuthPack);
--    ktest_make_sample_data(&p->kdcCert);
--}
--
- static void
- ktest_make_sample_dh_rep_info(krb5_dh_rep_info *p)
- {
-@@ -818,20 +802,6 @@ ktest_make_sample_pa_pk_as_rep_encKeyPack(krb5_pa_pk_as_rep *p)
-     ktest_make_sample_data(&p->u.encKeyPack);
- }
- 
--void
--ktest_make_sample_pa_pk_as_rep_draft9_dhSignedData(krb5_pa_pk_as_rep_draft9 *p)
--{
--    p->choice = choice_pa_pk_as_rep_draft9_dhSignedData;
--    ktest_make_sample_data(&p->u.dhSignedData);
--}
--
--void
--ktest_make_sample_pa_pk_as_rep_draft9_encKeyPack(krb5_pa_pk_as_rep_draft9 *p)
--{
--    p->choice = choice_pa_pk_as_rep_draft9_encKeyPack;
--    ktest_make_sample_data(&p->u.encKeyPack);
--}
--
- void
- ktest_make_sample_auth_pack(krb5_auth_pack *p)
- {
-@@ -851,14 +821,6 @@ ktest_make_sample_auth_pack(krb5_auth_pack *p)
-     p->supportedKDFs[1] = NULL;
- }
- 
--void
--ktest_make_sample_auth_pack_draft9(krb5_auth_pack_draft9 *p)
--{
--    ktest_make_sample_pk_authenticator_draft9(&p->pkAuthenticator);
--    p->clientPublicValue = ealloc(sizeof(krb5_subject_pk_info));
--    ktest_make_sample_subject_pk_info(p->clientPublicValue);
--}
--
- void
- ktest_make_sample_kdc_dh_key_info(krb5_kdc_dh_key_info *p)
- {
-@@ -874,13 +836,6 @@ ktest_make_sample_reply_key_pack(krb5_reply_key_pack *p)
-     ktest_make_sample_checksum(&p->asChecksum);
- }
- 
--void
--ktest_make_sample_reply_key_pack_draft9(krb5_reply_key_pack_draft9 *p)
--{
--    ktest_make_sample_keyblock(&p->replyKey);
--    p->nonce = SAMPLE_NONCE;
--}
--
- void
- ktest_make_sample_sp80056a_other_info(krb5_sp80056a_other_info *p)
- {
-@@ -1717,12 +1672,6 @@ ktest_empty_pk_authenticator(krb5_pk_authenticator *p)
-     p->freshnessToken = NULL;
- }
- 
--static void
--ktest_empty_pk_authenticator_draft9(krb5_pk_authenticator_draft9 *p)
--{
--    ktest_destroy_principal(&p->kdcName);
--}
--
- static void
- ktest_empty_subject_pk_info(krb5_subject_pk_info *p)
- {
-@@ -1754,13 +1703,6 @@ ktest_empty_pa_pk_as_req(krb5_pa_pk_as_req *p)
-     ktest_empty_data(&p->kdcPkId);
- }
- 
--void
--ktest_empty_pa_pk_as_req_draft9(krb5_pa_pk_as_req_draft9 *p)
--{
--    ktest_empty_data(&p->signedAuthPack);
--    ktest_empty_data(&p->kdcCert);
--}
--
- static void
- ktest_empty_dh_rep_info(krb5_dh_rep_info *p)
- {
-@@ -1779,16 +1721,6 @@ ktest_empty_pa_pk_as_rep(krb5_pa_pk_as_rep *p)
-     p->choice = choice_pa_pk_as_rep_UNKNOWN;
- }
- 
--void
--ktest_empty_pa_pk_as_rep_draft9(krb5_pa_pk_as_rep_draft9 *p)
--{
--    if (p->choice == choice_pa_pk_as_rep_draft9_dhSignedData)
--        ktest_empty_data(&p->u.dhSignedData);
--    else if (p->choice == choice_pa_pk_as_rep_draft9_encKeyPack)
--        ktest_empty_data(&p->u.encKeyPack);
--    p->choice = choice_pa_pk_as_rep_draft9_UNKNOWN;
--}
--
- void
- ktest_empty_auth_pack(krb5_auth_pack *p)
- {
-@@ -1820,17 +1752,6 @@ ktest_empty_auth_pack(krb5_auth_pack *p)
-     }
- }
- 
--void
--ktest_empty_auth_pack_draft9(krb5_auth_pack_draft9 *p)
--{
--    ktest_empty_pk_authenticator_draft9(&p->pkAuthenticator);
--    if (p->clientPublicValue != NULL) {
--        ktest_empty_subject_pk_info(p->clientPublicValue);
--        free(p->clientPublicValue);
--        p->clientPublicValue = NULL;
--    }
--}
--
- void
- ktest_empty_kdc_dh_key_info(krb5_kdc_dh_key_info *p)
- {
-@@ -1844,12 +1765,6 @@ ktest_empty_reply_key_pack(krb5_reply_key_pack *p)
-     ktest_empty_checksum(&p->asChecksum);
- }
- 
--void
--ktest_empty_reply_key_pack_draft9(krb5_reply_key_pack_draft9 *p)
--{
--    ktest_empty_keyblock(&p->replyKey);
--}
--
- void ktest_empty_sp80056a_other_info(krb5_sp80056a_other_info *p)
- {
-     ktest_empty_algorithm_identifier(&p->algorithm_identifier);
-diff --git a/src/tests/asn.1/ktest.h b/src/tests/asn.1/ktest.h
-index 1413cfae1..d9cc90a5c 100644
---- a/src/tests/asn.1/ktest.h
-+++ b/src/tests/asn.1/ktest.h
-@@ -101,18 +101,11 @@ void ktest_make_maximal_pa_otp_req(krb5_pa_otp_req *p);
- 
- #ifndef DISABLE_PKINIT
- void ktest_make_sample_pa_pk_as_req(krb5_pa_pk_as_req *p);
--void ktest_make_sample_pa_pk_as_req_draft9(krb5_pa_pk_as_req_draft9 *p);
- void ktest_make_sample_pa_pk_as_rep_dhInfo(krb5_pa_pk_as_rep *p);
- void ktest_make_sample_pa_pk_as_rep_encKeyPack(krb5_pa_pk_as_rep *p);
--void ktest_make_sample_pa_pk_as_rep_draft9_dhSignedData(
--    krb5_pa_pk_as_rep_draft9 *p);
--void ktest_make_sample_pa_pk_as_rep_draft9_encKeyPack(
--    krb5_pa_pk_as_rep_draft9 *p);
- void ktest_make_sample_auth_pack(krb5_auth_pack *p);
--void ktest_make_sample_auth_pack_draft9(krb5_auth_pack_draft9 *p);
- void ktest_make_sample_kdc_dh_key_info(krb5_kdc_dh_key_info *p);
- void ktest_make_sample_reply_key_pack(krb5_reply_key_pack *p);
--void ktest_make_sample_reply_key_pack_draft9(krb5_reply_key_pack_draft9 *p);
- void ktest_make_sample_sp80056a_other_info(krb5_sp80056a_other_info *p);
- void ktest_make_sample_pkinit_supp_pub_info(krb5_pkinit_supp_pub_info *p);
- #endif
-@@ -197,14 +190,10 @@ void ktest_empty_pa_otp_req(krb5_pa_otp_req *p);
- 
- #ifndef DISABLE_PKINIT
- void ktest_empty_pa_pk_as_req(krb5_pa_pk_as_req *p);
--void ktest_empty_pa_pk_as_req_draft9(krb5_pa_pk_as_req_draft9 *p);
- void ktest_empty_pa_pk_as_rep(krb5_pa_pk_as_rep *p);
--void ktest_empty_pa_pk_as_rep_draft9(krb5_pa_pk_as_rep_draft9 *p);
- void ktest_empty_auth_pack(krb5_auth_pack *p);
--void ktest_empty_auth_pack_draft9(krb5_auth_pack_draft9 *p);
- void ktest_empty_kdc_dh_key_info(krb5_kdc_dh_key_info *p);
- void ktest_empty_reply_key_pack(krb5_reply_key_pack *p);
--void ktest_empty_reply_key_pack_draft9(krb5_reply_key_pack_draft9 *p);
- void ktest_empty_sp80056a_other_info(krb5_sp80056a_other_info *p);
- void ktest_empty_pkinit_supp_pub_info(krb5_pkinit_supp_pub_info *p);
- #endif
-diff --git a/src/tests/asn.1/ktest_equal.c b/src/tests/asn.1/ktest_equal.c
-index 714cc4398..8a3911cdc 100644
---- a/src/tests/asn.1/ktest_equal.c
-+++ b/src/tests/asn.1/ktest_equal.c
-@@ -876,20 +876,6 @@ ktest_equal_pk_authenticator(krb5_pk_authenticator *ref,
-     return p;
- }
- 
--static int
--ktest_equal_pk_authenticator_draft9(krb5_pk_authenticator_draft9 *ref,
--                                    krb5_pk_authenticator_draft9 *var)
--{
--    int p = TRUE;
--    if (ref == var) return TRUE;
--    else if (ref == NULL || var == NULL) return FALSE;
--    p = p && ptr_equal(kdcName, ktest_equal_principal_data);
--    p = p && scalar_equal(cusec);
--    p = p && scalar_equal(ctime);
--    p = p && scalar_equal(nonce);
--    return p;
--}
--
- static int
- ktest_equal_subject_pk_info(krb5_subject_pk_info *ref,
-                             krb5_subject_pk_info *var)
-@@ -937,18 +923,6 @@ ktest_equal_pa_pk_as_req(krb5_pa_pk_as_req *ref, krb5_pa_pk_as_req *var)
-     return p;
- }
- 
--int
--ktest_equal_pa_pk_as_req_draft9(krb5_pa_pk_as_req_draft9 *ref,
--                                krb5_pa_pk_as_req_draft9 *var)
--{
--    int p = TRUE;
--    if (ref == var) return TRUE;
--    else if (ref == NULL || var == NULL) return FALSE;
--    p = p && equal_str(signedAuthPack);
--    p = p && equal_str(kdcCert);
--    return p;
--}
--
- static int
- ktest_equal_dh_rep_info(krb5_dh_rep_info *ref, krb5_dh_rep_info *var)
- {
-@@ -996,19 +970,6 @@ ktest_equal_auth_pack(krb5_auth_pack *ref, krb5_auth_pack *var)
-     return p;
- }
- 
--int
--ktest_equal_auth_pack_draft9(krb5_auth_pack_draft9 *ref,
--                             krb5_auth_pack_draft9 *var)
--{
--    int p = TRUE;
--    if (ref == var) return TRUE;
--    else if (ref == NULL || var == NULL) return FALSE;
--    p = p && struct_equal(pkAuthenticator,
--                          ktest_equal_pk_authenticator_draft9);
--    p = p && ptr_equal(clientPublicValue, ktest_equal_subject_pk_info);
--    return p;
--}
--
- int
- ktest_equal_kdc_dh_key_info(krb5_kdc_dh_key_info *ref,
-                             krb5_kdc_dh_key_info *var)
-@@ -1033,18 +994,6 @@ ktest_equal_reply_key_pack(krb5_reply_key_pack *ref, krb5_reply_key_pack *var)
-     return p;
- }
- 
--int
--ktest_equal_reply_key_pack_draft9(krb5_reply_key_pack_draft9 *ref,
--                                  krb5_reply_key_pack_draft9 *var)
--{
--    int p = TRUE;
--    if (ref == var) return TRUE;
--    else if (ref == NULL || var == NULL) return FALSE;
--    p = p && struct_equal(replyKey, ktest_equal_keyblock);
--    p = p && scalar_equal(nonce);
--    return p;
--}
--
- #endif /* not DISABLE_PKINIT */
- 
- int
-diff --git a/src/tests/asn.1/ktest_equal.h b/src/tests/asn.1/ktest_equal.h
-index cfa82ac6e..80a0d781a 100644
---- a/src/tests/asn.1/ktest_equal.h
-+++ b/src/tests/asn.1/ktest_equal.h
-@@ -139,13 +139,10 @@ int ktest_equal_ldap_sequence_of_keys(ldap_seqof_key_data *ref,
- 
- #ifndef DISABLE_PKINIT
- generic(ktest_equal_pa_pk_as_req, krb5_pa_pk_as_req);
--generic(ktest_equal_pa_pk_as_req_draft9, krb5_pa_pk_as_req_draft9);
- generic(ktest_equal_pa_pk_as_rep, krb5_pa_pk_as_rep);
- generic(ktest_equal_auth_pack, krb5_auth_pack);
--generic(ktest_equal_auth_pack_draft9, krb5_auth_pack_draft9);
- generic(ktest_equal_kdc_dh_key_info, krb5_kdc_dh_key_info);
- generic(ktest_equal_reply_key_pack, krb5_reply_key_pack);
--generic(ktest_equal_reply_key_pack_draft9, krb5_reply_key_pack_draft9);
- #endif /* not DISABLE_PKINIT */
- 
- int ktest_equal_kkdcp_message(krb5_kkdcp_message *ref,
-diff --git a/src/tests/asn.1/pkinit_encode.out b/src/tests/asn.1/pkinit_encode.out
-index 55a60bbef..9bd08e159 100644
---- a/src/tests/asn.1/pkinit_encode.out
-+++ b/src/tests/asn.1/pkinit_encode.out
-@@ -1,13 +1,8 @@
- encode_krb5_pa_pk_as_req: 30 38 80 08 6B 72 62 35 64 61 74 61 A1 22 30 20 30 1E 80 08 6B 72 62 35 64 61 74 61 81 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61
--encode_krb5_pa_pk_as_req_draft9: 30 14 80 08 6B 72 62 35 64 61 74 61 82 08 6B 72 62 35 64 61 74 61
- encode_krb5_pa_pk_as_rep(dhInfo): A0 28 30 26 80 08 6B 72 62 35 64 61 74 61 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
- encode_krb5_pa_pk_as_rep(encKeyPack): 81 08 6B 72 62 35 64 61 74 61
--encode_krb5_pa_pk_as_rep_draft9(dhSignedData): 80 08 6B 72 62 35 64 61 74 61
--encode_krb5_pa_pk_as_rep_draft9(encKeyPack): 81 08 6B 72 62 35 64 61 74 61
- encode_krb5_auth_pack: 30 81 9F A0 35 30 33 A0 05 02 03 01 E2 40 A1 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A2 03 02 01 2A A3 06 04 04 31 32 33 34 A4 0A 04 08 6B 72 62 35 64 61 74 61 A1 22 30 20 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 03 09 00 6B 72 62 35 64 61 74 61 A2 24 30 22 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A3 0A 04 08 6B 72 62 35 64 61 74 61 A4 10 30 0E 30 0C A0 0A 06 08 6B 72 62 35 64 61 74 61
--encode_krb5_auth_pack_draft9: 30 75 A0 4F 30 4D A0 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A2 05 02 03 01 E2 40 A3 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A A4 03 02 01 2A A1 22 30 20 30 13 06 09 2A 86 48 86 F7 12 01 02 02 04 06 70 61 72 61 6D 73 03 09 00 6B 72 62 35 64 61 74 61
- encode_krb5_kdc_dh_key_info: 30 25 A0 0B 03 09 00 6B 72 62 35 64 61 74 61 A1 03 02 01 2A A2 11 18 0F 31 39 39 34 30 36 31 30 30 36 30 33 31 37 5A
- encode_krb5_reply_key_pack: 30 26 A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
--encode_krb5_reply_key_pack_draft9: 30 1A A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 03 02 01 2A
- encode_krb5_sp80056a_other_info: 30 81 81 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A0 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A2 0A 04 08 6B 72 62 35 64 61 74 61
- encode_krb5_pkinit_supp_pub_info: 30 1D A0 03 02 01 14 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0A 04 08 6B 72 62 35 64 61 74 61
-diff --git a/src/tests/asn.1/pkinit_trval.out b/src/tests/asn.1/pkinit_trval.out
-index 9557188a8..3675fba38 100644
---- a/src/tests/asn.1/pkinit_trval.out
-+++ b/src/tests/asn.1/pkinit_trval.out
-@@ -15,14 +15,6 @@ encode_krb5_pa_pk_as_req:
- .  [2] <8>
-       6b 72 62 35 64 61 74 61                             krb5data
- 
--encode_krb5_pa_pk_as_req_draft9:
--
--[Sequence/Sequence Of]
--.  [0] <8>
--      6b 72 62 35 64 61 74 61                             krb5data
--.  [2] <8>
--      6b 72 62 35 64 61 74 61                             krb5data
--
- encode_krb5_pa_pk_as_rep(dhInfo):
- 
- [CONT 0]
-@@ -36,16 +28,6 @@ encode_krb5_pa_pk_as_rep(dhInfo):
- 
- encode_krb5_pa_pk_as_rep(encKeyPack):
- 
--[CONT 1] <8>
--   6b 72 62 35 64 61 74 61                                krb5data
--
--encode_krb5_pa_pk_as_rep_draft9(dhSignedData):
--
--[CONT 0] <8>
--   6b 72 62 35 64 61 74 61                                krb5data
--
--encode_krb5_pa_pk_as_rep_draft9(encKeyPack):
--
- [CONT 1] <8>
-    6b 72 62 35 64 61 74 61                                krb5data
- 
-@@ -79,27 +61,6 @@ encode_krb5_auth_pack:
- .  .  .  [0] [Object Identifier] <8>
-             6b 72 62 35 64 61 74 61                          krb5data
- 
--encode_krb5_auth_pack_draft9:
--
--[Sequence/Sequence Of]
--.  [0] [Sequence/Sequence Of]
--.  .  [0] [Sequence/Sequence Of]
--.  .  .  [0] [Integer] 1
--.  .  .  [1] [Sequence/Sequence Of]
--.  .  .  .  [General string] "hftsai"
--.  .  .  .  [General string] "extra"
--.  .  [1] [General string] "ATHENA.MIT.EDU"
--.  .  [2] [Integer] 123456
--.  .  [3] [Generalized Time] "19940610060317Z"
--.  .  [4] [Integer] 42
--.  [1] [Sequence/Sequence Of]
--.  .  [Sequence/Sequence Of]
--.  .  .  [Object Identifier] <9>
--            2a 86 48 86 f7 12 01 02 02                       *.H......
--.  .  .  [Octet String] "params"
--.  .  [Bit String] <9>
--         00 6b 72 62 35 64 61 74 61                       .krb5data
--
- encode_krb5_kdc_dh_key_info:
- 
- [Sequence/Sequence Of]
-@@ -118,14 +79,6 @@ encode_krb5_reply_key_pack:
- .  .  [0] [Integer] 1
- .  .  [1] [Octet String] "1234"
- 
--encode_krb5_reply_key_pack_draft9:
--
--[Sequence/Sequence Of]
--.  [0] [Sequence/Sequence Of]
--.  .  [0] [Integer] 1
--.  .  [1] [Octet String] "12345678"
--.  [1] [Integer] 42
--
- encode_krb5_sp80056a_other_info:
- 
- [Sequence/Sequence Of]
diff --git a/Remove-PKINIT-draft-9-support.patch b/Remove-PKINIT-draft-9-support.patch
deleted file mode 100644
index 8b43a05..0000000
--- a/Remove-PKINIT-draft-9-support.patch
+++ /dev/null
@@ -1,1706 +0,0 @@
-From a3e44c1ab745535fe9e2c396a09ff8d713810cc4 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Tue, 18 Jun 2019 13:06:44 -0400
-Subject: [PATCH] Remove PKINIT draft 9 support
-
-PKINIT draft 9 support is required to interoperate with Windows 2000,
-Windows XP, and Windows Server 2003, all of which are well beyond
-end-of-life.  Remove it.
-
-ticket: 8817 (new)
-(cherry picked from commit bb82690be39a033669388154964486e213d84e76)
----
- src/plugins/preauth/pkinit/pkinit.h           |   9 -
- src/plugins/preauth/pkinit/pkinit_accessor.c  |  12 -
- src/plugins/preauth/pkinit/pkinit_accessor.h  |   6 -
- src/plugins/preauth/pkinit/pkinit_clnt.c      | 231 +++-----
- src/plugins/preauth/pkinit/pkinit_crypto.h    |   1 -
- .../preauth/pkinit/pkinit_crypto_openssl.c    | 221 ++------
- src/plugins/preauth/pkinit/pkinit_lib.c       |  65 ---
- src/plugins/preauth/pkinit/pkinit_srv.c       | 531 +++++-------------
- src/plugins/preauth/pkinit/pkinit_trace.h     |   4 -
- src/tests/t_pkinit.py                         |   6 +-
- 10 files changed, 277 insertions(+), 809 deletions(-)
-
-diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
-index fe2ec0d31..b437fd53f 100644
---- a/src/plugins/preauth/pkinit/pkinit.h
-+++ b/src/plugins/preauth/pkinit/pkinit.h
-@@ -213,7 +213,6 @@ struct _pkinit_req_context {
-     pkinit_identity_opts *idopts;
-     int do_identity_matching;
-     krb5_preauthtype pa_type;
--    int rfc4556_kdc;
-     int rfc6112_kdc;
-     int identity_initialized;
-     int identity_prompted;
-@@ -244,7 +243,6 @@ struct _pkinit_kdc_req_context {
-     int magic;
-     pkinit_req_crypto_context cryptoctx;
-     krb5_auth_pack *rcv_auth_pack;
--    krb5_auth_pack_draft9 *rcv_auth_pack9;
-     krb5_preauthtype pa_type;
- };
- typedef struct _pkinit_kdc_req_context *pkinit_kdc_req_context;
-@@ -329,22 +327,15 @@ void pkinit_free_deferred_ids(pkinit_deferred_id *identities);
-  * initialization and free functions
-  */
- void init_krb5_pa_pk_as_req(krb5_pa_pk_as_req **in);
--void init_krb5_pa_pk_as_req_draft9(krb5_pa_pk_as_req_draft9 **in);
- void init_krb5_reply_key_pack(krb5_reply_key_pack **in);
--void init_krb5_reply_key_pack_draft9(krb5_reply_key_pack_draft9 **in);
- 
- void init_krb5_pa_pk_as_rep(krb5_pa_pk_as_rep **in);
--void init_krb5_pa_pk_as_rep_draft9(krb5_pa_pk_as_rep_draft9 **in);
- void init_krb5_subject_pk_info(krb5_subject_pk_info **in);
- 
- void free_krb5_pa_pk_as_req(krb5_pa_pk_as_req **in);
--void free_krb5_pa_pk_as_req_draft9(krb5_pa_pk_as_req_draft9 **in);
- void free_krb5_reply_key_pack(krb5_reply_key_pack **in);
--void free_krb5_reply_key_pack_draft9(krb5_reply_key_pack_draft9 **in);
- void free_krb5_auth_pack(krb5_auth_pack **in);
--void free_krb5_auth_pack_draft9(krb5_context, krb5_auth_pack_draft9 **in);
- void free_krb5_pa_pk_as_rep(krb5_pa_pk_as_rep **in);
--void free_krb5_pa_pk_as_rep_draft9(krb5_pa_pk_as_rep_draft9 **in);
- void free_krb5_external_principal_identifier(krb5_external_principal_identifier ***in);
- void free_krb5_algorithm_identifiers(krb5_algorithm_identifier ***in);
- void free_krb5_algorithm_identifier(krb5_algorithm_identifier *in);
-diff --git a/src/plugins/preauth/pkinit/pkinit_accessor.c b/src/plugins/preauth/pkinit/pkinit_accessor.c
-index 6bae94969..0908f1b9b 100644
---- a/src/plugins/preauth/pkinit/pkinit_accessor.c
-+++ b/src/plugins/preauth/pkinit/pkinit_accessor.c
-@@ -41,22 +41,15 @@
-     krb5_error_code (*k5int_decode_##type)(const krb5_data *, type ***)
- 
- DEF_FUNC_PTRS(krb5_auth_pack);
--DEF_FUNC_PTRS(krb5_auth_pack_draft9);
- DEF_FUNC_PTRS(krb5_kdc_dh_key_info);
- DEF_FUNC_PTRS(krb5_pa_pk_as_rep);
- DEF_FUNC_PTRS(krb5_pa_pk_as_req);
--DEF_FUNC_PTRS(krb5_pa_pk_as_req_draft9);
- DEF_FUNC_PTRS(krb5_reply_key_pack);
--DEF_FUNC_PTRS(krb5_reply_key_pack_draft9);
- 
- /* special cases... */
- krb5_error_code
- (*k5int_decode_krb5_principal_name)(const krb5_data *, krb5_principal_data **);
- 
--krb5_error_code
--(*k5int_encode_krb5_pa_pk_as_rep_draft9)(const krb5_pa_pk_as_rep_draft9 *,
--                                         krb5_data **code);
--
- krb5_error_code
- (*k5int_encode_krb5_td_dh_parameters)(krb5_algorithm_identifier *const *,
-                                       krb5_data **code);
-@@ -101,21 +94,16 @@ pkinit_accessor_init(void)
-     k5int_decode_##type = k5int.decode_##type;
- 
-     SET_PTRS(krb5_auth_pack);
--    SET_PTRS(krb5_auth_pack_draft9);
-     SET_PTRS(krb5_kdc_dh_key_info);
-     SET_PTRS(krb5_pa_pk_as_rep);
-     SET_PTRS(krb5_pa_pk_as_req);
--    SET_PTRS(krb5_pa_pk_as_req_draft9);
-     SET_PTRS(krb5_reply_key_pack);
--    SET_PTRS(krb5_reply_key_pack_draft9);
-     SET_PTRS(krb5_td_dh_parameters);
-     SET_PTRS(krb5_td_trusted_certifiers);
- 
-     /* special cases... */
-     k5int_decode_krb5_principal_name = k5int.decode_krb5_principal_name;
-     k5int_encode_krb5_kdc_req_body = k5int.encode_krb5_kdc_req_body;
--    k5int_encode_krb5_pa_pk_as_rep_draft9 = \
--        k5int.encode_krb5_pa_pk_as_rep_draft9;
-     k5int_krb5_free_kdc_req = k5int.free_kdc_req;
-     k5int_set_prompt_types = k5int.set_prompt_types;
-     return 0;
-diff --git a/src/plugins/preauth/pkinit/pkinit_accessor.h b/src/plugins/preauth/pkinit/pkinit_accessor.h
-index dcee3db53..e510ab624 100644
---- a/src/plugins/preauth/pkinit/pkinit_accessor.h
-+++ b/src/plugins/preauth/pkinit/pkinit_accessor.h
-@@ -45,21 +45,15 @@ extern krb5_error_code (*k5int_encode_##type)(const type **, krb5_data **); \
- extern krb5_error_code (*k5int_decode_##type)(const krb5_data *, type ***)
- 
- DEF_EXT_FUNC_PTRS(krb5_auth_pack);
--DEF_EXT_FUNC_PTRS(krb5_auth_pack_draft9);
- DEF_EXT_FUNC_PTRS(krb5_kdc_dh_key_info);
- DEF_EXT_FUNC_PTRS(krb5_pa_pk_as_rep);
- DEF_EXT_FUNC_PTRS(krb5_pa_pk_as_req);
--DEF_EXT_FUNC_PTRS(krb5_pa_pk_as_req_draft9);
- DEF_EXT_FUNC_PTRS(krb5_reply_key_pack);
--DEF_EXT_FUNC_PTRS(krb5_reply_key_pack_draft9);
- 
- /* special cases... */
- extern krb5_error_code (*k5int_decode_krb5_principal_name)
- 	(const krb5_data *, krb5_principal_data **);
- 
--extern krb5_error_code (*k5int_encode_krb5_pa_pk_as_rep_draft9)
--	(const krb5_pa_pk_as_rep_draft9 *, krb5_data **code);
--
- extern krb5_error_code (*k5int_encode_krb5_td_dh_parameters)
- 	(krb5_algorithm_identifier *const *, krb5_data **code);
- extern krb5_error_code (*k5int_decode_krb5_td_dh_parameters)
-diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
-index 58400d555..1a642139a 100644
---- a/src/plugins/preauth/pkinit/pkinit_clnt.c
-+++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
-@@ -148,11 +148,7 @@ pa_pkinit_gen_req(krb5_context context,
-         goto cleanup;
-     }
- 
--    /*
--     * The most we'll return is two pa_data, normally just one.
--     * We need to make room for the NULL terminator.
--     */
--    return_pa_data = k5calloc(3, sizeof(*return_pa_data), &retval);
-+    return_pa_data = k5calloc(2, sizeof(*return_pa_data), &retval);
-     if (return_pa_data == NULL)
-         goto cleanup;
- 
-@@ -162,21 +158,11 @@ pa_pkinit_gen_req(krb5_context context,
- 
-     return_pa_data[0]->magic = KV5M_PA_DATA;
- 
--    if (pa_type == KRB5_PADATA_PK_AS_REQ_OLD)
--        return_pa_data[0]->pa_type = KRB5_PADATA_PK_AS_REP_OLD;
--    else
--        return_pa_data[0]->pa_type = pa_type;
-+    return_pa_data[0]->pa_type = pa_type;
-     return_pa_data[0]->length = out_data->length;
-     return_pa_data[0]->contents = (krb5_octet *) out_data->data;
-     *out_data = empty_data();
- 
--    if (return_pa_data[0]->pa_type == KRB5_PADATA_PK_AS_REP_OLD) {
--        return_pa_data[1] = k5alloc(sizeof(*return_pa_data[1]), &retval);
--        if (return_pa_data[1] == NULL)
--            goto cleanup;
--        return_pa_data[1]->pa_type = KRB5_PADATA_AS_CHECKSUM;
--    }
--
-     *out_padata = return_pa_data;
-     return_pa_data = NULL;
-     cb->disable_fallback(context, rock);
-@@ -206,8 +192,6 @@ pkinit_as_req_create(krb5_context context,
-     krb5_data *coded_auth_pack = NULL;
-     krb5_auth_pack auth_pack;
-     krb5_pa_pk_as_req *req = NULL;
--    krb5_auth_pack_draft9 auth_pack9;
--    krb5_pa_pk_as_req_draft9 *req9 = NULL;
-     krb5_algorithm_identifier **cmstypes = NULL;
-     int protocol = reqctx->opts->dh_or_rsa;
-     unsigned char *dh_params = NULL, *dh_pubkey = NULL;
-@@ -216,42 +200,25 @@ pkinit_as_req_create(krb5_context context,
-     pkiDebug("pkinit_as_req_create pa_type = %d\n", reqctx->pa_type);
- 
-     /* Create the authpack */
--    switch((int)reqctx->pa_type) {
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        protocol = RSA_PROTOCOL;
--        memset(&auth_pack9, 0, sizeof(auth_pack9));
--        auth_pack9.pkAuthenticator.ctime = ctsec;
--        auth_pack9.pkAuthenticator.cusec = cusec;
--        auth_pack9.pkAuthenticator.nonce = nonce;
--        auth_pack9.pkAuthenticator.kdcName = server;
--        break;
--    case KRB5_PADATA_PK_AS_REQ:
--        memset(&info, 0, sizeof(info));
--        memset(&auth_pack, 0, sizeof(auth_pack));
--        auth_pack.pkAuthenticator.ctime = ctsec;
--        auth_pack.pkAuthenticator.cusec = cusec;
--        auth_pack.pkAuthenticator.nonce = nonce;
--        auth_pack.pkAuthenticator.paChecksum = *cksum;
--        if (!reqctx->opts->disable_freshness)
--            auth_pack.pkAuthenticator.freshnessToken = reqctx->freshness_token;
--        auth_pack.clientDHNonce.length = 0;
--        auth_pack.clientPublicValue = &info;
--        auth_pack.supportedKDFs = (krb5_data **)supported_kdf_alg_ids;
--
--        /* add List of CMS algorithms */
--        retval = create_krb5_supportedCMSTypes(context, plgctx->cryptoctx,
--                                               reqctx->cryptoctx,
--                                               reqctx->idctx, &cmstypes);
--        auth_pack.supportedCMSTypes = cmstypes;
--        if (retval)
--            goto cleanup;
--        break;
--    default:
--        pkiDebug("as_req: unrecognized pa_type = %d\n",
--                 (int)reqctx->pa_type);
--        retval = -1;
-+    memset(&info, 0, sizeof(info));
-+    memset(&auth_pack, 0, sizeof(auth_pack));
-+    auth_pack.pkAuthenticator.ctime = ctsec;
-+    auth_pack.pkAuthenticator.cusec = cusec;
-+    auth_pack.pkAuthenticator.nonce = nonce;
-+    auth_pack.pkAuthenticator.paChecksum = *cksum;
-+    if (!reqctx->opts->disable_freshness)
-+        auth_pack.pkAuthenticator.freshnessToken = reqctx->freshness_token;
-+    auth_pack.clientDHNonce.length = 0;
-+    auth_pack.clientPublicValue = &info;
-+    auth_pack.supportedKDFs = (krb5_data **)supported_kdf_alg_ids;
-+
-+    /* add List of CMS algorithms */
-+    retval = create_krb5_supportedCMSTypes(context, plgctx->cryptoctx,
-+                                           reqctx->cryptoctx,
-+                                           reqctx->idctx, &cmstypes);
-+    auth_pack.supportedCMSTypes = cmstypes;
-+    if (retval)
-         goto cleanup;
--    }
- 
-     switch(protocol) {
-     case DH_PROTOCOL:
-@@ -274,14 +241,7 @@ pkinit_as_req_create(krb5_context context,
-     case RSA_PROTOCOL:
-         TRACE_PKINIT_CLIENT_REQ_RSA(context);
-         pkiDebug("as_req: RSA key transport algorithm\n");
--        switch((int)reqctx->pa_type) {
--        case KRB5_PADATA_PK_AS_REQ_OLD:
--            auth_pack9.clientPublicValue = NULL;
--            break;
--        case KRB5_PADATA_PK_AS_REQ:
--            auth_pack.clientPublicValue = NULL;
--            break;
--        }
-+        auth_pack.clientPublicValue = NULL;
-         break;
-     default:
-         pkiDebug("as_req: unknown key transport protocol %d\n",
-@@ -290,16 +250,7 @@ pkinit_as_req_create(krb5_context context,
-         goto cleanup;
-     }
- 
--    /* Encode the authpack */
--    switch((int)reqctx->pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        retval = k5int_encode_krb5_auth_pack(&auth_pack, &coded_auth_pack);
--        break;
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        retval = k5int_encode_krb5_auth_pack_draft9(&auth_pack9,
--                                                    &coded_auth_pack);
--        break;
--    }
-+    retval = k5int_encode_krb5_auth_pack(&auth_pack, &coded_auth_pack);
-     if (retval) {
-         pkiDebug("failed to encode the AuthPack %d\n", retval);
-         goto cleanup;
-@@ -311,60 +262,39 @@ pkinit_as_req_create(krb5_context context,
- #endif
- 
-     /* create PKCS7 object from authpack */
--    switch((int)reqctx->pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        init_krb5_pa_pk_as_req(&req);
--        if (req == NULL) {
--            retval = ENOMEM;
--            goto cleanup;
--        }
--        if (use_content_info(context, reqctx, client)) {
--            retval = cms_contentinfo_create(context, plgctx->cryptoctx,
--                                            reqctx->cryptoctx, reqctx->idctx,
--                                            CMS_SIGN_CLIENT,
--                                            (unsigned char *)
--                                            coded_auth_pack->data,
--                                            coded_auth_pack->length,
--                                            (unsigned char **)
--                                            &req->signedAuthPack.data,
--                                            &req->signedAuthPack.length);
--        } else {
--            retval = cms_signeddata_create(context, plgctx->cryptoctx,
--                                           reqctx->cryptoctx, reqctx->idctx,
--                                           CMS_SIGN_CLIENT, 1,
--                                           (unsigned char *)
--                                           coded_auth_pack->data,
--                                           coded_auth_pack->length,
--                                           (unsigned char **)
--                                           &req->signedAuthPack.data,
--                                           &req->signedAuthPack.length);
--        }
--#ifdef DEBUG_ASN1
--        print_buffer_bin((unsigned char *)req->signedAuthPack.data,
--                         req->signedAuthPack.length,
--                         "/tmp/client_signed_data");
--#endif
--        break;
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        init_krb5_pa_pk_as_req_draft9(&req9);
--        if (req9 == NULL) {
--            retval = ENOMEM;
--            goto cleanup;
--        }
-+    init_krb5_pa_pk_as_req(&req);
-+    if (req == NULL) {
-+        retval = ENOMEM;
-+        goto cleanup;
-+    }
-+    if (use_content_info(context, reqctx, client)) {
-+        retval = cms_contentinfo_create(context, plgctx->cryptoctx,
-+                                        reqctx->cryptoctx, reqctx->idctx,
-+                                        CMS_SIGN_CLIENT,
-+                                        (unsigned char *)
-+                                        coded_auth_pack->data,
-+                                        coded_auth_pack->length,
-+                                        (unsigned char **)
-+                                        &req->signedAuthPack.data,
-+                                        &req->signedAuthPack.length);
-+    } else {
-         retval = cms_signeddata_create(context, plgctx->cryptoctx,
--                                       reqctx->cryptoctx, reqctx->idctx, CMS_SIGN_DRAFT9, 1,
--                                       (unsigned char *)coded_auth_pack->data,
-+                                       reqctx->cryptoctx, reqctx->idctx,
-+                                       CMS_SIGN_CLIENT, 1,
-+                                       (unsigned char *)
-+                                       coded_auth_pack->data,
-                                        coded_auth_pack->length,
-                                        (unsigned char **)
--                                       &req9->signedAuthPack.data,
--                                       &req9->signedAuthPack.length);
--        break;
-+                                       &req->signedAuthPack.data,
-+                                       &req->signedAuthPack.length);
-+    }
-+
- #ifdef DEBUG_ASN1
--        print_buffer_bin((unsigned char *)req9->signedAuthPack.data,
--                         req9->signedAuthPack.length,
--                         "/tmp/client_signed_data_draft9");
-+    print_buffer_bin((unsigned char *)req->signedAuthPack.data,
-+                     req->signedAuthPack.length,
-+                     "/tmp/client_signed_data");
- #endif
--    }
-+
-     krb5_free_data(context, coded_auth_pack);
-     if (retval) {
-         pkiDebug("failed to create pkcs7 signed data\n");
-@@ -372,33 +302,21 @@ pkinit_as_req_create(krb5_context context,
-     }
- 
-     /* create a list of trusted CAs */
--    switch((int)reqctx->pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        retval = create_krb5_trustedCertifiers(context, plgctx->cryptoctx,
--                                               reqctx->cryptoctx, reqctx->idctx, &req->trustedCertifiers);
--        if (retval)
--            goto cleanup;
--        retval = create_issuerAndSerial(context, plgctx->cryptoctx,
--                                        reqctx->cryptoctx, reqctx->idctx,
--                                        (unsigned char **)&req->kdcPkId.data,
--                                        &req->kdcPkId.length);
--        if (retval)
--            goto cleanup;
-+    retval = create_krb5_trustedCertifiers(context, plgctx->cryptoctx,
-+                                           reqctx->cryptoctx, reqctx->idctx,
-+                                           &req->trustedCertifiers);
-+    if (retval)
-+        goto cleanup;
-+    retval = create_issuerAndSerial(context, plgctx->cryptoctx,
-+                                    reqctx->cryptoctx, reqctx->idctx,
-+                                    (unsigned char **)&req->kdcPkId.data,
-+                                    &req->kdcPkId.length);
-+    if (retval)
-+        goto cleanup;
-+
-+    /* Encode the as-req */
-+    retval = k5int_encode_krb5_pa_pk_as_req(req, as_req);
- 
--        /* Encode the as-req */
--        retval = k5int_encode_krb5_pa_pk_as_req(req, as_req);
--        break;
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        retval = create_issuerAndSerial(context, plgctx->cryptoctx,
--                                        reqctx->cryptoctx, reqctx->idctx,
--                                        (unsigned char **)&req9->kdcCert.data,
--                                        &req9->kdcCert.length);
--        if (retval)
--            goto cleanup;
--        /* Encode the as-req */
--        retval = k5int_encode_krb5_pa_pk_as_req_draft9(req9, as_req);
--        break;
--    }
- #ifdef DEBUG_ASN1
-     if (!retval)
-         print_buffer_bin((unsigned char *)(*as_req)->data, (*as_req)->length,
-@@ -410,7 +328,6 @@ cleanup:
-     free(dh_params);
-     free(dh_pubkey);
-     free_krb5_pa_pk_as_req(&req);
--    free_krb5_pa_pk_as_req_draft9(&req9);
- 
-     pkiDebug("pkinit_as_req_create retval=%d\n", (int) retval);
- 
-@@ -1165,31 +1082,13 @@ pkinit_client_process(krb5_context context, krb5_clpreauth_moddata moddata,
-         d = make_data(in_padata->contents, in_padata->length);
-         return krb5_copy_data(context, &d, &reqctx->freshness_token);
-     case KRB5_PADATA_PK_AS_REQ:
--        reqctx->rfc4556_kdc = 1;
-         pkiDebug("processing KRB5_PADATA_PK_AS_REQ\n");
-         processing_request = 1;
-         break;
- 
-     case KRB5_PADATA_PK_AS_REP:
--        reqctx->rfc4556_kdc = 1;
-         pkiDebug("processing KRB5_PADATA_PK_AS_REP\n");
-         break;
--    case KRB5_PADATA_PK_AS_REP_OLD:
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        /* Don't fall back to draft9 code if the KDC supports RFC 4556. */
--        if (reqctx->rfc4556_kdc) {
--            TRACE_PKINIT_CLIENT_NO_DRAFT9(context);
--            return KRB5KDC_ERR_PREAUTH_FAILED;
--        }
--        if (in_padata->length == 0) {
--            pkiDebug("processing KRB5_PADATA_PK_AS_REQ_OLD\n");
--            in_padata->pa_type = KRB5_PADATA_PK_AS_REQ_OLD;
--            processing_request = 1;
--        } else {
--            pkiDebug("processing KRB5_PADATA_PK_AS_REP_OLD\n");
--            in_padata->pa_type = KRB5_PADATA_PK_AS_REP_OLD;
--        }
--        break;
-     default:
-         pkiDebug("unrecognized patype = %d for PKINIT\n",
-                  in_padata->pa_type);
-@@ -1363,8 +1262,6 @@ pkinit_client_get_flags(krb5_context kcontext, krb5_preauthtype patype)
- static krb5_preauthtype supported_client_pa_types[] = {
-     KRB5_PADATA_PK_AS_REP,
-     KRB5_PADATA_PK_AS_REQ,
--    KRB5_PADATA_PK_AS_REP_OLD,
--    KRB5_PADATA_PK_AS_REQ_OLD,
-     KRB5_PADATA_PKINIT_KX,
-     KRB5_PADATA_AS_FRESHNESS,
-     0
-diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h
-index 0acb731cd..8064a07d0 100644
---- a/src/plugins/preauth/pkinit/pkinit_crypto.h
-+++ b/src/plugins/preauth/pkinit/pkinit_crypto.h
-@@ -46,7 +46,6 @@
-  */
- enum cms_msg_types {
-     CMS_SIGN_CLIENT,
--    CMS_SIGN_DRAFT9,
-     CMS_SIGN_SERVER,
-     CMS_ENVEL_SERVER
- };
-diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-index 8aa2c5257..8c7fd0cca 100644
---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-@@ -1050,17 +1050,11 @@ create_contentinfo(krb5_context context, ASN1_OBJECT *oid,
-     if (p7->type == NULL)
-         goto oom;
- 
--    if (OBJ_obj2nid(oid) == NID_pkcs7_data) {
--        /* Draft 9 uses id-pkcs7-data for signed data.  For this type OpenSSL
--         * expects an octet string in d.data. */
--        p7->d.data = ostr;
--    } else {
--        p7->d.other = ASN1_TYPE_new();
--        if (p7->d.other == NULL)
--            goto oom;
--        p7->d.other->type = V_ASN1_OCTET_STRING;
--        p7->d.other->value.octet_string = ostr;
--    }
-+    p7->d.other = ASN1_TYPE_new();
-+    if (p7->d.other == NULL)
-+        goto oom;
-+    p7->d.other->type = V_ASN1_OCTET_STRING;
-+    p7->d.other->value.octet_string = ostr;
- 
-     *p7_out = p7;
-     return 0;
-@@ -1249,43 +1243,37 @@ cms_signeddata_create(krb5_context context,
-             goto cleanup;
-         p7si->digest_enc_alg->parameter->type = V_ASN1_NULL;
- 
--        if (cms_msg_type == CMS_SIGN_DRAFT9){
--            /* don't include signed attributes for pa-type 15 request */
--            abuf = data;
--            alen = data_len;
--        } else {
--            /* add signed attributes */
--            /* compute sha1 digest over the EncapsulatedContentInfo */
--            ctx = EVP_MD_CTX_new();
--            if (ctx == NULL)
--                goto cleanup;
--            EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
--            EVP_DigestUpdate(ctx, data, data_len);
--            md_tmp = EVP_MD_CTX_md(ctx);
--            EVP_DigestFinal_ex(ctx, md_data, &md_len);
--            EVP_MD_CTX_free(ctx);
-+        /* add signed attributes */
-+        /* compute sha1 digest over the EncapsulatedContentInfo */
-+        ctx = EVP_MD_CTX_new();
-+        if (ctx == NULL)
-+            goto cleanup;
-+        EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
-+        EVP_DigestUpdate(ctx, data, data_len);
-+        md_tmp = EVP_MD_CTX_md(ctx);
-+        EVP_DigestFinal_ex(ctx, md_data, &md_len);
-+        EVP_MD_CTX_free(ctx);
- 
--            /* create a message digest attr */
--            digest_attr = ASN1_OCTET_STRING_new();
--            ASN1_OCTET_STRING_set(digest_attr, md_data, (int)md_len);
--            PKCS7_add_signed_attribute(p7si, NID_pkcs9_messageDigest,
--                                       V_ASN1_OCTET_STRING, (char *) digest_attr);
-+        /* create a message digest attr */
-+        digest_attr = ASN1_OCTET_STRING_new();
-+        ASN1_OCTET_STRING_set(digest_attr, md_data, (int)md_len);
-+        PKCS7_add_signed_attribute(p7si, NID_pkcs9_messageDigest,
-+                                   V_ASN1_OCTET_STRING, (char *)digest_attr);
- 
--            /* create a content-type attr */
--            oid_copy = OBJ_dup(oid);
--            if (oid_copy == NULL)
--                goto cleanup2;
--            PKCS7_add_signed_attribute(p7si, NID_pkcs9_contentType,
--                                       V_ASN1_OBJECT, oid_copy);
--
--            /* create the signature over signed attributes. get DER encoded value */
--            /* This is the place where smartcard signature needs to be calculated */
--            sk = p7si->auth_attr;
--            alen = ASN1_item_i2d((ASN1_VALUE *) sk, &abuf,
--                                 ASN1_ITEM_rptr(PKCS7_ATTR_SIGN));
--            if (abuf == NULL)
--                goto cleanup2;
--        } /* signed attributes */
-+        /* create a content-type attr */
-+        oid_copy = OBJ_dup(oid);
-+        if (oid_copy == NULL)
-+            goto cleanup2;
-+        PKCS7_add_signed_attribute(p7si, NID_pkcs9_contentType,
-+                                   V_ASN1_OBJECT, oid_copy);
-+
-+        /* create the signature over signed attributes. get DER encoded value */
-+        /* This is the place where smartcard signature needs to be calculated */
-+        sk = p7si->auth_attr;
-+        alen = ASN1_item_i2d((ASN1_VALUE *)sk, &abuf,
-+                             ASN1_ITEM_rptr(PKCS7_ATTR_SIGN));
-+        if (abuf == NULL)
-+            goto cleanup2;
- 
- #ifndef WITHOUT_PKCS11
-         /* Some tokens can only do RSAEncryption without sha1 hash */
-@@ -1301,11 +1289,7 @@ cms_signeddata_create(krb5_context context,
-             ctx = EVP_MD_CTX_new();
-             if (ctx == NULL)
-                 goto cleanup;
--            /* if this is not draft9 request, include digest signed attribute */
--            if (cms_msg_type != CMS_SIGN_DRAFT9)
--                EVP_DigestInit_ex(ctx, md_tmp, NULL);
--            else
--                EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
-+            EVP_DigestInit_ex(ctx, md_tmp, NULL);
-             EVP_DigestUpdate(ctx, abuf, alen);
-             EVP_DigestFinal_ex(ctx, md_data2, &md_len2);
-             EVP_MD_CTX_free(ctx);
-@@ -1349,8 +1333,7 @@ cms_signeddata_create(krb5_context context,
- #ifdef DEBUG_SIG
-         print_buffer(sig, sig_len);
- #endif
--        if (cms_msg_type != CMS_SIGN_DRAFT9 )
--            free(abuf);
-+        free(abuf);
-         if (retval)
-             goto cleanup2;
- 
-@@ -1393,19 +1376,13 @@ cms_signeddata_create(krb5_context context,
-         print_buffer_bin(*signed_data, *signed_data_len,
-                          "/tmp/client_pkcs7_signeddata");
-     } else {
--        if (cms_msg_type == CMS_SIGN_SERVER) {
--            print_buffer_bin(*signed_data, *signed_data_len,
--                             "/tmp/kdc_pkcs7_signeddata");
--        } else {
--            print_buffer_bin(*signed_data, *signed_data_len,
--                             "/tmp/draft9_pkcs7_signeddata");
--        }
-+        print_buffer_bin(*signed_data, *signed_data_len,
-+                         "/tmp/kdc_pkcs7_signeddata");
-     }
- #endif
- 
- cleanup2:
-     if (p7si) {
--        if (cms_msg_type != CMS_SIGN_DRAFT9)
- #ifndef WITHOUT_PKCS11
-         if (id_cryptoctx->pkcs11_method == 1 &&
-             id_cryptoctx->mech == CKM_RSA_PKCS) {
-@@ -1692,15 +1669,13 @@ cms_signeddata_verify(krb5_context context,
- #endif
-         } else {
-             /* retrieve verified certificate chain */
--            if (cms_msg_type == CMS_SIGN_CLIENT || cms_msg_type == CMS_SIGN_DRAFT9)
-+            if (cms_msg_type == CMS_SIGN_CLIENT)
-                 verified_chain = X509_STORE_CTX_get1_chain(cert_ctx);
-         }
-         X509_STORE_CTX_free(cert_ctx);
-         if (i <= 0)
-             goto cleanup;
-         out = BIO_new(BIO_s_mem());
--        if (cms_msg_type == CMS_SIGN_DRAFT9)
--            flags |= CMS_NOATTR;
-         if (CMS_verify(cms, NULL, store, NULL, out, flags) == 0) {
-             unsigned long err = ERR_peek_error();
-             switch(ERR_GET_REASON(err)) {
-@@ -1717,21 +1692,6 @@ cms_signeddata_verify(krb5_context context,
-     } /* message was signed */
-     if (!OBJ_cmp(etype, oid))
-         valid_oid = 1;
--    else if (cms_msg_type == CMS_SIGN_DRAFT9) {
--        /*
--         * Various implementations of the pa-type 15 request use
--         * different OIDS.  We check that the returned object
--         * has any of the acceptable OIDs
--         */
--        ASN1_OBJECT *client_oid = NULL, *server_oid = NULL, *rsa_oid = NULL;
--        client_oid = pkinit_pkcs7type2oid(plgctx, CMS_SIGN_CLIENT);
--        server_oid = pkinit_pkcs7type2oid(plgctx, CMS_SIGN_SERVER);
--        rsa_oid = pkinit_pkcs7type2oid(plgctx, CMS_ENVEL_SERVER);
--        if (!OBJ_cmp(etype, client_oid) ||
--            !OBJ_cmp(etype, server_oid) ||
--            !OBJ_cmp(etype, rsa_oid))
--            valid_oid = 1;
--    }
- 
-     if (valid_oid)
-         pkiDebug("CMS Verification successful\n");
-@@ -1761,7 +1721,7 @@ cms_signeddata_verify(krb5_context context,
-         reqctx->received_cert = X509_dup(x);
- 
-         /* generate authorization data */
--        if (cms_msg_type == CMS_SIGN_CLIENT || cms_msg_type == CMS_SIGN_DRAFT9) {
-+        if (cms_msg_type == CMS_SIGN_CLIENT) {
- 
-             if (authz_data == NULL || authz_data_len == NULL)
-                 goto out;
-@@ -1841,24 +1801,11 @@ cms_envelopeddata_create(krb5_context context,
-     int signed_data_len = 0, enc_data_len = 0, flags = PKCS7_BINARY;
-     STACK_OF(X509) *encerts = NULL;
-     const EVP_CIPHER *cipher = NULL;
--    int cms_msg_type;
--
--    /* create the PKCS7 SignedData portion of the PKCS7 EnvelopedData */
--    switch ((int)pa_type) {
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--    case KRB5_PADATA_PK_AS_REP_OLD:
--        cms_msg_type = CMS_SIGN_DRAFT9;
--        break;
--    case KRB5_PADATA_PK_AS_REQ:
--        cms_msg_type = CMS_ENVEL_SERVER;
--        break;
--    default:
--        goto cleanup;
--    }
- 
-     retval = cms_signeddata_create(context, plgctx, reqctx, idctx,
--                                   cms_msg_type, include_certchain, key_pack, key_pack_len,
--                                   &signed_data, (unsigned int *)&signed_data_len);
-+                                   CMS_ENVEL_SERVER, include_certchain,
-+                                   key_pack, key_pack_len, &signed_data,
-+                                   (unsigned int *)&signed_data_len);
-     if (retval) {
-         pkiDebug("failed to create pkcs7 signed data\n");
-         goto cleanup;
-@@ -1874,26 +1821,11 @@ cms_envelopeddata_create(krb5_context context,
- 
-     cipher = EVP_des_ede3_cbc();
-     in = BIO_new(BIO_s_mem());
--    switch (pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        prepare_enc_data(signed_data, signed_data_len, &enc_data,
--                         &enc_data_len);
--        retval = BIO_write(in, enc_data, enc_data_len);
--        if (retval != enc_data_len) {
--            pkiDebug("BIO_write only wrote %d\n", retval);
--            goto cleanup;
--        }
--        break;
--    case KRB5_PADATA_PK_AS_REP_OLD:
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        retval = BIO_write(in, signed_data, signed_data_len);
--        if (retval != signed_data_len) {
--            pkiDebug("BIO_write only wrote %d\n", retval);
--            goto cleanup;
--        }
--        break;
--    default:
--        retval = -1;
-+    prepare_enc_data(signed_data, signed_data_len, &enc_data,
-+                     &enc_data_len);
-+    retval = BIO_write(in, enc_data, enc_data_len);
-+    if (retval != enc_data_len) {
-+        pkiDebug("BIO_write only wrote %d\n", retval);
-         goto cleanup;
-     }
- 
-@@ -1902,20 +1834,7 @@ cms_envelopeddata_create(krb5_context context,
-         retval = oerr(context, 0, _("Failed to encrypt PKCS7 object"));
-         goto cleanup;
-     }
--    switch (pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        p7->d.enveloped->enc_data->content_type =
--            OBJ_nid2obj(NID_pkcs7_signed);
--        break;
--    case KRB5_PADATA_PK_AS_REP_OLD:
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        p7->d.enveloped->enc_data->content_type =
--            OBJ_nid2obj(NID_pkcs7_data);
--        break;
--        break;
--        break;
--        break;
--    }
-+    p7->d.enveloped->enc_data->content_type = OBJ_nid2obj(NID_pkcs7_signed);
- 
-     *out_len = i2d_PKCS7(p7, NULL);
-     if (!*out_len || (p = *out = malloc(*out_len)) == NULL) {
-@@ -1963,7 +1882,6 @@ cms_envelopeddata_verify(krb5_context context,
-     const unsigned char *p = enveloped_data;
-     unsigned int tmp_buf_len = 0, tmp_buf2_len = 0, vfy_buf_len = 0;
-     unsigned char *tmp_buf = NULL, *tmp_buf2 = NULL, *vfy_buf = NULL;
--    int msg_type = 0;
- 
- #ifdef DEBUG_ASN1
-     print_buffer_bin(enveloped_data, enveloped_data_len,
-@@ -1995,46 +1913,21 @@ cms_envelopeddata_verify(krb5_context context,
-     print_buffer_bin(tmp_buf, tmp_buf_len, "/tmp/client_enc_keypack");
- #endif
-     /* verify PKCS7 SignedData message */
--    switch (pa_type) {
--    case KRB5_PADATA_PK_AS_REP:
--        msg_type = CMS_ENVEL_SERVER;
--
--        break;
--    case KRB5_PADATA_PK_AS_REP_OLD:
--        msg_type = CMS_SIGN_DRAFT9;
--        break;
--    default:
--        pkiDebug("%s: unrecognized pa_type = %d\n", __FUNCTION__, pa_type);
--        retval = KRB5KDC_ERR_PREAUTH_FAILED;
-+    /* Wrap the signed data to make decoding easier in the verify routine. */
-+    retval = wrap_signeddata(tmp_buf, tmp_buf_len, &tmp_buf2, &tmp_buf2_len);
-+    if (retval) {
-+        pkiDebug("failed to encode signeddata\n");
-         goto cleanup;
-     }
--    /*
--     * If this is the RFC style, wrap the signed data to make
--     * decoding easier in the verify routine.
--     * For draft9-compatible, we don't do anything because it
--     * is already wrapped.
--     */
--    if (msg_type == CMS_ENVEL_SERVER) {
--        retval = wrap_signeddata(tmp_buf, tmp_buf_len,
--                                 &tmp_buf2, &tmp_buf2_len);
--        if (retval) {
--            pkiDebug("failed to encode signeddata\n");
--            goto cleanup;
--        }
--        vfy_buf = tmp_buf2;
--        vfy_buf_len = tmp_buf2_len;
--
--    } else {
--        vfy_buf = tmp_buf;
--        vfy_buf_len = tmp_buf_len;
--    }
-+    vfy_buf = tmp_buf2;
-+    vfy_buf_len = tmp_buf2_len;
- 
- #ifdef DEBUG_ASN1
-     print_buffer_bin(vfy_buf, vfy_buf_len, "/tmp/client_enc_keypack2");
- #endif
- 
-     retval = cms_signeddata_verify(context, plg_cryptoctx, req_cryptoctx,
--                                   id_cryptoctx, msg_type,
-+                                   id_cryptoctx, CMS_ENVEL_SERVER,
-                                    require_crl_checking,
-                                    vfy_buf, vfy_buf_len,
-                                    data, data_len, NULL, NULL, NULL);
-@@ -3580,8 +3473,6 @@ pkinit_pkcs7type2oid(pkinit_plg_crypto_context cryptoctx, int pkcs7_type)
-     switch (pkcs7_type) {
-     case CMS_SIGN_CLIENT:
-         return cryptoctx->id_pkinit_authData;
--    case CMS_SIGN_DRAFT9:
--        return OBJ_nid2obj(NID_pkcs7_data);
-     case CMS_SIGN_SERVER:
-         return cryptoctx->id_pkinit_DHKeyData;
-     case CMS_ENVEL_SERVER:
-diff --git a/src/plugins/preauth/pkinit/pkinit_lib.c b/src/plugins/preauth/pkinit/pkinit_lib.c
-index d5858c424..bb2916bd5 100644
---- a/src/plugins/preauth/pkinit/pkinit_lib.c
-+++ b/src/plugins/preauth/pkinit/pkinit_lib.c
-@@ -110,15 +110,6 @@ free_krb5_pa_pk_as_req(krb5_pa_pk_as_req **in)
-     free(*in);
- }
- 
--void
--free_krb5_pa_pk_as_req_draft9(krb5_pa_pk_as_req_draft9 **in)
--{
--    if (*in == NULL) return;
--    free((*in)->signedAuthPack.data);
--    free((*in)->kdcCert.data);
--    free(*in);
--}
--
- void
- free_krb5_reply_key_pack(krb5_reply_key_pack **in)
- {
-@@ -128,14 +119,6 @@ free_krb5_reply_key_pack(krb5_reply_key_pack **in)
-     free(*in);
- }
- 
--void
--free_krb5_reply_key_pack_draft9(krb5_reply_key_pack_draft9 **in)
--{
--    if (*in == NULL) return;
--    free((*in)->replyKey.contents);
--    free(*in);
--}
--
- void
- free_krb5_auth_pack(krb5_auth_pack **in)
- {
-@@ -160,15 +143,6 @@ free_krb5_auth_pack(krb5_auth_pack **in)
-     free(*in);
- }
- 
--void
--free_krb5_auth_pack_draft9(krb5_context context,
--                           krb5_auth_pack_draft9 **in)
--{
--    if ((*in) == NULL) return;
--    krb5_free_principal(context, (*in)->pkAuthenticator.kdcName);
--    free(*in);
--}
--
- void
- free_krb5_pa_pk_as_rep(krb5_pa_pk_as_rep **in)
- {
-@@ -187,14 +161,6 @@ free_krb5_pa_pk_as_rep(krb5_pa_pk_as_rep **in)
-     free(*in);
- }
- 
--void
--free_krb5_pa_pk_as_rep_draft9(krb5_pa_pk_as_rep_draft9 **in)
--{
--    if (*in == NULL) return;
--    free((*in)->u.encKeyPack.data);
--    free(*in);
--}
--
- void
- free_krb5_external_principal_identifier(krb5_external_principal_identifier ***in)
- {
-@@ -261,17 +227,6 @@ init_krb5_pa_pk_as_req(krb5_pa_pk_as_req **in)
-     (*in)->kdcPkId.length = 0;
- }
- 
--void
--init_krb5_pa_pk_as_req_draft9(krb5_pa_pk_as_req_draft9 **in)
--{
--    (*in) = malloc(sizeof(krb5_pa_pk_as_req_draft9));
--    if ((*in) == NULL) return;
--    (*in)->signedAuthPack.data = NULL;
--    (*in)->signedAuthPack.length = 0;
--    (*in)->kdcCert.data = NULL;
--    (*in)->kdcCert.length = 0;
--}
--
- void
- init_krb5_reply_key_pack(krb5_reply_key_pack **in)
- {
-@@ -283,15 +238,6 @@ init_krb5_reply_key_pack(krb5_reply_key_pack **in)
-     (*in)->asChecksum.length = 0;
- }
- 
--void
--init_krb5_reply_key_pack_draft9(krb5_reply_key_pack_draft9 **in)
--{
--    (*in) = malloc(sizeof(krb5_reply_key_pack_draft9));
--    if ((*in) == NULL) return;
--    (*in)->replyKey.contents = NULL;
--    (*in)->replyKey.length = 0;
--}
--
- void
- init_krb5_pa_pk_as_rep(krb5_pa_pk_as_rep **in)
- {
-@@ -306,17 +252,6 @@ init_krb5_pa_pk_as_rep(krb5_pa_pk_as_rep **in)
-     (*in)->u.dh_Info.kdfID = NULL;
- }
- 
--void
--init_krb5_pa_pk_as_rep_draft9(krb5_pa_pk_as_rep_draft9 **in)
--{
--    (*in) = malloc(sizeof(krb5_pa_pk_as_rep_draft9));
--    if ((*in) == NULL) return;
--    (*in)->u.dhSignedData.length = 0;
--    (*in)->u.dhSignedData.data = NULL;
--    (*in)->u.encKeyPack.length = 0;
--    (*in)->u.encKeyPack.data = NULL;
--}
--
- void
- init_krb5_subject_pk_info(krb5_subject_pk_info **in)
- {
-diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
-index 6aa646cc6..c44be9c74 100644
---- a/src/plugins/preauth/pkinit/pkinit_srv.c
-+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
-@@ -421,9 +421,7 @@ pkinit_server_verify_padata(krb5_context context,
-     krb5_error_code retval = 0;
-     krb5_data authp_data = {0, 0, NULL}, krb5_authz = {0, 0, NULL};
-     krb5_pa_pk_as_req *reqp = NULL;
--    krb5_pa_pk_as_req_draft9 *reqp9 = NULL;
-     krb5_auth_pack *auth_pack = NULL;
--    krb5_auth_pack_draft9 *auth_pack9 = NULL;
-     pkinit_kdc_context plgctx = NULL;
-     pkinit_kdc_req_context reqctx = NULL;
-     krb5_checksum cksum = {0, 0, 0, NULL};
-@@ -464,58 +462,32 @@ pkinit_server_verify_padata(krb5_context context,
- 
-     PADATA_TO_KRB5DATA(data, &k5data);
- 
--    switch ((int)data->pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        TRACE_PKINIT_SERVER_PADATA_VERIFY(context);
--        retval = k5int_decode_krb5_pa_pk_as_req(&k5data, &reqp);
--        if (retval) {
--            pkiDebug("decode_krb5_pa_pk_as_req failed\n");
--            goto cleanup;
--        }
--#ifdef DEBUG_ASN1
--        print_buffer_bin(reqp->signedAuthPack.data,
--                         reqp->signedAuthPack.length,
--                         "/tmp/kdc_signed_data");
--#endif
--        retval = cms_signeddata_verify(context, plgctx->cryptoctx,
--                                       reqctx->cryptoctx, plgctx->idctx, CMS_SIGN_CLIENT,
--                                       plgctx->opts->require_crl_checking,
--                                       (unsigned char *)
--                                       reqp->signedAuthPack.data, reqp->signedAuthPack.length,
--                                       (unsigned char **)&authp_data.data,
--                                       &authp_data.length,
--                                       (unsigned char **)&krb5_authz.data,
--                                       &krb5_authz.length, &is_signed);
--        break;
--    case KRB5_PADATA_PK_AS_REP_OLD:
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        TRACE_PKINIT_SERVER_PADATA_VERIFY_OLD(context);
--        retval = k5int_decode_krb5_pa_pk_as_req_draft9(&k5data, &reqp9);
--        if (retval) {
--            pkiDebug("decode_krb5_pa_pk_as_req_draft9 failed\n");
--            goto cleanup;
--        }
--#ifdef DEBUG_ASN1
--        print_buffer_bin(reqp9->signedAuthPack.data,
--                         reqp9->signedAuthPack.length,
--                         "/tmp/kdc_signed_data_draft9");
--#endif
--
--        retval = cms_signeddata_verify(context, plgctx->cryptoctx,
--                                       reqctx->cryptoctx, plgctx->idctx, CMS_SIGN_DRAFT9,
--                                       plgctx->opts->require_crl_checking,
--                                       (unsigned char *)
--                                       reqp9->signedAuthPack.data, reqp9->signedAuthPack.length,
--                                       (unsigned char **)&authp_data.data,
--                                       &authp_data.length,
--                                       (unsigned char **)&krb5_authz.data,
--                                       &krb5_authz.length, NULL);
--        break;
--    default:
-+    if (data->pa_type != KRB5_PADATA_PK_AS_REQ) {
-         pkiDebug("unrecognized pa_type = %d\n", data->pa_type);
-         retval = EINVAL;
-         goto cleanup;
-     }
-+
-+    TRACE_PKINIT_SERVER_PADATA_VERIFY(context);
-+    retval = k5int_decode_krb5_pa_pk_as_req(&k5data, &reqp);
-+    if (retval) {
-+        pkiDebug("decode_krb5_pa_pk_as_req failed\n");
-+        goto cleanup;
-+    }
-+#ifdef DEBUG_ASN1
-+    print_buffer_bin(reqp->signedAuthPack.data, reqp->signedAuthPack.length,
-+                     "/tmp/kdc_signed_data");
-+#endif
-+    retval = cms_signeddata_verify(context, plgctx->cryptoctx,
-+                                   reqctx->cryptoctx, plgctx->idctx,
-+                                   CMS_SIGN_CLIENT,
-+                                   plgctx->opts->require_crl_checking,
-+                                   (unsigned char *)reqp->signedAuthPack.data,
-+                                   reqp->signedAuthPack.length,
-+                                   (unsigned char **)&authp_data.data,
-+                                   &authp_data.length,
-+                                   (unsigned char **)&krb5_authz.data,
-+                                   &krb5_authz.length, &is_signed);
-     if (retval) {
-         TRACE_PKINIT_SERVER_PADATA_VERIFY_FAIL(context);
-         goto cleanup;
-@@ -541,117 +513,87 @@ pkinit_server_verify_padata(krb5_context context,
- #endif
- 
-     OCTETDATA_TO_KRB5DATA(&authp_data, &k5data);
--    switch ((int)data->pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        retval = k5int_decode_krb5_auth_pack(&k5data, &auth_pack);
--        if (retval) {
--            pkiDebug("failed to decode krb5_auth_pack\n");
--            goto cleanup;
--        }
--
--        retval = krb5_check_clockskew(context,
--                                      auth_pack->pkAuthenticator.ctime);
--        if (retval)
--            goto cleanup;
-+    retval = k5int_decode_krb5_auth_pack(&k5data, &auth_pack);
-+    if (retval) {
-+        pkiDebug("failed to decode krb5_auth_pack\n");
-+        goto cleanup;
-+    }
- 
--        /* check dh parameters */
--        if (auth_pack->clientPublicValue != NULL) {
--            retval = server_check_dh(context, plgctx->cryptoctx,
--                                     reqctx->cryptoctx, plgctx->idctx,
--                                     &auth_pack->clientPublicValue->algorithm.parameters,
--                                     plgctx->opts->dh_min_bits);
-+    retval = krb5_check_clockskew(context, auth_pack->pkAuthenticator.ctime);
-+    if (retval)
-+        goto cleanup;
- 
--            if (retval) {
--                pkiDebug("bad dh parameters\n");
--                goto cleanup;
--            }
--        } else if (!is_signed) {
--            /*Anonymous pkinit requires DH*/
--            retval = KRB5KDC_ERR_PREAUTH_FAILED;
--            krb5_set_error_message(context, retval,
--                                   _("Anonymous pkinit without DH public "
--                                     "value not supported."));
--            goto cleanup;
--        }
--        der_req = cb->request_body(context, rock);
--        retval = krb5_c_make_checksum(context, CKSUMTYPE_NIST_SHA, NULL,
--                                      0, der_req, &cksum);
-+    /* check dh parameters */
-+    if (auth_pack->clientPublicValue != NULL) {
-+        retval = server_check_dh(context, plgctx->cryptoctx,
-+                                 reqctx->cryptoctx, plgctx->idctx,
-+                                 &auth_pack->clientPublicValue->algorithm.parameters,
-+                                 plgctx->opts->dh_min_bits);
-         if (retval) {
--            pkiDebug("unable to calculate AS REQ checksum\n");
-+            pkiDebug("bad dh parameters\n");
-             goto cleanup;
-         }
--        if (cksum.length != auth_pack->pkAuthenticator.paChecksum.length ||
--            k5_bcmp(cksum.contents,
--                    auth_pack->pkAuthenticator.paChecksum.contents,
--                    cksum.length) != 0) {
--            pkiDebug("failed to match the checksum\n");
-+    } else if (!is_signed) {
-+        /*Anonymous pkinit requires DH*/
-+        retval = KRB5KDC_ERR_PREAUTH_FAILED;
-+        krb5_set_error_message(context, retval,
-+                               _("Anonymous pkinit without DH public "
-+                                 "value not supported."));
-+        goto cleanup;
-+    }
-+    der_req = cb->request_body(context, rock);
-+    retval = krb5_c_make_checksum(context, CKSUMTYPE_NIST_SHA, NULL, 0,
-+                                  der_req, &cksum);
-+    if (retval) {
-+        pkiDebug("unable to calculate AS REQ checksum\n");
-+        goto cleanup;
-+    }
-+    if (cksum.length != auth_pack->pkAuthenticator.paChecksum.length ||
-+        k5_bcmp(cksum.contents, auth_pack->pkAuthenticator.paChecksum.contents,
-+                cksum.length) != 0) {
-+        pkiDebug("failed to match the checksum\n");
- #ifdef DEBUG_CKSUM
--            pkiDebug("calculating checksum on buf size (%d)\n",
--                     req_pkt->length);
--            print_buffer(req_pkt->data, req_pkt->length);
--            pkiDebug("received checksum type=%d size=%d ",
--                     auth_pack->pkAuthenticator.paChecksum.checksum_type,
-+        pkiDebug("calculating checksum on buf size (%d)\n", req_pkt->length);
-+        print_buffer(req_pkt->data, req_pkt->length);
-+        pkiDebug("received checksum type=%d size=%d ",
-+                 auth_pack->pkAuthenticator.paChecksum.checksum_type,
-+                 auth_pack->pkAuthenticator.paChecksum.length);
-+        print_buffer(auth_pack->pkAuthenticator.paChecksum.contents,
-                      auth_pack->pkAuthenticator.paChecksum.length);
--            print_buffer(auth_pack->pkAuthenticator.paChecksum.contents,
--                         auth_pack->pkAuthenticator.paChecksum.length);
--            pkiDebug("expected checksum type=%d size=%d ",
--                     cksum.checksum_type, cksum.length);
--            print_buffer(cksum.contents, cksum.length);
-+        pkiDebug("expected checksum type=%d size=%d ",
-+                 cksum.checksum_type, cksum.length);
-+        print_buffer(cksum.contents, cksum.length);
- #endif
- 
--            retval = KRB5KDC_ERR_PA_CHECKSUM_MUST_BE_INCLUDED;
--            goto cleanup;
--        }
--
--        ftoken = auth_pack->pkAuthenticator.freshnessToken;
--        if (ftoken != NULL) {
--            retval = cb->check_freshness_token(context, rock, ftoken);
--            if (retval)
--                goto cleanup;
--            valid_freshness_token = TRUE;
--        }
--
--        /* check if kdcPkId present and match KDC's subjectIdentifier */
--        if (reqp->kdcPkId.data != NULL) {
--            int valid_kdcPkId = 0;
--            retval = pkinit_check_kdc_pkid(context, plgctx->cryptoctx,
--                                           reqctx->cryptoctx, plgctx->idctx,
--                                           (unsigned char *)reqp->kdcPkId.data,
--                                           reqp->kdcPkId.length, &valid_kdcPkId);
--            if (retval)
--                goto cleanup;
--            if (!valid_kdcPkId)
--                pkiDebug("kdcPkId in AS_REQ does not match KDC's cert"
--                         "RFC says to ignore and proceed\n");
-+        retval = KRB5KDC_ERR_PA_CHECKSUM_MUST_BE_INCLUDED;
-+        goto cleanup;
-+    }
- 
--        }
--        /* remember the decoded auth_pack for verify_padata routine */
--        reqctx->rcv_auth_pack = auth_pack;
--        auth_pack = NULL;
--        break;
--    case KRB5_PADATA_PK_AS_REP_OLD:
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        retval = k5int_decode_krb5_auth_pack_draft9(&k5data, &auth_pack9);
--        if (retval) {
--            pkiDebug("failed to decode krb5_auth_pack_draft9\n");
-+    ftoken = auth_pack->pkAuthenticator.freshnessToken;
-+    if (ftoken != NULL) {
-+        retval = cb->check_freshness_token(context, rock, ftoken);
-+        if (retval)
-             goto cleanup;
--        }
--        if (auth_pack9->clientPublicValue != NULL) {
--            retval = server_check_dh(context, plgctx->cryptoctx,
--                                     reqctx->cryptoctx, plgctx->idctx,
--                                     &auth_pack9->clientPublicValue->algorithm.parameters,
--                                     plgctx->opts->dh_min_bits);
-+        valid_freshness_token = TRUE;
-+    }
- 
--            if (retval) {
--                pkiDebug("bad dh parameters\n");
--                goto cleanup;
--            }
-+    /* check if kdcPkId present and match KDC's subjectIdentifier */
-+    if (reqp->kdcPkId.data != NULL) {
-+        int valid_kdcPkId = 0;
-+        retval = pkinit_check_kdc_pkid(context, plgctx->cryptoctx,
-+                                       reqctx->cryptoctx, plgctx->idctx,
-+                                       (unsigned char *)reqp->kdcPkId.data,
-+                                       reqp->kdcPkId.length, &valid_kdcPkId);
-+        if (retval)
-+            goto cleanup;
-+        if (!valid_kdcPkId) {
-+            pkiDebug("kdcPkId in AS_REQ does not match KDC's cert; "
-+                     "RFC says to ignore and proceed\n");
-         }
--        /* remember the decoded auth_pack for verify_padata routine */
--        reqctx->rcv_auth_pack9 = auth_pack9;
--        auth_pack9 = NULL;
--        break;
-     }
-+    /* remember the decoded auth_pack for verify_padata routine */
-+    reqctx->rcv_auth_pack = auth_pack;
-+    auth_pack = NULL;
- 
-     if (is_signed) {
-         retval = check_log_freshness(context, plgctx, request,
-@@ -682,21 +624,13 @@ cleanup:
-             pkiDebug("pkinit_create_edata failed\n");
-     }
- 
--    switch ((int)data->pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        free_krb5_pa_pk_as_req(&reqp);
--        free(cksum.contents);
--        break;
--    case KRB5_PADATA_PK_AS_REP_OLD:
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        free_krb5_pa_pk_as_req_draft9(&reqp9);
--    }
-+    free_krb5_pa_pk_as_req(&reqp);
-+    free(cksum.contents);
-     free(authp_data.data);
-     free(krb5_authz.data);
-     if (reqctx != NULL)
-         pkinit_fini_kdc_req_context(context, reqctx);
-     free_krb5_auth_pack(&auth_pack);
--    free_krb5_auth_pack_draft9(context, &auth_pack9);
- 
-     (*respond)(arg, retval, modreq, e_data, NULL);
- }
-@@ -817,7 +751,6 @@ pkinit_server_return_padata(krb5_context context,
-     krb5_error_code retval = 0;
-     krb5_data scratch = {0, 0, NULL};
-     krb5_pa_pk_as_req *reqp = NULL;
--    krb5_pa_pk_as_req_draft9 *reqp9 = NULL;
-     int i = 0;
- 
-     unsigned char *subjectPublicKey = NULL;
-@@ -828,21 +761,17 @@ pkinit_server_return_padata(krb5_context context,
-     krb5_kdc_dh_key_info dhkey_info;
-     krb5_data *encoded_dhkey_info = NULL;
-     krb5_pa_pk_as_rep *rep = NULL;
--    krb5_pa_pk_as_rep_draft9 *rep9 = NULL;
-     krb5_data *out_data = NULL;
-     krb5_data secret;
- 
-     krb5_enctype enctype = -1;
- 
-     krb5_reply_key_pack *key_pack = NULL;
--    krb5_reply_key_pack_draft9 *key_pack9 = NULL;
-     krb5_data *encoded_key_pack = NULL;
- 
-     pkinit_kdc_context plgctx;
-     pkinit_kdc_req_context reqctx;
- 
--    int fixed_keypack = 0;
--
-     *send_pa = NULL;
-     if (padata->pa_type == KRB5_PADATA_PKINIT_KX) {
-         return return_pkinit_kx(context, request, reply,
-@@ -886,29 +815,13 @@ pkinit_server_return_padata(krb5_context context,
-         goto cleanup;
-     }
- 
--    switch((int)reqctx->pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        init_krb5_pa_pk_as_rep(&rep);
--        if (rep == NULL) {
--            retval = ENOMEM;
--            goto cleanup;
--        }
--        /* let's assume it's RSA. we'll reset it to DH if needed */
--        rep->choice = choice_pa_pk_as_rep_encKeyPack;
--        break;
--    case KRB5_PADATA_PK_AS_REP_OLD:
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        init_krb5_pa_pk_as_rep_draft9(&rep9);
--        if (rep9 == NULL) {
--            retval = ENOMEM;
--            goto cleanup;
--        }
--        rep9->choice = choice_pa_pk_as_rep_draft9_encKeyPack;
--        break;
--    default:
--        retval = KRB5KDC_ERR_PREAUTH_FAILED;
-+    init_krb5_pa_pk_as_rep(&rep);
-+    if (rep == NULL) {
-+        retval = ENOMEM;
-         goto cleanup;
-     }
-+    /* let's assume it's RSA. we'll reset it to DH if needed */
-+    rep->choice = choice_pa_pk_as_rep_encKeyPack;
- 
-     if (reqctx->rcv_auth_pack != NULL &&
-         reqctx->rcv_auth_pack->clientPublicValue != NULL) {
-@@ -917,18 +830,7 @@ pkinit_server_return_padata(krb5_context context,
-         subjectPublicKey_len =
-             reqctx->rcv_auth_pack->clientPublicValue->subjectPublicKey.length;
-         rep->choice = choice_pa_pk_as_rep_dhInfo;
--    } else if (reqctx->rcv_auth_pack9 != NULL &&
--               reqctx->rcv_auth_pack9->clientPublicValue != NULL) {
--        subjectPublicKey = (unsigned char *)
--            reqctx->rcv_auth_pack9->clientPublicValue->subjectPublicKey.data;
--        subjectPublicKey_len =
--            reqctx->rcv_auth_pack9->clientPublicValue->subjectPublicKey.length;
--        rep9->choice = choice_pa_pk_as_rep_draft9_dhSignedData;
--    }
- 
--    /* if this DH, then process finish computing DH key */
--    if (rep != NULL && (rep->choice == choice_pa_pk_as_rep_dhInfo ||
--                        rep->choice == choice_pa_pk_as_rep_draft9_dhSignedData)) {
-         pkiDebug("received DH key delivery AS REQ\n");
-         retval = server_process_dh(context, plgctx->cryptoctx,
-                                    reqctx->cryptoctx, plgctx->idctx, subjectPublicKey,
-@@ -938,10 +840,6 @@ pkinit_server_return_padata(krb5_context context,
-             pkiDebug("failed to process/create dh paramters\n");
-             goto cleanup;
-         }
--    }
--    if ((rep9 != NULL &&
--         rep9->choice == choice_pa_pk_as_rep_draft9_dhSignedData) ||
--        (rep != NULL && rep->choice == choice_pa_pk_as_rep_dhInfo)) {
- 
-         /*
-          * This is DH, so don't generate the key until after we
-@@ -966,36 +864,18 @@ pkinit_server_return_padata(krb5_context context,
-                          "/tmp/kdc_dh_key_info");
- #endif
- 
--        switch ((int)padata->pa_type) {
--        case KRB5_PADATA_PK_AS_REQ:
--            retval = cms_signeddata_create(context, plgctx->cryptoctx,
--                                           reqctx->cryptoctx, plgctx->idctx, CMS_SIGN_SERVER, 1,
--                                           (unsigned char *)
--                                           encoded_dhkey_info->data,
--                                           encoded_dhkey_info->length,
--                                           (unsigned char **)
--                                           &rep->u.dh_Info.dhSignedData.data,
--                                           &rep->u.dh_Info.dhSignedData.length);
--            if (retval) {
--                pkiDebug("failed to create pkcs7 signed data\n");
--                goto cleanup;
--            }
--            break;
--        case KRB5_PADATA_PK_AS_REP_OLD:
--        case KRB5_PADATA_PK_AS_REQ_OLD:
--            retval = cms_signeddata_create(context, plgctx->cryptoctx,
--                                           reqctx->cryptoctx, plgctx->idctx, CMS_SIGN_DRAFT9, 1,
--                                           (unsigned char *)
--                                           encoded_dhkey_info->data,
--                                           encoded_dhkey_info->length,
--                                           (unsigned char **)
--                                           &rep9->u.dhSignedData.data,
--                                           &rep9->u.dhSignedData.length);
--            if (retval) {
--                pkiDebug("failed to create pkcs7 signed data\n");
--                goto cleanup;
--            }
--            break;
-+        retval = cms_signeddata_create(context, plgctx->cryptoctx,
-+                                       reqctx->cryptoctx, plgctx->idctx,
-+                                       CMS_SIGN_SERVER, 1,
-+                                       (unsigned char *)
-+                                       encoded_dhkey_info->data,
-+                                       encoded_dhkey_info->length,
-+                                       (unsigned char **)
-+                                       &rep->u.dh_Info.dhSignedData.data,
-+                                       &rep->u.dh_Info.dhSignedData.length);
-+        if (retval) {
-+            pkiDebug("failed to create pkcs7 signed data\n");
-+            goto cleanup;
-         }
- 
-     } else {
-@@ -1007,102 +887,49 @@ pkinit_server_return_padata(krb5_context context,
-             goto cleanup;
-         }
- 
--        /* check if PA_TYPE of KRB5_PADATA_AS_CHECKSUM (132) is present which
--         * means the client is requesting that a checksum is send back instead
--         * of the nonce.
--         */
--        for (i = 0; request->padata[i] != NULL; i++) {
--            pkiDebug("%s: Checking pa_type 0x%08x\n",
--                     __FUNCTION__, request->padata[i]->pa_type);
--            if (request->padata[i]->pa_type == KRB5_PADATA_AS_CHECKSUM)
--                fixed_keypack = 1;
-+        init_krb5_reply_key_pack(&key_pack);
-+        if (key_pack == NULL) {
-+            retval = ENOMEM;
-+            goto cleanup;
-         }
--        pkiDebug("%s: return checksum instead of nonce = %d\n",
--                 __FUNCTION__, fixed_keypack);
--
--        /* if this is an RFC reply or draft9 client requested a checksum
--         * in the reply instead of the nonce, create an RFC-style keypack
--         */
--        if ((int)padata->pa_type == KRB5_PADATA_PK_AS_REQ || fixed_keypack) {
--            init_krb5_reply_key_pack(&key_pack);
--            if (key_pack == NULL) {
--                retval = ENOMEM;
--                goto cleanup;
--            }
- 
--            retval = krb5_c_make_checksum(context, 0,
--                                          encrypting_key, KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM,
--                                          req_pkt, &key_pack->asChecksum);
--            if (retval) {
--                pkiDebug("unable to calculate AS REQ checksum\n");
--                goto cleanup;
--            }
-+        retval = krb5_c_make_checksum(context, 0, encrypting_key,
-+                                      KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM,
-+                                      req_pkt, &key_pack->asChecksum);
-+        if (retval) {
-+            pkiDebug("unable to calculate AS REQ checksum\n");
-+            goto cleanup;
-+        }
- #ifdef DEBUG_CKSUM
--            pkiDebug("calculating checksum on buf size = %d\n", req_pkt->length);
--            print_buffer(req_pkt->data, req_pkt->length);
--            pkiDebug("checksum size = %d\n", key_pack->asChecksum.length);
--            print_buffer(key_pack->asChecksum.contents,
--                         key_pack->asChecksum.length);
--            pkiDebug("encrypting key (%d)\n", encrypting_key->length);
--            print_buffer(encrypting_key->contents, encrypting_key->length);
-+        pkiDebug("calculating checksum on buf size = %d\n", req_pkt->length);
-+        print_buffer(req_pkt->data, req_pkt->length);
-+        pkiDebug("checksum size = %d\n", key_pack->asChecksum.length);
-+        print_buffer(key_pack->asChecksum.contents,
-+                     key_pack->asChecksum.length);
-+        pkiDebug("encrypting key (%d)\n", encrypting_key->length);
-+        print_buffer(encrypting_key->contents, encrypting_key->length);
- #endif
- 
--            krb5_copy_keyblock_contents(context, encrypting_key,
--                                        &key_pack->replyKey);
-+        krb5_copy_keyblock_contents(context, encrypting_key,
-+                                    &key_pack->replyKey);
- 
--            retval = k5int_encode_krb5_reply_key_pack(key_pack,
--                                                      &encoded_key_pack);
--            if (retval) {
--                pkiDebug("failed to encode reply_key_pack\n");
--                goto cleanup;
--            }
-+        retval = k5int_encode_krb5_reply_key_pack(key_pack,
-+                                                  &encoded_key_pack);
-+        if (retval) {
-+            pkiDebug("failed to encode reply_key_pack\n");
-+            goto cleanup;
-         }
- 
--        switch ((int)padata->pa_type) {
--        case KRB5_PADATA_PK_AS_REQ:
--            rep->choice = choice_pa_pk_as_rep_encKeyPack;
--            retval = cms_envelopeddata_create(context, plgctx->cryptoctx,
--                                              reqctx->cryptoctx, plgctx->idctx, padata->pa_type, 1,
--                                              (unsigned char *)
--                                              encoded_key_pack->data,
--                                              encoded_key_pack->length,
--                                              (unsigned char **)
--                                              &rep->u.encKeyPack.data,
--                                              &rep->u.encKeyPack.length);
--            break;
--        case KRB5_PADATA_PK_AS_REP_OLD:
--        case KRB5_PADATA_PK_AS_REQ_OLD:
--            /* if the request is from the broken draft9 client that
--             * expects back a nonce, create it now
--             */
--            if (!fixed_keypack) {
--                init_krb5_reply_key_pack_draft9(&key_pack9);
--                if (key_pack9 == NULL) {
--                    retval = ENOMEM;
--                    goto cleanup;
--                }
--                key_pack9->nonce = reqctx->rcv_auth_pack9->pkAuthenticator.nonce;
--                krb5_copy_keyblock_contents(context, encrypting_key,
--                                            &key_pack9->replyKey);
--
--                retval = k5int_encode_krb5_reply_key_pack_draft9(key_pack9,
--                                                                 &encoded_key_pack);
--                if (retval) {
--                    pkiDebug("failed to encode reply_key_pack\n");
--                    goto cleanup;
--                }
--            }
--
--            rep9->choice = choice_pa_pk_as_rep_draft9_encKeyPack;
--            retval = cms_envelopeddata_create(context, plgctx->cryptoctx,
--                                              reqctx->cryptoctx, plgctx->idctx, padata->pa_type, 1,
--                                              (unsigned char *)
--                                              encoded_key_pack->data,
--                                              encoded_key_pack->length,
--                                              (unsigned char **)
--                                              &rep9->u.encKeyPack.data, &rep9->u.encKeyPack.length);
--            break;
--        }
-+        rep->choice = choice_pa_pk_as_rep_encKeyPack;
-+        retval = cms_envelopeddata_create(context, plgctx->cryptoctx,
-+                                          reqctx->cryptoctx, plgctx->idctx,
-+                                          padata->pa_type, 1,
-+                                          (unsigned char *)
-+                                          encoded_key_pack->data,
-+                                          encoded_key_pack->length,
-+                                          (unsigned char **)
-+                                          &rep->u.encKeyPack.data,
-+                                          &rep->u.encKeyPack.length);
-         if (retval) {
-             pkiDebug("failed to create pkcs7 enveloped data: %s\n",
-                      error_message(retval));
-@@ -1112,23 +939,12 @@ pkinit_server_return_padata(krb5_context context,
-         print_buffer_bin((unsigned char *)encoded_key_pack->data,
-                          encoded_key_pack->length,
-                          "/tmp/kdc_key_pack");
--        switch ((int)padata->pa_type) {
--        case KRB5_PADATA_PK_AS_REQ:
--            print_buffer_bin(rep->u.encKeyPack.data,
--                             rep->u.encKeyPack.length,
--                             "/tmp/kdc_enc_key_pack");
--            break;
--        case KRB5_PADATA_PK_AS_REP_OLD:
--        case KRB5_PADATA_PK_AS_REQ_OLD:
--            print_buffer_bin(rep9->u.encKeyPack.data,
--                             rep9->u.encKeyPack.length,
--                             "/tmp/kdc_enc_key_pack");
--            break;
--        }
-+        print_buffer_bin(rep->u.encKeyPack.data, rep->u.encKeyPack.length,
-+                         "/tmp/kdc_enc_key_pack");
- #endif
-     }
- 
--    if ((rep != NULL && rep->choice == choice_pa_pk_as_rep_dhInfo) &&
-+    if (rep->choice == choice_pa_pk_as_rep_dhInfo &&
-         ((reqctx->rcv_auth_pack != NULL &&
-           reqctx->rcv_auth_pack->supportedKDFs != NULL))) {
- 
-@@ -1147,15 +963,7 @@ pkinit_server_return_padata(krb5_context context,
-         }
-     }
- 
--    switch ((int)padata->pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        retval = k5int_encode_krb5_pa_pk_as_rep(rep, &out_data);
--        break;
--    case KRB5_PADATA_PK_AS_REP_OLD:
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        retval = k5int_encode_krb5_pa_pk_as_rep_draft9(rep9, &out_data);
--        break;
--    }
-+    retval = k5int_encode_krb5_pa_pk_as_rep(rep, &out_data);
-     if (retval) {
-         pkiDebug("failed to encode AS_REP\n");
-         goto cleanup;
-@@ -1167,13 +975,11 @@ pkinit_server_return_padata(krb5_context context,
- #endif
- 
-     /* If this is DH, we haven't computed the key yet, so do it now. */
--    if ((rep9 != NULL &&
--         rep9->choice == choice_pa_pk_as_rep_draft9_dhSignedData) ||
--        (rep != NULL && rep->choice == choice_pa_pk_as_rep_dhInfo)) {
-+    if (rep->choice == choice_pa_pk_as_rep_dhInfo) {
- 
--	/* If we're not doing draft 9, and mutually supported KDFs were found,
--	 * use the algorithm agility KDF. */
--        if (rep != NULL && rep->u.dh_Info.kdfID) {
-+        /* If mutually supported KDFs were found, use the algorithm agility
-+         * KDF. */
-+        if (rep->u.dh_Info.kdfID) {
-             secret.data = (char *)server_key;
-             secret.length = server_key_len;
- 
-@@ -1209,15 +1015,7 @@ pkinit_server_return_padata(krb5_context context,
-         goto cleanup;
-     }
-     (*send_pa)->magic = KV5M_PA_DATA;
--    switch ((int)padata->pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        (*send_pa)->pa_type = KRB5_PADATA_PK_AS_REP;
--        break;
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--    case KRB5_PADATA_PK_AS_REP_OLD:
--        (*send_pa)->pa_type = KRB5_PADATA_PK_AS_REP_OLD;
--        break;
--    }
-+    (*send_pa)->pa_type = KRB5_PADATA_PK_AS_REP;
-     (*send_pa)->length = out_data->length;
-     (*send_pa)->contents = (krb5_octet *) out_data->data;
- 
-@@ -1231,23 +1029,9 @@ cleanup:
-         krb5_free_data(context, encoded_key_pack);
-     free(dh_pubkey);
-     free(server_key);
--
--    switch ((int)padata->pa_type) {
--    case KRB5_PADATA_PK_AS_REQ:
--        free_krb5_pa_pk_as_req(&reqp);
--        free_krb5_pa_pk_as_rep(&rep);
--        free_krb5_reply_key_pack(&key_pack);
--        break;
--    case KRB5_PADATA_PK_AS_REP_OLD:
--    case KRB5_PADATA_PK_AS_REQ_OLD:
--        free_krb5_pa_pk_as_req_draft9(&reqp9);
--        free_krb5_pa_pk_as_rep_draft9(&rep9);
--        if (!fixed_keypack)
--            free_krb5_reply_key_pack_draft9(&key_pack9);
--        else
--            free_krb5_reply_key_pack(&key_pack);
--        break;
--    }
-+    free_krb5_pa_pk_as_req(&reqp);
-+    free_krb5_pa_pk_as_rep(&rep);
-+    free_krb5_reply_key_pack(&key_pack);
- 
-     if (retval)
-         pkiDebug("pkinit_verify_padata failure");
-@@ -1265,8 +1049,6 @@ pkinit_server_get_flags(krb5_context kcontext, krb5_preauthtype patype)
- 
- static krb5_preauthtype supported_server_pa_types[] = {
-     KRB5_PADATA_PK_AS_REQ,
--    KRB5_PADATA_PK_AS_REQ_OLD,
--    KRB5_PADATA_PK_AS_REP_OLD,
-     KRB5_PADATA_PKINIT_KX,
-     0
- };
-@@ -1796,7 +1578,6 @@ pkinit_init_kdc_req_context(krb5_context context, pkinit_kdc_req_context *ctx)
-     if (retval)
-         goto cleanup;
-     reqctx->rcv_auth_pack = NULL;
--    reqctx->rcv_auth_pack9 = NULL;
- 
-     pkiDebug("%s: returning reqctx at %p\n", __FUNCTION__, reqctx);
-     *ctx = reqctx;
-@@ -1822,8 +1603,6 @@ pkinit_fini_kdc_req_context(krb5_context context, void *ctx)
-     pkinit_fini_req_crypto(reqctx->cryptoctx);
-     if (reqctx->rcv_auth_pack != NULL)
-         free_krb5_auth_pack(&reqctx->rcv_auth_pack);
--    if (reqctx->rcv_auth_pack9 != NULL)
--        free_krb5_auth_pack_draft9(context, &reqctx->rcv_auth_pack9);
- 
-     free(reqctx);
- }
-diff --git a/src/plugins/preauth/pkinit/pkinit_trace.h b/src/plugins/preauth/pkinit/pkinit_trace.h
-index 4da735f80..bba3226bd 100644
---- a/src/plugins/preauth/pkinit/pkinit_trace.h
-+++ b/src/plugins/preauth/pkinit/pkinit_trace.h
-@@ -49,8 +49,6 @@
- #define TRACE_PKINIT_CLIENT_KDF_OS2K(c, keyblock)                       \
-     TRACE(c, "PKINIT client used octetstring2key to compute reply key " \
-           "{keyblock}", keyblock)
--#define TRACE_PKINIT_CLIENT_NO_DRAFT9(c)                                \
--    TRACE(c, "PKINIT client ignoring draft 9 offer from RFC 4556 KDC")
- #define TRACE_PKINIT_CLIENT_NO_IDENTITY(c)                              \
-     TRACE(c, "PKINIT client has no configured identity; giving up")
- #define TRACE_PKINIT_CLIENT_REP_CHECKSUM_FAIL(c, expected, received)    \
-@@ -115,8 +113,6 @@
-     TRACE(c, "PKINIT server found no SAN in client cert")
- #define TRACE_PKINIT_SERVER_PADATA_VERIFY(c)                    \
-     TRACE(c, "PKINIT server verifying KRB5_PADATA_PK_AS_REQ")
--#define TRACE_PKINIT_SERVER_PADATA_VERIFY_OLD(c)                        \
--    TRACE(c, "PKINIT server verifying KRB5_PADATA_PK_AS_REQ_OLD")
- #define TRACE_PKINIT_SERVER_PADATA_VERIFY_FAIL(c)       \
-     TRACE(c, "PKINIT server failed to verify PA data")
- #define TRACE_PKINIT_SERVER_RETURN_PADATA(c)    \
-diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
-index 1dadb1b96..93f0f2632 100755
---- a/src/tests/t_pkinit.py
-+++ b/src/tests/t_pkinit.py
-@@ -432,11 +432,9 @@ realm.kinit(realm.user_princ,
- realm.klist(realm.user_princ)
- realm.run([kvno, realm.host_princ])
- 
--# Supply the wrong PIN, and verify that we ignore the draft9 padata offer
--# in the KDC method data after RFC 4556 PKINIT fails.
-+# Supply the wrong PIN.
- mark('PKCS11 identity, wrong PIN')
--expected_trace = ('PKINIT client has no configured identity; giving up',
--                  'PKINIT client ignoring draft 9 offer from RFC 4556 KDC')
-+expected_trace = ('PKINIT client has no configured identity; giving up',)
- realm.kinit(realm.user_princ,
-             flags=['-X', 'X509_user_identity=%s' % p11_identity],
-             password='wrong', expected_code=1, expected_trace=expected_trace)
diff --git a/Remove-ccapi-related-comments-in-configure.ac.patch b/Remove-ccapi-related-comments-in-configure.ac.patch
deleted file mode 100644
index 8770cb8..0000000
--- a/Remove-ccapi-related-comments-in-configure.ac.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 68fdf968da2ed338340a835a0c942991c7c02986 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Wed, 3 Apr 2019 16:01:22 -0400
-Subject: [PATCH] Remove ccapi-related comments in configure.ac
-
-These suggested ccapi is buildable on non-Windows, and empirically it
-is not.
-
-(cherry picked from commit eb48b176bccf3634b9c82f588dce85125a5c4bd8)
----
- src/configure.in | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/src/configure.in b/src/configure.in
-index 7c309a26b..8d781a7c8 100644
---- a/src/configure.in
-+++ b/src/configure.in
-@@ -1450,7 +1450,6 @@ V5_AC_OUTPUT_MAKEFILE(.
- 	lib/crypto/crypto_tests
- 
- 	lib/krb5 lib/krb5/error_tables lib/krb5/asn.1 lib/krb5/ccache
--dnl	lib/krb5/ccache/ccapi
- 	lib/krb5/keytab lib/krb5/krb lib/krb5/rcache lib/krb5/os
- 	lib/krb5/unicode
- 
-@@ -1463,8 +1462,6 @@ dnl	lib/krb5/ccache/ccapi
- 	lib/krad
- 	lib/apputils
- 
--dnl	ccapi ccapi/lib ccapi/lib/unix ccapi/server ccapi/server/unix ccapi/test
--
- 	kdc kprop config-files build-tools man doc include
- 
- 	plugins/certauth/test
diff --git a/Remove-checksum-type-profile-variables.patch b/Remove-checksum-type-profile-variables.patch
deleted file mode 100644
index a392a60..0000000
--- a/Remove-checksum-type-profile-variables.patch
+++ /dev/null
@@ -1,428 +0,0 @@
-From 46aa5ffd844a280f368d78c7c395bb1b2323dfbe Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Mon, 13 May 2019 14:19:57 -0400
-Subject: [PATCH] Remove checksum type profile variables
-
-Remove support for the krb5.conf relations ap_req_checksum_type,
-kdc_req_checksum_type, and safe_checksum_type.  These values were
-useful for interoperating with very old KDCs, which should no longer
-be deployed.
-
-Additionally, kdc_req_checksum_type was incorrectly documented as only
-applying to single-DES keys; in practice it also worked for RC4.  The
-other two were not clearly documented, but safe_checksum_type did
-allow use of hmac-md5-rc4 for any enctype, and ap_req_checksum_type
-did not impose any limitations.
-
-[ghudson@mit.edu: edited commit message]
-
-ticket: 8804 (new)
-(cherry picked from commit a5a140dc85201faf1ba3a687553058354722a1b4)
----
- doc/admin/conf_files/krb5_conf.rst | 37 ------------
- src/include/k5-int.h               |  6 --
- src/lib/krb5/krb/auth_con.c        |  2 -
- src/lib/krb5/krb/init_ctx.c        | 13 -----
- src/lib/krb5/krb/send_tgs.c        | 19 +------
- src/lib/krb5/krb/ser_ctx.c         | 38 +------------
- src/lib/krb5/krb/t_copy_context.c  |  6 --
- src/man/krb5.conf.man              | 90 ++----------------------------
- 8 files changed, 7 insertions(+), 204 deletions(-)
-
-diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
-index e9f7e8c59..5df3bfe36 100644
---- a/doc/admin/conf_files/krb5_conf.rst
-+++ b/doc/admin/conf_files/krb5_conf.rst
-@@ -111,14 +111,6 @@ The libdefaults section may contain any of the following relations:
-     strong crypto.  Users in affected environments should set this tag
-     to true until their infrastructure adopts stronger ciphers.
- 
--**ap_req_checksum_type**
--    An integer which specifies the type of AP-REQ checksum to use in
--    authenticators.  This variable should be unset so the appropriate
--    checksum for the encryption key in use will be used.  This can be
--    set if backward compatibility requires a specific checksum type.
--    See the **kdc_req_checksum_type** configuration option for the
--    possible values and their meanings.
--
- **canonicalize**
-     If this flag is set to true, initial ticket requests to the KDC
-     will request canonicalization of the client principal name, and
-@@ -297,26 +289,6 @@ The libdefaults section may contain any of the following relations:
-     corrective factor is only used by the Kerberos library; it is not
-     used to change the system clock.  The default value is 1.
- 
--**kdc_req_checksum_type**
--    An integer which specifies the type of checksum to use for the KDC
--    requests, for compatibility with very old KDC implementations.
--    This value is only used for DES keys; other keys use the preferred
--    checksum type for those keys.
--
--    The possible values and their meanings are as follows.
--
--    ======== ===============================
--    1        CRC32
--    2        RSA MD4
--    3        RSA MD4 DES
--    4        DES CBC
--    7        RSA MD5
--    8        RSA MD5 DES
--    9        NIST SHA
--    12       HMAC SHA1 DES3
--    -138     Microsoft MD5 HMAC checksum type
--    ======== ===============================
--
- **noaddresses**
-     If this flag is true, requests for initial tickets will not be
-     made with address restrictions set, allowing the tickets to be
-@@ -365,15 +337,6 @@ The libdefaults section may contain any of the following relations:
-     (:ref:`duration` string.)  Sets the default renewable lifetime
-     for initial ticket requests.  The default value is 0.
- 
--**safe_checksum_type**
--    An integer which specifies the type of checksum to use for the
--    KRB-SAFE requests.  By default it is set to 8 (RSA MD5 DES).  For
--    compatibility with applications linked against DCE version 1.1 or
--    earlier Kerberos libraries, use a value of 3 to use the RSA MD4
--    DES instead.  This field is ignored when its value is incompatible
--    with the session key type.  See the **kdc_req_checksum_type**
--    configuration option for the possible values and their meanings.
--
- **spake_preauth_groups**
-     A whitespace or comma-separated list of words which specifies the
-     groups allowed for SPAKE preauthentication.  The possible values
-diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index 1e6a739e9..1a78fd7a9 100644
---- a/src/include/k5-int.h
-+++ b/src/include/k5-int.h
-@@ -182,7 +182,6 @@ typedef unsigned char   u_char;
- #define KRB5_CONF_ACL_FILE                     "acl_file"
- #define KRB5_CONF_ADMIN_SERVER                 "admin_server"
- #define KRB5_CONF_ALLOW_WEAK_CRYPTO            "allow_weak_crypto"
--#define KRB5_CONF_AP_REQ_CHECKSUM_TYPE         "ap_req_checksum_type"
- #define KRB5_CONF_AUTH_TO_LOCAL                "auth_to_local"
- #define KRB5_CONF_AUTH_TO_LOCAL_NAMES          "auth_to_local_names"
- #define KRB5_CONF_CANONICALIZE                 "canonicalize"
-@@ -241,7 +240,6 @@ typedef unsigned char   u_char;
- #define KRB5_CONF_KDC_LISTEN                   "kdc_listen"
- #define KRB5_CONF_KDC_MAX_DGRAM_REPLY_SIZE     "kdc_max_dgram_reply_size"
- #define KRB5_CONF_KDC_PORTS                    "kdc_ports"
--#define KRB5_CONF_KDC_REQ_CHECKSUM_TYPE        "kdc_req_checksum_type"
- #define KRB5_CONF_KDC_TCP_PORTS                "kdc_tcp_ports"
- #define KRB5_CONF_KDC_TCP_LISTEN               "kdc_tcp_listen"
- #define KRB5_CONF_KDC_TCP_LISTEN_BACKLOG       "kdc_tcp_listen_backlog"
-@@ -289,7 +287,6 @@ typedef unsigned char   u_char;
- #define KRB5_CONF_REJECT_BAD_TRANSIT           "reject_bad_transit"
- #define KRB5_CONF_RENEW_LIFETIME               "renew_lifetime"
- #define KRB5_CONF_RESTRICT_ANONYMOUS_TO_TGT    "restrict_anonymous_to_tgt"
--#define KRB5_CONF_SAFE_CHECKSUM_TYPE           "safe_checksum_type"
- #define KRB5_CONF_SUPPORTED_ENCTYPES           "supported_enctypes"
- #define KRB5_CONF_SPAKE_PREAUTH_INDICATOR      "spake_preauth_indicator"
- #define KRB5_CONF_SPAKE_PREAUTH_KDC_CHALLENGE  "spake_preauth_kdc_challenge"
-@@ -1185,9 +1182,6 @@ struct _krb5_context {
-     void            *ser_ctx;
-     /* allowable clock skew */
-     krb5_deltat     clockskew;
--    krb5_cksumtype  kdc_req_sumtype;
--    krb5_cksumtype  default_ap_req_sumtype;
--    krb5_cksumtype  default_safe_sumtype;
-     krb5_flags      kdc_default_options;
-     krb5_flags      library_options;
-     krb5_boolean    profile_secure;
-diff --git a/src/lib/krb5/krb/auth_con.c b/src/lib/krb5/krb/auth_con.c
-index c86a4af63..1dfce631c 100644
---- a/src/lib/krb5/krb/auth_con.c
-+++ b/src/lib/krb5/krb/auth_con.c
-@@ -40,8 +40,6 @@ krb5_auth_con_init(krb5_context context, krb5_auth_context *auth_context)
-     (*auth_context)->auth_context_flags =
-         KRB5_AUTH_CONTEXT_DO_TIME |  KRB5_AUTH_CONN_INITIALIZED;
- 
--    (*auth_context)->req_cksumtype = context->default_ap_req_sumtype;
--    (*auth_context)->safe_cksumtype = context->default_safe_sumtype;
-     (*auth_context)->checksum_func = NULL;
-     (*auth_context)->checksum_func_data = NULL;
-     (*auth_context)->negotiated_etype = ENCTYPE_NULL;
-diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
-index d263d5cc5..37405728c 100644
---- a/src/lib/krb5/krb/init_ctx.c
-+++ b/src/lib/krb5/krb/init_ctx.c
-@@ -258,19 +258,6 @@ krb5_init_context_profile(profile_t profile, krb5_flags flags,
-     get_integer(ctx, KRB5_CONF_CLOCKSKEW, DEFAULT_CLOCKSKEW, &tmp);
-     ctx->clockskew = tmp;
- 
--    /* DCE 1.1 and below only support CKSUMTYPE_RSA_MD4 (2)  */
--    /* DCE add kdc_req_checksum_type = 2 to krb5.conf */
--    get_integer(ctx, KRB5_CONF_KDC_REQ_CHECKSUM_TYPE, CKSUMTYPE_RSA_MD5,
--                &tmp);
--    ctx->kdc_req_sumtype = tmp;
--
--    get_integer(ctx, KRB5_CONF_AP_REQ_CHECKSUM_TYPE, 0, &tmp);
--    ctx->default_ap_req_sumtype = tmp;
--
--    get_integer(ctx, KRB5_CONF_SAFE_CHECKSUM_TYPE, CKSUMTYPE_RSA_MD5_DES,
--                &tmp);
--    ctx->default_safe_sumtype = tmp;
--
-     get_integer(ctx, KRB5_CONF_KDC_DEFAULT_OPTIONS, KDC_OPT_RENEWABLE_OK,
-                 &tmp);
-     ctx->kdc_default_options = tmp;
-diff --git a/src/lib/krb5/krb/send_tgs.c b/src/lib/krb5/krb/send_tgs.c
-index e43a5cc5b..3dda2fdaa 100644
---- a/src/lib/krb5/krb/send_tgs.c
-+++ b/src/lib/krb5/krb/send_tgs.c
-@@ -53,7 +53,6 @@ tgs_construct_ap_req(krb5_context context, krb5_data *checksum_data,
-                      krb5_creds *tgt, krb5_keyblock *subkey,
-                      krb5_data **ap_req_asn1_out)
- {
--    krb5_cksumtype cksumtype;
-     krb5_error_code ret;
-     krb5_checksum checksum;
-     krb5_authenticator authent;
-@@ -67,24 +66,8 @@ tgs_construct_ap_req(krb5_context context, krb5_data *checksum_data,
-     memset(&ap_req, 0, sizeof(ap_req));
-     memset(&authent_enc, 0, sizeof(authent_enc));
- 
--    /* Determine the authenticator checksum type. */
--    switch (tgt->keyblock.enctype) {
--    case ENCTYPE_DES_CBC_CRC:
--    case ENCTYPE_DES_CBC_MD4:
--    case ENCTYPE_DES_CBC_MD5:
--    case ENCTYPE_ARCFOUR_HMAC:
--    case ENCTYPE_ARCFOUR_HMAC_EXP:
--        cksumtype = context->kdc_req_sumtype;
--        break;
--    default:
--        ret = krb5int_c_mandatory_cksumtype(context, tgt->keyblock.enctype,
--                                            &cksumtype);
--        if (ret)
--            goto cleanup;
--    }
--
-     /* Generate checksum. */
--    ret = krb5_c_make_checksum(context, cksumtype, &tgt->keyblock,
-+    ret = krb5_c_make_checksum(context, 0, &tgt->keyblock,
-                                KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM, checksum_data,
-                                &checksum);
-     if (ret)
-diff --git a/src/lib/krb5/krb/ser_ctx.c b/src/lib/krb5/krb/ser_ctx.c
-index a9f50b239..39f656322 100644
---- a/src/lib/krb5/krb/ser_ctx.c
-+++ b/src/lib/krb5/krb/ser_ctx.c
-@@ -124,9 +124,6 @@ krb5_context_size(krb5_context kcontext, krb5_pointer arg, size_t *sizep)
-      *  krb5_int32                      for n_tgs_etypes*sizeof(krb5_int32)
-      *  nktypes*sizeof(krb5_int32)      for tgs_etypes.
-      *  krb5_int32                      for clockskew
--     *  krb5_int32                      for kdc_req_sumtype
--     *  krb5_int32                      for ap_req_sumtype
--     *  krb5_int32                      for safe_sumtype
-      *  krb5_int32                      for kdc_default_options
-      *  krb5_int32                      for library_options
-      *  krb5_int32                      for profile_secure
-@@ -139,7 +136,7 @@ krb5_context_size(krb5_context kcontext, krb5_pointer arg, size_t *sizep)
-     kret = EINVAL;
-     if ((context = (krb5_context) arg)) {
-         /* Calculate base length */
--        required = (14 * sizeof(krb5_int32) +
-+        required = (11 * sizeof(krb5_int32) +
-                     (etypes_len(context->in_tkt_etypes) * sizeof(krb5_int32)) +
-                     (etypes_len(context->tgs_etypes) * sizeof(krb5_int32)));
- 
-@@ -255,24 +252,6 @@ krb5_context_externalize(krb5_context kcontext, krb5_pointer arg, krb5_octet **b
-     if (kret)
-         return (kret);
- 
--    /* Now kdc_req_sumtype */
--    kret = krb5_ser_pack_int32((krb5_int32) context->kdc_req_sumtype,
--                               &bp, &remain);
--    if (kret)
--        return (kret);
--
--    /* Now default ap_req_sumtype */
--    kret = krb5_ser_pack_int32((krb5_int32) context->default_ap_req_sumtype,
--                               &bp, &remain);
--    if (kret)
--        return (kret);
--
--    /* Now default safe_sumtype */
--    kret = krb5_ser_pack_int32((krb5_int32) context->default_safe_sumtype,
--                               &bp, &remain);
--    if (kret)
--        return (kret);
--
-     /* Now kdc_default_options */
-     kret = krb5_ser_pack_int32((krb5_int32) context->kdc_default_options,
-                                &bp, &remain);
-@@ -426,21 +405,6 @@ krb5_context_internalize(krb5_context kcontext, krb5_pointer *argp, krb5_octet *
-         goto cleanup;
-     context->clockskew = (krb5_deltat) ibuf;
- 
--    /* kdc_req_sumtype */
--    if ((kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain)))
--        goto cleanup;
--    context->kdc_req_sumtype = (krb5_cksumtype) ibuf;
--
--    /* default ap_req_sumtype */
--    if ((kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain)))
--        goto cleanup;
--    context->default_ap_req_sumtype = (krb5_cksumtype) ibuf;
--
--    /* default_safe_sumtype */
--    if ((kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain)))
--        goto cleanup;
--    context->default_safe_sumtype = (krb5_cksumtype) ibuf;
--
-     /* kdc_default_options */
-     if ((kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain)))
-         goto cleanup;
-diff --git a/src/lib/krb5/krb/t_copy_context.c b/src/lib/krb5/krb/t_copy_context.c
-index a6e48cd25..22be2198b 100644
---- a/src/lib/krb5/krb/t_copy_context.c
-+++ b/src/lib/krb5/krb/t_copy_context.c
-@@ -77,9 +77,6 @@ check_context(krb5_context c, krb5_context r)
-     check(c->os_context.os_flags == r->os_context.os_flags);
-     compare_string(c->os_context.default_ccname, r->os_context.default_ccname);
-     check(c->clockskew == r->clockskew);
--    check(c->kdc_req_sumtype == r->kdc_req_sumtype);
--    check(c->default_ap_req_sumtype == r->default_ap_req_sumtype);
--    check(c->default_safe_sumtype == r->default_safe_sumtype);
-     check(c->kdc_default_options == r->kdc_default_options);
-     check(c->library_options == r->library_options);
-     check(c->profile_secure == r->profile_secure);
-@@ -136,9 +133,6 @@ main(int argc, char **argv)
-     check(krb5_cc_set_default_name(ctx, "defccname") == 0);
-     check(krb5_set_default_realm(ctx, "defrealm") == 0);
-     ctx->clockskew = 18;
--    ctx->kdc_req_sumtype = CKSUMTYPE_NIST_SHA;
--    ctx->default_ap_req_sumtype = CKSUMTYPE_HMAC_SHA1_96_AES128;
--    ctx->default_safe_sumtype = CKSUMTYPE_HMAC_SHA1_96_AES256;
-     ctx->kdc_default_options = KDC_OPT_FORWARDABLE;
-     ctx->library_options = 0;
-     ctx->profile_secure = TRUE;
-diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
-index d431dce75..aafdf7f83 100644
---- a/src/man/krb5.conf.man
-+++ b/src/man/krb5.conf.man
-@@ -1,6 +1,6 @@
- .\" Man page generated from reStructuredText.
- .
--.TH "KRB5.CONF" "5" " " "1.17" "MIT Kerberos"
-+.TH "KRB5.CONF" "5" " " "1.18" "MIT Kerberos"
- .SH NAME
- krb5.conf \- Kerberos configuration file
- .
-@@ -202,14 +202,6 @@ failures in existing Kerberos infrastructures that do not support
- strong crypto.  Users in affected environments should set this tag
- to true until their infrastructure adopts stronger ciphers.
- .TP
--\fBap_req_checksum_type\fP
--An integer which specifies the type of AP\-REQ checksum to use in
--authenticators.  This variable should be unset so the appropriate
--checksum for the encryption key in use will be used.  This can be
--set if backward compatibility requires a specific checksum type.
--See the \fBkdc_req_checksum_type\fP configuration option for the
--possible values and their meanings.
--.TP
- \fBcanonicalize\fP
- If this flag is set to true, initial ticket requests to the KDC
- will request canonicalization of the client principal name, and
-@@ -291,6 +283,10 @@ hostnames for use in service principal names.  Setting this flag
- to false can improve security by reducing reliance on DNS, but
- means that short hostnames will not be canonicalized to
- fully\-qualified hostnames.  The default value is true.
-+.sp
-+If this option is set to \fBfallback\fP (new in release 1.18), DNS
-+canonicalization will only be performed the server hostname is not
-+found with the original name when requesting credentials.
- .TP
- \fBdns_lookup_kdc\fP
- Indicate whether DNS SRV records should be used to locate the KDCs
-@@ -384,73 +380,6 @@ requesting service tickets or authenticating to services.  This
- corrective factor is only used by the Kerberos library; it is not
- used to change the system clock.  The default value is 1.
- .TP
--\fBkdc_req_checksum_type\fP
--An integer which specifies the type of checksum to use for the KDC
--requests, for compatibility with very old KDC implementations.
--This value is only used for DES keys; other keys use the preferred
--checksum type for those keys.
--.sp
--The possible values and their meanings are as follows.
--.TS
--center;
--|l|l|.
--_
--T{
--1
--T}	T{
--CRC32
--T}
--_
--T{
--2
--T}	T{
--RSA MD4
--T}
--_
--T{
--3
--T}	T{
--RSA MD4 DES
--T}
--_
--T{
--4
--T}	T{
--DES CBC
--T}
--_
--T{
--7
--T}	T{
--RSA MD5
--T}
--_
--T{
--8
--T}	T{
--RSA MD5 DES
--T}
--_
--T{
--9
--T}	T{
--NIST SHA
--T}
--_
--T{
--12
--T}	T{
--HMAC SHA1 DES3
--T}
--_
--T{
--\-138
--T}	T{
--Microsoft MD5 HMAC checksum type
--T}
--_
--.TE
--.TP
- \fBnoaddresses\fP
- If this flag is true, requests for initial tickets will not be
- made with address restrictions set, allowing the tickets to be
-@@ -499,15 +428,6 @@ set.  The default is not to search domain components.
- (duration string.)  Sets the default renewable lifetime
- for initial ticket requests.  The default value is 0.
- .TP
--\fBsafe_checksum_type\fP
--An integer which specifies the type of checksum to use for the
--KRB\-SAFE requests.  By default it is set to 8 (RSA MD5 DES).  For
--compatibility with applications linked against DCE version 1.1 or
--earlier Kerberos libraries, use a value of 3 to use the RSA MD4
--DES instead.  This field is ignored when its value is incompatible
--with the session key type.  See the \fBkdc_req_checksum_type\fP
--configuration option for the possible values and their meanings.
--.TP
- \fBspake_preauth_groups\fP
- A whitespace or comma\-separated list of words which specifies the
- groups allowed for SPAKE preauthentication.  The possible values
diff --git a/Remove-confvalidator-utility.patch b/Remove-confvalidator-utility.patch
deleted file mode 100644
index e361ef6..0000000
--- a/Remove-confvalidator-utility.patch
+++ /dev/null
@@ -1,430 +0,0 @@
-From f7b50b3e40ae43666fb10b0a1502f9cd88b6a2fe Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Wed, 3 Apr 2019 14:58:19 -0400
-Subject: [PATCH] Remove confvalidator utility
-
-This utility has not been maintained with encryption types and salt
-changes, which suggests it is unused.
-
-(cherry picked from commit 482a366793d9338e9edb504b407d7704a4bb2f8f)
----
- src/util/confvalidator/README         |  25 ----
- src/util/confvalidator/confparser.py  | 144 -------------------
- src/util/confvalidator/rules.yml      |  13 --
- src/util/confvalidator/validator.conf |   2 -
- src/util/confvalidator/validator.py   | 194 --------------------------
- 5 files changed, 378 deletions(-)
- delete mode 100644 src/util/confvalidator/README
- delete mode 100644 src/util/confvalidator/confparser.py
- delete mode 100644 src/util/confvalidator/rules.yml
- delete mode 100644 src/util/confvalidator/validator.conf
- delete mode 100644 src/util/confvalidator/validator.py
-
-diff --git a/src/util/confvalidator/README b/src/util/confvalidator/README
-deleted file mode 100644
-index 7bf7a106a..000000000
---- a/src/util/confvalidator/README
-+++ /dev/null
-@@ -1,25 +0,0 @@
--validator.py is a command line tool for identifying invalid attributes, values and some formating problems in Kerberos configuration files.
--The list of the valid attributes is created based on the “configuration variables” section in k5-int.h and user defined attributes from the rules file.
--
--Usage:
--
--validator.py path [-d defPath] [-r rulesPath] [-c validatorConfPath]
--
--Options:
--
--path – the path to the configuration file to validate
--
---d defPath – path to the k5-int.h file. Starting from the 1.7 release this header holds the profile attribute names in the form #define KRB5_CONF_xxx ”ZZZ”.
--
---r rulesPath - path the rules file in yaml format. It may be used to manage the list of the valid attributes and to define the additional validation rules.
--
---c validatorConfPath – the same as -r and -d options, but in validator configuration file format.
--
--Example:
--
--python validator.py src/config-files/krb5.conf -r rules.yml -d src/include/k5-int.h
--or
--python validator.py src/config-files/krb5.conf -c validator.conf
--
--For more details please refer to the sample files validator.conf and rules.yml
--
-diff --git a/src/util/confvalidator/confparser.py b/src/util/confvalidator/confparser.py
-deleted file mode 100644
-index 2fea142a5..000000000
---- a/src/util/confvalidator/confparser.py
-+++ /dev/null
-@@ -1,144 +0,0 @@
--'''
--Created on Jan 31, 2010
--
--@author: tsitkova
--'''
--import re
--import copy
--import yaml
--
--class ConfParser(object):
--    def __init__(self, path):
--        self.configuration = self._parse(path)
--    
--    def walk(self):
--        for trio in self._walk(self.configuration):
--            yield trio
--    
--    def _parse(self, path):
--        comment_pattern = re.compile(r'(\s*[#].*)')
--        section_pattern = re.compile(r'^\s*\[(?P<section>\w+)\]\s+$')
--        empty_pattern = re.compile(r'^\s*$')
--        equalsign_pattern = re.compile(r'=')
--        
--        section = None
--        parser_stack = list()
--        result = dict()
--        value = None
--        f = open(path, 'r')
--        for (ln,line) in enumerate(f):
--            line = comment_pattern.sub('', line)
--            line = equalsign_pattern.sub(' = ',line,count=1)
--            if empty_pattern.match(line) is not None:
--                continue
--            m = section_pattern.match(line)
--            if m is not None:
--                section = m.group('section')
--                value = dict()
--                result[section] = value
--                continue
--            if section is None:
--                msg = 'Failed to determine section for line #%i' % ln
--                raise ValueError(msg)
--            try:
--                value = self._parseLine(value, line, parser_stack)
--            except:
--                print 'Error while parsing line %i: %s' % (ln+1, line)
--                raise
--        f.close()
--
--        if len(parser_stack):
--            raise 'Parsing error.'
--        
--        return result
--
--    def _parseLine(self, value, content, stack):
--        token_pattern = re.compile(r'(?P<token>\S+)(?=\s+)')
--        attr = None
--        token_stack = list()
--        
--        for m in token_pattern.finditer(content):
--            token = m.group('token')
--            if not self._validate(token):
--                raise ValueError('Invalid token %s' % token)
--            if token == '=':
--                if len(token_stack) == 0:
--                    raise ValueError('Failed to find attribute.')
--                elif len(token_stack) == 1:
--                    attr = token_stack.pop()
--                else:
--                    value[attr] = token_stack[:-1]
--                    attr = token_stack[-1]
--                    token_stack = list()
--            elif token == '{':
--                if attr is None:
--                    raise ValueError('Failed to find attribute.')
--                stack.append((attr,value))
--                value = dict()
--            elif token == '}':
--                if len(stack) == 0:
--                    raise ValueError('Failed to parse: unbalanced braces')
--                if len(token_stack):
--                    if attr is None:
--                        raise ValueError('Missing attribute')
--                    value[attr] = token_stack
--                    attr = None
--                    token_stack = list()
--                (attr,parent_value) = stack.pop()                                
--                parent_value[attr] = value
--                value = parent_value
--            else:
--                token_stack.append(token)
--        if len(token_stack):
--            if attr is None:
--                raise ValueError('Missing attribute')
--            value[attr] =  token_stack
--                
--        return value
--
--    def _validate(self, token):
--        result = True
--        for s in ['{','}']:
--            if s in token and s != token:
--                result = False
--        
--        return result
--
--    def _walk(self, parsedData, path='root'):
--        dirs = list()
--        av = list()
--        for (key, value) in parsedData.iteritems():
--            if type(value) == dict:
--                new_path = path + '.' + key
--                for trio in self._walk(value, new_path):
--                    yield trio
--                dirs.append(key)
--            else:
--                av.append((key,value))
--        yield (path, dirs, av)
--
--
--
--class ConfParserTest(ConfParser):
--    def __init__(self):
--        self.conf_path = '../tests/krb5.conf'
--        super(ConfParserTest, self).__init__(self.conf_path)
--
--    def run_tests(self):
--        self._test_walk()
--            
--    def _test_parse(self):
--        result = self._parse(self.conf_path)
--        print yaml.dump(result)
--        
--    def _test_walk(self):
--        configuration = self._parse(self.conf_path)
--        for (path,dirs,av) in self.walk():
--            print path,dirs,av
--
--
--
--        
--if __name__ == '__main__':
--    tester = ConfParserTest()
--    tester.run_tests()
-diff --git a/src/util/confvalidator/rules.yml b/src/util/confvalidator/rules.yml
-deleted file mode 100644
-index c6ccc89fe..000000000
---- a/src/util/confvalidator/rules.yml
-+++ /dev/null
-@@ -1,13 +0,0 @@
--# Extend the list of the allowed enctypes and salts as needed
--Types:
--    supported_enctypes:
--        '(aes256-cts-hmac-sha1-96|aes256-cts|aes128-cts-hmac-sha1-96|aes128-cts|des3-hmac-sha1|des3-cbc-raw|des3-cbc-sha1|des3-hmac-sha1|rc4-hmac|arcfour-hmac-md5)(:(normal|v4))?$'
--    default_tgs_enctypes:
--        '(aes256-cts-hmac-sha1-96|aes256-cts|aes128-cts-hmac-sha1-96|aes128-cts|des3-hmac-sha1|des3-cbc-raw|des3-cbc-sha1|des3-hmac-sha1|rc4-hmac|arcfour-hmac-md5)'
--    default_tkt_enctypes:
--        '(aes256-cts-hmac-sha1-96|aes256-cts|aes128-cts-hmac-sha1-96|aes128-cts|des3-hmac-sha1|des3-cbc-raw|des3-cbc-sha1|des3-hmac-sha1|rc4-hmac|arcfour-hmac-md5)'
--
--# Add all valid profile attributes that are not listed in k5-int.h 
--Attributes:
--    - logging
--    - dbmodules
-diff --git a/src/util/confvalidator/validator.conf b/src/util/confvalidator/validator.conf
-deleted file mode 100644
-index 71e205c3b..000000000
---- a/src/util/confvalidator/validator.conf
-+++ /dev/null
-@@ -1,2 +0,0 @@
--RulesPath=./rules.yml
--HfilePath=../../include/k5-int.h
-diff --git a/src/util/confvalidator/validator.py b/src/util/confvalidator/validator.py
-deleted file mode 100644
-index d739bc091..000000000
---- a/src/util/confvalidator/validator.py
-+++ /dev/null
-@@ -1,194 +0,0 @@
--'''
--Created on Jan 25, 2010
--
--@author: tsitkova
--'''
--import os
--import sys
--import re
--import yaml
--from optparse import OptionParser
--from confparser import ConfParser
--
--class Rule(object):
--    def __init__(self):
--        pass
--    
--    def validate(self,node):
--        (path,dirs,avs) = node        
--
--
--class Validator(object):
--    def __init__(self, kerberosPath, confPath=None, rulesPath=None, hfilePath=None):
--        self.parser = ConfParser(kerberosPath)
--        if confPath is not None:
--            content = self._readConfigFile(confPath)
--            rulesPath = content['RulesPath']
--            hfilePath = content['HfilePath']
--        if rulesPath is not None and hfilePath is not None:    
--            self.rules = self._loadRules(rulesPath)
--            self.validKeys = SupportedKeys(hfilePath).validKeys.union(self.rules['Attributes'])
--        else:
--            raise ValueError('Invalid arguments for validator: no path to rules and definition files')
--        
--        self._attribute_pattern = re.compile(r'^\w+$')
--        self._lowercase_pattern = re.compile(r'[a-z]')
--
--    def _readConfigFile(self,path):
--        f = open(path)
--        result = dict()
--        for line in f:
--            line = line.rstrip()
--            fields = line.split('=')
--            result[fields[0]] = fields[1]
--        
--        return result
--    
--    def _loadRules(self, path):
--        f = open(path)
--        rules = yaml.load(f)
--        f.close()
--        
--        return rules
--        
--    def validate(self):
--        typeInfo = self.rules['Types']
--        
--        for node in self.parser.walk():
--            self._validateTypes(node, typeInfo)
--            self._validateAttrubutes(node, self.validKeys)
--            # self._validateRealm(node)
--
--
--    def _validateTypes(self, node, typeInfo):
--        (path, dirs, avs) = node
--        for (key, value) in avs:
--            valid_type_pattern = typeInfo.get(key)
--            if valid_type_pattern is not None:
--                for t in value:
--                    if re.match(valid_type_pattern, t) is None:
--                        print 'Wrong type %s for attribute %s.%s' % (t,path,key)
--                        
--    def _validateAttrubutes(self, node, validKeys):
--        (path, dirs, avs) = node 
--        attributes = list()
--        for attr in dirs:
--            if self._attribute_pattern.match(attr) is not None:
--                attributes.append(attr)
--        for (attr, value) in avs:
--            if self._attribute_pattern.match(attr) is not None:
--                attributes.append(attr)
--
--        for attr in attributes:
--            if attr not in validKeys:
--                print 'Unrecognized attribute %s at %s' % (attr, path)
--
--#    def _validateRealm(self, node):
--#        (path, dirs, avs) = node 
--#        if path == 'root.realms':
--#            for attr in dirs:
--#                if self._lowercase_pattern.search(attr) is not None:
--#                    print 'Lower case letter in realm attribute: %s at %s' % (attr, path)
--
--class SupportedKeys(object):
--    def __init__(self, path):
--        self.validKeys = self.getKeysFromHfile(path)
--    
--    def getKeysFromHfile(self, path):
--        pattern = re.compile(r'^[#]define KRB5_CONF_\w+\s+["](\w+)["]')
--        f = open(path)
--        result = set()
--        for l in f:
--            l = l.rstrip()
--            m = pattern.match(l)
--            if m is not None:
--                result.add(m.groups()[0])
--        f.close()
--        
--        return result
--
--    
--class ValidatorTest(Validator):
--    def __init__(self):
--        self.kerberosPath = '../tests/kdc1.conf'
--        self.rulesPath = '../tests/rules.yml'
--        self.hfilePath = '../tests/k5-int.h'
--        self.confPath = '../tests/validator.conf'
--
--        super(ValidatorTest, self).__init__(self.kerberosPath, 
--                                            rulesPath=self.rulesPath, 
--                                            hfilePath=self.hfilePath)
--
--    def run_tests(self):
--        self._test_validate()
--    
--    def _test__loadRules(self):
--        result = self._loadRules(self.rulesPath)
--        print result
--        
--    def _test_validate(self):
--        self.validate()
--        
--    def _test__readConfigFile(self):
--        result = self._readConfigFile(self.confPath)
--        print result
--
--class SupportedKeysTest(SupportedKeys):
--    def __init__(self):
--        self.path = '../tests/k5-int.h'
--        
--    def run_tests(self):
--        self._test_getKeysFromHFile()
--    
--    def _test_getKeysFromHFile(self):
--        result = set()
--        krb5keys = self.getKeysFromHfile(self.path)
--        for key in krb5keys:
--            print key
--            result.update(key)
--        print len(krb5keys)  
--        
--        return result
--    
--def _test():        
--    tester = ValidatorTest()
--    krb5keys = tester.run_tests()
--                    
--if __name__ == '__main__':
--    TEST = False
--    if TEST:
--        _test()
--        sys.exit()
--    
--    
--    usage = "\n\t%prog path [-d defPath] [-r rulesPath] [-c validatorConfPath]"
--    description = 'Description: validates kerberos configuration file'
--    parser = OptionParser(usage = usage, description = description)
--    parser.add_option("-c", dest="confPath",
--                      help='path to validator config file')
--    parser.add_option("-d", dest="hfilePath",
--                      help='path to h-file with attribute definition')
--    parser.add_option("-r", dest="rulesPath",
--                      help='path to file with validation rules')
--    (options, args) = parser.parse_args()
--
--    if len(args) != 1 and len(sys.argv) <= 3:
--        print '\n%s' % parser.get_usage()
--        sys.exit()
--
--    validator = None
--    if options.confPath is not None:
--        validator = Validator(args[0], confPath=options.confPath)
--    elif options.hfilePath is not None and options.rulesPath is not None:
--        validator = Validator(args[0], hfilePath=options.hfilePath, rulesPath=options.rulesPath)
--    else:
--        print '\nMust specify either configuration file or paths to rules and definitions files'
--        print '%s' % parser.get_usage()
--        sys.exit()
--    
--    validator.validate()
--        
--
--
--        
--        
diff --git a/Remove-dead-variable-def_kslist-from-two-files.patch b/Remove-dead-variable-def_kslist-from-two-files.patch
deleted file mode 100644
index fa8e263..0000000
--- a/Remove-dead-variable-def_kslist-from-two-files.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From cc4aace493d1caaca9edebcc5d836e847e358afd Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 2 May 2019 16:57:51 -0400
-Subject: [PATCH] Remove dead variable def_kslist from two files
-
-def_kslist was part of kdb5_create.c since its addition (commit
-edf8b4d8a6a665c2aa150993cd813ea6c5cf12e1) and has always been
-irrelevant since the rblock structure is fully initialized in
-kdb5_create().
-
-def_klist was copied into kdb5_ldap_realm.c (present in addition at
-commit 42d9d6ab320ee3a661fe21472be542acd542d5be).  The global rblock
-structure (and therefore the initializer) was removed in commit
-9c850f8b62784170a5e42315c1a9552ddcf4ca2b, leaving def_kslist
-unreferenced.
-
-Remove def_kslist from both files, and remove the rblock initializer
-from kdb5_create.c.
-
-[ghudson@mit.edu: edited commit message]
-
-(cherry picked from commit 6309f5e3508cd24151222b2cd095766283e205f2)
----
- src/kadmin/dbutil/kdb5_create.c                  | 12 +-----------
- src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c |  1 -
- 2 files changed, 1 insertion(+), 12 deletions(-)
-
-diff --git a/src/kadmin/dbutil/kdb5_create.c b/src/kadmin/dbutil/kdb5_create.c
-index bc1b9195d..efdb8adb0 100644
---- a/src/kadmin/dbutil/kdb5_create.c
-+++ b/src/kadmin/dbutil/kdb5_create.c
-@@ -66,8 +66,6 @@ enum ap_op {
-     TGT_KEY                             /* special handling for tgt key */
- };
- 
--krb5_key_salt_tuple def_kslist = { ENCTYPE_DES_CBC_CRC, KRB5_KDB_SALTTYPE_NORMAL };
--
- struct realm_info {
-     krb5_deltat max_life;
-     krb5_deltat max_rlife;
-@@ -76,15 +74,7 @@ struct realm_info {
-     krb5_keyblock *key;
-     krb5_int32 nkslist;
-     krb5_key_salt_tuple *kslist;
--} rblock = { /* XXX */
--    KRB5_KDB_MAX_LIFE,
--    KRB5_KDB_MAX_RLIFE,
--    KRB5_KDB_EXPIRATION,
--    KRB5_KDB_DEF_FLAGS,
--    (krb5_keyblock *) NULL,
--    1,
--    &def_kslist
--};
-+} rblock;
- 
- struct iterate_args {
-     krb5_context        ctx;
-diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
-index 5a745e21d..c21d19981 100644
---- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
-+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
-@@ -91,7 +91,6 @@
- extern time_t get_date(char *); /* kadmin/cli/getdate.o */
- 
- char *yes = "yes\n"; /* \n to compare against result of fgets */
--krb5_key_salt_tuple def_kslist = {ENCTYPE_DES_CBC_CRC, KRB5_KDB_SALTTYPE_NORMAL};
- 
- krb5_data tgt_princ_entries[] = {
-     {0, KRB5_TGS_NAME_SIZE, KRB5_TGS_NAME},
diff --git a/Remove-doxygen-generated-HTML-output-for-ccapi.patch b/Remove-doxygen-generated-HTML-output-for-ccapi.patch
deleted file mode 100644
index 0cb10b6..0000000
--- a/Remove-doxygen-generated-HTML-output-for-ccapi.patch
+++ /dev/null
@@ -1,7653 +0,0 @@
-From 8629596d91d41914a6996b897845f601af7b59fc Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 4 Apr 2019 14:15:58 -0400
-Subject: [PATCH] Remove doxygen-generated HTML output for ccapi
-
-(cherry picked from commit d4f90b750d6d81cc001f6b00266c82c1c916bbf4)
----
- doc/ccapi/Doxyfile                            |  281 ----
- doc/ccapi/ccache-api-v2.html                  | 1217 ---------------
- doc/ccapi/html/doxygen.css                    |  310 ----
- doc/ccapi/html/doxygen.png                    |  Bin 1281 -> 0 bytes
- ...roup__cc__ccache__iterator__reference.html |   96 --
- .../html/group__cc__ccache__reference.html    |   96 --
- .../html/group__cc__context__reference.html   |  161 --
- ..._cc__credentials__iterator__reference.html |  133 --
- .../group__cc__credentials__reference.html    |  197 ---
- .../html/group__cc__string__reference.html    |   96 --
- .../group__ccapi__constants__reference.html   |  407 -----
- .../html/group__ccapi__types__reference.html  |  138 --
- doc/ccapi/html/group__helper__macros.html     | 1377 -----------------
- doc/ccapi/html/index.html                     |   85 -
- doc/ccapi/html/structcc__ccache__d.html       |   43 -
- doc/ccapi/html/structcc__ccache__f.html       |  722 ---------
- .../html/structcc__ccache__iterator__d.html   |   43 -
- .../html/structcc__ccache__iterator__f.html   |  117 --
- doc/ccapi/html/structcc__context__d.html      |   43 -
- doc/ccapi/html/structcc__context__f.html      |  513 ------
- doc/ccapi/html/structcc__credentials__d.html  |   67 -
- doc/ccapi/html/structcc__credentials__f.html  |   85 -
- .../structcc__credentials__iterator__d.html   |   43 -
- .../structcc__credentials__iterator__f.html   |   85 -
- .../html/structcc__credentials__union.html    |  118 --
- .../html/structcc__credentials__v4__t.html    |  358 -----
- .../html/structcc__credentials__v5__t.html    |  334 ----
- doc/ccapi/html/structcc__data.html            |   94 --
- doc/ccapi/html/structcc__string__d.html       |   67 -
- doc/ccapi/html/structcc__string__f.html       |   51 -
- 30 files changed, 7377 deletions(-)
- delete mode 100644 doc/ccapi/Doxyfile
- delete mode 100755 doc/ccapi/ccache-api-v2.html
- delete mode 100644 doc/ccapi/html/doxygen.css
- delete mode 100644 doc/ccapi/html/doxygen.png
- delete mode 100644 doc/ccapi/html/group__cc__ccache__iterator__reference.html
- delete mode 100644 doc/ccapi/html/group__cc__ccache__reference.html
- delete mode 100644 doc/ccapi/html/group__cc__context__reference.html
- delete mode 100644 doc/ccapi/html/group__cc__credentials__iterator__reference.html
- delete mode 100644 doc/ccapi/html/group__cc__credentials__reference.html
- delete mode 100644 doc/ccapi/html/group__cc__string__reference.html
- delete mode 100644 doc/ccapi/html/group__ccapi__constants__reference.html
- delete mode 100644 doc/ccapi/html/group__ccapi__types__reference.html
- delete mode 100644 doc/ccapi/html/group__helper__macros.html
- delete mode 100644 doc/ccapi/html/index.html
- delete mode 100644 doc/ccapi/html/structcc__ccache__d.html
- delete mode 100644 doc/ccapi/html/structcc__ccache__f.html
- delete mode 100644 doc/ccapi/html/structcc__ccache__iterator__d.html
- delete mode 100644 doc/ccapi/html/structcc__ccache__iterator__f.html
- delete mode 100644 doc/ccapi/html/structcc__context__d.html
- delete mode 100644 doc/ccapi/html/structcc__context__f.html
- delete mode 100644 doc/ccapi/html/structcc__credentials__d.html
- delete mode 100644 doc/ccapi/html/structcc__credentials__f.html
- delete mode 100644 doc/ccapi/html/structcc__credentials__iterator__d.html
- delete mode 100644 doc/ccapi/html/structcc__credentials__iterator__f.html
- delete mode 100644 doc/ccapi/html/structcc__credentials__union.html
- delete mode 100644 doc/ccapi/html/structcc__credentials__v4__t.html
- delete mode 100644 doc/ccapi/html/structcc__credentials__v5__t.html
- delete mode 100644 doc/ccapi/html/structcc__data.html
- delete mode 100644 doc/ccapi/html/structcc__string__d.html
- delete mode 100644 doc/ccapi/html/structcc__string__f.html
-
-diff --git a/doc/ccapi/Doxyfile b/doc/ccapi/Doxyfile
-deleted file mode 100644
-index 734c29c90..000000000
---- a/doc/ccapi/Doxyfile
-+++ /dev/null
-@@ -1,281 +0,0 @@
--# Doxyfile 1.5.3
--
--#---------------------------------------------------------------------------
--# Project related configuration options
--#---------------------------------------------------------------------------
--DOXYFILE_ENCODING      = UTF-8
--PROJECT_NAME           = "Credentials Cache API   "
--PROJECT_NUMBER         = 
--OUTPUT_DIRECTORY       = .
--CREATE_SUBDIRS         = NO
--OUTPUT_LANGUAGE        = English
--BRIEF_MEMBER_DESC      = YES
--REPEAT_BRIEF           = YES
--ABBREVIATE_BRIEF       = "The $name class   " \
--                         "The $name widget   " \
--                         "The $name file   " \
--                         is \
--                         provides \
--                         specifies \
--                         contains \
--                         represents \
--                         a \
--                         an \
--                         the
--ALWAYS_DETAILED_SEC    = YES
--INLINE_INHERITED_MEMB  = NO
--FULL_PATH_NAMES        = NO
--STRIP_FROM_PATH        = 
--STRIP_FROM_INC_PATH    = 
--SHORT_NAMES            = NO
--JAVADOC_AUTOBRIEF      = NO
--QT_AUTOBRIEF           = NO
--MULTILINE_CPP_IS_BRIEF = NO
--DETAILS_AT_TOP         = YES
--INHERIT_DOCS           = YES
--SEPARATE_MEMBER_PAGES  = NO
--TAB_SIZE               = 8
--ALIASES                = 
--OPTIMIZE_OUTPUT_FOR_C  = YES
--OPTIMIZE_OUTPUT_JAVA   = NO
--BUILTIN_STL_SUPPORT    = NO
--CPP_CLI_SUPPORT        = NO
--DISTRIBUTE_GROUP_DOC   = NO
--SUBGROUPING            = YES
--#---------------------------------------------------------------------------
--# Build related configuration options
--#---------------------------------------------------------------------------
--EXTRACT_ALL            = YES
--EXTRACT_PRIVATE        = NO
--EXTRACT_STATIC         = NO
--EXTRACT_LOCAL_CLASSES  = NO
--EXTRACT_LOCAL_METHODS  = NO
--EXTRACT_ANON_NSPACES   = NO
--HIDE_UNDOC_MEMBERS     = NO
--HIDE_UNDOC_CLASSES     = NO
--HIDE_FRIEND_COMPOUNDS  = NO
--HIDE_IN_BODY_DOCS      = YES
--INTERNAL_DOCS          = NO
--CASE_SENSE_NAMES       = YES
--HIDE_SCOPE_NAMES       = YES
--SHOW_INCLUDE_FILES     = NO
--INLINE_INFO            = YES
--SORT_MEMBER_DOCS       = NO
--SORT_BRIEF_DOCS        = NO
--SORT_BY_SCOPE_NAME     = NO
--GENERATE_TODOLIST      = YES
--GENERATE_TESTLIST      = YES
--GENERATE_BUGLIST       = YES
--GENERATE_DEPRECATEDLIST= YES
--ENABLED_SECTIONS       = 
--MAX_INITIALIZER_LINES  = 30
--SHOW_USED_FILES        = NO
--SHOW_DIRECTORIES       = NO
--FILE_VERSION_FILTER    = 
--#---------------------------------------------------------------------------
--# configuration options related to warning and progress messages
--#---------------------------------------------------------------------------
--QUIET                  = NO
--WARNINGS               = YES
--WARN_IF_UNDOCUMENTED   = YES
--WARN_IF_DOC_ERROR      = YES
--WARN_NO_PARAMDOC       = YES
--WARN_FORMAT            = "$file:$line: $text   "
--WARN_LOGFILE           = 
--#---------------------------------------------------------------------------
--# configuration options related to the input files
--#---------------------------------------------------------------------------
--INPUT                  = ../../Sources/include/CredentialsCache.h
--INPUT_ENCODING         = UTF-8
--FILE_PATTERNS          = *.c \
--                         *.cc \
--                         *.cxx \
--                         *.cpp \
--                         *.c++ \
--                         *.d \
--                         *.java \
--                         *.ii \
--                         *.ixx \
--                         *.ipp \
--                         *.i++ \
--                         *.inl \
--                         *.h \
--                         *.hh \
--                         *.hxx \
--                         *.hpp \
--                         *.h++ \
--                         *.idl \
--                         *.odl \
--                         *.cs \
--                         *.php \
--                         *.php3 \
--                         *.inc \
--                         *.m \
--                         *.mm \
--                         *.dox \
--                         *.py \
--                         *.C \
--                         *.CC \
--                         *.C++ \
--                         *.II \
--                         *.I++ \
--                         *.H \
--                         *.HH \
--                         *.H++ \
--                         *.CS \
--                         *.PHP \
--                         *.PHP3 \
--                         *.M \
--                         *.MM \
--                         *.PY
--RECURSIVE              = YES
--EXCLUDE                = 
--EXCLUDE_SYMLINKS       = NO
--EXCLUDE_PATTERNS       = 
--EXCLUDE_SYMBOLS        = 
--EXAMPLE_PATH           = 
--EXAMPLE_PATTERNS       = *
--EXAMPLE_RECURSIVE      = NO
--IMAGE_PATH             = 
--INPUT_FILTER           = 
--FILTER_PATTERNS        = 
--FILTER_SOURCE_FILES    = NO
--#---------------------------------------------------------------------------
--# configuration options related to source browsing
--#---------------------------------------------------------------------------
--SOURCE_BROWSER         = NO
--INLINE_SOURCES         = NO
--STRIP_CODE_COMMENTS    = YES
--REFERENCED_BY_RELATION = YES
--REFERENCES_RELATION    = YES
--REFERENCES_LINK_SOURCE = YES
--USE_HTAGS              = NO
--VERBATIM_HEADERS       = NO
--#---------------------------------------------------------------------------
--# configuration options related to the alphabetical class index
--#---------------------------------------------------------------------------
--ALPHABETICAL_INDEX     = NO
--COLS_IN_ALPHA_INDEX    = 5
--IGNORE_PREFIX          = 
--#---------------------------------------------------------------------------
--# configuration options related to the HTML output
--#---------------------------------------------------------------------------
--GENERATE_HTML          = YES
--HTML_OUTPUT            = html
--HTML_FILE_EXTENSION    = .html
--HTML_HEADER            = 
--HTML_FOOTER            = 
--HTML_STYLESHEET        = 
--HTML_ALIGN_MEMBERS     = NO
--GENERATE_HTMLHELP      = NO
--HTML_DYNAMIC_SECTIONS  = NO
--CHM_FILE               = 
--HHC_LOCATION           = 
--GENERATE_CHI           = NO
--BINARY_TOC             = NO
--TOC_EXPAND             = NO
--DISABLE_INDEX          = YES
--ENUM_VALUES_PER_LINE   = 4
--GENERATE_TREEVIEW      = NO
--TREEVIEW_WIDTH         = 250
--#---------------------------------------------------------------------------
--# configuration options related to the LaTeX output
--#---------------------------------------------------------------------------
--GENERATE_LATEX         = NO
--LATEX_OUTPUT           = latex
--LATEX_CMD_NAME         = latex
--MAKEINDEX_CMD_NAME     = makeindex
--COMPACT_LATEX          = NO
--PAPER_TYPE             = letter
--EXTRA_PACKAGES         = 
--LATEX_HEADER           = 
--PDF_HYPERLINKS         = YES
--USE_PDFLATEX           = YES
--LATEX_BATCHMODE        = NO
--LATEX_HIDE_INDICES     = NO
--#---------------------------------------------------------------------------
--# configuration options related to the RTF output
--#---------------------------------------------------------------------------
--GENERATE_RTF           = YES
--RTF_OUTPUT             = rtf
--COMPACT_RTF            = YES
--RTF_HYPERLINKS         = YES
--RTF_STYLESHEET_FILE    = 
--RTF_EXTENSIONS_FILE    = 
--#---------------------------------------------------------------------------
--# configuration options related to the man page output
--#---------------------------------------------------------------------------
--GENERATE_MAN           = NO
--MAN_OUTPUT             = man
--MAN_EXTENSION          = .3
--MAN_LINKS              = NO
--#---------------------------------------------------------------------------
--# configuration options related to the XML output
--#---------------------------------------------------------------------------
--GENERATE_XML           = NO
--XML_OUTPUT             = xml
--XML_SCHEMA             = 
--XML_DTD                = 
--XML_PROGRAMLISTING     = YES
--#---------------------------------------------------------------------------
--# configuration options for the AutoGen Definitions output
--#---------------------------------------------------------------------------
--GENERATE_AUTOGEN_DEF   = NO
--#---------------------------------------------------------------------------
--# configuration options related to the Perl module output
--#---------------------------------------------------------------------------
--GENERATE_PERLMOD       = NO
--PERLMOD_LATEX          = NO
--PERLMOD_PRETTY         = YES
--PERLMOD_MAKEVAR_PREFIX = 
--#---------------------------------------------------------------------------
--# Configuration options related to the preprocessor   
--#---------------------------------------------------------------------------
--ENABLE_PREPROCESSING   = YES
--MACRO_EXPANSION        = NO
--EXPAND_ONLY_PREDEF     = NO
--SEARCH_INCLUDES        = NO
--INCLUDE_PATH           = 
--INCLUDE_FILE_PATTERNS  = 
--PREDEFINED             = 
--EXPAND_AS_DEFINED      = 
--SKIP_FUNCTION_MACROS   = YES
--#---------------------------------------------------------------------------
--# Configuration::additions related to external references   
--#---------------------------------------------------------------------------
--TAGFILES               = 
--GENERATE_TAGFILE       = 
--ALLEXTERNALS           = NO
--EXTERNAL_GROUPS        = NO
--PERL_PATH              = /usr/bin/perl
--#---------------------------------------------------------------------------
--# Configuration options related to the dot tool   
--#---------------------------------------------------------------------------
--CLASS_DIAGRAMS         = NO
--MSCGEN_PATH            = /Volumes/Ragna-Blade/Developer/Doxygen/Doxygen.app/Contents/Resources/
--HIDE_UNDOC_RELATIONS   = YES
--HAVE_DOT               = NO
--CLASS_GRAPH            = YES
--COLLABORATION_GRAPH    = YES
--GROUP_GRAPHS           = YES
--UML_LOOK               = NO
--TEMPLATE_RELATIONS     = NO
--INCLUDE_GRAPH          = YES
--INCLUDED_BY_GRAPH      = YES
--CALL_GRAPH             = NO
--CALLER_GRAPH           = NO
--GRAPHICAL_HIERARCHY    = YES
--DIRECTORY_GRAPH        = YES
--DOT_IMAGE_FORMAT       = png
--DOT_PATH               = 
--DOTFILE_DIRS           = 
--DOT_GRAPH_MAX_NODES    = 50
--MAX_DOT_GRAPH_DEPTH    = 1000
--DOT_TRANSPARENT        = NO
--DOT_MULTI_TARGETS      = NO
--GENERATE_LEGEND        = YES
--DOT_CLEANUP            = YES
--#---------------------------------------------------------------------------
--# Configuration::additions related to the search engine   
--#---------------------------------------------------------------------------
--SEARCHENGINE           = NO
-diff --git a/doc/ccapi/ccache-api-v2.html b/doc/ccapi/ccache-api-v2.html
-deleted file mode 100755
-index b8d3f06e5..000000000
---- a/doc/ccapi/ccache-api-v2.html
-+++ /dev/null
-@@ -1,1217 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"
--			"http://www.w3.org/TR/REC-html40/loose.dtd">
--<HTML>
--<HEAD> 
--	<TITLE>Credentials Cache API v2 Specification</TITLE> 
--</HEAD>
--<BODY>
--<H1>Credentials Cache API v2 Specification</H1>
--<H3>This version of the API is deprecated.  <BR>
--Please refer to CCAPI version 3 or later for the current API.</H3>
--
--<UL>
--   <LI><A HREF="#TypeDefinitions">Type Definitions</A>
--   
--   <UL CLASS=small>
--      <LI><A HREF="#cc_int32">cc_int32 &amp; cc_uint32</A>
--      
--      <LI><A HREF="#cc_time_t">cc_time_t</A>
--      
--      <LI><A HREF="#cc_nc_flags">cc_nc_flags</A>
--      
--      <LI><A HREF="#typedefCC_Cred">cc_cred</A>
--      
--      <LI><A HREF="#typedefCC_Data">cc_data</A>
--      
--      <LI><A HREF="#typedefV4Cred_type">V4Cred_type</A>
--      
--      <LI><A HREF="#enumStringToKey_Type">StringToKey_Type</A>
--      
--      <LI><A HREF="#enumCc_cred_vers">cc_cred_vers</A>
--      
--      <LI><A HREF="#unionCred_ptr_union">cred_ptr_union</A>
--      
--      <LI><A HREF="#unionCred_union">cred_union</A>
--      
--      <LI><A HREF="#typdefInfoNC">infoNC</A>
--      
--      <LI><A HREF="#opaque_types">opaque types</A>
--   </UL>
--   
--   <LI><A HREF="#ErrorCodeDefinitions">Error Code Definitions</A>
--   
--   <LI><A HREF="#ImplementationNotes">Implementation Notes</A>
--   
--   <LI><A HREF="#FunctionDefinitions">Function Definitions</A>
--   
--   <UL>
--      <LI><A HREF="#MainCacheFunctions">Main Cache Functions</A>
--      
--      <UL CLASS=small>
--         <LI><A HREF="#cc_initialize">cc_initialize</A>
--         
--         <LI><A HREF="#cc_create">cc_create</A>
--         
--         <LI><A HREF="#cc_open">cc_open</A>
--         
--         <LI><A HREF="#cc_close">cc_close</A>
--         
--         <LI><A HREF="#cc_destroy">cc_destroy</A>
--         
--         <LI><A HREF="#cc_shutdown">cc_shutdown</A>
--         
--         <LI><A HREF="#cc_initialize">cc_initialize</A>
--         
--         <LI><A HREF="#cc_get_change_time">cc_get_change_time</A>
--         
--         <LI><A HREF="#cc_get_NC_info">cc_get_NC_info</A>
--         
--         <LI><A HREF="#cc_seq_fetch_NCs_begin">cc_seq_fetch_NCs_begin</A>
--         
--         <LI><A HREF="#cc_seq_fetch_NCs_next">cc_seq_fetch_NCs_next</A>
--         
--         <LI><A HREF="#cc_seq_fetch_NCs_end">cc_seq_fetch_NCs_end</A>
--      
--      </UL>
--      
--      <LI><A HREF="#NCFunctions">NC Functions</A>
--      
--      <UL CLASS=small>
--         <LI><A HREF="#cc_get_name">cc_get_name</A>
--         
--         <LI><A HREF="#cc_get_cred_version">cc_get_cred_version</A>
--         
--         <LI><A HREF="#cc_get_principal">cc_get_principal</A>
--         
--         <LI><A HREF="#cc_get_instance">cc_get_instance</A>
--         
--         <LI><A HREF="#cc_remove_cred">cc_remove_cred</A>
--         
--         <LI><A HREF="#cc_store">cc_store</A>
--         
--         <LI><A HREF="#cc_get_instance">cc_get_instance</A>
--         
--         <LI><A HREF="#cc_seq_fetch_creds_begin">cc_seq_fetch_creds_begin</A>
--         
--         <LI><A HREF="#cc_seq_fetch_creds_next">cc_seq_fetch_creds_next</A>
--         
--         <LI><A HREF="#cc_seq_fetch_creds_end">cc_seq_fetch_creds_end</A>
--         
--         <LI><A HREF="#cc_lock_request">cc_lock_request</A>
--      </UL>
--      
--      <LI><A HREF="#LiberationFunctions">Liberation Functions</A>
--      
--      <UL CLASS=small>
--         <LI><A HREF="#cc_free_principal">cc_free_principal</A>
--         
--         <LI><A HREF="#cc_free_name">cc_free_name</A>
--         
--         <LI><A HREF="#cc_free_creds">cc_free_creds</A>
--         
--         <LI><A HREF="#cc_free_NC_info">cc_free_NC_info</A>
--      </UL>
--   </UL>
--   
--   <LI><A HREF="#RevisionNotes">Revision History/Notes</A>
--   
--   <UL>
--      <LI><A HREF="#ChangesRev3">Changes made during revsion 3</A>
--   </UL>
--   
--   <LI><A HREF="#FutureIdeas">Ideas for Future Versions</A>
--   
--   <LI><A HREF="#Abstract">Abstract</A>
--</UL>
--
--<P>
--<HR>
--<A NAME="Abstract"></A>
--
--<H2>Abstract</H2>
--
--<P>This is the specification for an API which provides Credentials
--Cache services for both
--<A HREF="http://web.mit.edu/kerberos/www/">Kerberos V5</A> and V4.
--The idea behind this API is that multiple Kerberos implementations
--can share a single Credentials Cache, mediated by this API
--specification. On the Microsoft Windows platform this will allow
--single-signon, even when more than one Kerberos DLL is in use on a
--particular system. Ideally, this problem could be solved by
--standardizing the Kerberos V5 API library interface. However, the
--Kerberos API is complicated enough that this would be hard to
--accomplish. Standardizing the interface for credentials cache access
--is much simpler. This API has also been adopted in the MIT Kerberos
--for the Macintosh implementation.
--
--<P>This specification has been revised to allow storage and
--manipulation of both V4 and V5 tickets. A cache contains one or more
--"Named Cache"s. It is assumed that V4 and V5 credentials would each
--be stored in separate "Named Cache"s and not mixed in a single "Named
--Cache".
--
--<P>Below, "NC" refers to "Named Cache".<BR>
--
--
--
--<P>
--<HR>
--<A NAME="RevisionNotes"></A>
--
--<H2><B>Revision History/Notes</B></H2>
--
--<H4>Original version (Draft Version 1)</H4>
--
--<P>1/27/96 by
--<A HREF="http://web.mit.edu/tytso/www/home.html">Theodore Ts'o</A>
--
--<H4>Revision 2 (Draft Version 1)</H4>
--
--<P>970628 by <A HREF="http://www.umich.edu/~sgr">Steve Rothwell</A>
--for the V4Cache Team (Paul Hill, Jenny Khuon, Jean Luker, Dave
--Detlefs, Allan Bjorklund, &amp; Steve Rothwell)
--
--<P><A NAME="ChangesRev3"></A>
--
--<H4>Revision 3 (Draft Version 1)</H4>
--
--<P>970725 by Steve Rothwell after initial implementation and alpha
--release. The term "credentials cache" was previously used to mean
--both "the main cache" and individual "named cache"s within the main
--cache. I have started using the term "NC" for "named cache" to make
--the distinction clearer and to reduce the overloading of the word
--"cache".
--
--<H5>Changes made for revision 3 of this API:</H5>
--
--<UL>
--   <LI>Added cred version type to cc_create() &amp; cc_open()
--   
--   <LI>New functions
--   
--   <UL>
--      <LI>cc_get_NC_info(), returns NC_info list for all NCs
--      
--      <LI>cc_free_NC_info(), frees NC_info list
--      
--      <LI>cc_get_cred_version(), returns version type of NC
--      
--      <LI>cc_get_name(), returns name of NC
--      
--      <LI>cc_free_name(), frees name aquired via cc_get_name()
--      
--      <LI>cc_seq_fetch_NCs(), iterate over all NCs
--   </UL>
--   
--   <LI>New return codes
--   
--   <UL>
--      <LI>CC_BAD_PARM
--      
--      <LI>CC_ERR_CACHE_ATTACH
--      
--      <LI>CC_ERR_CACHE_RELEASE
--      
--      <LI>CC_ERR_CACHE_FULL
--      
--      <LI>CC_ERR_CRED_VERSION
--   </UL>
--   
--   <LI>Modified functions
--   
--   <UL>
--      <LI>cc_create(), cc_open(), pass version type of NC
--      
--      <LI>cc_store(), cc_remove(), cc_
--   </UL>
--   
--   <LI>New &amp; Modified typedefs &amp; data structures
--   
--   <UL>
--      <LI>cc_cred_vers { CC_CRED_VUNKNOWN, CC_CRED_V4, CC_CRED_V5 }
--      
--      <LI>cred_ptr_union : contains pointer to credentials (either V4
--      or V5)
--      
--      <LI>cred_union : contains version type and cred_ptr_union
--      
--      <LI>modified V4Cred_type
--      
--      <LI>enum StringToKey_Type { STK_AFS or STK_DES }
--      
--      <LI>copies of the maximum V4 string size indicators
--      KRB_PRINCIPAL_SZ, KRB_SERVICE_SZ, KRB_INSTANCE_SZ,
--      KRB_REALM_SZ, ADDR_SZ
--   </UL>
--</UL>
--
--<H4>Revision 4 (Draft Version 1)</H4>
--
--<P>970908 by Steve Rothwell to incorporate changes initiated by Ted
--Tso. Further changes are expected in the comments for cc_create() and
--cc_get_change_time().
--
--<H4>Revision 4a (Final Version 1)</H4>
--
--<P>980603 by <A HREF="mailto:smcguire@mit.edu">Scott McGuire</A> to
--correct typographical errors, HTML errors, and minor clarifications.
--Final API Version 1 spec.
--
--<H4>Revision 5 (Draft Version 2)</H4>
--
--<P>990201 by <A HREF="mailto:smcguire@mit.edu">Scott McGuire</A>.
--
--<UL>
--   <LI>Increased API version number to 2.
--   
--   <LI>Added enum's defining version numbers.
--   
--   <LI>Changes to cc_initialize() to specify how to deal with
--   different API version numbers.
--   
--   <LI>Added description of cc_int32 and cc_uint32 types.
--   
--   <LI>Change some cc_int32's to cc_uint32's.
--   
--   <LI>Changed way cc_create() will behave when called on an existing
--   cache.
--   
--   <LI>Replaced cc_seq_fetch_NCs() with cc_seq_fetch_NCs_begin(),
--   cc_seq_fetch_NCs_next(), and cc_seq_fetch_NCs_end();
--   
--   <LI>Replaced cc_seq_fetch_creds() with cc_seq_fetch_creds_begin(),
--   cc_seq_fetch_creds_next(), and cc_seq_fetch_creds_end();
--   
--   <LI>Replaced enum type references in structs and function
--   paramenters with cc_int32 references;
--   
--   <LI>Replaced int type references in function parameters with
--   cc_int32;
--   
--   <LI>Added return type of cc_int32 to all functions;
--   
--   <LI>Removed #ifdef from cred_union structure;
--   
--   <LI>Constant definitions and changes to V4Cred_type structure;
--   
--   <LI>Removed incorrect const ccache_p * parameters from cc_store()
--   and cc_remove_cred();
--   
--   <LI>Added CC_NOERROR and CC_BAD_PARM as possible return codes from
--   all functions (except no CC_BAD_PARM from cc_shutdown() );
--   
--   <LI>Added CC_ERR_CRED_VERSION as possible return code from
--   cc_open() and cc_create();
--   
--   <LI>Moved infoNC structure definition up to be with rest of
--   structure definitions;
--   
--   <LI>Changed "struct _infoNC" to "infoNC" in parameter type
--   references.
--   
--   <LI>cc_free_principal() and cc_free_name() now take char **
--   instead of char * for final parameter. (This change was made
--   between rev 4a and rev 5, but I'm re-emphasizing it here.)
--   
--   <LI>Added Implementation Notes section with requirement that all
--   functions must be atomic and name requirements for Windows DLL's.
--   
--   <LI>Renamed "the proposed changes to this API are" section to
--   "Ideas for Future Versions" -- but removed all items but one
--   because they'd all been done.
--   
--   <LI>Removed most of the notes about differences with the Win NT/95
--   implementation of the API -- the differences have been reconciled.
--   
--   <LI>Removed unnecessary and inconsistent italicizing.
--</UL>
--
--<H4>Revsion 5a (Final Version 2)</H4>
--
--<P>990723 by <A HREF="mailto:smcguire@mit.edu">Scott McGuire</A>.
--
--<UL>
--   <LI>cc_create(): Removed text about "expected" form of name.
--   Removed note about "the alpha version does not do this."
--   
--   <LI>cc_destroy(): Clarified that you do not need to call
--   cc_close() on the cache_pointer after calling this function.
--   
--   <LI>Removed note about Windows cc_get_instance() and
--   cc_set_instance() functions, they are no longer part of the
--   Windows code!
--</UL>
--
--<H2><A NAME="FutureIdeas"></A>Ideas for Future Versions</H2>
--
--<UL>
--   <LI>Define Get/Set functions for all components of _cc_creds?
--   (This will allow future changes to the data structure to be
--   transparent to the caller. This also makes backward compatibility
--   much easier to maintain.)
--</UL>
--
--<P><!-- -----------------------------------------------------------------------------------><!-- type definitions                                                                 --><!-- -----------------------------------------------------------------------------------><BR>
--
--
--<HR>
--<A NAME="TypeDefinitions"></A>
--
--<H2>Type definitions</H2>
--
--<PRE>// enums for API versions used in cc_initialize()
--enum {
--   CC_API_VER_1 = 1,
--   CC_API_VER_2 = 2
--};
--&nbsp;
--<A NAME="cc_int32"></A>
--// cc_int32 and cc_uint32 are not exactly defined in this API due
--// to a lack of standard 32-bit integer size between platforms
--// (although there is the C9X standard).
--// However, we will place the following constraints:
--//
--// cc_int32 is a signed integer that is at least 32 bits wide.
--// cc_uint32 is an unsigned integer that is at least 32 bits wide
--&nbsp;
--<A NAME="cc_time_t"></A>
--typedef cc_int32 cc_time_t;  //see <A HREF="#cc_time_t_Note">notes below</A>
--<A NAME="cc_nc_flags"></A>
--typedef cc_uint32 cc_nc_flags;
--&nbsp;
--&nbsp;
--<A NAME="opaque_types"></A>
--typedef struct opaque_dll_control_block_type* apiCB;
--typedef struct opaque_ccache_pointer_type* ccache_p;
--typedef struct opaque_credential_iterator_type* ccache_cit;
--&nbsp;
--// These really are intended to be opaque. All implementations of the cache API must have
--// them but what they are is implementation specific. In the case of SGR's implementation,
--// the cc_ctx returned available after a call to cc_initialize, is a CCache_ctx class object. The&nbsp;
--// code that normally calls the cc_initialize function is straight C, which means the calling
--// application doesn't have a chance in hell of manipulating this directly. The API is designed
--// so that it does not have to. It does have to pass the pointer to the class around, one reason&nbsp;
--// being so that the destructor can eventually be called.
--&nbsp;
--&nbsp;
--<A NAME="typedefCC_Data"></A>
--typedef struct _cc_data {
--&nbsp;&nbsp;&nbsp; cc_uint32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; type;
--&nbsp;&nbsp;&nbsp; cc_uint32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; length;
--&nbsp;&nbsp;&nbsp; unsigned char*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; data;
--} cc_data;
--&nbsp;
--<A NAME="typedefCC_Cred"></A>
--typedef struct _cc_creds {
--&nbsp;&nbsp;&nbsp; char*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; client; /* client's principal identifier */
--&nbsp;&nbsp;&nbsp; char*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; server; /* server's principal identifier */
--&nbsp;&nbsp;&nbsp; cc_data&nbsp;&nbsp;&nbsp;&nbsp; keyblock;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* session encryption key info */
--&nbsp;&nbsp;&nbsp; cc_time_t&nbsp;&nbsp; authtime;
--&nbsp;&nbsp;&nbsp; cc_time_t&nbsp;&nbsp; starttime;
--&nbsp;&nbsp;&nbsp; cc_time_t&nbsp;&nbsp; endtime;
--&nbsp;&nbsp;&nbsp; cc_time_t&nbsp;&nbsp; renew_till;
--&nbsp;&nbsp;&nbsp; cc_uint32&nbsp;&nbsp;&nbsp; is_skey;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* true if ticket is encrypted in
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; another ticket's skey */
--&nbsp;&nbsp;&nbsp; cc_uint32&nbsp;&nbsp;&nbsp; ticket_flags;&nbsp;&nbsp; /* flags in ticket */
--&nbsp;&nbsp;&nbsp; cc_data**&nbsp;&nbsp; addresses;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* addrs in ticket */
--&nbsp;&nbsp;&nbsp; cc_data&nbsp;&nbsp;&nbsp;&nbsp; ticket;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* ticket string itself */
--&nbsp;&nbsp;&nbsp; cc_data&nbsp;&nbsp;&nbsp;&nbsp; second_ticket;&nbsp; /* second ticket, if related to
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ticket (via DUPLICATE-SKEY or
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ENC-TKT-IN-SKEY) */
--&nbsp;&nbsp;&nbsp; cc_data**&nbsp;&nbsp; authdata;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* authorization data */
--} cc_creds;
--&nbsp;
--&nbsp;
--// use an enumerated type so all callers infer the same meaning
--// these values are what krbv4win uses internally.
--<A NAME="enumStringToKey_Type"></A>
--enum StringToKey_Type { STK_AFS = 0, STK_DES = 1 };
--&nbsp;
--enum { MAX_V4_CRED_LEN = 1250 };
--&nbsp;
--&nbsp;
--// V4 Credentials
--<A NAME="typedefV4Cred_type"></A>
--enum {
--&nbsp;&nbsp;KRB_NAME_SZ = 40,
--&nbsp;&nbsp;KRB_INSTANCE_SZ = 40,
--&nbsp;&nbsp;KRB_REALM_SZ = 40
--};
--&nbsp;
--typedef struct _V4credential {
--&nbsp;&nbsp;&nbsp; unsigned char&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;      kversion;
--&nbsp;&nbsp;&nbsp; char&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;     principal[KRB_NAME_SZ+1];
--&nbsp;&nbsp;&nbsp; char&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;     principal_instance[KRB_INSTANCE_SZ+1];
--&nbsp;&nbsp;&nbsp; char&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;     service[KRB_NAME_SZ+1];
--&nbsp;&nbsp;&nbsp; char&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;     service_instance[KRB_INSTANCE_SZ+1];
--&nbsp;&nbsp;&nbsp; char&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;     realm[KRB_REALM_SZ+1];
--&nbsp;&nbsp;&nbsp; unsigned char&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;        session_key[8];
--&nbsp;&nbsp;&nbsp; cc_int32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;        kvno;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // k95 used BYTE skvno
--&nbsp;&nbsp;&nbsp; cc_int32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; str_to_key;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// k4 infers dynamically, k95 stores; of type enum StringToKey_Type
--&nbsp;&nbsp;&nbsp; long&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;     issue_date;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // k95 called this issue_time
--&nbsp;&nbsp;&nbsp; cc_int32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;        lifetime;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // k95 used LONG expiration_time
--&nbsp;&nbsp;&nbsp; cc_uint32    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;address;&nbsp;&nbsp;   &nbsp;&nbsp;&nbsp;&nbsp;       // IP Address of local host as an unsigned 32-bit integer
--&nbsp;&nbsp;&nbsp; cc_int32&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;        ticket_sz;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // k95 used BYTE, k4 ktext uses int to hold up to 1250
--&nbsp;&nbsp;&nbsp; unsigned char&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;        ticket[MAX_V4_CRED_LEN];
--&nbsp;&nbsp;&nbsp; unsigned long&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;        oops;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // zero to catch runaways
--} V4Cred_type;
--&nbsp;
--<A NAME="enumCc_cred_vers"></A>
--enum cc_cred_vers {&nbsp;&nbsp;
--&nbsp;&nbsp;&nbsp; CC_CRED_VUNKNOWN = 0,&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // For validation
--&nbsp;&nbsp;&nbsp; CC_CRED_V4 = 1,
--&nbsp;&nbsp;&nbsp; CC_CRED_V5 = 2,
--&nbsp;&nbsp;&nbsp; CC_CRED_VMAX = 3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // For validation
--};
--&nbsp;
--<A NAME="unionCred_ptr_union"></A>
--typedef union cred_ptr_union_type {
--&nbsp;&nbsp;&nbsp; V4Cred_type* pV4Cred;
--&nbsp;&nbsp;&nbsp; cc_creds*&nbsp;&nbsp;&nbsp; pV5Cred;
--} cred_ptr_union;
--&nbsp;
--<A NAME="unionCred_union"></A>
--typedef struct cred_union_type {
--&nbsp;&nbsp;&nbsp; cc_int32 cred_type;  // cc_cred_vers
--&nbsp;&nbsp;&nbsp; <A HREF="#unionCred_ptr_union">cred_ptr_union</A> cred;
--} cred_union;
--&nbsp;
--<A NAME="typdefInfoNC"></A>
--typedef struct _infoNC {
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; char*&nbsp;&nbsp; name;
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; char*&nbsp;&nbsp; principal;
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; cc_int32 vers;   // cc_cred_vers
--} infoNC;</PRE>
--
--<H4>The cc_data structure</H4>
--
--<P>The cc_data structure is used to store the following elements:
--
--<UL>
--   <LI>keyblock
--   
--   <LI>addresses
--   
--   <LI>ticket (and second_ticket)
--   
--   <LI>authorization data
--</UL>
--
--<P>For cc_creds.ticket and cc_creds.second_ticket, the cc_data.type
--field MUST be zero. For the cc_creds.addresses, cc_creds.authdata,
--and cc_data.keyblock, the cc_data.type field should be the address
--type, authorization data type, and encryption type, as defined by the
--Kerberos V5 protocol definition.
--
--<H4><A NAME="cc_time_t_Note"></A>cc_time_t</H4>
--
--<P>The cc_time_t fields are used to represent time. The time must be
--stored as the number of seconds since midnight GMT on January 1,
--1970.
--
--<H4>Principal names</H4>
--
--<P>Principal names are stored as C strings in this API. The C strings
--may contain UTF-8 encoded strings for internationalization
--purposes.<BR>
--
--
--<HR>
--<A NAME="ErrorCodeDefinitions"></A>
--
--<H2>Error Codes Definition</H2>
--
--<P><TABLE BORDER=1>
--   <TR>
--      <TD>
--         <P>0&nbsp;
--      </TD><TD>
--         <P>CC_NOERROR&nbsp;
--      </TD><TD>
--         <P>"Successful return"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>1&nbsp;
--      </TD><TD>
--         <P>CC_BADNAME&nbsp;
--      </TD><TD>
--         <P>"Bad credential cache name format"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>2&nbsp;
--      </TD><TD>
--         <P>CC_NOTFOUD&nbsp;
--      </TD><TD>
--         <P>"Matching credential not found"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>3&nbsp;
--      </TD><TD>
--         <P>CC_END&nbsp;
--      </TD><TD>
--         <P>"End of credential cache reached"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>4&nbsp;
--      </TD><TD>
--         <P>CC_IO&nbsp;
--      </TD><TD>
--         <P>"Credentials cache I/O operation failed"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>5&nbsp;
--      </TD><TD>
--         <P>CC_WRITE&nbsp;
--      </TD><TD>
--         <P>"Error writing to credentials cache file"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>6&nbsp;
--      </TD><TD>
--         <P>CC_NOMEM&nbsp;
--      </TD><TD>
--         <P>"No memory"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>7&nbsp;
--      </TD><TD>
--         <P>CC_FORMAT&nbsp;
--      </TD><TD>
--         <P>"Corrupted credentials cache"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>8&nbsp;
--      </TD><TD>
--         <P>CC_LOCKED&nbsp;
--      </TD><TD>
--         <P>"The credentials cache or NC is locked"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>9&nbsp;
--      </TD><TD>
--         <P>CC_BAD_API_VERSION&nbsp;
--      </TD><TD>
--         <P>"Unsupported API version"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>10&nbsp;
--      </TD><TD>
--         <P>CC_NO_EXIST&nbsp;
--      </TD><TD>
--         <P>"Credentials cache or NC does not exist"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>11&nbsp;
--      </TD><TD>
--         <P>CC_NOT_SUPP&nbsp;
--      </TD><TD>
--         <P>"Function not supported"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>12&nbsp;
--      </TD><TD>
--         <P>CC_BAD_PARM&nbsp;
--      </TD><TD>
--         <P>"Bad Paramter Passed"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>13&nbsp;
--      </TD><TD>
--         <P>CC_ERR_CACHE_ATTACH&nbsp;
--      </TD><TD>
--         <P>"Failed to attach cache"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>14&nbsp;
--      </TD><TD>
--         <P>CC_ERR_CACHE_RELEASE&nbsp;
--      </TD><TD>
--         <P>"Failed to release cache"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>15&nbsp;
--      </TD><TD>
--         <P>CC_ERR_CACHE_FULL&nbsp;
--      </TD><TD>
--         <P>"Cache FULL"&nbsp;
--      </TD></TR>
--   <TR>
--      <TD>
--         <P>16&nbsp;
--      </TD><TD>
--         <P>CC_ERR_CRED_VERSION&nbsp;
--      </TD><TD>
--         <P>"Wrong Cred Version"&nbsp;
--      </TD></TR>
--</TABLE>
--
--<P>
--<HR>
--<A NAME="ImplementationNotes"></A>
--
--<H2>Implementation Notes</H2>
--
--<H4>All functions are atomic</H4>
--
--<P>All Credentials Cache API functions must be atomic.
--
--<P><B>Windows</B>
--
--<P>DLLs should be named KrbCC16.dll and KrbCC32.dll.
--
--<P>
--<HR>
--<A NAME="FunctionDefinitions"></A>
--
--<H2>Function definitions</H2>
--
--<P><A NAME="MainCacheFunctions"></A>
--
--<H3>Main Cache Functions</H3>
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_initialize                                                                    --><!-- ----------------------------------------------------------------------------------->
--
--
--<P><A NAME="cc_initialize"></A>
--
--<H4>cc_initialize</H4>
--
--<PRE>cc_int32 cc_initialize(apiCB** cc_ctx, cc_int32 api_version, cc_int32* api_supported, char** vendor)</PRE>
--
--<P>This function performs any initialization required by the
--<I>API</I>. It must be called before any other function in the
--<I>API</I> is called. The cc_ctx returned by this function must be
--passed to all other <I>API</I> functions as the first argument.
--
--<P>The application must pass in the maximum version number of the API
--it supports in the <B>api_version</B> parameter.
--
--<P>If <B>api_supported</B> non-NULL, then cc_initialize will store
--the maximum API version number supported by the library implementing
--the API there.
--
--<P>If the version requested by <B>api_version</B> is not equal to the
--version supported by the library, CC_BAD_API_VERSION will be returned
--as the error code (along with the version the library does support in
--<B>api_supported</B>) and cc_initialize should not allocate any
--memory.
--
--<P>If the <B>vendor</B> is non-NULL, then cc_initialize will store a
--pointer to a read/only C string which contains a string describing
--the vendor which implemented the credentials cache <I>API</I>.
--
--<P>Possible error codes: CC_NOERROR, CC_NOMEM, CC_BAD_API_VERSION,
--CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_shutdown  		                                                              --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_shutdown"></A>
--
--<H4>cc_shutdown</H4>
--
--<PRE>cc_int32 cc_shutdown(apiCB** cc_ctx)</PRE>
--
--<P>This function performs any cleanup required by the <I>API</I>.
--cc_ctx will be NULL on return. The application program must call
--cc_initialize() again before making any credentials cache <I>API</I>
--calls.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_get_change_time                                                               --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_get_change_time"></A>
--
--<H4>cc_get_change_time</H4>
--
--<PRE>cc_int32 cc_get_change_time(apiCB* cc_ctx, cc_time_t* time)</PRE>
--
--<P>This function returns the time of the most recent change for the
--entire cache. There is ONE timestamp maintained for the entire cache.
--By maintaining a local copy the caller can deduce whether "something
--changed" or not.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_NOMEM,
--CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_get_NC_info  	                                                              --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_get_NC_info"></A>
--
--<H4>cc_get_NC_info</H4>
--
--<PRE>cc_int32 cc_get_NC_info(apiCB* cc_ctx, infoNC*** ppNCi)</PRE>
--
--<P>cc_get_NC_info() is a wrapper for cc_seq_fetch_NCs(),
--cc_get_name() cc_get_cred_version(), and cc_get_principal(). It
--returns all the information needed to uniquely identify each NC in
--the cache (name and cred_version) and the associated principal.
--Specifically it returns a null terminated list of pointers to infoNC
--structs. Each infoNC struct contain a pointer to the NC's name, a
--pointer to the the principal associated with the NC, and the version
--number (as an enumerated type) of the credentials stored in this NC.
--
--<P>The ppNCi (the entire data structure) aquired by this routine
--should be freed with cc_free_NC_info().
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_NOMEM,
--CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_open      		                                                              --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_open"></A>
--
--<H4>cc_open</H4>
--
--<PRE>cc_int32 cc_open(apiCB* cc_ctx, const char* name, cc_int32 cred_vers, cc_uint32 cc_flags,
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ccache_p** ccache_pointer)</PRE>
--
--<P>Opens an already exising NC identified by both <B>name</B>, and
--<B>cred_vers</B>. It fills in the parameter **ccache_pointer with a
--pointer to the NC.
--
--<P>The list of cache names, principals, and credentials versions may
--be retrieved via cc_seq_fetch_NCs(), cc_get_name(),
--cc_get_cred_version(), &amp; cc_get_principal() OR via
--cc_get_NC_info().
--
--<P>Possible error codes: CC_NOERROR, CC_BADNAME, CC_NO_EXIST,
--CC_NOMEM, CC_ERR_CRED_VERSION, CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_create                                                                        --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_create"></A>
--
--<H4>cc_create</H4>
--
--<PRE>cc_int32 cc_create(apiCB* cc_ctx, const char* name, const char* principal,
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; cc_int32 cred_vers, cc_uint32 cc_flags, ccache_p** ccache_pointer)</PRE>
--
--<P>Create a new NC. The NC is uniquely identified by the combination
--of it's name and the "cc_creds_vers" (i.e. which credentials version
--it holds). The principal given is also associated with the NC. A NULL
--<B>name</B> is not allowed (and CC_BADNAME should be returned if one
--is passed in). If <B>name</B> is non-null and there is already a NC
--named <B>name</B>, all credentials in the cache are removed, and
--handle for the existing cache is returned. If there is already a NC
--named name, all existing handles for this cache remain valid. The NC
--is created with a primary principal specified by <B>principal</B>.
--
--<P><I>(Removed text about the "expected" form of the NC name.)</I>
--
--<P>An NC is intended to hold credentials for a single principal in a
--single realm, and for a single credentials version (i.e. V4 or V5).
--The cache can contain credentials for other credential versions,
--other realms, and even other principals, but each in a separate NC.
--This rule will allow callers that can only handle a single principal
--in a single realm to continue to work by dealing with only one NC.
--Callers that can deal with multiple principals, multiple realms,
--and/or multiple credentials versions can do so by dealing with
--multiple NCs. By doing it this way, the callers that are able to
--handle multiple principals, realms, and/or versions can do so without
--interfering with "differently abled" code.
--
--<P>The list of cache names, principals, &amp; cred_versions may be
--retrieved via cc_get_NC_info().
--
--<P>Possible error codes: CC_NOERROR, CC_BADNAME, CC_BAD_PARM,
--CC_NO_EXIST, CC_NOMEM, CC_ERR_CRED_VERSION
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_close                                                                         --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_close"></A>
--
--<H4>cc_close</H4>
--
--<PRE>cc_int32 cc_close(apiCB* cc_ctx, ccache_p** ccache_pointer)</PRE>
--
--<P>Close the NC. The <B>ccache_pointer</B> related memory is
--deallocated, and ccache_pointer is set to NULL before being returned
--to caller.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_destroy                                                                       --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_destroy"></A>
--
--<H4>cc_destroy</H4>
--
--<PRE>cc_int32 cc_destroy(apiCB* cc_ctx, ccache_p** ccache_pointer)</PRE>
--
--<P>Destroy the NC pointed to by <B>ccache_pointer</B>. The
--<B>ccache_pointer</B> related memory is deallocated, and
--ccache_pointer is set to NULL before being returned to caller. The
--caller does not need to call cc_close() on the <B>cache_pointer</B>
--afterwards.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_seq_fetch_NCs                                                                 --><!-- -----------------------------------------------------------------------------------><BR>
--
--
--
--<P><A NAME="cc_seq_fetch_NCs_begin"></A>
--
--<H4>cc_seq_fetch_NCs_begin</H4>
--
--<PRE>cc_int32 cc_seq_fetch_NCs_begin(apiCB* cc_ctx, ccache_cit** itNCs)</PRE>
--
--<P>Used to allocate memory and initialize the iterator *itNCs. Use
--cc_seq_fetch_NCs_end() to deallocate the memory used by *itNCs.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM,
--CC_NOMEM
--
--<H4><A NAME="cc_seq_fetch_NCs_next"></A></H4>
--
--<H4>cc_seq_fetch_NCs_next</H4>
--
--<PRE>cc_int32 cc_seq_fetch_NCs_next(apiCB* cc_ctx, ccache_p** ccache_pointer, ccache_cit* itNCs)</PRE>
--
--<P>Used to sequentially open every NC in the cache.
--
--<P>Ccache_pointer must be a pointer to a ccache_p*. The
--ccache_pointer returned may be used to get information about the NC
--by calling cc_get_name(), cc_get_cred_version(), and
--cc_get_principal(). Ccache_pointer's returned must be freed via
--cc_close() between calls to cc_seq_fetch_NCs_next().
--
--<P>itNCs must be a pointer to a ccache_cit* variable provided by the
--calling application and which is used by cc_seq_fetch_NCs_next() to
--determine the next NC to return. It must have been initialized by
--cc_seq_fetch_NCs_begin().
--
--<P>If changes are made to the credentials cache while it iterator is
--being used, it must return at least the intersection, and at most the
--union, of the set of NC's that were in the cache when the iteration
--began and the set of NC's that are in the cache when it ends.
--
--<P>When the last NC in the sequence is returned, the return code from
--cc_seq_fetch_NCs_next() will be CC_END.
--
--<P>Possible error codes: CC_NOERROR, CC_END, CC_NO_EXIST.
--CC_BAD_PARM, CC_NOMEM
--
--<H4>&nbsp;</H4>
--
--<H4><A NAME="cc_seq_fetch_NCs_end"></A></H4>
--
--<H4>cc_seq_fetch_NCs_end</H4>
--
--<PRE>cc_int32 cc_seq_fetch_NCs_end(apiCB* cc_ctx, ccache_cit** itNCs)</PRE>
--
--<P>Deallocates the memory used by *itNCs, and sets *itNCs to NULL.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM
--
--<P>&nbsp;
--
--<P><A NAME="NCFunctions"></A>
--
--<H3>NC Functions</H3>
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_get_name                                                                      --><!-- -----------------------------------------------------------------------------------><A NAME="cc_get_name"></A>
--
--
--<H4>cc_get_name</H4>
--
--<PRE>cc_int32 cc_get_name(apiCB* cc_ctx, const ccache_p* ccache_pointer, char** name)</PRE>
--
--<P>cc_get_name() returns the name of the NC indicated by
--ccache_pointer. The name can be used in cc_open() or cc_create(). The
--combination of the name and the credentials version uniqeuly identify
--an NC. The returned name should be freed via cc_free_name().
--
--<P>Possible error codes: CC_NOERROR, CC_NOMEM, CC_NO_EXIST,
--CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_get_cred_version                                                              --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_get_cred_version"></A>
--
--<H4>cc_get_cred_version</H4>
--
--<PRE>cc_int32 cc_get_cred_version(apiCB* cc_ctx, const ccache_p* ccache_pointer, cc_int32* cred_vers)</PRE>
--
--<P>cc_get_cred_version() returns one of the enumerated type
--cc_cred_vers in cred_vers. The expected values are CC_CRED_V4, or
--CC_CRED_V5. The combination of the name and the credentials version
--uniquely identify an NC.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_set_principal                                                                 --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_set_principal"></A>
--
--<H4>cc_set_principal</H4>
--
--<PRE>cc_int32 cc_set_principal(apiCB* cc_ctx, const ccache_p* ccache_pointer, const cc_int32 cred_vers,
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;const char* principal)</PRE>
--
--<P>Set the primary principal for the NC indicated by ccache_pointer.
--This is the complement to cc_get_principal().
--
--<P>cred_vers is used as a double check.
--
--<P>principal points to a null terminated string that will be copied
--into the NC. This new principal will be returned if you call
--cc_get_principal() for this NC.
--
--<P>Possible error codes: CC_NOERROR, CC_NOMEM, CC_NO_EXIST,
--CC_ERR_CRED_VERSION, CC_BAD_PARM<BR>
--
--&nbsp;
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_get_principal                                                                 --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_get_principal"></A>
--
--<H4>cc_get_principal</H4>
--
--<PRE>cc_int32 cc_get_principal(apiCB* cc_ctx, const ccache_p* ccache_pointer, char** principal)</PRE>
--
--<P>Return the primary principal for the NC that was set via
--cc_create() or cc_set_principal(). The returned principal should be
--freed via cc_free_principal() .
--
--<P>Possible error codes: CC_NOERROR, CC_NOMEM, CC_NO_EXIST,
--CC_BAD_PARM<BR>
--
--
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_store                                                                         --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_store"></A>
--
--<H4>cc_store</H4>
--
--<PRE>cc_int32 cc_store(apiCB* cc_ctx, ccache_p* ccache_pointer, const&nbsp;<A HREF="#unionCred_union">cred_union</A> cred)</PRE>
--
--<P>Store (make a copy of) <B>cred</B> in the NC indicated by
--<B>ccache_pointer</B>.
--
--<P>A cred_union contains a cred_type indicator and a cred_ptr_union.
--A cred_ptr_union can contain either a V4Cred_type pointer or a
--cc_creds (V5 creds) pointer. Cred_type indicates which type of
--pointer is in the cred_ptr_union. This also allows the <I>API</I> to
--enforce the credentials version declared in cc_create() or cc_open().
--
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_ERR_CACHE_FULL,
--CC_ERR_CRED_VERSION, CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_remove_cred                                                                   --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_remove_cred"></A>
--
--<H4>cc_remove_cred</H4>
--
--<PRE>cc_int32 cc_remove_cred(apiCB* cc_ctx, ccache_p* ccache_pointer, const <A HREF="#unionCred_union">cred_union</A> cred)</PRE>
--
--<P>Removes the credential <B>cred</B> from <B>ccache_pointer</B>. The
--credentials in the NC indicated by ccache_pointer are searched to
--find a matching credential. If found, that credential is removed from
--the NC. The cred parameter is not modified and should be freed via
--cc_free_creds(). It is legitimate to call this function during a
--sequential fetch, and the deletion of a credential already returned
--by cc_seq_fetch_creds() should not disturb sequence of credentials
--returned by cc_seq_fetch_creds().
--
--<P>Use of cred_union is the same as is explained in cc_store().
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_NOTFOUND,
--CC_ERR_CRED_VERSION, CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_seq_fetch_creds                                                               --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_seq_fetch_creds_begin"></A>
--
--<H4>cc_seq_fetch_creds_begin</H4>
--
--<PRE>cc_int32 cc_seq_fetch_creds_begin(apiCB* cc_ctx, const ccache_p* ccache_pointer, ccache_cit** itCreds)</PRE>
--
--<P>Allocates memory for and initializes *itCreds. This memory must be
--deallocated using cc_seq_fetch_creds_end().
--
--<P>Ccache_pointer must be a valid pointer to the NC containing the
--creds to be returned by the iterator.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM,
--CC_NOMEM
--
--<P>&nbsp;
--
--<P><A NAME="cc_seq_fetch_creds_next"></A>
--
--<H4>cc_seq_fetch_creds_next</H4>
--
--<PRE>cc_int32 cc_seq_fetch_creds_next(apiCB* cc_ctx, cred_union** cred, ccache_cit* itCreds)</PRE>
--
--<P>cc_seq_fetch_creds_next() is used to sequentially read every set
--of credentials in an NC. The NC has been indicated in the call to
--cc_seq_fetch_creds_begin().
--
--<P>itCreds must be a pointer to a ccache_cit* variable provided by
--the calling application and which is used by
--cc_seq_fetch_creds_next() to determine the next cached credential to
--return. The ccache_cit* variable must be initialized by calling
--cc_seq_fetch_creds_begin().
--
--<P>The credentials are filled into the cred_union pointed to by
--creds. Note that the cred_union contains elements which are
--dynamically allocated, so must be freed using cc_free_creds() between
--calls to cc_seq_fetch_creds_next().
--
--<P>If changes are made to the NC while it iterator is being used, it
--must return at least the intersection, and at most the union, of the
--set of credentials that were in the NC when the iteration began and
--the set of credentials that are in the NC when it ends.
--
--<P>When the last credential in the sequence is returned, the return
--code from cc_seq_fetch_creds_next() will be CC_END.
--
--<P>Possible error codes: CC_NOERROR, CC_END, CC_NO_EXIST,
--CC_BAD_PARM, CC_NOMEM
--
--<P>&nbsp;
--
--<P><A NAME="cc_seq_fetch_creds_end"></A>
--
--<H4>cc_seq_fetch_creds_end</H4>
--
--<PRE>cc_int32 cc_seq_fetch_creds_end(apiCB* cc_ctx, ccache_cit** itCreds)</PRE>
--
--<P>Deallocates memory used by *itCreds and sets *itCreds to NULL.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_lock_request                                                                  --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_lock_request"></A>
--
--<H4>cc_lock_request</H4>
--
--<PRE>cc_int32 cc_lock_request(apiCB* cc_ctx, const ccache_p* ccache_pointer, cc_int32 lock_type)</PRE>
--
--<DL>
--   <DD>99/02/11 - smcguire
--   
--   <DD><B>As of&nbsp;this date there is no locking in the Win NT/95
--   or Machintosh implementations. The description below may not be
--   completely accurate as to how this function should be
--   implemented.</B>
--</DL>
--
--<P>This function is currently NOT IMPLEMENTED. All functions attach
--to the cache, take action, and detach from the cache before returning
--to the caller.
--
--<P>This function will lock or unlock the NC based on the argument
--value of lock_type:
--
--<PRE>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CC_LOCK_UNLOCK&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Unlock the NC
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CC_LOCK_READER&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Lock the NC for reading
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CC_LOCK_WRITER&nbsp; 3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Lock the NC for writing
--&nbsp;
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CC_LOCK_NOBLOCK 16&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Don't block, but return an error code if
--&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; the request cannot be satisfied.
--&nbsp;</PRE>
--
--<P>Locking is done on a per-thread basis. At most one thread may have
--the credentials locked for writing; if so, there must not be any
--threads that have the credentials locked for reading.
--
--<P>Multiple threads may have the cache locked for reading, as long as
--there is not a writer lock asserted on the cache.
--
--<P>If a thread has a cache locked for reading, that lock may be
--upgraded to a writer lock by calling cc_lock_request() with a
--lock_type of CC_LOCK_WRITER. If a thread has the cache locked for
--reading or writing, a request to cc_lock_request() for a reader or
--writer lock, respectively, is a no-op. If a thread does not have the
--cache locked, and calls cc_lock_request() with a lock_type of
--CC_LOCK_UNLOCK, this is also a no-op.
--
--<P>A request for CC_LOCK_READER and CC_LOCK_WRITER may be made
--non-blocking by logical or'ing the value CC_LOCK_NOBLOCK. In that
--case, if it is not possible to satisfy the lock request, the error
--CC_LOCKED will be returned.
--
--<P>&nbsp;
--
--<P><A NAME="LiberationFunctions"></A>
--
--<H3>Liberation Functions</H3>
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_free_principal                                                                --><!-- -----------------------------------------------------------------------------------><A NAME="cc_free_principal"></A>
--
--
--<H4>cc_free_principal</H4>
--
--<PRE>cc_int32 cc_free_principal(apiCB* cc_ctx, char** principal)</PRE>
--
--<P>This function frees the <B>principal</B> returned by
--cc_get_principal() and sets *principal to NULL.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_free_name                                                                     --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_free_name"></A>
--
--<H4>cc_free_name</H4>
--
--<PRE>cc_int32 cc_free_name(apiCB* cc_ctx, char** name)</PRE>
--
--<P>This function frees the <B>name</B> returned by cc_get_name() and
--sets *name to NULL.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_free_creds                                                                    --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_free_creds"></A>
--
--<H4>cc_free_creds</H4>
--
--<PRE>cc_int32 cc_free_creds(apiCB* cc_ctx, cred_union** creds)</PRE>
--
--<P>This function frees all storage associated with creds returned by
--cc_seq_fetch_creds() and sets the creds pointer to NULL.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM
--
--<P><!-- -----------------------------------------------------------------------------------><!-- cc_free_NC_info                                                                  --><!-- -----------------------------------------------------------------------------------><BR>
--
--<A NAME="cc_free_NC_info"></A>
--
--<H4>cc_free_NC_info</H4>
--
--<PRE>cc_int32 cc_free_NC_info(apiCB* cc_ctx, infoNC*** ppNCi)</PRE>
--
--<P>This routine frees all storage aquired by cc_get_NC_info() and
--sets ppNCi to NULL.
--
--<P>Possible error codes: CC_NOERROR, CC_NO_EXIST, CC_BAD_PARM
--
--<!-- Begin MIT-use only web reporting counter -->
--	<IMG SRC="http://counter.mit.edu/tally" WIDTH=1 HEIGHT=1 ALT="">
--<!-- End MIT-use only web reporting counter -->
--</BODY></HTML>
-diff --git a/doc/ccapi/html/doxygen.css b/doc/ccapi/html/doxygen.css
-deleted file mode 100644
-index 05615b2e6..000000000
---- a/doc/ccapi/html/doxygen.css
-+++ /dev/null
-@@ -1,310 +0,0 @@
--BODY,H1,H2,H3,H4,H5,H6,P,CENTER,TD,TH,UL,DL,DIV {
--	font-family: Geneva, Arial, Helvetica, sans-serif;
--}
--BODY,TD {
--       font-size: 90%;
--}
--H1 {
--	text-align: center;
--       font-size: 160%;
--}
--H2 {
--       font-size: 120%;
--}
--H3 {
--       font-size: 100%;
--}
--CAPTION { font-weight: bold }
--DIV.qindex {
--	width: 100%;
--	background-color: #e8eef2;
--	border: 1px solid #84b0c7;
--	text-align: center;
--	margin: 2px;
--	padding: 2px;
--	line-height: 140%;
--}
--DIV.nav {
--	width: 100%;
--	background-color: #e8eef2;
--	border: 1px solid #84b0c7;
--	text-align: center;
--	margin: 2px;
--	padding: 2px;
--	line-height: 140%;
--}
--DIV.navtab {
--       background-color: #e8eef2;
--       border: 1px solid #84b0c7;
--       text-align: center;
--       margin: 2px;
--       margin-right: 15px;
--       padding: 2px;
--}
--TD.navtab {
--       font-size: 70%;
--}
--A.qindex {
--       text-decoration: none;
--       font-weight: bold;
--       color: #1A419D;
--}
--A.qindex:visited {
--       text-decoration: none;
--       font-weight: bold;
--       color: #1A419D
--}
--A.qindex:hover {
--	text-decoration: none;
--	background-color: #ddddff;
--}
--A.qindexHL {
--	text-decoration: none;
--	font-weight: bold;
--	background-color: #6666cc;
--	color: #ffffff;
--	border: 1px double #9295C2;
--}
--A.qindexHL:hover {
--	text-decoration: none;
--	background-color: #6666cc;
--	color: #ffffff;
--}
--A.qindexHL:visited { text-decoration: none; background-color: #6666cc; color: #ffffff }
--A.el { text-decoration: none; font-weight: bold }
--A.elRef { font-weight: bold }
--A.code:link { text-decoration: none; font-weight: normal; color: #0000FF}
--A.code:visited { text-decoration: none; font-weight: normal; color: #0000FF}
--A.codeRef:link { font-weight: normal; color: #0000FF}
--A.codeRef:visited { font-weight: normal; color: #0000FF}
--A:hover { text-decoration: none; background-color: #f2f2ff }
--DL.el { margin-left: -1cm }
--.fragment {
--       font-family: Fixed, monospace;
--       font-size: 95%;
--}
--PRE.fragment {
--	border: 1px solid #CCCCCC;
--	background-color: #f5f5f5;
--	margin-top: 4px;
--	margin-bottom: 4px;
--	margin-left: 2px;
--	margin-right: 8px;
--	padding-left: 6px;
--	padding-right: 6px;
--	padding-top: 4px;
--	padding-bottom: 4px;
--}
--DIV.ah { background-color: black; font-weight: bold; color: #ffffff; margin-bottom: 3px; margin-top: 3px }
--TD.md { background-color: #F4F4FB; font-weight: bold; }
--TD.mdPrefix {
--       background-color: #F4F4FB;
--       color: #606060;
--	font-size: 80%;
--}
--TD.mdname1 { background-color: #F4F4FB; font-weight: bold; color: #602020; }
--TD.mdname { background-color: #F4F4FB; font-weight: bold; color: #602020; width: 600px; }
--DIV.groupHeader {
--       margin-left: 16px;
--       margin-top: 12px;
--       margin-bottom: 6px;
--       font-weight: bold;
--}
--DIV.groupText { margin-left: 16px; font-style: italic; font-size: 90% }
--BODY {
--	background: white;
--	color: black;
--	margin-right: 20px;
--	margin-left: 20px;
--}
--TD.indexkey {
--	background-color: #e8eef2;
--	font-weight: bold;
--	padding-right  : 10px;
--	padding-top    : 2px;
--	padding-left   : 10px;
--	padding-bottom : 2px;
--	margin-left    : 0px;
--	margin-right   : 0px;
--	margin-top     : 2px;
--	margin-bottom  : 2px;
--	border: 1px solid #CCCCCC;
--}
--TD.indexvalue {
--	background-color: #e8eef2;
--	font-style: italic;
--	padding-right  : 10px;
--	padding-top    : 2px;
--	padding-left   : 10px;
--	padding-bottom : 2px;
--	margin-left    : 0px;
--	margin-right   : 0px;
--	margin-top     : 2px;
--	margin-bottom  : 2px;
--	border: 1px solid #CCCCCC;
--}
--TR.memlist {
--   background-color: #f0f0f0; 
--}
--P.formulaDsp { text-align: center; }
--IMG.formulaDsp { }
--IMG.formulaInl { vertical-align: middle; }
--SPAN.keyword       { color: #008000 }
--SPAN.keywordtype   { color: #604020 }
--SPAN.keywordflow   { color: #e08000 }
--SPAN.comment       { color: #800000 }
--SPAN.preprocessor  { color: #806020 }
--SPAN.stringliteral { color: #002080 }
--SPAN.charliteral   { color: #008080 }
--.mdTable {
--	border: 1px solid #868686;
--	background-color: #F4F4FB;
--}
--.mdRow {
--	padding: 8px 10px;
--}
--.mdescLeft {
--       padding: 0px 8px 4px 8px;
--	font-size: 80%;
--	font-style: italic;
--	background-color: #FAFAFA;
--	border-top: 1px none #E0E0E0;
--	border-right: 1px none #E0E0E0;
--	border-bottom: 1px none #E0E0E0;
--	border-left: 1px none #E0E0E0;
--	margin: 0px;
--}
--.mdescRight {
--       padding: 0px 8px 4px 8px;
--	font-size: 80%;
--	font-style: italic;
--	background-color: #FAFAFA;
--	border-top: 1px none #E0E0E0;
--	border-right: 1px none #E0E0E0;
--	border-bottom: 1px none #E0E0E0;
--	border-left: 1px none #E0E0E0;
--	margin: 0px;
--}
--.memItemLeft {
--	padding: 1px 0px 0px 8px;
--	margin: 4px;
--	border-top-width: 1px;
--	border-right-width: 1px;
--	border-bottom-width: 1px;
--	border-left-width: 1px;
--	border-top-color: #E0E0E0;
--	border-right-color: #E0E0E0;
--	border-bottom-color: #E0E0E0;
--	border-left-color: #E0E0E0;
--	border-top-style: solid;
--	border-right-style: none;
--	border-bottom-style: none;
--	border-left-style: none;
--	background-color: #FAFAFA;
--	font-size: 80%;
--}
--.memItemRight {
--	padding: 1px 8px 0px 8px;
--	margin: 4px;
--	border-top-width: 1px;
--	border-right-width: 1px;
--	border-bottom-width: 1px;
--	border-left-width: 1px;
--	border-top-color: #E0E0E0;
--	border-right-color: #E0E0E0;
--	border-bottom-color: #E0E0E0;
--	border-left-color: #E0E0E0;
--	border-top-style: solid;
--	border-right-style: none;
--	border-bottom-style: none;
--	border-left-style: none;
--	background-color: #FAFAFA;
--	font-size: 80%;
--}
--.memTemplItemLeft {
--	padding: 1px 0px 0px 8px;
--	margin: 4px;
--	border-top-width: 1px;
--	border-right-width: 1px;
--	border-bottom-width: 1px;
--	border-left-width: 1px;
--	border-top-color: #E0E0E0;
--	border-right-color: #E0E0E0;
--	border-bottom-color: #E0E0E0;
--	border-left-color: #E0E0E0;
--	border-top-style: none;
--	border-right-style: none;
--	border-bottom-style: none;
--	border-left-style: none;
--	background-color: #FAFAFA;
--	font-size: 80%;
--}
--.memTemplItemRight {
--	padding: 1px 8px 0px 8px;
--	margin: 4px;
--	border-top-width: 1px;
--	border-right-width: 1px;
--	border-bottom-width: 1px;
--	border-left-width: 1px;
--	border-top-color: #E0E0E0;
--	border-right-color: #E0E0E0;
--	border-bottom-color: #E0E0E0;
--	border-left-color: #E0E0E0;
--	border-top-style: none;
--	border-right-style: none;
--	border-bottom-style: none;
--	border-left-style: none;
--	background-color: #FAFAFA;
--	font-size: 80%;
--}
--.memTemplParams {
--	padding: 1px 0px 0px 8px;
--	margin: 4px;
--	border-top-width: 1px;
--	border-right-width: 1px;
--	border-bottom-width: 1px;
--	border-left-width: 1px;
--	border-top-color: #E0E0E0;
--	border-right-color: #E0E0E0;
--	border-bottom-color: #E0E0E0;
--	border-left-color: #E0E0E0;
--	border-top-style: solid;
--	border-right-style: none;
--	border-bottom-style: none;
--	border-left-style: none;
--       color: #606060;
--	background-color: #FAFAFA;
--	font-size: 80%;
--}
--.search     { color: #003399;
--              font-weight: bold;
--}
--FORM.search {
--              margin-bottom: 0px;
--              margin-top: 0px;
--}
--INPUT.search { font-size: 75%;
--               color: #000080;
--               font-weight: normal;
--               background-color: #e8eef2;
--}
--TD.tiny      { font-size: 75%;
--}
--a {
--	color: #1A41A8;
--}
--a:visited {
--	color: #2A3798;
--}
--.dirtab { padding: 4px;
--          border-collapse: collapse;
--          border: 1px solid #84b0c7;
--}
--TH.dirtab { background: #e8eef2;
--            font-weight: bold;
--}
--HR { height: 1px;
--     border: none;
--     border-top: 1px solid black;
--}
--
-diff --git a/doc/ccapi/html/doxygen.png b/doc/ccapi/html/doxygen.png
-deleted file mode 100644
-index f0a274bbaffdd67f6d784c894d9cf28729db0e14..0000000000000000000000000000000000000000
-GIT binary patch
-literal 0
-HcmV?d00001
-
-literal 1281
-zcmaJ>ZA?>F7(Vx-ms?uoS`b@hdRtpo6o^%HU>M$hfGrBvQnk$LE?p^P!kn&ikhyq!
-zX~V@&tPF5Qt@V?oTL96Bi%aRiwbe1)9DWQI#?)=HxS7QSw`J`5fAJ*eJbB;uNuKA&
-zdERDo*{Y<(If(#(B$Lr#;nB(8Y#ia=ZCeW?JfPLuQY`=@cW$k<E#YgKyU6A)-{x|^
-zSGl7KXr0>}Rivq|vbxGrRq1Tl9;+(gNt?}UtVKM2`T5t1jLzuL@0UIs`S#vlhl4)^
-zLgSYrPj@$+`|j?eSbXTmiHGkWxV8V}BzNR?pl9k_s4pDu9vd5a_UzZEPk)}Ad{AV_
-zzddrjrh4=Imr`E06;LY{)YYt?o}L~H@7C}F^WB!Ra=v`Q0bj{>5&$66CWF>mf6vjP
-z2N>RRY6ZYa=K`76>+|_)Xdwko+7wv}7cN|btOhWb(*{sta~6b?S8Omrxw}!4`NhGr
-zZVpNqpu1@BE`QGWNTpEpcJVW5izu~2B^GlM?1(OPg)zwW;QcP@Ltcclm>XbJL9C|j
-z=9!2?ua=uIlf0%AndzHsRC}IyTL$EhAee(fdKB`?27KeS^2M8M_7b~PiCFO&r5LC7
-z7gl1*a<8;SjNaw#h=<QpmK-G;Lf4e&V2d=^tR-#`t2BurQJOTOE{;Md(U^YATvO9;
-z4I{}xnO7yBM>843_AV9iZbWQOAp5YOC<O7w$v(XmmnwC^@m*|0aAjjE>^&_F*9K0>
-zB|6%IDb?aM#3viTxkLU4aXg&@+CkNTOnQ1iMP*^?b|^lJy$4C)Zk4isV!|RZ*XhXh
-zw8q3$=*0LeGC!XI_Wc?dkT~3+*Gu%%yIqP+Wr3H$=&ROMQU6q}Ag^P~>c5vAEO;a-
-z_dK-3PPeKar%)6$j~vI2#*-YH!1h6HYVtwCX5<p!%bpC+9i87oHVCn|I#9D0y75yR
-zJQw6@XOIl@W*@`MO)nfJ(~u64Ti&rqof91tY=qXq60BRhWOS4$CDxC!em~1jh-png
-zMQbqLAY5D^T1w#X8?O-qH1wySN^Vc%NP{4{h{zG;E!}$|eE+h%Hm#yUOJ?KC*`ks?
-zg5U;TkLo;*pf;P0%=IQeNQ_f?#PVTUhNoDZxUQGUH3=1|@R(5HX`||Q00@omW7Cby
-zG3}hVgdpg4SAsAW?b7eVFog|lSRBK9F6hM$YKiX{6f!1;(xQhEoP0Y|t_BIevE;GE
-z2XYZEQ>_wM`iF#<P$gppapp|;Uq{ni$l=L?-jUr0@GynF0>UKz&&@9Oo5w3%XGYrX
-zW>dY~)SG-((Yim%`InwgTvyRC?e=Wh^8KCao!R6Eg&TpVWUY1sN~4G}V?nFnEGo-;
-zHZ_$eW9-Gn<k9lt5=<Gn#tdKEGn{-<%Byf5PjhNGEXtL9?1Q5B9|(jXyZ>C%^WS9b
-z@p;-$oH#MtC0v>Q$HX%4^JdFdO$0cbv-W)<ywG@<$zg!vlj4LU*RM0<PuQ#drYOO8
-zy6=MA*)e0Fy56&kb@AEitV_wv%*^l2NvbRbkf9MHGWaz8UmSybRXkz#i*n0Az)7>Q
-TtK}Eh@>>I#ipmV1>S*>q-hkC}
-
-diff --git a/doc/ccapi/html/group__cc__ccache__iterator__reference.html b/doc/ccapi/html/group__cc__ccache__iterator__reference.html
-deleted file mode 100644
-index 2c8bfe27b..000000000
---- a/doc/ccapi/html/group__cc__ccache__iterator__reference.html
-+++ /dev/null
-@@ -1,96 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_ccache_iterator_t Overview</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_ccache_iterator_t Overview</h1><hr><a name="_details"></a><h2>Detailed Description</h2>
--The cc_ccache_iterator_t type represents an iterator that iterates over a set of ccaches and returns them in all in some order. A new instance of this type can be obtained by calling <a class="el" href="group__helper__macros.html#g6957bc9570e4769a5b1213d2a1d90cd7">cc_context_new_ccache_iterator()</a>.<p>
--For API function documentation see <a class="el" href="structcc__ccache__iterator__f.html">cc_ccache_iterator_f</a>. 
--<p>
--<h2>Data Structures</h2>
--<ul>
--<li>struct <a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_d</a>
--</ul>
--<h2>Typedefs</h2>
--<ul>
--<li>typedef <a class="el" href="structcc__ccache__iterator__f.html">cc_ccache_iterator_f</a> <a class="el" href="group__cc__ccache__iterator__reference.html#g55a6d891b6840466cc956bdd327dc314">cc_ccache_iterator_f</a>
--<li>typedef <a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_d</a> <a class="el" href="group__cc__ccache__iterator__reference.html#g0ab4121cf78b7e0f92a90e9d4c15f0cf">cc_ccache_iterator_d</a>
--<li>typedef <a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_d</a> * <a class="el" href="group__cc__ccache__iterator__reference.html#gce800a50d1fe0dcb05b6be0884232318">cc_ccache_iterator_t</a>
--</ul>
--<hr><h2>Typedef Documentation</h2>
--<a class="anchor" name="g55a6d891b6840466cc956bdd327dc314"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_iterator_f" ref="g55a6d891b6840466cc956bdd327dc314" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__ccache__iterator__f.html">cc_ccache_iterator_f</a> <a class="el" href="structcc__ccache__iterator__f.html">cc_ccache_iterator_f</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g0ab4121cf78b7e0f92a90e9d4c15f0cf"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_iterator_d" ref="g0ab4121cf78b7e0f92a90e9d4c15f0cf" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_d</a> <a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_d</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="gce800a50d1fe0dcb05b6be0884232318"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_iterator_t" ref="gce800a50d1fe0dcb05b6be0884232318" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef <a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_d</a>* <a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_t</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/group__cc__ccache__reference.html b/doc/ccapi/html/group__cc__ccache__reference.html
-deleted file mode 100644
-index ce47b73c6..000000000
---- a/doc/ccapi/html/group__cc__ccache__reference.html
-+++ /dev/null
-@@ -1,96 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_ccache_t Overview</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_ccache_t Overview</h1><hr><a name="_details"></a><h2>Detailed Description</h2>
--The cc_ccache_t type represents a reference to a ccache. Callers can access a ccache and the credentials stored in it via a cc_ccache_t. A cc_ccache_t can be acquired via <a class="el" href="group__helper__macros.html#g256a5ba17fe0e4502e0722d9b081bbef">cc_context_open_ccache()</a>, <a class="el" href="group__helper__macros.html#g45a7ce29eb409baabadcae1bc95d5c57">cc_context_open_default_ccache()</a>, or <a class="el" href="group__helper__macros.html#gcff0b3e247a2adc95442324fec6c5651">cc_ccache_iterator_next()</a>.<p>
--For API function documentation see <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a>. 
--<p>
--<h2>Data Structures</h2>
--<ul>
--<li>struct <a class="el" href="structcc__ccache__d.html">cc_ccache_d</a>
--</ul>
--<h2>Typedefs</h2>
--<ul>
--<li>typedef <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> <a class="el" href="group__cc__ccache__reference.html#ga88aed938d3678e263f6507fcd6e5e38">cc_ccache_f</a>
--<li>typedef <a class="el" href="structcc__ccache__d.html">cc_ccache_d</a> <a class="el" href="group__cc__ccache__reference.html#g8eaae84d4f6a48e1e21eb4fe8a0b367a">cc_ccache_d</a>
--<li>typedef <a class="el" href="structcc__ccache__d.html">cc_ccache_d</a> * <a class="el" href="group__cc__ccache__reference.html#gf59e3c32bf0b7d9cc409438cebb2f048">cc_ccache_t</a>
--</ul>
--<hr><h2>Typedef Documentation</h2>
--<a class="anchor" name="ga88aed938d3678e263f6507fcd6e5e38"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_f" ref="ga88aed938d3678e263f6507fcd6e5e38" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g8eaae84d4f6a48e1e21eb4fe8a0b367a"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_d" ref="g8eaae84d4f6a48e1e21eb4fe8a0b367a" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__ccache__d.html">cc_ccache_d</a> <a class="el" href="structcc__ccache__d.html">cc_ccache_d</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="gf59e3c32bf0b7d9cc409438cebb2f048"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_t" ref="gf59e3c32bf0b7d9cc409438cebb2f048" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef <a class="el" href="structcc__ccache__d.html">cc_ccache_d</a>* <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/group__cc__context__reference.html b/doc/ccapi/html/group__cc__context__reference.html
-deleted file mode 100644
-index cd7e6be3d..000000000
---- a/doc/ccapi/html/group__cc__context__reference.html
-+++ /dev/null
-@@ -1,161 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_context_t Overview</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_context_t Overview</h1><hr><a name="_details"></a><h2>Detailed Description</h2>
--The cc_context_t type gives the caller access to a ccache collection. Before being able to call any functions in the CCache API, the caller needs to acquire an instance of cc_context_t by calling <a class="el" href="group__cc__context__reference.html#ge4174587d8bb261e32194bbb9585fb82">cc_initialize()</a>.<p>
--For API function documentation see <a class="el" href="structcc__context__f.html">cc_context_f</a>. 
--<p>
--<h2>Data Structures</h2>
--<ul>
--<li>struct <a class="el" href="structcc__context__d.html">cc_context_d</a>
--</ul>
--<h2>Typedefs</h2>
--<ul>
--<li>typedef <a class="el" href="structcc__context__f.html">cc_context_f</a> <a class="el" href="group__cc__context__reference.html#gf285100b13ebff78db5ce1efb30e689d">cc_context_f</a>
--<li>typedef <a class="el" href="structcc__context__d.html">cc_context_d</a> <a class="el" href="group__cc__context__reference.html#g989a601250a2a05fd23b46c546084add">cc_context_d</a>
--<li>typedef <a class="el" href="structcc__context__d.html">cc_context_d</a> * <a class="el" href="group__cc__context__reference.html#gea6f60fd799984a7178bcb4d4c7290c0">cc_context_t</a>
--</ul>
--<h2>Functions</h2>
--<ul>
--<li>CCACHE_API <a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> <a class="el" href="group__cc__context__reference.html#ge4174587d8bb261e32194bbb9585fb82">cc_initialize</a> (<a class="el" href="structcc__context__d.html">cc_context_t</a> *out_context, <a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> in_version, <a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> *out_supported_version, char const **out_vendor)
--<dl class="el"><dd class="mdescRight">Initialize a new cc_context.  <a href="#ge4174587d8bb261e32194bbb9585fb82"></a><br></dl></ul>
--<hr><h2>Typedef Documentation</h2>
--<a class="anchor" name="gf285100b13ebff78db5ce1efb30e689d"></a><!-- doxytag: member="CredentialsCache.h::cc_context_f" ref="gf285100b13ebff78db5ce1efb30e689d" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__context__f.html">cc_context_f</a> <a class="el" href="structcc__context__f.html">cc_context_f</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g989a601250a2a05fd23b46c546084add"></a><!-- doxytag: member="CredentialsCache.h::cc_context_d" ref="g989a601250a2a05fd23b46c546084add" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__context__d.html">cc_context_d</a> <a class="el" href="structcc__context__d.html">cc_context_d</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="gea6f60fd799984a7178bcb4d4c7290c0"></a><!-- doxytag: member="CredentialsCache.h::cc_context_t" ref="gea6f60fd799984a7178bcb4d4c7290c0" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef <a class="el" href="structcc__context__d.html">cc_context_d</a>* <a class="el" href="structcc__context__d.html">cc_context_t</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr><h2>Function Documentation</h2>
--<a class="anchor" name="ge4174587d8bb261e32194bbb9585fb82"></a><!-- doxytag: member="CredentialsCache.h::cc_initialize" ref="ge4174587d8bb261e32194bbb9585fb82" args="(cc_context_t *out_context, cc_int32 in_version, cc_int32 *out_supported_version, char const **out_vendor)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">CCACHE_API <a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> cc_initialize           </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top"><a class="el" href="structcc__context__d.html">cc_context_t</a> *&nbsp;</td>
--          <td class="mdname" nowrap> <em>out_context</em>, </td>
--        </tr>
--        <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>&nbsp;</td>
--          <td class="mdname" nowrap> <em>in_version</em>, </td>
--        </tr>
--        <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> *&nbsp;</td>
--          <td class="mdname" nowrap> <em>out_supported_version</em>, </td>
--        </tr>
--        <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>char const **&nbsp;</td>
--          <td class="mdname" nowrap> <em>out_vendor</em></td>
--        </tr>
--        <tr>
--          <td class="md"></td>
--          <td class="md">)&nbsp;</td>
--          <td class="md" colspan="2"></td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Initialize a new cc_context. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>out_context</em>&nbsp;</td><td>on exit, a new context object. Must be free with <a class="el" href="group__helper__macros.html#g8ff82ce108889d4ed29f46ffe6efc40e">cc_context_release()</a>. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_version</em>&nbsp;</td><td>the requested API version. This should be the maximum version the application supports. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_supported_version</em>&nbsp;</td><td>if non-NULL, on exit contains the maximum API version supported by the implementation. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_vendor</em>&nbsp;</td><td>if non-NULL, on exit contains a pointer to a read-only C string which contains a string describing the vendor which implemented the credentials cache API. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. May return CCAPI v2 error CC_BAD_API_VERSION if <a class="el" href="group__ccapi__constants__reference.html#gg06fc87d81c62e9abb8790b6e5713c55bafee271af4e43ec6c9bb2e3e849cc1f9">ccapi_version_2</a> is passed in. </dd></dl>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/group__cc__credentials__iterator__reference.html b/doc/ccapi/html/group__cc__credentials__iterator__reference.html
-deleted file mode 100644
-index 41ba42f86..000000000
---- a/doc/ccapi/html/group__cc__credentials__iterator__reference.html
-+++ /dev/null
-@@ -1,133 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_credentials_iterator_t</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_credentials_iterator_t</h1><hr><a name="_details"></a><h2>Detailed Description</h2>
--The cc_credentials_iterator_t type represents an iterator that iterates over a set of credentials. A new instance of this type can be obtained by calling <a class="el" href="group__helper__macros.html#g893b31c419e71c2f528781d3036fa3ff">cc_ccache_new_credentials_iterator()</a>.<p>
--For API function documentation see <a class="el" href="structcc__credentials__iterator__f.html">cc_credentials_iterator_f</a>. 
--<p>
--<h2>Data Structures</h2>
--<ul>
--<li>struct <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_d</a>
--</ul>
--<h2>Typedefs</h2>
--<ul>
--<li>typedef <a class="el" href="structcc__credentials__iterator__f.html">cc_credentials_iterator_f</a> <a class="el" href="group__cc__credentials__iterator__reference.html#g220581901999fe870ab65046e56cd1d6">cc_credentials_iterator_f</a>
--<li>typedef <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_d</a> <a class="el" href="group__cc__credentials__iterator__reference.html#ga1ad98d009f803bb13c04331bb47aee8">cc_credentials_iterator_d</a>
--<li>typedef <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_d</a> * <a class="el" href="group__cc__credentials__iterator__reference.html#g0d07a146ead685954032d0d7a6af7d4a">cc_credentials_iterator_t</a>
--</ul>
--<h2>Variables</h2>
--<ul>
--<li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="group__cc__credentials__iterator__reference.html#g7d765e583b5994785e214df663e8959c">cc_credentials_iterator_f::clone</a> )(<a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> in_credentials_iterator, <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> *out_credentials_iterator)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g59a9f96a6c00b64c0ab971f7e9b5aae2">cc_credentials_iterator_clone()</a></b>: Make a copy of a credentials iterator.  <a href="#g7d765e583b5994785e214df663e8959c"></a><br></dl></ul>
--<hr><h2>Typedef Documentation</h2>
--<a class="anchor" name="g220581901999fe870ab65046e56cd1d6"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_iterator_f" ref="g220581901999fe870ab65046e56cd1d6" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__credentials__iterator__f.html">cc_credentials_iterator_f</a> <a class="el" href="structcc__credentials__iterator__f.html">cc_credentials_iterator_f</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="ga1ad98d009f803bb13c04331bb47aee8"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_iterator_d" ref="ga1ad98d009f803bb13c04331bb47aee8" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_d</a> <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_d</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g0d07a146ead685954032d0d7a6af7d4a"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_iterator_t" ref="g0d07a146ead685954032d0d7a6af7d4a" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_d</a>* <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr><h2>Variable Documentation</h2>
--<a class="anchor" name="g7d765e583b5994785e214df663e8959c"></a><!-- doxytag: member="cc_credentials_iterator_f::clone" ref="g7d765e583b5994785e214df663e8959c" args=")(cc_credentials_iterator_t in_credentials_iterator, cc_credentials_iterator_t *out_credentials_iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* clone)(<a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> in_credentials_iterator, <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> *out_credentials_iterator)<code> [inherited]</code>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g59a9f96a6c00b64c0ab971f7e9b5aae2">cc_credentials_iterator_clone()</a></b>: Make a copy of a credentials iterator. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_credentials_iterator</em>&nbsp;</td><td>a credentials iterator object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_credentials_iterator</em>&nbsp;</td><td>on exit, a copy of <em>in_credentials_iterator</em>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/group__cc__credentials__reference.html b/doc/ccapi/html/group__cc__credentials__reference.html
-deleted file mode 100644
-index d083e6c07..000000000
---- a/doc/ccapi/html/group__cc__credentials__reference.html
-+++ /dev/null
-@@ -1,197 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_credentials_t Overview</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_credentials_t Overview</h1><hr><a name="_details"></a><h2>Detailed Description</h2>
--The cc_credentials_t type is used to store a single set of credentials for either Kerberos v4 or Kerberos v5. In addition to its only function, release(), it contains a pointer to a <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a> structure. A <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a> structure contains an integer of the enumerator type cc_credentials_version, which is either <a class="el" href="group__ccapi__constants__reference.html#ggae76da96fff95c157c3b28c4455dc35c017c26531bad42f92f7f3e1f697b58fa">cc_credentials_v4</a> or <a class="el" href="group__ccapi__constants__reference.html#ggae76da96fff95c157c3b28c4455dc35c98335a31ad81a10632568375dcc10668">cc_credentials_v5</a>, and a pointer union, which contains either a <a class="el" href="structcc__credentials__v4__t.html">cc_credentials_v4_t</a> pointer or a <a class="el" href="structcc__credentials__v5__t.html">cc_credentials_v5_t</a> pointer, depending on the value in version.<p>
--Variables of the type cc_credentials_t are allocated by the CCAPI implementation, and should be released with their release() function. API functions which receive credentials structures from the caller always accept <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a>, which is allocated by the caller, and accordingly disposed by the caller.<p>
--For API functions see <a class="el" href="structcc__credentials__f.html">cc_credentials_f</a>. 
--<p>
--<h2>Data Structures</h2>
--<ul>
--<li>struct <a class="el" href="structcc__credentials__v4__t.html">cc_credentials_v4_t</a>
--<li>struct <a class="el" href="structcc__data.html">cc_data</a>
--<li>struct <a class="el" href="structcc__credentials__v5__t.html">cc_credentials_v5_t</a>
--<li>struct <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a>
--<li>struct <a class="el" href="structcc__credentials__d.html">cc_credentials_d</a>
--</ul>
--<h2>Typedefs</h2>
--<ul>
--<li>typedef <a class="el" href="structcc__credentials__v4__t.html">cc_credentials_v4_t</a> <a class="el" href="group__cc__credentials__reference.html#g15918c5c162aa2edf2bd1890f8a78c70">cc_credentials_v4_t</a>
--<li>typedef <a class="el" href="structcc__data.html">cc_data</a> <a class="el" href="group__cc__credentials__reference.html#g5004a9b025c5cef3364c4a614b700f50">cc_data</a>
--<li>typedef <a class="el" href="structcc__credentials__v5__t.html">cc_credentials_v5_t</a> <a class="el" href="group__cc__credentials__reference.html#g5e882157ba93358ac4a78760a2ccdbd6">cc_credentials_v5_t</a>
--<li>typedef <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a> <a class="el" href="group__cc__credentials__reference.html#ge277840865f515373fcab3c6299901a3">cc_credentials_union</a>
--<li>typedef <a class="el" href="structcc__credentials__f.html">cc_credentials_f</a> <a class="el" href="group__cc__credentials__reference.html#g85b7bf154216b8f780ddaae4b8b0a96c">cc_credentials_f</a>
--<li>typedef <a class="el" href="structcc__credentials__d.html">cc_credentials_d</a> <a class="el" href="group__cc__credentials__reference.html#g04cec8816d2e51bb3ee5b1b3c1f5429d">cc_credentials_d</a>
--<li>typedef <a class="el" href="structcc__credentials__d.html">cc_credentials_d</a> * <a class="el" href="group__cc__credentials__reference.html#gf7b0ec03495a6818dd9cd0c1d395ece2">cc_credentials_t</a>
--</ul>
--<hr><h2>Typedef Documentation</h2>
--<a class="anchor" name="g15918c5c162aa2edf2bd1890f8a78c70"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_v4_t" ref="g15918c5c162aa2edf2bd1890f8a78c70" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__credentials__v4__t.html">cc_credentials_v4_t</a> <a class="el" href="structcc__credentials__v4__t.html">cc_credentials_v4_t</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g5004a9b025c5cef3364c4a614b700f50"></a><!-- doxytag: member="CredentialsCache.h::cc_data" ref="g5004a9b025c5cef3364c4a614b700f50" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__data.html">cc_data</a> <a class="el" href="structcc__data.html">cc_data</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g5e882157ba93358ac4a78760a2ccdbd6"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_v5_t" ref="g5e882157ba93358ac4a78760a2ccdbd6" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__credentials__v5__t.html">cc_credentials_v5_t</a> <a class="el" href="structcc__credentials__v5__t.html">cc_credentials_v5_t</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="ge277840865f515373fcab3c6299901a3"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_union" ref="ge277840865f515373fcab3c6299901a3" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a> <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g85b7bf154216b8f780ddaae4b8b0a96c"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_f" ref="g85b7bf154216b8f780ddaae4b8b0a96c" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__credentials__f.html">cc_credentials_f</a> <a class="el" href="structcc__credentials__f.html">cc_credentials_f</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g04cec8816d2e51bb3ee5b1b3c1f5429d"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_d" ref="g04cec8816d2e51bb3ee5b1b3c1f5429d" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__credentials__d.html">cc_credentials_d</a> <a class="el" href="structcc__credentials__d.html">cc_credentials_d</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="gf7b0ec03495a6818dd9cd0c1d395ece2"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_t" ref="gf7b0ec03495a6818dd9cd0c1d395ece2" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef <a class="el" href="structcc__credentials__d.html">cc_credentials_d</a>* <a class="el" href="structcc__credentials__d.html">cc_credentials_t</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/group__cc__string__reference.html b/doc/ccapi/html/group__cc__string__reference.html
-deleted file mode 100644
-index 9ce3b7195..000000000
---- a/doc/ccapi/html/group__cc__string__reference.html
-+++ /dev/null
-@@ -1,96 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_string_t Overview</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_string_t Overview</h1><hr><a name="_details"></a><h2>Detailed Description</h2>
--The cc_string_t represents a C string returned by the API. It has a pointer to the string data and a release() function. This type is used for both principal names and ccache names returned by the API. Principal names may contain UTF-8 encoded strings for internationalization purposes.<p>
--For API function documentation see <a class="el" href="structcc__string__f.html">cc_string_f</a>. 
--<p>
--<h2>Data Structures</h2>
--<ul>
--<li>struct <a class="el" href="structcc__string__d.html">cc_string_d</a>
--</ul>
--<h2>Typedefs</h2>
--<ul>
--<li>typedef <a class="el" href="structcc__string__f.html">cc_string_f</a> <a class="el" href="group__cc__string__reference.html#g3d01e5c05378e9e78f126156137d51ce">cc_string_f</a>
--<li>typedef <a class="el" href="structcc__string__d.html">cc_string_d</a> <a class="el" href="group__cc__string__reference.html#g80f57852683632a4c587af5b0f545dea">cc_string_d</a>
--<li>typedef <a class="el" href="structcc__string__d.html">cc_string_d</a> * <a class="el" href="group__cc__string__reference.html#ge6bb6a8c574096b66b5def65eb87a40e">cc_string_t</a>
--</ul>
--<hr><h2>Typedef Documentation</h2>
--<a class="anchor" name="g3d01e5c05378e9e78f126156137d51ce"></a><!-- doxytag: member="CredentialsCache.h::cc_string_f" ref="g3d01e5c05378e9e78f126156137d51ce" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__string__f.html">cc_string_f</a> <a class="el" href="structcc__string__f.html">cc_string_f</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g80f57852683632a4c587af5b0f545dea"></a><!-- doxytag: member="CredentialsCache.h::cc_string_d" ref="g80f57852683632a4c587af5b0f545dea" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef struct <a class="el" href="structcc__string__d.html">cc_string_d</a> <a class="el" href="structcc__string__d.html">cc_string_d</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="ge6bb6a8c574096b66b5def65eb87a40e"></a><!-- doxytag: member="CredentialsCache.h::cc_string_t" ref="ge6bb6a8c574096b66b5def65eb87a40e" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef <a class="el" href="structcc__string__d.html">cc_string_d</a>* <a class="el" href="structcc__string__d.html">cc_string_t</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/group__ccapi__constants__reference.html b/doc/ccapi/html/group__ccapi__constants__reference.html
-deleted file mode 100644
-index 87ec30b83..000000000
---- a/doc/ccapi/html/group__ccapi__constants__reference.html
-+++ /dev/null
-@@ -1,407 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : Constants</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>Constants</h1>
--<p>
--<h2>Enumerations</h2>
--<ul>
--<li>enum { <br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#gg06fc87d81c62e9abb8790b6e5713c55bafee271af4e43ec6c9bb2e3e849cc1f9">ccapi_version_2</a> =  2, 
--<a class="el" href="group__ccapi__constants__reference.html#gg06fc87d81c62e9abb8790b6e5713c55b26f201de4113dda3b4ec78dcda95d5a1">ccapi_version_3</a> =  3, 
--<a class="el" href="group__ccapi__constants__reference.html#gg06fc87d81c62e9abb8790b6e5713c55b833d16677b6eb5531fb1285b216c8f3b">ccapi_version_4</a> =  4, 
--<a class="el" href="group__ccapi__constants__reference.html#gg06fc87d81c62e9abb8790b6e5713c55bc3ad534e2499e8e48c86f852c39c8415">ccapi_version_5</a> =  5, 
--<br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#gg06fc87d81c62e9abb8790b6e5713c55bc462c2766a9fe8fa84d8fccea65b8ab3">ccapi_version_6</a> =  6, 
--<a class="el" href="group__ccapi__constants__reference.html#gg06fc87d81c62e9abb8790b6e5713c55b9c325640a04bb548b92d49df89381bc8">ccapi_version_7</a> =  7, 
--<a class="el" href="group__ccapi__constants__reference.html#gg06fc87d81c62e9abb8790b6e5713c55bc33d8c3e3c172be1515cc0d2df8e3d71">ccapi_version_max</a> =  ccapi_version_7
--<br>
-- }
--<li>enum { <br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a> =  0, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b748d5a55ed773e002ccc271beb4512c0a">ccIteratorEnd</a> =  201, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b775735bfd0c621b1c5c2a0067f60cfa9d">ccErrBadParam</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b74f31ee78c32ed1bea75d364ccbf1e690">ccErrNoMem</a>, 
--<br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7d9bf97d9c57a6a14ac5b6a7a06e008f7">ccErrInvalidContext</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b708791e8ed735ecc02c1e6b222f913c71">ccErrInvalidCCache</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b742b40a71ad0c84171c8d982f6cfdeec9">ccErrInvalidString</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b78705dd3f7b52ce8e23e9a25f552b4a84">ccErrInvalidCredentials</a>, 
--<br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7fbc118bc7860198fc6a0b8e4a161363a">ccErrInvalidCCacheIterator</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b751c0c94d8b4dfb834b27fa7090f7b4f2">ccErrInvalidCredentialsIterator</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b73e2425cf044691597d10bbc14b3c90ba">ccErrInvalidLock</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7b508b53d9628aa7e0fca3253d619e78e">ccErrBadName</a>, 
--<br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7d2f35f60002115819c8c443e67191ea4">ccErrBadCredentialsVersion</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b759ae48c63ae4aaaa3cd7bc5504847660">ccErrBadAPIVersion</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b78df04862b2e05986499f0d93268fa7b8">ccErrContextLocked</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b71606d0e0540ead205a400306e5933c04">ccErrContextUnlocked</a>, 
--<br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7a453f3f6d7e578f47efbb1734cb46002">ccErrCCacheLocked</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7d3ebfa156acf72a3a86f14760d315e24">ccErrCCacheUnlocked</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7b0fa85b2c59d51c3ec205e40191e7619">ccErrBadLockType</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7604f23ab0c8c3e1d97f8b32c4501a895">ccErrNeverDefault</a>, 
--<br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b74c8c5082e236270c5dc55e998dfb9288">ccErrCredentialsNotFound</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b73098feac66058e6ebd02c5e44fa20a9c">ccErrCCacheNotFound</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b793bd0c54010e2a36d2e2af1e8aaef06f">ccErrContextNotFound</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7267b21d05e1f4005392c52e439de03a4">ccErrServerUnavailable</a>, 
--<br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7a18e1555d7af1a60ce1978069e95fe6f">ccErrServerInsecure</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7fd9fdcb22b761cb3e53e1d6d6b545884">ccErrServerCantBecomeUID</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7d6825aa88394eb52df80bef870d986db">ccErrTimeOffsetNotSet</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b75f8cef73e4ac4c8894c4318ef921350e">ccErrBadInternalMessage</a>, 
--<br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7a35748a788a849ff09dd453ac66f8314">ccErrNotImplemented</a>, 
--<a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b79cab6af44e2358aa12f176a60e245d67">ccErrClientNotFound</a>
--<br>
-- }
--<li>enum <a class="el" href="group__ccapi__constants__reference.html#gae76da96fff95c157c3b28c4455dc35c">cc_credential_versions</a> { <a class="el" href="group__ccapi__constants__reference.html#ggae76da96fff95c157c3b28c4455dc35c017c26531bad42f92f7f3e1f697b58fa">cc_credentials_v4</a> =  1, 
--<a class="el" href="group__ccapi__constants__reference.html#ggae76da96fff95c157c3b28c4455dc35c98335a31ad81a10632568375dcc10668">cc_credentials_v5</a> =  2, 
--<a class="el" href="group__ccapi__constants__reference.html#ggae76da96fff95c157c3b28c4455dc35ca49ae6c35599f5860241601dcb0c9e0d">cc_credentials_v4_v5</a> =  3
-- }
--<li>enum <a class="el" href="group__ccapi__constants__reference.html#g2081cbacd4ec3d5a64c8729fd78fc611">cc_lock_types</a> { <a class="el" href="group__ccapi__constants__reference.html#gg2081cbacd4ec3d5a64c8729fd78fc6110a9a6083623e4c7c8340c0146f032154">cc_lock_read</a> =  0, 
--<a class="el" href="group__ccapi__constants__reference.html#gg2081cbacd4ec3d5a64c8729fd78fc611bc97eae3b375c4cee90087597b7f375d">cc_lock_write</a> =  1, 
--<a class="el" href="group__ccapi__constants__reference.html#gg2081cbacd4ec3d5a64c8729fd78fc61184bf8feb65a88dc09aa52c6d955111a3">cc_lock_upgrade</a> =  2, 
--<a class="el" href="group__ccapi__constants__reference.html#gg2081cbacd4ec3d5a64c8729fd78fc611426c331fb09e249b6944d8ba28893eba">cc_lock_downgrade</a> =  3
-- }
--<li>enum <a class="el" href="group__ccapi__constants__reference.html#g0eff5be22e263d0bd9e4bb6fb0a8e948">cc_lock_modes</a> { <a class="el" href="group__ccapi__constants__reference.html#gg0eff5be22e263d0bd9e4bb6fb0a8e9485fe1eddb0bba9df16dbcc63aeeb79aa3">cc_lock_noblock</a> =  0, 
--<a class="el" href="group__ccapi__constants__reference.html#gg0eff5be22e263d0bd9e4bb6fb0a8e94827e385feb864d167880744d0874834d8">cc_lock_block</a> =  1
-- }
--<li>enum { <br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#gg99fb83031ce9923c84392b4e92f956b5ae3147869a486588adf6bc588ee8cc30">cc_v4_name_size</a> =  40, 
--<a class="el" href="group__ccapi__constants__reference.html#gg99fb83031ce9923c84392b4e92f956b55abe44162300eabb9a9f65b324cad493">cc_v4_instance_size</a> =  40, 
--<a class="el" href="group__ccapi__constants__reference.html#gg99fb83031ce9923c84392b4e92f956b5714d28ea3d6c6807817d7b377afc22f8">cc_v4_realm_size</a> =  40, 
--<a class="el" href="group__ccapi__constants__reference.html#gg99fb83031ce9923c84392b4e92f956b5b52bd33d187632efd597f282540b081a">cc_v4_ticket_size</a> =  1254, 
--<br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#gg99fb83031ce9923c84392b4e92f956b57532f28276c3a759e487560ee4666a29">cc_v4_key_size</a> =  8
--<br>
-- }
--<li>enum <a class="el" href="group__ccapi__constants__reference.html#ge78c8fbb79f8ff963ec7c88c431721c3">cc_string_to_key_type</a> { <br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#gge78c8fbb79f8ff963ec7c88c431721c3c0beda03d5c9e36ce9a199c98573d39a">cc_v4_stk_afs</a> =  0, 
--<a class="el" href="group__ccapi__constants__reference.html#gge78c8fbb79f8ff963ec7c88c431721c31b71e069604cd1cebc2b694ef04aedd1">cc_v4_stk_des</a> =  1, 
--<a class="el" href="group__ccapi__constants__reference.html#gge78c8fbb79f8ff963ec7c88c431721c3db66296923c38aa2d7c7420da28d7014">cc_v4_stk_columbia_special</a> =  2, 
--<a class="el" href="group__ccapi__constants__reference.html#gge78c8fbb79f8ff963ec7c88c431721c3816b6bb45f51557bc3de5e13d38dc310">cc_v4_stk_krb5</a> =  3, 
--<br>
--&nbsp;&nbsp;<a class="el" href="group__ccapi__constants__reference.html#gge78c8fbb79f8ff963ec7c88c431721c3e19e1a52a4289172671e91d87ab027bb">cc_v4_stk_unknown</a> =  4
--<br>
-- }
--</ul>
--<hr><h2>Enumeration Type Documentation</h2>
--<a class="anchor" name="g06fc87d81c62e9abb8790b6e5713c55b"></a><!-- doxytag: member="CredentialsCache.h::@0" ref="g06fc87d81c62e9abb8790b6e5713c55b" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">anonymous enum          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--API version numbers<p>
--These constants are passed into <a class="el" href="group__cc__context__reference.html#ge4174587d8bb261e32194bbb9585fb82">cc_initialize()</a> to indicate the version of the API the caller wants to use.<p>
--CCAPI v1 and v2 are deprecated and should not be used. <dl compact><dt><b>Enumerator: </b></dt><dd>
--<table border="0" cellspacing="2" cellpadding="0">
--<tr><td valign="top"><em><a class="anchor" name="gg06fc87d81c62e9abb8790b6e5713c55bafee271af4e43ec6c9bb2e3e849cc1f9"></a><!-- doxytag: member="ccapi_version_2" ref="gg06fc87d81c62e9abb8790b6e5713c55bafee271af4e43ec6c9bb2e3e849cc1f9" args="" -->ccapi_version_2</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg06fc87d81c62e9abb8790b6e5713c55b26f201de4113dda3b4ec78dcda95d5a1"></a><!-- doxytag: member="ccapi_version_3" ref="gg06fc87d81c62e9abb8790b6e5713c55b26f201de4113dda3b4ec78dcda95d5a1" args="" -->ccapi_version_3</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg06fc87d81c62e9abb8790b6e5713c55b833d16677b6eb5531fb1285b216c8f3b"></a><!-- doxytag: member="ccapi_version_4" ref="gg06fc87d81c62e9abb8790b6e5713c55b833d16677b6eb5531fb1285b216c8f3b" args="" -->ccapi_version_4</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg06fc87d81c62e9abb8790b6e5713c55bc3ad534e2499e8e48c86f852c39c8415"></a><!-- doxytag: member="ccapi_version_5" ref="gg06fc87d81c62e9abb8790b6e5713c55bc3ad534e2499e8e48c86f852c39c8415" args="" -->ccapi_version_5</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg06fc87d81c62e9abb8790b6e5713c55bc462c2766a9fe8fa84d8fccea65b8ab3"></a><!-- doxytag: member="ccapi_version_6" ref="gg06fc87d81c62e9abb8790b6e5713c55bc462c2766a9fe8fa84d8fccea65b8ab3" args="" -->ccapi_version_6</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg06fc87d81c62e9abb8790b6e5713c55b9c325640a04bb548b92d49df89381bc8"></a><!-- doxytag: member="ccapi_version_7" ref="gg06fc87d81c62e9abb8790b6e5713c55b9c325640a04bb548b92d49df89381bc8" args="" -->ccapi_version_7</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg06fc87d81c62e9abb8790b6e5713c55bc33d8c3e3c172be1515cc0d2df8e3d71"></a><!-- doxytag: member="ccapi_version_max" ref="gg06fc87d81c62e9abb8790b6e5713c55bc33d8c3e3c172be1515cc0d2df8e3d71" args="" -->ccapi_version_max</em>&nbsp;</td><td>
--</td></tr>
--</table>
--</dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="gdf764cbdea00d65edcd07bb9953ad2b7"></a><!-- doxytag: member="CredentialsCache.h::@1" ref="gdf764cbdea00d65edcd07bb9953ad2b7" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">anonymous enum          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Error codes <dl compact><dt><b>Enumerator: </b></dt><dd>
--<table border="0" cellspacing="2" cellpadding="0">
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26"></a><!-- doxytag: member="ccNoError" ref="ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26" args="" -->ccNoError</em>&nbsp;</td><td>
--Success. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b748d5a55ed773e002ccc271beb4512c0a"></a><!-- doxytag: member="ccIteratorEnd" ref="ggdf764cbdea00d65edcd07bb9953ad2b748d5a55ed773e002ccc271beb4512c0a" args="" -->ccIteratorEnd</em>&nbsp;</td><td>
--Iterator is done iterating. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b775735bfd0c621b1c5c2a0067f60cfa9d"></a><!-- doxytag: member="ccErrBadParam" ref="ggdf764cbdea00d65edcd07bb9953ad2b775735bfd0c621b1c5c2a0067f60cfa9d" args="" -->ccErrBadParam</em>&nbsp;</td><td>
--Bad parameter (NULL or invalid pointer where valid pointer expected). </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b74f31ee78c32ed1bea75d364ccbf1e690"></a><!-- doxytag: member="ccErrNoMem" ref="ggdf764cbdea00d65edcd07bb9953ad2b74f31ee78c32ed1bea75d364ccbf1e690" args="" -->ccErrNoMem</em>&nbsp;</td><td>
--Not enough memory to complete the operation. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7d9bf97d9c57a6a14ac5b6a7a06e008f7"></a><!-- doxytag: member="ccErrInvalidContext" ref="ggdf764cbdea00d65edcd07bb9953ad2b7d9bf97d9c57a6a14ac5b6a7a06e008f7" args="" -->ccErrInvalidContext</em>&nbsp;</td><td>
--Context is invalid (e.g., it was released). </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b708791e8ed735ecc02c1e6b222f913c71"></a><!-- doxytag: member="ccErrInvalidCCache" ref="ggdf764cbdea00d65edcd07bb9953ad2b708791e8ed735ecc02c1e6b222f913c71" args="" -->ccErrInvalidCCache</em>&nbsp;</td><td>
--CCache is invalid (e.g., it was released or destroyed). </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b742b40a71ad0c84171c8d982f6cfdeec9"></a><!-- doxytag: member="ccErrInvalidString" ref="ggdf764cbdea00d65edcd07bb9953ad2b742b40a71ad0c84171c8d982f6cfdeec9" args="" -->ccErrInvalidString</em>&nbsp;</td><td>
--String is invalid (e.g., it was released). </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b78705dd3f7b52ce8e23e9a25f552b4a84"></a><!-- doxytag: member="ccErrInvalidCredentials" ref="ggdf764cbdea00d65edcd07bb9953ad2b78705dd3f7b52ce8e23e9a25f552b4a84" args="" -->ccErrInvalidCredentials</em>&nbsp;</td><td>
--Credentials are invalid (e.g., they were released), or they have a bad version. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7fbc118bc7860198fc6a0b8e4a161363a"></a><!-- doxytag: member="ccErrInvalidCCacheIterator" ref="ggdf764cbdea00d65edcd07bb9953ad2b7fbc118bc7860198fc6a0b8e4a161363a" args="" -->ccErrInvalidCCacheIterator</em>&nbsp;</td><td>
--CCache iterator is invalid (e.g., it was released). </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b751c0c94d8b4dfb834b27fa7090f7b4f2"></a><!-- doxytag: member="ccErrInvalidCredentialsIterator" ref="ggdf764cbdea00d65edcd07bb9953ad2b751c0c94d8b4dfb834b27fa7090f7b4f2" args="" -->ccErrInvalidCredentialsIterator</em>&nbsp;</td><td>
--Credentials iterator is invalid (e.g., it was released). </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b73e2425cf044691597d10bbc14b3c90ba"></a><!-- doxytag: member="ccErrInvalidLock" ref="ggdf764cbdea00d65edcd07bb9953ad2b73e2425cf044691597d10bbc14b3c90ba" args="" -->ccErrInvalidLock</em>&nbsp;</td><td>
--Lock is invalid (e.g., it was released). </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7b508b53d9628aa7e0fca3253d619e78e"></a><!-- doxytag: member="ccErrBadName" ref="ggdf764cbdea00d65edcd07bb9953ad2b7b508b53d9628aa7e0fca3253d619e78e" args="" -->ccErrBadName</em>&nbsp;</td><td>
--Bad credential cache name format. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7d2f35f60002115819c8c443e67191ea4"></a><!-- doxytag: member="ccErrBadCredentialsVersion" ref="ggdf764cbdea00d65edcd07bb9953ad2b7d2f35f60002115819c8c443e67191ea4" args="" -->ccErrBadCredentialsVersion</em>&nbsp;</td><td>
--Credentials version is invalid. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b759ae48c63ae4aaaa3cd7bc5504847660"></a><!-- doxytag: member="ccErrBadAPIVersion" ref="ggdf764cbdea00d65edcd07bb9953ad2b759ae48c63ae4aaaa3cd7bc5504847660" args="" -->ccErrBadAPIVersion</em>&nbsp;</td><td>
--Unsupported API version. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b78df04862b2e05986499f0d93268fa7b8"></a><!-- doxytag: member="ccErrContextLocked" ref="ggdf764cbdea00d65edcd07bb9953ad2b78df04862b2e05986499f0d93268fa7b8" args="" -->ccErrContextLocked</em>&nbsp;</td><td>
--Context is already locked. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b71606d0e0540ead205a400306e5933c04"></a><!-- doxytag: member="ccErrContextUnlocked" ref="ggdf764cbdea00d65edcd07bb9953ad2b71606d0e0540ead205a400306e5933c04" args="" -->ccErrContextUnlocked</em>&nbsp;</td><td>
--Context is not locked by the caller. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7a453f3f6d7e578f47efbb1734cb46002"></a><!-- doxytag: member="ccErrCCacheLocked" ref="ggdf764cbdea00d65edcd07bb9953ad2b7a453f3f6d7e578f47efbb1734cb46002" args="" -->ccErrCCacheLocked</em>&nbsp;</td><td>
--CCache is already locked. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7d3ebfa156acf72a3a86f14760d315e24"></a><!-- doxytag: member="ccErrCCacheUnlocked" ref="ggdf764cbdea00d65edcd07bb9953ad2b7d3ebfa156acf72a3a86f14760d315e24" args="" -->ccErrCCacheUnlocked</em>&nbsp;</td><td>
--CCache is not locked by the caller. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7b0fa85b2c59d51c3ec205e40191e7619"></a><!-- doxytag: member="ccErrBadLockType" ref="ggdf764cbdea00d65edcd07bb9953ad2b7b0fa85b2c59d51c3ec205e40191e7619" args="" -->ccErrBadLockType</em>&nbsp;</td><td>
--Bad lock type. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7604f23ab0c8c3e1d97f8b32c4501a895"></a><!-- doxytag: member="ccErrNeverDefault" ref="ggdf764cbdea00d65edcd07bb9953ad2b7604f23ab0c8c3e1d97f8b32c4501a895" args="" -->ccErrNeverDefault</em>&nbsp;</td><td>
--CCache was never default. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b74c8c5082e236270c5dc55e998dfb9288"></a><!-- doxytag: member="ccErrCredentialsNotFound" ref="ggdf764cbdea00d65edcd07bb9953ad2b74c8c5082e236270c5dc55e998dfb9288" args="" -->ccErrCredentialsNotFound</em>&nbsp;</td><td>
--Matching credentials not found in the ccache. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b73098feac66058e6ebd02c5e44fa20a9c"></a><!-- doxytag: member="ccErrCCacheNotFound" ref="ggdf764cbdea00d65edcd07bb9953ad2b73098feac66058e6ebd02c5e44fa20a9c" args="" -->ccErrCCacheNotFound</em>&nbsp;</td><td>
--Matching ccache not found in the collection. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b793bd0c54010e2a36d2e2af1e8aaef06f"></a><!-- doxytag: member="ccErrContextNotFound" ref="ggdf764cbdea00d65edcd07bb9953ad2b793bd0c54010e2a36d2e2af1e8aaef06f" args="" -->ccErrContextNotFound</em>&nbsp;</td><td>
--Matching cache collection not found. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7267b21d05e1f4005392c52e439de03a4"></a><!-- doxytag: member="ccErrServerUnavailable" ref="ggdf764cbdea00d65edcd07bb9953ad2b7267b21d05e1f4005392c52e439de03a4" args="" -->ccErrServerUnavailable</em>&nbsp;</td><td>
--CCacheServer is unavailable. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7a18e1555d7af1a60ce1978069e95fe6f"></a><!-- doxytag: member="ccErrServerInsecure" ref="ggdf764cbdea00d65edcd07bb9953ad2b7a18e1555d7af1a60ce1978069e95fe6f" args="" -->ccErrServerInsecure</em>&nbsp;</td><td>
--CCacheServer has detected that it is running as the wrong user. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7fd9fdcb22b761cb3e53e1d6d6b545884"></a><!-- doxytag: member="ccErrServerCantBecomeUID" ref="ggdf764cbdea00d65edcd07bb9953ad2b7fd9fdcb22b761cb3e53e1d6d6b545884" args="" -->ccErrServerCantBecomeUID</em>&nbsp;</td><td>
--CCacheServer failed to start running as the user. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7d6825aa88394eb52df80bef870d986db"></a><!-- doxytag: member="ccErrTimeOffsetNotSet" ref="ggdf764cbdea00d65edcd07bb9953ad2b7d6825aa88394eb52df80bef870d986db" args="" -->ccErrTimeOffsetNotSet</em>&nbsp;</td><td>
--KDC time offset not set for this ccache. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b75f8cef73e4ac4c8894c4318ef921350e"></a><!-- doxytag: member="ccErrBadInternalMessage" ref="ggdf764cbdea00d65edcd07bb9953ad2b75f8cef73e4ac4c8894c4318ef921350e" args="" -->ccErrBadInternalMessage</em>&nbsp;</td><td>
--The client and CCacheServer can't communicate (e.g., a version mismatch). </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b7a35748a788a849ff09dd453ac66f8314"></a><!-- doxytag: member="ccErrNotImplemented" ref="ggdf764cbdea00d65edcd07bb9953ad2b7a35748a788a849ff09dd453ac66f8314" args="" -->ccErrNotImplemented</em>&nbsp;</td><td>
--API function not supported by this implementation. </td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggdf764cbdea00d65edcd07bb9953ad2b79cab6af44e2358aa12f176a60e245d67"></a><!-- doxytag: member="ccErrClientNotFound" ref="ggdf764cbdea00d65edcd07bb9953ad2b79cab6af44e2358aa12f176a60e245d67" args="" -->ccErrClientNotFound</em>&nbsp;</td><td>
--CCacheServer has no record of the caller's process (e.g., the server crashed). </td></tr>
--</table>
--</dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="gae76da96fff95c157c3b28c4455dc35c"></a><!-- doxytag: member="CredentialsCache.h::cc_credential_versions" ref="gae76da96fff95c157c3b28c4455dc35c" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">enum <a class="el" href="group__ccapi__constants__reference.html#gae76da96fff95c157c3b28c4455dc35c">cc_credential_versions</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Credentials versions<p>
--These constants are used in several places in the API to discern between Kerberos v4 and Kerberos v5. Not all values are valid inputs and outputs for all functions; function specifications below detail the allowed values.<p>
--Kerberos version constants will always be a bit-field, and can be tested as such; for example the following test will tell you if a ccacheVersion includes v5 credentials:<p>
--if ((ccacheVersion &amp; cc_credentials_v5) != 0) <dl compact><dt><b>Enumerator: </b></dt><dd>
--<table border="0" cellspacing="2" cellpadding="0">
--<tr><td valign="top"><em><a class="anchor" name="ggae76da96fff95c157c3b28c4455dc35c017c26531bad42f92f7f3e1f697b58fa"></a><!-- doxytag: member="cc_credentials_v4" ref="ggae76da96fff95c157c3b28c4455dc35c017c26531bad42f92f7f3e1f697b58fa" args="" -->cc_credentials_v4</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggae76da96fff95c157c3b28c4455dc35c98335a31ad81a10632568375dcc10668"></a><!-- doxytag: member="cc_credentials_v5" ref="ggae76da96fff95c157c3b28c4455dc35c98335a31ad81a10632568375dcc10668" args="" -->cc_credentials_v5</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="ggae76da96fff95c157c3b28c4455dc35ca49ae6c35599f5860241601dcb0c9e0d"></a><!-- doxytag: member="cc_credentials_v4_v5" ref="ggae76da96fff95c157c3b28c4455dc35ca49ae6c35599f5860241601dcb0c9e0d" args="" -->cc_credentials_v4_v5</em>&nbsp;</td><td>
--</td></tr>
--</table>
--</dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g2081cbacd4ec3d5a64c8729fd78fc611"></a><!-- doxytag: member="CredentialsCache.h::cc_lock_types" ref="g2081cbacd4ec3d5a64c8729fd78fc611" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">enum <a class="el" href="group__ccapi__constants__reference.html#g2081cbacd4ec3d5a64c8729fd78fc611">cc_lock_types</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Lock types<p>
--These constants are used in the locking functions to describe the type of lock requested. Note that all CCAPI locks are advisory so only callers using the lock calls will be blocked by each other. This is because locking functions were introduced after the CCAPI came into common use and we did not want to break existing callers. <dl compact><dt><b>Enumerator: </b></dt><dd>
--<table border="0" cellspacing="2" cellpadding="0">
--<tr><td valign="top"><em><a class="anchor" name="gg2081cbacd4ec3d5a64c8729fd78fc6110a9a6083623e4c7c8340c0146f032154"></a><!-- doxytag: member="cc_lock_read" ref="gg2081cbacd4ec3d5a64c8729fd78fc6110a9a6083623e4c7c8340c0146f032154" args="" -->cc_lock_read</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg2081cbacd4ec3d5a64c8729fd78fc611bc97eae3b375c4cee90087597b7f375d"></a><!-- doxytag: member="cc_lock_write" ref="gg2081cbacd4ec3d5a64c8729fd78fc611bc97eae3b375c4cee90087597b7f375d" args="" -->cc_lock_write</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg2081cbacd4ec3d5a64c8729fd78fc61184bf8feb65a88dc09aa52c6d955111a3"></a><!-- doxytag: member="cc_lock_upgrade" ref="gg2081cbacd4ec3d5a64c8729fd78fc61184bf8feb65a88dc09aa52c6d955111a3" args="" -->cc_lock_upgrade</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg2081cbacd4ec3d5a64c8729fd78fc611426c331fb09e249b6944d8ba28893eba"></a><!-- doxytag: member="cc_lock_downgrade" ref="gg2081cbacd4ec3d5a64c8729fd78fc611426c331fb09e249b6944d8ba28893eba" args="" -->cc_lock_downgrade</em>&nbsp;</td><td>
--</td></tr>
--</table>
--</dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g0eff5be22e263d0bd9e4bb6fb0a8e948"></a><!-- doxytag: member="CredentialsCache.h::cc_lock_modes" ref="g0eff5be22e263d0bd9e4bb6fb0a8e948" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">enum <a class="el" href="group__ccapi__constants__reference.html#g0eff5be22e263d0bd9e4bb6fb0a8e948">cc_lock_modes</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Locking Modes<p>
--These constants are used in the advisory locking functions to describe whether or not the lock function should block waiting for a lock or return an error immediately. For example, attempting to acquire a lock with a non-blocking call will result in an error if the lock cannot be acquired; otherwise, the call will block until the lock can be acquired. <dl compact><dt><b>Enumerator: </b></dt><dd>
--<table border="0" cellspacing="2" cellpadding="0">
--<tr><td valign="top"><em><a class="anchor" name="gg0eff5be22e263d0bd9e4bb6fb0a8e9485fe1eddb0bba9df16dbcc63aeeb79aa3"></a><!-- doxytag: member="cc_lock_noblock" ref="gg0eff5be22e263d0bd9e4bb6fb0a8e9485fe1eddb0bba9df16dbcc63aeeb79aa3" args="" -->cc_lock_noblock</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg0eff5be22e263d0bd9e4bb6fb0a8e94827e385feb864d167880744d0874834d8"></a><!-- doxytag: member="cc_lock_block" ref="gg0eff5be22e263d0bd9e4bb6fb0a8e94827e385feb864d167880744d0874834d8" args="" -->cc_lock_block</em>&nbsp;</td><td>
--</td></tr>
--</table>
--</dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="g99fb83031ce9923c84392b4e92f956b5"></a><!-- doxytag: member="CredentialsCache.h::@2" ref="g99fb83031ce9923c84392b4e92f956b5" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">anonymous enum          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Sizes of fields in <a class="el" href="structcc__credentials__v4__t.html">cc_credentials_v4_t</a>. <dl compact><dt><b>Enumerator: </b></dt><dd>
--<table border="0" cellspacing="2" cellpadding="0">
--<tr><td valign="top"><em><a class="anchor" name="gg99fb83031ce9923c84392b4e92f956b5ae3147869a486588adf6bc588ee8cc30"></a><!-- doxytag: member="cc_v4_name_size" ref="gg99fb83031ce9923c84392b4e92f956b5ae3147869a486588adf6bc588ee8cc30" args="" -->cc_v4_name_size</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg99fb83031ce9923c84392b4e92f956b55abe44162300eabb9a9f65b324cad493"></a><!-- doxytag: member="cc_v4_instance_size" ref="gg99fb83031ce9923c84392b4e92f956b55abe44162300eabb9a9f65b324cad493" args="" -->cc_v4_instance_size</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg99fb83031ce9923c84392b4e92f956b5714d28ea3d6c6807817d7b377afc22f8"></a><!-- doxytag: member="cc_v4_realm_size" ref="gg99fb83031ce9923c84392b4e92f956b5714d28ea3d6c6807817d7b377afc22f8" args="" -->cc_v4_realm_size</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg99fb83031ce9923c84392b4e92f956b5b52bd33d187632efd597f282540b081a"></a><!-- doxytag: member="cc_v4_ticket_size" ref="gg99fb83031ce9923c84392b4e92f956b5b52bd33d187632efd597f282540b081a" args="" -->cc_v4_ticket_size</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gg99fb83031ce9923c84392b4e92f956b57532f28276c3a759e487560ee4666a29"></a><!-- doxytag: member="cc_v4_key_size" ref="gg99fb83031ce9923c84392b4e92f956b57532f28276c3a759e487560ee4666a29" args="" -->cc_v4_key_size</em>&nbsp;</td><td>
--</td></tr>
--</table>
--</dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="ge78c8fbb79f8ff963ec7c88c431721c3"></a><!-- doxytag: member="CredentialsCache.h::cc_string_to_key_type" ref="ge78c8fbb79f8ff963ec7c88c431721c3" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">enum <a class="el" href="group__ccapi__constants__reference.html#ge78c8fbb79f8ff963ec7c88c431721c3">cc_string_to_key_type</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--String to key type (Kerberos v4 only) <dl compact><dt><b>Enumerator: </b></dt><dd>
--<table border="0" cellspacing="2" cellpadding="0">
--<tr><td valign="top"><em><a class="anchor" name="gge78c8fbb79f8ff963ec7c88c431721c3c0beda03d5c9e36ce9a199c98573d39a"></a><!-- doxytag: member="cc_v4_stk_afs" ref="gge78c8fbb79f8ff963ec7c88c431721c3c0beda03d5c9e36ce9a199c98573d39a" args="" -->cc_v4_stk_afs</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gge78c8fbb79f8ff963ec7c88c431721c31b71e069604cd1cebc2b694ef04aedd1"></a><!-- doxytag: member="cc_v4_stk_des" ref="gge78c8fbb79f8ff963ec7c88c431721c31b71e069604cd1cebc2b694ef04aedd1" args="" -->cc_v4_stk_des</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gge78c8fbb79f8ff963ec7c88c431721c3db66296923c38aa2d7c7420da28d7014"></a><!-- doxytag: member="cc_v4_stk_columbia_special" ref="gge78c8fbb79f8ff963ec7c88c431721c3db66296923c38aa2d7c7420da28d7014" args="" -->cc_v4_stk_columbia_special</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gge78c8fbb79f8ff963ec7c88c431721c3816b6bb45f51557bc3de5e13d38dc310"></a><!-- doxytag: member="cc_v4_stk_krb5" ref="gge78c8fbb79f8ff963ec7c88c431721c3816b6bb45f51557bc3de5e13d38dc310" args="" -->cc_v4_stk_krb5</em>&nbsp;</td><td>
--</td></tr>
--<tr><td valign="top"><em><a class="anchor" name="gge78c8fbb79f8ff963ec7c88c431721c3e19e1a52a4289172671e91d87ab027bb"></a><!-- doxytag: member="cc_v4_stk_unknown" ref="gge78c8fbb79f8ff963ec7c88c431721c3e19e1a52a4289172671e91d87ab027bb" args="" -->cc_v4_stk_unknown</em>&nbsp;</td><td>
--</td></tr>
--</table>
--</dl>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/group__ccapi__types__reference.html b/doc/ccapi/html/group__ccapi__types__reference.html
-deleted file mode 100644
-index 9c646b8d9..000000000
---- a/doc/ccapi/html/group__ccapi__types__reference.html
-+++ /dev/null
-@@ -1,138 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : Basic Types</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>Basic Types</h1>
--<p>
--<h2>Typedefs</h2>
--<ul>
--<li>typedef uint32_t <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a>
--<li>typedef int32_t <a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>
--<li>typedef int64_t <a class="el" href="group__ccapi__types__reference.html#gb6fb75be8c6af177e86f1b3bc562f031">cc_int64</a>
--<li>typedef uint64_t <a class="el" href="group__ccapi__types__reference.html#g44f60a4b4db805be9d55b476dd949a66">cc_uint64</a>
--<li>typedef <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a>
--</ul>
--<hr><h2>Typedef Documentation</h2>
--<a class="anchor" name="ga00783c3f4aa70580d0900b1a79aab9d"></a><!-- doxytag: member="CredentialsCache.h::cc_uint32" ref="ga00783c3f4aa70580d0900b1a79aab9d" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef uint32_t <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Unsigned 32-bit integer type     </td>
--  </tr>
--</table>
--<a class="anchor" name="g0ce639c8d65dc6367fb361d5bbcea874"></a><!-- doxytag: member="CredentialsCache.h::cc_int32" ref="g0ce639c8d65dc6367fb361d5bbcea874" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef int32_t <a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Signed 32-bit integer type     </td>
--  </tr>
--</table>
--<a class="anchor" name="gb6fb75be8c6af177e86f1b3bc562f031"></a><!-- doxytag: member="CredentialsCache.h::cc_int64" ref="gb6fb75be8c6af177e86f1b3bc562f031" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef int64_t <a class="el" href="group__ccapi__types__reference.html#gb6fb75be8c6af177e86f1b3bc562f031">cc_int64</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Unsigned 64-bit integer type     </td>
--  </tr>
--</table>
--<a class="anchor" name="g44f60a4b4db805be9d55b476dd949a66"></a><!-- doxytag: member="CredentialsCache.h::cc_uint64" ref="g44f60a4b4db805be9d55b476dd949a66" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef uint64_t <a class="el" href="group__ccapi__types__reference.html#g44f60a4b4db805be9d55b476dd949a66">cc_uint64</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Signed 64-bit integer type     </td>
--  </tr>
--</table>
--<a class="anchor" name="ge7a754cfe5664beadddaa100646c9742"></a><!-- doxytag: member="CredentialsCache.h::cc_time_t" ref="ge7a754cfe5664beadddaa100646c9742" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">typedef <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--The cc_time_t type is used to represent a time in seconds. The time must be stored as the number of seconds since midnight GMT on January 1, 1970.     </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/group__helper__macros.html b/doc/ccapi/html/group__helper__macros.html
-deleted file mode 100644
-index cf1c681dc..000000000
---- a/doc/ccapi/html/group__helper__macros.html
-+++ /dev/null
-@@ -1,1377 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : CCAPI Function Helper Macros</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>CCAPI Function Helper Macros</h1>
--<p>
--<h2>Defines</h2>
--<ul>
--<li>#define <a class="el" href="group__helper__macros.html#g8ff82ce108889d4ed29f46ffe6efc40e">cc_context_release</a>(context)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; release (context))
--<li>#define <a class="el" href="group__helper__macros.html#g82f551af17455b78fa3a2e3f83c96907">cc_context_get_change_time</a>(context, change_time)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; get_change_time (context, change_time))
--<li>#define <a class="el" href="group__helper__macros.html#gcb4eb9f1db6f8ebf261339ad87cb6c51">cc_context_get_default_ccache_name</a>(context, name)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; get_default_ccache_name (context, name))
--<li>#define <a class="el" href="group__helper__macros.html#g256a5ba17fe0e4502e0722d9b081bbef">cc_context_open_ccache</a>(context, name, ccache)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; open_ccache (context, name, ccache))
--<li>#define <a class="el" href="group__helper__macros.html#g45a7ce29eb409baabadcae1bc95d5c57">cc_context_open_default_ccache</a>(context, ccache)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; open_default_ccache (context, ccache))
--<li>#define <a class="el" href="group__helper__macros.html#g9fbcbd0f1b107cdaa2a0179e227f82cf">cc_context_create_ccache</a>(context, name, version, principal, ccache)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; create_ccache (context, name, version, principal, ccache))
--<li>#define <a class="el" href="group__helper__macros.html#g10a184dd699cae4df6f3480290804a72">cc_context_create_default_ccache</a>(context, version, principal, ccache)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; create_default_ccache (context, version, principal, ccache))
--<li>#define <a class="el" href="group__helper__macros.html#g1a6dffb1db25590351646fdcf9824f09">cc_context_create_new_ccache</a>(context, version, principal, ccache)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; create_new_ccache (context, version, principal, ccache))
--<li>#define <a class="el" href="group__helper__macros.html#g6957bc9570e4769a5b1213d2a1d90cd7">cc_context_new_ccache_iterator</a>(context, iterator)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; new_ccache_iterator (context, iterator))
--<li>#define <a class="el" href="group__helper__macros.html#gcf4595340ddc8dafa539a86ac317625d">cc_context_lock</a>(context, type, block)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; lock (context, type, block))
--<li>#define <a class="el" href="group__helper__macros.html#g544261b88c9ac0f2379a35648cae3f27">cc_context_unlock</a>(context)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; unlock (context))
--<li>#define <a class="el" href="group__helper__macros.html#g9258ef05d06f3d4dc798ec654f78b967">cc_context_compare</a>(context, compare_to, equal)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; compare (context, compare_to, equal))
--<li>#define <a class="el" href="group__helper__macros.html#g9eb3508958528c00844a101275497e5a">cc_context_wait_for_change</a>(context)&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; wait_for_change (context))
--<li>#define <a class="el" href="group__helper__macros.html#ge517135d87d8775d77b426d57a491ef0">cc_ccache_release</a>(ccache)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; release (ccache))
--<li>#define <a class="el" href="group__helper__macros.html#ge05b68d91bece2f99b531e96cde8d457">cc_ccache_destroy</a>(ccache)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; destroy (ccache))
--<li>#define <a class="el" href="group__helper__macros.html#g535b92993b85d92b67fa622447afbe13">cc_ccache_set_default</a>(ccache)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; set_default (ccache))
--<li>#define <a class="el" href="group__helper__macros.html#g934f93499765bdd179bb2342ae0f0fa6">cc_ccache_get_credentials_version</a>(ccache, version)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_credentials_version (ccache, version))
--<li>#define <a class="el" href="group__helper__macros.html#g042bea6044879ec03996b190792e3ae9">cc_ccache_get_name</a>(ccache, name)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_name (ccache, name))
--<li>#define <a class="el" href="group__helper__macros.html#g464aa49a2e8054c9c3c2a3410eaf5c54">cc_ccache_get_principal</a>(ccache, version, principal)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_principal (ccache, version, principal))
--<li>#define <a class="el" href="group__helper__macros.html#gfaa81492b5d7b3ba00208a9577ce0ba2">cc_ccache_set_principal</a>(ccache, version, principal)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; set_principal (ccache, version, principal))
--<li>#define <a class="el" href="group__helper__macros.html#g35c1548dbacb8907da7b8c3124eabf39">cc_ccache_store_credentials</a>(ccache, credentials)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; store_credentials (ccache, credentials))
--<li>#define <a class="el" href="group__helper__macros.html#ga1bbc05414ad4c17cea9cd5e5c50c7cc">cc_ccache_remove_credentials</a>(ccache, credentials)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; remove_credentials (ccache, credentials))
--<li>#define <a class="el" href="group__helper__macros.html#g893b31c419e71c2f528781d3036fa3ff">cc_ccache_new_credentials_iterator</a>(ccache, iterator)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; new_credentials_iterator (ccache, iterator))
--<li>#define <a class="el" href="group__helper__macros.html#gb8c2624719ee1c4be5f1b1bc4844f0cc">cc_ccache_lock</a>(ccache, type, block)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; lock (ccache, type, block))
--<li>#define <a class="el" href="group__helper__macros.html#ge9b13c950cb6ee636c4a73d6c569a811">cc_ccache_unlock</a>(ccache)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; unlock (ccache))
--<li>#define <a class="el" href="group__helper__macros.html#g884b0c60718fa1057574a3cd844e96ee">cc_ccache_get_last_default_time</a>(ccache, last_default_time)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_last_default_time (ccache, last_default_time))
--<li>#define <a class="el" href="group__helper__macros.html#gb19ef7d2b1bcfb474e18e157fb3bc9c6">cc_ccache_get_change_time</a>(ccache, change_time)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_change_time (ccache, change_time))
--<li>#define <a class="el" href="group__helper__macros.html#ge1238f80c37ae89486f2ba29bcbcae38">cc_ccache_move</a>(source, destination)&nbsp;&nbsp;&nbsp;((source) -&gt; functions -&gt; move (source, destination))
--<li>#define <a class="el" href="group__helper__macros.html#g197ff60fac986634fbef8ca102ec54a5">cc_ccache_compare</a>(ccache, compare_to, equal)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; compare (ccache, compare_to, equal))
--<li>#define <a class="el" href="group__helper__macros.html#g1fa36a89752da4a491d2ecdad17f8b0e">cc_ccache_get_kdc_time_offset</a>(ccache, version, time_offset)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_kdc_time_offset (ccache, version, time_offset))
--<li>#define <a class="el" href="group__helper__macros.html#g519bf0ab152e5a3d2beee8a76a27d16e">cc_ccache_set_kdc_time_offset</a>(ccache, version, time_offset)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; set_kdc_time_offset (ccache, version, time_offset))
--<li>#define <a class="el" href="group__helper__macros.html#g803c35f92992dc0b73e8809d13ebabab">cc_ccache_clear_kdc_time_offset</a>(ccache, version)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; clear_kdc_time_offset (ccache, version))
--<li>#define <a class="el" href="group__helper__macros.html#gc508ad0c010c88ad8ff0739b43a2b199">cc_ccache_wait_for_change</a>(ccache)&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; wait_for_change (ccache))
--<li>#define <a class="el" href="group__helper__macros.html#ge9bebfed2d574e69f29dd341bc8a63d9">cc_string_release</a>(string)&nbsp;&nbsp;&nbsp;((string) -&gt; functions -&gt; release (string))
--<li>#define <a class="el" href="group__helper__macros.html#gab5cad8ca82847950956b0f493132c14">cc_credentials_release</a>(credentials)&nbsp;&nbsp;&nbsp;((credentials) -&gt; functions -&gt; release (credentials))
--<li>#define <a class="el" href="group__helper__macros.html#g39ae30e49dba65b87c6b9794f20fb784">cc_credentials_compare</a>(credentials, compare_to, equal)&nbsp;&nbsp;&nbsp;((credentials) -&gt; functions -&gt; compare (credentials, compare_to, equal))
--<li>#define <a class="el" href="group__helper__macros.html#g34f37496fb8bc414aafb0b265afecb1b">cc_ccache_iterator_release</a>(iterator)&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; release (iterator))
--<li>#define <a class="el" href="group__helper__macros.html#gcff0b3e247a2adc95442324fec6c5651">cc_ccache_iterator_next</a>(iterator, ccache)&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; next (iterator, ccache))
--<li>#define <a class="el" href="group__helper__macros.html#g904d7757fd7ac40f4ee9b448a389f2dd">cc_ccache_iterator_clone</a>(iterator, new_iterator)&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; clone (iterator, new_iterator))
--<li>#define <a class="el" href="group__helper__macros.html#g79f914583e8076ac24c0d5dde4ddb712">cc_credentials_iterator_release</a>(iterator)&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; release (iterator))
--<li>#define <a class="el" href="group__helper__macros.html#g0c2f41d90f478b2415b699085f8fcaa4">cc_credentials_iterator_next</a>(iterator, credentials)&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; next (iterator, credentials))
--<li>#define <a class="el" href="group__helper__macros.html#g59a9f96a6c00b64c0ab971f7e9b5aae2">cc_credentials_iterator_clone</a>(iterator, new_iterator)&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; clone (iterator, new_iterator))
--</ul>
--<hr><h2>Define Documentation</h2>
--<a class="anchor" name="g8ff82ce108889d4ed29f46ffe6efc40e"></a><!-- doxytag: member="CredentialsCache.h::cc_context_release" ref="g8ff82ce108889d4ed29f46ffe6efc40e" args="(context)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_release          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; release (context))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> release()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g82f551af17455b78fa3a2e3f83c96907"></a><!-- doxytag: member="CredentialsCache.h::cc_context_get_change_time" ref="g82f551af17455b78fa3a2e3f83c96907" args="(context, change_time)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_get_change_time          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>change_time&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; get_change_time (context, change_time))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> get_change_time()     </td>
--  </tr>
--</table>
--<a class="anchor" name="gcb4eb9f1db6f8ebf261339ad87cb6c51"></a><!-- doxytag: member="CredentialsCache.h::cc_context_get_default_ccache_name" ref="gcb4eb9f1db6f8ebf261339ad87cb6c51" args="(context, name)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_get_default_ccache_name          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>name&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; get_default_ccache_name (context, name))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> get_default_ccache_name()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g256a5ba17fe0e4502e0722d9b081bbef"></a><!-- doxytag: member="CredentialsCache.h::cc_context_open_ccache" ref="g256a5ba17fe0e4502e0722d9b081bbef" args="(context, name, ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_open_ccache          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>name,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>ccache&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; open_ccache (context, name, ccache))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> open_ccache()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g45a7ce29eb409baabadcae1bc95d5c57"></a><!-- doxytag: member="CredentialsCache.h::cc_context_open_default_ccache" ref="g45a7ce29eb409baabadcae1bc95d5c57" args="(context, ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_open_default_ccache          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>ccache&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; open_default_ccache (context, ccache))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> open_default_ccache()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g9fbcbd0f1b107cdaa2a0179e227f82cf"></a><!-- doxytag: member="CredentialsCache.h::cc_context_create_ccache" ref="g9fbcbd0f1b107cdaa2a0179e227f82cf" args="(context, name, version, principal, ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_create_ccache          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>name,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>version,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>principal,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>ccache&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; create_ccache (context, name, version, principal, ccache))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> create_ccache()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g10a184dd699cae4df6f3480290804a72"></a><!-- doxytag: member="CredentialsCache.h::cc_context_create_default_ccache" ref="g10a184dd699cae4df6f3480290804a72" args="(context, version, principal, ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_create_default_ccache          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>version,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>principal,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>ccache&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; create_default_ccache (context, version, principal, ccache))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> create_default_ccache()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g1a6dffb1db25590351646fdcf9824f09"></a><!-- doxytag: member="CredentialsCache.h::cc_context_create_new_ccache" ref="g1a6dffb1db25590351646fdcf9824f09" args="(context, version, principal, ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_create_new_ccache          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>version,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>principal,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>ccache&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; create_new_ccache (context, version, principal, ccache))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> create_new_ccache()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g6957bc9570e4769a5b1213d2a1d90cd7"></a><!-- doxytag: member="CredentialsCache.h::cc_context_new_ccache_iterator" ref="g6957bc9570e4769a5b1213d2a1d90cd7" args="(context, iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_new_ccache_iterator          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>iterator&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; new_ccache_iterator (context, iterator))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> new_ccache_iterator()     </td>
--  </tr>
--</table>
--<a class="anchor" name="gcf4595340ddc8dafa539a86ac317625d"></a><!-- doxytag: member="CredentialsCache.h::cc_context_lock" ref="gcf4595340ddc8dafa539a86ac317625d" args="(context, type, block)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_lock          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>type,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>block&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; lock (context, type, block))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> lock()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g544261b88c9ac0f2379a35648cae3f27"></a><!-- doxytag: member="CredentialsCache.h::cc_context_unlock" ref="g544261b88c9ac0f2379a35648cae3f27" args="(context)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_unlock          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; unlock (context))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> unlock()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g9258ef05d06f3d4dc798ec654f78b967"></a><!-- doxytag: member="CredentialsCache.h::cc_context_compare" ref="g9258ef05d06f3d4dc798ec654f78b967" args="(context, compare_to, equal)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_compare          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>compare_to,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>equal&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; compare (context, compare_to, equal))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> compare()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g9eb3508958528c00844a101275497e5a"></a><!-- doxytag: member="CredentialsCache.h::cc_context_wait_for_change" ref="g9eb3508958528c00844a101275497e5a" args="(context)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_context_wait_for_change          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">context&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((context) -&gt; functions -&gt; wait_for_change (context))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__context__f.html">cc_context_f</a> wait_for_change()     </td>
--  </tr>
--</table>
--<a class="anchor" name="ge517135d87d8775d77b426d57a491ef0"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_release" ref="ge517135d87d8775d77b426d57a491ef0" args="(ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_release          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; release (ccache))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> release()     </td>
--  </tr>
--</table>
--<a class="anchor" name="ge05b68d91bece2f99b531e96cde8d457"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_destroy" ref="ge05b68d91bece2f99b531e96cde8d457" args="(ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_destroy          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; destroy (ccache))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> destroy()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g535b92993b85d92b67fa622447afbe13"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_set_default" ref="g535b92993b85d92b67fa622447afbe13" args="(ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_set_default          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; set_default (ccache))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> set_default()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g934f93499765bdd179bb2342ae0f0fa6"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_get_credentials_version" ref="g934f93499765bdd179bb2342ae0f0fa6" args="(ccache, version)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_get_credentials_version          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>version&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_credentials_version (ccache, version))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> get_credentials_version()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g042bea6044879ec03996b190792e3ae9"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_get_name" ref="g042bea6044879ec03996b190792e3ae9" args="(ccache, name)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_get_name          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>name&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_name (ccache, name))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> get_name()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g464aa49a2e8054c9c3c2a3410eaf5c54"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_get_principal" ref="g464aa49a2e8054c9c3c2a3410eaf5c54" args="(ccache, version, principal)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_get_principal          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>version,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>principal&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_principal (ccache, version, principal))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> get_principal()     </td>
--  </tr>
--</table>
--<a class="anchor" name="gfaa81492b5d7b3ba00208a9577ce0ba2"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_set_principal" ref="gfaa81492b5d7b3ba00208a9577ce0ba2" args="(ccache, version, principal)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_set_principal          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>version,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>principal&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; set_principal (ccache, version, principal))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> set_principal()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g35c1548dbacb8907da7b8c3124eabf39"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_store_credentials" ref="g35c1548dbacb8907da7b8c3124eabf39" args="(ccache, credentials)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_store_credentials          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>credentials&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; store_credentials (ccache, credentials))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> store_credentials()     </td>
--  </tr>
--</table>
--<a class="anchor" name="ga1bbc05414ad4c17cea9cd5e5c50c7cc"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_remove_credentials" ref="ga1bbc05414ad4c17cea9cd5e5c50c7cc" args="(ccache, credentials)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_remove_credentials          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>credentials&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; remove_credentials (ccache, credentials))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> remove_credentials()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g893b31c419e71c2f528781d3036fa3ff"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_new_credentials_iterator" ref="g893b31c419e71c2f528781d3036fa3ff" args="(ccache, iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_new_credentials_iterator          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>iterator&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; new_credentials_iterator (ccache, iterator))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> new_credentials_iterator()     </td>
--  </tr>
--</table>
--<a class="anchor" name="gb8c2624719ee1c4be5f1b1bc4844f0cc"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_lock" ref="gb8c2624719ee1c4be5f1b1bc4844f0cc" args="(ccache, type, block)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_lock          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>type,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>block&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; lock (ccache, type, block))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> lock()     </td>
--  </tr>
--</table>
--<a class="anchor" name="ge9b13c950cb6ee636c4a73d6c569a811"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_unlock" ref="ge9b13c950cb6ee636c4a73d6c569a811" args="(ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_unlock          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; unlock (ccache))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> unlock()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g884b0c60718fa1057574a3cd844e96ee"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_get_last_default_time" ref="g884b0c60718fa1057574a3cd844e96ee" args="(ccache, last_default_time)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_get_last_default_time          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>last_default_time&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_last_default_time (ccache, last_default_time))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> get_last_default_time()     </td>
--  </tr>
--</table>
--<a class="anchor" name="gb19ef7d2b1bcfb474e18e157fb3bc9c6"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_get_change_time" ref="gb19ef7d2b1bcfb474e18e157fb3bc9c6" args="(ccache, change_time)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_get_change_time          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>change_time&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_change_time (ccache, change_time))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> get_change_time()     </td>
--  </tr>
--</table>
--<a class="anchor" name="ge1238f80c37ae89486f2ba29bcbcae38"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_move" ref="ge1238f80c37ae89486f2ba29bcbcae38" args="(source, destination)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_move          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">source,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>destination&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((source) -&gt; functions -&gt; move (source, destination))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> move()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g197ff60fac986634fbef8ca102ec54a5"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_compare" ref="g197ff60fac986634fbef8ca102ec54a5" args="(ccache, compare_to, equal)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_compare          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>compare_to,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>equal&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; compare (ccache, compare_to, equal))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> compare()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g1fa36a89752da4a491d2ecdad17f8b0e"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_get_kdc_time_offset" ref="g1fa36a89752da4a491d2ecdad17f8b0e" args="(ccache, version, time_offset)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_get_kdc_time_offset          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>version,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>time_offset&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; get_kdc_time_offset (ccache, version, time_offset))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> get_kdc_time_offset()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g519bf0ab152e5a3d2beee8a76a27d16e"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_set_kdc_time_offset" ref="g519bf0ab152e5a3d2beee8a76a27d16e" args="(ccache, version, time_offset)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_set_kdc_time_offset          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>version,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>time_offset&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; set_kdc_time_offset (ccache, version, time_offset))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> set_kdc_time_offset()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g803c35f92992dc0b73e8809d13ebabab"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_clear_kdc_time_offset" ref="g803c35f92992dc0b73e8809d13ebabab" args="(ccache, version)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_clear_kdc_time_offset          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>version&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; clear_kdc_time_offset (ccache, version))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> clear_kdc_time_offset()     </td>
--  </tr>
--</table>
--<a class="anchor" name="gc508ad0c010c88ad8ff0739b43a2b199"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_wait_for_change" ref="gc508ad0c010c88ad8ff0739b43a2b199" args="(ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_wait_for_change          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">ccache&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((ccache) -&gt; functions -&gt; wait_for_change (ccache))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> wait_for_change()     </td>
--  </tr>
--</table>
--<a class="anchor" name="ge9bebfed2d574e69f29dd341bc8a63d9"></a><!-- doxytag: member="CredentialsCache.h::cc_string_release" ref="ge9bebfed2d574e69f29dd341bc8a63d9" args="(string)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_string_release          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">string&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((string) -&gt; functions -&gt; release (string))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__string__f.html">cc_string_f</a> release()     </td>
--  </tr>
--</table>
--<a class="anchor" name="gab5cad8ca82847950956b0f493132c14"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_release" ref="gab5cad8ca82847950956b0f493132c14" args="(credentials)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_credentials_release          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">credentials&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((credentials) -&gt; functions -&gt; release (credentials))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__credentials__f.html">cc_credentials_f</a> release()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g39ae30e49dba65b87c6b9794f20fb784"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_compare" ref="g39ae30e49dba65b87c6b9794f20fb784" args="(credentials, compare_to, equal)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_credentials_compare          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">credentials,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>compare_to,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>equal&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((credentials) -&gt; functions -&gt; compare (credentials, compare_to, equal))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__credentials__f.html">cc_credentials_f</a> compare()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g34f37496fb8bc414aafb0b265afecb1b"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_iterator_release" ref="g34f37496fb8bc414aafb0b265afecb1b" args="(iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_iterator_release          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">iterator&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; release (iterator))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__iterator__f.html">cc_ccache_iterator_f</a> release()     </td>
--  </tr>
--</table>
--<a class="anchor" name="gcff0b3e247a2adc95442324fec6c5651"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_iterator_next" ref="gcff0b3e247a2adc95442324fec6c5651" args="(iterator, ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_iterator_next          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">iterator,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>ccache&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; next (iterator, ccache))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__iterator__f.html">cc_ccache_iterator_f</a> next()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g904d7757fd7ac40f4ee9b448a389f2dd"></a><!-- doxytag: member="CredentialsCache.h::cc_ccache_iterator_clone" ref="g904d7757fd7ac40f4ee9b448a389f2dd" args="(iterator, new_iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_ccache_iterator_clone          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">iterator,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>new_iterator&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; clone (iterator, new_iterator))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__ccache__iterator__f.html">cc_ccache_iterator_f</a> clone()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g79f914583e8076ac24c0d5dde4ddb712"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_iterator_release" ref="g79f914583e8076ac24c0d5dde4ddb712" args="(iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_credentials_iterator_release          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">iterator&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; release (iterator))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__credentials__iterator__f.html">cc_credentials_iterator_f</a> release()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g0c2f41d90f478b2415b699085f8fcaa4"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_iterator_next" ref="g0c2f41d90f478b2415b699085f8fcaa4" args="(iterator, credentials)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_credentials_iterator_next          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">iterator,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>credentials&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; next (iterator, credentials))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__credentials__iterator__f.html">cc_credentials_iterator_f</a> next()     </td>
--  </tr>
--</table>
--<a class="anchor" name="g59a9f96a6c00b64c0ab971f7e9b5aae2"></a><!-- doxytag: member="CredentialsCache.h::cc_credentials_iterator_clone" ref="g59a9f96a6c00b64c0ab971f7e9b5aae2" args="(iterator, new_iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">#define cc_credentials_iterator_clone          </td>
--          <td class="md" valign="top">(&nbsp;</td>
--          <td class="md" nowrap valign="top">iterator,         <tr>
--          <td class="md" nowrap align="right"></td>
--          <td class="md"></td>
--          <td class="md" nowrap>new_iterator&nbsp;</td>
--          <td class="mdname1" valign="top" nowrap>          </td>
--          <td class="md" valign="top">&nbsp;)&nbsp;</td>
--          <td class="md" nowrap>&nbsp;&nbsp;&nbsp;((iterator) -&gt; functions -&gt; clone (iterator, new_iterator))</td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Helper macro for <a class="el" href="structcc__credentials__iterator__f.html">cc_credentials_iterator_f</a> clone()     </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/index.html b/doc/ccapi/html/index.html
-deleted file mode 100644
-index bf920052f..000000000
---- a/doc/ccapi/html/index.html
-+++ /dev/null
-@@ -1,85 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : Credentials Cache API (CCAPI) Documentation</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>Credentials Cache API (CCAPI) Documentation</h1>
--<p>
--<h2><a class="anchor" name="toc">
--Table of Contents</a></h2>
--<ul>
--<li><a class="el" href="index.html#introduction">Introduction</a> </li>
--<li><a class="el" href="index.html#error_handling">Error Handling</a> </li>
--<li><a class="el" href="index.html#synchronization_atomicity">Synchronization and Atomicity</a> </li>
--<li><a class="el" href="index.html#memory_management">Object Memory Management</a> </li>
--<li><a class="el" href="index.html#opaque_types">Opaque Types</a></li>
--</ul>
--<ul>
--<li><a class="el" href="group__ccapi__constants__reference.html">Constants</a> </li>
--<li><a class="el" href="group__ccapi__types__reference.html">Basic Types</a></li>
--</ul>
--<ul>
--<li><a class="el" href="group__cc__context__reference.html">cc_context_t Overview</a> </li>
--<li><a class="el" href="structcc__context__f.html">cc_context_t Functions</a></li>
--</ul>
--<ul>
--<li><a class="el" href="group__cc__ccache__reference.html">cc_ccache_t Overview</a> </li>
--<li><a class="el" href="structcc__ccache__f.html">cc_ccache_t Functions</a></li>
--</ul>
--<ul>
--<li><a class="el" href="group__cc__credentials__reference.html">cc_credentials_t Overview</a> </li>
--<li><a class="el" href="structcc__credentials__f.html">cc_credentials_t Functions</a></li>
--</ul>
--<ul>
--<li><a class="el" href="group__cc__ccache__iterator__reference.html">cc_ccache_iterator_t Overview</a> </li>
--<li><a class="el" href="structcc__ccache__iterator__f.html">cc_ccache_iterator_t Functions</a></li>
--</ul>
--<ul>
--<li><a class="el" href="group__cc__credentials__iterator__reference.html">cc_credentials_iterator_t</a> </li>
--<li><a class="el" href="structcc__credentials__iterator__f.html">cc_credentials_iterator_t Functions</a></li>
--</ul>
--<ul>
--<li><a class="el" href="group__cc__string__reference.html">cc_string_t Overview</a> </li>
--<li><a class="el" href="structcc__string__f.html">cc_string_t Functions</a></li>
--</ul>
--<h2><a class="anchor" name="introduction">
--Introduction</a></h2>
--This is the specification for an API which provides Credentials Cache services for both Kerberos v5 and v4. The idea behind this API is that multiple Kerberos implementations can share a single collection of credentials caches, mediated by this API specification. On the Mac OS and Microsoft Windows platforms this will allow single-login, even when more than one Kerberos shared library is in use on a particular system.<p>
--Abstractly, a credentials cache collection contains one or more credentials caches, or ccaches. A ccache is uniquely identified by its name, which is a string internal to the API and not intended to be presented to users. The user presentable identifier of a ccache is its principal.<p>
--Unlike the previous versions of the API, version 3 of the API stores both Kerberos v4 and v5 credentials in the same ccache.<p>
--At any given time, one ccache is the "default" ccache. The exact meaning of a default ccache is OS-specific; refer to implementation requirements for details.<h2><a class="anchor" name="error_handling">
--Error Handling</a></h2>
--All functions of the API return some of the error constants listed FIXME; the exact list of error constants returned by any API function is provided in the function descriptions below.<p>
--When returning an error constant other than ccNoError or ccIteratorEnd, API functions never modify any of the values passed in by reference.<h2><a class="anchor" name="synchronization_atomicity">
--Synchronization and Atomicity</a></h2>
--Every function in the API is atomic. In order to make a series of calls atomic, callers should lock the ccache or cache collection they are working with to advise other callers not to modify that container. Note that advisory locks are per container so even if you have a read lock on the cache collection other callers can obtain write locks on ccaches in that cache collection.<p>
--Note that iterators do not iterate over ccaches and credentials atomically because locking ccaches and the cache collection over every iteration would degrade performance considerably under high load. However, iterators do guarantee a consistent view of items they are iterating over. Iterators will never return duplicate entries or skip entries when items are removed or added to the container they are iterating over.<p>
--An application can always lock a ccache or the cache collection to guarantee that other callers participating in the advisory locking system do not modify the ccache or cache collection.<p>
--Implementations should not use copy-on-write techniques to implement locks because those techniques imply that same parts of the ccache collection remain visible to some callers even though they are not present in the collection, which is a potential security risk. For example, a copy-on-write technique might make a copy of the entire collection when a read lock is acquired, so as to allow the owner of the lock to access the collection in an apparently unmodified state, while also allowing others to make modifications to the collection. However, this would also enable the owner of the lock to indefinitely (until the expiration time) use credentials that have actually been deleted from the collection.<h2><a class="anchor" name="memory_management">
--Object Memory Management</a></h2>
--The lifetime of an object returned by the API is until release() is called for it. Releasing one object has no effect on existence of any other object. For example, a ccache obtained within a context continue to exist when the context is released.<p>
--Every object returned by the API (cc_context_t, cc_ccache_t, cc_ccache_iterator_t, cc_credentials_t, cc_credentials_iterator_t, cc_string_t) is owned by the caller of the API, and it is the responsibility of the caller to call release() for every object to prevent memory leaks.<h2><a class="anchor" name="opaque_types">
--Opaque Types</a></h2>
--All of the opaque high-level types in CCache API are implemented as structures of function pointers and private data. To perform some operation on a type, the caller of the API has to first obtain an instance of that type, and then call the appropriate function pointer from that instance. For example, to call get_change_time() on a cc_context_t, one would call <a class="el" href="group__cc__context__reference.html#ge4174587d8bb261e32194bbb9585fb82">cc_initialize()</a> which creates a new cc_context_t and then call its get_change_time(), like this:<p>
--<div class="fragment"><pre class="fragment"> <a class="code" href="structcc__context__d.html">cc_context_t</a> context;
-- <a class="code" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> err = <a class="code" href="group__cc__context__reference.html#ge4174587d8bb261e32194bbb9585fb82">cc_initialize</a> (&amp;context, <a class="code" href="group__ccapi__constants__reference.html#gg06fc87d81c62e9abb8790b6e5713c55b26f201de4113dda3b4ec78dcda95d5a1">ccapi_version_3</a>, nil, nil);
-- <span class="keywordflow">if</span> (err == <a class="code" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>)
-- time = context-&gt;<a class="code" href="structcc__context__d.html#ac5b195bc75b92f5c1924e6a3a6aa611">functions</a>-&gt;<a class="code" href="structcc__context__f.html#51bd5a48dcd263bfb3128cc5838b4cd7">get_change_time</a> (context)
--</pre></div><p>
--All API functions also have convenience preprocessor macros, which make the API seem completely function-based. For example, cc_context_get_change_time (context, time) is equivalent to context-&gt;functions-&gt;get_change_time (context, time). The convenience macros follow the following naming convention:<p>
--The API function some_function() <div class="fragment"><pre class="fragment"> cc_type_t an_object;
-- result = an_object-&gt;functions-&gt;some_function (opaque_pointer, args)
--</pre></div><p>
--has an equivalent convenience macro of the form cc_type_some_function(): <div class="fragment"><pre class="fragment"> cc_type_t an_object;
-- result = cc_type_some_function (an_object, args)
--</pre></div><p>
--The specifications below include the names for both the functions and the convenience macros, in that order. For clarity, it is recommended that clients using the API use the convenience macros, but that is merely a stylistic choice.<p>
--Implementing the API in this manner allows us to extend and change the interface in the future, while preserving compatibility with older clients.<p>
--For example, consider the case when the signature or the semantics of a cc_ccache_t function is changed. The API version number is incremented. The library implementation contains both a function with the old signature and semantics and a function with the new signature and semantics. When a context is created, the API version number used in that context is stored in the context, and therefore it can be used whenever a ccache is created in that context. When a ccache is created in a context with the old API version number, the function pointer structure for the ccache is filled with pointers to functions implementing the old semantics; when a ccache is created in a context with the new API version number, the function pointer structure for the ccache is filled with poitners to functions implementing the new semantics.<p>
--Similarly, if a function is added to the API, the version number in the context can be used to decide whether to include the implementation of the new function in the appropriate function pointer structure or not. <hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:05 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__ccache__d.html b/doc/ccapi/html/structcc__ccache__d.html
-deleted file mode 100644
-index c19aa2b59..000000000
---- a/doc/ccapi/html/structcc__ccache__d.html
-+++ /dev/null
-@@ -1,43 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_ccache_d Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_ccache_d Struct Reference<br>
--<small>
--[<a class="el" href="group__cc__ccache__reference.html">cc_ccache_t Overview</a>]</small>
--</h1><!-- doxytag: class="cc_ccache_d" --><h2>Data Fields</h2>
--<ul>
--<li>const <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a> * <a class="el" href="structcc__ccache__d.html#55d1ef4ddfa9a0e84a35791bb5da4bb3">functions</a>
--</ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="55d1ef4ddfa9a0e84a35791bb5da4bb3"></a><!-- doxytag: member="cc_ccache_d::functions" ref="55d1ef4ddfa9a0e84a35791bb5da4bb3" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">const <a class="el" href="structcc__ccache__f.html">cc_ccache_f</a>* <a class="el" href="structcc__ccache__d.html#55d1ef4ddfa9a0e84a35791bb5da4bb3">functions</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:05 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__ccache__f.html b/doc/ccapi/html/structcc__ccache__f.html
-deleted file mode 100644
-index ddab94ff9..000000000
---- a/doc/ccapi/html/structcc__ccache__f.html
-+++ /dev/null
-@@ -1,722 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_ccache_f Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_ccache_f Struct Reference</h1><!-- doxytag: class="cc_ccache_f" --><hr><a name="_details"></a><h2>Detailed Description</h2>
--Function pointer table for cc_ccache_t. For more information see <a class="el" href="group__cc__ccache__reference.html">cc_ccache_t Overview</a>. 
--<p>
--<h2>Data Fields</h2>
--<ul>
--<li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#ef46c1c04ceb1a0a479db84ddba7160c">release</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#ge517135d87d8775d77b426d57a491ef0">cc_ccache_release()</a></b>: Release memory associated with a cc_ccache_t object.  <a href="#ef46c1c04ceb1a0a479db84ddba7160c"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#86872ea5155e7ff57f4674a8f8c1d6c5">destroy</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#ge05b68d91bece2f99b531e96cde8d457">cc_ccache_destroy()</a></b>: Destroy a ccache.  <a href="#86872ea5155e7ff57f4674a8f8c1d6c5"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#93c7e154d7472227b02d240a13dd53da">set_default</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g535b92993b85d92b67fa622447afbe13">cc_ccache_set_default()</a></b>: Make a ccache the default ccache.  <a href="#93c7e154d7472227b02d240a13dd53da"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#934cc9927404ee42460008b49e572158">get_credentials_version</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> *out_credentials_version)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g934f93499765bdd179bb2342ae0f0fa6">cc_ccache_get_credentials_version()</a></b>: Get the credentials version of a ccache.  <a href="#934cc9927404ee42460008b49e572158"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#e60fec8fe34019df7108e8deed0f52ac">get_name</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="structcc__string__d.html">cc_string_t</a> *out_name)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g042bea6044879ec03996b190792e3ae9">cc_ccache_get_name()</a></b>: Get the name of a ccache.  <a href="#e60fec8fe34019df7108e8deed0f52ac"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#ef23df23bb71b1f01138b791bc8b6255">get_principal</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_credentials_version, <a class="el" href="structcc__string__d.html">cc_string_t</a> *out_principal)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g464aa49a2e8054c9c3c2a3410eaf5c54">cc_ccache_get_principal()</a></b>: Get the principal of a ccache.  <a href="#ef23df23bb71b1f01138b791bc8b6255"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#0d72ae907e8357633fe4ff2248818f42">set_principal</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_credentials_version, const char *in_principal)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#gfaa81492b5d7b3ba00208a9577ce0ba2">cc_ccache_set_principal()</a></b>: Set the principal of a ccache.  <a href="#0d72ae907e8357633fe4ff2248818f42"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#c4ac7d0cb5e15309978d8c4990f769a3">store_credentials</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, const <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a> *in_credentials_union)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g35c1548dbacb8907da7b8c3124eabf39">cc_ccache_store_credentials()</a></b>: Store credentials in a ccache.  <a href="#c4ac7d0cb5e15309978d8c4990f769a3"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#6cc6d19ff6044fafc3cd9f42c338341c">remove_credentials</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, <a class="el" href="structcc__credentials__d.html">cc_credentials_t</a> in_credentials)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#ga1bbc05414ad4c17cea9cd5e5c50c7cc">cc_ccache_remove_credentials()</a></b>: Remove credentials from a ccache.  <a href="#6cc6d19ff6044fafc3cd9f42c338341c"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#4efc19a7cd2ac6695da44cb7f7e9be14">new_credentials_iterator</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> *out_credentials_iterator)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g893b31c419e71c2f528781d3036fa3ff">cc_ccache_new_credentials_iterator()</a></b>: Iterate over credentials in a ccache.  <a href="#4efc19a7cd2ac6695da44cb7f7e9be14"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#d4e0dc020d293643405a07396b6f5942">move</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_source_ccache, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_destination_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#ge1238f80c37ae89486f2ba29bcbcae38">cc_ccache_move()</a></b>: Move the contents of one ccache into another, destroying the source.  <a href="#d4e0dc020d293643405a07396b6f5942"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#731d262d2aa179451f824d320c460f58">lock</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_lock_type, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_block)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#gb8c2624719ee1c4be5f1b1bc4844f0cc">cc_ccache_lock()</a></b>: Lock a ccache.  <a href="#731d262d2aa179451f824d320c460f58"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#bffbfe60a3e8da64224623df5235159a">unlock</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#ge9b13c950cb6ee636c4a73d6c569a811">cc_ccache_unlock()</a></b>: Unlock a ccache.  <a href="#bffbfe60a3e8da64224623df5235159a"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#c65301a0ef050524286130185c3ec06d">get_last_default_time</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> *out_last_default_time)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#gb19ef7d2b1bcfb474e18e157fb3bc9c6">cc_ccache_get_change_time()</a></b>: Get the last time a ccache was the default ccache.  <a href="#c65301a0ef050524286130185c3ec06d"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#a73ffc6e33ca8155cd644aa5d702c36f">get_change_time</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> *out_change_time)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#gb19ef7d2b1bcfb474e18e157fb3bc9c6">cc_ccache_get_change_time()</a></b>: Get the last time a ccache changed.  <a href="#a73ffc6e33ca8155cd644aa5d702c36f"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#30719ac8b49a62bf73cb2841e397a81d">compare</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_compare_to_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> *out_equal)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g197ff60fac986634fbef8ca102ec54a5">cc_ccache_compare()</a></b>: Compare two ccache objects.  <a href="#30719ac8b49a62bf73cb2841e397a81d"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#106ee10feffc1681c7583d6aac4d33b4">get_kdc_time_offset</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_credentials_version, <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> *out_time_offset)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g1fa36a89752da4a491d2ecdad17f8b0e">cc_ccache_get_kdc_time_offset()</a></b>: Get the KDC time offset for credentials in a ccache.  <a href="#106ee10feffc1681c7583d6aac4d33b4"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#d537ad02da9b4eae3f5e51df0c58ee2e">set_kdc_time_offset</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_credentials_version, <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> in_time_offset)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g519bf0ab152e5a3d2beee8a76a27d16e">cc_ccache_set_kdc_time_offset()</a></b>: Set the KDC time offset for credentials in a ccache.  <a href="#d537ad02da9b4eae3f5e51df0c58ee2e"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#bc092bd23b9081d12e695faa55913257">clear_kdc_time_offset</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_credentials_version)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g803c35f92992dc0b73e8809d13ebabab">cc_ccache_clear_kdc_time_offset()</a></b>: Clear the KDC time offset for credentials in a ccache.  <a href="#bc092bd23b9081d12e695faa55913257"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#4c815231f7e071a1dedd9aef3cedb0ef">wait_for_change</a> )(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#gc508ad0c010c88ad8ff0739b43a2b199">cc_ccache_wait_for_change()</a></b>: Wait for the next change to a ccache.  <a href="#4c815231f7e071a1dedd9aef3cedb0ef"></a><br></dl></ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="ef46c1c04ceb1a0a479db84ddba7160c"></a><!-- doxytag: member="cc_ccache_f::release" ref="ef46c1c04ceb1a0a479db84ddba7160c" args=")(cc_ccache_t io_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#ef46c1c04ceb1a0a479db84ddba7160c">release</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#ge517135d87d8775d77b426d57a491ef0">cc_ccache_release()</a></b>: Release memory associated with a cc_ccache_t object. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_ccache</em>&nbsp;</td><td>the ccache object to release. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--<dl compact><dt><b>Note:</b></dt><dd>Does not modify the ccache. If you wish to remove the ccache see <a class="el" href="group__helper__macros.html#ge05b68d91bece2f99b531e96cde8d457">cc_ccache_destroy()</a>. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="86872ea5155e7ff57f4674a8f8c1d6c5"></a><!-- doxytag: member="cc_ccache_f::destroy" ref="86872ea5155e7ff57f4674a8f8c1d6c5" args=")(cc_ccache_t io_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#86872ea5155e7ff57f4674a8f8c1d6c5">destroy</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#ge05b68d91bece2f99b531e96cde8d457">cc_ccache_destroy()</a></b>: Destroy a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_ccache</em>&nbsp;</td><td>the ccache object to destroy and release. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Destroy the ccache referred to by <em>io_ccache</em> and releases memory associated with the <em>io_ccache</em> object. After this call <em>io_ccache</em> becomes invalid. If <em>io_ccache</em> was the default ccache, the next ccache in the cache collection (if any) becomes the new default.     </td>
--  </tr>
--</table>
--<a class="anchor" name="93c7e154d7472227b02d240a13dd53da"></a><!-- doxytag: member="cc_ccache_f::set_default" ref="93c7e154d7472227b02d240a13dd53da" args=")(cc_ccache_t io_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#93c7e154d7472227b02d240a13dd53da">set_default</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g535b92993b85d92b67fa622447afbe13">cc_ccache_set_default()</a></b>: Make a ccache the default ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_ccache</em>&nbsp;</td><td>a ccache object to make the new default ccache. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="934cc9927404ee42460008b49e572158"></a><!-- doxytag: member="cc_ccache_f::get_credentials_version" ref="934cc9927404ee42460008b49e572158" args=")(cc_ccache_t in_ccache, cc_uint32 *out_credentials_version)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#934cc9927404ee42460008b49e572158">get_credentials_version</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> *out_credentials_version)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g934f93499765bdd179bb2342ae0f0fa6">cc_ccache_get_credentials_version()</a></b>: Get the credentials version of a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_credentials_version</em>&nbsp;</td><td>on exit, the credentials version of <em>in_ccache</em>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--<a class="el" href="group__helper__macros.html#g934f93499765bdd179bb2342ae0f0fa6">cc_ccache_get_credentials_version()</a> returns one value of the enumerated type cc_credentials_vers. The possible return values are <a class="el" href="group__ccapi__constants__reference.html#ggae76da96fff95c157c3b28c4455dc35c017c26531bad42f92f7f3e1f697b58fa">cc_credentials_v4</a> (if ccache's v4 principal has been set), <a class="el" href="group__ccapi__constants__reference.html#ggae76da96fff95c157c3b28c4455dc35c98335a31ad81a10632568375dcc10668">cc_credentials_v5</a> (if ccache's v5 principal has been set), or <a class="el" href="group__ccapi__constants__reference.html#ggae76da96fff95c157c3b28c4455dc35ca49ae6c35599f5860241601dcb0c9e0d">cc_credentials_v4_v5</a> (if both ccache's v4 and v5 principals have been set). A ccache's principal is set with one of <a class="el" href="group__helper__macros.html#g9fbcbd0f1b107cdaa2a0179e227f82cf">cc_context_create_ccache()</a>, <a class="el" href="group__helper__macros.html#g1a6dffb1db25590351646fdcf9824f09">cc_context_create_new_ccache()</a>, <a class="el" href="group__helper__macros.html#g10a184dd699cae4df6f3480290804a72">cc_context_create_default_ccache()</a>, or <a class="el" href="group__helper__macros.html#gfaa81492b5d7b3ba00208a9577ce0ba2">cc_ccache_set_principal()</a>.     </td>
--  </tr>
--</table>
--<a class="anchor" name="e60fec8fe34019df7108e8deed0f52ac"></a><!-- doxytag: member="cc_ccache_f::get_name" ref="e60fec8fe34019df7108e8deed0f52ac" args=")(cc_ccache_t in_ccache, cc_string_t *out_name)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#e60fec8fe34019df7108e8deed0f52ac">get_name</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="structcc__string__d.html">cc_string_t</a> *out_name)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g042bea6044879ec03996b190792e3ae9">cc_ccache_get_name()</a></b>: Get the name of a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_name</em>&nbsp;</td><td>on exit, a cc_string_t representing the name of <em>in_ccache</em>. <em>out_name</em> must be released with <a class="el" href="group__helper__macros.html#ge9bebfed2d574e69f29dd341bc8a63d9">cc_string_release()</a>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="ef23df23bb71b1f01138b791bc8b6255"></a><!-- doxytag: member="cc_ccache_f::get_principal" ref="ef23df23bb71b1f01138b791bc8b6255" args=")(cc_ccache_t in_ccache, cc_uint32 in_credentials_version, cc_string_t *out_principal)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#ef23df23bb71b1f01138b791bc8b6255">get_principal</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_credentials_version, <a class="el" href="structcc__string__d.html">cc_string_t</a> *out_principal)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g464aa49a2e8054c9c3c2a3410eaf5c54">cc_ccache_get_principal()</a></b>: Get the principal of a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_credentials_version</em>&nbsp;</td><td>the credentials version to get the principal for. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_principal</em>&nbsp;</td><td>on exit, a cc_string_t representing the principal of <em>in_ccache</em>. <em>out_principal</em> must be released with <a class="el" href="group__helper__macros.html#ge9bebfed2d574e69f29dd341bc8a63d9">cc_string_release()</a>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Return the principal for the ccache that was set via <a class="el" href="group__helper__macros.html#g9fbcbd0f1b107cdaa2a0179e227f82cf">cc_context_create_ccache()</a>, <a class="el" href="group__helper__macros.html#g10a184dd699cae4df6f3480290804a72">cc_context_create_default_ccache()</a>, <a class="el" href="group__helper__macros.html#g1a6dffb1db25590351646fdcf9824f09">cc_context_create_new_ccache()</a>, or <a class="el" href="group__helper__macros.html#gfaa81492b5d7b3ba00208a9577ce0ba2">cc_ccache_set_principal()</a>. Principals for v4 and v5 are separate, but should be kept synchronized for each ccache; they can be retrieved by passing cc_credentials_v4 or cc_credentials_v5 in cred_vers. Passing cc_credentials_v4_v5 will result in the error ccErrBadCredentialsVersion.     </td>
--  </tr>
--</table>
--<a class="anchor" name="0d72ae907e8357633fe4ff2248818f42"></a><!-- doxytag: member="cc_ccache_f::set_principal" ref="0d72ae907e8357633fe4ff2248818f42" args=")(cc_ccache_t io_ccache, cc_uint32 in_credentials_version, const char *in_principal)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#0d72ae907e8357633fe4ff2248818f42">set_principal</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_credentials_version, const char *in_principal)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#gfaa81492b5d7b3ba00208a9577ce0ba2">cc_ccache_set_principal()</a></b>: Set the principal of a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_credentials_version</em>&nbsp;</td><td>the credentials version to set the principal for. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_principal</em>&nbsp;</td><td>a C string representing the new principal of <em>in_ccache</em>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Set the a principal for ccache. The v4 and v5 principals can be set independently, but they should always be kept equal, up to differences in string representation between v4 and v5. Passing cc_credentials_v4_v5 in cred_vers will result in the error ccErrBadCredentialsVersion.     </td>
--  </tr>
--</table>
--<a class="anchor" name="c4ac7d0cb5e15309978d8c4990f769a3"></a><!-- doxytag: member="cc_ccache_f::store_credentials" ref="c4ac7d0cb5e15309978d8c4990f769a3" args=")(cc_ccache_t io_ccache, const cc_credentials_union *in_credentials_union)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#c4ac7d0cb5e15309978d8c4990f769a3">store_credentials</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, const <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a> *in_credentials_union)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g35c1548dbacb8907da7b8c3124eabf39">cc_ccache_store_credentials()</a></b>: Store credentials in a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_credentials_union</em>&nbsp;</td><td>the credentials to store in <em>io_ccache</em>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Store a copy of credentials in the ccache.<p>
--See the description of the credentials types for the meaning of <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a> fields.<p>
--Before credentials of a specific credential type can be stored in a ccache, the corresponding principal version has to be set. For example, before you can store Kerberos v4 credentials in a ccache, the Kerberos v4 principal has to be set either by <a class="el" href="group__helper__macros.html#g9fbcbd0f1b107cdaa2a0179e227f82cf">cc_context_create_ccache()</a>, <a class="el" href="group__helper__macros.html#g10a184dd699cae4df6f3480290804a72">cc_context_create_default_ccache()</a>, <a class="el" href="group__helper__macros.html#g1a6dffb1db25590351646fdcf9824f09">cc_context_create_new_ccache()</a>, or <a class="el" href="group__helper__macros.html#gfaa81492b5d7b3ba00208a9577ce0ba2">cc_ccache_set_principal()</a>; likewise for Kerberos v5. Otherwise, ccErrBadCredentialsVersion is returned.     </td>
--  </tr>
--</table>
--<a class="anchor" name="6cc6d19ff6044fafc3cd9f42c338341c"></a><!-- doxytag: member="cc_ccache_f::remove_credentials" ref="6cc6d19ff6044fafc3cd9f42c338341c" args=")(cc_ccache_t io_ccache, cc_credentials_t in_credentials)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#6cc6d19ff6044fafc3cd9f42c338341c">remove_credentials</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, <a class="el" href="structcc__credentials__d.html">cc_credentials_t</a> in_credentials)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#ga1bbc05414ad4c17cea9cd5e5c50c7cc">cc_ccache_remove_credentials()</a></b>: Remove credentials from a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_credentials</em>&nbsp;</td><td>the credentials to remove from <em>io_ccache</em>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Removes credentials from a ccache. Note that credentials must be previously acquired from the CCache API; only exactly matching credentials will be removed. (This places the burden of determining exactly which credentials to remove on the caller, but ensures there is no ambigity about which credentials will be removed.) cc_credentials_t objects can be obtained by iterating over the ccache's credentials with <a class="el" href="group__helper__macros.html#g893b31c419e71c2f528781d3036fa3ff">cc_ccache_new_credentials_iterator()</a>.<p>
--If found, the credentials are removed from the ccache. The credentials parameter is not modified and should be freed by the caller. It is legitimate to call this function while an iterator is traversing the ccache, and the deletion of a credential already returned by <a class="el" href="group__helper__macros.html#g0c2f41d90f478b2415b699085f8fcaa4">cc_credentials_iterator_next()</a> will not disturb sequence of credentials returned by <a class="el" href="group__helper__macros.html#g0c2f41d90f478b2415b699085f8fcaa4">cc_credentials_iterator_next()</a>.     </td>
--  </tr>
--</table>
--<a class="anchor" name="4efc19a7cd2ac6695da44cb7f7e9be14"></a><!-- doxytag: member="cc_ccache_f::new_credentials_iterator" ref="4efc19a7cd2ac6695da44cb7f7e9be14" args=")(cc_ccache_t in_ccache, cc_credentials_iterator_t *out_credentials_iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#4efc19a7cd2ac6695da44cb7f7e9be14">new_credentials_iterator</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> *out_credentials_iterator)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g893b31c419e71c2f528781d3036fa3ff">cc_ccache_new_credentials_iterator()</a></b>: Iterate over credentials in a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_credentials_iterator</em>&nbsp;</td><td>a credentials iterator for <em>io_ccache</em>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Allocates memory for iterator and initializes it. Successive calls to <a class="el" href="group__helper__macros.html#g0c2f41d90f478b2415b699085f8fcaa4">cc_credentials_iterator_next()</a> will return credentials from the ccache.<p>
--If changes are made to the ccache while an iterator is being used on it, the iterator must return at least the intersection, and at most the union, of the set of credentials that were in the ccache when the iteration began and the set of credentials that are in the ccache when it ends.     </td>
--  </tr>
--</table>
--<a class="anchor" name="d4e0dc020d293643405a07396b6f5942"></a><!-- doxytag: member="cc_ccache_f::move" ref="d4e0dc020d293643405a07396b6f5942" args=")(cc_ccache_t io_source_ccache, cc_ccache_t io_destination_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#d4e0dc020d293643405a07396b6f5942">move</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_source_ccache, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_destination_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#ge1238f80c37ae89486f2ba29bcbcae38">cc_ccache_move()</a></b>: Move the contents of one ccache into another, destroying the source. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_source_ccache</em>&nbsp;</td><td>a ccache object to move. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>io_destination_ccache</em>&nbsp;</td><td>a ccache object replace with the contents of <em>io_source_ccache</em>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--<a class="el" href="group__helper__macros.html#ge1238f80c37ae89486f2ba29bcbcae38">cc_ccache_move()</a> atomically copies the credentials, credential versions and principals from one ccache to another. On successful completion <em>io_source_ccache</em> will be released and the ccache it points to will be destroyed. Any credentials previously in <em>io_destination_ccache</em> will be replaced with credentials from <em>io_source_ccache</em>. The only part of <em>io_destination_ccache</em> which remains constant is the name. Any other callers referring to <em>io_destination_ccache</em> will suddenly see new data in it.<p>
--Typically <a class="el" href="group__helper__macros.html#ge1238f80c37ae89486f2ba29bcbcae38">cc_ccache_move()</a> is used when the caller wishes to safely overwrite the contents of a ccache with new data which requires several steps to generate. <a class="el" href="group__helper__macros.html#ge1238f80c37ae89486f2ba29bcbcae38">cc_ccache_move()</a> allows the caller to create a temporary ccache (which can be destroyed if any intermediate step fails) and the atomically copy the temporary cache into the destination.     </td>
--  </tr>
--</table>
--<a class="anchor" name="731d262d2aa179451f824d320c460f58"></a><!-- doxytag: member="cc_ccache_f::lock" ref="731d262d2aa179451f824d320c460f58" args=")(cc_ccache_t io_ccache, cc_uint32 in_lock_type, cc_uint32 in_block)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#731d262d2aa179451f824d320c460f58">lock</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_lock_type, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_block)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#gb8c2624719ee1c4be5f1b1bc4844f0cc">cc_ccache_lock()</a></b>: Lock a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_ccache</em>&nbsp;</td><td>the ccache object for the ccache you wish to lock. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_lock_type</em>&nbsp;</td><td>the type of lock to obtain. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_block</em>&nbsp;</td><td>whether or not the function should block if the lock cannot be obtained immediately. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Attempts to acquire an advisory lock for a ccache. Allowed values for lock_type are:<p>
--<ul>
--<li>cc_lock_read: a read lock. </li>
--<li>cc_lock_write: a write lock </li>
--<li>cc_lock_upgrade: upgrade an already-obtained read lock to a write lock </li>
--<li>cc_lock_downgrade: downgrade an already-obtained write lock to a read lock</li>
--</ul>
--If block is cc_lock_block, <a class="el" href="structcc__ccache__f.html#731d262d2aa179451f824d320c460f58">lock()</a> will not return until the lock is acquired. If block is cc_lock_noblock, <a class="el" href="structcc__ccache__f.html#731d262d2aa179451f824d320c460f58">lock()</a> will return immediately, either acquiring the lock and returning ccNoError, or failing to acquire the lock and returning an error explaining why.<p>
--To avoid having to deal with differences between thread semantics on different platforms, locks are granted per ccache, rather than per thread or per process. That means that different threads of execution have to acquire separate contexts in order to be able to synchronize with each other.<p>
--The lock should be unlocked by using <a class="el" href="group__helper__macros.html#ge9b13c950cb6ee636c4a73d6c569a811">cc_ccache_unlock()</a>.<p>
--<dl compact><dt><b>Note:</b></dt><dd>All locks are advisory. For example, callers which do not call <a class="el" href="group__helper__macros.html#gb8c2624719ee1c4be5f1b1bc4844f0cc">cc_ccache_lock()</a> and <a class="el" href="group__helper__macros.html#ge9b13c950cb6ee636c4a73d6c569a811">cc_ccache_unlock()</a> will not be prevented from writing to the ccache when you have a read lock. This is because the CCAPI locking was added after the first release and thus adding mandatory locks would have changed the user experience and performance of existing applications. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="bffbfe60a3e8da64224623df5235159a"></a><!-- doxytag: member="cc_ccache_f::unlock" ref="bffbfe60a3e8da64224623df5235159a" args=")(cc_ccache_t io_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#bffbfe60a3e8da64224623df5235159a">unlock</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#ge9b13c950cb6ee636c4a73d6c569a811">cc_ccache_unlock()</a></b>: Unlock a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="c65301a0ef050524286130185c3ec06d"></a><!-- doxytag: member="cc_ccache_f::get_last_default_time" ref="c65301a0ef050524286130185c3ec06d" args=")(cc_ccache_t in_ccache, cc_time_t *out_last_default_time)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#c65301a0ef050524286130185c3ec06d">get_last_default_time</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> *out_last_default_time)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#gb19ef7d2b1bcfb474e18e157fb3bc9c6">cc_ccache_get_change_time()</a></b>: Get the last time a ccache was the default ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a cache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_last_default_time</em>&nbsp;</td><td>on exit, the last time the ccache was default. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--This function returns the last time when the ccache was made the default ccache. This allows clients to sort the ccaches by how recently they were default, which is useful for user listing of ccaches. If the ccache was never default, ccErrNeverDefault is returned.     </td>
--  </tr>
--</table>
--<a class="anchor" name="a73ffc6e33ca8155cd644aa5d702c36f"></a><!-- doxytag: member="cc_ccache_f::get_change_time" ref="a73ffc6e33ca8155cd644aa5d702c36f" args=")(cc_ccache_t in_ccache, cc_time_t *out_change_time)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#a73ffc6e33ca8155cd644aa5d702c36f">get_change_time</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> *out_change_time)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#gb19ef7d2b1bcfb474e18e157fb3bc9c6">cc_ccache_get_change_time()</a></b>: Get the last time a ccache changed. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a cache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_change_time</em>&nbsp;</td><td>on exit, the last time the ccache changed. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. If the ccache was never the default ccache, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7604f23ab0c8c3e1d97f8b32c4501a895">ccErrNeverDefault</a>. Otherwise, an error code representing the failure.</dd></dl>
--This function returns the time of the most recent change made to a ccache. By maintaining a local copy the caller can deduce whether or not the ccache has been modified since the previous call to <a class="el" href="group__helper__macros.html#gb19ef7d2b1bcfb474e18e157fb3bc9c6">cc_ccache_get_change_time()</a>.<p>
--The time returned by <a class="el" href="group__helper__macros.html#gb19ef7d2b1bcfb474e18e157fb3bc9c6">cc_ccache_get_change_time()</a> increases whenever:<p>
--<ul>
--<li>a credential is stored </li>
--<li>a credential is removed </li>
--<li>a ccache principal is changed </li>
--<li>the ccache becomes the default ccache </li>
--<li>the ccache is no longer the default ccache</li>
--</ul>
--<dl compact><dt><b>Note:</b></dt><dd>In order to be able to compare two values returned by <a class="el" href="group__helper__macros.html#gb19ef7d2b1bcfb474e18e157fb3bc9c6">cc_ccache_get_change_time()</a>, the caller must use the same ccache object to acquire them. Callers should maintain a single ccache object in memory for <a class="el" href="group__helper__macros.html#gb19ef7d2b1bcfb474e18e157fb3bc9c6">cc_ccache_get_change_time()</a> calls rather than creating a new ccache object for every call.</dd></dl>
--<dl compact><dt><b>See also:</b></dt><dd><a class="el" href="structcc__ccache__f.html#4c815231f7e071a1dedd9aef3cedb0ef">wait_for_change</a> </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="30719ac8b49a62bf73cb2841e397a81d"></a><!-- doxytag: member="cc_ccache_f::compare" ref="30719ac8b49a62bf73cb2841e397a81d" args=")(cc_ccache_t in_ccache, cc_ccache_t in_compare_to_ccache, cc_uint32 *out_equal)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#30719ac8b49a62bf73cb2841e397a81d">compare</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_compare_to_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> *out_equal)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g197ff60fac986634fbef8ca102ec54a5">cc_ccache_compare()</a></b>: Compare two ccache objects. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_compare_to_ccache</em>&nbsp;</td><td>a ccache object to compare with <em>in_ccache</em>. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_equal</em>&nbsp;</td><td>on exit, whether or not the two ccaches refer to the same ccache. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="106ee10feffc1681c7583d6aac4d33b4"></a><!-- doxytag: member="cc_ccache_f::get_kdc_time_offset" ref="106ee10feffc1681c7583d6aac4d33b4" args=")(cc_ccache_t in_ccache, cc_uint32 in_credentials_version, cc_time_t *out_time_offset)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#106ee10feffc1681c7583d6aac4d33b4">get_kdc_time_offset</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_credentials_version, <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> *out_time_offset)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g1fa36a89752da4a491d2ecdad17f8b0e">cc_ccache_get_kdc_time_offset()</a></b>: Get the KDC time offset for credentials in a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_credentials_version</em>&nbsp;</td><td>the credentials version to get the time offset for. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_time_offset</em>&nbsp;</td><td>on exit, the KDC time offset for <em>in_ccache</em> for credentials version <em>in_credentials_version</em>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a> if a time offset was obtained or <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7d6825aa88394eb52df80bef870d986db">ccErrTimeOffsetNotSet</a> if a time offset has not been set. On failure, an error code representing the failure. </dd></dl>
--<dl compact><dt><b>See also:</b></dt><dd><a class="el" href="structcc__ccache__f.html#d537ad02da9b4eae3f5e51df0c58ee2e">set_kdc_time_offset</a>, <a class="el" href="structcc__ccache__f.html#bc092bd23b9081d12e695faa55913257">clear_kdc_time_offset</a></dd></dl>
--Sometimes the KDC and client's clocks get out of sync. <a class="el" href="group__helper__macros.html#g1fa36a89752da4a491d2ecdad17f8b0e">cc_ccache_get_kdc_time_offset()</a> returns the difference between the KDC and client's clocks at the time credentials were acquired. This offset allows callers to figure out how much time is left on a given credential even though the end_time is based on the KDC's clock not the client's clock.     </td>
--  </tr>
--</table>
--<a class="anchor" name="d537ad02da9b4eae3f5e51df0c58ee2e"></a><!-- doxytag: member="cc_ccache_f::set_kdc_time_offset" ref="d537ad02da9b4eae3f5e51df0c58ee2e" args=")(cc_ccache_t io_ccache, cc_uint32 in_credentials_version, cc_time_t in_time_offset)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#d537ad02da9b4eae3f5e51df0c58ee2e">set_kdc_time_offset</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_credentials_version, <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> in_time_offset)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g519bf0ab152e5a3d2beee8a76a27d16e">cc_ccache_set_kdc_time_offset()</a></b>: Set the KDC time offset for credentials in a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_credentials_version</em>&nbsp;</td><td>the credentials version to get the time offset for. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_time_offset</em>&nbsp;</td><td>the new KDC time offset for <em>in_ccache</em> for credentials version <em>in_credentials_version</em>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--<dl compact><dt><b>See also:</b></dt><dd><a class="el" href="structcc__ccache__f.html#106ee10feffc1681c7583d6aac4d33b4">get_kdc_time_offset</a>, <a class="el" href="structcc__ccache__f.html#bc092bd23b9081d12e695faa55913257">clear_kdc_time_offset</a></dd></dl>
--Sometimes the KDC and client's clocks get out of sync. <a class="el" href="group__helper__macros.html#g519bf0ab152e5a3d2beee8a76a27d16e">cc_ccache_set_kdc_time_offset()</a> sets the difference between the KDC and client's clocks at the time credentials were acquired. This offset allows callers to figure out how much time is left on a given credential even though the end_time is based on the KDC's clock not the client's clock.     </td>
--  </tr>
--</table>
--<a class="anchor" name="bc092bd23b9081d12e695faa55913257"></a><!-- doxytag: member="cc_ccache_f::clear_kdc_time_offset" ref="bc092bd23b9081d12e695faa55913257" args=")(cc_ccache_t io_ccache, cc_uint32 in_credentials_version)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#bc092bd23b9081d12e695faa55913257">clear_kdc_time_offset</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> io_ccache, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_credentials_version)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g803c35f92992dc0b73e8809d13ebabab">cc_ccache_clear_kdc_time_offset()</a></b>: Clear the KDC time offset for credentials in a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_credentials_version</em>&nbsp;</td><td>the credentials version to get the time offset for. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--<dl compact><dt><b>See also:</b></dt><dd><a class="el" href="structcc__ccache__f.html#106ee10feffc1681c7583d6aac4d33b4">get_kdc_time_offset</a>, <a class="el" href="structcc__ccache__f.html#d537ad02da9b4eae3f5e51df0c58ee2e">set_kdc_time_offset</a></dd></dl>
--Sometimes the KDC and client's clocks get out of sync. <a class="el" href="group__helper__macros.html#g803c35f92992dc0b73e8809d13ebabab">cc_ccache_clear_kdc_time_offset()</a> clears the difference between the KDC and client's clocks at the time credentials were acquired. This offset allows callers to figure out how much time is left on a given credential even though the end_time is based on the KDC's clock not the client's clock.     </td>
--  </tr>
--</table>
--<a class="anchor" name="4c815231f7e071a1dedd9aef3cedb0ef"></a><!-- doxytag: member="cc_ccache_f::wait_for_change" ref="4c815231f7e071a1dedd9aef3cedb0ef" args=")(cc_ccache_t in_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__f.html#4c815231f7e071a1dedd9aef3cedb0ef">wait_for_change</a>)(<a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> in_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#gc508ad0c010c88ad8ff0739b43a2b199">cc_ccache_wait_for_change()</a></b>: Wait for the next change to a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache</em>&nbsp;</td><td>a ccache object. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--This function blocks until the next change is made to the ccache referenced by <em>in_ccache</em>. By repeatedly calling <a class="el" href="group__helper__macros.html#gc508ad0c010c88ad8ff0739b43a2b199">cc_ccache_wait_for_change()</a> from a worker thread the caller can effectively receive callbacks whenever the ccache changes. This is considerably more efficient than polling with <a class="el" href="group__helper__macros.html#gb19ef7d2b1bcfb474e18e157fb3bc9c6">cc_ccache_get_change_time()</a>.<p>
--<a class="el" href="group__helper__macros.html#gc508ad0c010c88ad8ff0739b43a2b199">cc_ccache_wait_for_change()</a> will return whenever:<p>
--<ul>
--<li>a credential is stored </li>
--<li>a credential is removed </li>
--<li>the ccache principal is changed </li>
--<li>the ccache becomes the default ccache </li>
--<li>the ccache is no longer the default ccache</li>
--</ul>
--<dl compact><dt><b>Note:</b></dt><dd>In order to make sure that the caller doesn't miss any changes, <a class="el" href="group__helper__macros.html#gc508ad0c010c88ad8ff0739b43a2b199">cc_ccache_wait_for_change()</a> always returns immediately after the first time it is called on a new ccache object. Callers must use the same ccache object for successive calls to <a class="el" href="group__helper__macros.html#gc508ad0c010c88ad8ff0739b43a2b199">cc_ccache_wait_for_change()</a> rather than creating a new ccache object for every call.</dd></dl>
--<dl compact><dt><b>See also:</b></dt><dd><a class="el" href="structcc__ccache__f.html#a73ffc6e33ca8155cd644aa5d702c36f">get_change_time</a> </dd></dl>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:05 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__ccache__iterator__d.html b/doc/ccapi/html/structcc__ccache__iterator__d.html
-deleted file mode 100644
-index 5e85ee2da..000000000
---- a/doc/ccapi/html/structcc__ccache__iterator__d.html
-+++ /dev/null
-@@ -1,43 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_ccache_iterator_d Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_ccache_iterator_d Struct Reference<br>
--<small>
--[<a class="el" href="group__cc__ccache__iterator__reference.html">cc_ccache_iterator_t Overview</a>]</small>
--</h1><!-- doxytag: class="cc_ccache_iterator_d" --><h2>Data Fields</h2>
--<ul>
--<li>const <a class="el" href="structcc__ccache__iterator__f.html">cc_ccache_iterator_f</a> * <a class="el" href="structcc__ccache__iterator__d.html#7cd2785c0dd1902e651805f478acae3e">functions</a>
--</ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="7cd2785c0dd1902e651805f478acae3e"></a><!-- doxytag: member="cc_ccache_iterator_d::functions" ref="7cd2785c0dd1902e651805f478acae3e" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">const <a class="el" href="structcc__ccache__iterator__f.html">cc_ccache_iterator_f</a>* <a class="el" href="structcc__ccache__iterator__d.html#7cd2785c0dd1902e651805f478acae3e">functions</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:05 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__ccache__iterator__f.html b/doc/ccapi/html/structcc__ccache__iterator__f.html
-deleted file mode 100644
-index 333aab8f4..000000000
---- a/doc/ccapi/html/structcc__ccache__iterator__f.html
-+++ /dev/null
-@@ -1,117 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_ccache_iterator_f Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_ccache_iterator_f Struct Reference</h1><!-- doxytag: class="cc_ccache_iterator_f" --><hr><a name="_details"></a><h2>Detailed Description</h2>
--Function pointer table for cc_ccache_iterator_t. For more information see <a class="el" href="group__cc__ccache__iterator__reference.html">cc_ccache_iterator_t Overview</a>. 
--<p>
--<h2>Data Fields</h2>
--<ul>
--<li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__iterator__f.html#4df0298826e5004ca873b005d6d3b9d0">release</a> )(<a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_t</a> io_ccache_iterator)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g34f37496fb8bc414aafb0b265afecb1b">cc_ccache_iterator_release()</a></b>: Release memory associated with a cc_ccache_iterator_t object.  <a href="#4df0298826e5004ca873b005d6d3b9d0"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__iterator__f.html#6f1c5bf2a8c3ca2fb1761a039fbf30cb">next</a> )(<a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_t</a> in_ccache_iterator, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#gcff0b3e247a2adc95442324fec6c5651">cc_ccache_iterator_next()</a></b>: Get the next ccache in the cache collection.  <a href="#6f1c5bf2a8c3ca2fb1761a039fbf30cb"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__iterator__f.html#3a2fc1000215e7e8a2ef5b29eb4af890">clone</a> )(<a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_t</a> in_ccache_iterator, <a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_t</a> *out_ccache_iterator)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g904d7757fd7ac40f4ee9b448a389f2dd">cc_ccache_iterator_clone()</a></b>: Make a copy of a ccache iterator.  <a href="#3a2fc1000215e7e8a2ef5b29eb4af890"></a><br></dl></ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="4df0298826e5004ca873b005d6d3b9d0"></a><!-- doxytag: member="cc_ccache_iterator_f::release" ref="4df0298826e5004ca873b005d6d3b9d0" args=")(cc_ccache_iterator_t io_ccache_iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__iterator__f.html#4df0298826e5004ca873b005d6d3b9d0">release</a>)(<a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_t</a> io_ccache_iterator)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g34f37496fb8bc414aafb0b265afecb1b">cc_ccache_iterator_release()</a></b>: Release memory associated with a cc_ccache_iterator_t object. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_ccache_iterator</em>&nbsp;</td><td>the ccache iterator object to release. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="6f1c5bf2a8c3ca2fb1761a039fbf30cb"></a><!-- doxytag: member="cc_ccache_iterator_f::next" ref="6f1c5bf2a8c3ca2fb1761a039fbf30cb" args=")(cc_ccache_iterator_t in_ccache_iterator, cc_ccache_t *out_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__iterator__f.html#6f1c5bf2a8c3ca2fb1761a039fbf30cb">next</a>)(<a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_t</a> in_ccache_iterator, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#gcff0b3e247a2adc95442324fec6c5651">cc_ccache_iterator_next()</a></b>: Get the next ccache in the cache collection. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache_iterator</em>&nbsp;</td><td>a ccache iterator object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_ccache</em>&nbsp;</td><td>on exit, the next ccache in the cache collection. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a> if the next ccache in the cache collection was obtained or <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b748d5a55ed773e002ccc271beb4512c0a">ccIteratorEnd</a> if there are no more ccaches. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="3a2fc1000215e7e8a2ef5b29eb4af890"></a><!-- doxytag: member="cc_ccache_iterator_f::clone" ref="3a2fc1000215e7e8a2ef5b29eb4af890" args=")(cc_ccache_iterator_t in_ccache_iterator, cc_ccache_iterator_t *out_ccache_iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__ccache__iterator__f.html#3a2fc1000215e7e8a2ef5b29eb4af890">clone</a>)(<a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_t</a> in_ccache_iterator, <a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_t</a> *out_ccache_iterator)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g904d7757fd7ac40f4ee9b448a389f2dd">cc_ccache_iterator_clone()</a></b>: Make a copy of a ccache iterator. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_ccache_iterator</em>&nbsp;</td><td>a ccache iterator object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_ccache_iterator</em>&nbsp;</td><td>on exit, a copy of <em>in_ccache_iterator</em>. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:05 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__context__d.html b/doc/ccapi/html/structcc__context__d.html
-deleted file mode 100644
-index d3904a2a1..000000000
---- a/doc/ccapi/html/structcc__context__d.html
-+++ /dev/null
-@@ -1,43 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_context_d Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_context_d Struct Reference<br>
--<small>
--[<a class="el" href="group__cc__context__reference.html">cc_context_t Overview</a>]</small>
--</h1><!-- doxytag: class="cc_context_d" --><h2>Data Fields</h2>
--<ul>
--<li>const <a class="el" href="structcc__context__f.html">cc_context_f</a> * <a class="el" href="structcc__context__d.html#ac5b195bc75b92f5c1924e6a3a6aa611">functions</a>
--</ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="ac5b195bc75b92f5c1924e6a3a6aa611"></a><!-- doxytag: member="cc_context_d::functions" ref="ac5b195bc75b92f5c1924e6a3a6aa611" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">const <a class="el" href="structcc__context__f.html">cc_context_f</a>* <a class="el" href="structcc__context__d.html#ac5b195bc75b92f5c1924e6a3a6aa611">functions</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:05 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__context__f.html b/doc/ccapi/html/structcc__context__f.html
-deleted file mode 100644
-index fe310518a..000000000
---- a/doc/ccapi/html/structcc__context__f.html
-+++ /dev/null
-@@ -1,513 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_context_f Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_context_f Struct Reference</h1><!-- doxytag: class="cc_context_f" --><hr><a name="_details"></a><h2>Detailed Description</h2>
--Function pointer table for cc_context_t. For more information see <a class="el" href="group__cc__context__reference.html">cc_context_t Overview</a>. 
--<p>
--<h2>Data Fields</h2>
--<ul>
--<li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#239ea938e3c076e6e245a9236bb05b24">release</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> io_context)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g8ff82ce108889d4ed29f46ffe6efc40e">cc_context_release()</a></b>: Release memory associated with a cc_context_t.  <a href="#239ea938e3c076e6e245a9236bb05b24"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#51bd5a48dcd263bfb3128cc5838b4cd7">get_change_time</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> *out_time)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g82f551af17455b78fa3a2e3f83c96907">cc_context_get_change_time()</a></b>: Get the last time the cache collection changed.  <a href="#51bd5a48dcd263bfb3128cc5838b4cd7"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#4e9432f5a1a10319037b0f04e8219c1b">get_default_ccache_name</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="structcc__string__d.html">cc_string_t</a> *out_name)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#gcb4eb9f1db6f8ebf261339ad87cb6c51">cc_context_get_default_ccache_name()</a></b>: Get the name of the default ccache.  <a href="#4e9432f5a1a10319037b0f04e8219c1b"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#bf8e7415758b890ca8f01ce5a00985ab">open_ccache</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, const char *in_name, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g256a5ba17fe0e4502e0722d9b081bbef">cc_context_open_ccache()</a></b>: Open a ccache.  <a href="#bf8e7415758b890ca8f01ce5a00985ab"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#7f101feaa1c88c8997b678507c029c39">open_default_ccache</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g45a7ce29eb409baabadcae1bc95d5c57">cc_context_open_default_ccache()</a></b>: Open the default ccache.  <a href="#7f101feaa1c88c8997b678507c029c39"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#82d3579723a0f909cb46c2016ed4ae22">create_ccache</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, const char *in_name, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_cred_vers, const char *in_principal, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g9fbcbd0f1b107cdaa2a0179e227f82cf">cc_context_create_ccache()</a></b>: Create a new ccache.  <a href="#82d3579723a0f909cb46c2016ed4ae22"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#b52a31c1fb59ac752baa16503d8e0e3f">create_default_ccache</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_cred_vers, const char *in_principal, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g10a184dd699cae4df6f3480290804a72">cc_context_create_default_ccache()</a></b>: Create a new default ccache.  <a href="#b52a31c1fb59ac752baa16503d8e0e3f"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#939a8ed76079bf71000347c40aeb5b2f">create_new_ccache</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_cred_vers, const char *in_principal, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g1a6dffb1db25590351646fdcf9824f09">cc_context_create_new_ccache()</a></b>: Create a new uniquely named ccache.  <a href="#939a8ed76079bf71000347c40aeb5b2f"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#0f945985d42255226915403df147667f">new_ccache_iterator</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_t</a> *out_iterator)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g6957bc9570e4769a5b1213d2a1d90cd7">cc_context_new_ccache_iterator()</a></b>: Get an iterator for the cache collection.  <a href="#0f945985d42255226915403df147667f"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#1be78f795193b04c4f45cb7d3c46480c">lock</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_lock_type, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_block)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#gcf4595340ddc8dafa539a86ac317625d">cc_context_lock()</a></b>: Lock the cache collection.  <a href="#1be78f795193b04c4f45cb7d3c46480c"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#55e38bd72efee8445b3abbc3fa5e7e27">unlock</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_cc_context)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g544261b88c9ac0f2379a35648cae3f27">cc_context_unlock()</a></b>: Unlock the cache collection.  <a href="#55e38bd72efee8445b3abbc3fa5e7e27"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#bb728ccd97eb387991feed0500475112">compare</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_cc_context, <a class="el" href="structcc__context__d.html">cc_context_t</a> in_compare_to_context, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> *out_equal)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g9258ef05d06f3d4dc798ec654f78b967">cc_context_compare()</a></b>: Compare two context objects.  <a href="#bb728ccd97eb387991feed0500475112"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#39a27ecd6d29fb7288f983c42d5686d0">wait_for_change</a> )(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_cc_context)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g9eb3508958528c00844a101275497e5a">cc_context_wait_for_change()</a></b>: Wait for the next change in the cache collection.  <a href="#39a27ecd6d29fb7288f983c42d5686d0"></a><br></dl></ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="239ea938e3c076e6e245a9236bb05b24"></a><!-- doxytag: member="cc_context_f::release" ref="239ea938e3c076e6e245a9236bb05b24" args=")(cc_context_t io_context)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#239ea938e3c076e6e245a9236bb05b24">release</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> io_context)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g8ff82ce108889d4ed29f46ffe6efc40e">cc_context_release()</a></b>: Release memory associated with a cc_context_t. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_context</em>&nbsp;</td><td>the context object to free. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="51bd5a48dcd263bfb3128cc5838b4cd7"></a><!-- doxytag: member="cc_context_f::get_change_time" ref="51bd5a48dcd263bfb3128cc5838b4cd7" args=")(cc_context_t in_context, cc_time_t *out_time)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#51bd5a48dcd263bfb3128cc5838b4cd7">get_change_time</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> *out_time)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g82f551af17455b78fa3a2e3f83c96907">cc_context_get_change_time()</a></b>: Get the last time the cache collection changed. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>the context object for the cache collection to examine. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_time</em>&nbsp;</td><td>on exit, the time of the most recent change for the entire ccache collection. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--This function returns the time of the most recent change for the entire ccache collection. By maintaining a local copy the caller can deduce whether or not the ccache collection has been modified since the previous call to <a class="el" href="group__helper__macros.html#g82f551af17455b78fa3a2e3f83c96907">cc_context_get_change_time()</a>.<p>
--The time returned by cc_context_get_changed_time() increases whenever:<p>
--<ul>
--<li>a ccache is created </li>
--<li>a ccache is destroyed </li>
--<li>a credential is stored </li>
--<li>a credential is removed </li>
--<li>a ccache principal is changed </li>
--<li>the default ccache is changed</li>
--</ul>
--<dl compact><dt><b>Note:</b></dt><dd>In order to be able to compare two values returned by <a class="el" href="group__helper__macros.html#g82f551af17455b78fa3a2e3f83c96907">cc_context_get_change_time()</a>, the caller must use the same context to acquire them. Callers should maintain a single context in memory for <a class="el" href="group__helper__macros.html#g82f551af17455b78fa3a2e3f83c96907">cc_context_get_change_time()</a> calls rather than creating a new context for every call.</dd></dl>
--<dl compact><dt><b>See also:</b></dt><dd><a class="el" href="structcc__context__f.html#39a27ecd6d29fb7288f983c42d5686d0">wait_for_change</a> </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="4e9432f5a1a10319037b0f04e8219c1b"></a><!-- doxytag: member="cc_context_f::get_default_ccache_name" ref="4e9432f5a1a10319037b0f04e8219c1b" args=")(cc_context_t in_context, cc_string_t *out_name)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#4e9432f5a1a10319037b0f04e8219c1b">get_default_ccache_name</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="structcc__string__d.html">cc_string_t</a> *out_name)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#gcb4eb9f1db6f8ebf261339ad87cb6c51">cc_context_get_default_ccache_name()</a></b>: Get the name of the default ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>the context object for the cache collection. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_name</em>&nbsp;</td><td>on exit, the name of the default ccache. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--This function returns the name of the default ccache. When the default ccache exists, its name is returned. If there are no ccaches in the collection, and thus there is no default ccache, the name that the default ccache should have is returned. The ccache with that name will be used as the default ccache by all processes which initialized Kerberos libraries before the ccache was created.<p>
--If there is no default ccache, and the client is creating a new ccache, it should be created with the default name. If there already is a default ccache, and the client wants to create a new ccache (as opposed to reusing an existing ccache), it should be created with any unique name; <a class="el" href="structcc__context__f.html#939a8ed76079bf71000347c40aeb5b2f">create_new_ccache()</a> can be used to accomplish that more easily.<p>
--If the first ccache is created with a name other than the default name, then the processes already running will not notice the credentials stored in the new ccache, which is normally undesirable.     </td>
--  </tr>
--</table>
--<a class="anchor" name="bf8e7415758b890ca8f01ce5a00985ab"></a><!-- doxytag: member="cc_context_f::open_ccache" ref="bf8e7415758b890ca8f01ce5a00985ab" args=")(cc_context_t in_context, const char *in_name, cc_ccache_t *out_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#bf8e7415758b890ca8f01ce5a00985ab">open_ccache</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, const char *in_name, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g256a5ba17fe0e4502e0722d9b081bbef">cc_context_open_ccache()</a></b>: Open a ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>the context object for the cache collection. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_name</em>&nbsp;</td><td>the name of the ccache to open. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_ccache</em>&nbsp;</td><td>on exit, a ccache object for the ccache </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. If no ccache named <em>in_name</em> exists, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b73098feac66058e6ebd02c5e44fa20a9c">ccErrCCacheNotFound</a>. On failure, an error code representing the failure.</dd></dl>
--Opens an already existing ccache identified by its name. It returns a reference to the ccache in <em>out_ccache</em>.<p>
--The list of all ccache names, principals, and credentials versions may be retrieved by calling cc_context_new_cache_iterator(), <a class="el" href="group__helper__macros.html#g042bea6044879ec03996b190792e3ae9">cc_ccache_get_name()</a>, <a class="el" href="group__helper__macros.html#g464aa49a2e8054c9c3c2a3410eaf5c54">cc_ccache_get_principal()</a>, and cc_ccache_get_cred_version().     </td>
--  </tr>
--</table>
--<a class="anchor" name="7f101feaa1c88c8997b678507c029c39"></a><!-- doxytag: member="cc_context_f::open_default_ccache" ref="7f101feaa1c88c8997b678507c029c39" args=")(cc_context_t in_context, cc_ccache_t *out_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#7f101feaa1c88c8997b678507c029c39">open_default_ccache</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g45a7ce29eb409baabadcae1bc95d5c57">cc_context_open_default_ccache()</a></b>: Open the default ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>the context object for the cache collection. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_ccache</em>&nbsp;</td><td>on exit, a ccache object for the default ccache </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. If no default ccache exists, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b73098feac66058e6ebd02c5e44fa20a9c">ccErrCCacheNotFound</a>. On failure, an error code representing the failure.</dd></dl>
--Opens the default ccache. It returns a reference to the ccache in *ccache.<p>
--This function performs the same function as calling cc_context_get_default_ccache_name followed by cc_context_open_ccache, but it performs it atomically.     </td>
--  </tr>
--</table>
--<a class="anchor" name="82d3579723a0f909cb46c2016ed4ae22"></a><!-- doxytag: member="cc_context_f::create_ccache" ref="82d3579723a0f909cb46c2016ed4ae22" args=")(cc_context_t in_context, const char *in_name, cc_uint32 in_cred_vers, const char *in_principal, cc_ccache_t *out_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#82d3579723a0f909cb46c2016ed4ae22">create_ccache</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, const char *in_name, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_cred_vers, const char *in_principal, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g9fbcbd0f1b107cdaa2a0179e227f82cf">cc_context_create_ccache()</a></b>: Create a new ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>the context object for the cache collection. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_name</em>&nbsp;</td><td>the name of the new ccache to create </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_cred_vers</em>&nbsp;</td><td>the version of the credentials the new ccache will hold </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_principal</em>&nbsp;</td><td>the client principal of the credentials the new ccache will hold </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_ccache</em>&nbsp;</td><td>on exit, a ccache object for the newly created ccache </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Create a new credentials cache. The ccache is uniquely identified by its name. The principal given is also associated with the ccache and the credentials version specified. A NULL name is not allowed (and ccErrBadName is returned if one is passed in). Only cc_credentials_v4 and cc_credentials_v5 are valid input values for cred_vers. If you want to create a new ccache that will hold both versions of credentials, call <a class="el" href="group__helper__macros.html#g9fbcbd0f1b107cdaa2a0179e227f82cf">cc_context_create_ccache()</a> with one version, and then <a class="el" href="group__helper__macros.html#gfaa81492b5d7b3ba00208a9577ce0ba2">cc_ccache_set_principal()</a> with the other version.<p>
--If you want to create a new ccache (with a unique name), you should use <a class="el" href="group__helper__macros.html#g1a6dffb1db25590351646fdcf9824f09">cc_context_create_new_ccache()</a> instead. If you want to create or reinitialize the default cache, you should use <a class="el" href="group__helper__macros.html#g10a184dd699cae4df6f3480290804a72">cc_context_create_default_ccache()</a>.<p>
--If name is non-NULL and there is already a ccache named name:<p>
--<ul>
--<li>the credentials in the ccache whose version is cred_vers are removed </li>
--<li>the principal (of the existing ccache) associated with cred_vers is set to principal </li>
--<li>a handle for the existing ccache is returned and all existing handles for the ccache remain valid</li>
--</ul>
--If no ccache named name already exists:<p>
--<ul>
--<li>a new empty ccache is created </li>
--<li>the principal of the new ccache associated with cred_vers is set to principal </li>
--<li>a handle for the new ccache is returned</li>
--</ul>
--For a new ccache, the name should be any unique string. The name is not intended to be presented to users.<p>
--If the created ccache is the first ccache in the collection, it is made the default ccache. Note that normally it is undesirable to create the first ccache with a name different from the default ccache name (as returned by <a class="el" href="group__helper__macros.html#gcb4eb9f1db6f8ebf261339ad87cb6c51">cc_context_get_default_ccache_name()</a>); see the description of <a class="el" href="group__helper__macros.html#gcb4eb9f1db6f8ebf261339ad87cb6c51">cc_context_get_default_ccache_name()</a> for details.<p>
--The principal should be a C string containing an unparsed Kerberos principal in the format of the appropriate Kerberos version, i.e.<div class="fragment"><pre class="fragment">foo.bar/@BAZ 
--      * </pre></div> for Kerberos v4 and<div class="fragment"><pre class="fragment">foo/bar/@BAZ </pre></div> for Kerberos v5.     </td>
--  </tr>
--</table>
--<a class="anchor" name="b52a31c1fb59ac752baa16503d8e0e3f"></a><!-- doxytag: member="cc_context_f::create_default_ccache" ref="b52a31c1fb59ac752baa16503d8e0e3f" args=")(cc_context_t in_context, cc_uint32 in_cred_vers, const char *in_principal, cc_ccache_t *out_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#b52a31c1fb59ac752baa16503d8e0e3f">create_default_ccache</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_cred_vers, const char *in_principal, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g10a184dd699cae4df6f3480290804a72">cc_context_create_default_ccache()</a></b>: Create a new default ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>the context object for the cache collection. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_cred_vers</em>&nbsp;</td><td>the version of the credentials the new default ccache will hold </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_principal</em>&nbsp;</td><td>the client principal of the credentials the new default ccache will hold </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_ccache</em>&nbsp;</td><td>on exit, a ccache object for the newly created default ccache </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Create the default credentials cache. The behavior of this function is similar to that of cc_create_ccache(). If there is a default ccache (which is always the case except when there are no ccaches at all in the collection), it is initialized with the specified credentials version and principal, as per cc_create_ccache(); otherwise, a new ccache is created, and its name is the name returned by <a class="el" href="group__helper__macros.html#gcb4eb9f1db6f8ebf261339ad87cb6c51">cc_context_get_default_ccache_name()</a>.     </td>
--  </tr>
--</table>
--<a class="anchor" name="939a8ed76079bf71000347c40aeb5b2f"></a><!-- doxytag: member="cc_context_f::create_new_ccache" ref="939a8ed76079bf71000347c40aeb5b2f" args=")(cc_context_t in_context, cc_uint32 in_cred_vers, const char *in_principal, cc_ccache_t *out_ccache)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#939a8ed76079bf71000347c40aeb5b2f">create_new_ccache</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_cred_vers, const char *in_principal, <a class="el" href="structcc__ccache__d.html">cc_ccache_t</a> *out_ccache)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g1a6dffb1db25590351646fdcf9824f09">cc_context_create_new_ccache()</a></b>: Create a new uniquely named ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>the context object for the cache collection. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_cred_vers</em>&nbsp;</td><td>the version of the credentials the new ccache will hold </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_principal</em>&nbsp;</td><td>the client principal of the credentials the new ccache will hold </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_ccache</em>&nbsp;</td><td>on exit, a ccache object for the newly created ccache </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Create a new unique credentials cache. The behavior of this function is similar to that of cc_create_ccache(). If there are no ccaches, and therefore no default ccache, the new ccache is created with the default ccache name as would be returned by <a class="el" href="structcc__context__f.html#4e9432f5a1a10319037b0f04e8219c1b">get_default_ccache_name()</a>. If there are some ccaches, and therefore there is a default ccache, the new ccache is created with a new unique name. Clearly, this function never reinitializes a ccache, since it always uses a unique name.     </td>
--  </tr>
--</table>
--<a class="anchor" name="0f945985d42255226915403df147667f"></a><!-- doxytag: member="cc_context_f::new_ccache_iterator" ref="0f945985d42255226915403df147667f" args=")(cc_context_t in_context, cc_ccache_iterator_t *out_iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#0f945985d42255226915403df147667f">new_ccache_iterator</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="structcc__ccache__iterator__d.html">cc_ccache_iterator_t</a> *out_iterator)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g6957bc9570e4769a5b1213d2a1d90cd7">cc_context_new_ccache_iterator()</a></b>: Get an iterator for the cache collection. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>the context object for the cache collection. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_iterator</em>&nbsp;</td><td>on exit, a ccache iterator object for the ccache collection. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Used to allocate memory and initialize iterator. Successive calls to iterator's next() function will return ccaches in the collection.<p>
--If changes are made to the collection while an iterator is being used on it, the iterator must return at least the intersection, and at most the union, of the set of ccaches that were present when the iteration began and the set of ccaches that are present when it ends.     </td>
--  </tr>
--</table>
--<a class="anchor" name="1be78f795193b04c4f45cb7d3c46480c"></a><!-- doxytag: member="cc_context_f::lock" ref="1be78f795193b04c4f45cb7d3c46480c" args=")(cc_context_t in_context, cc_uint32 in_lock_type, cc_uint32 in_block)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#1be78f795193b04c4f45cb7d3c46480c">lock</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_context, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_lock_type, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> in_block)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#gcf4595340ddc8dafa539a86ac317625d">cc_context_lock()</a></b>: Lock the cache collection. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>the context object for the cache collection. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_lock_type</em>&nbsp;</td><td>the type of lock to obtain. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_block</em>&nbsp;</td><td>whether or not the function should block if the lock cannot be obtained immediately. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--Attempts to acquire an advisory lock for the ccache collection. Allowed values for lock_type are:<p>
--<ul>
--<li>cc_lock_read: a read lock. </li>
--<li>cc_lock_write: a write lock </li>
--<li>cc_lock_upgrade: upgrade an already-obtained read lock to a write lock </li>
--<li>cc_lock_downgrade: downgrade an already-obtained write lock to a read lock</li>
--</ul>
--If block is cc_lock_block, <a class="el" href="structcc__context__f.html#1be78f795193b04c4f45cb7d3c46480c">lock()</a> will not return until the lock is acquired. If block is cc_lock_noblock, <a class="el" href="structcc__context__f.html#1be78f795193b04c4f45cb7d3c46480c">lock()</a> will return immediately, either acquiring the lock and returning ccNoError, or failing to acquire the lock and returning an error explaining why.<p>
--Locks apply only to the list of ccaches, not the contents of those ccaches. To prevent callers participating in the advisory locking from changing the credentials in a cache you must also lock that ccache with <a class="el" href="group__helper__macros.html#gb8c2624719ee1c4be5f1b1bc4844f0cc">cc_ccache_lock()</a>. This is so that you can get the list of ccaches without preventing applications from simultaneously obtaining service tickets.<p>
--To avoid having to deal with differences between thread semantics on different platforms, locks are granted per context, rather than per thread or per process. That means that different threads of execution have to acquire separate contexts in order to be able to synchronize with each other.<p>
--The lock should be unlocked by using <a class="el" href="group__helper__macros.html#g544261b88c9ac0f2379a35648cae3f27">cc_context_unlock()</a>.<p>
--<dl compact><dt><b>Note:</b></dt><dd>All locks are advisory. For example, callers which do not call <a class="el" href="group__helper__macros.html#gcf4595340ddc8dafa539a86ac317625d">cc_context_lock()</a> and <a class="el" href="group__helper__macros.html#g544261b88c9ac0f2379a35648cae3f27">cc_context_unlock()</a> will not be prevented from writing to the cache collection when you have a read lock. This is because the CCAPI locking was added after the first release and thus adding mandatory locks would have changed the user experience and performance of existing applications. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="55e38bd72efee8445b3abbc3fa5e7e27"></a><!-- doxytag: member="cc_context_f::unlock" ref="55e38bd72efee8445b3abbc3fa5e7e27" args=")(cc_context_t in_cc_context)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#55e38bd72efee8445b3abbc3fa5e7e27">unlock</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_cc_context)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g544261b88c9ac0f2379a35648cae3f27">cc_context_unlock()</a></b>: Unlock the cache collection. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>the context object for the cache collection. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="bb728ccd97eb387991feed0500475112"></a><!-- doxytag: member="cc_context_f::compare" ref="bb728ccd97eb387991feed0500475112" args=")(cc_context_t in_cc_context, cc_context_t in_compare_to_context, cc_uint32 *out_equal)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#bb728ccd97eb387991feed0500475112">compare</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_cc_context, <a class="el" href="structcc__context__d.html">cc_context_t</a> in_compare_to_context, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> *out_equal)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g9258ef05d06f3d4dc798ec654f78b967">cc_context_compare()</a></b>: Compare two context objects. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>a context object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_compare_to_context</em>&nbsp;</td><td>a context object to compare with <em>in_context</em>. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_equal</em>&nbsp;</td><td>on exit, whether or not the two contexts refer to the same cache collection. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="39a27ecd6d29fb7288f983c42d5686d0"></a><!-- doxytag: member="cc_context_f::wait_for_change" ref="39a27ecd6d29fb7288f983c42d5686d0" args=")(cc_context_t in_cc_context)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__context__f.html#39a27ecd6d29fb7288f983c42d5686d0">wait_for_change</a>)(<a class="el" href="structcc__context__d.html">cc_context_t</a> in_cc_context)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g9eb3508958528c00844a101275497e5a">cc_context_wait_for_change()</a></b>: Wait for the next change in the cache collection. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_context</em>&nbsp;</td><td>a context object. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure.</dd></dl>
--This function blocks until the next change is made to the cache collection ccache collection. By repeatedly calling <a class="el" href="group__helper__macros.html#g9eb3508958528c00844a101275497e5a">cc_context_wait_for_change()</a> from a worker thread the caller can effectively receive callbacks whenever the cache collection changes. This is considerably more efficient than polling with <a class="el" href="group__helper__macros.html#g82f551af17455b78fa3a2e3f83c96907">cc_context_get_change_time()</a>.<p>
--<a class="el" href="group__helper__macros.html#g9eb3508958528c00844a101275497e5a">cc_context_wait_for_change()</a> will return whenever:<p>
--<ul>
--<li>a ccache is created </li>
--<li>a ccache is destroyed </li>
--<li>a credential is stored </li>
--<li>a credential is removed </li>
--<li>a ccache principal is changed </li>
--<li>the default ccache is changed</li>
--</ul>
--<dl compact><dt><b>Note:</b></dt><dd>In order to make sure that the caller doesn't miss any changes, <a class="el" href="group__helper__macros.html#g9eb3508958528c00844a101275497e5a">cc_context_wait_for_change()</a> always returns immediately after the first time it is called on a new context object. Callers must use the same context object for successive calls to <a class="el" href="group__helper__macros.html#g9eb3508958528c00844a101275497e5a">cc_context_wait_for_change()</a> rather than creating a new context for every call.</dd></dl>
--<dl compact><dt><b>See also:</b></dt><dd><a class="el" href="structcc__context__f.html#51bd5a48dcd263bfb3128cc5838b4cd7">get_change_time</a> </dd></dl>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:05 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__credentials__d.html b/doc/ccapi/html/structcc__credentials__d.html
-deleted file mode 100644
-index 8a13251e5..000000000
---- a/doc/ccapi/html/structcc__credentials__d.html
-+++ /dev/null
-@@ -1,67 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_credentials_d Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_credentials_d Struct Reference<br>
--<small>
--[<a class="el" href="group__cc__credentials__reference.html">cc_credentials_t Overview</a>]</small>
--</h1><!-- doxytag: class="cc_credentials_d" --><h2>Data Fields</h2>
--<ul>
--<li>const <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a> * <a class="el" href="structcc__credentials__d.html#35a5997194639f90a5178c5526ea1bf3">data</a>
--<li>const <a class="el" href="structcc__credentials__f.html">cc_credentials_f</a> * <a class="el" href="structcc__credentials__d.html#f94340ad2254e9ae5bc24e184f2ea923">functions</a>
--</ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="35a5997194639f90a5178c5526ea1bf3"></a><!-- doxytag: member="cc_credentials_d::data" ref="35a5997194639f90a5178c5526ea1bf3" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">const <a class="el" href="structcc__credentials__union.html">cc_credentials_union</a>* <a class="el" href="structcc__credentials__d.html#35a5997194639f90a5178c5526ea1bf3">data</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="f94340ad2254e9ae5bc24e184f2ea923"></a><!-- doxytag: member="cc_credentials_d::functions" ref="f94340ad2254e9ae5bc24e184f2ea923" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">const <a class="el" href="structcc__credentials__f.html">cc_credentials_f</a>* <a class="el" href="structcc__credentials__d.html#f94340ad2254e9ae5bc24e184f2ea923">functions</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__credentials__f.html b/doc/ccapi/html/structcc__credentials__f.html
-deleted file mode 100644
-index 91f4b3adb..000000000
---- a/doc/ccapi/html/structcc__credentials__f.html
-+++ /dev/null
-@@ -1,85 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_credentials_f Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_credentials_f Struct Reference</h1><!-- doxytag: class="cc_credentials_f" --><hr><a name="_details"></a><h2>Detailed Description</h2>
--Function pointer table for cc_credentials_t. For more information see <a class="el" href="group__cc__credentials__reference.html">cc_credentials_t Overview</a>. 
--<p>
--<h2>Data Fields</h2>
--<ul>
--<li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__credentials__f.html#6cc7338e31fd5f2436fb15b23506f57d">release</a> )(<a class="el" href="structcc__credentials__d.html">cc_credentials_t</a> io_credentials)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#gab5cad8ca82847950956b0f493132c14">cc_credentials_release()</a></b>: Release memory associated with a cc_credentials_t object.  <a href="#6cc7338e31fd5f2436fb15b23506f57d"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__credentials__f.html#8511e9a8220b2003a1c66b314ca6bc9f">compare</a> )(<a class="el" href="structcc__credentials__d.html">cc_credentials_t</a> in_credentials, <a class="el" href="structcc__credentials__d.html">cc_credentials_t</a> in_compare_to_credentials, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> *out_equal)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g39ae30e49dba65b87c6b9794f20fb784">cc_credentials_compare()</a></b>: Compare two credentials objects.  <a href="#8511e9a8220b2003a1c66b314ca6bc9f"></a><br></dl></ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="6cc7338e31fd5f2436fb15b23506f57d"></a><!-- doxytag: member="cc_credentials_f::release" ref="6cc7338e31fd5f2436fb15b23506f57d" args=")(cc_credentials_t io_credentials)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__credentials__f.html#6cc7338e31fd5f2436fb15b23506f57d">release</a>)(<a class="el" href="structcc__credentials__d.html">cc_credentials_t</a> io_credentials)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#gab5cad8ca82847950956b0f493132c14">cc_credentials_release()</a></b>: Release memory associated with a cc_credentials_t object. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_credentials</em>&nbsp;</td><td>the credentials object to release. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="8511e9a8220b2003a1c66b314ca6bc9f"></a><!-- doxytag: member="cc_credentials_f::compare" ref="8511e9a8220b2003a1c66b314ca6bc9f" args=")(cc_credentials_t in_credentials, cc_credentials_t in_compare_to_credentials, cc_uint32 *out_equal)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__credentials__f.html#8511e9a8220b2003a1c66b314ca6bc9f">compare</a>)(<a class="el" href="structcc__credentials__d.html">cc_credentials_t</a> in_credentials, <a class="el" href="structcc__credentials__d.html">cc_credentials_t</a> in_compare_to_credentials, <a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> *out_equal)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g39ae30e49dba65b87c6b9794f20fb784">cc_credentials_compare()</a></b>: Compare two credentials objects. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_credentials</em>&nbsp;</td><td>a credentials object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>in_compare_to_credentials</em>&nbsp;</td><td>a credentials object to compare with <em>in_credentials</em>. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_equal</em>&nbsp;</td><td>on exit, whether or not the two credentials objects refer to the same credentials in the cache collection. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__credentials__iterator__d.html b/doc/ccapi/html/structcc__credentials__iterator__d.html
-deleted file mode 100644
-index 5682db0ed..000000000
---- a/doc/ccapi/html/structcc__credentials__iterator__d.html
-+++ /dev/null
-@@ -1,43 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_credentials_iterator_d Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_credentials_iterator_d Struct Reference<br>
--<small>
--[<a class="el" href="group__cc__credentials__iterator__reference.html">cc_credentials_iterator_t</a>]</small>
--</h1><!-- doxytag: class="cc_credentials_iterator_d" --><h2>Data Fields</h2>
--<ul>
--<li>const <a class="el" href="structcc__credentials__iterator__f.html">cc_credentials_iterator_f</a> * <a class="el" href="structcc__credentials__iterator__d.html#4533a2f8b94b150439d777f749cedc12">functions</a>
--</ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="4533a2f8b94b150439d777f749cedc12"></a><!-- doxytag: member="cc_credentials_iterator_d::functions" ref="4533a2f8b94b150439d777f749cedc12" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">const <a class="el" href="structcc__credentials__iterator__f.html">cc_credentials_iterator_f</a>* <a class="el" href="structcc__credentials__iterator__d.html#4533a2f8b94b150439d777f749cedc12">functions</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__credentials__iterator__f.html b/doc/ccapi/html/structcc__credentials__iterator__f.html
-deleted file mode 100644
-index 66aec178a..000000000
---- a/doc/ccapi/html/structcc__credentials__iterator__f.html
-+++ /dev/null
-@@ -1,85 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_credentials_iterator_f Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_credentials_iterator_f Struct Reference</h1><!-- doxytag: class="cc_credentials_iterator_f" --><hr><a name="_details"></a><h2>Detailed Description</h2>
--Function pointer table for cc_credentials_iterator_t. For more information see <a class="el" href="group__cc__credentials__iterator__reference.html">cc_credentials_iterator_t</a>. 
--<p>
--<h2>Data Fields</h2>
--<ul>
--<li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__credentials__iterator__f.html#16c385de50a458e4223af5680488c95c">release</a> )(<a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> io_credentials_iterator)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g79f914583e8076ac24c0d5dde4ddb712">cc_credentials_iterator_release()</a></b>: Release memory associated with a cc_credentials_iterator_t object.  <a href="#16c385de50a458e4223af5680488c95c"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__credentials__iterator__f.html#8ba419513434ba0b03a1be0c17da1478">next</a> )(<a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> in_credentials_iterator, <a class="el" href="structcc__credentials__d.html">cc_credentials_t</a> *out_credentials)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g0c2f41d90f478b2415b699085f8fcaa4">cc_credentials_iterator_next()</a></b>: Get the next credentials in the ccache.  <a href="#8ba419513434ba0b03a1be0c17da1478"></a><br></dl><li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="group__cc__credentials__iterator__reference.html#g7d765e583b5994785e214df663e8959c">clone</a> )(<a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> in_credentials_iterator, <a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> *out_credentials_iterator)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#g59a9f96a6c00b64c0ab971f7e9b5aae2">cc_credentials_iterator_clone()</a></b>: Make a copy of a credentials iterator.  <a href="group__cc__credentials__iterator__reference.html#g7d765e583b5994785e214df663e8959c"></a><br></dl></ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="16c385de50a458e4223af5680488c95c"></a><!-- doxytag: member="cc_credentials_iterator_f::release" ref="16c385de50a458e4223af5680488c95c" args=")(cc_credentials_iterator_t io_credentials_iterator)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__credentials__iterator__f.html#16c385de50a458e4223af5680488c95c">release</a>)(<a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> io_credentials_iterator)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g79f914583e8076ac24c0d5dde4ddb712">cc_credentials_iterator_release()</a></b>: Release memory associated with a cc_credentials_iterator_t object. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_credentials_iterator</em>&nbsp;</td><td>the credentials iterator object to release. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="8ba419513434ba0b03a1be0c17da1478"></a><!-- doxytag: member="cc_credentials_iterator_f::next" ref="8ba419513434ba0b03a1be0c17da1478" args=")(cc_credentials_iterator_t in_credentials_iterator, cc_credentials_t *out_credentials)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__credentials__iterator__f.html#8ba419513434ba0b03a1be0c17da1478">next</a>)(<a class="el" href="structcc__credentials__iterator__d.html">cc_credentials_iterator_t</a> in_credentials_iterator, <a class="el" href="structcc__credentials__d.html">cc_credentials_t</a> *out_credentials)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#g0c2f41d90f478b2415b699085f8fcaa4">cc_credentials_iterator_next()</a></b>: Get the next credentials in the ccache. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>in_credentials_iterator</em>&nbsp;</td><td>a credentials iterator object. </td></tr>
--    <tr><td valign="top"></td><td valign="top"><em>out_credentials</em>&nbsp;</td><td>on exit, the next credentials in the ccache. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a> if the next credential in the ccache was obtained or <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b748d5a55ed773e002ccc271beb4512c0a">ccIteratorEnd</a> if there are no more credentials. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__credentials__union.html b/doc/ccapi/html/structcc__credentials__union.html
-deleted file mode 100644
-index 6082346cc..000000000
---- a/doc/ccapi/html/structcc__credentials__union.html
-+++ /dev/null
-@@ -1,118 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_credentials_union Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_credentials_union Struct Reference<br>
--<small>
--[<a class="el" href="group__cc__credentials__reference.html">cc_credentials_t Overview</a>]</small>
--</h1><!-- doxytag: class="cc_credentials_union" --><h2>Data Fields</h2>
--<ul>
--<li><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__credentials__union.html#2d41fe5eaeafcfae38d60dae26985ac2">version</a>
--<li>union {
--<ul>
--<li>&nbsp;&nbsp;&nbsp;<a class="el" href="structcc__credentials__v4__t.html">cc_credentials_v4_t</a> * &nbsp;&nbsp;&nbsp;<a class="el" href="structcc__credentials__union.html#5cd1c69704fe9706f69fdde1d954bba5">credentials_v4</a>
--<li>&nbsp;&nbsp;&nbsp;<a class="el" href="structcc__credentials__v5__t.html">cc_credentials_v5_t</a> * &nbsp;&nbsp;&nbsp;<a class="el" href="structcc__credentials__union.html#9d28c534b1b7c41da162f26620e92ded">credentials_v5</a>
--</ul>
--<li>} <a class="el" href="structcc__credentials__union.html#9e7108eff62e2df10a768cec653fe9c3">credentials</a>
--</ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="2d41fe5eaeafcfae38d60dae26985ac2"></a><!-- doxytag: member="cc_credentials_union::version" ref="2d41fe5eaeafcfae38d60dae26985ac2" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__credentials__union.html#2d41fe5eaeafcfae38d60dae26985ac2">version</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--The credentials version of this credentials object.     </td>
--  </tr>
--</table>
--<a class="anchor" name="5cd1c69704fe9706f69fdde1d954bba5"></a><!-- doxytag: member="cc_credentials_union::credentials_v4" ref="5cd1c69704fe9706f69fdde1d954bba5" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="structcc__credentials__v4__t.html">cc_credentials_v4_t</a>* <a class="el" href="structcc__credentials__union.html#5cd1c69704fe9706f69fdde1d954bba5">credentials_v4</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--If <em>version</em> is <a class="el" href="group__ccapi__constants__reference.html#ggae76da96fff95c157c3b28c4455dc35c017c26531bad42f92f7f3e1f697b58fa">cc_credentials_v4</a>, a pointer to a <a class="el" href="structcc__credentials__v4__t.html">cc_credentials_v4_t</a>.     </td>
--  </tr>
--</table>
--<a class="anchor" name="9d28c534b1b7c41da162f26620e92ded"></a><!-- doxytag: member="cc_credentials_union::credentials_v5" ref="9d28c534b1b7c41da162f26620e92ded" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="structcc__credentials__v5__t.html">cc_credentials_v5_t</a>* <a class="el" href="structcc__credentials__union.html#9d28c534b1b7c41da162f26620e92ded">credentials_v5</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--If <em>version</em> is <a class="el" href="group__ccapi__constants__reference.html#ggae76da96fff95c157c3b28c4455dc35c98335a31ad81a10632568375dcc10668">cc_credentials_v5</a>, a pointer to a <a class="el" href="structcc__credentials__v5__t.html">cc_credentials_v5_t</a>.     </td>
--  </tr>
--</table>
--<a class="anchor" name="9e7108eff62e2df10a768cec653fe9c3"></a><!-- doxytag: member="cc_credentials_union::credentials" ref="9e7108eff62e2df10a768cec653fe9c3" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">union { ... } 				 <a class="el" href="structcc__credentials__union.html#9e7108eff62e2df10a768cec653fe9c3">credentials</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--The credentials.     </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__credentials__v4__t.html b/doc/ccapi/html/structcc__credentials__v4__t.html
-deleted file mode 100644
-index 086e7fea7..000000000
---- a/doc/ccapi/html/structcc__credentials__v4__t.html
-+++ /dev/null
-@@ -1,358 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_credentials_v4_t Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_credentials_v4_t Struct Reference<br>
--<small>
--[<a class="el" href="group__cc__credentials__reference.html">cc_credentials_t Overview</a>]</small>
--</h1><!-- doxytag: class="cc_credentials_v4_t" --><hr><a name="_details"></a><h2>Detailed Description</h2>
--If a cc_credentials_t variable is used to store Kerberos v4 credentials, then credentials.credentials_v4 points to a v4 credentials structure. This structure is similar to a krb4 API CREDENTIALS structure. 
--<p>
--<h2>Data Fields</h2>
--<ul>
--<li><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__credentials__v4__t.html#2d41fe5eaeafcfae38d60dae26985ac2">version</a>
--<li>char <a class="el" href="structcc__credentials__v4__t.html#9f819063dece13be2211723c071cc05a">principal</a> [cc_v4_name_size]
--<li>char <a class="el" href="structcc__credentials__v4__t.html#76949f2eaa30043f779dd32a617b36b2">principal_instance</a> [cc_v4_instance_size]
--<li>char <a class="el" href="structcc__credentials__v4__t.html#2034c72f7997740d1bd0526fde941f36">service</a> [cc_v4_name_size]
--<li>char <a class="el" href="structcc__credentials__v4__t.html#188bf95cfe0ec75c60e5df82a65ce4f1">service_instance</a> [cc_v4_instance_size]
--<li>char <a class="el" href="structcc__credentials__v4__t.html#1965bd82f992c9448d2600d241c11143">realm</a> [cc_v4_realm_size]
--<li>unsigned char <a class="el" href="structcc__credentials__v4__t.html#5833b04b0672722de1dc40148eac67ca">session_key</a> [cc_v4_key_size]
--<li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> <a class="el" href="structcc__credentials__v4__t.html#cee6149add6477c273b3318d6497ca0b">kvno</a>
--<li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> <a class="el" href="structcc__credentials__v4__t.html#dbfece338488ae1e84f642e1675a2248">string_to_key_type</a>
--<li><a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> <a class="el" href="structcc__credentials__v4__t.html#02d649915754b7903b7a60ef9fb9f036">issue_date</a>
--<li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> <a class="el" href="structcc__credentials__v4__t.html#a546cc61e206f01e8657cc4d22e9e4cd">lifetime</a>
--<li><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__credentials__v4__t.html#99252d53c89be046c8ce4d12e8bb2fe4">address</a>
--<li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> <a class="el" href="structcc__credentials__v4__t.html#fbf8c355fc354f976f66db1e51034d9e">ticket_size</a>
--<li>unsigned char <a class="el" href="structcc__credentials__v4__t.html#c4f3ef871699e35563771cfe9889c8e5">ticket</a> [cc_v4_ticket_size]
--</ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="2d41fe5eaeafcfae38d60dae26985ac2"></a><!-- doxytag: member="cc_credentials_v4_t::version" ref="2d41fe5eaeafcfae38d60dae26985ac2" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__credentials__v4__t.html#2d41fe5eaeafcfae38d60dae26985ac2">version</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="9f819063dece13be2211723c071cc05a"></a><!-- doxytag: member="cc_credentials_v4_t::principal" ref="9f819063dece13be2211723c071cc05a" args="[cc_v4_name_size]" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">char <a class="el" href="structcc__credentials__v4__t.html#9f819063dece13be2211723c071cc05a">principal</a>[cc_v4_name_size]          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--A properly quoted string representation of the first component of the client principal     </td>
--  </tr>
--</table>
--<a class="anchor" name="76949f2eaa30043f779dd32a617b36b2"></a><!-- doxytag: member="cc_credentials_v4_t::principal_instance" ref="76949f2eaa30043f779dd32a617b36b2" args="[cc_v4_instance_size]" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">char <a class="el" href="structcc__credentials__v4__t.html#76949f2eaa30043f779dd32a617b36b2">principal_instance</a>[cc_v4_instance_size]          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--A properly quoted string representation of the second component of the client principal     </td>
--  </tr>
--</table>
--<a class="anchor" name="2034c72f7997740d1bd0526fde941f36"></a><!-- doxytag: member="cc_credentials_v4_t::service" ref="2034c72f7997740d1bd0526fde941f36" args="[cc_v4_name_size]" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">char <a class="el" href="structcc__credentials__v4__t.html#2034c72f7997740d1bd0526fde941f36">service</a>[cc_v4_name_size]          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--A properly quoted string representation of the first component of the service principal     </td>
--  </tr>
--</table>
--<a class="anchor" name="188bf95cfe0ec75c60e5df82a65ce4f1"></a><!-- doxytag: member="cc_credentials_v4_t::service_instance" ref="188bf95cfe0ec75c60e5df82a65ce4f1" args="[cc_v4_instance_size]" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">char <a class="el" href="structcc__credentials__v4__t.html#188bf95cfe0ec75c60e5df82a65ce4f1">service_instance</a>[cc_v4_instance_size]          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--A properly quoted string representation of the second component of the service principal     </td>
--  </tr>
--</table>
--<a class="anchor" name="1965bd82f992c9448d2600d241c11143"></a><!-- doxytag: member="cc_credentials_v4_t::realm" ref="1965bd82f992c9448d2600d241c11143" args="[cc_v4_realm_size]" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">char <a class="el" href="structcc__credentials__v4__t.html#1965bd82f992c9448d2600d241c11143">realm</a>[cc_v4_realm_size]          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--A properly quoted string representation of the realm     </td>
--  </tr>
--</table>
--<a class="anchor" name="5833b04b0672722de1dc40148eac67ca"></a><!-- doxytag: member="cc_credentials_v4_t::session_key" ref="5833b04b0672722de1dc40148eac67ca" args="[cc_v4_key_size]" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">unsigned char <a class="el" href="structcc__credentials__v4__t.html#5833b04b0672722de1dc40148eac67ca">session_key</a>[cc_v4_key_size]          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Ticket session key     </td>
--  </tr>
--</table>
--<a class="anchor" name="cee6149add6477c273b3318d6497ca0b"></a><!-- doxytag: member="cc_credentials_v4_t::kvno" ref="cee6149add6477c273b3318d6497ca0b" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> <a class="el" href="structcc__credentials__v4__t.html#cee6149add6477c273b3318d6497ca0b">kvno</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Key version number     </td>
--  </tr>
--</table>
--<a class="anchor" name="dbfece338488ae1e84f642e1675a2248"></a><!-- doxytag: member="cc_credentials_v4_t::string_to_key_type" ref="dbfece338488ae1e84f642e1675a2248" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> <a class="el" href="structcc__credentials__v4__t.html#dbfece338488ae1e84f642e1675a2248">string_to_key_type</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--String to key type used. See cc_string_to_key_type for valid values     </td>
--  </tr>
--</table>
--<a class="anchor" name="02d649915754b7903b7a60ef9fb9f036"></a><!-- doxytag: member="cc_credentials_v4_t::issue_date" ref="02d649915754b7903b7a60ef9fb9f036" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> <a class="el" href="structcc__credentials__v4__t.html#02d649915754b7903b7a60ef9fb9f036">issue_date</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Time when the ticket was issued     </td>
--  </tr>
--</table>
--<a class="anchor" name="a546cc61e206f01e8657cc4d22e9e4cd"></a><!-- doxytag: member="cc_credentials_v4_t::lifetime" ref="a546cc61e206f01e8657cc4d22e9e4cd" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> <a class="el" href="structcc__credentials__v4__t.html#a546cc61e206f01e8657cc4d22e9e4cd">lifetime</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Ticket lifetime in 5 minute units     </td>
--  </tr>
--</table>
--<a class="anchor" name="99252d53c89be046c8ce4d12e8bb2fe4"></a><!-- doxytag: member="cc_credentials_v4_t::address" ref="99252d53c89be046c8ce4d12e8bb2fe4" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__credentials__v4__t.html#99252d53c89be046c8ce4d12e8bb2fe4">address</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--IPv4 address of the client the ticket was issued for     </td>
--  </tr>
--</table>
--<a class="anchor" name="fbf8c355fc354f976f66db1e51034d9e"></a><!-- doxytag: member="cc_credentials_v4_t::ticket_size" ref="fbf8c355fc354f976f66db1e51034d9e" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a> <a class="el" href="structcc__credentials__v4__t.html#fbf8c355fc354f976f66db1e51034d9e">ticket_size</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Ticket size (no greater than cc_v4_ticket_size)     </td>
--  </tr>
--</table>
--<a class="anchor" name="c4f3ef871699e35563771cfe9889c8e5"></a><!-- doxytag: member="cc_credentials_v4_t::ticket" ref="c4f3ef871699e35563771cfe9889c8e5" args="[cc_v4_ticket_size]" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">unsigned char <a class="el" href="structcc__credentials__v4__t.html#c4f3ef871699e35563771cfe9889c8e5">ticket</a>[cc_v4_ticket_size]          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Ticket data     </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__credentials__v5__t.html b/doc/ccapi/html/structcc__credentials__v5__t.html
-deleted file mode 100644
-index ad0996281..000000000
---- a/doc/ccapi/html/structcc__credentials__v5__t.html
-+++ /dev/null
-@@ -1,334 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_credentials_v5_t Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_credentials_v5_t Struct Reference<br>
--<small>
--[<a class="el" href="group__cc__credentials__reference.html">cc_credentials_t Overview</a>]</small>
--</h1><!-- doxytag: class="cc_credentials_v5_t" --><hr><a name="_details"></a><h2>Detailed Description</h2>
--If a cc_credentials_t variable is used to store Kerberos v5 c redentials, and then credentials.credentials_v5 points to a v5 credentials structure. This structure is similar to a krb5_creds structure. 
--<p>
--<h2>Data Fields</h2>
--<ul>
--<li>char * <a class="el" href="structcc__credentials__v5__t.html#9a07d92f0eb56a4db24f14d21be5923b">client</a>
--<li>char * <a class="el" href="structcc__credentials__v5__t.html#ffeefede74d4b54c220f6a43dd2beabd">server</a>
--<li><a class="el" href="structcc__data.html">cc_data</a> <a class="el" href="structcc__credentials__v5__t.html#c02ecbe79ca87f90c4f6771c330b9057">keyblock</a>
--<li><a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> <a class="el" href="structcc__credentials__v5__t.html#43f17e3cff872e49a0d2b88deccb5c97">authtime</a>
--<li><a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> <a class="el" href="structcc__credentials__v5__t.html#709d64dcb56e208a02f9dbd59ef703d7">starttime</a>
--<li><a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> <a class="el" href="structcc__credentials__v5__t.html#0ebf7b3d5d28b0e9000c435af3ee9d59">endtime</a>
--<li><a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> <a class="el" href="structcc__credentials__v5__t.html#1c710d76f8e94dc2c51e68bab258f15a">renew_till</a>
--<li><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__credentials__v5__t.html#7fb325cd1ddca84f9033cd2f5122e1d3">is_skey</a>
--<li><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__credentials__v5__t.html#c8380b3eee0768bc6c1fe8c719b72f04">ticket_flags</a>
--<li><a class="el" href="structcc__data.html">cc_data</a> ** <a class="el" href="structcc__credentials__v5__t.html#80f824d334544ae2bd33c69eda1c9a09">addresses</a>
--<li><a class="el" href="structcc__data.html">cc_data</a> <a class="el" href="structcc__credentials__v5__t.html#6cf74018168214de0ea09704d9436c03">ticket</a>
--<li><a class="el" href="structcc__data.html">cc_data</a> <a class="el" href="structcc__credentials__v5__t.html#bb02ec4ece756277bceaa85626f2bc34">second_ticket</a>
--<li><a class="el" href="structcc__data.html">cc_data</a> ** <a class="el" href="structcc__credentials__v5__t.html#0a8d97c740085a737b6aaec587f7fa9e">authdata</a>
--</ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="9a07d92f0eb56a4db24f14d21be5923b"></a><!-- doxytag: member="cc_credentials_v5_t::client" ref="9a07d92f0eb56a4db24f14d21be5923b" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">char* <a class="el" href="structcc__credentials__v5__t.html#9a07d92f0eb56a4db24f14d21be5923b">client</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--A properly quoted string representation of the client principal.     </td>
--  </tr>
--</table>
--<a class="anchor" name="ffeefede74d4b54c220f6a43dd2beabd"></a><!-- doxytag: member="cc_credentials_v5_t::server" ref="ffeefede74d4b54c220f6a43dd2beabd" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">char* <a class="el" href="structcc__credentials__v5__t.html#ffeefede74d4b54c220f6a43dd2beabd">server</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--A properly quoted string representation of the service principal.     </td>
--  </tr>
--</table>
--<a class="anchor" name="c02ecbe79ca87f90c4f6771c330b9057"></a><!-- doxytag: member="cc_credentials_v5_t::keyblock" ref="c02ecbe79ca87f90c4f6771c330b9057" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="structcc__data.html">cc_data</a> <a class="el" href="structcc__credentials__v5__t.html#c02ecbe79ca87f90c4f6771c330b9057">keyblock</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Session encryption key info.     </td>
--  </tr>
--</table>
--<a class="anchor" name="43f17e3cff872e49a0d2b88deccb5c97"></a><!-- doxytag: member="cc_credentials_v5_t::authtime" ref="43f17e3cff872e49a0d2b88deccb5c97" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> <a class="el" href="structcc__credentials__v5__t.html#43f17e3cff872e49a0d2b88deccb5c97">authtime</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--The time when the ticket was issued.     </td>
--  </tr>
--</table>
--<a class="anchor" name="709d64dcb56e208a02f9dbd59ef703d7"></a><!-- doxytag: member="cc_credentials_v5_t::starttime" ref="709d64dcb56e208a02f9dbd59ef703d7" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> <a class="el" href="structcc__credentials__v5__t.html#709d64dcb56e208a02f9dbd59ef703d7">starttime</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--The time when the ticket becomes valid.     </td>
--  </tr>
--</table>
--<a class="anchor" name="0ebf7b3d5d28b0e9000c435af3ee9d59"></a><!-- doxytag: member="cc_credentials_v5_t::endtime" ref="0ebf7b3d5d28b0e9000c435af3ee9d59" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> <a class="el" href="structcc__credentials__v5__t.html#0ebf7b3d5d28b0e9000c435af3ee9d59">endtime</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--The time when the ticket expires.     </td>
--  </tr>
--</table>
--<a class="anchor" name="1c710d76f8e94dc2c51e68bab258f15a"></a><!-- doxytag: member="cc_credentials_v5_t::renew_till" ref="1c710d76f8e94dc2c51e68bab258f15a" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ge7a754cfe5664beadddaa100646c9742">cc_time_t</a> <a class="el" href="structcc__credentials__v5__t.html#1c710d76f8e94dc2c51e68bab258f15a">renew_till</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--The time when the ticket becomes no longer renewable (if renewable).     </td>
--  </tr>
--</table>
--<a class="anchor" name="7fb325cd1ddca84f9033cd2f5122e1d3"></a><!-- doxytag: member="cc_credentials_v5_t::is_skey" ref="7fb325cd1ddca84f9033cd2f5122e1d3" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__credentials__v5__t.html#7fb325cd1ddca84f9033cd2f5122e1d3">is_skey</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--1 if the ticket is encrypted in another ticket's key, or 0 otherwise.     </td>
--  </tr>
--</table>
--<a class="anchor" name="c8380b3eee0768bc6c1fe8c719b72f04"></a><!-- doxytag: member="cc_credentials_v5_t::ticket_flags" ref="c8380b3eee0768bc6c1fe8c719b72f04" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__credentials__v5__t.html#c8380b3eee0768bc6c1fe8c719b72f04">ticket_flags</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Ticket flags, as defined by the Kerberos 5 API.     </td>
--  </tr>
--</table>
--<a class="anchor" name="80f824d334544ae2bd33c69eda1c9a09"></a><!-- doxytag: member="cc_credentials_v5_t::addresses" ref="80f824d334544ae2bd33c69eda1c9a09" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="structcc__data.html">cc_data</a>** <a class="el" href="structcc__credentials__v5__t.html#80f824d334544ae2bd33c69eda1c9a09">addresses</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--The the list of network addresses of hosts that are allowed to authenticate using this ticket.     </td>
--  </tr>
--</table>
--<a class="anchor" name="6cf74018168214de0ea09704d9436c03"></a><!-- doxytag: member="cc_credentials_v5_t::ticket" ref="6cf74018168214de0ea09704d9436c03" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="structcc__data.html">cc_data</a> <a class="el" href="structcc__credentials__v5__t.html#6cf74018168214de0ea09704d9436c03">ticket</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Ticket data.     </td>
--  </tr>
--</table>
--<a class="anchor" name="bb02ec4ece756277bceaa85626f2bc34"></a><!-- doxytag: member="cc_credentials_v5_t::second_ticket" ref="bb02ec4ece756277bceaa85626f2bc34" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="structcc__data.html">cc_data</a> <a class="el" href="structcc__credentials__v5__t.html#bb02ec4ece756277bceaa85626f2bc34">second_ticket</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Second ticket data.     </td>
--  </tr>
--</table>
--<a class="anchor" name="0a8d97c740085a737b6aaec587f7fa9e"></a><!-- doxytag: member="cc_credentials_v5_t::authdata" ref="0a8d97c740085a737b6aaec587f7fa9e" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="structcc__data.html">cc_data</a>** <a class="el" href="structcc__credentials__v5__t.html#0a8d97c740085a737b6aaec587f7fa9e">authdata</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--Authorization data.     </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__data.html b/doc/ccapi/html/structcc__data.html
-deleted file mode 100644
-index 346f6a41d..000000000
---- a/doc/ccapi/html/structcc__data.html
-+++ /dev/null
-@@ -1,94 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_data Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_data Struct Reference<br>
--<small>
--[<a class="el" href="group__cc__credentials__reference.html">cc_credentials_t Overview</a>]</small>
--</h1><!-- doxytag: class="cc_data" --><hr><a name="_details"></a><h2>Detailed Description</h2>
--The CCAPI data structure. This structure is similar to a krb5_data structure. In a v5 credentials structure, <a class="el" href="structcc__data.html">cc_data</a> structures are used to store tagged variable-length binary data. Specifically, for cc_credentials_v5.ticket and cc_credentials_v5.second_ticket, the <a class="el" href="structcc__data.html#1cfc8b2545d7999b7a760b47bfbbf6e7">cc_data.type</a> field must be zero. For the cc_credentials_v5.addresses, cc_credentials_v5.authdata, and cc_credentials_v5.keyblock, the <a class="el" href="structcc__data.html#1cfc8b2545d7999b7a760b47bfbbf6e7">cc_data.type</a> field should be the address type, authorization data type, and encryption type, as defined by the Kerberos v5 protocol definition. 
--<p>
--<h2>Data Fields</h2>
--<ul>
--<li><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__data.html#1cfc8b2545d7999b7a760b47bfbbf6e7">type</a>
--<li><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__data.html#61dffab9209fdc97d53c4cb31f746aa5">length</a>
--<li>void * <a class="el" href="structcc__data.html#735984d41155bc1032e09bece8f8d66d">data</a>
--</ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="1cfc8b2545d7999b7a760b47bfbbf6e7"></a><!-- doxytag: member="cc_data::type" ref="1cfc8b2545d7999b7a760b47bfbbf6e7" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__data.html#1cfc8b2545d7999b7a760b47bfbbf6e7">type</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--The type of the data as defined by the krb5_data structure.     </td>
--  </tr>
--</table>
--<a class="anchor" name="61dffab9209fdc97d53c4cb31f746aa5"></a><!-- doxytag: member="cc_data::length" ref="61dffab9209fdc97d53c4cb31f746aa5" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#ga00783c3f4aa70580d0900b1a79aab9d">cc_uint32</a> <a class="el" href="structcc__data.html#61dffab9209fdc97d53c4cb31f746aa5">length</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--The length of <em>data</em>.     </td>
--  </tr>
--</table>
--<a class="anchor" name="735984d41155bc1032e09bece8f8d66d"></a><!-- doxytag: member="cc_data::data" ref="735984d41155bc1032e09bece8f8d66d" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">void* <a class="el" href="structcc__data.html#735984d41155bc1032e09bece8f8d66d">data</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--The data buffer.     </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__string__d.html b/doc/ccapi/html/structcc__string__d.html
-deleted file mode 100644
-index b38286b3e..000000000
---- a/doc/ccapi/html/structcc__string__d.html
-+++ /dev/null
-@@ -1,67 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_string_d Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_string_d Struct Reference<br>
--<small>
--[<a class="el" href="group__cc__string__reference.html">cc_string_t Overview</a>]</small>
--</h1><!-- doxytag: class="cc_string_d" --><h2>Data Fields</h2>
--<ul>
--<li>const char * <a class="el" href="structcc__string__d.html#8f64897c7ccc5c13f276d1d07c4e7095">data</a>
--<li>const <a class="el" href="structcc__string__f.html">cc_string_f</a> * <a class="el" href="structcc__string__d.html#002f78b173b7dd8a6925385cd11f4b0f">functions</a>
--</ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="8f64897c7ccc5c13f276d1d07c4e7095"></a><!-- doxytag: member="cc_string_d::data" ref="8f64897c7ccc5c13f276d1d07c4e7095" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">const char* <a class="el" href="structcc__string__d.html#8f64897c7ccc5c13f276d1d07c4e7095">data</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<a class="anchor" name="002f78b173b7dd8a6925385cd11f4b0f"></a><!-- doxytag: member="cc_string_d::functions" ref="002f78b173b7dd8a6925385cd11f4b0f" args="" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top">const <a class="el" href="structcc__string__f.html">cc_string_f</a>* <a class="el" href="structcc__string__d.html#002f78b173b7dd8a6925385cd11f4b0f">functions</a>          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
-diff --git a/doc/ccapi/html/structcc__string__f.html b/doc/ccapi/html/structcc__string__f.html
-deleted file mode 100644
-index d5f738f49..000000000
---- a/doc/ccapi/html/structcc__string__f.html
-+++ /dev/null
-@@ -1,51 +0,0 @@
--<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
--<html><head><meta http-equiv="Content-Type" content="text/html;charset=iso-8859-1">
--<title>Credentials Cache API   : cc_string_f Struct Reference</title>
--<link href="doxygen.css" rel="stylesheet" type="text/css">
--<link href="tabs.css" rel="stylesheet" type="text/css">
--</head><body>
--<!-- Generated by Doxygen 1.4.6 -->
--<h1>cc_string_f Struct Reference</h1><!-- doxytag: class="cc_string_f" --><hr><a name="_details"></a><h2>Detailed Description</h2>
--Function pointer table for cc_string_t. For more information see <a class="el" href="group__cc__string__reference.html">cc_string_t Overview</a>. 
--<p>
--<h2>Data Fields</h2>
--<ul>
--<li><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__string__f.html#ba3623018f7ad67de1f29f4cf1a9c66f">release</a> )(<a class="el" href="structcc__string__d.html">cc_string_t</a> io_string)
--<dl class="el"><dd class="mdescRight"><b><a class="el" href="group__helper__macros.html#ge9bebfed2d574e69f29dd341bc8a63d9">cc_string_release()</a></b>: Release memory associated with a cc_string_t object.  <a href="#ba3623018f7ad67de1f29f4cf1a9c66f"></a><br></dl></ul>
--<hr><h2>Field Documentation</h2>
--<a class="anchor" name="ba3623018f7ad67de1f29f4cf1a9c66f"></a><!-- doxytag: member="cc_string_f::release" ref="ba3623018f7ad67de1f29f4cf1a9c66f" args=")(cc_string_t io_string)" --><p>
--<table class="mdTable" cellpadding="2" cellspacing="0">
--  <tr>
--    <td class="mdRow">
--      <table cellpadding="0" cellspacing="0" border="0">
--        <tr>
--          <td class="md" nowrap valign="top"><a class="el" href="group__ccapi__types__reference.html#g0ce639c8d65dc6367fb361d5bbcea874">cc_int32</a>(* <a class="el" href="structcc__string__f.html#ba3623018f7ad67de1f29f4cf1a9c66f">release</a>)(<a class="el" href="structcc__string__d.html">cc_string_t</a> io_string)          </td>
--        </tr>
--      </table>
--    </td>
--  </tr>
--</table>
--<table cellspacing="5" cellpadding="0" border="0">
--  <tr>
--    <td>
--      &nbsp;
--    </td>
--    <td>
--
--<p>
--<b><a class="el" href="group__helper__macros.html#ge9bebfed2d574e69f29dd341bc8a63d9">cc_string_release()</a></b>: Release memory associated with a cc_string_t object. 
--<p>
--<dl compact><dt><b>Parameters:</b></dt><dd>
--  <table border="0" cellspacing="2" cellpadding="0">
--    <tr><td valign="top"></td><td valign="top"><em>io_string</em>&nbsp;</td><td>the string object to release. </td></tr>
--  </table>
--</dl>
--<dl compact><dt><b>Returns:</b></dt><dd>On success, <a class="el" href="group__ccapi__constants__reference.html#ggdf764cbdea00d65edcd07bb9953ad2b7386efd60970fd1740c97093a79558c26">ccNoError</a>. On failure, an error code representing the failure. </dd></dl>
--    </td>
--  </tr>
--</table>
--<hr size="1"><address style="align: right;"><small>Generated on Tue Oct 2 17:16:06 2007 for Credentials Cache API    by&nbsp;
--<a href="http://www.doxygen.org/index.html">
--<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.4.6 </small></address>
--</body>
--</html>
diff --git a/Remove-kadmin-RPC-support-for-setting-v4-key.patch b/Remove-kadmin-RPC-support-for-setting-v4-key.patch
deleted file mode 100644
index 28fc9e4..0000000
--- a/Remove-kadmin-RPC-support-for-setting-v4-key.patch
+++ /dev/null
@@ -1,466 +0,0 @@
-From 43c7d037b5e6bac3345c069af70f3cd6fd947f3f Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 4 Apr 2019 16:14:46 -0400
-Subject: [PATCH] Remove kadmin RPC support for setting v4 key
-
-ticket: 8794 (new)
-(cherry picked from commit 752187a441ed0f301f1a8adb1fea843080ac8c97)
----
- src/kadmin/server/kadm_rpc_svc.c            |   7 --
- src/kadmin/server/ovsec_kadmd.c             |   2 +-
- src/kadmin/server/server_stubs.c            |  50 ---------
- src/lib/kadm5/admin.h                       |   3 -
- src/lib/kadm5/admin_xdr.h                   |   1 -
- src/lib/kadm5/clnt/Makefile.in              |   2 +-
- src/lib/kadm5/clnt/client_principal.c       |  22 ----
- src/lib/kadm5/clnt/client_rpc.c             |   8 --
- src/lib/kadm5/clnt/libkadm5clnt_mit.exports |   2 -
- src/lib/kadm5/kadm_rpc.h                    |  16 +--
- src/lib/kadm5/kadm_rpc_xdr.c                |  19 ----
- src/lib/kadm5/srv/Makefile.in               |   2 +-
- src/lib/kadm5/srv/libkadm5srv_mit.exports   |   2 -
- src/lib/kadm5/srv/svr_principal.c           | 118 --------------------
- 14 files changed, 6 insertions(+), 248 deletions(-)
-
-diff --git a/src/kadmin/server/kadm_rpc_svc.c b/src/kadmin/server/kadm_rpc_svc.c
-index 41fc88ac8..d343e2c25 100644
---- a/src/kadmin/server/kadm_rpc_svc.c
-+++ b/src/kadmin/server/kadm_rpc_svc.c
-@@ -53,7 +53,6 @@ void kadm_1(rqstp, transp)
- 	  mpol_arg modify_policy_2_arg;
- 	  gpol_arg get_policy_2_arg;
- 	  setkey_arg setkey_principal_2_arg;
--	  setv4key_arg setv4key_principal_2_arg;
- 	  cprinc3_arg create_principal3_2_arg;
- 	  chpass3_arg chpass_principal3_2_arg;
- 	  chrand3_arg chrand_principal3_2_arg;
-@@ -134,12 +133,6 @@ void kadm_1(rqstp, transp)
- 	  local = (bool_t (*)()) chpass_principal_2_svc;
- 	  break;
- 
--     case SETV4KEY_PRINCIPAL:
--	  xdr_argument = xdr_setv4key_arg;
--	  xdr_result = xdr_generic_ret;
--	  local = (bool_t (*)()) setv4key_principal_2_svc;
--	  break;
--
-      case SETKEY_PRINCIPAL:
- 	  xdr_argument = xdr_setkey_arg;
- 	  xdr_result = xdr_generic_ret;
-diff --git a/src/kadmin/server/ovsec_kadmd.c b/src/kadmin/server/ovsec_kadmd.c
-index 6a6b21401..3737791b6 100644
---- a/src/kadmin/server/ovsec_kadmd.c
-+++ b/src/kadmin/server/ovsec_kadmd.c
-@@ -227,7 +227,7 @@ log_badverf(gss_name_t client_name, gss_name_t server_name,
-         {14, "GET_PRINCS"},
-         {15, "GET_POLS"},
-         {16, "SETKEY_PRINCIPAL"},
--        {17, "SETV4KEY_PRINCIPAL"},
-+        /* 17 was "SETV4KEY_PRINCIPAL" */
-         {18, "CREATE_PRINCIPAL3"},
-         {19, "CHPASS_PRINCIPAL3"},
-         {20, "CHRAND_PRINCIPAL3"},
-diff --git a/src/kadmin/server/server_stubs.c b/src/kadmin/server/server_stubs.c
-index cfef97fec..d5a25e502 100644
---- a/src/kadmin/server/server_stubs.c
-+++ b/src/kadmin/server/server_stubs.c
-@@ -893,56 +893,6 @@ exit_func:
-     return TRUE;
- }
- 
--bool_t
--setv4key_principal_2_svc(setv4key_arg *arg, generic_ret *ret,
--                         struct svc_req *rqstp)
--{
--    char                            *prime_arg = NULL;
--    gss_buffer_desc                 client_name = GSS_C_EMPTY_BUFFER;
--    gss_buffer_desc                 service_name = GSS_C_EMPTY_BUFFER;
--    kadm5_server_handle_t           handle;
--    const char                      *errmsg = NULL;
--
--    ret->code = stub_setup(arg->api_version, rqstp, arg->princ, &handle,
--                           &ret->api_version, &client_name, &service_name,
--                           &prime_arg);
--    if (ret->code)
--        goto exit_func;
--
--    ret->code = check_lockdown_keys(handle, arg->princ);
--    if (ret->code != KADM5_OK) {
--        if (ret->code == KADM5_PROTECT_KEYS) {
--            log_unauth("kadm5_setv4key_principal", prime_arg, &client_name,
--                       &service_name, rqstp);
--            ret->code = KADM5_AUTH_SETKEY;
--        }
--    } else if (!(CHANGEPW_SERVICE(rqstp)) &&
--               stub_auth(handle, OP_SETKEY, arg->princ, NULL, NULL, NULL)) {
--        ret->code = kadm5_setv4key_principal(handle, arg->princ,
--                                             arg->keyblock);
--    } else {
--        log_unauth("kadm5_setv4key_principal", prime_arg,
--                   &client_name, &service_name, rqstp);
--        ret->code = KADM5_AUTH_SETKEY;
--    }
--
--    if (ret->code != KADM5_AUTH_SETKEY) {
--        if (ret->code != 0)
--            errmsg = krb5_get_error_message(handle->context, ret->code);
--
--        log_done("kadm5_setv4key_principal", prime_arg, errmsg,
--                 &client_name, &service_name, rqstp);
--
--        if (errmsg != NULL)
--            krb5_free_error_message(handle->context, errmsg);
--    }
--
--exit_func:
--    stub_cleanup(handle, prime_arg, &client_name, &service_name);
--    return TRUE;
--}
--
--
- bool_t
- setkey_principal_2_svc(setkey_arg *arg, generic_ret *ret,
-                        struct svc_req *rqstp)
-diff --git a/src/lib/kadm5/admin.h b/src/lib/kadm5/admin.h
-index b765148b3..7268be44e 100644
---- a/src/lib/kadm5/admin.h
-+++ b/src/lib/kadm5/admin.h
-@@ -394,9 +394,6 @@ kadm5_ret_t    kadm5_randkey_principal_3(void *server_handle,
-                                          krb5_key_salt_tuple *ks_tuple,
-                                          krb5_keyblock **keyblocks,
-                                          int *n_keys);
--kadm5_ret_t    kadm5_setv4key_principal(void *server_handle,
--                                        krb5_principal principal,
--                                        krb5_keyblock *keyblock);
- 
- kadm5_ret_t    kadm5_setkey_principal(void *server_handle,
-                                       krb5_principal principal,
-diff --git a/src/lib/kadm5/admin_xdr.h b/src/lib/kadm5/admin_xdr.h
-index 2d22611e7..9da98451e 100644
---- a/src/lib/kadm5/admin_xdr.h
-+++ b/src/lib/kadm5/admin_xdr.h
-@@ -37,7 +37,6 @@ bool_t	    xdr_mprinc_arg(XDR *xdrs, mprinc_arg *objp);
- bool_t	    xdr_rprinc_arg(XDR *xdrs, rprinc_arg *objp);
- bool_t	    xdr_chpass_arg(XDR *xdrs, chpass_arg *objp);
- bool_t      xdr_chpass3_arg(XDR *xdrs, chpass3_arg *objp);
--bool_t      xdr_setv4key_arg(XDR *xdrs, setv4key_arg *objp);
- bool_t      xdr_setkey_arg(XDR *xdrs, setkey_arg *objp);
- bool_t      xdr_setkey3_arg(XDR *xdrs, setkey3_arg *objp);
- bool_t      xdr_setkey4_arg(XDR *xdrs, setkey4_arg *objp);
-diff --git a/src/lib/kadm5/clnt/Makefile.in b/src/lib/kadm5/clnt/Makefile.in
-index a180e85cd..2bc385afe 100644
---- a/src/lib/kadm5/clnt/Makefile.in
-+++ b/src/lib/kadm5/clnt/Makefile.in
-@@ -3,7 +3,7 @@ BUILDTOP=$(REL)..$(S)..$(S)..
- LOCALINCLUDES = -I$(BUILDTOP)/include/kadm5
- 
- LIBBASE=kadm5clnt_mit
--LIBMAJOR=11
-+LIBMAJOR=12
- LIBMINOR=0
- STOBJLISTS=../OBJS.ST OBJS.ST
- SHLIB_EXPDEPS=\
-diff --git a/src/lib/kadm5/clnt/client_principal.c b/src/lib/kadm5/clnt/client_principal.c
-index 18714bf37..96d9d1932 100644
---- a/src/lib/kadm5/clnt/client_principal.c
-+++ b/src/lib/kadm5/clnt/client_principal.c
-@@ -273,28 +273,6 @@ kadm5_chpass_principal_3(void *server_handle,
-     return r.code;
- }
- 
--kadm5_ret_t
--kadm5_setv4key_principal(void *server_handle,
--                         krb5_principal princ,
--                         krb5_keyblock *keyblock)
--{
--    setv4key_arg        arg;
--    generic_ret         r = { 0, 0 };
--    kadm5_server_handle_t handle = server_handle;
--
--    CHECK_HANDLE(server_handle);
--
--    arg.princ = princ;
--    arg.keyblock = keyblock;
--    arg.api_version = handle->api_version;
--
--    if(princ == NULL || keyblock == NULL)
--        return EINVAL;
--    if (setv4key_principal_2(&arg, &r, handle->clnt))
--        eret();
--    return r.code;
--}
--
- kadm5_ret_t
- kadm5_setkey_principal(void *server_handle,
-                        krb5_principal princ,
-diff --git a/src/lib/kadm5/clnt/client_rpc.c b/src/lib/kadm5/clnt/client_rpc.c
-index df5455fd8..d84d158b4 100644
---- a/src/lib/kadm5/clnt/client_rpc.c
-+++ b/src/lib/kadm5/clnt/client_rpc.c
-@@ -84,14 +84,6 @@ chpass_principal3_2(chpass3_arg *argp, generic_ret *res, CLIENT *clnt)
- 			 (xdrproc_t)xdr_generic_ret, (caddr_t)res, TIMEOUT);
- }
- 
--enum clnt_stat
--setv4key_principal_2(setv4key_arg *argp, generic_ret *res, CLIENT *clnt)
--{
--	return clnt_call(clnt, SETV4KEY_PRINCIPAL,
--			 (xdrproc_t)xdr_setv4key_arg, (caddr_t)argp,
--			 (xdrproc_t)xdr_generic_ret, (caddr_t)res, TIMEOUT);
--}
--
- enum clnt_stat
- setkey_principal_2(setkey_arg *argp, generic_ret *res, CLIENT *clnt)
- {
-diff --git a/src/lib/kadm5/clnt/libkadm5clnt_mit.exports b/src/lib/kadm5/clnt/libkadm5clnt_mit.exports
-index f122b31ab..e41c8e4f7 100644
---- a/src/lib/kadm5/clnt/libkadm5clnt_mit.exports
-+++ b/src/lib/kadm5/clnt/libkadm5clnt_mit.exports
-@@ -44,7 +44,6 @@ kadm5_set_string
- kadm5_setkey_principal
- kadm5_setkey_principal_3
- kadm5_setkey_principal_4
--kadm5_setv4key_principal
- kadm5_unlock
- krb5_aprof_finish
- krb5_aprof_get_boolean
-@@ -114,6 +113,5 @@ xdr_rprinc_arg
- xdr_setkey3_arg
- xdr_setkey4_arg
- xdr_setkey_arg
--xdr_setv4key_arg
- xdr_ui_4
- kadm5_init_iprop
-diff --git a/src/lib/kadm5/kadm_rpc.h b/src/lib/kadm5/kadm_rpc.h
-index 8d7cf3b36..5099c6c14 100644
---- a/src/lib/kadm5/kadm_rpc.h
-+++ b/src/lib/kadm5/kadm_rpc.h
-@@ -82,13 +82,6 @@ struct chpass3_arg {
- };
- typedef struct chpass3_arg chpass3_arg;
- 
--struct setv4key_arg {
--	krb5_ui_4 api_version;
--	krb5_principal princ;
--	krb5_keyblock *keyblock;
--};
--typedef struct setv4key_arg setv4key_arg;
--
- struct setkey_arg {
- 	krb5_ui_4 api_version;
- 	krb5_principal princ;
-@@ -322,11 +315,9 @@ extern  enum clnt_stat setkey_principal_2(setkey_arg *, generic_ret *,
- 					  CLIENT *);
- extern  bool_t setkey_principal_2_svc(setkey_arg *, generic_ret *,
- 				      struct svc_req *);
--#define SETV4KEY_PRINCIPAL 17
--extern  enum clnt_stat setv4key_principal_2(setv4key_arg *, generic_ret *,
--					    CLIENT *);
--extern  bool_t setv4key_principal_2_svc(setv4key_arg *, generic_ret *,
--					struct svc_req *);
-+
-+/* 17 was SETV4KEY_PRINCIPAL (removed in 1.18). */
-+
- #define CREATE_PRINCIPAL3 18
- extern  enum clnt_stat create_principal3_2(cprinc3_arg *, generic_ret *,
- 					   CLIENT *);
-@@ -380,7 +371,6 @@ extern bool_t xdr_gprincs_arg ();
- extern bool_t xdr_gprincs_ret ();
- extern bool_t xdr_chpass_arg ();
- extern bool_t xdr_chpass3_arg ();
--extern bool_t xdr_setv4key_arg ();
- extern bool_t xdr_setkey_arg ();
- extern bool_t xdr_setkey3_arg ();
- extern bool_t xdr_setkey4_arg ();
-diff --git a/src/lib/kadm5/kadm_rpc_xdr.c b/src/lib/kadm5/kadm_rpc_xdr.c
-index 2892d4147..745ee857e 100644
---- a/src/lib/kadm5/kadm_rpc_xdr.c
-+++ b/src/lib/kadm5/kadm_rpc_xdr.c
-@@ -710,25 +710,6 @@ xdr_chpass3_arg(XDR *xdrs, chpass3_arg *objp)
- 	return (TRUE);
- }
- 
--bool_t
--xdr_setv4key_arg(XDR *xdrs, setv4key_arg *objp)
--{
--	unsigned int n_keys = 1;
--
--	if (!xdr_ui_4(xdrs, &objp->api_version)) {
--		return (FALSE);
--	}
--	if (!xdr_krb5_principal(xdrs, &objp->princ)) {
--		return (FALSE);
--	}
--	if (!xdr_array(xdrs, (caddr_t *) &objp->keyblock,
--		       &n_keys, ~0,
--		       sizeof(krb5_keyblock), xdr_krb5_keyblock)) {
--		return (FALSE);
--	}
--	return (TRUE);
--}
--
- bool_t
- xdr_setkey_arg(XDR *xdrs, setkey_arg *objp)
- {
-diff --git a/src/lib/kadm5/srv/Makefile.in b/src/lib/kadm5/srv/Makefile.in
-index 617d65666..89e6097cf 100644
---- a/src/lib/kadm5/srv/Makefile.in
-+++ b/src/lib/kadm5/srv/Makefile.in
-@@ -9,7 +9,7 @@ DEFINES = @HESIOD_DEFS@
- ##DOSLIBNAME = libkadm5srv.lib
- 
- LIBBASE=kadm5srv_mit
--LIBMAJOR=11
-+LIBMAJOR=12
- LIBMINOR=0
- STOBJLISTS=../OBJS.ST OBJS.ST
- 
-diff --git a/src/lib/kadm5/srv/libkadm5srv_mit.exports b/src/lib/kadm5/srv/libkadm5srv_mit.exports
-index 64ad5dd69..e3c04e690 100644
---- a/src/lib/kadm5/srv/libkadm5srv_mit.exports
-+++ b/src/lib/kadm5/srv/libkadm5srv_mit.exports
-@@ -45,7 +45,6 @@ kadm5_set_string
- kadm5_setkey_principal
- kadm5_setkey_principal_3
- kadm5_setkey_principal_4
--kadm5_setv4key_principal
- kadm5_unlock
- kdb_delete_entry
- kdb_free_entry
-@@ -133,7 +132,6 @@ xdr_rprinc_arg
- xdr_setkey3_arg
- xdr_setkey4_arg
- xdr_setkey_arg
--xdr_setv4key_arg
- xdr_sstring_arg
- xdr_ui_4
- kadm5_init_iprop
-diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
-index 9ab2c5a74..48cac0c11 100644
---- a/src/lib/kadm5/srv/svr_principal.c
-+++ b/src/lib/kadm5/srv/svr_principal.c
-@@ -1645,124 +1645,6 @@ done:
-     return ret;
- }
- 
--/*
-- * kadm5_setv4key_principal:
-- *
-- * Set only ONE key of the principal, removing all others.  This key
-- * must have the DES_CBC_CRC enctype and is entered as having the
-- * krb4 salttype.  This is to enable things like kadmind4 to work.
-- */
--kadm5_ret_t
--kadm5_setv4key_principal(void *server_handle,
--                         krb5_principal principal,
--                         krb5_keyblock *keyblock)
--{
--    krb5_db_entry               *kdb;
--    osa_princ_ent_rec           adb;
--    krb5_timestamp              now;
--    kadm5_policy_ent_rec        pol;
--    krb5_keysalt                keysalt;
--    int                         i, kvno, ret;
--    krb5_boolean                have_pol = FALSE;
--    kadm5_server_handle_t       handle = server_handle;
--    krb5_key_data               tmp_key_data;
--    krb5_keyblock               *act_mkey;
--
--    memset( &tmp_key_data, 0, sizeof(tmp_key_data));
--
--    CHECK_HANDLE(server_handle);
--
--    krb5_clear_error_message(handle->context);
--
--    if (principal == NULL || keyblock == NULL)
--        return EINVAL;
--    if (hist_princ && /* this will be NULL when initializing the databse */
--        ((krb5_principal_compare(handle->context,
--                                 principal, hist_princ)) == TRUE))
--        return KADM5_PROTECT_PRINCIPAL;
--
--    if (keyblock->enctype != ENCTYPE_DES_CBC_CRC)
--        return KADM5_SETV4KEY_INVAL_ENCTYPE;
--
--    if ((ret = kdb_get_entry(handle, principal, &kdb, &adb)))
--        return(ret);
--
--    for (kvno = 0, i=0; i<kdb->n_key_data; i++)
--        if (kdb->key_data[i].key_data_kvno > kvno)
--            kvno = kdb->key_data[i].key_data_kvno;
--
--    if (kdb->key_data != NULL)
--        cleanup_key_data(handle->context, kdb->n_key_data, kdb->key_data);
--
--    kdb->key_data = calloc(1, sizeof(krb5_key_data));
--    if (kdb->key_data == NULL)
--        return ENOMEM;
--    kdb->n_key_data = 1;
--    keysalt.type = KRB5_KDB_SALTTYPE_V4;
--    /* XXX data.magic? */
--    keysalt.data.length = 0;
--    keysalt.data.data = NULL;
--
--    ret = kdb_get_active_mkey(handle, NULL, &act_mkey);
--    if (ret)
--        goto done;
--
--    /* use tmp_key_data as temporary location and reallocate later */
--    ret = krb5_dbe_encrypt_key_data(handle->context, act_mkey, keyblock,
--                                    &keysalt, kvno + 1, kdb->key_data);
--    if (ret) {
--        goto done;
--    }
--
--    kdb->attributes &= ~KRB5_KDB_REQUIRES_PWCHANGE;
--
--    ret = krb5_timeofday(handle->context, &now);
--    if (ret)
--        goto done;
--
--    if ((adb.aux_attributes & KADM5_POLICY)) {
--        ret = get_policy(handle, adb.policy, &pol, &have_pol);
--        if (ret)
--            goto done;
--    }
--    if (have_pol) {
--        if (pol.pw_max_life)
--            kdb->pw_expiration = ts_incr(now, pol.pw_max_life);
--        else
--            kdb->pw_expiration = 0;
--    } else {
--        kdb->pw_expiration = 0;
--    }
--
--    ret = krb5_dbe_update_last_pwd_change(handle->context, kdb, now);
--    if (ret)
--        goto done;
--
--    /* unlock principal on this KDC */
--    kdb->fail_auth_count = 0;
--
--    /* key data changed, let the database provider know */
--    kdb->mask = KADM5_KEY_DATA | KADM5_FAIL_AUTH_COUNT;
--
--    if ((ret = kdb_put_entry(handle, kdb, &adb)))
--        goto done;
--
--    ret = KADM5_OK;
--done:
--    for (i = 0; i < tmp_key_data.key_data_ver; i++) {
--        if (tmp_key_data.key_data_contents[i]) {
--            memset (tmp_key_data.key_data_contents[i], 0, tmp_key_data.key_data_length[i]);
--            free (tmp_key_data.key_data_contents[i]);
--        }
--    }
--
--    kdb_free_entry(handle, kdb, &adb);
--    if (have_pol)
--        kadm5_free_policy_ent(handle->lhandle, &pol);
--
--    return ret;
--}
--
- kadm5_ret_t
- kadm5_setkey_principal(void *server_handle,
-                        krb5_principal principal,
diff --git a/Remove-krb5int_c_combine_keys.patch b/Remove-krb5int_c_combine_keys.patch
deleted file mode 100644
index 64e2e72..0000000
--- a/Remove-krb5int_c_combine_keys.patch
+++ /dev/null
@@ -1,479 +0,0 @@
-From 343e236ed2637a826f4d53ff60d2b2bc349100d6 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 18 Apr 2019 17:27:07 -0400
-Subject: [PATCH] Remove krb5int_c_combine_keys()
-
-This method of combining keys was specified by
-draft-ietf-krb-wg-kerberos-sam for DES and 3DES enctypes, and is
-otherwise unused.  Remove it.
-
-[ghudson@mit.edu: rewrote commit message]
-
-ticket: 8812
-(cherry picked from commit 925a7df2f486aaa3ff137d2bcdf8ff57186638c6)
-[rharwood@redhat.com: conflicts: .gitignore]
----
- src/include/k5-int.h                    |   7 -
- src/lib/crypto/crypto_tests/Makefile.in |  12 +-
- src/lib/crypto/crypto_tests/deps        |  10 --
- src/lib/crypto/crypto_tests/t_combine.c |  62 -------
- src/lib/crypto/krb/Makefile.in          |   3 -
- src/lib/crypto/krb/combine_keys.c       | 227 ------------------------
- src/lib/crypto/krb/deps                 |  13 --
- src/lib/crypto/libk5crypto.exports      |   1 -
- 8 files changed, 3 insertions(+), 332 deletions(-)
- delete mode 100644 src/lib/crypto/crypto_tests/t_combine.c
- delete mode 100644 src/lib/crypto/krb/combine_keys.c
-
-diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index 2bc59e636..0857fd1cc 100644
---- a/src/include/k5-int.h
-+++ b/src/include/k5-int.h
-@@ -673,13 +673,6 @@ zapfreedata(krb5_data *data)
-     }
- }
- 
--/*
-- * Combine two keys (normally used by the hardware preauth mechanism)
-- */
--krb5_error_code
--krb5int_c_combine_keys(krb5_context context, krb5_keyblock *key1,
--                       krb5_keyblock *key2, krb5_keyblock *outkey);
--
- void krb5int_c_free_keyblock(krb5_context, krb5_keyblock *key);
- void krb5int_c_free_keyblock_contents(krb5_context, krb5_keyblock *);
- krb5_error_code krb5int_c_init_keyblock(krb5_context, krb5_enctype enctype,
-diff --git a/src/lib/crypto/crypto_tests/Makefile.in b/src/lib/crypto/crypto_tests/Makefile.in
-index 09feeb50e..0295ee14f 100644
---- a/src/lib/crypto/crypto_tests/Makefile.in
-+++ b/src/lib/crypto/crypto_tests/Makefile.in
-@@ -23,8 +23,7 @@ EXTRADEPSRCS=\
- 	$(srcdir)/t_short.c	\
- 	$(srcdir)/t_str2key.c	\
- 	$(srcdir)/t_derive.c	\
--	$(srcdir)/t_fork.c	\
--	$(srcdir)/t_combine.c
-+	$(srcdir)/t_fork.c
- 
- ##DOS##BUILDTOP = ..\..\..
- 
-@@ -33,8 +32,7 @@ check-unix: t_nfold t_encrypt t_decrypt t_prf t_prng t_cmac t_hmac \
- 		aes-test  \
- 		camellia-test  \
- 		t_mddriver4 t_mddriver \
--		t_cts t_sha2 t_short t_str2key t_derive t_fork t_cf2 \
--		t_combine
-+		t_cts t_sha2 t_short t_str2key t_derive t_fork t_cf2
- 	$(RUN_TEST) ./t_nfold
- 	$(RUN_TEST) ./t_encrypt
- 	$(RUN_TEST) ./t_decrypt
-@@ -59,7 +57,6 @@ check-unix: t_nfold t_encrypt t_decrypt t_prf t_prng t_cmac t_hmac \
- 	$(RUN_TEST) ./t_fork
- 	$(RUN_TEST) ./t_cf2 <$(srcdir)/t_cf2.in >t_cf2.output
- 	diff t_cf2.output $(srcdir)/t_cf2.expected
--	$(RUN_TEST) ./t_combine
- #	$(RUN_TEST) ./t_pkcs5
- 
- t_nfold$(EXEEXT): t_nfold.$(OBJEXT) $(KRB5_BASE_DEPLIBS)
-@@ -134,9 +131,6 @@ t_fork$(EXEEXT): t_fork.$(OBJEXT) $(KRB5_BASE_DEPLIBS)
- t_cf2$(EXEEXT): t_cf2.$(OBJEXT) $(KRB5_BASE_DEPLIBS)
- 	$(CC_LINK) -o $@ t_cf2.$(OBJEXT) $(KRB5_BASE_LIBS)
- 
--t_combine$(EXEEXT): t_combine.$(OBJEXT) $(KRB5_BASE_DEPLIBS)
--	$(CC_LINK) -o $@ t_combine.$(OBJEXT) $(KRB5_BASE_LIBS)
--
- clean:
- 	$(RM) t_nfold.o t_nfold t_encrypt t_encrypt.o \
- 		t_decrypt.o t_decrypt t_prng.o t_prng t_cmac.o t_cmac \
-@@ -149,7 +143,7 @@ clean:
- 		t_str2key.o t_derive t_derive.o t_fork t_fork.o \
- 		t_mddriver$(EXEEXT) $(OUTPRE)t_mddriver.$(OBJEXT) \
- 		camellia-test camellia-test.o camellia-vt.txt \
--		t_cf2 t_cf2.o t_cf2.output t_combine.o t_combine
-+		t_cf2 t_cf2.o t_cf2.output
- 
- 	-$(RM) t_prng.output
- 	-$(RM) t_prf.output
-diff --git a/src/lib/crypto/crypto_tests/deps b/src/lib/crypto/crypto_tests/deps
-index 19fef2582..0d10d4a1a 100644
---- a/src/lib/crypto/crypto_tests/deps
-+++ b/src/lib/crypto/crypto_tests/deps
-@@ -226,13 +226,3 @@ $(OUTPRE)t_fork.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-   $(top_srcdir)/include/socket-utils.h t_fork.c
--$(OUTPRE)t_combine.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
--  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
--  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
--  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
--  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
--  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h t_combine.c
-diff --git a/src/lib/crypto/crypto_tests/t_combine.c b/src/lib/crypto/crypto_tests/t_combine.c
-deleted file mode 100644
-index ba0622bcf..000000000
---- a/src/lib/crypto/crypto_tests/t_combine.c
-+++ /dev/null
-@@ -1,62 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/* lib/crypto/crypto_tests/t_combine.c - krb5int_c_combine_keys tests */
--/*
-- * Copyright (C) 2014 by the Massachusetts Institute of Technology.
-- * All rights reserved.
-- *
-- * Redistribution and use in source and binary forms, with or without
-- * modification, are permitted provided that the following conditions
-- * are met:
-- *
-- * * Redistributions of source code must retain the above copyright
-- *   notice, this list of conditions and the following disclaimer.
-- *
-- * * Redistributions in binary form must reproduce the above copyright
-- *   notice, this list of conditions and the following disclaimer in
-- *   the documentation and/or other materials provided with the
-- *   distribution.
-- *
-- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
-- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
-- * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
-- * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
-- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
-- * OF THE POSSIBILITY OF SUCH DAMAGE.
-- */
--
--#include "k5-int.h"
--
--unsigned char des3_key1[] = "\x10\xB6\x75\xD5\x5B\xD9\x6E\x73"
--    "\xFD\x54\xB3\x3D\x37\x52\xC1\x2A\xF7\x43\x91\xFE\x1C\x02\x37\x13";
--unsigned char des3_key2[] = "\xC8\xDA\x3E\xA7\xB6\x64\xAE\x7A"
--    "\xB5\x70\x2A\x29\xB3\xBF\x9B\xA8\x46\x7C\x5B\xA8\x8A\x46\x70\x10";
--unsigned char des3_result[] = "\x2F\x79\x97\x3E\x3E\xA4\x73\x1A"
--    "\xB9\x3D\xEF\x5E\x7C\x29\xFB\x2A\x68\x86\x1F\xC1\x85\x0E\x79\x92";
--
--int
--main(int argc, char **argv)
--{
--    krb5_keyblock kb1, kb2, result;
--
--    kb1.enctype = ENCTYPE_DES3_CBC_SHA1;
--    kb1.contents = des3_key1;
--    kb1.length = 24;
--    kb2.enctype = ENCTYPE_DES3_CBC_SHA1;
--    kb2.contents = des3_key2;
--    kb2.length = 24;
--    memset(&result, 0, sizeof(result));
--    if (krb5int_c_combine_keys(NULL, &kb1, &kb2, &result) != 0)
--        abort();
--    if (result.enctype != ENCTYPE_DES3_CBC_SHA1 || result.length != 24 ||
--        memcmp(result.contents, des3_result, 24) != 0)
--        abort();
--    krb5_free_keyblock_contents(NULL, &result);
--
--    return 0;
--}
-diff --git a/src/lib/crypto/krb/Makefile.in b/src/lib/crypto/krb/Makefile.in
-index c0e0b791b..536bacb6e 100644
---- a/src/lib/crypto/krb/Makefile.in
-+++ b/src/lib/crypto/krb/Makefile.in
-@@ -22,7 +22,6 @@ STLIBOBJS=\
- 	cksumtypes.o		\
- 	cmac.o			\
- 	coll_proof_cksum.o	\
--	combine_keys.o		\
- 	crypto_length.o		\
- 	crypto_libinit.o	\
- 	default_state.o 	\
-@@ -84,7 +83,6 @@ OBJS=\
- 	$(OUTPRE)cksumtypes.$(OBJEXT)		\
- 	$(OUTPRE)cmac.$(OBJEXT)			\
- 	$(OUTPRE)coll_proof_cksum.$(OBJEXT)	\
--	$(OUTPRE)combine_keys.$(OBJEXT)		\
- 	$(OUTPRE)crypto_length.$(OBJEXT)	\
- 	$(OUTPRE)crypto_libinit.$(OBJEXT)	\
- 	$(OUTPRE)default_state.$(OBJEXT) 	\
-@@ -146,7 +144,6 @@ SRCS=\
- 	$(srcdir)/cksumtypes.c		\
- 	$(srcdir)/cmac.c		\
- 	$(srcdir)/coll_proof_cksum.c	\
--	$(srcdir)/combine_keys.c	\
- 	$(srcdir)/crypto_length.c	\
- 	$(srcdir)/crypto_libinit.c	\
- 	$(srcdir)/default_state.c 	\
-diff --git a/src/lib/crypto/krb/combine_keys.c b/src/lib/crypto/krb/combine_keys.c
-deleted file mode 100644
-index c36434e17..000000000
---- a/src/lib/crypto/krb/combine_keys.c
-+++ /dev/null
-@@ -1,227 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/* Copyright (c) 2002 Naval Research Laboratory (NRL/CCS) */
--/*
-- * Permission to use, copy, modify and distribute this software and its
-- * documentation is hereby granted, provided that both the copyright
-- * notice and this permission notice appear in all copies of the software,
-- * derivative works or modified versions, and any portions thereof.
-- *
-- * NRL ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS" CONDITION AND
-- * DISCLAIMS ANY LIABILITY OF ANY KIND FOR ANY DAMAGES WHATSOEVER
-- * RESULTING FROM THE USE OF THIS SOFTWARE.
-- */
--
--/*
-- * Key combination function.
-- *
-- * If Key1 and Key2 are two keys to be combined, the algorithm to combine
-- * them is as follows.
-- *
-- * Definitions:
-- *
-- * k-truncate is defined as truncating to the key size the input.
-- *
-- * DR is defined as the generate "random" data from a key
-- * (defined in crypto draft)
-- *
-- * DK is defined as the key derivation function (krb5int_derive_key())
-- *
-- * (note: | means "concatenate")
-- *
-- * Combine key algorithm:
-- *
-- * R1 = DR(Key1, n-fold(Key2)) [ Output is length of Key1 ]
-- * R2 = DR(Key2, n-fold(Key1)) [ Output is length of Key2 ]
-- *
-- * rnd = n-fold(R1 | R2) [ Note: output size of nfold must be appropriately
-- *                         sized for random-to-key function ]
-- * tkey = random-to-key(rnd)
-- * Combine-Key(Key1, Key2) = DK(tkey, CombineConstant)
-- *
-- * CombineConstant is defined as the byte string:
-- *
-- * { 0x63 0x6f 0x6d 0x62 0x69 0x6e 0x65 }, which corresponds to the
-- * ASCII encoding of the string "combine"
-- */
--
--#include "crypto_int.h"
--
--static krb5_error_code dr(const struct krb5_enc_provider *enc,
--                          const krb5_keyblock *inkey, unsigned char *outdata,
--                          const krb5_data *in_constant);
--
--/*
-- * We only support this combine_keys algorithm for des and 3des keys.
-- * Everything else should use the PRF defined in the crypto framework.
-- * We don't implement that yet.
-- */
--
--static krb5_boolean
--enctype_ok(krb5_enctype e)
--{
--    switch (e) {
--    case ENCTYPE_DES3_CBC_SHA1:
--        return TRUE;
--    default:
--        return FALSE;
--    }
--}
--
--krb5_error_code
--krb5int_c_combine_keys(krb5_context context, krb5_keyblock *key1,
--                       krb5_keyblock *key2, krb5_keyblock *outkey)
--{
--    unsigned char *r1 = NULL, *r2 = NULL, *combined = NULL, *rnd = NULL;
--    unsigned char *output = NULL;
--    size_t keybytes, keylength;
--    const struct krb5_enc_provider *enc;
--    krb5_data input, randbits;
--    krb5_keyblock tkeyblock;
--    krb5_key tkey = NULL;
--    krb5_error_code ret;
--    const struct krb5_keytypes *ktp;
--    krb5_boolean myalloc = FALSE;
--
--    if (!enctype_ok(key1->enctype) || !enctype_ok(key2->enctype))
--        return KRB5_CRYPTO_INTERNAL;
--
--    if (key1->length != key2->length || key1->enctype != key2->enctype)
--        return KRB5_CRYPTO_INTERNAL;
--
--    /* Find our encryption algorithm. */
--    ktp = find_enctype(key1->enctype);
--    if (ktp == NULL)
--        return KRB5_BAD_ENCTYPE;
--    enc = ktp->enc;
--
--    keybytes = enc->keybytes;
--    keylength = enc->keylength;
--
--    /* Allocate and set up buffers. */
--    r1 = k5alloc(keybytes, &ret);
--    if (ret)
--        goto cleanup;
--    r2 = k5alloc(keybytes, &ret);
--    if (ret)
--        goto cleanup;
--    rnd = k5alloc(keybytes, &ret);
--    if (ret)
--        goto cleanup;
--    combined = k5calloc(2, keybytes, &ret);
--    if (ret)
--        goto cleanup;
--    output = k5alloc(keylength, &ret);
--    if (ret)
--        goto cleanup;
--
--    /*
--     * Get R1 and R2 (by running the input keys through the DR algorithm.
--     * Note this is most of derive-key, but not all.
--     */
--
--    input.length = key2->length;
--    input.data = (char *) key2->contents;
--    ret = dr(enc, key1, r1, &input);
--    if (ret)
--        goto cleanup;
--
--    input.length = key1->length;
--    input.data = (char *) key1->contents;
--    ret = dr(enc, key2, r2, &input);
--    if (ret)
--        goto cleanup;
--
--    /*
--     * Concatenate the two keys together, and then run them through
--     * n-fold to reduce them to a length appropriate for the random-to-key
--     * operation.  Note here that krb5int_nfold() takes sizes in bits, hence
--     * the multiply by 8.
--     */
--
--    memcpy(combined, r1, keybytes);
--    memcpy(combined + keybytes, r2, keybytes);
--
--    krb5int_nfold((keybytes * 2) * 8, combined, keybytes * 8, rnd);
--
--    /*
--     * Run the "random" bits through random-to-key to produce a encryption
--     * key.
--     */
--
--    randbits.length = keybytes;
--    randbits.data = (char *) rnd;
--    tkeyblock.length = keylength;
--    tkeyblock.contents = output;
--    tkeyblock.enctype = key1->enctype;
--
--    ret = (*ktp->rand2key)(&randbits, &tkeyblock);
--    if (ret)
--        goto cleanup;
--
--    ret = krb5_k_create_key(NULL, &tkeyblock, &tkey);
--    if (ret)
--        goto cleanup;
--
--    /*
--     * Run through derive-key one more time to produce the final key.
--     * Note that the input to derive-key is the ASCII string "combine".
--     */
--
--    input.length = 7;
--    input.data = "combine";
--
--    /*
--     * Just FYI: _if_ we have space here in the key, then simply use it
--     * without modification.  But if the key is blank (no allocated storage)
--     * then allocate some memory for it.  This allows programs to use one of
--     * the existing keys as the output key, _or_ pass in a blank keyblock
--     * for us to allocate.  It's easier for us to allocate it since we already
--     * know the crypto library internals
--     */
--
--    if (outkey->length == 0 || outkey->contents == NULL) {
--        outkey->contents = k5alloc(keylength, &ret);
--        if (ret)
--            goto cleanup;
--        outkey->length = keylength;
--        outkey->enctype = key1->enctype;
--        myalloc = TRUE;
--    }
--
--    ret = krb5int_derive_keyblock(enc, NULL, tkey, outkey, &input,
--                                  DERIVE_RFC3961);
--    if (ret) {
--        if (myalloc) {
--            free(outkey->contents);
--            outkey->contents = NULL;
--        }
--        goto cleanup;
--    }
--
--cleanup:
--    zapfree(r1, keybytes);
--    zapfree(r2, keybytes);
--    zapfree(rnd, keybytes);
--    zapfree(combined, keybytes * 2);
--    zapfree(output, keylength);
--    krb5_k_free_key(NULL, tkey);
--    return ret;
--}
--
--/* Our DR function, a simple wrapper around krb5int_derive_random(). */
--static krb5_error_code
--dr(const struct krb5_enc_provider *enc, const krb5_keyblock *inkey,
--   unsigned char *out, const krb5_data *in_constant)
--{
--    krb5_data outdata = make_data(out, enc->keybytes);
--    krb5_key key = NULL;
--    krb5_error_code ret;
--
--    ret = krb5_k_create_key(NULL, inkey, &key);
--    if (ret != 0)
--        return ret;
--    ret = krb5int_derive_random(enc, NULL, key, &outdata, in_constant,
--                                DERIVE_RFC3961);
--    krb5_k_free_key(NULL, key);
--    return ret;
--}
-diff --git a/src/lib/crypto/krb/deps b/src/lib/crypto/krb/deps
-index f9a740860..2f4af1906 100644
---- a/src/lib/crypto/krb/deps
-+++ b/src/lib/crypto/krb/deps
-@@ -191,19 +191,6 @@ coll_proof_cksum.so coll_proof_cksum.po $(OUTPRE)coll_proof_cksum.$(OBJEXT): \
-   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-   $(top_srcdir)/include/socket-utils.h coll_proof_cksum.c \
-   crypto_int.h
--combine_keys.so combine_keys.po $(OUTPRE)combine_keys.$(OBJEXT): \
--  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
--  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/crypto_mod.h \
--  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
--  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
--  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
--  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
--  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h combine_keys.c \
--  crypto_int.h
- crypto_length.so crypto_length.po $(OUTPRE)crypto_length.$(OBJEXT): \
-   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports
-index 63804299f..451d5e035 100644
---- a/src/lib/crypto/libk5crypto.exports
-+++ b/src/lib/crypto/libk5crypto.exports
-@@ -58,7 +58,6 @@ krb5_c_prf_length
- krb5int_c_mandatory_cksumtype
- krb5_c_fx_cf2_simple
- krb5int_c_weak_enctype
--krb5int_c_combine_keys
- krb5_encrypt_data
- krb5int_c_copy_keyblock
- krb5int_c_copy_keyblock_contents
diff --git a/Remove-more-dead-code.patch b/Remove-more-dead-code.patch
deleted file mode 100644
index 2d547cb..0000000
--- a/Remove-more-dead-code.patch
+++ /dev/null
@@ -1,276 +0,0 @@
-From 740ab812bedd022ec60e7ef63bf4be12dd730d67 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 9 May 2019 14:07:24 -0400
-Subject: [PATCH] Remove more dead code
-
-(cherry picked from commit 0269810b1aec6c554fb746433f045d59fd34ab3a)
----
- src/clients/klist/klist.c                     |  5 ---
- src/kadmin/dbutil/kdb5_mkey.c                 |  2 --
- src/kadmin/server/ipropd_svc.c                |  4 ---
- src/lib/gssapi/krb5/gssapi_krb5.c             |  2 +-
- src/lib/gssapi/krb5/k5sealv3.c                |  5 ++-
- src/lib/gssapi/krb5/k5sealv3iov.c             |  5 ++-
- src/lib/kdb/kdb_convert.c                     | 36 +++----------------
- .../kdb/ldap/ldap_util/kdb5_ldap_services.c   |  4 ---
- .../kdb/ldap/libkdb_ldap/ldap_create.c        | 10 ------
- src/plugins/preauth/pkinit/pkinit_srv.c       |  8 -----
- src/tests/hammer/kdc5_hammer.c                |  4 +--
- 11 files changed, 10 insertions(+), 75 deletions(-)
-
-diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c
-index 8c307151a..4261ac96c 100644
---- a/src/clients/klist/klist.c
-+++ b/src/clients/klist/klist.c
-@@ -720,11 +720,6 @@ show_credential(krb5_creds *cred)
-         extra_field += 2;
-     }
- 
--    if (extra_field > 3) {
--        fputs("\n", stdout);
--        extra_field = 0;
--    }
--
-     if (show_flags) {
-         flags = flags_string(cred);
-         if (flags && *flags) {
-diff --git a/src/kadmin/dbutil/kdb5_mkey.c b/src/kadmin/dbutil/kdb5_mkey.c
-index 19796c202..aceb0a9b8 100644
---- a/src/kadmin/dbutil/kdb5_mkey.c
-+++ b/src/kadmin/dbutil/kdb5_mkey.c
-@@ -1240,7 +1240,6 @@ kdb5_purge_mkeys(int argc, char *argv[])
-                             if (actkvno_entry == actkvno_list) {
-                                 /* remove from head */
-                                 actkvno_list = actkvno_entry->next;
--                                prev_actkvno_entry = actkvno_list;
-                             } else if (actkvno_entry->next == NULL) {
-                                 /* remove from tail */
-                                 prev_actkvno_entry->next = NULL;
-@@ -1263,7 +1262,6 @@ kdb5_purge_mkeys(int argc, char *argv[])
-                         if (mkey_aux_entry->mkey_kvno == args.kvnos[j].kvno) {
-                             if (mkey_aux_entry == mkey_aux_list) {
-                                 mkey_aux_list = mkey_aux_entry->next;
--                                prev_mkey_aux_entry = mkey_aux_list;
-                             } else if (mkey_aux_entry->next == NULL) {
-                                 prev_mkey_aux_entry->next = NULL;
-                             } else {
-diff --git a/src/kadmin/server/ipropd_svc.c b/src/kadmin/server/ipropd_svc.c
-index dc9984c2c..56e9b90b2 100644
---- a/src/kadmin/server/ipropd_svc.c
-+++ b/src/kadmin/server/ipropd_svc.c
-@@ -263,8 +263,6 @@ ipropx_resync(uint32_t vers, struct svc_req *rqstp)
-     int pret, fret;
-     FILE *p;
-     kadm5_server_handle_t handle = global_server_handle;
--    OM_uint32 min_stat;
--    gss_name_t name = NULL;
-     char *client_name = NULL, *service_name = NULL;
-     char *whoami = "iprop_full_resync_1";
- 
-@@ -440,8 +438,6 @@ out:
- 	debprret(whoami, ret.ret, 0);
-     free(client_name);
-     free(service_name);
--    if (name)
--	gss_release_name(&min_stat, &name);
-     free(ubuf);
-     return (&ret);
- }
-diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c
-index 79b83e0c6..f09cda007 100644
---- a/src/lib/gssapi/krb5/gssapi_krb5.c
-+++ b/src/lib/gssapi/krb5/gssapi_krb5.c
-@@ -780,7 +780,7 @@ krb5_gss_localname(OM_uint32 *minor,
-     localname->value = gssalloc_strdup(lname);
-     localname->length = strlen(lname);
- 
--    return (code == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE;
-+    return GSS_S_COMPLETE;
- }
- 
- 
-diff --git a/src/lib/gssapi/krb5/k5sealv3.c b/src/lib/gssapi/krb5/k5sealv3.c
-index 25d9f2711..3b4f8cb83 100644
---- a/src/lib/gssapi/krb5/k5sealv3.c
-+++ b/src/lib/gssapi/krb5/k5sealv3.c
-@@ -145,9 +145,8 @@ gss_krb5int_make_seal_token_v3 (krb5_context context,
-         /* TOK_ID */
-         store_16_be(KG2_TOK_WRAP_MSG, outbuf);
-         /* flags */
--        outbuf[2] = (acceptor_flag
--                     | (conf_req_flag ? FLAG_WRAP_CONFIDENTIAL : 0)
--                     | (ctx->have_acceptor_subkey ? FLAG_ACCEPTOR_SUBKEY : 0));
-+        outbuf[2] = (acceptor_flag | FLAG_WRAP_CONFIDENTIAL |
-+                     (ctx->have_acceptor_subkey ? FLAG_ACCEPTOR_SUBKEY : 0));
-         /* filler */
-         outbuf[3] = 0xff;
-         /* EC */
-diff --git a/src/lib/gssapi/krb5/k5sealv3iov.c b/src/lib/gssapi/krb5/k5sealv3iov.c
-index a73edb6a4..333ee124d 100644
---- a/src/lib/gssapi/krb5/k5sealv3iov.c
-+++ b/src/lib/gssapi/krb5/k5sealv3iov.c
-@@ -144,9 +144,8 @@ gss_krb5int_make_seal_token_v3_iov(krb5_context context,
-         /* TOK_ID */
-         store_16_be(KG2_TOK_WRAP_MSG, outbuf);
-         /* flags */
--        outbuf[2] = (acceptor_flag
--                     | (conf_req_flag ? FLAG_WRAP_CONFIDENTIAL : 0)
--                     | (ctx->have_acceptor_subkey ? FLAG_ACCEPTOR_SUBKEY : 0));
-+        outbuf[2] = (acceptor_flag | FLAG_WRAP_CONFIDENTIAL |
-+                     (ctx->have_acceptor_subkey ? FLAG_ACCEPTOR_SUBKEY : 0));
-         /* filler */
-         outbuf[3] = 0xFF;
-         /* EC */
-diff --git a/src/lib/kdb/kdb_convert.c b/src/lib/kdb/kdb_convert.c
-index 76140732f..e1bf1919f 100644
---- a/src/lib/kdb/kdb_convert.c
-+++ b/src/lib/kdb/kdb_convert.c
-@@ -305,8 +305,6 @@ ulog_conv_2logentry(krb5_context context, krb5_db_entry *entry,
-     krb5_error_code ret;
-     kdbe_attr_type_t *attr_types;
-     int kadm_data_yes;
--    /* always exclude non-replicated attributes, for now */
--    krb5_boolean exclude_nra = TRUE;
- 
-     nattrs = tmpint = 0;
-     final = -1;
-@@ -356,7 +354,8 @@ ulog_conv_2logentry(krb5_context context, krb5_db_entry *entry,
-             nattrs++;
-         }
-     } else {
--        find_changed_attrs(curr, entry, exclude_nra, attr_types, &nattrs);
-+        /* Always exclude non-replicated attributes for now. */
-+        find_changed_attrs(curr, entry, TRUE, attr_types, &nattrs);
-         krb5_db_free_principal(context, curr);
-     }
- 
-@@ -402,31 +401,6 @@ ulog_conv_2logentry(krb5_context context, krb5_db_entry *entry,
-             }
-             break;
- 
--        case AT_LAST_SUCCESS:
--            if (!exclude_nra && entry->last_success >= 0) {
--                ULOG_ENTRY_TYPE(update, ++final).av_type = AT_LAST_SUCCESS;
--                ULOG_ENTRY(update, final).av_last_success =
--                    (uint32_t)entry->last_success;
--            }
--            break;
--
--        case AT_LAST_FAILED:
--            if (!exclude_nra && entry->last_failed >= 0) {
--                ULOG_ENTRY_TYPE(update, ++final).av_type = AT_LAST_FAILED;
--                ULOG_ENTRY(update, final).av_last_failed =
--                    (uint32_t)entry->last_failed;
--            }
--            break;
--
--        case AT_FAIL_AUTH_COUNT:
--            if (!exclude_nra) {
--                ULOG_ENTRY_TYPE(update, ++final).av_type =
--                    AT_FAIL_AUTH_COUNT;
--                ULOG_ENTRY(update, final).av_fail_auth_count =
--                    (uint32_t)entry->fail_auth_count;
--            }
--            break;
--
-         case AT_PRINC:
-             if (entry->princ->length > 0) {
-                 ULOG_ENTRY_TYPE(update, ++final).av_type = AT_PRINC;
-@@ -552,10 +526,8 @@ ulog_conv_2logentry(krb5_context context, krb5_db_entry *entry,
- /* END CSTYLED */
- 
-         case AT_LEN:
--            if (entry->len >= 0) {
--                ULOG_ENTRY_TYPE(update, ++final).av_type = AT_LEN;
--                ULOG_ENTRY(update, final).av_len = (int16_t)entry->len;
--            }
-+            ULOG_ENTRY_TYPE(update, ++final).av_type = AT_LEN;
-+            ULOG_ENTRY(update, final).av_len = (int16_t)entry->len;
-             break;
- 
-         default:
-diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
-index ce038fc3d..0a95101ad 100644
---- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
-+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
-@@ -135,10 +135,6 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
-             print_usage = TRUE;
-             goto cleanup;
-         }
--        if (file_name == NULL) {
--            com_err(me, ENOMEM, _("while setting service object password"));
--            goto cleanup;
--        }
-     } else { /* argc == 2 */
-         service_object = strdup (argv[1]);
-         if (service_object == NULL) {
-diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
-index 1e6fffee5..5b57c799a 100644
---- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
-+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
-@@ -56,7 +56,6 @@ krb5_ldap_create(krb5_context context, char *conf_section, char **db_args)
-     krb5_ldap_realm_params *rparams = NULL;
-     krb5_ldap_context *ldap_context=NULL;
-     krb5_boolean realm_obj_created = FALSE;
--    krb5_boolean krbcontainer_obj_created = FALSE;
-     int mask = 0;
- 
-     /* Clear the global error string */
-@@ -121,15 +120,6 @@ krb5_ldap_create(krb5_context context, char *conf_section, char **db_args)
-         goto cleanup;
- 
- cleanup:
--    /* If the krbcontainer/realm creation is not complete, do the roll-back here */
--    if ((krbcontainer_obj_created) && (!realm_obj_created)) {
--        int rc;
--        rc = krb5_ldap_delete_krbcontainer(context,
--                                           ldap_context->container_dn);
--        k5_setmsg(context, rc, _("could not complete roll-back, error "
--                                 "deleting Kerberos Container"));
--    }
--
-     if (rparams)
-         krb5_ldap_free_realm_params(rparams);
- 
-diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
-index 27e6ef4d2..6aa646cc6 100644
---- a/src/plugins/preauth/pkinit/pkinit_srv.c
-+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
-@@ -258,15 +258,7 @@ verify_client_san(krb5_context context,
-     }
-     pkiDebug("%s: no upn san match found\n", __FUNCTION__);
- 
--    /* We found no match */
--    if (princs != NULL || upns != NULL) {
--        *valid_san = 0;
--        /* XXX ??? If there was one or more name in the cert, but
--         * none matched the client name, then return mismatch? */
--        retval = KRB5KDC_ERR_CLIENT_NAME_MISMATCH;
--    }
-     retval = 0;
--
- out:
-     if (princs != NULL) {
-         for (i = 0; princs[i] != NULL; i++)
-diff --git a/src/tests/hammer/kdc5_hammer.c b/src/tests/hammer/kdc5_hammer.c
-index 086c21d1c..8220fd97b 100644
---- a/src/tests/hammer/kdc5_hammer.c
-+++ b/src/tests/hammer/kdc5_hammer.c
-@@ -439,7 +439,6 @@ int get_tgt (context, p_client_str, p_client, ccache)
-     krb5_principal *p_client;
-     krb5_ccache ccache;
- {
--    char *cache_name = NULL;		/* -f option */
-     long lifetime = KRB5_DEFAULT_LIFE;	/* -l option */
-     krb5_error_code code;
-     krb5_creds my_creds;
-@@ -464,8 +463,7 @@ int get_tgt (context, p_client_str, p_client, ccache)
- 
-     code = krb5_cc_initialize (context, ccache, *p_client);
-     if (code != 0) {
--	com_err (prog, code, "when initializing cache %s",
--		 cache_name?cache_name:"");
-+	com_err (prog, code, "when initializing cache");
- 	return(-1);
-     }
- 
diff --git a/Remove-now-unused-checksum-functions.patch b/Remove-now-unused-checksum-functions.patch
deleted file mode 100644
index e84ae39..0000000
--- a/Remove-now-unused-checksum-functions.patch
+++ /dev/null
@@ -1,335 +0,0 @@
-From 25418e054868301e1a1a5824913b74f2479e1b15 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Fri, 28 Jun 2019 13:09:47 -0400
-Subject: [PATCH] Remove now-unused checksum functions
-
-fb2dada5eb89c4cd4e39dedd6dbb7dbd5e94f8b8 removed all call sites of
-krb5int_cbc_checksum(), krb5int_confounder_verify(), and
-krb5int_confounder_checksum(), but neglected the functions themselves.
-
-ticket: 8808
-(cherry picked from commit 2063ff09b384d466c15aca8970c01d074230c815)
----
- src/lib/crypto/krb/Makefile.in           |   6 -
- src/lib/crypto/krb/checksum_cbc.c        |  41 ------
- src/lib/crypto/krb/checksum_confounder.c | 159 -----------------------
- src/lib/crypto/krb/crypto_int.h          |  16 ---
- src/lib/crypto/krb/deps                  |  26 ----
- 5 files changed, 248 deletions(-)
- delete mode 100644 src/lib/crypto/krb/checksum_cbc.c
- delete mode 100644 src/lib/crypto/krb/checksum_confounder.c
-
-diff --git a/src/lib/crypto/krb/Makefile.in b/src/lib/crypto/krb/Makefile.in
-index b587f7e19..2b0c4163d 100644
---- a/src/lib/crypto/krb/Makefile.in
-+++ b/src/lib/crypto/krb/Makefile.in
-@@ -10,8 +10,6 @@ STLIBOBJS=\
- 	aead.o		 	\
- 	block_size.o		\
- 	cf2.o 			\
--	checksum_cbc.o		\
--	checksum_confounder.o	\
- 	checksum_dk_cmac.o	\
- 	checksum_dk_hmac.o	\
- 	checksum_etm.o		\
-@@ -70,8 +68,6 @@ OBJS=\
- 	$(OUTPRE)aead.$(OBJEXT)		 	\
- 	$(OUTPRE)block_size.$(OBJEXT)		\
- 	$(OUTPRE)cf2.$(OBJEXT) 			\
--	$(OUTPRE)checksum_cbc.$(OBJEXT)		\
--	$(OUTPRE)checksum_confounder.$(OBJEXT)	\
- 	$(OUTPRE)checksum_dk_cmac.$(OBJEXT)	\
- 	$(OUTPRE)checksum_dk_hmac.$(OBJEXT)	\
- 	$(OUTPRE)checksum_etm.$(OBJEXT)		\
-@@ -130,8 +126,6 @@ SRCS=\
- 	$(srcdir)/aead.c		\
- 	$(srcdir)/block_size.c		\
- 	$(srcdir)/cf2.c 			\
--	$(srcdir)/checksum_cbc.c		\
--	$(srcdir)/checksum_confounder.c	\
- 	$(srcdir)/checksum_dk_cmac.c	\
- 	$(srcdir)/checksum_dk_hmac.c	\
- 	$(srcdir)/checksum_etm.c	\
-diff --git a/src/lib/crypto/krb/checksum_cbc.c b/src/lib/crypto/krb/checksum_cbc.c
-deleted file mode 100644
-index 48afeb0e5..000000000
---- a/src/lib/crypto/krb/checksum_cbc.c
-+++ /dev/null
-@@ -1,41 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/* lib/crypto/krb/checksum_cbc.c */
--/*
-- * Copyright (C) 2009 by the Massachusetts Institute of Technology.
-- * All rights reserved.
-- *
-- * Export of this software from the United States of America may
-- *   require a specific license from the United States Government.
-- *   It is the responsibility of any person or organization contemplating
-- *   export to obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of M.I.T. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  Furthermore if you modify this software you must label
-- * your software as modified software and not distribute it in such a
-- * fashion that it might be confused with the original M.I.T. software.
-- * M.I.T. makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- */
--
--/* CBC checksum, which computes the ivec resulting from CBC encryption of the
-- * input. */
--
--#include "crypto_int.h"
--
--krb5_error_code
--krb5int_cbc_checksum(const struct krb5_cksumtypes *ctp,
--                     krb5_key key, krb5_keyusage usage,
--                     const krb5_crypto_iov *data, size_t num_data,
--                     krb5_data *output)
--{
--    if (ctp->enc->cbc_mac == NULL)
--        return KRB5_CRYPTO_INTERNAL;
--    return ctp->enc->cbc_mac(key, data, num_data, NULL, output);
--}
-diff --git a/src/lib/crypto/krb/checksum_confounder.c b/src/lib/crypto/krb/checksum_confounder.c
-deleted file mode 100644
-index 34941562c..000000000
---- a/src/lib/crypto/krb/checksum_confounder.c
-+++ /dev/null
-@@ -1,159 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/* lib/crypto/krb/checksum_confounder.c */
--/*
-- * Copyright (C) 2009 by the Massachusetts Institute of Technology.
-- * All rights reserved.
-- *
-- * Export of this software from the United States of America may
-- *   require a specific license from the United States Government.
-- *   It is the responsibility of any person or organization contemplating
-- *   export to obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of M.I.T. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  Furthermore if you modify this software you must label
-- * your software as modified software and not distribute it in such a
-- * fashion that it might be confused with the original M.I.T. software.
-- * M.I.T. makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- */
--
--/*
-- * Confounder checksum implementation, using tokens of the form:
-- *   enc(xorkey, confounder | hash(confounder | data))
-- * where xorkey is the key XOR'd with 0xf0 bytes.
-- */
--
--#include "crypto_int.h"
--
--/* Derive a key by XOR with 0xF0 bytes. */
--static krb5_error_code
--mk_xorkey(krb5_key origkey, krb5_key *xorkey)
--{
--    krb5_error_code retval = 0;
--    unsigned char *xorbytes;
--    krb5_keyblock xorkeyblock;
--    size_t i = 0;
--
--    xorbytes = k5memdup(origkey->keyblock.contents, origkey->keyblock.length,
--                        &retval);
--    if (xorbytes == NULL)
--        return retval;
--    for (i = 0; i < origkey->keyblock.length; i++)
--        xorbytes[i] ^= 0xf0;
--
--    /* Do a shallow copy here. */
--    xorkeyblock = origkey->keyblock;
--    xorkeyblock.contents = xorbytes;
--
--    retval = krb5_k_create_key(0, &xorkeyblock, xorkey);
--    zapfree(xorbytes, origkey->keyblock.length);
--    return retval;
--}
--
--krb5_error_code
--krb5int_confounder_checksum(const struct krb5_cksumtypes *ctp,
--                            krb5_key key, krb5_keyusage usage,
--                            const krb5_crypto_iov *data, size_t num_data,
--                            krb5_data *output)
--{
--    krb5_error_code ret;
--    krb5_data conf, hashval;
--    krb5_key xorkey = NULL;
--    krb5_crypto_iov *hash_iov, iov;
--    size_t blocksize = ctp->enc->block_size, hashsize = ctp->hash->hashsize;
--
--    /* Partition the output buffer into confounder and hash. */
--    conf = make_data(output->data, blocksize);
--    hashval = make_data(output->data + blocksize, hashsize);
--
--    /* Create the confounder. */
--    ret = krb5_c_random_make_octets(NULL, &conf);
--    if (ret != 0)
--        return ret;
--
--    ret = mk_xorkey(key, &xorkey);
--    if (ret)
--        return ret;
--
--    /* Hash the confounder, then the input data. */
--    hash_iov = k5calloc(num_data + 1, sizeof(krb5_crypto_iov), &ret);
--    if (hash_iov == NULL)
--        goto cleanup;
--    hash_iov[0].flags = KRB5_CRYPTO_TYPE_DATA;
--    hash_iov[0].data = conf;
--    memcpy(hash_iov + 1, data, num_data * sizeof(krb5_crypto_iov));
--    ret = ctp->hash->hash(hash_iov, num_data + 1, &hashval);
--    if (ret != 0)
--        goto cleanup;
--
--    /* Confounder and hash are in output buffer; encrypt them in place. */
--    iov.flags = KRB5_CRYPTO_TYPE_DATA;
--    iov.data = *output;
--    ret = ctp->enc->encrypt(xorkey, NULL, &iov, 1);
--
--cleanup:
--    free(hash_iov);
--    krb5_k_free_key(NULL, xorkey);
--    return ret;
--}
--
--krb5_error_code krb5int_confounder_verify(const struct krb5_cksumtypes *ctp,
--                                          krb5_key key, krb5_keyusage usage,
--                                          const krb5_crypto_iov *data,
--                                          size_t num_data,
--                                          const krb5_data *input,
--                                          krb5_boolean *valid)
--{
--    krb5_error_code ret;
--    unsigned char *plaintext = NULL;
--    krb5_key xorkey = NULL;
--    krb5_data computed = empty_data();
--    krb5_crypto_iov *hash_iov = NULL, iov;
--    size_t blocksize = ctp->enc->block_size, hashsize = ctp->hash->hashsize;
--
--    plaintext = k5memdup(input->data, input->length, &ret);
--    if (plaintext == NULL)
--        return ret;
--
--    ret = mk_xorkey(key, &xorkey);
--    if (ret != 0)
--        goto cleanup;
--
--    /* Decrypt the input checksum. */
--    iov.flags = KRB5_CRYPTO_TYPE_DATA;
--    iov.data = make_data(plaintext, input->length);
--    ret = ctp->enc->decrypt(xorkey, NULL, &iov, 1);
--    if (ret != 0)
--        goto cleanup;
--
--    /* Hash the confounder, then the input data. */
--    hash_iov = k5calloc(num_data + 1, sizeof(krb5_crypto_iov), &ret);
--    if (hash_iov == NULL)
--        goto cleanup;
--    hash_iov[0].flags = KRB5_CRYPTO_TYPE_DATA;
--    hash_iov[0].data = make_data(plaintext, blocksize);
--    memcpy(hash_iov + 1, data, num_data * sizeof(krb5_crypto_iov));
--    ret = alloc_data(&computed, hashsize);
--    if (ret != 0)
--        goto cleanup;
--    ret = ctp->hash->hash(hash_iov, num_data + 1, &computed);
--    if (ret != 0)
--        goto cleanup;
--
--    /* Compare the decrypted hash to the computed one. */
--    *valid = (k5_bcmp(plaintext + blocksize, computed.data, hashsize) == 0);
--
--cleanup:
--    zapfree(plaintext, input->length);
--    zapfree(computed.data, hashsize);
--    free(hash_iov);
--    krb5_k_free_key(NULL, xorkey);
--    return ret;
--}
-diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h
-index 1b4324d71..5cc1f8e43 100644
---- a/src/lib/crypto/krb/crypto_int.h
-+++ b/src/lib/crypto/krb/crypto_int.h
-@@ -299,11 +299,6 @@ krb5_error_code krb5int_unkeyed_checksum(const struct krb5_cksumtypes *ctp,
-                                          const krb5_crypto_iov *data,
-                                          size_t num_data,
-                                          krb5_data *output);
--krb5_error_code krb5int_cbc_checksum(const struct krb5_cksumtypes *ctp,
--                                     krb5_key key, krb5_keyusage usage,
--                                     const krb5_crypto_iov *data,
--                                     size_t num_data,
--                                     krb5_data *output);
- krb5_error_code krb5int_hmacmd5_checksum(const struct krb5_cksumtypes *ctp,
-                                          krb5_key key, krb5_keyusage usage,
-                                          const krb5_crypto_iov *data,
-@@ -317,17 +312,6 @@ krb5_error_code krb5int_dk_cmac_checksum(const struct krb5_cksumtypes *ctp,
-                                          krb5_key key, krb5_keyusage usage,
-                                          const krb5_crypto_iov *data,
-                                          size_t num_data, krb5_data *output);
--krb5_error_code krb5int_confounder_checksum(const struct krb5_cksumtypes *ctp,
--                                            krb5_key key, krb5_keyusage usage,
--                                            const krb5_crypto_iov *data,
--                                            size_t num_data,
--                                            krb5_data *output);
--krb5_error_code krb5int_confounder_verify(const struct krb5_cksumtypes *ctp,
--                                          krb5_key key, krb5_keyusage usage,
--                                          const krb5_crypto_iov *data,
--                                          size_t num_data,
--                                          const krb5_data *input,
--                                          krb5_boolean *valid);
- krb5_error_code krb5int_etm_checksum(const struct krb5_cksumtypes *ctp,
-                                      krb5_key key, krb5_keyusage usage,
-                                      const krb5_crypto_iov *data,
-diff --git a/src/lib/crypto/krb/deps b/src/lib/crypto/krb/deps
-index 2f4af1906..883d12c56 100644
---- a/src/lib/crypto/krb/deps
-+++ b/src/lib/crypto/krb/deps
-@@ -37,32 +37,6 @@ cf2.so cf2.po $(OUTPRE)cf2.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-   cf2.c crypto_int.h
--checksum_cbc.so checksum_cbc.po $(OUTPRE)checksum_cbc.$(OBJEXT): \
--  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
--  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/crypto_mod.h \
--  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
--  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
--  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
--  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
--  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h checksum_cbc.c \
--  crypto_int.h
--checksum_confounder.so checksum_confounder.po $(OUTPRE)checksum_confounder.$(OBJEXT): \
--  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
--  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/crypto_mod.h \
--  $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
--  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
--  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
--  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
--  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h checksum_confounder.c \
--  crypto_int.h
- checksum_dk_cmac.so checksum_dk_cmac.po $(OUTPRE)checksum_dk_cmac.$(OBJEXT): \
-   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
diff --git a/Remove-null-check-in-krb5_gss_duplicate_name.patch b/Remove-null-check-in-krb5_gss_duplicate_name.patch
deleted file mode 100644
index 685261a..0000000
--- a/Remove-null-check-in-krb5_gss_duplicate_name.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 7016aa77499732446d7bc838b95810c8cdf5b15b Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Fri, 30 Aug 2019 11:19:52 -0400
-Subject: [PATCH] Remove null check in krb5_gss_duplicate_name()
-
-Within the krb5 mechanism, we require minor_status to be writable
-without checking.  Remove the null check in krb5_gss_duplicate_name()
-to squash a forward-null defect.
-
-(cherry picked from commit 9fd7bc179f0bd74fc83c1edf0247dcfd87fc73e6)
----
- src/lib/gssapi/krb5/duplicate_name.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/src/lib/gssapi/krb5/duplicate_name.c b/src/lib/gssapi/krb5/duplicate_name.c
-index b88d97d9d..ea53e9c0d 100644
---- a/src/lib/gssapi/krb5/duplicate_name.c
-+++ b/src/lib/gssapi/krb5/duplicate_name.c
-@@ -34,8 +34,7 @@ krb5_gss_duplicate_name(OM_uint32 *minor_status, const gss_name_t input_name,
-     krb5_error_code code;
-     krb5_gss_name_t princ, outprinc;
- 
--    if (minor_status)
--        *minor_status = 0;
-+    *minor_status = 0;
- 
-     code = krb5_gss_init_context(&context);
-     if (code) {
diff --git a/Remove-ovsec_adm_export-dump-format-support.patch b/Remove-ovsec_adm_export-dump-format-support.patch
deleted file mode 100644
index ebc053c..0000000
--- a/Remove-ovsec_adm_export-dump-format-support.patch
+++ /dev/null
@@ -1,385 +0,0 @@
-From 5125a9bd20b2fa2b0f420dc20780d08af1cc91a6 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 22 Jan 2019 18:34:58 -0500
-Subject: [PATCH] Remove ovsec_adm_export dump format support
-
-Dumping only suported single-DES principals.  While importing still
-functioned, it would only have been useful for extremely old (1.3-era)
-KDCs.
-
-ticket: 8798 (new)
-(cherry picked from commit 23b93fd48bc445005436c5be98a7269b599b1800)
----
- doc/admin/admin_commands/kdb5_util.rst |  11 +--
- doc/admin/database.rst                 |  14 ----
- src/kadmin/dbutil/dump.c               | 109 ++-----------------------
- src/kadmin/dbutil/kdb5_util.c          |   4 +-
- src/man/kdb5_util.man                  |  13 +--
- src/tests/Makefile.in                  |   6 --
- src/tests/t_dump.py                    |   8 --
- 7 files changed, 13 insertions(+), 152 deletions(-)
-
-diff --git a/doc/admin/admin_commands/kdb5_util.rst b/doc/admin/admin_commands/kdb5_util.rst
-index fee68261a..7dd54f797 100644
---- a/doc/admin/admin_commands/kdb5_util.rst
-+++ b/doc/admin/admin_commands/kdb5_util.rst
-@@ -136,7 +136,7 @@ dump
- 
- .. _kdb5_util_dump:
- 
--    **dump** [**-b7**\|\ **-ov**\|\ **-r13**\|\ **-r18**]
-+    **dump** [**-b7**\|\ **-r13**\|\ **-r18**]
-     [**-verbose**] [**-mkey_convert**] [**-new_mkey_file**
-     *mkey_file*] [**-rev**] [**-recurse**] [*filename*
-     [*principals*...]]
-@@ -151,9 +151,6 @@ load_dump version 7".  If filename is not specified, or is the string
-     load_dump version 4").  This was the dump format produced on
-     releases prior to 1.2.2.
- 
--**-ov**
--    causes the dump to be in "ovsec_adm_export" format.
--
- **-r13**
-     causes the dump to be in the Kerberos 5 1.3 format ("kdb5_util
-     load_dump version 5").  This was the dump format produced on
-@@ -204,7 +201,7 @@ load
- 
- .. _kdb5_util_load:
- 
--    **load** [**-b7**\|\ **-ov**\|\ **-r13**\|\ **-r18**] [**-hash**]
-+    **load** [**-b7**\|\ **-r13**\|\ **-r18**] [**-hash**]
-     [**-verbose**] [**-update**] *filename*
- 
- Loads a database dump from the named file into the named database.  If
-@@ -222,10 +219,6 @@ Options:
-     ("kdb5_util load_dump version 4").  This was the dump format
-     produced on releases prior to 1.2.2.
- 
--**-ov**
--    requires the database to be in "ovsec_adm_import" format.  Must be
--    used with the **-update** option.
--
- **-r13**
-     requires the database to be in Kerberos 5 1.3 format ("kdb5_util
-     load_dump version 5").  This was the dump format produced on
-diff --git a/doc/admin/database.rst b/doc/admin/database.rst
-index 2b02af3a0..113a680a6 100644
---- a/doc/admin/database.rst
-+++ b/doc/admin/database.rst
-@@ -393,20 +393,6 @@ To dump a single principal and later load it, updating the database:
-           If the database file exists, and the *-update* flag was not
-           given, *kdb5_util* will overwrite the existing database.
- 
--Using kdb5_util to upgrade a master KDC from krb5 1.1.x:
--
--::
--
--    shell% kdb5_util dump old-kdb-dump
--    shell% kdb5_util dump -ov old-kdb-dump.ov
--      [Create a new KDC installation, using the old stash file/master password]
--    shell% kdb5_util load old-kdb-dump
--    shell% kdb5_util load -update old-kdb-dump.ov
--
--The use of old-kdb-dump.ov for an extra dump and load is necessary
--to preserve per-principal policy information, which is not included in
--the default dump format of krb5 1.1.x.
--
- .. note::
- 
-           Using kdb5_util to dump and reload the principal database is
-diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c
-index 8301a33d0..19f2cc230 100644
---- a/src/kadmin/dbutil/dump.c
-+++ b/src/kadmin/dbutil/dump.c
-@@ -484,83 +484,6 @@ dump_r1_11_policy(void *data, osa_policy_ent_t entry)
-     fprintf(arg->ofile, "\n");
- }
- 
--static void
--print_key_data(FILE *f, krb5_key_data *kd)
--{
--    int c;
--
--    fprintf(f, "%d\t%d\t", kd->key_data_type[0], kd->key_data_length[0]);
--    for (c = 0; c < kd->key_data_length[0]; c++)
--        fprintf(f, "%02x ", kd->key_data_contents[0][c]);
--}
--
--/* Output osa_adb_princ_ent data in a printable serialized format, suitable for
-- * ovsec_adm_import consumption. */
--static krb5_error_code
--dump_ov_princ(krb5_context context, krb5_db_entry *entry, const char *name,
--              FILE *fp, krb5_boolean verbose, krb5_boolean omit_nra)
--{
--    char *princstr;
--    unsigned int x;
--    int y, foundcrc;
--    krb5_tl_data tl_data;
--    osa_princ_ent_rec adb;
--    XDR xdrs;
--    krb5_key_data *key_data;
--
--    tl_data.tl_data_type = KRB5_TL_KADM_DATA;
--    if (krb5_dbe_lookup_tl_data(context, entry, &tl_data) ||
--        tl_data.tl_data_length == 0)
--        return 0;
--
--    memset(&adb, 0, sizeof(adb));
--    xdrmem_create(&xdrs, (caddr_t)tl_data.tl_data_contents,
--                  tl_data.tl_data_length, XDR_DECODE);
--    if (!xdr_osa_princ_ent_rec(&xdrs, &adb)) {
--        xdr_destroy(&xdrs);
--        return KADM5_XDR_FAILURE;
--    }
--    xdr_destroy(&xdrs);
--
--    krb5_unparse_name(context, entry->princ, &princstr);
--    fprintf(fp, "princ\t%s\t", princstr);
--    if (adb.policy == NULL)
--        fputc('\t', fp);
--    else
--        fprintf(fp, "%s\t", adb.policy);
--    fprintf(fp, "%lx\t%d\t%d\t%d", adb.aux_attributes, adb.old_key_len,
--            adb.old_key_next, adb.admin_history_kvno);
--
--    for (x = 0; x < adb.old_key_len; x++) {
--        foundcrc = 0;
--        for (y = 0; y < adb.old_keys[x].n_key_data; y++) {
--            key_data = &adb.old_keys[x].key_data[y];
--            if (key_data->key_data_type[0] != ENCTYPE_DES_CBC_CRC)
--                continue;
--            if (foundcrc) {
--                fprintf(stderr, _("Warning!  Multiple DES-CBC-CRC keys for "
--                                  "principal %s; skipping duplicates.\n"),
--                        princstr);
--                continue;
--            }
--            foundcrc++;
--
--            fputc('\t', fp);
--            print_key_data(fp, key_data);
--        }
--        if (!foundcrc) {
--            fprintf(stderr, _("Warning!  No DES-CBC-CRC key for principal %s, "
--                              "cannot generate OV-compatible record; "
--                              "skipping\n"), princstr);
--        }
--    }
--
--    fputc('\n', fp);
--    free(princstr);
--    xdr_free(xdr_osa_princ_ent_rec, &adb);
--    return 0;
--}
--
- static krb5_error_code
- dump_iterator(void *ptr, krb5_db_entry *entry)
- {
-@@ -1101,14 +1024,6 @@ process_k5beta7_record(krb5_context context, const char *fname, FILE *filep,
-                           process_k5beta7_princ, process_k5beta7_policy);
- }
- 
--static int
--process_ov_record(krb5_context context, const char *fname, FILE *filep,
--                  krb5_boolean verbose, int *linenop)
--{
--    return process_tagged(context, fname, filep, verbose, linenop,
--                          process_ov_principal, process_k5beta7_policy);
--}
--
- static int
- process_r1_8_record(krb5_context context, const char *fname, FILE *filep,
-                     krb5_boolean verbose, int *linenop)
-@@ -1135,16 +1050,6 @@ dump_version beta7_version = {
-     dump_k5beta7_policy,
-     process_k5beta7_record,
- };
--dump_version ov_version = {
--    "OpenV*Secure V1.0",
--    "OpenV*Secure V1.0\t",
--    1,
--    0,
--    0,
--    dump_ov_princ,
--    dump_k5beta7_policy,
--    process_ov_record
--};
- dump_version r1_3_version = {
-     "Kerberos version 5 release 1.3",
-     "kdb5_util load_dump version 5\n",
-@@ -1267,7 +1172,7 @@ current_dump_sno_in_ulog(krb5_context context, const char *ifile)
- 
- /*
-  * usage is:
-- *      dump_db [-b7] [-ov] [-r13] [-r18] [-verbose] [-mkey_convert]
-+ *      dump_db [-b7] [-r13] [-r18] [-verbose] [-mkey_convert]
-  *              [-new_mkey_file mkey_file] [-rev] [-recurse]
-  *              [filename [principals...]]
-  */
-@@ -1302,7 +1207,8 @@ dump_db(int argc, char **argv)
-         if (!strcmp(argv[aindex], "-b7")) {
-             dump = &beta7_version;
-         } else if (!strcmp(argv[aindex], "-ov")) {
--            dump = &ov_version;
-+            fprintf(stderr, _("OV dump format not supported\n"));
-+            goto error;
-         } else if (!strcmp(argv[aindex], "-r13")) {
-             dump = &r1_3_version;
-         } else if (!strcmp(argv[aindex], "-r18")) {
-@@ -1515,8 +1421,7 @@ restore_dump(krb5_context context, char *dumpfile, FILE *f,
- }
- 
- /*
-- * Usage: load_db [-ov] [-b7] [-r13] [-r18] [-verbose] [-update] [-hash]
-- *                filename
-+ * Usage: load_db [-b7] [-r13] [-r18] [-verbose] [-update] [-hash] filename
-  */
- void
- load_db(int argc, char **argv)
-@@ -1540,7 +1445,8 @@ load_db(int argc, char **argv)
-         if (!strcmp(argv[aindex], "-b7")){
-             load = &beta7_version;
-         } else if (!strcmp(argv[aindex], "-ov")) {
--            load = &ov_version;
-+            fprintf(stderr, _("OV dump format not supported\n"));
-+            goto error;
-         } else if (!strcmp(argv[aindex], "-r13")) {
-             load = &r1_3_version;
-         } else if (!strcmp(argv[aindex], "-r18")){
-@@ -1605,9 +1511,6 @@ load_db(int argc, char **argv)
-             load = &r1_8_version;
-         } else if (strcmp(buf, r1_11_version.header) == 0) {
-             load = &r1_11_version;
--        } else if (strncmp(buf, ov_version.header,
--                           strlen(ov_version.header)) == 0) {
--            load = &ov_version;
-         } else {
-             fprintf(stderr, _("%s: dump header bad in %s\n"), progname,
-                     dumpfile);
-diff --git a/src/kadmin/dbutil/kdb5_util.c b/src/kadmin/dbutil/kdb5_util.c
-index accc959e0..e73e2c68e 100644
---- a/src/kadmin/dbutil/kdb5_util.c
-+++ b/src/kadmin/dbutil/kdb5_util.c
-@@ -85,10 +85,10 @@ void usage()
-               "\tcreate  [-s]\n"
-               "\tdestroy [-f]\n"
-               "\tstash   [-f keyfile]\n"
--              "\tdump    [-old|-ov|-b6|-b7|-r13|-r18] [-verbose]\n"
-+              "\tdump    [-old|-b6|-b7|-r13|-r18] [-verbose]\n"
-               "\t        [-mkey_convert] [-new_mkey_file mkey_file]\n"
-               "\t        [-rev] [-recurse] [filename [princs...]]\n"
--              "\tload    [-old|-ov|-b6|-b7|-r13|-r18] [-verbose] [-update] "
-+              "\tload    [-old|-b6|-b7|-r13|-r18] [-verbose] [-update] "
-               "filename\n"
-               "\tark     [-e etype_list] principal\n"
-               "\tadd_mkey [-e etype] [-s]\n"
-diff --git a/src/man/kdb5_util.man b/src/man/kdb5_util.man
-index 5ebc68a57..9a36ef0df 100644
---- a/src/man/kdb5_util.man
-+++ b/src/man/kdb5_util.man
-@@ -1,6 +1,6 @@
- .\" Man page generated from reStructuredText.
- .
--.TH "KDB5_UTIL" "8" " " "1.17" "MIT Kerberos"
-+.TH "KDB5_UTIL" "8" " " "1.18" "MIT Kerberos"
- .SH NAME
- kdb5_util \- Kerberos database maintenance utility
- .
-@@ -136,7 +136,7 @@ kdc.conf(5)\&.
- .SS dump
- .INDENT 0.0
- .INDENT 3.5
--\fBdump\fP [\fB\-b7\fP|\fB\-ov\fP|\fB\-r13\fP|\fB\-r18\fP]
-+\fBdump\fP [\fB\-b7\fP|\fB\-r13\fP|\fB\-r18\fP]
- [\fB\-verbose\fP] [\fB\-mkey_convert\fP] [\fB\-new_mkey_file\fP
- \fImkey_file\fP] [\fB\-rev\fP] [\fB\-recurse\fP] [\fIfilename\fP
- [\fIprincipals\fP\&...]]
-@@ -154,9 +154,6 @@ causes the dump to be in the Kerberos 5 Beta 7 format ("kdb5_util
- load_dump version 4").  This was the dump format produced on
- releases prior to 1.2.2.
- .TP
--\fB\-ov\fP
--causes the dump to be in "ovsec_adm_export" format.
--.TP
- \fB\-r13\fP
- causes the dump to be in the Kerberos 5 1.3 format ("kdb5_util
- load_dump version 5").  This was the dump format produced on
-@@ -203,7 +200,7 @@ doing a normal dump instead of a recursive traversal.
- .SS load
- .INDENT 0.0
- .INDENT 3.5
--\fBload\fP [\fB\-b7\fP|\fB\-ov\fP|\fB\-r13\fP|\fB\-r18\fP] [\fB\-hash\fP]
-+\fBload\fP [\fB\-b7\fP|\fB\-r13\fP|\fB\-r18\fP] [\fB\-hash\fP]
- [\fB\-verbose\fP] [\fB\-update\fP] \fIfilename\fP
- .UNINDENT
- .UNINDENT
-@@ -224,10 +221,6 @@ requires the database to be in the Kerberos 5 Beta 7 format
- ("kdb5_util load_dump version 4").  This was the dump format
- produced on releases prior to 1.2.2.
- .TP
--\fB\-ov\fP
--requires the database to be in "ovsec_adm_import" format.  Must be
--used with the \fB\-update\fP option.
--.TP
- \fB\-r13\fP
- requires the database to be in Kerberos 5 1.3 format ("kdb5_util
- load_dump version 5").  This was the dump format produced on
-diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in
-index e27617ee2..c96c5d6b7 100644
---- a/src/tests/Makefile.in
-+++ b/src/tests/Makefile.in
-@@ -97,7 +97,6 @@ kdb_check: kdc.conf krb5.conf
- 	$(RUN_DB_TEST) ../tests/create/kdb5_mkdums $(KTEST_OPTS)
- 	$(RUN_DB_TEST) ../tests/verify/kdb5_verify $(KTEST_OPTS)
- 	$(RUN_DB_TEST) ../kadmin/dbutil/kdb5_util $(KADMIN_OPTS) dump $(TEST_DB).dump
--	$(RUN_DB_TEST) ../kadmin/dbutil/kdb5_util $(KADMIN_OPTS) dump -ov $(TEST_DB).ovdump
- 	$(RUN_DB_TEST) ../kadmin/dbutil/kdb5_util $(KADMIN_OPTS) destroy -f
- 	@echo "====> NOTE!"
- 	@echo "The following 'create' command is needed due to a change"
-@@ -105,16 +104,11 @@ kdb_check: kdc.conf krb5.conf
- 	@echo ====
- 	$(RUN_DB_TEST) ../kadmin/dbutil/kdb5_util $(KADMIN_OPTS) create -W
- 	$(RUN_DB_TEST) ../kadmin/dbutil/kdb5_util $(KADMIN_OPTS) load $(TEST_DB).dump
--	$(RUN_DB_TEST) ../kadmin/dbutil/kdb5_util $(KADMIN_OPTS) load -update -ov $(TEST_DB).ovdump
- 	$(RUN_DB_TEST) ../tests/verify/kdb5_verify $(KTEST_OPTS)
- 	$(RUN_DB_TEST) ../kadmin/dbutil/kdb5_util $(KADMIN_OPTS) dump $(TEST_DB).dump2
--	$(RUN_DB_TEST) ../kadmin/dbutil/kdb5_util $(KADMIN_OPTS) dump -ov $(TEST_DB).ovdump2
- 	sort $(TEST_DB).dump > $(TEST_DB).sort
- 	sort $(TEST_DB).dump2 > $(TEST_DB).sort2
--	sort $(TEST_DB).ovdump > $(TEST_DB).ovsort
--	sort $(TEST_DB).ovdump2 > $(TEST_DB).ovsort2
- 	cmp $(TEST_DB).sort $(TEST_DB).sort2
--	cmp $(TEST_DB).ovsort $(TEST_DB).ovsort2
- 	$(RUN_DB_TEST) ../kadmin/dbutil/kdb5_util $(KADMIN_OPTS) destroy -f
- 	$(RM) $(TEST_DB)* stash_file
- 
-diff --git a/src/tests/t_dump.py b/src/tests/t_dump.py
-index d803d5602..5d692df99 100755
---- a/src/tests/t_dump.py
-+++ b/src/tests/t_dump.py
-@@ -73,7 +73,6 @@ for realm in multidb_realms(start_kdc=False):
-     srcdump_r18 = os.path.join(srcdumpdir, 'dump.r18')
-     srcdump_r13 = os.path.join(srcdumpdir, 'dump.r13')
-     srcdump_b7 = os.path.join(srcdumpdir, 'dump.b7')
--    srcdump_ov = os.path.join(srcdumpdir, 'dump.ov')
- 
-     # Load a dump file from the source directory.
-     realm.run([kdb5_util, 'destroy', '-f'])
-@@ -86,17 +85,10 @@ for realm in multidb_realms(start_kdc=False):
-     dump_compare(realm, ['-r18'], srcdump_r18)
-     dump_compare(realm, ['-r13'], srcdump_r13)
-     dump_compare(realm, ['-b7'], srcdump_b7)
--    dump_compare(realm, ['-ov'], srcdump_ov)
- 
-     # Load each format of dump, check it, re-dump it, and compare.
-     load_dump_check_compare(realm, ['-r18'], srcdump_r18)
-     load_dump_check_compare(realm, ['-r13'], srcdump_r13)
-     load_dump_check_compare(realm, ['-b7'], srcdump_b7)
- 
--    # Loading the last (-b7 format) dump won't have loaded the
--    # per-principal kadm data.  Load that incrementally with -ov.
--    realm.run([kadminl, 'getprinc', 'user'], expected_msg='Policy: [none]')
--    realm.run([kdb5_util, 'load', '-update', '-ov', srcdump_ov])
--    realm.run([kadminl, 'getprinc', 'user'], expected_msg='Policy: testpol')
--
- success('Dump/load tests')
diff --git a/Remove-srvtab-support.patch b/Remove-srvtab-support.patch
deleted file mode 100644
index dbdf99f..0000000
--- a/Remove-srvtab-support.patch
+++ /dev/null
@@ -1,1410 +0,0 @@
-From c742a3eacc7b2dc92bf8dc83f5e8ea602dded8c2 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Mon, 9 Oct 2017 15:58:33 -0400
-Subject: [PATCH] Remove srvtab support
-
-Also change internal names from "srvtab" to "keytab" where the old
-name was used.
-
-ticket: 8793 (new)
-(cherry picked from commit a23e670b40f69b6be0024f8a60d2afaf7f7a005a)
----
- doc/admin/admin_commands/ktutil.rst           |  22 +-
- doc/basic/keytab_def.rst                      |   6 +-
- src/kadmin/ktutil/ktutil.c                    |  11 +-
- src/kadmin/ktutil/ktutil.h                    |   4 -
- src/kadmin/ktutil/ktutil_ct.ct                |   4 +-
- src/kadmin/ktutil/ktutil_funcs.c              |  19 -
- src/kadmin/testing/proto/krb5.conf.proto      |   2 +-
- src/kadmin/testing/scripts/env-setup.shin     |   2 +-
- src/kadmin/testing/scripts/init_db            |   2 +-
- .../testing/scripts/make-host-keytab.plin     |   2 +-
- .../testing/scripts/start_servers_local       |   3 -
- src/kprop/kprop.c                             |  10 +-
- src/kprop/kpropd.c                            |  12 +-
- src/lib/kadm5/unit-test/api.current/init.exp  |   4 +-
- src/lib/krb5/keytab/Makefile.in               |   3 -
- src/lib/krb5/keytab/deps                      |  11 -
- src/lib/krb5/keytab/kt_srvtab.c               | 435 ------------------
- src/lib/krb5/keytab/ktbase.c                  |   7 +-
- src/lib/krb5/krb/in_tkt_sky.c                 |   6 +-
- src/lib/krb5/libkrb5.exports                  |   1 -
- src/lib/rpc/unit-test/Makefile.in             |   6 +-
- src/lib/rpc/unit-test/config/unix.exp         |   2 +-
- src/lib/rpc/unit-test/lib/helpers.exp         |   4 +-
- src/lib/rpc/unit-test/rpc_test_setup.sh       |   6 +-
- src/man/ktutil.man                            |  26 +-
- src/tests/dejagnu/config/default.exp          |  58 ++-
- src/tests/dejagnu/krb-standalone/gssapi.exp   |   8 +-
- src/tests/dejagnu/krb-standalone/kadmin.exp   |  48 +-
- src/tests/dejagnu/krb-standalone/kprop.exp    |   6 +-
- src/tests/dejagnu/krb-standalone/sample.exp   |   8 +-
- src/tests/dejagnu/krb-standalone/simple.exp   |   6 +-
- .../dejagnu/krb-standalone/standalone.exp     |   4 +-
- src/tests/dejagnu/krb-standalone/tcp.exp      |   5 -
- 33 files changed, 86 insertions(+), 667 deletions(-)
- delete mode 100644 src/lib/krb5/keytab/kt_srvtab.c
-
-diff --git a/doc/admin/admin_commands/ktutil.rst b/doc/admin/admin_commands/ktutil.rst
-index 0dbc08f60..0897c7757 100644
---- a/doc/admin/admin_commands/ktutil.rst
-+++ b/doc/admin/admin_commands/ktutil.rst
-@@ -13,8 +13,8 @@ DESCRIPTION
- -----------
- 
- The ktutil command invokes a command interface from which an
--administrator can read, write, or edit entries in a keytab or Kerberos
--V4 srvtab file.
-+administrator can read, write, or edit entries in a keytab.  (Kerberos
-+V4 srvtab files are no longer supported.)
- 
- 
- COMMANDS
-@@ -38,15 +38,6 @@ Read the Kerberos V5 keytab file *keytab* into the current keylist.
- 
- Alias: **rkt**
- 
--read_st
--~~~~~~~
--
--    **read_st** *srvtab*
--
--Read the Kerberos V4 srvtab file *srvtab* into the current keylist.
--
--Alias: **rst**
--
- write_kt
- ~~~~~~~~
- 
-@@ -56,15 +47,6 @@ Write the current keylist into the Kerberos V5 keytab file *keytab*.
- 
- Alias: **wkt**
- 
--write_st
--~~~~~~~~
--
--    **write_st** *srvtab*
--
--Write the current keylist into the Kerberos V4 srvtab file *srvtab*.
--
--Alias: **wst**
--
- clear_list
- ~~~~~~~~~~
- 
-diff --git a/doc/basic/keytab_def.rst b/doc/basic/keytab_def.rst
-index 33ae67c6c..6c7fcc3b0 100644
---- a/doc/basic/keytab_def.rst
-+++ b/doc/basic/keytab_def.rst
-@@ -12,10 +12,8 @@ credentials for client applications.
- 
- Keytabs are named using the format *type*\ ``:``\ *value*.  Usually
- *type* is ``FILE`` and *value* is the absolute pathname of the file.
--Other possible values for *type* are ``SRVTAB``, which indicates a
--file in the deprecated Kerberos 4 srvtab format, and ``MEMORY``, which
--indicates a temporary keytab stored in the memory of the current
--process.
-+The other possible value for *type* is ``MEMORY``, which indicates a
-+temporary keytab stored in the memory of the current process.
- 
- A keytab contains one or more entries, where each entry consists of a
- timestamp (indicating when the entry was written to the keytab), a
-diff --git a/src/kadmin/ktutil/ktutil.c b/src/kadmin/ktutil/ktutil.c
-index 196f20786..92d7023a4 100644
---- a/src/kadmin/ktutil/ktutil.c
-+++ b/src/kadmin/ktutil/ktutil.c
-@@ -98,15 +98,8 @@ void ktutil_read_v4(argc, argv)
-     int argc;
-     char *argv[];
- {
--    krb5_error_code retval;
--
--    if (argc != 2) {
--        fprintf(stderr, _("%s: must specify the srvtab to read\n"), argv[0]);
--        return;
--    }
--    retval = ktutil_read_srvtab(kcontext, argv[1], &ktlist);
--    if (retval)
--        com_err(argv[0], retval, _("while reading srvtab \"%s\""), argv[1]);
-+    fprintf(stderr, _("%s: reading srvtabs is no longer supported\n"),
-+            argv[0]);
- }
- 
- void ktutil_write_v5(argc, argv)
-diff --git a/src/kadmin/ktutil/ktutil.h b/src/kadmin/ktutil/ktutil.h
-index ddb754bae..acaf0239a 100644
---- a/src/kadmin/ktutil/ktutil.h
-+++ b/src/kadmin/ktutil/ktutil.h
-@@ -50,10 +50,6 @@ krb5_error_code ktutil_write_keytab (krb5_context,
-                                      krb5_kt_list,
-                                      char *);
- 
--krb5_error_code ktutil_read_srvtab (krb5_context,
--                                    char *,
--                                    krb5_kt_list *);
--
- void ktutil_add_entry (int, char *[]);
- 
- void ktutil_clear_list (int, char *[]);
-diff --git a/src/kadmin/ktutil/ktutil_ct.ct b/src/kadmin/ktutil/ktutil_ct.ct
-index 0c7ccb689..2061ef9d0 100644
---- a/src/kadmin/ktutil/ktutil_ct.ct
-+++ b/src/kadmin/ktutil/ktutil_ct.ct
-@@ -32,13 +32,13 @@ request ktutil_clear_list, "Clear the current keylist.",
- request ktutil_read_v5, "Read a krb5 keytab into the current keylist.",
- 	read_kt, rkt;
- 
--request ktutil_read_v4, "Read a krb4 srvtab into the current keylist.",
-+request ktutil_read_v4, "Deprecated and removed.",
- 	read_st, rst;
- 
- request ktutil_write_v5, "Write the current keylist to a krb5 keytab.",
- 	write_kt, wkt;
- 
--request ktutil_write_v4, "Write the current keylist to a krb4 srvtab.",
-+request ktutil_write_v4, "Deprecated and removed.",
- 	write_st, wst;
- 
- request ktutil_add_entry, "Add an entry to the current keylist.",
-diff --git a/src/kadmin/ktutil/ktutil_funcs.c b/src/kadmin/ktutil/ktutil_funcs.c
-index 6d119a2b6..e2e005d22 100644
---- a/src/kadmin/ktutil/ktutil_funcs.c
-+++ b/src/kadmin/ktutil/ktutil_funcs.c
-@@ -368,22 +368,3 @@ krb5_error_code ktutil_write_keytab(context, list, name)
-     krb5_kt_close(context, kt);
-     return retval;
- }
--
--/*
-- * Read in a named krb4 srvtab and append to list.  Allocate new list
-- * if needed.
-- */
--krb5_error_code ktutil_read_srvtab(context, name, list)
--    krb5_context context;
--    char *name;
--    krb5_kt_list *list;
--{
--    char *ktname;
--    krb5_error_code result;
--
--    if (asprintf(&ktname, "SRVTAB:%s", name) < 0)
--        return ENOMEM;
--    result = ktutil_read_keytab(context, ktname, list);
--    free(ktname);
--    return result;
--}
-diff --git a/src/kadmin/testing/proto/krb5.conf.proto b/src/kadmin/testing/proto/krb5.conf.proto
-index 9c4bc1de7..f91cf70f3 100644
---- a/src/kadmin/testing/proto/krb5.conf.proto
-+++ b/src/kadmin/testing/proto/krb5.conf.proto
-@@ -1,6 +1,6 @@
- [libdefaults]
- 	default_realm = __REALM__
--	default_keytab_name = FILE:__K5ROOT__/v5srvtab
-+	default_keytab_name = FILE:__K5ROOT__/keytab
- 	dns_fallback = no
- 	plugin_base_dir = __PLUGIN_DIR__
- 	allow_weak_crypto = true
-diff --git a/src/kadmin/testing/scripts/env-setup.shin b/src/kadmin/testing/scripts/env-setup.shin
-index c8d866f15..726298351 100755
---- a/src/kadmin/testing/scripts/env-setup.shin
-+++ b/src/kadmin/testing/scripts/env-setup.shin
-@@ -77,7 +77,7 @@ SRVTCL=$TESTDIR/util/kadm5_srv_tcl; export SRVTCL
- 
- KRB5_CONFIG=$K5ROOT/krb5.conf; export KRB5_CONFIG
- KRB5_KDC_PROFILE=$K5ROOT/kdc.conf; export KRB5_KDC_PROFILE
--KRB5_KTNAME=$K5ROOT/ovsec_adm.srvtab; export KRB5_KTNAME
-+KRB5_KTNAME=$K5ROOT/ovsec_adm.keytab; export KRB5_KTNAME
- KRB5_CLIENT_KTNAME=$K5ROOT/client_keytab; export KRB5_CLIENT_KTNAME
- KRB5CCNAME=$K5ROOT/krb5cc_unit-test; export KRB5CCNAME
- 
-diff --git a/src/kadmin/testing/scripts/init_db b/src/kadmin/testing/scripts/init_db
-index cd7165628..bf119f2ac 100755
---- a/src/kadmin/testing/scripts/init_db
-+++ b/src/kadmin/testing/scripts/init_db
-@@ -218,7 +218,7 @@ changepw/kerberos@$REALM	cil
- 
- EOF
- 
--eval $LOCAL_MAKE_KEYTAB -princ kadmin/admin -princ kadmin/changepw -princ ovsec_adm/admin -princ ovsec_adm/changepw $K5ROOT/ovsec_adm.srvtab $REDIRECT
-+eval $LOCAL_MAKE_KEYTAB -princ kadmin/admin -princ kadmin/changepw -princ ovsec_adm/admin -princ ovsec_adm/changepw $K5ROOT/ovsec_adm.keytab $REDIRECT
- 
- # Create $K5ROOT/setup.csh to make it easy to run other programs against
- # the test db
-diff --git a/src/kadmin/testing/scripts/make-host-keytab.plin b/src/kadmin/testing/scripts/make-host-keytab.plin
-index dfe0b3a01..c77d61c70 100755
---- a/src/kadmin/testing/scripts/make-host-keytab.plin
-+++ b/src/kadmin/testing/scripts/make-host-keytab.plin
-@@ -11,7 +11,7 @@ $usage = "Usage: $whoami [ -server server ] [ -princ principal ]
- 	Default principals are host/hostname\@SECURE-TEST.OV.COM and
- 	  test/hostname\@SECURE-TEST.OV.COM.
- 	If any principals are specified, the default principals are
--	  not added to the srvtab.
-+	  not added to the keytab.
- 	The string \"xCANONHOSTx\" in a principal specification will be
- 	  replaced by the canonical host name of the local host.";
- 
-diff --git a/src/kadmin/testing/scripts/start_servers_local b/src/kadmin/testing/scripts/start_servers_local
-index 0cbed462d..809892974 100755
---- a/src/kadmin/testing/scripts/start_servers_local
-+++ b/src/kadmin/testing/scripts/start_servers_local
-@@ -98,9 +98,6 @@ x=$?
- rm /tmp/start_servers_local$$
- if test $x != 0 ; then exit 1 ; fi
- 
--# rm -f /etc/v5srvtab
--# eval $LOCAL_MAKE_KEYTAB -princ host/xCANONHOSTx /etc/v5srvtab $REDIRECT
--
- # run the servers (from the build tree)
- 
- adm_start_file=/tmp/adm_server_start.$$
-diff --git a/src/kprop/kprop.c b/src/kprop/kprop.c
-index b7fb63777..0b53aae7e 100644
---- a/src/kprop/kprop.c
-+++ b/src/kprop/kprop.c
-@@ -49,7 +49,7 @@ static char *kprop_version = KPROP_PROT_VERSION;
- 
- static char *progname = NULL;
- static int debug = 0;
--static char *srvtab = NULL;
-+static char *keytab_path = NULL;
- static char *replica_host;
- static char *realm = NULL;
- static char *def_realm = NULL;
-@@ -83,7 +83,7 @@ static void update_last_prop_file(char *hostname, char *file_name);
- static void usage()
- {
-     fprintf(stderr, _("\nUsage: %s [-r realm] [-f file] [-d] [-P port] "
--                      "[-s srvtab] replica_host\n\n"), progname);
-+                      "[-s keytab] replica_host\n\n"), progname);
-     exit(1);
- }
- 
-@@ -140,7 +140,7 @@ parse_args(krb5_context context, int argc, char **argv)
-             port = optarg;
-             break;
-         case 's':
--            srvtab = optarg;
-+            keytab_path = optarg;
-             break;
-         default:
-             usage();
-@@ -191,8 +191,8 @@ get_tickets(krb5_context context)
-         exit(1);
-     }
- 
--    if (srvtab != NULL) {
--        retval = krb5_kt_resolve(context, srvtab, &keytab);
-+    if (keytab_path != NULL) {
-+        retval = krb5_kt_resolve(context, keytab_path, &keytab);
-         if (retval) {
-             com_err(progname, retval, _("while resolving keytab"));
-             exit(1);
-diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c
-index 0c7bffa24..e4aaf553c 100644
---- a/src/kprop/kpropd.c
-+++ b/src/kprop/kpropd.c
-@@ -117,7 +117,7 @@ static kadm5_config_params params;
- static char *progname;
- static int debug = 0;
- static int nodaemon = 0;
--static char *srvtab = NULL;
-+static char *keytab_path = NULL;
- static int standalone = 0;
- static const char *pid_file = NULL;
- 
-@@ -168,7 +168,7 @@ static void
- usage()
- {
-     fprintf(stderr,
--            _("\nUsage: %s [-r realm] [-s srvtab] [-dS] [-f replica_file]\n"),
-+            _("\nUsage: %s [-r realm] [-s keytab] [-dS] [-f replica_file]\n"),
-             progname);
-     fprintf(stderr, _("\t[-F kerberos_db_file ] [-p kdb5_util_pathname]\n"));
-     fprintf(stderr, _("\t[-x db_args]* [-P port] [-a acl_file]\n"));
-@@ -701,7 +701,7 @@ reinit:
-                 iprop_svc_princstr);
-     }
-     retval = kadm5_init_with_skey(kpropd_context, iprop_svc_princstr,
--                                  srvtab,
-+                                  keytab_path,
-                                   master_svc_princstr,
-                                   &params,
-                                   KADM5_STRUCT_VERSION,
-@@ -1092,7 +1092,7 @@ parse_args(int argc, char **argv)
-             realm = optarg;
-             break;
-         case 's':
--            srvtab = optarg;
-+            keytab_path = optarg;
-             break;
-         case 'D':
-             nodaemon++;
-@@ -1246,8 +1246,8 @@ kerberos_authenticate(krb5_context context, int fd, krb5_principal *clientp,
-         exit(1);
-     }
- 
--    if (srvtab != NULL) {
--        retval = krb5_kt_resolve(context, srvtab, &keytab);
-+    if (keytab_path != NULL) {
-+        retval = krb5_kt_resolve(context, keytab_path, &keytab);
-         if (retval) {
-             syslog(LOG_ERR, _("Error in krb5_kt_resolve: %s"),
-                    error_message(retval));
-diff --git a/src/lib/kadm5/unit-test/api.current/init.exp b/src/lib/kadm5/unit-test/api.current/init.exp
-index d9ae3fbd8..f78261376 100644
---- a/src/lib/kadm5/unit-test/api.current/init.exp
-+++ b/src/lib/kadm5/unit-test/api.current/init.exp
-@@ -695,10 +695,10 @@ if {$RPC} {
-     test45_46 ovsec_adm/changepw
- 
-     # re-extract the keytab so it is right
--    exec rm $env(K5ROOT)/ovsec_adm.srvtab
-+    exec rm $env(K5ROOT)/ovsec_adm.keytab
-     exec $env(MAKE_KEYTAB) -princ ovsec_adm/admin -princ ovsec_adm/changepw \
- 	    -princ kadmin/admin -princ kadmin/changepw \
--	    $env(K5ROOT)/ovsec_adm.srvtab
-+	    $env(K5ROOT)/ovsec_adm.keytab
- }
- 
- return ""
-diff --git a/src/lib/krb5/keytab/Makefile.in b/src/lib/krb5/keytab/Makefile.in
-index 2a8fceb00..4621bf714 100644
---- a/src/lib/krb5/keytab/Makefile.in
-+++ b/src/lib/krb5/keytab/Makefile.in
-@@ -14,7 +14,6 @@ STLIBOBJS= \
- 	ktfns.o		\
- 	kt_file.o	\
- 	kt_memory.o	\
--	kt_srvtab.o	\
- 	read_servi.o
- 
- OBJS=	\
-@@ -26,7 +25,6 @@ OBJS=	\
- 	$(OUTPRE)ktfns.$(OBJEXT)	\
- 	$(OUTPRE)kt_file.$(OBJEXT)	\
- 	$(OUTPRE)kt_memory.$(OBJEXT)	\
--	$(OUTPRE)kt_srvtab.$(OBJEXT)	\
- 	$(OUTPRE)read_servi.$(OBJEXT)
- 
- SRCS=	\
-@@ -38,7 +36,6 @@ SRCS=	\
- 	$(srcdir)/ktfns.c	\
- 	$(srcdir)/kt_file.c	\
- 	$(srcdir)/kt_memory.c	\
--	$(srcdir)/kt_srvtab.c	\
- 	$(srcdir)/read_servi.c
- 
- EXTRADEPSRCS= \
-diff --git a/src/lib/krb5/keytab/deps b/src/lib/krb5/keytab/deps
-index 4c98188ca..522cad0e8 100644
---- a/src/lib/krb5/keytab/deps
-+++ b/src/lib/krb5/keytab/deps
-@@ -87,17 +87,6 @@ kt_memory.so kt_memory.po $(OUTPRE)kt_memory.$(OBJEXT): \
-   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-   kt-int.h kt_memory.c
--kt_srvtab.so kt_srvtab.po $(OUTPRE)kt_srvtab.$(OBJEXT): \
--  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
--  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  kt_srvtab.c
- read_servi.so read_servi.po $(OUTPRE)read_servi.$(OBJEXT): \
-   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-diff --git a/src/lib/krb5/keytab/kt_srvtab.c b/src/lib/krb5/keytab/kt_srvtab.c
-deleted file mode 100644
-index bbfaadfc2..000000000
---- a/src/lib/krb5/keytab/kt_srvtab.c
-+++ /dev/null
-@@ -1,435 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/* lib/krb5/keytab/kt_srvtab.c */
--/*
-- * Copyright 1990,1991,2002,2007,2008 by the Massachusetts Institute of Technology.
-- * All Rights Reserved.
-- *
-- * Export of this software from the United States of America may
-- *   require a specific license from the United States Government.
-- *   It is the responsibility of any person or organization contemplating
-- *   export to obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of M.I.T. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  Furthermore if you modify this software you must label
-- * your software as modified software and not distribute it in such a
-- * fashion that it might be confused with the original M.I.T. software.
-- * M.I.T. makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- */
--/*
-- * Copyright (c) Hewlett-Packard Company 1991
-- * Released to the Massachusetts Institute of Technology for inclusion
-- * in the Kerberos source code distribution.
-- *
-- * Copyright 1990,1991 by the Massachusetts Institute of Technology.
-- * All Rights Reserved.
-- *
-- * Export of this software from the United States of America may
-- *   require a specific license from the United States Government.
-- *   It is the responsibility of any person or organization contemplating
-- *   export to obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of M.I.T. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  Furthermore if you modify this software you must label
-- * your software as modified software and not distribute it in such a
-- * fashion that it might be confused with the original M.I.T. software.
-- * M.I.T. makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- */
--
--#include "k5-int.h"
--#include <stdio.h>
--
--#ifndef LEAN_CLIENT
--
--/*
-- * Constants
-- */
--
--#define KRB5_KT_VNO_1   0x0501  /* krb v5, keytab version 1 (DCE compat) */
--#define KRB5_KT_VNO     0x0502  /* krb v5, keytab version 2 (standard)  */
--
--#define KRB5_KT_DEFAULT_VNO KRB5_KT_VNO
--
--/*
-- * Types
-- */
--typedef struct _krb5_ktsrvtab_data {
--    char *name;                 /* Name of the file */
--    FILE *openf;                /* open file, if any. */
--} krb5_ktsrvtab_data;
--
--/*
-- * Macros
-- */
--#define KTPRIVATE(id) ((krb5_ktsrvtab_data *)(id)->data)
--#define KTFILENAME(id) (((krb5_ktsrvtab_data *)(id)->data)->name)
--#define KTFILEP(id) (((krb5_ktsrvtab_data *)(id)->data)->openf)
--
--extern const struct _krb5_kt_ops krb5_kts_ops;
--
--static krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_resolve(krb5_context, const char *, krb5_keytab *);
--
--static krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_get_name(krb5_context, krb5_keytab, char *, unsigned int);
--
--static krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_close(krb5_context, krb5_keytab);
--
--static krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_get_entry(krb5_context, krb5_keytab, krb5_const_principal,
--                        krb5_kvno, krb5_enctype, krb5_keytab_entry *);
--
--static krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_start_seq_get(krb5_context, krb5_keytab, krb5_kt_cursor *);
--
--static krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_get_next(krb5_context, krb5_keytab, krb5_keytab_entry *,
--                       krb5_kt_cursor *);
--
--static krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_end_get(krb5_context, krb5_keytab, krb5_kt_cursor *);
--
--static krb5_error_code
--krb5_ktsrvint_open(krb5_context, krb5_keytab);
--
--static krb5_error_code
--krb5_ktsrvint_close(krb5_context, krb5_keytab);
--
--static krb5_error_code
--krb5_ktsrvint_read_entry(krb5_context, krb5_keytab, krb5_keytab_entry *);
--
--/*
-- * This is an implementation specific resolver.  It returns a keytab id
-- * initialized with srvtab keytab routines.
-- */
--
--static krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_resolve(krb5_context context, const char *name, krb5_keytab *id)
--{
--    krb5_ktsrvtab_data *data;
--
--    if ((*id = (krb5_keytab) malloc(sizeof(**id))) == NULL)
--        return(ENOMEM);
--
--    (*id)->ops = &krb5_kts_ops;
--    data = (krb5_ktsrvtab_data *)malloc(sizeof(krb5_ktsrvtab_data));
--    if (data == NULL) {
--        free(*id);
--        return(ENOMEM);
--    }
--
--    data->name = strdup(name);
--    if (data->name == NULL) {
--        free(data);
--        free(*id);
--        return(ENOMEM);
--    }
--
--    data->openf = 0;
--
--    (*id)->data = (krb5_pointer)data;
--    (*id)->magic = KV5M_KEYTAB;
--    return(0);
--}
--
--/*
-- * "Close" a file-based keytab and invalidate the id.  This means
-- * free memory hidden in the structures.
-- */
--
--krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_close(krb5_context context, krb5_keytab id)
--/*
-- * This routine is responsible for freeing all memory allocated
-- * for this keytab.  There are no system resources that need
-- * to be freed nor are there any open files.
-- *
-- * This routine should undo anything done by krb5_ktsrvtab_resolve().
-- */
--{
--    free(KTFILENAME(id));
--    free(id->data);
--    id->ops = 0;
--    free(id);
--    return (0);
--}
--
--/*
-- * This is the get_entry routine for the file based keytab implementation.
-- * It opens the keytab file, and either retrieves the entry or returns
-- * an error.
-- */
--
--krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_get_entry(krb5_context context, krb5_keytab id, krb5_const_principal principal, krb5_kvno kvno, krb5_enctype enctype, krb5_keytab_entry *entry)
--{
--    krb5_keytab_entry best_entry, ent;
--    krb5_error_code kerror = 0;
--    int found_wrong_kvno = 0;
--
--    /* Open the srvtab. */
--    if ((kerror = krb5_ktsrvint_open(context, id)))
--        return(kerror);
--
--    /* srvtab files only have DES_CBC_CRC keys. */
--    switch (enctype) {
--    case ENCTYPE_DES_CBC_CRC:
--    case ENCTYPE_DES_CBC_MD5:
--    case ENCTYPE_DES_CBC_MD4:
--    case ENCTYPE_DES_CBC_RAW:
--    case IGNORE_ENCTYPE:
--        break;
--    default:
--        return KRB5_KT_NOTFOUND;
--    }
--
--    best_entry.principal = 0;
--    best_entry.vno = 0;
--    best_entry.key.contents = 0;
--    while ((kerror = krb5_ktsrvint_read_entry(context, id, &ent)) == 0) {
--        ent.key.enctype = enctype;
--        if (krb5_principal_compare(context, principal, ent.principal)) {
--            if (kvno == IGNORE_VNO || ent.vno == IGNORE_VNO) {
--                if (!best_entry.principal || (best_entry.vno < ent.vno)) {
--                    krb5_kt_free_entry(context, &best_entry);
--                    best_entry = ent;
--                }
--            } else {
--                if (ent.vno == kvno) {
--                    best_entry = ent;
--                    break;
--                } else {
--                    found_wrong_kvno = 1;
--                }
--            }
--        } else {
--            krb5_kt_free_entry(context, &ent);
--        }
--    }
--    if (kerror == KRB5_KT_END) {
--        if (best_entry.principal)
--            kerror = 0;
--        else if (found_wrong_kvno)
--            kerror = KRB5_KT_KVNONOTFOUND;
--        else
--            kerror = KRB5_KT_NOTFOUND;
--    }
--    if (kerror) {
--        (void) krb5_ktsrvint_close(context, id);
--        krb5_kt_free_entry(context, &best_entry);
--        return kerror;
--    }
--    if ((kerror = krb5_ktsrvint_close(context, id)) != 0) {
--        krb5_kt_free_entry(context, &best_entry);
--        return kerror;
--    }
--    *entry = best_entry;
--    return 0;
--}
--
--/*
-- * Get the name of the file containing a srvtab-based keytab.
-- */
--
--krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_get_name(krb5_context context, krb5_keytab id, char *name, unsigned int len)
--/*
-- * This routine returns the name of the name of the file associated with
-- * this srvtab-based keytab.  The name is prefixed with PREFIX:, so that
-- * trt will happen if the name is passed back to resolve.
-- */
--{
--    int result;
--
--    memset(name, 0, len);
--    result = snprintf(name, len, "%s:%s", id->ops->prefix, KTFILENAME(id));
--    if (SNPRINTF_OVERFLOW(result, len))
--        return(KRB5_KT_NAME_TOOLONG);
--    return(0);
--}
--
--/*
-- * krb5_ktsrvtab_start_seq_get()
-- */
--
--krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_start_seq_get(krb5_context context, krb5_keytab id, krb5_kt_cursor *cursorp)
--{
--    krb5_error_code retval;
--    long *fileoff;
--
--    if ((retval = krb5_ktsrvint_open(context, id)))
--        return retval;
--
--    if (!(fileoff = (long *)malloc(sizeof(*fileoff)))) {
--        krb5_ktsrvint_close(context, id);
--        return ENOMEM;
--    }
--    *fileoff = ftell(KTFILEP(id));
--    *cursorp = (krb5_kt_cursor)fileoff;
--
--    return 0;
--}
--
--/*
-- * krb5_ktsrvtab_get_next()
-- */
--
--krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_get_next(krb5_context context, krb5_keytab id, krb5_keytab_entry *entry, krb5_kt_cursor *cursor)
--{
--    long *fileoff = (long *)*cursor;
--    krb5_keytab_entry cur_entry;
--    krb5_error_code kerror;
--
--    if (fseek(KTFILEP(id), *fileoff, 0) == -1)
--        return KRB5_KT_END;
--    if ((kerror = krb5_ktsrvint_read_entry(context, id, &cur_entry)))
--        return kerror;
--    *fileoff = ftell(KTFILEP(id));
--    *entry = cur_entry;
--    return 0;
--}
--
--/*
-- * krb5_ktsrvtab_end_get()
-- */
--
--krb5_error_code KRB5_CALLCONV
--krb5_ktsrvtab_end_get(krb5_context context, krb5_keytab id, krb5_kt_cursor *cursor)
--{
--    free(*cursor);
--    return krb5_ktsrvint_close(context, id);
--}
--
--/*
-- * krb5_kts_ops
-- */
--
--const struct _krb5_kt_ops krb5_kts_ops = {
--    0,
--    "SRVTAB",   /* Prefix -- this string should not appear anywhere else! */
--    krb5_ktsrvtab_resolve,
--    krb5_ktsrvtab_get_name,
--    krb5_ktsrvtab_close,
--    krb5_ktsrvtab_get_entry,
--    krb5_ktsrvtab_start_seq_get,
--    krb5_ktsrvtab_get_next,
--    krb5_ktsrvtab_end_get,
--    0,
--    0,
--    0
--};
--
--/* formerly: lib/krb5/keytab/srvtab/kts_util.c */
--
--#include <stdio.h>
--
--/* The maximum sizes for V4 aname, realm, sname, and instance +1 */
--/* Taken from krb.h */
--#define         ANAME_SZ        40
--#define         REALM_SZ        40
--#define         SNAME_SZ        40
--#define         INST_SZ         40
--
--static krb5_error_code
--read_field(FILE *fp, char *s, int len)
--{
--    int c;
--
--    while ((c = getc(fp)) != 0) {
--        if (c == EOF || len <= 1)
--            return KRB5_KT_END;
--        *s = c;
--        s++;
--        len--;
--    }
--    *s = 0;
--    return 0;
--}
--
--krb5_error_code
--krb5_ktsrvint_open(krb5_context context, krb5_keytab id)
--{
--    KTFILEP(id) = fopen(KTFILENAME(id), "rb");
--    if (!KTFILEP(id))
--        return errno;
--    set_cloexec_file(KTFILEP(id));
--    return 0;
--}
--
--krb5_error_code
--krb5_ktsrvint_close(krb5_context context, krb5_keytab id)
--{
--    if (!KTFILEP(id))
--        return 0;
--    (void) fclose(KTFILEP(id));
--    KTFILEP(id) = 0;
--    return 0;
--}
--
--krb5_error_code
--krb5_ktsrvint_read_entry(krb5_context context, krb5_keytab id, krb5_keytab_entry *ret_entry)
--{
--    FILE *fp;
--    char name[SNAME_SZ], instance[INST_SZ], realm[REALM_SZ];
--    unsigned char key[8];
--    int vno;
--    krb5_error_code kerror;
--
--    /* Read in an entry from the srvtab file. */
--    fp = KTFILEP(id);
--    kerror = read_field(fp, name, sizeof(name));
--    if (kerror != 0)
--        return kerror;
--    kerror = read_field(fp, instance, sizeof(instance));
--    if (kerror != 0)
--        return kerror;
--    kerror = read_field(fp, realm, sizeof(realm));
--    if (kerror != 0)
--        return kerror;
--    vno = getc(fp);
--    if (vno == EOF)
--        return KRB5_KT_END;
--    if (fread(key, 1, sizeof(key), fp) != sizeof(key))
--        return KRB5_KT_END;
--
--    /* Fill in ret_entry with the data we read.  Everything maps well
--     * except for the timestamp, which we don't have a value for.  For
--     * now we just set it to 0. */
--    memset(ret_entry, 0, sizeof(*ret_entry));
--    ret_entry->magic = KV5M_KEYTAB_ENTRY;
--    kerror = krb5_425_conv_principal(context, name, instance, realm,
--                                     &ret_entry->principal);
--    if (kerror != 0)
--        return kerror;
--    ret_entry->vno = vno;
--    ret_entry->timestamp = 0;
--    ret_entry->key.enctype = ENCTYPE_DES_CBC_CRC;
--    ret_entry->key.magic = KV5M_KEYBLOCK;
--    ret_entry->key.length = sizeof(key);
--    ret_entry->key.contents = k5memdup(key, sizeof(key), &kerror);
--    if (ret_entry->key.contents == NULL) {
--        krb5_free_principal(context, ret_entry->principal);
--        return kerror;
--    }
--
--    return 0;
--}
--#endif /* LEAN_CLIENT */
-diff --git a/src/lib/krb5/keytab/ktbase.c b/src/lib/krb5/keytab/ktbase.c
-index 0d39b2940..25752245a 100644
---- a/src/lib/krb5/keytab/ktbase.c
-+++ b/src/lib/krb5/keytab/ktbase.c
-@@ -55,20 +55,15 @@
- 
- extern const krb5_kt_ops krb5_ktf_ops;
- extern const krb5_kt_ops krb5_ktf_writable_ops;
--extern const krb5_kt_ops krb5_kts_ops;
- extern const krb5_kt_ops krb5_mkt_ops;
- 
- struct krb5_kt_typelist {
-     const krb5_kt_ops *ops;
-     const struct krb5_kt_typelist *next;
- };
--const static struct krb5_kt_typelist krb5_kt_typelist_srvtab = {
--    &krb5_kts_ops,
--    NULL
--};
- const static struct krb5_kt_typelist krb5_kt_typelist_memory = {
-     &krb5_mkt_ops,
--    &krb5_kt_typelist_srvtab
-+    NULL
- };
- const static struct krb5_kt_typelist krb5_kt_typelist_wrfile  = {
-     &krb5_ktf_writable_ops,
-diff --git a/src/lib/krb5/krb/in_tkt_sky.c b/src/lib/krb5/krb/in_tkt_sky.c
-index 7a8922623..342fe18dc 100644
---- a/src/lib/krb5/krb/in_tkt_sky.c
-+++ b/src/lib/krb5/krb/in_tkt_sky.c
-@@ -56,9 +56,9 @@ get_as_key_skey(krb5_context context, krb5_principal client,
-   If addrs is non-NULL, it is used for the addresses requested.  If it is
-   null, the system standard addresses are used.
- 
--  If keyblock is NULL, an appropriate key for creds->client is retrieved
--  from the system key store (e.g. /etc/srvtab).  If keyblock is non-NULL,
--  it is used as the decryption key.
-+  If keyblock is NULL, an appropriate key for creds->client is retrieved from
-+  the system key store (e.g. /etc/krb5.keytab).  If keyblock is non-NULL, it
-+  is used as the decryption key.
- 
-   A succesful call will place the ticket in the credentials cache ccache.
- 
-diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports
-index dfdb72daf..038e4de4b 100644
---- a/src/lib/krb5/libkrb5.exports
-+++ b/src/lib/krb5/libkrb5.exports
-@@ -459,7 +459,6 @@ krb5_kt_resolve
- krb5_kt_start_seq_get
- krb5_ktf_ops
- krb5_ktf_writable_ops
--krb5_kts_ops
- krb5_kuserok
- krb5_lock_file
- krb5_make_authdata_kdc_issued
-diff --git a/src/lib/rpc/unit-test/Makefile.in b/src/lib/rpc/unit-test/Makefile.in
-index 6f29e33c9..46f2f1d4b 100644
---- a/src/lib/rpc/unit-test/Makefile.in
-+++ b/src/lib/rpc/unit-test/Makefile.in
-@@ -45,8 +45,8 @@ PASS=@PASS@
- unit-test-body:
- 	$(RM) krb5cc_rpc_test_*
- 	$(ENV_SETUP) $(VALGRIND) $(START_SERVERS)
--	RPC_TEST_SRVTAB=/tmp/rpc_test_v5srvtab.$$$$ ; export RPC_TEST_SRVTAB ; \
--	trap "echo Failed, cleaning up... ; rm -f $$RPC_TEST_SRVTAB ; $(ENV_SETUP) $(STOP_SERVERS) ; trap '' 0 ; exit 1" 0 1 2 3 14 15 ; \
-+	RPC_TEST_KEYTAB=/tmp/rpc_test_keytab.$$$$ ; export RPC_TEST_KEYTAB ; \
-+	trap "echo Failed, cleaning up... ; rm -f $$RPC_TEST_KEYTAB ; $(ENV_SETUP) $(STOP_SERVERS) ; trap '' 0 ; exit 1" 0 1 2 3 14 15 ; \
- 	if $(ENV_SETUP) \
- 		$(RUNTEST) SERVER=./server CLIENT=./client \
- 		KINIT=$(BUILDTOP)/clients/kinit/kinit \
-@@ -55,7 +55,7 @@ unit-test-body:
- 		PASS="$(PASS)" --tool rpc_test $(RUNTESTFLAGS) ; \
- 	then \
- 		echo Cleaning up... ; \
--		rm -f $$RPC_TEST_SRVTAB krb5cc_rpc_test_* ; \
-+		rm -f $$RPC_TEST_KEYTAB krb5cc_rpc_test_* ; \
- 		$(ENV_SETUP) $(STOP_SERVERS) ; \
- 		trap 0 ; exit 0 ; \
- 	else exit 1 ; fi
-diff --git a/src/lib/rpc/unit-test/config/unix.exp b/src/lib/rpc/unit-test/config/unix.exp
-index ba57b703e..ed179bbe3 100644
---- a/src/lib/rpc/unit-test/config/unix.exp
-+++ b/src/lib/rpc/unit-test/config/unix.exp
-@@ -139,7 +139,7 @@ proc rpc_test_start { } {
- 
- 	if [info exists server_pid] { rpc_test_exit }
- 
--	set env(KRB5_KTNAME) FILE:$env(RPC_TEST_SRVTAB)
-+	set env(KRB5_KTNAME) FILE:$env(RPC_TEST_KEYTAB)
- 
-  	verbose "% $SERVER" 1
- 	set server_pid [spawn $SERVER $PROT]
-diff --git a/src/lib/rpc/unit-test/lib/helpers.exp b/src/lib/rpc/unit-test/lib/helpers.exp
-index a1b078374..6ba2b10ae 100644
---- a/src/lib/rpc/unit-test/lib/helpers.exp
-+++ b/src/lib/rpc/unit-test/lib/helpers.exp
-@@ -121,8 +121,8 @@ proc setup_database {} {
- if ![info exists CANON_HOST] {
-     set CANON_HOST [exec $env(QUALNAME)]
-     setup_database
--    file delete $env(RPC_TEST_SRVTAB)
--    exec $env(MAKE_KEYTAB) -princ "server/$CANON_HOST" $env(RPC_TEST_SRVTAB)
-+    file delete $env(RPC_TEST_KEYTAB)
-+    exec $env(MAKE_KEYTAB) -princ "server/$CANON_HOST" $env(RPC_TEST_KEYTAB)
- }
- 
- 
-diff --git a/src/lib/rpc/unit-test/rpc_test_setup.sh b/src/lib/rpc/unit-test/rpc_test_setup.sh
-index 968f52a67..b610f87ef 100755
---- a/src/lib/rpc/unit-test/rpc_test_setup.sh
-+++ b/src/lib/rpc/unit-test/rpc_test_setup.sh
-@@ -1,7 +1,7 @@
- #!/bin/sh
- #
- # This script performs additional setup for the RPC unit test.  It
--# assumes that gmake has put TOP and RPC_TEST_SRVTAB into the
-+# assumes that gmake has put TOP and RPC_TEST_KEYTAB into the
- # environment. 
- #
- # $Id$
-@@ -42,9 +42,9 @@ if test $? != 0 ; then
- fi
- rm /tmp/rpc_test_setup$$
- 
--rm -f $RPC_TEST_SRVTAB
-+rm -f $RPC_TEST_KEYTAB
- 
--eval $MAKE_KEYTAB -princ server/$CANON_HOST $RPC_TEST_SRVTAB $REDIRECT
-+eval $MAKE_KEYTAB -princ server/$CANON_HOST $RPC_TEST_KEYTAB $REDIRECT
- 
- # grep -s "$CANON_HOST SECURE-TEST.OV.COM" /etc/krb.realms
- # if [ $? != 0 ]; then
-diff --git a/src/man/ktutil.man b/src/man/ktutil.man
-index 4e174c0fe..233329468 100644
---- a/src/man/ktutil.man
-+++ b/src/man/ktutil.man
-@@ -1,6 +1,6 @@
- .\" Man page generated from reStructuredText.
- .
--.TH "KTUTIL" "1" " " "1.17" "MIT Kerberos"
-+.TH "KTUTIL" "1" " " "1.18" "MIT Kerberos"
- .SH NAME
- ktutil \- Kerberos keytab file maintenance utility
- .
-@@ -36,8 +36,8 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
- .SH DESCRIPTION
- .sp
- The ktutil command invokes a command interface from which an
--administrator can read, write, or edit entries in a keytab or Kerberos
--V4 srvtab file.
-+administrator can read, write, or edit entries in a keytab.  (Kerberos
-+V4 srvtab files are no longer supported.)
- .SH COMMANDS
- .SS list
- .INDENT 0.0
-@@ -59,16 +59,6 @@ Alias: \fBl\fP
- Read the Kerberos V5 keytab file \fIkeytab\fP into the current keylist.
- .sp
- Alias: \fBrkt\fP
--.SS read_st
--.INDENT 0.0
--.INDENT 3.5
--\fBread_st\fP \fIsrvtab\fP
--.UNINDENT
--.UNINDENT
--.sp
--Read the Kerberos V4 srvtab file \fIsrvtab\fP into the current keylist.
--.sp
--Alias: \fBrst\fP
- .SS write_kt
- .INDENT 0.0
- .INDENT 3.5
-@@ -79,16 +69,6 @@ Alias: \fBrst\fP
- Write the current keylist into the Kerberos V5 keytab file \fIkeytab\fP\&.
- .sp
- Alias: \fBwkt\fP
--.SS write_st
--.INDENT 0.0
--.INDENT 3.5
--\fBwrite_st\fP \fIsrvtab\fP
--.UNINDENT
--.UNINDENT
--.sp
--Write the current keylist into the Kerberos V4 srvtab file \fIsrvtab\fP\&.
--.sp
--Alias: \fBwst\fP
- .SS clear_list
- .INDENT 0.0
- .INDENT 3.5
-diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp
-index d7b296516..ea9bedd45 100644
---- a/src/tests/dejagnu/config/default.exp
-+++ b/src/tests/dejagnu/config/default.exp
-@@ -440,8 +440,8 @@ proc delete_db {} {
- 	$tmppwd/kdc-db.ulog \
- 	$tmppwd/replica-db $tmppwd/replica-db.ok $tmppwd/replica-db.kadm5 $tmppwd/replica-db.kadm5.lock \
- 	$tmppwd/replica-db~ $tmppwd/replica-db~.ok $tmppwd/replica-db~.kadm5 $tmppwd/replica-db~.kadm5.lock
--    # Creating a new database means we need a new srvtab.
--    file delete $tmppwd/srvtab $tmppwd/cpw_srvtab
-+    # Creating a new database means we need a new keytab.
-+    file delete $tmppwd/keytab $tmppwd/cpw_keytab
- }
- 
- delete_db
-@@ -1510,11 +1510,9 @@ proc start_kpropd {} {
- 
-     envstack_push
-     setup_kerberos_env replica
--    spawn $KPROPD -S -d -t -P [expr 10 + $portbase] -s $tmppwd/srvtab -f $tmppwd/incoming-replica-datatrans -p $KDB5_UTIL -a $tmppwd/kpropd-acl
-+    spawn $KPROPD -S -d -t -P [expr 10 + $portbase] -s $tmppwd/keytab -f $tmppwd/incoming-replica-datatrans -p $KDB5_UTIL -a $tmppwd/kpropd-acl
-     set kpropd_pid [exp_pid]
-     set kpropd_spawn_id $spawn_id
--#    send_user [list $KPROPD -S -d -P [expr 10 + $portbase] -s $tmppwd/srvtab -f $tmppwd/incoming-replica-datatrans -p $KDB5_UTIL -a $tmppwd/kpropd-acl]\n
--#    spawn_shell
-     envstack_pop
- }
- 
-@@ -1859,13 +1857,13 @@ proc add_random_key { kkey standalone } {
-     }
- }
- 
--# setup_srvtab
--# Set up a srvtab file.  start_kerberos_daemons and add_random_key
-+# setup_keytab
-+# Set up a keytab file.  start_kerberos_daemons and add_random_key
- # $id/$hostname must be called before this procedure.  If the
- # argument is non-zero, call pass at relevant points.  Returns 1 on
- # success, 0 on failure. If the id field is not provided, host is used.
- 
--proc setup_srvtab { standalone {id host} } {
-+proc setup_keytab { standalone {id host} } {
-     global REALMNAME
-     global KADMIN_LOCAL
-     global KEY
-@@ -1874,17 +1872,17 @@ proc setup_srvtab { standalone {id host} } {
-     global spawn_id
-     global last_service
- 
--    if {!$standalone && [file exists $tmppwd/srvtab] && $last_service == $id} {
-+    if {!$standalone && [file exists $tmppwd/keytab] && $last_service == $id} {
- 	return 1
-     }
- 
--    file delete $tmppwd/srvtab $tmppwd/srvtab.old
-+    file delete $tmppwd/keytab $tmppwd/keytab.old
- 
-     if ![get_hostname] {
- 	return 0
-     }
- 
--    file delete $hostname-new-srvtab
-+    file delete $hostname-new-keytab
- 
-     envstack_push
-     setup_kerberos_env kdc
-@@ -1892,40 +1890,40 @@ proc setup_srvtab { standalone {id host} } {
-     envstack_pop
-     expect_after {
- 	-re "(.*)\r\nkadmin.local:  " {
--	    fail "kadmin.local srvtab (unmatched output: $expect_out(1,string))"
-+	    fail "kadmin.local keytab (unmatched output: $expect_out(1,string))"
- 	    if {!$standalone} {
--		file delete $tmppwd/srvtab
-+		file delete $tmppwd/keytab
- 	    }
- 	    catch "expect_after"
- 	    return 0
- 	}
- 	timeout {
--	    fail "kadmin.local srvtab"
-+	    fail "kadmin.local keytab"
- 	    if {!$standalone} {
--		file delete $tmppwd/srvtab
-+		file delete $tmppwd/keytab
- 	    }
- 	    catch "expect_after"
- 	    return 0
- 	}
- 	eof {
--	    fail "kadmin.local srvtab"
-+	    fail "kadmin.local keytab"
- 	    if {!$standalone} {
--		file delete $tmppwd/srvtab
-+		file delete $tmppwd/keytab
- 	    }
- 	    catch "expect_after"
- 	    return 0
- 	}
-     }
-     expect "kadmin.local:  "
--    send "xst -k $hostname-new-srvtab $id/$hostname kiprop/$hostname\r"
--    expect "xst -k $hostname-new-srvtab $id/$hostname kiprop/$hostname\r\n"
-+    send "xst -k $hostname-new-keytab $id/$hostname kiprop/$hostname\r"
-+    expect "xst -k $hostname-new-keytab $id/$hostname kiprop/$hostname\r\n"
-     expect {
--	-re ".*Entry for principal $id/$hostname.* added to keytab WRFILE:$hostname-new-srvtab." { }
-+	-re ".*Entry for principal $id/$hostname.* added to keytab WRFILE:$hostname-new-keytab." { }
- 	-re "\r\nkadmin.local:  " {
- 	    if {$standalone} {
--		fail "kadmin.local srvtab"
-+		fail "kadmin.local keytab"
- 	    } else {
--		file delete $tmppwd/srvtab
-+		file delete $tmppwd/keytab
- 	    }
- 	    catch expect_after
- 	    return 0
-@@ -1935,27 +1933,27 @@ proc setup_srvtab { standalone {id host} } {
-     send "quit\r"
-     expect eof
-     catch expect_after
--    if ![check_exit_status "kadmin.local srvtab"] {
-+    if ![check_exit_status "kadmin.local keytab"] {
- 	if {!$standalone} {
--	    file delete $tmppwd/srvtab
-+	    file delete $tmppwd/keytab
- 	}
- 	return 0
-     }
- 
--    catch "exec mv -f $hostname-new-srvtab $tmppwd/srvtab" exec_output
-+    catch "exec mv -f $hostname-new-keytab $tmppwd/keytab" exec_output
-     if ![string match "" $exec_output] {
- 	verbose -log "$exec_output"
--	perror "can't mv new srvtab"
-+	perror "can't mv new keytab"
- 	return 0
-     }
- 
-     if {$standalone} {
--	pass "kadmin.local srvtab"
-+	pass "kadmin.local keytab"
-     }
- 
--    # Make the srvtab file globally readable in case we are using a
--    # root shell and the srvtab is NFS mounted.
--    catch "exec chmod a+r $tmppwd/srvtab"
-+    # Make the keytab file globally readable in case we are using a
-+    # root shell and the keytab is NFS mounted.
-+    catch "exec chmod a+r $tmppwd/keytab"
- 
-     # Remember what we just extracted
-     set last_service $id
-diff --git a/src/tests/dejagnu/krb-standalone/gssapi.exp b/src/tests/dejagnu/krb-standalone/gssapi.exp
-index 582e08719..e3357e769 100644
---- a/src/tests/dejagnu/krb-standalone/gssapi.exp
-+++ b/src/tests/dejagnu/krb-standalone/gssapi.exp
-@@ -238,9 +238,9 @@ proc doit { } {
- 	perror "failed to set up gssservice/$hostname key"
-     }
- 
--    # Use kdb5_edit to create a srvtab entry for gssservice
--    if ![setup_srvtab 0 gssservice] {
--	perror "failed to set up gssservice srvtab"
-+    # Use kdb5_edit to create a keytab entry for gssservice
-+    if ![setup_keytab 0 gssservice] {
-+	perror "failed to set up gssservice keytab"
-     }
- 
-     catch "exec rm -f $tmppwd/gss_tk_0 $tmppwd/gss_tk_1 $tmppwd/gss_tk_2 $tmppwd/gss_tk_3"
-@@ -278,7 +278,7 @@ proc doit { } {
-     #
-     # set KRB5CCNAME and KRB5_KTNAME
-     #
--    set env(KRB5_KTNAME) FILE:$tmppwd/srvtab
-+    set env(KRB5_KTNAME) FILE:$tmppwd/keytab
-     verbose "KRB5_KTNAME=$env(KRB5_KTNAME)"
- 
-     # Now start the gss-server.
-diff --git a/src/tests/dejagnu/krb-standalone/kadmin.exp b/src/tests/dejagnu/krb-standalone/kadmin.exp
-index 33fc34a7b..36a345258 100644
---- a/src/tests/dejagnu/krb-standalone/kadmin.exp
-+++ b/src/tests/dejagnu/krb-standalone/kadmin.exp
-@@ -457,62 +457,16 @@ proc kadmin_extract { instance name } {
-     expect -re "assword\[^\r\n\]*: *" {
- 	send "adminpass$KEY\r"
-     }
--#    expect -re "kadmin: Entry for principal $name/$instance with kvno [0-9], encryption type .* added to keytab WRFILE:$tmppwd/keytab."
-     expect_after
-     expect eof
-     set k_stat [wait -i $spawn_id]
-     verbose "wait -i $spawn_id returned $k_stat (kadmin xst)"
-     catch "close -i $spawn_id"
--    catch "exec rm -f $instance-new-srvtab"
-+    catch "exec rm -f $instance-new-keytab"
-     pass "kadmin xst $instance $name"
-     return 1
- }
- 
--#++
--# kadmin_extractv4	- Test extract service key in v4 format function of
--#			  kadmin.
--#
--# Extracts service key for service name $name instance $instance in version
--# 4 format.  Returns 1 on success.
--#--
--#proc kadmin_extractv4 { instance name } {
--#    global REALMNAME
--#    global KADMIN
--#    global KEY
--#    global spawn_id
--#
--#    spawn $KADMIN -p krbtest/admin@$REALMNAME -q "xst4 $instance $name"
--#    expect_after {
--#	"Cannot contact any KDC" {
--#	    fail "kadmin xst4 $instance $name lost KDC"
--#	    catch "expect_after"
--#	    return 0
--#	}
--#	timeout {
--#	    fail "kadmin xst4 $instance $name"
--#	    catch "expect_after"
--#	    return 0
--#	}
--#	eof {
--#	    fail "kadmin xst4 $instance $name"
--#	    catch "expect_after"
--#	    return 0
--#	}
--#    }
--#    expect -re "assword\[^\r\n\]*: *" {
--#	send "adminpass$KEY\r"
--#    }
--#    expect "extracted entry $name to key table $instance-new-v4-srvtab"
--#    expect_after
--#    expect eof
--#    set k_stat [wait -i $spawn_id]
--#    verbose "wait -i $spawn_id returned $k_stat (kadmin xst4)"
--#    catch "close -i $spawn_id"
--#    catch "exec rm -f $instance-new-v4-srvtab"
--#    pass "kadmin xst4 $instance $name"
--#    return 1
--#}
--
- #++
- # kadmin_delete	- Test delete principal function of kadmin.
- #
-diff --git a/src/tests/dejagnu/krb-standalone/kprop.exp b/src/tests/dejagnu/krb-standalone/kprop.exp
-index 2221a65e4..f71ee8638 100644
---- a/src/tests/dejagnu/krb-standalone/kprop.exp
-+++ b/src/tests/dejagnu/krb-standalone/kprop.exp
-@@ -72,8 +72,8 @@ proc doit { } {
- 	fail "kprop (host key)"
- 	return
-     }
--    if ![setup_srvtab 0] {
--	fail "kprop (srvtab)"
-+    if ![setup_keytab 0] {
-+	fail "kprop (keytab)"
- 	return
-     }
- 
-@@ -99,7 +99,7 @@ proc doit { } {
-     sleep 1
- 
-     # Try a propagation.
--    spawn $KPROP -f $tmppwd/replica_datatrans -P [expr 10 + $portbase] -s $tmppwd/srvtab $hostname
-+    spawn $KPROP -f $tmppwd/replica_datatrans -P [expr 10 + $portbase] -s $tmppwd/keytab $hostname
-     expect eof
-     set kprop_exit [check_exit_status "kprop (exit status)"]
-     # log output for debugging
-diff --git a/src/tests/dejagnu/krb-standalone/sample.exp b/src/tests/dejagnu/krb-standalone/sample.exp
-index 326f1848d..93a75f1d0 100644
---- a/src/tests/dejagnu/krb-standalone/sample.exp
-+++ b/src/tests/dejagnu/krb-standalone/sample.exp
-@@ -42,7 +42,7 @@ proc start_sserver_daemon { inetd } {
-     # if inetd = 0, then we are running stand-alone
-     if !{$inetd} {
- 	    # Start the sserver
--	    spawn $SSERVER -p [expr 8 + $portbase] -S $tmppwd/srvtab
-+	    spawn $SSERVER -p [expr 8 + $portbase] -S $tmppwd/keytab
- 	    set sserver_pid [exp_pid]
- 	    set sserver_spawn_id $spawn_id
- 
-@@ -52,7 +52,7 @@ proc start_sserver_daemon { inetd } {
- 	    sleep 2
-     } else {
- 	    # Start the sserver
--	    spawn $T_INETD [expr 8 + $portbase] $SSERVER sserver -S $tmppwd/srvtab
-+	    spawn $T_INETD [expr 8 + $portbase] $SSERVER sserver -S $tmppwd/keytab
- 	    set sserver_pid [exp_pid]
- 	    set sserver_spawn_id $spawn_id
- 
-@@ -166,8 +166,8 @@ proc doit { } {
- 	return
-     }
- 
--    # Use ksrvutil to create a srvtab entry for sample
--    if ![setup_srvtab 1 sample] {
-+    # Use ksrvutil to create a keytab entry for sample
-+    if ![setup_keytab 1 sample] {
- 	return
-     }
- 
-diff --git a/src/tests/dejagnu/krb-standalone/simple.exp b/src/tests/dejagnu/krb-standalone/simple.exp
-index fa749035f..d8b218248 100644
---- a/src/tests/dejagnu/krb-standalone/simple.exp
-+++ b/src/tests/dejagnu/krb-standalone/simple.exp
-@@ -40,7 +40,7 @@ proc start_sim_server_daemon { } {
-     global portbase
- 
-     # Start the sim_server
--    spawn $SIM_SERVER -p [expr 8 + $portbase] -S $tmppwd/srvtab
-+    spawn $SIM_SERVER -p [expr 8 + $portbase] -S $tmppwd/keytab
-     set sim_server_pid [exp_pid]
-     set sim_server_spawn_id $spawn_id
- 
-@@ -179,8 +179,8 @@ proc doit { } {
- 	return
-     }
- 
--    # Use ksrvutil to create a srvtab entry for sample
--    if ![setup_srvtab 1 sample] {
-+    # Use ksrvutil to create a keytab entry for sample
-+    if ![setup_keytab 1 sample] {
- 	return
-     }
- 
-diff --git a/src/tests/dejagnu/krb-standalone/standalone.exp b/src/tests/dejagnu/krb-standalone/standalone.exp
-index 5b5970fba..d284297e8 100644
---- a/src/tests/dejagnu/krb-standalone/standalone.exp
-+++ b/src/tests/dejagnu/krb-standalone/standalone.exp
-@@ -166,8 +166,8 @@ proc doit { } {
-     verbose "wait -i $spawn_id returned $k_stat (kadmin addpol)"
-     catch "close -i $spawn_id"
- 
--    # Use ksrvutil to create a srvtab entry.
--    if ![setup_srvtab 1] {
-+    # Use ksrvutil to create a keytab entry.
-+    if ![setup_keytab 1] {
- 	return
-     }
- 
-diff --git a/src/tests/dejagnu/krb-standalone/tcp.exp b/src/tests/dejagnu/krb-standalone/tcp.exp
-index db09b895e..df3195bb6 100644
---- a/src/tests/dejagnu/krb-standalone/tcp.exp
-+++ b/src/tests/dejagnu/krb-standalone/tcp.exp
-@@ -33,11 +33,6 @@ proc doit { } {
- 	return
-     }
- 
--    # Use ksrvutil to create a srvtab entry.
--#    if ![setup_srvtab 1] {
--#	return
--#    }
--
-     # Use kinit to get a ticket.
-     if ![kinit krbtest/admin adminpass$KEY 1] {
- 	return
diff --git a/Remove-strerror-calls-from-k5_get_error.patch b/Remove-strerror-calls-from-k5_get_error.patch
deleted file mode 100644
index 42db53c..0000000
--- a/Remove-strerror-calls-from-k5_get_error.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From bf8f84d2116af9aba33202f44fdaf04a76430410 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Thu, 6 Jun 2019 11:46:58 -0400
-Subject: [PATCH] Remove strerror() calls from k5_get_error()
-
-Coverity models strerror() as a function which cannot accept negative
-values, even though it has defined behavior on all integers.
-k5_get_error() contains code to call strerror_r() and strerror() if
-its fptr global is unset, which isn't an expected case in practice.
-To silence a large number of Coverity false positives, just return a
-fixed string if fptr is null.
-
-(cherry picked from commit 2d400bea7a81a5a834a1be6ded439f18e0afa5ba)
----
- src/util/support/errors.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/src/util/support/errors.c b/src/util/support/errors.c
-index 70e1d59d0..f8bea07a3 100644
---- a/src/util/support/errors.c
-+++ b/src/util/support/errors.c
-@@ -78,10 +78,9 @@ k5_get_error(struct errinfo *ep, long code)
- 
-     lock();
-     if (fptr == NULL) {
-+        /* Should be rare; fptr should be set whenever libkrb5 is loaded. */
-         unlock();
--        if (strerror_r(code, buf, sizeof(buf)) == 0)
--            return oom_check(strdup(buf));
--        return oom_check(strdup(strerror(code)));
-+        return oom_check(strdup(_("Error code translation unavailable")));
-     }
-     r = fptr(code);
- #ifndef HAVE_COM_ERR_INTL
diff --git a/Remove-support-for-no-flags-SAM-2-preauth.patch b/Remove-support-for-no-flags-SAM-2-preauth.patch
deleted file mode 100644
index 9f95b3d..0000000
--- a/Remove-support-for-no-flags-SAM-2-preauth.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 9e71fcd5db98fb7ace02e8684486cc7f092d82ad Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Wed, 17 Apr 2019 17:07:46 -0400
-Subject: [PATCH] Remove support for no-flags SAM-2 preauth
-
-When neither the send-encrypted-sad nor the use-sad-as-key flag is set
-in the SAM-2 challenge, the protocol calls for the AS key to be
-combined with the string-to-key of the SAD using a key combination
-method which has only been implemented for DES and 3DES enctypes.
-Rather than extending key combination, remove support for this case.
-
-[ghudson@mit.edu: rewrote commit message, added comment]
-
-ticket: 8812 (new)
-(cherry picked from commit c30e0af224ef3716513744fd86aec3eeea90abf9)
----
- src/lib/krb5/krb/preauth_sam2.c | 40 +++++++++------------------------
- 1 file changed, 11 insertions(+), 29 deletions(-)
-
-diff --git a/src/lib/krb5/krb/preauth_sam2.c b/src/lib/krb5/krb/preauth_sam2.c
-index c7484c47e..fda86bee2 100644
---- a/src/lib/krb5/krb/preauth_sam2.c
-+++ b/src/lib/krb5/krb/preauth_sam2.c
-@@ -211,38 +211,20 @@ sam2_process(krb5_context context, krb5_clpreauth_moddata moddata,
-     /* Get encryption key to be used for checksum and sam_response */
-     if (!(sc2b->sam_flags & KRB5_SAM_USE_SAD_AS_KEY)) {
-         /* Retain as_key from above gak_fct call. */
--
--        if (!(sc2b->sam_flags & KRB5_SAM_SEND_ENCRYPTED_SAD)) {
--            /* as_key = combine_key (as_key, string_to_key(SAD)) */
--            krb5_keyblock tmp_kb;
--
--            retval = krb5_c_string_to_key(context, sc2b->sam_etype,
--                                          &response_data, salt, &tmp_kb);
--
--            if (retval) {
--                krb5_free_sam_challenge_2(context, sc2);
--                krb5_free_sam_challenge_2_body(context, sc2b);
--                if (defsalt.length) free(defsalt.data);
--                return(retval);
--            }
--
--            /* This should be a call to the crypto library some day */
--            /* key types should already match the sam_etype */
--            retval = krb5int_c_combine_keys(context, &ctx->as_key, &tmp_kb,
--                                            &ctx->as_key);
--
--            if (retval) {
--                krb5_free_sam_challenge_2(context, sc2);
--                krb5_free_sam_challenge_2_body(context, sc2b);
--                if (defsalt.length) free(defsalt.data);
--                return(retval);
--            }
--            krb5_free_keyblock_contents(context, &tmp_kb);
--        }
--
-         if (defsalt.length)
-             free(defsalt.data);
- 
-+        if (!(sc2b->sam_flags & KRB5_SAM_SEND_ENCRYPTED_SAD)) {
-+            /*
-+             * If no flags are set, the protocol calls for us to combine the
-+             * initial reply key with the SAD, using a method which is only
-+             * specified for DES and 3DES enctypes.  We no longer support this
-+             * case.
-+             */
-+            krb5_free_sam_challenge_2(context, sc2);
-+            krb5_free_sam_challenge_2_body(context, sc2b);
-+            return(KRB5_SAM_UNSUPPORTED);
-+        }
-     } else {
-         /* as_key = string_to_key(SAD) */
- 
diff --git a/Remove-support-for-single-DES-and-CRC.patch b/Remove-support-for-single-DES-and-CRC.patch
deleted file mode 100644
index 6c7e2e9..0000000
--- a/Remove-support-for-single-DES-and-CRC.patch
+++ /dev/null
@@ -1,3336 +0,0 @@
-From 2cc75213f2227cffeaf60ad0c4ef60b5466b073e Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Fri, 24 May 2019 13:12:03 -0400
-Subject: [PATCH] Remove support for single-DES and CRC
-
-Single-DES removal brings us closer to compliance with RFC 6649.
-Single-DES was disabled by default starting in release 1.8, and
-user-visible deprecation warnings were issued starting in release
-1.17.
-
-ticket: 8808
-(cherry picked from commit fb2dada5eb89c4cd4e39dedd6dbb7dbd5e94f8b8)
-[rharwood@redhat.com: .gitignore removal]
----
- doc/admin/advanced/retiring-des.rst           |   5 +
- doc/admin/conf_files/kdc_conf.rst             |  17 +-
- doc/admin/conf_files/krb5_conf.rst            |  17 +-
- doc/admin/enctypes.rst                        |  38 +-
- doc/appdev/refs/macros/index.rst              |   1 +
- doc/conf.py                                   |   2 +-
- doc/mitK5features.rst                         |   2 +-
- src/include/k5-int.h                          |   1 -
- src/include/krb5/krb5.hin                     |  10 +-
- src/include/win-mac.h                         |  12 -
- src/kdc/kdc_util.c                            |  14 -
- src/kdc/main.c                                |   6 -
- src/kdc/realm_data.h                          |   1 -
- src/lib/crypto/builtin/des/des_int.h          |   1 -
- .../crypto/builtin/enc_provider/Makefile.in   |   3 -
- src/lib/crypto/builtin/enc_provider/deps      |  12 -
- src/lib/crypto/builtin/enc_provider/des.c     | 120 ---
- .../crypto/builtin/hash_provider/Makefile.in  |   7 +-
- src/lib/crypto/builtin/hash_provider/deps     |  13 -
- .../crypto/builtin/hash_provider/hash_crc32.c |  56 --
- src/lib/crypto/krb/Makefile.in                |   9 -
- src/lib/crypto/krb/cksumtypes.c               |  24 -
- src/lib/crypto/krb/combine_keys.c             |   3 -
- src/lib/crypto/krb/crc32.c                    | 165 -----
- src/lib/crypto/krb/crypto_int.h               |  16 -
- src/lib/crypto/krb/default_state.c            |   4 -
- src/lib/crypto/krb/deps                       |  36 -
- src/lib/crypto/krb/enc_old.c                  | 181 -----
- src/lib/crypto/krb/etypes.c                   |  46 --
- src/lib/crypto/krb/s2k_des.c                  | 691 ------------------
- src/lib/crypto/libk5crypto.exports            |   1 -
- .../crypto/openssl/enc_provider/Makefile.in   |   3 -
- src/lib/crypto/openssl/enc_provider/deps      |  11 -
- src/lib/crypto/openssl/enc_provider/des.c     | 218 ------
- .../crypto/openssl/hash_provider/Makefile.in  |  10 +-
- src/lib/crypto/openssl/hash_provider/deps     |  12 -
- .../crypto/openssl/hash_provider/hash_crc32.c |  56 --
- src/lib/gssapi/krb5/accept_sec_context.c      |   3 -
- src/lib/gssapi/krb5/gssapiP_krb5.h            |  20 +-
- src/lib/gssapi/krb5/k5seal.c                  |  28 +-
- src/lib/gssapi/krb5/k5sealiov.c               |  20 -
- src/lib/gssapi/krb5/k5unseal.c                | 112 ---
- src/lib/gssapi/krb5/k5unsealiov.c             |  34 +-
- src/lib/gssapi/krb5/util_crypt.c              |  41 --
- src/lib/kadm5/kadm_rpc_xdr.c                  |  10 -
- src/lib/krb5/ccache/cc_mslsa.c                |  11 +-
- src/lib/krb5/krb/auth_con.c                   |  23 +-
- src/lib/krb5/krb/gic_keytab.c                 |   4 -
- src/lib/krb5/krb/init_ctx.c                   |   9 -
- src/lib/krb5/krb/mk_req_ext.c                 |  43 +-
- src/lib/krb5/krb/s4u_creds.c                  |   3 -
- src/lib/krb5/krb/ser_ctx.c                    |   2 +-
- src/man/kdc.conf.man                          |  47 +-
- src/man/krb5.conf.man                         |   6 +-
- .../leash/htmlhelp/html/Encryption_Types.htm  |  14 +-
- 55 files changed, 74 insertions(+), 2180 deletions(-)
- delete mode 100644 src/lib/crypto/builtin/enc_provider/des.c
- delete mode 100644 src/lib/crypto/builtin/hash_provider/hash_crc32.c
- delete mode 100644 src/lib/crypto/krb/crc32.c
- delete mode 100644 src/lib/crypto/krb/enc_old.c
- delete mode 100644 src/lib/crypto/krb/s2k_des.c
- delete mode 100644 src/lib/crypto/openssl/enc_provider/des.c
- delete mode 100644 src/lib/crypto/openssl/hash_provider/hash_crc32.c
-
-diff --git a/doc/admin/advanced/retiring-des.rst b/doc/admin/advanced/retiring-des.rst
-index ebac95f24..4a964c15c 100644
---- a/doc/admin/advanced/retiring-des.rst
-+++ b/doc/admin/advanced/retiring-des.rst
-@@ -22,6 +22,11 @@ However, deployments of krb5 using Kerberos databases created with older
- versions of krb5 will not necessarily start using strong crypto for
- ordinary operation without administrator intervention.
- 
-+MIT krb5 began flagging deprecated encryption types with release 1.17,
-+and removed DES (single-DES) support in release 1.18.  As a
-+consequence, a release prior to 1.18 is required to perform these
-+migrations.
-+
- Types of keys
- -------------
- 
-diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst
-index 62d1bfc05..2c6ea1855 100644
---- a/doc/admin/conf_files/kdc_conf.rst
-+++ b/doc/admin/conf_files/kdc_conf.rst
-@@ -381,13 +381,6 @@ The following tags may be specified in a [realms] subsection:
-     listed in **host_based_services**.  ``no_host_referral = *`` will
-     disable referral processing altogether.
- 
--**des_crc_session_supported**
--    (Boolean value).  If set to true, the KDC will assume that service
--    principals support des-cbc-crc for session key enctype negotiation
--    purposes.  If **allow_weak_crypto** in :ref:`libdefaults` is
--    false, or if des-cbc-crc is not a permitted enctype, then this
--    variable has no effect.  Defaults to true.  New in release 1.11.
--
- **reject_bad_transit**
-     (Boolean value.)  If set to true, the KDC will check the list of
-     transited realms for cross-realm tickets against the transit path
-@@ -848,13 +841,8 @@ Encryption types marked as "weak" are available for compatibility but
- not recommended for use.
- 
- ==================================================== =========================================================
--des-cbc-crc                                          DES cbc mode with CRC-32 (weak)
--des-cbc-md4                                          DES cbc mode with RSA-MD4 (weak)
--des-cbc-md5                                          DES cbc mode with RSA-MD5 (weak)
--des-cbc-raw                                          DES cbc mode raw (weak)
- des3-cbc-raw                                         Triple DES cbc mode raw (weak)
- des3-cbc-sha1 des3-hmac-sha1 des3-cbc-sha1-kd        Triple DES cbc mode with HMAC/sha1
--des-hmac-sha1                                        DES with HMAC/sha1 (weak)
- aes256-cts-hmac-sha1-96 aes256-cts aes256-sha1       AES-256 CTS mode with 96-bit SHA-1 HMAC
- aes128-cts-hmac-sha1-96 aes128-cts aes128-sha1       AES-128 CTS mode with 96-bit SHA-1 HMAC
- aes256-cts-hmac-sha384-192 aes256-sha2               AES-256 CTS mode with 192-bit SHA-384 HMAC
-@@ -863,7 +851,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5               RC4 with HMAC/MD5
- arcfour-hmac-exp rc4-hmac-exp arcfour-hmac-md5-exp   Exportable RC4 with HMAC/MD5 (weak)
- camellia256-cts-cmac camellia256-cts                 Camellia-256 CTS mode with CMAC
- camellia128-cts-cmac camellia128-cts                 Camellia-128 CTS mode with CMAC
--des                                                  The DES family: des-cbc-crc, des-cbc-md5, and des-cbc-md4 (weak)
- des3                                                 The triple DES family: des3-cbc-sha1
- aes                                                  The AES family: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128
- rc4                                                  The RC4 family: arcfour-hmac
-@@ -875,8 +862,8 @@ types for the variable in question.  Types or families can be removed
- from the current list by prefixing them with a minus sign ("-").
- Types or families can be prefixed with a plus sign ("+") for symmetry;
- it has the same meaning as just listing the type or family.  For
--example, "``DEFAULT -des``" would be the default set of encryption
--types with DES types removed, and "``des3 DEFAULT``" would be the
-+example, "``DEFAULT -rc4``" would be the default set of encryption
-+types with RC4 types removed, and "``des3 DEFAULT``" would be the
- default set of encryption types with triple DES types moved to the
- front.
- 
-diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
-index 5df3bfe36..89f02434b 100644
---- a/doc/admin/conf_files/krb5_conf.rst
-+++ b/doc/admin/conf_files/krb5_conf.rst
-@@ -106,10 +106,7 @@ The libdefaults section may contain any of the following relations:
-     in :ref:`Encryption_types` in :ref:`kdc.conf(5)`) will be filtered
-     out of the lists **default_tgs_enctypes**,
-     **default_tkt_enctypes**, and **permitted_enctypes**.  The default
--    value for this tag is false, which may cause authentication
--    failures in existing Kerberos infrastructures that do not support
--    strong crypto.  Users in affected environments should set this tag
--    to true until their infrastructure adopts stronger ciphers.
-+    value for this tag is false.
- 
- **canonicalize**
-     If this flag is set to true, initial ticket requests to the KDC
-@@ -163,9 +160,7 @@ The libdefaults section may contain any of the following relations:
-     preference from highest to lowest.  The list may be delimited with
-     commas or whitespace.  See :ref:`Encryption_types` in
-     :ref:`kdc.conf(5)` for a list of the accepted values for this tag.
--    The default value is |defetypes|, but single-DES encryption types
--    will be implicitly removed from this list if the value of
--    **allow_weak_crypto** is false.
-+    The default value is |defetypes|.
- 
-     Do not set this unless required for specific backward
-     compatibility purposes; stale values of this setting can prevent
-@@ -177,9 +172,7 @@ The libdefaults section may contain any of the following relations:
-     the client should request when making an AS-REQ, in order of
-     preference from highest to lowest.  The format is the same as for
-     default_tgs_enctypes.  The default value for this tag is
--    |defetypes|, but single-DES encryption types will be implicitly
--    removed from this list if the value of **allow_weak_crypto** is
--    false.
-+    |defetypes|.
- 
-     Do not set this unless required for specific backward
-     compatibility purposes; stale values of this setting can prevent
-@@ -297,9 +290,7 @@ The libdefaults section may contain any of the following relations:
- **permitted_enctypes**
-     Identifies all encryption types that are permitted for use in
-     session key encryption.  The default value for this tag is
--    |defetypes|, but single-DES encryption types will be implicitly
--    removed from this list if the value of **allow_weak_crypto** is
--    false.
-+    |defetypes|.
- 
- **plugin_base_dir**
-     If set, determines the base directory where krb5 plugins are
-diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
-index 3cdfc92cf..84183a53c 100644
---- a/doc/admin/enctypes.rst
-+++ b/doc/admin/enctypes.rst
-@@ -48,17 +48,12 @@ Session key selection
- The KDC chooses the session key enctype by taking the intersection of
- its **permitted_enctypes** list, the list of long-term keys for the
- most recent kvno of the service, and the client's requested list of
--enctypes.  If **allow_weak_crypto** is true, all services are assumed
--to support des-cbc-crc.
-+enctypes.
- 
--Starting in krb5-1.11, **des_crc_session_supported** in
--:ref:`kdc.conf(5)` allows additional control over whether the KDC
--issues des-cbc-crc session keys.
--
--Also starting in krb5-1.11, it is possible to set a string attribute
--on a service principal to control what session key enctypes the KDC
--may issue for service tickets for that principal.  See
--:ref:`set_string` in :ref:`kadmin(1)` for details.
-+Starting in krb5-1.11, it is possible to set a string attribute on a
-+service principal to control what session key enctypes the KDC may
-+issue for service tickets for that principal.  See :ref:`set_string`
-+in :ref:`kadmin(1)` for details.
- 
- 
- Choosing enctypes for a service
-@@ -86,11 +81,11 @@ affect how enctypes are chosen.
- 
- **allow_weak_crypto**
-     defaults to *false* starting with krb5-1.8.  When *false*, removes
--    single-DES enctypes (and other weak enctypes) from
--    **permitted_enctypes**, **default_tkt_enctypes**, and
--    **default_tgs_enctypes**.  Do not set this to *true* unless the
--    use of weak enctypes is an acceptable risk for your environment
--    and the weak enctypes are required for backward compatibility.
-+    weak enctypes from **permitted_enctypes**,
-+    **default_tkt_enctypes**, and **default_tgs_enctypes**.  Do not
-+    set this to *true* unless the use of weak enctypes is an
-+    acceptable risk for your environment and the weak enctypes are
-+    required for backward compatibility.
- 
- **permitted_enctypes**
-     controls the set of enctypes that a service will accept as session
-@@ -127,9 +122,9 @@ See :ref:`Encryption_types` for additional information about enctypes.
- ========================== ===== ======== =======
- enctype                    weak? krb5     Windows
- ========================== ===== ======== =======
--des-cbc-crc                weak  all      >=2000
--des-cbc-md4                weak  all      ?
--des-cbc-md5                weak  all      >=2000
-+des-cbc-crc                weak  <1.18    >=2000
-+des-cbc-md4                weak  <1.18    ?
-+des-cbc-md5                weak  <1.18    >=2000
- des3-cbc-sha1                    >=1.1    none
- arcfour-hmac                     >=1.3    >=2000
- arcfour-hmac-exp           weak  >=1.3    >=2000
-@@ -141,6 +136,7 @@ camellia128-cts-cmac             >=1.9    none
- camellia256-cts-cmac             >=1.9    none
- ========================== ===== ======== =======
- 
--krb5 releases 1.8 and later disable the single-DES enctypes by
--default.  Microsoft Windows releases Windows 7 and later disable
--single-DES enctypes by default.
-+krb5 releases 1.18 and later do not support single-DES.  krb5 releases
-+1.8 and later disable the single-DES enctypes by default.  Microsoft
-+Windows releases Windows 7 and later disable single-DES enctypes by
-+default.
-diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst
-index 47c6d4413..534795d15 100644
---- a/doc/appdev/refs/macros/index.rst
-+++ b/doc/appdev/refs/macros/index.rst
-@@ -55,6 +55,7 @@ Public
-    ENCTYPE_DES3_CBC_RAW.rst
-    ENCTYPE_DES3_CBC_SHA.rst
-    ENCTYPE_DES3_CBC_SHA1.rst
-+   ENCTYPE_DES3_CBC_SHA1.rst
-    ENCTYPE_DES_CBC_CRC.rst
-    ENCTYPE_DES_CBC_MD4.rst
-    ENCTYPE_DES_CBC_MD5.rst
-diff --git a/doc/conf.py b/doc/conf.py
-index c32e33001..759367c21 100644
---- a/doc/conf.py
-+++ b/doc/conf.py
-@@ -272,7 +272,7 @@ else:
-     rst_epilog += '''
- .. |krb5conf| replace:: ``/etc/krb5.conf``
- .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal des3-cbc-sha1:normal arcfour-hmac-md5:normal``
--.. |defetypes| replace:: ``aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac des-cbc-crc des-cbc-md5 des-cbc-md4``
-+.. |defetypes| replace:: ``aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac``
- .. |defmkey| replace:: ``aes256-cts-hmac-sha1-96``
- .. |copy| unicode:: U+000A9
- '''
-diff --git a/doc/mitK5features.rst b/doc/mitK5features.rst
-index 584f7b893..a19068e26 100644
---- a/doc/mitK5features.rst
-+++ b/doc/mitK5features.rst
-@@ -37,7 +37,7 @@ Database backends: LDAP, DB2, LMDB
- 
- krb4 support: Kerberos 5 release < 1.8
- 
--DES support: configurable (See :ref:`retiring-des`)
-+DES support: Kerberos 5 release < 1.18 (See :ref:`retiring-des`)
- 
- Interoperability
- ----------------
-diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index 1a78fd7a9..e0c557554 100644
---- a/src/include/k5-int.h
-+++ b/src/include/k5-int.h
-@@ -200,7 +200,6 @@ typedef unsigned char   u_char;
- #define KRB5_CONF_DEFAULT_REALM                "default_realm"
- #define KRB5_CONF_DEFAULT_TGS_ENCTYPES         "default_tgs_enctypes"
- #define KRB5_CONF_DEFAULT_TKT_ENCTYPES         "default_tkt_enctypes"
--#define KRB5_CONF_DES_CRC_SESSION_SUPPORTED    "des_crc_session_supported"
- #define KRB5_CONF_DICT_FILE                    "dict_file"
- #define KRB5_CONF_DISABLE                      "disable"
- #define KRB5_CONF_DISABLE_ENCRYPTED_TIMESTAMP  "disable_encrypted_timestamp"
-diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
-index 346e796a5..5f596d1fc 100644
---- a/src/include/krb5/krb5.hin
-+++ b/src/include/krb5/krb5.hin
-@@ -422,13 +422,13 @@ typedef struct _krb5_crypto_iov {
- 
- /* per Kerberos v5 protocol spec */
- #define ENCTYPE_NULL            0x0000
--#define ENCTYPE_DES_CBC_CRC     0x0001  /**< DES cbc mode with CRC-32 */
--#define ENCTYPE_DES_CBC_MD4     0x0002  /**< DES cbc mode with RSA-MD4 */
--#define ENCTYPE_DES_CBC_MD5     0x0003  /**< DES cbc mode with RSA-MD5 */
--#define ENCTYPE_DES_CBC_RAW     0x0004  /**< @deprecated DES cbc mode raw */
-+#define ENCTYPE_DES_CBC_CRC     0x0001  /**< @deprecated no longer supported */
-+#define ENCTYPE_DES_CBC_MD4     0x0002  /**< @deprecated no longer supported */
-+#define ENCTYPE_DES_CBC_MD5     0x0003  /**< @deprecated no longer supported */
-+#define ENCTYPE_DES_CBC_RAW     0x0004  /**< @deprecated no longer supported */
- #define ENCTYPE_DES3_CBC_SHA    0x0005  /**< @deprecated DES-3 cbc with SHA1 */
- #define ENCTYPE_DES3_CBC_RAW    0x0006  /**< @deprecated DES-3 cbc mode raw */
--#define ENCTYPE_DES_HMAC_SHA1   0x0008  /**< @deprecated */
-+#define ENCTYPE_DES_HMAC_SHA1   0x0008  /**< @deprecated no longer supported */
- /* PKINIT */
- #define ENCTYPE_DSA_SHA1_CMS    0x0009  /**< DSA with SHA1, CMS signature */
- #define ENCTYPE_MD5_RSA_CMS     0x000a  /**< MD5 with RSA, CMS signature */
-diff --git a/src/include/win-mac.h b/src/include/win-mac.h
-index c3744ed14..dc0f2a1ae 100644
---- a/src/include/win-mac.h
-+++ b/src/include/win-mac.h
-@@ -176,18 +176,6 @@ typedef _W64 int         ssize_t;
- #define HAVE_STDLIB_H
- #endif
- 
--/* This controls which encryption routines libcrypto will provide */
--#define PROVIDE_DES_CBC_MD5
--#define PROVIDE_DES_CBC_CRC
--#define PROVIDE_DES_CBC_RAW
--#define PROVIDE_DES_CBC_CKSUM
--#define PROVIDE_CRC32
--#define PROVIDE_RSA_MD4
--#define PROVIDE_RSA_MD5
--/* #define PROVIDE_DES3_CBC_SHA */
--/* #define PROVIDE_DES3_CBC_RAW */
--/* #define PROVIDE_NIST_SHA */
--
- /* Ugly. Microsoft, in stdc mode, doesn't support the low-level i/o
-  * routines directly. Rather, they only export the _<function> version.
-  * The following defines works around this problem.
-diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
-index f2741090e..df1ba6acf 100644
---- a/src/kdc/kdc_util.c
-+++ b/src/kdc/kdc_util.c
-@@ -991,17 +991,6 @@ dbentry_supports_enctype(kdc_realm_t *kdc_active_realm, krb5_db_entry *server,
-     free(etypes_str);
-     free(etypes);
- 
--    /* If configured to, assume every server without a session_enctypes
--     * attribute supports DES_CBC_CRC. */
--    if (kdc_active_realm->realm_assume_des_crc_sess &&
--        enctype == ENCTYPE_DES_CBC_CRC)
--        return TRUE;
--
--    /* Due to an ancient interop problem, assume nothing supports des-cbc-md5
--     * unless there's a session_enctypes explicitly saying that it does. */
--    if (enctype == ENCTYPE_DES_CBC_MD5)
--        return FALSE;
--
-     /* Assume the server supports any enctype it has a long-term key for. */
-     return !krb5_dbe_find_enctype(kdc_context, server, enctype, -1, 0, &datap);
- }
-@@ -1752,9 +1741,6 @@ krb5_boolean
- enctype_requires_etype_info_2(krb5_enctype enctype)
- {
-     switch(enctype) {
--    case ENCTYPE_DES_CBC_CRC:
--    case ENCTYPE_DES_CBC_MD4:
--    case ENCTYPE_DES_CBC_MD5:
-     case ENCTYPE_DES3_CBC_SHA1:
-     case ENCTYPE_DES3_CBC_RAW:
-     case ENCTYPE_ARCFOUR_HMAC:
-diff --git a/src/kdc/main.c b/src/kdc/main.c
-index 1596c1c5b..8d4df4d6a 100644
---- a/src/kdc/main.c
-+++ b/src/kdc/main.c
-@@ -307,12 +307,6 @@ init_realm(kdc_realm_t * rdp, krb5_pointer aprof, char *realm,
-                                 &rdp->realm_reject_bad_transit))
-         rdp->realm_reject_bad_transit = TRUE;
- 
--    /* Handle assume des-cbc-crc is supported for session keys */
--    hierarchy[2] = KRB5_CONF_DES_CRC_SESSION_SUPPORTED;
--    if (krb5_aprof_get_boolean(aprof, hierarchy, TRUE,
--                               &rdp->realm_assume_des_crc_sess))
--        rdp->realm_assume_des_crc_sess = TRUE;
--
-     /* Handle ticket maximum life */
-     hierarchy[2] = KRB5_CONF_MAX_LIFE;
-     if (krb5_aprof_get_deltat(aprof, hierarchy, TRUE, &rdp->realm_maxlife))
-diff --git a/src/kdc/realm_data.h b/src/kdc/realm_data.h
-index 859daf159..8d698dcb8 100644
---- a/src/kdc/realm_data.h
-+++ b/src/kdc/realm_data.h
-@@ -73,7 +73,6 @@ typedef struct __kdc_realm_data {
-     krb5_deltat         realm_maxrlife; /* Maximum renewable life for realm */
-     krb5_boolean        realm_reject_bad_transit; /* Accept unverifiable transited_realm ? */
-     krb5_boolean        realm_restrict_anon;  /* Anon to local TGT only */
--    krb5_boolean        realm_assume_des_crc_sess;  /* Assume princs support des-cbc-crc for session keys */
- } kdc_realm_t;
- 
- struct server_handle {
-diff --git a/src/lib/crypto/builtin/des/des_int.h b/src/lib/crypto/builtin/des/des_int.h
-index 67e40a19c..f8dc6b296 100644
---- a/src/lib/crypto/builtin/des/des_int.h
-+++ b/src/lib/crypto/builtin/des/des_int.h
-@@ -131,7 +131,6 @@ typedef struct mit_des_ran_key_seed {
- /* the first byte of the key is already in the keyblock */
- 
- #define MIT_DES_BLOCK_LENGTH            (8*sizeof(krb5_octet))
--#define MIT_DES_CBC_CRC_PAD_MINIMUM     CRC32_CKSUM_LENGTH
- /* This used to be 8*sizeof(krb5_octet) */
- #define MIT_DES_KEYSIZE                 8
- 
-diff --git a/src/lib/crypto/builtin/enc_provider/Makefile.in b/src/lib/crypto/builtin/enc_provider/Makefile.in
-index 4fd3311b4..3459e1d0e 100644
---- a/src/lib/crypto/builtin/enc_provider/Makefile.in
-+++ b/src/lib/crypto/builtin/enc_provider/Makefile.in
-@@ -11,21 +11,18 @@ LOCALINCLUDES = -I$(srcdir)/../des 	\
- ##DOS##OBJFILE = ..\..\$(OUTPRE)enc_provider.lst
- 
- STLIBOBJS= \
--	des.o 	\
- 	des3.o 	\
- 	rc4.o 	\
- 	aes.o   \
- 	camellia.o
- 
- OBJS= \
--	$(OUTPRE)des.$(OBJEXT) 	\
- 	$(OUTPRE)des3.$(OBJEXT) 	\
- 	$(OUTPRE)aes.$(OBJEXT) 	\
- 	$(OUTPRE)camellia.$(OBJEXT)	\
- 	$(OUTPRE)rc4.$(OBJEXT)
- 
- SRCS= \
--	$(srcdir)/des.c 	\
- 	$(srcdir)/des3.c 	\
- 	$(srcdir)/aes.c 	\
- 	$(srcdir)/camellia.c	\
-diff --git a/src/lib/crypto/builtin/enc_provider/deps b/src/lib/crypto/builtin/enc_provider/deps
-index 72e340766..7a3324c44 100644
---- a/src/lib/crypto/builtin/enc_provider/deps
-+++ b/src/lib/crypto/builtin/enc_provider/deps
-@@ -1,18 +1,6 @@
- #
- # Generated makefile dependencies follow.
- #
--des.so des.po $(OUTPRE)des.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
--  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
--  $(srcdir)/../aes/aes.h $(srcdir)/../crypto_mod.h $(srcdir)/../des/des_int.h \
--  $(srcdir)/../sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
--  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
--  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
--  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
--  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h des.c
- des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
-diff --git a/src/lib/crypto/builtin/enc_provider/des.c b/src/lib/crypto/builtin/enc_provider/des.c
-deleted file mode 100644
-index 30b8229f8..000000000
---- a/src/lib/crypto/builtin/enc_provider/des.c
-+++ /dev/null
-@@ -1,120 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/*
-- * Copyright (C) 1998 by the FundsXpress, INC.
-- *
-- * All rights reserved.
-- *
-- * Export of this software from the United States of America may require
-- * a specific license from the United States Government.  It is the
-- * responsibility of any person or organization contemplating export to
-- * obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of FundsXpress. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  FundsXpress makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- *
-- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
-- * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
-- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
-- */
--
--#include "crypto_int.h"
--#include "des_int.h"
--
--static krb5_error_code
--validate_and_schedule(krb5_key key, const krb5_data *ivec,
--                      const krb5_crypto_iov *data, size_t num_data,
--                      mit_des_key_schedule schedule)
--{
--    if (key->keyblock.length != 8)
--        return KRB5_BAD_KEYSIZE;
--    if (iov_total_length(data, num_data, FALSE) % 8 != 0)
--        return KRB5_BAD_MSIZE;
--    if (ivec != NULL && ivec->length != 8)
--        return KRB5_BAD_MSIZE;
--
--    switch (mit_des_key_sched(key->keyblock.contents, schedule)) {
--    case -1:
--        return(KRB5DES_BAD_KEYPAR);
--    case -2:
--        return(KRB5DES_WEAK_KEY);
--    }
--    return 0;
--}
--
--static krb5_error_code
--des_encrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
--            size_t num_data)
--{
--    mit_des_key_schedule schedule;
--    krb5_error_code err;
--
--    err = validate_and_schedule(key, ivec, data, num_data, schedule);
--    if (err)
--        return err;
--
--    krb5int_des_cbc_encrypt(data, num_data, schedule,
--                            ivec != NULL ? (unsigned char *) ivec->data :
--                            NULL);
--
--    zap(schedule, sizeof(schedule));
--    return 0;
--}
--
--static krb5_error_code
--des_decrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
--            size_t num_data)
--{
--    mit_des_key_schedule schedule;
--    krb5_error_code err;
--
--    err = validate_and_schedule(key, ivec, data, num_data, schedule);
--    if (err)
--        return err;
--
--    krb5int_des_cbc_decrypt(data, num_data, schedule,
--                            ivec != NULL ? (unsigned char *) ivec->data :
--                            NULL);
--
--    zap(schedule, sizeof(schedule));
--    return 0;
--}
--
--static krb5_error_code
--des_cbc_mac(krb5_key key, const krb5_crypto_iov *data, size_t num_data,
--            const krb5_data *ivec, krb5_data *output)
--{
--    mit_des_key_schedule schedule;
--    krb5_error_code err;
--
--    err = validate_and_schedule(key, ivec, data, num_data, schedule);
--    if (err)
--        return err;
--
--    if (output->length != 8)
--        return KRB5_CRYPTO_INTERNAL;
--
--    krb5int_des_cbc_mac(data, num_data, schedule,
--                        ivec != NULL ? (unsigned char *) ivec->data : NULL,
--                        (unsigned char *) output->data);
--
--    zap(schedule, sizeof(schedule));
--    return 0;
--}
--
--const struct krb5_enc_provider krb5int_enc_des = {
--    8,
--    7, 8,
--    des_encrypt,
--    des_decrypt,
--    des_cbc_mac,
--    krb5int_des_init_state,
--    krb5int_default_free_state
--};
-diff --git a/src/lib/crypto/builtin/hash_provider/Makefile.in b/src/lib/crypto/builtin/hash_provider/Makefile.in
-index 2f587a497..ceebf9380 100644
---- a/src/lib/crypto/builtin/hash_provider/Makefile.in
-+++ b/src/lib/crypto/builtin/hash_provider/Makefile.in
-@@ -8,20 +8,17 @@ LOCALINCLUDES = -I$(srcdir)/.. -I$(srcdir)/../../krb -I$(srcdir)/../md4 \
- ##DOS##OBJFILE = ..\..\$(OUTPRE)hash_provider.lst
- 
- STLIBOBJS= \
--	hash_crc32.o 	\
- 	hash_md4.o 	\
- 	hash_md5.o 	\
- 	hash_sha1.o	\
- 	hash_sha2.o
- 
--OBJS=   $(OUTPRE)hash_crc32.$(OBJEXT) 	\
--	$(OUTPRE)hash_md4.$(OBJEXT) 	\
-+OBJS=   $(OUTPRE)hash_md4.$(OBJEXT) 	\
- 	$(OUTPRE)hash_md5.$(OBJEXT) 	\
- 	$(OUTPRE)hash_sha1.$(OBJEXT)	\
- 	$(OUTPRE)hash_sha2.$(OBJEXT)
- 
--SRCS=	$(srcdir)/hash_crc32.c	\
--	$(srcdir)/hash_md4.c 	\
-+SRCS=	$(srcdir)/hash_md4.c 	\
- 	$(srcdir)/hash_md5.c 	\
- 	$(srcdir)/hash_sha1.c	\
- 	$(srcdir)/hash_sha2.c
-diff --git a/src/lib/crypto/builtin/hash_provider/deps b/src/lib/crypto/builtin/hash_provider/deps
-index 18f89b383..fb65a44be 100644
---- a/src/lib/crypto/builtin/hash_provider/deps
-+++ b/src/lib/crypto/builtin/hash_provider/deps
-@@ -1,19 +1,6 @@
- #
- # Generated makefile dependencies follow.
- #
--hash_crc32.so hash_crc32.po $(OUTPRE)hash_crc32.$(OBJEXT): \
--  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
--  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../aes/aes.h \
--  $(srcdir)/../crypto_mod.h $(srcdir)/../sha2/sha2.h \
--  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  hash_crc32.c
- hash_md4.so hash_md4.po $(OUTPRE)hash_md4.$(OBJEXT): \
-   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-diff --git a/src/lib/crypto/builtin/hash_provider/hash_crc32.c b/src/lib/crypto/builtin/hash_provider/hash_crc32.c
-deleted file mode 100644
-index 1d0be5563..000000000
---- a/src/lib/crypto/builtin/hash_provider/hash_crc32.c
-+++ /dev/null
-@@ -1,56 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/*
-- * Copyright (C) 1998 by the FundsXpress, INC.
-- *
-- * All rights reserved.
-- *
-- * Export of this software from the United States of America may require
-- * a specific license from the United States Government.  It is the
-- * responsibility of any person or organization contemplating export to
-- * obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of FundsXpress. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  FundsXpress makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- *
-- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
-- * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
-- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
-- */
--
--#include "crypto_int.h"
--
--static krb5_error_code
--k5_crc32_hash(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
--{
--    unsigned long c;
--    unsigned int i;
--
--    if (output->length != CRC32_CKSUM_LENGTH)
--        return KRB5_CRYPTO_INTERNAL;
--
--    c = 0;
--    for (i = 0; i < num_data; i++) {
--        const krb5_crypto_iov *iov = &data[i];
--
--        if (SIGN_IOV(iov))
--            mit_crc32(iov->data.data, iov->data.length, &c);
--    }
--
--    store_32_le(c, output->data);
--    return 0;
--}
--
--const struct krb5_hash_provider krb5int_hash_crc32 = {
--    "CRC32",
--    CRC32_CKSUM_LENGTH,
--    1,
--    k5_crc32_hash
--};
-diff --git a/src/lib/crypto/krb/Makefile.in b/src/lib/crypto/krb/Makefile.in
-index fc01a2ced..c0e0b791b 100644
---- a/src/lib/crypto/krb/Makefile.in
-+++ b/src/lib/crypto/krb/Makefile.in
-@@ -23,7 +23,6 @@ STLIBOBJS=\
- 	cmac.o			\
- 	coll_proof_cksum.o	\
- 	combine_keys.o		\
--	crc32.o			\
- 	crypto_length.o		\
- 	crypto_libinit.o	\
- 	default_state.o 	\
-@@ -37,7 +36,6 @@ STLIBOBJS=\
- 	enc_dk_cmac.o		\
- 	enc_dk_hmac.o		\
- 	enc_etm.o		\
--	enc_old.o		\
- 	enc_raw.o		\
- 	enc_rc4.o		\
- 	etypes.o		\
-@@ -61,7 +59,6 @@ STLIBOBJS=\
- 	prng.o			\
- 	prng_$(PRNG_ALG).o	\
- 	random_to_key.o		\
--	s2k_des.o		\
- 	s2k_pbkdf2.o		\
- 	s2k_rc4.o		\
- 	state.o 		\
-@@ -88,7 +85,6 @@ OBJS=\
- 	$(OUTPRE)cmac.$(OBJEXT)			\
- 	$(OUTPRE)coll_proof_cksum.$(OBJEXT)	\
- 	$(OUTPRE)combine_keys.$(OBJEXT)		\
--	$(OUTPRE)crc32.$(OBJEXT)		\
- 	$(OUTPRE)crypto_length.$(OBJEXT)	\
- 	$(OUTPRE)crypto_libinit.$(OBJEXT)	\
- 	$(OUTPRE)default_state.$(OBJEXT) 	\
-@@ -102,7 +98,6 @@ OBJS=\
- 	$(OUTPRE)enc_dk_cmac.$(OBJEXT)		\
- 	$(OUTPRE)enc_dk_hmac.$(OBJEXT)		\
- 	$(OUTPRE)enc_etm.$(OBJEXT)		\
--	$(OUTPRE)enc_old.$(OBJEXT)		\
- 	$(OUTPRE)enc_raw.$(OBJEXT)		\
- 	$(OUTPRE)enc_rc4.$(OBJEXT)		\
- 	$(OUTPRE)etypes.$(OBJEXT)		\
-@@ -126,7 +121,6 @@ OBJS=\
- 	$(OUTPRE)prng.$(OBJEXT)			\
- 	$(OUTPRE)prng_$(PRNG_ALG).$(OBJEXT)	\
- 	$(OUTPRE)random_to_key.$(OBJEXT)	\
--	$(OUTPRE)s2k_des.$(OBJEXT)		\
- 	$(OUTPRE)s2k_pbkdf2.$(OBJEXT)		\
- 	$(OUTPRE)s2k_rc4.$(OBJEXT)		\
- 	$(OUTPRE)state.$(OBJEXT) 		\
-@@ -153,7 +147,6 @@ SRCS=\
- 	$(srcdir)/cmac.c		\
- 	$(srcdir)/coll_proof_cksum.c	\
- 	$(srcdir)/combine_keys.c	\
--	$(srcdir)/crc32.c		\
- 	$(srcdir)/crypto_length.c	\
- 	$(srcdir)/crypto_libinit.c	\
- 	$(srcdir)/default_state.c 	\
-@@ -167,7 +160,6 @@ SRCS=\
- 	$(srcdir)/enc_dk_cmac.c		\
- 	$(srcdir)/enc_dk_hmac.c		\
- 	$(srcdir)/enc_etm.c		\
--	$(srcdir)/enc_old.c		\
- 	$(srcdir)/enc_raw.c		\
- 	$(srcdir)/enc_rc4.c		\
- 	$(srcdir)/etypes.c		\
-@@ -192,7 +184,6 @@ SRCS=\
- 	$(srcdir)/prng_$(PRNG_ALG).c	\
- 	$(srcdir)/cf2.c 		\
- 	$(srcdir)/random_to_key.c	\
--	$(srcdir)/s2k_des.c		\
- 	$(srcdir)/s2k_pbkdf2.c		\
- 	$(srcdir)/s2k_rc4.c		\
- 	$(srcdir)/state.c 		\
-diff --git a/src/lib/crypto/krb/cksumtypes.c b/src/lib/crypto/krb/cksumtypes.c
-index 85967f9aa..ecc2e08c9 100644
---- a/src/lib/crypto/krb/cksumtypes.c
-+++ b/src/lib/crypto/krb/cksumtypes.c
-@@ -28,42 +28,18 @@
- #include "crypto_int.h"
- 
- const struct krb5_cksumtypes krb5int_cksumtypes_list[] = {
--    { CKSUMTYPE_CRC32,
--      "crc32", { 0 }, "CRC-32",
--      NULL, &krb5int_hash_crc32,
--      krb5int_unkeyed_checksum, NULL,
--      4, 4, CKSUM_UNKEYED | CKSUM_NOT_COLL_PROOF },
--
-     { CKSUMTYPE_RSA_MD4,
-       "md4", { 0 }, "RSA-MD4",
-       NULL, &krb5int_hash_md4,
-       krb5int_unkeyed_checksum, NULL,
-       16, 16, CKSUM_UNKEYED },
- 
--    { CKSUMTYPE_RSA_MD4_DES,
--      "md4-des", { 0 }, "RSA-MD4 with DES cbc mode",
--      &krb5int_enc_des, &krb5int_hash_md4,
--      krb5int_confounder_checksum, krb5int_confounder_verify,
--      24, 24, 0 },
--
--    { CKSUMTYPE_DESCBC,
--      "des-cbc", { 0 }, "DES cbc mode",
--      &krb5int_enc_des, NULL,
--      krb5int_cbc_checksum, NULL,
--      8, 8, 0 },
--
-     { CKSUMTYPE_RSA_MD5,
-       "md5", { 0 }, "RSA-MD5",
-       NULL, &krb5int_hash_md5,
-       krb5int_unkeyed_checksum, NULL,
-       16, 16, CKSUM_UNKEYED },
- 
--    { CKSUMTYPE_RSA_MD5_DES,
--      "md5-des", { 0 }, "RSA-MD5 with DES cbc mode",
--      &krb5int_enc_des, &krb5int_hash_md5,
--      krb5int_confounder_checksum, krb5int_confounder_verify,
--      24, 24, 0 },
--
-     { CKSUMTYPE_NIST_SHA,
-       "sha", { 0 }, "NIST-SHA",
-       NULL, &krb5int_hash_sha1,
-diff --git a/src/lib/crypto/krb/combine_keys.c b/src/lib/crypto/krb/combine_keys.c
-index 90905c5ae..c36434e17 100644
---- a/src/lib/crypto/krb/combine_keys.c
-+++ b/src/lib/crypto/krb/combine_keys.c
-@@ -60,9 +60,6 @@ static krb5_boolean
- enctype_ok(krb5_enctype e)
- {
-     switch (e) {
--    case ENCTYPE_DES_CBC_CRC:
--    case ENCTYPE_DES_CBC_MD4:
--    case ENCTYPE_DES_CBC_MD5:
-     case ENCTYPE_DES3_CBC_SHA1:
-         return TRUE;
-     default:
-diff --git a/src/lib/crypto/krb/crc32.c b/src/lib/crypto/krb/crc32.c
-deleted file mode 100644
-index 11fe312da..000000000
---- a/src/lib/crypto/krb/crc32.c
-+++ /dev/null
-@@ -1,165 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/* lib/crypto/krb/crc32.c */
--/*
-- * Copyright 1990, 2002 by the Massachusetts Institute of Technology.
-- * All Rights Reserved.
-- *
-- * Export of this software from the United States of America may
-- *   require a specific license from the United States Government.
-- *   It is the responsibility of any person or organization contemplating
-- *   export to obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of M.I.T. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  Furthermore if you modify this software you must label
-- * your software as modified software and not distribute it in such a
-- * fashion that it might be confused with the original M.I.T. software.
-- * M.I.T. makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- */
--/*
-- * Copyright (C) 1986 Gary S. Brown.  You may use this program, or
-- * code or tables extracted from it, as desired without restriction.
-- */
--
--/*
-- *
-- * CRC-32/AUTODIN-II routines
-- */
--
--#include "crypto_int.h"
--
--/* First, the polynomial itself and its table of feedback terms.  The  */
--/* polynomial is                                                       */
--/* X^32+X^26+X^23+X^22+X^16+X^12+X^11+X^10+X^8+X^7+X^5+X^4+X^2+X^1+X^0 */
--/* Note that we take it "backwards" and put the highest-order term in  */
--/* the lowest-order bit.  The X^32 term is "implied"; the LSB is the   */
--/* X^31 term, etc.  The X^0 term (usually shown as "+1") results in    */
--/* the MSB being 1.                                                    */
--
--/* Note that the usual hardware shift register implementation, which   */
--/* is what we're using (we're merely optimizing it by doing eight-bit  */
--/* chunks at a time) shifts bits into the lowest-order term.  In our   */
--/* implementation, that means shifting towards the right.  Why do we   */
--/* do it this way?  Because the calculated CRC must be transmitted in  */
--/* order from highest-order term to lowest-order term.  UARTs transmit */
--/* characters in order from LSB to MSB.  By storing the CRC this way,  */
--/* we hand it to the UART in the order low-byte to high-byte; the UART */
--/* sends each low-bit to hight-bit; and the result is transmission bit */
--/* by bit from highest- to lowest-order term without requiring any bit */
--/* shuffling on our part.  Reception works similarly.                  */
--
--/* The feedback terms table consists of 256, 32-bit entries.  Notes:   */
--/*                                                                     */
--/*  1. The table can be generated at runtime if desired; code to do so */
--/*     is shown later.  It might not be obvious, but the feedback      */
--/*     terms simply represent the results of eight shift/xor opera-    */
--/*     tions for all combinations of data and CRC register values.     */
--/*                                                                     */
--/*  2. The CRC accumulation logic is the same for all CRC polynomials, */
--/*     be they sixteen or thirty-two bits wide.  You simply choose the */
--/*     appropriate table.  Alternatively, because the table can be     */
--/*     generated at runtime, you can start by generating the table for */
--/*     the polynomial in question and use exactly the same "updcrc",   */
--/*     if your application needn't simultaneously handle two CRC       */
--/*     polynomials.  (Note, however, that XMODEM is strange.)          */
--/*                                                                     */
--/*  3. For 16-bit CRCs, the table entries need be only 16 bits wide;   */
--/*     of course, 32-bit entries work OK if the high 16 bits are zero. */
--/*                                                                     */
--/*  4. The values must be right-shifted by eight bits by the "updcrc"  */
--/*     logic; the shift must be unsigned (bring in zeroes).  On some   */
--/*     hardware you could probably optimize the shift in assembler by  */
--/*     using byte-swap instructions.                                   */
--
--static u_long const crc_table[256] = {
--    0x00000000, 0x77073096, 0xee0e612c, 0x990951ba,
--    0x076dc419, 0x706af48f, 0xe963a535, 0x9e6495a3,
--    0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988,
--    0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91,
--    0x1db71064, 0x6ab020f2, 0xf3b97148, 0x84be41de,
--    0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7,
--    0x136c9856, 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec,
--    0x14015c4f, 0x63066cd9, 0xfa0f3d63, 0x8d080df5,
--    0x3b6e20c8, 0x4c69105e, 0xd56041e4, 0xa2677172,
--    0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b,
--    0x35b5a8fa, 0x42b2986c, 0xdbbbc9d6, 0xacbcf940,
--    0x32d86ce3, 0x45df5c75, 0xdcd60dcf, 0xabd13d59,
--    0x26d930ac, 0x51de003a, 0xc8d75180, 0xbfd06116,
--    0x21b4f4b5, 0x56b3c423, 0xcfba9599, 0xb8bda50f,
--    0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924,
--    0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d,
--    0x76dc4190, 0x01db7106, 0x98d220bc, 0xefd5102a,
--    0x71b18589, 0x06b6b51f, 0x9fbfe4a5, 0xe8b8d433,
--    0x7807c9a2, 0x0f00f934, 0x9609a88e, 0xe10e9818,
--    0x7f6a0dbb, 0x086d3d2d, 0x91646c97, 0xe6635c01,
--    0x6b6b51f4, 0x1c6c6162, 0x856530d8, 0xf262004e,
--    0x6c0695ed, 0x1b01a57b, 0x8208f4c1, 0xf50fc457,
--    0x65b0d9c6, 0x12b7e950, 0x8bbeb8ea, 0xfcb9887c,
--    0x62dd1ddf, 0x15da2d49, 0x8cd37cf3, 0xfbd44c65,
--    0x4db26158, 0x3ab551ce, 0xa3bc0074, 0xd4bb30e2,
--    0x4adfa541, 0x3dd895d7, 0xa4d1c46d, 0xd3d6f4fb,
--    0x4369e96a, 0x346ed9fc, 0xad678846, 0xda60b8d0,
--    0x44042d73, 0x33031de5, 0xaa0a4c5f, 0xdd0d7cc9,
--    0x5005713c, 0x270241aa, 0xbe0b1010, 0xc90c2086,
--    0x5768b525, 0x206f85b3, 0xb966d409, 0xce61e49f,
--    0x5edef90e, 0x29d9c998, 0xb0d09822, 0xc7d7a8b4,
--    0x59b33d17, 0x2eb40d81, 0xb7bd5c3b, 0xc0ba6cad,
--    0xedb88320, 0x9abfb3b6, 0x03b6e20c, 0x74b1d29a,
--    0xead54739, 0x9dd277af, 0x04db2615, 0x73dc1683,
--    0xe3630b12, 0x94643b84, 0x0d6d6a3e, 0x7a6a5aa8,
--    0xe40ecf0b, 0x9309ff9d, 0x0a00ae27, 0x7d079eb1,
--    0xf00f9344, 0x8708a3d2, 0x1e01f268, 0x6906c2fe,
--    0xf762575d, 0x806567cb, 0x196c3671, 0x6e6b06e7,
--    0xfed41b76, 0x89d32be0, 0x10da7a5a, 0x67dd4acc,
--    0xf9b9df6f, 0x8ebeeff9, 0x17b7be43, 0x60b08ed5,
--    0xd6d6a3e8, 0xa1d1937e, 0x38d8c2c4, 0x4fdff252,
--    0xd1bb67f1, 0xa6bc5767, 0x3fb506dd, 0x48b2364b,
--    0xd80d2bda, 0xaf0a1b4c, 0x36034af6, 0x41047a60,
--    0xdf60efc3, 0xa867df55, 0x316e8eef, 0x4669be79,
--    0xcb61b38c, 0xbc66831a, 0x256fd2a0, 0x5268e236,
--    0xcc0c7795, 0xbb0b4703, 0x220216b9, 0x5505262f,
--    0xc5ba3bbe, 0xb2bd0b28, 0x2bb45a92, 0x5cb36a04,
--    0xc2d7ffa7, 0xb5d0cf31, 0x2cd99e8b, 0x5bdeae1d,
--    0x9b64c2b0, 0xec63f226, 0x756aa39c, 0x026d930a,
--    0x9c0906a9, 0xeb0e363f, 0x72076785, 0x05005713,
--    0x95bf4a82, 0xe2b87a14, 0x7bb12bae, 0x0cb61b38,
--    0x92d28e9b, 0xe5d5be0d, 0x7cdcefb7, 0x0bdbdf21,
--    0x86d3d2d4, 0xf1d4e242, 0x68ddb3f8, 0x1fda836e,
--    0x81be16cd, 0xf6b9265b, 0x6fb077e1, 0x18b74777,
--    0x88085ae6, 0xff0f6a70, 0x66063bca, 0x11010b5c,
--    0x8f659eff, 0xf862ae69, 0x616bffd3, 0x166ccf45,
--    0xa00ae278, 0xd70dd2ee, 0x4e048354, 0x3903b3c2,
--    0xa7672661, 0xd06016f7, 0x4969474d, 0x3e6e77db,
--    0xaed16a4a, 0xd9d65adc, 0x40df0b66, 0x37d83bf0,
--    0xa9bcae53, 0xdebb9ec5, 0x47b2cf7f, 0x30b5ffe9,
--    0xbdbdf21c, 0xcabac28a, 0x53b39330, 0x24b4a3a6,
--    0xbad03605, 0xcdd70693, 0x54de5729, 0x23d967bf,
--    0xb3667a2e, 0xc4614ab8, 0x5d681b02, 0x2a6f2b94,
--    0xb40bbe37, 0xc30c8ea1, 0x5a05df1b, 0x2d02ef8d
--};
--
--void
--mit_crc32(krb5_pointer in, size_t in_length, unsigned long *cksum)
--{
--    u_char *data;
--    u_long c = *cksum;
--    int idx;
--    size_t i;
--
--    data = (u_char *)in;
--    for (i = 0; i < in_length; i++) {
--        idx = (int) (data[i] ^ c);
--        idx &= 0xff;
--        c >>= 8;
--        c ^= crc_table[idx];
--    }
--
--    *cksum = c;
--}
-diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h
-index 6c1c77cac..b18d5e2e3 100644
---- a/src/lib/crypto/krb/crypto_int.h
-+++ b/src/lib/crypto/krb/crypto_int.h
-@@ -180,8 +180,6 @@ extern const size_t krb5int_cksumtypes_length;
- /*** Prototypes for enctype table functions ***/
- 
- /* Length */
--unsigned int krb5int_old_crypto_length(const struct krb5_keytypes *ktp,
--                                       krb5_cryptotype type);
- unsigned int krb5int_raw_crypto_length(const struct krb5_keytypes *ktp,
-                                        krb5_cryptotype type);
- unsigned int krb5int_arcfour_crypto_length(const struct krb5_keytypes *ktp,
-@@ -196,10 +194,6 @@ unsigned int krb5int_aes2_crypto_length(const struct krb5_keytypes *ktp,
-                                         krb5_cryptotype type);
- 
- /* Encrypt */
--krb5_error_code krb5int_old_encrypt(const struct krb5_keytypes *ktp,
--                                    krb5_key key, krb5_keyusage usage,
--                                    const krb5_data *ivec,
--                                    krb5_crypto_iov *data, size_t num_data);
- krb5_error_code krb5int_raw_encrypt(const struct krb5_keytypes *ktp,
-                                     krb5_key key, krb5_keyusage usage,
-                                     const krb5_data *ivec,
-@@ -224,10 +218,6 @@ krb5_error_code krb5int_etm_encrypt(const struct krb5_keytypes *ktp,
-                                     krb5_crypto_iov *data, size_t num_data);
- 
- /* Decrypt */
--krb5_error_code krb5int_old_decrypt(const struct krb5_keytypes *ktp,
--                                    krb5_key key, krb5_keyusage usage,
--                                    const krb5_data *ivec,
--                                    krb5_crypto_iov *data, size_t num_data);
- krb5_error_code krb5int_raw_decrypt(const struct krb5_keytypes *ktp,
-                                     krb5_key key, krb5_keyusage usage,
-                                     const krb5_data *ivec,
-@@ -388,10 +378,6 @@ krb5_error_code krb5int_cmac_checksum(const struct krb5_enc_provider *enc,
-                                       size_t num_data,
-                                       krb5_data *output);
- 
--/* Compute a CRC-32 checksum.  c is in-out to allow chaining; init to 0. */
--#define CRC32_CKSUM_LENGTH 4
--void mit_crc32(krb5_pointer in, size_t in_length, unsigned long *c);
--
- /* Translate an RFC 3961 key usage to a Microsoft RC4 usage. */
- krb5_keyusage krb5int_arcfour_translate_usage(krb5_keyusage usage);
- 
-@@ -455,7 +441,6 @@ void k5_iov_cursor_put(struct iov_cursor *cursor, unsigned char *block);
- /* Modules must implement the k5_sha256() function prototyped in k5-int.h. */
- 
- /* Modules must implement the following enc_providers and hash_providers: */
--extern const struct krb5_enc_provider krb5int_enc_des;
- extern const struct krb5_enc_provider krb5int_enc_des3;
- extern const struct krb5_enc_provider krb5int_enc_arcfour;
- extern const struct krb5_enc_provider krb5int_enc_aes128;
-@@ -465,7 +450,6 @@ extern const struct krb5_enc_provider krb5int_enc_aes256_ctr;
- extern const struct krb5_enc_provider krb5int_enc_camellia128;
- extern const struct krb5_enc_provider krb5int_enc_camellia256;
- 
--extern const struct krb5_hash_provider krb5int_hash_crc32;
- extern const struct krb5_hash_provider krb5int_hash_md4;
- extern const struct krb5_hash_provider krb5int_hash_md5;
- extern const struct krb5_hash_provider krb5int_hash_sha1;
-diff --git a/src/lib/crypto/krb/default_state.c b/src/lib/crypto/krb/default_state.c
-index c7bfe323f..0757c8b02 100644
---- a/src/lib/crypto/krb/default_state.c
-+++ b/src/lib/crypto/krb/default_state.c
-@@ -39,10 +39,6 @@ krb5int_des_init_state(const krb5_keyblock *key, krb5_keyusage usage,
-     if (alloc_data(state_out, 8))
-         return ENOMEM;
- 
--    /* des-cbc-crc uses the key as the initial ivec. */
--    if (key->enctype == ENCTYPE_DES_CBC_CRC)
--        memcpy(state_out->data, key->contents, state_out->length);
--
-     return 0;
- }
- 
-diff --git a/src/lib/crypto/krb/deps b/src/lib/crypto/krb/deps
-index 2a7f9b0ef..f9a740860 100644
---- a/src/lib/crypto/krb/deps
-+++ b/src/lib/crypto/krb/deps
-@@ -204,18 +204,6 @@ combine_keys.so combine_keys.po $(OUTPRE)combine_keys.$(OBJEXT): \
-   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-   $(top_srcdir)/include/socket-utils.h combine_keys.c \
-   crypto_int.h
--crc32.so crc32.po $(OUTPRE)crc32.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
--  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
--  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
--  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  crc32.c crypto_int.h
- crypto_length.so crypto_length.po $(OUTPRE)crypto_length.$(OBJEXT): \
-   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-@@ -372,18 +360,6 @@ enc_etm.so enc_etm.po $(OUTPRE)enc_etm.$(OBJEXT): $(BUILDTOP)/include/autoconf.h
-   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
-   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-   crypto_int.h enc_etm.c
--enc_old.so enc_old.po $(OUTPRE)enc_old.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
--  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
--  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
--  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  crypto_int.h enc_old.c
- enc_raw.so enc_raw.po $(OUTPRE)enc_raw.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-@@ -660,18 +636,6 @@ random_to_key.so random_to_key.po $(OUTPRE)random_to_key.$(OBJEXT): \
-   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-   $(top_srcdir)/include/socket-utils.h crypto_int.h random_to_key.c
--s2k_des.so s2k_des.po $(OUTPRE)s2k_des.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
--  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
--  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
--  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  crypto_int.h s2k_des.c
- s2k_pbkdf2.so s2k_pbkdf2.po $(OUTPRE)s2k_pbkdf2.$(OBJEXT): \
-   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-diff --git a/src/lib/crypto/krb/enc_old.c b/src/lib/crypto/krb/enc_old.c
-deleted file mode 100644
-index 1b02a5915..000000000
---- a/src/lib/crypto/krb/enc_old.c
-+++ /dev/null
-@@ -1,181 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/* lib/crypto/krb/enc_old.c */
--/*
-- * Copyright 2008 by the Massachusetts Institute of Technology.
-- * All Rights Reserved.
-- *
-- * Export of this software from the United States of America may
-- *   require a specific license from the United States Government.
-- *   It is the responsibility of any person or organization contemplating
-- *   export to obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of M.I.T. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  Furthermore if you modify this software you must label
-- * your software as modified software and not distribute it in such a
-- * fashion that it might be confused with the original M.I.T. software.
-- * M.I.T. makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- */
--
--#include "crypto_int.h"
--
--unsigned int
--krb5int_old_crypto_length(const struct krb5_keytypes *ktp,
--                          krb5_cryptotype type)
--{
--    switch (type) {
--    case KRB5_CRYPTO_TYPE_HEADER:
--        return ktp->enc->block_size + ktp->hash->hashsize;
--    case KRB5_CRYPTO_TYPE_PADDING:
--        return ktp->enc->block_size;
--    case KRB5_CRYPTO_TYPE_TRAILER:
--        return 0;
--    case KRB5_CRYPTO_TYPE_CHECKSUM:
--        return ktp->hash->hashsize;
--    default:
--        assert(0 && "invalid cryptotype passed to krb5int_old_crypto_length");
--        return 0;
--    }
--}
--
--krb5_error_code
--krb5int_old_encrypt(const struct krb5_keytypes *ktp, krb5_key key,
--                    krb5_keyusage usage, const krb5_data *ivec,
--                    krb5_crypto_iov *data, size_t num_data)
--{
--    const struct krb5_enc_provider *enc = ktp->enc;
--    const struct krb5_hash_provider *hash = ktp->hash;
--    krb5_error_code ret;
--    krb5_crypto_iov *header, *trailer, *padding;
--    krb5_data checksum, confounder, crcivec = empty_data();
--    unsigned int plainlen, padsize;
--    size_t i;
--
--    /* E(Confounder | Checksum | Plaintext | Pad) */
--
--    plainlen = enc->block_size + hash->hashsize;
--    for (i = 0; i < num_data; i++) {
--        krb5_crypto_iov *iov = &data[i];
--
--        if (iov->flags == KRB5_CRYPTO_TYPE_DATA)
--            plainlen += iov->data.length;
--    }
--
--    header = krb5int_c_locate_iov(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
--    if (header == NULL ||
--        header->data.length < enc->block_size + hash->hashsize)
--        return KRB5_BAD_MSIZE;
--
--    /* Trailer may be absent. */
--    trailer = krb5int_c_locate_iov(data, num_data, KRB5_CRYPTO_TYPE_TRAILER);
--    if (trailer != NULL)
--        trailer->data.length = 0;
--
--    /* Check that the input data is correctly padded. */
--    padsize = krb5_roundup(plainlen, enc->block_size) - plainlen;
--    padding = krb5int_c_locate_iov(data, num_data, KRB5_CRYPTO_TYPE_PADDING);
--    if (padsize > 0 && (padding == NULL || padding->data.length < padsize))
--        return KRB5_BAD_MSIZE;
--    if (padding) {
--        padding->data.length = padsize;
--        memset(padding->data.data, 0, padsize);
--    }
--
--    /* Generate a confounder in the header block. */
--    confounder = make_data(header->data.data, enc->block_size);
--    ret = krb5_c_random_make_octets(0, &confounder);
--    if (ret != 0)
--        goto cleanup;
--    checksum = make_data(header->data.data + enc->block_size, hash->hashsize);
--    memset(checksum.data, 0, hash->hashsize);
--
--    /* Checksum the plaintext with zeroed checksum and padding. */
--    ret = hash->hash(data, num_data, &checksum);
--    if (ret != 0)
--        goto cleanup;
--
--    /* Use the key as the ivec for des-cbc-crc if none was provided. */
--    if (key->keyblock.enctype == ENCTYPE_DES_CBC_CRC && ivec == NULL) {
--        ret = alloc_data(&crcivec, key->keyblock.length);
--        if (ret != 0)
--            goto cleanup;
--        memcpy(crcivec.data, key->keyblock.contents, key->keyblock.length);
--        ivec = &crcivec;
--    }
--
--    ret = enc->encrypt(key, ivec, data, num_data);
--    if (ret != 0)
--        goto cleanup;
--
--cleanup:
--    zapfree(crcivec.data, crcivec.length);
--    return ret;
--}
--
--krb5_error_code
--krb5int_old_decrypt(const struct krb5_keytypes *ktp, krb5_key key,
--                    krb5_keyusage usage, const krb5_data *ivec,
--                    krb5_crypto_iov *data, size_t num_data)
--{
--    const struct krb5_enc_provider *enc = ktp->enc;
--    const struct krb5_hash_provider *hash = ktp->hash;
--    krb5_error_code ret;
--    krb5_crypto_iov *header, *trailer;
--    krb5_data checksum, crcivec = empty_data();
--    char *saved_checksum = NULL;
--
--    /* Check that the input data is correctly padded. */
--    if (iov_total_length(data, num_data, FALSE) % enc->block_size != 0)
--        return KRB5_BAD_MSIZE;
--
--    header = krb5int_c_locate_iov(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
--    if (header == NULL ||
--        header->data.length != enc->block_size + hash->hashsize)
--        return KRB5_BAD_MSIZE;
--
--    trailer = krb5int_c_locate_iov(data, num_data, KRB5_CRYPTO_TYPE_TRAILER);
--    if (trailer != NULL && trailer->data.length != 0)
--        return KRB5_BAD_MSIZE;
--
--    /* Use the key as the ivec for des-cbc-crc if none was provided. */
--    if (key->keyblock.enctype == ENCTYPE_DES_CBC_CRC && ivec == NULL) {
--        ret = alloc_data(&crcivec, key->keyblock.length);
--        memcpy(crcivec.data, key->keyblock.contents, key->keyblock.length);
--        ivec = &crcivec;
--    }
--
--    /* Decrypt the ciphertext. */
--    ret = enc->decrypt(key, ivec, data, num_data);
--    if (ret != 0)
--        goto cleanup;
--
--    /* Save the checksum, then zero it out in the plaintext. */
--    checksum = make_data(header->data.data + enc->block_size, hash->hashsize);
--    saved_checksum = k5memdup(checksum.data, checksum.length, &ret);
--    if (saved_checksum == NULL)
--        goto cleanup;
--    memset(checksum.data, 0, checksum.length);
--
--    /*
--     * Checksum the plaintext (with zeroed checksum field), storing the result
--     * back into the plaintext field we just zeroed out.  Then compare it to
--     * the saved checksum.
--     */
--    ret = hash->hash(data, num_data, &checksum);
--    if (k5_bcmp(checksum.data, saved_checksum, checksum.length) != 0) {
--        ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
--        goto cleanup;
--    }
--
--cleanup:
--    zapfree(crcivec.data, crcivec.length);
--    zapfree(saved_checksum, hash->hashsize);
--    return ret;
--}
-diff --git a/src/lib/crypto/krb/etypes.c b/src/lib/crypto/krb/etypes.c
-index 8f44c37e7..fc278783b 100644
---- a/src/lib/crypto/krb/etypes.c
-+++ b/src/lib/crypto/krb/etypes.c
-@@ -35,42 +35,6 @@
- 
- /* Deprecations come from RFC 6649 and RFC 8249. */
- const struct krb5_keytypes krb5int_enctypes_list[] = {
--    { ENCTYPE_DES_CBC_CRC,
--      "des-cbc-crc", { 0 }, "DES cbc mode with CRC-32",
--      &krb5int_enc_des, &krb5int_hash_crc32,
--      16,
--      krb5int_old_crypto_length, krb5int_old_encrypt, krb5int_old_decrypt,
--      krb5int_des_string_to_key, k5_rand2key_des,
--      krb5int_des_prf,
--      CKSUMTYPE_RSA_MD5_DES,
--      ETYPE_WEAK | ETYPE_DEPRECATED, 56 },
--    { ENCTYPE_DES_CBC_MD4,
--      "des-cbc-md4", { 0 }, "DES cbc mode with RSA-MD4",
--      &krb5int_enc_des, &krb5int_hash_md4,
--      16,
--      krb5int_old_crypto_length, krb5int_old_encrypt, krb5int_old_decrypt,
--      krb5int_des_string_to_key, k5_rand2key_des,
--      krb5int_des_prf,
--      CKSUMTYPE_RSA_MD4_DES,
--      ETYPE_WEAK | ETYPE_DEPRECATED, 56 },
--    { ENCTYPE_DES_CBC_MD5,
--      "des-cbc-md5", { "des" }, "DES cbc mode with RSA-MD5",
--      &krb5int_enc_des, &krb5int_hash_md5,
--      16,
--      krb5int_old_crypto_length, krb5int_old_encrypt, krb5int_old_decrypt,
--      krb5int_des_string_to_key, k5_rand2key_des,
--      krb5int_des_prf,
--      CKSUMTYPE_RSA_MD5_DES,
--      ETYPE_WEAK | ETYPE_DEPRECATED, 56 },
--    { ENCTYPE_DES_CBC_RAW,
--      "des-cbc-raw", { 0 }, "DES cbc mode raw",
--      &krb5int_enc_des, NULL,
--      16,
--      krb5int_raw_crypto_length, krb5int_raw_encrypt, krb5int_raw_decrypt,
--      krb5int_des_string_to_key, k5_rand2key_des,
--      krb5int_des_prf,
--      0,
--      ETYPE_WEAK | ETYPE_DEPRECATED, 56 },
-     { ENCTYPE_DES3_CBC_RAW,
-       "des3-cbc-raw", { 0 }, "Triple DES cbc mode raw",
-       &krb5int_enc_des3, NULL,
-@@ -92,16 +56,6 @@ const struct krb5_keytypes krb5int_enctypes_list[] = {
-       CKSUMTYPE_HMAC_SHA1_DES3,
-       ETYPE_DEPRECATED, 112 },
- 
--    { ENCTYPE_DES_HMAC_SHA1,
--      "des-hmac-sha1", { 0 }, "DES with HMAC/sha1",
--      &krb5int_enc_des, &krb5int_hash_sha1,
--      8,
--      krb5int_dk_crypto_length, krb5int_dk_encrypt, krb5int_dk_decrypt,
--      krb5int_dk_string_to_key, k5_rand2key_des,
--      NULL, /*PRF*/
--      0,
--      ETYPE_WEAK | ETYPE_DEPRECATED, 56 },
--
-     /* rc4-hmac uses a 128-bit key, but due to weaknesses in the RC4 cipher, we
-      * consider its strength degraded and assign it an SSF value of 64. */
-     { ENCTYPE_ARCFOUR_HMAC,
-diff --git a/src/lib/crypto/krb/s2k_des.c b/src/lib/crypto/krb/s2k_des.c
-deleted file mode 100644
-index d5c29befc..000000000
---- a/src/lib/crypto/krb/s2k_des.c
-+++ /dev/null
-@@ -1,691 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/*
-- * Copyright (C) 1998 by the FundsXpress, INC.
-- *
-- * All rights reserved.
-- *
-- * Export of this software from the United States of America may require
-- * a specific license from the United States Government.  It is the
-- * responsibility of any person or organization contemplating export to
-- * obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of FundsXpress. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  FundsXpress makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- *
-- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
-- * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
-- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
-- */
--
--/*
-- * RFC 3961 and AFS string to key.  These are not standard crypto primitives
-- * (RFC 3961 string-to-key is implemented in OpenSSL for historical reasons but
-- * it doesn't get weak keys right), so we have to implement them here.
-- */
--
--#include <ctype.h>
--#include "crypto_int.h"
--
--#undef min
--#define min(a,b) ((a)>(b)?(b):(a))
--
--/* Compute a CBC checksum of in (with length len) using the specified key and
-- * ivec.  The result is written into out. */
--static krb5_error_code
--des_cbc_mac(const unsigned char *keybits, const unsigned char *ivec,
--            const unsigned char *in, size_t len, unsigned char *out)
--{
--    krb5_error_code ret;
--    krb5_keyblock kb;
--    krb5_key key;
--    krb5_crypto_iov iov[2];
--    unsigned char zero[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
--    krb5_data outd, ivecd;
--
--    /* Make a key from keybits. */
--    kb.magic = KV5M_KEYBLOCK;
--    kb.enctype = ENCTYPE_DES_CBC_CRC;
--    kb.length = 8;
--    kb.contents = (unsigned char *)keybits;
--    ret = krb5_k_create_key(NULL, &kb, &key);
--    if (ret)
--        return ret;
--
--    /* Make iovs for the input data, padding it out to the block size. */
--    iov[0].flags = KRB5_CRYPTO_TYPE_DATA;
--    iov[0].data = make_data((unsigned char *)in, len);
--    iov[1].flags = KRB5_CRYPTO_TYPE_DATA;
--    iov[1].data = make_data(zero, krb5_roundup(len, 8) - len);
--
--    /* Make krb5_data structures for the ivec and output. */
--    ivecd = make_data((unsigned char *)ivec, 8);
--    outd = make_data(out, 8);
--
--    /* Call the cbc_mac operation of the module's DES enc-provider. */
--    ret = krb5int_enc_des.cbc_mac(key, iov, 2, &ivecd, &outd);
--    krb5_k_free_key(NULL, key);
--    return ret;
--}
--
--/*** AFS string-to-key constants ***/
--
--/* Initial permutation */
--static const char IP[] = {
--    58,50,42,34,26,18,10, 2,
--    60,52,44,36,28,20,12, 4,
--    62,54,46,38,30,22,14, 6,
--    64,56,48,40,32,24,16, 8,
--    57,49,41,33,25,17, 9, 1,
--    59,51,43,35,27,19,11, 3,
--    61,53,45,37,29,21,13, 5,
--    63,55,47,39,31,23,15, 7,
--};
--
--/* Final permutation, FP = IP^(-1) */
--static const char FP[] = {
--    40, 8,48,16,56,24,64,32,
--    39, 7,47,15,55,23,63,31,
--    38, 6,46,14,54,22,62,30,
--    37, 5,45,13,53,21,61,29,
--    36, 4,44,12,52,20,60,28,
--    35, 3,43,11,51,19,59,27,
--    34, 2,42,10,50,18,58,26,
--    33, 1,41, 9,49,17,57,25,
--};
--
--/*
-- * Permuted-choice 1 from the key bits to yield C and D.
-- * Note that bits 8,16... are left out: They are intended for a parity check.
-- */
--static const char PC1_C[] = {
--    57,49,41,33,25,17, 9,
--    1,58,50,42,34,26,18,
--    10, 2,59,51,43,35,27,
--    19,11, 3,60,52,44,36,
--};
--
--static const char PC1_D[] = {
--    63,55,47,39,31,23,15,
--    7,62,54,46,38,30,22,
--    14, 6,61,53,45,37,29,
--    21,13, 5,28,20,12, 4,
--};
--
--/* Sequence of shifts used for the key schedule */
--static const char shifts[] = {
--    1,1,2,2,2,2,2,2,1,2,2,2,2,2,2,1,
--};
--
--/* Permuted-choice 2, to pick out the bits from the CD array that generate the
-- * key schedule */
--static const char PC2_C[] = {
--    14,17,11,24, 1, 5,
--    3,28,15, 6,21,10,
--    23,19,12, 4,26, 8,
--    16, 7,27,20,13, 2,
--};
--
--static const char PC2_D[] = {
--    41,52,31,37,47,55,
--    30,40,51,45,33,48,
--    44,49,39,56,34,53,
--    46,42,50,36,29,32,
--};
--
--/* The E bit-selection table */
--static const char e[] = {
--    32, 1, 2, 3, 4, 5,
--    4, 5, 6, 7, 8, 9,
--    8, 9,10,11,12,13,
--    12,13,14,15,16,17,
--    16,17,18,19,20,21,
--    20,21,22,23,24,25,
--    24,25,26,27,28,29,
--    28,29,30,31,32, 1,
--};
--
--/* P is a permutation on the selected combination of the current L and key. */
--static const char P[] = {
--    16, 7,20,21,
--    29,12,28,17,
--    1,15,23,26,
--    5,18,31,10,
--    2, 8,24,14,
--    32,27, 3, 9,
--    19,13,30, 6,
--    22,11, 4,25,
--};
--
--/*
-- * The 8 selection functions.
-- * For some reason, they give a 0-origin
-- * index, unlike everything else.
-- */
--static const char S[8][64] = {
--    {14, 4,13, 1, 2,15,11, 8, 3,10, 6,12, 5, 9, 0, 7,
--     0,15, 7, 4,14, 2,13, 1,10, 6,12,11, 9, 5, 3, 8,
--     4, 1,14, 8,13, 6, 2,11,15,12, 9, 7, 3,10, 5, 0,
--     15,12, 8, 2, 4, 9, 1, 7, 5,11, 3,14,10, 0, 6,13},
--
--    {15, 1, 8,14, 6,11, 3, 4, 9, 7, 2,13,12, 0, 5,10,
--     3,13, 4, 7,15, 2, 8,14,12, 0, 1,10, 6, 9,11, 5,
--     0,14, 7,11,10, 4,13, 1, 5, 8,12, 6, 9, 3, 2,15,
--     13, 8,10, 1, 3,15, 4, 2,11, 6, 7,12, 0, 5,14, 9},
--
--    {10, 0, 9,14, 6, 3,15, 5, 1,13,12, 7,11, 4, 2, 8,
--     13, 7, 0, 9, 3, 4, 6,10, 2, 8, 5,14,12,11,15, 1,
--     13, 6, 4, 9, 8,15, 3, 0,11, 1, 2,12, 5,10,14, 7,
--     1,10,13, 0, 6, 9, 8, 7, 4,15,14, 3,11, 5, 2,12},
--
--    { 7,13,14, 3, 0, 6, 9,10, 1, 2, 8, 5,11,12, 4,15,
--      13, 8,11, 5, 6,15, 0, 3, 4, 7, 2,12, 1,10,14, 9,
--      10, 6, 9, 0,12,11, 7,13,15, 1, 3,14, 5, 2, 8, 4,
--      3,15, 0, 6,10, 1,13, 8, 9, 4, 5,11,12, 7, 2,14},
--
--    { 2,12, 4, 1, 7,10,11, 6, 8, 5, 3,15,13, 0,14, 9,
--      14,11, 2,12, 4, 7,13, 1, 5, 0,15,10, 3, 9, 8, 6,
--      4, 2, 1,11,10,13, 7, 8,15, 9,12, 5, 6, 3, 0,14,
--      11, 8,12, 7, 1,14, 2,13, 6,15, 0, 9,10, 4, 5, 3},
--
--    {12, 1,10,15, 9, 2, 6, 8, 0,13, 3, 4,14, 7, 5,11,
--     10,15, 4, 2, 7,12, 9, 5, 6, 1,13,14, 0,11, 3, 8,
--     9,14,15, 5, 2, 8,12, 3, 7, 0, 4,10, 1,13,11, 6,
--     4, 3, 2,12, 9, 5,15,10,11,14, 1, 7, 6, 0, 8,13},
--
--    { 4,11, 2,14,15, 0, 8,13, 3,12, 9, 7, 5,10, 6, 1,
--      13, 0,11, 7, 4, 9, 1,10,14, 3, 5,12, 2,15, 8, 6,
--      1, 4,11,13,12, 3, 7,14,10,15, 6, 8, 0, 5, 9, 2,
--      6,11,13, 8, 1, 4,10, 7, 9, 5, 0,15,14, 2, 3,12},
--
--    {13, 2, 8, 4, 6,15,11, 1,10, 9, 3,14, 5, 0,12, 7,
--     1,15,13, 8,10, 3, 7, 4,12, 5, 6,11, 0,14, 9, 2,
--     7,11, 4, 1, 9,12,14, 2, 0, 6,10,13,15, 3, 5, 8,
--     2, 1,14, 7, 4,10, 8,13,15,12, 9, 0, 3, 5, 6,11},
--};
--
--
--/* Set up the key schedule from the key. */
--static void
--afs_crypt_setkey(char *key, char *E, char (*KS)[48])
--{
--    int i, j, k, t;
--    char C[28], D[28];          /* Used to calculate key schedule. */
--
--    /*
--     * First, generate C and D by permuting
--     * the key.  The low order bit of each
--     * 8-bit char is not used, so C and D are only 28
--     * bits apiece.
--     */
--    for (i = 0; i < 28; i++) {
--        C[i] = key[PC1_C[i] - 1];
--        D[i] = key[PC1_D[i] - 1];
--    }
--    /*
--     * To generate Ki, rotate C and D according
--     * to schedule and pick up a permutation
--     * using PC2.
--     */
--    for (i = 0; i < 16; i++) {
--        /* Rotate. */
--        for (k = 0; k < shifts[i]; k++) {
--            t = C[0];
--            for (j = 0; j < 28 - 1; j++)
--                C[j] = C[j + 1];
--            C[27] = t;
--            t = D[0];
--            for (j = 0; j < 28 - 1; j++)
--                D[j] = D[j + 1];
--            D[27] = t;
--        }
--        /* Get Ki.  Note C and D are concatenated. */
--        for (j = 0; j < 24; j++) {
--            KS[i][j] = C[PC2_C[j]-1];
--            KS[i][j+24] = D[PC2_D[j]-28-1];
--        }
--    }
--
--    memcpy(E, e, 48);
--}
--
--/*
-- * The payoff: encrypt a block.
-- */
--
--static void
--afs_encrypt_block(char *block, char *E, char (*KS)[48])
--{
--    const long edflag = 0;
--    int i, ii;
--    int t, j, k;
--    char tempL[32];
--    char f[32];
--    char L[64];                 /* Current block divided into two halves */
--    char *const R = &L[32];
--    /* The combination of the key and the input, before selection. */
--    char preS[48];
--
--    /* First, permute the bits in the input. */
--    for (j = 0; j < 64; j++)
--        L[j] = block[IP[j] - 1];
--    /* Perform an encryption operation 16 times. */
--    for (ii = 0; ii < 16; ii++) {
--        /* Set direction. */
--        i = (edflag) ? 15 - ii : ii;
--        /* Save the R array, which will be the new L. */
--        memcpy(tempL, R, 32);
--        /* Expand R to 48 bits using the E selector; exclusive-or with the
--         * current key bits. */
--        for (j = 0; j < 48; j++)
--            preS[j] = R[E[j] - 1] ^ KS[i][j];
--        /*
--         * The pre-select bits are now considered in 8 groups of 6 bits each.
--         * The 8 selection functions map these 6-bit quantities into 4-bit
--         * quantities and the results permuted to make an f(R, K).  The
--         * indexing into the selection functions is peculiar; it could be
--         * simplified by rewriting the tables.
--         */
--        for (j = 0; j < 8; j++) {
--            t = 6 * j;
--            k = S[j][(preS[t + 0] << 5) +
--                     (preS[t + 1] << 3) +
--                     (preS[t + 2] << 2) +
--                     (preS[t + 3] << 1) +
--                     (preS[t + 4] << 0) +
--                     (preS[t + 5] << 4)];
--            t = 4 * j;
--            f[t + 0] = (k >> 3) & 1;
--            f[t + 1] = (k >> 2) & 1;
--            f[t + 2] = (k >> 1) & 1;
--            f[t + 3] = (k >> 0) & 1;
--        }
--        /* The new R is L ^ f(R, K).  The f here has to be permuted first,
--         * though. */
--        for (j = 0; j < 32; j++)
--            R[j] = L[j] ^ f[P[j] - 1];
--        /* Finally, the new L (the original R) is copied back. */
--        memcpy(L, tempL, 32);
--    }
--    /* The output L and R are reversed. */
--    for (j = 0; j < 32; j++) {
--        t = L[j];
--        L[j] = R[j];
--        R[j] = t;
--    }
--    /* The final output gets the inverse permutation of the very original. */
--    for (j = 0; j < 64; j++)
--        block[j] = L[FP[j] - 1];
--}
--
--/* iobuf must be at least 16 bytes */
--static char *
--afs_crypt(const char *pw, const char *salt, char *iobuf)
--{
--    int i, j, c;
--    int temp;
--    char block[66];
--    char E[48];
--    char KS[16][48];            /* Key schedule, generated from key */
--
--    for (i = 0; i < 66; i++)
--        block[i] = 0;
--    for (i = 0; (c = *pw) != '\0' && i < 64; pw++){
--        for(j = 0; j < 7; j++, i++)
--            block[i] = (c >> (6 - j)) & 01;
--        i++;
--    }
--
--    afs_crypt_setkey(block, E, KS);
--
--    for (i = 0; i < 66; i++)
--        block[i] = 0;
--
--    for (i = 0; i < 2; i++) {
--        c = *salt++;
--        iobuf[i] = c;
--        if (c > 'Z')
--            c -= 6;
--        if (c > '9')
--            c -= 7;
--        c -= '.';
--        for (j = 0; j < 6; j++) {
--            if ((c >> j) & 01) {
--                temp = E[6 * i + j];
--                E[6 * i + j] = E[6 * i + j + 24];
--                E[6 * i + j + 24] = temp;
--            }
--        }
--    }
--
--    for (i = 0; i < 25; i++)
--        afs_encrypt_block(block, E, KS);
--
--    for (i = 0; i < 11; i++) {
--        c = 0;
--        for (j = 0; j < 6; j++) {
--            c <<= 1;
--            c |= block[6 * i + j];
--        }
--        c += '.';
--        if (c > '9')
--            c += 7;
--        if (c > 'Z')
--            c += 6;
--        iobuf[i + 2] = c;
--    }
--    iobuf[i + 2] = 0;
--    if (iobuf[1] == 0)
--        iobuf[1] = iobuf[0];
--    return iobuf;
--}
--
--static krb5_error_code
--afs_s2k_oneblock(const krb5_data *data, const krb5_data *salt,
--                 unsigned char *key_out)
--{
--    unsigned int i;
--    unsigned char password[9]; /* trailing nul for crypt() */
--    char afs_crypt_buf[16];
--
--    /*
--     * Run afs_crypt and use the first eight returned bytes after the copy of
--     * the (fixed) salt.
--     *
--     * Since the returned bytes are alphanumeric, the output is limited to
--     * 2**48 possibilities; for each byte, only 64 possible values can be used.
--     */
--
--    memset(password, 0, sizeof(password));
--    if (salt->length > 0)
--        memcpy(password, salt->data, min(salt->length, 8));
--    for (i = 0; i < 8; i++) {
--        if (isupper(password[i]))
--            password[i] = tolower(password[i]);
--    }
--    for (i = 0; i < data->length; i++)
--        password[i] ^= data->data[i];
--    for (i = 0; i < 8; i++) {
--        if (password[i] == '\0')
--            password[i] = 'X';
--    }
--    password[8] = '\0';
--    /* Out-of-bounds salt characters are equivalent to a salt string
--     * of "p1". */
--    strncpy((char *)key_out,
--            (char *)afs_crypt((char *)password, "#~", afs_crypt_buf) + 2, 8);
--    for (i = 0; i < 8; i++)
--        key_out[i] <<= 1;
--    /* Fix up key parity again. */
--    k5_des_fixup_key_parity(key_out);
--    zap(password, sizeof(password));
--    return 0;
--}
--
--static krb5_error_code
--afs_s2k_multiblock(const krb5_data *data, const krb5_data *salt,
--                   unsigned char *key_out)
--{
--    krb5_error_code ret;
--    unsigned char ivec[8], tkey[8], *password;
--    size_t pw_len = salt->length + data->length;
--    unsigned int i, j;
--
--    /* Do a CBC checksum, twice, and use the result as the new key.  */
--
--    password = malloc(pw_len);
--    if (!password)
--        return ENOMEM;
--
--    if (data->length > 0)
--        memcpy(password, data->data, data->length);
--    for (i = data->length, j = 0; j < salt->length; i++, j++) {
--        password[i] = salt->data[j];
--        if (isupper(password[i]))
--            password[i] = tolower(password[i]);
--    }
--
--    memcpy(ivec, "kerberos", sizeof(ivec));
--    memcpy(tkey, ivec, sizeof(tkey));
--    k5_des_fixup_key_parity(tkey);
--    ret = des_cbc_mac(tkey, ivec, password, pw_len, tkey);
--    if (ret)
--        goto cleanup;
--
--    memcpy(ivec, tkey, sizeof(ivec));
--    k5_des_fixup_key_parity(tkey);
--    ret = des_cbc_mac(tkey, ivec, password, pw_len, key_out);
--    if (ret)
--        goto cleanup;
--    k5_des_fixup_key_parity(key_out);
--
--cleanup:
--    zapfree(password, pw_len);
--    return ret;
--}
--
--static krb5_error_code
--afs_s2k(const krb5_data *data, const krb5_data *salt, unsigned char *key_out)
--{
--    if (data->length <= 8)
--        return afs_s2k_oneblock(data, salt, key_out);
--    else
--        return afs_s2k_multiblock(data, salt, key_out);
--}
--
--static krb5_error_code
--des_s2k(const krb5_data *pw, const krb5_data *salt, unsigned char *key_out)
--{
--    union {
--        /* 8 "forward" bytes, 8 "reverse" bytes */
--        unsigned char uc[16];
--        krb5_ui_4 ui[4];
--    } temp;
--    unsigned int i;
--    krb5_ui_4 x, y, z;
--    unsigned char *p, *copy;
--    size_t copylen;
--    krb5_error_code ret;
--
--    /* As long as the architecture is big-endian or little-endian, it
--       doesn't matter which it is.  Think of it as reversing the
--       bytes, and also reversing the bits within each byte.  But this
--       current algorithm is dependent on having four 8-bit char values
--       exactly overlay a 32-bit integral type.  */
--    if (sizeof(temp.uc) != sizeof(temp.ui)
--        || (unsigned char)~0 != 0xFF
--        || (krb5_ui_4)~(krb5_ui_4)0 != 0xFFFFFFFF
--        || (temp.uc[0] = 1, temp.uc[1] = 2, temp.uc[2] = 3, temp.uc[3] = 4,
--            !(temp.ui[0] == 0x01020304
--              || temp.ui[0] == 0x04030201)))
--        abort();
--#define FETCH4(VAR, IDX)        VAR = temp.ui[IDX/4]
--#define PUT4(VAR, IDX)          temp.ui[IDX/4] = VAR
--
--    copylen = pw->length + salt->length;
--    /* Don't need NUL termination, at this point we're treating it as
--       a byte array, not a string.  */
--    copy = malloc(copylen);
--    if (copy == NULL)
--        return ENOMEM;
--    if (pw->length > 0)
--        memcpy(copy, pw->data, pw->length);
--    if (salt->length > 0)
--        memcpy(copy + pw->length, salt->data, salt->length);
--
--    memset(&temp, 0, sizeof(temp));
--    p = temp.uc;
--    /* Handle the fan-fold xor operation by splitting the data into
--       forward and reverse sections, and combine them later, rather
--       than having to do the reversal over and over again.  */
--    for (i = 0; i < copylen; i++) {
--        *p++ ^= copy[i];
--        if (p == temp.uc+16) {
--            p = temp.uc;
--#ifdef PRINT_TEST_VECTORS
--            {
--                int j;
--                printf("after %d input bytes:\nforward block:\t", i+1);
--                for (j = 0; j < 8; j++)
--                    printf(" %02x", temp.uc[j] & 0xff);
--                printf("\nreverse block:\t");
--                for (j = 8; j < 16; j++)
--                    printf(" %02x", temp.uc[j] & 0xff);
--                printf("\n");
--            }
--#endif
--        }
--    }
--
--#ifdef PRINT_TEST_VECTORS
--    if (p != temp.uc) {
--        int j;
--        printf("at end, after %d input bytes:\nforward block:\t", i);
--        for (j = 0; j < 8; j++)
--            printf(" %02x", temp.uc[j] & 0xff);
--        printf("\nreverse block:\t");
--        for (j = 8; j < 16; j++)
--            printf(" %02x", temp.uc[j] & 0xff);
--        printf("\n");
--    }
--#endif
--#define REVERSE(VAR)                            \
--    {                                           \
--        krb5_ui_4 old = VAR, temp1 = 0;         \
--        int j;                                  \
--        for (j = 0; j < 32; j++) {              \
--            temp1 = (temp1 << 1) | (old & 1);   \
--            old >>= 1;                          \
--        }                                       \
--        VAR = temp1;                            \
--    }
--
--    FETCH4 (x, 8);
--    FETCH4 (y, 12);
--    /* Ignore high bits of each input byte.  */
--    x &= 0x7F7F7F7F;
--    y &= 0x7F7F7F7F;
--    /* Reverse the bit strings -- after this, y is "before" x.  */
--    REVERSE (x);
--    REVERSE (y);
--#ifdef PRINT_TEST_VECTORS
--    {
--        int j;
--        union { unsigned char uc[4]; krb5_ui_4 ui; } t2;
--        printf("after reversal, reversed block:\n\t\t");
--        t2.ui = y;
--        for (j = 0; j < 4; j++)
--            printf(" %02x", t2.uc[j] & 0xff);
--        t2.ui = x;
--        for (j = 0; j < 4; j++)
--            printf(" %02x", t2.uc[j] & 0xff);
--        printf("\n");
--    }
--#endif
--    /* Ignored bits are now at the bottom of each byte, where we'll
--     * put the parity bits.  Good.  */
--    FETCH4 (z, 0);
--    z &= 0x7F7F7F7F;
--    /* Ignored bits for z are at the top of each byte; fix that.  */
--    z <<= 1;
--    /* Finish the fan-fold xor for these four bytes.  */
--    z ^= y;
--    PUT4 (z, 0);
--    /* Now do the second four bytes.  */
--    FETCH4 (z, 4);
--    z &= 0x7F7F7F7F;
--    /* Ignored bits for z are at the top of each byte; fix that.  */
--    z <<= 1;
--    /* Finish the fan-fold xor for these four bytes.  */
--    z ^= x;
--    PUT4 (z, 4);
--
--#ifdef PRINT_TEST_VECTORS
--    {
--        int j;
--        printf("after reversal, combined block:\n\t\t");
--        for (j = 0; j < 8; j++)
--            printf(" %02x", temp.uc[j] & 0xff);
--        printf("\n");
--    }
--#endif
--
--#define FIXUP(k) (k5_des_fixup_key_parity(k),                   \
--                  k5_des_is_weak_key(k) ? (k[7] ^= 0xF0) : 0)
--
--    /* Now temp.cb is the temporary key, with invalid parity.  */
--    FIXUP(temp.uc);
--
--#ifdef PRINT_TEST_VECTORS
--    {
--        int j;
--        printf("after fixing parity and weak keys:\n\t\t");
--        for (j = 0; j < 8; j++)
--            printf(" %02x", temp.uc[j] & 0xff);
--        printf("\n");
--    }
--#endif
--
--    ret = des_cbc_mac(temp.uc, temp.uc, copy, copylen, temp.uc);
--    if (ret)
--        goto cleanup;
--
--#ifdef PRINT_TEST_VECTORS
--    {
--        int j;
--        printf("cbc checksum:\n\t\t");
--        for (j = 0; j < 8; j++)
--            printf(" %02x", temp.uc[j] & 0xff);
--        printf("\n");
--    }
--#endif
--
--    FIXUP(temp.uc);
--
--#ifdef PRINT_TEST_VECTORS
--    {
--        int j;
--        printf("after fixing parity and weak keys:\n\t\t");
--        for (j = 0; j < 8; j++)
--            printf(" %02x", temp.uc[j] & 0xff);
--        printf("\n");
--    }
--#endif
--
--    memcpy(key_out, temp.uc, 8);
--
--cleanup:
--    zap(&temp, sizeof(temp));
--    zapfree(copy, copylen);
--    return ret;
--}
--
--krb5_error_code
--krb5int_des_string_to_key(const struct krb5_keytypes *ktp,
--                          const krb5_data *string, const krb5_data *salt,
--                          const krb5_data *parm, krb5_keyblock *keyblock)
--{
--    int type;
--
--    if (parm != NULL) {
--        if (parm->length != 1)
--            return KRB5_ERR_BAD_S2K_PARAMS;
--        type = parm->data[0];
--        if (type != 0 && type != 1)
--            return KRB5_ERR_BAD_S2K_PARAMS;
--    } else
--        type = 0;
--
--    /* Use AFS string to key if we were told to. */
--    if (type == 1)
--        return afs_s2k(string, salt, keyblock->contents);
--
--    return des_s2k(string, salt, keyblock->contents);
--}
-diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports
-index 90afdf5f7..63804299f 100644
---- a/src/lib/crypto/libk5crypto.exports
-+++ b/src/lib/crypto/libk5crypto.exports
-@@ -85,7 +85,6 @@ krb5_k_prf
- krb5_k_reference_key
- krb5_k_verify_checksum
- krb5_k_verify_checksum_iov
--mit_crc32
- krb5int_aes_encrypt
- krb5int_aes_decrypt
- krb5int_enc_des3
-diff --git a/src/lib/crypto/openssl/enc_provider/Makefile.in b/src/lib/crypto/openssl/enc_provider/Makefile.in
-index b9e28c9cd..a9069d22d 100644
---- a/src/lib/crypto/openssl/enc_provider/Makefile.in
-+++ b/src/lib/crypto/openssl/enc_provider/Makefile.in
-@@ -3,21 +3,18 @@ BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
- LOCALINCLUDES = -I$(srcdir)/../../krb -I$(srcdir)/..
- 
- STLIBOBJS= \
--	des.o 	\
- 	des3.o 	\
- 	rc4.o 	\
- 	aes.o   \
- 	camellia.o
- 
- OBJS= \
--	$(OUTPRE)des.$(OBJEXT) 	\
- 	$(OUTPRE)des3.$(OBJEXT) 	\
- 	$(OUTPRE)aes.$(OBJEXT) 	\
- 	$(OUTPRE)camellia.$(OBJEXT) 	\
- 	$(OUTPRE)rc4.$(OBJEXT)
- 
- SRCS= \
--	$(srcdir)/des.c 	\
- 	$(srcdir)/des3.c 	\
- 	$(srcdir)/aes.c 	\
- 	$(srcdir)/camellia.c 	\
-diff --git a/src/lib/crypto/openssl/enc_provider/deps b/src/lib/crypto/openssl/enc_provider/deps
-index 428fcf6f5..1c28cc842 100644
---- a/src/lib/crypto/openssl/enc_provider/deps
-+++ b/src/lib/crypto/openssl/enc_provider/deps
-@@ -1,17 +1,6 @@
- #
- # Generated makefile dependencies follow.
- #
--des.so des.po $(OUTPRE)des.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
--  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
--  $(srcdir)/../crypto_mod.h $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
--  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
--  $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
--  $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
--  $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
--  $(top_srcdir)/include/socket-utils.h des.c
- des3.so des3.po $(OUTPRE)des3.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h \
-diff --git a/src/lib/crypto/openssl/enc_provider/des.c b/src/lib/crypto/openssl/enc_provider/des.c
-deleted file mode 100644
-index a662db512..000000000
---- a/src/lib/crypto/openssl/enc_provider/des.c
-+++ /dev/null
-@@ -1,218 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/* lib/crypto/openssl/enc_provider/des.c */
--/*
-- * Copyright (C) 2009 by the Massachusetts Institute of Technology.
-- * All rights reserved.
-- *
-- * Export of this software from the United States of America may
-- *   require a specific license from the United States Government.
-- *   It is the responsibility of any person or organization contemplating
-- *   export to obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of M.I.T. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  Furthermore if you modify this software you must label
-- * your software as modified software and not distribute it in such a
-- * fashion that it might be confused with the original M.I.T. software.
-- * M.I.T. makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- */
--
--/*
-- * Copyright (C) 1998 by the FundsXpress, INC.
-- *
-- * All rights reserved.
-- *
-- * Export of this software from the United States of America may require
-- * a specific license from the United States Government.  It is the
-- * responsibility of any person or organization contemplating export to
-- * obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of FundsXpress. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  FundsXpress makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- *
-- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
-- * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
-- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
-- */
--
--#include "crypto_int.h"
--#include <openssl/evp.h>
--#include <openssl/des.h>
--
--#define DES_BLOCK_SIZE 8
--#define DES_KEY_SIZE 8
--#define DES_KEY_BYTES 7
--
--static krb5_error_code
--validate(krb5_key key, const krb5_data *ivec, const krb5_crypto_iov *data,
--         size_t num_data, krb5_boolean *empty)
--{
--    size_t input_length = iov_total_length(data, num_data, FALSE);
--
--    if (key->keyblock.length != DES_KEY_SIZE)
--        return(KRB5_BAD_KEYSIZE);
--    if ((input_length%DES_BLOCK_SIZE) != 0)
--        return(KRB5_BAD_MSIZE);
--    if (ivec && (ivec->length != 8))
--        return(KRB5_BAD_MSIZE);
--
--    *empty = (input_length == 0);
--    return 0;
--}
--
--static krb5_error_code
--k5_des_encrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
--               size_t num_data)
--{
--    int ret, olen = DES_BLOCK_SIZE;
--    unsigned char iblock[DES_BLOCK_SIZE], oblock[DES_BLOCK_SIZE];
--    struct iov_cursor cursor;
--    EVP_CIPHER_CTX *ctx;
--    krb5_boolean empty;
--
--    ret = validate(key, ivec, data, num_data, &empty);
--    if (ret != 0 || empty)
--        return ret;
--
--    ctx = EVP_CIPHER_CTX_new();
--    if (ctx == NULL)
--        return ENOMEM;
--
--    ret = EVP_EncryptInit_ex(ctx, EVP_des_cbc(), NULL,
--                             key->keyblock.contents, (ivec && ivec->data) ? (unsigned char*)ivec->data : NULL);
--    if (!ret) {
--        EVP_CIPHER_CTX_free(ctx);
--        return KRB5_CRYPTO_INTERNAL;
--    }
--
--    EVP_CIPHER_CTX_set_padding(ctx, 0);
--
--    k5_iov_cursor_init(&cursor, data, num_data, DES_BLOCK_SIZE, FALSE);
--    while (k5_iov_cursor_get(&cursor, iblock)) {
--        ret = EVP_EncryptUpdate(ctx, oblock, &olen, iblock, DES_BLOCK_SIZE);
--        if (!ret)
--            break;
--        k5_iov_cursor_put(&cursor, oblock);
--    }
--
--    if (ivec != NULL)
--        memcpy(ivec->data, oblock, DES_BLOCK_SIZE);
--
--    EVP_CIPHER_CTX_free(ctx);
--
--    zap(iblock, sizeof(iblock));
--    zap(oblock, sizeof(oblock));
--
--    if (ret != 1)
--        return KRB5_CRYPTO_INTERNAL;
--    return 0;
--}
--
--static krb5_error_code
--k5_des_decrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
--               size_t num_data)
--{
--    int ret, olen = DES_BLOCK_SIZE;
--    unsigned char iblock[DES_BLOCK_SIZE], oblock[DES_BLOCK_SIZE];
--    struct iov_cursor cursor;
--    EVP_CIPHER_CTX *ctx;
--    krb5_boolean empty;
--
--    ret = validate(key, ivec, data, num_data, &empty);
--    if (ret != 0 || empty)
--        return ret;
--
--    ctx = EVP_CIPHER_CTX_new();
--    if (ctx == NULL)
--        return ENOMEM;
--
--    ret = EVP_DecryptInit_ex(ctx, EVP_des_cbc(), NULL,
--                             key->keyblock.contents,
--                             (ivec) ? (unsigned char*)ivec->data : NULL);
--    if (!ret) {
--        EVP_CIPHER_CTX_free(ctx);
--        return KRB5_CRYPTO_INTERNAL;
--    }
--
--    EVP_CIPHER_CTX_set_padding(ctx,0);
--
--    k5_iov_cursor_init(&cursor, data, num_data, DES_BLOCK_SIZE, FALSE);
--    while (k5_iov_cursor_get(&cursor, iblock)) {
--        ret = EVP_DecryptUpdate(ctx, oblock, &olen, iblock, DES_BLOCK_SIZE);
--        if (!ret)
--            break;
--        k5_iov_cursor_put(&cursor, oblock);
--    }
--
--    if (ivec != NULL)
--        memcpy(ivec->data, iblock, DES_BLOCK_SIZE);
--
--    EVP_CIPHER_CTX_free(ctx);
--
--    zap(iblock, sizeof(iblock));
--    zap(oblock, sizeof(oblock));
--
--    if (ret != 1)
--        return KRB5_CRYPTO_INTERNAL;
--    return 0;
--}
--
--static krb5_error_code
--k5_des_cbc_mac(krb5_key key, const krb5_crypto_iov *data, size_t num_data,
--               const krb5_data *ivec, krb5_data *output)
--{
--    int ret;
--    struct iov_cursor cursor;
--    DES_cblock blockY, blockB;
--    DES_key_schedule sched;
--    krb5_boolean empty;
--
--    ret = validate(key, ivec, data, num_data, &empty);
--    if (ret != 0)
--        return ret;
--
--    if (output->length != DES_BLOCK_SIZE)
--        return KRB5_BAD_MSIZE;
--
--    if (DES_set_key((DES_cblock *)key->keyblock.contents, &sched) != 0)
--        return KRB5_CRYPTO_INTERNAL;
--
--    if (ivec != NULL)
--        memcpy(blockY, ivec->data, DES_BLOCK_SIZE);
--    else
--        memset(blockY, 0, DES_BLOCK_SIZE);
--
--    k5_iov_cursor_init(&cursor, data, num_data, DES_BLOCK_SIZE, FALSE);
--    while (k5_iov_cursor_get(&cursor, blockB)) {
--        store_64_n(load_64_n(blockB) ^ load_64_n(blockY), blockB);
--        DES_ecb_encrypt(&blockB, &blockY, &sched, 1);
--    }
--
--    memcpy(output->data, blockY, DES_BLOCK_SIZE);
--    return 0;
--}
--
--const struct krb5_enc_provider krb5int_enc_des = {
--    DES_BLOCK_SIZE,
--    DES_KEY_BYTES, DES_KEY_SIZE,
--    k5_des_encrypt,
--    k5_des_decrypt,
--    k5_des_cbc_mac,
--    krb5int_des_init_state,
--    krb5int_default_free_state
--};
-diff --git a/src/lib/crypto/openssl/hash_provider/Makefile.in b/src/lib/crypto/openssl/hash_provider/Makefile.in
-index 7762e20a5..f7245fbd1 100644
---- a/src/lib/crypto/openssl/hash_provider/Makefile.in
-+++ b/src/lib/crypto/openssl/hash_provider/Makefile.in
-@@ -2,15 +2,11 @@ mydir=lib$(S)crypto$(S)openssl$(S)hash_provider
- BUILDTOP=$(REL)..$(S)..$(S)..$(S)..
- LOCALINCLUDES = -I$(srcdir)/../../krb -I$(srcdir)/..
- 
--STLIBOBJS= \
--	hash_crc32.o 	\
--	hash_evp.o
-+STLIBOBJS=   hash_evp.o
- 
--OBJS=   $(OUTPRE)hash_crc32.$(OBJEXT) 	\
--	$(OUTPRE)hash_evp.$(OBJEXT)
-+OBJS=   $(OUTPRE)hash_evp.$(OBJEXT)
- 
--SRCS=	$(srcdir)/hash_crc32.c	\
--	$(srcdir)/hash_evp.c
-+SRCS=	$(srcdir)/hash_evp.c
- 
- all-unix: all-libobjs
- 
-diff --git a/src/lib/crypto/openssl/hash_provider/deps b/src/lib/crypto/openssl/hash_provider/deps
-index 87dd02012..690574cab 100644
---- a/src/lib/crypto/openssl/hash_provider/deps
-+++ b/src/lib/crypto/openssl/hash_provider/deps
-@@ -1,18 +1,6 @@
- #
- # Generated makefile dependencies follow.
- #
--hash_crc32.so hash_crc32.po $(OUTPRE)hash_crc32.$(OBJEXT): \
--  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
--  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
--  $(COM_ERR_DEPS) $(srcdir)/../../krb/crypto_int.h $(srcdir)/../crypto_mod.h \
--  $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
--  $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  hash_crc32.c
- hash_evp.so hash_evp.po $(OUTPRE)hash_evp.$(OBJEXT): \
-   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
-   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
-diff --git a/src/lib/crypto/openssl/hash_provider/hash_crc32.c b/src/lib/crypto/openssl/hash_provider/hash_crc32.c
-deleted file mode 100644
-index 4013843ed..000000000
---- a/src/lib/crypto/openssl/hash_provider/hash_crc32.c
-+++ /dev/null
-@@ -1,56 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/*
-- * Copyright (C) 1998 by the FundsXpress, INC.
-- *
-- * All rights reserved.
-- *
-- * Export of this software from the United States of America may require
-- * a specific license from the United States Government.  It is the
-- * responsibility of any person or organization contemplating export to
-- * obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of FundsXpress. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  FundsXpress makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- *
-- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
-- * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
-- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
-- */
--
--#include "crypto_int.h"
--
--static krb5_error_code
--k5_crc32_hash(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
--{
--    unsigned long c;
--    unsigned int i;
--
--    if (output->length != CRC32_CKSUM_LENGTH)
--        return(KRB5_CRYPTO_INTERNAL);
--
--    c = 0;
--    for (i = 0; i < num_data; i++) {
--        const krb5_crypto_iov *iov = &data[i];
--
--        if (SIGN_IOV(iov))
--            mit_crc32(iov->data.data, iov->data.length, &c);
--    }
--
--    store_32_le(c, output->data);
--    return(0);
--}
--
--const struct krb5_hash_provider krb5int_hash_crc32 = {
--    "CRC32",
--    CRC32_CKSUM_LENGTH,
--    1,
--    k5_crc32_hash
--};
-diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
-index 5baa6cecf..439ae6aeb 100644
---- a/src/lib/gssapi/krb5/accept_sec_context.c
-+++ b/src/lib/gssapi/krb5/accept_sec_context.c
-@@ -1011,9 +1011,6 @@ kg_accept_krb5(minor_status, context_handle,
-             }
- 
-             switch (negotiated_etype) {
--            case ENCTYPE_DES_CBC_MD5:
--            case ENCTYPE_DES_CBC_MD4:
--            case ENCTYPE_DES_CBC_CRC:
-             case ENCTYPE_DES3_CBC_SHA1:
-             case ENCTYPE_ARCFOUR_HMAC:
-             case ENCTYPE_ARCFOUR_HMAC_EXP:
-diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h
-index e92be88b4..2647434ba 100644
---- a/src/lib/gssapi/krb5/gssapiP_krb5.h
-+++ b/src/lib/gssapi/krb5/gssapiP_krb5.h
-@@ -120,17 +120,17 @@ extern const gss_OID_set kg_all_mechs;
- /* These are to be stored in little-endian order, i.e., des-mac is
-    stored as 02 00.  */
- enum sgn_alg {
--    SGN_ALG_DES_MAC_MD5           = 0x0000,
--    SGN_ALG_MD2_5                 = 0x0001,
--    SGN_ALG_DES_MAC               = 0x0002,
--    SGN_ALG_3                     = 0x0003, /* not published */
-+    /* SGN_ALG_DES_MAC_MD5           = 0x0000, */
-+    /* SGN_ALG_MD2_5                 = 0x0001, */
-+    /* SGN_ALG_DES_MAC               = 0x0002, */
-+    /* SGN_ALG_3                     = 0x0003, /\* not published *\/ */
-     SGN_ALG_HMAC_MD5              = 0x0011, /* microsoft w2k;  */
-     SGN_ALG_HMAC_SHA1_DES3_KD     = 0x0004
- };
- enum seal_alg {
-     SEAL_ALG_NONE            = 0xffff,
--    SEAL_ALG_DES             = 0x0000,
--    SEAL_ALG_1               = 0x0001, /* not published */
-+    /* SEAL_ALG_DES             = 0x0000, */
-+    /* SEAL_ALG_1               = 0x0001, /\* not published *\/ */
-     SEAL_ALG_MICROSOFT_RC4   = 0x0010, /* microsoft w2k;  */
-     SEAL_ALG_DES3KD          = 0x0002
- };
-@@ -147,12 +147,12 @@ enum seal_alg {
- #define KG_USAGE_INITIATOR_SIGN 25
- 
- enum qop {
--    GSS_KRB5_INTEG_C_QOP_MD5       = 0x0001, /* *partial* MD5 = "MD2.5" */
--    GSS_KRB5_INTEG_C_QOP_DES_MD5   = 0x0002,
--    GSS_KRB5_INTEG_C_QOP_DES_MAC   = 0x0003,
-+    /* GSS_KRB5_INTEG_C_QOP_MD5       = 0x0001, */
-+    /* GSS_KRB5_INTEG_C_QOP_DES_MD5   = 0x0002, */
-+    /* GSS_KRB5_INTEG_C_QOP_DES_MAC   = 0x0003, */
-     GSS_KRB5_INTEG_C_QOP_HMAC_SHA1 = 0x0004,
-     GSS_KRB5_INTEG_C_QOP_MASK      = 0x00ff,
--    GSS_KRB5_CONF_C_QOP_DES        = 0x0100,
-+    /* GSS_KRB5_CONF_C_QOP_DES        = 0x0100, */
-     GSS_KRB5_CONF_C_QOP_DES3_KD    = 0x0200,
-     GSS_KRB5_CONF_C_QOP_MASK       = 0xff00
- };
-diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c
-index 4da531b58..d1cdce486 100644
---- a/src/lib/gssapi/krb5/k5seal.c
-+++ b/src/lib/gssapi/krb5/k5seal.c
-@@ -71,7 +71,6 @@ make_seal_token_v1 (krb5_context context,
-     char *data_ptr;
-     krb5_data plaind;
-     krb5_checksum md5cksum;
--    krb5_checksum cksum;
-     /* msglen contains the message length
-      * we are signing/encrypting.  tmsglen
-      * contains the length of the message
-@@ -137,12 +136,8 @@ make_seal_token_v1 (krb5_context context,
- 
-     /* pad the plaintext, encrypt if needed, and stick it in the token */
- 
--    /* initialize the the cksum */
-+    /* initialize the the checksum */
-     switch (signalg) {
--    case SGN_ALG_DES_MAC_MD5:
--    case SGN_ALG_MD2_5:
--        md5cksum.checksum_type = CKSUMTYPE_RSA_MD5;
--        break;
-     case SGN_ALG_HMAC_SHA1_DES3_KD:
-         md5cksum.checksum_type = CKSUMTYPE_HMAC_SHA1_DES3;
-         break;
-@@ -152,7 +147,6 @@ make_seal_token_v1 (krb5_context context,
-             sign_usage = 15;
-         break;
-     default:
--    case SGN_ALG_DES_MAC:
-         abort ();
-     }
- 
-@@ -203,26 +197,6 @@ make_seal_token_v1 (krb5_context context,
-         return(code);
-     }
-     switch(signalg) {
--    case SGN_ALG_DES_MAC_MD5:
--    case 3:
--
--        code = kg_encrypt_inplace(context, seq, KG_USAGE_SEAL,
--                                  (g_OID_equal(oid, gss_mech_krb5_old) ?
--                                   seq->keyblock.contents : NULL),
--                                  md5cksum.contents, 16);
--        if (code) {
--            krb5_free_checksum_contents(context, &md5cksum);
--            xfree (plain);
--            gssalloc_free(t);
--            return code;
--        }
--
--        cksum.length = cksum_size;
--        cksum.contents = md5cksum.contents + 16 - cksum.length;
--
--        memcpy(ptr+14, cksum.contents, cksum.length);
--        break;
--
-     case SGN_ALG_HMAC_SHA1_DES3_KD:
-         /*
-          * Using key derivation, the call to krb5_c_make_checksum
-diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c
-index 88caa856f..9bb2ee109 100644
---- a/src/lib/gssapi/krb5/k5sealiov.c
-+++ b/src/lib/gssapi/krb5/k5sealiov.c
-@@ -145,10 +145,6 @@ make_seal_token_v1_iov(krb5_context context,
- 
-     /* initialize the checksum */
-     switch (ctx->signalg) {
--    case SGN_ALG_DES_MAC_MD5:
--    case SGN_ALG_MD2_5:
--        md5cksum.checksum_type = CKSUMTYPE_RSA_MD5;
--        break;
-     case SGN_ALG_HMAC_SHA1_DES3_KD:
-         md5cksum.checksum_type = CKSUMTYPE_HMAC_SHA1_DES3;
-         break;
-@@ -158,7 +154,6 @@ make_seal_token_v1_iov(krb5_context context,
-             sign_usage = 15;
-         break;
-     default:
--    case SGN_ALG_DES_MAC:
-         abort ();
-     }
- 
-@@ -183,21 +178,6 @@ make_seal_token_v1_iov(krb5_context context,
-         goto cleanup;
- 
-     switch (ctx->signalg) {
--    case SGN_ALG_DES_MAC_MD5:
--    case SGN_ALG_3:
--        code = kg_encrypt_inplace(context, ctx->seq, KG_USAGE_SEAL,
--                                  (g_OID_equal(ctx->mech_used,
--                                               gss_mech_krb5_old) ?
--                                   ctx->seq->keyblock.contents : NULL),
--                                  md5cksum.contents, 16);
--        if (code != 0)
--            goto cleanup;
--
--        cksum.length = ctx->cksum_size;
--        cksum.contents = md5cksum.contents + 16 - cksum.length;
--
--        memcpy(ptr + 14, cksum.contents, cksum.length);
--        break;
-     case SGN_ALG_HMAC_SHA1_DES3_KD:
-         assert(md5cksum.length == ctx->cksum_size);
-         memcpy(ptr + 14, md5cksum.contents, md5cksum.length);
-diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c
-index 57720c2ea..9b183bc33 100644
---- a/src/lib/gssapi/krb5/k5unseal.c
-+++ b/src/lib/gssapi/krb5/k5unseal.c
-@@ -76,7 +76,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
-     int sealalg;
-     int bad_pad = 0;
-     gss_buffer_desc token;
--    krb5_checksum cksum;
-     krb5_checksum md5cksum;
-     krb5_data plaind;
-     char *data_ptr;
-@@ -132,7 +131,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
-        but few enough that we can try them all. */
- 
-     if ((ctx->sealalg == SEAL_ALG_NONE && signalg > 1) ||
--        (ctx->sealalg == SEAL_ALG_1 && signalg != SGN_ALG_3) ||
-         (ctx->sealalg == SEAL_ALG_DES3KD &&
-          signalg != SGN_ALG_HMAC_SHA1_DES3_KD)||
-         (ctx->sealalg == SEAL_ALG_MICROSOFT_RC4 &&
-@@ -142,16 +140,11 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
-     }
- 
-     switch (signalg) {
--    case SGN_ALG_DES_MAC_MD5:
--    case SGN_ALG_MD2_5:
-     case SGN_ALG_HMAC_MD5:
-         cksum_len = 8;
-         if (toktype != KG_TOK_SEAL_MSG)
-             sign_usage = 15;
-         break;
--    case SGN_ALG_3:
--        cksum_len = 16;
--        break;
-     case SGN_ALG_HMAC_SHA1_DES3_KD:
-         cksum_len = 20;
-         break;
-@@ -260,12 +253,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
- 
-     /* initialize the the cksum */
-     switch (signalg) {
--    case SGN_ALG_DES_MAC_MD5:
--    case SGN_ALG_MD2_5:
--    case SGN_ALG_DES_MAC:
--    case SGN_ALG_3:
--        md5cksum.checksum_type = CKSUMTYPE_RSA_MD5;
--        break;
-     case SGN_ALG_HMAC_MD5:
-         md5cksum.checksum_type = CKSUMTYPE_HMAC_MD5_ARCFOUR;
-         break;
-@@ -282,105 +269,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer,
-     md5cksum.length = sumlen;
- 
-     switch (signalg) {
--    case SGN_ALG_DES_MAC_MD5:
--    case SGN_ALG_3:
--        /* compute the checksum of the message */
--
--        /* 8 = bytes of token body to be checksummed according to spec */
--
--        if (! (data_ptr = xmalloc(8 + plainlen))) {
--            if (sealalg != 0xffff)
--                xfree(plain);
--            if (toktype == KG_TOK_SEAL_MSG)
--                gssalloc_free(token.value);
--            *minor_status = ENOMEM;
--            return(GSS_S_FAILURE);
--        }
--
--        (void) memcpy(data_ptr, ptr-2, 8);
--
--        (void) memcpy(data_ptr+8, plain, plainlen);
--
--        plaind.length = 8 + plainlen;
--        plaind.data = data_ptr;
--        code = krb5_k_make_checksum(context, md5cksum.checksum_type,
--                                    ctx->seq, sign_usage,
--                                    &plaind, &md5cksum);
--        xfree(data_ptr);
--
--        if (code) {
--            if (toktype == KG_TOK_SEAL_MSG)
--                gssalloc_free(token.value);
--            *minor_status = code;
--            return(GSS_S_FAILURE);
--        }
--
--        code = kg_encrypt_inplace(context, ctx->seq, KG_USAGE_SEAL,
--                                  (g_OID_equal(ctx->mech_used,
--                                               gss_mech_krb5_old) ?
--                                   ctx->seq->keyblock.contents : NULL),
--                                  md5cksum.contents, 16);
--        if (code) {
--            krb5_free_checksum_contents(context, &md5cksum);
--            if (toktype == KG_TOK_SEAL_MSG)
--                gssalloc_free(token.value);
--            *minor_status = code;
--            return GSS_S_FAILURE;
--        }
--
--        if (signalg == 0)
--            cksum.length = 8;
--        else
--            cksum.length = 16;
--        cksum.contents = md5cksum.contents + 16 - cksum.length;
--
--        code = k5_bcmp(cksum.contents, ptr + 14, cksum.length);
--        break;
--
--    case SGN_ALG_MD2_5:
--        if (!ctx->seed_init &&
--            (code = kg_make_seed(context, ctx->subkey, ctx->seed))) {
--            krb5_free_checksum_contents(context, &md5cksum);
--            if (sealalg != 0xffff)
--                xfree(plain);
--            if (toktype == KG_TOK_SEAL_MSG)
--                gssalloc_free(token.value);
--            *minor_status = code;
--            return GSS_S_FAILURE;
--        }
--
--        if (! (data_ptr = xmalloc(sizeof(ctx->seed) + 8 + plainlen))) {
--            krb5_free_checksum_contents(context, &md5cksum);
--            if (sealalg == 0)
--                xfree(plain);
--            if (toktype == KG_TOK_SEAL_MSG)
--                gssalloc_free(token.value);
--            *minor_status = ENOMEM;
--            return(GSS_S_FAILURE);
--        }
--        (void) memcpy(data_ptr, ptr-2, 8);
--        (void) memcpy(data_ptr+8, ctx->seed, sizeof(ctx->seed));
--        (void) memcpy(data_ptr+8+sizeof(ctx->seed), plain, plainlen);
--        plaind.length = 8 + sizeof(ctx->seed) + plainlen;
--        plaind.data = data_ptr;
--        krb5_free_checksum_contents(context, &md5cksum);
--        code = krb5_k_make_checksum(context, md5cksum.checksum_type,
--                                    ctx->seq, sign_usage,
--                                    &plaind, &md5cksum);
--        xfree(data_ptr);
--
--        if (code) {
--            if (sealalg == 0)
--                xfree(plain);
--            if (toktype == KG_TOK_SEAL_MSG)
--                gssalloc_free(token.value);
--            *minor_status = code;
--            return(GSS_S_FAILURE);
--        }
--
--        code = k5_bcmp(md5cksum.contents, ptr + 14, 8);
--        /* Falls through to defective-token??  */
--
-     default:
-         *minor_status = 0;
-         return(GSS_S_DEFECTIVE_TOKEN);
-diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c
-index f15d2db69..85a9574f3 100644
---- a/src/lib/gssapi/krb5/k5unsealiov.c
-+++ b/src/lib/gssapi/krb5/k5unsealiov.c
-@@ -44,7 +44,6 @@ kg_unseal_v1_iov(krb5_context context,
-     unsigned char *ptr;
-     int sealalg;
-     int signalg;
--    krb5_checksum cksum;
-     krb5_checksum md5cksum;
-     size_t cksum_len = 0;
-     size_t conflen = 0;
-@@ -54,8 +53,8 @@ kg_unseal_v1_iov(krb5_context context,
-     size_t sumlen;
-     krb5_keyusage sign_usage = KG_USAGE_SIGN;
- 
--    md5cksum.length = cksum.length = 0;
--    md5cksum.contents = cksum.contents = NULL;
-+    md5cksum.length = 0;
-+    md5cksum.contents = NULL;
- 
-     header = kg_locate_header_iov(iov, iov_count, toktype);
-     assert(header != NULL);
-@@ -103,7 +102,6 @@ kg_unseal_v1_iov(krb5_context context,
-     }
- 
-     if ((ctx->sealalg == SEAL_ALG_NONE && signalg > 1) ||
--        (ctx->sealalg == SEAL_ALG_1 && signalg != SGN_ALG_3) ||
-         (ctx->sealalg == SEAL_ALG_DES3KD &&
-          signalg != SGN_ALG_HMAC_SHA1_DES3_KD)||
-         (ctx->sealalg == SEAL_ALG_MICROSOFT_RC4 &&
-@@ -113,16 +111,11 @@ kg_unseal_v1_iov(krb5_context context,
-     }
- 
-     switch (signalg) {
--    case SGN_ALG_DES_MAC_MD5:
--    case SGN_ALG_MD2_5:
-     case SGN_ALG_HMAC_MD5:
-         cksum_len = 8;
-         if (toktype != KG_TOK_WRAP_MSG)
-             sign_usage = 15;
-         break;
--    case SGN_ALG_3:
--        cksum_len = 16;
--        break;
-     case SGN_ALG_HMAC_SHA1_DES3_KD:
-         cksum_len = 20;
-         break;
-@@ -189,12 +182,6 @@ kg_unseal_v1_iov(krb5_context context,
-     /* initialize the checksum */
- 
-     switch (signalg) {
--    case SGN_ALG_DES_MAC_MD5:
--    case SGN_ALG_MD2_5:
--    case SGN_ALG_DES_MAC:
--    case SGN_ALG_3:
--        md5cksum.checksum_type = CKSUMTYPE_RSA_MD5;
--        break;
-     case SGN_ALG_HMAC_MD5:
-         md5cksum.checksum_type = CKSUMTYPE_HMAC_MD5_ARCFOUR;
-         break;
-@@ -223,23 +210,6 @@ kg_unseal_v1_iov(krb5_context context,
-     }
- 
-     switch (signalg) {
--    case SGN_ALG_DES_MAC_MD5:
--    case SGN_ALG_3:
--        code = kg_encrypt_inplace(context, ctx->seq, KG_USAGE_SEAL,
--                                  (g_OID_equal(ctx->mech_used,
--                                               gss_mech_krb5_old) ?
--                                   ctx->seq->keyblock.contents : NULL),
--                                  md5cksum.contents, 16);
--        if (code != 0) {
--            retval = GSS_S_FAILURE;
--            goto cleanup;
--        }
--
--        cksum.length = cksum_len;
--        cksum.contents = md5cksum.contents + 16 - cksum.length;
--
--        code = k5_bcmp(cksum.contents, ptr + 14, cksum.length);
--        break;
-     case SGN_ALG_HMAC_SHA1_DES3_KD:
-     case SGN_ALG_HMAC_MD5:
-         code = k5_bcmp(md5cksum.contents, ptr + 14, cksum_len);
-diff --git a/src/lib/gssapi/krb5/util_crypt.c b/src/lib/gssapi/krb5/util_crypt.c
-index 0cebde12a..80954aff7 100644
---- a/src/lib/gssapi/krb5/util_crypt.c
-+++ b/src/lib/gssapi/krb5/util_crypt.c
-@@ -74,27 +74,6 @@ kg_copy_keys(krb5_context context, krb5_gss_ctx_id_rec *ctx, krb5_key subkey)
-     return 0;
- }
- 
--static krb5_error_code
--kg_derive_des_enc_key(krb5_context context, krb5_key subkey, krb5_key *out)
--{
--    krb5_error_code code;
--    krb5_keyblock *keyblock;
--    unsigned int i;
--
--    *out = NULL;
--
--    code = krb5_k_key_keyblock(context, subkey, &keyblock);
--    if (code != 0)
--        return code;
--
--    for (i = 0; i < keyblock->length; i++)
--        keyblock->contents[i] ^= 0xF0;
--
--    code = krb5_k_create_key(context, keyblock, out);
--    krb5_free_keyblock(context, keyblock);
--    return code;
--}
--
- krb5_error_code
- kg_setup_keys(krb5_context context, krb5_gss_ctx_id_rec *ctx, krb5_key subkey,
-               krb5_cksumtype *cksumtype)
-@@ -118,26 +97,6 @@ kg_setup_keys(krb5_context context, krb5_gss_ctx_id_rec *ctx, krb5_key subkey,
-         return code;
- 
-     switch (subkey->keyblock.enctype) {
--    case ENCTYPE_DES_CBC_MD5:
--    case ENCTYPE_DES_CBC_MD4:
--    case ENCTYPE_DES_CBC_CRC:
--        krb5_k_free_key(context, ctx->seq);
--        code = krb5_k_create_key(context, &subkey->keyblock, &ctx->seq);
--        if (code != 0)
--            return code;
--
--        krb5_k_free_key(context, ctx->enc);
--        code = kg_derive_des_enc_key(context, subkey, &ctx->enc);
--        if (code != 0)
--            return code;
--
--        ctx->enc->keyblock.enctype = ENCTYPE_DES_CBC_RAW;
--        ctx->seq->keyblock.enctype = ENCTYPE_DES_CBC_RAW;
--        ctx->signalg = SGN_ALG_DES_MAC_MD5;
--        ctx->cksum_size = 8;
--        ctx->sealalg = SEAL_ALG_DES;
--
--        break;
-     case ENCTYPE_DES3_CBC_SHA1:
-         code = kg_copy_keys(context, ctx, subkey);
-         if (code != 0)
-diff --git a/src/lib/kadm5/kadm_rpc_xdr.c b/src/lib/kadm5/kadm_rpc_xdr.c
-index 745ee857e..f22ea7f1f 100644
---- a/src/lib/kadm5/kadm_rpc_xdr.c
-+++ b/src/lib/kadm5/kadm_rpc_xdr.c
-@@ -1109,16 +1109,6 @@ xdr_krb5_octet(XDR *xdrs, krb5_octet *objp)
- bool_t
- xdr_krb5_enctype(XDR *xdrs, krb5_enctype *objp)
- {
--   /*
--    * This used to be xdr_krb5_keytype, but keytypes and enctypes have
--    * been merged into only enctypes.  However, randkey_principal
--    * already ensures that only a key of ENCTYPE_DES_CBC_CRC will be
--    * returned to v1 clients, and ENCTYPE_DES_CBC_CRC has the same
--    * value as KEYTYPE_DES used too, which is what all v1 clients
--    * expect.  Therefore, IMHO, just encoding whatever enctype we get
--    * is safe.
--    */
--
-    if (!xdr_int32(xdrs, (int32_t *) objp))
- 	return (FALSE);
-    return (TRUE);
-diff --git a/src/lib/krb5/ccache/cc_mslsa.c b/src/lib/krb5/ccache/cc_mslsa.c
-index 0d00c86d4..4367322b7 100644
---- a/src/lib/krb5/ccache/cc_mslsa.c
-+++ b/src/lib/krb5/ccache/cc_mslsa.c
-@@ -1103,13 +1103,14 @@ GetMSTGT(krb5_context context, HANDLE LogonHandle, ULONG PackageId, KERB_EXTERNA
-     }
- 
-     if (krb5_get_tgs_ktypes(context, NULL, &etype_list)) {
--        ptr = etype_list = NULL;
--        etype = ENCTYPE_DES_CBC_CRC;
--    } else {
--        ptr = etype_list + 1;
--        etype = *etype_list;
-+        /* No enctypes - nothing we can do. */
-+        bIsLsaError = TRUE;
-+        goto cleanup;
-     }
- 
-+    ptr = etype_list + 1;
-+    etype = *etype_list;
-+
-     while ( etype ) {
-         // Try once more but this time specify the Encryption Type
-         // (This will not store the retrieved tickets in the LSA cache unless
-diff --git a/src/lib/krb5/krb/auth_con.c b/src/lib/krb5/krb/auth_con.c
-index 1dfce631c..aa90454f3 100644
---- a/src/lib/krb5/krb/auth_con.c
-+++ b/src/lib/krb5/krb/auth_con.c
-@@ -313,28 +313,11 @@ krb5_auth_con_getremoteseqnumber(krb5_context context, krb5_auth_context auth_co
- krb5_error_code KRB5_CALLCONV
- krb5_auth_con_initivector(krb5_context context, krb5_auth_context auth_context)
- {
--    krb5_error_code ret;
--    krb5_enctype enctype;
--
-     if (auth_context->key == NULL)
-         return EINVAL;
--    ret = krb5_c_init_state(context, &auth_context->key->keyblock,
--                            KRB5_KEYUSAGE_KRB_PRIV_ENCPART,
--                            &auth_context->cstate);
--    if (ret)
--        return ret;
--
--    /*
--     * Historically we used a zero-filled buffer of the enctype block size.
--     * This matches every existing enctype except RC4 (which has a block size
--     * of 1) and des-cbc-crc (which uses the key instead of a zero-filled
--     * buffer).  Special-case des-cbc-crc to remain interoperable.
--     */
--    enctype = krb5_k_key_enctype(context, auth_context->key);
--    if (enctype == ENCTYPE_DES_CBC_CRC)
--        zap(auth_context->cstate.data, auth_context->cstate.length);
--
--    return 0;
-+    return krb5_c_init_state(context, &auth_context->key->keyblock,
-+                             KRB5_KEYUSAGE_KRB_PRIV_ENCPART,
-+                             &auth_context->cstate);
- }
- 
- krb5_error_code
-diff --git a/src/lib/krb5/krb/gic_keytab.c b/src/lib/krb5/krb/gic_keytab.c
-index e82f42581..1d70cf46f 100644
---- a/src/lib/krb5/krb/gic_keytab.c
-+++ b/src/lib/krb5/krb/gic_keytab.c
-@@ -130,10 +130,6 @@ lookup_etypes_for_keytab(krb5_context context, krb5_keytab keytab,
-         }
-         etypes = p;
-         etypes[count++] = etype;
--        /* All DES key types work with des-cbc-crc, which is more likely to be
--         * accepted by the KDC (since MIT KDCs refuse des-cbc-md5). */
--        if (etype == ENCTYPE_DES_CBC_MD5 || etype == ENCTYPE_DES_CBC_MD4)
--            etypes[count++] = ENCTYPE_DES_CBC_CRC;
-         etypes[count] = 0;
-     }
-     if (ret != KRB5_KT_END)
-diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c
-index 37405728c..b597dda54 100644
---- a/src/lib/krb5/krb/init_ctx.c
-+++ b/src/lib/krb5/krb/init_ctx.c
-@@ -56,17 +56,12 @@
- #include "brand.c"
- #include "../krb5_libinit.h"
- 
--/* The des-mdX entries are last for now, because it's easy to
--   configure KDCs to issue TGTs with des-mdX keys and then not accept
--   them.  This'll be fixed, but for better compatibility, let's prefer
--   des-crc for now.  */
- static krb5_enctype default_enctype_list[] = {
-     ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96,
-     ENCTYPE_AES256_CTS_HMAC_SHA384_192, ENCTYPE_AES128_CTS_HMAC_SHA256_128,
-     ENCTYPE_DES3_CBC_SHA1,
-     ENCTYPE_ARCFOUR_HMAC,
-     ENCTYPE_CAMELLIA128_CTS_CMAC, ENCTYPE_CAMELLIA256_CTS_CMAC,
--    ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, ENCTYPE_DES_CBC_MD4,
-     0
- };
- 
-@@ -483,10 +478,6 @@ krb5int_parse_enctype_list(krb5_context context, const char *profkey,
-             /* Set all enctypes in the default list. */
-             for (i = 0; default_list[i]; i++)
-                 mod_list(default_list[i], sel, weak, &list);
--        } else if (strcasecmp(token, "des") == 0) {
--            mod_list(ENCTYPE_DES_CBC_CRC, sel, weak, &list);
--            mod_list(ENCTYPE_DES_CBC_MD5, sel, weak, &list);
--            mod_list(ENCTYPE_DES_CBC_MD4, sel, weak, &list);
-         } else if (strcasecmp(token, "des3") == 0) {
-             mod_list(ENCTYPE_DES3_CBC_SHA1, sel, weak, &list);
-         } else if (strcasecmp(token, "aes") == 0) {
-diff --git a/src/lib/krb5/krb/mk_req_ext.c b/src/lib/krb5/krb/mk_req_ext.c
-index dce092781..9fc6a0e52 100644
---- a/src/lib/krb5/krb/mk_req_ext.c
-+++ b/src/lib/krb5/krb/mk_req_ext.c
-@@ -82,36 +82,6 @@ generate_authenticator(krb5_context,
-                        krb5_enctype *desired_etypes,
-                        krb5_enctype tkt_enctype);
- 
--/* Return the checksum type for the AP request, or 0 to use the enctype's
-- * mandatory checksum. */
--static krb5_cksumtype
--ap_req_cksum(krb5_context context, krb5_auth_context auth_context,
--             krb5_enctype enctype)
--{
--    /* Use the configured checksum type if one was set. */
--    if (auth_context->req_cksumtype)
--        return auth_context->req_cksumtype;
--
--    /*
--     * Otherwise choose based on the enctype.  For interoperability with very
--     * old implementations, use unkeyed MD4 or MD5 checkums for DES enctypes.
--     * (The authenticator checksum does not have to be keyed since it is
--     * contained within an encrypted blob.)
--     */
--    switch (enctype) {
--    case ENCTYPE_DES_CBC_CRC:
--    case ENCTYPE_DES_CBC_MD5:
--        return CKSUMTYPE_RSA_MD5;
--        break;
--    case ENCTYPE_DES_CBC_MD4:
--        return CKSUMTYPE_RSA_MD4;
--        break;
--    default:
--        /* Use the mandatory checksum type for the enctype. */
--        return 0;
--    }
--}
--
- krb5_error_code KRB5_CALLCONV
- krb5_mk_req_extended(krb5_context context, krb5_auth_context *auth_context,
-                      krb5_flags ap_req_options, krb5_data *in_data,
-@@ -198,15 +168,10 @@ krb5_mk_req_extended(krb5_context context, krb5_auth_context *auth_context,
-             checksum.length = in_data->length;
-             checksum.contents = (krb5_octet *) in_data->data;
-         } else {
--            krb5_enctype enctype = krb5_k_key_enctype(context,
--                                                      (*auth_context)->key);
--            krb5_cksumtype cksumtype = ap_req_cksum(context, *auth_context,
--                                                    enctype);
--            if ((retval = krb5_k_make_checksum(context,
--                                               cksumtype,
--                                               (*auth_context)->key,
--                                               KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM,
--                                               in_data, &checksum)))
-+            retval = krb5_k_make_checksum(context, 0, (*auth_context)->key,
-+                                          KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM,
-+                                          in_data, &checksum);
-+            if (retval)
-                 goto cleanup_cksum;
-         }
-         checksump = &checksum;
-diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c
-index 614ed4190..d8015c64a 100644
---- a/src/lib/krb5/krb/s4u_creds.c
-+++ b/src/lib/krb5/krb/s4u_creds.c
-@@ -341,9 +341,6 @@ verify_s4u2self_reply(krb5_context context,
-     assert(req_s4u_user != NULL);
- 
-     switch (subkey->enctype) {
--    case ENCTYPE_DES_CBC_CRC:
--    case ENCTYPE_DES_CBC_MD4:
--    case ENCTYPE_DES_CBC_MD5:
-     case ENCTYPE_DES3_CBC_SHA1:
-     case ENCTYPE_DES3_CBC_RAW:
-     case ENCTYPE_ARCFOUR_HMAC:
-diff --git a/src/lib/krb5/krb/ser_ctx.c b/src/lib/krb5/krb/ser_ctx.c
-index 39f656322..55491428b 100644
---- a/src/lib/krb5/krb/ser_ctx.c
-+++ b/src/lib/krb5/krb/ser_ctx.c
-@@ -400,7 +400,7 @@ krb5_context_internalize(krb5_context kcontext, krb5_pointer *argp, krb5_octet *
-     } else
-         context->tgs_etypes = NULL;
- 
--    /* Allowable checksum */
-+    /* Allowable clockskew */
-     if ((kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain)))
-         goto cleanup;
-     context->clockskew = (krb5_deltat) ibuf;
-diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
-index 4a75be8cb..8058134ac 100644
---- a/src/man/kdc.conf.man
-+++ b/src/man/kdc.conf.man
-@@ -441,13 +441,6 @@ marks the server principal as host\-based or the service is also
- listed in \fBhost_based_services\fP\&.  \fBno_host_referral = *\fP will
- disable referral processing altogether.
- .TP
--\fBdes_crc_session_supported\fP
--(Boolean value).  If set to true, the KDC will assume that service
--principals support des\-cbc\-crc for session key enctype negotiation
--purposes.  If \fBallow_weak_crypto\fP in libdefaults is
--false, or if des\-cbc\-crc is not a permitted enctype, then this
--variable has no effect.  Defaults to true.  New in release 1.11.
--.TP
- \fBreject_bad_transit\fP
- (Boolean value.)  If set to true, the KDC will check the list of
- transited realms for cross\-realm tickets against the transit path
-@@ -969,30 +962,6 @@ center;
- |l|l|.
- _
- T{
--des\-cbc\-crc
--T}	T{
--DES cbc mode with CRC\-32 (weak)
--T}
--_
--T{
--des\-cbc\-md4
--T}	T{
--DES cbc mode with RSA\-MD4 (weak)
--T}
--_
--T{
--des\-cbc\-md5
--T}	T{
--DES cbc mode with RSA\-MD5 (weak)
--T}
--_
--T{
--des\-cbc\-raw
--T}	T{
--DES cbc mode raw (weak)
--T}
--_
--T{
- des3\-cbc\-raw
- T}	T{
- Triple DES cbc mode raw (weak)
-@@ -1005,12 +974,6 @@ Triple DES cbc mode with HMAC/sha1
- T}
- _
- T{
--des\-hmac\-sha1
--T}	T{
--DES with HMAC/sha1 (weak)
--T}
--_
--T{
- aes256\-cts\-hmac\-sha1\-96 aes256\-cts aes256\-sha1
- T}	T{
- AES\-256 CTS mode with 96\-bit SHA\-1 HMAC
-@@ -1059,12 +1022,6 @@ Camellia\-128 CTS mode with CMAC
- T}
- _
- T{
--des
--T}	T{
--The DES family: des\-cbc\-crc, des\-cbc\-md5, and des\-cbc\-md4 (weak)
--T}
--_
--T{
- des3
- T}	T{
- The triple DES family: des3\-cbc\-sha1
-@@ -1095,8 +1052,8 @@ types for the variable in question.  Types or families can be removed
- from the current list by prefixing them with a minus sign ("\-").
- Types or families can be prefixed with a plus sign ("+") for symmetry;
- it has the same meaning as just listing the type or family.  For
--example, "\fBDEFAULT \-des\fP" would be the default set of encryption
--types with DES types removed, and "\fBdes3 DEFAULT\fP" would be the
-+example, "\fBDEFAULT \-rc4\fP" would be the default set of encryption
-+types with RC4 types removed, and "\fBdes3 DEFAULT\fP" would be the
- default set of encryption types with triple DES types moved to the
- front.
- .sp
-diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
-index aafdf7f83..d6ff91c3b 100644
---- a/src/man/krb5.conf.man
-+++ b/src/man/krb5.conf.man
-@@ -254,7 +254,7 @@ the client should request when making a TGS\-REQ, in order of
- preference from highest to lowest.  The list may be delimited with
- commas or whitespace.  See Encryption_types in
- kdc.conf(5) for a list of the accepted values for this tag.
--The default value is \fBaes256\-cts\-hmac\-sha1\-96 aes128\-cts\-hmac\-sha1\-96 aes256\-cts\-hmac\-sha384\-192 aes128\-cts\-hmac\-sha256\-128 des3\-cbc\-sha1 arcfour\-hmac\-md5 camellia256\-cts\-cmac camellia128\-cts\-cmac des\-cbc\-crc des\-cbc\-md5 des\-cbc\-md4\fP, but single\-DES encryption types
-+The default value is \fBaes256\-cts\-hmac\-sha1\-96 aes128\-cts\-hmac\-sha1\-96 aes256\-cts\-hmac\-sha384\-192 aes128\-cts\-hmac\-sha256\-128 des3\-cbc\-sha1 arcfour\-hmac\-md5 camellia256\-cts\-cmac camellia128\-cts\-cmac\fP, but weak encryption types
- will be implicitly removed from this list if the value of
- \fBallow_weak_crypto\fP is false.
- .sp
-@@ -268,7 +268,7 @@ Identifies the supported list of session key encryption types that
- the client should request when making an AS\-REQ, in order of
- preference from highest to lowest.  The format is the same as for
- default_tgs_enctypes.  The default value for this tag is
--\fBaes256\-cts\-hmac\-sha1\-96 aes128\-cts\-hmac\-sha1\-96 aes256\-cts\-hmac\-sha384\-192 aes128\-cts\-hmac\-sha256\-128 des3\-cbc\-sha1 arcfour\-hmac\-md5 camellia256\-cts\-cmac camellia128\-cts\-cmac des\-cbc\-crc des\-cbc\-md5 des\-cbc\-md4\fP, but single\-DES encryption types will be implicitly
-+\fBaes256\-cts\-hmac\-sha1\-96 aes128\-cts\-hmac\-sha1\-96 aes256\-cts\-hmac\-sha384\-192 aes128\-cts\-hmac\-sha256\-128 des3\-cbc\-sha1 arcfour\-hmac\-md5 camellia256\-cts\-cmac camellia128\-cts\-cmac\fP, but weak encryption types will be implicitly
- removed from this list if the value of \fBallow_weak_crypto\fP is
- false.
- .sp
-@@ -388,7 +388,7 @@ used across NATs.  The default value is true.
- \fBpermitted_enctypes\fP
- Identifies all encryption types that are permitted for use in
- session key encryption.  The default value for this tag is
--\fBaes256\-cts\-hmac\-sha1\-96 aes128\-cts\-hmac\-sha1\-96 aes256\-cts\-hmac\-sha384\-192 aes128\-cts\-hmac\-sha256\-128 des3\-cbc\-sha1 arcfour\-hmac\-md5 camellia256\-cts\-cmac camellia128\-cts\-cmac des\-cbc\-crc des\-cbc\-md5 des\-cbc\-md4\fP, but single\-DES encryption types will be implicitly
-+\fBaes256\-cts\-hmac\-sha1\-96 aes128\-cts\-hmac\-sha1\-96 aes256\-cts\-hmac\-sha384\-192 aes128\-cts\-hmac\-sha256\-128 des3\-cbc\-sha1 arcfour\-hmac\-md5 camellia256\-cts\-cmac camellia128\-cts\-cmac\fP, but weak encryption types will be implicitly
- removed from this list if the value of \fBallow_weak_crypto\fP is
- false.
- .TP
-diff --git a/src/windows/leash/htmlhelp/html/Encryption_Types.htm b/src/windows/leash/htmlhelp/html/Encryption_Types.htm
-index aad42a389..1aebdd0b4 100644
---- a/src/windows/leash/htmlhelp/html/Encryption_Types.htm
-+++ b/src/windows/leash/htmlhelp/html/Encryption_Types.htm
-@@ -79,18 +79,6 @@ will have an entry in the Encryption type column. <br>
- <th>Description</th>
- </tr>
- <tr>
--<th id="th2">  des-  </th>
--  <td> The DES (Data Encryption Standard)
--family is a symmetric block cipher. It was designed to handle only
--56-bit keys which is not enough for modern computing power. It is now
--considered to be weak encryption. <ul id="helpul">
--<li> des-cbc-crc (<b>weak</b>) </li>
--<li>des-cbc-md5 (<b>weak</b>)  </li>
--<li> des-cbc-md4  (<b>weak</b>) </li>
--
--</ul>
--</td>
--</tr><tr>
- <th id="th2"> des3- </th>
-    <td> The triple DES family improves on
- the original DES (Data Encryption Standard) by using 3 separate 56-bit
-@@ -106,7 +94,7 @@ keys. Some modes of 3DES are considered weak while others are strong
- <tr>
- <th id="th2"> aes </th>
-      <td>The AES Advanced Encryption Standard
--family, like DES and 3DES, is a symmetric block cipher and was designed
-+family, like 3DES, is a symmetric block cipher and was designed
- to replace them. It can use multiple key sizes. Kerberos specifies use
- for 256-bit and 128-bit keys.
- <ul id="helpul">
diff --git a/Remove-the-v4-and-afs3-salt-types.patch b/Remove-the-v4-and-afs3-salt-types.patch
deleted file mode 100644
index 671e933..0000000
--- a/Remove-the-v4-and-afs3-salt-types.patch
+++ /dev/null
@@ -1,508 +0,0 @@
-From 35395701a34f68e99abfe23d07b93c59cd63ad50 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Fri, 24 May 2019 13:11:44 -0400
-Subject: [PATCH] Remove the v4 and afs3 salt types
-
-In preparation for removing single-DES support, remove the v4 and afs3
-salt types.  The afs3 salt type could only be used with single-DES
-keys, and the v4 salt type was only useful for single-DES keys from
-krb4 databases.
-
-[ghudson@mit.edu: wrote commit message]
-
-ticket: 8808
-(cherry picked from commit e0a35ff48c09a26ebb9aefd7e98855a84574b8be)
----
- doc/admin/conf_files/kdc_conf.rst             |  2 -
- src/include/kdb.h                             |  4 +-
- src/kadmin/testing/proto/kdc.conf.proto       |  2 +-
- src/kdc/kdc_preauth.c                         | 40 +++++--------------
- .../api.current/chpass-principal-v2.exp       |  8 ++--
- .../api.current/get-principal-v2.exp          |  4 +-
- src/lib/kdb/kdb5.c                            |  4 --
- src/lib/kdb/kdb_cpw.c                         | 16 +-------
- src/lib/krb5/krb/str_conv.c                   |  2 -
- src/lib/krb5/krb/t_get_etype_info.py          |  7 ----
- src/man/kdc.conf.man                          | 14 +------
- src/tests/dejagnu/config/default.exp          | 17 --------
- src/tests/t_etype_info.py                     | 24 +----------
- src/tests/t_keytab.py                         |  5 ---
- src/tests/t_renprinc.py                       |  2 +-
- src/tests/t_salt.py                           | 26 +-----------
- src/util/k5test.py                            | 11 -----
- 17 files changed, 24 insertions(+), 164 deletions(-)
-
-diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst
-index c73791ceb..62d1bfc05 100644
---- a/doc/admin/conf_files/kdc_conf.rst
-+++ b/doc/admin/conf_files/kdc_conf.rst
-@@ -917,10 +917,8 @@ follows:
- 
- ================= ============================================
- normal            default for Kerberos Version 5
--v4                the only type used by Kerberos Version 4 (no salt)
- norealm           same as the default, without using realm information
- onlyrealm         uses only realm information as the salt
--afs3              AFS version 3, only used for compatibility with Kerberos 4 in AFS
- special           generate a random salt
- ================= ============================================
- 
-diff --git a/src/include/kdb.h b/src/include/kdb.h
-index 9812a35e6..7749cfc99 100644
---- a/src/include/kdb.h
-+++ b/src/include/kdb.h
-@@ -73,11 +73,11 @@
- 
- /* Salt types */
- #define KRB5_KDB_SALTTYPE_NORMAL        0
--#define KRB5_KDB_SALTTYPE_V4            1
-+/* #define KRB5_KDB_SALTTYPE_V4            1 */
- #define KRB5_KDB_SALTTYPE_NOREALM       2
- #define KRB5_KDB_SALTTYPE_ONLYREALM     3
- #define KRB5_KDB_SALTTYPE_SPECIAL       4
--#define KRB5_KDB_SALTTYPE_AFS3          5
-+/* #define KRB5_KDB_SALTTYPE_AFS3          5 */
- #define KRB5_KDB_SALTTYPE_CERTHASH      6
- 
- /* Attributes */
-diff --git a/src/kadmin/testing/proto/kdc.conf.proto b/src/kadmin/testing/proto/kdc.conf.proto
-index 61283ac77..45df78b91 100644
---- a/src/kadmin/testing/proto/kdc.conf.proto
-+++ b/src/kadmin/testing/proto/kdc.conf.proto
-@@ -12,5 +12,5 @@
- 		kadmind_port = 1751
- 		kpasswd_port = 1752
- 		master_key_type = des3-hmac-sha1
--		supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal des-cbc-crc:v4 des-cbc-md5:normal des-cbc-raw:normal
-+		supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal des-cbc-md5:normal des-cbc-raw:normal
- 	}
-diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c
-index caf133c14..508a5cf89 100644
---- a/src/kdc/kdc_preauth.c
-+++ b/src/kdc/kdc_preauth.c
-@@ -781,8 +781,8 @@ add_etype_info(krb5_context context, krb5_kdcpreauth_rock rock,
-     return add_pa_data_element(pa_list, pa);
- }
- 
--/* Add PW-SALT or AFS3-SALT entries to pa_list as appropriate for the request
-- * and client principal. */
-+/* Add PW-SALT entries to pa_list as appropriate for the request and client
-+ * principal. */
- static krb5_error_code
- add_pw_salt(krb5_context context, krb5_kdcpreauth_rock rock,
-             krb5_pa_data ***pa_list)
-@@ -801,21 +801,13 @@ add_pw_salt(krb5_context context, krb5_kdcpreauth_rock rock,
-     if (ret)
-         return 0;
- 
--    if (salttype == KRB5_KDB_SALTTYPE_AFS3) {
--        ret = alloc_pa_data(KRB5_PADATA_AFS3_SALT, salt->length + 1, &pa);
--        if (ret)
--            goto cleanup;
--        memcpy(pa->contents, salt->data, salt->length);
--        pa->contents[salt->length] = '\0';
--    } else {
--        /* Steal memory from salt to make the pa-data entry. */
--        ret = alloc_pa_data(KRB5_PADATA_PW_SALT, 0, &pa);
--        if (ret)
--            goto cleanup;
--        pa->length = salt->length;
--        pa->contents = (uint8_t *)salt->data;
--        salt->data = NULL;
--    }
-+    /* Steal memory from salt to make the pa-data entry. */
-+    ret = alloc_pa_data(KRB5_PADATA_PW_SALT, 0, &pa);
-+    if (ret)
-+        goto cleanup;
-+    pa->length = salt->length;
-+    pa->contents = (uint8_t *)salt->data;
-+    salt->data = NULL;
- 
-     /* add_pa_data_element() claims pa on success or failure. */
-     ret = add_pa_data_element(pa_list, pa);
-@@ -1545,20 +1537,6 @@ _make_etype_info_entry(krb5_context context,
-                                    &salttype, &salt);
-     if (retval)
-         goto cleanup;
--    if (etype_info2 && salttype == KRB5_KDB_SALTTYPE_AFS3) {
--        switch (etype) {
--        case ENCTYPE_DES_CBC_CRC:
--        case ENCTYPE_DES_CBC_MD4:
--        case ENCTYPE_DES_CBC_MD5:
--            retval = alloc_data(&entry->s2kparams, 1);
--            if (retval)
--                goto cleanup;
--            entry->s2kparams.data[0] = 1;
--            break;
--        default:
--            break;
--        }
--    }
- 
-     entry->length = salt->length;
-     entry->salt = (unsigned char *)salt->data;
-diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-index 8361fb085..db899a1dc 100644
---- a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-+++ b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-@@ -18,8 +18,8 @@ proc test200 {} {
- 
-     # I'd like to specify a long list of keysalt tuples and make sure
-     # that chpass does the right thing, but we can only use those
--    # enctypes that krbtgt has a key for: des-cbc-crc:normal and
--    # des-cbc-crc:v4, according to the prototype kdc.conf.
-+    # enctypes that krbtgt has a key for: des-cbc-crc:normal
-+    # according to the prototype kdc.conf.
-     if {! [cmd [format {
- 	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
- 		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-@@ -53,10 +53,10 @@ proc test200 {} {
-     }
- 
-     # XXX Perhaps I should actually check the key type returned.
--    if {$num_keys == 3} {
-+    if {$num_keys == 2} {
- 	pass "$test"
-     } else {
--	fail "$test: $num_keys keys, should be 3"
-+	fail "$test: $num_keys keys, should be 2"
-     }
-     if { ! [cmd {kadm5_destroy $server_handle}]} {
- 	perror "$test: unexpected failure in destroy"
-diff --git a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-index 86c45f49e..8526897ed 100644
---- a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-+++ b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-@@ -143,8 +143,8 @@ proc test101_102 {rpc} {
-     }
- 
-     set failed 0
--    if {$num_keys != 3} {
--	fail "$test: num_keys $num_keys should be 3"
-+    if {$num_keys != 2} {
-+	fail "$test: num_keys $num_keys should be 2"
- 	set failed 1
-     }
-     for {set i 0} {$i < $num_keys} {incr i} {
-diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c
-index da5332217..b81a44312 100644
---- a/src/lib/kdb/kdb5.c
-+++ b/src/lib/kdb/kdb5.c
-@@ -2312,15 +2312,11 @@ krb5_dbe_compute_salt(krb5_context context, const krb5_key_data *key,
-         if (retval)
-             return retval;
-         break;
--    case KRB5_KDB_SALTTYPE_V4:
--        sdata = empty_data();
--        break;
-     case KRB5_KDB_SALTTYPE_NOREALM:
-         retval = krb5_principal2salt_norealm(context, princ, &sdata);
-         if (retval)
-             return retval;
-         break;
--    case KRB5_KDB_SALTTYPE_AFS3:
-     case KRB5_KDB_SALTTYPE_ONLYREALM:
-         return krb5_copy_data(context, &princ->realm, salt_out);
-     case KRB5_KDB_SALTTYPE_SPECIAL:
-diff --git a/src/lib/kdb/kdb_cpw.c b/src/lib/kdb/kdb_cpw.c
-index 03efc28ed..450860f47 100644
---- a/src/lib/kdb/kdb_cpw.c
-+++ b/src/lib/kdb/kdb_cpw.c
-@@ -260,7 +260,6 @@ add_key_pwd(context, master_key, ks_tuple, ks_tuple_count, passwd,
-     krb5_keysalt          key_salt;
-     krb5_keyblock         key;
-     krb5_data             pwd;
--    krb5_data             afs_params = string2data("\1"), *s2k_params;
-     int                   i, j;
-     krb5_key_data        *kd_slot;
- 
-@@ -268,7 +267,6 @@ add_key_pwd(context, master_key, ks_tuple, ks_tuple_count, passwd,
-         krb5_boolean similar;
- 
-         similar = 0;
--        s2k_params = NULL;
- 
-         /*
-          * We could use krb5_keysalt_iterate to replace this loop, or use
-@@ -316,18 +314,6 @@ add_key_pwd(context, master_key, ks_tuple, ks_tuple_count, passwd,
-                                               &key_salt.data)))
-                 return(retval);
-             break;
--        case KRB5_KDB_SALTTYPE_V4:
--            key_salt.data.length = 0;
--            key_salt.data.data = 0;
--            break;
--        case KRB5_KDB_SALTTYPE_AFS3:
--            retval = krb5int_copy_data_contents(context,
--                                                &db_entry->princ->realm,
--                                                &key_salt.data);
--            if (retval)
--                return retval;
--            s2k_params = &afs_params;
--            break;
-         case KRB5_KDB_SALTTYPE_SPECIAL:
-             retval = make_random_salt(context, &key_salt);
-             if (retval)
-@@ -342,7 +328,7 @@ add_key_pwd(context, master_key, ks_tuple, ks_tuple_count, passwd,
-         retval = krb5_c_string_to_key_with_params(context,
-                                                   ks_tuple[i].ks_enctype,
-                                                   &pwd, &key_salt.data,
--                                                  s2k_params, &key);
-+                                                  NULL, &key);
-         if (retval) {
-             free(key_salt.data.data);
-             return retval;
-diff --git a/src/lib/krb5/krb/str_conv.c b/src/lib/krb5/krb/str_conv.c
-index 3d057241b..c8421a8c1 100644
---- a/src/lib/krb5/krb/str_conv.c
-+++ b/src/lib/krb5/krb/str_conv.c
-@@ -61,11 +61,9 @@ struct salttype_lookup_entry {
- #include "kdb.h"
- static const struct salttype_lookup_entry salttype_table[] = {
-     { KRB5_KDB_SALTTYPE_NORMAL,     "normal"     },
--    { KRB5_KDB_SALTTYPE_V4,         "v4",        },
-     { KRB5_KDB_SALTTYPE_NOREALM,    "norealm",   },
-     { KRB5_KDB_SALTTYPE_ONLYREALM,  "onlyrealm", },
-     { KRB5_KDB_SALTTYPE_SPECIAL,    "special",   },
--    { KRB5_KDB_SALTTYPE_AFS3,       "afs3",      },
- };
- static const int salttype_table_nents = sizeof(salttype_table)/
-     sizeof(salttype_table[0]);
-diff --git a/src/lib/krb5/krb/t_get_etype_info.py b/src/lib/krb5/krb/t_get_etype_info.py
-index 7c400be86..3c9168591 100644
---- a/src/lib/krb5/krb/t_get_etype_info.py
-+++ b/src/lib/krb5/krb/t_get_etype_info.py
-@@ -9,9 +9,6 @@ realm.run([kadminl, 'ank', '-nokey', '+preauth', 'pnokey'])
- realm.run([kadminl, 'ank', '-e', 'aes256-cts:special', '-pw', 'pw', 'exp'])
- realm.run([kadminl, 'ank', '-e', 'aes256-cts:special', '-pw', 'pw', '+preauth',
-            'pexp'])
--realm.run([kadminl, 'ank', '-e', 'des-cbc-crc:afs3', '-pw', 'pw', 'afs'])
--realm.run([kadminl, 'ank', '-e', 'des-cbc-crc:afs3', '-pw', 'pw', '+preauth',
--           'pafs'])
- 
- # Extract the explicit salt values from the database.
- out = realm.run([kdb5_util, 'tabdump', 'keyinfo'])
-@@ -56,8 +53,4 @@ realm.run(['./t_get_etype_info', 'exp'],
- realm.run(['./t_get_etype_info', 'pexp'],
-           expected_msg='etype: aes256-cts\nsalt: ' + pexp_salt + '\n')
- 
--msg = 'etype: des-cbc-crc\nsalt: KRBTEST.COM\ns2kparams: 01\n'
--realm.run(['./t_get_etype_info', 'afs'], expected_msg=msg)
--realm.run(['./t_get_etype_info', 'pafs'], expected_msg=msg)
--
- success('krb5_get_etype_info() tests')
-diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
-index ab3ee0289..4a75be8cb 100644
---- a/src/man/kdc.conf.man
-+++ b/src/man/kdc.conf.man
-@@ -1,6 +1,6 @@
- .\" Man page generated from reStructuredText.
- .
--.TH "KDC.CONF" "5" " " "1.17" "MIT Kerberos"
-+.TH "KDC.CONF" "5" " " "1.18" "MIT Kerberos"
- .SH NAME
- kdc.conf \- Kerberos V5 KDC configuration file
- .
-@@ -1148,12 +1148,6 @@ default for Kerberos Version 5
- T}
- _
- T{
--v4
--T}	T{
--the only type used by Kerberos Version 4 (no salt)
--T}
--_
--T{
- norealm
- T}	T{
- same as the default, without using realm information
-@@ -1166,12 +1160,6 @@ uses only realm information as the salt
- T}
- _
- T{
--afs3
--T}	T{
--AFS version 3, only used for compatibility with Kerberos 4 in AFS
--T}
--_
--T{
- special
- T}	T{
- generate a random salt
-diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp
-index ea9bedd45..c061d764e 100644
---- a/src/tests/dejagnu/config/default.exp
-+++ b/src/tests/dejagnu/config/default.exp
-@@ -238,22 +238,6 @@ set passes {
- 	{master_key_type=aes256-cts-hmac-sha1-96}
- 	{dummy=[verbose -log "AES + DES enctypes, DES3 TGT"]}
-     }
--    {
--	des-v4
--	mode=udp
--	des3_krbtgt=0
--	{supported_enctypes=des-cbc-crc:v4}
--	{default_tkt_enctypes(client)=des-cbc-crc}
--	{dummy=[verbose -log "DES TGT, DES-CRC enctype, V4 salt"]}
--    }
--    {
--	des-md5-v4
--	mode=udp
--	des3_krbtgt=0
--	{supported_enctypes=des-cbc-md5:v4 des-cbc-crc:v4}
--	{default_tkt_enctypes(client)=des-cbc-md5 des-cbc-crc}
--	{dummy=[verbose -log "DES TGT, DES-MD5 and -CRC enctypes, V4 salt"]}
--    }
-     {
- 	all-enctypes
- 	mode=udp
-@@ -356,7 +340,6 @@ set unused_passes {
- 	aes128-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:norealm \
- 	des3-cbc-sha1:normal des3-cbc-sha1:none \
- 	des-cbc-md5:normal des-cbc-md4:normal des-cbc-crc:normal \
--	des-cbc-md5:v4 des-cbc-md4:v4 des-cbc-crc:v4 \
- 	}
- 	{dummy=[verbose -log "DES3 TGT, default enctypes"]}
-     }
-diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
-index 2026e7876..c21d054f1 100644
---- a/src/tests/t_etype_info.py
-+++ b/src/tests/t_etype_info.py
-@@ -1,6 +1,6 @@
- from k5test import *
- 
--supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac des-cbc-crc:afs3'
-+supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac'
- conf = {'libdefaults': {'allow_weak_crypto': 'true'},
-         'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
- realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf)
-@@ -43,28 +43,6 @@ test_etinfo('preauthuser', 'rc4-hmac-exp des3 rc4 des-cbc-crc',
- test_etinfo('preauthuser', 'rc4 aes256-cts',
-             ['error etype_info2 rc4-hmac KRBTEST.COMpreauthuser'])
- 
--# AFS3 salt for DES enctypes is conveyed using s2kparams in
--# PA-ETYPE-INFO2, not at all in PA-ETYPE-INFO, and with a special padata
--# type instead of PA-PW-SALT.
--test_etinfo('user', 'des-cbc-crc rc4',
--            ['asrep etype_info2 des-cbc-crc KRBTEST.COM 01',
--             'asrep etype_info des-cbc-crc KRBTEST.COM',
--             'asrep afs3_salt KRBTEST.COM'])
--test_etinfo('preauthuser', 'des-cbc-crc rc4',
--            ['error etype_info2 des-cbc-crc KRBTEST.COM 01',
--             'error etype_info des-cbc-crc KRBTEST.COM'])
--
--# DES keys can be used with other DES enctypes.  The requested enctype
--# shows up in the etype-info, not the database key enctype.
--test_etinfo('user', 'des-cbc-md4 rc4',
--            ['asrep etype_info2 des-cbc-md4 KRBTEST.COM 01',
--             'asrep etype_info des-cbc-md4 KRBTEST.COM',
--             'asrep afs3_salt KRBTEST.COM'])
--test_etinfo('user', 'des-cbc-md5 rc4',
--            ['asrep etype_info2 des KRBTEST.COM 01',
--             'asrep etype_info des KRBTEST.COM',
--             'asrep afs3_salt KRBTEST.COM'])
--
- # If no keys are found matching the request enctypes, a
- # preauth-required error can be generated with no etype-info at all
- # (to allow for preauth mechs which don't depend on long-term keys).
-diff --git a/src/tests/t_keytab.py b/src/tests/t_keytab.py
-index 72e09daac..633f7c7ef 100755
---- a/src/tests/t_keytab.py
-+++ b/src/tests/t_keytab.py
-@@ -155,9 +155,6 @@ realm.run([kadminl, 'ank', '-pw', 'pw', 'default'])
- realm.run([kadminl, 'ank', '-e', 'aes256-cts:special', '-pw', 'pw', 'exp'])
- realm.run([kadminl, 'ank', '-e', 'aes256-cts:special', '-pw', 'pw', '+preauth',
-            'pexp'])
--realm.run([kadminl, 'ank', '-e', 'des-cbc-crc:afs3', '-pw', 'pw', 'afs'])
--realm.run([kadminl, 'ank', '-e', 'des-cbc-crc:afs3', '-pw', 'pw', '+preauth',
--           'pafs'])
- 
- # Extract one of the explicit salt values from the database.
- out = realm.run([kdb5_util, 'tabdump', 'keyinfo'])
-@@ -187,8 +184,6 @@ test_addent(realm, 'default', '-f')
- test_addent(realm, 'default', '-f -e aes128-cts')
- test_addent(realm, 'exp', '-f')
- test_addent(realm, 'pexp', '-f')
--test_addent(realm, 'afs', '-f')
--test_addent(realm, 'pafs', '-f')
- 
- success('Keytab-related tests')
- success('Keytab-related tests')
-diff --git a/src/tests/t_renprinc.py b/src/tests/t_renprinc.py
-index 46cbed441..3dbb3e77e 100755
---- a/src/tests/t_renprinc.py
-+++ b/src/tests/t_renprinc.py
-@@ -25,7 +25,7 @@ from k5test import *
- enctype = "aes128-cts"
- 
- realm = K5Realm(create_host=False, create_user=False)
--salttypes = ('normal', 'v4', 'norealm', 'onlyrealm')
-+salttypes = ('normal', 'norealm', 'onlyrealm')
- 
- # For a variety of salt types, test that we can rename a principal and
- # still get tickets with the same password.
-diff --git a/src/tests/t_salt.py b/src/tests/t_salt.py
-index 278911a22..008efcb03 100755
---- a/src/tests/t_salt.py
-+++ b/src/tests/t_salt.py
-@@ -15,13 +15,9 @@ def test_salt(realm, e1, salt, e2):
-     realm.run([kadminl, 'delprinc', 'user'])
- 
- # Enctype/salt pairs chosen with non-default salt types.
--# The enctypes are mostly arbitrary, though afs3 must only be used with des.
--# We do not enforce that v4 salts must only be used with des, but it seems
--# like a good idea.
--salts = [('des-cbc-crc', 'afs3'),
--         ('des3-cbc-sha1', 'norealm'),
-+# The enctypes are mostly arbitrary.
-+salts = [('des3-cbc-sha1', 'norealm'),
-          ('arcfour-hmac', 'onlyrealm'),
--         ('des-cbc-crc', 'v4'),
-          ('aes128-cts-hmac-sha1-96', 'special')]
- # These enctypes are chosen to cover the different string-to-key routines.
- # Omit ":normal" from aes256 to check that salttype defaulting works.
-@@ -56,22 +52,4 @@ dup_kstypes = ['arcfour-hmac-md5:normal,rc4-hmac:normal',
- for ks in dup_kstypes:
-     test_dup(realm, ks)
- 
--# Attempt to create a principal with a non-des enctype and the afs3 salt,
--# verifying that the expected error is received and the principal creation
--# fails.
--def test_reject_afs3(realm, etype):
--    query = 'ank -e ' + etype + ':afs3 -pw password princ1'
--    realm.run([kadminl, 'ank', '-e', etype + ':afs3', '-pw', 'password',
--               'princ1'], expected_code=1,
--              expected_msg='Invalid key generation parameters from KDC')
--    realm.run([kadminl, 'getprinc', 'princ1'], expected_code=1,
--              expected_msg='Principal does not exist')
--
--# Verify that the afs3 salt is rejected for arcfour and pbkdf2 enctypes.
--# We do not currently do any verification on the key-generation parameters
--# for the triple-DES enctypes, so that test is commented out.
--test_reject_afs3(realm, 'arcfour-hmac')
--test_reject_afs3(realm, 'aes256-cts-hmac-sha1-96')
--#test_reject_afs3(realm, 'des3-cbc-sha1')
--
- success("Salt types")
-diff --git a/src/util/k5test.py b/src/util/k5test.py
-index 3aec1ef92..b6d93f1d8 100644
---- a/src/util/k5test.py
-+++ b/src/util/k5test.py
-@@ -1246,17 +1246,6 @@ _passes = [
-     # No special settings; exercises AES256.
-     ('default', None, None, None),
- 
--    # Exercise a DES enctype and the v4 salt type.
--    ('desv4', None,
--     {'libdefaults': {
--                'default_tgs_enctypes': 'des-cbc-crc',
--                'default_tkt_enctypes': 'des-cbc-crc',
--                'permitted_enctypes': 'des-cbc-crc',
--                'allow_weak_crypto': 'true'}},
--     {'realms': {'$realm': {
--                    'supported_enctypes': 'des-cbc-crc:v4',
--                    'master_key_type': 'des-cbc-crc'}}}),
--
-     # Exercise the DES3 enctype.
-     ('des3', None,
-      {'libdefaults': {
diff --git a/Set-a-more-modern-default-ksu-CMD_PATH.patch b/Set-a-more-modern-default-ksu-CMD_PATH.patch
deleted file mode 100644
index 31f9602..0000000
--- a/Set-a-more-modern-default-ksu-CMD_PATH.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 6b50f9c5b2a1b856e65fa69de05e7c05d2b89614 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:32:09 -0400
-Subject: [PATCH] Set a more modern default ksu CMD_PATH
-
-ksu uses CMD_PATH to expand command names in .k5users.  Include the /usr
-tree and .../sbin variants.  Drop nonstandard /local.
-
-ticket: 8807 (new)
-(cherry picked from commit 9eb937a6e1f740d323221813e5da096d30bd68de)
----
- src/clients/ksu/Makefile.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in
-index 5755bb58a..9d58f29b5 100644
---- a/src/clients/ksu/Makefile.in
-+++ b/src/clients/ksu/Makefile.in
-@@ -1,6 +1,6 @@
- mydir=clients$(S)ksu
- BUILDTOP=$(REL)..$(S)..
--DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/bin /local/bin"'
-+DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/usr/local/sbin /usr/local/bin /sbin /bin /usr/sbin /usr/bin"'
- 
- KSU_LIBS=@KSU_LIBS@
- PAM_LIBS=@PAM_LIBS@
diff --git a/Simplify-SAM-2-as_key-handling.patch b/Simplify-SAM-2-as_key-handling.patch
deleted file mode 100644
index 8929e65..0000000
--- a/Simplify-SAM-2-as_key-handling.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 3b4f517a3a403943877e925ae0eb1745611b996f Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Sun, 5 May 2019 18:53:27 -0400
-Subject: [PATCH] Simplify SAM-2 as_key handling
-
-The ctx->gak_fct() call in sam2_process() used an empty salt instead
-of the default salt when the KDC did not supply an explicit salt.
-This bug arose when commit bc096a77ffdab283d77c2e0fc1fdd15b9f77eb41
-changed the internal contracts around salts but did not adjust the
-SAM-2 code.  Commit e9aa891fcdb4c08d39902ab89afb268042b60c86 fixed the
-resulting bug, but mistakenly did not adjust the gak_fct call to use
-the correct salt.
-
-Later on, the code contains a redundant call to krb5_c_string_to_key()
-in the non-USE_SAD_AS_KEY modes, replacing ctx->as_key.  This call was
-properly adjusted by commit e9aa891fcdb4c08d39902ab89afb268042b60c86,
-so the improper gak_fct call did not manifest as a bug.
-
-Fix the gak_fct call to supply the correct salt, and remove the
-redundant string_to_key operation.
-
-(cherry picked from commit d48670c51460e9a74b4f4a9966f85ca6f77c1d8b)
----
- src/lib/krb5/krb/preauth_sam2.c | 25 +++----------------------
- 1 file changed, 3 insertions(+), 22 deletions(-)
-
-diff --git a/src/lib/krb5/krb/preauth_sam2.c b/src/lib/krb5/krb/preauth_sam2.c
-index 4c70021a9..c7484c47e 100644
---- a/src/lib/krb5/krb/preauth_sam2.c
-+++ b/src/lib/krb5/krb/preauth_sam2.c
-@@ -95,7 +95,6 @@ sam2_process(krb5_context context, krb5_clpreauth_moddata moddata,
-     krb5_prompt kprompt;
-     krb5_prompt_type prompt_type;
-     krb5_data defsalt, *salt;
--    struct gak_password *gakpw;
-     krb5_checksum **cksum;
-     krb5_data *scratch = NULL;
-     krb5_boolean valid_cksum = 0;
-@@ -152,9 +151,8 @@ sam2_process(krb5_context context, krb5_clpreauth_moddata moddata,
- 
-         salt = ctx->default_salt ? NULL : &ctx->salt;
-         retval = ctx->gak_fct(context, request->client, sc2b->sam_etype,
--                              prompter, prompter_data, &ctx->salt,
--                              &ctx->s2kparams, &ctx->as_key,
--                              ctx->gak_data, ctx->rctx.items);
-+                              prompter, prompter_data, salt, &ctx->s2kparams,
-+                              &ctx->as_key, ctx->gak_data, ctx->rctx.items);
-         if (retval) {
-             krb5_free_sam_challenge_2(context, sc2);
-             krb5_free_sam_challenge_2_body(context, sc2b);
-@@ -212,24 +210,7 @@ sam2_process(krb5_context context, krb5_clpreauth_moddata moddata,
- 
-     /* Get encryption key to be used for checksum and sam_response */
-     if (!(sc2b->sam_flags & KRB5_SAM_USE_SAD_AS_KEY)) {
--        /* as_key = string_to_key(password) */
--
--        if (ctx->as_key.length) {
--            krb5_free_keyblock_contents(context, &ctx->as_key);
--            ctx->as_key.length = 0;
--        }
--
--        /* generate a key using the supplied password */
--        gakpw = ctx->gak_data;
--        retval = krb5_c_string_to_key(context, sc2b->sam_etype,
--                                      gakpw->password, salt, &ctx->as_key);
--
--        if (retval) {
--            krb5_free_sam_challenge_2(context, sc2);
--            krb5_free_sam_challenge_2_body(context, sc2b);
--            if (defsalt.length) free(defsalt.data);
--            return(retval);
--        }
-+        /* Retain as_key from above gak_fct call. */
- 
-         if (!(sc2b->sam_flags & KRB5_SAM_SEND_ENCRYPTED_SAD)) {
-             /* as_key = combine_key (as_key, string_to_key(SAD)) */
diff --git a/Simplify-krb5_dbe_def_search_enctype.patch b/Simplify-krb5_dbe_def_search_enctype.patch
deleted file mode 100644
index f9f9365..0000000
--- a/Simplify-krb5_dbe_def_search_enctype.patch
+++ /dev/null
@@ -1,165 +0,0 @@
-From 18bd513161900357110e96b06c53144a212ab00c Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Thu, 22 Aug 2019 16:19:12 -0400
-Subject: [PATCH] Simplify krb5_dbe_def_search_enctype()
-
-Key data is now sorted in descending kvno order (since commit
-44ad57d8d38efc944f64536354435f5b721c0ee0) and key enctypes can be
-compared with a simple equality test (since single-DES support was
-removed in commit fb2dada5eb89c4cd4e39dedd6dbb7dbd5e94f8b8).  Use
-these assumptions to simplify krb5_dbe_def_search_enctype().
-
-The rewrite contains one probably-unnoticeable bugfix: if enctype,
-salttype, and kvno are all given as -1 in a repeated search, yield all
-key entries of permitted enctype, not just entries of the maximum
-kvno.
-
-(cherry picked from commit fcfb0e47c995a7e9f956c3716be3175f44ad26e0)
----
- src/lib/kdb/kdb_default.c | 117 +++++++++++++++-----------------------
- 1 file changed, 45 insertions(+), 72 deletions(-)
-
-diff --git a/src/lib/kdb/kdb_default.c b/src/lib/kdb/kdb_default.c
-index a1021f13a..231a0d8b4 100644
---- a/src/lib/kdb/kdb_default.c
-+++ b/src/lib/kdb/kdb_default.c
-@@ -37,94 +37,67 @@
- 
- 
- /*
-- * Given a particular enctype and optional salttype and kvno, find the
-- * most appropriate krb5_key_data entry of the database entry.
-- *
-- * If stype or kvno is negative, it is ignored.
-- * If kvno is 0 get the key which is maxkvno for the princ and matches
-- * the other attributes.
-+ * Set *kd_out to the key data entry matching kvno, enctype, and salttype.  If
-+ * any of those three parameters are -1, ignore them.  If kvno is 0, match only
-+ * the highest kvno.  Begin searching at the index *start and set *start to the
-+ * index after the match.  Do not return keys of non-permitted enctypes; return
-+ * KRB5_KDB_NO_PERMITTED_KEY if the whole list was searched and only
-+ * non-permitted matches were found.
-  */
- krb5_error_code
--krb5_dbe_def_search_enctype(kcontext, dbentp, start, ktype, stype, kvno, kdatap)
--    krb5_context        kcontext;
--    krb5_db_entry       *dbentp;
--    krb5_int32          *start;
--    krb5_int32          ktype;
--    krb5_int32          stype;
--    krb5_int32          kvno;
--    krb5_key_data       **kdatap;
-+krb5_dbe_def_search_enctype(krb5_context context, krb5_db_entry *ent,
-+                            krb5_int32 *start, krb5_int32 enctype,
-+                            krb5_int32 salttype, krb5_int32 kvno,
-+                            krb5_key_data **kd_out)
- {
--    int                 i, idx;
--    int                 maxkvno;
--    krb5_key_data       *datap;
--    krb5_error_code     ret;
--    krb5_boolean        saw_non_permitted = FALSE;
--
--    ret = 0;
--    if (ktype != -1 && !krb5_is_permitted_enctype(kcontext, ktype))
--        return KRB5_KDB_NO_PERMITTED_KEY;
--
--    if (kvno == -1 && stype == -1 && ktype == -1)
--        kvno = 0;
-+    krb5_key_data *kd;
-+    krb5_int32 db_salttype;
-+    krb5_boolean saw_non_permitted = FALSE;
-+    int i;
- 
--    if (kvno == 0) {
--        /* Get the max key version */
--        for (i = 0; i < dbentp->n_key_data; i++) {
--            if (kvno < dbentp->key_data[i].key_data_kvno) {
--                kvno = dbentp->key_data[i].key_data_kvno;
--            }
--        }
--    }
-+    *kd_out = NULL;
- 
--    maxkvno = -1;
--    idx = -1;
--    datap = (krb5_key_data *) NULL;
--    for (i = *start; i < dbentp->n_key_data; i++) {
--        krb5_boolean    similar;
--        krb5_int32      db_stype;
--
--        ret = 0;
--        if (dbentp->key_data[i].key_data_ver > 1) {
--            db_stype = dbentp->key_data[i].key_data_type[1];
--        } else {
--            db_stype = KRB5_KDB_SALTTYPE_NORMAL;
--        }
--
--        /* Match this entry against the arguments. */
--        if (ktype != -1) {
--            ret = krb5_c_enctype_compare(kcontext, (krb5_enctype) ktype,
--                                         dbentp->key_data[i].key_data_type[0],
--                                         &similar);
--            if (ret != 0 || !similar)
--                continue;
--        }
--        if (stype >= 0 && db_stype != stype)
-+    if (enctype != -1 && !krb5_is_permitted_enctype(context, enctype))
-+        return KRB5_KDB_NO_PERMITTED_KEY;
-+    if (ent->n_key_data == 0)
-+        return KRB5_KDB_NO_MATCHING_KEY;
-+
-+    /* Match the highest kvno if kvno is 0.  Key data is sorted in descending
-+     * order of kvno. */
-+    if (kvno == 0)
-+        kvno = ent->key_data[0].key_data_kvno;
-+
-+    for (i = *start; i < ent->n_key_data; i++) {
-+        kd = &ent->key_data[i];
-+        db_salttype = (kd->key_data_ver > 1) ? kd->key_data_type[1] :
-+            KRB5_KDB_SALTTYPE_NORMAL;
-+
-+        /* Match this entry against the arguments.  Stop searching if we have
-+         * passed the entries for the requested kvno. */
-+        if (enctype != -1 && kd->key_data_type[0] != enctype)
-+            continue;
-+        if (salttype >= 0 && db_salttype != salttype)
-             continue;
--        if (kvno >= 0 && dbentp->key_data[i].key_data_kvno != kvno)
-+        if (kvno >= 0 && kd->key_data_kvno < kvno)
-+            break;
-+        if (kvno >= 0 && kd->key_data_kvno != kvno)
-             continue;
- 
-         /* Filter out non-permitted enctypes. */
--        if (!krb5_is_permitted_enctype(kcontext,
--                                       dbentp->key_data[i].key_data_type[0])) {
-+        if (!krb5_is_permitted_enctype(context, kd->key_data_type[0])) {
-             saw_non_permitted = TRUE;
-             continue;
-         }
- 
--        if (dbentp->key_data[i].key_data_kvno > maxkvno) {
--            maxkvno = dbentp->key_data[i].key_data_kvno;
--            datap = &dbentp->key_data[i];
--            idx = i;
--        }
-+        *start = i + 1;
-+        *kd_out = kd;
-+        return 0;
-     }
-+
-     /* If we scanned the whole set of keys and matched only non-permitted
-      * enctypes, indicate that. */
--    if (maxkvno < 0 && *start == 0 && saw_non_permitted)
--        ret = KRB5_KDB_NO_PERMITTED_KEY;
--    if (maxkvno < 0)
--        return ret ? ret : KRB5_KDB_NO_MATCHING_KEY;
--    *kdatap = datap;
--    *start = idx+1;
--    return 0;
-+    return (*start == 0 && saw_non_permitted) ? KRB5_KDB_NO_PERMITTED_KEY :
-+        KRB5_KDB_NO_MATCHING_KEY;
- }
- 
- /*
diff --git a/Simply-OpenSSL-PKCS7-decryption-code.patch b/Simply-OpenSSL-PKCS7-decryption-code.patch
deleted file mode 100644
index 94ef2a1..0000000
--- a/Simply-OpenSSL-PKCS7-decryption-code.patch
+++ /dev/null
@@ -1,300 +0,0 @@
-From 172390c584726ecd5747b064587acc1db44a98ca Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Mon, 6 May 2019 13:13:06 -0400
-Subject: [PATCH] Simply OpenSSL PKCS7 decryption code
-
-Fold pkcs7_decrypt() and pkcs7_dataDecode() into a single function,
-and make it output the plaintext rather than a BIO.
-
-[ghudson@mit.edu: continued a modernization of pkcs7_dataDecode() into
-a larger refactoring]
-
-(cherry picked from commit 210356653a2f963ffe9a8a1b1627c64fb8ca7a3d)
----
- .../preauth/pkinit/pkinit_crypto_openssl.c    | 211 +++++-------------
- 1 file changed, 62 insertions(+), 149 deletions(-)
-
-diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-index 5ff81d8cf..8aa2c5257 100644
---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-@@ -81,12 +81,8 @@ static int openssl_callback (int, X509_STORE_CTX *);
- static int openssl_callback_ignore_crls (int, X509_STORE_CTX *);
- 
- static int pkcs7_decrypt
--(krb5_context context, pkinit_identity_crypto_context id_cryptoctx,
-- PKCS7 *p7, BIO *bio);
--
--static BIO * pkcs7_dataDecode
--(krb5_context context, pkinit_identity_crypto_context id_cryptoctx,
-- PKCS7 *p7);
-+(krb5_context context, pkinit_identity_crypto_context id_cryptoctx, PKCS7 *p7,
-+ unsigned char **data_out, unsigned int *len_out);
- 
- static ASN1_OBJECT * pkinit_pkcs7type2oid
- (pkinit_plg_crypto_context plg_cryptoctx, int pkcs7_type);
-@@ -1964,9 +1960,6 @@ cms_envelopeddata_verify(krb5_context context,
- {
-     krb5_error_code retval = KRB5KDC_ERR_PREAUTH_FAILED;
-     PKCS7 *p7 = NULL;
--    BIO *out = NULL;
--    int i = 0;
--    unsigned int size = 0;
-     const unsigned char *p = enveloped_data;
-     unsigned int tmp_buf_len = 0, tmp_buf2_len = 0, vfy_buf_len = 0;
-     unsigned char *tmp_buf = NULL, *tmp_buf2 = NULL, *vfy_buf = NULL;
-@@ -1991,26 +1984,13 @@ cms_envelopeddata_verify(krb5_context context,
-     }
- 
-     /* decrypt received PKCS7 message */
--    out = BIO_new(BIO_s_mem());
--    if (pkcs7_decrypt(context, id_cryptoctx, p7, out)) {
-+    if (pkcs7_decrypt(context, id_cryptoctx, p7, &tmp_buf, &tmp_buf_len)) {
-         pkiDebug("PKCS7 decryption successful\n");
-     } else {
-         retval = oerr(context, 0, _("Failed to decrypt PKCS7 message"));
-         goto cleanup;
-     }
- 
--    /* transfer the decoded PKCS7 SignedData message into a separate buffer */
--    for (;;) {
--        if ((tmp_buf = realloc(tmp_buf, size + 1024 * 10)) == NULL)
--            goto cleanup;
--        i = BIO_read(out, &(tmp_buf[size]), 1024 * 10);
--        if (i <= 0)
--            break;
--        else
--            size += i;
--    }
--    tmp_buf_len = size;
--
- #ifdef DEBUG_ASN1
-     print_buffer_bin(tmp_buf, tmp_buf_len, "/tmp/client_enc_keypack");
- #endif
-@@ -2072,8 +2052,6 @@ cleanup:
- 
-     if (p7 != NULL)
-         PKCS7_free(p7);
--    if (out != NULL)
--        BIO_free(out);
-     free(tmp_buf);
-     free(tmp_buf2);
- 
-@@ -5714,39 +5692,6 @@ cleanup:
-     return retval;
- }
- 
--static int
--pkcs7_decrypt(krb5_context context,
--              pkinit_identity_crypto_context id_cryptoctx,
--              PKCS7 *p7,
--              BIO *data)
--{
--    BIO *tmpmem = NULL;
--    int retval = 0, i = 0;
--    char buf[4096];
--
--    if(p7 == NULL)
--        return 0;
--
--    if(!PKCS7_type_is_enveloped(p7)) {
--        pkiDebug("wrong pkcs7 content type\n");
--        return 0;
--    }
--
--    if(!(tmpmem = pkcs7_dataDecode(context, id_cryptoctx, p7))) {
--        pkiDebug("unable to decrypt pkcs7 object\n");
--        return 0;
--    }
--
--    for(;;) {
--        i = BIO_read(tmpmem, buf, sizeof(buf));
--        if (i <= 0) break;
--        BIO_write(data, buf, i);
--        BIO_free_all(tmpmem);
--        return 1;
--    }
--    return retval;
--}
--
- krb5_error_code
- pkinit_process_td_trusted_certifiers(
-     krb5_context context,
-@@ -5827,118 +5772,86 @@ cleanup:
-     return retval;
- }
- 
--static BIO *
--pkcs7_dataDecode(krb5_context context,
--                 pkinit_identity_crypto_context id_cryptoctx,
--                 PKCS7 *p7)
-+/* Originally based on OpenSSL's PKCS7_dataDecode(), now modified to remove the
-+ * use of BIO objects and to fit the PKINIT internal interfaces. */
-+static int
-+pkcs7_decrypt(krb5_context context,
-+              pkinit_identity_crypto_context id_cryptoctx, PKCS7 *p7,
-+              unsigned char **data_out, unsigned int *len_out)
- {
--    unsigned int eklen=0, tkeylen=0;
--    BIO *out=NULL,*etmp=NULL,*bio=NULL;
--    unsigned char *ek=NULL, *tkey=NULL;
--    ASN1_OCTET_STRING *data_body=NULL;
--    const EVP_CIPHER *evp_cipher=NULL;
--    EVP_CIPHER_CTX *evp_ctx=NULL;
--    X509_ALGOR *enc_alg=NULL;
--    STACK_OF(PKCS7_RECIP_INFO) *rsk=NULL;
--    PKCS7_RECIP_INFO *ri=NULL;
--
--    p7->state=PKCS7_S_HEADER;
--
--    rsk=p7->d.enveloped->recipientinfo;
--    enc_alg=p7->d.enveloped->enc_data->algorithm;
--    data_body=p7->d.enveloped->enc_data->enc_data;
--    evp_cipher=EVP_get_cipherbyobj(enc_alg->algorithm);
--    if (evp_cipher == NULL) {
--        PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CIPHER_TYPE);
--        goto cleanup;
--    }
-+    krb5_error_code ret;
-+    int ok = 0, plaintext_len = 0, final_len;
-+    unsigned int keylen = 0, eklen = 0, blocksize;
-+    unsigned char *ek = NULL, *tkey = NULL, *plaintext = NULL, *use_key;
-+    ASN1_OCTET_STRING *data_body = p7->d.enveloped->enc_data->enc_data;
-+    const EVP_CIPHER *evp_cipher;
-+    EVP_CIPHER_CTX *evp_ctx = NULL;
-+    X509_ALGOR *enc_alg = p7->d.enveloped->enc_data->algorithm;
-+    STACK_OF(PKCS7_RECIP_INFO) *rsk = p7->d.enveloped->recipientinfo;
-+    PKCS7_RECIP_INFO *ri = NULL;
- 
--    if ((etmp=BIO_new(BIO_f_cipher())) == NULL) {
--        PKCS7err(PKCS7_F_PKCS7_DATADECODE,ERR_R_BIO_LIB);
--        goto cleanup;
--    }
-+    *data_out = NULL;
-+    *len_out = 0;
- 
--    /* It was encrypted, we need to decrypt the secret key
--     * with the private key */
-+    p7->state = PKCS7_S_HEADER;
- 
-     /* RFC 4556 section 3.2.3.2 requires that there be exactly one
-      * recipientInfo. */
-     if (sk_PKCS7_RECIP_INFO_num(rsk) != 1) {
-         pkiDebug("invalid number of EnvelopedData RecipientInfos\n");
--        goto cleanup;
-+        return 0;
-     }
--
-     ri = sk_PKCS7_RECIP_INFO_value(rsk, 0);
--    (void)pkinit_decode_data(context, id_cryptoctx,
--                             ASN1_STRING_get0_data(ri->enc_key),
--                             ASN1_STRING_length(ri->enc_key), &ek, &eklen);
- 
--    evp_ctx=NULL;
--    BIO_get_cipher_ctx(etmp,&evp_ctx);
--    if (EVP_CipherInit_ex(evp_ctx,evp_cipher,NULL,NULL,NULL,0) <= 0)
-+    evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
-+    if (evp_cipher == NULL)
-+        goto cleanup;
-+    keylen = EVP_CIPHER_key_length(evp_cipher);
-+    blocksize = EVP_CIPHER_block_size(evp_cipher);
-+
-+    evp_ctx = EVP_CIPHER_CTX_new();
-+    if (evp_ctx == NULL)
-         goto cleanup;
--    if (EVP_CIPHER_asn1_to_param(evp_ctx,enc_alg->parameter) < 0)
-+    if (!EVP_DecryptInit(evp_ctx, evp_cipher, NULL, NULL) ||
-+        EVP_CIPHER_asn1_to_param(evp_ctx, enc_alg->parameter) <= 0)
-         goto cleanup;
- 
-     /* Generate a random symmetric key to avoid exposing timing data if RSA
-      * decryption fails the padding check. */
--    tkeylen = EVP_CIPHER_CTX_key_length(evp_ctx);
--    tkey = OPENSSL_malloc(tkeylen);
--    if (tkey == NULL)
-+    tkey = malloc(keylen);
-+    if (tkey == NULL || !EVP_CIPHER_CTX_rand_key(evp_ctx, tkey))
-         goto cleanup;
--    if (EVP_CIPHER_CTX_rand_key(evp_ctx, tkey) <= 0)
--        goto cleanup;
--    if (ek == NULL) {
--        ek = tkey;
--        eklen = tkeylen;
--        tkey = NULL;
--    }
- 
--    if (eklen != (unsigned)EVP_CIPHER_CTX_key_length(evp_ctx)) {
--        /* Some S/MIME clients don't use the same key
--         * and effective key length. The key length is
--         * determined by the size of the decrypted RSA key.
--         */
--        if (!EVP_CIPHER_CTX_set_key_length(evp_ctx, (int)eklen)) {
--            ek = tkey;
--            eklen = tkeylen;
--            tkey = NULL;
--        }
--    }
--    if (EVP_CipherInit_ex(evp_ctx,NULL,NULL,ek,NULL,0) <= 0)
--        goto cleanup;
-+    /* Decrypt the secret key with the private key. */
-+    ret = pkinit_decode_data(context, id_cryptoctx,
-+                             ASN1_STRING_get0_data(ri->enc_key),
-+                             ASN1_STRING_length(ri->enc_key), &ek, &eklen);
-+    use_key = (ret || eklen != keylen) ? tkey : ek;
- 
--    if (out == NULL)
--        out=etmp;
--    else
--        BIO_push(out,etmp);
--    etmp=NULL;
-+    /* Allocate a plaintext buffer and decrypt data_body into it. */
-+    plaintext = malloc(data_body->length + blocksize);
-+    if (plaintext == NULL)
-+        goto cleanup;
-+    if (!EVP_DecryptInit(evp_ctx, NULL, use_key, NULL))
-+        goto cleanup;
-+    if (!EVP_DecryptUpdate(evp_ctx, plaintext, &plaintext_len,
-+                           data_body->data, data_body->length))
-+        goto cleanup;
-+    if (!EVP_DecryptFinal(evp_ctx, plaintext + plaintext_len, &final_len))
-+        goto cleanup;
-+    plaintext_len += final_len;
- 
--    if (data_body->length > 0)
--        bio = BIO_new_mem_buf(data_body->data, data_body->length);
--    else {
--        bio=BIO_new(BIO_s_mem());
--        BIO_set_mem_eof_return(bio,0);
--    }
--    BIO_push(out,bio);
--    bio=NULL;
-+    *len_out = plaintext_len;
-+    *data_out = plaintext;
-+    plaintext = NULL;
-+    ok = 1;
- 
--    if (0) {
--    cleanup:
--        if (out != NULL) BIO_free_all(out);
--        if (etmp != NULL) BIO_free_all(etmp);
--        if (bio != NULL) BIO_free_all(bio);
--        out=NULL;
--    }
--    if (ek != NULL) {
--        OPENSSL_cleanse(ek, eklen);
--        OPENSSL_free(ek);
--    }
--    if (tkey != NULL) {
--        OPENSSL_cleanse(tkey, tkeylen);
--        OPENSSL_free(tkey);
--    }
--    return(out);
-+cleanup:
-+    EVP_CIPHER_CTX_free(evp_ctx);
-+    zapfree(plaintext, plaintext_len);
-+    zapfree(ek, eklen);
-+    zapfree(tkey, keylen);
-+    return ok;
- }
- 
- #ifdef DEBUG_DH
diff --git a/Skip-URI-tests-when-using-asan.patch b/Skip-URI-tests-when-using-asan.patch
deleted file mode 100644
index 4c82306..0000000
--- a/Skip-URI-tests-when-using-asan.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 345ffa545ef85ae5c6384c931759cc5353f4d434 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Sat, 3 Aug 2019 13:30:28 -0400
-Subject: [PATCH] Skip URI tests when using asan
-
-resolve_wrapper uses RTLD_DEEPBIND to load libresolv, triggering a
-failure in the asan runtime.
-
-(cherry picked from commit dbcec74b277952adf6e49d087932d2d0ea5393d1)
----
- src/lib/krb5/os/Makefile.in | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/src/lib/krb5/os/Makefile.in b/src/lib/krb5/os/Makefile.in
-index 91b0486b8..f523a5ac8 100644
---- a/src/lib/krb5/os/Makefile.in
-+++ b/src/lib/krb5/os/Makefile.in
-@@ -232,12 +232,16 @@ check-unix-locate: t_locate_kdc
- 		echo 'Skipped t_locate_kdc test: OFFLINE' >> $(SKIPTESTS); \
- 	fi
- 
-+ASAN = @ASAN@
- check-unix-uri: t_locate_kdc
--	if [ $(HAVE_RESOLV_WRAPPER) = 1 ]; then \
--	    $(RUNPYTEST) $(srcdir)/t_discover_uri.py $(PYTESTFLAGS); \
--	else \
-+	if [ $(HAVE_RESOLV_WRAPPER) = 0 ]; then \
- 	    echo '*** WARNING: skipped t_discover_uri.py due to not using resolv_wrapper'; \
- 	    echo 'Skipped URI discovery tests: resolv_wrapper 1.1.5 not found' >> $(SKIPTESTS); \
-+	elif [ $(ASAN) = yes ]; then \
-+	    echo '*** Skipping URI discovery tests: resolv_wrapper is incompatible with asan'; \
-+	    echo 'Skipped URI discovery tests: incompatible with asan' >> $(SKIPTESTS); \
-+	else \
-+	    $(RUNPYTEST) $(srcdir)/t_discover_uri.py $(PYTESTFLAGS); \
- 	fi
- 
- check-unix-trace: t_trace
diff --git a/Squash-apparent-forward-null-in-clnttcp_create.patch b/Squash-apparent-forward-null-in-clnttcp_create.patch
deleted file mode 100644
index 084d23a..0000000
--- a/Squash-apparent-forward-null-in-clnttcp_create.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From e2087bcf8a10fa0ecc4f0663e8df9b7ef5752805 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Fri, 30 Aug 2019 11:16:58 -0400
-Subject: [PATCH] Squash apparent forward-null in clnttcp_create()
-
-clnttcp_create() only allows raddr to be NULL if *sockp is set.
-Static analyzers cannot know this, so can report a forward null
-defect.  Add an raddr check before calling connect() to squash the
-defect.
-
-[ghudson@mit.edu: rewrote commit message]
-
-(cherry picked from commit b2f688eedd4bcca525201ef9485749a8c20b808a)
----
- src/lib/rpc/clnt_tcp.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/lib/rpc/clnt_tcp.c b/src/lib/rpc/clnt_tcp.c
-index 87761906c..dbd62d0a7 100644
---- a/src/lib/rpc/clnt_tcp.c
-+++ b/src/lib/rpc/clnt_tcp.c
-@@ -168,9 +168,9 @@ clnttcp_create(
- 	if (*sockp < 0) {
- 		*sockp = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
- 		(void)bindresvport_sa(*sockp, NULL);
--		if ((*sockp < 0)
--		    || (connect(*sockp, (struct sockaddr *)raddr,
--		    sizeof(*raddr)) < 0)) {
-+		if (*sockp < 0 || raddr == NULL ||
-+		    connect(*sockp, (struct sockaddr *)raddr,
-+			    sizeof(*raddr)) < 0) {
- 			rpc_createerr.cf_stat = RPC_SYSTEMERROR;
- 			rpc_createerr.cf_error.re_errno = errno;
-                         (void)closesocket(*sockp);
diff --git a/Support-389ds-s-lockout-model.patch b/Support-389ds-s-lockout-model.patch
deleted file mode 100644
index 2800e0b..0000000
--- a/Support-389ds-s-lockout-model.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 2c00970b3fe53b38f976c79f648fdd75a2682287 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:47:44 -0400
-Subject: [PATCH] Support 389ds's lockout model
-
-Handle the attribute 'nsAccountLock' from Netscape derivatives.  Based
-on a patch by Nalin Dahyabhai and Simo Sorce.
-
-ticket: 5891
-(cherry picked from commit 6ad061e24eca41a61eebed61db39768bfa51a084)
----
- src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c   | 18 ++++++++++++++++++
- .../kdb/ldap/libkdb_ldap/ldap_principal.c      |  1 +
- 2 files changed, 19 insertions(+)
-
-diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
-index 5b9d1e9fa..2ade63719 100644
---- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
-+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
-@@ -1420,6 +1420,7 @@ populate_krb5_db_entry(krb5_context context, krb5_ldap_context *ldap_context,
-     struct berval **ber_key_data = NULL, **ber_tl_data = NULL;
-     krb5_tl_data userinfo_tl_data = { NULL }, **endp, *tl;
-     osa_princ_ent_rec princ_ent;
-+    char *is_login_disabled = NULL;
- 
-     memset(&princ_ent, 0, sizeof(princ_ent));
- 
-@@ -1653,6 +1654,23 @@ populate_krb5_db_entry(krb5_context context, krb5_ldap_context *ldap_context,
-     if (ret)
-         goto cleanup;
- 
-+    /*
-+     * 389ds and other Netscape directory server derivatives support an
-+     * attribute "nsAccountLock" which functions similarly to eDirectory's
-+     * "loginDisabled".  When the user's account object is also a
-+     * krbPrincipalAux object, the kdb entry should be treated as if
-+     * DISALLOW_ALL_TIX has been set.
-+     */
-+    ret = krb5_ldap_get_string(ld, ent, "nsAccountLock", &is_login_disabled,
-+                               &attr_present);
-+    if (ret)
-+        goto cleanup;
-+    if (attr_present == TRUE) {
-+        if (strcasecmp(is_login_disabled, "TRUE") == 0)
-+            entry->attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
-+        free(is_login_disabled);
-+    }
-+
-     ret = krb5_read_tkt_policy(context, ldap_context, entry, tktpolname);
-     if (ret)
-         goto cleanup;
-diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
-index d722dbfa6..a5180c73f 100644
---- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
-+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
-@@ -54,6 +54,7 @@ char     *principal_attributes[] = { "krbprincipalname",
-                                      "krbLastFailedAuth",
-                                      "krbLoginFailedCount",
-                                      "krbLastSuccessfulAuth",
-+                                     "nsAccountLock",
-                                      "krbLastPwdChange",
-                                      "krbLastAdminUnlock",
-                                      "krbPrincipalAuthInd",
diff --git a/Update-ASN.1-SAM-tests-to-use-a-modern-enctype.patch b/Update-ASN.1-SAM-tests-to-use-a-modern-enctype.patch
deleted file mode 100644
index 980797e..0000000
--- a/Update-ASN.1-SAM-tests-to-use-a-modern-enctype.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 152e88043117927c334fead93bb3bd3dd74593b7 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 16 Apr 2019 14:16:39 -0400
-Subject: [PATCH] Update ASN.1 SAM tests to use a modern enctype
-
-(cherry picked from commit 3e94e53febc6d5636272f31ae9dba8e3babe9263)
----
- src/tests/asn.1/krb5_decode_test.c   | 2 +-
- src/tests/asn.1/ktest.c              | 4 ++--
- src/tests/asn.1/reference_encode.out | 4 ++--
- src/tests/asn.1/trval_reference.out  | 4 ++--
- 4 files changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/src/tests/asn.1/krb5_decode_test.c b/src/tests/asn.1/krb5_decode_test.c
-index ee70fa4b9..cbd99ba63 100644
---- a/src/tests/asn.1/krb5_decode_test.c
-+++ b/src/tests/asn.1/krb5_decode_test.c
-@@ -934,7 +934,7 @@ int main(argc, argv)
-     /* decode_sam_challenge_2_body */
-     {
-         setup(krb5_sam_challenge_2_body,ktest_make_sample_sam_challenge_2_body);
--        decode_run("sam_challenge_2_body","","30 64 A0 03 02 01 2A A1 07 03 05 00 80 00 00 00 A2 0B 04 09 74 79 70 65 20 6E 61 6D 65 A4 11 04 0F 63 68 61 6C 6C 65 6E 67 65 20 6C 61 62 65 6C A5 10 04 0E 63 68 61 6C 6C 65 6E 67 65 20 69 70 73 65 A6 16 04 14 72 65 73 70 6F 6E 73 65 5F 70 72 6F 6D 70 74 20 69 70 73 65 A8 05 02 03 54 32 10 A9 03 02 01 01",decode_krb5_sam_challenge_2_body,ktest_equal_sam_challenge_2_body,krb5_free_sam_challenge_2_body);
-+        decode_run("sam_challenge_2_body","","30 64 A0 03 02 01 2A A1 07 03 05 00 80 00 00 00 A2 0B 04 09 74 79 70 65 20 6E 61 6D 65 A4 11 04 0F 63 68 61 6C 6C 65 6E 67 65 20 6C 61 62 65 6C A5 10 04 0E 63 68 61 6C 6C 65 6E 67 65 20 69 70 73 65 A6 16 04 14 72 65 73 70 6F 6E 73 65 5F 70 72 6F 6D 70 74 20 69 70 73 65 A8 05 02 03 54 32 10 A9 03 02 01 14",decode_krb5_sam_challenge_2_body,ktest_equal_sam_challenge_2_body,krb5_free_sam_challenge_2_body);
-         ktest_empty_sam_challenge_2_body(&ref);
- 
-     }
-diff --git a/src/tests/asn.1/ktest.c b/src/tests/asn.1/ktest.c
-index 5bfdc5be2..6bf6e54ac 100644
---- a/src/tests/asn.1/ktest.c
-+++ b/src/tests/asn.1/ktest.c
-@@ -507,7 +507,7 @@ ktest_make_sample_sam_challenge_2_body(krb5_sam_challenge_2_body *p)
-     krb5_data_parse(&p->sam_response_prompt, "response_prompt ipse");
-     p->sam_pk_for_sad = empty_data();
-     p->sam_nonce = 0x543210;
--    p->sam_etype = ENCTYPE_DES_CBC_CRC;
-+    p->sam_etype = ENCTYPE_AES256_CTS_HMAC_SHA384_192;
- }
- 
- void
-@@ -518,7 +518,7 @@ ktest_make_sample_sam_response_2(krb5_sam_response_2 *p)
-     p->sam_flags = KRB5_SAM_USE_SAD_AS_KEY; /* KRB5_SAM_* values */
-     krb5_data_parse(&p->sam_track_id, "track data");
-     krb5_data_parse(&p->sam_enc_nonce_or_sad.ciphertext, "nonce or sad");
--    p->sam_enc_nonce_or_sad.enctype = ENCTYPE_DES_CBC_CRC;
-+    p->sam_enc_nonce_or_sad.enctype = ENCTYPE_AES256_CTS_HMAC_SHA384_192;
-     p->sam_enc_nonce_or_sad.kvno = 3382;
-     p->sam_nonce = 0x543210;
- }
-diff --git a/src/tests/asn.1/reference_encode.out b/src/tests/asn.1/reference_encode.out
-index a76deead2..80b18a2fb 100644
---- a/src/tests/asn.1/reference_encode.out
-+++ b/src/tests/asn.1/reference_encode.out
-@@ -49,8 +49,8 @@ encode_krb5_enc_data: 30 23 A0 03 02 01 00 A1 03 02 01 05 A2 17 04 15 6B 72 62 4
- encode_krb5_enc_data(MSB-set kvno): 30 26 A0 03 02 01 00 A1 06 02 04 FF 00 00 00 A2 17 04 15 6B 72 62 41 53 4E 2E 31 20 74 65 73 74 20 6D 65 73 73 61 67 65
- encode_krb5_enc_data(kvno=-1): 30 23 A0 03 02 01 00 A1 03 02 01 FF A2 17 04 15 6B 72 62 41 53 4E 2E 31 20 74 65 73 74 20 6D 65 73 73 61 67 65
- encode_krb5_sam_challenge_2: 30 22 A0 0D 30 0B 04 09 63 68 61 6C 6C 65 6E 67 65 A1 11 30 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
--encode_krb5_sam_challenge_2_body: 30 64 A0 03 02 01 2A A1 07 03 05 00 80 00 00 00 A2 0B 04 09 74 79 70 65 20 6E 61 6D 65 A4 11 04 0F 63 68 61 6C 6C 65 6E 67 65 20 6C 61 62 65 6C A5 10 04 0E 63 68 61 6C 6C 65 6E 67 65 20 69 70 73 65 A6 16 04 14 72 65 73 70 6F 6E 73 65 5F 70 72 6F 6D 70 74 20 69 70 73 65 A8 05 02 03 54 32 10 A9 03 02 01 01
--encode_krb5_sam_response_2: 30 42 A0 03 02 01 2B A1 07 03 05 00 80 00 00 00 A2 0C 04 0A 74 72 61 63 6B 20 64 61 74 61 A3 1D 30 1B A0 03 02 01 01 A1 04 02 02 0D 36 A2 0E 04 0C 6E 6F 6E 63 65 20 6F 72 20 73 61 64 A4 05 02 03 54 32 10
-+encode_krb5_sam_challenge_2_body: 30 64 A0 03 02 01 2A A1 07 03 05 00 80 00 00 00 A2 0B 04 09 74 79 70 65 20 6E 61 6D 65 A4 11 04 0F 63 68 61 6C 6C 65 6E 67 65 20 6C 61 62 65 6C A5 10 04 0E 63 68 61 6C 6C 65 6E 67 65 20 69 70 73 65 A6 16 04 14 72 65 73 70 6F 6E 73 65 5F 70 72 6F 6D 70 74 20 69 70 73 65 A8 05 02 03 54 32 10 A9 03 02 01 14
-+encode_krb5_sam_response_2: 30 42 A0 03 02 01 2B A1 07 03 05 00 80 00 00 00 A2 0C 04 0A 74 72 61 63 6B 20 64 61 74 61 A3 1D 30 1B A0 03 02 01 14 A1 04 02 02 0D 36 A2 0E 04 0C 6E 6F 6E 63 65 20 6F 72 20 73 61 64 A4 05 02 03 54 32 10
- encode_krb5_enc_sam_response_enc_2: 30 1F A0 03 02 01 58 A1 18 04 16 65 6E 63 5F 73 61 6D 5F 72 65 73 70 6F 6E 73 65 5F 65 6E 63 5F 32
- encode_krb5_pa_for_user: 30 4B A0 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A2 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34 A3 0A 1B 08 6B 72 62 35 64 61 74 61
- encode_krb5_pa_s4u_x509_user: 30 68 A0 55 30 53 A0 06 02 04 00 CA 14 9A A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A2 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A3 12 04 10 70 61 5F 73 34 75 5F 78 35 30 39 5F 75 73 65 72 A4 07 03 05 00 80 00 00 00 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
-diff --git a/src/tests/asn.1/trval_reference.out b/src/tests/asn.1/trval_reference.out
-index e5c715924..432fdcebb 100644
---- a/src/tests/asn.1/trval_reference.out
-+++ b/src/tests/asn.1/trval_reference.out
-@@ -1180,7 +1180,7 @@ encode_krb5_sam_challenge_2_body:
- .  [5] [Octet String] "challenge ipse"
- .  [6] [Octet String] "response_prompt ipse"
- .  [8] [Integer] 5517840
--.  [9] [Integer] 1
-+.  [9] [Integer] 20
- 
- encode_krb5_sam_response_2:
- 
-@@ -1189,7 +1189,7 @@ encode_krb5_sam_response_2:
- .  [1] [Bit String] 0x80000000
- .  [2] [Octet String] "track data"
- .  [3] [Sequence/Sequence Of]
--.  .  [0] [Integer] 1
-+.  .  [0] [Integer] 20
- .  .  [1] [Integer] 3382
- .  .  [2] [Octet String] "nonce or sad"
- .  [4] [Integer] 5517840
diff --git a/Update-default-krb5kdc-mkey-manual-entry-enctype.patch b/Update-default-krb5kdc-mkey-manual-entry-enctype.patch
deleted file mode 100644
index ff99839..0000000
--- a/Update-default-krb5kdc-mkey-manual-entry-enctype.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 2957d2186ee2b60b80e6ba97a1f5d661ccb20f30 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Mon, 20 May 2019 16:52:57 -0400
-Subject: [PATCH] Update default krb5kdc mkey manual-entry enctype
-
-Change from the legacy des-cbc-crc to the default for kdb5_util and
-kadmind, which is currently aes256-cts-hmac-sha1-96.
-
-(cherry picked from commit 512f5cde625253cba1e6f87e037a00ef88178882)
----
- doc/admin/admin_commands/krb5kdc.rst | 2 +-
- src/kdc/main.c                       | 2 +-
- src/man/krb5kdc.man                  | 2 +-
- 3 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/doc/admin/admin_commands/krb5kdc.rst b/doc/admin/admin_commands/krb5kdc.rst
-index 0342d0d18..455bb6858 100644
---- a/doc/admin/admin_commands/krb5kdc.rst
-+++ b/doc/admin/admin_commands/krb5kdc.rst
-@@ -39,7 +39,7 @@ LDAP database.
- 
- The **-k** *keytype* option specifies the key type of the master key
- to be entered manually as a password when **-m** is given; the default
--is ``des-cbc-crc``.
-+is |defmkey|.
- 
- The **-M** *mkeyname* option specifies the principal name for the
- master key in the database (usually ``K/M`` in the KDC's realm).
-diff --git a/src/kdc/main.c b/src/kdc/main.c
-index 60092a0df..04393772f 100644
---- a/src/kdc/main.c
-+++ b/src/kdc/main.c
-@@ -777,7 +777,7 @@ initialize_realms(krb5_context kcontext, int argc, char **argv,
-         case 'm':                       /* manual type-in of master key */
-             manual = TRUE;
-             if (menctype == ENCTYPE_UNKNOWN)
--                menctype = ENCTYPE_DES_CBC_CRC;
-+                menctype = DEFAULT_KDC_ENCTYPE;
-             break;
-         case 'M':                       /* master key name in DB */
-             mkey_name = optarg;
-diff --git a/src/man/krb5kdc.man b/src/man/krb5kdc.man
-index 8ace9662f..aa8614698 100644
---- a/src/man/krb5kdc.man
-+++ b/src/man/krb5kdc.man
-@@ -59,7 +59,7 @@ LDAP database.
- .sp
- The \fB\-k\fP \fIkeytype\fP option specifies the key type of the master key
- to be entered manually as a password when \fB\-m\fP is given; the default
--is \fBdes\-cbc\-crc\fP\&.
-+is \fBaes256\-cts\-hmac\-sha1\-96\fP\&.
- .sp
- The \fB\-M\fP \fImkeyname\fP option specifies the principal name for the
- master key in the database (usually \fBK/M\fP in the KDC\(aqs realm).
diff --git a/Update-test-suite-to-avoid-single-DES-enctypes.patch b/Update-test-suite-to-avoid-single-DES-enctypes.patch
deleted file mode 100644
index a6ef987..0000000
--- a/Update-test-suite-to-avoid-single-DES-enctypes.patch
+++ /dev/null
@@ -1,2327 +0,0 @@
-From 8fe2563e133e904e56c3ed3b9b970bb632c843b6 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Fri, 24 May 2019 13:11:55 -0400
-Subject: [PATCH] Update test suite to avoid single-DES enctypes
-
-Remove the CRC exercise code, since CRC is DES-only.
-
-ticket: 8808
-(cherry picked from commit 50588db5d26e81f3d564d1f69435af34ae80d9b2)
----
- src/kadmin/testing/proto/kdc.conf.proto       |   2 +-
- src/kadmin/testing/util/tcl_kadm5.c           |   2 -
- src/lib/crypto/crypto_tests/CRC.pm            | 156 ----------
- src/lib/crypto/crypto_tests/Makefile.in       |  31 +-
- src/lib/crypto/crypto_tests/crc.pl            | 111 -------
- src/lib/crypto/crypto_tests/deps              |  24 --
- src/lib/crypto/crypto_tests/t_cf2.expected    |   1 -
- src/lib/crypto/crypto_tests/t_cf2.in          |   5 -
- src/lib/crypto/crypto_tests/t_cksum.c         | 160 ----------
- src/lib/crypto/crypto_tests/t_cksums.c        |   8 +-
- src/lib/crypto/crypto_tests/t_combine.c       |  18 --
- src/lib/crypto/crypto_tests/t_crc.c           | 148 ----------
- src/lib/crypto/crypto_tests/t_decrypt.c       | 148 ----------
- src/lib/crypto/crypto_tests/t_encrypt.c       |   3 -
- src/lib/crypto/crypto_tests/t_short.c         |   3 -
- src/lib/crypto/crypto_tests/t_str2key.c       | 274 ------------------
- src/lib/crypto/crypto_tests/vectors.c         |   3 +-
- .../api.current/chpass-principal-v2.exp       |   8 +-
- .../api.current/get-principal-v2.exp          |   4 +-
- .../api.current/randkey-principal-v2.exp      |  11 +-
- src/lib/kadm5/unit-test/setkey-test.c         |   6 +-
- src/lib/krb5/keytab/t_keytab.c                |  40 +--
- src/lib/krb5/krb/t_etypes.c                   |  67 +----
- src/lib/krb5/krb/t_ser.c                      |   2 +-
- src/lib/krb5/os/t_trace.c                     |   2 +-
- src/lib/krb5/os/t_trace.ref                   |   2 +-
- src/tests/asn.1/ktest.c                       |   2 +-
- src/tests/asn.1/pkinit_encode.out             |   2 +-
- src/tests/asn.1/pkinit_trval.out              |   2 +-
- src/tests/dejagnu/config/default.exp          | 226 ++-------------
- src/tests/gssapi/t_invalid.c                  |  20 +-
- src/tests/gssapi/t_pcontok.c                  |  17 +-
- src/tests/gssapi/t_prf.c                      |   7 -
- src/tests/t_etype_info.py                     |   4 +-
- src/tests/t_keyrollover.py                    |   6 +-
- src/tests/t_salt.py                           |   2 +-
- src/tests/t_sesskeynego.py                    |  18 +-
- src/util/k5test.py                            |   2 +-
- 38 files changed, 88 insertions(+), 1459 deletions(-)
- delete mode 100644 src/lib/crypto/crypto_tests/CRC.pm
- delete mode 100644 src/lib/crypto/crypto_tests/crc.pl
- delete mode 100644 src/lib/crypto/crypto_tests/t_cksum.c
- delete mode 100644 src/lib/crypto/crypto_tests/t_crc.c
-
-diff --git a/src/kadmin/testing/proto/kdc.conf.proto b/src/kadmin/testing/proto/kdc.conf.proto
-index 45df78b91..8a4b87de1 100644
---- a/src/kadmin/testing/proto/kdc.conf.proto
-+++ b/src/kadmin/testing/proto/kdc.conf.proto
-@@ -12,5 +12,5 @@
- 		kadmind_port = 1751
- 		kpasswd_port = 1752
- 		master_key_type = des3-hmac-sha1
--		supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal des-cbc-md5:normal des-cbc-raw:normal
-+		supported_enctypes = des3-hmac-sha1:normal aes256-cts:normal aes128-cts:normal aes256-sha2:normal aes128-sha2:normal
- 	}
-diff --git a/src/kadmin/testing/util/tcl_kadm5.c b/src/kadmin/testing/util/tcl_kadm5.c
-index 9dde579ef..4d3114b11 100644
---- a/src/kadmin/testing/util/tcl_kadm5.c
-+++ b/src/kadmin/testing/util/tcl_kadm5.c
-@@ -1514,8 +1514,6 @@ static Tcl_DString *unparse_keytype(krb5_enctype enctype)
-     switch (enctype) {
-         /* XXX is this right? */
-     case ENCTYPE_NULL: Tcl_DStringAppend(str, "ENCTYPE_NULL", -1); break;
--    case ENCTYPE_DES_CBC_CRC:
--        Tcl_DStringAppend(str, "ENCTYPE_DES_CBC_CRC", -1); break;
-     default:
-         sprintf(buf, "UNKNOWN KEYTYPE (0x%x)", enctype);
-         Tcl_DStringAppend(str, buf, -1);
-diff --git a/src/lib/crypto/crypto_tests/CRC.pm b/src/lib/crypto/crypto_tests/CRC.pm
-deleted file mode 100644
-index ee2ab2ae8..000000000
---- a/src/lib/crypto/crypto_tests/CRC.pm
-+++ /dev/null
-@@ -1,156 +0,0 @@
--# Copyright 2002 by the Massachusetts Institute of Technology.
--# All Rights Reserved.
--#
--# Export of this software from the United States of America may
--#   require a specific license from the United States Government.
--#   It is the responsibility of any person or organization contemplating
--#   export to obtain such a license before exporting.
--# 
--# WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
--# distribute this software and its documentation for any purpose and
--# without fee is hereby granted, provided that the above copyright
--# notice appear in all copies and that both that copyright notice and
--# this permission notice appear in supporting documentation, and that
--# the name of M.I.T. not be used in advertising or publicity pertaining
--# to distribution of the software without specific, written prior
--# permission.  Furthermore if you modify this software you must label
--# your software as modified software and not distribute it in such a
--# fashion that it might be confused with the original M.I.T. software.
--# M.I.T. makes no representations about the suitability of
--# this software for any purpose.  It is provided "as is" without express
--# or implied warranty.
--
--package CRC;
--
--# CRC: implement a CRC using the Poly package (yes this is slow)
--#
--# message M(x) = m_0 * x^0 + m_1 * x^1 + ... + m_(k-1) * x^(k-1)
--# generator P(x) = p_0 * x^0 + p_1 * x^1 + ... + p_n * x^n
--# remainder R(x) = r_0 * x^0 + r_1 * x^1 + ... + r_(n-1) * x^(n-1)
--#
--# R(x) = (x^n * M(x)) % P(x)
--#
--# Note that if F(x) = x^n * M(x) + R(x), then F(x) = 0 mod P(x) .
--#
--# In MIT Kerberos 5, R(x) is taken as the CRC, as opposed to what
--# ISO 3309 does.
--#
--# ISO 3309 adds a precomplement and a postcomplement.
--#
--# The ISO 3309 postcomplement is of the form
--#
--# A(x) = x^0 + x^1 + ... + x^(n-1) .
--#
--# The ISO 3309 precomplement is of the form
--#
--# B(x) = x^k * A(x) .
--#
--# The ISO 3309 FCS is then
--#
--# (x^n * M(x)) % P(x) + B(x) % P(x) + A(x) ,
--#
--# which is equivalent to
--#
--# (x^n * M(x) + B(x)) % P(x) + A(x) .
--#
--# In ISO 3309, the transmitted frame is
--#
--# F'(x) = x^n * M(x) + R(x) + R'(x) + A(x) ,
--#
--# where
--#
--# R'(x) = B(x) % P(x) .
--#
--# Note that this means that if a new remainder is computed over the
--# frame F'(x) (treating F'(x) as the new M(x)), it will be equal to a
--# constant.
--#
--# F'(x) = 0 + R'(x) + A(x) mod P(x) ,
--#
--# then
--#
--# (F'(x) + x^k * A(x)) * x^n
--#
--# = ((R'(x) + A(x)) + x^k * A(x)) * x^n mod P(x)
--#
--# = (x^k * A(x) + A(x) + x^k * A(x)) * x^n mod P(x)
--#
--# = (0 + A(x)) * x^n mod P(x)
--#
--# Note that (A(x) * x^n) % P(x) is a constant, and that this result
--# depends on B(x) being x^k * A(x).
--
--use Carp;
--use Poly;
--
--sub new {
--    my $self = shift;
--    my $class = ref($self) || $self;
--    my %args = @_;
--    $self = {bitsendian => "little"};
--    bless $self, $class;
--    $self->setpoly($args{"Poly"}) if exists $args{"Poly"};
--    $self->bitsendian($args{"bitsendian"})
--	if exists $args{"bitsendian"};
--    $self->{precomp} = $args{precomp} if exists $args{precomp};
--    $self->{postcomp} = $args{postcomp} if exists $args{postcomp};
--    return $self;
--}
--
--sub setpoly {
--    my $self = shift;
--    my($arg) = @_;
--    croak "need a polynomial" if !$arg->isa("Poly");
--    $self->{Poly} = $arg;
--    return $self;
--}
--
--sub crc {
--    my $self = shift;
--    my $msg = Poly->new(@_);
--    my($order, $r, $precomp);
--    $order = $self->{Poly}->order;
--    # B(x) = x^k * precomp
--    $precomp = $self->{precomp} ?
--	$self->{precomp} * Poly->powers2poly(scalar(@_)) : Poly->new;
--    # R(x) = (x^n * M(x)) % P(x)
--    $r = ($msg * Poly->powers2poly($order)) % $self->{Poly};
--    # B(x) % P(x)
--    $r += $precomp % $self->{Poly};
--    $r += $self->{postcomp} if exists $self->{postcomp};
--    return $r;
--}
--
--# endianness of bits of each octet
--#
--# Note that the message is always treated as being sent in big-endian
--# octet order.
--#
--# Usually, the message will be treated as bits being little-endian,
--# since that is the common case for serial implementations that
--# present data in octets; e.g., most UARTs shift octets onto the line
--# in little-endian order, and protocols such as ISO 3309, V.42,
--# etc. treat individual octets as being sent LSB-first.
--
--sub bitsendian {
--    my $self = shift;
--    my($arg) = @_;
--    croak "bad bit endianness" if $arg !~ /big|little/;
--    $self->{bitsendian} = $arg;
--    return $self;
--}
--
--sub crcstring {
--    my $self = shift;
--    my($arg) = @_;
--    my($packstr, @m);
--    {
--	$packstr = "B*", last if $self->{bitsendian} =~ /big/;
--	$packstr = "b*", last if $self->{bitsendian} =~ /little/;
--	croak "bad bit endianness";
--    };
--    @m = split //, unpack $packstr, $arg;
--    return $self->crc(@m);
--}
--
--1;
-diff --git a/src/lib/crypto/crypto_tests/Makefile.in b/src/lib/crypto/crypto_tests/Makefile.in
-index c5eba1b10..09feeb50e 100644
---- a/src/lib/crypto/crypto_tests/Makefile.in
-+++ b/src/lib/crypto/crypto_tests/Makefile.in
-@@ -16,9 +16,7 @@ EXTRADEPSRCS=\
- 	$(srcdir)/aes-test.c	\
- 	$(srcdir)/camellia-test.c	\
- 	$(srcdir)/t_cf2.c	\
--	$(srcdir)/t_cksum.c	\
- 	$(srcdir)/t_cksums.c	\
--	$(srcdir)/t_crc.c	\
- 	$(srcdir)/t_mddriver.c	\
- 	$(srcdir)/t_kperf.c	\
- 	$(srcdir)/t_sha2.c	\
-@@ -30,15 +28,12 @@ EXTRADEPSRCS=\
- 
- ##DOS##BUILDTOP = ..\..\..
- 
--# NOTE: The t_cksum known checksum values are primarily for regression
--# testing.  They are not derived a priori, but are known to produce
--# checksums that interoperate.
- check-unix: t_nfold t_encrypt t_decrypt t_prf t_prng t_cmac t_hmac \
--		t_cksum4 t_cksum5 t_cksums \
-+		t_cksums \
- 		aes-test  \
- 		camellia-test  \
- 		t_mddriver4 t_mddriver \
--		t_crc t_cts t_sha2 t_short t_str2key t_derive t_fork t_cf2 \
-+		t_cts t_sha2 t_short t_str2key t_derive t_fork t_cf2 \
- 		t_combine
- 	$(RUN_TEST) ./t_nfold
- 	$(RUN_TEST) ./t_encrypt
-@@ -47,10 +42,7 @@ check-unix: t_nfold t_encrypt t_decrypt t_prf t_prng t_cmac t_hmac \
- 	$(RUN_TEST) ./t_cmac
- 	$(RUN_TEST) ./t_hmac
- 	$(RUN_TEST) ./t_prf
--	$(RUN_TEST) ./t_cksum4 "this is a test" e3f76a07f3401e3536b43a3f54226c39422c35682c354835
--	$(RUN_TEST) ./t_cksum5 "this is a test" e3f76a07f3401e351143ee6f4c09be1edb4264d55015db53
- 	$(RUN_TEST) ./t_cksums
--	$(RUN_TEST) ./t_crc
- 	$(RUN_TEST) ./t_cts
- 	$(RUN_TEST) ./aes-test -k > vk.txt
- 	cmp vk.txt $(srcdir)/expect-vk.txt
-@@ -109,24 +101,9 @@ t_short$(EXEEXT): t_short.$(OBJEXT) $(KRB5_BASE_DEPLIBS)
- 	$(CC_LINK) -o $@ t_short.$(OBJEXT) \
- 		$(KRB5_BASE_LIBS)
- 
--t_cksum4.o: $(srcdir)/t_cksum.c
--	$(CC) -DMD=4 $(ALL_CFLAGS) -o t_cksum4.o -c $(srcdir)/t_cksum.c
--
--t_cksum5.o: $(srcdir)/t_cksum.c
--	$(CC) -DMD=5 $(ALL_CFLAGS) -o t_cksum5.o -c $(srcdir)/t_cksum.c
--
--t_cksum4: t_cksum4.o $(CRYTPO_DEPLIB)
--	$(CC_LINK) -o t_cksum4 t_cksum4.o $(KRB5_BASE_LIBS)
--
--t_cksum5: t_cksum5.o $(CRYPTO_DEPLIB)
--	$(CC_LINK) -o t_cksum5 t_cksum5.o $(KRB5_BASE_LIBS)
--
- t_cksums: t_cksums.o $(CRYTPO_DEPLIB)
- 	$(CC_LINK) -o t_cksums t_cksums.o -lkrb5 $(KRB5_BASE_LIBS)
- 
--t_crc: t_crc.o $(KRB5_BASE_DEPLIBS)
--	$(CC_LINK) -o $@ t_crc.o $(KRB5_BASE_LIBS)
--
- aes-test: aes-test.$(OBJEXT) $(KRB5_BASE_DEPLIBS)
- 	$(CC_LINK) -o aes-test aes-test.$(OBJEXT) $(KRB5_BASE_LIBS)
- 
-@@ -165,9 +142,9 @@ clean:
- 		t_decrypt.o t_decrypt t_prng.o t_prng t_cmac.o t_cmac \
- 		t_hmac.o t_hmac t_pkcs5.o t_pkcs5 pbkdf2.o t_prf t_prf.o \
- 		aes-test.o aes-test vt.txt vk.txt kresults.out \
--		t_crc.o t_crc t_cts.o t_cts \
-+		t_cts.o t_cts \
- 		t_mddriver4.o t_mddriver4 t_mddriver.o t_mddriver \
--		t_cksum4 t_cksum4.o t_cksum5 t_cksum5.o t_cksums t_cksums.o \
-+		t_cksums t_cksums.o \
- 		t_kperf.o t_kperf t_sha2.o t_sha2 t_short t_short.o t_str2key \
- 		t_str2key.o t_derive t_derive.o t_fork t_fork.o \
- 		t_mddriver$(EXEEXT) $(OUTPRE)t_mddriver.$(OBJEXT) \
-diff --git a/src/lib/crypto/crypto_tests/crc.pl b/src/lib/crypto/crypto_tests/crc.pl
-deleted file mode 100644
-index b21b6b15d..000000000
---- a/src/lib/crypto/crypto_tests/crc.pl
-+++ /dev/null
-@@ -1,111 +0,0 @@
--# Copyright 2002 by the Massachusetts Institute of Technology.
--# All Rights Reserved.
--#
--# Export of this software from the United States of America may
--#   require a specific license from the United States Government.
--#   It is the responsibility of any person or organization contemplating
--#   export to obtain such a license before exporting.
--# 
--# WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
--# distribute this software and its documentation for any purpose and
--# without fee is hereby granted, provided that the above copyright
--# notice appear in all copies and that both that copyright notice and
--# this permission notice appear in supporting documentation, and that
--# the name of M.I.T. not be used in advertising or publicity pertaining
--# to distribution of the software without specific, written prior
--# permission.  Furthermore if you modify this software you must label
--# your software as modified software and not distribute it in such a
--# fashion that it might be confused with the original M.I.T. software.
--# M.I.T. makes no representations about the suitability of
--# this software for any purpose.  It is provided "as is" without express
--# or implied warranty.
--
--use CRC;
--
--print "*** crudely testing polynomial functions ***\n";
--
--$x = Poly->new(1,1,1,1);
--$y = Poly->new(1,1);
--print "x = @{[$x->pretty]}\ny = @{[$y->pretty]}\n";
--$q = $x / $y;
--$r = $x % $y;
--print $x->pretty, " = (", $y->pretty , ") * (", $q->pretty,
--    ") + ", $r->pretty, "\n";
--$q = $y / $x;
--$r = $y % $x;
--print "y / x = @{[$q->pretty]}\ny % x = @{[$r->pretty]}\n";
--
--# ISO 3309 32-bit FCS polynomial
--$fcs32 = Poly->powers2poly(32,26,23,22,16,12,11,10,8,7,5,4,2,1,0);
--print "fcs32 = ", $fcs32->pretty, "\n";
--
--$crc = CRC->new(Poly => $fcs32, bitsendian => "little");
--
--print "\n";
--
--print "*** little endian, no complementation ***\n";
--for ($i = 0; $i < 256; $i++) {
--    $r = $crc->crcstring(pack "C", $i);
--    printf ("%02x: ", $i) if !($i % 8);
--    print ($r->revhex, ($i % 8 == 7) ? "\n" : " ");
--}
--
--print "\n";
--
--print "*** little endian, 4 bits, no complementation ***\n";
--for ($i = 0; $i < 16; $i++) {
--    @m = (split //, unpack "b*", pack "C", $i)[0..3];
--    $r = $crc->crc(@m);
--    printf ("%02x: ", $i) if !($i % 8);
--    print ($r->revhex, ($i % 8 == 7) ? "\n" : " ");
--}
--
--print "\n";
--
--print "*** test vectors for t_crc.c, little endian ***\n";
--for ($i = 1; $i <= 4; $i *=2) {
--    for ($j = 0; $j < $i * 8; $j++) {
--	@m = split //, unpack "b*", pack "V", 1 << $j;
--	splice @m, $i * 8;
--	$r = $crc->crc(@m);
--	$m = unpack "H*", pack "b*", join("", @m);
--	print "{HEX, \"$m\", 0x", $r->revhex, "},\n";
--    }
--}
--@m = ("foo", "test0123456789",
--      "MASSACHVSETTS INSTITVTE OF TECHNOLOGY");
--foreach $m (@m) {
--    $r = $crc->crcstring($m);
--    print "{STR, \"$m\", 0x", $r->revhex, "},\n";
--}
--__END__
--
--print "*** big endian, no complementation ***\n";
--for ($i = 0; $i < 256; $i++) {
--    $r = $crc->crcstring(pack "C", $i);
--    printf ("%02x: ", $i) if !($i % 8);
--    print ($r->hex, ($i % 8 == 7) ? "\n" : " ");
--}
--
--# all ones polynomial of order 31
--$ones = Poly->new((1) x 32);
--
--print "*** big endian, ISO-3309 style\n";
--$crc = CRC->new(Poly => $fcs32,
--		bitsendian => "little",
--		precomp => $ones,
--		postcomp => $ones);
--for ($i = 0; $i < 256; $i++) {
--    $r = $crc->crcstring(pack "C", $i);
--    print ($r->hex, ($i % 8 == 7) ? "\n" : " ");
--}
--
--for ($i = 0; $i < 0; $i++) {
--    $x = Poly->new((1) x 32, (0) x $i);
--    $y = Poly->new((1) x 32);
--    $f = ($x % $fcs32) + $y;
--    $r = (($f + $x) * Poly->powers2poly(32)) % $fcs32;
--    @out = @$r;
--    unshift @out, 0 while @out < 32;
--    print @out, "\n";
--}
-diff --git a/src/lib/crypto/crypto_tests/deps b/src/lib/crypto/crypto_tests/deps
-index 5d94a593d..19fef2582 100644
---- a/src/lib/crypto/crypto_tests/deps
-+++ b/src/lib/crypto/crypto_tests/deps
-@@ -140,17 +140,6 @@ $(OUTPRE)camellia-test.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-   $(top_srcdir)/include/socket-utils.h camellia-test.c
- $(OUTPRE)t_cf2.$(OBJEXT): $(BUILDTOP)/include/krb5/krb5.h \
-   $(COM_ERR_DEPS) $(top_srcdir)/include/krb5.h t_cf2.c
--$(OUTPRE)t_cksum.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
--  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-hex.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  t_cksum.c
- $(OUTPRE)t_cksums.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \
-@@ -161,19 +150,6 @@ $(OUTPRE)t_cksums.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
-   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-   $(top_srcdir)/include/socket-utils.h t_cksums.c
--$(OUTPRE)t_crc.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
--  $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
--  $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
--  $(srcdir)/../builtin/crypto_mod.h $(srcdir)/../builtin/sha2/sha2.h \
--  $(srcdir)/../krb/crypto_int.h $(top_srcdir)/include/k5-buf.h \
--  $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
--  $(top_srcdir)/include/k5-hex.h $(top_srcdir)/include/k5-int-pkinit.h \
--  $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
--  $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
--  $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
--  $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
--  $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
--  t_crc.c
- $(OUTPRE)t_mddriver.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-   $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
-   $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h \
-diff --git a/src/lib/crypto/crypto_tests/t_cf2.expected b/src/lib/crypto/crypto_tests/t_cf2.expected
-index 11a24b800..f8251a16c 100644
---- a/src/lib/crypto/crypto_tests/t_cf2.expected
-+++ b/src/lib/crypto/crypto_tests/t_cf2.expected
-@@ -1,6 +1,5 @@
- 97df97e4b798b29eb31ed7280287a92a
- 4d6ca4e629785c1f01baf55e2e548566b9617ae3a96868c337cb93b5e72b1c7b
--43bae3738c9467e6
- e58f9eb643862c13ad38e529313462a7f73e62834fe54a01
- 24d7f6b6bae4e5c00d2082c5ebab3672
- edd02a39d2dbde31611c16e610be062c
-diff --git a/src/lib/crypto/crypto_tests/t_cf2.in b/src/lib/crypto/crypto_tests/t_cf2.in
-index e62ead7d8..73e2f8fbc 100644
---- a/src/lib/crypto/crypto_tests/t_cf2.in
-+++ b/src/lib/crypto/crypto_tests/t_cf2.in
-@@ -8,11 +8,6 @@ key1
- key2
- a
- b
--1
--key1
--key2
--a
--b
- 16
- key1
- key2
-diff --git a/src/lib/crypto/crypto_tests/t_cksum.c b/src/lib/crypto/crypto_tests/t_cksum.c
-deleted file mode 100644
-index 0edaeb850..000000000
---- a/src/lib/crypto/crypto_tests/t_cksum.c
-+++ /dev/null
-@@ -1,160 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/* lib/crypto/crypto_tests/t_cksum.c */
--/*
-- * Copyright 1995 by the Massachusetts Institute of Technology.
-- * All Rights Reserved.
-- *
-- * Export of this software from the United States of America may
-- *   require a specific license from the United States Government.
-- *   It is the responsibility of any person or organization contemplating
-- *   export to obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of M.I.T. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  Furthermore if you modify this software you must label
-- * your software as modified software and not distribute it in such a
-- * fashion that it might be confused with the original M.I.T. software.
-- * M.I.T. makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- */
--
--/* Test checksum and checksum compatability for rsa-md[4,5]-des. */
--
--#include "k5-int.h"
--#include "k5-hex.h"
--
--#define MD5_K5BETA_COMPAT
--#define MD4_K5BETA_COMPAT
--
--#if MD == 4
--#define CKTYPE CKSUMTYPE_RSA_MD4_DES
--#endif
--
--#if MD == 5
--#define CKTYPE CKSUMTYPE_RSA_MD5_DES
--#endif
--
--static void
--print_checksum(char *text, int number, char *message, krb5_checksum *checksum)
--{
--    unsigned int i;
--
--    printf("%s MD%d checksum(\"%s\") = ", text, number, message);
--    for (i=0; i<checksum->length; i++)
--        printf("%02x", (unsigned char) checksum->contents[i]);
--    printf("\n");
--}
--
--/*
-- * Test the checksum verification of Old Style (tm) and correct RSA-MD[4,5]-DES
-- * checksums.
-- */
--
--krb5_octet testkey[8] = { 0x45, 0x01, 0x49, 0x61, 0x58, 0x19, 0x1a, 0x3d };
--
--int
--main(argc, argv)
--    int argc;
--    char **argv;
--{
--    int                   msgindex;
--    size_t                len;
--    krb5_boolean          valid;
--    krb5_keyblock         keyblock;
--    krb5_key              key;
--    krb5_error_code       kret=0;
--    krb5_data             plaintext;
--    krb5_checksum         checksum, knowncksum;
--
--    /* this is a terrible seed, but that's ok for the test. */
--
--    plaintext.length = 8;
--    plaintext.data = (char *) testkey;
--
--    krb5_c_random_seed(/* XXX */ 0, &plaintext);
--
--    keyblock.enctype = ENCTYPE_DES_CBC_CRC;
--    keyblock.length = sizeof(testkey);
--    keyblock.contents = testkey;
--
--    krb5_k_create_key(NULL, &keyblock, &key);
--
--    for (msgindex = 1; msgindex + 1 < argc; msgindex += 2) {
--        plaintext.length = strlen(argv[msgindex]);
--        plaintext.data = argv[msgindex];
--
--        /* Create a checksum. */
--        kret = krb5_k_make_checksum(NULL, CKTYPE, key, 0, &plaintext,
--                                    &checksum);
--        if (kret != 0) {
--            printf("krb5_calculate_checksum choked with %d\n", kret);
--            break;
--        }
--        print_checksum("correct", MD, argv[msgindex], &checksum);
--
--        /* Verify it. */
--        kret = krb5_k_verify_checksum(NULL, key, 0, &plaintext, &checksum,
--                                      &valid);
--        if (kret != 0) {
--            printf("verify on new checksum choked with %d\n", kret);
--            break;
--        }
--        if (!valid) {
--            printf("verify on new checksum failed\n");
--            kret = 1;
--            break;
--        }
--        printf("Verify succeeded for \"%s\"\n", argv[msgindex]);
--
--        /* Corrupt the checksum and see if it still verifies. */
--        checksum.contents[0]++;
--        kret = krb5_k_verify_checksum(NULL, key, 0, &plaintext, &checksum,
--                                      &valid);
--        if (kret != 0) {
--            printf("verify on new checksum choked with %d\n", kret);
--            break;
--        }
--        if (valid) {
--            printf("verify on new checksum succeeded, but shouldn't have\n");
--            kret = 1;
--            break;
--        }
--        printf("Verify of bad checksum OK for \"%s\"\n", argv[msgindex]);
--        free(checksum.contents);
--
--        /* Verify a known-good checksum for this plaintext. */
--        kret = k5_hex_decode(argv[msgindex + 1], &knowncksum.contents, &len);
--        if (kret) {
--            printf("k5_hex_decode failed\n");
--            break;
--        }
--        knowncksum.length = len;
--        knowncksum.checksum_type = CKTYPE;
--        knowncksum.magic = KV5M_CHECKSUM;
--        kret = krb5_k_verify_checksum(NULL, key, 0, &plaintext, &knowncksum,
--                                      &valid);
--        if (kret != 0) {
--            printf("verify on known checksum choked with %d\n", kret);
--            break;
--        }
--        if (!valid) {
--            printf("verify on known checksum failed\n");
--            kret = 1;
--            break;
--        }
--        printf("Verify on known checksum succeeded\n");
--        free(knowncksum.contents);
--    }
--    if (!kret)
--        printf("%d tests passed successfully for MD%d checksum\n", (argc-1)/2, MD);
--
--    krb5_k_free_key(NULL, key);
--
--    return(kret);
--}
-diff --git a/src/lib/crypto/crypto_tests/t_cksums.c b/src/lib/crypto/crypto_tests/t_cksums.c
-index 5afc90ed8..4da14ea43 100644
---- a/src/lib/crypto/crypto_tests/t_cksums.c
-+++ b/src/lib/crypto/crypto_tests/t_cksums.c
-@@ -27,7 +27,7 @@
- /*
-  * This harness tests checksum results against known values.  With the -v flag,
-  * results for all tests are displayed.  This harness only works for
-- * deterministic checksums; for rsa-md4-des and rsa-md5-des, see t_cksum.c.
-+ * deterministic checksums.
-  */
- 
- #include "k5-int.h"
-@@ -40,12 +40,6 @@ struct test {
-     krb5_data keybits;
-     krb5_data cksum;
- } test_cases[] = {
--    {
--        { KV5M_DATA, 3, "abc" },
--        CKSUMTYPE_CRC32, 0, 0, { KV5M_DATA, 0, "" },
--        { KV5M_DATA, 4,
--          "\xD0\x98\x65\xCA" }
--    },
-     {
-         { KV5M_DATA, 3, "one" },
-         CKSUMTYPE_RSA_MD4, 0, 0, { KV5M_DATA, 0, "" },
-diff --git a/src/lib/crypto/crypto_tests/t_combine.c b/src/lib/crypto/crypto_tests/t_combine.c
-index 89219c762..ba0622bcf 100644
---- a/src/lib/crypto/crypto_tests/t_combine.c
-+++ b/src/lib/crypto/crypto_tests/t_combine.c
-@@ -32,10 +32,6 @@
- 
- #include "k5-int.h"
- 
--unsigned char des_key1[] = "\x04\x86\xCD\x97\x61\xDF\xD6\x29";
--unsigned char des_key2[] = "\x1A\x54\x9B\x7F\xDC\x20\x83\x0E";
--unsigned char des_result[] = "\xC2\x13\x01\x52\x89\x26\xC4\xF7";
--
- unsigned char des3_key1[] = "\x10\xB6\x75\xD5\x5B\xD9\x6E\x73"
-     "\xFD\x54\xB3\x3D\x37\x52\xC1\x2A\xF7\x43\x91\xFE\x1C\x02\x37\x13";
- unsigned char des3_key2[] = "\xC8\xDA\x3E\xA7\xB6\x64\xAE\x7A"
-@@ -48,20 +44,6 @@ main(int argc, char **argv)
- {
-     krb5_keyblock kb1, kb2, result;
- 
--    kb1.enctype = ENCTYPE_DES_CBC_CRC;
--    kb1.contents = des_key1;
--    kb1.length = 8;
--    kb2.enctype = ENCTYPE_DES_CBC_CRC;
--    kb2.contents = des_key2;
--    kb2.length = 8;
--    memset(&result, 0, sizeof(result));
--    if (krb5int_c_combine_keys(NULL, &kb1, &kb2, &result) != 0)
--        abort();
--    if (result.enctype != ENCTYPE_DES_CBC_CRC || result.length != 8 ||
--        memcmp(result.contents, des_result, 8) != 0)
--        abort();
--    krb5_free_keyblock_contents(NULL, &result);
--
-     kb1.enctype = ENCTYPE_DES3_CBC_SHA1;
-     kb1.contents = des3_key1;
-     kb1.length = 24;
-diff --git a/src/lib/crypto/crypto_tests/t_crc.c b/src/lib/crypto/crypto_tests/t_crc.c
-deleted file mode 100644
-index 8cd1d36cb..000000000
---- a/src/lib/crypto/crypto_tests/t_crc.c
-+++ /dev/null
-@@ -1,148 +0,0 @@
--/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
--/* lib/crypto/crypto_tests/t_crc.c */
--/*
-- * Copyright 2002,2005 by the Massachusetts Institute of Technology.
-- * All Rights Reserved.
-- *
-- * Export of this software from the United States of America may
-- *   require a specific license from the United States Government.
-- *   It is the responsibility of any person or organization contemplating
-- *   export to obtain such a license before exporting.
-- *
-- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
-- * distribute this software and its documentation for any purpose and
-- * without fee is hereby granted, provided that the above copyright
-- * notice appear in all copies and that both that copyright notice and
-- * this permission notice appear in supporting documentation, and that
-- * the name of M.I.T. not be used in advertising or publicity pertaining
-- * to distribution of the software without specific, written prior
-- * permission.  Furthermore if you modify this software you must label
-- * your software as modified software and not distribute it in such a
-- * fashion that it might be confused with the original M.I.T. software.
-- * M.I.T. makes no representations about the suitability of
-- * this software for any purpose.  It is provided "as is" without express
-- * or implied warranty.
-- */
--
--/*
-- * Sanity checks for CRC32.
-- */
--#include <sys/times.h>
--#include <limits.h>
--#include <stdio.h>
--#include <stdlib.h>
--#include <string.h>
--#include <k5-hex.h>
--#include "crypto_int.h"
--
--#define HEX 1
--#define STR 2
--struct crc_trial {
--    int         type;
--    char        *data;
--    unsigned long       sum;
--};
--
--struct crc_trial trials[] = {
--    {HEX, "01", 0x77073096},
--    {HEX, "02", 0xee0e612c},
--    {HEX, "04", 0x076dc419},
--    {HEX, "08", 0x0edb8832},
--    {HEX, "10", 0x1db71064},
--    {HEX, "20", 0x3b6e20c8},
--    {HEX, "40", 0x76dc4190},
--    {HEX, "80", 0xedb88320},
--    {HEX, "0100", 0x191b3141},
--    {HEX, "0200", 0x32366282},
--    {HEX, "0400", 0x646cc504},
--    {HEX, "0800", 0xc8d98a08},
--    {HEX, "1000", 0x4ac21251},
--    {HEX, "2000", 0x958424a2},
--    {HEX, "4000", 0xf0794f05},
--    {HEX, "8000", 0x3b83984b},
--    {HEX, "0001", 0x77073096},
--    {HEX, "0002", 0xee0e612c},
--    {HEX, "0004", 0x076dc419},
--    {HEX, "0008", 0x0edb8832},
--    {HEX, "0010", 0x1db71064},
--    {HEX, "0020", 0x3b6e20c8},
--    {HEX, "0040", 0x76dc4190},
--    {HEX, "0080", 0xedb88320},
--    {HEX, "01000000", 0xb8bc6765},
--    {HEX, "02000000", 0xaa09c88b},
--    {HEX, "04000000", 0x8f629757},
--    {HEX, "08000000", 0xc5b428ef},
--    {HEX, "10000000", 0x5019579f},
--    {HEX, "20000000", 0xa032af3e},
--    {HEX, "40000000", 0x9b14583d},
--    {HEX, "80000000", 0xed59b63b},
--    {HEX, "00010000", 0x01c26a37},
--    {HEX, "00020000", 0x0384d46e},
--    {HEX, "00040000", 0x0709a8dc},
--    {HEX, "00080000", 0x0e1351b8},
--    {HEX, "00100000", 0x1c26a370},
--    {HEX, "00200000", 0x384d46e0},
--    {HEX, "00400000", 0x709a8dc0},
--    {HEX, "00800000", 0xe1351b80},
--    {HEX, "00000100", 0x191b3141},
--    {HEX, "00000200", 0x32366282},
--    {HEX, "00000400", 0x646cc504},
--    {HEX, "00000800", 0xc8d98a08},
--    {HEX, "00001000", 0x4ac21251},
--    {HEX, "00002000", 0x958424a2},
--    {HEX, "00004000", 0xf0794f05},
--    {HEX, "00008000", 0x3b83984b},
--    {HEX, "00000001", 0x77073096},
--    {HEX, "00000002", 0xee0e612c},
--    {HEX, "00000004", 0x076dc419},
--    {HEX, "00000008", 0x0edb8832},
--    {HEX, "00000010", 0x1db71064},
--    {HEX, "00000020", 0x3b6e20c8},
--    {HEX, "00000040", 0x76dc4190},
--    {HEX, "00000080", 0xedb88320},
--    {STR, "foo", 0x7332bc33},
--    {STR, "test0123456789", 0xb83e88d6},
--    {STR, "MASSACHVSETTS INSTITVTE OF TECHNOLOGY", 0xe34180f7}
--};
--
--#define NTRIALS (sizeof(trials) / sizeof(trials[0]))
--
--
--int
--main(void)
--{
--    unsigned int i;
--    struct crc_trial trial;
--    uint8_t *bytes;
--    size_t len;
--    unsigned long cksum;
--    char *typestr;
--
--    for (i = 0; i < NTRIALS; i++) {
--        trial = trials[i];
--        switch (trial.type) {
--        case STR:
--            len = strlen(trial.data);
--            typestr = "STR";
--            cksum = 0;
--            mit_crc32(trial.data, len, &cksum);
--            break;
--        case HEX:
--            typestr = "HEX";
--            if (k5_hex_decode(trial.data, &bytes, &len) != 0)
--                abort();
--            cksum = 0;
--            mit_crc32(bytes, len, &cksum);
--            free(bytes);
--            break;
--        default:
--            typestr = "BOGUS";
--            fprintf(stderr, "bad trial type %d\n", trial.type);
--            exit(1);
--        }
--        printf("%s: %s \"%s\" = 0x%08lx\n",
--               (trial.sum == cksum) ? "OK" : "***BAD***",
--               typestr, trial.data, cksum);
--    }
--    exit(0);
--}
-diff --git a/src/lib/crypto/crypto_tests/t_decrypt.c b/src/lib/crypto/crypto_tests/t_decrypt.c
-index 4ae0256cc..a40a85500 100644
---- a/src/lib/crypto/crypto_tests/t_decrypt.c
-+++ b/src/lib/crypto/crypto_tests/t_decrypt.c
-@@ -39,151 +39,6 @@ struct test {
-     krb5_data keybits;
-     krb5_data ciphertext;
- } test_cases[] = {
--    {
--        ENCTYPE_DES_CBC_CRC,
--        { KV5M_DATA, 0, "" }, 0,
--        { KV5M_DATA, 8,
--          "\x45\xE6\x08\x7C\xDF\x13\x8F\xB5" },
--        { KV5M_DATA, 16,
--          "\x28\xF6\xB0\x9A\x01\x2B\xCC\xF7\x2F\xB0\x51\x22\xB2\x83\x9E\x6E" }
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        { KV5M_DATA, 1, "1" }, 1,
--        { KV5M_DATA, 8,
--          "\x92\xA7\x15\x58\x10\x58\x6B\x2F" },
--        { KV5M_DATA, 16,
--          "\xB4\xC8\x71\xC2\xF3\xE7\xBF\x76\x05\xEF\xD6\x2F\x2E\xEE\xC2\x05" }
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        { KV5M_DATA, 9, "9 bytesss" }, 2,
--        { KV5M_DATA, 8,
--          "\xA4\xB9\x51\x4A\x61\x64\x64\x23" },
--        { KV5M_DATA, 24,
--          "\x5F\x14\xC3\x51\x78\xD3\x3D\x7C\xDE\x0E\xC1\x69\xC6\x23\xCC\x83"
--          "\x21\xB7\xB8\xBD\x34\xEA\x7E\xFE" }
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        { KV5M_DATA, 13, "13 bytes byte", }, 3,
--        { KV5M_DATA, 8,
--          "\x2F\x16\xA2\xA7\xFD\xB0\x57\x68" },
--        { KV5M_DATA, 32,
--          "\x0B\x58\x8E\x38\xD9\x71\x43\x3C\x9D\x86\xD8\xBA\xEB\xF6\x3E\x4C"
--          "\x1A\x01\x66\x6E\x76\xD8\xA5\x4A\x32\x93\xF7\x26\x79\xED\x88\xC9" }
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        { KV5M_DATA, 30, "30 bytes bytes bytes bytes byt", }, 4,
--        { KV5M_DATA, 8,
--          "\xBC\x8F\x70\xFD\x20\x97\xD6\x7C" },
--        { KV5M_DATA, 48,
--          "\x38\xD6\x32\xD2\xC2\x0A\x7C\x2E\xA2\x50\xFC\x8E\xCE\x42\x93\x8E"
--          "\x92\xA9\xF5\xD3\x02\x50\x26\x65\xC1\xA3\x37\x29\xC1\x05\x0D\xC2"
--          "\x05\x62\x98\xFB\xFB\x16\x82\xCE\xEB\x65\xE5\x92\x04\xFD\xA7\xDF" }
--    },
--
--    {
--        ENCTYPE_DES_CBC_MD4,
--        { KV5M_DATA, 0, "", }, 0,
--        { KV5M_DATA, 8,
--          "\x13\xEF\x45\xD0\xD6\xD9\xA1\x5D" },
--        { KV5M_DATA, 24,
--          "\x1F\xB2\x02\xBF\x07\xAF\x30\x47\xFB\x78\x01\xE5\x88\x56\x86\x86"
--          "\xBA\x63\xD7\x8B\xE3\xE8\x7D\xC7" }
--    },
--    {
--        ENCTYPE_DES_CBC_MD4,
--        { KV5M_DATA, 1, "1", }, 1,
--        { KV5M_DATA, 8,
--          "\x64\x68\x86\x54\xDC\x26\x9E\x67" },
--        { KV5M_DATA, 32,
--          "\x1F\x6C\xB9\xCE\xCB\x73\xF7\x55\xAB\xFD\xB3\xD5\x65\xBD\x31\xD5"
--          "\xA2\xE6\x4B\xFE\x44\xC4\x91\xE2\x0E\xEB\xE5\xBD\x20\xE4\xD2\xA9" }
--    },
--    {
--        ENCTYPE_DES_CBC_MD4,
--        { KV5M_DATA, 9, "9 bytesss", }, 2,
--        { KV5M_DATA, 8,
--          "\x68\x04\xFB\x26\xDF\x8A\x4C\x32" },
--        { KV5M_DATA, 40,
--          "\x08\xA5\x3D\x62\xFE\xC3\x33\x8A\xD1\xD2\x18\xE6\x0D\xBD\xD3\xB2"
--          "\x12\x94\x06\x79\xD1\x25\xE0\x62\x1B\x3B\xAB\x46\x80\xCE\x03\x67"
--          "\x6A\x2C\x42\x0E\x9B\xE7\x84\xEB" }
--    },
--    {
--        ENCTYPE_DES_CBC_MD4,
--        { KV5M_DATA, 13, "13 bytes byte", }, 3,
--        { KV5M_DATA, 8,
--          "\x23\x4A\x43\x6E\xC7\x2F\xA8\x0B" },
--        { KV5M_DATA, 40,
--          "\x17\xCD\x45\xE1\x4F\xF0\x6B\x28\x40\xA6\x03\x6E\x9A\xA7\xA4\x14"
--          "\x4E\x29\x76\x81\x44\xA0\xC1\x82\x7D\x8C\x4B\xC7\xC9\x90\x6E\x72"
--          "\xCD\x4D\xC3\x28\xF6\x64\x8C\x99" }
--    },
--    {
--        ENCTYPE_DES_CBC_MD4,
--        { KV5M_DATA, 30, "30 bytes bytes bytes bytes byt", }, 4,
--        { KV5M_DATA, 8,
--          "\x1F\xD5\xF7\x43\x34\xC4\xFB\x8C" },
--        { KV5M_DATA, 56,
--          "\x51\x13\x4C\xD8\x95\x1E\x9D\x57\xC0\xA3\x60\x53\xE0\x4C\xE0\x3E"
--          "\xCB\x84\x22\x48\x8F\xDD\xC5\xC0\x74\xC4\xD8\x5E\x60\xA2\xAE\x42"
--          "\x3C\x3C\x70\x12\x01\x31\x4F\x36\x2C\xB0\x74\x48\x09\x16\x79\xC6"
--          "\xA4\x96\xC1\x1D\x7B\x93\xC7\x1B" }
--    },
--
--    {
--        ENCTYPE_DES_CBC_MD5,
--        { KV5M_DATA, 0, "", }, 0,
--        { KV5M_DATA, 8,
--          "\x4A\x54\x5E\x0B\xF7\xA2\x26\x31" },
--        { KV5M_DATA, 24,
--          "\x78\x4C\xD8\x15\x91\xA0\x34\xBE\x82\x55\x6F\x56\xDC\xA3\x22\x4B"
--          "\x62\xD9\x95\x6F\xA9\x0B\x1B\x93" }
--    },
--    {
--        ENCTYPE_DES_CBC_MD5,
--        { KV5M_DATA, 1, "1", }, 1,
--        { KV5M_DATA, 8,
--          "\xD5\x80\x4A\x26\x9D\xC4\xE6\x45" },
--        { KV5M_DATA, 32,
--          "\xFF\xA2\x5C\x7B\xE2\x87\x59\x6B\xFE\x58\x12\x6E\x90\xAA\xA0\xF1"
--          "\x2D\x9A\x82\xA0\xD8\x6D\xF6\xD5\xF9\x07\x4B\x6B\x39\x9E\x7F\xF1" }
--    },
--    {
--        ENCTYPE_DES_CBC_MD5,
--        { KV5M_DATA, 9, "9 bytesss", }, 2,
--        { KV5M_DATA, 8,
--          "\xC8\x31\x2F\x7F\x83\xEA\x46\x40" },
--        { KV5M_DATA, 40,
--          "\xE7\x85\x03\x37\xF2\xCC\x5E\x3F\x35\xCE\x3D\x69\xE2\xC3\x29\x86"
--          "\x38\xA7\xAA\x44\xB8\x78\x03\x1E\x39\x85\x1E\x47\xC1\x5B\x5D\x0E"
--          "\xE7\xE7\xAC\x54\xDE\x11\x1D\x80" }
--    },
--    {
--        ENCTYPE_DES_CBC_MD5,
--        { KV5M_DATA, 13, "13 bytes byte", }, 3,
--        { KV5M_DATA, 8,
--          "\x7F\xDA\x3E\x62\xAD\x8A\xF1\x8C" },
--        { KV5M_DATA, 40,
--          "\xD7\xA8\x03\x2E\x19\x99\x4C\x92\x87\x77\x50\x65\x95\xFB\xDA\x98"
--          "\x83\x15\x8A\x85\x14\x54\x8E\x29\x6E\x91\x1C\x29\xF4\x65\xC6\x72"
--          "\x36\x60\x00\x55\x8B\xFC\x2E\x88" }
--    },
--    {
--        ENCTYPE_DES_CBC_MD5,
--        { KV5M_DATA, 30, "30 bytes bytes bytes bytes byt", }, 4,
--        { KV5M_DATA, 8,
--          "\xD3\xD6\x83\x29\x70\xA7\x37\x52" },
--        { KV5M_DATA, 56,
--          "\x8A\x48\x16\x6A\x4C\x6F\xEA\xE6\x07\xA8\xCF\x68\xB3\x81\xC0\x75"
--          "\x5E\x40\x2B\x19\xDB\xC0\xF8\x1A\x7D\x7C\xA1\x9A\x25\xE0\x52\x23"
--          "\xF6\x06\x44\x09\xBF\x5A\x4F\x50\xAC\xD8\x26\x63\x9F\xFA\x76\x73"
--          "\xFD\x32\x4E\xC1\x9E\x42\x95\x02" }
--    },
--
-     {
-         ENCTYPE_DES3_CBC_SHA1,
-         { KV5M_DATA, 0, "", }, 0,
-@@ -669,9 +524,6 @@ printhex(const char *head, void *data, size_t len)
- 
- static krb5_enctype
- enctypes[] = {
--    ENCTYPE_DES_CBC_CRC,
--    ENCTYPE_DES_CBC_MD4,
--    ENCTYPE_DES_CBC_MD5,
-     ENCTYPE_DES3_CBC_SHA1,
-     ENCTYPE_ARCFOUR_HMAC,
-     ENCTYPE_ARCFOUR_HMAC_EXP,
-diff --git a/src/lib/crypto/crypto_tests/t_encrypt.c b/src/lib/crypto/crypto_tests/t_encrypt.c
-index 4afbddedb..bd9b94691 100644
---- a/src/lib/crypto/crypto_tests/t_encrypt.c
-+++ b/src/lib/crypto/crypto_tests/t_encrypt.c
-@@ -37,9 +37,6 @@
- 
- /* What enctypes should we test?*/
- krb5_enctype interesting_enctypes[] = {
--    ENCTYPE_DES_CBC_CRC,
--    ENCTYPE_DES_CBC_MD4,
--    ENCTYPE_DES_CBC_MD5,
-     ENCTYPE_DES3_CBC_SHA1,
-     ENCTYPE_ARCFOUR_HMAC,
-     ENCTYPE_ARCFOUR_HMAC_EXP,
-diff --git a/src/lib/crypto/crypto_tests/t_short.c b/src/lib/crypto/crypto_tests/t_short.c
-index 40fa2821f..d4c2b97df 100644
---- a/src/lib/crypto/crypto_tests/t_short.c
-+++ b/src/lib/crypto/crypto_tests/t_short.c
-@@ -34,9 +34,6 @@
- #include "k5-int.h"
- 
- krb5_enctype interesting_enctypes[] = {
--    ENCTYPE_DES_CBC_CRC,
--    ENCTYPE_DES_CBC_MD4,
--    ENCTYPE_DES_CBC_MD5,
-     ENCTYPE_DES3_CBC_SHA1,
-     ENCTYPE_ARCFOUR_HMAC,
-     ENCTYPE_ARCFOUR_HMAC_EXP,
-diff --git a/src/lib/crypto/crypto_tests/t_str2key.c b/src/lib/crypto/crypto_tests/t_str2key.c
-index 27896e61e..cdb1acc6d 100644
---- a/src/lib/crypto/crypto_tests/t_str2key.c
-+++ b/src/lib/crypto/crypto_tests/t_str2key.c
-@@ -35,280 +35,6 @@ struct test {
-     krb5_error_code expected_err;
-     krb5_boolean allow_weak;
- } test_cases[] = {
--    /* AFS string-to-key tests from old t_afss2k.c. */
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xA4\xD0\xD0\x9B\x86\x92\xB0\xC2" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "M",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xF1\xF2\x9E\xAB\xD0\xEF\xDF\x73" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xD6\x85\x61\xC4\xF2\x94\xF4\xA1" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My ",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xD0\xE3\xA7\x83\x94\x61\xE0\xD0" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My P",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xD5\x62\xCD\x94\x61\xCB\x97\xDF" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Pa",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\x9E\xA2\xA2\xEC\xA8\x8C\x6B\x8F" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Pas",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xE3\x91\x6D\xD3\x85\xF1\x67\xC4" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Pass",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xF4\xC4\x73\xC8\x8A\xE9\x94\x6D" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Passw",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xA1\x9E\xB3\xAD\x6B\xE3\xAB\xD9" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Passwo",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xAD\xA1\xCE\x10\x37\x83\xA7\x8C" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Passwor",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xD3\x01\xD0\xF7\x3E\x7A\x49\x0B" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Password",
--        { KV5M_DATA, 15, "Sodium Chloride" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xB6\x2A\x4A\xEC\x9D\x4C\x68\xDF" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\x61\xEF\xE6\x83\xE5\x8A\x6B\x98" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "M",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\x68\xCD\x68\xAD\xC4\x86\xCD\xE5" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\x83\xA1\xC8\x86\x8F\x67\xD0\x62" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My ",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\x9E\xC7\x8F\xA4\xA4\xB3\xE0\xD5" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My P",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xD9\x92\x86\x8F\x9D\x8C\x85\xE6" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Pa",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xDA\xF2\x92\x83\xF4\x9B\xA7\xAD" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Pas",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\x91\xCD\xAD\xEF\x86\xDF\xD3\xA2" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Pass",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\x73\xD3\x67\x68\x8F\x6E\xE3\x73" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Passw",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xC4\x61\x85\x9D\xAD\xF4\xDC\xB0" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Passwo",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\xE9\x02\x83\x16\x2C\xEC\xE0\x08" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Passwor",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\x61\xC8\x26\x29\xD9\x73\x6E\xB6" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "My Password",
--        { KV5M_DATA, 4, "NaCl" },
--        { KV5M_DATA, 1, "\1" },
--        { KV5M_DATA, 8, "\x8C\xA8\x9E\xC4\xA8\xDC\x31\x73" },
--        0,
--        FALSE
--    },
--
--    /* Test vectors from RFC 3961 appendix A.2. */
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "password",
--        { KV5M_DATA, 21, "ATHENA.MIT.EDUraeburn" },
--        { KV5M_DATA, 1, "\0" },
--        { KV5M_DATA, 8, "\xCB\xC2\x2F\xAE\x23\x52\x98\xE3" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "potatoe",
--        { KV5M_DATA, 19, "WHITEHOUSE.GOVdanny" },
--        { KV5M_DATA, 1, "\0" },
--        { KV5M_DATA, 8, "\xDF\x3D\x32\xA7\x4F\xD9\x2A\x01" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "\xF0\x9D\x84\x9E",
--        { KV5M_DATA, 18, "EXAMPLE.COMpianist" },
--        { KV5M_DATA, 1, "\0" },
--        { KV5M_DATA, 8, "\x4F\xFB\x26\xBA\xB0\xCD\x94\x13" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "\xC3\x9F",
--        { KV5M_DATA, 23, "ATHENA.MIT.EDUJuri\xC5\xA1\x69\xC4\x87" },
--        { KV5M_DATA, 1, "\0" },
--        { KV5M_DATA, 8, "\x62\xC8\x1A\x52\x32\xB5\xE6\x9D" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "11119999",
--        { KV5M_DATA, 8, "AAAAAAAA" },
--        { KV5M_DATA, 1, "\0" },
--        { KV5M_DATA, 8, "\x98\x40\x54\xd0\xf1\xa7\x3e\x31" },
--        0,
--        FALSE
--    },
--    {
--        ENCTYPE_DES_CBC_CRC,
--        "NNNN6666",
--        { KV5M_DATA, 8, "FFFFAAAA" },
--        { KV5M_DATA, 1, "\0" },
--        { KV5M_DATA, 8, "\xC4\xBF\x6B\x25\xAD\xF7\xA4\xF8" },
--        0,
--        FALSE
--    },
--
-     /* Test vectors from RFC 3961 appendix A.4. */
-     {
-         ENCTYPE_DES3_CBC_SHA1,
-diff --git a/src/lib/crypto/crypto_tests/vectors.c b/src/lib/crypto/crypto_tests/vectors.c
-index c1a765732..bcf5c9106 100644
---- a/src/lib/crypto/crypto_tests/vectors.c
-+++ b/src/lib/crypto/crypto_tests/vectors.c
-@@ -30,7 +30,8 @@
-  *
-  * N.B.: Doesn't compile -- this file uses some routines internal to our
-  * crypto library which are declared "static" and thus aren't accessible
-- * without modifying the other sources.
-+ * without modifying the other sources.  Additionally, some ciphers have been
-+ * removed.
-  */
- 
- #include <assert.h>
-diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-index db899a1dc..740425c69 100644
---- a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-+++ b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
-@@ -18,8 +18,8 @@ proc test200 {} {
- 
-     # I'd like to specify a long list of keysalt tuples and make sure
-     # that chpass does the right thing, but we can only use those
--    # enctypes that krbtgt has a key for: des-cbc-crc:normal
--    # according to the prototype kdc.conf.
-+    # enctypes that krbtgt has a key for: the AES enctypes, according to
-+    # the prototype kdc.conf.
-     if {! [cmd [format {
- 	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
- 		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-@@ -53,10 +53,10 @@ proc test200 {} {
-     }
- 
-     # XXX Perhaps I should actually check the key type returned.
--    if {$num_keys == 2} {
-+    if {$num_keys == 5} {
- 	pass "$test"
-     } else {
--	fail "$test: $num_keys keys, should be 2"
-+	fail "$test: $num_keys keys, should be 5"
-     }
-     if { ! [cmd {kadm5_destroy $server_handle}]} {
- 	perror "$test: unexpected failure in destroy"
-diff --git a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-index 8526897ed..3ea1ba29b 100644
---- a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-+++ b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
-@@ -143,8 +143,8 @@ proc test101_102 {rpc} {
-     }
- 
-     set failed 0
--    if {$num_keys != 2} {
--	fail "$test: num_keys $num_keys should be 2"
-+    if {$num_keys != 5} {
-+	fail "$test: num_keys $num_keys should be 5"
- 	set failed 1
-     }
-     for {set i 0} {$i < $num_keys} {incr i} {
-diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
-index ee652cbd3..2925c1c43 100644
---- a/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
-+++ b/src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
-@@ -16,10 +16,9 @@ proc test100 {} {
- 	return
-     }
- 
--    # I'd like to specify a long list of keysalt tuples and make sure
--    # that randkey does the right thing, but we can only use those
--    # enctypes that krbtgt has a key for: des-cbc-crc:normal and
--    # des-cbc-crc:v4, according to the prototype kdc.conf.
-+    # I'd like to specify a long list of keysalt tuples and make sure that
-+    # randkey does the right thing, but we can only use those enctypes that
-+    # krbtgt has a key for: 3DES and AES, according to the prototype kdc.conf.
-     if {! [cmd [format {
- 	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
- 		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
-@@ -47,10 +46,10 @@ proc test100 {} {
-     }
- 
-     # XXX Perhaps I should actually check the key type returned.
--    if {$num_keys == 2} {
-+    if {$num_keys == 5} {
- 	pass "$test"
-     } else {
--	fail "$test: $num_keys keys, should be 2"
-+	fail "$test: $num_keys keys, should be 5"
-     }
-     if { ! [cmd {kadm5_destroy $server_handle}]} {
- 	perror "$test: unexpected failure in destroy"
-diff --git a/src/lib/kadm5/unit-test/setkey-test.c b/src/lib/kadm5/unit-test/setkey-test.c
-index fa2392f81..8e7df96e9 100644
---- a/src/lib/kadm5/unit-test/setkey-test.c
-+++ b/src/lib/kadm5/unit-test/setkey-test.c
-@@ -19,15 +19,15 @@ need a random number generator
- #endif  /* no random */
- 
- krb5_keyblock test1[] = {
--    {0, ENCTYPE_DES_CBC_CRC, 0, 0},
-+    {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0},
-     {-1},
- };
- krb5_keyblock test2[] = {
--    {0, ENCTYPE_DES_CBC_CRC, 0, 0},
-+    {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0},
-     {-1},
- };
- krb5_keyblock test3[] = {
--    {0, ENCTYPE_DES_CBC_CRC, 0, 0},
-+    {0, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0, 0},
-     {-1},
- };
- 
-diff --git a/src/lib/krb5/keytab/t_keytab.c b/src/lib/krb5/keytab/t_keytab.c
-index c845596d6..ea4ce6819 100644
---- a/src/lib/krb5/keytab/t_keytab.c
-+++ b/src/lib/krb5/keytab/t_keytab.c
-@@ -96,6 +96,8 @@ kt_test(krb5_context context, const char *name)
-     krb5_principal princ;
-     krb5_kt_cursor cursor, cursor2;
-     int cnt;
-+    krb5_enctype e1 = ENCTYPE_AES128_CTS_HMAC_SHA256_128,
-+        e2 = ENCTYPE_AES256_CTS_HMAC_SHA384_192;
- 
-     kret = krb5_kt_resolve(context, name, &kt);
-     CHECK(kret, "resolve");
-@@ -139,9 +141,9 @@ kt_test(krb5_context context, const char *name)
-     /* ===================   Add entries to keytab ================= */
-     /*
-      * Add the following for this principal
--     * enctype 1, kvno 1, key = "1"
--     * enctype 2, kvno 1, key = "1"
--     * enctype 1, kvno 2, key = "2"
-+     * enctype e1, kvno 1, key = "1"
-+     * enctype e2, kvno 1, key = "1"
-+     * enctype e1, kvno 2, key = "2"
-      */
-     memset(&kent, 0, sizeof(kent));
-     kent.magic = KV5M_KEYTAB_ENTRY;
-@@ -149,7 +151,7 @@ kt_test(krb5_context context, const char *name)
-     kent.timestamp = 327689;
-     kent.vno = 1;
-     kent.key.magic = KV5M_KEYBLOCK;
--    kent.key.enctype = 1;
-+    kent.key.enctype = e1;
-     kent.key.length = 1;
-     kent.key.contents = (krb5_octet *) "1";
- 
-@@ -157,11 +159,11 @@ kt_test(krb5_context context, const char *name)
-     kret = krb5_kt_add_entry(context, kt, &kent);
-     CHECK(kret, "Adding initial entry");
- 
--    kent.key.enctype = 2;
-+    kent.key.enctype = e2;
-     kret = krb5_kt_add_entry(context, kt, &kent);
-     CHECK(kret, "Adding second entry");
- 
--    kent.key.enctype = 1;
-+    kent.key.enctype = e1;
-     kent.vno = 2;
-     kent.key.contents = (krb5_octet *) "2";
-     kret = krb5_kt_add_entry(context, kt, &kent);
-@@ -183,7 +185,7 @@ kt_test(krb5_context context, const char *name)
-     cnt = 0;
-     while((kret = krb5_kt_next_entry(context, kt, &kent, &cursor)) == 0) {
-         if(((kent.vno != 1) && (kent.vno != 2)) ||
--           ((kent.key.enctype != 1) && (kent.key.enctype != 2)) ||
-+           ((kent.key.enctype != e1) && (kent.key.enctype != e2)) ||
-            (kent.key.length != 1) ||
-            (kent.key.contents[0] != kent.vno +'0')) {
-             fprintf(stderr, "Error in read contents\n");
-@@ -231,7 +233,7 @@ kt_test(krb5_context context, const char *name)
-     /* Ensure a valid answer  - we did not specify an enctype or kvno */
-     if (!krb5_principal_compare(context, princ, kent.principal) ||
-         ((kent.vno != 1) && (kent.vno != 2)) ||
--        ((kent.key.enctype != 1) && (kent.key.enctype != 2)) ||
-+        ((kent.key.enctype != e1) && (kent.key.enctype != e2)) ||
-         (kent.key.length != 1) ||
-         (kent.key.contents[0] != kent.vno +'0')) {
-         fprintf(stderr, "Retrieved principal does not check\n");
-@@ -243,12 +245,12 @@ kt_test(krb5_context context, const char *name)
-     /* Try to lookup a specific enctype - but unspecified kvno - should give
-      * max kvno
-      */
--    kret = krb5_kt_get_entry(context, kt, princ, 0, 1, &kent);
-+    kret = krb5_kt_get_entry(context, kt, princ, 0, e1, &kent);
-     CHECK(kret, "looking up principal");
- 
-     /* Ensure a valid answer  - we did specified an enctype */
-     if (!krb5_principal_compare(context, princ, kent.principal) ||
--        (kent.vno != 2) || (kent.key.enctype != 1) ||
-+        (kent.vno != 2) || (kent.key.enctype != e1) ||
-         (kent.key.length != 1) ||
-         (kent.key.contents[0] != kent.vno +'0')) {
-         fprintf(stderr, "Retrieved principal does not check\n");
-@@ -266,7 +268,7 @@ kt_test(krb5_context context, const char *name)
- 
-     /* Ensure a valid answer  - we did not specify a kvno */
-     if (!krb5_principal_compare(context, princ, kent.principal) ||
--        (kent.vno != 2) || (kent.key.enctype != 1) ||
-+        (kent.vno != 2) || (kent.key.enctype != e1) ||
-         (kent.key.length != 1) ||
-         (kent.key.contents[0] != kent.vno +'0')) {
-         fprintf(stderr, "Retrieved principal does not check\n");
-@@ -281,11 +283,11 @@ kt_test(krb5_context context, const char *name)
- 
-     /* Try to lookup specified enctype and kvno */
- 
--    kret = krb5_kt_get_entry(context, kt, princ, 1, 1, &kent);
-+    kret = krb5_kt_get_entry(context, kt, princ, 1, e1, &kent);
-     CHECK(kret, "looking up principal");
- 
-     if (!krb5_principal_compare(context, princ, kent.principal) ||
--        (kent.vno != 1) || (kent.key.enctype != 1) ||
-+        (kent.vno != 1) || (kent.key.enctype != e1) ||
-         (kent.key.length != 1) ||
-         (kent.key.contents[0] != kent.vno +'0')) {
-         fprintf(stderr, "Retrieved principal does not check\n");
-@@ -334,7 +336,7 @@ kt_test(krb5_context context, const char *name)
- 
-     /* Try to lookup specified enctype and kvno  - that does not exist*/
- 
--    kret = krb5_kt_get_entry(context, kt, princ, 3, 1, &kent);
-+    kret = krb5_kt_get_entry(context, kt, princ, 3, e1, &kent);
-     CHECK_ERR(kret, KRB5_KT_KVNONOTFOUND,
-               "looking up specific principal, kvno, enctype");
- 
-@@ -347,12 +349,12 @@ kt_test(krb5_context context, const char *name)
-     kret = krb5_parse_name(context, "test/test2@TEST.MIT.EDU", &princ);
-     CHECK(kret, "parsing principal");
- 
--    kret = krb5_kt_get_entry(context, kt, princ, 0, 1, &kent);
-+    kret = krb5_kt_get_entry(context, kt, princ, 0, e1, &kent);
-     CHECK(kret, "looking up principal");
- 
--    /* Ensure a valid answer  - we are looking for max(kvno) and enc=1 */
-+    /* Ensure a valid answer  - we are looking for max(kvno) and enc=e1 */
-     if (!krb5_principal_compare(context, princ, kent.principal) ||
--        (kent.vno != 2) || (kent.key.enctype != 1) ||
-+        (kent.vno != 2) || (kent.key.enctype != e1) ||
-         (kent.key.length != 1) ||
-         (kent.key.contents[0] != kent.vno +'0')) {
-         fprintf(stderr, "Retrieved principal does not check\n");
-@@ -368,12 +370,12 @@ kt_test(krb5_context context, const char *name)
-     krb5_free_keytab_entry_contents(context, &kent);
-     /* And ensure gone */
- 
--    kret = krb5_kt_get_entry(context, kt, princ, 0, 1, &kent);
-+    kret = krb5_kt_get_entry(context, kt, princ, 0, e1, &kent);
-     CHECK(kret, "looking up principal");
- 
-     /* Ensure a valid answer - kvno should now be 1 - we deleted 2 */
-     if (!krb5_principal_compare(context, princ, kent.principal) ||
--        (kent.vno != 1) || (kent.key.enctype != 1) ||
-+        (kent.vno != 1) || (kent.key.enctype != e1) ||
-         (kent.key.length != 1) ||
-         (kent.key.contents[0] != kent.vno +'0')) {
-         fprintf(stderr, "Delete principal check failed\n");
-diff --git a/src/lib/krb5/krb/t_etypes.c b/src/lib/krb5/krb/t_etypes.c
-index 317637684..f609e938a 100644
---- a/src/lib/krb5/krb/t_etypes.c
-+++ b/src/lib/krb5/krb/t_etypes.c
-@@ -36,20 +36,6 @@ static struct {
-     krb5_error_code expected_err_noweak;
-     krb5_error_code expected_err_weak;
- } tests[] = {
--    /* Empty string, unused default list */
--    { "",
--      { ENCTYPE_DES_CBC_CRC, 0 },
--      { 0 },
--      { 0 },
--      0, 0
--    },
--    /* Single weak enctype */
--    { "des-cbc-md4",
--      { 0 },
--      { 0 },
--      { ENCTYPE_DES_CBC_MD4, 0 },
--      0, 0
--    },
-     /* Single non-weak enctype */
-     { "aes128-cts-hmac-sha1-96",
-       { 0 },
-@@ -57,35 +43,11 @@ static struct {
-       { ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0 },
-       0, 0
-     },
--    /* Two enctypes, one an alias, one weak */
--    { "rc4-hmac des-cbc-md5",
--      { 0 },
--      { ENCTYPE_ARCFOUR_HMAC, 0 },
--      { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES_CBC_MD5, 0 },
--      0, 0
--    },
--    /* Three enctypes, all weak, case variation, funky separators */
--    { "  deS-HMac-shA1 , arCFour-hmaC-mD5-exp\tdeS3-Cbc-RAw\n",
--      { 0 },
--      { 0 },
--      { ENCTYPE_DES_HMAC_SHA1, ENCTYPE_ARCFOUR_HMAC_EXP,
--        ENCTYPE_DES3_CBC_RAW, 0 },
--      0, 0
--    },
--    /* Default set with enctypes added (one weak in each pair) */
--    { "DEFAULT des-cbc-raw +des3-hmac-sha1",
--      { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_ARCFOUR_HMAC_EXP, 0 },
--      { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES3_CBC_SHA1, 0 },
--      { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_ARCFOUR_HMAC_EXP,
--        ENCTYPE_DES_CBC_RAW, ENCTYPE_DES3_CBC_SHA1, 0 },
--      0, 0
--    },
-     /* Default set with enctypes removed */
-     { "default -aes128-cts -des-hmac-sha1",
--      { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96,
--        ENCTYPE_DES_CBC_MD5, ENCTYPE_DES_HMAC_SHA1, 0 },
-+      { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0 },
-+      { ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 },
-       { ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 },
--      { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_DES_CBC_MD5, 0 },
-       0, 0
-     },
-     /* Family followed by enctype */
-@@ -105,31 +67,22 @@ static struct {
-       { ENCTYPE_CAMELLIA128_CTS_CMAC, 0 },
-       { ENCTYPE_CAMELLIA128_CTS_CMAC, 0 }
-     },
--    /* Enctype followed by two families */
--    { "+rc4-hmAC des3 +des",
--      { 0 },
--      { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES3_CBC_SHA1, 0 },
--      { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES3_CBC_SHA1, ENCTYPE_DES_CBC_CRC,
--        ENCTYPE_DES_CBC_MD5, ENCTYPE_DES_CBC_MD4 },
--      0, 0
--    },
-     /* Default set with family added and enctype removed */
-     { "DEFAULT +aes -arcfour-hmac-md5",
--      { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES3_CBC_SHA1, ENCTYPE_DES_CBC_CRC, 0 },
-+      { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES3_CBC_SHA1, 0 },
-       { ENCTYPE_DES3_CBC_SHA1, ENCTYPE_AES256_CTS_HMAC_SHA1_96,
-         ENCTYPE_AES128_CTS_HMAC_SHA1_96, ENCTYPE_AES256_CTS_HMAC_SHA384_192,
-         ENCTYPE_AES128_CTS_HMAC_SHA256_128, 0 },
--      { ENCTYPE_DES3_CBC_SHA1, ENCTYPE_DES_CBC_CRC,
-+      { ENCTYPE_DES3_CBC_SHA1,
-         ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96,
-         ENCTYPE_AES256_CTS_HMAC_SHA384_192, ENCTYPE_AES128_CTS_HMAC_SHA256_128,
-         0 },
-       0, 0
-     },
-     /* Default set with families removed and enctypes added (one redundant) */
--    { "DEFAULT -des -des3 rc4-hmac rc4-hmac-exp",
-+    { "DEFAULT -des3 rc4-hmac rc4-hmac-exp",
-       { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96,
--        ENCTYPE_DES3_CBC_SHA1, ENCTYPE_ARCFOUR_HMAC,
--        ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, ENCTYPE_DES_CBC_MD4, 0 },
-+        ENCTYPE_DES3_CBC_SHA1, ENCTYPE_ARCFOUR_HMAC, 0 },
-       { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96,
-         ENCTYPE_ARCFOUR_HMAC, 0 },
-       { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96,
-@@ -158,17 +111,17 @@ static struct {
-     },
-     /* Test krb5_set_default_in_tkt_ktypes */
-     { NULL,
--      { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_DES_CBC_CRC, 0 },
-       { ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 },
--      { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_DES_CBC_CRC, 0 },
-+      { ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 },
-+      { ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 },
-       0, 0
-     },
-     /* Should get KRB5_CONFIG_ETYPE_NOSUPP if app-provided list has no strong
-      * enctypes and allow_weak_crypto=false. */
-     { NULL,
--      { ENCTYPE_DES_CBC_CRC, 0 },
-+      { ENCTYPE_ARCFOUR_HMAC_EXP, 0 },
-       { 0 },
--      { ENCTYPE_DES_CBC_CRC, 0 },
-+      { ENCTYPE_ARCFOUR_HMAC_EXP, 0 },
-       KRB5_CONFIG_ETYPE_NOSUPP, 0
-     },
-     /* Should get EINVAL if app provides an empty list. */
-diff --git a/src/lib/krb5/krb/t_ser.c b/src/lib/krb5/krb/t_ser.c
-index 1d6cceaa2..f1a8c2553 100644
---- a/src/lib/krb5/krb/t_ser.c
-+++ b/src/lib/krb5/krb/t_ser.c
-@@ -272,7 +272,7 @@ ser_acontext_test(krb5_context kcontext, int verbose)
-                               KV5M_AUTH_CONTEXT))) {
-             memset(&ukeyblock, 0, sizeof(ukeyblock));
-             memset(keydata, 0, sizeof(keydata));
--            ukeyblock.enctype = ENCTYPE_DES_CBC_MD5;
-+            ukeyblock.enctype = ENCTYPE_AES128_CTS_HMAC_SHA256_128;
-             ukeyblock.length = sizeof(keydata);
-             ukeyblock.contents = keydata;
-             keydata[0] = 0xde;
-diff --git a/src/lib/krb5/os/t_trace.c b/src/lib/krb5/os/t_trace.c
-index 5aea68e8d..10ba8d0ac 100644
---- a/src/lib/krb5/os/t_trace.c
-+++ b/src/lib/krb5/os/t_trace.c
-@@ -204,7 +204,7 @@ main (int argc, char *argv[])
-     padatap = NULL;
- 
-     TRACE(ctx, "krb5_enctype, display shortest name of enctype: {etype}",
--          ENCTYPE_DES_CBC_CRC);
-+          ENCTYPE_AES128_CTS_HMAC_SHA1_96);
-     TRACE(ctx, "krb5_enctype *, display list of enctypes: {etypes}", enctypes);
-     TRACE(ctx, "krb5_enctype *, display list of enctypes: {etypes}", NULL);
- 
-diff --git a/src/lib/krb5/os/t_trace.ref b/src/lib/krb5/os/t_trace.ref
-index bd5d9b6b6..044a66999 100644
---- a/src/lib/krb5/os/t_trace.ref
-+++ b/src/lib/krb5/os/t_trace.ref
-@@ -40,7 +40,7 @@ int, krb5_principal type: NT 4 style name and SID
- int, krb5_principal type: ?
- krb5_pa_data **, display list of padata type numbers: PA-PW-SALT (3), 0
- krb5_pa_data **, display list of padata type numbers: (empty)
--krb5_enctype, display shortest name of enctype: des-cbc-crc
-+krb5_enctype, display shortest name of enctype: aes128-cts
- krb5_enctype *, display list of enctypes: 5, rc4-hmac-exp, 511
- krb5_enctype *, display list of enctypes: (empty)
- krb5_ccache, display type:name: FILE:/path/to/ccache
-diff --git a/src/tests/asn.1/ktest.c b/src/tests/asn.1/ktest.c
-index 6bf6e54ac..258377299 100644
---- a/src/tests/asn.1/ktest.c
-+++ b/src/tests/asn.1/ktest.c
-@@ -893,7 +893,7 @@ ktest_make_sample_sp80056a_other_info(krb5_sp80056a_other_info *p)
- void
- ktest_make_sample_pkinit_supp_pub_info(krb5_pkinit_supp_pub_info *p)
- {
--    p->enctype = ENCTYPE_DES_CBC_CRC;
-+    p->enctype = ENCTYPE_AES256_CTS_HMAC_SHA384_192;
-     ktest_make_sample_data(&p->as_req);
-     ktest_make_sample_data(&p->pk_as_rep);
- }
-diff --git a/src/tests/asn.1/pkinit_encode.out b/src/tests/asn.1/pkinit_encode.out
-index 3b0f7190a..55a60bbef 100644
---- a/src/tests/asn.1/pkinit_encode.out
-+++ b/src/tests/asn.1/pkinit_encode.out
-@@ -10,4 +10,4 @@ encode_krb5_kdc_dh_key_info: 30 25 A0 0B 03 09 00 6B 72 62 35 64 61 74 61 A1 03
- encode_krb5_reply_key_pack: 30 26 A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 0F 30 0D A0 03 02 01 01 A1 06 04 04 31 32 33 34
- encode_krb5_reply_key_pack_draft9: 30 1A A0 13 30 11 A0 03 02 01 01 A1 0A 04 08 31 32 33 34 35 36 37 38 A1 03 02 01 2A
- encode_krb5_sp80056a_other_info: 30 81 81 30 0B 06 09 2A 86 48 86 F7 12 01 02 02 A0 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A1 32 04 30 30 2E A0 10 1B 0E 41 54 48 45 4E 41 2E 4D 49 54 2E 45 44 55 A1 1A 30 18 A0 03 02 01 01 A1 11 30 0F 1B 06 68 66 74 73 61 69 1B 05 65 78 74 72 61 A2 0A 04 08 6B 72 62 35 64 61 74 61
--encode_krb5_pkinit_supp_pub_info: 30 1D A0 03 02 01 01 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0A 04 08 6B 72 62 35 64 61 74 61
-+encode_krb5_pkinit_supp_pub_info: 30 1D A0 03 02 01 14 A1 0A 04 08 6B 72 62 35 64 61 74 61 A2 0A 04 08 6B 72 62 35 64 61 74 61
-diff --git a/src/tests/asn.1/pkinit_trval.out b/src/tests/asn.1/pkinit_trval.out
-index f9edbe154..9557188a8 100644
---- a/src/tests/asn.1/pkinit_trval.out
-+++ b/src/tests/asn.1/pkinit_trval.out
-@@ -145,6 +145,6 @@ encode_krb5_sp80056a_other_info:
- encode_krb5_pkinit_supp_pub_info:
- 
- [Sequence/Sequence Of]
--.  [0] [Integer] 1
-+.  [0] [Integer] 20
- .  [1] [Octet String] "krb5data"
- .  [2] [Octet String] "krb5data"
-diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp
-index c061d764e..e8adee234 100644
---- a/src/tests/dejagnu/config/default.exp
-+++ b/src/tests/dejagnu/config/default.exp
-@@ -16,21 +16,6 @@ set stty_init {erase \^h kill \^u}
- set env(TERM) dumb
- 
- set des3_krbtgt 0
--set tgt_support_desmd5 0
--
--# The names of the individual passes must be unique; lots of things
--# depend on it.  The PASSES variable may not contain comments; only
--# small pieces get evaluated, so comments will do strange things.
--
--# Most of the purpose of using multiple passes is to exercise the
--# dependency of various bugs on configuration file settings,
--# particularly with regards to encryption types.
--
--# The des.no-kdc-md5 pass will fail if the KDC does not constrain
--# session key enctypes to those in its permitted_enctypes list.  It
--# works by assuming enctype similarity, thus allowing the client to
--# request a des-cbc-md4 session key.  Since only des-cbc-crc is in the
--# KDC's permitted_enctypes list, the TGT will be unusable.
- 
- if { [string length $VALGRIND] } {
-     rename spawn valgrind_aux_spawn
-@@ -111,47 +96,21 @@ if { $PRIOCNTL_HACK } {
-     }
- }
- 
--# The des.des3-tgt.no-kdc-des3 pass will fail if the KDC doesn't
--# constrain ticket key enctypes to those in permitted_enctypes.  It
--# does this by not putting des3 in the permitted_enctypes, while
--# creating a TGT princpal that has a des3 key as well as a des key.
-+# The names of the individual passes must be unique; lots of things
-+# depend on it.  The PASSES variable may not contain comments; only
-+# small pieces get evaluated, so comments will do strange things.
- 
--# XXX -- master_key_type is fragile w.r.t. permitted_enctypes; it is
--# possible to configure things such that you have a master_key_type
--# that is not permitted, and the error message used to be cryptic.
-+# Most of the purpose of using multiple passes is to exercise the
-+# dependency of various bugs on configuration file settings,
-+# particularly with regards to encryption types.
- 
- set passes {
--    {
--	des
--	mode=udp
--	des3_krbtgt=0
--	{supported_enctypes=des-cbc-crc:normal}
--	{dummy=[verbose -log "DES TGT, DES enctype"]}
--    }
--    {
--	des.des3tgt
--	mode=udp
--	des3_krbtgt=1
--	{supported_enctypes=des-cbc-crc:normal}
--	{dummy=[verbose -log "DES3 TGT, DES enctype"]}
--    }
-     {
- 	des3
- 	mode=udp
- 	des3_krbtgt=1
--	{supported_enctypes=des3-cbc-sha1:normal des-cbc-crc:normal}
--	{dummy=[verbose -log "DES3 TGT, DES3 + DES enctypes"]}
--    }
--    {
--	aes-des
--	mode=udp
--	des3_krbtgt=0
--	{supported_enctypes=aes256-cts-hmac-sha1-96:normal des-cbc-crc:normal}
--	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des-cbc-crc}
--	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des-cbc-crc}
--	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des-cbc-crc}
--	{master_key_type=aes256-cts-hmac-sha1-96}
--	{dummy=[verbose -log "AES + DES enctypes"]}
-+	{supported_enctypes=des3-cbc-sha1:normal}
-+	{dummy=[verbose -log "DES3 TGT, DES3 enctype"]}
-     }
-     {
- 	aes-only
-@@ -220,10 +179,10 @@ set passes {
- 	aes-des3
- 	mode=udp
- 	des3_krbtgt=0
--	{supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal des-cbc-crc:normal}
--	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1 des-cbc-crc}
--	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1 des-cbc-crc}
--	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1 des-cbc-crc}
-+	{supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal}
-+	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
-+	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
-+	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
- 	{master_key_type=aes256-cts-hmac-sha1-96}
- 	{dummy=[verbose -log "AES + DES3 + DES enctypes"]}
-     }
-@@ -231,12 +190,12 @@ set passes {
- 	aes-des3tgt
- 	mode=udp
- 	des3_krbtgt=1
--	{supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal des-cbc-crc:normal}
--	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1 des-cbc-crc}
--	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1 des-cbc-crc}
--	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1 des-cbc-crc}
-+	{supported_enctypes=aes256-cts-hmac-sha1-96:normal des3-cbc-sha1:normal}
-+	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
-+	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
-+	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96 des3-cbc-sha1}
- 	{master_key_type=aes256-cts-hmac-sha1-96}
--	{dummy=[verbose -log "AES + DES enctypes, DES3 TGT"]}
-+	{dummy=[verbose -log "AES enctypes, DES3 TGT"]}
-     }
-     {
- 	all-enctypes
-@@ -248,114 +207,7 @@ set passes {
- 	{allow_weak_crypto(server)=false}
- 	{dummy=[verbose -log "all default enctypes"]}
-     }
--    {
--	des.no-kdc-md5
--	mode=udp
--	des3_krbtgt=0
--	tgt_support_desmd5=0
--	{permitted_enctypes(kdc)=des-cbc-crc}
--	{default_tgs_enctypes(client)=des-cbc-md5 des-cbc-md4 des-cbc-crc}
--	{default_tkt_enctypes(client)=des-cbc-md5 des-cbc-md4 des-cbc-crc}
--	{supported_enctypes=des-cbc-crc:normal}
--	{master_key_type=des-cbc-crc}
--	{dummy=[verbose -log \
--		"DES TGT, KDC permitting only des-cbc-crc"]}
--    }
--    {
--	des.des3-tgt.no-kdc-des3
--	mode=udp
--	tgt_support_desmd5=0
--	{permitted_enctypes(kdc)=des-cbc-crc}
--	{default_tgs_enctypes(client)=des-cbc-crc}
--	{default_tkt_enctypes(client)=des-cbc-crc}
--	{supported_enctypes=des3-cbc-sha1:normal des-cbc-crc:normal}
--	{master_key_type=des-cbc-crc}
--	{dummy=[verbose -log \
--		"DES3 TGT, KDC permitting only des-cbc-crc"]}
--    }
--}
--
--# des.md5-tgt is set as unused, since it won't trigger the error case
--# if SUPPORT_DESMD5 isn't honored.
--
--# The des.md5-tgt pass will fail if enctype similarity is inconsisent;
--# between 1.0.x and 1.1, the decrypt functions became more strict
--# about matching enctypes, while the KDB retrieval functions didn't
--# coerce the enctype to match what was requested.  It works by setting
--# SUPPORT_DESMD5 on the TGT principal, forcing an enctype of
--# des-cbc-md5 on the TGT key.  Since the database only contains a
--# des-cbc-crc key, the decrypt will fail if enctypes are not coerced.
--
--# des.no-kdc-md5.client-md4-skey is retained in unsed_passes, even
--# though des.no-kdc-md5 is roughly equivalent, since the associated
--# comment needs additional investigation at some point re the kadmin
--# client.
--
--# The des.no-kdc-md5.client-md4-skey will fail on TGS requests due to
--# the KDC issuing session keys that it won't accept.  It will also
--# fail for a kadmin client, but for different reasons, since the kadm5
--# library does some curious filtering of enctypes, and also uses
--# get_in_tkt() rather than get_init_creds(); the former does an
--# intersection of the enctypes provided by the caller and those listed
--# in the config file!
--
--set unused_passes {
--    {
--	des.md5-tgt
--	des3_krbtgt=0
--	tgt_support_desmd5=1
--	supported_enctypes=des-cbc-crc:normal
--	{permitted_enctypes(kdc)=des-cbc-md5 des-cbc-md4 des-cbc-crc}
--	{permitted_enctypes(client)=des-cbc-md5 des-cbc-md4 des-cbc-crc}
--	{dummy=[verbose -log "DES TGT, SUPPORTS_DESMD5"]}
--    }
--    {
--	des.md5-tgt.no-kdc-md5
--	des3_krbtgt=0
--	tgt_support_desmd5=1
--	{permitted_enctypes(kdc)=des-cbc-crc}
--	{default_tgs_enctypes(client)=des-cbc-crc}
--	{default_tkt_enctypes(client)=des-cbc-crc}
--	{supported_enctypes=des-cbc-crc:normal}
--	{master_key_type=des-cbc-crc}
--	{dummy=[verbose -log \
--		"DES TGT, SUPPORTS_DESMD5, KDC permitting only des-cbc-crc"]}
--    }
--    {
--	des.no-kdc-md5.client-md4-skey
--	des3_krbtgt=0
--	{permitted_enctypes(kdc)=des-cbc-crc}
--	{permitted_enctypes(client)=des-cbc-crc des-cbc-md4}
--	{default_tgs_enctypes(client)=des-cbc-crc des-cbc-md4}
--	{default_tkt_enctypes(client)=des-cbc-md4}
--	{supported_enctypes=des-cbc-crc:normal}
--	{dummy=[verbose -log \
--		"DES TGT, DES enctype, KDC permitting only des-cbc-crc, client requests des-cbc-md4 session key"]}
--    }
--    {
--	all-enctypes
--	des3_krbtgt=1
--	{supported_enctypes=\
--	aes256-cts-hmac-sha1-96:normal aes256-cts-hmac-sha1-96:norealm \
--	aes128-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:norealm \
--	des3-cbc-sha1:normal des3-cbc-sha1:none \
--	des-cbc-md5:normal des-cbc-md4:normal des-cbc-crc:normal \
--	}
--	{dummy=[verbose -log "DES3 TGT, default enctypes"]}
--    }
--    {
--	aes-tcp
--	mode=tcp
--	des3_krbtgt=0
--	{supported_enctypes=aes256-cts-hmac-sha1-96:normal}
--	{permitted_enctypes(kdc)=aes256-cts-hmac-sha1-96}
--	{permitted_enctypes(client)=aes256-cts-hmac-sha1-96}
--	{permitted_enctypes(server)=aes256-cts-hmac-sha1-96}
--	{master_key_type=aes256-cts-hmac-sha1-96}
--	{dummy=[verbose -log "AES via TCP"]}
--    }
- }
--#	{supported_enctypes=des-cbc-md5:normal des-cbc-crc:normal twofish256-hmac-sha1:normal }
- 
- # This shouldn't be necessary on dejagnu-1.4 and later, but 1.3 seems
- # to need it because its runtest.exp doesn't deal with PASS at all.
-@@ -1095,7 +947,7 @@ proc setup_kerberos_db { standalone } {
-     global REALMNAME KDB5_UTIL KADMIN_LOCAL KEY
-     global tmppwd hostname
-     global spawn_id
--    global des3_krbtgt tgt_support_desmd5
-+    global des3_krbtgt
-     global multipass_name last_passname_db
- 
-     set failall 0
-@@ -1334,48 +1186,6 @@ proc setup_kerberos_db { standalone } {
- 	    }
- 	}
-     }
--    if $tgt_support_desmd5 {
--	# Make TGT support des-cbc-md5
--	set test "kadmin.local TGT to SUPPORT_DESMD5"
--	set body {
--	    if $failall {
--		break
--	    }
--	    spawn $KADMIN_LOCAL -r $REALMNAME
--	    verbose "starting $test"
--	    expect_after $def_exp_after
--
--	    expect "kadmin.local: "
--	    send "modprinc +support_desmd5 krbtgt/$REALMNAME@$REALMNAME\r"
--	    # It echos...
--	    expect "modprinc +support_desmd5 krbtgt/$REALMNAME@$REALMNAME\r"
--	    expect {
--		"Principal \"krbtgt/$REALMNAME@$REALMNAME\" modified.\r\n" { }
--	    }
--	    expect "kadmin.local: "
--	    send "quit\r"
--	    expect eof
--	    catch expect_after
--	    if ![check_exit_status kadmin_local] {
--		break
--	    }
--	}
--	set ret [catch $body]
--	catch "expect eof"
--	catch expect_after
--	if $ret {
--	    set failall 1
--	    if $standalone {
--		fail $test
--	    } else {
--		delete_db
--	    }
--	} else {
--	    if $standalone {
--		pass $test
--	    }
--	}
--    }
-     envstack_pop
- 
-     # create the admin database lock file
-diff --git a/src/tests/gssapi/t_invalid.c b/src/tests/gssapi/t_invalid.c
-index 2a332a8ae..9876a11e6 100644
---- a/src/tests/gssapi/t_invalid.c
-+++ b/src/tests/gssapi/t_invalid.c
-@@ -84,17 +84,6 @@ struct test {
-     size_t toklen;
-     const char *token;
- } tests[] = {
--    {
--        ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_RAW,
--        SEAL_ALG_DES, SGN_ALG_DES_MAC_MD5, 8,
--        8,
--        "\x26\xEC\xBA\xB6\xFE\xBA\x91\xCE",
--        53,
--        "\x60\x33\x06\x09\x2A\x86\x48\x86\xF7\x12\x01\x02\x02\x02\x01\x00"
--        "\x00\x00\x00\xFF\xFF\xF0\x0B\x90\x7B\xC4\xFC\xEB\xF4\x84\x9C\x5A"
--        "\xA8\x56\x41\x3E\xE1\x62\xEE\x38\xD1\x34\x9A\xE3\xFB\xC9\xFD\x0A"
--        "\xDC\x83\xE1\x4A\xE4"
--    },
-     {
-         ENCTYPE_DES3_CBC_SHA1, ENCTYPE_DES3_CBC_RAW,
-         SEAL_ALG_DES3KD, SGN_ALG_HMAC_SHA1_DES3_KD, 20,
-@@ -160,8 +149,6 @@ make_fake_context(const struct test *test)
-     gss_union_ctx_id_t uctx;
-     krb5_gss_ctx_id_t kgctx;
-     krb5_keyblock kb;
--    unsigned char encbuf[8];
--    size_t i;
- 
-     kgctx = calloc(1, sizeof(*kgctx));
-     if (kgctx == NULL)
-@@ -184,11 +171,6 @@ make_fake_context(const struct test *test)
-     if (krb5_k_create_key(NULL, &kb, &kgctx->seq) != 0)
-         abort();
- 
--    if (kb.enctype == ENCTYPE_DES_CBC_RAW) {
--        for (i = 0; i < 8; i++)
--            encbuf[i] = kb.contents[i] ^ 0xF0;
--        kb.contents = encbuf;
--    }
-     if (krb5_k_create_key(NULL, &kb, &kgctx->enc) != 0)
-         abort();
- 
-@@ -248,7 +230,7 @@ test_bogus_1964_token(gss_ctx_id_t ctx)
-     gss_iov_buffer_desc iov;
- 
-     store_16_be(KG_TOK_SIGN_MSG, tokbuf);
--    store_16_le(SGN_ALG_DES_MAC_MD5, tokbuf + 2);
-+    store_16_le(SGN_ALG_HMAC_MD5, tokbuf + 2);
-     store_16_le(SEAL_ALG_NONE, tokbuf + 4);
-     store_16_le(0xFFFF, tokbuf + 6);
-     memset(tokbuf + 8, 0, 16);
-diff --git a/src/tests/gssapi/t_pcontok.c b/src/tests/gssapi/t_pcontok.c
-index c40ea434c..7368f752f 100644
---- a/src/tests/gssapi/t_pcontok.c
-+++ b/src/tests/gssapi/t_pcontok.c
-@@ -43,7 +43,6 @@
- #include "k5-int.h"
- #include "common.h"
- 
--#define SGN_ALG_DES_MAC_MD5       0x00
- #define SGN_ALG_HMAC_SHA1_DES3_KD 0x04
- #define SGN_ALG_HMAC_MD5          0x11
- 
-@@ -78,11 +77,7 @@ make_delete_token(gss_krb5_lucid_context_v1_t *lctx, gss_buffer_desc *out)
-     ret = krb5_k_create_key(context, &seqkb, &seq);
-     check_k5err(context, "krb5_k_create_key", ret);
- 
--    if (signalg == SGN_ALG_DES_MAC_MD5) {
--        cktype = CKSUMTYPE_RSA_MD5;
--        cksize = 8;
--        ckusage = 0;
--    } else if (signalg == SGN_ALG_HMAC_SHA1_DES3_KD) {
-+    if (signalg == SGN_ALG_HMAC_SHA1_DES3_KD) {
-         cktype = CKSUMTYPE_HMAC_SHA1_DES3;
-         cksize = 20;
-         ckusage = 23;
-@@ -122,15 +117,7 @@ make_delete_token(gss_krb5_lucid_context_v1_t *lctx, gss_buffer_desc *out)
-     d = make_data(ptr - 8, 8);
-     ret = krb5_k_make_checksum(context, cktype, seq, ckusage, &d, &cksum);
-     check_k5err(context, "krb5_k_make_checksum", ret);
--    if (signalg == SGN_ALG_DES_MAC_MD5) {
--        iov.flags = KRB5_CRYPTO_TYPE_DATA;
--        iov.data = make_data(cksum.contents, 16);
--        ret = krb5_k_encrypt_iov(context, seq, 0, NULL, &iov, 1);
--        check_k5err(context, "krb5_k_encrypt_iov", ret);
--        memcpy(ptr + 8, cksum.contents + 8, 8);
--    } else {
--        memcpy(ptr + 8, cksum.contents, cksize);
--    }
-+    memcpy(ptr + 8, cksum.contents, cksize);
- 
-     /* Create the sequence number (8 bytes). */
-     iov.flags = KRB5_CRYPTO_TYPE_DATA;
-diff --git a/src/tests/gssapi/t_prf.c b/src/tests/gssapi/t_prf.c
-index 6a698ce0f..f71774cdc 100644
---- a/src/tests/gssapi/t_prf.c
-+++ b/src/tests/gssapi/t_prf.c
-@@ -41,13 +41,6 @@ static struct {
-     const char *key2;
-     const char *out2;
- } tests[] = {
--    { ENCTYPE_DES_CBC_CRC,
--      "E607FE9DABB57AE0",
--      "803C4121379FC4B87CE413B67707C4632EBED2C6D6B7"
--      "2A55E878836E35E21600D915D590DED5B6D77BB30A1F",
--      "54758316B6257A75",
--      "279E4105F7ADC9BD6EF28ABE31D89B442FE0058388BA"
--      "33264ACB5729562DC637950F6BD144B654BE7700B2D6" },
-     { ENCTYPE_DES3_CBC_SHA1,
-       "70378A19CD64134580C27C0115D6B34A1CF2FEECEF9886A2",
-       "9F8D127C520BB826BFF3E0FE5EF352389C17E0C073D9"
-diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
-index c21d054f1..2a052fc17 100644
---- a/src/tests/t_etype_info.py
-+++ b/src/tests/t_etype_info.py
-@@ -24,7 +24,7 @@ def test_etinfo(princ, enctypes, expected_lines):
- # With no newer enctypes in the request, PA-ETYPE-INFO2,
- # PA-ETYPE-INFO, and PA-PW-SALT appear in the AS-REP, each listing one
- # key for the most preferred matching enctype.
--test_etinfo('user', 'rc4-hmac-exp des3 rc4 des-cbc-crc',
-+test_etinfo('user', 'rc4-hmac-exp des3 rc4',
-             ['asrep etype_info2 des3-cbc-sha1 KRBTEST.COMuser',
-              'asrep etype_info des3-cbc-sha1 KRBTEST.COMuser',
-              'asrep pw_salt KRBTEST.COMuser'])
-@@ -37,7 +37,7 @@ test_etinfo('user', 'rc4 aes256-cts',
- 
- # In preauth-required errors, PA-PW-SALT does not appear, but the same
- # etype-info2 values are expected.
--test_etinfo('preauthuser', 'rc4-hmac-exp des3 rc4 des-cbc-crc',
-+test_etinfo('preauthuser', 'rc4-hmac-exp des3 rc4',
-             ['error etype_info2 des3-cbc-sha1 KRBTEST.COMpreauthuser',
-              'error etype_info des3-cbc-sha1 KRBTEST.COMpreauthuser'])
- test_etinfo('preauthuser', 'rc4 aes256-cts',
-diff --git a/src/tests/t_keyrollover.py b/src/tests/t_keyrollover.py
-index 4af6804f2..2c825a692 100755
---- a/src/tests/t_keyrollover.py
-+++ b/src/tests/t_keyrollover.py
-@@ -2,7 +2,7 @@ from k5test import *
- 
- rollover_krb5_conf = {'libdefaults': {'allow_weak_crypto': 'true'}}
- 
--realm = K5Realm(krbtgt_keysalt='des-cbc-crc:normal',
-+realm = K5Realm(krbtgt_keysalt='aes128-cts-hmac-sha256-128:normal',
-                 krb5_conf=rollover_krb5_conf)
- 
- princ1 = 'host/test1@%s' % (realm.realm,)
-@@ -22,9 +22,9 @@ realm.run([kvno, princ1])
- realm.run([kadminl, 'purgekeys', realm.krbtgt_princ])
- # Make sure an old TGT fails after purging old TGS key.
- realm.run([kvno, princ2], expected_code=1)
--ddes = "DEPRECATED:des-cbc-crc"
-+et = "aes128-cts-hmac-sha256-128"
- msg = 'krbtgt/%s@%s\n\tEtype (skey, tkt): %s, %s' % \
--    (realm.realm, realm.realm, ddes, ddes)
-+    (realm.realm, realm.realm, et, et)
- realm.run([klist, '-e'], expected_msg=msg)
- 
- # Check that new key actually works.
-diff --git a/src/tests/t_salt.py b/src/tests/t_salt.py
-index 008efcb03..65084bbf3 100755
---- a/src/tests/t_salt.py
-+++ b/src/tests/t_salt.py
-@@ -22,7 +22,7 @@ salts = [('des3-cbc-sha1', 'norealm'),
- # These enctypes are chosen to cover the different string-to-key routines.
- # Omit ":normal" from aes256 to check that salttype defaulting works.
- second_kstypes = ['aes256-cts-hmac-sha1-96', 'arcfour-hmac:normal',
--                  'des3-cbc-sha1:normal', 'des-cbc-crc:normal']
-+                  'des3-cbc-sha1:normal']
- 
- # Test using different salt types in a principal's key list.
- # Parameters from one key in the list must not leak over to later ones.
-diff --git a/src/tests/t_sesskeynego.py b/src/tests/t_sesskeynego.py
-index da02f224a..621b27156 100755
---- a/src/tests/t_sesskeynego.py
-+++ b/src/tests/t_sesskeynego.py
-@@ -23,13 +23,7 @@ conf2 = {'libdefaults': {'default_tgs_enctypes': 'aes256-cts,aes128-cts'}}
- conf3 = {'libdefaults': {
-         'allow_weak_crypto': 'true',
-         'default_tkt_enctypes': 'aes128-cts',
--        'default_tgs_enctypes': 'rc4-hmac,aes128-cts,des-cbc-crc'}}
--conf4 = {'libdefaults': {
--        'allow_weak_crypto': 'true',
--        'default_tkt_enctypes': 'aes256-cts',
--        'default_tgs_enctypes': 'des-cbc-crc,rc4-hmac,aes256-cts'},
--         'realms': {'$realm': {'des_crc_session_supported': 'false'}}}
--
-+        'default_tgs_enctypes': 'rc4-hmac,aes128-cts'}}
- # Test with client request and session_enctypes preferring aes128, but
- # aes256 long-term key.
- realm = K5Realm(krb5_conf=conf1, create_host=False, get_creds=False)
-@@ -63,16 +57,6 @@ test_kvno(realm, 'aes128-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96')
- realm.run([kadminl, 'setstr', 'server', 'session_enctypes',
-            'rc4-hmac,aes128-cts,aes256-cts'])
- test_kvno(realm, 'DEPRECATED:arcfour-hmac', 'aes256-cts-hmac-sha1-96')
--
--# 3c: Test des-cbc-crc default assumption.
--realm.run([kadminl, 'delstr', 'server', 'session_enctypes'])
--test_kvno(realm, 'DEPRECATED:des-cbc-crc', 'aes256-cts-hmac-sha1-96')
--realm.stop()
--
--# Last go: test that we can disable the des-cbc-crc assumption
--realm = K5Realm(krb5_conf=conf4, get_creds=False)
--realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts', 'server'])
--test_kvno(realm, 'aes256-cts-hmac-sha1-96', 'aes256-cts-hmac-sha1-96')
- realm.stop()
- 
- success('sesskeynego')
-diff --git a/src/util/k5test.py b/src/util/k5test.py
-index b6d93f1d8..da2782e15 100644
---- a/src/util/k5test.py
-+++ b/src/util/k5test.py
-@@ -1307,7 +1307,7 @@ _passes = [
-                     'master_key_type': 'aes256-sha2'}}}),
- 
-     # Test a setup with modern principal keys but an old TGT key.
--    ('aes256.destgt', 'des-cbc-crc:normal',
-+    ('aes256.destgt', 'arcfour-hmac:normal',
-      {'libdefaults': {'allow_weak_crypto': 'true'}},
-      None)
- ]
diff --git a/Use-imported-soft-pkcs11-for-tests.patch b/Use-imported-soft-pkcs11-for-tests.patch
deleted file mode 100644
index 22e7759..0000000
--- a/Use-imported-soft-pkcs11-for-tests.patch
+++ /dev/null
@@ -1,471 +0,0 @@
-From 47e66724b9d5cfef84965d99c83d29e4739932e3 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Thu, 20 Jun 2019 13:41:57 -0400
-Subject: [PATCH] Use imported soft-pkcs11 for tests
-
-Update the soft-pkcs11 code for OpenSSL 1.1, fix some warnings,
-integrate it into the build system, and use it for the PKINIT tests.
-
-(cherry picked from commit e5ef7b69765353ea62ad8712a229ed4e90a8fe17)
----
- src/configure.in                        |   1 +
- src/tests/Makefile.in                   |   2 +-
- src/tests/softpkcs11/Makefile.in        |  21 ++++
- src/tests/softpkcs11/deps               |   6 ++
- src/tests/softpkcs11/main.c             | 124 +++++++++++++++++-------
- src/tests/softpkcs11/softpkcs11.exports |  39 ++++++++
- src/tests/t_pkinit.py                   |  18 +---
- 7 files changed, 162 insertions(+), 49 deletions(-)
- create mode 100644 src/tests/softpkcs11/Makefile.in
- create mode 100644 src/tests/softpkcs11/deps
- create mode 100644 src/tests/softpkcs11/softpkcs11.exports
-
-diff --git a/src/configure.in b/src/configure.in
-index a19a0ea97..d0d8c4ed7 100644
---- a/src/configure.in
-+++ b/src/configure.in
-@@ -1086,6 +1086,7 @@ int i = 1;
- fi
- if test "$k5_cv_openssl_version_okay" = yes && (test "$enable_pkinit" = yes || test "$enable_pkinit" = try); then
-   K5_GEN_MAKEFILE(plugins/preauth/pkinit)
-+  K5_GEN_MAKEFILE(tests/softpkcs11)
-   PKINIT=yes
-   AC_CHECK_LIB(crypto, CMS_get0_content, [AC_DEFINE([HAVE_OPENSSL_CMS], 1, [Define if OpenSSL supports cms.])])
- elif test "$k5_cv_openssl_version_okay" = no && test "$enable_pkinit" = yes; then
-diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in
-index d2a37c616..8fa44fb59 100644
---- a/src/tests/Makefile.in
-+++ b/src/tests/Makefile.in
-@@ -1,7 +1,7 @@
- mydir=tests
- BUILDTOP=$(REL)..
- SUBDIRS = resolve asn.1 create hammer verify gssapi dejagnu shlib \
--	gss-threads misc threads
-+	gss-threads misc threads softpkcs11
- 
- RUN_DB_TEST = $(RUN_SETUP) KRB5_KDC_PROFILE=kdc.conf KRB5_CONFIG=krb5.conf \
- 	LC_ALL=C $(VALGRIND)
-diff --git a/src/tests/softpkcs11/Makefile.in b/src/tests/softpkcs11/Makefile.in
-new file mode 100644
-index 000000000..e89678154
---- /dev/null
-+++ b/src/tests/softpkcs11/Makefile.in
-@@ -0,0 +1,21 @@
-+mydir=tests$(S)softpkcs11
-+BUILDTOP=$(REL)..$(S)..
-+
-+LOCALINCLUDES = -I$(top_srcdir)/plugins/preauth/pkinit
-+
-+LIBBASE=softpkcs11
-+LIBMAJOR=0
-+LIBMINOR=0
-+
-+SHLIB_EXPLIBS=$(SUPPORT_LIB) -lcrypto
-+SHLIB_EXPDEPS=$(SUPPORT_DEPLIB)
-+
-+STLIBOBJS=main.o
-+
-+SRCS=$(srcdir)/main.c
-+
-+all-unix: all-libs
-+clean-unix:: clean-libs clean-libobjs
-+
-+@libnover_frag@
-+@libobj_frag@
-diff --git a/src/tests/softpkcs11/deps b/src/tests/softpkcs11/deps
-new file mode 100644
-index 000000000..1e82d9572
---- /dev/null
-+++ b/src/tests/softpkcs11/deps
-@@ -0,0 +1,6 @@
-+#
-+# Generated makefile dependencies follow.
-+#
-+main.so main.po $(OUTPRE)main.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
-+  $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-thread.h \
-+  $(top_srcdir)/plugins/preauth/pkinit/pkcs11.h main.c
-diff --git a/src/tests/softpkcs11/main.c b/src/tests/softpkcs11/main.c
-index 2acec5169..5255323d3 100644
---- a/src/tests/softpkcs11/main.c
-+++ b/src/tests/softpkcs11/main.c
-@@ -1,3 +1,4 @@
-+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
- /*
-  * Copyright (c) 2004-2006, Stockholms universitet
-  * (Stockholm University, Stockholm Sweden)
-@@ -31,7 +32,57 @@
-  * POSSIBILITY OF SUCH DAMAGE.
-  */
- 
--#include "locl.h"
-+#include "k5-platform.h"
-+
-+#include <openssl/err.h>
-+#include <openssl/evp.h>
-+#include <openssl/pem.h>
-+#include <openssl/rand.h>
-+#include <openssl/x509.h>
-+
-+#include <ctype.h>
-+#include <pwd.h>
-+
-+#include <pkcs11.h>
-+
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#define EVP_PKEY_get0_RSA(key) ((key)->pkey.rsa)
-+#define RSA_PKCS1_OpenSSL RSA_PKCS1_SSLeay
-+#define RSA_get0_key compat_rsa_get0_key
-+static void
-+compat_rsa_get0_key(const RSA *rsa, const BIGNUM **n, const BIGNUM **e,
-+                    const BIGNUM **d)
-+{
-+    if (n != NULL)
-+        *n = rsa->n;
-+    if (e != NULL)
-+        *e = rsa->e;
-+    if (d != NULL)
-+        *d = rsa->d;
-+}
-+#endif
-+
-+#define OPENSSL_ASN1_MALLOC_ENCODE(T, B, BL, S, R)      \
-+    {                                                   \
-+        unsigned char *p;                               \
-+        (BL) = i2d_##T((S), NULL);                      \
-+        if ((BL) <= 0) {                                \
-+            (R) = EINVAL;                               \
-+        } else {                                        \
-+            (B) = malloc((BL));                         \
-+            if ((B) == NULL) {                          \
-+                (R) = ENOMEM;                           \
-+            } else {                                    \
-+                p = (B);                                \
-+                (R) = 0;                                \
-+                (BL) = i2d_##T((S), &p);                \
-+                if ((BL) <= 0) {                        \
-+                    free((B));                          \
-+                    (R) = EINVAL;                       \
-+                }                                       \
-+            }                                           \
-+        }                                               \
-+    }
- 
- /* RCSID("$Id: main.c,v 1.24 2006/01/11 12:42:53 lha Exp $"); */
- 
-@@ -124,7 +175,7 @@ st_logf(const char *fmt, ...)
- }
- 
- static void
--snprintf_fill(char *str, size_t size, char fillchar, const char *fmt, ...)
-+snprintf_fill(char *str, int size, char fillchar, const char *fmt, ...)
- {
-     int len;
-     va_list ap;
-@@ -141,19 +192,19 @@ snprintf_fill(char *str, size_t size, char fillchar, const char *fmt, ...)
- #endif
- 
- #define VERIFY_SESSION_HANDLE(s, state)                 \
--{                                                       \
--    CK_RV ret;                                          \
--    ret = verify_session_handle(s, state);              \
--    if (ret != CKR_OK) {                                \
--        /* return CKR_OK */;                            \
--    }                                                   \
--}
-+    {                                                   \
-+        CK_RV vshret;                                   \
-+        vshret = verify_session_handle(s, state);       \
-+        if (vshret != CKR_OK) {                         \
-+            /* return CKR_OK */;                        \
-+        }                                               \
-+    }
- 
- static CK_RV
- verify_session_handle(CK_SESSION_HANDLE hSession,
-                       struct session_state **state)
- {
--    int i;
-+    size_t i;
- 
-     for (i = 0; i < MAX_NUM_SESSION; i++){
-         if (soft_token.state[i].session_handle == hSession)
-@@ -361,16 +412,20 @@ add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key)
-         CK_ULONG modulus_bits = 0;
-         CK_BYTE *exponent = NULL;
-         size_t exponent_len = 0;
-+        RSA *rsa;
-+        const BIGNUM *n, *e;
- 
--        modulus_bits = BN_num_bits(key->pkey.rsa->n);
-+        rsa = EVP_PKEY_get0_RSA(key);
-+        RSA_get0_key(rsa, &n, &e, NULL);
-+        modulus_bits = BN_num_bits(n);
- 
--        modulus_len = BN_num_bytes(key->pkey.rsa->n);
-+        modulus_len = BN_num_bytes(n);
-         modulus = malloc(modulus_len);
--        BN_bn2bin(key->pkey.rsa->n, modulus);
-+        BN_bn2bin(n, modulus);
- 
--        exponent_len = BN_num_bytes(key->pkey.rsa->e);
-+        exponent_len = BN_num_bytes(e);
-         exponent = malloc(exponent_len);
--        BN_bn2bin(key->pkey.rsa->e, exponent);
-+        BN_bn2bin(e, exponent);
- 
-         add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len);
-         add_object_attribute(o, 0, CKA_MODULUS_BITS,
-@@ -378,7 +433,7 @@ add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key)
-         add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT,
-                              exponent, exponent_len);
- 
--        RSA_set_method(key->pkey.rsa, RSA_PKCS1_SSLeay());
-+        RSA_set_method(rsa, RSA_PKCS1_OpenSSL());
- 
-         free(modulus);
-         free(exponent);
-@@ -474,7 +529,7 @@ add_certificate(char *label,
-     o->u.cert = cert;
-     public_key = X509_get_pubkey(o->u.cert);
- 
--    switch (EVP_PKEY_type(public_key->type)) {
-+    switch (EVP_PKEY_base_id(public_key)) {
-     case EVP_PKEY_RSA:
-         key_type = CKK_RSA;
-         break;
-@@ -604,8 +659,8 @@ add_certificate(char *label,
-             /* XXX verify keytype */
- 
-             if (key_type == CKK_RSA)
--                RSA_set_method(o->u.private_key.key->pkey.rsa,
--                               RSA_PKCS1_SSLeay());
-+                RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key),
-+                               RSA_PKCS1_OpenSSL());
- 
-             if (X509_check_private_key(cert, o->u.private_key.key) != 1) {
-                 EVP_PKEY_free(o->u.private_key.key);
-@@ -755,8 +810,9 @@ CK_RV
- C_Initialize(CK_VOID_PTR a)
- {
-     CK_C_INITIALIZE_ARGS_PTR args = a;
-+    size_t i;
-+
-     st_logf("Initialize\n");
--    int i;
- 
-     OpenSSL_add_all_algorithms();
-     ERR_load_crypto_strings();
-@@ -825,7 +881,7 @@ C_Initialize(CK_VOID_PTR a)
- CK_RV
- C_Finalize(CK_VOID_PTR args)
- {
--    int i;
-+    size_t i;
- 
-     st_logf("Finalize\n");
- 
-@@ -1008,7 +1064,7 @@ C_OpenSession(CK_SLOT_ID slotID,
-               CK_NOTIFY Notify,
-               CK_SESSION_HANDLE_PTR phSession)
- {
--    int i;
-+    size_t i;
- 
-     st_logf("OpenSession: slot: %d\n", (int)slotID);
- 
-@@ -1050,7 +1106,7 @@ C_CloseSession(CK_SESSION_HANDLE hSession)
- CK_RV
- C_CloseAllSessions(CK_SLOT_ID slotID)
- {
--    int i;
-+    size_t i;
- 
-     st_logf("CloseAllSessions\n");
- 
-@@ -1127,7 +1183,8 @@ C_Login(CK_SESSION_HANDLE hSession,
-         }
- 
-         /* XXX check keytype */
--        RSA_set_method(o->u.private_key.key->pkey.rsa, RSA_PKCS1_SSLeay());
-+        RSA_set_method(EVP_PKEY_get0_RSA(o->u.private_key.key),
-+                       RSA_PKCS1_OpenSSL());
- 
-         if (X509_check_private_key(o->u.private_key.cert, o->u.private_key.key) != 1) {
-             EVP_PKEY_free(o->u.private_key.key);
-@@ -1226,7 +1283,6 @@ C_FindObjectsInit(CK_SESSION_HANDLE hSession,
-     }
-     if (ulCount) {
-         CK_ULONG i;
--        size_t len;
- 
-         print_attributes(pTemplate, ulCount);
- 
-@@ -1415,7 +1471,7 @@ C_Encrypt(CK_SESSION_HANDLE hSession,
-         return CKR_ARGUMENTS_BAD;
-     }
- 
--    rsa = o->u.public_key->pkey.rsa;
-+    rsa = EVP_PKEY_get0_RSA(o->u.public_key);
- 
-     if (rsa == NULL)
-         return CKR_ARGUMENTS_BAD;
-@@ -1445,7 +1501,7 @@ C_Encrypt(CK_SESSION_HANDLE hSession,
-         goto out;
-     }
- 
--    if (buffer_len + padding_len < ulDataLen) {
-+    if ((CK_ULONG)buffer_len + padding_len < ulDataLen) {
-         ret = CKR_ARGUMENTS_BAD;
-         goto out;
-     }
-@@ -1566,7 +1622,7 @@ C_Decrypt(CK_SESSION_HANDLE hSession,
-         return CKR_ARGUMENTS_BAD;
-     }
- 
--    rsa = o->u.private_key.key->pkey.rsa;
-+    rsa = EVP_PKEY_get0_RSA(o->u.private_key.key);
- 
-     if (rsa == NULL)
-         return CKR_ARGUMENTS_BAD;
-@@ -1596,7 +1652,7 @@ C_Decrypt(CK_SESSION_HANDLE hSession,
-         goto out;
-     }
- 
--    if (buffer_len + padding_len < ulEncryptedDataLen) {
-+    if ((CK_ULONG)buffer_len + padding_len < ulEncryptedDataLen) {
-         ret = CKR_ARGUMENTS_BAD;
-         goto out;
-     }
-@@ -1725,7 +1781,7 @@ C_Sign(CK_SESSION_HANDLE hSession,
-         return CKR_ARGUMENTS_BAD;
-     }
- 
--    rsa = o->u.private_key.key->pkey.rsa;
-+    rsa = EVP_PKEY_get0_RSA(o->u.private_key.key);
- 
-     if (rsa == NULL)
-         return CKR_ARGUMENTS_BAD;
-@@ -1754,7 +1810,7 @@ C_Sign(CK_SESSION_HANDLE hSession,
-         goto out;
-     }
- 
--    if (buffer_len < ulDataLen + padding_len) {
-+    if ((CK_ULONG)buffer_len < ulDataLen + padding_len) {
-         ret = CKR_ARGUMENTS_BAD;
-         goto out;
-     }
-@@ -1872,7 +1928,7 @@ C_Verify(CK_SESSION_HANDLE hSession,
-         return CKR_ARGUMENTS_BAD;
-     }
- 
--    rsa = o->u.public_key->pkey.rsa;
-+    rsa = EVP_PKEY_get0_RSA(o->u.public_key);
- 
-     if (rsa == NULL)
-         return CKR_ARGUMENTS_BAD;
-@@ -1900,7 +1956,7 @@ C_Verify(CK_SESSION_HANDLE hSession,
-         goto out;
-     }
- 
--    if (buffer_len < ulDataLen) {
-+    if ((CK_ULONG)buffer_len < ulDataLen) {
-         ret = CKR_ARGUMENTS_BAD;
-         goto out;
-     }
-@@ -1926,7 +1982,7 @@ C_Verify(CK_SESSION_HANDLE hSession,
-     if (len > buffer_len)
-         abort();
- 
--    if (len != ulSignatureLen) {
-+    if ((CK_ULONG)len != ulSignatureLen) {
-         ret = CKR_GENERAL_ERROR;
-         goto out;
-     }
-diff --git a/src/tests/softpkcs11/softpkcs11.exports b/src/tests/softpkcs11/softpkcs11.exports
-new file mode 100644
-index 000000000..aa7284511
---- /dev/null
-+++ b/src/tests/softpkcs11/softpkcs11.exports
-@@ -0,0 +1,39 @@
-+C_CloseAllSessions
-+C_CloseSession
-+C_Decrypt
-+C_DecryptFinal
-+C_DecryptInit
-+C_DecryptUpdate
-+C_DigestInit
-+C_Encrypt
-+C_EncryptFinal
-+C_EncryptInit
-+C_EncryptUpdate
-+C_Finalize
-+C_FindObjects
-+C_FindObjectsFinal
-+C_FindObjectsInit
-+C_GenerateRandom
-+C_GetAttributeValue
-+C_GetFunctionList
-+C_GetInfo
-+C_GetMechanismInfo
-+C_GetMechanismList
-+C_GetObjectSize
-+C_GetSessionInfo
-+C_GetSlotInfo
-+C_GetSlotList
-+C_GetTokenInfo
-+C_Initialize
-+C_InitToken
-+C_Login
-+C_Logout
-+C_OpenSession
-+C_Sign
-+C_SignFinal
-+C_SignInit
-+C_SignUpdate
-+C_Verify
-+C_VerifyFinal
-+C_VerifyInit
-+C_VerifyUpdate
-diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
-index 93f0f2632..69daf4987 100755
---- a/src/tests/t_pkinit.py
-+++ b/src/tests/t_pkinit.py
-@@ -4,14 +4,7 @@ from k5test import *
- if not os.path.exists(os.path.join(plugins, 'preauth', 'pkinit.so')):
-     skip_rest('PKINIT tests', 'PKINIT module not built')
- 
--# Check if soft-pkcs11.so is available.
--try:
--    import ctypes
--    lib = ctypes.LibraryLoader(ctypes.CDLL).LoadLibrary('soft-pkcs11.so')
--    del lib
--    have_soft_pkcs11 = True
--except:
--    have_soft_pkcs11 = False
-+soft_pkcs11 = os.path.join(buildtop, 'tests', 'softpkcs11', 'softpkcs11.so')
- 
- # Construct a krb5.conf fragment configuring pkinit.
- certs = os.path.join(srctop, 'tests', 'dejagnu', 'pkinit-certs')
-@@ -69,9 +62,9 @@ p12_upn2_identity = 'PKCS12:%s' % user_upn2_p12
- p12_upn3_identity = 'PKCS12:%s' % user_upn3_p12
- p12_generic_identity = 'PKCS12:%s' % generic_p12
- p12_enc_identity = 'PKCS12:%s' % user_enc_p12
--p11_identity = 'PKCS11:soft-pkcs11.so'
--p11_token_identity = ('PKCS11:module_name=soft-pkcs11.so:'
--                      'slotid=1:token=SoftToken (token)')
-+p11_identity = 'PKCS11:' + soft_pkcs11
-+p11_token_identity = ('PKCS11:module_name=' + soft_pkcs11 +
-+                      ':slotid=1:token=SoftToken (token)')
- 
- # Start a realm with the test kdb module for the following UPN SAN tests.
- realm = K5Realm(krb5_conf=pkinit_krb5_conf, kdc_conf=alias_kdc_conf,
-@@ -398,9 +391,6 @@ realm.klist(realm.user_princ)
- realm.kinit(realm.user_princ, flags=['-X', 'X509_user_identity=,'],
-             expected_code=1, expected_msg='Preauthentication failed while')
- 
--if not have_soft_pkcs11:
--    skip_rest('PKINIT PKCS11 tests', 'soft-pkcs11.so not found')
--
- softpkcs11rc = os.path.join(os.getcwd(), 'testdir', 'soft-pkcs11.rc')
- realm.env['SOFTPKCS11RC'] = softpkcs11rc
- 
diff --git a/Use-secure_getenv-where-appropriate.patch b/Use-secure_getenv-where-appropriate.patch
deleted file mode 100644
index 4775663..0000000
--- a/Use-secure_getenv-where-appropriate.patch
+++ /dev/null
@@ -1,240 +0,0 @@
-From 13cc24f4e631ee54176430eac73be14bcd9052d3 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Wed, 24 Apr 2019 16:19:50 -0400
-Subject: [PATCH] Use secure_getenv() where appropriate
-
-ticket: 8800
-(cherry picked from commit d439e370b70f7af4ed2da9c692a3be7dcf7b4ac6)
----
- src/lib/kadm5/alt_prof.c                     |  2 +-
- src/lib/krb5/ccache/ccselect_k5identity.c    |  2 +-
- src/lib/krb5/os/ccdefname.c                  |  2 +-
- src/lib/krb5/os/expand_path.c                |  2 +-
- src/lib/krb5/os/init_os_ctx.c                |  6 +++---
- src/lib/krb5/os/ktdefname.c                  |  4 ++--
- src/lib/krb5/os/trace.c                      |  2 +-
- src/lib/krb5/rcache/rc_base.c                |  4 ++--
- src/lib/krb5/rcache/rc_io.c                  |  4 ++--
- src/plugins/preauth/pkinit/pkinit_identity.c | 11 +++--------
- src/plugins/tls/k5tls/openssl.c              |  2 +-
- src/util/profile/prof_file.c                 |  2 +-
- 12 files changed, 19 insertions(+), 24 deletions(-)
-
-diff --git a/src/lib/kadm5/alt_prof.c b/src/lib/kadm5/alt_prof.c
-index 3f6b53651..5531a10fb 100644
---- a/src/lib/kadm5/alt_prof.c
-+++ b/src/lib/kadm5/alt_prof.c
-@@ -73,7 +73,7 @@ krb5_aprof_init(char *fname, char *envname, krb5_pointer *acontextp)
-     ret = krb5_get_default_config_files(&filenames);
-     if (ret)
-         return ret;
--    if (envname == NULL || (kdc_config = getenv(envname)) == NULL)
-+    if (envname == NULL || (kdc_config = secure_getenv(envname)) == NULL)
-         kdc_config = fname;
-     k5_buf_init_dynamic(&buf);
-     if (kdc_config)
-diff --git a/src/lib/krb5/ccache/ccselect_k5identity.c b/src/lib/krb5/ccache/ccselect_k5identity.c
-index bee541658..b2dbf8a09 100644
---- a/src/lib/krb5/ccache/ccselect_k5identity.c
-+++ b/src/lib/krb5/ccache/ccselect_k5identity.c
-@@ -135,7 +135,7 @@ get_homedir(krb5_context context)
-     struct passwd pwx, *pwd;
- 
-     if (!context->profile_secure)
--        homedir = getenv("HOME");
-+        homedir = secure_getenv("HOME");
- 
-     if (homedir == NULL) {
-         if (k5_getpwuid_r(geteuid(), &pwx, pwbuf, sizeof(pwbuf), &pwd) != 0)
-diff --git a/src/lib/krb5/os/ccdefname.c b/src/lib/krb5/os/ccdefname.c
-index e5cb3e44c..233173d35 100644
---- a/src/lib/krb5/os/ccdefname.c
-+++ b/src/lib/krb5/os/ccdefname.c
-@@ -300,7 +300,7 @@ krb5_cc_default_name(krb5_context context)
-         return os_ctx->default_ccname;
- 
-     /* Try the environment variable first. */
--    envstr = getenv(KRB5_ENV_CCNAME);
-+    envstr = secure_getenv(KRB5_ENV_CCNAME);
-     if (envstr != NULL) {
-         os_ctx->default_ccname = strdup(envstr);
-         return os_ctx->default_ccname;
-diff --git a/src/lib/krb5/os/expand_path.c b/src/lib/krb5/os/expand_path.c
-index 61fb23459..4ce466c19 100644
---- a/src/lib/krb5/os/expand_path.c
-+++ b/src/lib/krb5/os/expand_path.c
-@@ -280,7 +280,7 @@ expand_temp_folder(krb5_context context, PTYPE param, const char *postfix,
-     const char *p = NULL;
- 
-     if (context == NULL || !context->profile_secure)
--        p = getenv("TMPDIR");
-+        p = secure_getenv("TMPDIR");
-     *ret = strdup((p != NULL) ? p : "/tmp");
-     if (*ret == NULL)
-         return ENOMEM;
-diff --git a/src/lib/krb5/os/init_os_ctx.c b/src/lib/krb5/os/init_os_ctx.c
-index 09809b932..3aa86f4ad 100644
---- a/src/lib/krb5/os/init_os_ctx.c
-+++ b/src/lib/krb5/os/init_os_ctx.c
-@@ -243,7 +243,7 @@ os_get_default_config_files(profile_filespec_t **pfiles, krb5_boolean secure)
-     char *name = 0;
- 
-     if (!secure) {
--        char *env = getenv("KRB5_CONFIG");
-+        char *env = secure_getenv("KRB5_CONFIG");
-         if (env) {
-             name = strdup(env);
-             if (!name) return ENOMEM;
-@@ -298,7 +298,7 @@ os_get_default_config_files(profile_filespec_t **pfiles, krb5_boolean secure)
-     if (secure) {
-         filepath = DEFAULT_SECURE_PROFILE_PATH;
-     } else {
--        filepath = getenv("KRB5_CONFIG");
-+        filepath = secure_getenv("KRB5_CONFIG");
-         if (!filepath) filepath = DEFAULT_PROFILE_PATH;
-     }
- 
-@@ -344,7 +344,7 @@ add_kdc_config_file(profile_filespec_t **pfiles)
-     size_t count = 0;
-     profile_filespec_t *newfiles;
- 
--    file = getenv(KDC_PROFILE_ENV);
-+    file = secure_getenv(KDC_PROFILE_ENV);
-     if (file == NULL)
-         file = DEFAULT_KDC_PROFILE;
- 
-diff --git a/src/lib/krb5/os/ktdefname.c b/src/lib/krb5/os/ktdefname.c
-index ffbd14d51..fbe4e98b4 100644
---- a/src/lib/krb5/os/ktdefname.c
-+++ b/src/lib/krb5/os/ktdefname.c
-@@ -42,7 +42,7 @@ kt_default_name(krb5_context context, char **name_out)
-         *name_out = strdup(krb5_overridekeyname);
-         return (*name_out == NULL) ? ENOMEM : 0;
-     } else if (context->profile_secure == FALSE &&
--               (str = getenv("KRB5_KTNAME")) != NULL) {
-+               (str = secure_getenv("KRB5_KTNAME")) != NULL) {
-         *name_out = strdup(str);
-         return (*name_out == NULL) ? ENOMEM : 0;
-     } else if (profile_get_string(context->profile, KRB5_CONF_LIBDEFAULTS,
-@@ -63,7 +63,7 @@ k5_kt_client_default_name(krb5_context context, char **name_out)
-     char *str;
- 
-     if (context->profile_secure == FALSE &&
--        (str = getenv("KRB5_CLIENT_KTNAME")) != NULL) {
-+        (str = secure_getenv("KRB5_CLIENT_KTNAME")) != NULL) {
-         *name_out = strdup(str);
-         return (*name_out == NULL) ? ENOMEM : 0;
-     } else if (profile_get_string(context->profile, KRB5_CONF_LIBDEFAULTS,
-diff --git a/src/lib/krb5/os/trace.c b/src/lib/krb5/os/trace.c
-index 40a9e7b10..85dbfeb47 100644
---- a/src/lib/krb5/os/trace.c
-+++ b/src/lib/krb5/os/trace.c
-@@ -389,7 +389,7 @@ k5_init_trace(krb5_context context)
- {
-     const char *filename;
- 
--    filename = getenv("KRB5_TRACE");
-+    filename = secure_getenv("KRB5_TRACE");
-     if (filename)
-         (void) krb5_set_trace_filename(context, filename);
- }
-diff --git a/src/lib/krb5/rcache/rc_base.c b/src/lib/krb5/rcache/rc_base.c
-index 373ac3046..9fa46432d 100644
---- a/src/lib/krb5/rcache/rc_base.c
-+++ b/src/lib/krb5/rcache/rc_base.c
-@@ -107,7 +107,7 @@ char *
- krb5_rc_default_type(krb5_context context)
- {
-     char *s;
--    if ((s = getenv("KRB5RCACHETYPE")))
-+    if ((s = secure_getenv("KRB5RCACHETYPE")))
-         return s;
-     else
-         return "dfl";
-@@ -117,7 +117,7 @@ char *
- krb5_rc_default_name(krb5_context context)
- {
-     char *s;
--    if ((s = getenv("KRB5RCACHENAME")))
-+    if ((s = secure_getenv("KRB5RCACHENAME")))
-         return s;
-     else
-         return (char *) 0;
-diff --git a/src/lib/krb5/rcache/rc_io.c b/src/lib/krb5/rcache/rc_io.c
-index 35fa14a1f..1800460b2 100644
---- a/src/lib/krb5/rcache/rc_io.c
-+++ b/src/lib/krb5/rcache/rc_io.c
-@@ -48,13 +48,13 @@ getdir(void)
- {
-     char *dir;
- 
--    if (!(dir = getenv("KRB5RCACHEDIR"))) {
-+    if (!(dir = secure_getenv("KRB5RCACHEDIR"))) {
- #if defined(_WIN32)
-         if (!(dir = getenv("TEMP")))
-             if (!(dir = getenv("TMP")))
-                 dir = "C:";
- #else
--        if (!(dir = getenv("TMPDIR"))) {
-+        if (!(dir = secure_getenv("TMPDIR"))) {
- #ifdef RCTMPDIR
-             dir = RCTMPDIR;
- #else
-diff --git a/src/plugins/preauth/pkinit/pkinit_identity.c b/src/plugins/preauth/pkinit/pkinit_identity.c
-index 8cd3fc640..b89c5d015 100644
---- a/src/plugins/preauth/pkinit/pkinit_identity.c
-+++ b/src/plugins/preauth/pkinit/pkinit_identity.c
-@@ -29,16 +29,10 @@
-  * SUCH DAMAGES.
-  */
- 
--#include <errno.h>
--#include <string.h>
--#include <stdio.h>
--#include <stdlib.h>
-+#include "pkinit.h"
- #include <dlfcn.h>
--#include <unistd.h>
- #include <dirent.h>
- 
--#include "pkinit.h"
--
- static void
- free_list(char **list)
- {
-@@ -430,7 +424,8 @@ process_option_identity(krb5_context context,
-     switch (idtype) {
-     case IDTYPE_ENVVAR:
-         return process_option_identity(context, plg_cryptoctx, req_cryptoctx,
--                                       idopts, id_cryptoctx, getenv(residual));
-+                                       idopts, id_cryptoctx,
-+                                       secure_getenv(residual));
-         break;
-     case IDTYPE_FILE:
-         retval = parse_fs_options(context, idopts, residual);
-diff --git a/src/plugins/tls/k5tls/openssl.c b/src/plugins/tls/k5tls/openssl.c
-index 822632c90..76a43b3cd 100644
---- a/src/plugins/tls/k5tls/openssl.c
-+++ b/src/plugins/tls/k5tls/openssl.c
-@@ -399,7 +399,7 @@ load_anchor(SSL_CTX *ctx, const char *location)
-     } else if (strncmp(location, "DIR:", 4) == 0) {
-         return load_anchor_dir(store, location + 4);
-     } else if (strncmp(location, "ENV:", 4) == 0) {
--        envloc = getenv(location + 4);
-+        envloc = secure_getenv(location + 4);
-         if (envloc == NULL)
-             return ENOENT;
-         return load_anchor(ctx, envloc);
-diff --git a/src/util/profile/prof_file.c b/src/util/profile/prof_file.c
-index 0dcb6b543..79f9500f6 100644
---- a/src/util/profile/prof_file.c
-+++ b/src/util/profile/prof_file.c
-@@ -183,7 +183,7 @@ errcode_t profile_open_file(const_profile_filespec_t filespec,
-     prf->magic = PROF_MAGIC_FILE;
- 
-     if (filespec[0] == '~' && filespec[1] == '/') {
--        home_env = getenv("HOME");
-+        home_env = secure_getenv("HOME");
- #ifdef HAVE_PWD_H
-         if (home_env == NULL) {
-             uid_t uid;
diff --git a/ci.fmf b/ci.fmf
new file mode 100644
index 0000000..c5aa0e0
--- /dev/null
+++ b/ci.fmf
@@ -0,0 +1 @@
+resultsdb-testcase: separate
diff --git a/gating.yaml b/gating.yaml
new file mode 100644
index 0000000..af37a4c
--- /dev/null
+++ b/gating.yaml
@@ -0,0 +1,8 @@
+--- !Policy
+product_versions:
+- fedora-*
+decision_contexts:
+- bodhi_update_push_stable
+subject_type: koji_build
+rules:
+- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tests.functional}
diff --git a/kadmin.service b/kadmin.service
index f1677c6..daa08b1 100644
--- a/kadmin.service
+++ b/kadmin.service
@@ -6,9 +6,9 @@ AssertPathExists=!/var/kerberos/krb5kdc/kpropd.acl
 
 [Service]
 Type=forking
-PIDFile=/var/run/kadmind.pid
+PIDFile=/run/kadmind.pid
 EnvironmentFile=-/etc/sysconfig/kadmin
-ExecStart=/usr/sbin/kadmind -P /var/run/kadmind.pid $KADMIND_ARGS
+ExecStart=/usr/sbin/kadmind -P /run/kadmind.pid $KADMIND_ARGS
 ExecReload=/bin/kill -HUP $MAINPID
 
 [Install]
diff --git a/kadmind.logrotate b/kadmind.logrotate
index 52a66c4..f00aa4d 100644
--- a/kadmind.logrotate
+++ b/kadmind.logrotate
@@ -4,6 +4,6 @@
     monthly
     rotate 12
     postrotate
-	/bin/kill -HUP `cat /var/run/kadmind.pid 2>/dev/null` 2> /dev/null || true
+        systemctl reload kadmin.service || true
     endscript
 }
diff --git a/kdc.conf b/kdc.conf
index f21c761..7b788e5 100644
--- a/kdc.conf
+++ b/kdc.conf
@@ -1,3 +1,7 @@
+[libdefaults]
+# Allow RC4 HMAC-MD5 for session keys (see CVE-2022-37966)
+#allow_rc4 = true
+
 [kdcdefaults]
     kdc_ports = 88
     kdc_tcp_ports = 88
@@ -5,9 +9,12 @@
 
 [realms]
 EXAMPLE.COM = {
-     #master_key_type = aes256-cts
+     master_key_type = aes256-cts-hmac-sha384-192
      acl_file = /var/kerberos/krb5kdc/kadm5.acl
      dict_file = /usr/share/dict/words
+     default_principal_flags = +preauth
      admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
-     supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal
+     supported_enctypes = aes256-cts-hmac-sha384-192:normal aes128-cts-hmac-sha256-128:normal aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal camellia256-cts-cmac:normal camellia128-cts-cmac:normal arcfour-hmac-md5:normal
+     # Supported encryption types for FIPS mode:
+     #supported_enctypes = aes256-cts-hmac-sha384-192:normal aes128-cts-hmac-sha256-128:normal
 }
diff --git a/krb5-1.11-kpasswdtest.patch b/krb5-1.11-kpasswdtest.patch
deleted file mode 100644
index 5e29cad..0000000
--- a/krb5-1.11-kpasswdtest.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From 37c9242bf19d63c6f35086a931b9a072d5b71caf Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:52:01 -0400
-Subject: [PATCH] krb5-1.11-kpasswdtest.patch
-
----
- src/kadmin/testing/proto/krb5.conf.proto | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/kadmin/testing/proto/krb5.conf.proto b/src/kadmin/testing/proto/krb5.conf.proto
-index 00c442978..9c4bc1de7 100644
---- a/src/kadmin/testing/proto/krb5.conf.proto
-+++ b/src/kadmin/testing/proto/krb5.conf.proto
-@@ -9,6 +9,7 @@
- 	__REALM__ = {
- 		kdc = __KDCHOST__:1750
- 		admin_server = __KDCHOST__:1751
-+		kpasswd_server = __KDCHOST__:1752
- 		database_module = foobar_db2_module_blah
- 	}
- 
diff --git a/krb5-1.11-run_user_0.patch b/krb5-1.11-run_user_0.patch
deleted file mode 100644
index 5b9ef9b..0000000
--- a/krb5-1.11-run_user_0.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 76a67da3510e761eb01822a6db551fa3092189a3 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:49:57 -0400
-Subject: [PATCH] krb5-1.11-run_user_0.patch
-
-A hack: if we're looking at creating a ccache directory directly below
-the /run/user/0 directory, and /run/user/0 doesn't exist, try to create
-it, too.
----
- src/lib/krb5/ccache/cc_dir.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/src/lib/krb5/ccache/cc_dir.c b/src/lib/krb5/ccache/cc_dir.c
-index 73f0fe62d..4850c0d07 100644
---- a/src/lib/krb5/ccache/cc_dir.c
-+++ b/src/lib/krb5/ccache/cc_dir.c
-@@ -61,6 +61,8 @@
- 
- #include <dirent.h>
- 
-+#define ROOT_SPECIAL_DCC_PARENT "/run/user/0"
-+
- extern const krb5_cc_ops krb5_dcc_ops;
- extern const krb5_cc_ops krb5_fcc_ops;
- 
-@@ -237,6 +239,18 @@ verify_dir(krb5_context context, const char *dirname)
- 
-     if (stat(dirname, &st) < 0) {
-         if (errno == ENOENT) {
-+            if (strncmp(dirname, ROOT_SPECIAL_DCC_PARENT "/",
-+                        sizeof(ROOT_SPECIAL_DCC_PARENT)) == 0 &&
-+                stat(ROOT_SPECIAL_DCC_PARENT, &st) < 0 &&
-+                errno == ENOENT) {
-+#ifdef USE_SELINUX
-+                selabel = krb5int_push_fscreatecon_for(ROOT_SPECIAL_DCC_PARENT);
-+#endif
-+                status = mkdir(ROOT_SPECIAL_DCC_PARENT, S_IRWXU);
-+#ifdef USE_SELINUX
-+                krb5int_pop_fscreatecon(selabel);
-+#endif
-+            }
- #ifdef USE_SELINUX
-             selabel = krb5int_push_fscreatecon_for(dirname);
- #endif
diff --git a/krb5-1.15-beta1-buildconf.patch b/krb5-1.15-beta1-buildconf.patch
deleted file mode 100644
index ec96987..0000000
--- a/krb5-1.15-beta1-buildconf.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From b7ba0fa6a2f8324c58b57dedde33c1ae5d1ddb41 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:45:26 -0400
-Subject: [PATCH] krb5-1.15-beta1-buildconf.patch
-
-Build binaries in this package as RELRO PIEs, libraries as partial RELRO,
-and install shared libraries with the execute bit set on them.  Prune out
-the -L/usr/lib* and PIE flags where they might leak out and affect
-apps which just want to link with the libraries. FIXME: needs to check and
-not just assume that the compiler supports using these flags.
----
- src/build-tools/krb5-config.in | 7 +++++++
- src/config/pre.in              | 2 +-
- src/config/shlib.conf          | 5 +++--
- 3 files changed, 11 insertions(+), 3 deletions(-)
-
-diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
-index c17cb5eb5..1891dea99 100755
---- a/src/build-tools/krb5-config.in
-+++ b/src/build-tools/krb5-config.in
-@@ -226,6 +226,13 @@ if test -n "$do_libs"; then
- 	    -e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \
- 	    -e 's#\$(CFLAGS)##'`
- 
-+    if test `dirname $libdir` = /usr ; then
-+        lib_flags=`echo $lib_flags | sed -e "s#-L$libdir##" -e "s#$RPATH_FLAG$libdir##"`
-+    fi
-+    lib_flags=`echo $lib_flags | sed -e "s#-fPIE##g" -e "s#-pie##g"`
-+    lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,relro##g"`
-+    lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,now##g"`
-+
-     if test $library = 'kdb'; then
- 	lib_flags="$lib_flags -lkdb5 $KDB5_DB_LIB"
- 	library=krb5
-diff --git a/src/config/pre.in b/src/config/pre.in
-index 917357df9..a8540ae2a 100644
---- a/src/config/pre.in
-+++ b/src/config/pre.in
-@@ -185,7 +185,7 @@ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP)
- INSTALL_SCRIPT=@INSTALL_PROGRAM@
- INSTALL_DATA=@INSTALL_DATA@
- INSTALL_SHLIB=@INSTALL_SHLIB@
--INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
-+INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755
- ## This is needed because autoconf will sometimes define @exec_prefix@ to be
- ## ${prefix}.
- prefix=@prefix@
-diff --git a/src/config/shlib.conf b/src/config/shlib.conf
-index 3e4af6c02..2b20c3fda 100644
---- a/src/config/shlib.conf
-+++ b/src/config/shlib.conf
-@@ -423,7 +423,7 @@ mips-*-netbsd*)
- 	# Linux ld doesn't default to stuffing the SONAME field...
- 	# Use objdump -x to examine the fields of the library
- 	# UNDEF_CHECK is suppressed by --enable-asan
--	LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK)'
-+	LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK)  -Wl,-z,relro -Wl,--warn-shared-textrel'
- 	UNDEF_CHECK='-Wl,--no-undefined'
- 	# $(EXPORT_CHECK) runs export-check.pl when in maintainer mode.
- 	LDCOMBINE_TAIL='-Wl,--version-script binutils.versions $(EXPORT_CHECK)'
-@@ -435,7 +435,8 @@ mips-*-netbsd*)
- 	SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
- 	PROFFLAGS=-pg
- 	PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)'
--	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)'
-+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) -pie -Wl,-z,relro -Wl,-z,now $(LDFLAGS)'
-+	INSTALL_SHLIB='${INSTALL} -m755'
- 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)'
- 	CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)'
- 	CXX_LINK_STATIC='$(CXX) $(PROG_LIBPATH) $(CXXFLAGS) $(LDFLAGS)'
diff --git a/krb5-1.3.1-dns.patch b/krb5-1.3.1-dns.patch
deleted file mode 100644
index 1cbb6f8..0000000
--- a/krb5-1.3.1-dns.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From 2cf42007974a9c72e8e6a6cc02295e9c2a89317e Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:46:21 -0400
-Subject: [PATCH] krb5-1.3.1-dns.patch
-
-We want to be able to use --with-netlib and --enable-dns at the same time.
----
- src/aclocal.m4 | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index a7afec09e..db18226ed 100644
---- a/src/aclocal.m4
-+++ b/src/aclocal.m4
-@@ -726,6 +726,7 @@ AC_HELP_STRING([--with-netlib=LIBS], use user defined resolver library),
- 	LIBS="$LIBS $withval"
- 	AC_MSG_RESULT("netlib will use \'$withval\'")
-   fi
-+  KRB5_AC_ENABLE_DNS
- ],dnl
- [AC_LIBRARY_NET]
- )])dnl
diff --git a/krb5-krb5kdc.conf b/krb5-krb5kdc.conf
index eadeb51..5160b28 100644
--- a/krb5-krb5kdc.conf
+++ b/krb5-krb5kdc.conf
@@ -1 +1 @@
-d /var/run/krb5kdc 0755 root root
+d /run/krb5kdc 0755 root root
diff --git a/krb5-tests b/krb5-tests
new file mode 100644
index 0000000..6754f3f
--- /dev/null
+++ b/krb5-tests
@@ -0,0 +1,18 @@
+#!/bin/sh
+set -e
+
+export RPM_PACKAGE_NAME={{ name }}
+export RPM_PACKAGE_VERSION={{ version }}
+export RPM_PACKAGE_RELEASE={{ release }}
+export RPM_ARCH={{ arch }}
+export RPM_BUILD_NCPUS="$(getconf _NPROCESSORS_ONLN)"
+
+testdir="$(mktemp -d)"
+trap "rm -rf ${testdir}" EXIT
+
+build_flags="$(eval "echo $(rpm --eval '%{_smp_mflags}')")"
+
+mkdir "${testdir}/{{ name }}-tests"
+cp -rp /usr/share/{{ name }}-tests/{{ arch }} "${testdir}/{{ name }}-tests/"
+make -C "${testdir}/{{ name }}-tests/{{ arch }}/" $build_flags
+keyctl session - make -C "${testdir}/{{ name }}-tests/{{ arch }}/" check
diff --git a/krb5.conf b/krb5.conf
index c45f388..5e474d1 100644
--- a/krb5.conf
+++ b/krb5.conf
@@ -15,6 +15,8 @@ includedir /etc/krb5.conf.d/
     rdns = false
     pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
     spake_preauth_groups = edwards25519
+    dns_canonicalize_hostname = fallback
+    qualify_shortname = ""
 #    default_realm = EXAMPLE.COM
 
 [realms]
diff --git a/krb5.rpmlintrc b/krb5.rpmlintrc
index ad8e989..e1d2f0b 100644
--- a/krb5.rpmlintrc
+++ b/krb5.rpmlintrc
@@ -1,5 +1,4 @@
 addFilter(r'spelling-error .* en_US (unencrypted)')
-addFilter(r'Source3: krb5-1.17-pdfs.tar')
 addFilter(r'hidden-file-or-dir /usr/share/man/man5/.k5identity.5.gz')
 addFilter(r'non-standard-dir-in-var kerberos')
 addFilter(r'explicit-lib-dependency libverto-module-base')
@@ -12,3 +11,4 @@ addFilter(r'/usr/bin/ksu')
 addFilter(r'no-documentation')
 addFilter(r'invalid-directory-reference .*pkgconfig')
 addFilter(r'incoherent-logrotate-file /etc/logrotate.d/k')
+addFilter(r'library-not-linked-against-libc')
diff --git a/krb5.spec b/krb5.spec
index 52ba958..4c5b542 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -1,5 +1,3 @@
-%global WITH_DIRSRV 1
-
 # Set this so that find-lang.sh will recognize the .po files.
 %global gettext_domain mit-krb5
 # Guess where the -libs subpackage's docs are going to go.
@@ -8,180 +6,135 @@
 %global configure_default_ccache_name 1
 %global configured_default_ccache_name KEYRING:persistent:%%{uid}
 
-# leave empty or set to e.g., -beta2
-%global prerelease %{nil}
+# Use baserelease to set the release number!
+#
+# baserelease is what we have standardized across Fedora and what
+# rpmdev-bumpspec knows how to handle.
+%global baserelease 11
+
+# This should be e.g. beta1 or %%nil
+%global pre_release %nil
+
+%global krb5_release %{baserelease}
+%if "x%{?pre_release}" != "x"
+%global krb5_release 0.%{baserelease}.%{pre_release}
+%global krb5_pre_release -%{pre_release}
+%endif
+
+%global krb5_version_major 1
+%global krb5_version_minor 21
+# For a release without a patch number set to %%nil
+%global krb5_version_patch 3
+
+%global krb5_version_major_minor %{krb5_version_major}.%{krb5_version_minor}
+%global krb5_version %{krb5_version_major_minor}
+%if "x%{?krb5_version_patch}" != "x"
+%global krb5_version %{krb5_version_major_minor}.%{krb5_version_patch}
+%endif
 
 # Should be in form 5.0, 6.1, etc.
-%global kdbversion 7.0
+%global kdbversion 9.0
 
 Summary: The Kerberos network authentication system
 Name: krb5
-Version: 1.17
-# for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces)
-Release: 45%{?dist}
+Version: %{krb5_version}
+Release: %{krb5_release}%{?dist}
 
-# lookaside-cached sources; two downloads and a build artifact
-Source0: https://web.mit.edu/kerberos/dist/krb5/1.17/krb5-%{version}%{prerelease}.tar.gz
 # rharwood has trust path to signing key and verifies on check-in
-Source1: https://web.mit.edu/kerberos/dist/krb5/1.17/krb5-%{version}%{prerelease}.tar.gz.asc
-# This source is generated during the build because sphinx doesn't
-# give me architecture-deterministic documentation builds.
-# To override this behavior (e.g., new upstream version), do:
-#     tar cfT krb5-1.15.2-pdfs.tar /dev/null
-# or the like.
-Source3: krb5-%{version}%{prerelease}-pdfs.tar
+Source0: https://web.mit.edu/kerberos/dist/krb5/%{krb5_version_major_minor}/krb5-%{krb5_version}%{?krb5_pre_release}.tar.gz
+Source1: https://web.mit.edu/kerberos/dist/krb5/%{krb5_version_major_minor}/krb5-%{krb5_version}%{?krb5_pre_release}.tar.gz.asc
 
-# Numbering is a relic of old init systems etc.  It's easiest to just leave.
 Source2: kprop.service
-Source4: kadmin.service
-Source5: krb5kdc.service
-Source6: krb5.conf
-Source10: kdc.conf
-Source11: kadm5.acl
-Source19: krb5kdc.sysconfig
-Source20: kadmin.sysconfig
-Source21: kprop.sysconfig
-Source29: ksu.pamd
-Source33: krb5kdc.logrotate
-Source34: kadmind.logrotate
-Source39: krb5-krb5kdc.conf
+Source3: kadmin.service
+Source4: krb5kdc.service
+Source5: krb5.conf
+Source6: kdc.conf
+Source7: kadm5.acl
+Source8: krb5kdc.sysconfig
+Source9: kadmin.sysconfig
+Source10: kprop.sysconfig
+Source11: ksu.pamd
+Source12: krb5kdc.logrotate
+Source13: kadmind.logrotate
+Source14: krb5-krb5kdc.conf
+Source15: %{name}-tests
 
-# Carry this locally until it's available in a packaged form.
-Source100: noport.c
+Patch0001: 0001-downstream-Revert-Don-t-issue-session-keys-with-depr.patch
+Patch0002: 0002-downstream-ksu-pam-integration.patch
+Patch0003: 0003-downstream-SELinux-integration.patch
+Patch0004: 0004-downstream-fix-debuginfo-with-y.tab.c.patch
+Patch0005: 0005-downstream-Remove-3des-support.patch
+Patch0006: 0006-downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
+Patch0007: 0007-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch
+Patch0008: 0008-downstream-Make-tests-compatible-with-sssd_krb5_loca.patch
+Patch0009: 0009-downstream-Include-missing-OpenSSL-FIPS-header.patch
+Patch0010: 0010-downstream-Do-not-set-root-as-ksu-file-owner.patch
+Patch0011: 0011-downstream-Allow-KRB5KDF-MD5-and-MD4-in-FIPS-mode.patch
+Patch0012: 0012-downstream-Allow-to-set-PAC-ticket-signature-as-opti.patch
+Patch0013: 0013-downstream-Make-PKINIT-CMS-SHA-1-signature-verificat.patch
+Patch0014: 0014-Enable-PKINIT-if-at-least-one-group-is-available.patch
+Patch0015: 0015-Replace-ssl.wrap_socket-for-tests.patch
+Patch0016: 0016-Eliminate-old-style-function-declarations.patch
+Patch0017: 0017-Fix-two-unlikely-memory-leaks.patch
+Patch0018: 0018-Fix-unimportant-memory-leaks.patch
+Patch0019: 0019-Remove-klist-s-defname-global-variable.patch
+Patch0020: 0020-End-connection-on-KDC_ERR_SVC_UNAVAILABLE.patch
+Patch0021: 0021-Add-request_timeout-configuration-parameter.patch
+Patch0022: 0022-Wait-indefinitely-on-KDC-TCP-connections.patch
+Patch0023: 0023-Remove-PKINIT-RSA-support.patch
+Patch0024: 0024-Fix-various-issues-detected-by-static-analysis.patch
+Patch0025: 0025-Generate-and-verify-message-MACs-in-libkrad.patch
+Patch0026: 0026-PKINIT-ECDH-support.patch
+Patch0027: 0027-Add-ecdsa-with-sha512-256-to-supportedCMSTypes.patch
+Patch0028: 0028-Get-rid-of-pkinit_crypto_openssl.h.patch
+Patch0029: 0029-Use-SoftHSMv2-for-PKCS11-PKINIT-tests.patch
+Patch0030: 0030-Simplify-PKINIT-cert-representation.patch
+Patch0031: 0031-Support-PKCS11-EC-client-certs-in-PKINIT.patch
+Patch0032: 0032-Improve-PKCS11-error-reporting-in-PKINIT.patch
+Patch0033: 0033-Set-missing-mask-flags-for-kdb5_util-operations.patch
+Patch0034: 0034-Prevent-overflow-when-calculating-ulog-block-size.patch
+Patch0035: 0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch
+Patch0036: 0036-downstream-Remove-3des-support-cumulative-1.patch
+Patch0037: 0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch
+Patch0038: 0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch
+Patch0039: 0039-Fix-strchr-conformance-to-C23.patch
+Patch0040: 0040-automated-fast.patch
+Patch0041: 0041-bail-if-prompter-is-not-specified-but-required.patch
 
-Patch26: krb5-1.12.1-pam.patch
-Patch27: krb5-1.17-beta1-selinux-label.patch
-Patch30: krb5-1.15-beta1-buildconf.patch
-Patch31: krb5-1.3.1-dns.patch
-Patch34: krb5-1.9-debuginfo.patch
-Patch35: krb5-1.11-run_user_0.patch
-Patch36: krb5-1.11-kpasswdtest.patch
-Patch90: Add-tests-for-KCM-ccache-type.patch
-Patch92: Address-some-optimized-out-memset-calls.patch
-Patch94: Avoid-allocating-a-register-in-zap-assembly.patch
-Patch95: In-rd_req_dec-always-log-non-permitted-enctypes.patch
-Patch96: In-kpropd-debug-log-proper-ticket-enctype-names.patch
-Patch97: Add-function-and-enctype-flag-for-deprecations.patch
-Patch98: Make-etype-names-in-KDC-logs-human-readable.patch
-Patch99: Mark-deprecated-enctypes-when-used.patch
-Patch100: Properly-size-ifdef-in-k5_cccol_lock.patch
-Patch101: Fix-memory-leak-in-none-replay-cache-type.patch
-Patch104: Clarify-header-comment-for-krb5_cc_start_seq_get.patch
-Patch105: Implement-krb5_cc_remove_cred-for-remaining-types.patch
-Patch106: Remove-srvtab-support.patch
-Patch107: Remove-kadmin-RPC-support-for-setting-v4-key.patch
-Patch108: Remove-ccapi-related-comments-in-configure.ac.patch
-Patch109: Remove-doxygen-generated-HTML-output-for-ccapi.patch
-Patch110: Remove-Kerberos-v4-support-vestiges-from-ccapi.patch
-Patch111: Fix-config-realm-change-logic-in-FILE-remove_cred.patch
-Patch112: Remove-confvalidator-utility.patch
-Patch113: Remove-ovsec_adm_export-dump-format-support.patch
-Patch114: Fix-potential-close-1-in-cc_file.c.patch
-Patch115: Check-more-errors-in-OpenSSL-crypto-backend.patch
-Patch116: Clear-forwardable-flag-instead-of-denying-request.patch
-Patch117: Add-dns_canonicalize_hostname-fallback-support.patch
-Patch118: Use-secure_getenv-where-appropriate.patch
-Patch119: Initialize-some-data-structure-magic-fields.patch
-Patch120: Fix-some-return-code-handling-bugs.patch
-Patch121: Modernize-exit-path-in-gss_krb5int_copy_ccache.patch
-Patch122: Simplify-SAM-2-as_key-handling.patch
-Patch123: Avoid-alignment-warnings-in-openssl-rc4.c.patch
-Patch124: Simply-OpenSSL-PKCS7-decryption-code.patch
-Patch125: Improve-error-messages-from-kadmin-change_password.patch
-Patch126: Remove-more-dead-code.patch
-Patch128: Remove-checksum-type-profile-variables.patch
-Patch129: Remove-dead-variable-def_kslist-from-two-files.patch
-Patch130: Mark-the-doc-kadm5-tex-files-as-historic.patch
-Patch131: Modernize-example-enctypes-in-documentation.patch
-Patch132: Update-ASN.1-SAM-tests-to-use-a-modern-enctype.patch
-Patch133: Update-default-krb5kdc-mkey-manual-entry-enctype.patch
-Patch134: Support-389ds-s-lockout-model.patch
-Patch135: Add-missing-newlines-to-deprecation-warnings.patch
-Patch136: Set-a-more-modern-default-ksu-CMD_PATH.patch
-Patch137: Remove-the-v4-and-afs3-salt-types.patch
-Patch138: Update-test-suite-to-avoid-single-DES-enctypes.patch
-Patch139: Remove-support-for-single-DES-and-CRC.patch
-Patch140: Display-unsupported-enctype-names.patch
-Patch142: Add-zapfreedata-convenience-function.patch
-Patch143: Remove-support-for-no-flags-SAM-2-preauth.patch
-Patch144: Remove-krb5int_c_combine_keys.patch
-Patch147: Remove-strerror-calls-from-k5_get_error.patch
-Patch148: Remove-PKINIT-draft-9-support.patch
-Patch149: Remove-PKINIT-draft-9-ASN.1-code-and-types.patch
-Patch150: Remove-3des-support.patch
-Patch151: Remove-now-unused-checksum-functions.patch
-Patch152: Don-t-error-on-invalid-enctypes-in-keytab.patch
-Patch153: Filter-enctypes-in-gss_set_allowable_enctypes.patch
-Patch154: Add-soft-pkcs11-source-code.patch
-Patch155: Use-imported-soft-pkcs11-for-tests.patch
-Patch156: Fix-Coverity-defects-in-soft-pkcs11-test-code.patch
-Patch157: Skip-URI-tests-when-using-asan.patch
-Patch158: Fix-memory-leaks-in-soft-pkcs11-code.patch
-Patch159: Initialize-life-rlife-in-kdcpolicy-interface.patch
-Patch160: Fix-KCM-client-time-offset-propagation.patch
-Patch161: krb5-1.17post5-FIPS-with-PRNG-and-RADIUS-without-SPA.patch
-Patch162: Simplify-krb5_dbe_def_search_enctype.patch
-Patch163: Squash-apparent-forward-null-in-clnttcp_create.patch
-Patch164: Remove-null-check-in-krb5_gss_duplicate_name.patch
-Patch165: Fix-KDC-crash-when-logging-PKINIT-enctypes.patch
-
-License: MIT
+License: Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision
 URL: https://web.mit.edu/kerberos/www/
-BuildRequires: autoconf, bison, cmake, flex, gawk, gettext, pkgconfig, sed
-BuildRequires: gcc
+BuildRequires: autoconf, bison, make, flex, gawk, gettext, pkgconfig, sed
+BuildRequires: gcc, gcc-c++
 BuildRequires: libcom_err-devel, libedit-devel, libss-devel
 BuildRequires: gzip, ncurses-devel
-BuildRequires: python3-sphinx, texlive-pdftex, latexmk
-
-# For autosetup
-BuildRequires: git
-
-# Originally from \usepackage directives produced by sphinx:
-BuildRequires: tex(babel.sty)
-BuildRequires: tex(bookmark.sty)
-BuildRequires: tex(capt-of.sty)
-BuildRequires: tex(eqparbox.sty)
-BuildRequires: tex(fancybox.sty)
-BuildRequires: tex(fncychap.sty)
-BuildRequires: tex(fontenc.sty)
-BuildRequires: tex(framed.sty)
-BuildRequires: tex(hyperref.sty)
-BuildRequires: tex(ifthen.sty)
-BuildRequires: tex(inputenc.sty)
-BuildRequires: tex(longtable.sty)
-BuildRequires: tex(multirow.sty)
-BuildRequires: tex(needspace.sty)
-BuildRequires: tex(report.cls)
-BuildRequires: tex(tabulary.sty)
-BuildRequires: tex(threeparttable.sty)
-BuildRequires: tex(times.sty)
-BuildRequires: tex(titlesec.sty)
-BuildRequires: tex(upquote.sty)
-BuildRequires: tex(wrapfig.sty)
-
-# Typical fonts, and the commands which we need to have present.
-BuildRequires: texlive, texlive-latex, texlive-texmf-fonts
-BuildRequires: /usr/bin/pdflatex /usr/bin/makeindex
+BuildRequires: python3, python3-sphinx
 BuildRequires: keyutils, keyutils-libs-devel >= 1.5.8
 BuildRequires: libselinux-devel
 BuildRequires: pam-devel
 BuildRequires: systemd-units
-
-# For the test framework.
-BuildRequires: perl-interpreter, dejagnu, tcl-devel, python3
-BuildRequires: net-tools, rpcbind
-BuildRequires: hostname
-BuildRequires: iproute
+BuildRequires: tcl-devel
 BuildRequires: libverto-devel
 BuildRequires: openldap-devel
-BuildRequires: openssl-devel >= 0.9.8
+BuildRequires: lmdb-devel
+BuildRequires: perl-interpreter
 
-%ifarch %{ix86} x86_64
-BuildRequires: yasm
+# For autosetup
+BuildRequires: git
+
+%if 0%{?fedora} > 35 || 0%{?rhel} >= 9
+# Need KDFs.  This is the "real" version
+BuildRequires: openssl-devel >= 1:3.0.0
+%else
+# Need KDFs.  This is the backported version
+BuildRequires: openssl-devel >= 1:1.1.1d-4
+BuildRequires: openssl-devel < 1:3.0.0
 %endif
 
-BuildRequires: nss_wrapper
-BuildRequires: socket_wrapper
+# Enable compilation of optional tests
+BuildRequires: resolv_wrapper
+BuildRequires: libcmocka-devel
+BuildRequires: opensc
+BuildRequires: softhsm
 
 %description
 Kerberos V5 is a trusted-third-party network authentication system,
@@ -207,7 +160,13 @@ to install this package.
 
 %package libs
 Summary: The non-admin shared libraries used by Kerberos 5
-Requires: coreutils, gawk, grep, sed
+%if 0%{?fedora} > 35 || 0%{?rhel} >= 9
+Requires: openssl-libs >= 1:3.0.0
+%else
+Requires: openssl-libs >= 1:1.1.1d-4
+Requires: openssl-libs < 1:3.0.0
+%endif
+Requires: coreutils
 Requires: keyutils-libs >= 1.5.8
 Requires: /etc/crypto-policies/back-ends/krb5.config
 
@@ -219,13 +178,14 @@ Kerberos, you need to install this package.
 %package server
 Summary: The KDC and related programs for Kerberos 5
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Requires: %{name}-pkinit%{?_isa} = %{version}-%{release}
 Requires(post): systemd-units
 Requires(preun): systemd-units
 Requires(postun): systemd-units
 # we drop files in its directory, but we don't want to own that directory
 Requires: logrotate
-# we specify /usr/share/dict/words as the default dict_file in kdc.conf
-Requires: /usr/share/dict/words
+# we specify /usr/share/dict/words (provided by words) as the default dict_file in kdc.conf
+Requires: words
 # for run-time, and for parts of the test suite
 BuildRequires: libverto-module-base
 Requires: libverto-module-base
@@ -255,6 +215,7 @@ realm, you need to install this package.
 %package workstation
 Summary: Kerberos 5 programs for use on workstations
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Requires: %{name}-pkinit%{?_isa} = %{version}-%{release}
 Requires: libkadm5%{?_isa} = %{version}-%{release}
 
 %description workstation
@@ -284,8 +245,57 @@ Kerberos is a network authentication system. The libkadm5 package
 contains only the libkadm5clnt and libkadm5serv shared objects. This
 interface is not considered stable.
 
+%package tests
+Summary: Test sources for krb5 build
+
+# Build dependencies
+Requires: coreutils, gawk, sed
+Requires: gcc-c++
+Requires: gettext
+Requires: libcom_err-devel
+Requires: libselinux-devel
+Requires: libss-devel
+Requires: libverto-devel
+Requires: lmdb-devel
+Requires: openldap-devel
+Requires: pam-devel
+Requires: redhat-rpm-config
+%if 0%{?fedora} > 35 || 0%{?rhel} >= 9
+Requires: openssl-devel >= 1:3.0.0
+%else
+Requires: openssl-devel >= 1:1.1.1d-4
+Requires: openssl-devel < 1:3.0.0
+%endif
+
+# Test dependencies
+Requires: dejagnu
+Requires: hostname
+Requires: iproute
+Requires: keyutils, keyutils-libs-devel >= 1.5.8
+Requires: libcmocka-devel
+Requires: libverto-module-base
+Requires: logrotate
+Requires: net-tools, rpcbind
+Requires: perl-interpreter
+Requires: procps-ng
+Requires: python3-kdcproxy
+Requires: resolv_wrapper
+Requires: /etc/crypto-policies/back-ends/krb5.config
+Requires: words
+Requires: opensc
+Requires: softhsm
+Recommends: python3-pyrad
+
+# Restore once openldap upstream tests are fixed
+#Recommends: openldap-servers
+#Recommends: openldap-clients
+
+%description tests
+FOR TESTING PURPOSE ONLY
+Test sources for krb5 build, with pre-defined compilation parameters
+
 %prep
-%autosetup -S git -n %{name}-%{version}%{prerelease} -a 3
+%autosetup -S git_am -n %{name}-%{version}%{?dashpre}
 ln NOTICE LICENSE
 
 # Generate an FDS-compatible LDIF file.
@@ -304,10 +314,7 @@ popd
 
 # Mess with some of the default ports that we use for testing, so that multiple
 # builds going on the same host don't step on each other.
-cfg="src/kadmin/testing/proto/kdc.conf.proto \
-     src/kadmin/testing/proto/krb5.conf.proto \
-     src/lib/kadm5/unit-test/api.current/init-v2.exp \
-     src/util/k5test.py"
+cfg="src/util/k5test.py"
 LONG_BIT=`getconf LONG_BIT`
 PORT=`expr 61000 + $LONG_BIT - 48`
 sed -i -e s,61000,`expr "$PORT" + 0`,g $cfg
@@ -323,14 +330,21 @@ PORT=`expr 7777 + $LONG_BIT - 48`
 sed -i -e s,7777,`expr "$PORT" + 0`,g $cfg
 sed -i -e s,7778,`expr "$PORT" + 1`,g $cfg
 
+# Fix kadmind port hard-coded in tests
+PORT=`expr 61000 + $LONG_BIT - 48`
+sed -i -e \
+    "s,params.kadmind_port = 61001;,params.kadmind_port = $((PORT + 1));," \
+    src/lib/kadm5/t_kadm5.c
+
+
 %build
 # Go ahead and supply tcl info, because configure doesn't know how to find it.
 source %{_libdir}/tclConfig.sh
 pushd src
 
-# Set this so that configure will have a value even if the current version of
-# autoconf doesn't set one.
-export runstatedir=%{_localstatedir}/run
+# This should be safe to remove once we have autoconf >= 2.70
+export runstatedir=/run
+
 # Work out the CFLAGS and CPPFLAGS which we intend to use.
 INCLUDES=-I%{_includedir}/et
 CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC -fno-strict-aliasing -fstack-protector-all`"
@@ -340,19 +354,18 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`"
     CFLAGS="$CFLAGS" \
     CPPFLAGS="$CPPFLAGS" \
     SS_LIB="-lss" \
+    PKCS11_MODNAME="p11-kit-proxy.so" \
     --enable-shared \
+    --runstatedir=/run \
     --localstatedir=%{_var}/kerberos \
     --disable-rpath \
     --without-krb5-config \
     --with-system-et \
     --with-system-ss \
-    --with-netlib=-lresolv \
     --with-tcl \
     --enable-dns-for-realm \
     --with-ldap \
-%if %{WITH_DIRSRV}
     --with-dirsrv-account-locking \
-%endif
     --enable-pkinit \
     --with-crypto-impl=openssl \
     --with-tls-impl=openssl \
@@ -360,76 +373,51 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`"
     --with-pam \
     --with-selinux \
     --with-prng-alg=os \
+    --with-lmdb \
     || (cat config.log; exit 1)
-# Now build it.
-make
-popd
+
+# Check we have required features enabled
+for x in DNS_LOOKUP DNS_LOOKUP_REALM; do
+    grep -q "#define KRB5_${x} 1" include/autoconf.h
+done
 
 # Sanity check the KDC_RUN_DIR.
-configured_kdcrundir=`grep KDC_RUN_DIR src/include/osconf.h | awk '{print $NF}'`
-configured_kdcrundir=`eval echo $configured_kdcrundir`
-if test "$configured_kdcrundir" != %{_localstatedir}/run/krb5kdc ; then
+pushd include
+make osconf.h
+popd
+configured_dir=`grep KDC_RUN_DIR include/osconf.h | awk '{print $NF}'`
+configured_dir=`eval echo $configured_dir`
+if test "$configured_dir" != /run/krb5kdc ; then
+    echo Failed to configure KDC_RUN_DIR.
     exit 1
 fi
 
+# Build fast, but get better errors if we fail
+make %{?_smp_mflags} || make -j1
+popd
+
 # Build the docs.
 make -C src/doc paths.py version.py
 cp src/doc/paths.py doc/
-mkdir -p build-man build-html build-pdf
+mkdir -p build-man build-html
 sphinx-build -a -b man   -t pathsubs doc build-man
 sphinx-build -a -b html  -t pathsubs doc build-html
 rm -fr build-html/_sources
-sphinx-build -a -b latex -t pathsubs doc build-pdf
-# Build the PDFs if we don't have pre-built ones
-for pdf in admin appdev basic build plugindev user ; do
-    test -s build-pdf/$pdf.pdf || make -C build-pdf
-done
-# new krb5-version-pdf
-tar -cf "krb5-%{version}%{prerelease}-pdfs.tar.new" build-pdf/*.pdf
-
-# We need to cut off any access to locally-running nameservers, too.
-%{__cc} -fPIC -shared -o noport.so -Wall -Wextra %{SOURCE100}
-
-%check
-mkdir nss_wrapper
-
-# Set things up to use the test wrappers.
-export NSS_WRAPPER_HOSTNAME=test.example.com
-export NSS_WRAPPER_HOSTS="$PWD/nss_wrapper/fakehosts"
-echo "127.0.0.1 $NSS_WRAPPER_HOSTNAME localhost" > $NSS_WRAPPER_HOSTS
-export NOPORT='53,111'
-export SOCKET_WRAPPER_DIR="$PWD/sockets" ; mkdir -p $SOCKET_WRAPPER_DIR
-export LD_PRELOAD="$PWD/noport.so:libnss_wrapper.so:libsocket_wrapper.so"
-
-# ugh.  COPR doesn't expose the keyring, so try to cope.
-KEYCTL=keyctl
-keyctl list @u &>/dev/null || KEYCTL=:
-
-# Run the test suite. We can't actually run the whole thing in the build
-# system, but we can at least run more than we used to.  The build system may
-# give us a revoked session keyring, so run affected tests with a new one.
-make -C src runenv.py
-: make -C src check TMPDIR=%{_tmppath}
-$KEYCTL session - make -C src/lib check TMPDIR=%{_tmppath} OFFLINE=yes
-make -C src/kdc check TMPDIR=%{_tmppath}
-$KEYCTL session - make -C src/appl check TMPDIR=%{_tmppath}
-make -C src/clients check TMPDIR=%{_tmppath}
-$KEYCTL session - make -C src/util check TMPDIR=%{_tmppath}
 
 %install
 [ "$RPM_BUILD_ROOT" != '/' ] && rm -rf -- "$RPM_BUILD_ROOT"
 
 # Sample KDC config files (bundled kdc.conf and kadm5.acl).
 mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc
-install -pm 600 %{SOURCE10} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
-install -pm 600 %{SOURCE11} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
+install -pm 600 %{SOURCE6} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
+install -pm 600 %{SOURCE7} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
 
 # Where per-user keytabs live by default.
 mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5/user
 
 # Default configuration file for everything.
 mkdir -p $RPM_BUILD_ROOT/etc
-install -pm 644 %{SOURCE6} $RPM_BUILD_ROOT/etc/krb5.conf
+install -pm 644 %{SOURCE5} $RPM_BUILD_ROOT/etc/krb5.conf
 
 # Default include on this directory
 mkdir -p $RPM_BUILD_ROOT/etc/krb5.conf.d
@@ -449,16 +437,16 @@ mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss/mech.d
 export DEFCCNAME="%{configured_default_ccache_name}"
 awk '{print}
      /^#    default_realm/{print "    default_ccache_name =", ENVIRON["DEFCCNAME"]}' \
-     %{SOURCE6} > $RPM_BUILD_ROOT/etc/krb5.conf
-touch -r %{SOURCE6} $RPM_BUILD_ROOT/etc/krb5.conf
+     %{SOURCE5} > $RPM_BUILD_ROOT/etc/krb5.conf
+touch -r %{SOURCE5} $RPM_BUILD_ROOT/etc/krb5.conf
 grep default_ccache_name $RPM_BUILD_ROOT/etc/krb5.conf
 %endif
 
 # Server init scripts (krb5kdc,kadmind,kpropd) and their sysconfig files.
 mkdir -p $RPM_BUILD_ROOT%{_unitdir}
 for unit in \
-    %{SOURCE5}\
-     %{SOURCE4} \
+    %{SOURCE4}\
+     %{SOURCE3} \
      %{SOURCE2} ; do
     # In the past, the init script was supposed to be named after the service
     # that the started daemon provided.  Changing their names is an
@@ -466,11 +454,11 @@ for unit in \
     install -pm 644 ${unit} $RPM_BUILD_ROOT%{_unitdir}
 done
 mkdir -p $RPM_BUILD_ROOT/%{_tmpfilesdir}
-install -pm 644 %{SOURCE39} $RPM_BUILD_ROOT/%{_tmpfilesdir}/
+install -pm 644 %{SOURCE14} $RPM_BUILD_ROOT/%{_tmpfilesdir}/
 mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/run/krb5kdc
 
 mkdir -p $RPM_BUILD_ROOT/etc/sysconfig
-for sysconfig in %{SOURCE19} %{SOURCE20} %{SOURCE21} ; do
+for sysconfig in %{SOURCE8} %{SOURCE9} %{SOURCE10} ; do
     install -pm 644 ${sysconfig} \
             $RPM_BUILD_ROOT/etc/sysconfig/`basename ${sysconfig} .sysconfig`
 done
@@ -478,15 +466,15 @@ done
 # logrotate configuration files
 mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d/
 for logrotate in \
-    %{SOURCE33} \
-     %{SOURCE34} ; do
+    %{SOURCE12} \
+     %{SOURCE13} ; do
     install -pm 644 ${logrotate} \
             $RPM_BUILD_ROOT/etc/logrotate.d/`basename ${logrotate} .logrotate`
 done
 
 # PAM configuration files.
 mkdir -p $RPM_BUILD_ROOT/etc/pam.d/
-for pam in %{SOURCE29} ; do
+for pam in %{SOURCE11} ; do
     install -pm 644 ${pam} \
             $RPM_BUILD_ROOT/etc/pam.d/`basename ${pam} .pamd`
 done
@@ -497,21 +485,17 @@ install -pdm 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/kdb
 install -pdm 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/authdata
 
 # The rest of the binaries, headers, libraries, and docs.
-make -C src DESTDIR=$RPM_BUILD_ROOT EXAMPLEDIR=%{libsdocdir}/examples install
+%make_install -C src EXAMPLEDIR=%{libsdocdir}/examples
 
 # Munge krb5-config yet again.  This is totally wrong for 64-bit, but chunks
 # of the buildconf patch already conspire to strip out /usr/<anything> from the
 # list of link flags, and it helps prevent file conflicts on multilib systems.
 sed -r -i -e 's|^libdir=/usr/lib(64)?$|libdir=/usr/lib|g' $RPM_BUILD_ROOT%{_bindir}/krb5-config
 
-# Temporay workaround for krb5-config reading too much from LDFLAGS.
-# Upstream: http://krbdev.mit.edu/rt/Ticket/Display.html?id=8159
-sed -r -i -e "s/-specs=\/.+?\/redhat-hardened-ld//g" $RPM_BUILD_ROOT%{_bindir}/krb5-config
-
-if [[ "$(< $RPM_BUILD_ROOT%{_bindir}/krb5-config )" == *redhat-hardened-ld* ]] ; then
-    printf '# redhat-hardened-ld for krb5-config failed' 1>&2
-    exit 1
-fi
+# Workaround krb5-config reading too much from LDFLAGS.
+# https://bugzilla.redhat.com/show_bug.cgi?id=1997021
+# https://bugzilla.redhat.com/show_bug.cgi?id=2048909
+sed -i -r -e 's/^(LDFLAGS=).*/\1/' $RPM_BUILD_ROOT%{_bindir}/krb5-config
 
 # Install processed man pages.
 for section in 1 5 8 ; do
@@ -536,16 +520,45 @@ rm -- "$RPM_BUILD_ROOT/%{_docdir}/krb5-libs/examples/services.append"
 # This is only needed for tests
 rm -- "$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth/test.so"
 
+# Generate tests launching script
+sed -e 's/{{ name }}/%{name}/g' \
+    -e 's/{{ version }}/%{krb5_version}/g' \
+    -e 's/{{ release }}/%{krb5_release}/g' \
+    -e 's/{{ arch }}/%{_arch}/g' \
+    -i %{SOURCE15}
+mkdir -p $RPM_BUILD_ROOT%{_libexecdir}
+install -pm 755 %{SOURCE15} $RPM_BUILD_ROOT%{_libexecdir}/%{name}-tests-%{_arch}
+
+# Copy source files from build folder to system data folder
+install -pdm 755 $RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}
+pushd src
+cp -p --parents -t "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/" \
+    $(find . -type f -exec file -i "{}" + \
+          | sed -n \
+                -e 's|^\./\([^:]\+\): \+text/.\+$|\1|p' \
+                -e 's|^\./\([^:]\+\): \+application/x-pem-file.\+$|\1|p' \
+                -e 's|^\./\([^:]\+\): \+application/json.\+$|\1|p' \
+          | grep -Ev '~$')
+popd
+
+# Copy binary test files
+install -pm 644 src/tests/pkinit-certs/*.p12 \
+    "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/tests/pkinit-certs/"
+
+# Unset executable bit if no shebang in script
+for f in $(find "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/" -type f -executable)
+do
+    head -n1 "$f" | grep -Eq '^#!' || chmod a-x "$f"
+done
+
+# Remove broken shebang Perl scripts
+rm -- "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/config/wconfig.pl"
+rm -- "$RPM_BUILD_ROOT%{_datarootdir}/%{name}-tests/%{_arch}/kadmin/kdbkeys/do-test.pl"
+
 %find_lang %{gettext_domain}
 
 %ldconfig_scriptlets libs
 
-%triggerun libs -- krb5-libs < 1.15.1-5
-if ! grep -q 'includedir /etc/krb5.conf.d' /etc/krb5.conf ; then
-    sed -i '1i # To opt out of the system crypto-policies configuration of krb5, remove the\n# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.\nincludedir /etc/krb5.conf.d/\n' /etc/krb5.conf
-fi
-exit 0
-
 %ldconfig_scriptlets server-ldap
 
 %post server
@@ -568,7 +581,6 @@ exit 0
 %doc src/config-files/services.append
 %doc src/config-files/krb5.conf
 %doc build-html/*
-%doc build-pdf/user.pdf build-pdf/basic.pdf
 %attr(0755,root,root) %doc src/config-files/convert-config-files
 
 # Clients of the KDC, including tools you're likely to need if you're running
@@ -600,7 +612,6 @@ exit 0
 
 %files server
 %docdir %{_mandir}
-%doc build-pdf/admin.pdf build-pdf/build.pdf
 %doc src/config-files/kdc.conf
 %{_unitdir}/krb5kdc.service
 %{_unitdir}/kadmin.service
@@ -625,6 +636,7 @@ exit 0
 %dir %{_libdir}/krb5/plugins/authdata
 %{_libdir}/krb5/plugins/preauth/otp.so
 %{_libdir}/krb5/plugins/kdb/db2.so
+%{_libdir}/krb5/plugins/kdb/klmdb.so
 
 # KDC binaries and configuration.
 %{_mandir}/man5/kadm5.acl.5*
@@ -675,7 +687,7 @@ exit 0
 %dir /etc/gss/mech.d
 %dir /etc/krb5.conf.d
 %config(noreplace) /etc/krb5.conf
-%config(noreplace) /etc/krb5.conf.d/crypto-policies
+%config(noreplace,missingok) /etc/krb5.conf.d/crypto-policies
 /%{_mandir}/man5/.k5identity.5*
 /%{_mandir}/man5/.k5login.5*
 /%{_mandir}/man5/k5identity.5*
@@ -706,7 +718,6 @@ exit 0
 
 %files devel
 %docdir %{_mandir}
-%doc build-pdf/appdev.pdf build-pdf/plugindev.pdf
 
 %{_includedir}/*
 %{_libdir}/libgssapi_krb5.so
@@ -729,7 +740,533 @@ exit 0
 %{_libdir}/libkadm5clnt_mit.so.*
 %{_libdir}/libkadm5srv_mit.so.*
 
+%files tests
+%{_libexecdir}/%{name}-tests-%{_arch}
+%{_datarootdir}/%{name}-tests/%{_arch}
+
 %changelog
+* Mon Jan 05 2026 Julien Rische <jrische@redhat.com> - 1.21.3-11
+- Fix strchr() conformance to C23
+
+* Mon Oct 20 2025 Alexander Bokovoy <abokovoy@redhat.com> - 1.21.3-10
+- Update the prompter patch to upstream version
+  Resolves: rhbz#2403513
+
+* Wed Oct 15 2025 Alexander Bokovoy <abokovoy@redhat.com> - 1.21.3-9
+- do not crash when prompter is not available in GSSAPI
+  Resolves: rhbz#2403513
+
+* Fri Sep 26 2025 Alexander Bokovoy <abokovoy@redhat.com> - 1.21.3-8
+- Add automated FAST channel for kinit
+- https://github.com/krb5/krb5/pull/1447 - work in progress
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.21.3-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Wed Jun 04 2025 Julien Rische <jrische@redhat.com> - 1.21.3-6
+- Do not block HMAC-MD4/5 in FIPS mode
+  Resolves: rhbz#2370259
+- PKINIT: implement paChecksum2 from MS-PKCA v20230920
+  Resolves: rhbz#2357215
+- Disallow RC4 HMAC-MD5 session keys by default (CVE-2025-3576)
+  Resolves: rhbz#2359705
+
+* Wed Jan 29 2025 Julien Rische <jrische@redhat.com> - 1.21.3-5
+- Prevent overflow when calculating ulog block size (CVE-2025-24528)
+  Resolves: rhbz#2342798
+- Support PKCS11 EC client certs in PKINIT
+  Resolves: rhbz#2341962
+- kdb5_util: fix DB entry flags on modification
+  Resolves: rhbz#2336555
+- Add ECDH support for PKINIT (RFC5349)
+  Resolves: rhbz#2214326
+- Remove dependency of krb5-libs on gawk and sed
+  Resolves: rhbz#2323859
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.21.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Wed Oct 30 2024 Julien Rische <jrische@redhat.com> - 1.21.3-3
+- libkrad: implement support for Message-Authenticator (CVE-2024-3596)
+  Resolves: rhbz#2304071
+- Fix various issues detected by static analysis
+  Resolves: rhbz#2322704
+- Remove RSA protocol for PKINIT
+  Resolves: rhbz#2322706
+- Make TCP waiting time configurable
+  Resolves: rhbz#2322711
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.21.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jul 09 2024 Julien Rische <jrische@redhat.com> - 1.21.3-1
+- New upstream version (1.21.3)
+- CVE-2024-26458: Memory leak in src/lib/rpc/pmap_rmt.c
+  Resolves: rhbz#2266732
+- CVE-2024-26461: Memory leak in src/lib/gssapi/krb5/k5sealv3.c
+  Resolves: rhbz#2266741
+- CVE-2024-26462: Memory leak in src/kdc/ndr.c
+  Resolves: rhbz#2266743
+- Add missing SPDX license identifiers
+  Resolves: rhbz#2265333
+
+* Mon Jul 08 2024 Julien Rische <jrische@redhat.com> - 1.21.2-6
+- CVE-2024-37370 CVE-2024-37371: GSS message token handling
+  Resolves: rhbz#2294678 rhbz#2294680
+- Fix double free in klist's show_ccache()
+  Resolves: rhbz#2257301
+- Do not include files with "~" termination in krb5-tests
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.21.2-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.21.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Jan 17 2024 Julien Rische <jrische@redhat.com> - 1.21.2-3
+- Fix double free in klist's show_ccache()
+  Resolves: rhbz#2257301
+- Store krb5-tests files in architecture-specific directories
+  Resolves: rhbz#2244601
+
+* Tue Oct 10 2023 Julien Rische <jrische@redhat.com> - 1.21.2-2
+- Use SPDX expression for license tag
+- Fix unimportant memory leaks
+  Resolves: rhbz#2223274
+
+* Wed Aug 16 2023 Julien Rische <jrische@redhat.com> - 1.21.2-1
+- New upstream version (1.21.2)
+- Fix double-free in KDC TGS processing (CVE-2023-39975)
+  Resolves: rhbz#2229113
+- Make tests compatible with Python 3.12
+  Resolves: rhbz#2224013
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.21-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Thu Jun 29 2023 Marek Blaha <mblaha@redhat.com> - 1.21-2
+- Replace file dependency with package name
+  Resolves: rhbz#2216903
+
+* Mon Jun 12 2023 Julien Rische <jrische@redhat.com> - 1.21-1
+- New upstream version (1.21)
+- Do not disable PKINIT if some of the well-known DH groups are unavailable
+  Resolves: rhbz#2214297
+- Make PKINIT CMS SHA-1 signature verification available in FIPS mode
+  Resolves: rhbz#2214300
+- Allow to set PAC ticket signature as optional
+  Resolves: rhbz#2181311
+- Add support for MS-PAC extended KDC signature (CVE-2022-37967)
+  Resolves: rhbz#2166001
+- Fix syntax error in aclocal.m4
+  Resolves: rhbz#2143306
+
+* Tue Jan 31 2023 Julien Rische <jrische@redhat.com> - 1.20.1-9
+- Add support for MS-PAC extended KDC signature (CVE-2022-37967)
+  Resolves: rhbz#2166001
+
+* Mon Jan 30 2023 Julien Rische <jrische@redhat.com> - 1.20.1-8
+- Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled
+- Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.20.1-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Wed Jan 18 2023 Julien Rische <jrische@redhat.com> - 1.20.1-6
+- Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf
+- Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf
+  Resolves: rhbz#2114771
+
+* Mon Jan 09 2023 Julien Rische <jrische@redhat.com> - 1.20.1-5
+- Strip debugging data from ksu executable file
+
+* Thu Jan 05 2023 Julien Rische <jrische@redhat.com> - 1.20.1-4
+- Include missing OpenSSL FIPS header
+- Make tests compatible with sssd_krb5_locator_plugin.so
+
+* Tue Dec 06 2022 Julien Rische <jrische@redhat.com> - 1.20.1-3
+- Enable TMT integration with Fedora CI
+
+* Thu Dec  1 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.20.1-2
+- Bump KDB ABI version provide to 9.0
+
+* Wed Nov 23 2022 Julien Rische <jrische@redhat.com> - 1.20.1-1
+- New upstream version (1.20.1)
+  Resolves: rhbz#2124463
+- Restore "supportedCMSTypes" attribute in PKINIT preauth requests
+- Set SHA-512 or SHA-256 with RSA as preferred CMS signature algorithms
+  Resolves: rhbz#2114766
+- Update error checking for OpenSSL CMS_verify
+  Resolves: rhbz#2119704
+- Remove invalid password expiry warning
+  Resolves: rhbz#2129113
+
+* Wed Nov 09 2022 Julien Rische <jrische@redhat.com> - 1.19.2-13
+- Fix integer overflows in PAC parsing (CVE-2022-42898)
+  Resolves: rhbz#2143011
+
+* Tue Aug 02 2022 Andreas Schneider <asn@redhat.com> - 1.19.2-12
+- Use baserelease to set the release number
+- Do not define netlib, but use autoconf detection for res_* functions
+- Add missing BR for resolv_wrapper to run t_discover_uri.py
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.19.2-11.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Wed Jun 15 2022 Julien Rische <jrische@redhat.com> - 1.19.2-11
+- Allow libkrad UDP/TCP connection to localhost in FIPS mode
+  Resolves: rhbz#2082189
+- Read GSS configuration files with mtime 0
+
+* Mon May  2 2022 Julien Rische <jrische@redhat.com> - 1.19.2-10
+- Use p11-kit as default PKCS11 module
+  Resolves: rhbz#2073274
+- Try harder to avoid password change replay errors
+  Resolves: rhbz#2072059
+
+* Tue Apr 05 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-9
+- Fix libkrad client cleanup
+- Fixes rhbz#2072059
+
+* Tue Apr 05 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-8
+- Allow use of larger RADIUS attributes in krad library
+
+* Wed Mar 23 2022 Julien Rische <jrische@redhat.com> - 1.19.2-7
+- Use SHA-256 instead of SHA-1 for PKINIT CMS digest
+
+* Tue Feb  8 2022 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.19.2-6
+- Drop old trigger scriplet
+- Reenable package notes and strip LDFLAGS from krb5-config (rhbz#2048909)
+
+* Wed Feb 02 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-5
+- Temporarily remove package note to unblock krb5-dependent packages
+  Resolves: rhbz#2048909
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.19.2-4.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Fri Dec 3 2021 Antonio Torres <antorres@redhat.com> - 1.19.2-4
+- Add patches to support OpenSLL 3.0.0
+- Remove TCL-based libkadm5 API tests
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 1.19.2-3.1
+- Rebuilt with OpenSSL 3.0.0
+
+* Tue Aug 24 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.2-3
+- Remove -specs= from krb5-config output
+
+* Thu Aug 19 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.2-2
+- Fix KDC null deref on TGS inner body null server (CVE-2021-37750)
+
+* Mon Jul 26 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.2-1
+- New upstream version (1.19.2)
+
+* Wed Jul 21 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-15
+- Fix defcred leak in krb5 gss_inquire_cred()
+
+* Mon Jul 12 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-14
+- Fix KDC null deref on bad encrypted challenge (CVE-2021-36222)
+
+* Thu Jul 01 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-13
+- Fix use-after-free during krad remote_shutdown()
+
+* Mon Jun 28 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-12
+- MEMORY locking fix and static analysis pullup
+
+* Mon Jun 21 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-11
+- Add the backward-compatible parts of openssl3 support
+
+* Wed Jun 09 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-10
+- Fix three canonicalization cases for fallback
+
+* Wed Jun 02 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-9
+- Fix doc build for Sphinx 4.0
+
+* Thu May 20 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-8
+- Add all the sssd-kcm workarounds
+
+* Thu May 20 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-7
+- Fix context for previous backport
+
+* Thu May 20 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-6
+- Add KCM_OP_GET_CRED_LIST and KCM_OP_RETRIEVE support
+
+* Tue May 04 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-5
+- Suppress static analyzer warning in FIPS override
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.19.1-3.1
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Mon Mar 01 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-3
+- Further test dependency fixes; no code changes
+
+* Mon Mar 01 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-2
+- Make test dependencies contingent on skipcheck; no code changes
+
+* Thu Feb 18 2021 Robbie Harwood <rharwood@redhat.com> - 1.19.1-1
+- New upstream version (1.19.1)
+
+* Wed Feb 17 2021 Robbie Harwood <rharwood@redhat.com> - 1.19-3
+- Restore krb5_set_default_tgs_ktypes()
+
+* Fri Feb 05 2021 Robbie Harwood <rharwood@redhat.com> - 1.19-2
+- No code change; just coping with reverted autoconf
+
+* Tue Feb 02 2021 Robbie Harwood <rharwood@redhat.com> - 1.19-1
+- New upstream version (1.19)
+
+* Thu Jan 28 2021 Robbie Harwood <rharwood@redhat.com> - 1.19-0.beta2.5
+- Support host-based GSS initiator names
+
+* Thu Jan 28 2021 Robbie Harwood <rharwood@redhat.com> - 1.19-0.beta2.4
+- Require krb5-pkinit from krb5-{server,workstation}
+
+* Thu Jan 28 2021 Robbie Harwood <rharwood@redhat.com> - 1.19-0.beta2.3
+- Fix up weird mass rebuild versioning
+
+* Thu Jan 28 2021 Robbie Harwood <rharwood@redhat.com> - 1.19-0.beta2.2.2
+- Add APIs for marshalling credentials
+
+* Wed Jan 27 2021 Robbie Harwood <rharwood@redhat.com> - 1.19-0.beta2.1.2
+- Cope with new autotools behavior wrt runstatedir
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.19-0.beta2.1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Tue Jan 12 2021 Robbie Harwood <rharwood@redhat.com> - 1.19-1
+- New upstream version (1.19-beta2)
+
+* Wed Dec 16 2020 Robbie Harwood <rharwood@redhat.com> - 1.19-0.beta1.2
+- New upstream version (1.19-beta1)
+
+* Wed Dec 16 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.3-5
+- Fix runstatedir configuration
+- Why couldn't systemd just leave it alone?
+
+* Tue Nov 24 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.3-4
+- Document -k option in kvno(1) synopsis
+
+* Fri Nov 20 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.3-3
+- Upstream executable shared libraries patch
+
+* Wed Nov 18 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.3-2
+- Fix build failure in -1
+
+* Wed Nov 18 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.3-1
+- New upstream version (1.18.3)
+
+* Tue Nov 17 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-30
+- Migrate /var/run to /run, an exercise in pointlessness
+  Resolves: rhbz#1898410
+
+* Thu Nov 05 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-29
+- Add recursion limit for ASN.1 indefinite lengths (CVE-2020-28196)
+
+* Fri Oct 23 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-28
+- Fix minor static analysis defects
+
+* Wed Oct 21 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-27
+- Fix build of previous
+
+* Wed Oct 21 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-26
+- Cross-realm s4u fixes for samba (rhbz#1836630)
+
+* Thu Oct 15 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-25
+- Unify kvno option documentation
+
+* Fri Oct 02 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-24
+- Add md5 override to krad
+
+* Thu Sep 10 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-23
+- Use `systemctl reload` to HUP the KDC during logrotate
+  Resolves: rhbz#1877692
+
+* Wed Sep 09 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-22
+- Fix input length checking in SPNEGO DER decoding
+
+* Fri Aug 28 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-21
+- Mark crypto-polices snippet as missingok
+  Resolves: rhbz#1868379
+
+* Thu Aug 13 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-20
+- Temporarily dns_canonicalize_hostname=fallback changes
+- Hopefully unbreak IPA while we debug further
+
+* Fri Aug 07 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-19
+- Expand dns_canonicalize_hostname=fallback support
+
+* Tue Aug 04 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-18
+- Fix leak in KERB_AP_OPTIONS_CBT server support
+
+* Mon Aug 03 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-17
+- Revert qualify_shortname removal
+
+* Mon Aug 03 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-16
+- Disable tests on s390x
+  Resolves: rhbz#1863952
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.18.2-15
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Fri Jul 31 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-14
+- Revert qualify_shortname changes
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.18.2-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jul 22 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-12
+- Ignore bad enctypes in krb5_string_to_keysalts()
+- Allow gss_unwrap_iov() of unpadded RC4 tokens
+
+* Wed Jul 15 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-11
+- Ignore bad enctypes in krb5_string_to_keysalts()
+
+* Wed Jul 08 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-10
+- Set qualify_shortname empty in default configuration
+  Resolves: rhbz#1852041
+
+* Mon Jun 15 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-9
+- Use two queues for concurrent t_otp.py daemons
+
+* Mon Jun 15 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-8
+- Match Heimdal behavior for channel bindings
+
+* Mon Jun 08 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-7
+- Fix test suite by removing wrapper workarounds
+
+* Mon Jun 08 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-6
+- Omit PA_FOR_USER if we can't compute its checksum
+
+* Sat May 30 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-5
+- Replace gssrpc tests with a Python script
+
+* Sat May 30 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-4
+- Default dns_canonicalize_hostname to "fallback"
+
+* Tue May 26 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-3
+- dns_canonicalize_hostname = fallback
+
+* Tue May 26 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-2
+- Pass channel bindings through SPNEGO
+
+* Fri May 22 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-1
+- New upstream release (1.18.2)
+
+* Fri May 22 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.1-6
+- Fix SPNEGO acceptor mech filtering
+
+* Mon May 18 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.1-5
+- Fix typo ("in in") in the ksu man page
+
+* Fri May 08 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.1-4
+- Omit KDC indicator check for S4U2Self requests
+
+* Tue Apr 28 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.1-3
+- Pass gss_localname() through SPNEGO
+
+* Tue Apr 14 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-1.1
+- Drop yasm requirement since we don't use builtin crypto
+
+* Tue Apr 14 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.1-1
+- New upstream version (1.18.1)
+
+* Tue Apr 07 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-12
+- Make ksu honor KRB5CCNAME again
+
+* Thu Apr 02 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-11
+- Do expiration warnings for all init_creds APIs
+
+* Wed Apr 01 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-10
+- Correctly import "service@" GSS host-based name
+
+* Thu Mar 26 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-9
+- Eliminate redundant PKINIT responder invocation
+
+* Thu Mar 26 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-8
+- Add finalization safety check to com_err
+
+* Fri Mar 20 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-7
+- Add maximum openssl version in preparation for openssl 3
+
+* Tue Mar 17 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-6
+- Document client keytab usage
+
+* Tue Mar 03 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-5
+- Refresh manually acquired creds from client keytab
+
+* Fri Feb 28 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-4
+- Allow deletion of require_auth with LDAP KDB
+
+* Thu Feb 27 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-3
+- Allow certauth modules to set hw-authent flag
+
+* Fri Feb 21 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-2
+- Fix AS-REQ checking of KDB-modified indicators
+
+* Wed Feb 12 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-1
+- New upstream version (1.18)
+
+* Fri Feb 07 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-0.beta2.3
+- Don't assume OpenSSL failures are memory errors
+
+* Thu Feb 06 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-0.beta2.2
+- Put KDB authdata first
+
+* Fri Jan 31 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-0.beta2.1
+- New upstream beta release - 1.18-beta2
+- Adjust naming convention for downstream patches
+
+* Fri Jan 10 2020 Robbie Harwood <rharwood@redhat.com> - 1.18-0.beta1.1
+- New upstream beta release - 1.18-beta1
+
+* Wed Jan 08 2020 Robbie Harwood <rharwood@redhat.com> - 1.17.1-5
+- Fix LDAP policy enforcement of pw_expiration
+- Fix handling of invalid CAMMAC service verifier
+
+* Mon Jan 06 2020 Robbie Harwood <rharwood@redhat.com> - 1.17.1-4
+- Fix xdr_bytes() strict-aliasing violations
+
+* Fri Jan 03 2020 Robbie Harwood <rharwood@redhat.com> - 1.17.1-3
+- Don't warn in kadmin when no policy is specified
+- Do not always canonicalize enterprise principals
+
+* Fri Dec 13 2019 Robbie Harwood <rharwood@redhat.com> - 1.17.1-2
+- Enable the LMDB backend for the KDB
+
+* Thu Dec 12 2019 Robbie Harwood <rharwood@redhat.com> - 1.17.1-1
+- New upstream version - 1.17.1
+- Stop building and packaging PDFs
+
+* Fri Dec 06 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-54
+- Qualify short hostnames when not using DNS
+
+* Wed Nov 27 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-53
+- Various gssalloc fixes
+
+* Thu Nov 21 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-52
+- Turns out openssl has an epoch
+
+* Wed Nov 20 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-51
+- Fix runtime openssl version to actually propogate
+
+* Wed Nov 20 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-50
+- Add runtime openssl version requirement too
+
+* Wed Nov 20 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-49
+- Fix kadmin addprinc -randkey -kvno
+
+* Tue Nov 19 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-48
+- Use OpenSSL's backported KDFs
+- Restore MD4 in FIPS mode (for samba)
+
+* Fri Nov 08 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-47
+- Add default_principal_flags to example kdc.conf
+
+* Wed Oct 02 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-46
+- Log unknown enctypes as unsupported in KDC
+
 * Wed Sep 25 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-45
 - Fix KDC crash when logging PKINIT enctypes (CVE-2019-14844)
 
@@ -762,7 +1299,7 @@ exit 0
 
 * Mon Jul 15 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-35
 - Don't error on invalid enctypes in keytab
-- Resolves: #1724380
+  Resolves: rhbz#1724380
 
 * Tue Jul 02 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-34
 - Remove now-unused checksum functions
@@ -847,7 +1384,7 @@ exit 0
 
 * Thu Apr 11 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-8
 - Implement krb5_cc_remove_cred for remaining types
-- Resolves: #1693836
+  Resolves: rhbz#1693836
 
 * Mon Apr 01 2019 Robbie Harwood <rharwood@redhat.com> - 1.17-7
 - FIPS-aware SPAKE group negotiation
@@ -882,7 +1419,7 @@ exit 0
 
 * Mon Dec 17 2018 Robbie Harwood <rharwood@redhat.com> - 1.17-1.beta2.2
 - Restore pdfs source file
-- Resolves: #1659716
+  Resolves: rhbz#1659716
 
 * Thu Dec 06 2018 Robbie Harwood <rharwood@redhat.com> - 1.17-1.beta2.1
 - New upstream release (1.17-beta2)
@@ -896,26 +1433,26 @@ exit 0
 
 * Thu Nov 08 2018 Robbie Harwood <rharwood@redhat.com> - 1.17-1.beta1.1
 - Fix spurious errors from kcmio_unix_socket_write
-- Resolves: #1645912
+  Resolves: rhbz#1645912
 
 * Thu Nov 01 2018 Robbie Harwood <rharwood@redhat.com> - 1.17-0.beta1.1
 - New upstream beta release
 
 * Wed Oct 24 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-25
 - Update man pages to reference kerberos(7)
-- Resolves: #1143767
+  Resolves: rhbz#1143767
 
 * Wed Oct 17 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-24
 - Use port-sockets.h macros in cc_kcm, sendto_kdc
-- Resolves: #1631998
+  Resolves: rhbz#1631998
 
 * Wed Oct 17 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-23
 - Correct kpasswd_server description in krb5.conf(5)
-- Resolves: #1640272
+  Resolves: rhbz#1640272
 
 * Mon Oct 15 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-22
 - Prefer TCP to UDP for password changes
-- Resolves: #1637611
+  Resolves: rhbz#1637611
 
 * Tue Oct 09 2018 Adam Williamson <awilliam@redhat.com> - 1.16.1-21
 - Revert the patch from -20 for now as it seems to make FreeIPA worse
@@ -964,18 +1501,18 @@ exit 0
 
 * Thu Jun 14 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-6
 - Switch to python3-sphinx for docs
-- Resolves: #1590928
+  Resolves: rhbz#1590928
 
 * Thu Jun 14 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-5
 - Make docs build python3-compatible
-- Resolves: #1590928
+  Resolves: rhbz#1590928
 
 * Thu Jun 07 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-4
 - Update includedir processing to match upstream
 
 * Fri Jun 01 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-3
 - Log when non-root ksu authorization fails
-- Resolves: #1575771
+  Resolves: rhbz#1575771
 
 * Fri May 04 2018 Robbie Harwood <rharwood@redhat.com> - 1.16.1-2
 - Remove "-nodes" option from make-certs scripts
@@ -997,7 +1534,7 @@ exit 0
 
 * Mon Apr 23 2018 Robbie Harwood <rharwood@redhat.com> - 1.16-23
 - Explicitly use openssl rather than builtin crypto
-- Resolves: #1570910
+  Resolves: rhbz#1570910
 
 * Tue Apr 17 2018 Robbie Harwood <rharwood@redhat.com> - 1.16-22
 - Merge duplicate subsections in profile library
@@ -1047,7 +1584,7 @@ exit 0
 
 * Wed Mar 07 2018 Robbie Harwood <rharwood@redhat.com> - 1.16-8
 - Fix capaths "." values on client
-- Resolves: 1551099
+  Resolves: 1551099
 
 * Tue Feb 13 2018 Robbie Harwood <rharwood@redhat.com> - 1.16-7
 - Fix flaws in LDAP DN checking
@@ -1056,7 +1593,7 @@ exit 0
 * Mon Feb 12 2018 Robbie Harwood <rharwood@redhat.com> - 1.16-6
 - Fix a leak in the previous commit
 - Restore dist macro that was accidentally removed
-- Resolves: #1540939
+  Resolves: rhbz#1540939
 
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.16-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
@@ -1069,7 +1606,7 @@ exit 0
 
 * Tue Dec 12 2017 Robbie Harwood <rharwood@redhat.com> - 1.16-2
 - Fix network service dependencies
-- Resolves: #1525230
+  Resolves: rhbz#1525230
 
 * Wed Dec 06 2017 Robbie Harwood <rharwood@redhat.com> - 1.16-1
 - New upstream release (1.16)
@@ -1099,12 +1636,12 @@ exit 0
 
 * Wed Sep 06 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-28
 - Save other programs from worrying about CVE-2017-11462
-- Resolves: #1488873
-- Resolves: #1488874
+  Resolves: rhbz#1488873
+  Resolves: rhbz#1488874
 
 * Tue Sep 05 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-27
 - Add hostname-based ccselect module
-- Resolves: #1463665
+  Resolves: rhbz#1463665
 
 * Tue Sep 05 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-26
 - Backport upstream certauth EKU fixes
@@ -1147,15 +1684,15 @@ exit 0
 
 * Mon Jun 26 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-13
 - Fix arch name (ppc64le, not ppc64el)
-- Related-to: #1464381
+- Related-to: rhbz#1464381
 
 * Mon Jun 26 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-12
 - Skip test suite on ppc64el
-- Related-to: #1464381
+- Related-to: rhbz#1464381
 
 * Fri Jun 23 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-11
 - Include more test suite changes from upstream
-- Resolves: #1464381
+  Resolves: rhbz#1464381
 
 * Wed Jun 07 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-10
 - Fix custom build with -DDEBUG
@@ -1171,12 +1708,12 @@ exit 0
 
 * Thu Apr 13 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-6
 - Include fixes for previous commit
-- Resolves: #1433083
+  Resolves: rhbz#1433083
 
 * Thu Apr 13 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-5
 - Automatically add includedir where not present
 - Try removing sleep statement to see if it is still needed
-- Resolves: #1433083
+  Resolves: rhbz#1433083
 
 * Fri Apr 07 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-4
 - Fix use of enterprise principals with forwarding
@@ -1186,7 +1723,7 @@ exit 0
 
 * Tue Mar 07 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-2
 - Remove duplication between subpackages
-- Resolves: #1250228
+  Resolves: rhbz#1250228
 
 * Fri Mar 03 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-1
 - New upstream release - 1.15.1
@@ -1220,14 +1757,14 @@ exit 0
 * Thu Oct 20 2016 Robbie Harwood <rharwood@redhat.com> - 1.15-beta1-1
 - New upstream release
 - Update selinux with RHEL hygene
-- Resolves: #1314096
+  Resolves: rhbz#1314096
 
 * Tue Oct 11 2016 Tomáš Mráz <tmraz@redhat.com> - 1.14.4-6
 - rebuild with OpenSSL 1.1.0, added backported upstream patch
 
 * Fri Sep 30 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.4-5
 - Properly close krad sockets
-- Resolves: #1380836
+  Resolves: rhbz#1380836
 
 * Fri Sep 30 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.4-4
 - Fix backward check in kprop.service
@@ -1246,42 +1783,42 @@ exit 0
 
 * Mon Sep 19 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.3-9
 - Add krb5_db_register_keytab
-- Resolves: #1376812
+  Resolves: rhbz#1376812
 
 * Mon Aug 29 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.3-8
 - Use responder for non-preauth AS requests
-- Resolves: #1370622
+  Resolves: rhbz#1370622
 
 * Mon Aug 29 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.3-7
 - Guess Samba client mutual flag using ap_option
-- Resolves: #1370980
+  Resolves: rhbz#1370980
 
 * Thu Aug 25 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.3-6
 - Fix KDC return code and set prompt types for OTP client preauth
-- Resolves: #1370072
+  Resolves: rhbz#1370072
 
 * Mon Aug 15 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.3-5
 - Turn OFD locks back on with glibc workaround
-- Resolves: #1274922
+  Resolves: rhbz#1274922
 
 * Wed Aug 10 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.3-4
 - Fix use of KKDCPP with SNI
-- Resolves: #1365027
+  Resolves: rhbz#1365027
 
 * Fri Aug 05 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.3-3
 - Make krb5-devel depend on libkadm5
-- Resolves: #1364487
+  Resolves: rhbz#1364487
 
 * Wed Aug 03 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.3-2
 - Up-port a bunch of stuff from the el-7.3 cycle
-- Resolves: #1255450, #1314989
+  Resolves: rhbz#1255450, rhbz#1314989
 
 * Mon Aug 01 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.3-1
 - New upstream version 1.14.3
 
 * Thu Jul 28 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.1-9
 - Fix CVE-2016-3120
-- Resolves: #1361051
+  Resolves: rhbz#1361051
 
 * Wed Jun 22 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.1-8
 - Fix incorrect recv() size calculation in libkrad
@@ -1294,18 +1831,18 @@ exit 0
 
 * Tue Apr 05 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.1-5
 - Use the correct patches this time.
-- Resolves: #1321135
+  Resolves: rhbz#1321135
 
 * Mon Apr 04 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.1-4
 - Add send/receive sendto_kdc hooks and corresponding tests
-- Resolves: #1321135
+  Resolves: rhbz#1321135
 
 * Fri Mar 18 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.1-3
 - Fix CVE-2016-3119 (NULL deref in LDAP module)
 
 * Thu Mar 17 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.1-2
 - Backport OID mech fix
-- Resolves: #1317609
+  Resolves: rhbz#1317609
 
 * Mon Feb 29 2016 Robbie Harwood <rharwood@redhat.com> - 1.14.1-1
 - New rawhide, new upstream version
@@ -1315,7 +1852,7 @@ exit 0
 
 * Mon Feb 22 2016 Robbie Harwood <rharwood@redhat.com> - 1.14-23
 - Fix log file permissions patch with our selinux
-- Resolves: #1309421
+  Resolves: rhbz#1309421
 
 * Fri Feb 19 2016 Robbie Harwood <rharwood@redhat.com> - 1.14-22
 - Backport my interposer fixes from upstream
@@ -1324,7 +1861,7 @@ exit 0
 * Tue Feb 16 2016 Robbie Harwood <rharwood@redhat.com> - 1.14-21
 - Adjust dependency on crypto-polices to be just the file we want
 - Patch courtesy of lslebodn
-- Resolves: #1308984
+  Resolves: rhbz#1308984
 
 * Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.14-20
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
@@ -1332,21 +1869,21 @@ exit 0
 * Thu Jan 28 2016 Robbie Harwood <rharwood@redhat.com> - 1.14-19
 - Replace _kadmin/_kprop with systemd macros
 - Remove traces of upstart from fedora package per policy
-- Resolves: #1290185
+  Resolves: rhbz#1290185
 
 * Wed Jan 27 2016 Robbie Harwood <rharwood@redhat.com> - 1.14-18
 - Fix CVE-2015-8629, CVE-2015-8630, CVE-2015-8631
 
 * Thu Jan 21 2016 Robbie Harwood <rharwood@redhat.com> - 1.14-17
 - Make krb5kdc.log not world-readable by default
-- Resolves: #1276484
+  Resolves: rhbz#1276484
 
 * Thu Jan 21 2016 Robbie Harwood <rharwood@redhat.com> - 1.14-16
 - Allow verification of attributes on krb5.conf
 
 * Wed Jan 20 2016 Robbie Harwood <rharwood@redhat.com> - 1.14-15
 - Use "new" systemd macros for service handling.  (Thanks vpavlin!)
-- Resolves: #850399
+  Resolves: rhbz#850399
 
 * Wed Jan 20 2016 Robbie Harwood <rharwood@redhat.com> - 1.14-14
 - Remove WITH_NSS macro (always false)
@@ -1356,13 +1893,13 @@ exit 0
 
 * Fri Jan 08 2016 Robbie Harwood <rharwood@redhat.com> - 1.14-13
 - Backport fix for chrome crash in spnego_gss_inquire_context
-- Resolves: #1295893
+  Resolves: rhbz#1295893
 
 * Wed Dec 16 2015 Robbie Harwood <rharwood@redhat.com> - 1.14-12
 - Backport patch to fix mechglue for gss_inqure_attrs_for_mech()
 
 * Thu Dec 03 2015 Robbie Harwood <rharwood@redhat.com> - 1.14-11
-- Backport interposer fix (#1284985)
+- Backport interposer fix (rhbz#1284985)
 - Drop workaround pwsize initialization patch (gcc has been fixed)
 
 * Tue Nov 24 2015 Robbie Harwood <rharwood@redhat.com> - 1.14-10
@@ -1397,7 +1934,7 @@ exit 0
 - New upstream beta version
 
 * Thu Oct 08 2015 Robbie Harwood <rharwood@redhat.com> - 1.13.2-13
-- Work around KDC client prinicipal in referrals issue (#1259844)
+- Work around KDC client prinicipal in referrals issue (rhbz#1259844)
 
 * Thu Oct 01 2015 Robbie Harwood <rharwood@redhat.com> - 1.13.2-12
 - Enable building with bad system /etc/krb5.conf
@@ -1410,7 +1947,7 @@ exit 0
 - Nix /usr/share/krb5.conf.d to reduce complexity
 
 * Wed Sep 23 2015 Robbie Harwood <rharwood@redhat.com> - 1.13.2-9
-- Depend on crypto-policies which provides /etc/krb5.conf.d (#1225792)
+- Depend on crypto-policies which provides /etc/krb5.conf.d (rhbz#1225792)
 
 * Thu Sep 10 2015 Robbie Harwood <rharwood@redhat.com> - 1.13.2-8
 - Remove dependency on systemd-sysv which is no longer needed for fedora > 20
@@ -1419,7 +1956,7 @@ exit 0
 
 * Thu Sep 10 2015 Robbie Harwood <rharwood@redhat.com> - 1.13.2-7
 - Support config snippets in /etc/krb5.conf.d/ and /usr/share/krb5.conf.d/
-  (#1225792, #1146370, #1145808)
+  (rhbz#1225792, rhbz#1146370, rhbz#1145808)
 
 * Thu Jun 25 2015 Roland Mainz <rmainz@redhat.com> - 1.13.2-6
 - Use system nss_wrapper and socket_wrapper for testing.
@@ -1427,8 +1964,8 @@ exit 0
 
 * Thu Jun 25 2015 Roland Mainz <rmainz@redhat.com> - 1.13.2-5
 - Remove Zanata test glue and related workarounds
-  - Bug #1234292 ("IPA server cannot be run in container due to incorrect /usr/sbin/_kadmind")
-  - Bug #1234326 ("krb5-server introduces new rpm dependency on ksh")
+  - rhbz#1234292 ("IPA server cannot be run in container due to incorrect /usr/sbin/_kadmind")
+  - rhbz#1234326 ("krb5-server introduces new rpm dependency on ksh")
 
 * Thu Jun 18 2015 Roland Mainz <rmainz@redhat.com> - 1.13.2-4
 - Fix dependicy on binfmt.service
@@ -1437,12 +1974,12 @@ exit 0
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
 
 * Tue Jun 2 2015 Roland Mainz <rmainz@redhat.com> - 1.13.2-2
-- Add patch to fix Redhat Bug #1227542 ("[SELinux] AVC denials may appear
+- Add patch to fix Redhat rhbz#1227542 ("[SELinux] AVC denials may appear
   when kadmind starts"). The issue was caused by an unneeded |htons()|
   which triggered SELinux AVC denials due to the "random" port usage.
 
 * Thu May 21 2015 Roland Mainz <rmainz@redhat.com> - 1.13.2-1
-- Add fix for RedHat Bug #1164304 ("Upstream unit tests loads
+- Add fix for RedHat rhbz#1164304 ("Upstream unit tests loads
   the installed shared libraries instead the ones from the build")
 
 * Thu May 14 2015 Roland Mainz <rmainz@redhat.com> - 1.13.2-0
@@ -1453,7 +1990,7 @@ exit 0
 - Minor spec cleanup
 
 * Mon May 4 2015 Roland Mainz <rmainz@redhat.com> - 1.13.1-4
-- fix for CVE-2015-2694 (#1216133) "requires_preauth bypass
+- fix for CVE-2015-2694 (rhbz#1216133) "requires_preauth bypass
   in PKINIT-enabled KDC".
   In MIT krb5 1.12 and later, when the KDC is configured with
   PKINIT support, an unauthenticated remote attacker can
@@ -1463,13 +2000,13 @@ exit 0
   dictionary attack against the user's password.
 
 * Wed Mar 25 2015 Roland Mainz <rmainz@redhat.com> - 1.13.1-3
-- Add temporay workaround for RH bug #1204646 ("krb5-config
+- Add temporay workaround for RH rhbz#1204646 ("krb5-config
   returns wrong -specs path") which modifies krb5-config post
   build so that development of krb5 dependicies gets unstuck.
   This MUST be removed before rawhide becomes F23 ...
 
 * Thu Mar 19 2015 Roland Mainz <rmainz@redhat.com> - 1.13.1-2
-- fix for CVE-2014-5355 (#1193939) "krb5: unauthenticated
+- fix for CVE-2014-5355 (rhbz#1193939) "krb5: unauthenticated
   denial of service in recvauth_common() and others"  
 
 * Fri Feb 13 2015 Roland Mainz <rmainz@redhat.com> - 1.13.1-1
@@ -1480,13 +2017,13 @@ exit 0
 - Minor spec cleanup
 
 * Wed Feb 4 2015 Roland Mainz <rmainz@redhat.com> - 1.13-8
-- fix for CVE-2014-5352 (#1179856) "gss_process_context_token()
+- fix for CVE-2014-5352 (rhbz#1179856) "gss_process_context_token()
   incorrectly frees context (MITKRB5-SA-2015-001)"
-- fix for CVE-2014-9421 (#1179857) "kadmind doubly frees partial
+- fix for CVE-2014-9421 (rhbz#1179857) "kadmind doubly frees partial
   deserialization results (MITKRB5-SA-2015-001)"
-- fix for CVE-2014-9422 (#1179861) "kadmind incorrectly
+- fix for CVE-2014-9422 (rhbz#1179861) "kadmind incorrectly
   validates server principal name (MITKRB5-SA-2015-001)"
-- fix for CVE-2014-9423 (#1179863) "libgssrpc server applications
+- fix for CVE-2014-9423 (rhbz#1179863) "libgssrpc server applications
   leak uninitialized bytes (MITKRB5-SA-2015-001)"
 
 * Wed Feb 4 2015 Roland Mainz <rmainz@redhat.com> - 1.13-7
@@ -1498,17 +2035,17 @@ exit 0
 - Support KDC_ERR_MORE_PREAUTH_DATA_REQUIRED (RT#8063)
 
 * Mon Jan 26 2015 Roland Mainz <rmainz@redhat.com> - 1.13-5
-- fix for kinit -C loops (#1184629, MIT/krb5 issue 243, "Do not
+- fix for kinit -C loops (rhbz#1184629, MIT/krb5 issue 243, "Do not
   loop on principal unknown errors").
 - Added "python-sphinx-latex" to the build requirements
   to fix build failures on F22 machines.
 
 * Thu Dec 18 2014 Roland Mainz <rmainz@redhat.com> - 1.13-4
-- fix for CVE-2014-5354 (#1174546) "krb5: NULL pointer
+- fix for CVE-2014-5354 (rhbz#1174546) "krb5: NULL pointer
   dereference when using keyless entries"  
 
 * Wed Dec 17 2014 Roland Mainz <rmainz@redhat.com> - 1.13-3
-- fix for CVE-2014-5353 (#1174543) "Fix LDAP misused policy
+- fix for CVE-2014-5353 (rhbz#1174543) "Fix LDAP misused policy
   name crash"  
 
 * Wed Oct 29 2014 Roland Mainz <rmainz@redhat.com> - 1.13-2
@@ -1518,18 +2055,18 @@ exit 0
 
 * Wed Oct 29 2014 Roland Mainz <rmainz@redhat.com> - 1.13-1
 - Update from krb5-1.13-alpha1 to final krb5-1.13
-- Removed patch for CVE-2014-5351 (#1145425) "krb5: current
+- Removed patch for CVE-2014-5351 (rhbz#1145425) "krb5: current
   keys returned when randomizing the keys for a service principal" -
   now part of upstream sources
-- Use patch for glibc |eventfd()| prototype mismatch (#1147887) only
+- Use patch for glibc |eventfd()| prototype mismatch (rhbz#1147887) only
   for Fedora > 20
 
 * Tue Sep 30 2014 Roland Mainz <rmainz@redhat.com> - 1.13-0.alpha1.3
 - fix build failure caused by change of prototype for glibc
-  |eventfd()| (#1147887)
+  |eventfd()| (rhbz#1147887)
 
 * Mon Sep 29 2014 Roland Mainz <rmainz@redhat.com> - 1.13-0.alpha1.3
-- fix for CVE-2014-5351 (#1145425) "krb5: current keys returned when
+- fix for CVE-2014-5351 (rhbz#1145425) "krb5: current keys returned when
   randomizing the keys for a service principal"
 
 * Mon Sep  8 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.13-0.alpha1.3
@@ -1545,7 +2082,7 @@ exit 0
 
 * Wed Aug 20 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-3
 - pull in upstream fix for an incorrect check on the value returned by a
-  strdup() call (#1132062)
+  strdup() call (rhbz#1132062)
 
 * Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.12.2-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
@@ -1553,7 +2090,7 @@ exit 0
 * Fri Aug 15 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-1
 - update to 1.12.2
   - drop patch for RT#7820, fixed in 1.12.2
-  - drop patch for #231147, fixed as RT#3277 in 1.12.2
+  - drop patch for rhbz#231147, fixed as RT#3277 in 1.12.2
   - drop patch for RT#7818, fixed in 1.12.2
   - drop patch for RT#7836, fixed in 1.12.2
   - drop patch for RT#7858, fixed in 1.12.2
@@ -1564,7 +2101,7 @@ exit 0
   - drop patch for CVE-2014-4344, included in 1.12.2
   - drop patch for CVE-2014-4345, included in 1.12.2
 - replace older proposed changes for ksu with backports of the changes
-  after review and merging upstream (#1015559, #1026099, #1118347)
+  after review and merging upstream (rhbz#1015559, rhbz#1026099, rhbz#1118347)
 
 * Thu Aug  7 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-14
 - incorporate fix for MITKRB5-SA-2014-001 (CVE-2014-4345)
@@ -1575,21 +2112,21 @@ exit 0
 
 * Wed Jul 16 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-12
 - gssapi: pull in proposed fix for a double free in initiators (David
-  Woodhouse, CVE-2014-4343, #1117963)
+  Woodhouse, CVE-2014-4343, rhbz#1117963)
 
 * Sat Jul 12 2014 Tom Callaway <spot@fedoraproject.org> - 1.12.1-11
 - fix license handling
 
 * Mon Jul  7 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-10
 - pull in fix for denial of service by injection of malformed GSSAPI tokens
-  (CVE-2014-4341, CVE-2014-4342, #1116181)
+  (CVE-2014-4341, CVE-2014-4342, rhbz#1116181)
 
 * Tue Jun 24 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-9
 - pull in changes from upstream which add processing of the contents of
-  /etc/gss/mech.d/*.conf when loading GSS modules (#1102839)
+  /etc/gss/mech.d/*.conf when loading GSS modules (rhbz#1102839)
 
 * Thu Jun 12 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-8
-- pull in fix for building against tcl 8.6 (#1107061)
+- pull in fix for building against tcl 8.6 (rhbz#1107061)
 
 * Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.12.1-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
@@ -1601,14 +2138,14 @@ exit 0
 - spnego: pull in patch from master to restore preserving the OID of the
   mechanism the initiator requested when we have multiple OIDs for the same
   mechanism, so that we reply using the same mechanism OID and the initiator
-  doesn't get confused (#1066000, RT#7858)
+  doesn't get confused (rhbz#1066000, RT#7858)
 
 * Fri Feb  7 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-4
 - pull in patch from master to move the default directory which the KDC uses
   when computing the socket path for a local OTP daemon from the database
   directory (/var/kerberos/krb5kdc) to the newly-added run directory
   (/run/krb5kdc), in line with what we're expecting in 1.13 (RT#7859, more
-  of #1040056 as #1063905)
+  of rhbz#1040056 as rhbz#1063905)
 - add a tmpfiles.d configuration file to have /run/krb5kdc created at
   boot-time
 - own /var/run/krb5kdc
@@ -1618,12 +2155,12 @@ exit 0
 
 * Fri Jan 31 2014 Nalin Dahyabhai <nalin@redhat.com>
 - add currently-proposed changes to teach ksu about credential cache
-  collections and the default_ccache_name setting (#1015559,#1026099)
+  collections and the default_ccache_name setting (rhbz#1015559,rhbz#1026099)
 
 * Tue Jan 21 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-2
 - pull in multiple changes to allow replay caches to be added to a GSS
-  credential store as "rcache"-type credentials (RT#7818/#7819/#7836,
-  #1056078/#1056080)
+  credential store as "rcache"-type credentials (RT#7818/rhbz#7819/rhbz#7836,
+  rhbz#1056078/rhbz#1056080)
 
 * Fri Jan 17 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-1
 - update to 1.12.1
@@ -1636,11 +2173,11 @@ exit 0
   - drop patches for RT#7813 and RT#7815, included now
   - add patch to always retrieve the KDC time offsets from keyring caches,
     so that we don't mistakenly interpret creds as expired before their
-    time when our clock is ahead of the KDC's (RT#7820, #1030607)
+    time when our clock is ahead of the KDC's (RT#7820, rhbz#1030607)
 
 * Mon Jan 13 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12-11
 - update the PIC patch for iaesx86.s to not use ELF relocations to the version
-  that landed upstream (RT#7815, #1045699)
+  that landed upstream (RT#7815, rhbz#1045699)
 
 * Thu Jan  9 2014 Nalin Dahyabhai <nalin@redhat.com>
 - pass -Wl,--warn-shared-textrel to the compiler when we're creating shared
@@ -1655,16 +2192,16 @@ exit 0
   master
 - make a guess at making the 32-bit AES-NI implementation sufficiently
   position-independent to not require execmod permissions for libk5crypto
-  (more of #1045699)
+  (more of rhbz#1045699)
 
 * Thu Jan  2 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12-8
 - add patch from Dhiru Kholia for the AES-NI implementations to allow
   libk5crypto to be properly marked as not needing an executable stack
-  on arches where they're used (#1045699, and so many others)
+  on arches where they're used (rhbz#1045699, and so many others)
 
 * Thu Jan  2 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12-7
 - revert that last change for a bit while sorting out execstack when we
-  use AES-NI (#1045699)
+  use AES-NI (rhbz#1045699)
 
 * Thu Dec 19 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.12-6
 - add yasm as a build requirement for AES-NI support, on arches that have
@@ -1672,7 +2209,7 @@ exit 0
 
 * Thu Dec 19 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.12-5
 - pull in fix from master to make reporting of errors encountered by
-  the SPNEGO mechanism work better (RT#7045, part of #1043962)
+  the SPNEGO mechanism work better (RT#7045, part of rhbz#1043962)
 
 * Thu Dec 19 2013 Nalin Dahyabhai <nalin@redhat.com>
 - update a test wrapper to properly handle things that the new libkrad does,
@@ -1682,19 +2219,19 @@ exit 0
 - revise previous patch to initialize one more element
 
 * Wed Dec 18 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.12-3
-- backport fixes to krb5_copy_context (RT#7807, #1044735/#1044739)
+- backport fixes to krb5_copy_context (RT#7807, rhbz#1044735/rhbz#1044739)
 
 * Wed Dec 18 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.12-2
 - pull in fix from master to return a NULL pointer rather than allocating
   zero bytes of memory if we read a zero-length input token (RT#7794, part of
-  #1043962)
+  rhbz#1043962)
 - pull in fix from master to ignore an empty token from an acceptor if
-  we've already finished authenticating (RT#7797, part of #1043962)
+  we've already finished authenticating (RT#7797, part of rhbz#1043962)
 - pull in fix from master to avoid a memory leak when a mechanism's
-  init_sec_context function fails (RT#7803, part of #1043962)
+  init_sec_context function fails (RT#7803, part of rhbz#1043962)
 - pull in fix from master to avoid a memory leak in a couple of error
   cases which could occur while obtaining acceptor credentials (RT#7805, part
-  of #1043962)
+  of rhbz#1043962)
 
 * Wed Dec 11 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.12-1
 - update to 1.12 final
@@ -1711,9 +2248,9 @@ exit 0
 
 * Mon Nov 18 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.4-2
 - pull in fix to store KDC time offsets in keyring credential caches (RT#7768,
-  #1030607)
+  rhbz#1030607)
 - pull in fix to set expiration times on credentials stored in keyring
-  credential caches (RT#7769, #1031724)
+  credential caches (RT#7769, rhbz#1031724)
 
 * Tue Nov 12 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.4-1
 - update to 1.11.4
@@ -1722,21 +2259,21 @@ exit 0
   - drop patch for CVE-2013-1418/CVE-2013-6800, included in 1.11.4
 
 * Tue Nov 12 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-31
-- switch to the simplified version of the patch for #1029110 (RT#7764)
+- switch to the simplified version of the patch for rhbz#1029110 (RT#7764)
 
 * Mon Nov 11 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-30
 - check more thoroughly for errors when resolving KEYRING ccache names of type
   "persistent", which should only have a numeric UID as the next part of the
-  name (#1029110)
+  name (rhbz#1029110)
 
 * Tue Nov  5 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-29
 - incorporate upstream patch for remote crash of KDCs which serve multiple
   realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800,
-  #1026997/#1031501)
+  rhbz#1026997/rhbz#1031501)
 
 * Mon Nov  4 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-28
 - drop patch to add additional access() checks to ksu - they add to breakage
-  when non-FILE: caches are in use (#1026099), shouldn't be resulting in any
+  when non-FILE: caches are in use (rhbz#1026099), shouldn't be resulting in any
   benefit, and clash with proposed changes to fix its cache handling
 
 * Tue Oct 22 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-27
@@ -1765,22 +2302,22 @@ exit 0
 - BuildRequires: pkgconfig, since configure uses it
 
 * Wed Oct 16 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-26
-- create and own /etc/gss (#1019937)
+- create and own /etc/gss (rhbz#1019937)
 
 * Tue Oct 15 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-25
 - pull up fix for importing previously-exported credential caches in the
-  gssapi library (RT# 7706, #1019420)
+  gssapi library (RT# 7706, rhbz#1019420)
 
 * Mon Oct 14 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-24
 - backport the callback to use the libkrb5 prompter when we can't load PEM
-  files for PKINIT (RT#7590, includes part of #965721/#1016690)
-- extract the rest of the fix #965721/#1016690 from the changes for RT#7680
+  files for PKINIT (RT#7590, includes part of rhbz#965721/rhbz#1016690)
+- extract the rest of the fix rhbz#965721/rhbz#1016690 from the changes for RT#7680
 
 * Mon Oct 14 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-23
-- fix trigger scriptlet's invocation of sed (#1016945)
+- fix trigger scriptlet's invocation of sed (rhbz#1016945)
 
 * Fri Oct  4 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-22
-- rebuild with keyutils 1.5.8 (part of #1012043)
+- rebuild with keyutils 1.5.8 (part of rhbz#1012043)
 
 * Wed Oct  2 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-21
 - switch to the version of persistent-keyring that was just merged to
@@ -1790,7 +2327,7 @@ exit 0
 * Mon Sep 30 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-20
 - pull up fix for not calling a kdb plugin's check-transited-path
   method before calling the library's default version, which only knows
-  how to read what's in the configuration file (RT#7709, #1013664)
+  how to read what's in the configuration file (RT#7709, rhbz#1013664)
 
 * Thu Sep 26 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-19
 - configure --without-krb5-config so that we don't pull in the old default
@@ -1801,7 +2338,7 @@ exit 0
 - fix broken dependency on awk (should be gawk, rdieter)
 
 * Wed Sep 25 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-17
-- add missing dependency on newer keyutils-libs (#1012034)
+- add missing dependency on newer keyutils-libs (rhbz#1012034)
 
 * Tue Sep 24 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-16
 - back out setting default_ccache_name to the new default for now, resetting
@@ -1809,11 +2346,11 @@ exit 0
 
 * Mon Sep 23 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-15
 - add explicit build-time dependency on a version of keyutils that's new
-  enough to include keyctl_get_persistent() (more of #991148)
+  enough to include keyctl_get_persistent() (more of rhbz#991148)
 
 * Thu Sep 19 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-14
 - incorporate Simo's updated backport of his updated persistent-keyring changes
-  (more of #991148)
+  (more of rhbz#991148)
 
 * Fri Sep 13 2013 Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-13
 - don't break during %%check when the session keyring is revoked
@@ -1827,17 +2364,17 @@ exit 0
 
 * Mon Sep  9 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.3-11
 - don't let comments intended for one scriptlet become part of the "script"
-  that gets passed to ldconfig as part of another one (Mattias Ellert, #1005675)
+  that gets passed to ldconfig as part of another one (Mattias Ellert, rhbz#1005675)
 
 * Fri Sep  6 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.3-10
-- incorporate Simo's backport of his persistent-keyring changes (#991148)
+- incorporate Simo's backport of his persistent-keyring changes (rhbz#991148)
 - restore build-time default DEFCCNAME on Fedora 21 and later and EL, and
   instead set default_ccache_name in the default krb5.conf's [libdefaults]
-  section (#991148)
+  section (rhbz#991148)
 - on releases where we expect krb5.conf to be configured with a
   default_ccache_name, add it whenever we upgrade from an older version of
   the package that wouldn't have included it in its default configuration
-  file (#991148)
+  file (rhbz#991148)
 
 * Fri Aug 23 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.3-9
 - take another stab at accounting for UnversionedDocdirs for the -libs
@@ -1852,7 +2389,7 @@ exit 0
   of files which dictate particular exit codes before exec'ing the actual
   binaries, instead of trying to use ConditionPathExists in the unit files
   to accomplish that, so that we exit with failure properly when what we
-  expect isn't actually in effect on the system (#800343)
+  expect isn't actually in effect on the system (rhbz#800343)
 
 * Mon Jul 29 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.3-7
 - attempt to account for UnversionedDocdirs for the -libs subpackage
@@ -1864,11 +2401,11 @@ exit 0
 
 * Mon Jul 22 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.3-5
 - pull up changes to allow GSSAPI modules to provide more functions
-  (RT#7682, #986564/#986565)
+  (RT#7682, rhbz#986564/rhbz#986565)
 
 * Fri Jul 19 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.3-4
 - use (a bundled, for now, copy of) nss_wrapper to let us run some of the
-  self-tests at build-time in more places than we could previously (#978756)
+  self-tests at build-time in more places than we could previously (rhbz#978756)
 - cover inconsistencies in whether or not there's a local caching nameserver
   that's willing to answer when the build environment doesn't have a
   resolver configuration, so that nss_wrapper's faking of the local
@@ -1876,23 +2413,23 @@ exit 0
 
 * Mon Jul  1 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.3-3
 - specify dependencies on the same arch of krb5-libs by using the %%{?_isa}
-  suffix, to avoid dragging 32-bit libraries onto 64-bit systems (#980155)
+  suffix, to avoid dragging 32-bit libraries onto 64-bit systems (rhbz#980155)
 
 * Thu Jun 13 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.3-2
 - special-case /run/user/0, attempting to create it when resolving a
   directory cache below it fails due to ENOENT and we find that it doesn't
   already exist, either, before attempting to create the directory cache
-  (maybe helping, maybe just making things more confusing for #961235)
+  (maybe helping, maybe just making things more confusing for rhbz#961235)
 
 * Tue Jun  4 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.3-1
 - update to 1.11.3
   - drop patch for RT#7605, fixed in this release
   - drop patch for CVE-2002-2443, fixed in this release
   - drop patch for RT#7369, fixed in this release
-- pull upstream fix for breaking t_skew.py by adding the patch for #961221
+- pull upstream fix for breaking t_skew.py by adding the patch for rhbz#961221
 
 * Fri May 31 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.2-10
-- respin with updated version of patch for RT#7650 (#969331)
+- respin with updated version of patch for RT#7650 (rhbz#969331)
 
 * Thu May 30 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.2-9
 - don't forget to set the SELinux label when creating the directory for
@@ -1908,22 +2445,22 @@ exit 0
 
 * Tue May 28 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.2-7
 - backport fix for not being able to verify the list of transited realms
-  in GSS acceptors (RT#7639, #959685)
+  in GSS acceptors (RT#7639, rhbz#959685)
 - backport fix for not being able to pass an empty password to the
-  get-init-creds APIs and have them actually use it (RT#7642, #960001)
+  get-init-creds APIs and have them actually use it (RT#7642, rhbz#960001)
 - add backported proposed fix to use the unauthenticated server time
   as the basis for computing the requested credential expiration times,
   rather than the client's idea of the current time, which could be
-  significantly incorrect (#961221)
+  significantly incorrect (rhbz#961221)
 
 * Tue May 21 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.2-6
 - pull in upstream fix to start treating a KRB5CCNAME value that begins
   with DIR:: the same as it would a DIR: value with just one ccache file
-  in it (RT#7172, #965574)
+  in it (RT#7172, rhbz#965574)
 
 * Mon May 13 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.2-5
 - pull up fix for UDP ping-pong flaw in kpasswd service (CVE-2002-2443,
-  #962531,#962534)
+  rhbz#962531,rhbz#962534)
 
 * Mon Apr 29 2013 Nathaniel McCallum <npmccallum@redhat.com> 1.11.2-4
 - Update otp patches
@@ -1943,11 +2480,11 @@ exit 0
   - drop pulled in patch for RT#7586, included in this release
   - drop pulled in patch for RT#7592, included in this release
 - pull in fix for keeping track of the message type when parsing FAST requests
-  in the KDC (RT#7605, #951843) (also #951965)
+  in the KDC (RT#7605, rhbz#951843) (also rhbz#951965)
 
 * Fri Apr 12 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.1-9
 - move the compiled-in default ccache location from the previous default of
-  FILE:/tmp/krb5cc_%%{uid} to DIR:/run/user/%%{uid}/krb5cc (part of #949588)
+  FILE:/tmp/krb5cc_%%{uid} to DIR:/run/user/%%{uid}/krb5cc (part of rhbz#949588)
 
 * Tue Apr 09 2013 Nathaniel McCallum <npmccallum@redhat.com> - 1.11.1-8
 - Update otp backport patches (libk5radius => libkrad)
@@ -1968,8 +2505,8 @@ exit 0
 * Tue Mar 26 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.1-5
 - pull up Simo's patch to mark the correct mechanism on imported GSSAPI
   contexts (RT#7592)
-- go back to using reconf to run autoconf and autoheader (part of #925640)
-- add temporary patch to use newer config.guess/config.sub (more of #925640)
+- go back to using reconf to run autoconf and autoheader (part of rhbz#925640)
+- add temporary patch to use newer config.guess/config.sub (more of rhbz#925640)
 
 * Mon Mar 18 2013 Nalin Dahyabhai <nalin@redhat.com>
 - fix a version comparison to expect newer texlive build requirements when
@@ -1980,12 +2517,12 @@ exit 0
 - Add otp support
 
 * Thu Feb 28 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.1-3
-- fix a memory leak when acquiring credentials using a keytab (RT#7586, #911110)
+- fix a memory leak when acquiring credentials using a keytab (RT#7586, rhbz#911110)
 
 * Wed Feb 27 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.1-2
-- prebuild PDF docs to reduce multilib differences (internal tooling, #884065)
+- prebuild PDF docs to reduce multilib differences (internal tooling, rhbz#884065)
 - drop the kerberos-iv portreserve file, and drop the rest on systemd systems
-- escape uses of macros in comments (more of #884065)
+- escape uses of macros in comments (more of rhbz#884065)
 
 * Mon Feb 25 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.1-1
 - update to 1.11.1
@@ -1993,7 +2530,7 @@ exit 0
     wrapper in the client transmit functions
 
 * Fri Feb  8 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11-2
-- set "rdns = false" in the default krb5.conf (#908323,#908324)
+- set "rdns = false" in the default krb5.conf (rhbz#908323,rhbz#908324)
 
 * Tue Dec 18 2012 Nalin Dahyabhai <nalin@redhat.com> 1.11-1
 - update to 1.11 release
@@ -2003,7 +2540,7 @@ exit 0
 
 * Thu Dec 13 2012 Nalin Dahyabhai <nalin@redhat.com>
 - when building with our bundled copy of libverto, package it in with -libs
-  rather than with -server (#886049)
+  rather than with -server (rhbz#886049)
 
 * Wed Nov 21 2012 Nalin Dahyabhai <nalin@redhat.com> 1.11-0.beta1.0
 - update to 1.11 beta 1
@@ -2025,9 +2562,9 @@ exit 0
 
 * Thu Nov 15 2012 Nalin Dahyabhai <nalin@redhat.com>
 - update to 1.11 alpha 1
-  - drop backported patch for RT #7406
-  - drop backported patch for RT #7407
-  - drop backported patch for RT #7408
+  - drop backported patch for RT rhbz#7406
+  - drop backported patch for RT rhbz#7407
+  - drop backported patch for RT rhbz#7408
   - the new docs system generates PDFs, so stop including them as sources
   - drop backported patch to allow deltat.y to build with the usual
     warning flags and the current gcc
@@ -2051,27 +2588,27 @@ exit 0
   %%{?_rawbuild} builds (zmraz)
 
 * Tue Sep 25 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10.3-6
-- actually pull up the patch for RT#7063, and not some other ticket (#773496)
+- actually pull up the patch for RT#7063, and not some other ticket (rhbz#773496)
 
 * Mon Sep 10 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10.3-5
 - add patch based on one from Filip Krska to not call poll() with a negative
-  timeout when the caller's intent is for us to just stop calling it (#838548)
+  timeout when the caller's intent is for us to just stop calling it (rhbz#838548)
 
 * Fri Sep  7 2012 Nalin Dahyabhai <nalin@redhat.com>
 - on EL6, conflict with libsmbclient before 3.5.10-124, which is when it
-  stopped linking with a symbol which we no longer export (#771687)
+  stopped linking with a symbol which we no longer export (rhbz#771687)
 - pull up patch for RT#7063, in which not noticing a prompt for a long
   time throws the client library's idea of the time difference between it
-  and the KDC really far out of whack (#773496)
+  and the KDC really far out of whack (rhbz#773496)
 - add a backport of more patches to set the client's list of supported enctypes
   when using a keytab to be the list of types of keys in the keytab, plus the
   list of other types the client supports but for which it doesn't have keys,
   in that order, so that KDCs have a better chance of being able to issue
-  tickets with session keys of types that the client can use (#837855)
+  tickets with session keys of types that the client can use (rhbz#837855)
 
 * Thu Sep  6 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10.3-4
 - cut down the number of times we load SELinux labeling configuration from
-  a minimum of two times to actually one (more of #845125)
+  a minimum of two times to actually one (more of rhbz#845125)
 
 * Thu Aug 30 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10.3-3
 - backport patch to disable replay detection in krb5_verify_init_creds()
@@ -2089,7 +2626,7 @@ exit 0
 * Thu Aug  2 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10.2-7
 - selinux: hang on to the list of selinux contexts, freeing and reloading
   it only when the file we read it from is modified, freeing it when the
-  shared library is being unloaded (#845125)
+  shared library is being unloaded (rhbz#845125)
 
 * Thu Aug  2 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10.2-6
 - go back to not messing with library file paths on Fedora 17: it breaks
@@ -2099,7 +2636,7 @@ exit 0
 * Tue Jul 31 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10.2-5
 - add upstream patch to fix freeing an uninitialized pointer and dereferencing
   another uninitialized pointer in the KDC (MITKRB5-SA-2012-001, CVE-2012-1014
-  and CVE-2012-1015, #844779 and #844777)
+  and CVE-2012-1015, rhbz#844779 and rhbz#844777)
 - fix a thinko in whether or not we mess around with devel .so symlinks on
   systems without a separate /usr (sbose)
 
@@ -2125,7 +2662,7 @@ exit 0
 - add a backport of Stef's patch to set the client's list of supported
   enctypes to match the types of keys that we have when we are using a
   keytab to try to get initial credentials, so that a KDC won't send us
-  an AS reply that we can't encrypt (RT#2131, #748528)
+  an AS reply that we can't encrypt (RT#2131, rhbz#748528)
 - don't shuffle around any shared libraries on releases with no-separate-/usr,
   since /usr/lib is the same place as /lib
 - add explicit buildrequires: on 'hostname', for the tests, on systems where
@@ -2134,15 +2671,15 @@ exit 0
 
 * Mon May  7 2012 Nalin Dahyabhai <nalin@redhat.com>
 - skip the setfscreatecon() if fopen() is passed "rb" as the open mode (part
-  of #819115)
+  of rhbz#819115)
 
 * Tue May  1 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10.1-3
 - have -server require /usr/share/dict/words, which we set as the default
-  dict_file in kdc.conf (#817089)
+  dict_file in kdc.conf (rhbz#817089)
 
 * Tue Mar 20 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10.1-2
-- change back dns_lookup_kdc to the default setting (Stef Walter, #805318)
-- comment out example.com examples in default krb5.conf (Stef Walter, #805320)
+- change back dns_lookup_kdc to the default setting (Stef Walter, rhbz#805318)
+- comment out example.com examples in default krb5.conf (Stef Walter, rhbz#805320)
 
 * Fri Mar  9 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10.1-1
 - update to 1.10.1
@@ -2153,7 +2690,7 @@ exit 0
 * Wed Mar  7 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10-5
 - when removing -workstation, remove our files from the info index while
   the file is still there, in %%preun, rather than %%postun, and use the
-  compressed file's name (#801035)
+  compressed file's name (rhbz#801035)
 
 * Tue Feb 21 2012 Nathaniel McCallum <nathaniel@natemccallum.com> - 1.10-4
 - Fix string RPC ACLs (RT#7093); CVE-2012-1012
@@ -2163,7 +2700,7 @@ exit 0
 
 * Mon Jan 30 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10-2
 - add patch to accept keytab entries with vno==0 as matches when we're
-  searching for an entry with a specific name/kvno (#230382/#782211,RT#3349)
+  searching for an entry with a specific name/kvno (rhbz#230382/rhbz#782211,RT#3349)
 
 * Mon Jan 30 2012 Nalin Dahyabhai <nalin@redhat.com> 1.10-1
 - update to 1.10 final
@@ -2188,21 +2725,21 @@ exit 0
 
 * Tue Dec 13 2011 Nalin Dahyabhai <nalin@redhat.com> 1.10-0.alpha1.3
 - pull in patch for RT#7046: tag a ccache containing credentials obtained via
-  S4U2Proxy with the principal name of the proxying principal (part of #761317)
+  S4U2Proxy with the principal name of the proxying principal (part of rhbz#761317)
   so that the default principal name can be set to that of the client for which
   it is proxying, which results in the ccache looking more normal to consumers
   of the ccache that don't care that there's proxying going on
 - pull in patch for RT#7047: allow tickets obtained via S4U2Proxy to be cached
-  (more of #761317)
+  (more of rhbz#761317)
 - pull in patch for RT#7048: allow PAC verification to only bother trying to
-  verify the signature with keys that it's given (still more of #761317)
+  verify the signature with keys that it's given (still more of rhbz#761317)
 
 * Tue Dec  6 2011 Nalin Dahyabhai <nalin@redhat.com> 1.10-0.alpha1.2
 - apply upstream patch to fix a null pointer dereference when processing
-  TGS requests (CVE-2011-1530, #753748)
+  TGS requests (CVE-2011-1530, rhbz#753748)
 
 * Wed Nov 30 2011 Nalin Dahyabhai <nalin@redhat.com> 1.10-0.alpha1.1
-- correct a bug in the fix for #754001 so that the file creation context is
+- correct a bug in the fix for rhbz#754001 so that the file creation context is
   consistently reset
 
 * Tue Nov 15 2011 Nalin Dahyabhai <nalin@redhat.com> 1.10-0.alpha1.0
@@ -2217,27 +2754,27 @@ exit 0
   should be able to run inside of the build system without issue
 
 * Wed Oct 26 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.9.1-19
-- Rebuilt for glibc bug#747377
+- Rebuilt for glibc rhbz#747377
 
 * Tue Oct 18 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-18
 - apply upstream patch to fix a null pointer dereference with the LDAP kdb
-  backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb
+  backend (CVE-2011-1527, rhbz#744125), an assertion failure with multiple kdb
   backends (CVE-2011-1528), and a null pointer dereference with multiple kdb
-  backends (CVE-2011-1529) (#737711)
+  backends (CVE-2011-1529) (rhbz#737711)
 
 * Thu Oct 13 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-17
 - pull in patch from trunk to rename krb5int_pac_sign() to krb5_pac_sign() and
-  make it public (#745533)
+  make it public (rhbz#745533)
 
 * Fri Oct  7 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-16
-- kadmin.service: fix #723723 again
+- kadmin.service: fix rhbz#723723 again
 - kadmin.service,krb5kdc.service: remove optional use of $KRB5REALM in command
   lines, because systemd parsing doesn't handle alternate value shell variable
   syntax
 - kprop.service: add missing Type=forking so that systemd doesn't assume simple
 - kprop.service: expect the ACL configuration to be there, not absent
 - handle a harder-to-trigger assertion failure that starts cropping up when we
-  exit the transmit loop on time (#739853)
+  exit the transmit loop on time (rhbz#739853)
 
 * Sun Oct  2 2011 Tom Callaway <spot@fedoraproject.org> 1.9.1-15
 - hardcode pid file as option in krb5kdc.service
@@ -2250,50 +2787,50 @@ exit 0
 
 * Tue Sep  6 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-12
 - pull in upstream patch for RT#6952, confusion following referrals for
-  cross-realm auth (#734341)
+  cross-realm auth (rhbz#734341)
 - pull in build-time deps for the tests
 
 * Thu Sep  1 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-11
-- switch to the upstream patch for #727829
+- switch to the upstream patch for rhbz#727829
 
 * Wed Aug 31 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-10
 - handle an assertion failure that starts cropping up when the patch for
-  using poll (#701446) meets servers that aren't running KDCs or against
-  which the connection fails for other reasons (#727829, #734172)
+  using poll (rhbz#701446) meets servers that aren't running KDCs or against
+  which the connection fails for other reasons (rhbz#727829, rhbz#734172)
 
 * Mon Aug  8 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-9
 - override the default build rules to not delete temporary y.tab.c files,
   so that they can be packaged, allowing debuginfo files which point to them
-  do so usefully (#729044)
+  do so usefully (rhbz#729044)
 
 * Fri Jul 22 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-8
-- build shared libraries with partial RELRO support (#723995)
+- build shared libraries with partial RELRO support (rhbz#723995)
 - filter out potentially multiple instances of -Wl,-z,relro from krb5-config
   output, now that it's in the buildroot's default LDFLAGS
 - pull in a patch to fix losing track of the replay cache FD, from SVN by
   way of Kevin Coffman
 
 * Wed Jul 20 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-7
-- kadmind.init: drop the attempt to detect no-database-present errors (#723723),
+- kadmind.init: drop the attempt to detect no-database-present errors (rhbz#723723),
   which is too fragile in cases where the database has been manually moved or
   is accessed through another kdb plugin
 
 * Tue Jul 19 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-6
 - backport fixes to teach libkrb5 to use descriptors higher than FD_SETSIZE
-  to talk to a KDC by using poll() if it's detected at compile-time (#701446,
+  to talk to a KDC by using poll() if it's detected at compile-time (rhbz#701446,
   RT#6905)
 
 * Thu Jun 23 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-5
 - pull a fix from SVN to try to avoid triggering a PTR lookup in getaddrinfo()
   during krb5_sname_to_principal(), and to let getaddrinfo() decide whether or
   not to ask for an IPv6 address based on the set of configured interfaces
-  (#717378, RT#6922)
+  (rhbz#717378, RT#6922)
 - pull a fix from SVN to use AI_ADDRCONFIG more often (RT#6923)
 
 * Mon Jun 20 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-4
 - apply upstream patch by way of Burt Holzman to fall back to a non-referral
   method in cases where we might be derailed by a KDC that rejects the
-  canonicalize option (for example, those from the RHEL 2.1 or 3 era) (#715074)
+  canonicalize option (for example, those from the RHEL 2.1 or 3 era) (rhbz#715074)
 
 * Tue Jun 14 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-3
 - pull a fix from SVN to get libgssrpc clients (e.g. kadmin) authenticating
@@ -2301,13 +2838,13 @@ exit 0
 
 * Tue Jun 14 2011 Nalin Dahyabhai <nalin@redhat.com>
 - incorporate a fix to teach the file labeling bits about when replay caches
-  are expunged (#576093)
+  are expunged (rhbz#576093)
 
 * Thu May 26 2011 Nalin Dahyabhai <nalin@redhat.com>
-- switch to the upstream patch for #707145
+- switch to the upstream patch for rhbz#707145
 
 * Wed May 25 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9.1-2
-- klist: don't trip over referral entries when invoked with -s (#707145,
+- klist: don't trip over referral entries when invoked with -s (rhbz#707145,
   RT#6915)
 
 * Fri May  6 2011 Nalin Dahyabhai <nalin@redhat.com>
@@ -2320,26 +2857,26 @@ exit 0
     CVE-2011-0282, CVE-2011-0283, CVE-2011-0284, CVE-2011-0285
 
 * Wed Apr 13 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9-9
-- kadmind: add upstream patch to fix free() on an invalid pointer (#696343,
+- kadmind: add upstream patch to fix free() on an invalid pointer (rhbz#696343,
   MITKRB5-SA-2011-004, CVE-2011-0285)
 
 * Mon Apr  4 2011 Nalin Dahyabhai <nalin@redhat.com>
 - don't discard the error code from an error message received in response
-  to a change-password request (#658871, RT#6893)
+  to a change-password request (rhbz#658871, RT#6893)
 
 * Fri Apr  1 2011 Nalin Dahyabhai <nalin@redhat.com>
 - override INSTALL_SETUID at build-time so that ksu is installed into
-  the buildroot with the right permissions (part of #225974)
+  the buildroot with the right permissions (part of rhbz#225974)
 
 * Fri Mar 18 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9-8
 - backport change from SVN to fix a computed-value-not-used warning in
-  kpropd (#684065)
+  kpropd (rhbz#684065)
 
 * Tue Mar 15 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9-7
 - turn off NSS as the backend for libk5crypto for now to work around its
-  DES string2key not working (#679012)
+  DES string2key not working (rhbz#679012)
 - add revised upstream patch to fix double-free in KDC while returning
-  typed-data with errors (MITKRB5-SA-2011-003, CVE-2011-0284, #674325)
+  typed-data with errors (MITKRB5-SA-2011-003, CVE-2011-0284, rhbz#674325)
 
 * Thu Feb 17 2011 Nalin Dahyabhai <nalin@redhat.com>
 - throw in a not-applied-by-default patch to try to make pkinit debugging
@@ -2352,14 +2889,14 @@ exit 0
 * Wed Feb  9 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9-5
 - krb5kdc init script: prototype some changes to do a quick spot-check
   of the TGS and kadmind keys and warn if there aren't any non-weak keys
-  on file for them (to flush out parts of #651466)
+  on file for them (to flush out parts of rhbz#651466)
 
 * Tue Feb  8 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9-4
 - add upstream patches to fix standalone kpropd exiting if the per-client
   child process exits with an error (MITKRB5-SA-2011-001), a hang or crash
   in the KDC when using the LDAP kdb backend, and an uninitialized pointer
-  use in the KDC (MITKRB5-SA-2011-002) (CVE-2010-4022, #664009,
-  CVE-2011-0281, #668719, CVE-2011-0282, #668726, CVE-2011-0283, #676126)
+  use in the KDC (MITKRB5-SA-2011-002) (CVE-2010-4022, rhbz#664009,
+  CVE-2011-0281, rhbz#668719, CVE-2011-0282, rhbz#668726, CVE-2011-0283, rhbz#676126)
 
 * Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.9-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
@@ -2370,11 +2907,11 @@ exit 0
 
 * Tue Feb  1 2011 Nalin Dahyabhai <nalin@redhat.com>
 - properly advertise that the kpropd init script now supports force-reload
-  (Zbysek Mraz, #630587)
+  (Zbysek Mraz, rhbz#630587)
 
 * Wed Jan 26 2011 Nalin Dahyabhai <nalin@redhat.com> 1.9-2
 - pkinit: when verifying signed data, use the CMS APIs for better
-  interoperability (#636985, RT#6851)
+  interoperability (rhbz#636985, RT#6851)
 
 * Wed Dec 22 2010 Nalin Dahyabhai <nalin@redhat.com> 1.9-1
 - update to 1.9 final
@@ -2394,56 +2931,56 @@ exit 0
 * Fri Nov  5 2010 Nalin Dahyabhai <nalin@redhat.com> 1.9-0.beta1.0
 - start moving to 1.9 with beta 1
   - drop patches for RT#5755, RT#6762, RT#6774, RT#6775
-  - drop no-longer-needed backport patch for #539423
+  - drop no-longer-needed backport patch for rhbz#539423
   - drop no-longer-needed patch for CVE-2010-1322
 - if WITH_NSS is set, built with --with-crypto-impl=nss (requires NSS 3.12.9)
 
 * Tue Oct  5 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.3-8
 - incorporate upstream patch to fix uninitialized pointer crash in the KDC's
-  authorization data handling (CVE-2010-1322, #636335)
+  authorization data handling (CVE-2010-1322, rhbz#636335)
 
 * Mon Oct  4 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.3-7
 - rebuild
 
 * Mon Oct  4 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.3-6
 - pull down patches from trunk to implement k5login_authoritative and
-  k5login_directory settings for krb5.conf (#539423)
+  k5login_directory settings for krb5.conf (rhbz#539423)
 
 * Wed Sep 29 2010 jkeating - 1.8.3-5
-- Rebuilt for gcc bug 634757
+- Rebuilt for gcc rhbz#634757
 
 * Wed Sep 15 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.3-4
 - fix reading of keyUsage extensions when attempting to select pkinit client
-  certs (part of #629022, RT#6775)
+  certs (part of rhbz#629022, RT#6775)
 - fix selection of pkinit client certs when one or more don't include a
-  subjectAltName extension (part of #629022, RT#6774)
+  subjectAltName extension (part of rhbz#629022, RT#6774)
 
 * Fri Sep  3 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.3-3
 - build with -fstack-protector-all instead of the default -fstack-protector,
-  so that we add checking to more functions (i.e., all of them) (#629950)
-- also link binaries with -Wl,-z,relro,-z,now (part of #629950)
+  so that we add checking to more functions (i.e., all of them) (rhbz#629950)
+- also link binaries with -Wl,-z,relro,-z,now (part of rhbz#629950)
 
 * Tue Aug 24 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.3-2
-- fix a logic bug in computing key expiration times (RT#6762, #627022)
+- fix a logic bug in computing key expiration times (RT#6762, rhbz#627022)
 
 * Wed Aug  4 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.3-1
 - update to 1.8.3
   - drop backports of fixes for gss context expiration and error table
     registration/deregistration mismatch
-  - drop patch for upstream #6750
+  - drop patch for upstream rhbz#6750
 
 * Wed Jul  7 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.2-3
 - tell krb5kdc and kadmind to create pid files, since they can
-- add logrotate configuration files for krb5kdc and kadmind (#462658)
-- fix parsing of the pidfile option in the KDC (upstream #6750)
+- add logrotate configuration files for krb5kdc and kadmind (rhbz#462658)
+- fix parsing of the pidfile option in the KDC (upstream rhbz#6750)
 
 * Mon Jun 21 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.2-2
 - libgssapi: pull in patch from svn to stop returning context-expired errors
-  when the ticket which was used to set up the context expires (#605366,
-  upstream #6739)
+  when the ticket which was used to set up the context expires (rhbz#605366,
+  upstream rhbz#6739)
 
 * Mon Jun 21 2010 Nalin Dahyabhai <nalin@redhat.com>
-- pull up fix for upstream #6745, in which the gssapi library would add the
+- pull up fix for upstream rhbz#6745, in which the gssapi library would add the
   wrong error table but subsequently attempt to unload the right one
 
 * Thu Jun 10 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.2-1
@@ -2455,8 +2992,8 @@ exit 0
 
 * Thu May 27 2010 Nalin Dahyabhai <nalin@redhat.com>
 - ksu: move session management calls to before we drop privileges, like
-  su does (#596887), and don't skip the PAM account check for root or the
-  same user (more of #540769)
+  su does (rhbz#596887), and don't skip the PAM account check for root or the
+  same user (more of rhbz#540769)
 
 * Mon May 24 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.1-6
 - make krb5-server-ldap also depend on the same version-release of krb5-libs,
@@ -2469,20 +3006,20 @@ exit 0
 
 * Tue May 18 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.1-5
 - add patch to correct GSSAPI library null pointer dereference which could be
-  triggered by malformed client requests (CVE-2010-1321, #582466)
+  triggered by malformed client requests (CVE-2010-1321, rhbz#582466)
 
 * Tue May  4 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.1-4
-- fix output of kprop's init script's "status" and "reload" commands (#588222)
+- fix output of kprop's init script's "status" and "reload" commands (rhbz#588222)
 
 * Tue Apr 20 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.1-3
-- incorporate patch to fix double-free in the KDC (CVE-2010-1320, #581922)
+- incorporate patch to fix double-free in the KDC (CVE-2010-1320, rhbz#581922)
 
 * Wed Apr 14 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.1-2
 - fix a typo in kerberos.ldif
 
 * Fri Apr  9 2010 Nalin Dahyabhai <nalin@redhat.com> 1.8.1-1
 - update to 1.8.1
-  - no longer need patches for #555875, #561174, #563431, RT#6661, CVE-2010-0628
+  - no longer need patches for rhbz#555875, rhbz#561174, rhbz#563431, RT#6661, CVE-2010-0628
 - replace buildrequires on tetex-latex with one on texlive-latex, which is
   the package that provides it now
 
@@ -2492,21 +3029,21 @@ exit 0
 * Thu Apr  8 2010 Nalin Dahyabhai <nalin@redhat.com>
 - drop patch to suppress key expiration warnings sent from the KDC in
   the last-req field, as the KDC is expected to just be configured to either
-  send them or not as a particular key approaches expiration (#556495)
+  send them or not as a particular key approaches expiration (rhbz#556495)
 
 * Tue Mar 23 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.8-5
-- add upstream fix for denial-of-service in SPNEGO (CVE-2010-0628, #576325)
+- add upstream fix for denial-of-service in SPNEGO (CVE-2010-0628, rhbz#576325)
 - kdc.conf: no more need to suggest keeping keys with v4-compatible salting
 
 * Fri Mar 19 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.8-4
 - remove the krb5-appl bits (the -workstation-clients and -workstation-servers
   subpackages) now that krb5-appl is its own package
-- replace our patch for #563431 (kpasswd doesn't fall back to guessing your
+- replace our patch for rhbz#563431 (kpasswd doesn't fall back to guessing your
   principal name using your user name if you don't have a ccache) with the
   one upstream uses
 
 * Fri Mar 12 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.8-3
-- add documentation for the ticket_lifetime option (#561174)
+- add documentation for the ticket_lifetime option (rhbz#561174)
 
 * Mon Mar  8 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.8-2
 - pull up patch to get the client libraries to correctly perform password
@@ -2526,10 +3063,10 @@ exit 0
 - fix a null pointer dereference and crash introduced in our PAM patch that
   would happen if ftpd was given the name of a user who wasn't known to the
   local system, limited to being triggerable by gssapi-authenticated clients by
-  the default xinetd config (Olivier Fourdan, #569472)
+  the default xinetd config (Olivier Fourdan, rhbz#569472)
 
 * Tue Mar  2 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-5
-- fix a regression (not labeling a kdb database lock file correctly, #569902)
+- fix a regression (not labeling a kdb database lock file correctly, rhbz#569902)
 
 * Thu Feb 25 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-4
 - move the package changelog to the end to match the usual style (jdennis)
@@ -2539,15 +3076,15 @@ exit 0
 
 * Wed Feb 17 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-3
 - pull up the change to make kpasswd's behavior better match the docs
-  when there's no ccache (#563431)
+  when there's no ccache (rhbz#563431)
 
 * Tue Feb 16 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-2
 - apply patch from upstream to fix KDC denial of service (CVE-2010-0283,
-  #566002)
+  rhbz#566002)
 
 * Wed Feb  3 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-1
 - update to 1.7.1
-  - don't trip AD lockout on wrong password (#542687, #554351)
+  - don't trip AD lockout on wrong password (rhbz#542687, rhbz#554351)
   - incorporates fixes for CVE-2009-4212 and CVE-2009-3295
   - fixes gss_krb5_copy_ccache() when SPNEGO is used
 - move sim_client/sim_server, gss-client/gss-server, uuclient/uuserver to
@@ -2557,7 +3094,7 @@ exit 0
   depends on -workstation which also includes them
 
 * Mon Jan 25 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7-23
-- tighten up default permissions on kdc.conf and kadm5.acl (#558343)
+- tighten up default permissions on kdc.conf and kadm5.acl (rhbz#558343)
 
 * Fri Jan 22 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7-22
 - use portreserve correctly -- portrelease takes the basename of the file
@@ -2566,47 +3103,47 @@ exit 0
 * Mon Jan 18 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7-21
 - suppress warnings of impending password expiration if expiration is more than
   seven days away when the KDC reports it via the last-req field, just as we
-  already do when it reports expiration via the key-expiration field (#556495)
+  already do when it reports expiration via the key-expiration field (rhbz#556495)
 - link with libtinfo rather than libncurses, when we can, in future RHEL
 
 * Fri Jan 15 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7-20
 - krb5_get_init_creds_password: check opte->flags instead of options->flags
-  when checking whether or not we get to use the prompter callback (#555875)
+  when checking whether or not we get to use the prompter callback (rhbz#555875)
 
 * Thu Jan 14 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7-19
 - use portreserve to make sure the KDC can always bind to the kerberos-iv
   port, kpropd can always bind to the krb5_prop port, and that kadmind can
-  always bind to the kerberos-adm port (#555279)
+  always bind to the kerberos-adm port (rhbz#555279)
 - correct inadvertent use of macros in the changelog (rpmlint)
 
 * Tue Jan 12 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7-18
 - add upstream patch for integer underflow during AES and RC4 decryption
-  (CVE-2009-4212), via Tom Yu (#545015)
+  (CVE-2009-4212), via Tom Yu (rhbz#545015)
 
 * Wed Jan  6 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7-17
 - put the conditional back for the -devel subpackage
-- back down to the earlier version of the patch for #551764; the backported
+- back down to the earlier version of the patch for rhbz#551764; the backported
   alternate version was incomplete
 
 * Tue Jan  5 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7-16
 - use %%global instead of %%define
 - pull up proposed patch for creating previously-not-there lock files for
-  kdb databases when 'kdb5_util' is called to 'load' (#551764)
+  kdb databases when 'kdb5_util' is called to 'load' (rhbz#551764)
 
 * Mon Jan  4 2010 Dennis Gregorovic <dgregor@redhat.com>
 - fix conditional for future RHEL
 
 * Mon Jan  4 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7-15
 - add upstream patch for KDC crash during referral processing (CVE-2009-3295),
-  via Tom Yu (#545002)
+  via Tom Yu (rhbz#545002)
 
 * Mon Dec 21 2009 Nalin Dahyabhai <nalin@redhat.com> - 1.7-14
-- refresh patch for #542868 from trunk
+- refresh patch for rhbz#542868 from trunk
 
 * Thu Dec 10 2009 Nalin Dahyabhai <nalin@redhat.com>
 - move man pages that live in the -libs subpackage into the regular
   %%{_mandir} tree where they'll still be found if that package is the
-  only one installed (#529319)
+  only one installed (rhbz#529319)
 
 * Wed Dec  9 2009 Nalin Dahyabhai <nalin@redhat.com> - 1.7-13
 - and put it back in
@@ -2615,14 +3152,14 @@ exit 0
 - back that last change out
 
 * Tue Dec  8 2009 Nalin Dahyabhai <nalin@redhat.com> - 1.7-12
-- try to make gss_krb5_copy_ccache() work correctly for spnego (#542868)
+- try to make gss_krb5_copy_ccache() work correctly for spnego (rhbz#542868)
 
 * Fri Dec  4 2009 Nalin Dahyabhai <nalin@redhat.com>
-- make krb5-config suppress CFLAGS output when called with --libs (#544391)
+- make krb5-config suppress CFLAGS output when called with --libs (rhbz#544391)
 
 * Thu Dec  3 2009 Nalin Dahyabhai <nalin@redhat.com> - 1.7-11
 - ksu: move account management checks to before we drop privileges, like
-  su does (#540769)
+  su does (rhbz#540769)
 - selinux: set the user part of file creation contexts to match the current
   context instead of what we looked up
 - configure with --enable-dns-for-realm instead of --enable-dns, which isn't
@@ -2630,7 +3167,7 @@ exit 0
 
 * Fri Nov 20 2009 Nalin Dahyabhai <nalin@redhat.com> - 1.7-10
 - move /etc/pam.d/ksu from krb5-workstation-servers to krb5-workstation,
-  where it's actually needed (#538703)
+  where it's actually needed (rhbz#538703)
 
 * Fri Oct 23 2009 Nalin Dahyabhai <nalin@redhat.com> - 1.7-9
 - add some conditional logic to simplify building on older Fedora releases
@@ -2641,11 +3178,11 @@ exit 0
 * Mon Sep 14 2009 Nalin Dahyabhai <nalin@redhat.com> - 1.7-8
 - specify the location of the subsystem lock when using the status() function
   in the kadmind and kpropd init scripts, so that we get the right error when
-  we're dead but have a lock file - requires initscripts 8.99 (#521772)
+  we're dead but have a lock file - requires initscripts 8.99 (rhbz#521772)
 
 * Tue Sep  8 2009 Nalin Dahyabhai <nalin@redhat.com>
 - if the init script fails to start krb5kdc/kadmind/kpropd because it's already
-  running (according to status()), return 0 (part of #521772)
+  running (according to status()), return 0 (part of rhbz#521772)
 
 * Mon Aug 24 2009 Nalin Dahyabhai <nalin@redhat.com> - 1.7-7
 - work around a compile problem with new openssl
@@ -2704,7 +3241,7 @@ exit 0
 - drop static build logic
 - drop pam_krb5-specific configuration from the default krb5.conf
 - drop only-use-v5 flags being passed to various things started by xinetd
-- put %%{krb5prefix}/sbin in everyone's path, too (#504525)
+- put %%{krb5prefix}/sbin in everyone's path, too (rhbz#504525)
 
 * Tue May 19 2009 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-106
 - add an auth stack to ksu's PAM configuration so that pam_setcred() calls
@@ -2728,7 +3265,7 @@ exit 0
 - add LSB-style init script info
 
 * Fri Apr 17 2009 Nalin Dahyabhai <nalin@redhat.com>
-- explicitly run the pdf generation script using sh (part of #225974)
+- explicitly run the pdf generation script using sh (part of rhbz#225974)
 
 * Tue Apr  7 2009 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-101
 - add patches for read overflow and null pointer dereference in the
@@ -2744,14 +3281,14 @@ exit 0
 - use triggeruns to properly shut down and disable krb524d when -server and
   -workstation-servers gets upgraded, because it's gone now
 - move the libraries to /%%{_lib}, but leave --libdir alone so that plugins
-  get installed and are searched for in the same locations (#473333)
+  get installed and are searched for in the same locations (rhbz#473333)
 - clean up buildprereq/prereqs, explicit mktemp requires, and add the
-  ldconfig for the -server-ldap subpackage (part of #225974)
-- escape possible macros in the changelog (part of #225974)
-- fixup summary texts (part of #225974)
-- take the execute bit off of the protocol docs (part of #225974)
-- unflag init scripts as configuration files (part of #225974)
-- make the kpropd init script treat 'reload' as 'restart' (part of #225974)
+  ldconfig for the -server-ldap subpackage (part of rhbz#225974)
+- escape possible macros in the changelog (part of rhbz#225974)
+- fixup summary texts (part of rhbz#225974)
+- take the execute bit off of the protocol docs (part of rhbz#225974)
+- unflag init scripts as configuration files (part of rhbz#225974)
+- make the kpropd init script treat 'reload' as 'restart' (part of rhbz#225974)
 
 * Tue Mar 17 2009 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-19
 - libgssapi_krb5: backport fix for some errors which can occur when
@@ -2766,7 +3303,7 @@ exit 0
 * Thu Sep  4 2008 Nalin Dahyabhai <nalin@redhat.com>
 - if we successfully change the user's password during an attempt to get
   initial credentials, but then fail to get initial creds from a non-master
-  using the new password, retry against the master (#432334)
+  using the new password, retry against the master (rhbz#432334)
 
 * Tue Aug  5 2008 Tom "spot" Callaway <tcallawa@redhat.com> 1.6.3-16
 - fix license tag
@@ -2789,7 +3326,7 @@ exit 0
 
 * Wed Apr 16 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-13
 - ftp: use the correct local filename during mget when the 'case' option is
-  enabled (#442713)
+  enabled (rhbz#442713)
 
 * Fri Apr  4 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-12
 - stop exporting kadmin keys to a keytab file when kadmind starts -- the
@@ -2803,17 +3340,17 @@ exit 0
 * Tue Mar 18 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-10
 - add fixes from MITKRB5-SA-2008-001 for use of null or dangling pointer
   when v4 compatibility is enabled on the KDC (CVE-2008-0062, CVE-2008-0063,
-  #432620, #432621)
+  rhbz#432620, rhbz#432621)
 - add fixes from MITKRB5-SA-2008-002 for array out-of-bounds accesses when
-  high-numbered descriptors are used (CVE-2008-0947, #433596)
+  high-numbered descriptors are used (CVE-2008-0947, rhbz#433596)
 - add backport bug fix for an attempt to free non-heap memory in
-  libgssapi_krb5 (CVE-2007-5901, #415321)
+  libgssapi_krb5 (CVE-2007-5901, rhbz#415321)
 - add backport bug fix for a double-free in out-of-memory situations in
-  libgssapi_krb5 (CVE-2007-5971, #415351)
+  libgssapi_krb5 (CVE-2007-5971, rhbz#415351)
 
 * Tue Mar 18 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-9
 - rework file labeling patch to not depend on fragile preprocessor trickery,
-  in another attempt at fixing #428355 and friends
+  in another attempt at fixing rhbz#428355 and friends
 
 * Tue Feb 26 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-8
 - ftp: add patch to fix "runique on" case when globbing fixes applied
@@ -2821,12 +3358,12 @@ exit 0
 
 * Mon Feb 25 2008 Nalin Dahyabhai <nalin@redhat.com>
 - add patch to suppress double-processing of /etc/krb5.conf when we build
-  with --sysconfdir=/etc, thereby suppressing double-logging (#231147)
+  with --sysconfdir=/etc, thereby suppressing double-logging (rhbz#231147)
 
 * Mon Feb 25 2008 Nalin Dahyabhai <nalin@redhat.com>
 - remove a patch, to fix problems with interfaces which are "up" but which
   have no address assigned, which conflicted with a different fix for the same
-  problem in 1.5 (#200979)
+  problem in 1.5 (rhbz#200979)
 
 * Mon Feb 25 2008 Nalin Dahyabhai <nalin@redhat.com>
 - ftp: don't lose track of a descriptor on passive get when the server fails to
@@ -2850,22 +3387,22 @@ exit 0
 
 * Tue Feb 12 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-5
 - enable patch for key-expiration reporting
-- enable patch to make kpasswd fall back to TCP if UDP fails (#251206)
+- enable patch to make kpasswd fall back to TCP if UDP fails (rhbz#251206)
 - enable patch to make kpasswd use the right sequence number on retransmit
 - enable patch to allow mech-specific creds delegated under spnego to be found
   when searching for creds
 
 * Wed Jan  2 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-4
 - some init script cleanups
-  - drop unquoted check and silent exit for "$NETWORKING" (#426852, #242502)
+  - drop unquoted check and silent exit for "$NETWORKING" (rhbz#426852, rhbz#242502)
   - krb524: don't barf on missing database if it looks like we're using kldap,
     same as for kadmin
   - return non-zero status for missing files which cause startup to
-    fail (#242502)
+    fail (rhbz#242502)
 
 * Tue Dec 18 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-3
 - allocate space for the nul-terminator in the local pathname when looking up
-  a file context, and properly free a previous context (Jose Plans, #426085)
+  a file context, and properly free a previous context (Jose Plans, rhbz#426085)
 
 * Wed Dec  5 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-2
 - rebuild
@@ -2881,7 +3418,7 @@ exit 0
 
 * Fri Oct 12 2007 Nalin Dahyabhai <nalin@redhat.com>
 - make krb5.conf %%verify(not md5 size mtime) in addition to
-  %%config(noreplace), like /etc/nsswitch.conf (#329811)
+  %%config(noreplace), like /etc/nsswitch.conf (rhbz#329811)
 
 * Mon Oct  1 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-9
 - apply the fix for CVE-2007-4000 instead of the experimental patch for
@@ -2898,7 +3435,7 @@ exit 0
 
 * Thu Sep  6 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-6
 - incorporate updated fix for CVE-2007-3999 (CVE-2007-4743)
-- fix incorrect call to "test" in the kadmin init script (#252322,#287291)
+- fix incorrect call to "test" in the kadmin init script (rhbz#252322,rhbz#287291)
 
 * Tue Sep  4 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-5
 - incorporate fixes for MITKRB5-SA-2007-006 (CVE-2007-3999, CVE-2007-4000)
@@ -2911,7 +3448,7 @@ exit 0
 - rebuild
 
 * Thu Jul 26 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-2
-- kdc.conf: default to listening for TCP clients, too (#248415)
+- kdc.conf: default to listening for TCP clients, too (rhbz#248415)
 
 * Thu Jul 19 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-1
 - update to 1.6.2
@@ -2937,13 +3474,13 @@ exit 0
 - rebuild
 
 * Sun Jun 24 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.1-3
-- label all files at creation-time according to the SELinux policy (#228157)
+- label all files at creation-time according to the SELinux policy (rhbz#228157)
 
 * Fri Jun 22 2007 Nalin Dahyabhai <nalin@redhat.com>
-- perform PAM account / session management in krshd (#182195,#195922)
+- perform PAM account / session management in krshd (rhbz#182195,rhbz#195922)
 - perform PAM authentication and account / session management in ftpd
 - perform PAM authentication, account / session management, and password-
-  changing in login.krb5 (#182195,#195922)
+  changing in login.krb5 (rhbz#182195,rhbz#195922)
 
 * Fri Jun 22 2007 Nalin Dahyabhai <nalin@redhat.com>
 - preprocess kerberos.ldif into a format FDS will like better, and include
@@ -2953,7 +3490,7 @@ exit 0
 - switch man pages to being generated with the right paths in them
 - drop old, incomplete SELinux patch
 - add patch from Greg Hudson to make srvtab routines report missing-file errors
-  at same point that keytab routines do (#241805)
+  at same point that keytab routines do (rhbz#241805)
 
 * Thu May 24 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.1-2
 - pull patch from svn to undo unintentional chattiness in ftp
@@ -2974,7 +3511,7 @@ exit 0
 * Wed May 16 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6-6
 - omit dependent libraries from the krb5-config --libs output, as using
   shared libraries (no more static libraries) makes them unnecessary and
-  they're not part of the libkrb5 interface (patch by Rex Dieter, #240220)
+  they're not part of the libkrb5 interface (patch by Rex Dieter, rhbz#240220)
   (strips out libkeyutils, libresolv, libdl)
 
 * Fri May  4 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6-5
@@ -2989,17 +3526,17 @@ exit 0
 * Fri Apr 13 2007 Nalin Dahyabhai <nalin@redhat.com>
 - move the default acl_file, dict_file, and admin_keytab settings to
   the part of the default/example kdc.conf where they'll actually have
-  an effect (#236417)
+  an effect (rhbz#236417)
 
 * Thu Apr  5 2007 Nalin Dahyabhai <nalin@redhat.com> 1.5-24
 - merge security fixes from RHSA-2007:0095
 
 * Tue Apr  3 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6-3
 - add patch to correct unauthorized access via krb5-aware telnet
-  daemon (#229782, CVE-2007-0956)
+  daemon (rhbz#229782, CVE-2007-0956)
 - add patch to fix buffer overflow in krb5kdc and kadmind
-  (#231528, CVE-2007-0957)
-- add patch to fix double-free in kadmind (#231537, CVE-2007-1216)
+  (rhbz#231528, CVE-2007-0957)
+- add patch to fix double-free in kadmind (rhbz#231537, CVE-2007-1216)
 
 * Thu Mar 22 2007 Nalin Dahyabhai <nalin@redhat.com>
 - back out buildrequires: keyutils-libs-devel for now
@@ -3015,19 +3552,19 @@ exit 0
 
 * Thu Mar 15 2007 Nalin Dahyabhai <nalin@redhat.com> 1.5-21
 - add preliminary patch to fix buffer overflow in krb5kdc and kadmind
-  (#231528, CVE-2007-0957)
-- add preliminary patch to fix double-free in kadmind (#231537, CVE-2007-1216)
+  (rhbz#231528, CVE-2007-0957)
+- add preliminary patch to fix double-free in kadmind (rhbz#231537, CVE-2007-1216)
 
 * Wed Feb 28 2007 Nalin Dahyabhai <nalin@redhat.com>
 - add patch to build semi-useful static libraries, but don't apply it unless
   we need them
 
 * Tue Feb 27 2007 Nalin Dahyabhai <nalin@redhat.com> - 1.5-20
-- temporarily back out %%post changes, fix for #143289 for security update
+- temporarily back out %%post changes, fix for rhbz#143289 for security update
 - add preliminary patch to correct unauthorized access via krb5-aware telnet
 
 * Mon Feb 19 2007 Nalin Dahyabhai <nalin@redhat.com>
-- make profile.d scriptlets mode 644 instead of 755 (part of #225974)
+- make profile.d scriptlets mode 644 instead of 755 (part of rhbz#225974)
 
 * Tue Jan 30 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6-1
 - clean up quoting of command-line arguments passed to the krsh/krlogin
@@ -3035,22 +3572,22 @@ exit 0
 
 * Mon Jan 22 2007 Nalin Dahyabhai <nalin@redhat.com>
 - initial update to 1.6, pre-package-reorg
-- move workstation daemons to a new subpackage (#81836, #216356, #217301), and
-  make the new subpackage require xinetd (#211885)
+- move workstation daemons to a new subpackage (rhbz#81836, rhbz#216356, rhbz#217301), and
+  make the new subpackage require xinetd (rhbz#211885)
 
 * Mon Jan 22 2007 Nalin Dahyabhai <nalin@redhat.com> - 1.5-18
-- make use of install-info more failsafe (Ville Skyttä, #223704)
+- make use of install-info more failsafe (Ville Skyttä, rhbz#223704)
 - preserve timestamps on shell scriptlets at %%install-time
 
 * Tue Jan 16 2007 Nalin Dahyabhai <nalin@redhat.com> - 1.5-17
-- move to using pregenerated PDF docs to cure multilib conflicts (#222721)
+- move to using pregenerated PDF docs to cure multilib conflicts (rhbz#222721)
 
 * Fri Jan 12 2007 Nalin Dahyabhai <nalin@redhat.com> - 1.5-16
-- update backport of the preauth module interface (part of #194654)
+- update backport of the preauth module interface (part of rhbz#194654)
 
 * Tue Jan  9 2007 Nalin Dahyabhai <nalin@redhat.com> - 1.5-14
-- apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (#218456)
-- apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (#218456)
+- apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (rhbz#218456)
+- apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (rhbz#218456)
 
 * Wed Dec 20 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-12
 - update backport of the preauth module interface
@@ -3068,21 +3605,21 @@ exit 0
   been applicable for a while
 
 * Wed Oct 18 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-10
-- rename krb5.sh and krb5.csh so that they don't overlap (#210623)
-- way-late application of added error info in kadmind.init (#65853)
+- rename krb5.sh and krb5.csh so that they don't overlap (rhbz#210623)
+- way-late application of added error info in kadmind.init (rhbz#65853)
 
 * Wed Oct 18 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-9.pal_18695
-- add backport of in-development preauth module interface (#208643)
+- add backport of in-development preauth module interface (rhbz#208643)
 
 * Mon Oct  9 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-9
-- provide docs in PDF format instead of as tex source (Enrico Scholz, #209943)
+- provide docs in PDF format instead of as tex source (Enrico Scholz, rhbz#209943)
 
 * Wed Oct  4 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-8
-- add missing shebang headers to krsh and krlogin wrapper scripts (#209238)
+- add missing shebang headers to krsh and krlogin wrapper scripts (rhbz#209238)
 
 * Wed Sep  6 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-7
 - set SS_LIB at configure-time so that libss-using apps get working readline
-  support (#197044)
+  support (rhbz#197044)
 
 * Fri Aug 18 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-6
 - switch to the updated patch for MITKRB-SA-2006-001
@@ -3093,7 +3630,7 @@ exit 0
 * Mon Aug  7 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-4
 - ensure that the gssapi library's been initialized before walking the
   internal mechanism list in gss_release_oid(), needed if called from
-  gss_release_name() right after a gss_import_name() (#198092)
+  gss_release_name() right after a gss_import_name() (rhbz#198092)
 
 * Tue Jul 25 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-3
 - rebuild
@@ -3114,7 +3651,7 @@ exit 0
 - update to 1.5
 
 * Fri Jun 23 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-9
-- mark profile.d config files noreplace (Laurent Rineau, #196447)
+- mark profile.d config files noreplace (Laurent Rineau, rhbz#196447)
 
 * Thu Jun  8 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-8
 - add buildprereq for autoconf
@@ -3122,11 +3659,11 @@ exit 0
 * Mon May 22 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-7
 - further munge krb5-config so that 'libdir=/usr/lib' is given even on 64-bit
   architectures, to avoid multilib conflicts; other changes will conspire to
-  strip out the -L flag which uses this, so it should be harmless (#192692)
+  strip out the -L flag which uses this, so it should be harmless (rhbz#192692)
 
 * Fri Apr 28 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-6
 - adjust the patch which removes the use of rpath to also produce a
-  krb5-config which is okay in multilib environments (#190118)
+  krb5-config which is okay in multilib environments (rhbz#190118)
 - make the name-of-the-tempfile comment which compile_et adds to error code
   headers always list the same file to avoid conflicts on multilib installations
 - strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib boxes
@@ -3141,7 +3678,7 @@ exit 0
 
 * Mon Feb  6 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-4
 - give a little bit more information to the user when kinit gets the catch-all
-  I/O error (#180175)
+  I/O error (rhbz#180175)
 
 * Thu Jan 19 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-3
 - rebuild properly when pthread_mutexattr_setrobust_np() is defined but not
@@ -3155,23 +3692,23 @@ exit 0
 
 * Thu Dec  1 2005 Nalin Dahyabhai <nalin@redhat.com>
 - login: don't truncate passwords before passing them into crypt(), in
-  case they're significant (#149476)
+  case they're significant (rhbz#149476)
 
 * Thu Nov 17 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-1
 - update to 1.4.3
-- make ksu setuid again (#137934, others)
+- make ksu setuid again (rhbz#137934, others)
 
 * Tue Sep 13 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-4
 - mark %%{krb5prefix}/man so that files which are packaged within it are
-  flagged as %%doc (#168163)
+  flagged as %%doc (rhbz#168163)
 
 * Tue Sep  6 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-3
 - add an xinetd configuration file for encryption-only telnetd, parallelling
-  the kshell/ekshell pair (#167535)
+  the kshell/ekshell pair (rhbz#167535)
 
 * Wed Aug 31 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-2
 - change the default configured encryption type for KDC databases to the
-  compiled-in default of des3-hmac-sha1 (#57847)
+  compiled-in default of des3-hmac-sha1 (rhbz#57847)
 
 * Thu Aug 11 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-1
 - update to 1.4.2, incorporating the fixes for MIT-KRB5-SA-2005-002 and
@@ -3182,23 +3719,23 @@ exit 0
 
 * Wed Jun 29 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-5
 - fix telnet client environment variable disclosure the same way NetKit's
-  telnet client did (CAN-2005-0488) (#159305)
+  telnet client did (CAN-2005-0488) (rhbz#159305)
 - keep apps which call krb5_principal_compare() or krb5_realm_compare() with
   malformed or NULL principal structures from crashing outright (Thomas Biege)
-  (#161475)
+  (rhbz#161475)
 
 * Tue Jun 28 2005 Nalin Dahyabhai <nalin@redhat.com>
 - apply fixes from draft of MIT-KRB5-SA-2005-002 (CAN-2005-1174,CAN-2005-1175)
-  (#157104)
-- apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (#159755)
+  (rhbz#157104)
+- apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (rhbz#159755)
 
 * Fri Jun 24 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-4
 - fix double-close in keytab handling
-- add port of fixes for CAN-2004-0175 to krb5-aware rcp (#151612)
+- add port of fixes for CAN-2004-0175 to krb5-aware rcp (rhbz#151612)
 
 * Fri May 13 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-3
 - prevent spurious EBADF in krshd when stdin is closed by the client while
-  the command is running (#151111)
+  the command is running (rhbz#151111)
 
 * Fri May 13 2005 Martin Stransky <stransky@redhat.com> 1.4.1-2
 - add deadlock patch, removed old patch
@@ -3257,18 +3794,18 @@ exit 0
 - rebuild
 
 * Mon Nov 22 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-3
-- fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, #140036)
+- fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, rhbz#140036)
 
 * Tue Nov 16 2004 Nalin Dahyabhai <nalin@redhat.com>
 - silence compiler warning in kprop by using an in-memory ccache with a fixed
   name instead of an on-disk ccache with a name generated by tmpnam()
 
 * Tue Nov 16 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-2
-- fix globbing patch port mode (#139075)
+- fix globbing patch port mode (rhbz#139075)
 
 * Mon Nov  1 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-1
 - fix segfault in telnet due to incorrect checking of gethostbyname_r result
-  codes (#129059)
+  codes (rhbz#129059)
 
 * Fri Oct 15 2004 Nalin Dahyabhai <nalin@redhat.com>
 - remove rc4-hmac:norealm and rc4-hmac:onlyrealm from the default list of
@@ -3293,11 +3830,11 @@ exit 0
 
 * Mon Aug 23 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-3
 - incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772
-  (MITKRB5-SA-2004-002, #130732)
-- incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #130732)
+  (MITKRB5-SA-2004-002, rhbz#130732)
+- incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, rhbz#130732)
 
 * Tue Jul 27 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-2
-- fix indexing error in server sorting patch (#127336)
+- fix indexing error in server sorting patch (rhbz#127336)
 
 * Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
 - rebuilt
@@ -3322,7 +3859,7 @@ exit 0
 - rebuild
 
 * Tue Jun  1 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-4
-- apply patch from MITKRB5-SA-2004-001 (#125001)
+- apply patch from MITKRB5-SA-2004-001 (rhbz#125001)
 
 * Wed May 12 2004 Thomas Woerner <twoerner@redhat.com> 1.3.3-3
 - removed rpath
@@ -3352,17 +3889,17 @@ exit 0
 
 * Mon Feb  2 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-9
 - remove patch to set TERM in klogind which, combined with the upstream fix in
-  1.3.1, actually produces the bug now (#114762)
+  1.3.1, actually produces the bug now (rhbz#114762)
 
 * Mon Jan 19 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-8
 - when iterating over lists of interfaces which are "up" from getifaddrs(),
-  skip over those which have no address (#113347)
+  skip over those which have no address (rhbz#113347)
 
 * Mon Jan 12 2004 Nalin Dahyabhai <nalin@redhat.com>
 - prefer the kdc which last replied to a request when sending requests to kdcs
 
 * Mon Nov 24 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-7
-- fix combination of --with-netlib and --enable-dns (#82176)
+- fix combination of --with-netlib and --enable-dns (rhbz#82176)
 
 * Tue Nov 18 2003 Nalin Dahyabhai <nalin@redhat.com>
 - remove libdefault ticket_lifetime option from the default krb5.conf, it is
@@ -3571,12 +4108,12 @@ exit 0
 * Wed Jun 27 2001 Nalin Dahyabhai <nalin@redhat.com>
 - add patch to support "ANY" keytab type (i.e.,
   "default_keytab_name = ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/srvtab"
-  patch from Gerald Britton, #42551)
-- build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (#30697)
+  patch from Gerald Britton, rhbz#42551)
+- build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (rhbz#30697)
 - patch ftpd to use long long and %%lld format specifiers to support the SIZE
-  command on large files (also #30697)
-- don't use LOG_AUTH as an option value when calling openlog() in ksu (#45965)
-- implement reload in krb5kdc and kadmind init scripts (#41911)
+  command on large files (also rhbz#30697)
+- don't use LOG_AUTH as an option value when calling openlog() in ksu (rhbz#45965)
+- implement reload in krb5kdc and kadmind init scripts (rhbz#41911)
 - lose the krb5server init script (not using it any more)
 
 * Sun Jun 24 2001 Elliot Lee <sopwith@redhat.com>
@@ -3589,7 +4126,7 @@ exit 0
 - rebuild in new environment
 
 * Thu Apr 26 2001 Nalin Dahyabhai <nalin@redhat.com>
-- add patch from Tom Yu to fix ftpd overflows (#37731)
+- add patch from Tom Yu to fix ftpd overflows (rhbz#37731)
 
 * Wed Apr 18 2001 Than Ngo <than@redhat.com>
 - disable optimizations on the alpha again
@@ -3613,7 +4150,7 @@ exit 0
 - own %%{_var}/kerberos
 
 * Tue Feb  6 2001 Nalin Dahyabhai <nalin@redhat.com>
-- own the directories which are created for each package (#26342)
+- own the directories which are created for each package (rhbz#26342)
 
 * Tue Jan 23 2001 Nalin Dahyabhai <nalin@redhat.com>
 - gettextize init scripts
@@ -3623,7 +4160,7 @@ exit 0
 - re-enable optimization on alphas
 
 * Mon Jan 15 2001 Nalin Dahyabhai <nalin@redhat.com>
-- fix krb5-send-pr (#18932) and move it from -server to -workstation
+- fix krb5-send-pr (rhbz#18932) and move it from -server to -workstation
 - buildprereq libtermcap-devel
 - temporariliy disable optimization on alphas
 - gettextize init scripts
@@ -3635,29 +4172,29 @@ exit 0
 - rebuild in new environment
 
 * Tue Oct 31 2000 Nalin Dahyabhai <nalin@redhat.com>
-- add bison as a BuildPrereq (#20091)
+- add bison as a BuildPrereq (rhbz#20091)
 
 * Mon Oct 30 2000 Nalin Dahyabhai <nalin@redhat.com>
-- change /usr/dict/words to /usr/share/dict/words in default kdc.conf (#20000)
+- change /usr/dict/words to /usr/share/dict/words in default kdc.conf (rhbz#20000)
 
 * Thu Oct  5 2000 Nalin Dahyabhai <nalin@redhat.com>
 - apply kpasswd bug fixes from David Wragg
 
 * Wed Oct  4 2000 Nalin Dahyabhai <nalin@redhat.com>
-- make krb5-libs obsolete the old krb5-configs package (#18351)
+- make krb5-libs obsolete the old krb5-configs package (rhbz#18351)
 - don't quit from the kpropd init script if there's no principal database so
   that you can propagate the first time without running kpropd manually
 - don't complain if /etc/ld.so.conf doesn't exist in the -libs %%post
 
 * Tue Sep 12 2000 Nalin Dahyabhai <nalin@redhat.com>
 - fix credential forwarding problem in klogind (goof in KRB5CCNAME handling)
-  (#11588)
-- fix heap corruption bug in FTP client (#14301)
+  (rhbz#11588)
+- fix heap corruption bug in FTP client (rhbz#14301)
 
 * Wed Aug 16 2000 Nalin Dahyabhai <nalin@redhat.com>
 - fix summaries and descriptions
 - switched the default transfer protocol from PORT to PASV as proposed on
-  bugzilla (#16134), and to match the regular ftp package's behavior
+  bugzilla (rhbz#16134), and to match the regular ftp package's behavior
 
 * Wed Jul 19 2000 Jeff Johnson <jbj@redhat.com>
 - rebuild to compress man pages.
@@ -3733,7 +4270,7 @@ exit 0
 * Sat Jun  3 2000 Nalin Dahyabhai <nalin@redhat.com>
 - use %%{_infodir} to better comply with FHS
 - move .so files to -devel subpackage
-- tweak xinetd config files (bugs #11833, #11835, #11836, #11840)
+- tweak xinetd config files (bugs rhbz#11833, rhbz#11835, rhbz#11836, rhbz#11840)
 - fix package descriptions again
 
 * Wed May 24 2000 Nalin Dahyabhai <nalin@redhat.com>
@@ -3770,7 +4307,7 @@ exit 0
 - fix configure stuff for ia64
 
 * Mon Apr 10 2000 Nalin Dahyabhai <nalin@redhat.com>
-- add LDCOMBINE=-lc to configure invocation to use libc versioning (bug #10653)
+- add LDCOMBINE=-lc to configure invocation to use libc versioning (rhbz#10653)
 - change Requires: for/in subpackages to include %%{version}
 
 * Wed Apr 05 2000 Nalin Dahyabhai <nalin@redhat.com>
diff --git a/krb5kdc.logrotate b/krb5kdc.logrotate
index 1100ed3..cfc4539 100644
--- a/krb5kdc.logrotate
+++ b/krb5kdc.logrotate
@@ -4,6 +4,6 @@
     monthly
     rotate 12
     postrotate
-	/bin/kill -HUP `cat /var/run/krb5kdc.pid 2>/dev/null` 2> /dev/null || true
+        systemctl reload krb5kdc.service || true
     endscript
 }
diff --git a/krb5kdc.service b/krb5kdc.service
index 806b062..40e23d6 100644
--- a/krb5kdc.service
+++ b/krb5kdc.service
@@ -5,9 +5,9 @@ After=syslog.target network.target network-online.target
 
 [Service]
 Type=forking
-PIDFile=/var/run/krb5kdc.pid
+PIDFile=/run/krb5kdc.pid
 EnvironmentFile=-/etc/sysconfig/krb5kdc
-ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5kdc.pid $KRB5KDC_ARGS
+ExecStart=/usr/sbin/krb5kdc -P /run/krb5kdc.pid $KRB5KDC_ARGS
 ExecReload=/bin/kill -HUP $MAINPID
 
 [Install]
diff --git a/noport.c b/noport.c
deleted file mode 100644
index 22088eb..0000000
--- a/noport.c
+++ /dev/null
@@ -1,111 +0,0 @@
-#define _GNU_SOURCE
-#include <sys/socket.h>
-#include <dlfcn.h>
-#include <errno.h>
-#include <stdlib.h>
-#include <string.h>
-#include <netinet/in.h>
-
-static int
-port_is_okay(unsigned short port)
-{
-	char *p, *q;
-	long l;
-
-	p = getenv("NOPORT");
-	while ((p != NULL) && (*p != '\0')) {
-		l = strtol(p, &q, 10);
-		if ((q == NULL) || (q == p)) {
-			break;
-		}
-		if ((*q == '\0') || (*q == ',')) {
-			if (port == l) {
-				errno = ECONNREFUSED;
-				return -1;
-			}
-		}
-		p = q;
-		p += strspn(p, ",");
-	}
-	return 0;
-}
-
-int
-connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
-{
-	unsigned short port;
-	static int (*next_connect)(int, const struct sockaddr *, socklen_t);
-
-	if (next_connect == NULL) {
-		next_connect = dlsym(RTLD_NEXT, "connect");
-		if (next_connect == NULL) {
-			errno = ENOSYS;
-			return -1;
-		}
-	}
-
-	if (getenv("NOPORT") == NULL) {
-		return next_connect(sockfd, addr, addrlen);
-	}
-
-	switch (addr->sa_family) {
-	case AF_INET:
-		port = ntohs(((struct sockaddr_in *)addr)->sin_port);
-		if (port_is_okay(port) != 0) {
-			return -1;
-		}
-		break;
-	case AF_INET6:
-		port = ntohs(((struct sockaddr_in6 *)addr)->sin6_port);
-		if (port_is_okay(port) != 0) {
-			return -1;
-		}
-		break;
-	default:
-		break;
-	}
-	return next_connect(sockfd, addr, addrlen);
-}
-
-ssize_t
-sendto(int sockfd, const void *buf, size_t len, int flags,
-       const struct sockaddr *dest_addr, socklen_t addrlen)
-{
-	unsigned short port;
-	static int (*next_sendto)(int, const void *, size_t, int,
-				  const struct sockaddr *, socklen_t);
-
-	if (next_sendto == NULL) {
-		next_sendto = dlsym(RTLD_NEXT, "sendto");
-		if (next_sendto == NULL) {
-			errno = ENOSYS;
-			return -1;
-		}
-	}
-
-	if (getenv("NOPORT") == NULL) {
-		return next_sendto(sockfd, buf, len, flags, dest_addr, addrlen);
-	}
-
-	if (dest_addr != NULL) {
-		switch (dest_addr->sa_family) {
-		case AF_INET:
-			port = ((struct sockaddr_in *)dest_addr)->sin_port;
-			port = ntohs(port);
-			if (port_is_okay(port) != 0) {
-				return -1;
-			}
-			break;
-		case AF_INET6:
-			port = ((struct sockaddr_in6 *)dest_addr)->sin6_port;
-			port = ntohs(port);
-			if (port_is_okay(port) != 0) {
-				return -1;
-			}
-			break;
-		default:
-			break;
-		}
-	}
-	return next_sendto(sockfd, buf, len, flags, dest_addr, addrlen);
-}
diff --git a/plans/tests.fmf b/plans/tests.fmf
new file mode 100644
index 0000000..970ae2e
--- /dev/null
+++ b/plans/tests.fmf
@@ -0,0 +1,5 @@
+summary: Tests
+discover:
+  how: fmf
+execute:
+  how: tmt
diff --git a/rpminspect.yaml b/rpminspect.yaml
new file mode 100644
index 0000000..a31a5e3
--- /dev/null
+++ b/rpminspect.yaml
@@ -0,0 +1,17 @@
+---
+inspections:
+  # https://bugzilla.redhat.com/show_bug.cgi?id=1956479
+  badfuncs: off
+
+  # Not a Java package
+  javabytecode: off
+
+  # I need to be able to *add* functions, and also we export internal
+  # functions that are not considered part of our ABI.
+  abidiff: off
+  
+  # These just flag when things change "too much"
+  changedfiles: off
+  filesize: off
+  patches: off
+  upstream: off
diff --git a/sources b/sources
index 3517dec..e8b99ef 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,2 @@
-SHA512 (krb5-1.17-pdfs.tar) = 89a5a709720ee9028e9bfbcbc808eec436c4b9c6e105888b37660e97cff48e190bc77affa9809353de9cf2f39e517e8a6ab22792263978b403a4a6317ac24a46
-SHA512 (krb5-1.17.tar.gz) = 7462a578b936bd17f155a362dbb5d388e157a80a096549028be6c55400b11361c7f8a28e424fd5674801873651df4e694d536cae66728b7ae5e840e532358c52
-SHA512 (krb5-1.17.tar.gz.asc) = 7ee81ccd05559ca1ff945619165297db251010db7c0205855f89ae66a73bc78e98f5e28ea154dcb752f5d4afb9349a293dcf8f64858d2129a869295fa8946e0f
+SHA512 (krb5-1.21.3.tar.gz) = 87bc06607f4d95ff604169cea22180703a42d667af05f66f1569b8bd592670c42820b335e5c279e8b4f066d1e7da20f1948a1e4def7c5d295c170cbfc7f49c71
+SHA512 (krb5-1.21.3.tar.gz.asc) = 8992a5f5247315b9846aa73be4ee1ea223c0231a52d5c6c28718b1f3e3b45d62e2dad4aa5543a83163d1369bb79886b6c1c22766f22d8aa2f6b2575c54d0075c
diff --git a/tests/got-audit/got-audit.gdb b/tests/got-audit/got-audit.gdb
new file mode 100644
index 0000000..6661297
--- /dev/null
+++ b/tests/got-audit/got-audit.gdb
@@ -0,0 +1,2 @@
+gef config gef.disable_color True
+got-audit --all
diff --git a/tests/got-audit/kdc.conf b/tests/got-audit/kdc.conf
new file mode 100644
index 0000000..ed7299f
--- /dev/null
+++ b/tests/got-audit/kdc.conf
@@ -0,0 +1,12 @@
+[kdcdefaults]
+    kdc_ports = 88
+    kdc_tcp_ports = 88
+
+[realms]
+    ${krb5REALM1} = {
+        #master_key_type = aes256-cts
+        acl_file = /var/kerberos/krb5kdc/kadm5.acl
+        dict_file = /usr/share/dict/words
+        admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
+        supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
+    }
diff --git a/tests/got-audit/krb5.conf b/tests/got-audit/krb5.conf
new file mode 100644
index 0000000..6979cb7
--- /dev/null
+++ b/tests/got-audit/krb5.conf
@@ -0,0 +1,29 @@
+# To opt out of the system crypto-policies configuration of krb5, remove the
+# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
+includedir /etc/krb5.conf.d/
+
+[logging]
+    default = FILE:/var/log/krb5libs.log
+    kdc = FILE:/var/log/krb5kdc.log
+    admin_server = FILE:/var/log/kadmind.log
+
+[libdefaults]
+    default_realm = ${krb5REALM1}
+    dns_lookup_realm = false
+    ticket_lifetime = 24h
+    renew_lifetime = 7d
+    forwardable = true
+    rdns = false
+    default_ccache_name = KEYRING:persistent:%{uid}
+
+[realms]
+    ${krb5REALM1} = {
+        kdc = localhost.localdomain
+        admin_server = localhost.localdomain
+    }
+
+[domain_realm]
+    ${krb5HostName} = ${krb5REALM1}
+
+[capaths]
+    ${krb5REALM1} = .
diff --git a/tests/got-audit/main.fmf b/tests/got-audit/main.fmf
new file mode 100644
index 0000000..f2c1f97
--- /dev/null
+++ b/tests/got-audit/main.fmf
@@ -0,0 +1,12 @@
+summary: Audit the GOT for signs of tampering
+description: |
+  Pointers in the server process GOT will be checked to ensure that
+  each function pointer's value is within a shared object file
+  that exports a symbol of that name, and that no shared object
+  files export conflicting symbols.
+contact: Gordon Messmer <gordon.messmer@gmail.com>
+require+:
+  - gdb-gef           # needed to test got-audit
+  - krb5-server
+test: ./runtest.sh
+framework: beakerlib
diff --git a/tests/got-audit/runtest.sh b/tests/got-audit/runtest.sh
new file mode 100755
index 0000000..925a04e
--- /dev/null
+++ b/tests/got-audit/runtest.sh
@@ -0,0 +1,121 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/openssh/Sanity/got-audit
+#   Description: Check pointers in the server process GOT for signs of tampering
+#   Author: Gordon Messmer <gordon.messmer@gmail.com>
+#
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+krb5REALM1='TEST1.REDHAT.COM'
+krb5HostName=`hostname`
+krb5DomainName=`hostname -d`
+krb5User='alice'
+krb5UserPass='alice'
+krb5UserKrbPass='aaa'
+krb5User2='bob'
+krb5User3='carl'
+krb5KDCPass='qwe'
+krb5RootPass='rrr'
+
+krb5conf="/etc/krb5.conf"
+krb5confdir="/etc/krb5.conf.d"
+krb5kdcconf="/var/kerberos/krb5kdc/kdc.conf"
+krb5kadmacl="/var/kerberos/krb5kdc/kadm5.acl"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlServiceStart sshd
+        rlRun "TestDir=\$(pwd)"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})"
+    rlPhaseEnd
+
+    rlPhaseStartSetup "KDC and kadmind setup"
+        # Stop and backup
+        rlRun "rlServiceStop kadmin krb5kdc"
+        rlRun "rm -f /var/kerberos/krb5kdc/principal* /var/kerberos/krb5kdc/.k5*"
+        rlFileBackup $krb5conf /var/kerberos/krb5kdc /etc/sysconfig/{kadmin,krb5kdc} /etc/hosts
+        rlFileBackup --clean /root/.k5login
+        [ -e /etc/krb5.keytab ] && rlFileBackup /etc/krb5.keytab
+        [ -e $krb5confdir ] && rlFileBackup $krb5confdir
+        # Basic setup of KDC and krb5.conf
+        rlRun "sed -i \"s/\[libdefaults\]/[libdefaults]\n default_realm = $krb5REALM1/\" $krb5conf"
+        rlRun "sed -i \"s/\[realms\]/[realms]\n $krb5REALM1 = {\n  kdc = $krb5HostName\n  admin_server = $krb5HostName\n }/\" $krb5conf"
+        if [ "$krb5DomainName" ]; then
+            rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n .$krb5DomainName = $krb5REALM1\n $krb5DomainName = $krb5REALM1/\" $krb5conf"
+        else
+            rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n $krb5HostName = $krb5REALM1/\" $krb5conf"
+        fi
+        rlRun "sed -i s/EXAMPLE.COM/$krb5REALM1/ $krb5kdcconf"
+        # Configure the kadmin ACL
+        rlRun "echo \"*/master@$krb5REALM1  *\" > $krb5kadmacl"
+        if rlIsFedora '>=31';then
+            rlLog "Modify supported_enctypes for Fedora >=31. Remove *DES ciphers."
+            rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
+        elif rlIsRHEL '8' && [ `rpm -q --qf '%{VERSION}' krb5-server | cut -d"." -f2` -lt 18 ];then
+            rlLog "Modify supported_enctypes for RHEL-8."
+            rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
+        else
+            #RHEL-8 Bug 1802334 - [Rebase] krb5: rebase to 1.18:
+            #- Removal of *DES encryption types
+            #https://bugzilla.redhat.com/show_bug.cgi?id=1802334
+            rlLog "Modify supported_enctypes for RHEL-8 with krb-1.18. Remove *DES ciphers."
+            rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
+        fi
+        # Create the realm databases
+        rlRun "rngd -r /dev/urandom"
+        rlRun "kdb5_util create -s -r $krb5REALM1 -P $krb5KDCPass"
+        rlRun "rlServiceStart kadmin krb5kdc"
+        rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -pw $krb5RootPass root/master\""
+        rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -pw $krb5UserKrbPass $krb5User\""
+        rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -randkey host/$krb5HostName\""
+        rlRun "kadmin.local -r $krb5REALM1 -q \"ktadd host/$krb5HostName\""
+        # Create test system user 
+        [ $krb5User != "root" ] && rlRun "useradd $krb5User"
+        rlRun "echo $krb5UserPass | passwd --stdin $krb5User"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Run GEF got-audit"
+        rlRun "systemctl restart krb5kdc.service"
+        rlRun "systemctl restart kadmin.service"
+        rlRun "systemctl --no-pager status krb5kdc.service"
+        rlRun "systemctl --no-pager status kadmin.service"
+
+        rlRun "SERVICE_PID=\$( systemctl show --property=MainPID krb5kdc.service | cut -f2 -d= )"
+        rlRun "echo SERVICE_PID is '$SERVICE_PID'"
+        [ -n "$SERVICE_PID" ] || rlFail "No service pid was found"
+        rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'"
+        # Basic test: ensure that at least one symbol is found in libc.so,
+        #  to verify that the report looks plausible.
+        rlAssertGrep " : /.*/libc.so" "$auditfile"
+        # Ensure the got-audit did not report any errors
+        rlAssertNotGrep " :: ERROR" "$auditfile"
+        rlRun "cp '$auditfile' '$TMT_TEST_DATA'/krb5kdc-got-audit.txt"
+
+        rlRun "SERVICE_PID=\$( systemctl show --property=MainPID kadmin.service | cut -f2 -d= )"
+        rlRun "echo SERVICE_PID is '$SERVICE_PID'"
+        [ -n "$SERVICE_PID" ] || rlFail "No service pid was found"
+        rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'"
+        # Basic test: ensure that at least one symbol is found in libc.so,
+        #  to verify that the report looks plausible.
+        rlAssertGrep " : /.*/libc.so" "$auditfile"
+        # Ensure the got-audit did not report any errors
+        rlAssertNotGrep " :: ERROR" "$auditfile"
+        rlRun "cp '$auditfile' '$TMT_TEST_DATA'/kadmin-got-audit.txt"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -rf /var/kerberos/krb5kdc/* /var/kerberos/krb5kdc/.k5* /etc/krb5* /etc/sysconfig/{kadmin,krb5kdc}"
+        rlFileRestore
+        rlServiceRestore krb5kdc kadmin
+        [ $krb5User != "root" ] && rlRun "userdel -r -f $krb5User"
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/tests/inplace-upgrade-sanity-test/Makefile b/tests/inplace-upgrade-sanity/Makefile
similarity index 97%
rename from tests/inplace-upgrade-sanity-test/Makefile
rename to tests/inplace-upgrade-sanity/Makefile
index ccd8818..cfff69d 100644
--- a/tests/inplace-upgrade-sanity-test/Makefile
+++ b/tests/inplace-upgrade-sanity/Makefile
@@ -55,6 +55,7 @@ $(METADATA): Makefile
 	@echo "TestTime:        20m" >> $(METADATA)
 	@echo "RunFor:          krb5" >> $(METADATA)
 	@echo "Requires:        expect krb5-server krb5-workstation openssh-clients openssh-server rng-tools" >> $(METADATA)
+    @echo "Requires:        setools-console" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
diff --git a/tests/inplace-upgrade-sanity-test/PURPOSE b/tests/inplace-upgrade-sanity/PURPOSE
similarity index 100%
rename from tests/inplace-upgrade-sanity-test/PURPOSE
rename to tests/inplace-upgrade-sanity/PURPOSE
diff --git a/tests/inplace-upgrade-sanity/TC#0378369.fmf b/tests/inplace-upgrade-sanity/TC#0378369.fmf
new file mode 100644
index 0000000..8d54d68
--- /dev/null
+++ b/tests/inplace-upgrade-sanity/TC#0378369.fmf
@@ -0,0 +1,21 @@
+tag:
+  - CI-Tier-1
+  - CI-Tier-1-krb5
+  - Fedora 31
+  - Fedora 32
+  - FedoraReady
+  - IDM-CI-gating
+  - NoRHEL4
+  - NoRHEL5
+  - TIPpass
+  - TIPpass_Security
+  - Tier1
+  - Tier1security
+  - rhel_upgrade
+tier: '1'
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5
+    continue: false
+extra-nitrate: TC#0378369
+extra-summary: /CoreOS/krb5/Sanity/inplace-upgrade-sanity-test
diff --git a/tests/inplace-upgrade-sanity/TC#0552039.fmf b/tests/inplace-upgrade-sanity/TC#0552039.fmf
new file mode 100644
index 0000000..7f2731d
--- /dev/null
+++ b/tests/inplace-upgrade-sanity/TC#0552039.fmf
@@ -0,0 +1,17 @@
+link:
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1394908
+tag:
+  - NoRHEL4
+  - NoRHEL5
+  - TIPpass
+  - TIPpass_Security
+  - Tier2
+tier: '2'
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6
+    continue: false
+environment:
+    TEST_ENTROPY_SOURCE: yes
+extra-nitrate: TC#0552039
+extra-summary: 'BZ#1394908: Enable faster getrandom-based entropy system'
diff --git a/tests/inplace-upgrade-sanity/TC#0608992.fmf b/tests/inplace-upgrade-sanity/TC#0608992.fmf
new file mode 100644
index 0000000..440308f
--- /dev/null
+++ b/tests/inplace-upgrade-sanity/TC#0608992.fmf
@@ -0,0 +1,14 @@
+tag:
+  - Fedora 31
+  - Fedora 32
+  - FedoraReady
+  - NoRHEL4
+  - NoRHEL5
+  - rhel_upgrade
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5
+    continue: false
+manual: true
+extra-nitrate: TC#0608992
+extra-summary: /CoreOS/krb5/Sanity/inplace-upgrade-sanity-test-manual
diff --git a/tests/inplace-upgrade-sanity-test/kdc.conf b/tests/inplace-upgrade-sanity/kdc.conf
similarity index 100%
rename from tests/inplace-upgrade-sanity-test/kdc.conf
rename to tests/inplace-upgrade-sanity/kdc.conf
diff --git a/tests/inplace-upgrade-sanity-test/krb5.conf b/tests/inplace-upgrade-sanity/krb5.conf
similarity index 100%
rename from tests/inplace-upgrade-sanity-test/krb5.conf
rename to tests/inplace-upgrade-sanity/krb5.conf
diff --git a/tests/inplace-upgrade-sanity/main.fmf b/tests/inplace-upgrade-sanity/main.fmf
new file mode 100644
index 0000000..40e0a0e
--- /dev/null
+++ b/tests/inplace-upgrade-sanity/main.fmf
@@ -0,0 +1,19 @@
+summary: Verifies basic scenarios which should work after inplace upgrade.
+enabled: true
+contact: Filip Dvorak <fdvorak@redhat.com>
+component:
+- krb5
+test: ./runtest.sh
+path: /tests/inplace-upgrade-sanity
+framework: beakerlib
+require:
+- expect
+- krb5-server
+- krb5-workstation
+- openssh-clients
+- openssh-server
+- rng-tools
+- setools-console
+duration: 20m
+extra-summary: /CoreOS/krb5/Sanity/inplace-upgrade-sanity-test
+extra-task: /CoreOS/krb5/Sanity/inplace-upgrade-sanity-test
diff --git a/tests/inplace-upgrade-sanity-test/runtest.sh b/tests/inplace-upgrade-sanity/runtest.sh
similarity index 67%
rename from tests/inplace-upgrade-sanity-test/runtest.sh
rename to tests/inplace-upgrade-sanity/runtest.sh
index cdd4744..c6e3d45 100755
--- a/tests/inplace-upgrade-sanity-test/runtest.sh
+++ b/tests/inplace-upgrade-sanity/runtest.sh
@@ -27,7 +27,6 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 # Include Beaker environment
-. /usr/bin/rhts-environment.sh
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
 PACKAGE="krb5"
@@ -36,15 +35,10 @@ PACKAGES="krb5-libs krb5-server krb5-workstation openssh"
 TEST_ENTROPY_SOURCE=${TEST_ENTROPY_SOURCE:-no}
 echo TEST_ENTROPY_SOURCE=$TEST_ENTROPY_SOURCE
 
-hostnamectl set-hostname test.fedora.com
-
-host_ip=`hostname -I | awk '{print$1}'`
-echo "$host_ip test.fedora.com" >> /etc/hosts
-
-krb5REALM1='ZMRAZ.COM'
-krb5REALM2='PKIS.NET'
+krb5REALM1='TEST1.REDHAT.COM'
+krb5REALM2='TEST2.REDHAT.COM'
 krb5HostName=`hostname`
-krb5DomainName='fedora.com'
+krb5DomainName=`hostname -d`
 krb5User='alice'
 krb5UserPass='alice'
 krb5UserKrbPass='aaa'
@@ -58,6 +52,8 @@ krb5confdir="/etc/krb5.conf.d"
 krb5kdcconf="/var/kerberos/krb5kdc/kdc.conf"
 krb5kadmacl="/var/kerberos/krb5kdc/kadm5.acl"
 
+
+
 rlJournalStart
     rlPhaseStartSetup
         for pkg in $PACKAGES; do
@@ -65,6 +61,8 @@ rlJournalStart
         done
         rlRun "TmpDir=\$(mktemp -d)"
         rlRun "pushd $TmpDir"
+        echo "-----/etc/krb5.conf----"; cat /etc/krb5.conf
+        echo "-----/var/kerberos/krb5kdc/kdc.conf-----"; cat /var/kerberos/krb5kdc/kdc.conf
     rlPhaseEnd
 
     # Run this part on OLD and in "normal" mode
@@ -73,18 +71,34 @@ rlJournalStart
         # Stop and backup
         rlRun "rlServiceStop kadmin krb5kdc"
         rlRun "rm -f /var/kerberos/krb5kdc/principal* /var/kerberos/krb5kdc/.k5*"
-        rlFileBackup $krb5conf /var/kerberos/krb5kdc /etc/sysconfig/{kadmin,krb5kdc}
+        rlFileBackup $krb5conf /var/kerberos/krb5kdc /etc/sysconfig/{kadmin,krb5kdc} /etc/hosts
+        rlFileBackup --clean /root/.k5login
         [ -e /etc/krb5.keytab ] && rlFileBackup /etc/krb5.keytab
         [ -e $krb5confdir ] && rlFileBackup $krb5confdir
+        # Make sure IPv4 is used for ssh connection
+        if ! grep `hostname` /etc/hosts; then
+            DEF_DEV=`ip route |grep default |awk '{print $5}'`
+            echo DEF_DEV=$DEF_DEV
+            DEF_IP=`ip -o -4 addr show dev $DEF_DEV |awk '{print $4}' |grep -v '/32' |sed 's|/.*||'`
+            echo DEF_IP=$DEF_IP
+            rlRun "echo '$DEF_IP `hostname`' >>/etc/hosts"
+            grep `hostname` /etc/hosts
+        fi
         # Basic setup of KDC and krb5.conf
         if rlIsRHEL 6; then
             rlRun "sed -i \"s/EXAMPLE.COM/$krb5REALM1/\" $krb5conf"
             rlRun "sed -i \"s/kerberos.example.com/$krb5HostName/\" $krb5conf"
-            rlRun "sed -i \"s/example.com/$krb5DomainName/\" $krb5conf"
+            if [ "$krb5DomainName" ]; then
+                rlRun "sed -i \"s/example.com/$krb5DomainName/\" $krb5conf"
+            fi
         else
             rlRun "sed -i \"s/\[libdefaults\]/[libdefaults]\n default_realm = $krb5REALM1/\" $krb5conf"
             rlRun "sed -i \"s/\[realms\]/[realms]\n $krb5REALM1 = {\n  kdc = $krb5HostName\n  admin_server = $krb5HostName\n }/\" $krb5conf"
-            rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n .$krb5DomainName = $krb5REALM1\n $krb5DomainName = $krb5REALM1/\" $krb5conf"
+            if [ "$krb5DomainName" ]; then
+                rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n .$krb5DomainName = $krb5REALM1\n $krb5DomainName = $krb5REALM1/\" $krb5conf"
+            else
+                rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n $krb5HostName = $krb5REALM1/\" $krb5conf"
+            fi
         fi
         rlRun "sed -i s/EXAMPLE.COM/$krb5REALM1/ $krb5kdcconf"
         # Configure the kadmin ACL
@@ -99,28 +113,59 @@ rlJournalStart
   dict_file = /usr/share/dict/words
   admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
   supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
- }
+}
 _EOF
-        rlIsRHEL 6 || rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal/\" /var/kerberos/krb5kdc/kdc.conf"
+        
+
+if rlIsRHEL '7'; then
+    rlLog "Modify supported_enctypes for RHEL-7."
+    rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal/\" /var/kerberos/krb5kdc/kdc.conf"
+    # Remove 3DES and DES cipher suite from kdc.conf - Fedora 31
+    # Fedora 31 - krb5 will be removing support for DES, 3DES, and crc-32 entirely
+    # they will not be allowed in session keys or long-term keys. (BZ#1670398)
+    # https://fedoraproject.org/wiki/Changes/krb5_crypto_modernization
+elif rlIsFedora '>=31';then
+    rlLog "Modify supported_enctypes for Fedora >=31. Remove *DES ciphers."
+    rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
+elif rlIsRHEL '8' && [ `rpm -q --qf '%{VERSION}' krb5-server | cut -d"." -f2` -lt 18 ];then
+    rlLog "Modify supported_enctypes for RHEL-8."
+    rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
+else
+    #RHEL-8 Bug 1802334 - [Rebase] krb5: rebase to 1.18:
+    #- Removal of *DES encryption types
+    #https://bugzilla.redhat.com/show_bug.cgi?id=1802334
+    rlLog "Modify supported_enctypes for RHEL-8 with krb-1.18. Remove *DES ciphers."
+    rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf"
+fi
         rlRun "sed -i \"s/\[realms\]/[realms]\n $krb5REALM2 = {\n  kdc = $krb5HostName\n  admin_server = $krb5HostName\n }/\" $krb5conf"
-        cat >> $krb5conf << _EOF
+    cat >> $krb5conf << _EOF
 
 [capaths]
  $krb5REALM1 = {
   $krb5REALM2 = .
  }
 _EOF
-        # Test the entropy source (not relevant for RHEL6)
+        # BZ#1394908: Test the entropy source (not relevant for RHEL6)
         if ! rlIsRHEL 6 && [[ $TEST_ENTROPY_SOURCE == 'yes' ]]; then
-            rlLog "The source of entropy will be tested as well"
+            rlLog "BZ#1394908: The source of entropy will be tested as well"
+            # Check number of audit rules
+            number_rules=$(auditctl -l | grep -v "No rules" | wc -l)
+            if [[ ${number_rules} -ne 0 ]];then
+                truncate -s0 /var/log/audit/audit.log
+                rlRun "auditctl -D" 0 "Delete previous audit rules"
+            fi
             START_DATE=`date +%H:%M:%S`
             echo START_DATE=$START_DATE
             sleep 1
             rlRun "auditctl -w /dev/random -p rwxa -k RAND"
             auditctl -l
-            sleep 1
+            sleep 5
             rlRun "ausearch -i -k RAND -ts $START_DATE"
         fi
+        
+        echo "-----/etc/krb5.conf----"; cat /etc/krb5.conf
+        echo "-----/var/kerberos/krb5kdc/kdc.conf-----"; cat /var/kerberos/krb5kdc/kdc.conf
+
         # Create the realm databases
         rlRun "rngd -r /dev/urandom"
         rlRun "kdb5_util create -s -r $krb5REALM1 -P $krb5KDCPass"
@@ -145,12 +190,12 @@ _EOF
         rlRun "kadmin.local -r $krb5REALM2 -q \"addprinc -randkey host/$krb5HostName\""
         rlRun "kadmin.local -r $krb5REALM2 -q \"addprinc -pw $krb5KDCPass krbtgt/$krb5REALM1@$krb5REALM2\""
         rlRun "kadmin.local -r $krb5REALM2 -q \"addprinc -pw $krb5KDCPass krbtgt/$krb5REALM2@$krb5REALM1\""
-        # Create test system user
+        # Create test system user 
         [ $krb5User != "root" ] && rlRun "useradd $krb5User"
         rlRun "echo $krb5UserPass | passwd --stdin $krb5User"
     rlPhaseEnd
     fi
-
+    
     rlPhaseStartTest "Daemon start and log file test"
         # Make sure there is enough entropy and start recording of the logs
         rlRun "rngd -r /dev/urandom"
@@ -190,6 +235,10 @@ _EOF
             echo "/var/log/kadmind.log:"
             tail -n 100 /var/log/kadmind.log
         fi
+
+        #add 'list' privilege for root/master 
+        sed -i -e '$a*/master@EXAMPLE.COM    *' /var/kerberos/krb5kdc/kadm5.acl
+
         # Restart daemon auto start
         if rlIsRHEL 6; then
             rlRun "service krb5kdc restart"
@@ -204,11 +253,21 @@ _EOF
         fi
         rlRun "echo $krb5UserKrbPass |kinit $krb5User && klist"
         rlRun "kdestroy"
-        rlRun "kadmin -p root/master -w rrr -q ''"
+        rlRun "kadmin -p root/master -w rrr -q 'getprincs'"
         rlAssertGrep "AS_REQ.*$krb5User@$krb5REALM1.*krbtgt/$krb5REALM1@$krb5REALM1" krb5kdc.log.record
-        cat krb5kdc.log.record
-        rlAssertGrep "Request: kadm5_init.*root/master@$krb5REALM1.*service=kadmin/`hostname`@$krb5REALM1" kadmind.log.record
-        cat kadmind.log.record
+
+#The principal related to kadmin are not created with hostname (kadmin/hostname@REALM) during creating krb5 DB
+#RHEL9 constains only kadmin/admin@REALM - this change was intentional - Don't create hostbased principals in new KDBs
+#https://krbdev.mit.edu/rt/Ticket/Display.html?id=8935
+        if rlIsRHEL 9 || rlIsFedora '>=33';then
+           kadmin_princ="Request: kadm5_init.*root/master@$krb5REALM1.*service=kadmin/admin@$krb5REALM1"
+        else
+           kadmin_princ="Request: kadm5_init.*root/master@$krb5REALM1.*service=kadmin/.*`hostname`@$krb5REALM1"
+        fi
+        rlAssertGrep "${kadmin_princ}" kadmind.log.record
+        #rlAssertGrep "Request: kadm5_init.*root\/master@$krb5REALM1.*service=kadmin\/(admin|.*`hostname`)@$krb5REALM1" kadmind.log.record -E
+        echo "***krb5kdc.log.record***" && cat krb5kdc.log.record
+        echo "***kadmind.log.record***" && cat kadmind.log.record
         # Stop log recording
         kill $KADMIND_LOG_PID
         kill $KRB5KDC_LOG_PID
@@ -238,6 +297,13 @@ _EOF
         cat klist.log
         rlAssertGrep "host/`hostname`@$krb5REALM1" klist.log
         rlRun "kdestroy"
+        #BZ1841488-sshd cannot write into reply cache (/var/tmp/krb5_0.rcache2) due to security context
+        #The problem is that this file had security context: system_u:object_r:kadmind_tmp_t:s0. 
+        #This is a problem when the ssh via krb5-GSSAPI is used because sshd service cannot write into this file.
+        if rlIsRHEL '>=8.3' || rlIsFedora '>=32'; then
+            rlLog "BZ1841488-sshd cannot write into reply cache (/var/tmp/krb5_0.rcache2) due to security context"
+            rlRun "sesearch -s sshd_t -t kadmind_tmp_t -c file -p write --allow | grep ^allow"
+        fi
     rlPhaseEnd
 
     rlPhaseStartTest "Basic kadmin and kpasswd test"
@@ -279,13 +345,14 @@ _EOF
         rlRun "kdestroy"
     rlPhaseEnd
 
-    # Test the entropy source (not relevant for RHEL6)
+    # BZ#1394908: Test the entropy source (not relevant for RHEL6)
     if ! rlIsRHEL 6 && [[ $TEST_ENTROPY_SOURCE == 'yes' ]]; then
-        rlPhaseStartTest "Enable faster getrandom-based entropy system"
+        rlPhaseStartTest "BZ#1394908: Enable faster getrandom-based entropy system"
             echo START_DATE=$START_DATE
             auditctl -l
+            sleep 5 
             rlRun "ausearch -i -k RAND -ts $START_DATE"
-            rlRun "ausearch -i -k RAND -ts $START_DATE |grep comm= |grep -v 'comm=rngd'" 1
+            rlRun "ausearch -i -k RAND -ts $START_DATE |grep comm= | grep -v comm=auditctl |grep -v 'comm=rngd'" 1
             rlRun "auditctl -D"
         rlPhaseEnd
     fi
@@ -299,8 +366,9 @@ _EOF
         [ $krb5User != "root" ] && rlRun "userdel -r -f $krb5User"
     rlPhaseEnd
     fi
-
+    
     rlPhaseStartCleanup
+        rlRun "kdestroy -A"
         rlRun "popd"
         rlRun "rm -r $TmpDir"
     rlPhaseEnd
diff --git a/tests/tests.yml b/tests/tests.yml
deleted file mode 100644
index 6ebc417..0000000
--- a/tests/tests.yml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-# This first play always runs on the local staging system
-- hosts: localhost
-  roles:
-  - role: standard-test-beakerlib
-    tags:
-    - classic
-    tests:
-    - inplace-upgrade-sanity-test
-    required_packages:
-    - expect            # Required for inplace-upgrade-sanity-test
-    - krb5-server       # Required for inplace-upgrade-sanity-test
-    - krb5-workstation  # Required for inplace-upgrade-sanity-test
-    - openssh-clients   # Required for inplace-upgrade-sanity-test
-    - openssh-server    # Required for inplace-upgrade-sanity-test
-    - rng-tools         # Required for inplace-upgrade-sanity-test
diff --git a/tests/upstream/main.fmf b/tests/upstream/main.fmf
new file mode 100644
index 0000000..66718fa
--- /dev/null
+++ b/tests/upstream/main.fmf
@@ -0,0 +1,7 @@
+summary: Run upstream tests
+test: ./test.sh
+enabled: true
+path: /tests/upstream
+require:
+- krb5-tests
+duration: 20m
diff --git a/tests/upstream/test.sh b/tests/upstream/test.sh
new file mode 100755
index 0000000..fd4aeeb
--- /dev/null
+++ b/tests/upstream/test.sh
@@ -0,0 +1,7 @@
+#!/bin/sh -eux
+rc=0
+for test_exec in /usr/libexec/krb5-tests-*
+do
+    "$test_exec" || rc=1
+done
+exit $rc